@company-semantics/contracts 46.0.0 → 47.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "46.0.0",
+  "version": "47.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -86,6 +86,7 @@
     "build": "tsc -b --noEmit",
     "typecheck": "NODE_OPTIONS='--max-old-space-size=4096' tsc -b --noEmit",
     "typecheck:ci": "NODE_OPTIONS='--max-old-space-size=4096' tsc -p scripts/ci/tsconfig.json",
+    "lint": "eslint src/ scripts/ tests/ __tests__/ vitest.config.ts",
     "lint:md": "markdownlint-cli2 '**/*.md' '#node_modules' '#.ralph/worktrees' '#.claude/worktrees'",
     "format": "prettier --write src/",
     "format:check": "prettier --check src/",
@@ -137,9 +138,11 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^22.20.1",
     "amphtml-validator": "^1.0.38",
     "culori": "^4.0.2",
+    "eslint": "^10.8.1",
     "husky": "^9.1.7",
     "lint-staged": "^17.3.0",
     "markdownlint-cli2": "^0.23.2",
@@ -147,6 +150,7 @@
     "prettier": "^3.9.6",
     "tsx": "^4.23.1",
     "typescript": "^5.8.3",
+    "typescript-eslint": "^8.66.0",
     "vite": "^8.2.0",
     "vitest": "^4.1.10",
     "yaml": "^2.9.0"
@@ -158,6 +162,8 @@
       "nanoid@<3.3.17": ">=3.3.17",
       "js-yaml@>=4.0.0 <4.3.1": ">=4.3.1 <5.0.0",
       "js-yaml@>=5.0.0 <5.2.2": ">=5.2.2 <6.0.0",
+      "ajv@<6.14.0": ">=6.14.0",
+      "flatted@<3.4.0": ">=3.4.0",
       "picomatch@<4.0.4": ">=4.0.4",
       "esbuild@<0.28.1": ">=0.28.1",
       "linkify-it@<5.0.2": ">=5.0.2",

package/src/api/generated-spec-hash.ts

@@ -1,3 +1,3 @@
 // AUTO-GENERATED — do not edit. Run pnpm generate:spec-hash to regenerate.
-export const SPEC_HASH = '9421bda67789' as const;
-export const SPEC_HASH_FULL = '9421bda67789792a5303137aaeb2f7f886cb490e8db9bee11e03f2de13f94806' as const;
+export const SPEC_HASH = '018976cde74a' as const;
+export const SPEC_HASH_FULL = '018976cde74aa4a20c06c5fb333963bf58199fba93d623cd89cf2a360d95eceb' as const;

package/src/api/generated.ts

@@ -4840,6 +4840,7 @@ export interface components {
             canEdit: boolean;
             canUploadContext?: boolean;
             canManageAcl?: boolean;
+            canComment: boolean;
             canChangeVisibility?: boolean;
             inheritsFromId: string | null;
             inheritsFrom: string | null;

package/src/api/http/routes/ai-chat.ts

@@ -14,7 +14,6 @@ import { buildCapabilityGraph } from "../../../mcp/capability-graph";
 import type {
   MCPToolDescriptor,
   ToolDiscoveryResponse,
-  CapabilityGraph,
 } from "../../../mcp/index";
 
 /**

package/src/content/schemas.ts

@@ -173,6 +173,29 @@ export const CompanyMdDocResponseSchema = z.object({
    * outside the single-doc read.
    */
   canManageAcl: z.boolean().optional(),
+  /**
+   * CONVERSATION capability signal (ADR-CONTRACTS-118 / ADR-BE-520): whether the
+   * requesting actor holds `CompanyMd.CanComment` (the `commenter` band and up)
+   * on this doc — the SAME binding `assertCanCommentSubject` enforces on every
+   * comment write AND, since ADR-BE-520, `assertCanReadSubject` enforces on the
+   * thread read. The app mounts or withholds the ENTIRE comment surface on it —
+   * the rail, the toolbar control, the open-thread badge, the preview
+   * highlights, the gutter marks and the thread fetch itself — not merely a
+   * create affordance: a document's conversation sits inside that document's
+   * confidentiality envelope rather than forming an annotation layer over it
+   * (ADR-APP-122). Signal only; admittance and enforcement are unchanged.
+   *
+   * REQUIRED, unlike the three signals above it, and the departure is
+   * deliberate. Those are optional for back-compat with doc shapes returned
+   * outside the single-doc read; this one gates a confidentiality surface, where
+   * an absent value means "unknown" rather than "false" and any client-invented
+   * default is a guess. Making it required is what lets the app delete the
+   * `canComment ?? canEdit` shadow-field fallback outright instead of carrying a
+   * second, weaker answer beside the server's. Pre-launch there is no
+   * back-compat consumer to protect, so the field is required and the package
+   * takes the major bump.
+   */
+  canComment: z.boolean(),
   /**
    * GOVERNANCE capability signal (ADR-BE-435): whether the requesting actor holds
    * `CompanyMd.CanChangeVisibility` (owner OR the `org.manage_content_sharing`

