@singi-labs/sifa-sdk 0.19.107 → 0.19.109

package/dist/schemas/write/org-profile.js

@@ -1,5 +1,7 @@
 // src/schemas/write/org-profile.ts
 import { z } from "zod";
+import { orgAliasField, orgDescriptionField, orgNameField } from "../org-profile.js";
+import { isValidPartialDate } from "./shared.js";
 var orgAddressWriteSchema = z.object({
   country: z.string().max(255).nullable().optional(),
   postalCode: z.string().max(64).nullable().optional(),
@@ -22,9 +24,14 @@ var orgLinkWriteSchema = z.object({
     { message: "Only http(s) URLs are allowed" }
   )
 });
+var orgFoundedSchema = z.string().max(10).refine(isValidPartialDate, {
+  message: "Must be a year (YYYY), month (YYYY-MM), or date (YYYY-MM-DD)"
+});
 var OrgProfileWriteSchema = z.object({
-  name: z.string().min(1).max(2e3),
-  description: z.string().max(5e4).nullable().optional(),
+  // The ingest gate: lexicon limits only (sifa-workspace#726), so a record
+  // written elsewhere is not dropped over a request-only rule.
+  name: orgNameField,
+  description: orgDescriptionField.nullable().optional(),
   logo: z.unknown().nullable().optional(),
   website: z.string().max(2048).nullable().optional(),
   entityRefs: z.array(z.string().max(2048)).max(20).nullable().optional(),
@@ -44,11 +51,12 @@ var OrgProfileWriteSchema = z.object({
     })
   ).max(10).nullable().optional(),
   founded: z.string().max(10).nullable().optional(),
-  aliases: z.array(z.string().max(200)).max(20).nullable().optional(),
+  aliases: z.array(orgAliasField).max(20).nullable().optional(),
   personalProfileVisible: z.boolean().nullable().optional(),
   createdAt: z.string()
 });
 export {
-  OrgProfileWriteSchema
+  OrgProfileWriteSchema,
+  orgFoundedSchema
 };
 //# sourceMappingURL=org-profile.js.map

package/dist/schemas/write/org-profile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/schemas/write/org-profile.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Schema enforced by the org-profile write endpoint on sifa-api.\n *\n * Sifa-managed org identity: name + description + contact channel plus\n * `entityRefs` linking the org to portable identifiers (Wikidata / ROR /\n * LEI / sifa.id URI, http(s) enforced elsewhere).\n */\n/**\n * Structured physical address (community.lexicon.location.address; all fields\n * optional). Field caps mirror `orgAddressSchema` in sifa-api\n * `src/routes/org-settings.ts` exactly; country is free text (not ISO-gated at\n * this layer).\n */\nconst orgAddressWriteSchema = z.object({\n  country: z.string().max(255).nullable().optional(),\n  postalCode: z.string().max(64).nullable().optional(),\n  region: z.string().max(255).nullable().optional(),\n  locality: z.string().max(255).nullable().optional(),\n  street: z.string().max(2048).nullable().optional(),\n  name: z.string().max(255).nullable().optional(),\n});\n\n/**\n * A featured link (both `name` and `url` required). Mirrors `orgLinkSchema` in\n * sifa-api: the url MUST be http(s) -- DOMPurify does not strip a\n * `javascript:`/`data:` scheme from a bare string, so the scheme is rejected\n * here to prevent stored XSS.\n */\nconst orgLinkWriteSchema = z.object({\n  name: z.string().min(1).max(255),\n  url: z\n    .string()\n    .max(2048)\n    .refine(\n      (u) => {\n        try {\n          const { protocol } = new URL(u);\n          return protocol === 'http:' || protocol === 'https:';\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Only http(s) URLs are allowed' },\n    ),\n});\n\nexport const OrgProfileWriteSchema = z.object({\n  name: z.string().min(1).max(2000),\n  description: z.string().max(50000).nullable().optional(),\n  logo: z.unknown().nullable().optional(),\n  website: z.string().max(2048).nullable().optional(),\n  entityRefs: z.array(z.string().max(2048)).max(20).nullable().optional(),\n  contact: z.string().max(320).nullable().optional(),\n  // Array caps stay at 10 (the sifa-web owner-editor limit) by design, even\n  // though the sifa-api endpoint tolerates 20. Field caps below mirror the API.\n  addresses: z.array(orgAddressWriteSchema).max(10).nullable().optional(),\n  companySize: z.string().max(64).nullable().optional(),\n  companyType: z.string().max(64).nullable().optional(),\n  links: z.array(orgLinkWriteSchema).max(10).nullable().optional(),\n  // Self-declared narrative fields; registry facts (LEI, registration number,\n  // legal form, ticker) stay internal and are never self-declared.