@company-semantics/contracts 39.1.0 → 39.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "39.1.0",
+  "version": "39.2.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -143,12 +143,14 @@
   },
   "pnpm": {
     "overrides": {
-      "picomatch": ">=4.0.4"
+      "picomatch": ">=4.0.4",
+      "brace-expansion@<5.0.8": ">=5.0.8"
     }
   },
   "lint-staged": {
     "*.ts": "bash -c 'tsc -b --noEmit'",
     "*.md": "markdownlint-cli2",
     "package.json": "node -e \"JSON.parse(require('fs').readFileSync('package.json'))\""
-  }
+  },
+  "securityRequirementsVersion": "8320e7a5612c6877c2959c127ffa78e693b9d1e95805340a5e4af11a01c4a669"
 }

package/src/guards/config.ts

@@ -238,6 +238,21 @@ export interface ContractsConsumerBaseline {
   packageJsonPath: string;
 }
 
+/**
+ * Security-overrides-sync guard baseline configuration.
+ * CI injects checkOverridesSync based on this config.
+ *
+ * Verifies the repo never RESOLVES a package below the ci security-version
+ * policy (company-semantics-ci/dependency-policy/security-requirements.ts). The
+ * requirement set is central in ci — a repo declares only where its manifest is.
+ *
+ * @see ADR-CI-122 (policy + resolver + guard) and ADR-CTRL-273 (sync driver)
+ */
+export interface SecurityOverridesBaseline {
+  /** Path to package.json relative to repo root */
+  packageJsonPath: string;
+}
+
 /**
  * Structural guard baselines.
  * Product repos provide DATA only; CI orchestrator owns guard implementations.
@@ -264,6 +279,13 @@ export interface StructuralBaselines {
    * Enforces: consumers never advance ahead of npm.
    */
   contractsConsumer?: ContractsConsumerBaseline;
+
+  /**
+   * Security-overrides-sync check configuration.
+   * CI injects checkOverridesSync based on this config.
+   * Enforces: no package resolves below the ci security-version policy.
+   */
+  securityOverrides?: SecurityOverridesBaseline;
 }
 
 /**