Task: the remaining v1 functions on v2 — activity sub-resource, invitations, data import, onboarding

Ticket of Desk v2 — REST API v2 everywhere. The shape is fixed in the resolution of the grilling on the remaining v1 functions; do not re-open it. Wrapper: @framework/ui/api (PR #42947, merged). Skills: /frappe-app-dev + /code-style for code, /quality-code-review in a fresh subagent before closing.

Question

Move the activity, invitations, data import and onboarding call sites onto v2 as ruled. Two PRs, with the framework half landing on desk-v2 beside the desk half and the develop PR opened as a held draft (map ruling 2026-09-18).

1. Framework half (frappe/api/v2.py, tests beside the other v2 route tests):

   • GET /document/<dt>/<name>/activity with types (the visible types list), and stream=emails|milestones plus start for the next page of one stream. The handler calls frappe.desk.form.activity.get_activity_timeline for the first page and the two get_more_* functions for a stream page, and returns the same keys as today (activities, has_more_emails, has_more_milestones, next_milestone_start).
   • User Invitation controller gains cancel and resend methods (moving the bodies of cancel_invitation and resend_invitation, with the same app-role gate), so the desk sends POST /document/User Invitation/<name>/method/cancel and .../resend on the existing doc-method route. The list read must return the child roles rows for each invitation; add roles to the fields the v2 list route can return for this DocType, or confirm fields=["roles.role"] already works. Check that the DocType's read permission matches the app-role gate the dotted functions use, and fix the permission, not the route, if it does not.
   • invite_by_email stays a dotted POST. The onboarding read stays a dotted GET and the onboarding write a dotted POST, with the write argument renamed from appName to app.
   • Data Import preview and start use the existing doc-method route: GET /document/Data Import/<name>/method/get_preview_from_template with import_file and google_sheets_url, and POST .../method/start_import. Confirm the route passes query arguments through to the method.

2. Desk and ui/ half on desk-v2:

   • ui/src/components/ActivityTimeline/useActivityTimeline.ts reads the activity sub-resource through the wrapper.
   • ui/src/components/InviteUser/useInviteUser.ts: pending list is listDocuments("User Invitation", …) filtered on status=Pending and app_name; cancel and resend are runDocumentMethod; invite is runMethod. The two frappe.client.get_list calls in the same file belong to the lists and search task (#42948) and are not touched here.
   • ui/src/components/DataImport/: preview and start go through runDocumentMethod; logs are listDocuments("Data Import Log", {filters: [["data_import","=",name]], …, limit}) with the same fields and order; the two getdoctype calls become getMeta(doctype, {include: "children"}) reading docs from the meta envelope. Template download and upload belong to the files task (#42992).
   • ui/src/components/Onboarding/onboarding.ts: both calls through runMethod.
   • Wrapper gains getDocumentPart(doctype, name, part, params) for sub-resource reads.

Done when both PRs are merged, no /api/method literal or frappe-ui fetch primitive remains in the files above, and the review gates ran.