@greensecurity/javascript-sdk 0.46.0-beta.6 → 0.46.0-beta.8

package/src/react-query/eventsListStandingAppointments.ts

@@ -81,13 +81,14 @@ export type EventsListStandingAppointmentsQueryError =
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointments(
@@ -121,13 +122,14 @@ export function useEventsListStandingAppointments(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsSuspense(
@@ -161,13 +163,14 @@ export function useEventsListStandingAppointmentsSuspense(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsInfinite(
@@ -215,13 +218,14 @@ export function useEventsListStandingAppointmentsInfinite(
  * the caller's role and their relationship to the record decide what the endpoint returns.
  *
  * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
- * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
- * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
- * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+ * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+ * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+ * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+ * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
  * `StandingAppointment` shape instead.
  *
- * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
- * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+ * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+ * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
  * build compares against it.
  */
 export function useEventsListStandingAppointmentsInfiniteSuspense(

package/src/react-query/organizationsGetFacility.ts

@@ -69,6 +69,7 @@ export type OrganizationsGetFacilityQueryError =
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`
@@ -116,6 +117,7 @@ export function useOrganizationsGetFacility(
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`

package/src/react-query/organizationsListOrSearchFacilities.ts

@@ -84,6 +84,7 @@ export type OrganizationsListOrSearchFacilitiesQueryError =
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`
@@ -128,6 +129,7 @@ export function useOrganizationsListOrSearchFacilities(
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`
@@ -172,6 +174,7 @@ export function useOrganizationsListOrSearchFacilitiesSuspense(
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`
@@ -230,6 +233,7 @@ export function useOrganizationsListOrSearchFacilitiesInfinite(
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`

package/src/react-query/vendorsAddVendorManagedByCompany.ts

@@ -50,9 +50,16 @@ export type VendorsAddVendorManagedByCompanyMutationError =
  * Add vendor managed by company
  *
  * @remarks
- * Adds a company as a manager of the vendor.
+ * Adds a company as a manager of the vendor. The new company starts with every access right
+ * turned off. The company must be on the same site as the vendor. Otherwise, the API returns
+ * `404`.
  *
- * **Permissions.** Requires the `vendors.edit` permission.
+ * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
+ * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
+ * a Green Security administrator, or an app whose API token can update the vendor (an app
+ * installed for the vendor's whole site, for the company the vendor belongs to, or by the vendor).
+ * A company manager whose company manages the vendor through a managed-by-company link, rather
+ * than owning the vendor, gets a `403`, and so do facility and system users.
  */
 export function useVendorsAddVendorManagedByCompanyMutation(
   options?: MutationHookOptions<

package/src/react-query/vendorsCreateVendorCompany.ts

@@ -52,7 +52,13 @@ export type VendorsCreateVendorCompanyMutationError =
  * @remarks
  * Creates vendor company
  *
- * **Permissions.** Requires the `companies.add` permission.
+ * **Permissions.** Requires the `companies.add` permission. Only these callers can move the vendor
+ * into a new company: the vendor, a company manager at the company the vendor belongs to, a Green
+ * Security administrator, or an app installed for the vendor's whole site. An app needs a
+ * site-wide installation because only a site-wide installation can create companies. An app
+ * installed only for a company or by a user gets a `403`, even when its API token can update the
+ * vendor. A company manager whose company manages the vendor through a managed-by-company link,
+ * rather than owning the vendor, gets a `403`, and so do facility and system users.
  */
 export function useVendorsCreateVendorCompanyMutation(
   options?: MutationHookOptions<

package/src/react-query/vendorsDeleteVendorManagedByCompany.ts

@@ -53,7 +53,15 @@ export type VendorsDeleteVendorManagedByCompanyMutationError =
  * @remarks
  * Removes a company as a manager of the vendor.
  *
- * **Permissions.** Requires the `vendors.edit` permission.
+ * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
+ * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
+ * a Green Security administrator, or an app whose API token can update the vendor (an app
+ * installed for the vendor's whole site, for the company the vendor belongs to, or by the vendor).
+ * A company manager whose company manages the vendor through a managed-by-company link, rather
+ * than owning the vendor, gets a `403`, and so do facility and system users.
+ *
+ * If `managed_vendor_id` doesn't belong to this vendor, the API returns `404`, the same response
+ * as for an ID that doesn't exist.
  */
 export function useVendorsDeleteVendorManagedByCompanyMutation(
   options?: MutationHookOptions<

