@company-semantics/contracts 0.23.1 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -55,7 +55,7 @@
     "guard:version-tag:json": "npx tsx scripts/ci/version-tag-guard.ts --json",
     "guard:test": "vitest run scripts/ci/__tests__",
     "release": "npx tsx scripts/release.ts",
-    "prepublishOnly": "pnpm guard:version-tag",
+    "prepublishOnly": "echo 'ERROR: Publishing is CI-only via tag push. Use pnpm release instead.' && exit 1",
     "test": "vitest run scripts/ci/__tests__"
   },
   "packageManager": "pnpm@10.25.0",

package/src/guards/config.ts

@@ -207,6 +207,18 @@ export interface VulnerabilitiesBaseline {
   }>;
 }
 
+/**
+ * Contracts consumer guard configuration.
+ * Enforces: consumers never advance ahead of npm.
+ *
+ * Verifies that the @company-semantics/contracts version specified
+ * in package.json exists on npm before allowing consumer updates.
+ */
+export interface ContractsConsumerBaseline {
+  /** Path to package.json relative to repo root */
+  packageJsonPath: string;
+}
+
 /**
  * Structural guard baselines.
  * Product repos provide DATA only; CI orchestrator owns guard implementations.
@@ -226,6 +238,13 @@ export interface StructuralBaselines {
    * CI injects checkVulnerabilities based on this config.
    */
   vulnerabilities?: VulnerabilitiesBaseline;
+
+  /**
+   * Contracts consumer check configuration.
+   * CI injects checkContractsConsumer based on this config.
+   * Enforces: consumers never advance ahead of npm.
+   */
+  contractsConsumer?: ContractsConsumerBaseline;
 }
 
 /**
@@ -373,6 +392,8 @@ export interface GuardCheckRegistry {
     structural?: BoundGuardCheck[];
     behavioral?: BoundGuardCheck[];
     invariants?: BoundGuardCheck[];
+    /** Evolution guards: drift detection (advisory only) */
+    evolution?: BoundGuardCheck[];
     /** Meta-guards: protect the guard system itself (coverage correctness) */
     meta?: BoundGuardCheck[];
   };

package/src/guards/index.ts

@@ -47,6 +47,7 @@ export type {
   StructuralBaselines,
   ScriptsDepsBaseline,
   VulnerabilitiesBaseline,
+  ContractsConsumerBaseline,
   EvolutionBaselines,
   ContractsFreshnessBaseline,
   CoverageBaseline,

package/src/mcp/index.ts

@@ -4,6 +4,10 @@
  * Types for tool discovery flow (read-only, UI-first).
  * Same descriptor used for discovery and invocation, different fields matter.
  *
+ * TWO SHAPES (same conceptual data, different layers):
+ * - ToolDiscoveryResponse: HTTP transport (GET /api/capabilities/tools response)
+ * - ToolListMessagePart: Chat protocol (atomic message part in conversation)
+ *
  * INVARIANTS:
  * - Discovery is descriptive (never executes)
  * - Invocation is authoritative (runtime is executor)