@thinkai/tai-api-contract 2.70.0 → 2.71.0

package/src/generated/openapi.ts

@@ -356,7 +356,7 @@ export interface paths {
         put?: never;
         /**
          * Invite member to workspace
-         * @description Workspace admin only. Upserts `tai_users` by email and adds or reactivates `tai_workspace_members`. Idempotent when the email is already an active member: returns **201** with the existing row and **does not change** their role if the request body role differs. Does not send email; optional `tai_workspace_invitations` row may be recorded (no accept/link flow yet).
+         * @description Workspace admin only. Creates or refreshes a **pending** `tai_workspace_invitations` row and emails an accept link; it does **not** create `tai_workspace_members`. Membership is granted only by `POST /invitations/{token}/accept`. Applies to new and existing platform users alike. Idempotent when the email is already an active member: returns **201** with `outcome: "already_member"` and the existing row, **does not change** their role if the request body role differs, and sends no email. Re-inviting a pending email refreshes the token and 7-day expiry (the previous link stops working). When SMTP is not configured the invitation is still created and a warning is logged.
          */
         post: operations["inviteTenantMember"];
         delete?: never;
@@ -389,6 +389,86 @@ export interface paths {
         patch: operations["updateTenantMemberRole"];
         trace?: never;
     };
+    "/workspaces/{workspaceId}/invitations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending workspace invitations
+         * @description Workspace admin only. Returns invitations still awaiting a decision so the team settings page can show "pending" alongside active members. Rows whose `expiresAt` has passed are flipped to `expired` on read and omitted.
+         */
+        get: operations["listWorkspaceInvitations"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invitations/{token}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Preview a workspace invitation (public)
+         * @description **Unauthenticated.** Lets the SPA render the invite landing page before the invitee has signed in. The invited email is **masked** (`j••••e@example.com`) so a leaked link does not disclose an address. Returns `404` with a generic message for unknown, revoked, or rejected tokens; a past-due `pending` invitation is flipped to `expired` and returned with that status so the SPA can show a stable message.
+         */
+        get: operations["getWorkspaceInvitationPreview"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invitations/{token}/accept": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Accept a workspace invitation
+         * @description Requires a Supabase JWT whose email matches the invited email. Creates the `tai_workspace_members` row with the invited role and closes the invitation as `accepted`. This is the **only** path that grants workspace membership — signing up alone never does. Idempotent: re-accepting your own accepted invitation returns `200` unchanged.
+         */
+        post: operations["acceptWorkspaceInvitation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invitations/{token}/reject": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline a workspace invitation
+         * @description Requires a Supabase JWT whose email matches the invited email — anonymous decline with only the token is not allowed. Closes the invitation as `rejected` and creates no member row. Idempotent for an already-rejected invitation.
+         */
+        post: operations["rejectWorkspaceInvitation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/{workspaceId}/org-chart/status": {
         parameters: {
             query?: never;
@@ -3099,6 +3179,54 @@ export interface components {
             /** @enum {string} */
             role: "admin" | "editor" | "viewer";
         };
+        /**
+         * @description `revoked` is an admin cancelling the invitation; `rejected` is the invitee declining it. Both leave the invitee outside the workspace.
+         * @enum {string}
+         */
+        WorkspaceInvitationStatusDto: "pending" | "accepted" | "expired" | "revoked" | "rejected";
+        /** @description Workspace invitation as seen by an authenticated admin or invitee. */
+        WorkspaceInvitationDto: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            workspaceId: string;
+            workspaceName: string;
+            /** @description Invited email address. */
+            email: string;
+            /** @enum {string} */
+            role: "admin" | "editor" | "viewer";
+            status: components["schemas"]["WorkspaceInvitationStatusDto"];
+            invitedByName?: string | null;
+            invitedByEmail?: string | null;
+            /** Format: date-time */
+            expiresAt: string;
+            /** Format: date-time */
+            createdAt: string;
+            /** Format: date-time */
+            acceptedAt?: string | null;
+        };
+        /** @description Unauthenticated invitation preview. `maskedEmail` is the only view of the invited address; compare it to the signed-in account client-side before calling accept. */
+        WorkspaceInvitationPreviewDto: {
+            workspaceName: string;
+            /** @enum {string} */
+            role: "admin" | "editor" | "viewer";
+            status: components["schemas"]["WorkspaceInvitationStatusDto"];
+            /** @example j••••e@example.com */
+            maskedEmail: string;
+            invitedByName?: string | null;
+            /** Format: date-time */
+            expiresAt: string;
+        };
+        WorkspaceInvitationListDto: {
+            invitations: components["schemas"]["WorkspaceInvitationDto"][];
+        };
+        /** @description Discriminated on `outcome`. `invited` carries the new pending invitation; `already_member` carries the existing membership row unchanged. */
+        InviteTeamMemberResultDto: {
+            /** @enum {string} */
+            outcome: "invited" | "already_member";
+            invitation?: components["schemas"]["WorkspaceInvitationDto"];
+            member?: components["schemas"]["TeamMemberDto"];
+        };
         /** @description Granular person erasure categories. All default to true when omitted. */
         EraseInsightsPersonBodyDto: {
             /** @description Remove the person node from `tai_workspace_config.org_chart`. */
@@ -6216,7 +6344,7 @@ export interface components {
          * @description Type of workspace lifecycle event.
