@crossworks/client-types 0.232.317 → 0.232.319

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossworks/client-types",
-  "version": "0.232.317",
+  "version": "0.232.319",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/dto/access.ts

@@ -2,8 +2,9 @@
  * The Access control's wire shapes (`/api/access/nodes/:id`). One level
  * system: admin > team > client > public. A caller sees what is at or below
  * its level. The level is the truth and the item's share link follows it:
- * none at admin or team (members read team items with their own logins), an
- * open link at client and public. See docs/access-levels.md.
+ * none at admin or team (members read team items with their own logins) or
+ * client (signed-in clients, client logins C1), an open link at public. See
+ * docs/access-levels.md.
  */
 import type { ShareMode } from './rows';
 
@@ -92,3 +93,87 @@ export type AccessNodeUpdate = {
   stillBelow?: AccessItemView[];
   share: AccessLinkView | null;
 };
+
+// ── "What clients see" (client logins C1) ────────────────────────────────────
+
+/** A brain item a client-level item names but a client may not read: a
+ *  mention chip, a link or an embed pointing at a team or admin item (or at
+ *  something that is not the brain's). Its title reaches the client page as
+ *  a label unless the client view hides it. */
+export type ClientReportRef = {
+  id: string;
+  /** Null when the id names nothing the brain holds any more. */
+  type: string | null;
+  title: string | null;
+  /** The item's level; null when it is not a brain item (a personal item,
+   *  or gone). */
+  audience: AccessLevel | null;
+};
+
+/** One item at client level, as the report lists it. */
+export type ClientReportItem = {
+  id: string;
+  type: string;
+  title: string;
+  updatedAt: string;
+  /** Its live open link, made when client meant "anyone with the link":
+   *  still live until the old client links are retired. Null: none. */
+  link: {
+    id: string;
+    createdAt: string;
+    viewCount: number;
+    lastViewedAt: string | null;
+    expiresAt: string | null;
+  } | null;
+  /** Addresses a page was emailed to with the page tool (invite hints). */
+  emailedTo: string[];
+  /** What it names that a client may not read (see ClientReportRef). */
+  refsAbove: ClientReportRef[];
+};
+
+/** The newest acknowledgement of the report. */
+export type ClientReportAck = {
+  ackedAt: string;
+  /** The admin who acknowledged it (null: that login is gone). */
+  ackedBy: { id: string; name: string } | null;
+  /** How many client-level items the admin saw. */
+  itemCount: number;
+};
+
+/** GET /api/access/client-report: every item at client level, what each
+ *  carries, and whether an admin has acknowledged the list. Adding a client
+ *  login stays disabled until `acknowledged` (client logins C2). */
+export type ClientReport = {
+  items: ClientReportItem[];
+  /** All client-level items (the list stops at 2000). */
+  total: number;
+  acknowledgement: ClientReportAck | null;
+  /** An admin acknowledged the report and nothing has gone to client since. */
+  acknowledged: boolean;
+  /** Client-level items the newest acknowledgement did not include. */
+  newSinceAck: string[];
+};
+
+/** POST /api/access/client-report/ack { itemIds } -> the acknowledgement.
+ *  `itemIds`: the client-level items the admin saw on the report. */
+export type ClientReportAckResponse = { acknowledgement: ClientReportAck; acknowledged: boolean };
+
+/** GET /api/shares/all -> { shares: SharedLinkRow[] }: every live link,
+ *  newest first. */
+export type SharedLinkRow = {
+  id: string;
+  /** Server-relative: `/s/<token>`. */
+  path: string;
+  nodeId: string;
+  nodeType: string;
+  title: string;
+  icon: string | null;
+  mode: ShareMode;
+  cascade: boolean;
+  createdAt: string;
+  viewCount: number;
+  lastViewedAt: string | null;
+  /** The item's level (client logins C1): `client` marks an old link, from
+   *  when client meant an open link. Absent from brains before C1. */
+  level?: AccessLevel;
+};

package/src/dto/logins.ts

@@ -0,0 +1,21 @@
+/**
+ * Login roles on the wire (client logins, Phase C0). Three roles: an admin,
+ * a member (the team) and a client (a person at the brain's one client
+ * company). A route that is not for the caller's role answers 403 with one
+ * of the reasons below; a client never falls through to an admin answer.
+ */
+
+/** Who a login is. The brain reads it from the login row on every request. */
+export type LoginKind = 'admin' | 'member' | 'client';
+
+/** The `reason` of a 403 a gate answers a login of the wrong role with:
+ *  `member-login` from an admin route, `admin-login` from a member route,
+ *  `client-login` from any route that is not a client route. */
+export type LoginRefusedReason = 'member-login' | 'admin-login' | 'client-login';
+
+/** The body of that 403. */
+export type LoginRefused = {
+  error: 'forbidden';
+  reason: LoginRefusedReason;
+  message: string;
+};

package/src/dto/rows.ts

@@ -815,6 +815,15 @@ export interface OnboardingModelChoices {
  */
 export type ShareMode = 'public';
 
+/**
+ * Why a link was refused (the `reason` of a 400 from the share routes):
+ * `team-links-retired` for a team link (member logins Phase 6), and
+ * `client-links-retired` for any link on an item at client level (client
+ * logins C1): client means signed-in clients, and public is the only level
+ * with an open link.
+ */
+export type ShareRetiredReason = 'team-links-retired' | 'client-links-retired';
+
 export type TeamVisibleShare = {
   /** Share token — the workspace opens /s/<token>. */
   token: string;

package/src/index.ts

@@ -40,7 +40,13 @@ export type {
   AccessLoweredView,
   AccessNodeUpdate,
   AccessNodeView,
+  ClientReport,
+  ClientReportAck,
+  ClientReportAckResponse,
+  ClientReportItem,
+  ClientReportRef,
   MemberItemAuthor,
+  SharedLinkRow,
 } from './dto/access';
 export type {
   AdminSpaceItem,
@@ -89,6 +95,7 @@ export type {
   MemberInviteState,
 } from './dto/member-invites';
 export type { MemberItemKind } from './member-kinds';
+export type { LoginKind, LoginRefused, LoginRefusedReason } from './dto/logins';
 
 // Types only at the root; the runtime constants (APP_TINTS, limits) are the
 // `@mantle/client-types/app-nav` subpath.