@sublay/js 7.7.0 → 7.8.0

package/dist/interfaces/Push.d.ts

@@ -18,3 +18,57 @@ export type MuteDuration = (typeof MUTE_DURATIONS)[number];
 export interface NotificationPreferences {
     disabledTypes: PushEventType[];
 }
+/**
+ * A Web Push subscription in its SERIALIZED form — the JSON the server reads,
+ * not the live browser object.
+ *
+ * A `PushSubscription` straight from `PushManager.subscribe()` does NOT satisfy
+ * this type. It exposes its keys only through `getKey(name)`; there is no `keys`
+ * property to read, so it is not assignable here under strict TypeScript, and
+ * passing one through a cast sends a body the server rejects.
+ *
+ * To produce a value of this type:
+ *
+ * 1. **Serialize** the subscription with `subscription.toJSON()`.
+ * 2. **Confirm** `endpoint`, `keys.p256dh` and `keys.auth` are all present —
+ *    `PushSubscriptionJSON` types every one of them as optional, while the
+ *    server requires all three as non-empty strings and 400s otherwise.
+ *
+ * ```ts
+ * const json = subscription.toJSON();
+ * if (!json.endpoint || !json.keys?.p256dh || !json.keys?.auth) {
+ *   throw new Error("Incomplete Web Push subscription");
+ * }
+ * const webPushSubscription: WebPushSubscription = {
+ *   endpoint: json.endpoint,
+ *   keys: { p256dh: json.keys.p256dh, auth: json.keys.auth },
+ * };
+ * ```
+ *
+ * Mirrors the server's `webPushSubscriptionSchema`
+ * (server `src/v7/validation/push-notifications/push-notifications.schema.ts`).
+ */
+export interface WebPushSubscription {
+    endpoint: string;
+    keys: {
+        p256dh: string;
+        auth: string;
+    };
+}
+/**
+ * Identifies one physical device. Mirrors the server's device-identifier body
+ * exactly (server `src/v7/validation/push-notifications/push-notifications.schema.ts`):
+ * a provider token for `ios`/`android`, a Web Push subscription for `web`. The
+ * union encodes the server's own cross-check — it rejects the same
+ * combinations the server's `superRefine` rejects.
+ *
+ * Passed to `auth.signOut` to unbind that device's push binding in the same
+ * transaction as the sign-out.
+ */
+export type PushDeviceIdentifier = {
+    platform: "ios" | "android";
+    token: string;
+} | {
+    platform: "web";
+    subscription: WebPushSubscription;
+};

package/dist/interfaces/Report.d.ts

@@ -1,7 +1,13 @@
 import { Entity } from "./Entity";
 import { Comment } from "./Comment";
 import { Space } from "./Space";
-export type ReportTargetType = "entity" | "comment";
+export type ReportTargetType = "entity" | "comment" | "message";
+/**
+ * The reasons the API accepts on a report. Server-enforced — anything outside
+ * this set is rejected with `report/invalid-body`. Use `other` plus `details`
+ * for anything the taxonomy doesn't cover.
+ */
+export type ReportReason = "spam" | "inappropriateContent" | "harassment" | "misinformation" | "hateSpeech" | "violence" | "illegalActivity" | "selfHarm" | "other";
 export type ReportStatus = "pending" | "on-hold" | "escalated" | "dismissed" | "actioned";
 export interface UserReport {
     id: string;

