@company-semantics/contracts 24.0.0 → 26.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "24.0.0",
+  "version": "26.0.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = 'ca30049e5670' as const;
-export const SPEC_HASH_FULL = 'ca30049e56707141ae807a8c218d97947e9aeade592540d5e2609eb985f43480' as const;
+export const SPEC_HASH = '62fe60545526' as const;
+export const SPEC_HASH_FULL = '62fe605455264b2246bb353c63b3e8905e7e2e22504f193dc15cce1edd34e68f' as const;

package/src/api/generated.ts

@@ -2144,6 +2144,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/org-units/{unitId}/open-roles/{roleId}/unit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Move an open role to a different unit (set the seat's unit) */
+        put: operations["setOrgUnitOpenRoleUnit"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/org-units/{unitId}/open-roles/{roleId}/title": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Set an open role's seat title */
+        put: operations["setOrgUnitOpenRoleTitle"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/users/org-chart": {
         parameters: {
             query?: never;
@@ -4877,6 +4911,38 @@ export interface components {
             };
         };
         PeopleOrgChartResponse: {
+            seats: {
+                /** Format: uuid */
+                id: string;
+                /** Format: uuid */
+                unitId: string;
+                title: string | null;
+                /** @enum {string} */
+                status: "planned" | "open" | "filled" | "closed";
+                hiring: boolean;
+                occupants: {
+                    /** Format: uuid */
+                    userId: string;
+                    fullName: string;
+                    avatarUrl: string | null;
+                    primaryUnitId: string | null;
+                    ownedUnits: {
+                        /** Format: uuid */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        mutability: "derived" | "user_managed";
+                    }[];
+                }[];
+            }[];
+            seatEdges: {
+                /** Format: uuid */
+                reportPositionId: string;
+                /** Format: uuid */
+                managerPositionId: string;
+                /** @enum {string} */
+                relationshipType: "solid" | "dotted";
+            }[];
             nodes: {
                 /** Format: uuid */
                 id: string;
@@ -9109,6 +9175,65 @@ export interface operations {
             };
         };
     };
+    setOrgUnitOpenRoleUnit: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                unitId: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: uuid */
+                    unitId: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Open role moved to the destination unit */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OpenRoleResponse"];
+                };
+            };
+        };
+    };
+    setOrgUnitOpenRoleTitle: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                unitId: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    title: string | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Open role with updated title */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OpenRoleResponse"];
+                };
+            };
+        };
+    };
     getPeopleOrgChart: {
         parameters: {
             query?: never;

package/src/email/registry.ts

@@ -112,6 +112,24 @@ export const EMAIL_KINDS = {
     plainTextRequired: true,
     htmlSupported: true,
   },
+  "companyMd.access_requested": {
+    kind: "companyMd.access_requested",
+    subject: "Someone requested access to a document",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
+  "companyMd.access_request_approved": {
+    kind: "companyMd.access_request_approved",
+    subject: "Your access request was approved",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
+  "companyMd.access_request_denied": {
+    kind: "companyMd.access_request_denied",
+    subject: "Your access request was reviewed",
+    plainTextRequired: true,
+    htmlSupported: true,
+  },
 } as const satisfies Record<EmailKind, EmailKindDefinition>;
 
 // =============================================================================

package/src/email/types.ts

@@ -32,7 +32,10 @@ export type EmailKind =
   | "org.ownership_transfer_completed"
   | "security.alert" // future
   | "chat.shared"
-  | "share.granted";
+  | "share.granted"
+  | "companyMd.access_requested"
+  | "companyMd.access_request_approved"
+  | "companyMd.access_request_denied";
 
 // =============================================================================
 // Email Payloads
@@ -128,6 +131,37 @@ export interface EmailPayloads {
     /** Optional message from the granter, included in the email only (not persisted) */
     message?: string;
   };
+  /** Sent to the doc owner(s) when an actor requests access (ADR-BE-338). */
+  "companyMd.access_requested": {
+    /** Display name of the requester */
+    requesterName: string;
+    /** Title of the company.md node access is requested for */
+    docTitle: string;
+    /** Optional message from the requester (email only) */
+    message?: string;
+    /** Deep-link that opens the doc's ShareDialog scrolled to the pending request */
+    reviewUrl: string;
+  };
+  /** Sent to the requester when an owner approves (ADR-BE-338). */
+  "companyMd.access_request_approved": {
+    /** Display name of the owner who approved */
+    approverName: string;
+    /** Title of the company.md node */
+    docTitle: string;
+    /** Access level granted */
+    accessLevel: "editor" | "commenter" | "viewer";
+    /** Full URL to view the node */
+    docUrl: string;
+  };
+  /** Sent to the requester when an owner denies (ADR-BE-338). */
+  "companyMd.access_request_denied": {
+    /** Display name of the owner who denied */
+    approverName: string;
+    /** Title of the company.md node */
+    docTitle: string;
+    /** Optional reason from the owner (email only) */
+    reason?: string;
+  };
 }
 
