@antiphony/shared 0.1.0

package/dist/cjs/api-codecs.cjs

@@ -0,0 +1,971 @@
+'use strict';
+
+var zod = require('zod');
+
+// api-codecs.ts
+var BlobRefSchema = zod.z.object({
+  /** Discriminator for AT Protocol type system */
+  $type: zod.z.literal("blob"),
+  /** Content Identifier (CID) or URL pointing to the blob */
+  ref: zod.z.string(),
+  /** MIME type of the blob (e.g., 'audio/webm') */
+  mimeType: zod.z.string(),
+  /** Size of the blob in bytes */
+  size: zod.z.number()
+});
+
+// types/records.ts
+function httpsUrl() {
+  return zod.z.string().trim().url().refine((u) => /^https?:\/\//i.test(u), {
+    message: "URL must use the http or https scheme"
+  });
+}
+var FirestoreTimestampSchema = zod.z.union([
+  zod.z.custom((data) => {
+    return data && typeof data === "object" && (typeof data.toDate === "function" || "seconds" in data && "nanoseconds" in data);
+  }),
+  zod.z.string(),
+  zod.z.number(),
+  zod.z.date()
+]).transform((data, ctx) => {
+  let date;
+  if (data instanceof Date) {
+    date = data;
+  } else if (typeof data === "string") {
+    date = new Date(data);
+  } else if (typeof data === "number") {
+    date = new Date(data);
+  } else if (typeof data.toDate === "function") {
+    date = data.toDate();
+  } else {
+    const timestamp = data;
+    date = new Date(timestamp.seconds * 1e3 + timestamp.nanoseconds / 1e6);
+  }
+  if (Number.isNaN(date.getTime())) {
+    ctx.addIssue({
+      code: zod.z.ZodIssueCode.custom,
+      message: "FirestoreTimestamp coerced to Invalid Date"
+    });
+    return zod.z.NEVER;
+  }
+  return date;
+});
+zod.z.object({
+  /** Unique Firebase UID */
+  id: zod.z.string(),
+  /** Public handle (e.g. @brad). Optional for Lite Users. */
+  handle: zod.z.string().min(3).max(20).regex(/^[a-zA-Z0-9_]+$/).nullable().optional(),
+  /** User stated intent (e.g. "Podcaster", "Listener") */
+  usageIntent: zod.z.string().nullable().optional(),
+  /** 
+   * Domain for federated handle support. 
+   * Defaults to 'voxpop.com'.
+   */
+  domain: zod.z.string().default("voxpop.com"),
+  /**
+   * Display Name (e.g. "Brad Thorson"). Nullable: Firestore stores `null`
+   * when the user clears this field via the settings form, and the schema
+   * must match storage reality or `UserRecordSchema.parse` (in
+   * `getUserRecordByUid`) will throw.
+   */
+  displayName: zod.z.string().max(50).nullable().optional(),
+  /** Short bio/description — nullable for the same reason as displayName. */
+  bio: zod.z.string().max(160).nullable().optional(),
+  /** URL to avatar image — nullable for the same reason as displayName. */
+  avatarUrl: zod.z.string().url().nullable().optional(),
+  /** Optional personal website surfaced on the public profile. */
+  website: httpsUrl().nullable().optional(),
+  /** Up to 5 additional public links (label + URL) shown under the bio. */
+  links: zod.z.array(zod.z.object({
+    label: zod.z.string().min(1).max(40),
+    url: httpsUrl()
+  })).max(5).optional(),
+  /** When true and a Bluesky identity is linked, surfaces it on the public profile. */
+  showBlueskyPublicly: zod.z.boolean().optional(),
+  /** Server timestamp of creation */
+  createdAt: FirestoreTimestampSchema,
+  /** Individual account tier — free or creator_pro */
+  tier: zod.z.enum(["free", "creator_pro"]).default("free"),
+  /** Account status. Deactivated accounts retain data but are excluded from lookups. */
+  status: zod.z.enum(["active", "deactivated"]).default("active"),
+  /** Timestamp when the account was deactivated (soft deleted) */
+  deactivatedAt: FirestoreTimestampSchema.optional(),
+  /**
+   * Denormalized org memberships — { orgId: role } for fast lookup.
+   * Source of truth is organizations/{orgId}/members/{userId}.
+   * Kept in sync by Cloud Function trigger.
+   */
+  orgMemberships: zod.z.record(zod.z.string(), zod.z.enum(["owner", "admin", "member"])).optional()
+});
+var PromptRecordSchema = zod.z.object({
+  /** Unique Prompt ID */
+  id: zod.z.string(),
+  /** ID of the User who created this prompt. Always a user ID, never an org ID. @see UserRecord */
+  authorId: zod.z.string(),
+  /** Organization context this prompt belongs to (null = personal/no org) */
+  orgId: zod.z.string().nullable().optional(),
+  /** The main text of the question/prompt */
+  title: zod.z.string().min(3),
+  /** Optional extra context */
+  description: zod.z.string().nullable().optional(),
+  /** User who created this prompt (differs from authorId when org-owned) */
+  createdBy: zod.z.string().optional(),
+  /** URL to the recorded audio file (GCS) */
+  audioUrl: zod.z.string().url().or(zod.z.literal("")),
+  /** AT Protocol blob reference (future replacement for audioUrl) */
+  audio: BlobRefSchema.optional(),
+  /**
+   * AT Protocol URI returned by the publisher after a successful
+   * `repo.putRecord` against the author's PDS — e.g.
+   * `at://did:plc:abc123/com.voxpop.audio.prompt/3kj4...`. Optional,
+   * no migration: existing rows leave it unset. Format-validated so
+   * malformed strings surface at the schema-parse boundary rather than
+   * being silently stored.
+   */
+  atprotoUri: zod.z.string().regex(/^at:\/\/.+/).optional(),
+  /** Server timestamp of creation */
+  createdAt: FirestoreTimestampSchema,
+  /**
+   * Life-cycle status.
+   * - `live`: Visible and accepting replies.
+   * - `archived`: Visible but closed for new replies.
+   * - `deleted`: Soft deleted.
