@tbs-fitness/contract 0.5.0 → 0.7.0

package/README.md

@@ -6,15 +6,16 @@ It is published as `@tbs-fitness/contract`. The package holds definitions only:
 
 ## What is in it
 
-| Import                                | Contents                                                                                                                         |
-| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
-| `@tbs-fitness/contract/enums`         | `ROLES`, `ACCOUNT_STATUSES`, `TOKEN_TRANSPORTS`, `AUDIT_OUTCOMES`, `APP_ENVIRONMENTS`, `FEATURE_FLAG_RULE_TYPES` and their types |
-| `@tbs-fitness/contract/common`        | Pagination, response envelopes (`{ data }`, `{ data, meta }`, `{ error }`), `emailSchema`, `phoneSchema`, `safeTextSchema`       |
-| `@tbs-fitness/contract/auth`          | Login, sessions, password changes and resets, account administration                                                             |
-| `@tbs-fitness/contract/client`        | Client sign-up, one-time code verification and resend, client sign-in and profile, password recovery                             |
-| `@tbs-fitness/contract/coach`         | Coach sign-up, one-time code verification and resend, coach sign-in and profile, password recovery                               |
-| `@tbs-fitness/contract/audit`         | The audit log query and response                                                                                                 |
-| `@tbs-fitness/contract/feature-flags` | Feature flag requests and responses                                                                                              |
+| Import                                | Contents                                                                                                                                                                            |
+| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@tbs-fitness/contract/enums`         | `ROLES`, `PERMISSIONS`, `CSRF_COOKIE_NAMES`, `CSRF_HEADER`, `ACCOUNT_STATUSES`, `TOKEN_TRANSPORTS`, `AUDIT_OUTCOMES`, `APP_ENVIRONMENTS`, `FEATURE_FLAG_RULE_TYPES` and their types |
+| `@tbs-fitness/contract/common`        | Pagination, response envelopes (`{ data }`, `{ data, meta }`, `{ error }`), `emailSchema`, `phoneSchema`, `safeTextSchema`                                                          |
+| `@tbs-fitness/contract/auth`          | Login, sessions, password changes and resets, account administration                                                                                                                |
+| `@tbs-fitness/contract/client`        | Client sign-up, one-time code verification and resend, client sign-in and profile, password recovery                                                                                |
+| `@tbs-fitness/contract/coach`         | Coach sign-up, one-time code verification and resend, coach sign-in and profile, password recovery                                                                                  |
+| `@tbs-fitness/contract/audit`         | The audit log query and response                                                                                                                                                    |
+| `@tbs-fitness/contract/feature-flags` | Feature flag requests and responses                                                                                                                                                 |
+| `@tbs-fitness/contract/food`          | Food library, metadata, CSV/XLSX import, client food suggestions and their review, and the shared nutrition helpers                                                                 |
 
 Each domain has its own entry point, so names only need to be unique within a domain. `auditLogResponseSchema`, for example, exists in both `/audit` and `/feature-flags`.
 
@@ -42,6 +43,29 @@ const result = createFlagSchema.safeParse(input); // The same rules as the API.
 
 Requests have two types. Clients use `*Input`, where fields with a default are optional. The backend uses `*Body`, which is the result after validation. List queries come from the URL as strings, so they have no `*Input`: use `Partial<PaginationQuery>` or `Partial<AuditLogQuery>`.
 