package/dist/interfaces/Workspace.d.ts

@@ -11,6 +11,13 @@ import { User } from "./User";
 export type WorkspaceCapability = "view" | "invite" | "remove-member" | "edit-member-access" | "edit-member-profile" | "create-sub-workspace" | "edit-workspace";
 export type WorkspaceInvitationStatus = "pending" | "accepted" | "declined" | "revoked";
 export type WorkspaceAuthorityReason = "owner" | "ancestor-owner" | "member" | "reach-holder";
+export type WorkspaceAuthorityReasonDetail = {
+    type: "owner" | "member";
+    viaWorkspaceId?: never;
+} | {
+    type: "ancestor-owner" | "reach-holder";
+    viaWorkspaceId: string;
+};
 export interface Workspace {
     id: string;
     name: string;
@@ -23,6 +30,18 @@ export interface Workspace {
     updatedAt: string;
     memberCount?: number;
 }
+export interface WorkspaceMember {
+    id: string;
+    workspaceId: string;
+    userId: string;
+    capabilities: WorkspaceCapability[];
+    permissions: string[];
+    rank: number;
+    title: string | null;
+    metadata: Record<string, any>;
+    joinedAt: string;
+    createdAt: string;
+}
 export interface WorkspaceInvitation {
     id: string;
     workspaceId: string;
@@ -67,9 +86,63 @@ export interface WorkspaceRosterCountsResponse {
     total: number;
     distinctUsers: number;
 }
+/**
+ * The `user` carried by a standing read. Normally the full user record, but the
+ * server falls back to `{ id }` alone when the user row is gone (a deleted user
+ * with a lingering membership row is a reachable case), so every field except
+ * `id` may be absent.
+ */
+export type WorkspaceStandingUser = Pick<User, "id"> & Partial<Omit<User, "id">>;
+export interface WorkspaceMemberStanding {
+    user: WorkspaceStandingUser;
+    reasons: WorkspaceAuthorityReasonDetail[];
+    capabilities?: WorkspaceCapability[];
+    permissions?: string[];
+    rank?: number | null;
+    title: string | null;
+    metadata: Record<string, any>;
+}
 export interface WorkspaceAuthority {
-    reasons: WorkspaceAuthorityReason[];
+    reasons: WorkspaceAuthorityReasonDetail[];
     capabilities: WorkspaceCapability[];
     permissions: string[];
     rank: number | null;
 }
+/**
+ * One descendant the subtree sweep did NOT clear, where the target user still
+ * holds a direct membership.
+ *
+ * `id` / `name` are masked TOGETHER: an entry the acting user may see carries
+ * both, and one they may not carries `null` for both — the sweep reports THAT a
+ * membership survived without disclosing the existence or name of a sealed
+ * sub-workspace the actor has no authority over (the same sealing fence the
+ * descendant roster read applies). Modelled as a discriminated union so a
+ * `null` check on `id` narrows `name` too.
+ */
+export type SkippedWorkspace = {
+    id: string;
+    name: string;
+    /** Why it was skipped. `out-of-reach`: the actor's authority does not extend there. */
+    reason: "out-of-reach";
+} | {
+    id: null;
+    name: null;
+    /** Why it was skipped. `out-of-reach`: the actor's authority does not extend there. */
+    reason: "out-of-reach";
+};
+export interface RemoveWorkspaceMemberFromSubtreeResponse {
+    removedCount: number;
+    removed: {
+        workspaceId: string;
+        userId: string;
+    }[];
+    /**
+     * How many descendant memberships the target RETAINED because the sweep could
+     * not reach them. Always `0` for an owner / ancestor-owner / privileged key.
+     * A non-zero value means the offboarding is PARTIAL — never conclude a user is
+     * fully removed from `removedCount` alone.
+     */
+    skippedCount: number;
+    /** One entry per retained membership; `skippedCount === skipped.length`. */
+    skipped: SkippedWorkspace[];
+}

package/dist/modules/auth/changePassword.d.ts

@@ -1,11 +1,34 @@
 import { SublayHttpClient } from "../../core/client";
+import { PushDeviceIdentifier } from "../../interfaces/Push";
 export interface ChangePasswordProps {
     /** The user's current password (verified before the change). */
     password: string;
     newPassword: string;
+    /**
+     * Optional. The physical device making this call.
+     *
+     * A password change also deletes every push binding the user holds, so an
+     * intruder's device stops receiving notification content. Naming this device
+     * keeps ITS binding — nothing re-binds a device from its live session, so
+     * without this the handset the user just changed their password on goes
+     * quiet until the app cold-starts or switches accounts.
+     *
+     * Same value passed to `push.register` / `auth.signOut`. Omit it and every
+     * binding for the user goes, this device included.
+     */
+    pushDevice?: PushDeviceIdentifier;
 }
 export interface ChangePasswordResponse {
     success: boolean;
     message: string;
 }
+/**
+ * Change the signed-in user's password.
+ *
+ * Ends every OTHER session for that user — every other device must sign in
+ * again with the new password — while the session making this call survives.
+ * The server identifies that session from the access token this request is
+ * already authenticated with, so nothing about the caller's session has to be
+ * sent.
+ */
 export declare function changePassword(client: SublayHttpClient, data: ChangePasswordProps): Promise<ChangePasswordResponse>;