+   */
+  status: zod.z.enum(["live", "archived", "deleted"]).default("live"),
+  /** AI Enrichment Fields */
+  aiStatus: zod.z.enum(["pending", "complete", "error"]).optional(),
+  aiError: zod.z.string().optional(),
+  aiSummary: zod.z.string().optional(),
+  aiLabels: zod.z.array(zod.z.string()).optional(),
+  transcription: zod.z.string().optional(),
+  /** Pre-computed waveform peaks (normalized 0–1) for instant audio visualization */
+  waveformPeaks: zod.z.array(zod.z.number()).optional(),
+  /** Social Share Video Fields */
+  socialVideoUrl: zod.z.string().url().optional(),
+  socialVideoStoragePath: zod.z.string().optional(),
+  socialVideoStatus: zod.z.enum(["pending", "complete", "error"]).optional(),
+  socialVideoError: zod.z.string().optional(),
+  /** The audio URL/path used to generate the current video (for cache invalidation) */
+  socialVideoSourceAudio: zod.z.string().optional()
+});
+var ReplyRecordSchema = zod.z.object({
+  /** Unique Reply ID */
+  id: zod.z.string(),
+  /** The Prompt being replied to. @see PromptRecord */
+  promptId: zod.z.string(),
+  /** The User who replied. @see UserRecord */
+  authorId: zod.z.string(),
+  /** URL to the recorded audio file (GCS) */
+  audioUrl: zod.z.string().url(),
+  /** AT Protocol blob reference (future replacement for audioUrl) */
+  audio: BlobRefSchema.optional(),
+  /** Server timestamp of creation */
+  createdAt: FirestoreTimestampSchema,
+  /**
+   * Life-cycle status.
+   * - `live`: Visible and accepting replies.
+   * - `archived`: Visible but closed for new replies.
+   * - `deleted`: Soft deleted.
+   */
+  status: zod.z.enum(["live", "archived", "deleted"]).default("live"),
+  /**
+   * Pre-computed waveform peaks (normalized 0–1) for instant audio
+   * visualization. **Stays on canonical** (does NOT move to the
+   * enrichment doc) — produced by a plain ffmpeg pass at ingestion,
+   * not an AI step; a self-hoster without paid-tier AI still needs
+   * this on every reply for the audio player. See
+   * `specs/ai-enrichment-split.md` § 5.
+   */
+  waveformPeaks: zod.z.array(zod.z.number()).optional(),
+  /**
+   * Duration of the audio in seconds, computed server-side from
+   * ffmpeg. **Stays on canonical** (same reasoning as `waveformPeaks`
+   * above — ingestion ffmpeg output, not an AI enrichment). See
+   * `specs/ai-enrichment-split.md` § 5.
+   */
+  audioDurationSec: zod.z.number().optional()
+});
+zod.z.object({
+  id: zod.z.string(),
+  /** Private notes by the prompt author about this reply. */
+  notes: zod.z.string().optional(),
+  // === AI-enrichment fields (sole source of truth post Stage 4) ===
+  //
+  // These lifted off canonical in Stage 4 of `specs/ai-enrichment-split.md`.
+  // Writers (`functions/`) route AI updates here via the split-write
+  // helper in `functions/src/services/replyEnrichmentDualWrite.ts`;
+  // readers source them via the hydrator's enrichment branch (see
+  // `packages/core/services/hydration.ts`).
+  // --- AI core (Gemini-generated) ---
+  aiStatus: zod.z.enum(["pending", "complete", "error", "skipped_too_short"]).optional(),
+  aiError: zod.z.string().optional(),
+  aiSummary: zod.z.string().optional(),
+  aiLabels: zod.z.array(zod.z.string()).optional(),
+  transcription: zod.z.string().optional(),
+  sentiment: zod.z.enum(["Positive", "Negative", "Neutral"]).optional(),
+  /** Must match the widened enum in `ReplyRecordSchema.energyLevel`. */
+  energyLevel: zod.z.enum(["High", "Low", "Neutral"]).optional(),
+  engagementScore: zod.z.number().min(1).max(10).optional(),
+  // --- Voice isolation (ElevenLabs, paid tier) ---
+  /** Noise-reduced audio URL — replaces `audioUrl` for downstream players when present. PUBLIC. */
+  enhancedAudioUrl: zod.z.string().url().optional(),
+  /** Storage path companion to `enhancedAudioUrl` — private. */
+  enhancedStoragePath: zod.z.string().optional(),
+  // --- Social-share video (paid tier) ---
+  //
+  // All `socialVideo*` fields are creator-only. The URL points at the
+  // generated artifact (a video file the creator can download and post
+  // to social media); the reply detail page does NOT render it.
+  socialVideoUrl: zod.z.string().url().optional(),
+  socialVideoStoragePath: zod.z.string().optional(),
+  socialVideoStatus: zod.z.enum(["pending", "complete", "error"]).optional(),
+  socialVideoError: zod.z.string().optional(),
+  /** The audio URL/path used to generate the current video (for cache invalidation). */
+  socialVideoSourceAudio: zod.z.string().optional()
+});
+zod.z.object({
+  /** Composite key `${viewerUid}_${targetUid}`. */
+  id: zod.z.string(),
+  /** Per-viewer CRM notes about the target. */
+  notes: zod.z.string().optional(),
+  /** Per-viewer freeform tags about the target. */
+  tags: zod.z.array(zod.z.string()).optional(),
+  // === Identity-merge: alias set ===
+  //
+  // Other identifiers the viewer has declared to be the SAME person as
+  // this entry's `targetUid`. vCard/URI-aligned: each entry is a
+  // scheme-prefixed identifier, so one field generalizes across networks
+  // AND across the future contact-sync import (which carries phone/email):
+  //   "uid:<firebaseUid>" | "did:plc:…" | "handle:bob.bsky.social"
+  //   | "tel:+15551234567" | "mailto:x@example.com"
+  // Mirrors vCard 4.0's `UID` + `CLIENTPIDMAP`/`PID` source-tracking
+  // (RFC 6350) — the standard answer to "the same person from multiple
+  // sources". See `specs/people-lexicon-prior-art.md`. The People
+  // read-path collapses any replier whose "uid:<uid>" appears here into
+  // this primary entry. Empty until the merge feature is used.