 // =============================================================================

package/src/generated/openapi-routes.ts

@@ -22,6 +22,7 @@ export const openApiRoutes = {
   '/api/chats/{id}/messages/{messageId}': ['DELETE'],
   '/api/chats/{id}/pin': ['DELETE', 'POST'],
   '/api/company-md/context-bank': ['POST'],
+  '/api/company-md/context-bank/search': ['GET'],
   '/api/company-md/docs/{id}': ['GET'],
   '/api/company-md/docs/{id}/content': ['PUT'],
   '/api/company-md/docs/{id}/context-bank': ['GET'],
@@ -54,6 +55,7 @@ export const openApiRoutes = {
   '/api/executions/{executionId}/timeline': ['GET'],
   '/api/executions/{executionId}/undo': ['POST'],
   '/api/factory/floor': ['GET'],
+  '/api/factory/kpis': ['GET'],
   '/api/factory/snapshot': ['GET'],
   '/api/ingestion/operations/{id}': ['GET'],
   '/api/internal-admin/impersonate/end': ['POST'],

package/src/identity/README.md

@@ -61,6 +61,14 @@ TypeScript types and functions for user identity and display name resolution.
 - `PeopleOrgChartOwnedUnitSchema`
 - `PeopleOrgChartResponse` _(type)_
 - `PeopleOrgChartResponseSchema`
+- `PeopleOrgChartSeat` _(type)_
+- `PeopleOrgChartSeatEdge` _(type)_
+- `PeopleOrgChartSeatEdgeSchema`
+- `PeopleOrgChartSeatOccupant` _(type)_
+- `PeopleOrgChartSeatOccupantSchema`
+- `PeopleOrgChartSeatSchema`
+- `PeopleOrgChartSeatStatus` _(type)_
+- `PeopleOrgChartSeatStatusSchema`
 - `Person` _(type)_
 - `PersonSchema`
 - `ProfileResponse` _(type)_

package/src/identity/index.ts

@@ -69,6 +69,10 @@ export {
   PeopleOrgChartOwnedUnitSchema,
   PeopleOrgChartEdgeSchema,
   PeopleOrgChartOpenRoleSchema,
+  PeopleOrgChartSeatStatusSchema,
+  PeopleOrgChartSeatOccupantSchema,
+  PeopleOrgChartSeatSchema,
+  PeopleOrgChartSeatEdgeSchema,
   PeopleOrgChartResponseSchema,
 } from "./people-org-chart";
 export type {
@@ -78,6 +82,10 @@ export type {
   PeopleOrgChartOwnedUnit,
   PeopleOrgChartEdge,
   PeopleOrgChartOpenRole,
+  PeopleOrgChartSeatStatus,
+  PeopleOrgChartSeatOccupant,
+  PeopleOrgChartSeat,
+  PeopleOrgChartSeatEdge,
   PeopleOrgChartResponse,
 } from "./people-org-chart";
 

package/src/identity/people-org-chart.ts

@@ -113,6 +113,93 @@ export type PeopleOrgChartOpenRole = z.infer<
   typeof PeopleOrgChartOpenRoleSchema
 >;
 