package/dist/modules/auth/signOut.d.ts

@@ -1,9 +1,103 @@
 import { SublayHttpClient } from "../../core/client";
+import { PushDeviceIdentifier } from "../../interfaces/Push";
 export interface SignOutProps {
     /**
      * Defaults to the SDK's stored refresh token (SDK-managed mode). Pass it
      * explicitly in host-managed mode, where the SDK holds no refresh token.
      */
     refreshToken?: string;
+    /**
+     * Optional. When supplied — and the project has the `push` bundle — the
+     * server deletes this user's push binding for that device in the SAME
+     * transaction as the token-family destroy: signing out unbinds the device's
+     * push, or nothing happens at all.
+     *
+     * **Needs a refresh token to have any effect.** The unbind is scoped to the
+     * `sub` of the refresh token, which is what stops one account removing
+     * another account's binding on a shared device — so with no token there is no
+     * user to scope it to and the server answers `204` before it ever looks at
+     * `pushDevice`. When none can be resolved the field is DROPPED from the
+     * request rather than sent into that silent no-op, the sign-out proceeds
+     * normally, and the returned `pushUnbindSkipped` says so. Watch for it in
+     * **host-managed mode**: such a client is built with `getToken` and no
+     * `initialTokens`, and its `setTokens` is inert, so it starts with no refresh
+     * token and can never acquire one. Pass `refreshToken` explicitly alongside
+     * `pushDevice` there.
+     *
+     * If the unbind fails the request fails (HTTP 500, code
+     * `auth/device-deregistration-failed` or `auth/sign-out-failed`) and NOTHING
+     * is committed — the session survives so the caller can retry, and this call
+     * rethrows WITHOUT clearing the SDK's local tokens, so the credential that
+     * retry needs is still there.
+     *
+     * That is the ONLY failure that leaves you signed in. Every other one — a
+     * `429` from the rate limiter or a quota gate, a `423`, a `503`, a `400` on
+     * the body, a dropped connection — never touched a push binding, so it
+     * clears the local tokens and RESOLVES: a user must always be able to sign
+     * out. See `UNBIND_FAILURE_CODES`.
+     *
+     * Omit it and the request is byte-identical to before this field existed.
+     */
+    pushDevice?: PushDeviceIdentifier;
+}
+/**
+ * Why the unbind did not happen. Present only when `pushUnbindSkipped` is
+ * `true`, and it exists because THE TWO SKIPS ARE RECOVERED DIFFERENTLY — a
+ * caller that cannot tell them apart can only ever pick the wrong remedy for
+ * one of them:
+ *
+ * - `no-refresh-token` — this SDK never asked. Nothing was destroyed either:
+ *   with no token the server has no session to end, so the account, its
+ *   credential and its binding are all still there. **Retryable**: re-issue
+ *   the sign-out with an explicit `refreshToken` and the unbind happens.
+ * - `push-unbind-status-unknown` — the server was asked and could not answer.
+ *   The sign-out itself DID commit, so the credential that would have driven a
+ *   retry is gone; re-issuing achieves nothing. The binding clears when that
+ *   account next registers on this device, or when the server prunes the token
+ *   as undeliverable.
+ */
+export type PushUnbindSkipReason = "no-refresh-token" | "push-unbind-status-unknown";
+export interface SignOutResult {
+    /**
+     * `true` whenever a `pushDevice` was supplied and the unbind did NOT happen,
+     * so this device's push binding for that account may still be live. Either
+     * the SDK declined to ask (no refresh token to scope the unbind to) or the
+     * server could not answer whether a binding exists; `pushUnbindSkipReason`
+     * says which, and the two are recovered differently.
+     *
+     * `false` means NO SKIP WAS REPORTED — by this SDK or by the server. It is
+     * not a promise that no skip happened, and the difference is not academic:
+     * the server declines the unbind for several reasons it answers with a plain
+     * `204`, and every one of them reads `false` here.
+     *
+     *   - The refresh token is authentic but expired beyond the server's unbind
+     *     window (90 days past `exp`), so there is no subject to scope the unbind
+     *     to. Reachable from this SDK by passing an old `refreshToken` explicitly
+     *     alongside `pushDevice`.
+     *   - The refresh token is malformed or fails signature verification.
+     *   - The project has no `push` bundle, so no binding can exist.
+     *   - The unbind ran and matched zero rows — the binding was already gone, or
+     *     was never registered under this device key.
+     *
+     * The server logs each of those under its own reason; only the case where it
+     * could not determine whether a binding exists is reported in the response,
+     * because that is the one where the binding may still be LIVE and nobody
+     * looked. The rest either prove there was nothing to remove or leave a device
+     * key the server cannot attribute to a user, and neither gives the caller
+     * anything to act on beyond what it already knows.
+     *
+     * A request that failed short of an unbind attempt reads `false` too — a
+     * gate's `429` or `423`, a `503`, a `400`, a dropped connection. Those clear
+     * the local tokens and resolve rather than reject (see `UNBIND_FAILURE_CODES`
+     * for why), and none of them is a REPORTED skip; they are logged with a
+     * warning instead.
+     *
+     * The sign-out itself is unaffected by the flag in both directions: a user
+     * must always be able to sign out, so a skipped unbind never fails the call
+     * and never leaves the local tokens in place.
+     */
+    pushUnbindSkipped: boolean;
+    /** Set only when `pushUnbindSkipped` is `true`. See `PushUnbindSkipReason`. */
+    pushUnbindSkipReason?: PushUnbindSkipReason;
 }
-export declare function signOut(client: SublayHttpClient, data?: SignOutProps): Promise<void>;
+export declare function signOut(client: SublayHttpClient, data?: SignOutProps): Promise<SignOutResult>;

