@antiphony/shared 0.5.1 → 0.6.0

package/dist/cjs/types/processing.d.cts

@@ -80,16 +80,16 @@ declare const ProcessingRequestSchema: z.ZodObject<{
      */
     reprocess: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
+    waveform?: boolean | undefined;
+    transcribe?: boolean | undefined;
     denoise?: boolean | undefined;
     trim?: boolean | undefined;
-    transcribe?: boolean | undefined;
-    waveform?: boolean | undefined;
     reprocess?: boolean | undefined;
 }, {
+    waveform?: boolean | undefined;
+    transcribe?: boolean | undefined;
     denoise?: boolean | undefined;
     trim?: boolean | undefined;
-    transcribe?: boolean | undefined;
-    waveform?: boolean | undefined;
     reprocess?: boolean | undefined;
 }>;
 type ProcessingRequest = z.infer<typeof ProcessingRequestSchema>;
@@ -104,15 +104,15 @@ declare const ProcessingStageMapSchema: z.ZodObject<{
     trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
     waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
 }, "strip", z.ZodTypeAny, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
 }, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
 }>;
 type ProcessingStageMap = z.infer<typeof ProcessingStageMapSchema>;
 /**
@@ -133,16 +133,16 @@ declare const ResolvedProcessingSchema: z.ZodObject<{
 } & {
     reprocess: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
     reprocess?: boolean | undefined;
 }, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
     reprocess?: boolean | undefined;
 }>;
 type ResolvedProcessing = z.infer<typeof ResolvedProcessingSchema>;
@@ -245,10 +245,10 @@ declare const ProcessingStateSchema: z.ZodObject<{
     updatedAt: z.ZodEffects<z.ZodUnion<[z.ZodType<unknown, z.ZodTypeDef, unknown>, z.ZodString, z.ZodNumber, z.ZodDate]>, Date, unknown>;
 }, "strip", z.ZodTypeAny, {
     updatedAt: Date;
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
     reprocess?: boolean | undefined;
     processedBlobCid?: string | undefined;
     processedMimeType?: string | undefined;
@@ -257,10 +257,10 @@ declare const ProcessingStateSchema: z.ZodObject<{
     waveformPeaks?: number[] | undefined;
     leaseUntil?: Date | undefined;
 }, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
     reprocess?: boolean | undefined;
     processedBlobCid?: string | undefined;
     processedMimeType?: string | undefined;
@@ -282,15 +282,15 @@ declare const ProcessingViewSchema: z.ZodObject<{
     trim: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
     waveform: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "skipped"]>>;
 }, "strip", z.ZodTypeAny, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
 }, {
+    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
+    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
     denoise?: "pending" | "ready" | "failed" | "skipped" | undefined;
     trim?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    transcribe?: "pending" | "ready" | "failed" | "skipped" | undefined;
-    waveform?: "pending" | "ready" | "failed" | "skipped" | undefined;
 }>;
 type ProcessingView = z.infer<typeof ProcessingViewSchema>;
 /**

package/dist/cjs/types/url.cjs

@@ -0,0 +1,10 @@
+'use strict';
+
+var zod = require('zod');
+
+// types/url.ts
+function httpsUrl() {
+  return zod.z.string().trim().url().regex(/^https?:\/\//i, { message: "URL must use the http or https scheme" });
+}
+
+exports.httpsUrl = httpsUrl;

