@company-semantics/contracts 41.0.0 → 42.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "41.0.0",
+  "version": "42.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -129,17 +129,17 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^26.1.2",
     "amphtml-validator": "^1.0.38",
     "culori": "^4.0.2",
     "husky": "^9.1.7",
-    "lint-staged": "^17.1.0",
-    "markdownlint-cli2": "^0.23.1",
+    "lint-staged": "^17.2.0",
+    "markdownlint-cli2": "^0.23.2",
     "openapi-typescript": "^7.13.0",
     "prettier": "^3.9.6",
     "tsx": "^4.23.1",
     "typescript": "^5.8.3",
-    "vite": "^7.3.6",
+    "vite": "^8.2.0",
     "vitest": "^4.1.10",
     "yaml": "^2.9.0"
   },

package/src/chat/README.md

@@ -42,7 +42,7 @@ Shared types for chat persistence, sharing, real-time events, and runtime profil
 - `ChatRuntimeProfile` _(type)_ — Chat runtime profile — user-selectable orchestration strategy.
 - `ChatRuntimeProfileInfo` _(type)_ — Runtime profile metadata for UI rendering.
 - `ChatShareInfo` _(type)_ — Chat share record with snapshot metadata.
-- `ChatShareInfoSchema`
+- `ChatShareInfoSchema` — A chat share, as returned by the share APIs.
 - `ChatSseEvent` _(type)_ — SSE event types for chat updates.
 - `ChatSseEventSchema`
 - `ChatSuccessResponse` _(type)_ — Generic mutation success confirmation.

package/src/chat/schemas.ts

@@ -58,12 +58,28 @@ export const SharedChatMessageSchema = z.object({
   parts: z.array(z.unknown()).optional(),
 });
 
+/**
+ * A chat share, as returned by the share APIs.
+ *
+ * SHOW-ONCE (ADR-BE-460). `token` and `shareUrl` are present ONLY on the
+ * response that creates the share. Share tokens are stored as a digest, so the
+ * server cannot redisplay one afterwards — listing or updating a share returns
+ * the record without them, and re-obtaining a link means revoke-and-reshare.
+ *
+ * This is the industry norm for capability links, and it is what removes the
+ * last reason to keep a recoverable copy of the token: a share list that can
+ * still show you the URL is a share list that can leak every live link at once.
+ * Consumers must treat both fields as optional and drive their copy-link
+ * affordance off creation, not off a fetched share.
+ */
 export const ChatShareInfoSchema = z.object({
   id: z.string(),
   chatId: z.string(),
-  token: z.string(),
+  /** Create-time only — never returned by list or update (show-once). */
+  token: z.string().optional(),
   visibility: ChatVisibilitySchema,
-  shareUrl: z.string(),
+  /** Create-time only — never returned by list or update (show-once). */
+  shareUrl: z.string().optional(),
   messageCountAtShare: z.number().int(),
   titleAtShare: z.string(),
   createdAt: IsoDateString,

package/src/security/token-policy.ts

@@ -64,8 +64,12 @@ export const AUTH_TOKEN_POLICY_REQUIREMENTS = {
     conformance: {
       status: "unmet",
       gap:
-        "Minted with randomUUID() (122 bits) and persisted verbatim: sessions.token " +
-        "holds the cookie value itself, and lookup is raw equality against it.",
+        "Issuance now conforms: minted by issueCapabilityToken at 256 bits and " +
+        "stored as a sha256:v1: digest (ADR-BE-460 deploy B). Still UNMET because " +
+        "the dual-read window is open — sessions.token retains the raw value so a " +
+        "rollback keeps working, and every lookup carries a plaintext fallback arm. " +
+        "Conformance is reached when migration C retires the column and deploy D " +
+        "removes the fallbacks.",
     },
   },
   ChatShareToken: {