@greensecurity/javascript-sdk 0.45.0-beta.22 → 0.45.0-beta.23

package/src/react-query/medicalProductsListAllManufacturers.ts

@@ -84,6 +84,8 @@ export type MedicalProductsListAllManufacturersQueryError =
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function useMedicalProductsListAllManufacturers(
   request: operations.ListAllManufacturersRequest,
@@ -119,6 +121,8 @@ export function useMedicalProductsListAllManufacturers(
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function useMedicalProductsListAllManufacturersSuspense(
   request: operations.ListAllManufacturersRequest,
@@ -154,6 +158,8 @@ export function useMedicalProductsListAllManufacturersSuspense(
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function useMedicalProductsListAllManufacturersInfinite(
   request: operations.ListAllManufacturersRequest,
@@ -203,6 +209,8 @@ export function useMedicalProductsListAllManufacturersInfinite(
  * Sortable by id, name, country, status, created_at and updated_at.
  *
  * Requires the `manufacturers` / `view` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.view` permission.
  */
 export function useMedicalProductsListAllManufacturersInfiniteSuspense(
   request: operations.ListAllManufacturersRequest,

package/src/react-query/medicalProductsListAllMedicalProductCategories.ts

@@ -84,6 +84,8 @@ export type MedicalProductsListAllMedicalProductCategoriesQueryError =
  * Sortable by id, name, sort_order, created_at and updated_at.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductCategories(
   request: operations.ListAllMedicalProductCategoriesRequest,
@@ -119,6 +121,8 @@ export function useMedicalProductsListAllMedicalProductCategories(
  * Sortable by id, name, sort_order, created_at and updated_at.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductCategoriesSuspense(
   request: operations.ListAllMedicalProductCategoriesRequest,
@@ -154,6 +158,8 @@ export function useMedicalProductsListAllMedicalProductCategoriesSuspense(
  * Sortable by id, name, sort_order, created_at and updated_at.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductCategoriesInfinite(
   request: operations.ListAllMedicalProductCategoriesRequest,
@@ -203,6 +209,8 @@ export function useMedicalProductsListAllMedicalProductCategoriesInfinite(
  * Sortable by id, name, sort_order, created_at and updated_at.
  *
  * Requires the `medical_product_categories` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductCategoriesInfiniteSuspense(
   request: operations.ListAllMedicalProductCategoriesRequest,

package/src/react-query/medicalProductsListAllMedicalProductFamilies.ts

@@ -87,6 +87,8 @@ export type MedicalProductsListAllMedicalProductFamiliesQueryError =
  * Sortable by id, name, brand_name, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductFamilies(
   request: operations.ListAllMedicalProductFamiliesRequest,
@@ -125,6 +127,8 @@ export function useMedicalProductsListAllMedicalProductFamilies(
  * Sortable by id, name, brand_name, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductFamiliesSuspense(
   request: operations.ListAllMedicalProductFamiliesRequest,
@@ -163,6 +167,8 @@ export function useMedicalProductsListAllMedicalProductFamiliesSuspense(
  * Sortable by id, name, brand_name, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductFamiliesInfinite(
   request: operations.ListAllMedicalProductFamiliesRequest,
@@ -215,6 +221,8 @@ export function useMedicalProductsListAllMedicalProductFamiliesInfinite(
  * Sortable by id, name, brand_name, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductFamiliesInfiniteSuspense(
   request: operations.ListAllMedicalProductFamiliesRequest,

package/src/react-query/medicalProductsListAllMedicalProducts.ts

@@ -88,6 +88,8 @@ export type MedicalProductsListAllMedicalProductsQueryError =
  * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProducts(
   request: operations.ListAllMedicalProductsRequest,
@@ -127,6 +129,8 @@ export function useMedicalProductsListAllMedicalProducts(
  * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductsSuspense(
   request: operations.ListAllMedicalProductsRequest,
@@ -166,6 +170,8 @@ export function useMedicalProductsListAllMedicalProductsSuspense(
  * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductsInfinite(
   request: operations.ListAllMedicalProductsRequest,
@@ -219,6 +225,8 @@ export function useMedicalProductsListAllMedicalProductsInfinite(
  * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
  *
  * Requires the `medical_products` / `view` permission.
+ *
+ * **Permissions.** Requires the `medical_products.view` permission.
  */
 export function useMedicalProductsListAllMedicalProductsInfiniteSuspense(
   request: operations.ListAllMedicalProductsRequest,

package/src/react-query/medicalProductsPatchDistributor.ts

@@ -54,6 +54,8 @@ export type MedicalProductsPatchDistributorMutationError =
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `distributors` / `edit` permission.
+ *
+ * **Permissions.** Requires the `distributors.edit` permission.
  */
 export function useMedicalProductsPatchDistributorMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsPatchManufacturer.ts

