@antiphony/shared 0.5.0 → 0.6.0

package/dist/cjs/index.d.cts

@@ -1,314 +1,11 @@
 export { CreateAudioPostRequest, CreateAudioPostRequestSchema, PatchAudioPostRequest, PatchAudioPostRequestSchema } from './api-codecs.cjs';
 export { FirestoreTimestamp, FirestoreTimestampSchema } from './types/records.cjs';
 export { ActorProfileRecord, ActorProfileRecordSchema, AudioEmbed, AudioEmbedSchema, AudioEmbedView, AudioEmbedViewSchema, AudioPostRecord, AudioPostRecordSchema, AudioPostView, AudioPostViewSchema, PostRecordPublic, PostRecordPublicSchema, ReplyRef, ReplyRefSchema, StrongRef, StrongRefSchema, TimedTranscript, TimedTranscriptSchema, TranscriptEnrichmentRecord, TranscriptEnrichmentRecordSchema, TranscriptSegment, TranscriptSegmentSchema, ViewerState, ViewerStateSchema } from './types/audio.cjs';
-import { z } from 'zod';
+export { BYTE_MUTATING_STAGES, CanonicalAudioFields, DERIVED_STAGES, PROCESSING_STAGES, ProcessingRequest, ProcessingRequestSchema, ProcessingStage, ProcessingStageMap, ProcessingStageMapSchema, ProcessingStageSchema, ProcessingStageStatus, ProcessingStageStatusSchema, ProcessingState, ProcessingStateSchema, ProcessingView, ProcessingViewSchema, ResolvedProcessing, ResolvedProcessingSchema, resolveAudioVariant, toProcessingView } from './types/processing.cjs';
 export { BlobRef, BlobRefSchema } from './types/blob.cjs';
-export { COLLECTIONS, EMBED_NSID, NSID, NsidValue, StoredNsidValue } from './nsid.cjs';
+export { httpsUrl } from './types/url.cjs';
+export { COLLECTIONS, EMBED_NSID, NSID, NsidValue, StoredNsidValue, XRPC_NSID, XrpcNsidValue } from './nsid.cjs';
 export { ConflictError, ForbiddenError, NotFoundError, RateLimitError, ServiceError, UnauthorizedError, ValidationError } from './errors/index.cjs';
 export { isFirestoreTimestamp } from './utils/index.cjs';
 export { ReportedErrorEvent, buildReportedErrorEvent, reportError } from './observability/report-error.cjs';
-
-/**
- * Audio hygiene / enrichment processing (B5).
- *
- * Antiphony can, when the calling app opts in, run audio processing on a
- * post's audio. Four stages, classified on two axes (see
- * `specs/enrichment-pipeline.md`):
- *
- *  - **Byte-mutating** (`denoise`, `trim`) produce new audio. They compose in
- *    order into a SINGLE processed variant — trimmed-and-denoised audio is one
- *    artifact, not two — addressed by `processedBlobCid`.
- *  - **Derived** (`transcribe`, `waveform`) are pure analysis over the final
- *    variant and modify no audio. Because they are a function of the variant,
- *    recomputation is always the correct response to their input changing.
- *
- * Every stage is OFF by default — the app asks for them per post via
- * `CreateAudioPostRequest.processing`, or after the fact via the `processing`
- * opt-in on `PATCH /api/v1/posts/{postId}`.
- *
- * The work runs asynchronously (outside the create request), so a post
- * carries a mutable `processing` state that starts `pending` and settles to
- * `ready`/`failed`/`skipped` per stage. That state is a storage-layer field —
- * it is NOT part of the canonical lexicon record and never enters the record
- * CID (like `kind` and `threadParticipants`), so processing can update it
- * without changing the post's content address.
- *
- * That immutability is why stage OUTPUT lives here rather than on the embed:
- * `embed.audio.ref.$link`, `embed.durationMs`, and `embed.waveform` are inside
- * the CID and can never be rewritten. The read-time view resolves per field
- * between the record's canonical values and the variant values below.