package/src/react-query/vendorsGetVendorCredentialDetails.ts

@@ -63,6 +63,10 @@ export type VendorsGetVendorCredentialDetailsQueryError =
  * is expanded, a company manager viewing a vendor-owned credential (not a company-owned one) only
  * receives the files they personally uploaded on the vendor's behalf.
  *
+ * For that same restricted company manager, `json_data` is returned as `null` unless they are the
+ * one who first submitted this version of the credential - everything else in the response
+ * (status, dates, notes, credential/invoice/etc.) is unaffected.
+ *
  * The following `expand` scopes are available:
  *
  * - `vendor_credential.credential`
@@ -127,6 +131,10 @@ export function useVendorsGetVendorCredentialDetails(
  * is expanded, a company manager viewing a vendor-owned credential (not a company-owned one) only
  * receives the files they personally uploaded on the vendor's behalf.
  *
+ * For that same restricted company manager, `json_data` is returned as `null` unless they are the
+ * one who first submitted this version of the credential - everything else in the response
+ * (status, dates, notes, credential/invoice/etc.) is unaffected.
+ *
  * The following `expand` scopes are available:
  *
  * - `vendor_credential.credential`

package/src/react-query/vendorsListVendorCredentialHistory.ts

@@ -78,6 +78,10 @@ export type VendorsListVendorCredentialHistoryQueryError =
  * Lists vendor credentials history
  *
  * **Permissions.** Requires the `vendor_credentials.view` permission.
+ *
+ * Each item's `submitted_by_current_user` says whether the calling user is the one who first
+ * submitted that version, so a vendor or company manager can tell their own submissions apart
+ * from ones made by someone else with access to the same credential.
  */
 export function useVendorsListVendorCredentialHistory(
   request: operations.ListVendorCredentialHistoryRequest,
@@ -107,6 +111,10 @@ export function useVendorsListVendorCredentialHistory(
  * Lists vendor credentials history
  *
  * **Permissions.** Requires the `vendor_credentials.view` permission.
+ *
+ * Each item's `submitted_by_current_user` says whether the calling user is the one who first
+ * submitted that version, so a vendor or company manager can tell their own submissions apart
+ * from ones made by someone else with access to the same credential.
  */
 export function useVendorsListVendorCredentialHistorySuspense(
   request: operations.ListVendorCredentialHistoryRequest,
@@ -136,6 +144,10 @@ export function useVendorsListVendorCredentialHistorySuspense(
  * Lists vendor credentials history
  *
  * **Permissions.** Requires the `vendor_credentials.view` permission.
+ *
+ * Each item's `submitted_by_current_user` says whether the calling user is the one who first
+ * submitted that version, so a vendor or company manager can tell their own submissions apart
+ * from ones made by someone else with access to the same credential.
  */
 export function useVendorsListVendorCredentialHistoryInfinite(
   request: operations.ListVendorCredentialHistoryRequest,
@@ -179,6 +191,10 @@ export function useVendorsListVendorCredentialHistoryInfinite(
  * Lists vendor credentials history
  *
  * **Permissions.** Requires the `vendor_credentials.view` permission.
+ *
+ * Each item's `submitted_by_current_user` says whether the calling user is the one who first
+ * submitted that version, so a vendor or company manager can tell their own submissions apart
+ * from ones made by someone else with access to the same credential.
  */
 export function useVendorsListVendorCredentialHistoryInfiniteSuspense(
   request: operations.ListVendorCredentialHistoryRequest,

package/src/react-query/vendorsUpdateVendorCustomField.ts

@@ -60,7 +60,9 @@ export type VendorsUpdateVendorCustomFieldMutationError =
  * Accepts a numeric vendor ID, `me` for the authenticated vendor,
  * or an active QR code (format: contains hyphens).
  *
- * **Permissions.** Requires the `vendors.edit` permission.
+ * **Permissions.** Requires the `vendors.edit` permission. A company manager whose company
+ * manages the vendor through a managed-by-company link, rather than owning it, also needs that
+ * link's `may_edit_profile` access right, or the API returns `403`.
  */
 export function useVendorsUpdateVendorCustomFieldMutation(
   options?: MutationHookOptions<