+  aliases: zod.z.array(zod.z.string()).optional(),
+  lastUpdated: FirestoreTimestampSchema.optional()
+});
+zod.z.object({
+  sipUri: zod.z.string(),
+  sipUsername: zod.z.string(),
+  sipSecret: zod.z.string(),
+  provider: zod.z.enum(["twilio", "plivo", "internal"])
+});
+zod.z.object({
+  /** User's personal phone number (E.164) */
+  phoneNumber: zod.z.string(),
+  /** Line type from Twilio Lookup v2 */
+  lineType: zod.z.string().nullable(),
+  /** Carrier name from Twilio Lookup v2 */
+  carrier: zod.z.string().nullable(),
+  /** free = shared Twilio number (ForwardedFrom routing), paid = dedicated number */
+  tier: zod.z.enum(["free", "paid"]),
+  /** The VoxPop Twilio number calls forward to (E.164) */
+  voxpopNumber: zod.z.string(),
+  /** Twilio Phone Number SID (paid tier only) */
+  twilioNumberSid: zod.z.string().nullable().optional(),
+  /** Forwarding verification state */
+  verificationStatus: zod.z.enum(["pending", "verifying", "verified", "failed"]).default("pending"),
+  /** Last verification attempt timestamp */
+  lastVerificationAt: FirestoreTimestampSchema.optional(),
+  /** Number of verification attempts */
+  verificationAttempts: zod.z.number().default(0),
+  /** Reason for verification failure */
+  failureReason: zod.z.string().nullable().optional(),
+  /** Whether call forwarding is active */
+  enabled: zod.z.boolean().default(false),
+  createdAt: FirestoreTimestampSchema,
+  updatedAt: FirestoreTimestampSchema
+});
+var ConnectorTypeSchema = zod.z.enum(["telephony"]);
+var ConnectorStatusSchema = zod.z.object({
+  /** Coarse, generic lifecycle the control-plane UI can render without
+   * connector-specific knowledge. */
+  state: zod.z.enum(["unconfigured", "pending", "active", "error", "disabled"]).default("unconfigured"),
+  detail: zod.z.string().nullable().optional(),
+  /** Opaque, connector-specific status detail (e.g. telephony's
+   * `{ verificationStatus, verificationAttempts, failureReason }`). Connector-
+   * owned like the rest of `status` — never user-writable. Nullable so a doc
+   * that stored `data: null` round-trips without a parse error. */
+  data: zod.z.record(zod.z.unknown()).nullable().optional(),
+  updatedAt: FirestoreTimestampSchema.optional()
+});
+var ConnectorConfigRecordSchema = zod.z.object({
+  connectorType: ConnectorTypeSchema,
+  /** The owning user. Org-scoping (ownerId as an orgId) is a later step. */
+  ownerId: zod.z.string(),
+  /** Opaque, connector-specific blob. Core does not interpret this. */
+  settings: zod.z.record(zod.z.unknown()).default({}),
+  /** Reference into a secret store (e.g. Secret Manager key). Never a raw secret. */
+  secretRef: zod.z.string().nullable().optional(),
+  enabled: zod.z.boolean().default(false),
+  status: ConnectorStatusSchema.default({ state: "unconfigured" }),
+  createdAt: FirestoreTimestampSchema,
+  updatedAt: FirestoreTimestampSchema
+});
+zod.z.object({
+  id: zod.z.string(),
+  ownerId: zod.z.string(),
+  /** The caller number this rule matches (E.164). Format-enforced at the
+   *  record level so any writer (API, future contact-sync/callback) can't
+   *  persist a malformed number. */
+  e164: zod.z.string().regex(/^\+[1-9]\d{6,14}$/, "Must be an E.164 phone number"),
+  /** Display label, e.g. "Mom" / "Delta Airlines". null = unlabeled. */
+  label: zod.z.string().nullable().optional(),
+  /** `allow` = ring through; `screen` = async voicemail. */
+  action: zod.z.enum(["allow", "screen"]),
+  /** Provenance. `manual` = user-created; the others are future writers. */
+  source: zod.z.enum(["manual", "contact-sync", "callback"]),
+  /** null = permanent; a date = self-expiring exception. */
+  expiresAt: FirestoreTimestampSchema.nullable().optional(),
+  createdAt: FirestoreTimestampSchema
+});
+var OrganizationRecordSchema = zod.z.object({
+  id: zod.z.string(),
+  /** Display name of the organization */
+  name: zod.z.string().min(3).max(50),
+  /** 
+   * Unique handle for the organization (e.g. voxpop.com/@mypodcast).
+   * Used for public URLs.
+   */
+  slug: zod.z.string().min(3).max(30).regex(/^[a-z0-9-]+$/),
+  /** URL to avatar/logo */
+  avatarUrl: zod.z.string().url().optional(),
+  /** URL to the podcast RSS feed */
+  rssFeedUrl: zod.z.string().url().optional(),
+  /** External website URL */
+  websiteUrl: httpsUrl().optional(),
+  /** Description or tagline */
+  description: zod.z.string().optional(),
+  /** Owner ID (User ID) */
+  ownerId: zod.z.string(),
+  /** Server timestamp of creation */
+  createdAt: FirestoreTimestampSchema,
+  /** Verified domain (e.g., "acme.com") — enables auto-join, enterprise features */
+  domain: zod.z.string().nullable().optional(),
+  /** Whether the domain has been verified via DNS TXT record */
+  domainVerified: zod.z.boolean().default(false),
+  /** DNS verification token (stored server-side until verification completes) */
+  domainVerificationToken: zod.z.string().optional(),
+  /** Billing email — required for paid orgs, where invoices go */
+  billingEmail: zod.z.string().email().nullable().optional(),
+  /**
+   * Tier determines isolation and feature set. Orgs are meant to be paid
+   * (business or enterprise); free/pro exist on the enum for the individual track.
+   * Default is provisionally `business` (the entry paid tier) — it's assigned at
+   * creation with no subscription behind it yet, so it stays provisional until billing
+   * promotes/reconciles the org. See docs/tech-debt.md "Org tier billing reconciliation".