\n  industries: z\n    .array(\n      z.object({\n        industry: z.string().max(100),\n        domain: z.string().max(100).nullable().optional(),\n      }),\n    )\n    .max(10)\n    .nullable()\n    .optional(),\n  founded: z.string().max(10).nullable().optional(),\n  aliases: z.array(z.string().max(200)).max(20).nullable().optional(),\n  personalProfileVisible: z.boolean().nullable().optional(),\n  createdAt: z.string(),\n});\n\nexport type OrgProfileWriteInput = z.infer<typeof OrgProfileWriteSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAelB,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAQD,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,KAAK,EACF,OAAO,EACP,IAAI,IAAI,EACR;AAAA,IACC,CAAC,MAAM;AACL,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC;AAC9B,eAAO,aAAa,WAAW,aAAa;AAAA,MAC9C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,EAAE,SAAS,gCAAgC;AAAA,EAC7C;AACJ,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAGjD,WAAW,EAAE,MAAM,qBAAqB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,OAAO,EAAE,MAAM,kBAAkB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/D,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,MAC5B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAClD,CAAC;AAAA,EACH,EACC,IAAI,EAAE,EACN,SAAS,EACT,SAAS;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAClE,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAW,EAAE,OAAO;AACtB,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/schemas/write/org-profile.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { orgAliasField, orgDescriptionField, orgNameField } from '../org-profile.js';\nimport { isValidPartialDate } from './shared.js';\n\n/**\n * Schema enforced by the org-profile write endpoint on sifa-api.\n *\n * Sifa-managed org identity: name + description + contact channel plus\n * `entityRefs` linking the org to portable identifiers (Wikidata / ROR /\n * LEI / sifa.id URI, http(s) enforced elsewhere).\n */\n/**\n * Structured physical address (community.lexicon.location.address; all fields\n * optional). Field caps mirror `orgAddressSchema` in sifa-api\n * `src/routes/org-settings.ts` exactly; country is free text (not ISO-gated at\n * this layer).\n */\nconst orgAddressWriteSchema = z.object({\n  country: z.string().max(255).nullable().optional(),\n  postalCode: z.string().max(64).nullable().optional(),\n  region: z.string().max(255).nullable().optional(),\n  locality: z.string().max(255).nullable().optional(),\n  street: z.string().max(2048).nullable().optional(),\n  name: z.string().max(255).nullable().optional(),\n});\n\n/**\n * A featured link (both `name` and `url` required). Mirrors `orgLinkSchema` in\n * sifa-api: the url MUST be http(s) -- DOMPurify does not strip a\n * `javascript:`/`data:` scheme from a bare string, so the scheme is rejected\n * here to prevent stored XSS.\n */\nconst orgLinkWriteSchema = z.object({\n  name: z.string().min(1).max(255),\n  url: z\n    .string()\n    .max(2048)\n    .refine(\n      (u) => {\n        try {\n          const { protocol } = new URL(u);\n          return protocol === 'http:' || protocol === 'https:';\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Only http(s) URLs are allowed' },\n    ),\n});\n\n/**\n * Self-declared founding date: a year (YYYY), a month (YYYY-MM) or a real date\n * (YYYY-MM-DD). The lexicon only caps `founded` at 10 characters, so this is a\n * request rule for write routes and editors, not part of the ingest gate below.\n */\nexport const orgFoundedSchema = z.string().max(10).refine(isValidPartialDate, {\n  message: 'Must be a year (YYYY), month (YYYY-MM), or date (YYYY-MM-DD)',\n});\n\nexport const OrgProfileWriteSchema = z.object({\n  // The ingest gate: lexicon limits only (sifa-workspace#726), so a record\n  // written elsewhere is not dropped over a request-only rule.\n  name: orgNameField,\n  description: orgDescriptionField.nullable().optional(),\n  logo: z.unknown().nullable().optional(),\n  website: z.string().max(2048).nullable().optional(),\n  entityRefs: z.array(z.string().max(2048)).max(20).nullable().optional(),\n  contact: z.string().max(320).nullable().optional(),\n  // Array caps stay at 10 (the sifa-web owner-editor limit) by design, even\n  // though the sifa-api endpoint tolerates 20. Field caps below mirror the API.