package/src/react-query/vendorsUpdateVendorManagedByCompany.ts

@@ -52,7 +52,16 @@ export type VendorsUpdateVendorManagedByCompanyMutationError =
  * @remarks
  * Updates the access rights that a company has for the vendor it manages.
  *
- * **Permissions.** Requires the `vendors.edit` permission.
+ * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change access
+ * rights: the vendor, a company manager at the company the vendor belongs to, a Green Security
+ * administrator, or an app whose API token can update the vendor (an app installed for the
+ * vendor's whole site, for the company the vendor belongs to, or by the vendor). A company manager
+ * whose company manages the vendor through a managed-by-company link, rather than owning the
+ * vendor, gets a `403`: that company can't change its own access rights or another company's.
+ * Facility and system users get a `403` too.
+ *
+ * If `managed_vendor_id` doesn't belong to this vendor, the API returns `404`, the same response
+ * as for an ID that doesn't exist.
  */
 export function useVendorsUpdateVendorManagedByCompanyMutation(
   options?: MutationHookOptions<

package/src/react-query/zonesGetSecurityZone.ts

@@ -66,6 +66,7 @@ export type ZonesGetSecurityZoneQueryError =
  * - `zone.facility`
  * - `zone.department`
  * - `zone.rules`
+ * - `zone.device_counts` (also requires `zone_devices.view`)
  *
  * The server ignores unrecognized values.
  */
@@ -103,6 +104,7 @@ export function useZonesGetSecurityZone(
  * - `zone.facility`
  * - `zone.department`
  * - `zone.rules`
+ * - `zone.device_counts` (also requires `zone_devices.view`)
  *
  * The server ignores unrecognized values.
  */

package/src/react-query/zonesListOrSearchSecurityZones.core.ts

@@ -82,6 +82,7 @@ export function buildZonesListOrSearchSecurityZonesQuery(
       latitude: request.latitude,
       longitude: request.longitude,
       nameLike: request.nameLike,
+      expand: request.expand,
       contactId: request.contactId,
       facilityId: request.facilityId,
       greenLocationId: request.greenLocationId,
@@ -131,6 +132,7 @@ export function buildZonesListOrSearchSecurityZonesInfiniteQuery(
       latitude: request.latitude,
       longitude: request.longitude,
       nameLike: request.nameLike,
+      expand: request.expand,
       contactId: request.contactId,
       facilityId: request.facilityId,
       greenLocationId: request.greenLocationId,
@@ -178,6 +180,7 @@ export function queryKeyZonesListOrSearchSecurityZones(
     latitude?: number | undefined;
     longitude?: number | undefined;
     nameLike?: string | undefined;
+    expand?: Array<components.Expand> | undefined;
     contactId?: number | undefined;
     facilityId?: number | undefined;
     greenLocationId?: number | undefined;
@@ -200,6 +203,7 @@ export function queryKeyZonesListOrSearchSecurityZonesInfinite(
     latitude?: number | undefined;
     longitude?: number | undefined;
     nameLike?: string | undefined;
+    expand?: Array<components.Expand> | undefined;
     contactId?: number | undefined;
     facilityId?: number | undefined;
     greenLocationId?: number | undefined;

