@company-semantics/contracts 16.0.0 → 17.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "16.0.0",
+  "version": "17.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -111,7 +111,9 @@
     "generate:api-types:check": "openapi-typescript openapi/backend.yaml -o /tmp/cs-api-types-check.ts && diff -q src/api/generated.ts /tmp/cs-api-types-check.ts",
     "generate:current": "tsx ../company-semantics-ci/scripts/generate-current.ts",
     "repo-map": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --write",
-    "repo-map:check": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --check"
+    "repo-map:check": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --check",
+    "readme-api": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --write",
+    "readme-api:check": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --check"
   },
   "packageManager": "pnpm@10.25.0",
   "engines": {

package/src/api/README.md

@@ -26,14 +26,33 @@ Regenerate with `pnpm generate:api-types`. Check for staleness with `pnpm genera
 
 The file is committed to the repo (not .gitignored) so consumers can import types without running the generator, and type changes are visible in code review diffs.
 
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
+
 ## Public API
 
-- `buildToolDiscoveryResponse(tools, includeGraph)` — Constructs a `ToolDiscoveryResponse`, optionally including the capability graph derived from tool metadata
-- `paths` (type) — OpenAPI route type map for typed fetch clients
-- `components` (type) — OpenAPI schema types
-- `operations` (type) — OpenAPI operation types keyed by operationId
+- `CursorPage` _(type)_
+- `CursorPageSchema`
+- `ErrorResponse` _(type)_
+- `ErrorResponseSchema`
+- `SPEC_HASH`
+- `SPEC_HASH_FULL`
+- `components` _(type)_
+- `operations` _(type)_
+- `paths` _(type)_
+
+<!-- END GENERATED: readme-public-api -->
+
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
 ## Dependencies
 
-- `src/mcp/` — `MCPToolDescriptor`, `ToolDiscoveryResponse`, `CapabilityGraph` types and `buildCapabilityGraph` function
-- `openapi/backend.yaml` — Source OpenAPI 3.1 spec for type generation
+**Internal domains:**
+
+- `mcp`
+- `resource-response`
+
+**External packages:**
+
+- `zod`
+
+<!-- END GENERATED: readme-dependencies -->

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = 'bd74b6f7478d' as const;
-export const SPEC_HASH_FULL = 'bd74b6f7478dcfb445d1e848ab3b65309f9b602b40c3fe2f0ce29b484e94943f' as const;
+export const SPEC_HASH = '0145da47b329' as const;
+export const SPEC_HASH_FULL = '0145da47b329d350ecef5661168bcdd0a7399c5aa3cacd2ad53f5d76ef2d5908' as const;

package/src/api/generated.ts

@@ -1955,7 +1955,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/org-units/{unitId}/structural-leaders": {
+    "/api/org-units/{unitId}/unit-owners": {
         parameters: {
             query?: never;
             header?: never;
@@ -1964,15 +1964,15 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Assign a user as structural leader of an org unit */
-        post: operations["assignOrgUnitStructuralLeader"];
+        /** Assign a user as unit owner of an org unit */
+        post: operations["assignOrgUnitOwner"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/api/org-units/{unitId}/structural-leaders/{userId}": {
+    "/api/org-units/{unitId}/unit-owners/{userId}": {
         parameters: {
             query?: never;
             header?: never;
@@ -1982,8 +1982,8 @@ export interface paths {
         get?: never;
         put?: never;
         post?: never;
-        /** Remove a user as structural leader of an org unit */
-        delete: operations["removeOrgUnitStructuralLeader"];
+        /** Remove a user as unit owner of an org unit */
+        delete: operations["removeOrgUnitOwner"];
         options?: never;
         head?: never;
         patch?: never;
@@ -4628,7 +4628,7 @@ export interface components {
             revokedAt: string | null;
             reason: string | null;
         };
-        StructuralLeaderAssignResponse: {
+        UnitOwnerAssignResponse: {
             /** Format: uuid */
             id: string;
             /** Format: uuid */
@@ -8485,7 +8485,7 @@ export interface operations {
             };
         };
     };
-    assignOrgUnitStructuralLeader: {
+    assignOrgUnitOwner: {
         parameters: {
             query?: never;
             header?: never;
@@ -8505,18 +8505,18 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Created structural-leader overlay row */
+            /** @description Created unit-owner overlay row */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["StructuralLeaderAssignResponse"];
+                    "application/json": components["schemas"]["UnitOwnerAssignResponse"];
                 };
             };
         };
     };
-    removeOrgUnitStructuralLeader: {
+    removeOrgUnitOwner: {
         parameters: {
             query?: never;
             header?: never;
@@ -8528,7 +8528,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Structural-leader authority revoked */
+            /** @description Unit-owner authority revoked */
             204: {
                 headers: {
                     [name: string]: unknown;

