@spotto/contract 1.0.70-alpha.13 → 1.0.70-alpha.15

package/dist/actions/[id]/patch/request.d.ts

@@ -1,4 +1,5 @@
 import { ActionEffect, ActionEvent, ActionPresentation, ActionTargetEntity } from '../../shared';
+import { PermissionGrant } from '../../../usergroups/shared';
 /** `name` is immutable. `event: null` clears the custom history label. */
 export interface UpdateActionRequest {
     label?: string;
@@ -9,4 +10,7 @@ export interface UpdateActionRequest {
     event?: ActionEvent | null;
     /** Replaced wholesale; an empty array clears every effect. */
     effects?: ActionEffect[];
+    /** UI-only visibility grants — replaced wholesale; [] clears them (usable
+     * by everyone). Every group id must exist in the org; `level` ignored. */
+    permissions?: PermissionGrant[];
 }

package/dist/actions/get/response.d.ts

@@ -1,4 +1,5 @@
 import { IEntityMeta } from '../../shared';
+import { PermissionGrant } from '../../usergroups/shared';
 import { ActionEffect, ActionEvent, ActionPresentation, ActionTargetEntity } from '../shared';
 import { GetActionsQuery } from './query';
 export interface GetActionResponse {
@@ -16,6 +17,9 @@ export interface GetActionResponse {
     event?: ActionEvent;
     /** Run on submit in author order (§4.2); absent = none. */
     effects?: ActionEffect[];
+    /** UI-only visibility grants — binary for actions (`level` ignored; any
+     * grant ⇒ members-only). Absent/empty = usable by everyone. */
+    permissions?: PermissionGrant[];
     meta?: IEntityMeta;
 }
 export interface GetActionsResponse {

package/dist/assets/download/query.d.ts

@@ -7,4 +7,11 @@ export interface DownloadAssetsQuery extends AssetFilters {
     timestampFormat?: TimestampFormat;
     timezone?: string;
     withEntityLinks?: boolean;
+    /**
+     * Export column curation: keep only the custom-field columns for these
+     * field ids. Omitted ⇒ every field column (existing API callers
+     * unchanged). Ids that resolve to no field are dropped silently — this
+     * is UI curation, not access control.
+     */
+    fieldIds?: string[];
 }

package/dist/assets/get/query.d.ts

@@ -60,6 +60,8 @@ export interface AssetFilters {
     createdAt?: DateCondition[];
     updatedAt?: DateCondition[];
     lastSeen?: DateCondition[];
+    /** Offline-sync delta read: matches records whose `lastChanged` >= this ms-epoch. */
+    updatedAfter?: number;
 }
 export interface GetAssetsQuery extends AssetFilters {
     page?: number;

package/dist/fields/[id]/get.d.ts

@@ -1,4 +1,5 @@
 import { FieldDataType, FieldInputType } from '../constants';
+import { PermissionGrant } from '../../usergroups/shared';
 export interface GetFieldResponse {
     id: string;
     name: string;
@@ -14,6 +15,8 @@ export interface GetFieldResponse {
     decimalMin?: number;
     decimalMax?: number;
     decimalPlaces?: number;
+    /** UI-only visibility grants (usergroups); absent/empty = open. */
+    permissions?: PermissionGrant[];
     meta?: {
         created: number;
         updated?: number;

package/dist/fields/[id]/patch/request.d.ts

@@ -1,4 +1,5 @@
 import { FieldInputType } from '../../constants';
+import { PermissionGrant } from '../../../usergroups/shared';
 export interface UpdateFieldRequestOption {
     value: string;
     previousValue?: string;
@@ -15,4 +16,7 @@ export interface UpdateFieldRequest {
     decimalMin?: number | null;
     decimalMax?: number | null;
     decimalPlaces?: number | null;
+    /** UI-only visibility grants — replaced wholesale; [] clears them (open).
+     * Every group id must exist in the org. */
+    permissions?: PermissionGrant[];
 }