@@ -54,6 +54,8 @@ export type MedicalProductsPatchManufacturerMutationError =
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `manufacturers` / `edit` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.edit` permission.
  */
 export function useMedicalProductsPatchManufacturerMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsPatchMedicalProduct.ts

@@ -54,6 +54,8 @@ export type MedicalProductsPatchMedicalProductMutationError =
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function useMedicalProductsPatchMedicalProductMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsPatchMedicalProductCategory.ts

@@ -54,6 +54,8 @@ export type MedicalProductsPatchMedicalProductCategoryMutationError =
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_product_categories` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.edit` permission.
  */
 export function useMedicalProductsPatchMedicalProductCategoryMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsPatchMedicalProductFamily.ts

@@ -54,6 +54,8 @@ export type MedicalProductsPatchMedicalProductFamilyMutationError =
  * Identical to `PUT`: both leave omitted keys as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function useMedicalProductsPatchMedicalProductFamilyMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsUpdateDistributor.ts

@@ -54,6 +54,8 @@ export type MedicalProductsUpdateDistributorMutationError =
  * Updates a distributor. Keys the request omits are left as they are.
  *
  * Requires the `distributors` / `edit` permission.
+ *
+ * **Permissions.** Requires the `distributors.edit` permission.
  */
 export function useMedicalProductsUpdateDistributorMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsUpdateManufacturer.ts

@@ -54,6 +54,8 @@ export type MedicalProductsUpdateManufacturerMutationError =
  * Updates a manufacturer. Keys the request omits are left as they are.
  *
  * Requires the `manufacturers` / `edit` permission.
+ *
+ * **Permissions.** Requires the `manufacturers.edit` permission.
  */
 export function useMedicalProductsUpdateManufacturerMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsUpdateMedicalProduct.ts

@@ -54,6 +54,8 @@ export type MedicalProductsUpdateMedicalProductMutationError =
  * Updates a medical product. Keys the request omits are left as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function useMedicalProductsUpdateMedicalProductMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsUpdateMedicalProductCategory.ts

@@ -54,6 +54,8 @@ export type MedicalProductsUpdateMedicalProductCategoryMutationError =
  * Updates a product category. Keys the request omits are left as they are.
  *
  * Requires the `medical_product_categories` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_product_categories.edit` permission.
  */
 export function useMedicalProductsUpdateMedicalProductCategoryMutation(
   options?: MutationHookOptions<

package/src/react-query/medicalProductsUpdateMedicalProductFamily.ts

@@ -54,6 +54,8 @@ export type MedicalProductsUpdateMedicalProductFamilyMutationError =
  * Updates a product family. Keys the request omits are left as they are.
  *
  * Requires the `medical_products` / `edit` permission.
+ *
+ * **Permissions.** Requires the `medical_products.edit` permission.
  */
 export function useMedicalProductsUpdateMedicalProductFamilyMutation(
   options?: MutationHookOptions<

package/src/react-query/mobileDevicesAddMobileDevice.ts

@@ -51,6 +51,8 @@ export type MobileDevicesAddMobileDeviceMutationError =
  *
  * @remarks
  * Add mobile device
+ *
+ * **Permissions.** Requires the `mobile_devices.add` permission.
  */
 export function useMobileDevicesAddMobileDeviceMutation(
   options?: MutationHookOptions<

package/src/react-query/organizationsCreateCompanyTargetFacility.ts

@@ -56,15 +56,25 @@ export type OrganizationsCreateCompanyTargetFacilityMutationError =
  *
  * Access control: the URL's `company_id` must be in the caller's update
  * scope for Company, AND the `facility_id` must be in the caller's create
- * scope for Facility (a facility on the company's site, or a facility
- * reachable via the API user's site/system/facility-scoped activation).
- * Either being out of scope returns `404 Company not found` /
- * `404 Facility not found` respectively. Deleted facilities also return
- * `404 Facility not found`.
+ * scope for Facility. For a facility/system/vendor/company-manager caller,
+ * that create scope is widened the same way listing's potential-target
+ * scope is: it includes the public, non-deleted, listed facility directory
+ * in addition to the caller's own create scope, so a non-deleted publicly
+ * listed facility can be targeted even when it isn't otherwise in the
+ * caller's Facility relation. An API-user caller is the exception —
+ * restricted to its own create scope (a facility on the company's site, or
+ * a facility reachable via the API user's site/system/facility-scoped
+ * activation), with no directory added. Either being out of scope returns
+ * `404 Company not found` / `404 Facility not found` respectively. Deleted
+ * facilities also return `404 Facility not found`.
+ *
+ * **Permissions.** Requires the `target_facilities.add` permission.
  *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsCreateCompanyTargetFacilityMutation(
   options?: MutationHookOptions<

