@crossworks/client-types 0.239.100 → 0.300.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossworks/client-types",
-  "version": "0.239.100",
+  "version": "0.300.0",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/dto/access-keys.ts

@@ -2,8 +2,8 @@
  * Inbound API keys on the wire (migration 0232, plan page 1e62e204): the
  * Settings > API access screen, and the public API v1 answers about keys.
  *
- * A key acts as the ONE login that made it (admin, member or client) and
- * can only narrow it: `access` (read or read_write) and `areas` (null = every area). It is
+ * A key acts as the ONE login that made it, as that login is now, and can
+ * only narrow it: `access` (read or read_write) and `areas` (null = every area). It is
  * a Bearer on /api/v1/* and /api/mcp, nowhere else. The secret is in the
  * create answer once; no other answer carries it or its hash.
  *
@@ -31,7 +31,7 @@ export type AccessKeyArea = (typeof ACCESS_KEY_AREAS)[number];
 
 export type AccessKeyAccess = 'read' | 'read_write';
 
-export type AccessKeyRole = 'admin' | 'member' | 'client';
+export type AccessKeyRole = 'admin' | 'member';
 
 export type AccessKeyStatus = 'active' | 'expired' | 'revoked';
 
@@ -46,7 +46,8 @@ export type AccessKeyView = {
   access: AccessKeyAccess;
   /** null = every area. */
   areas: AccessKeyArea[] | null;
-  /** An admin key on /api/mcp: risky tools allowed by name. */
+  /** A key of a login in Admin with the keys area, on /api/mcp: risky
+   *  tools allowed by name (the admin gate still decides each call). */
   riskyTools: string[];
   status: AccessKeyStatus;
   /** ISO time; null = never expires. */
@@ -58,21 +59,20 @@ export type AccessKeyView = {
   revokedAt: string | null;
 };
 
-/** GET /api/access-keys. A member or client gets their own keys; an
- *  admin gets every key on the brain. */
+/** GET /api/access-keys. A member gets their own keys; an admin gets every
+ *  key on the brain. */
 export type AccessKeyList = {
   keys: AccessKeyView[];
-  /** The caller's role: an admin may name risky tools, and sees every key. */
+  /** The caller's kind: an admin sees every key. */
   role: AccessKeyRole;
   areas: AccessKeyArea[];
   /** The expiry a key gets when the create names none. */
   defaultExpiryDays: number;
   /** The longest expiry the caller may pick, in days; null = any, "never"
-   *  included (an admin). A member's keys last at most 90 days, a client's
-   *  30. */
+   *  included: a login in the Admin workspace with its keys area (W8a, never
+   *  the role). Everyone else's keys last at most 90 days. */
   maxExpiryDays: number | null;
-  /** Whether the create needs the caller's password (an admin or member;
-   *  a client has none). */
+  /** Whether the create needs the caller's password: always since W8a. */
   needsPassword: boolean;
 };
 
@@ -85,7 +85,7 @@ export type AccessKeyCreateInput = {
   areas: AccessKeyArea[] | null;
   /** Omitted = the default (90); null = never; else 1 to 3650 days. */
   expiresInDays?: number | null;
-  /** Only for an admin's own key. */
+  /** Only for a login in the Admin workspace with its keys area (W8a). */
   riskyTools?: string[];
   /** The caller's password, when `needsPassword` (never stored, never
    *  logged). */

package/src/dto/access.ts

@@ -13,12 +13,12 @@ import type { AccessContactShare } from './contact-shares';
 export const ACCESS_LEVELS = ['admin', 'team', 'client', 'public'] as const;
 export type AccessLevel = (typeof ACCESS_LEVELS)[number];
 
-/** One item as the Access control lists it (the item itself or its closure). */
+/** One item as the old Access control listed it (gone since W5b2: the
+ *  routes answer 410). Its level went from the wire in W8c. */
 export type AccessItemView = {
   id: string;
   type: string;
   title: string;
-  audience: AccessLevel;
 };
 
 /** The item's link. `path` is server-relative (`/s/<token>`). */
@@ -129,9 +129,8 @@ export type AccessLoweredView = {
   to: AccessLevel;
 };
 
