@company-semantics/contracts 44.5.0 → 45.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "44.5.0",
+  "version": "45.1.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -116,6 +116,7 @@
     "generate:current": "tsx ../company-semantics-ci/scripts/generate-current.ts",
     "adr:new": "tsx ../company-semantics-control/scripts/adr/adr-new-cli.ts",
     "repo-map": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --write",
+    "sync:workflow-pins": "tsx ../company-semantics-ci/scripts/sync-workflow-pins.ts --write",
     "repo-map:check": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --check",
     "readme-api": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --write --jsdoc",
     "readme-api:check": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --check --jsdoc",
@@ -130,11 +131,11 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
+    "@types/node": "^22.20.1",
     "amphtml-validator": "^1.0.38",
     "culori": "^4.0.2",
     "husky": "^9.1.7",
-    "lint-staged": "^17.2.0",
+    "lint-staged": "^17.3.0",
     "markdownlint-cli2": "^0.23.2",
     "openapi-typescript": "^7.13.0",
     "prettier": "^3.9.6",
@@ -146,11 +147,10 @@
   },
   "pnpm": {
     "overrides": {
-      "brace-expansion@<5.0.8": ">=5.0.8",
+      "brace-expansion@<5.0.9": ">=5.0.9",
       "minimatch@<10.2.3": ">=10.2.3",
       "js-yaml@>=4.0.0 <4.3.0": ">=4.3.0 <5.0.0",
       "js-yaml@>=5.0.0 <5.2.2": ">=5.2.2 <6.0.0",
-      "rollup@<4.59.0": ">=4.59.0",
       "picomatch@<4.0.4": ">=4.0.4",
       "esbuild@<0.28.1": ">=0.28.1",
       "linkify-it@<5.0.2": ">=5.0.2",
@@ -163,5 +163,5 @@
     "*.md": "markdownlint-cli2",
     "package.json": "node -e \"JSON.parse(require('fs').readFileSync('package.json'))\""
   },
-  "securityRequirementsVersion": "9ffb1b974fa033f13a73539f8338cad319b62bb95695aa4ac7b5215a50493513"
+  "securityRequirementsVersion": "5227de9b2a68460019c85186c0318d77915e02df1eb8aa8d1516b001e84bc524"
 }

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = '9bcb0e0bc2cc' as const;
-export const SPEC_HASH_FULL = '9bcb0e0bc2cce27742a97dd5f7ef4cadcff268e8700f40554258301cee4e183e' as const;
+export const SPEC_HASH = 'b10dd357bc4f' as const;
+export const SPEC_HASH_FULL = 'b10dd357bc4fd990f9d6646954b3b1aa38f9dce4dd64ecfe8f5f83eb8f51a568' as const;

package/src/api/generated.ts

@@ -4736,8 +4736,8 @@ export interface components {
             extractionStatus: "pending" | "extracting" | "complete" | "failed";
             errorClass?: string | null;
             errorReason?: string | null;
-            createdAt: string;
-            updatedAt: string;
+            createdAt?: string;
+            updatedAt?: string;
         };
         UpdateCompanyMdTitleRequest: {
             title: string;

package/src/content/schemas.ts

@@ -199,8 +199,16 @@ export const CompanyMdDocResponseSchema = z.object({
    */
   errorClass: z.string().nullable().optional(),
   errorReason: z.string().nullable().optional(),
-  createdAt: z.string(),
-  updatedAt: z.string(),
+  /**
+   * Withheld from non-readers — see `CompanyMdDocRelations` for why, and keep the
+   * two in lockstep. Present on every reader path; absent on the
+   * `locked_requestable` / `redacted_admin` stubs, where a moving timestamp is
+   * the last remaining side channel on a doc whose body, collaborators and
+   * structure are already withheld. Absence means "you were not told", not
+   * "never modified".
+   */
+  createdAt: z.string().optional(),
+  updatedAt: z.string().optional(),
 });
 
 // ---------------------------------------------------------------------------

package/src/guards/evolution-config.ts

@@ -11,8 +11,6 @@
  * ./config.ts so the package public surface is unchanged.
  *
  * Design principle: Configuration is data, not code.
- *
- * @architecture-role universal
  */
 
 // =============================================================================

package/src/guards/soc2-config.ts

@@ -10,8 +10,6 @@
  * ./config.ts so the package public surface is unchanged.
  *
  * Design principle: Configuration is data, not code.
- *
- * @architecture-role universal
  */
 
 import type { Soc2ControlArea } from "./types";

package/src/org/__tests__/company-md-collab.test.ts

@@ -142,6 +142,62 @@ describe("CompanyMdCollabSseEventSchema — raw backend frames", () => {
     ).not.toThrow();
   });
 
