@tangle-network/agent-app 0.45.54 → 0.45.55

package/dist/{invitations-DoYMvXea.d.ts → teams/invitations.d.ts}

@@ -1,5 +1,3 @@
-import { A as AssignableWorkspaceRole } from './roles-B4nU3jDi.js';
-
 /**
  * Pure invitation helpers + email-template renderer for the teams capability.
  * Zero dependencies: no drizzle, no env, no react, no network. The lifecycle API
@@ -12,31 +10,31 @@ import { A as AssignableWorkspaceRole } from './roles-B4nU3jDi.js';
  * secret (API key) and the network call stay in the app's seam — agent-app ships
  * only the deterministic template.
  */
-
+import type { AssignableWorkspaceRole } from './roles';
 /** The role an invitation grants — the assignable workspace ladder (never owner). */
-type InvitationPermission = AssignableWorkspaceRole;
+export type InvitationPermission = AssignableWorkspaceRole;
 /** Define possible states for an invitation's lifecycle including pending, accepted, expired, and revoked */
-type InvitationStatus = 'pending' | 'accepted' | 'expired' | 'revoked';
+export type InvitationStatus = 'pending' | 'accepted' | 'expired' | 'revoked';
 /** Define possible statuses for the sending state of an invitation email */
-type InvitationEmailStatus = 'not_sent' | 'sent' | 'failed';
+export type InvitationEmailStatus = 'not_sent' | 'sent' | 'failed';
 /** Define the number of days before an invitation expires */
-declare const INVITATION_EXPIRY_DAYS = 7;
+export declare const INVITATION_EXPIRY_DAYS = 7;
 /** Normalize an invitation email by trimming whitespace and converting to lowercase */
-declare function normalizeInvitationEmail(email: string): string;
+export declare function normalizeInvitationEmail(email: string): string;
 /** Resolve invitation permission from a string or return null if invalid */
-declare function parseInvitationPermission(value: string | undefined): InvitationPermission | null;
+export declare function parseInvitationPermission(value: string | undefined): InvitationPermission | null;
 /** Calculate the expiration date of an invitation based on the given or current date */
-declare function getInvitationExpiresAt(now?: Date): Date;
+export declare function getInvitationExpiresAt(now?: Date): Date;
 /**
  * A cryptographically-random, URL-safe invitation token. `inv_`-prefixed so a
  * token is self-identifying and never collides with the workspaceMember invite
  * tokens minted by `members-api` (`generateInviteToken`).
  */
-declare function generateInvitationToken(): string;
+export declare function generateInvitationToken(): string;
 /** Generate an invite URL by combining the origin with an encoded token */
-declare function inviteUrlForToken(origin: string, token: string): string;
+export declare function inviteUrlForToken(origin: string, token: string): string;
 /** Define input data required to render an invitation email template */
-interface RenderInvitationEmailInput {
+export interface RenderInvitationEmailInput {
     to: string;
     workspaceName: string;
     inviterEmail: string;
@@ -45,12 +43,12 @@ interface RenderInvitationEmailInput {
     expiresAt: Date;
 }
 /** Define the structure for an invitation email brand including the RFC-5322 From header */
-interface InvitationEmailBrand {
+export interface InvitationEmailBrand {
     /** RFC-5322 From header, e.g. `GTM Agent <noreply@gtm.tangle.tools>`. */
     fromAddress: string;
 }
 /** Define the structure of a fully rendered invitation email with sender, subject, and content fields */
-interface RenderedInvitationEmail {
+export interface RenderedInvitationEmail {
     from: string;
     subject: string;
     html: string;
@@ -61,6 +59,4 @@ interface RenderedInvitationEmail {
  * caller passes the result to its own mail client; this never reads a secret or
  * touches the network.
  */
-declare function renderInvitationEmail(input: RenderInvitationEmailInput, brand: InvitationEmailBrand): RenderedInvitationEmail;
-
-export { INVITATION_EXPIRY_DAYS as I, type RenderInvitationEmailInput as R, type InvitationEmailBrand as a, type InvitationEmailStatus as b, type InvitationPermission as c, type InvitationStatus as d, type RenderedInvitationEmail as e, getInvitationExpiresAt as f, generateInvitationToken as g, inviteUrlForToken as i, normalizeInvitationEmail as n, parseInvitationPermission as p, renderInvitationEmail as r };
+export declare function renderInvitationEmail(input: RenderInvitationEmailInput, brand: InvitationEmailBrand): RenderedInvitationEmail;