+// ---------------------------------------------------------------------------
+// Seat — the position-centric unification (ADR-CONT-093)
+// ---------------------------------------------------------------------------
+//
+// A `PeopleOrgChartSeat` is the unified chart actor: a `positions` row carrying
+// its SEAT-SCOPED attributes (unit placement, title, seat-existence status,
+// hiring/staffing sub-state) plus an `occupants[]` array of PERSON-SCOPED
+// attributes for whoever currently holds it. The split is structural, not
+// member-vs-open-role: a VACANT seat (`occupants: []`) is the old "open role";
+// an OCCUPIED seat (`occupants.length >= 1`) is the old "member" (N occupants
+// for a co-occupied seat — forward-compatible; live data is 0/1). Reporting is
+// expressed seat→seat in `seatEdges[]`, NOT on the seat, so the edge list stays
+// the single source of truth for placement (ADR-CTRL-159). `OrgChartActorRef`
+// is retained write-only (set-manager request/response) and is removed from
+// this read model.
+//
+// This pair (`seats[]` + `seatEdges[]`) is ADDITIVE alongside the legacy
+// `nodes`/`edges`/`openRoles` during the transition; the projector dual-emits
+// both from one position pass. A later breaking minor removes the legacy half.
+
+export const PeopleOrgChartSeatStatusSchema = z.enum([
+  "planned",
+  "open",
+  "filled",
+  "closed",
+]);
+export type PeopleOrgChartSeatStatus = z.infer<
+  typeof PeopleOrgChartSeatStatusSchema
+>;
+
+// Person-scoped attributes of a seat's holder — keyed by `userId`, they travel
+// with the person across seats (ADR-BE-329: a vacant seat grants none of these
+// by construction). Mirrors the legacy `PeopleOrgChartNode` person fields.
+export const PeopleOrgChartSeatOccupantSchema = z.object({
+  userId: z.string().uuid(),
+  fullName: z.string(),
+  avatarUrl: z.string().nullable(),
+  // Stable HOME unit (home_assignments), not the seat unit — mirrors the legacy
+  // node's `primaryUnitId`. Null ⇒ no home assignment.
+  primaryUnitId: z.string().uuid().nullable(),
+  // Units this occupant is a local structural owner of (ADR-BE-168). Empty ⇒
+  // not a unit owner. Same shape + semantics as the legacy node's `ownedUnits`.
+  ownedUnits: z.array(PeopleOrgChartOwnedUnitSchema),
+});
+
+export type PeopleOrgChartSeatOccupant = z.infer<
+  typeof PeopleOrgChartSeatOccupantSchema
+>;
+
+export const PeopleOrgChartSeatSchema = z.object({
+  // positionId — the seat identity (stable across occupancy changes).
+  id: z.string().uuid(),
+  // positions.unit_id — the seat's placement column. The chart columns a seat by
+  // this unit regardless of occupancy.
+  unitId: z.string().uuid(),
+  // positions.title — '' is mapped to null to preserve the legacy nullable wire
+  // shape (ADR-BE-312). Seat-scoped, NOT the occupant's member-display jobTitle.
+  title: z.string().nullable(),
+  // Seat-existence lifecycle (ADR-CTRL-182).
+  status: PeopleOrgChartSeatStatusSchema,
+  // Staffing sub-state: `position_fulfillment.status != 'inactive'` (ADR-BE-312).
+  // Orthogonal to `status` — "are we trying to staff this seat?". An absent
+  // fulfillment row ⇒ false.
+  hiring: z.boolean(),
+  // The seat's current holders. [] ⇒ vacant (the old "open role"); >= 1 ⇒
+  // occupied (the old "member"). Only account-linked, active/interim occupants
+  // appear, mirroring the legacy node-keying.
+  occupants: z.array(PeopleOrgChartSeatOccupantSchema),
+});
+
+export type PeopleOrgChartSeat = z.infer<typeof PeopleOrgChartSeatSchema>;
+
+// A seat→seat reporting edge — one row per `position_reporting` row (NOT a
+// member cross-product). Endpoints are positionIds; resolve each to its seat in
+// `seats[]`. Mirrors the legacy person-keyed `PeopleOrgChartEdge`, but keyed by
+// the stable seat identity so a vacant seat's edge is expressible without an
+// `OrgChartActorRef`.
+export const PeopleOrgChartSeatEdgeSchema = z.object({
+  reportPositionId: z.string().uuid(),
+  managerPositionId: z.string().uuid(),
+  relationshipType: ReportingRelationshipTypeSchema,
+});
+
+export type PeopleOrgChartSeatEdge = z.infer<
+  typeof PeopleOrgChartSeatEdgeSchema
+>;
+
 // ---------------------------------------------------------------------------
 // GET /api/users/org-chart
 // ---------------------------------------------------------------------------
@@ -123,6 +210,16 @@ export type PeopleOrgChartOpenRole = z.infer<
 // the render-time reporting heuristic.
 
 export const PeopleOrgChartResponseSchema = z.object({
+  // Position-centric unified view (ADR-CONT-093). `seats[]` carries every chart
+  // actor (occupied or vacant) and `seatEdges[]` the seat→seat reporting graph.
+  // ADDITIVE alongside the legacy fields below during the transition; a later
+  // breaking minor removes the legacy half.
+  seats: z.array(PeopleOrgChartSeatSchema),
+  seatEdges: z.array(PeopleOrgChartSeatEdgeSchema),
+  // Legacy, transitional (ADR-CONT-093 supersedes). Derived from the same
+  // position pass as `seats`/`seatEdges`; consumers should migrate to the seat
+  // model. `nodes` = occupied actors, `openRoles` = vacant 'open' actors,
+  // `edges` = the same reporting graph keyed by person/open-role actor refs.
   nodes: z.array(PeopleOrgChartNodeSchema),
   edges: z.array(PeopleOrgChartEdgeSchema),
   openRoles: z.array(PeopleOrgChartOpenRoleSchema),