package/src/auth/README.md

@@ -9,14 +9,26 @@ Shared types for authentication flows across Company Semantics codebases. Define
 - AuthStartResponse is a discriminated union on `mode` — consumers must handle all three modes
 - OTPErrorCode values are stable strings used by both backend (error generation) and frontend (user messaging)
 
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
+
 ## Public API
 
-**Types:**
+- `AuthStartMode` _(type)_
+- `AuthStartResponse` _(type)_
+- `OTPErrorCode`
+
+<!-- END GENERATED: readme-public-api -->
 
-- `OTPErrorCode` — enum: `InvalidCode`, `Expired`, `AlreadyUsed`, `NotFound`
-- `AuthStartMode` — `'otp' | 'sso' | 'hybrid'`
-- `AuthStartResponse` — discriminated union describing auth flow entry point
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
 ## Dependencies
 
-- None (leaf domain in contracts)
+**Internal domains:**
+
+_None._
+
+**External packages:**
+
+_None._
+
+<!-- END GENERATED: readme-dependencies -->

package/src/billing/README.md

@@ -12,11 +12,25 @@ Defines the shared type vocabulary for organization billing status and plan info
 - `billingOwnerUserId` must equal `org.ownerUserId` — no separate billing owner concept in v1
 - `OrgPlanStatus` is a closed union: `active`, `trialing`, `past_due`, `canceled`
 
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
+
 ## Public API
 
-- `OrgPlanStatus` — Union type for organization plan states
-- `OrgBillingInfo` — Read-only billing information (plan name, status, cadence, seats, billing owner)
+- `OrgBillingInfo` _(type)_
+- `OrgPlanStatus` _(type)_
+
+<!-- END GENERATED: readme-public-api -->
+
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
 ## Dependencies
 
-- None — leaf domain with no imports from other contracts modules
+**Internal domains:**
+
+_None._
+
+**External packages:**
+
+_None._
+
+<!-- END GENERATED: readme-dependencies -->

package/src/chat/README.md

@@ -13,29 +13,90 @@ Shared types for chat persistence, sharing, real-time events, and runtime profil
 - Runtime profile labels are vendor-agnostic (no model names in UI)
 - Default runtime profile is `agentic`
 