- */
-/**
- * Per-stage status.
- *  - `pending`  — requested, not yet done (the worker acts on these).
- *  - `ready`    — completed.
- *  - `failed`   — attempted and errored.
- *  - `skipped`  — requested but this deployment has no provider for it.
- *
- * A stage returning to `pending` after having been `ready` is NORMAL, not a
- * regression: a byte-mutating stage completing invalidates derived artifacts,
- * which are then recomputed. Clients treat any `pending` stage as "still
- * working", which already covers this.
- */
-declare const ProcessingStageStatusSchema: z.ZodEnum<["pending", "ready", "failed", "skipped"]>;
-type ProcessingStageStatus = z.infer<typeof ProcessingStageStatusSchema>;
-/**
- * The stage names, in the order a multi-stage request runs them:
- * denoise → trim → (transcribe, waveform).
- *
- * All byte-mutating stages run first; the two derived stages then consume the
- * final variant and are mutually independent. Denoise precedes trim
- * deliberately — silence detection keys off a noise floor, so on noisy input
- * the "silence" is not actually quiet and trim under-cuts.
- */
-declare const PROCESSING_STAGES: readonly ["denoise", "trim", "transcribe", "waveform"];
-declare const ProcessingStageSchema: z.ZodEnum<["denoise", "trim", "transcribe", "waveform"]>;
-type ProcessingStage = z.infer<typeof ProcessingStageSchema>;
-/** Stages that produce new audio bytes, composing into one processed variant. */
-declare const BYTE_MUTATING_STAGES: readonly ["denoise", "trim"];
-/** Stages that are pure analysis over the final variant, modifying no audio. */
-declare const DERIVED_STAGES: readonly ["transcribe", "waveform"];
-/**
- * What the calling app opts into, on `CreateAudioPostRequest`. All default
- * off; only `true` values request a stage.
- */
-declare const ProcessingRequestSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodBoolean>;
-    denoise: z.ZodOptional<z.ZodBoolean>;
-    trim: z.ZodOptional<z.ZodBoolean>;
-    waveform: z.ZodOptional<z.ZodBoolean>;
-    /**
-     * Whether a completed byte-mutating stage should invalidate and recompute
-     * the derived artifacts that describe the old audio. Defaults to **true**
-     * — a transcript of superseded audio is wrong, not merely stale.
-     *
-     * `false` opts out, for an app that would rather keep the existing
-     * transcript than pay to regenerate it. It does NOT name a stage, so a
-     * request carrying only `reprocess` requests no work.
-     */
-    reprocess: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    denoise?: boolean | undefined;
-    trim?: boolean | undefined;
-    transcribe?: boolean | undefined;
-    waveform?: boolean | undefined;
-    reprocess?: boolean | undefined;
-}, {
-    denoise?: boolean | undefined;
-    trim?: boolean | undefined;
-    transcribe?: boolean | undefined;
-    waveform?: boolean | undefined;
-    reprocess?: boolean | undefined;
-}>;
-type ProcessingRequest = z.infer<typeof ProcessingRequestSchema>;
-/**
- * Per-stage status across all stages — the shape shared by the stored state,
- * the hydrated view, and the resolved-initial-state handoff between the route
- * and the service. A key is present iff that stage was requested.
- */
-declare const ProcessingStageMapSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-}, "strip", z.ZodTypeAny, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}>;
-type ProcessingStageMap = z.infer<typeof ProcessingStageMapSchema>;
-/**
- * An opt-in request resolved against a deployment's capabilities: the initial
- * per-stage state plus the settings the async worker needs to honour it.
- *
- * `reprocess` is carried here — and persisted — rather than passed to the
- * worker as an argument, because the request that asks for the work and the
- * pass that performs it are separated by a queue (step 8). Written on every
- * request including the default, because the stored state is MERGED onto —
- * absent means true only for posts written before this field existed.