package/dist/teams/invite.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure invite-token helpers — generation, shape validation, and expiry math.
+ * No I/O: the members API persists/looks up tokens; these functions only
+ * produce well-formed tokens and decide, given values the caller already
+ * loaded, whether an invite is usable.
+ *
+ * A token is an opaque high-entropy URL-safe string. It is the bearer secret
+ * in `/invite/:token`, so it must be unguessable and never derived from the
+ * email or workspace. `generateInviteToken` uses Web Crypto (`crypto`), which
+ * is present in Workers, Node 18+, Deno, and browsers — no Node-only import,
+ * so this stays a pure leaf.
+ */
+/** Cryptographically-random, URL-safe (base64url) invite token. */
+export declare function generateInviteToken(): string;
+/** True when `value` has the shape of an invite token (not whether it exists). */
+export declare function isInviteTokenShape(value: unknown): value is string;
+/** A pending invite row, narrowed to the fields invite acceptance reasons over. */
+export interface InviteTokenState {
+    /** null until accepted — a non-null value means the invite was already used. */
+    acceptedAt: Date | number | null | undefined;
+    /** Email the invite was addressed to, if any. */
+    inviteEmail?: string | null;
+    /** Optional hard expiry; omit/undefined for invites that never expire. */
+    expiresAt?: Date | number | null;
+}
+/** Define possible reasons for rejecting an invite including acceptance, expiration, or email mismatch */
+export type InviteRejectionReason = 'already-accepted' | 'expired' | 'email-mismatch';
+/** Represent the outcome of validating an invite with success status and optional rejection reason */
+export interface InviteValidationResult {
+    ok: boolean;
+    reason?: InviteRejectionReason;
+}
+/**
+ * Decide whether a loaded invite can be accepted by `acceptingEmail` at `now`.
+ * Pure: the caller has already fetched the row by token; this only judges it.
+ * Email match is case-insensitive and only enforced when the invite was
+ * addressed to a specific email (an open invite has no `inviteEmail`).
+ */
+export declare function validateInviteToken(invite: InviteTokenState, opts?: {
+    acceptingEmail?: string | null;
+    now?: Date;
+}): InviteValidationResult;

