@company-semantics/contracts 58.3.0 → 58.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@company-semantics/contracts",
-  "version": "58.3.0",
+  "version": "58.4.0",
   "private": false,
   "repository": {
     "type": "git",

package/src/index.ts

@@ -687,6 +687,7 @@ export type { OrgDirectoryPerson, OrgDirectoryResponse } from "./org/index";
 // caller's own directory rather than supplied by the caller.
 export {
   BATCH_INVITE_PERSONS_MAX,
+  INVITE_EXPIRY_DAYS,
   BATCH_INVITE_SKIP_REASONS,
   BatchInviteSkipReasonSchema,
   BatchInviteRequestSchema,

package/src/org/README.md

@@ -163,6 +163,7 @@ Shared type vocabulary for organization ownership, type classification, and tran
 - `INVITE_BATCH_ITEM_REASONS` — Why an item is not `sent`.
 - `INVITE_BATCH_ITEM_STATUSES` — Per-recipient outcome within a batch. - `eligible` — will be invited when the batch is sent. - `excluded` —…
 - `INVITE_BATCH_STATUSES` — Batch lifecycle. - `draft` — created, membership not yet evaluated.
+- `INVITE_EXPIRY_DAYS` — How many days an invitation link stays redeemable.
 - `IdentityTrustLevel` _(type)_ — Identity Trust Level — org's identity posture
 - `IntegrationRequest` _(type)_ — Advisory integration request created by a member.
 - `IntegrationRequestStatus` _(type)_ — Status of an integration request from a member.

package/src/org/index.ts

@@ -412,6 +412,7 @@ export {
   OrgDirectoryPersonSchema,
   OrgDirectoryResponseSchema,
   BATCH_INVITE_PERSONS_MAX,
+  INVITE_EXPIRY_DAYS,
   BATCH_INVITE_SKIP_REASONS,
   BatchInviteSkipReasonSchema,
   BatchInviteRequestSchema,

package/src/org/schemas.ts

@@ -854,6 +854,20 @@ export type OrgDirectoryResponse = z.infer<typeof OrgDirectoryResponseSchema>;
  */
 export const BATCH_INVITE_PERSONS_MAX = 100;
 
+/**
+ * How many days an invitation link stays redeemable.
+ *
+ * Shared vocabulary, not prose: the backend stamps `expires_at` from this when
+ * it mints an invite, and the review surface states the same window to the
+ * person about to send one. It lived in both places as a literal and drifted —
+ * the copy still promised seven days after the policy moved.
+ *
+ * A SECURITY parameter as much as a UX one: it bounds how long a leaked invite
+ * link stays usable, so widening it is a deliberate trust-model change rather
+ * than a copy edit.
+ */
+export const INVITE_EXPIRY_DAYS = 30;
+
 /** @deprecated Use {@link CreateInviteBatchRequestSchema}. Removed in 58.0.0. */
 export const BatchInviteRequestSchema = z.object({
   personIds: z.array(z.string().uuid()).min(1).max(BATCH_INVITE_PERSONS_MAX),