          * @enum {string}
          */
-        ActivityLogEventTypeDto: "repo.added" | "repo.removed" | "repo.readded" | "integration.github.added" | "integration.github.updated" | "integration.github.removed" | "integration.github.permissions_changed" | "integration.github.repo_added" | "integration.github.repo_removed" | "fix.requested" | "fix.generating" | "fix.pr_created" | "fix.merged" | "fix.failed" | "readiness.scan_started" | "readiness.scan_completed" | "readiness.scan_failed" | "readiness.scan_partial" | "integrations.agent_execution.provider_changed" | "integrations.repo_eligibility.overrides_changed" | "integrations.repo_eligibility.languages_refresh_requested" | "integrations.cursor.platform_key_enabled" | "integrations.cursor.platform_key_disabled" | "member.invited" | "member.role_changed" | "member.removed" | "hris.personio.sync_started" | "hris.personio.sync_completed" | "hris.personio.sync_failed" | "hris.zenhr.sync_started" | "hris.zenhr.sync_completed" | "hris.zenhr.sync_failed" | "hris.zelt.sync_started" | "hris.zelt.sync_completed" | "hris.zelt.sync_failed" | "hris.sync_started" | "hris.sync_completed" | "hris.sync_failed" | "repo.sync_skipped" | "integrations.cursor.execution_key.added" | "integrations.cursor.execution_key.updated" | "integrations.cursor.execution_key.removed" | "integrations.cursor.execution_key.check_failed" | "integrations.cursor.admin_key.added" | "integrations.cursor.admin_key.updated" | "integrations.cursor.admin_key.removed" | "integrations.claude.execution_key.added" | "integrations.claude.execution_key.updated" | "integrations.claude.execution_key.removed" | "integrations.claude.execution_key.check_failed" | "integrations.claude.admin_key.added" | "integrations.claude.admin_key.updated" | "integrations.claude.admin_key.removed" | "integrations.claude.analytics_key.added" | "integrations.claude.analytics_key.updated" | "integrations.claude.analytics_key.removed" | "readiness.scan_precheck_failed" | "productivity.ingest.completed" | "productivity.ingest.failed" | "productivity.ingest.skipped" | "productivity.ingest.repo_skipped" | "productivity.ingest.coverage_gap_detected" | "integrations.newrelic.added" | "integrations.newrelic.removed" | "integrations.newrelic.sync_completed" | "integrations.newrelic.sync_failed" | "integrations.prometheus.added" | "integrations.prometheus.removed" | "integrations.prometheus.sync_completed" | "integrations.prometheus.sync_failed" | "integrations.grafana.added" | "integrations.grafana.removed" | "integrations.grafana.sync_completed" | "integrations.grafana.sync_failed" | "integrations.zelt.added" | "integrations.zelt.removed";
+        ActivityLogEventTypeDto: "repo.added" | "repo.removed" | "repo.readded" | "integration.github.added" | "integration.github.updated" | "integration.github.removed" | "integration.github.permissions_changed" | "integration.github.repo_added" | "integration.github.repo_removed" | "fix.requested" | "fix.generating" | "fix.pr_created" | "fix.merged" | "fix.failed" | "readiness.scan_started" | "readiness.scan_completed" | "readiness.scan_failed" | "readiness.scan_partial" | "integrations.agent_execution.provider_changed" | "integrations.repo_eligibility.overrides_changed" | "integrations.repo_eligibility.languages_refresh_requested" | "integrations.cursor.platform_key_enabled" | "integrations.cursor.platform_key_disabled" | "member.invited" | "member.invite_accepted" | "member.invite_rejected" | "member.role_changed" | "member.removed" | "hris.personio.sync_started" | "hris.personio.sync_completed" | "hris.personio.sync_failed" | "hris.zenhr.sync_started" | "hris.zenhr.sync_completed" | "hris.zenhr.sync_failed" | "hris.zelt.sync_started" | "hris.zelt.sync_completed" | "hris.zelt.sync_failed" | "hris.sync_started" | "hris.sync_completed" | "hris.sync_failed" | "repo.sync_skipped" | "integrations.cursor.execution_key.added" | "integrations.cursor.execution_key.updated" | "integrations.cursor.execution_key.removed" | "integrations.cursor.execution_key.check_failed" | "integrations.cursor.admin_key.added" | "integrations.cursor.admin_key.updated" | "integrations.cursor.admin_key.removed" | "integrations.claude.execution_key.added" | "integrations.claude.execution_key.updated" | "integrations.claude.execution_key.removed" | "integrations.claude.execution_key.check_failed" | "integrations.claude.admin_key.added" | "integrations.claude.admin_key.updated" | "integrations.claude.admin_key.removed" | "integrations.claude.analytics_key.added" | "integrations.claude.analytics_key.updated" | "integrations.claude.analytics_key.removed" | "readiness.scan_precheck_failed" | "productivity.ingest.completed" | "productivity.ingest.failed" | "productivity.ingest.skipped" | "productivity.ingest.repo_skipped" | "productivity.ingest.coverage_gap_detected" | "integrations.newrelic.added" | "integrations.newrelic.removed" | "integrations.newrelic.sync_completed" | "integrations.newrelic.sync_failed" | "integrations.prometheus.added" | "integrations.prometheus.removed" | "integrations.prometheus.sync_completed" | "integrations.prometheus.sync_failed" | "integrations.grafana.added" | "integrations.grafana.removed" | "integrations.grafana.sync_completed" | "integrations.grafana.sync_failed" | "integrations.zelt.added" | "integrations.zelt.removed";
         ActivityLogActorDto: {
             /** Format: uuid */
             userId: string;
@@ -6771,6 +6899,8 @@ export interface components {
         NotificationId: string;
         /** @description Workspace member user id (`tai_users.id`). */