package/dist/teams/members-api.d.ts

@@ -1,7 +1,3 @@
-import { f as WorkspaceRole } from '../roles-B4nU3jDi.js';
-import { T as TeamDatabase, a as TeamTables, g as TeamParentTable, h as WorkspaceAccessApi } from '../access-490O6aOU.js';
-import 'drizzle-orm/sqlite-core';
-
 /**
  * Framework-neutral members API for the teams module: the invite / list /
  * update-role / remove / accept-invite logic, lifted out of any one app's route
@@ -23,9 +19,11 @@ import 'drizzle-orm/sqlite-core';
  *
  * Imports `drizzle-orm`, so this is a subpath, never re-exported from root.
  */
-
+import { type WorkspaceRole } from './roles';
+import type { TeamDatabase, WorkspaceAccessApi } from './drizzle/access';
+import type { TeamParentTable, TeamTables } from './drizzle/schema';
 /** The authenticated caller — apps resolve this from their own session layer. */
-interface MembersApiActor {
+export interface MembersApiActor {
     id: string;
     email?: string | null;
 }
@@ -33,7 +31,7 @@ interface MembersApiActor {
  * The product's user table, narrowed to the columns the member queries read.
  * Adopters pass their real drizzle user table.
  */
-interface UserLookupTable {
+export interface UserLookupTable {
     id: any;
     name: any;
     email: any;
@@ -43,7 +41,7 @@ interface UserLookupTable {
  * read. The handlers join it to resolve a workspace's organization (the same
  * table passed to createTeamTables as workspaceTable).
  */
-interface WorkspaceLookupTable {
+export interface WorkspaceLookupTable {
     id: any;
     organizationId: any;
 }
@@ -54,14 +52,14 @@ interface WorkspaceLookupTable {
  * a NEW seat (invitee is not already an org member and has no pending org
  * invite) — the same guard gtm uses, so the seam never fires on a no-op invite.
  */
-interface EnforceSeatSeam {
+export interface EnforceSeatSeam {
     (input: {
         actorId: string;
         organizationId: string;
     }): Promise<void> | void;
 }
 /** Thrown by an `enforceSeat` seam to deny an invite; serialized to a 402. */
-declare class SeatLimitError extends Error {
+export declare class SeatLimitError extends Error {
     readonly status: number;
     readonly capability?: string;
     readonly requiredPlan?: string;
@@ -77,7 +75,7 @@ declare class SeatLimitError extends Error {
  * swallows rejections, so an unavailable downstream never blocks the mutation.
  * Each fires only for members with a real `userId` (never email-only invites).
  */
-interface MemberSyncSeam {
+export interface MemberSyncSeam {
     add?(input: {
         workspaceId: string;
         userId: string;
@@ -94,7 +92,7 @@ interface MemberSyncSeam {
     }): Promise<void> | void;
 }
 /** Define configuration options for managing team members and workspace access APIs */
-interface MembersApiOptions {
+export interface MembersApiOptions {
     db: TeamDatabase;
     tables: TeamTables;
     /** The product's user table (FK target passed to createTeamTables). */
@@ -107,7 +105,7 @@ interface MembersApiOptions {
     memberSyncSeam?: MemberSyncSeam;
 }
 /** Define the structure of a workspace member entry with identification, role, and status details */
-interface MemberListEntry {
+export interface MemberListEntry {
     id: string;
     userId: string | null;
     organizationMemberId: string | null;
@@ -123,7 +121,7 @@ interface MemberListEntry {
  * handlers; an app maps its route methods onto them (GET→list, POST→invite,
  * PATCH→updateRole, DELETE→remove; accept on its own route).
  */
-declare function createMembersApi(opts: MembersApiOptions): {
+export declare function createMembersApi(opts: MembersApiOptions): {
     listMembers: (input: {
         workspaceId: string;
         actor: MembersApiActor;
@@ -150,5 +148,3 @@ declare function createMembersApi(opts: MembersApiOptions): {
         actor: MembersApiActor;
     }) => Promise<Response>;
 };
-
-export { type EnforceSeatSeam, type MemberListEntry, type MemberSyncSeam, type MembersApiActor, type MembersApiOptions, SeatLimitError, type UserLookupTable, type WorkspaceLookupTable, createMembersApi };

package/dist/teams/resend.d.ts

@@ -1,11 +1,3 @@
-import { SendInvitationEmailSeam } from './invitations-api.js';
-import '../invitations-DoYMvXea.js';
-import '../roles-B4nU3jDi.js';
-import './members-api.js';
-import '../access-490O6aOU.js';
-import 'drizzle-orm/sqlite-core';
-import '../invitations-schema-_fI7HkJP.js';
-
 /**
  * Opt-in Resend transport for the teams invitations `sendInvitationEmail` seam.
  * Most adopters back the seam with Resend and hand-roll the same wrapper — and
@@ -18,9 +10,9 @@ import '../invitations-schema-_fI7HkJP.js';
  * `resend` is an OPTIONAL peer, imported only here: apps not on Resend keep
  * passing a raw seam, and the package core never pulls a mail dependency.
  */
-
+import type { SendInvitationEmailSeam } from './invitations-api';
 /** Define options for sending a resend invitation including sender address and optional API key */
-interface ResendInvitationSenderOptions {
+export interface ResendInvitationSenderOptions {
     /** RFC-5322 From header, e.g. `GTM Agent <noreply@gtm.tangle.tools>`. */
     from: string;
     /** Resend API key. Defaults to `process.env.RESEND_API_KEY`. */
@@ -32,6 +24,4 @@ interface ResendInvitationSenderOptions {
  * The client is built lazily on first send; with no key the seam fails typed
  * (the invitation is still created — emailStatus becomes 'failed').
  */
-declare function createResendInvitationSender(opts: ResendInvitationSenderOptions): SendInvitationEmailSeam;
-
-export { type ResendInvitationSenderOptions, createResendInvitationSender };
+export declare function createResendInvitationSender(opts: ResendInvitationSenderOptions): SendInvitationEmailSeam;