package/dist/index.d.ts

@@ -25,3 +25,4 @@ export * from './views';
 export * from './forms';
 export * from './actions';
 export * from './submissions';
+export * from './usergroups';

package/dist/index.js

@@ -41,4 +41,5 @@ __exportStar(require("./views"), exports);
 __exportStar(require("./forms"), exports);
 __exportStar(require("./actions"), exports);
 __exportStar(require("./submissions"), exports);
+__exportStar(require("./usergroups"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAwB;AACxB,uCAAoB;AACpB,2CAAwB;AACxB,iDAA8B;AAC9B,2CAAwB;AACxB,2CAAwB;AACxB,8CAA2B;AAC3B,6CAA0B;AAC1B,kDAA+B;AAC/B,4CAAyB;AACzB,0CAAuB;AACvB,yCAAsB;AACtB,8CAA2B;AAC3B,0CAAuB;AACvB,8CAA2B;AAC3B,0CAAuB;AACvB,2CAAwB;AACxB,8CAA2B;AAC3B,2CAAwB;AACxB,8CAA2B;AAC3B,2CAAwB;AACxB,4CAAyB;AACzB,wCAAqB;AACrB,0CAAuB;AACvB,0CAAuB;AACvB,4CAAyB;AACzB,gDAA6B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAwB;AACxB,uCAAoB;AACpB,2CAAwB;AACxB,iDAA8B;AAC9B,2CAAwB;AACxB,2CAAwB;AACxB,8CAA2B;AAC3B,6CAA0B;AAC1B,kDAA+B;AAC/B,4CAAyB;AACzB,0CAAuB;AACvB,yCAAsB;AACtB,8CAA2B;AAC3B,0CAAuB;AACvB,8CAA2B;AAC3B,0CAAuB;AACvB,2CAAwB;AACxB,8CAA2B;AAC3B,2CAAwB;AACxB,8CAA2B;AAC3B,2CAAwB;AACxB,4CAAyB;AACzB,wCAAqB;AACrB,0CAAuB;AACvB,0CAAuB;AACvB,4CAAyB;AACzB,gDAA6B;AAC7B,+CAA4B"}

package/dist/locations/get/query.d.ts

@@ -22,6 +22,8 @@ export interface LocationFilters {
      */
     manifestId?: string;
     manifestIds?: string[];
+    /** Offline-sync delta read: matches records whose `lastChanged` >= this ms-epoch. */
+    updatedAfter?: number;
 }
 export interface GetLocationsQuery extends LocationFilters {
     page?: number;

package/dist/organisations/constants.d.ts

@@ -21,12 +21,23 @@ export interface SnapshotPreferences {
 export interface WorkflowPreferences {
     mainMenuEnabled?: boolean;
 }
+/**
+ * Org toggle for the usergroups feature set (field/action visibility +
+ * location record scope). Default OFF: enforcement, hiding, and the
+ * /users/current access lists all short-circuit; usergroup data stays
+ * inert. Every flip to ON recomputes all user caches (and bootstraps the
+ * "all" group iff the org has zero usergroups).
+ */
+export interface UsergroupPreferences {
+    enabled: boolean;
+}
 export interface Preferences {
     readers: ReaderPreferences;
     assets: AssetPreferences;
     locations: LocationPreferences;
     snapshots?: SnapshotPreferences;
     workflows?: WorkflowPreferences;
+    usergroups?: UsergroupPreferences;
     mainMenuLinks?: Array<{
         label: string;
         url: string;

package/dist/usergroups/[id]/index.d.ts

@@ -0,0 +1 @@
+export * from './patch';

package/dist/usergroups/[id]/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./patch"), exports);
+//# sourceMappingURL=index.js.map

package/dist/usergroups/[id]/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/usergroups/[id]/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAuB"}

package/dist/usergroups/[id]/patch/index.d.ts

@@ -0,0 +1,2 @@
+export * from './request';
+export * from './response';

