@company-semantics/contracts 39.0.0 → 39.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "39.0.0",
+  "version": "39.2.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -143,12 +143,14 @@
   },
   "pnpm": {
     "overrides": {
-      "picomatch": ">=4.0.4"
+      "picomatch": ">=4.0.4",
+      "brace-expansion@<5.0.8": ">=5.0.8"
     }
   },
   "lint-staged": {
     "*.ts": "bash -c 'tsc -b --noEmit'",
     "*.md": "markdownlint-cli2",
     "package.json": "node -e \"JSON.parse(require('fs').readFileSync('package.json'))\""
-  }
+  },
+  "securityRequirementsVersion": "8320e7a5612c6877c2959c127ffa78e693b9d1e95805340a5e4af11a01c4a669"
 }

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = '35fcb4a5f2ca' as const;
-export const SPEC_HASH_FULL = '35fcb4a5f2ca6f167a3b18024de026f143681623fea3442c2587b2ab64c9d34a' as const;
+export const SPEC_HASH = '4669379f3c9c' as const;
+export const SPEC_HASH_FULL = '4669379f3c9c9733dea3f5bf53f2c1c0d1f0e496fddbf874e8d1f1951e805d7c' as const;

package/src/api/generated.ts

@@ -4546,6 +4546,8 @@ export interface components {
             }[];
             canEdit: boolean;
             canUploadContext?: boolean;
+            canManageAcl?: boolean;
+            canChangeVisibility?: boolean;
             inheritsFromId: string | null;
             inheritsFrom: string | null;
             sources: {

package/src/content/schemas.ts

@@ -153,6 +153,26 @@ export const CompanyMdDocResponseSchema = z.object({
    * doc shapes returned outside the single-doc read.
    */
   canUploadContext: z.boolean().optional(),
+  /**
+   * COLLABORATION capability signal (ADR-BE-434): whether the requesting actor
+   * holds `CompanyMd.CanShare` (`ACL_MANAGE` — the editor+ effective band OR the
+   * `org.manage_content_sharing` admin custody) on this doc — the SAME binding the
+   * `/acl` + sharing routes enforce. The app gates the Share affordance on it so a
+   * viewer/commenter never opens a dead Share dialog. Signal only; admittance and
+   * enforcement are unchanged. Optional for back-compat with doc shapes returned
+   * outside the single-doc read.
+   */
+  canManageAcl: z.boolean().optional(),
+  /**
+   * GOVERNANCE capability signal (ADR-BE-435): whether the requesting actor holds
+   * `CompanyMd.CanChangeVisibility` (owner OR the `org.manage_content_sharing`
+   * admin custody) on this doc — the SAME binding the visibility/sharing-policy
+   * write enforces. The app renders the Share dialog's general-access +
+   * discoverability controls read-only when false, so a non-governing editor
+   * cannot change a governance control and 403 on save. Signal only; admittance
+   * and enforcement are unchanged. Optional for back-compat.
+   */
+  canChangeVisibility: z.boolean().optional(),
   // Stable id of the inherited-from doc — the resolution key (mirrors the
   // resolved parentId). `inheritsFrom` is presentation only (ADR-BE-315).
   inheritsFromId: z.string().nullable(),

package/src/guards/config.ts

@@ -238,6 +238,21 @@ export interface ContractsConsumerBaseline {
   packageJsonPath: string;
 }
 
+/**
+ * Security-overrides-sync guard baseline configuration.
+ * CI injects checkOverridesSync based on this config.
+ *
+ * Verifies the repo never RESOLVES a package below the ci security-version
+ * policy (company-semantics-ci/dependency-policy/security-requirements.ts). The
+ * requirement set is central in ci — a repo declares only where its manifest is.
+ *
+ * @see ADR-CI-122 (policy + resolver + guard) and ADR-CTRL-273 (sync driver)
+ */
+export interface SecurityOverridesBaseline {
+  /** Path to package.json relative to repo root */
+  packageJsonPath: string;
+}
+
 /**
  * Structural guard baselines.
  * Product repos provide DATA only; CI orchestrator owns guard implementations.
@@ -264,6 +279,13 @@ export interface StructuralBaselines {
    * Enforces: consumers never advance ahead of npm.
    */
   contractsConsumer?: ContractsConsumerBaseline;
+
+  /**
+   * Security-overrides-sync check configuration.
+   * CI injects checkOverridesSync based on this config.
+   * Enforces: no package resolves below the ci security-version policy.
+   */
+  securityOverrides?: SecurityOverridesBaseline;
 }
 
 /**