@singi-labs/sifa-sdk 0.19.44 → 0.19.46

package/dist/rpg/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/rpg/catalog.ts","../../src/rpg/unlocks.ts"],"names":[],"mappings":";;;AAEO,IAAM,eAAA,GAAkB,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAC1D,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,WAAW,CAAA;AAAA,IAC3B,UAAA,EAAY,EAAE,IAAA,CAAK;AAAA,MACjB,0BAAA;AAAA,MACA,8BAAA;AAAA,MACA,8BAAA;AAAA,MACA;AAAA,KACD;AAAA,GACF,CAAA;AAAA,EACD,EAAE,MAAA,CAAO,EAAE,MAAM,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,GAAA,CAAI,CAAC,GAAG,CAAA;AAAA,EACzF,CAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAM,EAAE,OAAA,CAAQ,SAAS,CAAA,EAAG,KAAA,EAAO,EAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,GAAG,CAAA;AAAA,EACjE,CAAA,CAAE,OAAO,EAAE,IAAA,EAAM,EAAE,OAAA,CAAQ,cAAc,GAAG;AAC9C,CAAC;AAEM,IAAM,aAAA,GAAgB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEpC,EAAA,EAAI,CAAA,CACD,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,cAAc,CAAA;AAAA,EACvB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA;AAAA,EACzB,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA;AAAA,EAC/B,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,EAC9B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,EAAE,CAAA;AAAA,EAC3B,QAAQ,CAAA,CAAE,KAAA,CAAM,eAAe,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EACtC,OAAA,EAAS,EAAE,OAAA;AACb,CAAC;AAQM,IAAM,SAAA,GAAgC;AAAA,EAC3C;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,KAAA,EAAO,YAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,OAAA;AAAA,IACN,QAAA,EAAU,MAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,QAAQ,CAAC,EAAE,MAAM,WAAA,EAAa,UAAA,EAAY,4BAA4B;AAAA,GACxE;AAAA,EACA;AAAA,IACE,EAAA,EAAI,oBAAA;AAAA,IACJ,KAAA,EAAO,eAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,OAAA;AAAA,IACN,QAAA,EAAU,MAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,QAAQ,CAAC,EAAE,MAAM,WAAA,EAAa,UAAA,EAAY,gCAAgC;AAAA,GAC5E;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,KAAA,EAAO,aAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,MAAA;AAAA,IACN,QAAA,EAAU,WAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,QAAQ,CAAC,EAAE,MAAM,WAAA,EAAa,UAAA,EAAY,gCAAgC;AAAA,GAC5E;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,KAAA,EAAO,cAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,MAAA;AAAA,IACN,QAAA,EAAU,UAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,QAAQ,CAAC,EAAE,MAAM,WAAA,EAAa,UAAA,EAAY,6BAA6B;AAAA,GACzE;AAAA,EACA;AAAA,IACE,EAAA,EAAI,mBAAA;AAAA,IACJ,KAAA,EAAO,cAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,OAAA;AAAA,IACN,QAAA,EAAU,UAAA;AAAA,IACV,OAAA,EAAS,KAAA;AAAA,IACT,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,gBAAgB;AAAA,GACnC;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,KAAA,EAAO,UAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,OAAA;AAAA,IACN,QAAA,EAAU,MAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,MAAA,EAAQ,CAAC,EAAE,IAAA,EAAM,sBAAsB,SAAA,EAAW,CAAC,OAAO,CAAA,EAAG;AAAA,GAC/D;AAAA,EACA;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,KAAA,EAAO,YAAA;AAAA,IACP,WAAA,EAAa,EAAA;AAAA,IACb,IAAA,EAAM,OAAA;AAAA,IACN,QAAA,EAAU,MAAA;AAAA,IACV,OAAA,EAAS,IAAA;AAAA,IACT,MAAA,EAAQ;AAAA,MACN,EAAE,IAAA,EAAM,oBAAA,EAAsB,SAAA,EAAW,CAAC,QAAQ,CAAA,EAAE;AAAA,MACpD,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,SAAA;AAAU;AACtC;AAEJ;;;ACtFA,SAAS,OAAA,CAAQ,GAAc,CAAA,EAA8B;AAC3D,EAAA,QAAQ,EAAE,IAAA;AAAM,IACd,KAAK,WAAA;AACH,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,QAAA,CAAS,CAAA,CAAE,UAAU,CAAA;AAAA,IAC5C,KAAK,oBAAA;AACH,MAAA,OAAO,CAAA,CAAE,UAAU,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,iBAAA,CAAkB,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,IAChE,KAAK,SAAA;AACH,MAAA,OAAO,CAAA,CAAE,YAAA,CAAa,QAAA,CAAS,CAAA,CAAE,KAAK,CAAA;AAAA,IACxC,KAAK,cAAA;AACH,MAAA,OAAO,CAAA,CAAE,YAAA;AAAA;AAEf;AAGO,SAAS,kBAAA,CACd,OAAA,EACA,KAAA,GAA4B,SAAA,EACT;AACnB,EAAA,OAAO,KAAA,CACJ,OAAO,CAAC,IAAA,KAAS,KAAK,OAAO,CAAA,CAC7B,GAAA,CAAI,CAAC,IAAA,MAAU,EAAE,MAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,QAAQ,CAAA,EAAG,OAAO,CAAC,CAAA,EAAE,CAAE,CAAA;AACnF","file":"index.js","sourcesContent":["import { z } from 'zod';\n\nexport const RpgUnlockSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('hasRecord'),\n    collection: z.enum([\n      'id.sifa.profile.position',\n      'id.sifa.profile.volunteering',\n      'id.sifa.profile.presentation',\n      'id.sifa.profile.education',\n    ]),\n  }),\n  z.object({ kind: z.literal('hasExternalAccount'), platforms: z.array(z.string()).min(1) }),\n  z.object({ kind: z.literal('usesApp'), appId: z.string().min(1) }),\n  z.object({ kind: z.literal('hasDoctorate') }),\n]);\n\nexport const RpgItemSchema = z.object({\n  /** Lowercase `[a-z0-9_]` only: the id is embedded in an AT Protocol record key. */\n  id: z\n    .string()\n    .min(1)\n    .max(50)\n    .regex(/^[a-z0-9_]+$/),\n  title: z.string().max(100),\n  description: z.string().max(500),\n  kind: z.enum(['layer', 'held']),\n  category: z.string().max(30),\n  unlock: z.array(RpgUnlockSchema).min(1), // ANY of these unlocks the item\n  enabled: z.boolean(),\n});\nexport type RpgItem = z.infer<typeof RpgItemSchema>;\nexport type RpgUnlock = z.infer<typeof RpgUnlockSchema>;\n\n/**\n * The Sifa item catalog for rpg.actor. PLACEHOLDER titles/categories until\n * rpg.actor transfers the real item cores.\n */\nexport const RPG_ITEMS: readonly RpgItem[] = [\n  {\n    id: 'sifa_power_suit',\n    title: 'Power Suit',\n    description: '',\n    kind: 'layer',\n    category: 'tops',\n    enabled: true,\n    unlock: [{ kind: 'hasRecord', collection: 'id.sifa.profile.position' }],\n  },\n  {\n    id: 'sifa_weekend_shirt',\n    title: 'Weekend Shirt',\n    description: '',\n    kind: 'layer',\n    category: 'tops',\n    enabled: true,\n    unlock: [{ kind: 'hasRecord', collection: 'id.sifa.profile.volunteering' }],\n  },\n  {\n    id: 'sifa_speaker_mic',\n    title: 'Speaker Mic',\n    description: '',\n    kind: 'held',\n    category: 'righthand',\n    enabled: true,\n    unlock: [{ kind: 'hasRecord', collection: 'id.sifa.profile.presentation' }],\n  },\n  {\n    id: 'sifa_school_books',\n    title: 'School Books',\n    description: '',\n    kind: 'held',\n    category: 'lefthand',\n    enabled: true,\n    unlock: [{ kind: 'hasRecord', collection: 'id.sifa.profile.education' }],\n  },\n  {\n    id: 'sifa_doctoral_cap',\n    title: 'Doctoral Cap',\n    description: '',\n    kind: 'layer',\n    category: 'headwear',\n    enabled: false,\n    unlock: [{ kind: 'hasDoctorate' }],\n  },\n  {\n    id: 'sifa_lab_coat',\n    title: 'Lab Coat',\n    description: '',\n    kind: 'layer',\n    category: 'tops',\n    enabled: true,\n    unlock: [{ kind: 'hasExternalAccount', platforms: ['orcid'] }],\n  },\n  {\n    id: 'sifa_dev_hoodie',\n    title: 'Dev Hoodie',\n    description: '',\n    kind: 'layer',\n    category: 'tops',\n    enabled: true,\n    unlock: [\n      { kind: 'hasExternalAccount', platforms: ['github'] },\n      { kind: 'usesApp', appId: 'tangled' },\n    ],\n  },\n];\n","import { RPG_ITEMS, type RpgItem, type RpgUnlock } from './catalog.js';\n\n/**\n * Profile signals the unlock rules are checked against. Callers must pass\n * lowercase platform codes (e.g. 'github', 'orcid') and registry app ids (e.g. 'tangled').\n */\nexport interface RpgUnlockSignals {\n  collections: readonly string[];\n  externalPlatforms: readonly string[];\n  activeAppIds: readonly string[];\n  hasDoctorate: boolean;\n}\n\n/** One enabled catalog item and whether the signals earn it. */\nexport interface RpgUnlockResult {\n  item: RpgItem;\n  earned: boolean;\n}\n\nfunction matches(u: RpgUnlock, s: RpgUnlockSignals): boolean {\n  switch (u.kind) {\n    case 'hasRecord':\n      return s.collections.includes(u.collection);\n    case 'hasExternalAccount':\n      return u.platforms.some((p) => s.externalPlatforms.includes(p));\n    case 'usesApp':\n      return s.activeAppIds.includes(u.appId);\n    case 'hasDoctorate':\n      return s.hasDoctorate;\n  }\n}\n\n/** Evaluate every enabled item (ANY matching unlock earns it); disabled items are omitted. */\nexport function evaluateRpgUnlocks(\n  signals: RpgUnlockSignals,\n  items: readonly RpgItem[] = RPG_ITEMS,\n): RpgUnlockResult[] {\n  return items\n    .filter((item) => item.enabled)\n    .map((item) => ({ item, earned: item.unlock.some((u) => matches(u, signals)) }));\n}\n"]}
+{"version":3,"sources":["../../src/rpg/index.ts"],"sourcesContent":["/**\n * `@singi-labs/sifa-sdk/rpg` -- the Sifa item catalog for rpg.actor and the\n * pure predicate that decides which items a profile has earned. No network\n * calls; safe to import anywhere.\n */\nexport {\n  RPG_ITEMS,\n  RpgItemSchema,\n  RpgUnlockSchema,\n  type RpgItem,\n  type RpgUnlock,\n} from './catalog.js';\nexport { evaluateRpgUnlocks, type RpgUnlockResult, type RpgUnlockSignals } from './unlocks.js';\n"],"mappings":";AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,0BAAuE;","names":[]}