package/src/react-query/organizationsDeleteCompanyTargetFacility.ts

@@ -58,6 +58,8 @@ export type OrganizationsDeleteCompanyTargetFacilityMutationError =
  * scope for Company (a company manager's or vendor's own company, or a
  * company whose app is activated for the API user). Callers outside that
  * scope receive `404 Company not found`.
+ *
+ * **Permissions.** Requires the `target_facilities.delete` permission.
  */
 export function useOrganizationsDeleteCompanyTargetFacilityMutation(
   options?: MutationHookOptions<

package/src/react-query/organizationsDownloadCompanyTargetFacilitiesExport.ts

@@ -58,6 +58,8 @@ export type OrganizationsDownloadCompanyTargetFacilitiesExportQueryError =
  * @remarks
  * Returns the exported company target facilities CSV via a 302 redirect to a short-lived presigned S3 URL.
  * If the export is still being generated, returns 202 with a JSON `{ ready: false }` payload.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsDownloadCompanyTargetFacilitiesExport(
   request: operations.DownloadCompanyTargetFacilitiesExportRequest,
@@ -86,6 +88,8 @@ export function useOrganizationsDownloadCompanyTargetFacilitiesExport(
  * @remarks
  * Returns the exported company target facilities CSV via a 302 redirect to a short-lived presigned S3 URL.
  * If the export is still being generated, returns 202 with a JSON `{ ready: false }` payload.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsDownloadCompanyTargetFacilitiesExportSuspense(
   request: operations.DownloadCompanyTargetFacilitiesExportRequest,

package/src/react-query/organizationsDownloadFacilityVendorsExport.ts

@@ -59,6 +59,8 @@ export type OrganizationsDownloadFacilityVendorsExportQueryError =
  * Returns the exported facility vendors CSV via a 302 redirect to a short-lived
  * presigned S3 URL. If the export is still being generated, returns 202 with a JSON
  * `{ ready: false }` payload.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsDownloadFacilityVendorsExport(
   request: operations.DownloadFacilityVendorsExportRequest,
@@ -88,6 +90,8 @@ export function useOrganizationsDownloadFacilityVendorsExport(
  * Returns the exported facility vendors CSV via a 302 redirect to a short-lived
  * presigned S3 URL. If the export is still being generated, returns 202 with a JSON
  * `{ ready: false }` payload.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsDownloadFacilityVendorsExportSuspense(
   request: operations.DownloadFacilityVendorsExportRequest,

package/src/react-query/organizationsExportCompanyTargetFacilities.ts

@@ -64,6 +64,8 @@ export type OrganizationsExportCompanyTargetFacilitiesQueryError =
  *
  * Access control: the URL's `company_id` must be in the caller's read scope for Company. Callers
  * outside that scope receive `404 Company not found`.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsExportCompanyTargetFacilities(
   request: operations.ExportCompanyTargetFacilitiesRequest,
@@ -98,6 +100,8 @@ export function useOrganizationsExportCompanyTargetFacilities(
  *
  * Access control: the URL's `company_id` must be in the caller's read scope for Company. Callers
  * outside that scope receive `404 Company not found`.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsExportCompanyTargetFacilitiesSuspense(
   request: operations.ExportCompanyTargetFacilitiesRequest,

package/src/react-query/organizationsExportFacilityVendors.ts

@@ -71,6 +71,8 @@ export type OrganizationsExportFacilityVendorsQueryError =
  *   * API users — `company_id` required; both the company AND the facility must be
  *     activated for the caller's marketplace app via the join-scoped
  *     `MarketplaceAppActivation` check.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsExportFacilityVendors(
   request: operations.ExportFacilityVendorsRequest,
@@ -112,6 +114,8 @@ export function useOrganizationsExportFacilityVendors(
  *   * API users — `company_id` required; both the company AND the facility must be
  *     activated for the caller's marketplace app via the join-scoped
  *     `MarketplaceAppActivation` check.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsExportFacilityVendorsSuspense(
   request: operations.ExportFacilityVendorsRequest,

package/src/react-query/organizationsGetCompanyTargetFacilitiesExportStatus.ts

@@ -58,6 +58,8 @@ export type OrganizationsGetCompanyTargetFacilitiesExportStatusQueryError =
  * @remarks
  * Poll the state of an asynchronous company target facilities export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsGetCompanyTargetFacilitiesExportStatus(
   request: operations.GetCompanyTargetFacilitiesExportStatusRequest,
@@ -86,6 +88,8 @@ export function useOrganizationsGetCompanyTargetFacilitiesExportStatus(
  * @remarks
  * Poll the state of an asynchronous company target facilities export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
+ *
+ * **Permissions.** Requires the `target_facilities.view` permission.
  */
 export function useOrganizationsGetCompanyTargetFacilitiesExportStatusSuspense(
   request: operations.GetCompanyTargetFacilitiesExportStatusRequest,