-/** PATCH /api/access/nodes/:id { audience, withClosure?, raiseClosure? }.
- *  `withClosure` only matters for a folder (its contents); a page's,
- *  drawing's or note's embeds always follow it down. */
+/** The old PATCH /api/access/nodes/:id (gone since W5b2: 410).
+ *  `withClosure` only mattered for a folder (its contents). */
 export type AccessNodeUpdate = {
   item: AccessItemView;
   /** Everything lowered with it, at its new level: the embeds that followed
@@ -177,9 +176,6 @@ export type ClientReportRef = {
    *  is not the brain's (a personal item), whose title is never shown. */
   type: string | null;
   title: string | null;
-  /** The item's level; null when it is not a brain item (a personal item,
-   *  or gone). */
-  audience: AccessLevel | null;
 };
 
 /** One item at client level, as the report lists it. */

package/src/dto/agent-graph.ts

@@ -9,8 +9,6 @@
  * public surface is byte-identical — only the file a symbol lives in moved.
  */
 
-import type { AccessLevel } from './access';
-
 // ── Skills ────────────────────────────────────────────────────────────────────
 
 /** A skill as returned by `GET /api/skills`. */
@@ -197,15 +195,6 @@ export interface ToolGroupDTO {
   /** Set when the group is an API integration; null for capability-only bundles. */
   integration: ToolGroupIntegrationDTO | null;
   enabled: boolean;
-  /** The group's level: an agent or a team app may hold it only at or above
-   *  it, and team apps call only built-in tools in an enabled group at team
-   *  level or below. A CONNECTOR group's level also decides who may use its
-   *  tools in apps and over their own MCP (team apps Phase 2): members at
-   *  team level or lower, clients at client level, contact links at
-   *  public; single http tools follow External access. Absent from servers
-   *  before it shipped. Set it with
-   *  `PATCH /api/access/tool-groups/:slug { audience }`. */
-  audience?: AccessLevel;
   createdAt: string;
   updatedAt: string;
 }

package/src/dto/logins.ts

@@ -1,17 +1,17 @@
 /**
- * Login roles on the wire (client logins, Phase C0). Three roles: an admin,
- * a member (the team) and a client (a person at the brain's one client
- * company). A route that is not for the caller's role answers 403 with one
- * of the reasons below; a client never falls through to an admin answer.
+ * Login kinds on the wire. Two: an admin and a member. The client login and
+ * its email-code sign-in went in workspaces W8a: a login carries no
+ * permission of its own, what it reads and may do comes from its
+ * workspaces. A route that is not for the caller's kind answers 403 with
+ * one of the reasons below.
  */
 
 /** Who a login is. The brain reads it from the login row on every request. */
-export type LoginKind = 'admin' | 'member' | 'client';
+export type LoginKind = 'admin' | 'member';
 
-/** The `reason` of a 403 a gate answers a login of the wrong role with:
- *  `member-login` from an admin route, `admin-login` from a member route,
- *  `client-login` from any route that is not a client route. */
-export type LoginRefusedReason = 'member-login' | 'admin-login' | 'client-login';
+/** The `reason` of a 403 a gate answers a login of the wrong kind with:
+ *  `member-login` from an admin route, `admin-login` from a member route. */
+export type LoginRefusedReason = 'member-login' | 'admin-login';
 
 /** The body of that 403. */
 export type LoginRefused = {
@@ -21,8 +21,8 @@ export type LoginRefused = {
 };
 
 /** The 400 POST /api/users/:id/password answers when the target does not sign
- *  in with a password: a client (a link or a code) or a role this brain does
- *  not know. An admin's or a member's password can be reset. */
+ *  in with a password: a role this brain does not know. An admin's or a
+ *  member's password can be reset. */
 export type PasswordResetRefused = {
   error: string;
   reason: 'not-a-password-login';

package/src/dto/member-apps.ts

@@ -86,13 +86,12 @@ export type MemberChatRow = {
   name: string;
   email: string;
   /** False when the login is disabled or no longer a member (its old
-   *  thread still shows). Always false for a client: a client is never a
-   *  team member (client logins audit B26). */
+   *  thread still shows). */
   active: boolean;
-  /** The login's role, named (0.232.333 on): 'member' for the team; 'client'
-   *  for a client login with a chat thread, which is NOT a team member; absent
-   *  for a former member who is an admin now (its old thread still shows). */
-  role?: 'member' | 'client';
+  /** The login's role, named (0.232.333 on): 'member' for the team; absent
+   *  for a former member who is an admin now (its old thread still shows).
+   *  (No login is a client since workspaces W8a.) */
+  role?: 'member';
   lastMessageAt: string | null;
   lastMessageText: string | null;
   lastMessageDirection: 'inbound' | 'outbound' | null;

package/src/dto/rows.ts

@@ -11,7 +11,6 @@
  */
 
 import type { AppNav, AppOpenStat, AppTint } from '../app-nav';
-import type { AccessLevel } from './access';
 import type { ListChips, ListWorkspace } from './grants';
 