package/src/react-query/zonesListOrSearchSecurityZones.ts

@@ -78,6 +78,8 @@ export type ZonesListOrSearchSecurityZonesQueryError =
  * Lists or searches security zones
  *
  * **Permissions.** Requires the `zones.view` permission.
+ *
+ * The `expand` parameter accepts only `zone.device_counts`, which also requires `zone_devices.view`. The server ignores other values.
  */
 export function useZonesListOrSearchSecurityZones(
   request: operations.ListOrSearchSecurityZonesRequest,
@@ -107,6 +109,8 @@ export function useZonesListOrSearchSecurityZones(
  * Lists or searches security zones
  *
  * **Permissions.** Requires the `zones.view` permission.
+ *
+ * The `expand` parameter accepts only `zone.device_counts`, which also requires `zone_devices.view`. The server ignores other values.
  */
 export function useZonesListOrSearchSecurityZonesSuspense(
   request: operations.ListOrSearchSecurityZonesRequest,
@@ -136,6 +140,8 @@ export function useZonesListOrSearchSecurityZonesSuspense(
  * Lists or searches security zones
  *
  * **Permissions.** Requires the `zones.view` permission.
+ *
+ * The `expand` parameter accepts only `zone.device_counts`, which also requires `zone_devices.view`. The server ignores other values.
  */
 export function useZonesListOrSearchSecurityZonesInfinite(
   request: operations.ListOrSearchSecurityZonesRequest,
@@ -179,6 +185,8 @@ export function useZonesListOrSearchSecurityZonesInfinite(
  * Lists or searches security zones
  *
  * **Permissions.** Requires the `zones.view` permission.
+ *
+ * The `expand` parameter accepts only `zone.device_counts`, which also requires `zone_devices.view`. The server ignores other values.
  */
 export function useZonesListOrSearchSecurityZonesInfiniteSuspense(
   request: operations.ListOrSearchSecurityZonesRequest,
@@ -226,6 +234,7 @@ export function setZonesListOrSearchSecurityZonesData(
       latitude?: number | undefined;
       longitude?: number | undefined;
       nameLike?: string | undefined;
+      expand?: Array<components.Expand> | undefined;
       contactId?: number | undefined;
       facilityId?: number | undefined;
       greenLocationId?: number | undefined;
@@ -252,6 +261,7 @@ export function invalidateZonesListOrSearchSecurityZones(
       latitude?: number | undefined;
       longitude?: number | undefined;
       nameLike?: string | undefined;
+      expand?: Array<components.Expand> | undefined;
       contactId?: number | undefined;
       facilityId?: number | undefined;
       greenLocationId?: number | undefined;

package/src/sdk/companies.ts

@@ -77,6 +77,9 @@ export class Companies extends ClientSDK {
    * @remarks
    * Lists companies available to the caller as minimal lookup summaries for list and typeahead UIs.
    *
+   * For a vendor, the list holds the active companies on the vendor's site: the companies the
+   * vendor can add as managing companies. Other callers see the companies they can view.
+   *
    * **Permissions.** Requires the `companies.view` permission.
    */
   async lookupCompanies(

package/src/sdk/events.ts

@@ -210,15 +210,16 @@ export class Events extends ClientSDK {
    * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission:
    * the caller's role and their relationship to the record decide what the endpoint returns.
    *
-   * Returns `Invite` items with the `invite.event` and `invite.invitee` scopes already applied,
-   * so `event` is the expanded `{ id, name }` summary instead of a bare id, and `invitee` is
-   * populated—the appointment and the recipient this list has always named. This endpoint
-   * takes no `expand` parameter; the endpoint always applies both scopes.
-   * SDK builds earlier than `0.55.0-beta.1` receive the older `PendingInvitation` shape instead, which
+   * Returns `Invite` items with the `invite.event`, `invite.invitee`, `event.location` and
+   * `event.creator` scopes already applied. So `event` is the expanded summary instead of a bare