package/dist/modules/chat/index.d.ts

@@ -19,4 +19,3 @@ export { toggleReaction } from "./toggleReaction";
 export { listReactions } from "./listReactions";
 export { markAsRead } from "./markAsRead";
 export { muteConversation } from "./muteConversation";
-export { reportMessage } from "./reportMessage";

package/dist/modules/collections/updateCollection.d.ts

@@ -2,6 +2,6 @@ import { SublayHttpClient } from "../../core/client";
 import { Collection } from "../../interfaces/Collection";
 export interface UpdateCollectionProps {
     collectionId: string;
-    name?: string;
+    name: string;
 }
 export declare function updateCollection(client: SublayHttpClient, data: UpdateCollectionProps): Promise<Collection>;

package/dist/modules/comments/updateComment.d.ts

@@ -2,6 +2,9 @@ import { SublayHttpClient } from "../../core/client";
 import { Comment } from "../../interfaces/Comment";
 export interface UpdateCommentProps {
     commentId: string;
-    content: string;
+    /** New text content. Cannot be empty. Omit to leave the content untouched. */
+    content?: string;
+    /** Replaces the comment's metadata wholesale (not merged). */
+    metadata?: Record<string, any>;
 }
 export declare function updateComment(client: SublayHttpClient, data: UpdateCommentProps): Promise<Comment>;

package/dist/modules/reports/createReport.d.ts

@@ -1,9 +1,9 @@
 import { SublayHttpClient } from "../../core/client";
-import { CreateReportResponse, ReportTargetType } from "../../interfaces/Report";
+import { CreateReportResponse, ReportReason, ReportTargetType } from "../../interfaces/Report";
 export interface CreateReportProps {
     targetType: ReportTargetType;
     targetId: string;
-    reason: string;
+    reason: ReportReason;
     details?: string;
 }
 export declare function createReport(client: SublayHttpClient, data: CreateReportProps): Promise<CreateReportResponse>;