package/dist/cjs/types/url.d.cts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+
+/**
+ * Scheme-restricted URL schema: an absolute `http:`/`https:` URL, trimmed.
+ *
+ * ## Why this exists
+ *
+ * `z.string().url()` is `new URL()` under the hood, and `new URL()` accepts
+ * ANY scheme. All of these parse clean through a bare `.url()`:
+ *
+ *     javascript:alert(1)
+ *     data:text/html,<script>alert(1)</script>
+ *     file:///etc/passwd
+ *     vbscript:msgbox(1)
+ *     blob:https://evil.example/x
+ *
+ * That is harmless for a value nobody dereferences and dangerous for one that
+ * clients do. `AudioEmbedView.url` is the field a player puts in `<audio src>`;
+ * `ActorProfileRecord.rssFeed` is the field an app renders as `<a href>`. A URL
+ * that reaches either of those unchecked is a stored-XSS shape — written once,
+ * fired for every viewer afterwards.
+ *
+ * So every URL field in this contract goes through this helper, and none of
+ * them uses a bare `.url()`. The `antiphony/no-bare-zod-url` ESLint rule
+ * enforces that, because "remember to use the helper" is not a control.
+ *
+ * ## Why `http:` is allowed, despite the name
+ *
+ * The name says https because https is what a deployment should serve; the rule
+ * admits `http:` because a self-hosted or local Antiphony is reached at
+ * `http://localhost:8787`, and `AudioEmbedView.url` is built from exactly that
+ * base (`ANTIPHONY_PUBLIC_BASE_URL`). Excluding plain http would make the
+ * contract unparseable in development for no safety gained: what this closes is
+ * scheme confusion, not transport confidentiality. Transport is a deployment
+ * concern, and the deployment that matters is https already.
+ *
+ * ## Why a string check and not a `.refine()`
+ *
+ * Two reasons, both practical:
+ *
+ *  - **It stays a `ZodString`.** A `.refine()` wraps the schema in `ZodEffects`,
+ *    which costs consumers `.extend()`-friendliness and makes the OpenAPI
+ *    generator emit a weaker schema. As a plain string check the constraint
+ *    survives into `openapi.json` as a `pattern`, so a consumer in another
+ *    language reads the rule instead of having to already know it.
+ *  - **It is checked against the raw string, not a parsed `protocol`.** HTML
+ *    strips tabs and newlines out of URL attributes before dereferencing them,
+ *    so a scheme split by a tab is a live `javascript:` URL in a browser — and
+ *    one `new URL()` parses happily. Requiring the string to LITERALLY begin
+ *    `http://` or `https://` rejects that whole family without enumerating it.
+ *
+ * `.trim()` runs first so surrounding whitespace is normalised away rather than
+ * sneaking a scheme past the anchor. It is a normalisation, not a loosening:
+ * bare `.url()` accepted padded input too, it just kept the padding.
+ *
+ * One fidelity note on that generated `pattern`: JSON Schema has no way to
+ * express a case-insensitive regex, so `openapi.json` documents
+ * `^https?:\/\/` without the `i` flag. `HTTPS://x` therefore passes here and
+ * fails a strict reading of the document. Real URLs carry a lowercase scheme,
+ * and the alternative — dropping `i` — would reject input for cosmetics, so the
+ * runtime stays the more permissive of the two on that one axis.
+ *
+ * Usage:
+ *
+ *     url:     httpsUrl()
+ *     rssFeed: httpsUrl().optional()
+ */
+declare function httpsUrl(): z.ZodString;
+
+export { httpsUrl };

package/dist/esm/api-codecs.js

@@ -1,6 +1,7 @@
-export { CreateAudioPostRequestSchema, PatchAudioPostRequestSchema } from './chunk-UYCXRNTK.js';
-import './chunk-J2HE6PE2.js';
+export { CreateAudioPostRequestSchema, PatchAudioPostRequestSchema } from './chunk-6EJLU4LG.js';
+import './chunk-QQ5GOLYW.js';
+import './chunk-SMK4OZNU.js';
 import './chunk-AKIWUNNK.js';
 import './chunk-D655OH2I.js';
-import './chunk-SMK4OZNU.js';
+import './chunk-KMQWUFMV.js';
 import './chunk-5JBD5THX.js';

package/dist/esm/{chunk-UYCXRNTK.js → chunk-6EJLU4LG.js}

@@ -1,4 +1,4 @@
-import { ReplyRefSchema, AudioEmbedSchema } from './chunk-J2HE6PE2.js';
+import { ReplyRefSchema, AudioEmbedSchema } from './chunk-QQ5GOLYW.js';
 import { ProcessingRequestSchema } from './chunk-AKIWUNNK.js';
 import { z } from 'zod';
 