package/dist/{roles-B4nU3jDi.d.ts → teams/roles.d.ts}

@@ -14,48 +14,46 @@
  * `resolveWorkspaceRole` is the bridge: it folds the org role and the
  * per-workspace role into the one effective workspace role a request runs at.
  */
-declare const WORKSPACE_ROLES: readonly ["viewer", "editor", "admin", "owner"];
+export declare const WORKSPACE_ROLES: readonly ["viewer", "editor", "admin", "owner"];
 /** Resolve the union type of all possible workspace role string literals from WORKSPACE_ROLES array */
-type WorkspaceRole = typeof WORKSPACE_ROLES[number];
+export type WorkspaceRole = typeof WORKSPACE_ROLES[number];
 /** Define the list of roles that can be assigned within a workspace */
-declare const ASSIGNABLE_WORKSPACE_ROLES: readonly ["viewer", "editor", "admin"];
+export declare const ASSIGNABLE_WORKSPACE_ROLES: readonly ["viewer", "editor", "admin"];
 /** Resolve the set of roles that can be assigned within a workspace */
-type AssignableWorkspaceRole = typeof ASSIGNABLE_WORKSPACE_ROLES[number];
+export type AssignableWorkspaceRole = typeof ASSIGNABLE_WORKSPACE_ROLES[number];
 /** Define the set of fixed roles available within an organization */
-declare const ORGANIZATION_ROLES: readonly ["owner", "admin", "member", "billing"];
+export declare const ORGANIZATION_ROLES: readonly ["owner", "admin", "member", "billing"];
 /** Resolve a role string from the predefined list of organization roles */
-type OrganizationRole = typeof ORGANIZATION_ROLES[number];
+export type OrganizationRole = typeof ORGANIZATION_ROLES[number];
 /** Define access levels for workspace collaboration as either read or write */
-type WorkspaceCollaborationAccess = 'read' | 'write';
+export type WorkspaceCollaborationAccess = 'read' | 'write';
 /** Define user roles available within a sandbox workspace environment */
-type SandboxWorkspaceRole = 'owner' | 'admin' | 'developer' | 'viewer';
+export type SandboxWorkspaceRole = 'owner' | 'admin' | 'developer' | 'viewer';
 /** Map workspace roles to their corresponding hierarchical rank values */
-declare const WORKSPACE_ROLE_RANK: Record<WorkspaceRole, number>;
+export declare const WORKSPACE_ROLE_RANK: Record<WorkspaceRole, number>;
 /** Map organization roles to their hierarchical rank for permission and access control purposes */
-declare const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number>;
+export declare const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number>;
 /** True when `actual` is at least `minimum` on the workspace ladder. */
-declare function hasWorkspaceRole(actual: WorkspaceRole, minimum: WorkspaceRole): boolean;
+export declare function hasWorkspaceRole(actual: WorkspaceRole, minimum: WorkspaceRole): boolean;
 /** True when `actual` is at least `minimum` on the organization ladder. */
-declare function hasOrganizationRole(actual: OrganizationRole, minimum: OrganizationRole): boolean;
+export declare function hasOrganizationRole(actual: OrganizationRole, minimum: OrganizationRole): boolean;
 /** Determine if a value is a valid assignable workspace role among viewer, editor, or admin */
-declare function isAssignableWorkspaceRole(value: unknown): value is AssignableWorkspaceRole;
+export declare function isAssignableWorkspaceRole(value: unknown): value is AssignableWorkspaceRole;
 /** Org owners and admins are workspace owners across the whole org. */
-declare function organizationRoleGrantsWorkspaceOwner(role: OrganizationRole | string | null | undefined): boolean;
+export declare function organizationRoleGrantsWorkspaceOwner(role: OrganizationRole | string | null | undefined): boolean;
 /**
  * The effective workspace role a request runs at: org owner/admin → owner of
  * every workspace; otherwise the explicit per-workspace role (or null = no
  * access). This is the single fold every access check goes through.
  */
-declare function resolveWorkspaceRole(organizationRole: OrganizationRole | string | null | undefined, workspaceRole: WorkspaceRole | null | undefined): WorkspaceRole | null;
+export declare function resolveWorkspaceRole(organizationRole: OrganizationRole | string | null | undefined, workspaceRole: WorkspaceRole | null | undefined): WorkspaceRole | null;
 /**
  * Whether `actorRole` may set/clear a member currently at `targetRole`. Owners
  * can manage anyone; everyone else can only manage members strictly below
  * their own rank (an admin cannot demote another admin or an owner).
  */
-declare function canManageWorkspaceMemberRole(actorRole: WorkspaceRole, targetRole: WorkspaceRole): boolean;
+export declare function canManageWorkspaceMemberRole(actorRole: WorkspaceRole, targetRole: WorkspaceRole): boolean;
 /** Map a workspace role to the corresponding collaboration access level */
-declare function workspaceRoleToCollaborationAccess(role: WorkspaceRole): WorkspaceCollaborationAccess;
+export declare function workspaceRoleToCollaborationAccess(role: WorkspaceRole): WorkspaceCollaborationAccess;
 /** Map a workspace role to its corresponding sandbox workspace role */
-declare function workspaceRoleToSandboxRole(role: WorkspaceRole): SandboxWorkspaceRole;
-
-export { type AssignableWorkspaceRole as A, type OrganizationRole as O, type SandboxWorkspaceRole as S, WORKSPACE_ROLES as W, ASSIGNABLE_WORKSPACE_ROLES as a, ORGANIZATION_ROLES as b, ORGANIZATION_ROLE_RANK as c, WORKSPACE_ROLE_RANK as d, type WorkspaceCollaborationAccess as e, type WorkspaceRole as f, canManageWorkspaceMemberRole as g, hasOrganizationRole as h, hasWorkspaceRole as i, isAssignableWorkspaceRole as j, workspaceRoleToSandboxRole as k, organizationRoleGrantsWorkspaceOwner as o, resolveWorkspaceRole as r, workspaceRoleToCollaborationAccess as w };
+export declare function workspaceRoleToSandboxRole(role: WorkspaceRole): SandboxWorkspaceRole;

