@company-semantics/contracts 45.0.0 → 45.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "45.0.0",
+  "version": "45.1.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -116,6 +116,7 @@
     "generate:current": "tsx ../company-semantics-ci/scripts/generate-current.ts",
     "adr:new": "tsx ../company-semantics-control/scripts/adr/adr-new-cli.ts",
     "repo-map": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --write",
+    "sync:workflow-pins": "tsx ../company-semantics-ci/scripts/sync-workflow-pins.ts --write",
     "repo-map:check": "tsx ../company-semantics-ci/scripts/generate-repo-map.ts --roots src --name company-semantics-contracts --check",
     "readme-api": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --write --jsdoc",
     "readme-api:check": "tsx ../company-semantics-ci/scripts/generate-readme-api.ts --roots src --check --jsdoc",
@@ -134,7 +135,7 @@
     "amphtml-validator": "^1.0.38",
     "culori": "^4.0.2",
     "husky": "^9.1.7",
-    "lint-staged": "^17.2.0",
+    "lint-staged": "^17.3.0",
     "markdownlint-cli2": "^0.23.2",
     "openapi-typescript": "^7.13.0",
     "prettier": "^3.9.6",
@@ -146,7 +147,7 @@
   },
   "pnpm": {
     "overrides": {
-      "brace-expansion@<5.0.8": ">=5.0.8",
+      "brace-expansion@<5.0.9": ">=5.0.9",
       "minimatch@<10.2.3": ">=10.2.3",
       "js-yaml@>=4.0.0 <4.3.0": ">=4.3.0 <5.0.0",
       "js-yaml@>=5.0.0 <5.2.2": ">=5.2.2 <6.0.0",
@@ -162,5 +163,5 @@
     "*.md": "markdownlint-cli2",
     "package.json": "node -e \"JSON.parse(require('fs').readFileSync('package.json'))\""
   },
-  "securityRequirementsVersion": "9ffb1b974fa033f13a73539f8338cad319b62bb95695aa4ac7b5215a50493513"
+  "securityRequirementsVersion": "5227de9b2a68460019c85186c0318d77915e02df1eb8aa8d1516b001e84bc524"
 }

package/src/guards/evolution-config.ts

@@ -11,8 +11,6 @@
  * ./config.ts so the package public surface is unchanged.
  *
  * Design principle: Configuration is data, not code.
- *
- * @architecture-role universal
  */
 
 // =============================================================================

package/src/guards/soc2-config.ts

@@ -10,8 +10,6 @@
  * ./config.ts so the package public surface is unchanged.
  *
  * Design principle: Configuration is data, not code.
- *
- * @architecture-role universal
  */
 
 import type { Soc2ControlArea } from "./types";

package/src/org/__tests__/company-md-collab.test.ts

@@ -142,6 +142,62 @@ describe("CompanyMdCollabSseEventSchema — raw backend frames", () => {
     ).not.toThrow();
   });
 
+  /**
+   * `canEdit` is permission and `status` is occupancy — the pair below is the
+   * case that motivated the field (ADR-CONTRACTS-114). A read-only participant
+   * and an edit-capable one who is merely reading BOTH report `viewing`, so a
+   * consumer that split the roster on `status` would get the wrong answer for
+   * one of them. These three assertions lock that the schema keeps the two
+   * axes independent, including the absent case a rollout produces.
+   */
+  it("carries canEdit independently of status", () => {
+    const base = {
+      type: "collab-presence" as const,
+      v: 1 as const,
+      userId: USER_ID,
+      clientKey: CLIENT_KEY,
+    };
+
+    // Edit-capable, but reading. Occupancy says viewing; permission says yes.
+    const reader = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "viewing",
+      canEdit: true,
+    });
+    expect(reader).toMatchObject({ status: "viewing", canEdit: true });
+
+    // Read-only, and on the editor tab. Occupancy is the same; permission is not.
+    const viewer = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "viewing",
+      canEdit: false,
+    });
+    expect(viewer).toMatchObject({ status: "viewing", canEdit: false });
+
+    // An older server omits the field. It must parse, and it must not
+    // materialize as `true` — absent means no edit rights, so a consumer
+    // reading `canEdit === true` fails closed on its own.
+    const legacy = CompanyMdCollabSseEventSchema.parse({
+      ...base,
+      status: "editing",
+    });
+    expect(legacy).toMatchObject({ status: "editing" });
+    expect((legacy as { canEdit?: boolean }).canEdit).toBeUndefined();
+  });
+
+  it("rejects a non-boolean canEdit", () => {
+    expect(() =>
+      CompanyMdCollabSseEventSchema.parse({
+        type: "collab-presence",
+        v: 1,
+        userId: USER_ID,
+        clientKey: CLIENT_KEY,
+        status: "editing",
+        canEdit: "yes",
+      }),
+    ).toThrow();
+  });
+
   it("parses a collab-reset frame for each reason the backend sends", () => {
     for (const reason of ["epoch-mismatch", "compacted", "cursor-ahead"]) {
       expect(() =>

package/src/org/company-md-collab.ts

@@ -235,7 +235,9 @@ export type CompanyMdCollabUpdateEvent = z.infer<
  * `userId` is trustworthy: the server stamps it from the posting session and
  * never takes it from a client body. That is why no client-supplied identity
  * type is published — receiving clients resolve name/avatar/colour from
- * `userId` themselves.
+ * `userId` themselves. `canEdit` is stamped from the same session for the same
+ * reason: it is an authority answer, and an authority answer a client could
+ * assert about itself is not one.
  */
 export const CompanyMdCollabPresenceEventSchema = z.object({
   type: z.literal("collab-presence"),
@@ -247,6 +249,23 @@ export const CompanyMdCollabPresenceEventSchema = z.object({
   clientKey: z.string().uuid(),
   /** What that editor instance is doing. */
   status: z.enum(["editing", "viewing"]),
+  /**
+   * Whether this participant may WRITE the document — server-stamped from the
+   * same `CompanyMd.CanEdit` binding the sync handshake reports as `editable`,
+   * never taken from a client body.
+   *
+   * Distinct from `status`, which is occupancy: `status` says what one editor
+   * instance is doing right now, this says what the person is ALLOWED to do.
+   * The roster admits viewers on purpose (CanView, not CanEdit), so a reader
+   * cannot tell the two apart without this — and a client must never re-derive
+   * it from an ACL, which would stand up a second access authority in the
+   * browser.
+   *
+   * Optional so an older server stays representable on the wire. ABSENT MEANS
+   * NO EDIT RIGHTS: a consumer reads the missing field as `false` rather than
+   * guessing, which keeps the surface default-deny through a rollout.
+   */
+  canEdit: z.boolean().optional(),
   /** Selection anchor — an encoded Y.RelativePosition blob. */
   anchor: z.string().optional(),
   /** Selection head — an encoded Y.RelativePosition blob. */