package/dist/modules/spaces/fetchUserSpaces.d.ts

@@ -7,5 +7,11 @@ export interface FetchUserSpacesProps {
     include?: string;
     role?: string;
     all?: "true" | "false";
+    /**
+     * Membership status to list. Defaults to `"active"` (spaces the user is in);
+     * `"pending"` returns join requests awaiting approval, `"banned"` the spaces
+     * they were removed from.
+     */
+    status?: "active" | "pending" | "banned";
 }
 export declare function fetchUserSpaces(client: SublayHttpClient, data: FetchUserSpacesProps): Promise<UserSpacesResponse>;

package/dist/modules/workspaces/acceptWorkspaceInvite.d.ts

@@ -0,0 +1,13 @@
+import { SublayHttpClient } from "../../core/client";
+export interface AcceptWorkspaceInviteProps {
+    inviteId: string;
+}
+export interface AcceptWorkspaceInviteResponse {
+    success: boolean;
+    workspaceId: string;
+}
+/**
+ * Accept an invitation — identity-matched to the bearer-token user + verified
+ * email required. Non-secret id. Idempotent when already a member/owner.
+ */
+export declare function acceptWorkspaceInvite(client: SublayHttpClient, data: AcceptWorkspaceInviteProps): Promise<AcceptWorkspaceInviteResponse>;

package/dist/modules/workspaces/createWorkspaceInvite.d.ts

@@ -0,0 +1,17 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceCapability, WorkspaceInvitation } from "../../interfaces/Workspace";
+export interface CreateWorkspaceInviteProps {
+    workspaceId: string;
+    email?: string;
+    userId?: string;
+    username?: string;
+    capabilities?: WorkspaceCapability[];
+    permissions?: string[];
+    rank: number;
+    title?: string | null;
+}
+/**
+ * Create an invitation (requires the `invite` capability on the workspace). The
+ * inviter is the bearer-token user.
+ */
+export declare function createWorkspaceInvite(client: SublayHttpClient, data: CreateWorkspaceInviteProps): Promise<WorkspaceInvitation>;

package/dist/modules/workspaces/declineWorkspaceInvite.d.ts

@@ -0,0 +1,14 @@
+import { SublayHttpClient } from "../../core/client";
+export interface DeclineWorkspaceInviteProps {
+    inviteId: string;
+}
+export interface DeclineWorkspaceInviteResponse {
+    success: boolean;
+}
+/**
+ * Decline an invitation — identity-matched to the bearer-token user, and
+ * verified-email-gated (the same gate as accept, so an unverified squatter on
+ * someone else's address cannot burn their invite). An unverified decline
+ * returns `403 workspace/email-not-verified`.
+ */
+export declare function declineWorkspaceInvite(client: SublayHttpClient, data: DeclineWorkspaceInviteProps): Promise<DeclineWorkspaceInviteResponse>;

package/dist/modules/workspaces/deleteWorkspace.d.ts

@@ -0,0 +1,13 @@
+import { SublayHttpClient } from "../../core/client";
+export interface DeleteWorkspaceProps {
+    workspaceId: string;
+}
+export interface DeleteWorkspaceResponse {
+    message: string;
+}
+/**
+ * Owner-only delete (own owner or an ancestor owner). Cascades the whole
+ * subtree transactionally. The actor is the bearer-token user — no `userId`
+ * body is sent.
+ */
+export declare function deleteWorkspace(client: SublayHttpClient, data: DeleteWorkspaceProps): Promise<DeleteWorkspaceResponse>;