+   */
+  tier: zod.z.enum(["free", "pro", "business", "enterprise"]).default("business"),
+  /** Stripe Customer ID */
+  stripeCustomerId: zod.z.string().optional(),
+  /** Subscription Status */
+  subscriptionStatus: zod.z.enum(["active", "trialing", "past_due", "canceled", "unpaid"]).optional()
+});
+var OrganizationMemberRecordSchema = zod.z.object({
+  orgId: zod.z.string(),
+  userId: zod.z.string(),
+  /** Role in the organization */
+  role: zod.z.enum(["owner", "admin", "member"]),
+  /** Server timestamp of joining */
+  joinedAt: FirestoreTimestampSchema,
+  invitedBy: zod.z.string().optional()
+});
+var OrgInviteRecordSchema = zod.z.object({
+  id: zod.z.string(),
+  orgId: zod.z.string(),
+  /** Email the invite was sent to */
+  email: zod.z.string().email(),
+  /** Role to assign on acceptance */
+  role: zod.z.enum(["admin", "member"]),
+  /** User ID of who sent the invite */
+  invitedBy: zod.z.string(),
+  /** Invite lifecycle status */
+  status: zod.z.enum(["pending", "accepted", "expired", "revoked"]).default("pending"),
+  /** Server timestamp of creation */
+  createdAt: FirestoreTimestampSchema,
+  /** When this invite expires */
+  expiresAt: FirestoreTimestampSchema
+});
+var ProfileViewBasicSchema = zod.z.object({
+  id: zod.z.string(),
+  handle: zod.z.string().nullable().optional(),
+  // `displayName` and `bio` are `.nullable()` — Firestore stores `null` for
+  // empty values on these fields (see users-dependencies.ts), and Zod's
+  // `.optional()` alone rejects `null`. This hit dashboard rendering on the
+  // Phase 3.1 HTTP cutover, when transport-layer Zod validation started
+  // actually exercising the wire shape. Consumers already use truthy
+  // checks / `??` / `||`, so widening the type to include `null` is safe.
+  displayName: zod.z.string().nullable().optional(),
+  avatarUrl: zod.z.string().nullable().optional(),
+  bio: zod.z.string().nullable().optional(),
+  /** Personal website link surfaced on the public profile. */
+  website: zod.z.string().nullable().optional(),
+  /** Public links (label + URL) shown under the bio. */
+  links: zod.z.array(zod.z.object({
+    label: zod.z.string(),
+    url: zod.z.string()
+  })).optional(),
+  /**
+   * AT Protocol identity, surfaced on the public profile only when the user
+   * opts in (`UserRecord.showBlueskyPublicly === true`). Projection happens
+   * in the user dependency layer; this schema simply allows the field.
+   */
+  bluesky: zod.z.object({
+    handle: zod.z.string(),
+    did: zod.z.string()
+  }).optional(),
+  stats: zod.z.object({
+    followers: zod.z.number().default(0),
+    following: zod.z.number().default(0),
+    prompts: zod.z.number().default(0)
+  }).optional(),
+  badges: zod.z.array(zod.z.string()).optional(),
+  isVerified: zod.z.boolean().optional(),
+  createdAt: FirestoreTimestampSchema.optional()
+});
+var ProfileViewDetailedSchema = ProfileViewBasicSchema.extend({
+  /** AT Protocol Identity link */
+  bluesky: zod.z.object({
+    handle: zod.z.string(),
+    did: zod.z.string()
+  }).optional(),
+  usageIntent: zod.z.string().nullable().optional(),
+  /** Hydrated RSS Data (fetched from sub-collection) */
+  rssSummary: zod.z.object({
+    title: zod.z.string().optional(),
+    description: zod.z.string().optional(),
+    items: zod.z.array(zod.z.object({
+      title: zod.z.string().optional(),
+      link: zod.z.string().optional(),
+      content: zod.z.string().optional(),
+      pubDate: zod.z.string().optional()
+    })).optional(),
+    lastFetchedAt: FirestoreTimestampSchema.optional()
+  }).optional(),
+  promptAudioUrl: zod.z.string().optional(),
+  /** @deprecated Use stats.prompts from ProfileViewBasic instead */
+  totalPrompts: zod.z.number().optional(),
+  totalReplies: zod.z.number().optional(),
+  favoritePromptId: zod.z.string().optional()
+});
+var ProfileViewSelfSchema = ProfileViewDetailedSchema.extend({
+  phoneNumber: zod.z.string().nullable().optional(),
+  email: zod.z.string().optional(),
+  lastSeenAt: FirestoreTimestampSchema.optional(),
+  lastActiveAt: FirestoreTimestampSchema.optional(),
+  unreadReplyCount: zod.z.number().default(0),
+  newReplierCount: zod.z.number().default(0),
+  /**
+   * Account tier from UserRecord — surfaced on the self profile so the
+   * client can gate paid features (e.g. the Performance dashboard tab).
+   * Optional for legacy docs without the field; consumers should treat
+   * missing as `'free'`.
+   */
+  tier: zod.z.enum(["free", "creator_pro"]).optional(),
+  /**
+   * Surfaces the linked Bluesky identity (handle + DID) on the public profile
+   * when true. Persisted on UserRecord; exposed in self/detailed views so the
+   * settings form can render the toggle's current state.
