@company-semantics/contracts 24.0.0 → 25.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "24.0.0",
+  "version": "25.0.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/email/registry.ts

@@ -112,6 +112,24 @@ export const EMAIL_KINDS = {
     plainTextRequired: true,
     htmlSupported: true,
   },
+  "companyMd.access_requested": {
+    kind: "companyMd.access_requested",
+    subject: "Someone requested access to a document",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
+  "companyMd.access_request_approved": {
+    kind: "companyMd.access_request_approved",
+    subject: "Your access request was approved",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
+  "companyMd.access_request_denied": {
+    kind: "companyMd.access_request_denied",
+    subject: "Your access request was reviewed",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
 } as const satisfies Record<EmailKind, EmailKindDefinition>;
 
 // =============================================================================

package/src/email/types.ts

@@ -32,7 +32,10 @@ export type EmailKind =
   | "org.ownership_transfer_completed"
   | "security.alert" // future
   | "chat.shared"
-  | "share.granted";
+  | "share.granted"
+  | "companyMd.access_requested"
+  | "companyMd.access_request_approved"
+  | "companyMd.access_request_denied";
 
 // =============================================================================
 // Email Payloads
@@ -128,6 +131,37 @@ export interface EmailPayloads {
     /** Optional message from the granter, included in the email only (not persisted) */
     message?: string;
   };
+  /** Sent to the doc owner(s) when an actor requests access (ADR-BE-338). */
+  "companyMd.access_requested": {
+    /** Display name of the requester */
+    requesterName: string;
+    /** Title of the company.md node access is requested for */
+    docTitle: string;
+    /** Optional message from the requester (email only) */
+    message?: string;
+    /** Deep-link that opens the doc's ShareDialog scrolled to the pending request */
+    reviewUrl: string;
+  };
+  /** Sent to the requester when an owner approves (ADR-BE-338). */
+  "companyMd.access_request_approved": {
+    /** Display name of the owner who approved */
+    approverName: string;
+    /** Title of the company.md node */
+    docTitle: string;
+    /** Access level granted */
+    accessLevel: "editor" | "commenter" | "viewer";
+    /** Full URL to view the node */
+    docUrl: string;
+  };
+  /** Sent to the requester when an owner denies (ADR-BE-338). */
+  "companyMd.access_request_denied": {
+    /** Display name of the owner who denied */
+    approverName: string;
+    /** Title of the company.md node */
+    docTitle: string;
+    /** Optional reason from the owner (email only) */
+    reason?: string;
+  };
 }
 
 // =============================================================================

package/src/index.ts

@@ -340,6 +340,8 @@ export type {
   TransferMemberEligibility,
   // Company.md domain types (PRD-00173)
   CompanyMdVisibility,
+  CompanyMdDiscoverabilityPolicy,
+  CompanyMdClassification,
   CompanyMdDocLevel,
   CompanyMdDocKind,
   CompanyMdNodeType,

package/src/org/README.md

@@ -57,8 +57,10 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `ChangeMemberRoleRequest` _(type)_ — Request payload for changing a member's role.
 - `ChangeMemberRoleResponse` _(type)_
 - `ChangeMemberRoleResponseSchema`
+- `CompanyMdClassification` _(type)_ — Information classification for a Company.md node — what the document is, for governance, NOT permissions.
 - `CompanyMdContextBankItem` _(type)_ — A context bank item — a company.md doc associated with one or more parent nodes.
 - `CompanyMdDependency` _(type)_
+- `CompanyMdDiscoverabilityPolicy` _(type)_ — Discoverability policy for a Company.md node — who knows it exists, orthogonal to who may read it (authority…
 - `CompanyMdDoc` _(type)_
 - `CompanyMdDocCollaborators` _(type)_
 - `CompanyMdDocCore` _(type)_

package/src/org/company-md.ts

@@ -23,6 +23,32 @@
  */
 export type CompanyMdVisibility = "private" | "unit" | "org";
 