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
+
 ## Public API
 
-**Types:**
+- `BaseEvent` _(type)_
+- `BaseEventSchema`
+- `CHAT_RUNTIME_PROFILES`
+- `ChatByInteractionResponse` _(type)_
+- `ChatByInteractionResponseSchema`
+- `ChatChangedField` _(type)_
+- `ChatChangedFieldSchema`
+- `ChatCreatedEvent` _(type)_
+- `ChatCreatedEventSchema`
+- `ChatDeletedEvent` _(type)_
+- `ChatDeletedEventSchema`
+- `ChatDetail` _(type)_
+- `ChatDetailSchema`
+- `ChatDomainEvent` _(type)_
+- `ChatDomainEventSchema`
+- `ChatInvalidationEvent` _(type)_
+- `ChatInvalidationEventSchema`
+- `ChatListFilters` _(type)_
+- `ChatListResponse` _(type)_
+- `ChatListResponseSchema`
+- `ChatMessage` _(type)_
+- `ChatMessageSchema`
+- `ChatRuntimeProfile` _(type)_
+- `ChatRuntimeProfileInfo` _(type)_
+- `ChatShareInfo` _(type)_
+- `ChatShareInfoSchema`
+- `ChatSseEvent` _(type)_
+- `ChatSseEventSchema`
+- `ChatSuccessResponse` _(type)_
+- `ChatSuccessResponseSchema`
+- `ChatSummary` _(type)_
+- `ChatSummaryExtended` _(type)_
+- `ChatSummaryExtendedSchema`
+- `ChatSummarySchema`
+- `ChatUpdatedEvent` _(type)_
+- `ChatUpdatedEventSchema`
+- `ChatVisibility` _(type)_
+- `ChatVisibilitySchema`
+- `CreateChatResponse` _(type)_
+- `CreateChatResponseSchema`
+- `CreateShareRequest` _(type)_
+- `CreateShareResponse` _(type)_
+- `CreateShareResponseSchema`
+- `DEFAULT_CHAT_RUNTIME_PROFILE`
+- `GetChatResponse` _(type)_
+- `GetChatResponseSchema`
+- `InvalidateChatEvent` _(type)_
+- `InvalidateChatEventSchema`
+- `InvalidateChatListEvent` _(type)_
+- `InvalidateChatListEventSchema`
+- `InvalidationReason` _(type)_
+- `InvalidationReasonSchema`
+- `IsoDateString`
+- `ListSharesResponse` _(type)_
+- `ListSharesResponseSchema`
+- `SharedChatMessage` _(type)_
+- `SharedChatMessageSchema`
+- `SharedChatView` _(type)_
+- `SharedChatViewSchema`
+- `TitleGenerationRequest` _(type)_
+- `TitleGenerationResponse` _(type)_
+- `TitleGenerationResponseSchema`
+- `TitleSource` _(type)_
+- `TitleSourceSchema`
+- `UpdateShareRequest` _(type)_
+- `UpdateShareResponse` _(type)_
+- `UpdateShareResponseSchema`
+
+<!-- END GENERATED: readme-public-api -->
 
-- `ChatVisibility` — `'private' | 'public'` share visibility
-- `ChatSummary`, `ChatSummaryExtended` — list view models
-- `ChatShareInfo`, `SharedChatView`, `SharedChatMessage` — sharing types
-- `CreateShareRequest`, `UpdateShareRequest` — share mutation requests
-- `TitleSource`, `ChatListFilters`, `TitleGenerationRequest/Response` — lifecycle types
-- `ChatRuntimeProfile` — `'fast' | 'balanced' | 'agentic'` orchestration strategy
-- `ChatRuntimeProfileInfo` — profile metadata for UI rendering
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
-**SSE event types:**
+## Dependencies
 
-- `ChatCreatedEvent`, `ChatUpdatedEvent`, `ChatDeletedEvent` — domain events
-- `InvalidateChatEvent`, `InvalidateChatListEvent` — staleness signals
-- `ChatSseEvent` — union of all SSE event types
+**Internal domains:**
 
-**Runtime values:**
+_None._
 
-- `CHAT_RUNTIME_PROFILES` — ordered array of profile info for UI rendering
-- `DEFAULT_CHAT_RUNTIME_PROFILE` — `'agentic'`
+**External packages:**
 
-## Dependencies
+- `zod`
 
-- None (leaf domain in contracts)
+<!-- END GENERATED: readme-dependencies -->

package/src/ci-envelope/README.md

@@ -13,24 +13,36 @@ Defines the shared type vocabulary for CI execution envelopes. An envelope is an
 - `ENVELOPE_TRANSITIONS` documents the state machine but does not enforce it
 - Terminal states: `blocked` and `finalized` have no outgoing transitions
 
