@company-semantics/contracts 39.7.0 → 40.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "39.7.0",
+  "version": "40.0.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = 'e8cf36a33d43' as const;
-export const SPEC_HASH_FULL = 'e8cf36a33d43bec5e4383c8edbfbdccd37fe8d081a5ddd02e96c83cb5e7bd21a' as const;
+export const SPEC_HASH = '402a9b3f7788' as const;
+export const SPEC_HASH_FULL = '402a9b3f77881eef9d41ee5ad49aa2b184a5b838ce948cc43ea4226e434f9b81' as const;

package/src/api/generated.ts

@@ -1423,23 +1423,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/company-md/docs/{id}/content": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /** Update a company.md document content */
-        put: operations["updateCompanyMdDocContent"];
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/company-md/docs/{id}/title": {
         parameters: {
             query?: never;
@@ -4660,9 +4643,6 @@ export interface components {
             createdAt: string;
             updatedAt: string;
         };
-        UpdateCompanyMdContentRequest: {
-            content: string;
-        };
         UpdateCompanyMdTitleRequest: {
             title: string;
         };
@@ -8224,30 +8204,6 @@ export interface operations {
             };
         };
     };
-    updateCompanyMdDocContent: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateCompanyMdContentRequest"];
-            };
-        };
-        responses: {
-            /** @description Content updated */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
     updateCompanyMdDocTitle: {
         parameters: {
             query?: never;

package/src/generated/openapi-routes.ts

@@ -34,7 +34,6 @@ export const openApiRoutes = {
   '/api/company-md/docs/{id}/collab/stream': ['GET'],
   '/api/company-md/docs/{id}/collab/sync': ['GET'],
   '/api/company-md/docs/{id}/collab/updates': ['POST'],
-  '/api/company-md/docs/{id}/content': ['PUT'],
   '/api/company-md/docs/{id}/context-bank': ['GET'],
   '/api/company-md/docs/{id}/context-bank/associate': ['POST'],
   '/api/company-md/docs/{id}/context-bank/retry': ['POST'],

package/src/index.ts

@@ -907,6 +907,17 @@ export type {
   DisableSecretRequest,
 } from "./security/index";
 
+// Auth token storage/entropy policy (PRD-00901)
+// @see src/security/token-policy.ts — single source for the runtime issuance
+// path and the secure-token-generation CI guard
+export { AUTH_TOKEN_POLICY_REQUIREMENTS } from "./security/index";
+export type {
+  TokenStorageFormat,
+  TokenPolicyConformance,
+  TokenPolicyRequirement,
+  AuthTokenPolicyClass,
+} from "./security/index";
+
 // Analytics response metadata (shared vocabulary for OLTP/OLAP separation)
 // @see ADR-CTRL-053 for design rationale
 export type {

package/src/notifications/kinds/company-md-access-requested.ts

@@ -28,8 +28,13 @@ export const accessRequestedDefinition: NotificationDefinition<"companyMd.access
   {
     kind: "companyMd.access_requested",
     compose: (payload, context) => {
-      const { requesterName, docTitle, message, requestedAccessLevel, reviewUrl } =
-        payload;
+      const {
+        requesterName,
+        docTitle,
+        message,
+        requestedAccessLevel,
+        reviewUrl,
+      } = payload;
 
       return {
         metadata: {

package/src/permissions/access-request.ts

@@ -24,10 +24,38 @@ export const ACCESS_REQUEST_STATUSES = [
 export const AccessRequestStatusSchema = z.enum(ACCESS_REQUEST_STATUSES);
 export type AccessRequestStatus = z.infer<typeof AccessRequestStatusSchema>;
 
+/**
+ * Character cap on an access-request message.
+ *
+ * A note to an owner, not a document: 280 is enough to say why you want access
+ * and short enough to read in an inbox row. Exported so the request dialog's
+ * `maxLength` and its remaining-character counter read the SAME number the API
+ * rejects on — a UI that let you type past the server's limit would fail the
+ * send with no explanation.
+ *
+ * Enforced in three places, deliberately: the input caps typing, this schema
+ * rejects the request, and a CHECK constraint on
+ * `company_md_doc_access_requests.message` bounds anything that reaches the
+ * table by another path.
+ */
+export const ACCESS_REQUEST_MESSAGE_MAX_LENGTH = 280;
+
+/**
+ * Plain text only. Rejects C0/C1 control characters — a pasted binary blob or a
+ * terminal dump — while allowing the newlines and tabs a human types. The field
+ * is rendered as text, never as markup, so this is about what may be STORED,
+ * not about escaping at render time.
+ */
+const PLAIN_TEXT = /^[^\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]*$/;
+
 /** POST body to create an access request. */
 export const AccessRequestCreateSchema = z.object({
   /** Optional context the requester sends to the owner(s). */
-  message: z.string().max(2000).optional(),
+  message: z
+    .string()
+    .max(ACCESS_REQUEST_MESSAGE_MAX_LENGTH)
+    .regex(PLAIN_TEXT, "Message must be plain text")
+    .optional(),
   /**
    * The band the requester is asking for (ADR-CONTRACTS-098 / ADR-BE-454):
    * `viewer` from the locked preview, `editor` from the view-only Editor tab