+   */
+  showBlueskyPublicly: zod.z.boolean().optional(),
+  settings: zod.z.object({
+    notifications: zod.z.boolean().optional(),
+    theme: zod.z.string().optional()
+  }).optional()
+});
+var ProfileViewAdminSchema = ProfileViewSelfSchema.extend({
+  blockedUsers: zod.z.array(zod.z.string()).optional(),
+  followers: zod.z.array(zod.z.string()).optional(),
+  following: zod.z.array(zod.z.string()).optional(),
+  reportCount: zod.z.number().optional(),
+  isBanned: zod.z.boolean().optional()
+});
+var ProfileViewSchema = ProfileViewAdminSchema;
+var PromptViewSchema = zod.z.object({
+  /** AT Protocol URI (e.g. at://did:plc.../app.../123) */
+  uri: zod.z.string().optional(),
+  /** IPFS Content ID */
+  cid: zod.z.string().optional(),
+  /** The raw prompt data */
+  record: PromptRecordSchema,
+  /** The hydrated author profile */
+  author: ProfileViewSchema,
+  /** Total number of replies */
+  replyCount: zod.z.number().default(0),
+  likeCount: zod.z.number().default(0),
+  updatedAt: FirestoreTimestampSchema.optional(),
+  lastReplyAt: FirestoreTimestampSchema.optional(),
+  tags: zod.z.array(zod.z.string()).optional(),
+  visibility: zod.z.enum(["public", "private", "unlisted", "archived"]).default("public"),
+  analytics: zod.z.object({
+    views: zod.z.number().default(0),
+    listens: zod.z.number().default(0),
+    /**
+     * Mean engagementScore (1–10) across this prompt's `status: 'live'`
+     * replies that completed AI enrichment. `null` when no such replies
+     * exist (0 would alias a valid bottom-of-range score). Derived in
+     * hydration from the prompt doc's `engagementScoreSum / Count`.
+     */
+    avgEngagementScore: zod.z.number().nullable().optional(),
+    /**
+     * Counts of `status: 'live'` AI-enriched replies grouped by sentiment.
+     * Keys lowercase by convention; source enum
+     * (`Positive | Neutral | Negative`) is mapped at the write site.
+     */
+    sentimentBreakdown: zod.z.object({
+      positive: zod.z.number(),
+      neutral: zod.z.number(),
+      negative: zod.z.number()
+    }).optional()
+  }).optional(),
+  moderation: zod.z.object({
+    flagged: zod.z.boolean().default(false),
+    reason: zod.z.string().optional()
+  }).optional(),
+  // AI Enrichment Fields (Hydrated from Record but hidden from Record Schema)
+  aiLabels: zod.z.array(zod.z.string()).optional(),
+  aiSummary: zod.z.string().optional(),
+  aiStatus: zod.z.enum(["pending", "complete", "error"]).optional(),
+  aiError: zod.z.string().optional(),
+  transcription: zod.z.string().optional()
+});
+var PromptViewPublicSchema = PromptViewSchema.omit({
+  analytics: true,
+  moderation: true,
+  aiLabels: true,
+  aiSummary: true,
+  aiStatus: true,
+  aiError: true,
+  transcription: true
+}).extend({
+  author: ProfileViewBasicSchema
+});
+var ReplyViewSchema = zod.z.object({
+  record: ReplyRecordSchema,
+  author: ProfileViewSchema,
+  recipient: ProfileViewSchema,
+  /** GCS Storage Path for audio file */
+  storagePath: zod.z.string().optional(),
+  duration: zod.z.number().optional(),
+  updatedAt: FirestoreTimestampSchema.optional(),
+  isRead: zod.z.boolean(),
+  readBy: zod.z.array(zod.z.string()).default([]),
+  isDeleted: zod.z.boolean().default(false),
+  reactions: zod.z.record(zod.z.string(), zod.z.number()).optional(),
+  moderation: zod.z.object({
+    flagged: zod.z.boolean().default(false),
+    reason: zod.z.string().optional()
+  }).optional(),
+  // AI Enrichment Fields (Hydrated from Record but hidden from Record Schema)
+  aiLabels: zod.z.array(zod.z.string()).optional(),
+  aiSummary: zod.z.string().optional(),
+  aiStatus: zod.z.enum(["pending", "complete", "error", "skipped_too_short"]).optional(),
+  aiError: zod.z.string().optional(),
+  transcription: zod.z.string().optional(),
+  sentiment: zod.z.enum(["Positive", "Negative", "Neutral"]).optional(),
+  /** Must match the widened enum in `ReplyRecordSchema.energyLevel`. */
+  energyLevel: zod.z.enum(["High", "Low", "Neutral"]).optional(),
+  engagementScore: zod.z.number().min(1).max(10).optional(),
+  // === Voice-isolation enrichment (lifted; see specs/ai-enrichment-split.md) ===
+  //
+  // `enhancedAudioUrl` is the only one of these the public view keeps —
+  // it replaces `audioUrl` for downstream players when present.
+  // `enhancedStoragePath` is private (storage paths are server-side
+  // bookkeeping).
+  enhancedAudioUrl: zod.z.string().url().optional(),
+  enhancedStoragePath: zod.z.string().optional(),
+  // === Social-share video enrichment (lifted; creator-only) ===
+  //
+  // All `socialVideo*` fields are stripped by `toReplyViewPublic` —
+  // the URL points at a generated artifact the creator may share to
+  // social media, NOT at content the reply page should render. Status /
+  // error / source-audio are job-tracking state.
+  socialVideoUrl: zod.z.string().url().optional(),
+  socialVideoStoragePath: zod.z.string().optional(),
+  socialVideoStatus: zod.z.enum(["pending", "complete", "error"]).optional(),
+  socialVideoError: zod.z.string().optional(),
+  socialVideoSourceAudio: zod.z.string().optional(),
+  /** @private Confirmed listener phone number (never exposed publicly) */
+  listenerPhoneNumber: zod.z.string().regex(/^\+[1-9]\d{1,14}$/).optional(),
+  /**
+   * @private Per-viewer private notes about this reply (CRM enrichment).
+   * Lifted into the view from `enrichments/replies/{id}.notes` by the
+   * hydrator when the viewer is the prompt author. Never populated for
+   * non-author viewers; defensively stripped by `toReplyViewPublic`.
+   */
+  notes: zod.z.string().optional()
+});
+var ReplyViewPublicSchema = ReplyViewSchema.omit({
+  listenerPhoneNumber: true,
+  notes: true,
+  // AI cluster — only `transcription` survives.
+  aiStatus: true,
+  aiError: true,
+  aiSummary: true,
+  aiLabels: true,
+  sentiment: true,
+  energyLevel: true,
+  engagementScore: true,
+  // Voice isolation — keep enhancedAudioUrl, strip the path.
+  enhancedStoragePath: true,
+  // Social-video — entire cluster is creator-only.