- */
-declare const ResolvedProcessingSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-} & {
-    reprocess: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    reprocess?: boolean | undefined;
-}, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    reprocess?: boolean | undefined;
-}>;
-type ResolvedProcessing = z.infer<typeof ResolvedProcessingSchema>;
-/**
- * Stored processing state on the post record (storage-layer; not in the CID):
- * the per-stage statuses plus the output of the stages themselves.
- *
- * The variant fields below all exist for the same reason — their canonical
- * counterparts live inside the record CID and cannot be updated:
- *
- *  - `processedBlobCid` ↔ `embed.audio.ref.$link`
- *  - `processedMimeType` ↔ `embed.audio.mimeType` (providers may transcode)
- *  - `processedDurationMs` ↔ `embed.durationMs` (trim changes duration)
- *  - `waveformPeaks` ↔ `embed.waveform` (the client's peaks describe the original)
- */
-declare const ProcessingStateSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-} & {
-    reprocess: z.ZodOptional<z.ZodBoolean>;
-} & {
-    /**
-     * Content CID of the processed audio variant — the composed output of every
-     * byte-mutating stage that has completed. The record's own
-     * `embed.audio.ref.$link` stays the ORIGINAL CID (immutable content
-     * address); only the read-time view swaps playback to this variant.
-     */
-    processedBlobCid: z.ZodOptional<z.ZodString>;
-    /**
-     * MIME type of the processed variant. Present because providers may
-     * TRANSCODE — the ElevenLabs Voice Isolator returns MP3 regardless of what
-     * it is given — so the variant's type cannot be assumed to match
-     * `embed.audio.mimeType`. Anything reading the variant's bytes must use
-     * this, not the embed's.
-     */
-    processedMimeType: z.ZodOptional<z.ZodString>;
-    /**
-     * Duration of the processed variant, when a byte-mutating stage changed it
-     * (i.e. trim). Absent when the variant's duration matches the original.
-     */
-    processedDurationMs: z.ZodOptional<z.ZodNumber>;
-    /**
-     * Peaks for the processed variant, once the `waveform` stage completes.
-     * Same normalization and bounds as `embed.waveform` (0–100, max 1000), so
-     * a view can never carry a larger payload than the record allows.
-     */
-    waveformPeaks: z.ZodOptional<z.ZodArray<z.ZodNumber, "many">>;
-    /**
-     * When the current runner's exclusive claim on this post expires.
-     *
-     * Queue delivery is at-least-once, so the same job can arrive twice and
-     * run CONCURRENTLY. `process()` is idempotent under sequential retry — it
-     * acts on `pending` and re-does nothing already settled — but two passes
-     * interleaved is a different failure: both read the same `pending` state,
-     * both bill the provider for the same stage, and both write
-     * `processedBlobCid`, so the surviving variant is whichever finished last
-     * and the other's blob is orphaned.
-     *
-     * A runner claims this field transactionally before doing any work and
-     * clears it when finished; a second runner finding it unexpired declines
-     * and returns. It is an EXPIRY, not a boolean lock, because the holder can
-     * die mid-run (instance recycled, process killed) with no chance to
-     * release — a plain flag would strand the post permanently, where a lapsed
-     * lease lets the next delivery pick it up.
-     *
-     * Internal, like the variant fields above: `toProcessingView` projects
-     * stages only, so this never reaches a client.
-     */
-    leaseUntil: z.ZodOptional<z.ZodEffects<z.ZodUnion<[z.ZodType<unknown, z.ZodTypeDef, unknown>, z.ZodString, z.ZodNumber, z.ZodDate]>, Date, unknown>>;
-    updatedAt: z.ZodEffects<z.ZodUnion<[z.ZodType<unknown, z.ZodTypeDef, unknown>, z.ZodString, z.ZodNumber, z.ZodDate]>, Date, unknown>;
-}, "strip", z.ZodTypeAny, {
-    updatedAt: Date;
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    reprocess?: boolean | undefined;
-    processedBlobCid?: string | undefined;
-    processedMimeType?: string | undefined;
-    processedDurationMs?: number | undefined;
-    waveformPeaks?: number[] | undefined;
-    leaseUntil?: Date | undefined;
-}, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    reprocess?: boolean | undefined;
-    processedBlobCid?: string | undefined;
-    processedMimeType?: string | undefined;
-    processedDurationMs?: number | undefined;
-    waveformPeaks?: number[] | undefined;
-    leaseUntil?: unknown;
-    updatedAt?: unknown;
-}>;
-type ProcessingState = z.infer<typeof ProcessingStateSchema>;
-/**
- * The processing status surfaced on the hydrated view — the per-stage status
- * only (no internal storage fields: variant CID, duration, peaks, timestamps).