+## Version 0.7.0
+
+Permission names, CSRF names and the client feature-flag response. Additive; consumers install `^0.7.0` explicitly.
+
+- `/enums`: `PERMISSIONS` and `Permission`, every permission name the API grants. Which role has which permission stays in the backend.
+- `/enums`: `CSRF_COOKIE_NAMES` (`__Host-tbs_csrf` when Secure, else `tbs_csrf`) and `CSRF_HEADER` (`x-csrf-token`).
+- `/feature-flags`: `evaluatedFlagsResponseSchema` and `EvaluatedFlagsResponse`, the response of `GET /feature-flags/me`: only the flags that are on for the caller.
+- `accountResponseSchema.permissions` stays an array of plain strings, so a client older than a new permission still accepts the sign-in.
+
+## Version 0.6.0
+
+The food library. Additive; consumers install `^0.6.0` explicitly.
+
+- `/enums`: `FOOD_SOURCES`, `SERVING_UNITS` (`g`, `ml`), `PORTION_UNITS`, `NUTRITION_BASES`, `FOOD_SUGGESTION_STATUSES`, `FOOD_SUGGESTION_RESOLUTIONS`, `FOOD_IMPORT_MODES`, `FOOD_IMPORT_STATUSES`, `FOOD_IMPORT_ROW_STATUSES`, `FOOD_IMPORT_FILE_TYPES`, `FOOD_IMPORT_ISSUE_SEVERITIES`, `FOOD_METADATA_SELECTIONS`, `FOOD_SORT_FIELDS` and `SORT_ORDERS`.
+- New `/food`:
+  - Library: `createFoodSchema`, `updateFoodSchema` (with `version`), `foodListQuerySchema`, `foodResponseSchema` (values per 100 and per serving, plus `formulaCalories`), `similarFoodResponseSchema`, `foodStatsResponseSchema`.
+  - Metadata: `metadataTypeResponseSchema`, `metadataValueResponseSchema`, `createMetadataValueSchema`, `updateMetadataValueSchema`.
+  - Import: `foodImportRowSchema` (one spreadsheet row, shared by the API and the preview), `commitFoodImportSchema`, `foodImportBatchResponseSchema`, `foodImportRowResponseSchema`, `FOOD_IMPORT_LIMITS`.
+  - Suggestions: `submitFoodSuggestionSchema`, `suggestionPhotoUploadSchema`, `presignedUploadResponseSchema`, `approveFoodSuggestionSchema` (one shape per resolution), `rejectFoodSuggestionSchema`, `foodSuggestionResponseSchema` (coach view), `clientFoodSuggestionResponseSchema` (client view), `FOOD_SUGGESTION_LIMITS`.
+  - Client search: `clientFoodSearchQuerySchema`, `clientFoodResponseSchema`.
+  - Helpers: `toPer100`, `perServing`, `formulaCalories` (Biki's formula, (protein + carbs) × 4 + fat × 9), `nutritionIssues`, `normalizeFoodName`, `slugifyMetadataKey`, `parseServingLabel`, `roundNutrient`.
+- Library nutrients are per 100 of the serving unit: per 100 g, or per 100 ml for a serving in ml. Values have at most 2 decimals.
+
 ## Version 0.5.0 (breaking)
 
 - `ROLES` is now `ADMIN`, `COACH` and `CLIENT`: `CUSTOMER` is renamed to `CLIENT`. The backend migrates stored roles in step.

package/dist/cjs/auth/auth.dto.js

@@ -90,6 +90,11 @@ exports.accountResponseSchema = zod_1.z
     role: zod_1.z.enum(index_js_1.ROLES),
     /** @deprecated Always `[role]`. Kept for clients written before `role`. */
     roles: zod_1.z.array(zod_1.z.string()),
+    /**
+     * Plain strings rather than `PERMISSIONS` values, because clients validate
+     * this response. With an enum, a client older than a new permission would
+     * reject the sign-in of everyone granted it.
+     */
     permissions: zod_1.z.array(zod_1.z.string()),
     lastLoginAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
 })