+   * id, with the appointment's dates, flags, notes, location and organizer, and `invitee` is
+   * populated with the recipient's name and thumbnail—what this list has always published. This
+   * endpoint takes no `expand` parameter; the endpoint always applies these scopes.
+   * SDK builds earlier than `0.46.0-beta.1` receive the older `PendingInvitation` shape instead, which
    * embeds the appointment.
    *
-   * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
-   * `0.55.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
+   * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+   * `0.46.0-beta.1` itself already receives `Invite`. See the `Invite` schema for exactly how a
    * build compares against it.
    */
   async listPendingInvitations(
@@ -243,15 +244,16 @@ export class Events extends ClientSDK {
    * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission.
    * The caller's role and their relationship to the record decide what the response includes.
    *
-   * Returns `Event` items with the `event.creator` and `event.invitees` scopes already applied,
-   * so the server populates `event_creator`, `event_creator_img_url` and `invitees`—the fields this
-   * feed has always carried. SDK builds below `0.55.0-beta.1` receive the older `Feed` shape
-   * instead, in which `facility` and `department` are name strings, not ids; the server
-   * chooses by the `X-SDK-User-Agent` header the SDK sends, so an existing client keeps the
-   * shape it was generated against until you regenerate it.
+   * Returns `Event` items with the `event.creator`, `event.invitees`, `event.facility` and
+   * `event.department` scopes already applied, so the server populates `event_creator`,
+   * `event_creator_img_url` and `invitees`, and `facility` and `department` are `{ id, name }`
+   * summaries—the fields this feed has always carried. SDK builds below `0.46.0-beta.1`
+   * receive the older `Feed` shape instead, in which `facility` and `department` are name
+   * strings, not ids; the server chooses by the `X-SDK-User-Agent` header the SDK sends, so an
+   * existing client keeps the shape it was generated against until you regenerate it.
    *
-   * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
-   * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
+   * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+   * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how the server compares a
    * build against it.
    */
   async listFeed(
@@ -275,13 +277,14 @@ export class Events extends ClientSDK {
    * the caller's role and their relationship to the record decide what the endpoint returns.
    *
    * Returns `Event` items with the `event.location`, `event.attendees`, `event.viewer_invite`,
-   * `event.creator` and `event.invitees` scopes already applied, so `location`, `attendees`,
-   * `event_creator`, `event_creator_img_url` and `invitees` are populated and `status` carries
-   * the reader's own outstanding invite. SDK builds earlier than `0.55.0-beta.1` receive the older
+   * `event.creator`, `event.invitees`, `event.facility` and `event.department` scopes already
+   * applied, so `location`, `attendees`, `event_creator`, `event_creator_img_url` and `invitees`
+   * are populated, `facility` and `department` are `{ id, name }` summaries, and `status` carries
+   * the reader's own outstanding invite. SDK builds earlier than `0.46.0-beta.1` receive the older
    * `StandingAppointment` shape instead.
    *
-   * The boundary is the prerelease build `0.55.0-beta.1`, not the `0.55.0` release, so
-   * `0.55.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
+   * The boundary is the prerelease build `0.46.0-beta.1`, not the `0.46.0` release, so
+   * `0.46.0-beta.1` itself already receives `Event`. See the `Event` schema for exactly how a
    * build compares against it.
    */
   async listStandingAppointments(