package/dist/modules/workspaces/fetchMyWorkspaceInvites.d.ts

@@ -0,0 +1,15 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceInvitation } from "../../interfaces/Workspace";
+export interface FetchMyWorkspaceInvitesResponse {
+    data: WorkspaceInvitation[];
+}
+/**
+ * The bearer-token user's LIVE pending invites (`status='pending' AND expiresAt
+ * > now`), matched by `userId` from the token. Surfacing is NOT
+ * verification-gated (the verified check applies when the user ACTS on an
+ * invite — accept or decline).
+ *
+ * This is the INBOX read — invites addressed TO the caller. For the invites a
+ * workspace has ISSUED, use `fetchWorkspaceInvites`.
+ */
+export declare function fetchMyWorkspaceInvites(client: SublayHttpClient): Promise<FetchMyWorkspaceInvitesResponse>;

package/dist/modules/workspaces/fetchWorkspaceAuthority.d.ts

@@ -0,0 +1,11 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceAuthority } from "../../interfaces/Workspace";
+export interface FetchWorkspaceAuthorityProps {
+    workspaceId: string;
+}
+/**
+ * Authority-as-a-service read — the bearer-token user's resolved standing
+ * (`{ reasons, capabilities, permissions, rank }`) on the workspace. A
+ * permission check is a one-line `.includes()` on the result.
+ */
+export declare function fetchWorkspaceAuthority(client: SublayHttpClient, data: FetchWorkspaceAuthorityProps): Promise<WorkspaceAuthority>;

package/dist/modules/workspaces/fetchWorkspaceInvites.d.ts

@@ -0,0 +1,17 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceInvitation } from "../../interfaces/Workspace";
+export interface FetchWorkspaceInvitesProps {
+    workspaceId: string;
+}
+export interface FetchWorkspaceInvitesResponse {
+    data: WorkspaceInvitation[];
+}
+/**
+ * List a workspace's LIVE pending invites (`status='pending' AND expiresAt >
+ * now`). Requires the `invite` capability (or owner). Always returned in full —
+ * this list is deliberately unpaginated.
+ *
+ * This is the OUTBOX read — invites this workspace ISSUED. For the invites
+ * addressed TO the caller, use `fetchMyWorkspaceInvites`.
+ */
+export declare function fetchWorkspaceInvites(client: SublayHttpClient, data: FetchWorkspaceInvitesProps): Promise<FetchWorkspaceInvitesResponse>;

package/dist/modules/workspaces/fetchWorkspaceMemberStanding.d.ts

@@ -0,0 +1,11 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceMemberStanding } from "../../interfaces/Workspace";
+export interface FetchWorkspaceMemberStandingProps {
+    workspaceId: string;
+    targetUserId: string;
+}
+/**
+ * Read one user's resolved standing on a workspace (`reasons`, `capabilities`,
+ * `permissions`, `rank`, `title`, `metadata`).
+ */
+export declare function fetchWorkspaceMemberStanding(client: SublayHttpClient, data: FetchWorkspaceMemberStandingProps): Promise<WorkspaceMemberStanding>;

package/dist/modules/workspaces/fetchWorkspaceMembers.d.ts

@@ -0,0 +1,13 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceRosterResponse, WorkspaceRosterCountsResponse } from "../../interfaces/Workspace";
+export interface FetchWorkspaceMembersProps {
+    workspaceId: string;
+    include?: string;
+    countOnly?: boolean;
+}
+/**
+ * Unified roster read — one entry per distinct user, each with a `reasons`
+ * array. Always returned in full (never paginated). With `countOnly=true` the
+ * shape is `WorkspaceRosterCountsResponse` instead. Actor from the token.
+ */
+export declare function fetchWorkspaceMembers(client: SublayHttpClient, data: FetchWorkspaceMembersProps): Promise<WorkspaceRosterResponse | WorkspaceRosterCountsResponse>;