+  socialVideoUrl: true,
+  socialVideoStoragePath: true,
+  socialVideoStatus: true,
+  socialVideoError: true,
+  socialVideoSourceAudio: true
+});
+var OrganizationViewSchema = zod.z.object({
+  record: OrganizationRecordSchema,
+  memberCount: zod.z.number().default(1),
+  currentUserRole: zod.z.enum(["owner", "admin", "member"]).optional()
+});
+zod.z.object({
+  record: OrganizationMemberRecordSchema,
+  profile: ProfileViewBasicSchema
+});
+zod.z.object({
+  record: OrgInviteRecordSchema,
+  /** Display name of the user who sent the invite */
+  inviterName: zod.z.string().optional(),
+  /** Name of the organization */
+  orgName: zod.z.string()
+});
+zod.z.object({
+  promptId: zod.z.string(),
+  repliers: zod.z.record(zod.z.string(), zod.z.object({
+    firstReplyAt: FirestoreTimestampSchema,
+    lastReplyAt: FirestoreTimestampSchema,
+    replyCount: zod.z.number()
+  }))
+});
+PromptViewSchema.extend({
+  replies: zod.z.array(ReplyViewSchema)
+});
+var ReplierSchema = zod.z.object({
+  handle: zod.z.string(),
+  /** ISO date string */
+  lastReplyDate: zod.z.string(),
+  /** ISO date string */
+  firstReplyAt: zod.z.string(),
+  totalReplies: zod.z.number()
+});
+zod.z.discriminatedUnion("type", [
+  // Public endpoint (`GET /resolve/:handle`) — project to the basic shape so
+  // PII/admin fields (email, phoneNumber, settings, blockedUsers, …) never
+  // cross the public API boundary. See `toProfileViewBasic`.
+  zod.z.object({ type: zod.z.literal("user"), profile: ProfileViewBasicSchema }),
+  zod.z.object({ type: zod.z.literal("org"), org: OrganizationViewSchema })
+]);
+zod.z.object({
+  // Public endpoint (`GET /users/:handle/profile`) — basic shape only, so the
+  // owner's PII/admin fields never serialize to anonymous callers.
+  profileUser: ProfileViewBasicSchema,
+  // Each prompt's nested `author` is the profile owner, hydrated from the
+  // wide admin profile (`getPromptsForUser` prefetches via getUserDataByUid).
+  // Use the PUBLIC prompt/reply shapes so that nested author PII (email,
+  // phoneNumber, settings, …) and owner-only prompt enrichment never leak.
+  allPromptsWithReplies: zod.z.array(PromptViewPublicSchema.extend({
+    replies: zod.z.array(ReplyViewPublicSchema)
+  })),
+  repliers: zod.z.array(ReplierSchema)
+});
+var RssSummarySchema = zod.z.object({
+  title: zod.z.string().optional(),
+  description: zod.z.string().optional(),
+  image: zod.z.string().optional(),
+  link: zod.z.string().optional(),
+  items: zod.z.array(zod.z.object({
+    title: zod.z.string().optional(),
+    link: zod.z.string().optional(),
+    content: zod.z.string().optional(),
+    pubDate: zod.z.string().optional()
+  })).optional(),
+  lastFetchedAt: FirestoreTimestampSchema.optional()
+});
+zod.z.object({
+  org: OrganizationViewSchema,
+  prompts: zod.z.array(PromptViewSchema),
+  rssSummary: RssSummarySchema.nullable()
+});
+zod.z.object({
+  profile: ProfileViewBasicSchema,
+  totalReplies: zod.z.number(),
+  /** ISO date string */
+  lastReplyDate: zod.z.string(),
+  /** ISO date string */
+  firstReplyAt: zod.z.string(),
+  /** Phone number for anonymous repliers (from Firebase Auth, only visible to prompt author) */
+  phoneNumber: zod.z.string().optional()
+});
+
+// types/audio.ts
+var StrongRefSchema = zod.z.object({
+  uri: zod.z.string().regex(/^at:\/\/.+/, "Must be an at:// URI"),
+  cid: zod.z.string()
+});
+var ReplyRefSchema = zod.z.object({
+  root: StrongRefSchema,
+  parent: StrongRefSchema
+});
+var AudioEmbedSchema = zod.z.object({
+  $type: zod.z.literal("dev.antiphony.embed.audio"),
+  /** The audio bytes as a content-addressed storage ref (CID/path). */
+  audio: BlobRefSchema,
+  /** Duration in MILLISECONDS (platform-wide unit; not seconds). */
+  durationMs: zod.z.number().int().min(0).optional(),
+  /** User-authored short description (audio analogue of image alt). NOT the transcript. */
+  alt: zod.z.string().max(1e4).optional(),
+  /** Pre-computed waveform peaks (normalized 0–100) for instant rendering. */
+  waveform: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional()
+});
+var TranscriptSegmentSchema = zod.z.object({
+  startMs: zod.z.number().int().min(0),
+  endMs: zod.z.number().int().min(0),
+  text: zod.z.string()
+}).refine((s) => s.endMs >= s.startMs, {
+  message: "endMs must be >= startMs",
+  path: ["endMs"]
+});
+var TimedTranscriptSchema = zod.z.object({
+  segments: zod.z.array(TranscriptSegmentSchema),
+  text: zod.z.string().optional()
+});
+var AudioEmbedViewSchema = zod.z.object({
+  $type: zod.z.literal("dev.antiphony.embed.audio#view"),
+  url: zod.z.string().url(),
+  durationMs: zod.z.number().int().min(0).optional(),
+  // `alt`/`waveform` are copied from the stored embed; keep the same bounds
+  // so a view can never carry a larger payload than the record allows.