package/dist/rpg/unlocks.js

@@ -0,0 +1,21 @@
+// src/rpg/unlocks.ts
+import { RPG_ITEMS } from "./catalog.js";
+function matches(u, s) {
+  switch (u.kind) {
+    case "hasRecord":
+      return s.collections.includes(u.collection);
+    case "hasExternalAccount":
+      return u.platforms.some((p) => s.externalPlatforms.includes(p));
+    case "usesApp":
+      return s.activeAppIds.includes(u.appId);
+    case "hasDoctorate":
+      return s.hasDoctorate;
+  }
+}
+function evaluateRpgUnlocks(signals, items = RPG_ITEMS) {
+  return items.filter((item) => item.enabled).map((item) => ({ item, earned: item.unlock.some((u) => matches(u, signals)) }));
+}
+export {
+  evaluateRpgUnlocks
+};
+//# sourceMappingURL=unlocks.js.map

package/dist/rpg/unlocks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/rpg/unlocks.ts"],"sourcesContent":["import { RPG_ITEMS, type RpgItem, type RpgUnlock } from './catalog.js';\n\n/**\n * Profile signals the unlock rules are checked against. Callers must pass\n * lowercase platform codes (e.g. 'github', 'orcid') and registry app ids (e.g. 'tangled').\n */\nexport interface RpgUnlockSignals {\n  collections: readonly string[];\n  externalPlatforms: readonly string[];\n  activeAppIds: readonly string[];\n  hasDoctorate: boolean;\n}\n\n/** One enabled catalog item and whether the signals earn it. */\nexport interface RpgUnlockResult {\n  item: RpgItem;\n  earned: boolean;\n}\n\nfunction matches(u: RpgUnlock, s: RpgUnlockSignals): boolean {\n  switch (u.kind) {\n    case 'hasRecord':\n      return s.collections.includes(u.collection);\n    case 'hasExternalAccount':\n      return u.platforms.some((p) => s.externalPlatforms.includes(p));\n    case 'usesApp':\n      return s.activeAppIds.includes(u.appId);\n    case 'hasDoctorate':\n      return s.hasDoctorate;\n  }\n}\n\n/** Evaluate every enabled item (ANY matching unlock earns it); disabled items are omitted. */\nexport function evaluateRpgUnlocks(\n  signals: RpgUnlockSignals,\n  items: readonly RpgItem[] = RPG_ITEMS,\n): RpgUnlockResult[] {\n  return items\n    .filter((item) => item.enabled)\n    .map((item) => ({ item, earned: item.unlock.some((u) => matches(u, signals)) }));\n}\n"],"mappings":";AAAA,SAAS,iBAA+C;AAmBxD,SAAS,QAAQ,GAAc,GAA8B;AAC3D,UAAQ,EAAE,MAAM;AAAA,IACd,KAAK;AACH,aAAO,EAAE,YAAY,SAAS,EAAE,UAAU;AAAA,IAC5C,KAAK;AACH,aAAO,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,kBAAkB,SAAS,CAAC,CAAC;AAAA,IAChE,KAAK;AACH,aAAO,EAAE,aAAa,SAAS,EAAE,KAAK;AAAA,IACxC,KAAK;AACH,aAAO,EAAE;AAAA,EACb;AACF;AAGO,SAAS,mBACd,SACA,QAA4B,WACT;AACnB,SAAO,MACJ,OAAO,CAAC,SAAS,KAAK,OAAO,EAC7B,IAAI,CAAC,UAAU,EAAE,MAAM,QAAQ,KAAK,OAAO,KAAK,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,EAAE;AACnF;","names":[]}

package/dist/schemas/blob-ref.js

@@ -0,0 +1,12 @@
+// src/schemas/blob-ref.ts
+import { z } from "zod";
+var BlobRefSchema = z.object({
+  $type: z.literal("blob"),
+  ref: z.object({ $link: z.string().min(1) }),
+  mimeType: z.string().min(1).max(255),
+  size: z.number().int().nonnegative()
+});
+export {
+  BlobRefSchema
+};
+//# sourceMappingURL=blob-ref.js.map

package/dist/schemas/blob-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/blob-ref.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Blob-ref passthrough shared by records that carry an uploaded blob (org logo,\n * presentation cover image, ...). Mirrors the `blobRefSchema` validated by the\n * sifa-api write endpoints -- the shape is validated, then written to the PDS\n * verbatim.\n */\nexport const BlobRefSchema = z.object({\n  $type: z.literal('blob'),\n  ref: z.object({ $link: z.string().min(1) }),\n  mimeType: z.string().min(1).max(255),\n  size: z.number().int().nonnegative(),\n});\n\nexport type BlobRef = z.infer<typeof BlobRefSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAQX,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACrC,CAAC;","names":[]}

package/dist/schemas/confirmation.js

@@ -0,0 +1,23 @@
+// src/schemas/confirmation.ts
+import { z } from "zod";
+import { datetimeSchema, maxGraphemes, strongRefSchema } from "./shared.js";
+var CONFIRMATION_RELATIONS = [
+  "id.sifa.defs#coSpeaker",
+  "id.sifa.defs#projectMember"
+];
+var ConfirmationRecordSchema = z.object({
+  subject: strongRefSchema,
+  relation: z.string().min(1),
+  /**
+   * Name the subject record carried at confirmation time. Lives in the
+   * confirming person's repo, out of the claimer's reach, so a rename after
+   * the fact is detectable.
+   */
+  subjectName: z.string().refine(maxGraphemes(300)).max(3e3).optional(),
+  createdAt: datetimeSchema
+});
+export {
+  CONFIRMATION_RELATIONS,
+  ConfirmationRecordSchema
+};
+//# sourceMappingURL=confirmation.js.map

package/dist/schemas/confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/confirmation.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { datetimeSchema, maxGraphemes, strongRefSchema } from './shared.js';\n\n/**\n * Relations shipped today. The lexicon declares these as `knownValues`, not an\n * enum, so the schema accepts any string: a consumer that meets a relation it\n * does not recognise should still see that the named person affirmed something.\n */\nexport const CONFIRMATION_RELATIONS = [\n  'id.sifa.defs#coSpeaker',\n  'id.sifa.defs#projectMember',\n] as const;\n\nexport type ConfirmationRelation = (typeof CONFIRMATION_RELATIONS)[number];\n\n/**\n * Zod schema for `id.sifa.confirmation` records.\n *\n * The subject strongRef carries no collection constraint by design: one record\n * type affirms a co-speaker credit, a project membership, and whatever\n * people-link relations come next. Resolve it by AT-URI; the CID pins the\n * version seen at confirmation time and is an integrity hint, not a join key,\n * because the claimer editing their record changes its CID without\n * invalidating anything.\n */\nexport const ConfirmationRecordSchema = z.object({\n  subject: strongRefSchema,\n  relation: z.string().min(1),\n  /**\n   * Name the subject record carried at confirmation time. Lives in the\n   * confirming person's repo, out of the claimer's reach, so a rename after\n   * the fact is detectable.\n   */\n  subjectName: z.string().refine(maxGraphemes(300)).max(3000).optional(),\n  createdAt: datetimeSchema,\n});\n\nexport type ConfirmationRecord = z.infer<typeof ConfirmationRecordSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,gBAAgB,cAAc,uBAAuB;AAOvD,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AACF;AAcO,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,SAAS;AAAA,EACT,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,aAAa,EAAE,OAAO,EAAE,OAAO,aAAa,GAAG,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACrE,WAAW;AACb,CAAC;","names":[]}

package/dist/schemas/endorsement-confirmation.js

@@ -0,0 +1,18 @@
+// src/schemas/endorsement-confirmation.ts
+import { z } from "zod";
+import { datetimeSchema, strongRefSchema } from "./shared.js";
+var EndorsementConfirmationRecordSchema = z.object({
+  endorsement: strongRefSchema,
+  /**
+   * Skill record this endorsement applies to. Set when the endorsement proposed
+   * a skill: the subject creates the record and links it here, because the
+   * endorser cannot write to the subject's repository. Also set when a proposed
+   * name matched a skill the subject already had.
+   */
+  skill: strongRefSchema.optional(),
+  createdAt: datetimeSchema
+});
+export {
+  EndorsementConfirmationRecordSchema
+};
+//# sourceMappingURL=endorsement-confirmation.js.map

