@company-semantics/contracts 1.17.0 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -112,17 +112,17 @@
     "node": "22.x"
   },
   "dependencies": {
-    "zod": "^4.2.1"
+    "zod": "^4.4.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
-    "markdownlint-cli2": "^0.22.0",
+    "markdownlint-cli2": "^0.22.1",
     "openapi-typescript": "^7.13.0",
     "tsx": "^4.21.0",
     "typescript": "^5",
-    "vitest": "^4.1.4",
+    "vitest": "^4.1.5",
     "yaml": "^2.8.3"
   },
   "pnpm": {

package/src/impersonation/index.ts

@@ -29,9 +29,14 @@ export {
   ImpersonationSessionResponseSchema,
   ImpersonationSessionNullableResponseSchema,
   EndImpersonationResponseSchema,
+  ImpersonationSessionWireDtoSchema,
 } from './schemas'
 
 export type {
   ImpersonationSessionResponse,
   EndImpersonationResponse,
+  ImpersonationSessionWireDtoParsed,
 } from './schemas'
+
+// Wire DTO for SSE projection (PRD-00557 F5)
+export type { ImpersonationSessionWireDto } from '../impersonation-events'

package/src/impersonation/schemas.ts

@@ -36,5 +36,24 @@ export const EndImpersonationResponseSchema = z.object({
   ok: z.literal(true),
 })
 
+/**
+ * Wire-only DTO for SSE snapshot/started events (PRD-00557 F5).
+ *
+ * .strict() rejects extraneous keys so a backend regression that leaks
+ * reason / reasonHash / ipAddress / userAgent is caught at the contract
+ * boundary, not at the network. This complements the type-level
+ * narrowing in src/impersonation-events.ts.
+ */
+export const ImpersonationSessionWireDtoSchema = z
+  .object({
+    id: z.string(),
+    targetUserId: z.string(),
+    startedAt: z.string().datetime({ offset: true }),
+    expiresAt: z.string().datetime({ offset: true }),
+    endedAt: z.string().datetime({ offset: true }).nullable(),
+  })
+  .strict()
+
 export type ImpersonationSessionResponse = z.infer<typeof ImpersonationSessionResponseSchema>
 export type EndImpersonationResponse = z.infer<typeof EndImpersonationResponseSchema>
+export type ImpersonationSessionWireDtoParsed = z.infer<typeof ImpersonationSessionWireDtoSchema>

package/src/impersonation-events.ts

@@ -7,7 +7,19 @@
  */
 
 import type { BaseEvent } from './chat/types'
-import type { ImpersonationSession } from './impersonation'
+
+/**
+ * Minimal projection of an impersonation session for over-the-wire delivery.
+ * Excludes reason, reasonHash, ipAddress, userAgent — those stay server-side
+ * (PRD-00557 F5: type-impossible wire exposure of admin-private fields).
+ */
+export interface ImpersonationSessionWireDto {
+  readonly id: string
+  readonly targetUserId: string
+  readonly startedAt: string
+  readonly expiresAt: string
+  readonly endedAt: string | null
+}
 
 /**
  * Sent as the first frame on SSE connection.
@@ -17,7 +29,7 @@ import type { ImpersonationSession } from './impersonation'
 export interface ImpersonationSessionSnapshotEvent extends BaseEvent {
   type: 'impersonation.session.snapshot'
   data: {
-    session: ImpersonationSession | null
+    session: ImpersonationSessionWireDto | null
   }
 }
 
@@ -25,7 +37,7 @@ export interface ImpersonationSessionSnapshotEvent extends BaseEvent {
 export interface ImpersonationSessionStartedEvent extends BaseEvent {
   type: 'impersonation.session.started'
   data: {
-    session: ImpersonationSession
+    session: ImpersonationSessionWireDto
   }
 }