\n  addresses: z.array(orgAddressWriteSchema).max(10).nullable().optional(),\n  companySize: z.string().max(64).nullable().optional(),\n  companyType: z.string().max(64).nullable().optional(),\n  links: z.array(orgLinkWriteSchema).max(10).nullable().optional(),\n  // Self-declared narrative fields; registry facts (LEI, registration number,\n  // legal form, ticker) stay internal and are never self-declared.\n  industries: z\n    .array(\n      z.object({\n        industry: z.string().max(100),\n        domain: z.string().max(100).nullable().optional(),\n      }),\n    )\n    .max(10)\n    .nullable()\n    .optional(),\n  founded: z.string().max(10).nullable().optional(),\n  aliases: z.array(orgAliasField).max(20).nullable().optional(),\n  personalProfileVisible: z.boolean().nullable().optional(),\n  createdAt: z.string(),\n});\n\nexport type OrgProfileWriteInput = z.infer<typeof OrgProfileWriteSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,eAAe,qBAAqB,oBAAoB;AACjE,SAAS,0BAA0B;AAenC,IAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAQD,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,KAAK,EACF,OAAO,EACP,IAAI,IAAI,EACR;AAAA,IACC,CAAC,MAAM;AACL,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC;AAC9B,eAAO,aAAa,WAAW,aAAa;AAAA,MAC9C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,EAAE,SAAS,gCAAgC;AAAA,EAC7C;AACJ,CAAC;AAOM,IAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,oBAAoB;AAAA,EAC5E,SAAS;AACX,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA;AAAA,EAG5C,MAAM;AAAA,EACN,aAAa,oBAAoB,SAAS,EAAE,SAAS;AAAA,EACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAGjD,WAAW,EAAE,MAAM,qBAAqB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,OAAO,EAAE,MAAM,kBAAkB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/D,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,MAC5B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAClD,CAAC;AAAA,EACH,EACC,IAAI,EAAE,EACN,SAAS,EACT,SAAS;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,SAAS,EAAE,MAAM,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,wBAAwB,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAW,EAAE,OAAO;AACtB,CAAC;","names":[]}

package/dist/schemas/write/org-settings.js

@@ -1,5 +1,7 @@
 // src/schemas/write/org-settings.ts
 import { z } from "zod";
+import { orgAliasField, orgDescriptionField, orgNameField } from "../org-profile.js";
+import { orgFoundedSchema } from "./org-profile.js";
 var orgLogoBlobSchema = z.object({
   $type: z.literal("blob"),
   ref: z.object({ $link: z.string().min(1) }),
@@ -29,8 +31,8 @@ var orgLinkSchema = z.object({
   )
 });
 var OrgProfileUpdateRequestSchema = z.object({
-  name: z.string().min(1).max(2e3),
-  description: z.string().max(5e4).optional(),
+  name: orgNameField,
+  description: orgDescriptionField.optional(),
   website: z.string().max(2048).optional(),
   contact: z.string().max(320).optional(),
   entityRefs: z.array(z.string().min(1).max(2048)).min(1).max(20),
@@ -57,9 +59,9 @@ var OrgProfileUpdateRequestSchema = z.object({
     })
   ).max(10).optional(),
   /** Self-declared founding date: year (YYYY), month (YYYY-MM), or full date (YYYY-MM-DD). */
-  founded: z.string().max(10).optional(),
+  founded: orgFoundedSchema.optional(),
   /** Self-declared alternative names / acronyms ("also known as"). */
-  aliases: z.array(z.string().max(200)).max(20).optional(),
+  aliases: z.array(orgAliasField.min(1)).max(20).optional(),
   /** Sole-trader opt-in; see {@link OrgClaimRequestSchema}. Flippable after the claim. */
   personalProfileVisible: z.boolean().optional()
 });