@@ -12,9 +12,9 @@ var CreateAudioPostRequestSchema = z.object({
   /** Present ⇒ this is a reply (StrongRef root + parent). */
   reply: ReplyRefSchema.optional(),
   /** BCP-47 language tags. */
-  langs: z.array(z.string()).max(3).optional(),
+  langs: z.array(z.string().max(35)).max(3).optional(),
   /** Author self-label values (content warnings). */
-  selfLabels: z.array(z.string()).optional(),
+  selfLabels: z.array(z.string().max(128)).max(10).optional(),
   /**
    * Opt-in audio processing for this post's audio (denoise / trim /
    * transcribe / waveform). All default off. Stages the deployment can't

package/dist/esm/chunk-KMQWUFMV.js

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+
+// types/url.ts
+function httpsUrl() {
+  return z.string().trim().url().regex(/^https?:\/\//i, { message: "URL must use the http or https scheme" });
+}
+
+export { httpsUrl };

package/dist/esm/{chunk-J2HE6PE2.js → chunk-QQ5GOLYW.js}

@@ -1,11 +1,12 @@
+import { BlobRefSchema } from './chunk-SMK4OZNU.js';
 import { ProcessingViewSchema, ProcessingStateSchema } from './chunk-AKIWUNNK.js';
 import { FirestoreTimestampSchema } from './chunk-D655OH2I.js';
-import { BlobRefSchema } from './chunk-SMK4OZNU.js';
+import { httpsUrl } from './chunk-KMQWUFMV.js';
 import { z } from 'zod';
 
 var StrongRefSchema = z.object({
-  uri: z.string().regex(/^at:\/\/.+/, "Must be an at:// URI"),
-  cid: z.string()
+  uri: z.string().regex(/^at:\/\/.+/, "Must be an at:// URI").max(512),
+  cid: z.string().max(128)
 });
 var ReplyRefSchema = z.object({
   root: StrongRefSchema,
@@ -47,8 +48,13 @@ var AudioEmbedViewSchema = z.object({
    * it to change (trim removes leading/trailing silence), and should render
    * these three as a set rather than caching them independently. The record's
    * originals are immutable and unaffected; this is a read-time resolution.
+   *
+   * Restricted to `http:`/`https:` (`httpsUrl()`), not any URL `new URL()`
+   * will parse. This is the value clients hand to `<audio src>`, so a
+   * `javascript:` or `data:` URL reaching one is stored XSS — and a bare
+   * `.url()` accepts both. See `types/url.ts`.
    */
-  url: z.string().url(),
+  url: httpsUrl(),
   durationMs: z.number().int().min(0).optional(),
   // `alt` is copied from the stored embed; keep the same bounds so a view can
   // never carry a larger payload than the record allows.
@@ -152,7 +158,13 @@ var TranscriptEnrichmentRecordSchema = z.object({
 var ActorProfileRecordSchema = z.object({
   handle: z.string().min(3).max(20).optional(),
   usageIntent: z.string().max(100).optional(),
-  rssFeed: z.string().url().optional()
+  /**
+   * Feed URL, restricted to `http:`/`https:` for the same reason
+   * `AudioEmbedView.url` is: an app renders this as an `<a href>`, and a bare
+   * `.url()` would let a `javascript:` URL through. A feed is a fetchable web
+   * document, so no legitimate value loses anything to the restriction.
+   */
+  rssFeed: httpsUrl().optional()
 });
 var ViewerStateSchema = z.object({
   /** True when the authenticated caller authored this post. */

package/dist/esm/index.d.ts

@@ -3,6 +3,7 @@ export { FirestoreTimestamp, FirestoreTimestampSchema } from './types/records.js
 export { ActorProfileRecord, ActorProfileRecordSchema, AudioEmbed, AudioEmbedSchema, AudioEmbedView, AudioEmbedViewSchema, AudioPostRecord, AudioPostRecordSchema, AudioPostView, AudioPostViewSchema, PostRecordPublic, PostRecordPublicSchema, ReplyRef, ReplyRefSchema, StrongRef, StrongRefSchema, TimedTranscript, TimedTranscriptSchema, TranscriptEnrichmentRecord, TranscriptEnrichmentRecordSchema, TranscriptSegment, TranscriptSegmentSchema, ViewerState, ViewerStateSchema } from './types/audio.js';
 export { BYTE_MUTATING_STAGES, CanonicalAudioFields, DERIVED_STAGES, PROCESSING_STAGES, ProcessingRequest, ProcessingRequestSchema, ProcessingStage, ProcessingStageMap, ProcessingStageMapSchema, ProcessingStageSchema, ProcessingStageStatus, ProcessingStageStatusSchema, ProcessingState, ProcessingStateSchema, ProcessingView, ProcessingViewSchema, ResolvedProcessing, ResolvedProcessingSchema, resolveAudioVariant, toProcessingView } from './types/processing.js';
 export { BlobRef, BlobRefSchema } from './types/blob.js';
+export { httpsUrl } from './types/url.js';
 export { COLLECTIONS, EMBED_NSID, NSID, NsidValue, StoredNsidValue, XRPC_NSID, XrpcNsidValue } from './nsid.js';
 export { ConflictError, ForbiddenError, NotFoundError, RateLimitError, ServiceError, UnauthorizedError, ValidationError } from './errors/index.js';
 export { isFirestoreTimestamp } from './utils/index.js';