- * Absent when no processing was requested.
- */
-declare const ProcessingViewSchema: z.ZodObject<{
-    transcribe: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    denoise: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-    waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
-}, "strip", z.ZodTypeAny, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}, {
-    denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
-}>;
-type ProcessingView = z.infer<typeof ProcessingViewSchema>;
-/**
- * Project the stored state onto the view — drops every internal field.
- *
- * Derived from `PROCESSING_STAGES` rather than listing the stages by hand, so
- * a stage added to the set cannot be silently omitted from the view (which
- * would leave clients unable to tell "not requested" from "in progress").
- */
-declare function toProcessingView(state: ProcessingState): ProcessingView;
-/** The record's own audio fields — canonical, inside the CID, never rewritten. */
-interface CanonicalAudioFields {
-    blobCid: string;
-    durationMs?: number;
-    waveform?: number[];
-}
-/**
- * Resolve the audio fields a reader should see: canonical from the record,
- * variant from `ProcessingState` wherever processing has superseded it.
- *
- * The three fields have to move together. Peaks are rendered ACROSS a duration
- * and a duration describes a specific set of bytes, so serving a processed URL
- * beside the original duration puts a scrubber out of alignment with the audio
- * under it — the failure this function exists to prevent.
- *
- * Resolution is not a uniform `??` per field, because the state's fields do not
- * all mean the same thing when absent:
- *
- *  - `processedDurationMs` absent is DEFINED as "the variant's duration equals
- *    the original" (denoise transcodes without retiming), so falling back to
- *    the record there is correct, not a guess.
- *  - `waveformPeaks` carries no such guarantee. Recompute marks the stage
- *    `pending` without clearing the field, so between a variant change and the
- *    recomputed peaks landing it holds peaks for the SUPERSEDED variant. Hence
- *    the status gate rather than a presence check.
- *
- * Peaks do not key off `processedBlobCid`: `waveform` always runs over the
- * final variant, so when it is `ready` its peaks describe whatever playback
- * resolves to here, variant or original alike.
- */
-declare function resolveAudioVariant(canonical: CanonicalAudioFields, state: ProcessingState | undefined): CanonicalAudioFields;
-
-export { BYTE_MUTATING_STAGES, type CanonicalAudioFields, DERIVED_STAGES, PROCESSING_STAGES, type ProcessingRequest, ProcessingRequestSchema, type ProcessingStage, type ProcessingStageMap, ProcessingStageMapSchema, ProcessingStageSchema, type ProcessingStageStatus, ProcessingStageStatusSchema, type ProcessingState, ProcessingStateSchema, type ProcessingView, ProcessingViewSchema, type ResolvedProcessing, ResolvedProcessingSchema, resolveAudioVariant, toProcessingView };
+import 'zod';

package/dist/cjs/nsid.cjs

@@ -16,6 +16,15 @@ var EMBED_NSID = {
   Audio: "dev.antiphony.embed.audio",
   RecordWithAudio: "dev.antiphony.embed.recordWithAudio"
 };
+var XRPC_NSID = {
+  // Queries (GET).
+  GetPost: "dev.antiphony.audio.getPost",
+  GetThread: "dev.antiphony.audio.getThread",
+  GetPlaybackUrl: "dev.antiphony.audio.getPlaybackUrl",
+  // Procedures (POST).