package/dist/cjs/enums/index.d.ts

@@ -3,6 +3,37 @@ export type AppEnvironment = (typeof APP_ENVIRONMENTS)[number];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
 export declare const ROLES: readonly ["ADMIN", "COACH", "CLIENT"];
 export type Role = (typeof ROLES)[number];
+/**
+ * Every permission name the API grants. Renaming one is a breaking change:
+ * clients compare these strings with what the API returns, so one on the old
+ * name silently loses whatever it guards. Which role has which permission is a
+ * server decision, so that mapping stays in the backend.
+ */
+export declare const PERMISSIONS: {
+    readonly accountsManage: "accounts:manage";
+    readonly rolesManage: "roles:manage";
+    readonly auditRead: "audit:read";
+    readonly featureFlagsManage: "feature_flags:manage";
+    readonly appSettingsManage: "app_settings:manage";
+    readonly communicationTemplatesManage: "communication_templates:manage";
+    readonly clientsReadAny: "clients:read:any";
+    readonly clientsWriteAny: "clients:write:any";
+    readonly clientsReadAssigned: "clients:read:assigned";
+    readonly clientsWriteAssigned: "clients:write:assigned";
+    readonly clientsReadSelf: "clients:read:self";
+    readonly clientsWriteSelf: "clients:write:self";
+    readonly foodsRead: "foods:read";
+    readonly foodsCreate: "foods:create";
+    readonly foodsUpdate: "foods:update";
+    readonly foodsDelete: "foods:delete";
+    readonly foodsImport: "foods:import";
+    readonly foodMetadataManage: "food_metadata:manage";
+    readonly foodSuggestionsReview: "food_suggestions:review";
+    readonly foodsSearchSelf: "foods:search:self";
+    readonly foodSuggestionsSubmitSelf: "food_suggestions:submit:self";
+    readonly foodSuggestionsReadSelf: "food_suggestions:read:self";
+};
+export type Permission = (typeof PERMISSIONS)[keyof typeof PERMISSIONS];
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
  * own their email address. Such a user cannot sign in.
@@ -21,6 +52,17 @@ export declare const TIMEZONE_SOURCES: readonly ["AUTO", "MANUAL"];
 export type TimezoneSource = (typeof TIMEZONE_SOURCES)[number];
 export declare const TOKEN_TRANSPORTS: readonly ["body", "cookie"];
 export type TokenTransport = (typeof TOKEN_TRANSPORTS)[number];
+/**
+ * The CSRF cookie the API sets, which scripts may read. The `__Host-` name is
+ * used when cookies are Secure, because browsers only honour that prefix on
+ * Secure cookies.
+ */
+export declare const CSRF_COOKIE_NAMES: {
+    readonly secure: "__Host-tbs_csrf";
+    readonly insecure: "tbs_csrf";
+};
+/** The header that carries the CSRF token back to the API. */
+export declare const CSRF_HEADER = "x-csrf-token";
 export declare const AUDIT_OUTCOMES: readonly ["success", "failure"];
 export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
 export declare const FEATURE_FLAG_RULE_TYPES: readonly ["user", "client", "trainer", "role"];
@@ -44,3 +86,41 @@ export type DeliveryStatus = (typeof DELIVERY_STATUSES)[number];
 /** Only one version of a template per message type and channel is active. */
 export declare const TEMPLATE_STATUSES: readonly ["draft", "active", "archived"];
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
+/** Who put a food into the library. */
+export declare const FOOD_SOURCES: readonly ["ADMIN", "COACH", "CLIENT_SUGGESTION", "IMPORT"];
+export type FoodSource = (typeof FOOD_SOURCES)[number];
+/**
+ * The unit a library serving is measured in. Nutrients are stored per 100 of
+ * this unit, so a food in `ml` holds values per 100 ml.
+ */
+export declare const SERVING_UNITS: readonly ["g", "ml"];
+export type ServingUnit = (typeof SERVING_UNITS)[number];
+/** The portion units a client can pick when logging a food. */
+export declare const PORTION_UNITS: readonly ["BOWL", "GRAM", "PIECE", "CUP"];
+export type PortionUnit = (typeof PORTION_UNITS)[number];
+/** Whether submitted nutrient values are per 100 units or per serving. */
+export declare const NUTRITION_BASES: readonly ["PER_100", "PER_SERVING"];
+export type NutritionBasis = (typeof NUTRITION_BASES)[number];
+export declare const FOOD_SUGGESTION_STATUSES: readonly ["pending", "approved", "rejected", "withdrawn"];
+export type FoodSuggestionStatus = (typeof FOOD_SUGGESTION_STATUSES)[number];
+/** How an approved suggestion was resolved. */
+export declare const FOOD_SUGGESTION_RESOLUTIONS: readonly ["ADDED_TO_LIBRARY", "LINKED_TO_EXISTING", "APPROVED_WITHOUT_LIBRARY"];
+export type FoodSuggestionResolution = (typeof FOOD_SUGGESTION_RESOLUTIONS)[number];
+/** What a bulk import does with a row whose food is already in the library. */
+export declare const FOOD_IMPORT_MODES: readonly ["SKIP_DUPLICATES", "UPDATE_EXISTING"];
+export type FoodImportMode = (typeof FOOD_IMPORT_MODES)[number];
+export declare const FOOD_IMPORT_STATUSES: readonly ["previewed", "completed", "expired"];
+export type FoodImportStatus = (typeof FOOD_IMPORT_STATUSES)[number];
+export declare const FOOD_IMPORT_ROW_STATUSES: readonly ["valid", "invalid", "duplicate_in_file", "duplicate_existing"];
+export type FoodImportRowStatus = (typeof FOOD_IMPORT_ROW_STATUSES)[number];
+export declare const FOOD_IMPORT_FILE_TYPES: readonly ["csv", "xlsx"];
+export type FoodImportFileType = (typeof FOOD_IMPORT_FILE_TYPES)[number];
+export declare const FOOD_IMPORT_ISSUE_SEVERITIES: readonly ["error", "warning"];
+export type FoodImportIssueSeverity = (typeof FOOD_IMPORT_ISSUE_SEVERITIES)[number];
+/** Whether a food takes one value of a metadata type or several. */
+export declare const FOOD_METADATA_SELECTIONS: readonly ["single", "multiple"];
+export type FoodMetadataSelection = (typeof FOOD_METADATA_SELECTIONS)[number];
+export declare const FOOD_SORT_FIELDS: readonly ["name", "updatedAt", "calories", "protein"];
+export type FoodSortField = (typeof FOOD_SORT_FIELDS)[number];
+export declare const SORT_ORDERS: readonly ["asc", "desc"];
+export type SortOrder = (typeof SORT_ORDERS)[number];