package/dist/usergroups/[id]/patch/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./request"), exports);
+__exportStar(require("./response"), exports);
+//# sourceMappingURL=index.js.map

package/dist/usergroups/[id]/patch/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/usergroups/[id]/patch/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAAyB;AACzB,6CAA0B"}

package/dist/usergroups/[id]/patch/request.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Membership and scope are replaced wholesale; an empty array clears either
+ * (a scope-less group abstains from location scope). `allLocations: false`
+ * clears the sentinel. Changes that alter the actor's own membership are
+ * rejected (the own-role-guard rule).
+ */
+export interface UpdateUsergroupRequest {
+    name?: string;
+    members?: string[];
+    locationScope?: string[];
+    allLocations?: boolean;
+}

package/dist/usergroups/[id]/patch/request.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=request.js.map

package/dist/usergroups/[id]/patch/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../src/usergroups/[id]/patch/request.ts"],"names":[],"mappings":""}

package/dist/usergroups/[id]/patch/response.d.ts

@@ -0,0 +1 @@
+export { GetUsergroupResponse as UpdateUsergroupResponse } from '../../get/response';

package/dist/usergroups/[id]/patch/response.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=response.js.map

package/dist/usergroups/[id]/patch/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../../../src/usergroups/[id]/patch/response.ts"],"names":[],"mappings":""}

package/dist/usergroups/get/index.d.ts

@@ -0,0 +1,2 @@
+export * from './query';
+export * from './response';

package/dist/usergroups/get/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./query"), exports);
+__exportStar(require("./response"), exports);
+//# sourceMappingURL=index.js.map

package/dist/usergroups/get/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/usergroups/get/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAuB;AACvB,6CAA0B"}

package/dist/usergroups/get/query.d.ts

@@ -0,0 +1,12 @@
+import { StandardSortFields, SortOrders } from '../../shared';
+export declare type UsergroupEmbedField = 'meta';
+export interface GetUsergroupsQuery {
+    page?: number;
+    limit?: number;
+    ids?: string[];
+    sort?: StandardSortFields;
+    sortOrder?: SortOrders;
+    embed?: Array<UsergroupEmbedField>;
+    /** Usergroups a given user id is a member of. */
+    member?: string;
+}

package/dist/usergroups/get/query.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=query.js.map

package/dist/usergroups/get/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/usergroups/get/query.ts"],"names":[],"mappings":""}

package/dist/usergroups/get/response.d.ts

@@ -0,0 +1,26 @@
+import { IEntityMeta } from '../../shared';
+import { GetUsergroupsQuery } from './query';
+export interface GetUsergroupResponse {
+    id: string;
+    name: string;
+    /** User ids. Membership's source of truth lives here, never on the user. */
+    members: string[];
+    /**
+     * Location-name path prefixes this group confines its members to. Absent
+     * or empty = the group abstains from location scope (it may exist purely
+     * for field/action grants).
+     */
+    locationScope?: string[];
+    /**
+     * The explicit "entire organisation" sentinel — never expressed as the
+     * root location's path (the root's name is the empty string). Emitted
+     * only when true.
+     */
+    allLocations?: boolean;
+    meta?: IEntityMeta;
+}
+export interface GetUsergroupsResponse {
+    query: GetUsergroupsQuery | null;
+    total: number;
+    items: GetUsergroupResponse[];
+}

package/dist/usergroups/get/response.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=response.js.map

package/dist/usergroups/get/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../../src/usergroups/get/response.ts"],"names":[],"mappings":""}

package/dist/usergroups/index.d.ts

@@ -0,0 +1,4 @@
+export * from './shared';
+export * from './get';
+export * from './post';
+export * from './[id]';

package/dist/usergroups/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./shared"), exports);
+__exportStar(require("./get"), exports);
+__exportStar(require("./post"), exports);
+__exportStar(require("./[id]"), exports);
+//# sourceMappingURL=index.js.map