+  CreatePost: "dev.antiphony.audio.createPost",
+  ReprocessPost: "dev.antiphony.audio.reprocessPost"
+};
 var COLLECTIONS = {
   // One post collection + the transcript enrichment namespace.
   [NSID.AudioPost]: "posts",
@@ -25,3 +34,4 @@ var COLLECTIONS = {
 exports.COLLECTIONS = COLLECTIONS;
 exports.EMBED_NSID = EMBED_NSID;
 exports.NSID = NSID;
+exports.XRPC_NSID = XRPC_NSID;

package/dist/cjs/nsid.d.cts

@@ -23,6 +23,30 @@ declare const EMBED_NSID: {
     readonly Audio: "dev.antiphony.embed.audio";
     readonly RecordWithAudio: "dev.antiphony.embed.recordWithAudio";
 };
+/**
+ * XRPC method NSIDs — the `/xrpc/<nsid>` surface (see
+ * specs/xrpc-and-atproto-lex-strategy.md).
+ *
+ * These are **siblings** of the record NSIDs in `NSID`, not children of them.
+ * A method shares the authority segment (`dev.antiphony.audio`) with the record
+ * but never nests under the record's own name: the record is
+ * `dev.antiphony.audio.post` and the query that fetches it is
+ * `dev.antiphony.audio.getPost`. Deriving one by appending to the other
+ * produces `dev.antiphony.audio.post.getPost`, a different and undefined
+ * namespace — hence a separate map rather than a helper over `NSID`.
+ *
+ * Queries are `GET`, procedures are `POST`; the grouping below follows that
+ * split because it is also the auth split (procedures always require an acting
+ * actor, queries may be viewer-less).
+ */
+declare const XRPC_NSID: {
+    readonly GetPost: "dev.antiphony.audio.getPost";
+    readonly GetThread: "dev.antiphony.audio.getThread";
+    readonly GetPlaybackUrl: "dev.antiphony.audio.getPlaybackUrl";
+    readonly CreatePost: "dev.antiphony.audio.createPost";
+    readonly ReprocessPost: "dev.antiphony.audio.reprocessPost";
+};
+type XrpcNsidValue = typeof XRPC_NSID[keyof typeof XRPC_NSID];
 /**
  * Maps the STORED AT Protocol record-type NSIDs to Firestore collection
  * names. When migrating to a PDS, this mapping becomes the adapter layer.
@@ -30,4 +54,4 @@ declare const EMBED_NSID: {
  */
 declare const COLLECTIONS: Record<StoredNsidValue, string>;
 
-export { COLLECTIONS, EMBED_NSID, NSID, type NsidValue, type StoredNsidValue };
+export { COLLECTIONS, EMBED_NSID, NSID, type NsidValue, type StoredNsidValue, XRPC_NSID, type XrpcNsidValue };

package/dist/cjs/types/audio.cjs

@@ -94,6 +94,30 @@ var ProcessingStateSchema = ResolvedProcessingSchema.extend({
    * (i.e. trim). Absent when the variant's duration matches the original.
    */
   processedDurationMs: zod.z.number().int().min(0).optional(),
+  /**
+   * Which denoiser produced the variant's denoise contribution — provenance,
+   * the counterpart to a transcript record's `model`.
+   *
+   * Lives here because a cleaned variant, unlike a transcript, has no record
+   * of its own to carry it: it is a blob CID on this state. Without it,
+   * changing denoisers leaves no way to tell which variants predate the
+   * switch, so nothing can identify what to re-run.
+   *
+   * Named for the STAGE, not the variant (`processedModel`), because it
+   * describes one link of the byte-mutating chain rather than the composed
+   * artifact. Trim contributes to the same variant and has no model, and a
+   * later external link would want its own field rather than to overwrite
+   * this one.
+   *
+   * Written on every successful denoise, never cleared — it moves with
+   * `processedBlobCid`, which is only ever set, never reset. A denoise that
+   * FAILS leaves both alone, which is correct: the variant still holds the
+   * previous denoiser's output, so the previous model still describes it.