+/**
+ * Discoverability policy for a Company.md node — *who knows it exists*, orthogonal
+ * to who may read it (authority resolution). See ADR-CTRL-194 / ADR-BE-338.
+ *
+ * - `org`: every org member knows the node exists; a non-reader sees the locked
+ *   meta-stub (title + owner byline) and may request access.
+ * - `owners`: only readers know it exists; a non-reader gets a no-leak 404.
+ *
+ * A *policy*, not a boolean — intentionally extensible (`unit | partners |
+ * customers`). It also governs retrieval (search, semantic search, suggested
+ * context, citation, agent browsing).
+ */
+export type CompanyMdDiscoverabilityPolicy = "org" | "owners";
+
+/**
+ * Information classification for a Company.md node — *what the document is*, for
+ * governance, NOT permissions (ADR-CTRL-194 / ADR-BE-338). Later drives export
+ * watermarking, share-approval gates, retrieval rules, and audit verbosity
+ * without changing who can read. Named now; enforcement behaviors deferred.
+ */
+export type CompanyMdClassification =
+  | "public"
+  | "internal"
+  | "confidential"
+  | "highly_confidential";
+
 /**
  * @deprecated Since 1.12.0. `CompanyMdDocLevel` is superseded by `CompanyMdDocKind` + `depth`.
  *
@@ -107,6 +133,17 @@ export interface CompanyMdNodeIdentity {
   readonly depth: 1 | 2 | 3 | 4 | 5 | null;
   readonly parentId: string | null;
   readonly visibility: CompanyMdVisibility;
+  /**
+   * Who knows this node exists (orthogonal to who may read it). Governs the
+   * non-reader branch: `org` → locked meta-stub + request-access; `owners` →
+   * no-leak 404. See ADR-CTRL-194 / ADR-BE-338.
+   */
+  readonly discoverabilityPolicy: CompanyMdDiscoverabilityPolicy;
+  /**
+   * Governance classification of the node (not a permission). Drives future
+   * governance behaviors (watermarking, share-approval, retrieval, audit).
+   */
+  readonly classification: CompanyMdClassification;
   /** Owning org_unit. Null for root docs or when the owning unit has been archived. */
   readonly owningUnitId: string | null;
 }
@@ -132,6 +169,21 @@ export interface CompanyMdDocCore extends CompanyMdNodeIdentity {
    * its body (ADR-BE-245). Omitted/`false` on the normal full-content path.
    */
   readonly contentRedacted?: boolean;
+  /**
+   * Read-state of this node for the requesting actor (ADR-CTRL-194 / ADR-BE-338):
+   * - `full`: actor may read; `content` is the real body.
+   * - `redacted_admin`: meta-tier admin meta-view (ADR-BE-245).
+   * - `locked_requestable`: non-reader of an `org`-discoverable node — body is the
+   *   redacted stub and the actor may request access.
+   * Omitted on legacy paths that only set `contentRedacted`.
+   */
+  readonly accessState?: "full" | "redacted_admin" | "locked_requestable";
+  /**
+   * Whether the requesting actor may request access to this node. A *separate*
+   * resolver, intentionally NOT equal to `discoverabilityPolicy` (a direct-link
+   * recipient to an `owners` node may still be allowed to request).
+   */
+  readonly canRequestAccess?: boolean;
 }
 
 export interface CompanyMdDocCollaborators {

package/src/org/index.ts

@@ -163,6 +163,8 @@ export { orderTreeNodes } from "./tree-ordering";
 // Company.md domain types (PRD-00173)
 export type {
   CompanyMdVisibility,
+  CompanyMdDiscoverabilityPolicy,
+  CompanyMdClassification,
   CompanyMdDocLevel,
   CompanyMdDocKind,
   CompanyMdNodeType,

package/src/permissions/access-request.ts

@@ -0,0 +1,67 @@
+/**
+ * Company.md Access-Request DTOs (ADR-CONTRACTS-071 / ADR-BE-338)
+ *
+ * The request-access workflow: a non-reader of an `org`-discoverable node asks
+ * the owner(s) for access; the first owner to act resolves the request, minting a
+ * normal grant. These are the shared request/response shapes.
+ *
+ * Zod-canonical: schema is the source of truth, the type is inferred.
+ */
+import { z } from "zod";
+import { GrantableAccessLevelSchema } from "./share-api";
+
+/**
+ * Lifecycle status of an access request. A single pending request exists per
+ * (node, actor); the first owner to act transitions it terminally.
+ */
+export const ACCESS_REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "denied",
+  "withdrawn",
+  "expired",
+] as const;
+export const AccessRequestStatusSchema = z.enum(ACCESS_REQUEST_STATUSES);
+export type AccessRequestStatus = z.infer<typeof AccessRequestStatusSchema>;
+
+/** POST body to create an access request. */
+export const AccessRequestCreateSchema = z.object({
+  /** Optional context the requester sends to the owner(s). */
+  message: z.string().max(2000).optional(),
+});
+export type AccessRequestCreate = z.infer<typeof AccessRequestCreateSchema>;
+
+/** A single actor that requested access (actor-generic; today a user). */
+export const AccessRequestActorSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+});
+export type AccessRequestActor = z.infer<typeof AccessRequestActorSchema>;
+
+/** Full access-request record returned to owners (and the requester). */
+export const AccessRequestSchema = z.object({
+  id: z.string(),
+  requestor: AccessRequestActorSchema,
+  docId: z.string(),
+  status: AccessRequestStatusSchema,
+  message: z.string().nullable(),
+  createdAt: z.string(),
+  resolvedAt: z.string().nullable(),
+});
+export type AccessRequest = z.infer<typeof AccessRequestSchema>;
+
+/**
+ * POST body to approve a request. The owner chooses the granted level (default
+ * `viewer` is applied server-side if the field is omitted by older clients).
+ */
+export const ApproveAccessRequestSchema = z.object({
+  accessLevel: GrantableAccessLevelSchema,
+});
+export type ApproveAccessRequest = z.infer<typeof ApproveAccessRequestSchema>;
+
+/** POST body to deny a request. */
+export const DenyAccessRequestSchema = z.object({
+  /** Optional reason, surfaced to the requester (email only). */
+  reason: z.string().max(2000).optional(),
+});
+export type DenyAccessRequest = z.infer<typeof DenyAccessRequestSchema>;

package/src/permissions/index.ts

@@ -8,4 +8,5 @@ export * from "./access-levels";
 export * from "./orgchart-roles";
 export * from "./access-source";
 export * from "./share-api";
+export * from "./access-request";
 export * from "./permission-introspection";