package/dist/esm/index.js

@@ -1,11 +1,12 @@
-export { isFirestoreTimestamp } from './chunk-24KIXQZK.js';
-export { CreateAudioPostRequestSchema, PatchAudioPostRequestSchema } from './chunk-UYCXRNTK.js';
+export { CreateAudioPostRequestSchema, PatchAudioPostRequestSchema } from './chunk-6EJLU4LG.js';
 export { COLLECTIONS, EMBED_NSID, NSID, XRPC_NSID } from './chunk-F5RKN3GY.js';
 export { ConflictError, ForbiddenError, NotFoundError, RateLimitError, ServiceError, UnauthorizedError, ValidationError } from './chunk-7LW2FHLD.js';
 import './chunk-72G3LBUQ.js';
 export { buildReportedErrorEvent, reportError } from './chunk-BNNLHRH7.js';
-export { ActorProfileRecordSchema, AudioEmbedSchema, AudioEmbedViewSchema, AudioPostRecordSchema, AudioPostViewSchema, PostRecordPublicSchema, ReplyRefSchema, StrongRefSchema, TimedTranscriptSchema, TranscriptEnrichmentRecordSchema, TranscriptSegmentSchema, ViewerStateSchema } from './chunk-J2HE6PE2.js';
+export { isFirestoreTimestamp } from './chunk-24KIXQZK.js';
+export { ActorProfileRecordSchema, AudioEmbedSchema, AudioEmbedViewSchema, AudioPostRecordSchema, AudioPostViewSchema, PostRecordPublicSchema, ReplyRefSchema, StrongRefSchema, TimedTranscriptSchema, TranscriptEnrichmentRecordSchema, TranscriptSegmentSchema, ViewerStateSchema } from './chunk-QQ5GOLYW.js';
+export { BlobRefSchema } from './chunk-SMK4OZNU.js';
 export { BYTE_MUTATING_STAGES, DERIVED_STAGES, PROCESSING_STAGES, ProcessingRequestSchema, ProcessingStageMapSchema, ProcessingStageSchema, ProcessingStageStatusSchema, ProcessingStateSchema, ProcessingViewSchema, ResolvedProcessingSchema, resolveAudioVariant, toProcessingView } from './chunk-AKIWUNNK.js';
 export { FirestoreTimestampSchema } from './chunk-D655OH2I.js';
-export { BlobRefSchema } from './chunk-SMK4OZNU.js';
+export { httpsUrl } from './chunk-KMQWUFMV.js';
 import './chunk-5JBD5THX.js';

