@company-semantics/contracts 0.130.0 → 0.132.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "0.130.0",
+  "version": "0.132.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -60,6 +60,10 @@
       "types": "./src/content/index.ts",
       "default": "./src/content/index.ts"
     },
+    "./impersonation": {
+      "types": "./src/impersonation/index.ts",
+      "default": "./src/impersonation/index.ts"
+    },
     "./schemas/guard-result.schema.json": "./schemas/guard-result.schema.json"
   },
   "types": "./src/index.ts",

package/src/guards/config.ts

@@ -15,15 +15,19 @@ import type { CheckResult, Soc2ControlArea } from './types';
 // =============================================================================
 
 /**
- * Three-tier size limit for a file role.
- * - target: Ideal maximum (for new code)
- * - warning: Soft limit (CI warns but passes)
- * - hard: Hard limit (CI fails)
+ * Role limit for the file-size guard, expressed as fractions of the repo's
+ * file-size envelope (envelope = universalLimit × (1 + overrideMaxOveragePct)).
+ *
+ * Only warnings are role-specific; the envelope is a single hard authority
+ * that applies to every file regardless of role.
+ *
+ * @field warnPct — Warning threshold as a fraction of envelope. Must be in (0, 1).
+ * @field targetPct — Optional ideal ceiling for new code in this role, as a
+ *                    fraction of envelope. Informational only — not enforced.
  */
 export interface RoleLimit {
-  target: number;
-  warning: number;
-  hard: number;
+  warnPct: number;
+  targetPct?: number;
 }
 
 // =============================================================================
@@ -74,24 +78,6 @@ export interface GuardConfig {
    */
   universalWarningThreshold: number;
 
-  /**
-   * Export complexity thresholds.
-   * Files with more exports than these limits are flagged.
-   */
-  exportLimits?: {
-    warning: number;
-    error: number;
-  };
-
-  /**
-   * Import fanout thresholds.
-   * Files with more imports than these limits are flagged.
-   */
-  importLimits?: {
-    warning: number;
-    error: number;
-  };
-
   /**
    * Domain directories to check for READMEs.
    * Example: ['src/domain', 'src/providers', 'src/interfaces']

package/src/impersonation/index.ts

@@ -0,0 +1,37 @@
+/**
+ * Impersonation Domain Barrel
+ *
+ * Re-exports impersonation types and response schemas.
+ * Import from '@company-semantics/contracts/impersonation'.
+ */
+
+// =============================================================================
+// Core Types (from flat module)
+// =============================================================================
+
+export type {
+  AuthMode,
+  ImpersonationSession,
+  RestrictedImpersonationAction,
+  ImpersonationCapability,
+  ImpersonationSessionSummary,
+  ImpersonationAuditEventType,
+} from '../impersonation'
+
+export { RESTRICTED_IMPERSONATION_ACTIONS } from '../impersonation'
+
+// =============================================================================
+// HTTP Response Schemas (Zod)
+// =============================================================================
+
+export {
+  ImpersonationSessionSchema,
+  ImpersonationSessionResponseSchema,
+  ImpersonationSessionNullableResponseSchema,
+  EndImpersonationResponseSchema,
+} from './schemas'
+
+export type {
+  ImpersonationSessionResponse,
+  EndImpersonationResponse,
+} from './schemas'

package/src/impersonation/schemas.ts

@@ -0,0 +1,40 @@
+/**
+ * Impersonation Response Schemas
+ *
+ * Zod schemas for impersonation HTTP endpoint responses.
+ * These schemas are used for runtime validation at API contract surfaces.
+ *
+ * Mirrors the ImpersonationSession interface in ../impersonation.ts.
+ * Both are maintained in parallel — Zod schema mirrors the TS interface.
+ */
+
+import { z } from 'zod'
+
+export const ImpersonationSessionSchema = z.object({
+  impersonationSessionId: z.string(),
+  adminUserId: z.string(),
+  targetUserId: z.string(),
+  reason: z.string(),
+  reasonHash: z.string(),
+  startedAt: z.string().datetime({ offset: true }),
+  expiresAt: z.string().datetime({ offset: true }),
+  endedAt: z.string().datetime({ offset: true }).nullable(),
+  ipAddress: z.string(),
+  userAgent: z.string(),
+})
+
+export const ImpersonationSessionResponseSchema = z.object({
+  session: ImpersonationSessionSchema,
+})
+
+export const ImpersonationSessionNullableResponseSchema = z.object({
+  session: ImpersonationSessionSchema.nullable(),
+})
+
+export const EndImpersonationResponseSchema = z.object({
+  success: z.literal(true),
+  ok: z.literal(true),
+})
+
+export type ImpersonationSessionResponse = z.infer<typeof ImpersonationSessionResponseSchema>
+export type EndImpersonationResponse = z.infer<typeof EndImpersonationResponseSchema>