package/src/index.ts

@@ -180,6 +180,10 @@ export {
   PeopleOrgChartOwnedUnitSchema,
   PeopleOrgChartEdgeSchema,
   PeopleOrgChartOpenRoleSchema,
+  PeopleOrgChartSeatStatusSchema,
+  PeopleOrgChartSeatOccupantSchema,
+  PeopleOrgChartSeatSchema,
+  PeopleOrgChartSeatEdgeSchema,
   PeopleOrgChartResponseSchema,
 } from "./identity/index";
 export type {
@@ -189,6 +193,10 @@ export type {
   PeopleOrgChartOwnedUnit,
   PeopleOrgChartEdge,
   PeopleOrgChartOpenRole,
+  PeopleOrgChartSeatStatus,
+  PeopleOrgChartSeatOccupant,
+  PeopleOrgChartSeat,
+  PeopleOrgChartSeatEdge,
   PeopleOrgChartResponse,
 } from "./identity/index";
 
@@ -340,6 +348,8 @@ export type {
   TransferMemberEligibility,
   // Company.md domain types (PRD-00173)
   CompanyMdVisibility,
+  CompanyMdDiscoverabilityPolicy,
+  CompanyMdClassification,
   CompanyMdDocLevel,
   CompanyMdDocKind,
   CompanyMdNodeType,

package/src/org/README.md

@@ -57,8 +57,10 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `ChangeMemberRoleRequest` _(type)_ — Request payload for changing a member's role.
 - `ChangeMemberRoleResponse` _(type)_
 - `ChangeMemberRoleResponseSchema`
+- `CompanyMdClassification` _(type)_ — Information classification for a Company.md node — what the document is, for governance, NOT permissions.
 - `CompanyMdContextBankItem` _(type)_ — A context bank item — a company.md doc associated with one or more parent nodes.
 - `CompanyMdDependency` _(type)_
+- `CompanyMdDiscoverabilityPolicy` _(type)_ — Discoverability policy for a Company.md node — who knows it exists, orthogonal to who may read it (authority…
 - `CompanyMdDoc` _(type)_
 - `CompanyMdDocCollaborators` _(type)_
 - `CompanyMdDocCore` _(type)_

package/src/org/company-md.ts

@@ -23,6 +23,32 @@
  */
 export type CompanyMdVisibility = "private" | "unit" | "org";
 
+/**
+ * Discoverability policy for a Company.md node — *who knows it exists*, orthogonal
+ * to who may read it (authority resolution). See ADR-CTRL-194 / ADR-BE-338.
+ *
+ * - `org`: every org member knows the node exists; a non-reader sees the locked
+ *   meta-stub (title + owner byline) and may request access.
+ * - `owners`: only readers know it exists; a non-reader gets a no-leak 404.
+ *
+ * A *policy*, not a boolean — intentionally extensible (`unit | partners |
+ * customers`). It also governs retrieval (search, semantic search, suggested
+ * context, citation, agent browsing).
+ */
+export type CompanyMdDiscoverabilityPolicy = "org" | "owners";
+
+/**
+ * Information classification for a Company.md node — *what the document is*, for
+ * governance, NOT permissions (ADR-CTRL-194 / ADR-BE-338). Later drives export
+ * watermarking, share-approval gates, retrieval rules, and audit verbosity
+ * without changing who can read. Named now; enforcement behaviors deferred.
+ */
+export type CompanyMdClassification =
+  | "public"
+  | "internal"
+  | "confidential"
+  | "highly_confidential";
+
 /**
  * @deprecated Since 1.12.0. `CompanyMdDocLevel` is superseded by `CompanyMdDocKind` + `depth`.
  *
@@ -107,6 +133,17 @@ export interface CompanyMdNodeIdentity {
   readonly depth: 1 | 2 | 3 | 4 | 5 | null;
   readonly parentId: string | null;
   readonly visibility: CompanyMdVisibility;
+  /**
+   * Who knows this node exists (orthogonal to who may read it). Governs the
+   * non-reader branch: `org` → locked meta-stub + request-access; `owners` →
+   * no-leak 404. See ADR-CTRL-194 / ADR-BE-338.
+   */
+  readonly discoverabilityPolicy: CompanyMdDiscoverabilityPolicy;
+  /**
+   * Governance classification of the node (not a permission). Drives future
+   * governance behaviors (watermarking, share-approval, retrieval, audit).
+   */
+  readonly classification: CompanyMdClassification;
   /** Owning org_unit. Null for root docs or when the owning unit has been archived. */
   readonly owningUnitId: string | null;
 }
@@ -132,6 +169,21 @@ export interface CompanyMdDocCore extends CompanyMdNodeIdentity {
    * its body (ADR-BE-245). Omitted/`false` on the normal full-content path.
    */
   readonly contentRedacted?: boolean;
+  /**
+   * Read-state of this node for the requesting actor (ADR-CTRL-194 / ADR-BE-338):
+   * - `full`: actor may read; `content` is the real body.
+   * - `redacted_admin`: meta-tier admin meta-view (ADR-BE-245).
+   * - `locked_requestable`: non-reader of an `org`-discoverable node — body is the
+   *   redacted stub and the actor may request access.
+   * Omitted on legacy paths that only set `contentRedacted`.
+   */
+  readonly accessState?: "full" | "redacted_admin" | "locked_requestable";
+  /**
+   * Whether the requesting actor may request access to this node. A *separate*
+   * resolver, intentionally NOT equal to `discoverabilityPolicy` (a direct-link
+   * recipient to an `owners` node may still be allowed to request).
+   */
+  readonly canRequestAccess?: boolean;
 }
 
