@company-semantics/contracts 44.3.0 → 44.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "44.3.0",
+  "version": "44.5.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -80,8 +80,8 @@
   },
   "scripts": {
     "build": "tsc -b --noEmit",
-    "typecheck": "tsc -b --noEmit",
-    "typecheck:ci": "tsc -p scripts/ci/tsconfig.json",
+    "typecheck": "NODE_OPTIONS='--max-old-space-size=4096' tsc -b --noEmit",
+    "typecheck:ci": "NODE_OPTIONS='--max-old-space-size=4096' tsc -p scripts/ci/tsconfig.json",
     "lint:md": "markdownlint-cli2 '**/*.md' '#node_modules' '#.ralph/worktrees' '#.claude/worktrees'",
     "format": "prettier --write src/",
     "format:check": "prettier --check src/",
@@ -99,11 +99,11 @@
     "guard:quick": "GUARD_DEPENDENCY_ROOT=../ tsx ../company-semantics-ci/run-guards.ts --config scripts/ci/guard-entries.ts --quick",
     "ci:local": "pnpm typecheck && pnpm lint:md && pnpm guard:test && GUARD_DEPENDENCY_ROOT=../ pnpm guard",
     "guard": "GUARD_DEPENDENCY_ROOT=../ tsx ../company-semantics-ci/run-guards.ts --config scripts/ci/guard-entries.ts",
-    "guard:test": "vitest run scripts/ci/__tests__",
+    "guard:test": "NODE_OPTIONS='--max-old-space-size=4096' vitest run scripts/ci/__tests__",
     "release": "npx tsx scripts/release.ts",
     "prepublishOnly": "echo 'ERROR: Publishing is CI-only via tag push. Use pnpm release instead.' && exit 1",
-    "test": "bash scripts/vitest-run.sh run",
-    "test:run": "bash scripts/vitest-run.sh run",
+    "test": "NODE_OPTIONS='--max-old-space-size=4096' bash scripts/vitest-run.sh run",
+    "test:run": "NODE_OPTIONS='--max-old-space-size=4096' bash scripts/vitest-run.sh run",
     "color": "tsx scripts/color.ts",
     "generate:spec-hash": "tsx scripts/generate-spec-hash.ts",
     "generate:spec-hash:check": "tsx scripts/generate-spec-hash.ts --check",

package/src/__tests__/resource-keys.test.ts

@@ -98,6 +98,37 @@ describe("resource-keys: system-scoped internalAdmin* types", () => {
   });
 });
 
+describe("resource-keys: userMd (user-scoped singleton)", () => {
+  const USER_ID = "55555555-5555-4555-8555-555555555555";
+  const key: ResourceKey = { type: "userMd", userId: USER_ID };
+
+  it("toQueryKey produces [type, userId] with no doc identity", () => {
+    const qk = toQueryKey(key);
+    expect(qk).toEqual(["userMd", USER_ID]);
+    // A per-user singleton: the user IS the identity, so there is no third
+    // segment even though the payload is a work item (ADR-BE-487).
+    expect(qk).toHaveLength(2);
+  });
+
+  it("roundtrips through fromQueryKey", () => {
+    const parsed = fromQueryKey(toQueryKey(key));
+    expect(parsed).toEqual(key);
+    expect("orgId" in parsed).toBe(false);
+  });
+
+  it("matchesResourceKey is user-scoped: rejects another user's doc", () => {
+    const otherUser = "66666666-6666-4666-8666-666666666666";
+    expect(matchesResourceKey(toQueryKey(key), key)).toBe(true);
+    expect(matchesResourceKey(["userMd", otherUser], key)).toBe(false);
+  });
+
+  it("does not collide with the other user-scoped keys", () => {
+    const viewerKey: ResourceKey = { type: "viewer", userId: USER_ID };
+    expect(matchesResourceKey(toQueryKey(viewerKey), key)).toBe(false);
+    expect(matchesResourceKey(toQueryKey(key), viewerKey)).toBe(false);
+  });
+});
+
 describe("resource-keys: companyMdAccessRequests (per-doc identity)", () => {
   const DOC_ID = "22222222-2222-4222-8222-222222222222";
   const key: ResourceKey = {