-## Public API
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
 
-**Types:**
+## Public API
 
-- `CIExecutionEnvelope` — Core envelope record (version, id, actor, session, intent, scope, authority, guardPlan, status, outcome)
-- `CIEnvelopeStatus` — Lifecycle states: `proposed` → `validated` → `executing` → `finalized` (or `blocked`)
-- `ExecutionIntent` — Semantic categories: `feature_extension`, `bug_fix`, `refactor_structural`, `guard_update`, `policy_update`, `schema_change`, `doc_update`, `cleanup`, `experimental`
-- `CIIntentDeclaration` — Intent with description and optional ADR references
-- `CIExecutionScope` — Affected repos, path globs, and change kinds
-- `CIAuthorityGrant` — Permission basis (CLAUDE.md/AI_AUTONOMY.md references)
-- `CIGuardPlan` — Required and advisory guard lists
-- `CIActorInfo`, `CISessionInfo` — Actor and session metadata
-- `CIGuardViolation`, `CIExecutionOutcome` — Post-execution audit data
+- `CIActorInfo` _(type)_
+- `CIAuthorityGrant` _(type)_
+- `CIChangeKind` _(type)_
+- `CIEnvelopeStatus` _(type)_
+- `CIExecutionEnvelope` _(type)_
+- `CIExecutionOutcome` _(type)_
+- `CIExecutionScope` _(type)_
+- `CIGuardPlan` _(type)_
+- `CIGuardViolation` _(type)_
+- `CIIntentDeclaration` _(type)_
+- `CISessionInfo` _(type)_
+- `ENVELOPE_TRANSITIONS`
+- `ExecutionIntent` _(type)_
 
-**Constants:**
+<!-- END GENERATED: readme-public-api -->
 
-- `ENVELOPE_TRANSITIONS` — Valid status transition graph (documentation only)
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
 ## Dependencies
 
-- None (leaf module — no imports from other contracts domains)
+**Internal domains:**
+
+_None._
+
+**External packages:**
+
+_None._
+
+<!-- END GENERATED: readme-dependencies -->

package/src/email/README.md

@@ -14,22 +14,30 @@ TypeScript types and registry for transactional email kinds and their metadata.
 - Subjects are owned by the registry, never duplicated in templates
 - Unknown email kinds MUST be rejected at API boundaries via `isValidEmailKind()`
 
-## Public API
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
 
-### Types
+## Public API
 
-- `EmailKind` — Union of valid email kind identifiers
-- `EmailPayloads` — Type-safe payload mapping for each kind
-- `SendEmailInput<K>` — Type-safe input for sending emails
-- `EmailKindDefinition` — Full definition schema for a kind
+- `EMAIL_KINDS`
+- `EmailKind` _(type)_
+- `EmailKindDefinition` _(type)_
+- `EmailPayloads` _(type)_
+- `SendEmailInput` _(type)_
+- `getEmailKindDefinition`
+- `isValidEmailKind`
 
-### Registry & Functions
+<!-- END GENERATED: readme-public-api -->
 
-- `EMAIL_KINDS` — Registry of all email kinds
-- `getEmailKindDefinition(kind)` — Type-safe registry lookup
-- `isValidEmailKind(kind)` — Validate string is EmailKind
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
 ## Dependencies
 
-**Imports from:** (none — leaf module)
-**Imported by:** company-semantics-backend (email service, templates)
+**Internal domains:**
+
+_None._
+
+**External packages:**
+
+_None._
+
+<!-- END GENERATED: readme-dependencies -->

package/src/execution/README.md

@@ -14,33 +14,98 @@ TypeScript types and registry for execution kinds and their governance metadata.
 - `visibility` is derived from `EXECUTION_KINDS[kind].governance.visibility`, never independently authored
 - Unknown execution kinds MUST be rejected at API boundaries via `isValidExecutionKind()`
 