package/dist/esm/types/audio.d.ts

@@ -228,6 +228,11 @@ declare const AudioEmbedViewSchema: z.ZodObject<{
      * it to change (trim removes leading/trailing silence), and should render
      * these three as a set rather than caching them independently. The record's
      * originals are immutable and unaffected; this is a read-time resolution.
+     *
+     * Restricted to `http:`/`https:` (`httpsUrl()`), not any URL `new URL()`
+     * will parse. This is the value clients hand to `<audio src>`, so a
+     * `javascript:` or `data:` URL reaching one is stored XSS — and a bare
+     * `.url()` accepts both. See `types/url.ts`.
      */
     url: z.ZodString;
     durationMs: z.ZodOptional<z.ZodNumber>;
@@ -870,6 +875,12 @@ type TranscriptEnrichmentRecord = z.infer<typeof TranscriptEnrichmentRecordSchem
 declare const ActorProfileRecordSchema: z.ZodObject<{
     handle: z.ZodOptional<z.ZodString>;
     usageIntent: z.ZodOptional<z.ZodString>;
+    /**
+     * Feed URL, restricted to `http:`/`https:` for the same reason
+     * `AudioEmbedView.url` is: an app renders this as an `<a href>`, and a bare
+     * `.url()` would let a `javascript:` URL through. A feed is a fetchable web
+     * document, so no legitimate value loses anything to the restriction.
+     */
     rssFeed: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     handle?: string | undefined;
@@ -1107,6 +1118,11 @@ declare const AudioPostViewSchema: z.ZodObject<{
          * it to change (trim removes leading/trailing silence), and should render
          * these three as a set rather than caching them independently. The record's
          * originals are immutable and unaffected; this is a read-time resolution.
+         *
+         * Restricted to `http:`/`https:` (`httpsUrl()`), not any URL `new URL()`
+         * will parse. This is the value clients hand to `<audio src>`, so a
+         * `javascript:` or `data:` URL reaching one is stored XSS — and a bare
+         * `.url()` accepts both. See `types/url.ts`.
          */
         url: z.ZodString;
         durationMs: z.ZodOptional<z.ZodNumber>;

package/dist/esm/types/audio.js

@@ -1,5 +1,6 @@
-export { ActorProfileRecordSchema, AudioEmbedSchema, AudioEmbedViewSchema, AudioPostRecordSchema, AudioPostViewSchema, PostRecordPublicSchema, ReplyRefSchema, StrongRefSchema, TimedTranscriptSchema, TranscriptEnrichmentRecordSchema, TranscriptSegmentSchema, ViewerStateSchema } from '../chunk-J2HE6PE2.js';
+export { ActorProfileRecordSchema, AudioEmbedSchema, AudioEmbedViewSchema, AudioPostRecordSchema, AudioPostViewSchema, PostRecordPublicSchema, ReplyRefSchema, StrongRefSchema, TimedTranscriptSchema, TranscriptEnrichmentRecordSchema, TranscriptSegmentSchema, ViewerStateSchema } from '../chunk-QQ5GOLYW.js';
+import '../chunk-SMK4OZNU.js';
 import '../chunk-AKIWUNNK.js';
 import '../chunk-D655OH2I.js';
-import '../chunk-SMK4OZNU.js';
+import '../chunk-KMQWUFMV.js';
 import '../chunk-5JBD5THX.js';