package/dist/teams-react/components/BrandMark.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Load the canonical Tangle knot only when a teams surface renders it.
+ * `/brand` imports the optional `@tangle-network/brand` peer, so a failed load
+ * renders a fixed-size spacer instead of crashing the panel.
+ */
+export interface BrandMarkProps {
+    size: number;
+    className?: string;
+}
+export declare function BrandMark({ size, className }: BrandMarkProps): import("react").JSX.Element;

package/dist/teams-react/components/InvitationsPanel.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Email-invitation panel: invite by email + role, and a history of every
+ * invitation (pending / accepted / expired / revoked) with its email-delivery
+ * status. Pending rows expose copy-link / resend / revoke. Fully callback-driven
+ * — the host supplies the data and the async `onInvite` / `onResend` / `onRevoke`
+ * callbacks (backed by `./teams/invitations-api`), so this imports no app router,
+ * fetch client, or toast. Styled with the shipped Tangle Quiet tokens (`var(--*)`).
+ *
+ * Mount alongside a list-only `MembersPanel` (`showInviteForm={false}`): the
+ * members panel shows accepted members, this owns the invite flow + pending list.
+ */
+import type { InvitationsPanelProps } from '../contracts';
+export declare function InvitationsPanel({ invitations, currentRole, onInvite, onResend, onRevoke, onCopy, onNotice, }: InvitationsPanelProps): import("react").JSX.Element;