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
+
 ## Public API
 
-### Types
+- `ApprovalRequestedMetadata` _(type)_
+- `AuditExportBundle` _(type)_
+- `AuditExportEvent` _(type)_
+- `CancelledMetadata` _(type)_
+- `ConfirmExecutionResponse` _(type)_
+- `ConfirmExecutionResponseSchema`
+- `ConfirmationApprovedMetadata` _(type)_
+- `ConfirmationExpiredMetadata` _(type)_
+- `ConfirmationRejectedMetadata` _(type)_
+- `EFFECTIVE_TERMINAL_STATES`
+- `EXECUTION_EVENT_TYPES`
+- `EXECUTION_KINDS`
+- `EXECUTION_STATES`
+- `EventHashFields` _(type)_
+- `ExecutionCompletedMetadata` _(type)_
+- `ExecutionCreatedMetadata` _(type)_
+- `ExecutionDomain` _(type)_
+- `ExecutionError` _(type)_
+- `ExecutionErrorCode` _(type)_
+- `ExecutionEventMetadataMap` _(type)_
+- `ExecutionEventType` _(type)_
+- `ExecutionEventTypeSchema`
+- `ExecutionFailedMetadata` _(type)_
+- `ExecutionInitiator` _(type)_
+- `ExecutionIntent` _(type)_
+- `ExecutionKind` _(type)_
+- `ExecutionKindDefinition` _(type)_
+- `ExecutionListResponse` _(type)_
+- `ExecutionListResponseSchema`
+- `ExecutionResultDataSchema`
+- `ExecutionResultResponse` _(type)_
+- `ExecutionResultResponseSchema`
+- `ExecutionSseEvent` _(type)_
+- `ExecutionSseEventSchema`
+- `ExecutionStartedMetadata` _(type)_
+- `ExecutionState` _(type)_
+- `ExecutionStateSchema`
+- `ExecutionStatus` _(type)_
+- `ExecutionSummary` _(type)_
+- `ExecutionSummaryProjectionSchema`
+- `ExecutionSummaryResponse` _(type)_
+- `ExecutionSummarySchema`
+- `ExecutionTarget` _(type)_
+- `ExecutionTimelineResponse` _(type)_
+- `ExecutionTimelineResponseSchema`
+- `FrozenExecutionIntent` _(type)_
+- `GetExecutionSummaryResponse` _(type)_
+- `GetExecutionSummaryResponseSchema`
+- `HASH_ALGORITHM`
+- `HASH_ENCODING`
+- `HashChainVerificationResult` _(type)_
+- `ISO8601Timestamp` _(type)_
+- `IconName` _(type)_
+- `LIFECYCLE_DECISIONS`
+- `LifecycleDecision` _(type)_
+- `LifecycleIntent` _(type)_
+- `RejectExecutionResponse` _(type)_
+- `RejectExecutionResponseSchema`
+- `StartExecutionResponse` _(type)_
+- `StartExecutionResponseSchema`
+- `TERMINAL_STATES`
+- `TimelineEvent` _(type)_
+- `TimelineEventSchema`
+- `TimelineIcon` _(type)_
+- `TimelineStatus` _(type)_
+- `TimelineUIEvent` _(type)_
+- `UndoCompletedMetadata` _(type)_
+- `VALID_TRANSITIONS`
+- `applyIntent`
+- `assertValidTransition`
+- `getExecutionKindDefinition`
+- `isConfirmationExpired`
+- `isExecutionEventType`
+- `isValidExecutionKind`
+- `parseExpiresAt`
+
+<!-- END GENERATED: readme-public-api -->
 
-- `ExecutionKind` — Union of valid execution kind identifiers
-- `ExecutionKindDefinition` — Full definition schema for a kind
-- `ExecutionDomain` — Domain category (`integration`, `policy`, `data`, `system`)
-- `ISO8601Timestamp` — ISO 8601 timestamp string alias
-- `IconName` — Icon identifiers for UI
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
-### Projection Contracts
+## Dependencies
 
-- `ExecutionSummary` — Admin-facing execution view (derived from audit records)
-- `ExecutionTarget` — Target of execution (e.g., Slack workspace)
-- `ExecutionInitiator` — Who initiated the execution
-- `ExecutionStatus` — Execution status (`pending`, `succeeded`, `failed`)
-- `TimelineUIEvent` — User-facing timeline entry (derived from audit records)
-- `TimelineStatus` — Timeline-specific status mapping
-- `TimelineIcon` — Timeline-specific icon subset
+**Internal domains:**
 
-### Registry & Functions
+- `message-parts`
 
-- `EXECUTION_KINDS` — Registry of all execution kinds
-- `getExecutionKindDefinition(kind)` — Type-safe registry lookup
-- `isValidExecutionKind(kind)` — Validate string is ExecutionKind
+**External packages:**
 
-## Dependencies
+- `zod`
 
-**Imports from:** (none — leaf module)
-**Imported by:** company-semantics-backend, company-semantics-app
+<!-- END GENERATED: readme-dependencies -->

package/src/guards/README.md

@@ -14,39 +14,67 @@ This module exports **types only** — runtime helper functions live in the work
 - **Schema alignment**: Types match `schemas/guard-result.schema.json` exactly
 - **Backward compatibility**: Breaking changes require major version bump
 