package/dist/cjs/enums/index.js

@@ -2,7 +2,7 @@
 // These values are stored in the database and sent over the API. Renaming or
 // removing one is a breaking change, so it needs a major version.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEMPLATE_STATUSES = exports.DELIVERY_STATUSES = exports.MESSAGE_TYPES = exports.COMMUNICATION_CHANNELS = exports.FEATURE_FLAG_RULE_TYPES = exports.AUDIT_OUTCOMES = exports.TOKEN_TRANSPORTS = exports.TIMEZONE_SOURCES = exports.ADMIN_SETTABLE_ACCOUNT_STATUSES = exports.ACCOUNT_STATUSES = exports.ROLES = exports.APP_ENVIRONMENTS = void 0;
+exports.SORT_ORDERS = exports.FOOD_SORT_FIELDS = exports.FOOD_METADATA_SELECTIONS = exports.FOOD_IMPORT_ISSUE_SEVERITIES = exports.FOOD_IMPORT_FILE_TYPES = exports.FOOD_IMPORT_ROW_STATUSES = exports.FOOD_IMPORT_STATUSES = exports.FOOD_IMPORT_MODES = exports.FOOD_SUGGESTION_RESOLUTIONS = exports.FOOD_SUGGESTION_STATUSES = exports.NUTRITION_BASES = exports.PORTION_UNITS = exports.SERVING_UNITS = exports.FOOD_SOURCES = exports.TEMPLATE_STATUSES = exports.DELIVERY_STATUSES = exports.MESSAGE_TYPES = exports.COMMUNICATION_CHANNELS = exports.FEATURE_FLAG_RULE_TYPES = exports.AUDIT_OUTCOMES = exports.CSRF_HEADER = exports.CSRF_COOKIE_NAMES = exports.TOKEN_TRANSPORTS = exports.TIMEZONE_SOURCES = exports.ADMIN_SETTABLE_ACCOUNT_STATUSES = exports.ACCOUNT_STATUSES = exports.PERMISSIONS = exports.ROLES = exports.APP_ENVIRONMENTS = void 0;
 exports.APP_ENVIRONMENTS = [
     'development',
     'staging',
@@ -10,6 +10,36 @@ exports.APP_ENVIRONMENTS = [
 ];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
 exports.ROLES = ['ADMIN', 'COACH', 'CLIENT'];
+/**
+ * Every permission name the API grants. Renaming one is a breaking change:
+ * clients compare these strings with what the API returns, so one on the old
+ * name silently loses whatever it guards. Which role has which permission is a
+ * server decision, so that mapping stays in the backend.
+ */
+exports.PERMISSIONS = {
+    accountsManage: 'accounts:manage',
+    rolesManage: 'roles:manage',
+    auditRead: 'audit:read',
+    featureFlagsManage: 'feature_flags:manage',
+    appSettingsManage: 'app_settings:manage',
+    communicationTemplatesManage: 'communication_templates:manage',
+    clientsReadAny: 'clients:read:any',
+    clientsWriteAny: 'clients:write:any',
+    clientsReadAssigned: 'clients:read:assigned',
+    clientsWriteAssigned: 'clients:write:assigned',
+    clientsReadSelf: 'clients:read:self',
+    clientsWriteSelf: 'clients:write:self',
+    foodsRead: 'foods:read',
+    foodsCreate: 'foods:create',
+    foodsUpdate: 'foods:update',
+    foodsDelete: 'foods:delete',
+    foodsImport: 'foods:import',
+    foodMetadataManage: 'food_metadata:manage',
+    foodSuggestionsReview: 'food_suggestions:review',