package/dist/teams-react/components/InviteAcceptPage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Invite-accept surface for `/invite/:token`. Renders the invite state (valid /
+ * invalid / already-accepted), handles the signed-out path (sign in or create
+ * an account with the invited email), the email-mismatch path (switch account),
+ * and the accept action. Callback-driven: the host supplies the resolved
+ * `details` and `onAccept` / `onNavigate`, so this imports no app router or
+ * fetch client. Styled with the shipped Tangle Quiet tokens (`var(--*)`).
+ */
+import type { InviteAcceptPageProps } from '../contracts';
+export declare function InviteAcceptPage({ details, onAccept, onNavigate, onResendVerification }: InviteAcceptPageProps): import("react").JSX.Element;

package/dist/teams-react/components/MembersPanel.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Workspace members panel: list members, invite by email + role, change a
+ * member's role, remove a member. Fully callback-driven — the host supplies the
+ * data and the async `onInvite`/`onChangeRole`/`onRemove` callbacks (backed by
+ * `./teams/members-api`), so this imports no app router, fetch client, or toast.
+ * Styled with the shipped Tangle Quiet tokens (`var(--*)`).
+ *
+ * Role gating mirrors the API: only admins/owners see role selects and the
+ * remove control; inherited org owners and explicit owners are not editable
+ * here (org-level concern). The invite role select offers `admin` only to
+ * admins/owners.
+ */
+import type { MembersPanelProps } from '../contracts';
+export declare function MembersPanel({ members, currentRole, onInvite, onChangeRole, onRemove, onNotice, showInviteForm, }: MembersPanelProps): import("react").JSX.Element;

package/dist/teams-react/components/RoleSelect.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared role dropdown for the teams panels — the popover-listbox pattern the
+ * design system requires in place of a native `<select>` (same contract as the
+ * design-canvas Toolbar's SelectControl: bordered trigger, chevron glyph, and a
+ * `role="listbox"` panel on the L3 popover surface with click-outside /
+ * Escape-to-close). Both panels assign from the same workspace-role set, so the
+ * options live here too.
+ */
+import type { WorkspaceRole } from '../../teams/roles';
+export interface RoleSelectProps {
+    value: WorkspaceRole;
+    onChange(role: WorkspaceRole): void;
+    /** Accessible name (no visible label — the panels label the row). */
+    ariaLabel: string;
+    disabled?: boolean;
+}
+export declare function RoleSelect({ value, onChange, ariaLabel, disabled }: RoleSelectProps): import("react").JSX.Element;

package/dist/teams-react/components/index.d.ts

@@ -0,0 +1,3 @@
+export * from './MembersPanel';
+export * from './InvitationsPanel';
+export * from './InviteAcceptPage';