-## Public API
-
-### Message Types
-
-- `GuardMessage` — Single error/warning with file, message, optional line/rule
-- `GuardTierResult` — Errors + warnings for one tier
-- `GuardResults` — Full results organized by tier
-- `GuardOutput` — JSON envelope for `--json` mode
-
-### Tier Types
+<!-- BEGIN GENERATED: readme-public-api — derived from code by `pnpm readme-api`. Do not edit. -->
 
-- `GuardTier` — `'structural' | 'behavioral' | 'invariants' | 'evolution'`
-- `GUARD_TIERS` — Ordered array for iteration
-
-### Check Types
+## Public API
 
-- `CheckResult` — Return type from individual guard checks
-- `GuardCheck` — Function signature `(root, config) => Promise<CheckResult>`
-- `GuardCheckFactory` — Factory signature `(overrides?) => GuardCheck`
+- `AggregateEvolutionConfig` _(type)_
+- `AlertsConfigGuardConfig` _(type)_
+- `BLOCKING_SOC2_CONTROLS`
+- `BackupConfigGuardConfig` _(type)_
+- `BoundGuardCheck` _(type)_
+- `CheckResult` _(type)_
+- `ContractsConsumerBaseline` _(type)_
+- `ContractsFreshnessBaseline` _(type)_
+- `CoverageBaseline` _(type)_
+- `DEFAULT_DOMAIN_SECTIONS`
+- `DEFAULT_INFRA_SECTIONS`
+- `DEFAULT_SKIP_DIRECTORIES`
+- `DomainAggregateBaseline` _(type)_
+- `EvolutionBaselines` _(type)_
+- `FileClusterBaseline` _(type)_
+- `GUARD_SCHEMA_VERSION`
+- `GUARD_TIERS`
+- `GuardCheck` _(type)_
+- `GuardCheckFactory` _(type)_
+- `GuardCheckRegistry` _(type)_
+- `GuardConfig` _(type)_
+- `GuardMessage` _(type)_
+- `GuardOutput` _(type)_
+- `GuardResults` _(type)_
+- `GuardTier` _(type)_
+- `GuardTierResult` _(type)_
+- `KnownVulnerability` _(type)_
+- `MetaBaselines` _(type)_
+- `REQUIRED_SOC2_CONTROLS`
+- `RoleLimit` _(type)_
+- `SOC2_CONTROL_NAMES`
+- `SOC2_SCHEMA_VERSION`
+- `ScriptsDepsBaseline` _(type)_
+- `SecretsDetectionConfig` _(type)_
+- `Soc2Baselines` _(type)_
+- `Soc2ComplianceOutput` _(type)_
+- `Soc2ControlArea` _(type)_
+- `Soc2ControlResult` _(type)_
+- `Soc2ControlStatus` _(type)_
+- `StructuralBaselines` _(type)_
+- `StructuredLoggingConfig` _(type)_
+- `SubdirectoryAffinityBaseline` _(type)_
+- `VulnerabilitiesBaseline` _(type)_
+- `VulnerabilityConfig` _(type)_
+
+<!-- END GENERATED: readme-public-api -->
+
+<!-- BEGIN GENERATED: readme-dependencies — derived from code by `pnpm readme-api`. Do not edit. -->
 
-### Config Types
+## Dependencies
 
-- `RoleLimit` — Three-tier limit (target, warning, hard)
-- `GuardConfig` — Polymorphic configuration for guards
+**Internal domains:**
 
-### Constants
+_None._
 
-- `GUARD_SCHEMA_VERSION` — `'2.0.0'` current schema version
-- `DEFAULT_SKIP_DIRECTORIES` — Standard dirs to skip
-- `DEFAULT_DOMAIN_SECTIONS` — Required README sections for domains
-- `DEFAULT_INFRA_SECTIONS` — Required README sections for infra
+**External packages:**
 
-## Dependencies
+_None._
 
-- No external dependencies (types only)
-- Consumed by: backend `scripts/ci/`, site `scripts/ci/`, workspace `scripts/ci/`
+<!-- END GENERATED: readme-dependencies -->