package/dist/schemas/write/org-settings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/schemas/write/org-settings.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Blob-ref passthrough for the org logo. Mirrors the `blobRefSchema` validated\n * by `PUT /api/org/profile` in sifa-api `src/routes/org-settings.ts` -- the\n * shape is validated, then written to the PDS verbatim.\n */\nconst orgLogoBlobSchema = z.object({\n  $type: z.literal('blob'),\n  ref: z.object({ $link: z.string().min(1) }),\n  mimeType: z.string().min(1).max(255),\n  size: z.number().int().nonnegative(),\n});\n\n/**\n * Structured physical address (headquarters, offices). Mirrors\n * `orgAddressSchema` in sifa-api `src/routes/org-settings.ts`: every field is\n * optional and country is NOT ISO-gated here (Sifa handles country codes and\n * final caps at the app layer).\n */\nconst orgAddressSchema = z.object({\n  country: z.string().max(255).optional(),\n  postalCode: z.string().max(64).optional(),\n  region: z.string().max(255).optional(),\n  locality: z.string().max(255).optional(),\n  street: z.string().max(2048).optional(),\n  name: z.string().max(255).optional(),\n});\n\n/**\n * A featured link (name + url). Mirrors `orgLinkSchema` in sifa-api: the url\n * MUST be http(s) -- DOMPurify does not strip a `javascript:`/`data:` scheme\n * from a bare string, so the scheme is rejected here to prevent stored XSS.\n */\nconst orgLinkSchema = z.object({\n  name: z.string().min(1).max(255),\n  url: z\n    .string()\n    .max(2048)\n    .refine(\n      (u) => {\n        try {\n          const { protocol } = new URL(u);\n          return protocol === 'http:' || protocol === 'https:';\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Only http(s) URLs are allowed' },\n    ),\n});\n\n/**\n * Body accepted by `PUT /api/org/profile` (edit the org record).\n *\n * Mirrors `profileBodySchema` in sifa-api `src/routes/org-settings.ts` EXACTLY.\n * Distinct from {@link OrgClaimRequestSchema}: no `authorityAck` (already\n * asserted at claim time), and an optional `logo` blob ref (a cleared field is\n * omitted, driving the fresh-from-body PDS PUT -- no spread-merge).\n */\nexport const OrgProfileUpdateRequestSchema = z.object({\n  name: z.string().min(1).max(2000),\n  description: z.string().max(50000).optional(),\n  website: z.string().max(2048).optional(),\n  contact: z.string().max(320).optional(),\n  entityRefs: z.array(z.string().min(1).max(2048)).min(1).max(20),\n  logo: orgLogoBlobSchema.optional(),\n  /** Structured physical locations (headquarters, offices) shown on the org page. */\n  addresses: z.array(orgAddressSchema).max(20).optional(),\n  /**\n   * Self-selected headcount band (a declared bucket, never a calculated count).\n   * Open string: any value is accepted so future ranges do not break the\n   * contract; the lexicon documents the offered `knownValues`.\n   */\n  companySize: z.string().max(64).optional(),\n  companyType: z.string().max(64).optional(),\n  /** Featured links surfaced on the org page (each url http(s)). */\n  links: z.array(orgLinkSchema).max(20).optional(),\n  /**\n   * Self-declared industry/domain pairs (same shape as the person profile).\n   * Registry-sourced classifications are layered separately, not self-declared.\n   */\n  industries: z\n    .array(\n      z.object({\n        industry: z.string().max(100),\n        domain: z.string().max(100).optional(),\n      }),\n    )\n    .max(10)\n    .optional(),\n  /** Self-declared founding date: year (YYYY), month (YYYY-MM), or full date (YYYY-MM-DD). */\n  founded: z.string().max(10).optional(),\n  /** Self-declared alternative names / acronyms (\"also known as\"). */\n  aliases: z.array(z.string().max(200)).max(20).optional(),\n  /** Sole-trader opt-in; see {@link OrgClaimRequestSchema}. Flippable after the claim. */\n  personalProfileVisible: z.boolean().optional(),\n});\n\nexport type OrgProfileUpdateRequestInput = z.infer<typeof OrgProfileUpdateRequestSchema>;\n\n/**\n * Body accepted by `POST /api/org/domains/challenge` (issue a one-time DNS TXT\n * challenge). Mirrors `challengeBodySchema` in sifa-api.\n */\nexport const OrgDomainChallengeRequestSchema = z.object({\n  domain: z.string().min(1).max(255),\n});\n\nexport type OrgDomainChallengeRequestInput = z.infer<typeof OrgDomainChallengeRequestSchema>;\n\n/**\n * Body accepted by `POST /api/org/domains/verify` (verify a challenge via DoH\n * TXT lookup). Mirrors `verifyBodySchema` in sifa-api.\n */\nexport const OrgDomainVerifyRequestSchema = z.object({\n  token: z.string().min(1).max(2048),\n});\n\nexport type OrgDomainVerifyRequestInput = z.infer<typeof OrgDomainVerifyRequestSchema>;\n\n/**\n * Body accepted by `POST` and `DELETE /api/org/notification-emails` (add /\n * remove a notification address). Mirrors `notificationEmailBodySchema` in\n * sifa-api. The bound-domain check is server-side (the address must use a\n * domain the org controls).