 export interface CompanyMdDocCollaborators {

package/src/org/index.ts

@@ -163,6 +163,8 @@ export { orderTreeNodes } from "./tree-ordering";
 // Company.md domain types (PRD-00173)
 export type {
   CompanyMdVisibility,
+  CompanyMdDiscoverabilityPolicy,
+  CompanyMdClassification,
   CompanyMdDocLevel,
   CompanyMdDocKind,
   CompanyMdNodeType,

package/src/permissions/access-request.ts

@@ -0,0 +1,67 @@
+/**
+ * Company.md Access-Request DTOs (ADR-CONTRACTS-071 / ADR-BE-338)
+ *
+ * The request-access workflow: a non-reader of an `org`-discoverable node asks
+ * the owner(s) for access; the first owner to act resolves the request, minting a
+ * normal grant. These are the shared request/response shapes.
+ *
+ * Zod-canonical: schema is the source of truth, the type is inferred.
+ */
+import { z } from "zod";
+import { GrantableAccessLevelSchema } from "./share-api";
+
+/**
+ * Lifecycle status of an access request. A single pending request exists per
+ * (node, actor); the first owner to act transitions it terminally.
+ */
+export const ACCESS_REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "denied",
+  "withdrawn",
+  "expired",
+] as const;
+export const AccessRequestStatusSchema = z.enum(ACCESS_REQUEST_STATUSES);
+export type AccessRequestStatus = z.infer<typeof AccessRequestStatusSchema>;
+
+/** POST body to create an access request. */
+export const AccessRequestCreateSchema = z.object({
+  /** Optional context the requester sends to the owner(s). */
+  message: z.string().max(2000).optional(),
+});
+export type AccessRequestCreate = z.infer<typeof AccessRequestCreateSchema>;
+
+/** A single actor that requested access (actor-generic; today a user). */
+export const AccessRequestActorSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+});
+export type AccessRequestActor = z.infer<typeof AccessRequestActorSchema>;
+
+/** Full access-request record returned to owners (and the requester). */
+export const AccessRequestSchema = z.object({
+  id: z.string(),
+  requestor: AccessRequestActorSchema,
+  docId: z.string(),
+  status: AccessRequestStatusSchema,
+  message: z.string().nullable(),
+  createdAt: z.string(),
+  resolvedAt: z.string().nullable(),
+});
+export type AccessRequest = z.infer<typeof AccessRequestSchema>;
+
+/**
+ * POST body to approve a request. The owner chooses the granted level (default
+ * `viewer` is applied server-side if the field is omitted by older clients).
+ */
+export const ApproveAccessRequestSchema = z.object({
+  accessLevel: GrantableAccessLevelSchema,
+});
+export type ApproveAccessRequest = z.infer<typeof ApproveAccessRequestSchema>;
+
+/** POST body to deny a request. */
+export const DenyAccessRequestSchema = z.object({
+  /** Optional reason, surfaced to the requester (email only). */
+  reason: z.string().max(2000).optional(),
+});
+export type DenyAccessRequest = z.infer<typeof DenyAccessRequestSchema>;

package/src/permissions/index.ts

@@ -8,4 +8,5 @@ export * from "./access-levels";
 export * from "./orgchart-roles";
 export * from "./access-source";
 export * from "./share-api";
+export * from "./access-request";
 export * from "./permission-introspection";