 // ── Row/DTO shapes moved from the server packages (jackdaw split P0) ─────────
@@ -138,8 +137,6 @@ export type PageRow = {
   summary: string | null;
   visibility: PageVisibility;
   width: PageWidth;
-  /** Access level (admin > team > client > public); the owner UI's badge. */
-  audience: AccessLevel;
   /** A read-only snapshot copy of an accepted item (data.snapshot_of,
    *  workspaces W6b fix round 1): nobody edits it, moves it out of its
    *  private workspace or shares it; its author may delete it. Absent on
@@ -189,14 +186,6 @@ export type AppRow = {
   shareMode: ShareMode | null;
   /** Whether this app is the designated Team Hub (prefs.teamHubAppId). */
   isHub: boolean;
-  /** The old access level badge. Not sent since workspaces W5b2 (grants
-   *  decide who reads an app: the list's `workspaces` chips and `hasLink`);
-   *  the field goes in W8. */
-  audience?: AccessLevel;
-  /** Not sent since W5b2 (with the level badge). */
-  inherited?: 'team' | 'client' | null;
-  /** Not sent since W5b2 (with the level badge). */
-  embedded?: 'team' | 'client' | null;
   /** A live open public link exists (not revoked, not expired): the
    *  "Public" pill. Absent from a brain before W5b2. */
   hasLink?: boolean;

package/src/dto/shell.ts

@@ -10,7 +10,7 @@ import type { TreeKind } from '../tree';
 import type { ShellWorkspace, WorkspaceArea } from './workspaces';
 
 /** Who is signed in, by role. */
-export type ShellRole = 'admin' | 'member' | 'client';
+export type ShellRole = 'admin' | 'member';
 
 /** What this brain can do, so a client branches on capability, not version. */
 export type ShellFeatures = { recallV2: boolean };

package/src/dto/workspaces.ts

@@ -166,7 +166,7 @@ export type ShellWorkspaces = { workspaces: ShellWorkspace[]; areas: WorkspaceAr
  * `brainId` is left out only while the database is behind the code.
  */
 export type AuthWhoami = {
-  role: 'admin' | 'member' | 'client';
+  role: 'admin' | 'member';
   loginId: string;
   email: string;
   displayName: string | null;

package/src/tree.ts

@@ -75,11 +75,6 @@ export type TreeKindSpec = {
   shareable: boolean;
   /** The item orders offered, the first being the default. */
   sorts: readonly TreeSort[];
-  /** Which levels a folder of this kind may be shared at. Absent means both
-   *  of TREE_SHARE_LEVELS. Recall is team-only: a client agent matching the
-   *  owner's prompts is the case the Recall v1 plan deferred. Enforced where
-   *  folders are shared (phase 4). */
-  shareLevels?: readonly TreeShareLevel[];
 };
 
 export const TREE_KIND_SPECS: Readonly<Record<TreeKind, TreeKindSpec>> = {
@@ -162,15 +157,14 @@ export const TREE_KIND_SPECS: Readonly<Record<TreeKind, TreeKindSpec>> = {
   },
   // The tree lists maps only; a map's cards are recall_nodes rows, never
   // nodes, so they never appear as items.
-  // Not shareable YET: team sharing is Recall R6, which adds the recall root
-  // to nodes_share_level_ck and the type to mantle_workspace_kind(). Until
-  // then the database refuses the share, so the tree must not offer it.
+  // Not shareable YET: a map is granted beyond Admin only once Recall R6
+  // lets a workspace's assistant read maps. Until then the tree must not
+  // offer it.
   recall: {
     kind: 'recall',
     root: 'recall',
     nodeType: 'recall',
     shareable: false,
-    shareLevels: ['team'],
     sorts: ['name', 'updated'],
   },
 };