package/dist/schemas/endorsement-confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/endorsement-confirmation.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { datetimeSchema, strongRefSchema } from './shared.js';\n\n/**\n * Zod schema for `id.sifa.endorsement.confirmation` records.\n * Lives in the endorsee's PDS to approve display of an endorsement.\n */\nexport const EndorsementConfirmationRecordSchema = z.object({\n  endorsement: strongRefSchema,\n  /**\n   * Skill record this endorsement applies to. Set when the endorsement proposed\n   * a skill: the subject creates the record and links it here, because the\n   * endorser cannot write to the subject's repository. Also set when a proposed\n   * name matched a skill the subject already had.\n   */\n  skill: strongRefSchema.optional(),\n  createdAt: datetimeSchema,\n});\n\nexport type EndorsementConfirmationRecord = z.infer<typeof EndorsementConfirmationRecordSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,gBAAgB,uBAAuB;AAMzC,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOb,OAAO,gBAAgB,SAAS;AAAA,EAChC,WAAW;AACb,CAAC;","names":[]}

package/dist/schemas/endorsement.js

@@ -0,0 +1,19 @@
+// src/schemas/endorsement.ts
+import { z } from "zod";
+import { datetimeSchema, didSchema, maxGraphemes, strongRefSchema } from "./shared.js";
+var EndorsementRecordSchema = z.object({
+  subject: didSchema,
+  /**
+   * Absent when the endorser is proposing a skill the subject has not listed,
+   * named by `skillName`. The record it becomes is linked from the subject's
+   * confirmation, since only they can write to their own repository.
+   */
+  skill: strongRefSchema.optional(),
+  skillName: z.string().min(1).refine(maxGraphemes(64)).max(640),
+  comment: z.string().refine(maxGraphemes(300)).max(3e3).optional(),
+  createdAt: datetimeSchema
+});
+export {
+  EndorsementRecordSchema
+};
+//# sourceMappingURL=endorsement.js.map

package/dist/schemas/endorsement.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/endorsement.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { datetimeSchema, didSchema, maxGraphemes, strongRefSchema } from './shared.js';\n\n/**\n * Zod schema for `id.sifa.endorsement` records. Lives in the endorser's PDS;\n * the endorser identity is implicit (whoever owns the repository).\n */\nexport const EndorsementRecordSchema = z.object({\n  subject: didSchema,\n  /**\n   * Absent when the endorser is proposing a skill the subject has not listed,\n   * named by `skillName`. The record it becomes is linked from the subject's\n   * confirmation, since only they can write to their own repository.\n   */\n  skill: strongRefSchema.optional(),\n  skillName: z.string().min(1).refine(maxGraphemes(64)).max(640),\n  comment: z.string().refine(maxGraphemes(300)).max(3000).optional(),\n  createdAt: datetimeSchema,\n});\n\nexport type EndorsementRecord = z.infer<typeof EndorsementRecordSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,gBAAgB,WAAW,cAAc,uBAAuB;AAMlE,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,OAAO,gBAAgB,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,aAAa,EAAE,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7D,SAAS,EAAE,OAAO,EAAE,OAAO,aAAa,GAAG,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACjE,WAAW;AACb,CAAC;","names":[]}

package/dist/schemas/entity.js

@@ -0,0 +1,74 @@
+// src/schemas/entity.ts
+import { z } from "zod";
+var httpUrlNullable = z.string().refine((s) => /^https?:\/\//i.test(s), { message: "must be an http(s) URL" }).nullable();
+var searchResultCommon = {
+  kind: z.string(),
+  name: z.string(),
+  domain: z.string().nullable(),
+  country: z.string().nullable(),
+  logoUrl: httpUrlNullable,
+  parentName: z.string().nullable()
+};
+var EntitySearchResultSchema = z.discriminatedUnion("source", [
+  z.object({
+    source: z.literal("entity"),
+    entityId: z.number().int().positive(),
+    ...searchResultCommon
+  }),
+  z.object({
+    source: z.literal("pdl"),
+    pdlId: z.string().min(1),
+    ...searchResultCommon
+  })
+]);
+var EntitySearchResponseSchema = z.object({
+  results: z.array(EntitySearchResultSchema),
+  hasMore: z.boolean()
+});
+var EntitySelectRequestSchema = z.object({
+  entityId: z.number().int().positive().optional(),
+  pdlId: z.string().min(1).optional()
+}).refine((v) => v.entityId != null !== (v.pdlId != null), {
+  message: "exactly one of entityId or pdlId is required"
+});
+var EntitySelectResponseSchema = z.object({
+  entityId: z.number().int().positive(),
+  slug: z.string(),
+  kind: z.string(),
+  canonicalName: z.string(),
+  domain: z.string().nullable(),
+  /**
+   * The entity's website, gated to sources trustworthy enough to prefill into a
+   * record the user signs. Narrower than `domain`, which is a display value and
+   * may come from a crawl. Null when the entity has no such source.
+   */
+  website: httpUrlNullable.default(null),
+  /** Which tier `website` came from. Crawled is never an accepted source. */
+  websiteTier: z.enum(["org", "curated"]).nullable().default(null),
+  entityRef: httpUrlNullable
+});
+var EntityImportSearchResponseSchema = z.object({
+  results: z.array(EntitySearchResultSchema)
+});
+var EntityResolveDomainRequestSchema = z.object({
+  domain: z.string().min(1).max(253)
+});
+var EntityResolveDomainResponseSchema = z.object({
+  results: z.array(EntitySearchResultSchema),
+  canMint: z.boolean()
+});
+var EntityMintDomainResponseSchema = z.object({
+  result: EntitySearchResultSchema,
+  pending: z.boolean()
+});
+export {
+  EntityImportSearchResponseSchema,
+  EntityMintDomainResponseSchema,
+  EntityResolveDomainRequestSchema,
+  EntityResolveDomainResponseSchema,
+  EntitySearchResponseSchema,
+  EntitySearchResultSchema,
+  EntitySelectRequestSchema,
+  EntitySelectResponseSchema
+};
+//# sourceMappingURL=entity.js.map