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = '44c4c6792ad6' as const;
-export const SPEC_HASH_FULL = '44c4c6792ad691901fe7f76cdf1b487664a2569532944b5a2fd57b69e599f334' as const;
+export const SPEC_HASH = '9bcb0e0bc2cc' as const;
+export const SPEC_HASH_FULL = '9bcb0e0bc2cce27742a97dd5f7ef4cadcff268e8700f40554258301cee4e183e' as const;

package/src/api/generated.ts

@@ -2879,6 +2879,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/me/md": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get (and lazily materialize) my personal doc */
+        get: operations["getMyMd"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/me/action-items": {
         parameters: {
             query?: never;
@@ -5550,7 +5567,7 @@ export interface components {
         WorkItemDetailResponse: {
             id: string;
             /** @enum {string} */
-            kind: "meeting" | "comm" | "doc";
+            kind: "meeting" | "comm" | "doc" | "personal";
             title: string;
             content: string;
             contentRedacted?: boolean;
@@ -10911,6 +10928,26 @@ export interface operations {
             };
         };
     };
+    getMyMd: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The caller-owned personal doc (kind personal), created on first access with an empty body */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkItemDetailResponse"];
+                };
+            };
+        };
+    };
     listMyActionItems: {
         parameters: {
             query?: never;

package/src/content/schemas.ts

@@ -217,7 +217,9 @@ export const CompanyMdDocResponseSchema = z.object({
  */
 export const WorkItemDetailResponseSchema = z.object({
   id: z.string(),
-  kind: z.enum(["meeting", "comm", "doc"]),
+  // `personal` is the /me/md page (ADR-BE-487): a per-(org, user) singleton
+  // riding the work_items substrate, served by getMyMd and this detail route.
+  kind: z.enum(["meeting", "comm", "doc", "personal"]),
   title: z.string(),
   content: z.string(),
   /**

package/src/generated/openapi-routes.ts

@@ -79,6 +79,7 @@ export const openApiRoutes = {
   '/api/me/feed': ['GET'],
   '/api/me/feed/read': ['POST'],
   '/api/me/feed/read-all': ['POST'],
+  '/api/me/md': ['GET'],
   '/api/me/meetings/recordings/start': ['POST'],
   '/api/me/meetings/recordings/{id}': ['DELETE'],
   '/api/me/meetings/recordings/{id}/complete': ['POST'],

package/src/permissions/share-api.ts

@@ -113,9 +113,12 @@ export const AclListResponseSchema = z.object({
    * Who knows this entity EXISTS — a SIBLING of `visibility`, not a modifier
    * on it (ADR-CONTRACTS-093).
    *
-   * ABSENT => this entity type has no discoverability axis (work_item,
-   * meeting_recording). Deliberately not defaulted: `org|owners` has no honest
-   * cross-entity value, unlike `general_access_role`'s `viewer`.
+   * ABSENT => the share dialog has no discoverability control for this
+   * entity: meeting_recording (no axis at all) and company_md (the policy is
+   * DERIVED server-side — 'org' for structural docs, ADR-BE-482 — never
+   * share-governed). PRESENT only for work_item, the one stored,
+   * share-governed axis (ADR-BE-486). Deliberately not defaulted: `org|owners`
+   * has no honest cross-entity value, unlike `general_access_role`'s `viewer`.
    *
    * The policy's domain is NON-READERS only. When `visibility` is `org` every
    * member is a reader, so the stored value affects no one — it is not erased,

package/src/resource-keys.ts

@@ -84,6 +84,12 @@ export type ResourceKey =
   | { type: "dismissedBanners"; userId: string }
   | { type: "userOrgs"; userId: string }
   | { type: "sessions"; userId: string }
+  // The viewer's personal doc (`/api/me/md`) — a per-user singleton, so it is
+  // keyed by userId alone with no doc identity segment. Its PAYLOAD is a work
+  // item, lazily materialized on first read (ADR-BE-487), but the resource is
+  // "this user's personal doc", not "work item <id>": a future generic
+  // `workItem` key would be a different resource with a different identity.
+  | { type: "userMd"; userId: string }
   | { type: "viewer"; userId: string };
 
 /**
@@ -131,6 +137,7 @@ const USER_SCOPED_TYPES = [
   "dismissedBanners",
   "userOrgs",
   "sessions",
+  "userMd",
   "viewer",
 ] as const;
 
@@ -186,6 +193,7 @@ export function toQueryKey(key: ResourceKey): readonly string[] {
     case "dismissedBanners":
     case "userOrgs":
     case "sessions":
+    case "userMd":
     case "viewer":
       return [key.type, key.userId] as const;