package/src/identity/__tests__/avatar.test.ts

@@ -50,7 +50,7 @@ describe("resolveAvatar", () => {
   });
 
   it("returns initials source when no avatarUrl", () => {
-    const result = resolveAvatar({ fullName: "Ian Heidt" } as any);
+    const result = resolveAvatar({ fullName: "Ian Heidt" });
     expect(result.source).toBe("initials");
     expect(result.initials).toBe("IH");
     expect(result.url).toBeUndefined();

package/src/message-parts/__tests__/wire.test.ts

@@ -1,26 +1,35 @@
 import { describe, it, expect } from "vitest";
 import { WireSurfaceBuilder } from "../wire.js";
+import type { MCPToolDescriptor } from "../../mcp/index.js";
 import type { ExecutionResultData } from "../execution.js";
 import type { UndoResultData } from "../execution.js";
 
+// Deliberately partial fixtures: toolList is a pure wrapper that passes `tools`
+// straight through, so these assert the wrapping, not descriptor validity. Cast
+// through `unknown` rather than `any` — the narrowing is intentional and stated,
+// not an absence of typing.
+const partialTools = (
+  tools: ReadonlyArray<Record<string, unknown>>,
+): MCPToolDescriptor[] => tools as unknown as MCPToolDescriptor[];
+
 describe("WireSurfaceBuilder.toolList", () => {
   it("returns data part with type data-tool-list", () => {
-    const tools = [
+    const tools = partialTools([
       { name: "search", description: "Search tool", inputSchema: {} },
-    ] as any;
+    ]);
     const result = WireSurfaceBuilder.toolList(tools);
     expect(result.type).toBe("data-tool-list");
   });
 
   it("data.tools matches input array exactly", () => {
-    const tools = [
+    const tools = partialTools([
       { name: "search", description: "Search tool", inputSchema: {} },
       {
         name: "fetch",
         description: "Fetch tool",
         inputSchema: { type: "object" },
       },
-    ] as any;
+    ]);
     const result = WireSurfaceBuilder.toolList(tools);
     expect(result.data.tools).toEqual(tools);
   });

package/src/permissions/access-levels.ts

@@ -9,7 +9,11 @@
  * levels are materialized into `effective_acl_grants`, and ADR-CTRL-086 for
  * the aggregation rule (most-permissive across sources).
  *
- * The commenter level is currently a stub — see ADR-CTRL-087.
+ * The commenter level is NO LONGER a stub. ADR-CTRL-087 held the placeholder
+ * open; ADR-BE-512 discharged it by giving the band a real domain (polymorphic
+ * comment threads bound to `CompanyMd.CanComment`), and ADR-BE-520 made that
+ * binding gate thread reads as well as writes. See also ADR-CONTRACTS-118 for
+ * the `canComment` capability signal the doc read publishes.
  *
  * `meta` is the metadata-only tier used for org-admin lifecycle access
  * (ADR-BE-245). It is materialized/derived only — never an explicit

package/src/permissions/access-request.ts

@@ -46,6 +46,10 @@ export const ACCESS_REQUEST_MESSAGE_MAX_LENGTH = 280;
  * is rendered as text, never as markup, so this is about what may be STORED,
  * not about escaping at render time.
  */
+// The control characters ARE the subject of this pattern — it exists to reject
+// them. no-control-regex flags them as probable typos, which is the opposite of
+// the intent documented above.
+// eslint-disable-next-line no-control-regex
 const PLAIN_TEXT = /^[^\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]*$/;
 
 /** POST body to create an access request. */

package/src/security/org-secrets.ts

@@ -41,6 +41,9 @@ export const OrgSecretsActionSchema = z.enum([
 ]);
 export type OrgSecretsAction = z.infer<typeof OrgSecretsActionSchema>;
 
+// The brand exists only to be referenced in a type position below; the value
+// binding is never read, which is the whole point of the nominal-typing idiom.
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
 declare const SecretValueStringBrand: unique symbol;
 
 /**