package/dist/schemas/entity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/entity.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Organization entity-resolution payloads (#159). Shared by the typeahead,\n * selection, and grow-on-demand import-search endpoints on sifa-api.\n */\n\n/**\n * A nullable string constrained to an http(s) URL. Rejects `javascript:` and\n * other script-bearing schemes at the SDK boundary so a hostile API response\n * cannot smuggle an XSS payload into a rendered `href`/`src`. Note: Wikidata\n * entity URIs are canonically `http://`, so both http and https are allowed.\n */\nconst httpUrlNullable = z\n  .string()\n  .refine((s) => /^https?:\\/\\//i.test(s), { message: 'must be an http(s) URL' })\n  .nullable();\n\nconst searchResultCommon = {\n  kind: z.string(),\n  name: z.string(),\n  domain: z.string().nullable(),\n  country: z.string().nullable(),\n  logoUrl: httpUrlNullable,\n  parentName: z.string().nullable(),\n};\n\n/**\n * A single typeahead row. Discriminated on `source`: a curated `entity` row\n * carries `entityId`, a `pdl` staging row carries `pdlId`. The union guarantees\n * the identifier for the row's source is always present, so a stable React key\n * can never be `entity:undefined`. The disambiguation fields\n * (domain/country/parentName) drive the dropdown display.\n */\nexport const EntitySearchResultSchema = z.discriminatedUnion('source', [\n  z.object({\n    source: z.literal('entity'),\n    entityId: z.number().int().positive(),\n    ...searchResultCommon,\n  }),\n  z.object({\n    source: z.literal('pdl'),\n    pdlId: z.string().min(1),\n    ...searchResultCommon,\n  }),\n]);\nexport type EntitySearchResult = z.infer<typeof EntitySearchResultSchema>;\n\n/** Response of `GET /api/entities/search`. */\nexport const EntitySearchResponseSchema = z.object({\n  results: z.array(EntitySearchResultSchema),\n  hasMore: z.boolean(),\n});\nexport type EntitySearchResponse = z.infer<typeof EntitySearchResponseSchema>;\n\n/**\n * Body of `POST /api/entities/select`: promote a PDL row OR bump an entity.\n * Exactly one of `entityId`/`pdlId` must be present -- supplying both is\n * ambiguous (the server would have to silently pick one) and is rejected.\n */\nexport const EntitySelectRequestSchema = z\n  .object({\n    entityId: z.number().int().positive().optional(),\n    pdlId: z.string().min(1).optional(),\n  })\n  .refine((v) => (v.entityId != null) !== (v.pdlId != null), {\n    message: 'exactly one of entityId or pdlId is required',\n  });\nexport type EntitySelectRequest = z.infer<typeof EntitySelectRequestSchema>;\n\n/** Response of `POST /api/entities/select`. `entityRef` is the portable\n * Wikidata/ROR/LEI URI to write to the position record, or null for a\n * PDL-only entity (its resolution stays AppView-side). */\nexport const EntitySelectResponseSchema = z.object({\n  entityId: z.number().int().positive(),\n  slug: z.string(),\n  kind: z.string(),\n  canonicalName: z.string(),\n  domain: z.string().nullable(),\n  /**\n   * The entity's website, gated to sources trustworthy enough to prefill into a\n   * record the user signs. Narrower than `domain`, which is a display value and\n   * may come from a crawl. Null when the entity has no such source.\n   */\n  website: httpUrlNullable.default(null),\n  /** Which tier `website` came from. Crawled is never an accepted source. */\n  websiteTier: z.enum(['org', 'curated']).nullable().default(null),\n  entityRef: httpUrlNullable,\n});\nexport type EntitySelectResponse = z.infer<typeof EntitySelectResponseSchema>;\n\n/** Response of `POST /api/entities/import-search`. */\nexport const EntityImportSearchResponseSchema = z.object({\n  results: z.array(EntitySearchResultSchema),\n});\nexport type EntityImportSearchResponse = z.infer<typeof EntityImportSearchResponseSchema>;\n\n/**\n * Body of the domain grow-on-demand endpoints (`POST /api/entities/resolve-domain`\n * and `POST /api/entities/mint-domain`). The server re-validates the value as a\n * registrable domain; 253 is the max DNS name length.\n */\nexport const EntityResolveDomainRequestSchema = z.object({\n  domain: z.string().min(1).max(253),\n});\nexport type EntityResolveDomainRequest = z.infer<typeof EntityResolveDomainRequestSchema>;\n\n/**\n * Response of `POST /api/entities/resolve-domain` (grow-on-demand Branch 1). Any\n * notable companies whose official website is the domain, imported from Wikidata.\n * `canMint` is true when nothing notable matched AND the domain is eligible for\n * the user-initiated mint-from-domain path -- it drives the \"Add <domain>\"\n * affordance.\n */\nexport const EntityResolveDomainResponseSchema = z.object({\n  results: z.array(EntitySearchResultSchema),\n  canMint: z.boolean(),\n});\nexport type EntityResolveDomainResponse = z.infer<typeof EntityResolveDomainResponseSchema>;\n\n/**\n * Response of `POST /api/entities/mint-domain` (grow-on-demand Branch 2). The\n * linkable entity minted from (or already resolved for) the domain. A non-2xx\n * status (e.g. the domain is not mintable, a confusable look-alike, or the site\n * yielded nothing usable) surfaces as a thrown error, not a null result.\n *\n * `pending` is true when the entity is a fresh hidden-pending mint: the\n * requesting user's own link resolves to it immediately, but it stays out of\n * other users' typeahead + aggregation until an admin approves it. Clients should\n * reflect this (\"added -- pending review\") rather than \"added & live\".\n */\nexport const EntityMintDomainResponseSchema = z.object({\n  result: EntitySearchResultSchema,\n  pending: z.boolean(),\n});\nexport type EntityMintDomainResponse = z.infer<typeof EntityMintDomainResponseSchema>;\n"],"mappings":";AAAA,SAAS,SAAS;AAalB,IAAM,kBAAkB,EACrB,OAAO,EACP,OAAO,CAAC,MAAM,gBAAgB,KAAK,CAAC,GAAG,EAAE,SAAS,yBAAyB,CAAC,EAC5E,SAAS;AAEZ,IAAM,qBAAqB;AAAA,EACzB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC;AASO,IAAM,2BAA2B,EAAE,mBAAmB,UAAU;AAAA,EACrE,EAAE,OAAO;AAAA,IACP,QAAQ,EAAE,QAAQ,QAAQ;AAAA,IAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACpC,GAAG;AAAA,EACL,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,GAAG;AAAA,EACL,CAAC;AACH,CAAC;AAIM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,MAAM,wBAAwB;AAAA,EACzC,SAAS,EAAE,QAAQ;AACrB,CAAC;AAQM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACpC,CAAC,EACA,OAAO,CAAC,MAAO,EAAE,YAAY,UAAW,EAAE,SAAS,OAAO;AAAA,EACzD,SAAS;AACX,CAAC;AAMI,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,eAAe,EAAE,OAAO;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,SAAS,gBAAgB,QAAQ,IAAI;AAAA;AAAA,EAErC,aAAa,EAAE,KAAK,CAAC,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/D,WAAW;AACb,CAAC;AAIM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,wBAAwB;AAC3C,CAAC;AAQM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,CAAC;AAUM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,SAAS,EAAE,MAAM,wBAAwB;AAAA,EACzC,SAAS,EAAE,QAAQ;AACrB,CAAC;AAcM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,QAAQ;AAAA,EACR,SAAS,EAAE,QAAQ;AACrB,CAAC;","names":[]}