package/dist/usergroups/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/usergroups/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAwB;AACxB,wCAAqB;AACrB,yCAAsB;AACtB,yCAAsB"}

package/dist/usergroups/post/index.d.ts

@@ -0,0 +1,2 @@
+export * from './request';
+export * from './response';

package/dist/usergroups/post/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./request"), exports);
+__exportStar(require("./response"), exports);
+//# sourceMappingURL=index.js.map

package/dist/usergroups/post/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/usergroups/post/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAAyB;AACzB,6CAA0B"}

package/dist/usergroups/post/request.d.ts

@@ -0,0 +1,11 @@
+export interface PostUsergroupRequest {
+    name: string;
+    /** User ids. The actor's own id is rejected — nobody edits their own
+     * memberships (the own-role-guard rule). */
+    members?: string[];
+    /** Non-empty location-name path prefixes; omitted/empty = the group
+     * abstains from location scope. Never the root path — "entire
+     * organisation" is `allLocations: true`. */
+    locationScope?: string[];
+    allLocations?: boolean;
+}

package/dist/usergroups/post/request.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=request.js.map

package/dist/usergroups/post/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/usergroups/post/request.ts"],"names":[],"mappings":""}

package/dist/usergroups/post/response.d.ts

@@ -0,0 +1 @@
+export { GetUsergroupResponse as PostUsergroupResponse } from '../get/response';

package/dist/usergroups/post/response.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=response.js.map

package/dist/usergroups/post/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../../src/usergroups/post/response.ts"],"names":[],"mappings":""}

package/dist/usergroups/shared.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Effective access level a field grant confers. Most-permissive wins across
+ * a user's groups; a field with no grants at all is open (EDIT) to everyone.
+ * Actions reuse the grant shape with `level` ignored (binary: any grant ⇒
+ * members-only).
+ */
+export declare const PERMISSION_GRANT_LEVELS: readonly ["NONE", "VIEW", "EDIT"];
+export declare type PermissionGrantLevel = (typeof PERMISSION_GRANT_LEVELS)[number];
+/** One usergroup's grant on a field or action. */
+export interface PermissionGrant {
+    /** Usergroup id — must exist in the organisation at write time. */
+    group: string;
+    level: PermissionGrantLevel;
+}
+/**
+ * A user's resolved location scope, derived from their usergroups: any
+ * `allLocations` group — or no location-defining group at all — resolves to
+ * unconfined; otherwise the union of the groups' `locationScope` prefixes.
+ * Emitted on GET /users/current so the client can detect scope changes.
+ */
+export declare type UsergroupsScope = {
+    unconfined: true;
+} | {
+    paths: string[];
+};

package/dist/usergroups/shared.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_GRANT_LEVELS = void 0;
+/**
+ * Effective access level a field grant confers. Most-permissive wins across
+ * a user's groups; a field with no grants at all is open (EDIT) to everyone.
+ * Actions reuse the grant shape with `level` ignored (binary: any grant ⇒
+ * members-only).
+ */
+exports.PERMISSION_GRANT_LEVELS = ['NONE', 'VIEW', 'EDIT'];
+//# sourceMappingURL=shared.js.map

package/dist/usergroups/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/usergroups/shared.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACU,QAAA,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA"}

package/dist/users/[id]/get/response.d.ts

@@ -4,8 +4,6 @@ export interface BaseGetUserResponse {
     name: string;
     role: IEmbeddedEntity;
     organisation: IEmbeddedEntity;
-    permissionLocationId: string;
-    permissionLocationPath: string;
     homeLocationId: string;
     homeLocationPath: string;
     meta?: IEntityMeta;

package/dist/users/[id]/patch/request.d.ts

@@ -1,6 +1,10 @@
 export interface UpdateUserRequest {
     name?: string;
     role?: string;
-    permissionLocationId?: string;
     homeLocationId?: string;
+    /**
+     * Complete usergroup membership for the target (group ids) — replaced
+     * wholesale; [] clears every membership. Never applied to yourself.
+     */
+    usergroups?: string[];
 }

