@company-semantics/contracts 0.61.2 → 0.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "0.61.2",
+  "version": "0.63.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/chat/index.ts

@@ -18,7 +18,6 @@ export type {
   CreateShareRequest,
   UpdateShareRequest,
   // Chat lifecycle types
-  ChatStatus,
   TitleSource,
   ChatListFilters,
   ChatSummaryExtended,

package/src/chat/types.ts

@@ -109,13 +109,6 @@ export interface UpdateShareRequest {
 // Chat Lifecycle Types
 // =============================================================================
 
-/**
- * Chat status for lifecycle management.
- * - active: Normal visible chat
- * - archived: Hidden from main list, still searchable
- */
-export type ChatStatus = 'active' | 'archived'
-
 /**
  * Title source - tracks how the title was set.
  * - auto: Generated automatically by LLM
@@ -129,8 +122,6 @@ export type TitleSource = 'auto' | 'manual'
 export interface ChatListFilters {
   /** Search query - matches against title */
   search?: string
-  /** Filter by status. Defaults to 'active' */
-  status?: ChatStatus | 'all'
   /** Include pinned chats at top */
   includePinned?: boolean
   /** Pagination limit */
@@ -140,10 +131,9 @@ export interface ChatListFilters {
 }
 
 /**
- * Extended chat summary with pin/archive/title status.
+ * Extended chat summary with pin/title status.
  */
 export interface ChatSummaryExtended extends ChatSummary {
-  status: ChatStatus
   /** If pinned, when it was pinned */
   pinnedAt: string | null
   /** How the title was set: 'auto' or 'manual' */
@@ -203,7 +193,7 @@ export type InvalidationReason = 'external-mutation' | 'bulk-operation' | 'sync-
 /**
  * Fields that can change on a chat, used in changed[] array.
  */
-export type ChatChangedField = 'title' | 'titleSource' | 'status' | 'pinnedAt'
+export type ChatChangedField = 'title' | 'titleSource' | 'pinnedAt'
 
 // =============================================================================
 // Domain Events (past-tense facts, carry full state)
@@ -227,8 +217,6 @@ export interface ChatCreatedEvent extends BaseEvent {
     title: string
     /** How the title was set */
     titleSource: TitleSource
-    /** Chat status */
-    status: ChatStatus
     /** When pinned (null if not pinned) */
     pinnedAt: string | null
     /** Message count */
@@ -243,7 +231,7 @@ export interface ChatCreatedEvent extends BaseEvent {
 }
 
 /**
- * Emitted when chat metadata changes (title, pin, archive, etc.)
+ * Emitted when chat metadata changes (title, pin, etc.)
  * Carries full current state - clients should replace local state entirely.
  */
 export interface ChatUpdatedEvent extends BaseEvent {
@@ -253,7 +241,6 @@ export interface ChatUpdatedEvent extends BaseEvent {
     title: string
     titleSource: TitleSource | null
     titleGeneratedAt: string | null
-    status: ChatStatus
     pinnedAt: string | null
     messageCount: number
     createdAt: string

package/src/impersonation.ts

@@ -0,0 +1,68 @@
+/**
+ * Break-Glass Impersonation — Shared Vocabulary
+ *
+ * This module defines the types for the emergency impersonation mechanism.
+ * See ADR-BE-068 for the trust model and invariant documentation.
+ */
+
+// Authentication mode — tags every request context
+export type AuthMode = 'STANDARD' | 'BREAK_GLASS';
+
+// Impersonation session model — full session state
+export interface ImpersonationSession {
+  readonly impersonationSessionId: string;
+  readonly adminUserId: string;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly reasonHash: string; // SHA-256 of reason text — tamper-evidence
+  readonly startedAt: string; // ISO 8601
+  readonly expiresAt: string; // ISO 8601
+  readonly endedAt: string | null; // ISO 8601 or null if active
+  readonly ipAddress: string;
+  readonly userAgent: string;
+}
+
+// Restricted action classes — single source of truth
+// Backend impersonation middleware consumes this enum centrally.
+// Routes do NOT self-classify. This prevents bypass via new routes.
+export type RestrictedImpersonationAction =
+  | 'delete_chat'
+  | 'delete_message'
+  | 'modify_billing'
+  | 'rotate_credentials'
+  | 'invite_remove_users'
+  | 'accept_agreements'
+  | 'irreversible_write';
+
+// All restricted actions as a const array for runtime checks
+export const RESTRICTED_IMPERSONATION_ACTIONS: readonly RestrictedImpersonationAction[] = [
+  'delete_chat',
+  'delete_message',
+  'modify_billing',
+  'rotate_credentials',
+  'invite_remove_users',
+  'accept_agreements',
+  'irreversible_write',
+] as const;
+
+// Impersonation-specific company capability
+export type ImpersonationCapability = 'company.impersonate';
+
+// Session summary — emitted on impersonation.ended and impersonation.expired
+export interface ImpersonationSessionSummary {
+  readonly impersonationSessionId: string;
+  readonly adminUserId: string;
+  readonly targetUserId: string;
+  readonly durationMs: number;
+  readonly actionCount: number;
+  readonly blockedActionCount: number;
+}
+
+// Impersonation audit event types
+export type ImpersonationAuditEventType =
+  | 'impersonation.started'
+  | 'impersonation.ended'
+  | 'impersonation.expired'
+  | 'impersonation.session_summary'
+  | 'impersonated.action'
+  | 'impersonation.blocked_action';

package/src/index.ts

@@ -150,7 +150,6 @@ export type {
   CreateShareRequest,
   UpdateShareRequest,
   // Chat lifecycle types
-  ChatStatus,
   TitleSource,
   ChatListFilters,
   ChatSummaryExtended,
@@ -402,3 +401,16 @@ export { RateLimitTier } from './rate-limit/index'
 // Billing domain types (v1 — read-only)
 // @see PRD-00121 for design rationale
 export type { OrgPlanStatus, OrgBillingInfo } from './billing/index'
+
+// Impersonation types (break-glass emergency access)
+// @see ADR-BE-068 for trust model
+export type {
+  AuthMode,
+  ImpersonationSession,
+  RestrictedImpersonationAction,
+  ImpersonationCapability,
+  ImpersonationSessionSummary,
+  ImpersonationAuditEventType,
+} from './impersonation'
+
+export { RESTRICTED_IMPERSONATION_ACTIONS } from './impersonation'