         WorkspaceMemberId: string;
+        /** @description Opaque workspace invitation token from the emailed accept link. Only its SHA-256 hash is stored server-side; the plaintext is shown exactly once, in the email. */
+        WorkspaceInvitationToken: string;
         /** @description Privacy request id (`tai_privacy_requests.id`). */
         PrivacyRequestId: string;
         FixId: string;
@@ -6836,6 +6966,11 @@ export type TeamMemberDto = components['schemas']['TeamMemberDto'];
 export type TeamMemberListDto = components['schemas']['TeamMemberListDto'];
 export type InviteTeamMemberBodyDto = components['schemas']['InviteTeamMemberBodyDto'];
 export type UpdateTeamMemberRoleBodyDto = components['schemas']['UpdateTeamMemberRoleBodyDto'];
+export type WorkspaceInvitationStatusDto = components['schemas']['WorkspaceInvitationStatusDto'];
+export type WorkspaceInvitationDto = components['schemas']['WorkspaceInvitationDto'];
+export type WorkspaceInvitationPreviewDto = components['schemas']['WorkspaceInvitationPreviewDto'];
+export type WorkspaceInvitationListDto = components['schemas']['WorkspaceInvitationListDto'];
+export type InviteTeamMemberResultDto = components['schemas']['InviteTeamMemberResultDto'];
 export type EraseInsightsPersonBodyDto = components['schemas']['EraseInsightsPersonBodyDto'];
 export type EraseInsightsPersonResultDto = components['schemas']['EraseInsightsPersonResultDto'];
 export type OrgChartNodeDto = components['schemas']['OrgChartNodeDto'];
@@ -7182,6 +7317,7 @@ export type ParameterProviderSlug = components['parameters']['ProviderSlug'];
 export type ParameterProjectId = components['parameters']['ProjectId'];
 export type ParameterNotificationId = components['parameters']['NotificationId'];
 export type ParameterWorkspaceMemberId = components['parameters']['WorkspaceMemberId'];
+export type ParameterWorkspaceInvitationToken = components['parameters']['WorkspaceInvitationToken'];
 export type ParameterPrivacyRequestId = components['parameters']['PrivacyRequestId'];
 export type ParameterFixId = components['parameters']['FixId'];
 export type ParameterInsightsProductivityRangeId = components['parameters']['InsightsProductivityRangeId'];
@@ -8225,13 +8361,13 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Invited member row */
+            /** @description Pending invitation, or the existing member row when already a member */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["TeamMemberDto"];
+                    "application/json": components["schemas"]["InviteTeamMemberResultDto"];
                 };
             };
             /** @description Invalid email or role */
@@ -8360,6 +8496,191 @@ export interface operations {
             };
         };
     };
+    listWorkspaceInvitations: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Pending invitations */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceInvitationListDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist or malformed workspaceId */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getWorkspaceInvitationPreview: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Opaque workspace invitation token from the emailed accept link. Only its SHA-256 hash is stored server-side; the plaintext is shown exactly once, in the email. */
+                token: components["parameters"]["WorkspaceInvitationToken"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Invitation preview */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceInvitationPreviewDto"];
+                };
+            };
+            /** @description Unknown or no longer available invitation */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    acceptWorkspaceInvitation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Opaque workspace invitation token from the emailed accept link. Only its SHA-256 hash is stored server-side; the plaintext is shown exactly once, in the email. */
+                token: components["parameters"]["WorkspaceInvitationToken"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Invitation accepted; caller is now a workspace member */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceInvitationDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Signed-in email does not match the invited email */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Unknown invitation token */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Invitation is no longer actionable */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Invitation expired */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    rejectWorkspaceInvitation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Opaque workspace invitation token from the emailed accept link. Only its SHA-256 hash is stored server-side; the plaintext is shown exactly once, in the email. */
+                token: components["parameters"]["WorkspaceInvitationToken"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Invitation declined */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceInvitationDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Signed-in email does not match the invited email */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Unknown invitation token */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Invitation was already accepted */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Invitation expired */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
     getWorkspaceOrgChartStatus: {
         parameters: {
             query?: never;