package/dist/schemas/feed.js

@@ -0,0 +1,73 @@
+// src/schemas/feed.ts
+import { z } from "zod";
+import { atUriSchema, cidSchema, datetimeSchema, didSchema } from "./shared.js";
+var FeedActorSchema = z.object({
+  did: didSchema,
+  handle: z.string(),
+  displayName: z.string().optional(),
+  avatarUrl: z.string().optional()
+});
+var FeedItemBaseSchema = z.object({
+  id: z.string(),
+  actor: FeedActorSchema,
+  indexedAt: datetimeSchema,
+  eventType: z.string()
+});
+var SifaFeedItemSchema = FeedItemBaseSchema.extend({
+  source: z.literal("sifa"),
+  appId: z.literal("sifa").optional(),
+  payload: z.record(z.string(), z.unknown())
+});
+var AtmosphereFeedItemSchema = FeedItemBaseSchema.extend({
+  source: z.literal("atmosphere"),
+  appId: z.string(),
+  uri: atUriSchema.optional(),
+  cid: cidSchema.optional(),
+  payload: z.record(z.string(), z.unknown())
+});
+var FollowFeedItemSchema = z.discriminatedUnion("source", [
+  SifaFeedItemSchema,
+  AtmosphereFeedItemSchema
+]);
+var FollowFeedPageSchema = z.object({
+  items: z.array(FollowFeedItemSchema),
+  cursor: z.string().nullable()
+});
+var FeedCursorSchema = z.object({
+  indexedAt: datetimeSchema,
+  source: z.union([z.literal("sifa"), z.literal("atmosphere")]),
+  id: z.string().min(1)
+});
+function toBase64Url(input) {
+  const g = globalThis;
+  const b64 = typeof g.btoa === "function" ? g.btoa(unescape(encodeURIComponent(input))) : g.Buffer.from(input, "utf-8").toString("base64");
+  let end = b64.length;
+  while (end > 0 && b64.charCodeAt(end - 1) === 61) end--;
+  return b64.slice(0, end).replace(/\+/g, "-").replace(/\//g, "_");
+}
+function fromBase64Url(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((input.length + 3) % 4);
+  const g = globalThis;
+  if (typeof g.atob === "function") {
+    return decodeURIComponent(escape(g.atob(padded)));
+  }
+  return g.Buffer.from(padded, "base64").toString("utf-8");
+}
+function encodeFeedCursor(cursor) {
+  return toBase64Url(JSON.stringify(cursor));
+}
+function decodeFeedCursor(encoded) {
+  const json = fromBase64Url(encoded);
+  const parsed = JSON.parse(json);
+  return FeedCursorSchema.parse(parsed);
+}
+export {
+  AtmosphereFeedItemSchema,
+  FeedActorSchema,
+  FollowFeedItemSchema,
+  FollowFeedPageSchema,
+  SifaFeedItemSchema,
+  decodeFeedCursor,
+  encodeFeedCursor
+};
+//# sourceMappingURL=feed.js.map