+  alt: zod.z.string().max(1e4).optional(),
+  waveform: zod.z.array(zod.z.number().int().min(0).max(100)).max(1e3).optional(),
+  /** Lifted from the transcript enrichment record; absent until transcription completes. */
+  transcript: TimedTranscriptSchema.optional()
+});
+zod.z.object({
+  /** Storage id (rkey/doc id). */
+  id: zod.z.string(),
+  // --- Tenancy + facets (storage-indexed; NOT in the lexicon) ---
+  /** Origin app that created this record — the multi-tenant isolation key. */
+  originAppId: zod.z.string(),
+  /** Authoring user. A queryable facet, not the tenancy boundary. */
+  authorId: zod.z.string(),
+  /** Optional AT Protocol identity of the author (facet). */
+  authorDid: zod.z.string().optional(),
+  /** Optional org context (facet). */
+  orgId: zod.z.string().nullable().optional(),
+  /** Denormalized from `reply` presence: `reply` set ⇒ 'reply', else 'prompt'. */
+  kind: zod.z.enum(["prompt", "reply"]),
+  // --- Lexicon fields (public contract) ---
+  /** User-authored text (bsky-semantic). May be empty for pure-audio posts. NEVER the transcript. */
+  text: zod.z.string().max(3e3),
+  /** Optional headline; a prompt feature, not the discriminator. */
+  title: zod.z.string().max(3e3).optional(),
+  /** Audio (or other) attachment. Audio posts carry an `AudioEmbed`. */
+  embed: AudioEmbedSchema.optional(),
+  /** Present iff this post is a reply (StrongRef root + parent). */
+  reply: ReplyRefSchema.optional(),
+  /** BCP-47 language tags for the text. */
+  langs: zod.z.array(zod.z.string()).max(3).optional(),
+  /** Author-applied self-label values (content warnings). Simplified from the
+   *  lexicon's `com.atproto.label.defs#selfLabels` to the bare value strings. */
+  selfLabels: zod.z.array(zod.z.string()).optional(),
+  createdAt: FirestoreTimestampSchema
+}).refine(
+  // `kind` is denormalized from `reply` presence at write time; enforce the
+  // invariant so an inconsistent record can't be written or read silently.
+  // A reply has `reply` and no `title`; a prompt has neither a `reply`.
+  (r) => r.kind === "reply" ? !!r.reply && r.title === void 0 : !r.reply,
+  {
+    message: "kind must match reply presence: 'reply' \u21D2 reply set & no title; 'prompt' \u21D2 no reply",
+    path: ["kind"]
+  }
+);
+zod.z.object({
+  id: zod.z.string(),
+  /** The post whose audio this transcribes. */
+  subject: StrongRefSchema,
+  transcript: TimedTranscriptSchema,
+  /** BCP-47 language tag of the transcript. */
+  lang: zod.z.string().optional(),
+  /** Model/provider provenance (the generator is a pluggable port). */
+  model: zod.z.string().optional(),
+  createdAt: FirestoreTimestampSchema
+});
+zod.z.object({
+  handle: zod.z.string().min(3).max(20).optional(),
+  usageIntent: zod.z.string().max(100).optional(),
+  rssFeed: zod.z.string().url().optional()
+});
+var ViewerStateSchema = zod.z.object({
+  /** True when the authenticated caller authored this post. */
+  isAuthor: zod.z.boolean().default(false)
+});
+var PostRecordPublicSchema = zod.z.object({
+  text: zod.z.string(),
+  title: zod.z.string().optional(),
+  reply: ReplyRefSchema.optional(),
+  langs: zod.z.array(zod.z.string()).optional(),
+  selfLabels: zod.z.array(zod.z.string()).optional(),
+  createdAt: FirestoreTimestampSchema
+});
+zod.z.object({
+  /** at:// URI (or internal ref) identifying the post. */
+  uri: zod.z.string(),
+  cid: zod.z.string().optional(),
+  kind: zod.z.enum(["prompt", "reply"]),
+  author: ProfileViewBasicSchema,
+  record: PostRecordPublicSchema,
+  /** Hydrated audio embed (signed URL + lifted transcript). */
+  embed: AudioEmbedViewSchema.optional(),
+  viewer: ViewerStateSchema
+});
+
+// api-codecs.ts
+var CreateAudioPostRequestSchema = zod.z.object({
+  /** User-authored text; may be empty for pure-audio posts. */
+  text: zod.z.string().max(3e3).default(""),
+  /** Optional headline (prompt feature). */
+  title: zod.z.string().max(3e3).optional(),
+  /** The uploaded audio attachment. */
+  embed: AudioEmbedSchema.optional(),
+  /** Present ⇒ this is a reply (StrongRef root + parent). */
+  reply: ReplyRefSchema.optional(),
+  /** BCP-47 language tags. */
+  langs: zod.z.array(zod.z.string()).max(3).optional(),
+  /** Author self-label values (content warnings). */
+  selfLabels: zod.z.array(zod.z.string()).optional()
+}).refine((d) => !(d.reply && d.title), {
+  message: "Replies cannot have a title",
+  path: ["title"]
+}).refine((d) => d.text.trim().length > 0 || !!d.embed, {
+  message: "Post must have text or an audio embed",
+  path: ["text"]
+});
+var CreatePromptRequestSchema = zod.z.object({
+  // Bounds chosen so the public prompt hero never needs to clip: title +
+  // description sit between the two dots inside an h-dvh, overflow-hidden
+  // layout. 80/200 keeps typical content to a few lines on short phones.
+  // (Record-level schema stays unbounded so any pre-existing longer values
+  // still read cleanly — this only gates new writes.)
+  title: zod.z.string().min(3).max(80),
+  description: zod.z.string().max(200).optional(),
+  audioUrl: zod.z.string().url().or(zod.z.literal("")),
+  setAsGreeting: zod.z.union([zod.z.boolean(), zod.z.string().transform((val) => val === "true")]).optional(),
+  /** Explicit org context override (normally inferred from auth.currentOrg) */
+  orgId: zod.z.string().nullable().optional()
+});
+var UpdateProfileRequestSchema = zod.z.object({
+  handle: zod.z.string().min(3).max(20).regex(/^[a-zA-Z0-9_]+$/).optional(),
+  displayName: zod.z.string().max(50).optional(),
+  bio: zod.z.string().max(160).optional(),
+  avatarUrl: zod.z.string().url().nullable().optional(),
+  usageIntent: zod.z.string().max(200).nullable().optional(),
+  /**
+   * Personal website surfaced on the public profile. Accepts a URL, empty
+   * string, or null from the client; normalizes empty string → null so the
+   * value stored on `UserRecord` (which requires `.url() | null`) round-trips
+   * cleanly through `UserRecordSchema.parse` on subsequent reads.