package/dist/modules/workspaces/index.d.ts

@@ -1,9 +1,21 @@
 export { createWorkspace } from "./createWorkspace";
 export { fetchWorkspace } from "./fetchWorkspace";
 export { fetchManyWorkspaces } from "./fetchManyWorkspaces";
-export { fetchMembers } from "./fetchMembers";
-export { createInvite } from "./createInvite";
-export { acceptInvite } from "./acceptInvite";
-export { declineInvite } from "./declineInvite";
-export { fetchMyInvites } from "./fetchMyInvites";
-export { getAuthority } from "./getAuthority";
+export { updateWorkspace } from "./updateWorkspace";
+export { updateWorkspaceInheritFlag } from "./updateWorkspaceInheritFlag";
+export { deleteWorkspace } from "./deleteWorkspace";
+export { transferWorkspaceOwnership } from "./transferWorkspaceOwnership";
+export { fetchWorkspaceMembers } from "./fetchWorkspaceMembers";
+export { fetchWorkspaceMemberStanding } from "./fetchWorkspaceMemberStanding";
+export { updateWorkspaceMember } from "./updateWorkspaceMember";
+export { removeWorkspaceMember } from "./removeWorkspaceMember";
+export { leaveWorkspace } from "./leaveWorkspace";
+export { removeWorkspaceMemberFromSubtree } from "./removeWorkspaceMemberFromSubtree";
+export { createWorkspaceInvite } from "./createWorkspaceInvite";
+export { fetchWorkspaceInvites } from "./fetchWorkspaceInvites";
+export { revokeWorkspaceInvite } from "./revokeWorkspaceInvite";
+export { resendWorkspaceInvite } from "./resendWorkspaceInvite";
+export { acceptWorkspaceInvite } from "./acceptWorkspaceInvite";
+export { declineWorkspaceInvite } from "./declineWorkspaceInvite";
+export { fetchMyWorkspaceInvites } from "./fetchMyWorkspaceInvites";
+export { fetchWorkspaceAuthority } from "./fetchWorkspaceAuthority";

package/dist/modules/workspaces/leaveWorkspace.d.ts

@@ -0,0 +1,11 @@
+import { SublayHttpClient } from "../../core/client";
+export interface LeaveWorkspaceProps {
+    workspaceId: string;
+}
+/**
+ * The bearer-token user leaves this workspace — removes THEIR OWN direct
+ * membership on THIS node only (owning a child is unaffected). An owner cannot
+ * leave (409 `workspace/sole-owner`); transfer or delete first. No `userId` is
+ * sent — the server derives the leaver from the token.
+ */
+export declare function leaveWorkspace(client: SublayHttpClient, data: LeaveWorkspaceProps): Promise<void>;

package/dist/modules/workspaces/removeWorkspaceMember.d.ts

@@ -0,0 +1,12 @@
+import { SublayHttpClient } from "../../core/client";
+export interface RemoveWorkspaceMemberProps {
+    workspaceId: string;
+    targetUserId: string;
+}
+/**
+ * Remove a member from this workspace. Requires the `remove-member` capability
+ * and is rank-bounded. The workspace owner cannot be removed (409
+ * `workspace/sole-owner`) — transfer ownership first. No `userId` body is sent;
+ * the actor comes from the token.
+ */
+export declare function removeWorkspaceMember(client: SublayHttpClient, data: RemoveWorkspaceMemberProps): Promise<void>;

package/dist/modules/workspaces/removeWorkspaceMemberFromSubtree.d.ts

@@ -0,0 +1,16 @@
+import { SublayHttpClient } from "../../core/client";
+import { RemoveWorkspaceMemberFromSubtreeResponse } from "../../interfaces/Workspace";
+export interface RemoveWorkspaceMemberFromSubtreeProps {
+    workspaceId: string;
+    targetUserId: string;
+}
+/**
+ * Removes the target user's direct memberships on this workspace and every
+ * descendant. Requires `remove-member` (rank-bounded per node). Blocks (409
+ * `workspace/owns-descendants`) with a report if the user OWNS any descendant
+ * workspace — transfer or delete those first. The actor comes from the token.
+ *
+ * A NON-owner's sweep can be PARTIAL: it stops at sealed sub-workspaces. Check
+ * `skippedCount` / `skipped` before treating the user as fully offboarded.
+ */
+export declare function removeWorkspaceMemberFromSubtree(client: SublayHttpClient, data: RemoveWorkspaceMemberFromSubtreeProps): Promise<RemoveWorkspaceMemberFromSubtreeResponse>;