+   *
+   * Internal, like the other variant fields — `toProcessingView` projects
+   * stages only, so this never reaches a client.
+   */
+  denoiseModel: zod.z.string().optional(),
   /**
    * Peaks for the processed variant, once the `waveform` stage completes.
    * Same normalization and bounds as `embed.waveform` (0–100, max 1000), so
@@ -125,11 +149,14 @@ var ProcessingStateSchema = ResolvedProcessingSchema.extend({
   updatedAt: FirestoreTimestampSchema
 });
 var ProcessingViewSchema = ProcessingStageMapSchema;
+function httpsUrl() {
+  return zod.z.string().trim().url().regex(/^https?:\/\//i, { message: "URL must use the http or https scheme" });
+}
 
 // types/audio.ts
 var StrongRefSchema = zod.z.object({
-  uri: zod.z.string().regex(/^at:\/\/.+/, "Must be an at:// URI"),
-  cid: zod.z.string()
+  uri: zod.z.string().regex(/^at:\/\/.+/, "Must be an at:// URI").max(512),
+  cid: zod.z.string().max(128)
 });
 var ReplyRefSchema = zod.z.object({
   root: StrongRefSchema,
@@ -171,8 +198,13 @@ var AudioEmbedViewSchema = zod.z.object({
    * it to change (trim removes leading/trailing silence), and should render
    * these three as a set rather than caching them independently. The record's
    * originals are immutable and unaffected; this is a read-time resolution.
+   *
+   * Restricted to `http:`/`https:` (`httpsUrl()`), not any URL `new URL()`
+   * will parse. This is the value clients hand to `<audio src>`, so a
+   * `javascript:` or `data:` URL reaching one is stored XSS — and a bare
+   * `.url()` accepts both. See `types/url.ts`.
    */
-  url: zod.z.string().url(),
+  url: httpsUrl(),
   durationMs: zod.z.number().int().min(0).optional(),
   // `alt` is copied from the stored embed; keep the same bounds so a view can
   // never carry a larger payload than the record allows.
@@ -276,7 +308,13 @@ var TranscriptEnrichmentRecordSchema = zod.z.object({
 var ActorProfileRecordSchema = zod.z.object({
   handle: zod.z.string().min(3).max(20).optional(),
   usageIntent: zod.z.string().max(100).optional(),
-  rssFeed: zod.z.string().url().optional()
+  /**
+   * Feed URL, restricted to `http:`/`https:` for the same reason
+   * `AudioEmbedView.url` is: an app renders this as an `<a href>`, and a bare
+   * `.url()` would let a `javascript:` URL through. A feed is a fetchable web
+   * document, so no legitimate value loses anything to the restriction.
+   */
+  rssFeed: httpsUrl().optional()
 });
 var ViewerStateSchema = zod.z.object({
   /** True when the authenticated caller authored this post. */
@@ -291,10 +329,15 @@ var ViewerStateSchema = zod.z.object({
   replyDisabledReason: zod.z.enum(["unauthenticated", "not_a_participant"]).optional()
 });
 var PostRecordPublicSchema = zod.z.object({
-  text: zod.z.string(),
-  title: zod.z.string().optional(),
+  // `text`, `title` and `langs` keep the record's bounds, for the same reason
+  // `AudioEmbedViewSchema.alt` does: a view must never be able to carry a
+  // larger payload than the record it projects. The write path already
+  // enforces these, so no stored post can exceed them — stating them here
+  // keeps the published contract honest rather than adding a new constraint.
+  text: zod.z.string().max(3e3),
+  title: zod.z.string().max(3e3).optional(),
   reply: ReplyRefSchema.optional(),
-  langs: zod.z.array(zod.z.string()).optional(),
+  langs: zod.z.array(zod.z.string()).max(3).optional(),
   selfLabels: zod.z.array(zod.z.string()).optional(),
   createdAt: FirestoreTimestampSchema
 });