+   */
+  website: zod.z.union([zod.z.string().url(), zod.z.literal(""), zod.z.null()]).optional().transform((v) => v === "" ? null : v),
+  /** Up to 5 public links (label + URL) shown under the bio. */
+  links: zod.z.array(zod.z.object({
+    label: zod.z.string().min(1).max(40),
+    url: zod.z.string().url()
+  })).max(5).optional(),
+  /** When true, surfaces the linked Bluesky identity on the public profile. */
+  showBlueskyPublicly: zod.z.boolean().optional()
+});
+var FcmTokenRequestSchema = zod.z.object({
+  // FCM registration tokens are typically ~163–200 chars; Google's docs
+  // don't publish a hard max but 4096 is a safe upper bound that prevents
+  // multi-MB payloads while accommodating any plausible FCM token format.
+  token: zod.z.string().min(1).max(4096)
+});
+var BadgeResetRequestSchema = zod.z.object({
+  type: zod.z.enum(["new_replier", "unread_reply"])
+});
+var CreateOrgRequestSchema = zod.z.object({
+  name: zod.z.string().min(3).max(50),
+  slug: zod.z.string().min(3).max(30).regex(/^[a-z0-9-]+$/),
+  avatarUrl: zod.z.string().url().optional(),
+  rssFeedUrl: zod.z.string().url().optional(),
+  websiteUrl: zod.z.string().url().optional(),
+  // 500 chars — enough for a multi-sentence blurb, prevents multi-MB writes.
+  description: zod.z.string().max(500).optional()
+});
+var UpdateOrgRequestSchema = zod.z.object({
+  name: zod.z.string().min(3).max(50).optional(),
+  slug: zod.z.string().min(3).max(30).regex(/^[a-z0-9-]+$/).optional(),
+  // 500 chars — matches CreateOrgRequestSchema.description.
+  description: zod.z.string().max(500).optional(),
+  avatarUrl: zod.z.string().url().nullable().optional(),
+  rssFeedUrl: zod.z.string().url().nullable().optional(),
+  websiteUrl: zod.z.string().url().nullable().optional(),
+  billingEmail: zod.z.string().email().nullable().optional(),
+  // 253 chars — the DNS spec maximum for a fully-qualified domain name.
+  domain: zod.z.string().max(253).nullable().optional()
+});
+var CreateOrgInviteRequestSchema = zod.z.object({
+  email: zod.z.string().email(),
+  role: zod.z.enum(["admin", "member"])
+});
+var UpdateMemberRoleRequestSchema = zod.z.object({
+  role: zod.z.enum(["admin", "member"])
+});
+var SwitchOrgRequestSchema = zod.z.object({
+  /** orgId to switch to, or null to switch to personal context */
+  orgId: zod.z.string().nullable()
+});
+var ConnectorConfigInputSchema = ConnectorConfigRecordSchema.omit({
+  connectorType: true,
+  ownerId: true,
+  status: true,
+  createdAt: true,
+  updatedAt: true
+});
+var ConnectorConfigUpdateSchema = ConnectorConfigInputSchema.partial();
+var PersonNotesUpdateSchema = zod.z.object({
+  notes: zod.z.string().max(1e4).optional(),
+  tags: zod.z.array(zod.z.string().max(64)).max(50).optional()
+});
+var PersonMergeRequestSchema = zod.z.object({
+  alternateUid: zod.z.string().min(1)
+});
+var ScreeningRuleInputSchema = zod.z.object({
+  e164: zod.z.string().regex(/^\+[1-9]\d{6,14}$/, "Must be an E.164 phone number"),
+  label: zod.z.string().max(120).nullable().optional(),
+  action: zod.z.enum(["allow", "screen"]),
+  expiresAt: zod.z.union([zod.z.string(), zod.z.number()]).nullable().optional().refine((v) => v == null || !Number.isNaN(new Date(v).getTime()), {
+    message: "Must be a valid ISO date string or epoch-ms timestamp"
+  })
+});
+var ScreeningRuleUpdateSchema = ScreeningRuleInputSchema.partial();
+var UpdateReplyStatusRequestSchema = zod.z.object({
+  status: zod.z.enum(["live", "archived", "deleted"])
+});
+var BulkReplyActionRequestSchema = zod.z.object({
+  replyIds: zod.z.array(zod.z.string()).min(1).max(100),
+  action: zod.z.enum(["markRead", "archive", "delete", "restore"])
+});
+
+exports.BadgeResetRequestSchema = BadgeResetRequestSchema;
+exports.BulkReplyActionRequestSchema = BulkReplyActionRequestSchema;
+exports.ConnectorConfigInputSchema = ConnectorConfigInputSchema;
+exports.ConnectorConfigUpdateSchema = ConnectorConfigUpdateSchema;
+exports.CreateAudioPostRequestSchema = CreateAudioPostRequestSchema;
+exports.CreateOrgInviteRequestSchema = CreateOrgInviteRequestSchema;
+exports.CreateOrgRequestSchema = CreateOrgRequestSchema;
+exports.CreatePromptRequestSchema = CreatePromptRequestSchema;
+exports.FcmTokenRequestSchema = FcmTokenRequestSchema;
+exports.PersonMergeRequestSchema = PersonMergeRequestSchema;
+exports.PersonNotesUpdateSchema = PersonNotesUpdateSchema;
+exports.ScreeningRuleInputSchema = ScreeningRuleInputSchema;
+exports.ScreeningRuleUpdateSchema = ScreeningRuleUpdateSchema;
+exports.SwitchOrgRequestSchema = SwitchOrgRequestSchema;
+exports.UpdateMemberRoleRequestSchema = UpdateMemberRoleRequestSchema;
+exports.UpdateOrgRequestSchema = UpdateOrgRequestSchema;
+exports.UpdateProfileRequestSchema = UpdateProfileRequestSchema;
+exports.UpdateReplyStatusRequestSchema = UpdateReplyStatusRequestSchema;