package/dist/teams-react/contracts.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Seams between the teams React surface and the host app. Everything here is
+ * interface-only and callback-driven: the components never import an app's
+ * router, fetch client, or toast system. The host passes data in and supplies
+ * the async callbacks (which it backs with `./teams/members-api` or
+ * `./teams/invitations-api` over fetch), so the same panel mounts in any app.
+ */
+import type { WorkspaceRole } from '../teams/roles';
+import type { InvitationEmailStatus, InvitationPermission, InvitationStatus } from '../teams/invitations';
+/** One member row as the panel renders it — the shape `members-api` returns. */
+export interface MemberView {
+    id: string;
+    userId: string | null;
+    role: WorkspaceRole;
+    name: string | null;
+    email: string | null;
+    /** null/undefined = pending invite (not yet accepted). */
+    acceptedAt?: Date | number | null;
+    /** true = inherited org owner/admin access (managed at the org level). */
+    inherited?: boolean;
+}
+/** Define properties and callbacks for managing members and their roles in a workspace panel */
+export interface MembersPanelProps {
+    members: MemberView[];
+    /** The viewer's effective role — gates which controls are interactive. */
+    currentRole: WorkspaceRole;
+    /** Invite a member; resolve with the shareable invite URL (or void). */
+    onInvite(input: {
+        email: string;
+        role: WorkspaceRole;
+    }): Promise<{
+        inviteUrl?: string;
+    } | void>;
+    /** Change a member's role. */
+    onChangeRole(input: {
+        memberId: string;
+        role: WorkspaceRole;
+    }): Promise<void>;
+    /** Remove a member. */
+    onRemove(input: {
+        memberId: string;
+    }): Promise<void>;
+    /** Optional toast/notice hook; defaults to a no-op (host owns its UX). */
+    onNotice?(notice: {
+        kind: 'success' | 'error';
+        message: string;
+    }): void;
+    /**
+     * Show the built-in invite form. Default `true`. An app that drives invites
+     * through `InvitationsPanel` (the rich email flow) sets this `false` so the
+     * members panel is list-only and the two don't present competing invite UIs.
+     */
+    showInviteForm?: boolean;
+}
+/** One invitation row as `InvitationsPanel` renders it — the shape `invitations-api` returns. */
+export interface InvitationView {
+    id: string;
+    email: string;
+    permissions: InvitationPermission;
+    status: InvitationStatus;
+    emailStatus: InvitationEmailStatus;
+    /** Date | epoch-ms | ISO string — normalized to a Date for display. */
+    expiresAt: Date | number | string;
+    /** Shareable accept link, for copy-to-clipboard. */
+    inviteUrl: string;
+}
+/** Define properties and callbacks for managing workspace invitations and user roles */
+export interface InvitationsPanelProps {
+    invitations: InvitationView[];
+    /** The viewer's effective role — gates whether the invite controls are interactive. */
+    currentRole: WorkspaceRole;
+    /** Create an invitation (sends the email); resolve with the shareable URL (or void). */
+    onInvite(input: {
+        email: string;
+        role: WorkspaceRole;
+    }): Promise<{
+        inviteUrl?: string;
+    } | void>;
+    /** Resend the invitation email. */
+    onResend(input: {
+        invitationId: string;
+    }): Promise<void>;
+    /** Revoke a pending invitation. */
+    onRevoke(input: {
+        invitationId: string;
+    }): Promise<void>;
+    /** Copy the invite link; defaults to `navigator.clipboard.writeText`. */
+    onCopy?(input: {
+        inviteUrl: string;
+    }): void | Promise<void>;
+    /** Optional toast/notice hook; defaults to a no-op (host owns its UX). */
+    onNotice?(notice: {
+        kind: 'success' | 'error';
+        message: string;
+    }): void;
+}
+/** Define possible statuses for the acceptance state of an invitation */
+export type InviteAcceptStatus = 'pending' | 'invalid' | 'already-accepted' | 'expired' | 'revoked';
+/** Describe details of an accepted invite including status, workspace, inviter, role, emails, and expiration */
+export interface InviteAcceptDetails {
+    status: InviteAcceptStatus;
+    /** Workspace the invite grants access to. */
+    workspaceName?: string | null;
+    /** Who sent it, if known. */
+    inviterName?: string | null;
+    /** Role the invite grants. */
+    role?: WorkspaceRole | null;
+    /** Email the invite was addressed to. */
+    inviteEmail?: string | null;
+    /** The signed-in user's email, or null if not signed in. */
+    currentUserEmail?: string | null;
+    /** When the invite expires (for display). Date | epoch-ms | ISO string. */
+    expiresAt?: Date | number | string | null;
+    /** True when the signed-in user must verify their email before they can accept. */
+    needsEmailVerification?: boolean;
+}
+/** Define properties and callbacks for handling invite acceptance and navigation actions on the invite page */
+export interface InviteAcceptPageProps {
+    details: InviteAcceptDetails;
+    /** Accept the invite; resolve with the workspace to navigate to. */
+    onAccept(): Promise<{
+        workspaceId?: string;
+    } | void>;
+    /** Navigate (sign in / sign up / switch account / open app). */
+    onNavigate(target: {
+        kind: 'sign-in' | 'sign-up' | 'switch-account' | 'open-app';
+        workspaceId?: string;
+    }): void;
+    /**
+     * Resend the verification email. Only invoked on the `needsEmailVerification`
+     * branch; an app without email verification omits it and that branch never shows.
+     */
+    onResendVerification?(): Promise<void>;
+}