package/dist/esm/types/url.d.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+
+/**
+ * Scheme-restricted URL schema: an absolute `http:`/`https:` URL, trimmed.
+ *
+ * ## Why this exists
+ *
+ * `z.string().url()` is `new URL()` under the hood, and `new URL()` accepts
+ * ANY scheme. All of these parse clean through a bare `.url()`:
+ *
+ *     javascript:alert(1)
+ *     data:text/html,<script>alert(1)</script>
+ *     file:///etc/passwd
+ *     vbscript:msgbox(1)
+ *     blob:https://evil.example/x
+ *
+ * That is harmless for a value nobody dereferences and dangerous for one that
+ * clients do. `AudioEmbedView.url` is the field a player puts in `<audio src>`;
+ * `ActorProfileRecord.rssFeed` is the field an app renders as `<a href>`. A URL
+ * that reaches either of those unchecked is a stored-XSS shape — written once,
+ * fired for every viewer afterwards.
+ *
+ * So every URL field in this contract goes through this helper, and none of
+ * them uses a bare `.url()`. The `antiphony/no-bare-zod-url` ESLint rule
+ * enforces that, because "remember to use the helper" is not a control.
+ *
+ * ## Why `http:` is allowed, despite the name
+ *
+ * The name says https because https is what a deployment should serve; the rule
+ * admits `http:` because a self-hosted or local Antiphony is reached at
+ * `http://localhost:8787`, and `AudioEmbedView.url` is built from exactly that
+ * base (`ANTIPHONY_PUBLIC_BASE_URL`). Excluding plain http would make the
+ * contract unparseable in development for no safety gained: what this closes is
+ * scheme confusion, not transport confidentiality. Transport is a deployment
+ * concern, and the deployment that matters is https already.
+ *
+ * ## Why a string check and not a `.refine()`
+ *
+ * Two reasons, both practical:
+ *
+ *  - **It stays a `ZodString`.** A `.refine()` wraps the schema in `ZodEffects`,
+ *    which costs consumers `.extend()`-friendliness and makes the OpenAPI
+ *    generator emit a weaker schema. As a plain string check the constraint
+ *    survives into `openapi.json` as a `pattern`, so a consumer in another
+ *    language reads the rule instead of having to already know it.
+ *  - **It is checked against the raw string, not a parsed `protocol`.** HTML
+ *    strips tabs and newlines out of URL attributes before dereferencing them,
+ *    so a scheme split by a tab is a live `javascript:` URL in a browser — and
+ *    one `new URL()` parses happily. Requiring the string to LITERALLY begin
+ *    `http://` or `https://` rejects that whole family without enumerating it.
+ *
+ * `.trim()` runs first so surrounding whitespace is normalised away rather than
+ * sneaking a scheme past the anchor. It is a normalisation, not a loosening:
+ * bare `.url()` accepted padded input too, it just kept the padding.
+ *
+ * One fidelity note on that generated `pattern`: JSON Schema has no way to
+ * express a case-insensitive regex, so `openapi.json` documents
+ * `^https?:\/\/` without the `i` flag. `HTTPS://x` therefore passes here and
+ * fails a strict reading of the document. Real URLs carry a lowercase scheme,
+ * and the alternative — dropping `i` — would reject input for cosmetics, so the
+ * runtime stays the more permissive of the two on that one axis.
+ *
+ * Usage:
+ *
+ *     url:     httpsUrl()
+ *     rssFeed: httpsUrl().optional()
+ */
+declare function httpsUrl(): z.ZodString;
+
+export { httpsUrl };

package/dist/esm/types/url.js

@@ -0,0 +1,2 @@
+export { httpsUrl } from '../chunk-KMQWUFMV.js';
+import '../chunk-5JBD5THX.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antiphony/shared",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Shared types, Zod schemas, and codecs for Antiphony — open audio call-and-response infrastructure and AT Protocol lexicons.",
   "license": "MIT",
   "homepage": "https://docs.antiphony.dev",
@@ -137,14 +137,16 @@
     "lint": "eslint . --max-warnings=0",
     "test": "vitest run"
   },
-  "dependencies": {
+  "//peerDependencies": "zod is a PEER, not a dependency, and the build has always assumed as much: tsup.config.ts marks it `external` so that there is ONE zod module instance shared with the consumer — the comment there spells out the consequence, that `@hono/zod-openapi`'s `.openapi()` extension never reaches schemas defined here if the instance is duplicated. Declaring it under `dependencies` said the opposite, that this package brings its own, and the contradiction was not theoretical: a consumer pinned to zod 3.22.4 against this package's `^3.24.1` gets TWO instances, 3.22.4 hoisted and 3.25.76 nested here. That is a live hazard inside zod 3, not a hedge against zod 4. As a peer, npm resolves one instance and says so when it cannot. The range is `^3.24.1` and is deliberately NOT widened to include `^4.0.0`: the schemas here are written against the zod 3 API, #148 verified that a zod 4 consumer breaks at parse time, and a peer range that overstates what the code supports is exactly the failure mode `@hono/zod-openapi` demonstrated with its `zod: >=3.0.0` — a range npm cannot fault, since 3.25.76 satisfies it, while the code underneath needed `^3.20.2`. Widen it only when the schemas actually move. ⚠️ SHIPS IN 0.6.0, which is unreleased — this changes the install contract, so a consumer that did not declare zod itself must now do so (npm 7+ auto-installs peers, but a consumer with `legacy-peer-deps` set does not). Vox Pop already declares zod in every workspace, so it is a no-op there.",
+  "peerDependencies": {
     "zod": "^3.24.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",
     "tsup": "^8.5.1",
-    "typescript-eslint": "^8.18.0",
+    "typescript-eslint": "^8.70.0",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.9",
+    "zod": "^3.24.1"
   }
 }