package/dist/schemas/feed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/feed.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { atUriSchema, cidSchema, datetimeSchema, didSchema } from './shared.js';\n\n/**\n * Feed item from `GET /api/following/feed`. Discriminated on `source`:\n *\n * - `sifa`: a Sifa-native event (e.g. profile update, endorsement).\n * - `atmosphere`: a curated creation event from another ATproto app\n *   (Barazo post, etc.). Payload is the hydrated `app.bsky.embed.*#view`\n *   shape, NOT the raw record (per memory `sifa-hydrated-view-embed-types`).\n *\n * Both variants share `actor`, `indexedAt`, and `id` (the materialized\n * `feed_events.id` row identifier, used in the cursor).\n */\nexport const FeedActorSchema = z.object({\n  did: didSchema,\n  handle: z.string(),\n  displayName: z.string().optional(),\n  avatarUrl: z.string().optional(),\n});\n\nexport type FeedActor = z.infer<typeof FeedActorSchema>;\n\nconst FeedItemBaseSchema = z.object({\n  id: z.string(),\n  actor: FeedActorSchema,\n  indexedAt: datetimeSchema,\n  eventType: z.string(),\n});\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport const SifaFeedItemSchema = FeedItemBaseSchema.extend({\n  source: z.literal('sifa'),\n  appId: z.literal('sifa').optional(),\n  payload: z.record(z.string(), z.unknown()),\n});\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport type SifaFeedItem = z.infer<typeof SifaFeedItemSchema>;\n\n/**\n * ATmosphere feed item. `payload` is intentionally permissive: it carries\n * a hydrated `app.bsky.embed.*#view` shape that varies by source app. The\n * AppView resolves the hydration; clients render via the existing\n * embed-view union (mirrors `sifa-web/src/components/stream/`).\n *\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport const AtmosphereFeedItemSchema = FeedItemBaseSchema.extend({\n  source: z.literal('atmosphere'),\n  appId: z.string(),\n  uri: atUriSchema.optional(),\n  cid: cidSchema.optional(),\n  payload: z.record(z.string(), z.unknown()),\n});\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport type AtmosphereFeedItem = z.infer<typeof AtmosphereFeedItemSchema>;\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport const FollowFeedItemSchema = z.discriminatedUnion('source', [\n  SifaFeedItemSchema,\n  AtmosphereFeedItemSchema,\n]);\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport type FollowFeedItem = z.infer<typeof FollowFeedItemSchema>;\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport const FollowFeedPageSchema = z.object({\n  items: z.array(FollowFeedItemSchema),\n  cursor: z.string().nullable(),\n});\n\n/**\n * @deprecated The `/api/following/feed` surface was reverted (sifa-api#674).\n *   Per `decisions/activity-data-strategy.md` the Sifa Timeline + ATmosphere\n *   Stream are two distinct surfaces with different data paths (Barazo API\n *   for Timeline, live PDS reads + Valkey for Stream). These collapsed feed\n *   types are no longer consumed. Scheduled for removal in next major bump.\n */\nexport type FollowFeedPage = z.infer<typeof FollowFeedPageSchema>;\n\n/**\n * Composite feed cursor `(indexedAt DESC, source, id)`. Encoded as a\n * URL-safe base64 string so it survives `URLSearchParams` round-trips\n * without further encoding. Decoupling encode/decode from the API call\n * lets consumers persist cursors (e.g. for \"jump-back-here\" UX) and\n * lets us unit-test the format.\n */\nexport interface FeedCursor {\n  indexedAt: string;\n  source: 'sifa' | 'atmosphere';\n  id: string;\n}\n\nconst FeedCursorSchema = z.object({\n  indexedAt: datetimeSchema,\n  source: z.union([z.literal('sifa'), z.literal('atmosphere')]),\n  id: z.string().min(1),\n});\n\ninterface BufferLike {\n  from: (input: string, encoding: 'utf-8' | 'base64') => { toString: (encoding: string) => string };\n}\n\ninterface Base64Global {\n  btoa?: (input: string) => string;\n  atob?: (input: string) => string;\n  Buffer?: BufferLike;\n}\n\nfunction toBase64Url(input: string): string {\n  const g = globalThis as unknown as Base64Global;\n  const b64: string =\n    typeof g.btoa === 'function'\n      ? g.btoa(unescape(encodeURIComponent(input)))\n      : (g.Buffer as BufferLike).from(input, 'utf-8').toString('base64');\n  // Strip up to 2 trailing '=' (base64 padding). CodeQL flags `/=+$/` as a\n  // polynomial regex on tainted input; we don't accept tainted input here,\n  // but the deterministic loop sidesteps the alert.\n  let end = b64.length;\n  while (end > 0 && b64.charCodeAt(end - 1) === 61) end--;\n  return b64.slice(0, end).replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n\nfunction fromBase64Url(input: string): string {\n  const padded = input.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice((input.length + 3) % 4);\n  const g = globalThis as unknown as Base64Global;\n  if (typeof g.atob === 'function') {\n    return decodeURIComponent(escape(g.atob(padded)));\n  }\n  return (g.Buffer as BufferLike).from(padded, 'base64').toString('utf-8');\n}\n\nexport function encodeFeedCursor(cursor: FeedCursor): string {\n  return toBase64Url(JSON.stringify(cursor));\n}\n\nexport function decodeFeedCursor(encoded: string): FeedCursor {\n  const json = fromBase64Url(encoded);\n  const parsed: unknown = JSON.parse(json);\n  return FeedCursorSchema.parse(parsed);\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,aAAa,WAAW,gBAAgB,iBAAiB;AAa3D,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,KAAK;AAAA,EACL,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAID,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO;AAAA,EACP,WAAW;AAAA,EACX,WAAW,EAAE,OAAO;AACtB,CAAC;AASM,IAAM,qBAAqB,mBAAmB,OAAO;AAAA,EAC1D,QAAQ,EAAE,QAAQ,MAAM;AAAA,EACxB,OAAO,EAAE,QAAQ,MAAM,EAAE,SAAS;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAuBM,IAAM,2BAA2B,mBAAmB,OAAO;AAAA,EAChE,QAAQ,EAAE,QAAQ,YAAY;AAAA,EAC9B,OAAO,EAAE,OAAO;AAAA,EAChB,KAAK,YAAY,SAAS;AAAA,EAC1B,KAAK,UAAU,SAAS;AAAA,EACxB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAkBM,IAAM,uBAAuB,EAAE,mBAAmB,UAAU;AAAA,EACjE;AAAA,EACA;AACF,CAAC;AAkBM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAwBD,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,WAAW;AAAA,EACX,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,YAAY,CAAC,CAAC;AAAA,EAC5D,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AACtB,CAAC;AAYD,SAAS,YAAY,OAAuB;AAC1C,QAAM,IAAI;AACV,QAAM,MACJ,OAAO,EAAE,SAAS,aACd,EAAE,KAAK,SAAS,mBAAmB,KAAK,CAAC,CAAC,IACzC,EAAE,OAAsB,KAAK,OAAO,OAAO,EAAE,SAAS,QAAQ;AAIrE,MAAI,MAAM,IAAI;AACd,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,MAAM,GAAI;AAClD,SAAO,IAAI,MAAM,GAAG,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AACjE;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC;AAC/F,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY;AAChC,WAAO,mBAAmB,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC;AAAA,EAClD;AACA,SAAQ,EAAE,OAAsB,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AACzE;AAEO,SAAS,iBAAiB,QAA4B;AAC3D,SAAO,YAAY,KAAK,UAAU,MAAM,CAAC;AAC3C;AAEO,SAAS,iBAAiB,SAA6B;AAC5D,QAAM,OAAO,cAAc,OAAO;AAClC,QAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,SAAO,iBAAiB,MAAM,MAAM;AACtC;","names":[]}

package/dist/schemas/follow-profile.js

@@ -0,0 +1,32 @@
+// src/schemas/follow-profile.ts
+import { z } from "zod";
+import { datetimeSchema, didSchema } from "./shared.js";
+var FollowProfileSchema = z.object({
+  did: didSchema,
+  handle: z.string(),
+  displayName: z.string().optional(),
+  headline: z.string().optional(),
+  avatarUrl: z.string().optional(),
+  source: z.string(),
+  claimed: z.boolean(),
+  followedAt: datetimeSchema,
+  blueskyVerified: z.boolean().optional(),
+  blueskyVerifiedAt: datetimeSchema.nullable().optional()
+});
+var FollowProfilePageSchema = z.object({
+  items: z.array(FollowProfileSchema),
+  cursor: z.string().nullable()
+});
+var FeatureAllowlistEntrySchema = z.object({
+  did: didSchema,
+  addedAt: datetimeSchema,
+  note: z.string().nullable().optional()
+});
+var FEATURE_FLAGS = ["FEED_V5_ENABLED"];
+export {
+  FEATURE_FLAGS,
+  FeatureAllowlistEntrySchema,
+  FollowProfilePageSchema,
+  FollowProfileSchema
+};
+//# sourceMappingURL=follow-profile.js.map