+    foodsSearchSelf: 'foods:search:self',
+    foodSuggestionsSubmitSelf: 'food_suggestions:submit:self',
+    foodSuggestionsReadSelf: 'food_suggestions:read:self',
+};
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
  * own their email address. Such a user cannot sign in.
@@ -28,6 +58,17 @@ exports.ADMIN_SETTABLE_ACCOUNT_STATUSES = ['active', 'disabled'];
  */
 exports.TIMEZONE_SOURCES = ['AUTO', 'MANUAL'];
 exports.TOKEN_TRANSPORTS = ['body', 'cookie'];
+/**
+ * The CSRF cookie the API sets, which scripts may read. The `__Host-` name is
+ * used when cookies are Secure, because browsers only honour that prefix on
+ * Secure cookies.
+ */
+exports.CSRF_COOKIE_NAMES = {
+    secure: '__Host-tbs_csrf',
+    insecure: 'tbs_csrf',
+};
+/** The header that carries the CSRF token back to the API. */
+exports.CSRF_HEADER = 'x-csrf-token';
 exports.AUDIT_OUTCOMES = ['success', 'failure'];
 exports.FEATURE_FLAG_RULE_TYPES = [
     'user',
@@ -60,3 +101,58 @@ exports.DELIVERY_STATUSES = [
 ];
 /** Only one version of a template per message type and channel is active. */
 exports.TEMPLATE_STATUSES = ['draft', 'active', 'archived'];
+/** Who put a food into the library. */
+exports.FOOD_SOURCES = [
+    'ADMIN',
+    'COACH',
+    'CLIENT_SUGGESTION',
+    'IMPORT',
+];
+/**
+ * The unit a library serving is measured in. Nutrients are stored per 100 of
+ * this unit, so a food in `ml` holds values per 100 ml.
+ */
+exports.SERVING_UNITS = ['g', 'ml'];
+/** The portion units a client can pick when logging a food. */
+exports.PORTION_UNITS = ['BOWL', 'GRAM', 'PIECE', 'CUP'];
+/** Whether submitted nutrient values are per 100 units or per serving. */
+exports.NUTRITION_BASES = ['PER_100', 'PER_SERVING'];
+exports.FOOD_SUGGESTION_STATUSES = [
+    'pending',
+    'approved',
+    'rejected',
+    'withdrawn',
+];
+/** How an approved suggestion was resolved. */
+exports.FOOD_SUGGESTION_RESOLUTIONS = [
+    'ADDED_TO_LIBRARY',
+    'LINKED_TO_EXISTING',
+    'APPROVED_WITHOUT_LIBRARY',
+];
+/** What a bulk import does with a row whose food is already in the library. */
+exports.FOOD_IMPORT_MODES = [
+    'SKIP_DUPLICATES',
+    'UPDATE_EXISTING',
+];
+exports.FOOD_IMPORT_STATUSES = [
+    'previewed',
+    'completed',
+    'expired',
+];
+exports.FOOD_IMPORT_ROW_STATUSES = [
+    'valid',
+    'invalid',
+    'duplicate_in_file',
+    'duplicate_existing',
+];
+exports.FOOD_IMPORT_FILE_TYPES = ['csv', 'xlsx'];
+exports.FOOD_IMPORT_ISSUE_SEVERITIES = ['error', 'warning'];
+/** Whether a food takes one value of a metadata type or several. */
+exports.FOOD_METADATA_SELECTIONS = ['single', 'multiple'];
+exports.FOOD_SORT_FIELDS = [
+    'name',
+    'updatedAt',
+    'calories',
+    'protein',
+];
+exports.SORT_ORDERS = ['asc', 'desc'];