package/src/security/index.ts

@@ -19,3 +19,11 @@ export type {
   RotateSecretRequest,
   DisableSecretRequest,
 } from "./org-secrets";
+
+export { AUTH_TOKEN_POLICY_REQUIREMENTS } from "./token-policy";
+export type {
+  TokenStorageFormat,
+  TokenPolicyConformance,
+  TokenPolicyRequirement,
+  AuthTokenPolicyClass,
+} from "./token-policy";

package/src/security/token-policy.ts

@@ -0,0 +1,113 @@
+/**
+ * Declared storage and entropy policy for auth-bearing tokens.
+ *
+ * This is the single source consumed by BOTH the runtime issuance path and the
+ * secure-token-generation CI guard. A declaration with no enforcing consumer is
+ * the defect class this module exists to close.
+ *
+ * Every field states what an implementation MUST satisfy. None of them describe
+ * what the code does today — that is `conformance`, and it is mandatory per
+ * class. Keeping the two apart is the point: a requirement record that reads as
+ * a description silently re-asserts the guarantee it was written to obtain, and
+ * is the same declaration-without-enforcement defect wearing a different hat.
+ */
+export type TokenStorageFormat = "hashed" | "hmac-signed" | "encrypted";
+
+/**
+ * Whether every known issuance site already satisfies the declared requirement.
+ *
+ * `enforced` — no known site violates it.
+ * `unmet` — at least one known site violates it; `gap` names what is wrong.
+ *
+ * This is NOT a suppression and confers no exemption. The requirement holds
+ * either way and the secure-token-generation guard reports the violating sites
+ * regardless — the field exists so the canonical record cannot be read as
+ * asserting a guarantee the implementation has not yet earned.
+ */
+export type TokenPolicyConformance =
+  | { readonly status: "enforced" }
+  | { readonly status: "unmet"; readonly gap: string };
+
+export interface TokenPolicyRequirement {
+  /** Minimum entropy the raw token must carry, in bits. */
+  readonly minEntropyBits: number;
+  /** Algorithm the stored representation must be derived with. */
+  readonly hashAlgorithm: string;
+  /**
+   * How the token must be persisted. Never 'plaintext' — that is not a member,
+   * because plaintext is never an acceptable requirement. A class that IS
+   * persisted in plaintext today says so through `conformance`, which is why
+   * the union does not need to express it.
+   */
+  readonly storageFormat: TokenStorageFormat;
+  /**
+   * Whether the implementation currently meets the requirement above. Required,
+   * not optional: an omitted status would default to an unearned claim, which
+   * is exactly the drift this record exists to surface.
+   */
+  readonly conformance: TokenPolicyConformance;
+  /**
+   * Identifier / function-name patterns that bind a call site to this policy
+   * class. Heuristic only: the AUTHORITATIVE binding is the explicit policy
+   * argument passed at the generation site. These patterns exist so the guard
+   * can flag an UNCLASSIFIED site, never to silently classify one.
+   */
+  readonly contextPatterns: readonly string[];
+}
+
+export const AUTH_TOKEN_POLICY_REQUIREMENTS = {
+  SessionToken: {
+    minEntropyBits: 256,
+    hashAlgorithm: "SHA-256",
+    storageFormat: "hashed",
+    contextPatterns: ["session"],
+    conformance: {
+      status: "unmet",
+      gap:
+        "Minted with randomUUID() (122 bits) and persisted verbatim: sessions.token " +
+        "holds the cookie value itself, and lookup is raw equality against it.",
+    },
+  },
+  ChatShareToken: {
+    minEntropyBits: 256,
+    hashAlgorithm: "SHA-256",
+    storageFormat: "hashed",
+    contextPatterns: ["share"],
+    conformance: {
+      status: "unmet",
+      gap:
+        "Minted with randomBytes(32) and persisted verbatim: chat_shares.token holds " +
+        "the share-URL value itself, and lookup is raw equality against it.",
+    },
+  },
+  InviteToken: {
+    minEntropyBits: 256,
+    hashAlgorithm: "SHA-256",
+    storageFormat: "hashed",
+    contextPatterns: ["invite"],
+    conformance: { status: "enforced" },
+  },
+  OAuthStateToken: {
+    minEntropyBits: 128,
+    hashAlgorithm: "HMAC-SHA256",
+    storageFormat: "hmac-signed",
+    contextPatterns: ["state", "nonce"],
+    conformance: { status: "enforced" },
+  },
+  OTPCode: {
+    minEntropyBits: 20,
+    hashAlgorithm: "bcrypt",
+    storageFormat: "hashed",
+    contextPatterns: ["otp", "loginCode"],
+    conformance: { status: "enforced" },
+  },
+  OAuthTokenEncryption: {
+    minEntropyBits: 256,
+    hashAlgorithm: "AES-256-GCM",
+    storageFormat: "encrypted",
+    contextPatterns: ["tokenEncryption"],
+    conformance: { status: "enforced" },
+  },
+} as const satisfies Record<string, TokenPolicyRequirement>;
+
+export type AuthTokenPolicyClass = keyof typeof AUTH_TOKEN_POLICY_REQUIREMENTS;