package/dist/schemas/follow-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/follow-profile.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { datetimeSchema, didSchema } from './shared.js';\n\n/**\n * Profile row shared across `/api/following`, `/api/profile/:handleOrDid/mutuals`,\n * and `/api/me/bluesky-suggestions`. Matches the existing `FollowProfile` TS\n * interface byte-for-byte but adds runtime validation for the SDK's pagination\n * helpers and the upcoming `sifa-app` consumer (where we can't trust the wire).\n *\n * Per `sifa-api#674` PR body: mutuals + bluesky-suggestions reuse this shape\n * exactly, so a single Zod schema covers all three endpoints.\n */\nexport const FollowProfileSchema = z.object({\n  did: didSchema,\n  handle: z.string(),\n  displayName: z.string().optional(),\n  headline: z.string().optional(),\n  avatarUrl: z.string().optional(),\n  source: z.string(),\n  claimed: z.boolean(),\n  followedAt: datetimeSchema,\n  blueskyVerified: z.boolean().optional(),\n  blueskyVerifiedAt: datetimeSchema.nullable().optional(),\n});\n\nexport type FollowProfileItem = z.infer<typeof FollowProfileSchema>;\n\n/**\n * Cursor-paginated page of {@link FollowProfileSchema} rows. Used by mutuals\n * + bluesky-suggestions. The legacy `/api/following` endpoint uses a different\n * wrapper key (`follows` instead of `items`) and is intentionally NOT covered\n * by this schema.\n */\nexport const FollowProfilePageSchema = z.object({\n  items: z.array(FollowProfileSchema),\n  cursor: z.string().nullable(),\n});\n\nexport type FollowProfilePage = z.infer<typeof FollowProfilePageSchema>;\n\n/**\n * Per-flag allowlist row returned by `GET /api/admin/feature-allowlists/:flag`.\n * Mirrors the `feature_allowlists` table; `note` is optional free-form text.\n */\nexport const FeatureAllowlistEntrySchema = z.object({\n  did: didSchema,\n  addedAt: datetimeSchema,\n  note: z.string().nullable().optional(),\n});\n\nexport type FeatureAllowlistEntry = z.infer<typeof FeatureAllowlistEntrySchema>;\n\n/**\n * Known feature flags accepted by the admin allowlist endpoints. Mirrors the\n * server-side `FEATURE_FLAGS` const in `sifa-api`. Kept as a `const` tuple so\n * consumers can `as const`-narrow when building UIs.\n */\nexport const FEATURE_FLAGS = ['FEED_V5_ENABLED'] as const;\nexport type FeatureFlag = (typeof FEATURE_FLAGS)[number];\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,gBAAgB,iBAAiB;AAWnC,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,KAAK;AAAA,EACL,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO;AAAA,EACjB,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY;AAAA,EACZ,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,mBAAmB,eAAe,SAAS,EAAE,SAAS;AACxD,CAAC;AAUM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,mBAAmB;AAAA,EAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,KAAK;AAAA,EACL,SAAS;AAAA,EACT,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACvC,CAAC;AASM,IAAM,gBAAgB,CAAC,iBAAiB;","names":[]}

package/dist/schemas/graph-follow.js

@@ -0,0 +1,19 @@
+// src/schemas/graph-follow.ts
+import { z } from "zod";
+import { datetimeSchema, didSchema, maxGraphemes } from "./shared.js";
+var GraphFollowRecordSchema = z.object({
+  subject: didSchema,
+  createdAt: datetimeSchema,
+  note: z.string().refine(maxGraphemes(200), "note must be at most 200 graphemes").optional()
+});
+function makeGraphFollowRecordSchema(followerDid) {
+  return GraphFollowRecordSchema.refine((record) => record.subject !== followerDid, {
+    message: "Self-follow is not allowed",
+    path: ["subject"]
+  });
+}
+export {
+  GraphFollowRecordSchema,
+  makeGraphFollowRecordSchema
+};
+//# sourceMappingURL=graph-follow.js.map

package/dist/schemas/graph-follow.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/graph-follow.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport { datetimeSchema, didSchema, maxGraphemes } from './shared.js';\n\n/**\n * Zod schema for `id.sifa.graph.follow` records.\n *\n * One-way professional follow; the record lives in the follower's PDS. Per\n * iter-1 decisions (`plans/2026-06-01-in-sifa-follow-primitive.md`), this is\n * a **distinct** graph from `app.bsky.graph.follow`, not a superset — but\n * the required field shape (`subject` + `createdAt`) is intentionally\n * identical so generic Bluesky `listRecords` consumers get usable records.\n *\n * `note` is a Sifa addition: an optional reason for the follow (\"why I\n * followed\"). Capped at 200 graphemes to match other profile-flavored\n * lexicon fields.\n */\nexport const GraphFollowRecordSchema = z.object({\n  subject: didSchema,\n  createdAt: datetimeSchema,\n  note: z.string().refine(maxGraphemes(200), 'note must be at most 200 graphemes').optional(),\n});\n\nexport type GraphFollowRecord = z.infer<typeof GraphFollowRecordSchema>;\n\n/**\n * Build a `GraphFollowRecordSchema` that rejects self-follow at the Zod\n * layer (CLAUDE.md mandatory standards #3 — input validation; sifa-api#673\n * E8 — defence in depth).\n *\n * Use this on the **client side** when constructing a new follow record\n * (the follower DID is the authenticated user). The plain\n * {@link GraphFollowRecordSchema} stays without the refine so firehose\n * consumers can validate records without context.\n */\nexport function makeGraphFollowRecordSchema(followerDid: string) {\n  return GraphFollowRecordSchema.refine((record) => record.subject !== followerDid, {\n    message: 'Self-follow is not allowed',\n    path: ['subject'],\n  });\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,SAAS,gBAAgB,WAAW,oBAAoB;AAejD,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,OAAO,aAAa,GAAG,GAAG,oCAAoC,EAAE,SAAS;AAC5F,CAAC;AAcM,SAAS,4BAA4B,aAAqB;AAC/D,SAAO,wBAAwB,OAAO,CAAC,WAAW,OAAO,YAAY,aAAa;AAAA,IAChF,SAAS;AAAA,IACT,MAAM,CAAC,SAAS;AAAA,EAClB,CAAC;AACH;","names":[]}