package/src/sdk/organizations.ts

@@ -36,6 +36,7 @@ export class Organizations extends ClientSDK {
    * - `facility.system`
    * - `facility.contacts`
    * - `facility.vendor_counts`
+   * - `facility.device_counts` (also requires `zone_devices.view`)
    * - `facility.appointment_policy`
    * - `facility.vendor_policy`
    * - `facility.vendor_guest_policy`
@@ -75,6 +76,7 @@ export class Organizations extends ClientSDK {
    * - `facility.system`
    * - `facility.contacts`
    * - `facility.vendor_counts`
+   * - `facility.device_counts` (also requires `zone_devices.view`)
    * - `facility.appointment_policy`
    * - `facility.vendor_policy`
    * - `facility.vendor_guest_policy`

package/src/sdk/vendors.ts

@@ -296,6 +296,10 @@ export class Vendors extends ClientSDK {
    * is expanded, a company manager viewing a vendor-owned credential (not a company-owned one) only
    * receives the files they personally uploaded on the vendor's behalf.
    *
+   * For that same restricted company manager, `json_data` is returned as `null` unless they are the
+   * one who first submitted this version of the credential - everything else in the response
+   * (status, dates, notes, credential/invoice/etc.) is unaffected.
+   *
    * The following `expand` scopes are available:
    *
    * - `vendor_credential.credential`
@@ -637,6 +641,10 @@ export class Vendors extends ClientSDK {
    * Lists vendor credentials history
    *
    * **Permissions.** Requires the `vendor_credentials.view` permission.
+   *
+   * Each item's `submitted_by_current_user` says whether the calling user is the one who first
+   * submitted that version, so a vendor or company manager can tell their own submissions apart
+   * from ones made by someone else with access to the same credential.
    */
   async listVendorCredentialHistory(
     request: operations.ListVendorCredentialHistoryRequest,
@@ -1144,7 +1152,9 @@ export class Vendors extends ClientSDK {
    * Accepts a numeric vendor ID, `me` for the authenticated vendor,
    * or an active QR code (format: contains hyphens).
    *
-   * **Permissions.** Requires the `vendors.edit` permission.
+   * **Permissions.** Requires the `vendors.edit` permission. A company manager whose company
+   * manages the vendor through a managed-by-company link, rather than owning it, also needs that
+   * link's `may_edit_profile` access right, or the API returns `403`.
    */
   async updateVendorCustomField(
     request: operations.UpdateVendorCustomFieldRequest,
@@ -1185,9 +1195,16 @@ export class Vendors extends ClientSDK {
    * Add vendor managed by company
    *
    * @remarks
-   * Adds a company as a manager of the vendor.
-   *
-   * **Permissions.** Requires the `vendors.edit` permission.
+   * Adds a company as a manager of the vendor. The new company starts with every access right
+   * turned off. The company must be on the same site as the vendor. Otherwise, the API returns
+   * `404`.
+   *
+   * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
+   * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
+   * a Green Security administrator, or an app whose API token can update the vendor (an app
+   * installed for the vendor's whole site, for the company the vendor belongs to, or by the vendor).
+   * A company manager whose company manages the vendor through a managed-by-company link, rather
+   * than owning the vendor, gets a `403`, and so do facility and system users.
    */
   async addVendorManagedByCompany(
     request: operations.AddVendorManagedByCompanyRequest,
@@ -1206,7 +1223,15 @@ export class Vendors extends ClientSDK {
    * @remarks
    * Removes a company as a manager of the vendor.
    *
-   * **Permissions.** Requires the `vendors.edit` permission.
+   * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change which
+   * companies manage the vendor: the vendor, a company manager at the company the vendor belongs to,
+   * a Green Security administrator, or an app whose API token can update the vendor (an app
+   * installed for the vendor's whole site, for the company the vendor belongs to, or by the vendor).
+   * A company manager whose company manages the vendor through a managed-by-company link, rather
+   * than owning the vendor, gets a `403`, and so do facility and system users.
+   *
+   * If `managed_vendor_id` doesn't belong to this vendor, the API returns `404`, the same response
+   * as for an ID that doesn't exist.
    */
   async deleteVendorManagedByCompany(
     request: operations.DeleteVendorManagedByCompanyRequest,
@@ -1225,7 +1250,16 @@ export class Vendors extends ClientSDK {
    * @remarks
    * Updates the access rights that a company has for the vendor it manages.
    *
-   * **Permissions.** Requires the `vendors.edit` permission.
+   * **Permissions.** Requires the `vendors.edit` permission. Only these callers can change access
+   * rights: the vendor, a company manager at the company the vendor belongs to, a Green Security
+   * administrator, or an app whose API token can update the vendor (an app installed for the
+   * vendor's whole site, for the company the vendor belongs to, or by the vendor). A company manager
+   * whose company manages the vendor through a managed-by-company link, rather than owning the
+   * vendor, gets a `403`: that company can't change its own access rights or another company's.
+   * Facility and system users get a `403` too.
+   *
+   * If `managed_vendor_id` doesn't belong to this vendor, the API returns `404`, the same response
+   * as for an ID that doesn't exist.
    */
   async updateVendorManagedByCompany(
     request: operations.UpdateVendorManagedByCompanyRequest,
@@ -1369,7 +1403,13 @@ export class Vendors extends ClientSDK {
    * @remarks
    * Creates vendor company
    *
-   * **Permissions.** Requires the `companies.add` permission.
+   * **Permissions.** Requires the `companies.add` permission. Only these callers can move the vendor
+   * into a new company: the vendor, a company manager at the company the vendor belongs to, a Green
+   * Security administrator, or an app installed for the vendor's whole site. An app needs a
+   * site-wide installation because only a site-wide installation can create companies. An app
+   * installed only for a company or by a user gets a `403`, even when its API token can update the
+   * vendor. A company manager whose company manages the vendor through a managed-by-company link,
+   * rather than owning the vendor, gets a `403`, and so do facility and system users.
    */
   async createVendorCompany(
     request: operations.CreateVendorCompanyRequest,

package/src/sdk/zones.ts

@@ -19,6 +19,8 @@ export class Zones extends ClientSDK {
    * Lists or searches security zones
    *
    * **Permissions.** Requires the `zones.view` permission.
+   *
+   * The `expand` parameter accepts only `zone.device_counts`, which also requires `zone_devices.view`. The server ignores other values.
    */
   async listOrSearchSecurityZones(
     request: operations.ListOrSearchSecurityZonesRequest,
@@ -46,6 +48,7 @@ export class Zones extends ClientSDK {
    * - `zone.facility`
    * - `zone.department`
    * - `zone.rules`
+   * - `zone.device_counts` (also requires `zone_devices.view`)
    *
    * The server ignores unrecognized values.
    */