\n */\nexport const OrgNotificationEmailRequestSchema = z.object({\n  email: z.string().email().max(320),\n});\n\nexport type OrgNotificationEmailRequestInput = z.infer<typeof OrgNotificationEmailRequestSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAOlB,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACrC,CAAC;AAQD,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvC,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACrC,CAAC;AAOD,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,KAAK,EACF,OAAO,EACP,IAAI,IAAI,EACR;AAAA,IACC,CAAC,MAAM;AACL,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC;AAC9B,eAAO,aAAa,WAAW,aAAa;AAAA,MAC9C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,EAAE,SAAS,gCAAgC;AAAA,EAC7C;AACJ,CAAC;AAUM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAK,EAAE,SAAS;AAAA,EAC5C,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC9D,MAAM,kBAAkB,SAAS;AAAA;AAAA,EAEjC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEzC,OAAO,EAAE,MAAM,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,MAC5B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,EACC,IAAI,EAAE,EACN,SAAS;AAAA;AAAA,EAEZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAErC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEvD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AAQM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,CAAC;AAQM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACnC,CAAC;AAUM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/schemas/write/org-settings.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { orgAliasField, orgDescriptionField, orgNameField } from '../org-profile.js';\nimport { orgFoundedSchema } from './org-profile.js';\n\n/**\n * Blob-ref passthrough for the org logo. Mirrors the `blobRefSchema` validated\n * by `PUT /api/org/profile` in sifa-api `src/routes/org-settings.ts` -- the\n * shape is validated, then written to the PDS verbatim.\n */\nconst orgLogoBlobSchema = z.object({\n  $type: z.literal('blob'),\n  ref: z.object({ $link: z.string().min(1) }),\n  mimeType: z.string().min(1).max(255),\n  size: z.number().int().nonnegative(),\n});\n\n/**\n * Structured physical address (headquarters, offices). Mirrors\n * `orgAddressSchema` in sifa-api `src/routes/org-settings.ts`: every field is\n * optional and country is NOT ISO-gated here (Sifa handles country codes and\n * final caps at the app layer).\n */\nconst orgAddressSchema = z.object({\n  country: z.string().max(255).optional(),\n  postalCode: z.string().max(64).optional(),\n  region: z.string().max(255).optional(),\n  locality: z.string().max(255).optional(),\n  street: z.string().max(2048).optional(),\n  name: z.string().max(255).optional(),\n});\n\n/**\n * A featured link (name + url). Mirrors `orgLinkSchema` in sifa-api: the url\n * MUST be http(s) -- DOMPurify does not strip a `javascript:`/`data:` scheme\n * from a bare string, so the scheme is rejected here to prevent stored XSS.\n */\nconst orgLinkSchema = z.object({\n  name: z.string().min(1).max(255),\n  url: z\n    .string()\n    .max(2048)\n    .refine(\n      (u) => {\n        try {\n          const { protocol } = new URL(u);\n          return protocol === 'http:' || protocol === 'https:';\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Only http(s) URLs are allowed' },\n    ),\n});\n\n/**\n * Body accepted by `PUT /api/org/profile` (edit the org record).\n *\n * Mirrors `profileBodySchema` in sifa-api `src/routes/org-settings.ts` EXACTLY.\n * Distinct from {@link OrgClaimRequestSchema}: no `authorityAck` (already\n * asserted at claim time), and an optional `logo` blob ref (a cleared field is\n * omitted, driving the fresh-from-body PDS PUT -- no spread-merge).\n */\nexport const OrgProfileUpdateRequestSchema = z.object({\n  name: orgNameField,\n  description: orgDescriptionField.optional(),\n  website: z.string().max(2048).optional(),\n  contact: z.string().max(320).optional(),\n  entityRefs: z.array(z.string().min(1).max(2048)).min(1).max(20),\n  logo: orgLogoBlobSchema.optional(),\n  /** Structured physical locations (headquarters, offices) shown on the org page. */\n  addresses: z.array(orgAddressSchema).max(20).optional(),\n  /**\n   * Self-selected headcount band (a declared bucket, never a calculated count).