package/src/react-query/organizationsGetFacility.ts

@@ -58,6 +58,26 @@ export type OrganizationsGetFacilityQueryError =
  *
  * @remarks
  * Retrieve an individual facility.
+ *
+ * **Permissions.** Requires `facilities.view`, `facility_profile.view`, or `targeted_facilities.view`. `facility.search` does not grant access on its own — it only extends the reach of a `targeted_facilities.view` caller to a facility they are not targeted at, returning the public summary for it instead of a 403.
+ *
+ * - Callers with `facilities.view` or `facility_profile.view` can look up any facility, but only receive full expansion for their own facility; for any other facility, expansion is dropped and only the public summary is returned.
+ * - Callers with `targeted_facilities.view` receive the full record and full expansion for a facility they are targeted at (a vendor's target facilities, or a facility/system user's own facility). For a facility they are not targeted at, they receive the public summary (no expansion) if they also hold `facility.search`, or a 401 otherwise.
+ *
+ * Available `expand` scopes are:
+ *
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is dropped entirely for callers who can only see the facility's public summary.
  */
 export function useOrganizationsGetFacility(
   request: operations.GetFacilityRequest,
@@ -85,6 +105,26 @@ export function useOrganizationsGetFacility(
  *
  * @remarks
  * Retrieve an individual facility.
+ *
+ * **Permissions.** Requires `facilities.view`, `facility_profile.view`, or `targeted_facilities.view`. `facility.search` does not grant access on its own — it only extends the reach of a `targeted_facilities.view` caller to a facility they are not targeted at, returning the public summary for it instead of a 403.
+ *
+ * - Callers with `facilities.view` or `facility_profile.view` can look up any facility, but only receive full expansion for their own facility; for any other facility, expansion is dropped and only the public summary is returned.
+ * - Callers with `targeted_facilities.view` receive the full record and full expansion for a facility they are targeted at (a vendor's target facilities, or a facility/system user's own facility). For a facility they are not targeted at, they receive the public summary (no expansion) if they also hold `facility.search`, or a 401 otherwise.
+ *
+ * Available `expand` scopes are:
+ *
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is dropped entirely for callers who can only see the facility's public summary.
  */
 export function useOrganizationsGetFacilitySuspense(
   request: operations.GetFacilityRequest,

package/src/react-query/organizationsGetFacilityVendorsExportStatus.ts

@@ -58,6 +58,8 @@ export type OrganizationsGetFacilityVendorsExportStatusQueryError =
  * @remarks
  * Poll the state of an asynchronous facility vendors export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsGetFacilityVendorsExportStatus(
   request: operations.GetFacilityVendorsExportStatusRequest,
@@ -86,6 +88,8 @@ export function useOrganizationsGetFacilityVendorsExportStatus(
  * @remarks
  * Poll the state of an asynchronous facility vendors export job. When `ready` is true,
  * the export is complete and can be downloaded via the download endpoint.
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsGetFacilityVendorsExportStatusSuspense(
   request: operations.GetFacilityVendorsExportStatusRequest,

package/src/react-query/organizationsListCompanyTargetFacilities.ts

@@ -80,9 +80,15 @@ export type OrganizationsListCompanyTargetFacilitiesQueryError =
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -92,9 +98,13 @@ export type OrganizationsListCompanyTargetFacilitiesQueryError =
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilities(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -126,9 +136,15 @@ export function useOrganizationsListCompanyTargetFacilities(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -138,9 +154,13 @@ export function useOrganizationsListCompanyTargetFacilities(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesSuspense(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -172,9 +192,15 @@ export function useOrganizationsListCompanyTargetFacilitiesSuspense(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -184,9 +210,13 @@ export function useOrganizationsListCompanyTargetFacilitiesSuspense(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesInfinite(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -232,9 +262,15 @@ export function useOrganizationsListCompanyTargetFacilitiesInfinite(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -244,9 +280,13 @@ export function useOrganizationsListCompanyTargetFacilitiesInfinite(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesInfiniteSuspense(
   request: operations.ListCompanyTargetFacilitiesRequest,

package/src/react-query/organizationsListFacilityVendors.ts

@@ -95,6 +95,8 @@ export type OrganizationsListFacilityVendorsQueryError =
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendors(
   request: operations.ListFacilityVendorsRequest,
@@ -141,6 +143,8 @@ export function useOrganizationsListFacilityVendors(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsSuspense(
   request: operations.ListFacilityVendorsRequest,
@@ -187,6 +191,8 @@ export function useOrganizationsListFacilityVendorsSuspense(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsInfinite(
   request: operations.ListFacilityVendorsRequest,
@@ -247,6 +253,8 @@ export function useOrganizationsListFacilityVendorsInfinite(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsInfiniteSuspense(
   request: operations.ListFacilityVendorsRequest,