@company-semantics/contracts 39.8.0 → 40.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "39.8.0",
+  "version": "40.0.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = 'e8cf36a33d43' as const;
-export const SPEC_HASH_FULL = 'e8cf36a33d43bec5e4383c8edbfbdccd37fe8d081a5ddd02e96c83cb5e7bd21a' as const;
+export const SPEC_HASH = '402a9b3f7788' as const;
+export const SPEC_HASH_FULL = '402a9b3f77881eef9d41ee5ad49aa2b184a5b838ce948cc43ea4226e434f9b81' as const;

package/src/api/generated.ts

@@ -1423,23 +1423,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/company-md/docs/{id}/content": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /** Update a company.md document content */
-        put: operations["updateCompanyMdDocContent"];
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/company-md/docs/{id}/title": {
         parameters: {
             query?: never;
@@ -4660,9 +4643,6 @@ export interface components {
             createdAt: string;
             updatedAt: string;
         };
-        UpdateCompanyMdContentRequest: {
-            content: string;
-        };
         UpdateCompanyMdTitleRequest: {
             title: string;
         };
@@ -8224,30 +8204,6 @@ export interface operations {
             };
         };
     };
-    updateCompanyMdDocContent: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateCompanyMdContentRequest"];
-            };
-        };
-        responses: {
-            /** @description Content updated */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
     updateCompanyMdDocTitle: {
         parameters: {
             query?: never;

package/src/generated/openapi-routes.ts

@@ -34,7 +34,6 @@ export const openApiRoutes = {
   '/api/company-md/docs/{id}/collab/stream': ['GET'],
   '/api/company-md/docs/{id}/collab/sync': ['GET'],
   '/api/company-md/docs/{id}/collab/updates': ['POST'],
-  '/api/company-md/docs/{id}/content': ['PUT'],
   '/api/company-md/docs/{id}/context-bank': ['GET'],
   '/api/company-md/docs/{id}/context-bank/associate': ['POST'],
   '/api/company-md/docs/{id}/context-bank/retry': ['POST'],

package/src/notifications/kinds/company-md-access-requested.ts

@@ -28,8 +28,13 @@ export const accessRequestedDefinition: NotificationDefinition<"companyMd.access
   {
     kind: "companyMd.access_requested",
     compose: (payload, context) => {
-      const { requesterName, docTitle, message, requestedAccessLevel, reviewUrl } =
-        payload;
+      const {
+        requesterName,
+        docTitle,
+        message,
+        requestedAccessLevel,
+        reviewUrl,
+      } = payload;
 
       return {
         metadata: {

package/src/permissions/access-request.ts

@@ -24,10 +24,38 @@ export const ACCESS_REQUEST_STATUSES = [
 export const AccessRequestStatusSchema = z.enum(ACCESS_REQUEST_STATUSES);
 export type AccessRequestStatus = z.infer<typeof AccessRequestStatusSchema>;
 
+/**
+ * Character cap on an access-request message.
+ *
+ * A note to an owner, not a document: 280 is enough to say why you want access
+ * and short enough to read in an inbox row. Exported so the request dialog's
+ * `maxLength` and its remaining-character counter read the SAME number the API
+ * rejects on — a UI that let you type past the server's limit would fail the
+ * send with no explanation.
+ *
+ * Enforced in three places, deliberately: the input caps typing, this schema
+ * rejects the request, and a CHECK constraint on
+ * `company_md_doc_access_requests.message` bounds anything that reaches the
+ * table by another path.
+ */
+export const ACCESS_REQUEST_MESSAGE_MAX_LENGTH = 280;
+
+/**
+ * Plain text only. Rejects C0/C1 control characters — a pasted binary blob or a
+ * terminal dump — while allowing the newlines and tabs a human types. The field
+ * is rendered as text, never as markup, so this is about what may be STORED,
+ * not about escaping at render time.
+ */
+const PLAIN_TEXT = /^[^\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]*$/;
+
 /** POST body to create an access request. */
 export const AccessRequestCreateSchema = z.object({
   /** Optional context the requester sends to the owner(s). */
-  message: z.string().max(2000).optional(),
+  message: z
+    .string()
+    .max(ACCESS_REQUEST_MESSAGE_MAX_LENGTH)
+    .regex(PLAIN_TEXT, "Message must be plain text")
+    .optional(),
   /**
    * The band the requester is asking for (ADR-CONTRACTS-098 / ADR-BE-454):
    * `viewer` from the locked preview, `editor` from the view-only Editor tab