@company-semantics/contracts 10.0.0 → 12.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "10.0.0",
+  "version": "12.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -115,7 +115,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.19.19",
+    "@types/node": "^25.9.2",
     "husky": "^9.1.7",
     "lint-staged": "^17.0.7",
     "markdownlint-cli2": "^0.22.1",

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = '1173d8fa2df9' as const;
-export const SPEC_HASH_FULL = '1173d8fa2df90dbf7a46608635f61e69939616ed509f6109bdf478fc1cd4a9c0' as const;
+export const SPEC_HASH = '8d48325678a4' as const;
+export const SPEC_HASH_FULL = '8d48325678a4837e0921b96c4c80fd3fe898dbd26cabb48483e9a5f3f7f9e488' as const;

package/src/api/generated.ts

@@ -126,7 +126,7 @@ export interface paths {
         patch: operations["updateUserProfile"];
         trace?: never;
     };
-    "/api/user/resync-slack-avatar": {
+    "/api/user/resync-slack-avatar/preview": {
         parameters: {
             query?: never;
             header?: never;
@@ -135,8 +135,25 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Resync Slack avatar */
-        post: operations["resyncSlackAvatar"];
+        /** Preview a Slack avatar resync (stages without persisting) */
+        post: operations["resyncSlackAvatarPreview"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/user/resync-slack-avatar/commit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Commit a previewed Slack avatar resync */
+        post: operations["resyncSlackAvatarCommit"];
         delete?: never;
         options?: never;
         head?: never;
@@ -2870,6 +2887,32 @@ export interface components {
             preferredName?: string | null;
             primaryUnitId?: string | null;
         };
+        ResyncSlackAvatarPreviewResponse: {
+            /** @constant */
+            success: true;
+            avatar: {
+                /** @enum {string} */
+                source: "photo" | "initials";
+                url?: string;
+                initials: string;
+            };
+            candidateKey: string;
+            contentSha256: string;
+        };
+        ResyncSlackAvatarCommitResponse: {
+            /** @constant */
+            success: true;
+            avatar: {
+                /** @enum {string} */
+                source: "photo" | "initials";
+                url?: string;
+                initials: string;
+            };
+        };
+        ResyncSlackAvatarCommitRequest: {
+            candidateKey: string;
+            contentSha256: string;
+        };
         SamlCallbackRequest: {
             SAMLResponse: string;
             RelayState: string;
@@ -3748,6 +3791,7 @@ export interface components {
             /** @enum {string} */
             level: "root" | "department" | "team" | "context";
             content: string;
+            contentRedacted?: boolean;
             /** @enum {string} */
             visibility: "private" | "unit" | "org";
             parentId: string | null;
@@ -4761,7 +4805,7 @@ export interface components {
                     id: string;
                 };
                 /** @enum {string} */
-                access_level: "owner" | "editor" | "commenter" | "viewer";
+                access_level: "meta" | "owner" | "editor" | "commenter" | "viewer";
                 /** @enum {string} */
                 source: "explicit" | "ownership" | "visibility" | "inheritance" | "migration";
             }[];
@@ -4788,7 +4832,7 @@ export interface components {
                 /** Format: uuid */
                 entity_id: string;
                 /** @enum {string} */
-                access_level: "owner" | "editor" | "commenter" | "viewer";
+                access_level: "meta" | "owner" | "editor" | "commenter" | "viewer";
                 /** @enum {string} */
                 source: "explicit" | "ownership" | "visibility" | "inheritance" | "migration";
             }[];
@@ -5097,7 +5141,7 @@ export interface operations {
             };
         };
     };
-    resyncSlackAvatar: {
+    resyncSlackAvatarPreview: {
         parameters: {
             query?: never;
             header?: never;
@@ -5106,12 +5150,38 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Avatar resynced successfully */
+            /** @description Slack avatar staged for preview; persist via /commit */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ResyncSlackAvatarPreviewResponse"];
+                };
+            };
+        };
+    };
+    resyncSlackAvatarCommit: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResyncSlackAvatarCommitRequest"];
+            };
+        };
+        responses: {
+            /** @description Previewed Slack avatar persisted */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResyncSlackAvatarCommitResponse"];
+                };
             };
         };
     };

package/src/content/schemas.ts

@@ -74,6 +74,12 @@ export const CompanyMdDocResponseSchema = z.object({
   title: z.string(),
   level: z.enum(["root", "department", "team", "context"]),
   content: z.string(),
+  /**
+   * When `true`, `content` is the redacted empty body (`''`) returned to a
+   * metadata-only (meta-tier) viewer who administers the doc but may not read
+   * its body (ADR-BE-245). Omitted/`false` on the normal full-content path.
+   */
+  contentRedacted: z.boolean().optional(),
   visibility: z.enum(["private", "unit", "org"]),
   parentId: z.string().nullable(),
   owningUnitId: z.string().nullable(),

package/src/org/company-md.ts

@@ -119,6 +119,12 @@ export interface CompanyMdTreeNode extends CompanyMdNodeIdentity {
 
 export interface CompanyMdDocCore extends CompanyMdNodeIdentity {
   readonly content: string;
+  /**
+   * When `true`, `content` is the redacted empty body (`''`) returned to a
+   * metadata-only (meta-tier) viewer who administers the doc but may not read
+   * its body (ADR-BE-245). Omitted/`false` on the normal full-content path.
+   */
+  readonly contentRedacted?: boolean;
 }
 
 export interface CompanyMdDocCollaborators {

package/src/permissions/access-levels.ts

@@ -1,18 +1,25 @@
 /**
  * Permission Access Levels
  *
- * Canonical four-level access vocabulary for object permissions across
- * Company Semantics, modeled on the Google-Docs four-level scheme.
+ * Canonical access vocabulary for object permissions across
+ * Company Semantics, modeled on the Google-Docs four-level scheme plus a
+ * weakest `meta` tier below `viewer`.
  *
  * Authority: ADR-CTRL-085 (Rights Table). See ADR-CTRL-084 for how these
  * levels are materialized into `effective_acl_grants`, and ADR-CTRL-086 for
  * the aggregation rule (most-permissive across sources).
  *
  * The commenter level is currently a stub — see ADR-CTRL-087.
+ *
+ * `meta` is the metadata-only tier used for org-admin lifecycle access
+ * (ADR-BE-245). It is materialized/derived only — never an explicit
+ * `acl_grants` value — and sits strictly below `viewer`, so
+ * `isAtLeast('meta', 'viewer') === false`.
  */
 import { z } from "zod";
 
 export const ACCESS_LEVELS = [
+  "meta",
   "owner",
   "editor",
   "commenter",
@@ -27,10 +34,11 @@ export const AccessLevelSchema = z.enum(ACCESS_LEVELS);
  * Used by `highestGrant()` in AUTH-006 (PRD-00674) to aggregate across sources.
  */
 export const ACCESS_LEVEL_ORDER: Record<AccessLevel, number> = {
-  viewer: 0,
-  commenter: 1,
-  editor: 2,
-  owner: 3,
+  meta: 0,
+  viewer: 1,
+  commenter: 2,
+  editor: 3,
+  owner: 4,
 };
 
 /**