package/dist/modules/workspaces/resendWorkspaceInvite.d.ts

@@ -0,0 +1,12 @@
+import { SublayHttpClient } from "../../core/client";
+import { WorkspaceInvitation } from "../../interfaces/Workspace";
+export interface ResendWorkspaceInviteProps {
+    workspaceId: string;
+    inviteId: string;
+}
+/**
+ * Resend / refresh a pending invitation (valid on any `pending` invite, even one
+ * past `expiresAt` — resets a 14-day expiry and resends the email). A terminal
+ * invite (accepted/declined/revoked) → 409. Requires `invite` (or owner).
+ */
+export declare function resendWorkspaceInvite(client: SublayHttpClient, data: ResendWorkspaceInviteProps): Promise<WorkspaceInvitation>;

package/dist/modules/workspaces/revokeWorkspaceInvite.d.ts

@@ -0,0 +1,13 @@
+import { SublayHttpClient } from "../../core/client";
+export interface RevokeWorkspaceInviteProps {
+    workspaceId: string;
+    inviteId: string;
+}
+export interface RevokeWorkspaceInviteResponse {
+    success: boolean;
+}
+/**
+ * Revoke a pending invitation. Requires the `invite` capability (or owner).
+ * Note the verb-suffixed POST route — this is not a `DELETE`.
+ */
+export declare function revokeWorkspaceInvite(client: SublayHttpClient, data: RevokeWorkspaceInviteProps): Promise<RevokeWorkspaceInviteResponse>;

package/dist/modules/workspaces/transferWorkspaceOwnership.d.ts

@@ -0,0 +1,15 @@
+import { SublayHttpClient } from "../../core/client";
+import { Workspace, WorkspaceCapability } from "../../interfaces/Workspace";
+export interface TransferWorkspaceOwnershipProps {
+    workspaceId: string;
+    newOwnerId: string;
+    previousOwnerDisposition?: "demote" | "remove";
+    previousOwnerRank?: number;
+    previousOwnerCapabilities?: WorkspaceCapability[];
+}
+/**
+ * Hand the workspace to a new owner. Owner-only (own owner or an ancestor
+ * owner). The actor is the bearer-token user — no `userId` is sent;
+ * `newOwnerId` addresses the TARGET, not the actor.
+ */
+export declare function transferWorkspaceOwnership(client: SublayHttpClient, data: TransferWorkspaceOwnershipProps): Promise<Workspace>;

package/dist/modules/workspaces/updateWorkspace.d.ts

@@ -0,0 +1,12 @@
+import { SublayHttpClient } from "../../core/client";
+import { Workspace } from "../../interfaces/Workspace";
+export interface UpdateWorkspaceProps {
+    workspaceId: string;
+    name?: string;
+    metadata?: Record<string, any>;
+}
+/**
+ * Edit a workspace's name / metadata. Requires the `edit-workspace` capability
+ * (or ownership). The actor is the bearer-token user — no `userId` is sent.
+ */
+export declare function updateWorkspace(client: SublayHttpClient, data: UpdateWorkspaceProps): Promise<Workspace>;

package/dist/modules/workspaces/updateWorkspaceInheritFlag.d.ts

@@ -0,0 +1,13 @@
+import { SublayHttpClient } from "../../core/client";
+import { Workspace } from "../../interfaces/Workspace";
+export interface UpdateWorkspaceInheritFlagProps {
+    workspaceId: string;
+    inheritsFromParent: boolean;
+}
+/**
+ * Flip whether capabilities held on an ancestor "reach" into this workspace.
+ * Owner-only in both directions (own owner or an ancestor owner), and blocked
+ * (403 `workspace/inherit-enforced`) when the project enforces its default.
+ * The actor is the bearer-token user — no `userId` is sent.
+ */
+export declare function updateWorkspaceInheritFlag(client: SublayHttpClient, data: UpdateWorkspaceInheritFlagProps): Promise<Workspace>;