\n   * Open string: any value is accepted so future ranges do not break the\n   * contract; the lexicon documents the offered `knownValues`.\n   */\n  companySize: z.string().max(64).optional(),\n  companyType: z.string().max(64).optional(),\n  /** Featured links surfaced on the org page (each url http(s)). */\n  links: z.array(orgLinkSchema).max(20).optional(),\n  /**\n   * Self-declared industry/domain pairs (same shape as the person profile).\n   * Registry-sourced classifications are layered separately, not self-declared.\n   */\n  industries: z\n    .array(\n      z.object({\n        industry: z.string().max(100),\n        domain: z.string().max(100).optional(),\n      }),\n    )\n    .max(10)\n    .optional(),\n  /** Self-declared founding date: year (YYYY), month (YYYY-MM), or full date (YYYY-MM-DD). */\n  founded: orgFoundedSchema.optional(),\n  /** Self-declared alternative names / acronyms (\"also known as\"). */\n  aliases: z.array(orgAliasField.min(1)).max(20).optional(),\n  /** Sole-trader opt-in; see {@link OrgClaimRequestSchema}. Flippable after the claim. */\n  personalProfileVisible: z.boolean().optional(),\n});\n\nexport type OrgProfileUpdateRequestInput = z.infer<typeof OrgProfileUpdateRequestSchema>;\n\n/**\n * Body accepted by `POST /api/org/domains/challenge` (issue a one-time DNS TXT\n * challenge). Mirrors `challengeBodySchema` in sifa-api.\n */\nexport const OrgDomainChallengeRequestSchema = z.object({\n  domain: z.string().min(1).max(255),\n});\n\nexport type OrgDomainChallengeRequestInput = z.infer<typeof OrgDomainChallengeRequestSchema>;\n\n/**\n * Body accepted by `POST /api/org/domains/verify` (verify a challenge via DoH\n * TXT lookup). Mirrors `verifyBodySchema` in sifa-api.\n */\nexport const OrgDomainVerifyRequestSchema = z.object({\n  token: z.string().min(1).max(2048),\n});\n\nexport type OrgDomainVerifyRequestInput = z.infer<typeof OrgDomainVerifyRequestSchema>;\n\n/**\n * Body accepted by `POST` and `DELETE /api/org/notification-emails` (add /\n * remove a notification address). Mirrors `notificationEmailBodySchema` in\n * sifa-api. The bound-domain check is server-side (the address must use a\n * domain the org controls).\n */\nexport const OrgNotificationEmailRequestSchema = z.object({\n  email: z.string().email().max(320),\n});\n\nexport type OrgNotificationEmailRequestInput = z.infer<typeof OrgNotificationEmailRequestSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,eAAe,qBAAqB,oBAAoB;AACjE,SAAS,wBAAwB;AAOjC,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACrC,CAAC;AAQD,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvC,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACrC,CAAC;AAOD,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,KAAK,EACF,OAAO,EACP,IAAI,IAAI,EACR;AAAA,IACC,CAAC,MAAM;AACL,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC;AAC9B,eAAO,aAAa,WAAW,aAAa;AAAA,MAC9C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,EAAE,SAAS,gCAAgC;AAAA,EAC7C;AACJ,CAAC;AAUM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,MAAM;AAAA,EACN,aAAa,oBAAoB,SAAS;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC9D,MAAM,kBAAkB,SAAS;AAAA;AAAA,EAEjC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEzC,OAAO,EAAE,MAAM,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,MAC5B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,EACC,IAAI,EAAE,EACN,SAAS;AAAA;AAAA,EAEZ,SAAS,iBAAiB,SAAS;AAAA;AAAA,EAEnC,SAAS,EAAE,MAAM,cAAc,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAExD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AAQM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,CAAC;AAQM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACnC,CAAC;AAUM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@singi-labs/sifa-sdk",
-  "version": "0.19.107",
+  "version": "0.19.109",
   "description": "Sifa SDK — public client library for the Sifa AppView on AT Protocol. Shared by sifa-web and sifa-app.",
   "license": "MIT",
   "type": "module",
@@ -252,7 +252,7 @@
     ]
   },
   "dependencies": {
-    "zod": "4.4.3"
+    "zod": "4.6.7"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5.100.0",
@@ -267,7 +267,7 @@
     }
   },
   "devDependencies": {
-    "@changesets/cli": "2.31.1",
+    "@changesets/cli": "3.0.3",
     "@commitlint/cli": "21.2.2",
     "@commitlint/config-conventional": "21.2.3",
     "@tanstack/react-query": "5.102.2",