+  /**
+   * `canEdit` is permission and `status` is occupancy — the pair below is the
+   * case that motivated the field (ADR-CONTRACTS-114). A read-only participant
+   * and an edit-capable one who is merely reading BOTH report `viewing`, so a
+   * consumer that split the roster on `status` would get the wrong answer for
+   * one of them. These three assertions lock that the schema keeps the two
+   * axes independent, including the absent case a rollout produces.
+   */
+  it("carries canEdit independently of status", () => {
+    const base = {
+      type: "collab-presence" as const,
+      v: 1 as const,
+      userId: USER_ID,
+      clientKey: CLIENT_KEY,
+    };
+
+    // Edit-capable, but reading. Occupancy says viewing; permission says yes.
+    const reader = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "viewing",
+      canEdit: true,
+    });
+    expect(reader).toMatchObject({ status: "viewing", canEdit: true });
+
+    // Read-only, and on the editor tab. Occupancy is the same; permission is not.
+    const viewer = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "viewing",
+      canEdit: false,
+    });
+    expect(viewer).toMatchObject({ status: "viewing", canEdit: false });
+
+    // An older server omits the field. It must parse, and it must not
+    // materialize as `true` — absent means no edit rights, so a consumer
+    // reading `canEdit === true` fails closed on its own.
+    const legacy = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "editing",
+    });
+    expect(legacy).toMatchObject({ status: "editing" });
+    expect((legacy as { canEdit?: boolean }).canEdit).toBeUndefined();
+  });
+
+  it("rejects a non-boolean canEdit", () => {
+    expect(() =>
+      CompanyMdCollabSseEventSchema.parse({
+        type: "collab-presence",
+        v: 1,
+        userId: USER_ID,
+        clientKey: CLIENT_KEY,
+        status: "editing",
+        canEdit: "yes",
+      }),
+    ).toThrow();
+  });
+
   it("parses a collab-reset frame for each reason the backend sends", () => {
     for (const reason of ["epoch-mismatch", "compacted", "cursor-ahead"]) {
       expect(() =>

package/src/org/company-md-collab.ts

@@ -235,7 +235,9 @@ export type CompanyMdCollabUpdateEvent = z.infer<
  * `userId` is trustworthy: the server stamps it from the posting session and
  * never takes it from a client body. That is why no client-supplied identity
  * type is published — receiving clients resolve name/avatar/colour from
- * `userId` themselves.
+ * `userId` themselves. `canEdit` is stamped from the same session for the same
+ * reason: it is an authority answer, and an authority answer a client could
+ * assert about itself is not one.
  */
 export const CompanyMdCollabPresenceEventSchema = z.object({
   type: z.literal("collab-presence"),
@@ -247,6 +249,23 @@ export const CompanyMdCollabPresenceEventSchema = z.object({
   clientKey: z.string().uuid(),
   /** What that editor instance is doing. */
   status: z.enum(["editing", "viewing"]),
+  /**
+   * Whether this participant may WRITE the document — server-stamped from the
+   * same `CompanyMd.CanEdit` binding the sync handshake reports as `editable`,
+   * never taken from a client body.
+   *
+   * Distinct from `status`, which is occupancy: `status` says what one editor
+   * instance is doing right now, this says what the person is ALLOWED to do.
+   * The roster admits viewers on purpose (CanView, not CanEdit), so a reader
+   * cannot tell the two apart without this — and a client must never re-derive
+   * it from an ACL, which would stand up a second access authority in the
+   * browser.
+   *
+   * Optional so an older server stays representable on the wire. ABSENT MEANS
+   * NO EDIT RIGHTS: a consumer reads the missing field as `false` rather than
+   * guessing, which keeps the surface default-deny through a rollout.
+   */
+  canEdit: z.boolean().optional(),
   /** Selection anchor — an encoded Y.RelativePosition blob. */
   anchor: z.string().optional(),
   /** Selection head — an encoded Y.RelativePosition blob. */

package/src/org/company-md.ts

@@ -275,8 +275,25 @@ export interface CompanyMdDocRelations {
   readonly inheritsFrom: string | null;
   readonly sources: readonly CompanyMdSource[];
   readonly dependencies: readonly CompanyMdDependency[];
-  readonly createdAt: string;
-  readonly updatedAt: string;
+  /**
+   * WITHHELD FROM NON-READERS, and optional for exactly that reason.
+   *
+   * A non-reader's doc read is a stub: `content` is `''`, and `sources` /
+   * `dependencies` / `members` are empty. These two timestamps were the one
+   * thing left on it that still reported activity INSIDE the document — that
+   * someone wrote to it, and roughly when. On a doc whose body, collaborators
+   * and structure are all withheld, a moving `updatedAt` is a side channel: poll
+   * it and you learn how busy a document you cannot open is.
+   *
+   * So they are absent on the `locked_requestable` / `redacted_admin` branches
+   * and present on every reader path. Optional rather than nullable because
+   * "withheld" is the absence of an answer, not an answer of `null` — and
+   * because an older consumer reading the new API sees a missing field, which is
+   * the shape it already tolerates for every other stub-withheld value here.
+   * Treat absence as "you were not told", never as "never modified".
+   */
+  readonly createdAt?: string;
+  readonly updatedAt?: string;
 }
 
 export type CompanyMdDoc = CompanyMdDocCore &