package/dist/users/current.d.ts

@@ -3,6 +3,12 @@ import { Preferences } from '../organisations/constants';
 import { Integrations } from '../integrations/constants';
 import { System } from '../system';
 import { HomeLayout } from './home-layout';
+import { PermissionGrantLevel, UsergroupsScope } from '../usergroups/shared';
+/** One entry of the §1.7 field access list — every org field appears. */
+export interface FieldAccessEntry {
+    id: string;
+    level: PermissionGrantLevel;
+}
 export interface EmbeddedRole extends IEmbeddedEntity {
     permissions: string[];
 }
@@ -16,8 +22,6 @@ export interface CurrentUserResponse {
     name: string;
     role: EmbeddedRole;
     organisation: EmbeddedOrganisation;
-    permissionLocationId: string;
-    permissionLocationPath: string;
     homeLocationId: string;
     homeLocationPath: string;
     meta?: IEntityMeta;
@@ -35,14 +39,28 @@ export interface CurrentUserResponse {
      * user customises — the client then renders its built-in default layout.
      */
     homeLayout?: HomeLayout;
+    /**
+     * UI-only visibility lists (usergroups feature) — COMPLETE: every org
+     * field appears with the caller's effective level (grant-less ⇒ EDIT;
+     * admin bypass ⇒ all EDIT), every usable action id appears. All three
+     * keys are omitted entirely when the org toggle is OFF — client rule:
+     * absent list (or absent id) ⇒ open.
+     */
+    fieldAccess?: FieldAccessEntry[];
+    actionAccess?: string[];
+    /**
+     * The caller's resolved location scope, verbatim from the user-doc cache.
+     * The offline client treats a CHANGE in this value (including appearing/
+     * disappearing) as its delta-cursor + cache reset trigger — delta reads
+     * never re-deliver docs whose lastChanged predates the cursor.
+     */
+    usergroupsScope?: UsergroupsScope;
 }
 export interface CurrentUserPublicResponse {
     id: string;
     name: string;
     role: EmbeddedRole;
     organisation: EmbeddedOrganisation;
-    permissionLocationId: string;
-    permissionLocationPath: string;
     homeLocationId: string;
     homeLocationPath: string;
     meta?: IEntityMeta;

package/dist/users/get/query.d.ts

@@ -10,8 +10,6 @@ export interface GetUsersQuery {
     sort?: StandardSortFields;
     sortOrder?: SortOrders;
     embed?: Array<UserEmbedField>;
-    permissionLocationId?: string;
-    permissionLocationPathBeginsWith?: string;
     homeLocationId?: string;
     homeLocationPathBeginsWith?: string;
 }

package/dist/users/post/request.d.ts

@@ -1,8 +1,13 @@
 export interface BasePostUserRequest {
     name: string;
     role: string;
-    permissionLocationId?: string;
     homeLocationId?: string;
+    /**
+     * Complete usergroup membership for the new user (group ids). Enforced
+     * per the closure invariant when the org toggle is ON; omitted = no
+     * groups (resolves unconfined).
+     */
+    usergroups?: string[];
 }
 export interface PostExternalUserRequest extends BasePostUserRequest {
     type: 'EXTERNAL';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotto/contract",
   "license": "ISC",
-  "version": "1.0.70-alpha.13",
+  "version": "1.0.70-alpha.15",
   "description": "Spotto's API Contract type definitions",
   "main": "./dist/index.js",
   "files": [
@@ -18,5 +18,5 @@
     "@types/geojson": "^7946.0.11",
     "shx": "^0.3.4"
   },
-  "gitHead": "ee164edbac29f51e60ef9c6046399a9e0ac4c316"
+  "gitHead": "1639adf5cd5b9bbac1c3f6aa3c6127bf1e3ee882"
 }