package/dist/cjs/feature-flags/feature-flag.dto.d.ts

@@ -140,3 +140,12 @@ export declare const killSwitchResponseSchema: z.ZodObject<{
     updatedAt: z.ZodNullable<z.ZodISODateTime>;
 }, z.core.$strip>;
 export type KillSwitchResponse = z.output<typeof killSwitchResponseSchema>;
+/**
+ * What a signed-in user may know about flags: only the keys that are on for
+ * them. It never holds rules, targeting values, rollout percentages or who
+ * changed what. A missing key means off, so always compare a value with `true`.
+ */
+export declare const evaluatedFlagsResponseSchema: z.ZodObject<{
+    flags: z.ZodRecord<z.ZodString, z.ZodBoolean>;
+}, z.core.$strip>;
+export type EvaluatedFlagsResponse = z.output<typeof evaluatedFlagsResponseSchema>;

package/dist/cjs/feature-flags/feature-flag.dto.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.killSwitchResponseSchema = exports.auditLogResponseSchema = exports.flagResponseSchema = exports.ruleResponseSchema = exports.flagListQuerySchema = exports.setKillSwitchSchema = exports.updateRuleSchema = exports.createRuleSchema = exports.updateFlagSchema = exports.createFlagSchema = exports.flagIdParamSchema = void 0;
+exports.evaluatedFlagsResponseSchema = exports.killSwitchResponseSchema = exports.auditLogResponseSchema = exports.flagResponseSchema = exports.ruleResponseSchema = exports.flagListQuerySchema = exports.setKillSwitchSchema = exports.updateRuleSchema = exports.createRuleSchema = exports.updateFlagSchema = exports.createFlagSchema = exports.flagIdParamSchema = void 0;
 const zod_1 = require("zod");
 const date_time_schema_js_1 = require("../common/date-time.schema.js");
 const pagination_schema_js_1 = require("../common/pagination.schema.js");
@@ -134,3 +134,11 @@ exports.killSwitchResponseSchema = zod_1.z.object({
     updatedBy: zod_1.z.uuid().nullable(),
     updatedAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
 });
+/**
+ * What a signed-in user may know about flags: only the keys that are on for
+ * them. It never holds rules, targeting values, rollout percentages or who
+ * changed what. A missing key means off, so always compare a value with `true`.
+ */
+exports.evaluatedFlagsResponseSchema = zod_1.z.object({
+    flags: zod_1.z.record(zod_1.z.string(), zod_1.z.boolean()),
+});

package/dist/cjs/food/client-food.dto.d.ts

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+export declare const MIN_CLIENT_FOOD_SEARCH_LENGTH = 2;
+export declare const clientFoodSearchQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodString;
+}, z.core.$strip>;
+export type ClientFoodSearchQuery = z.output<typeof clientFoodSearchQuerySchema>;
+/** A library food as a client sees it: what they need to log it, and nothing about who added it. */
+export declare const clientFoodResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    nameHi: z.ZodNullable<z.ZodString>;
+    namePa: z.ZodNullable<z.ZodString>;
+    englishAlias: z.ZodNullable<z.ZodString>;
+    serving: z.ZodObject<{
+        label: z.ZodString;
+        quantity: z.ZodNumber;
+        unit: z.ZodEnum<{
+            g: "g";
+            ml: "ml";
+        }>;
+    }, z.core.$strip>;
+    per100: z.ZodObject<{
+        calories: z.ZodNumber;
+        protein: z.ZodNumber;
+        carbs: z.ZodNumber;
+        fat: z.ZodNumber;
+        sugar: z.ZodNullable<z.ZodNumber>;
+        fiber: z.ZodNullable<z.ZodNumber>;
+        solubleFiber: z.ZodNullable<z.ZodNumber>;
+        insolubleFiber: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>;
+    perServing: z.ZodObject<{
+        calories: z.ZodNumber;
+        protein: z.ZodNumber;
+        carbs: z.ZodNumber;
+        fat: z.ZodNumber;
+        sugar: z.ZodNullable<z.ZodNumber>;
+        fiber: z.ZodNullable<z.ZodNumber>;
+        solubleFiber: z.ZodNullable<z.ZodNumber>;
+        insolubleFiber: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>;
+    tags: z.ZodArray<z.ZodObject<{
+        typeKey: z.ZodString;
+        label: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ClientFoodResponse = z.output<typeof clientFoodResponseSchema>;

package/dist/cjs/food/client-food.dto.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientFoodResponseSchema = exports.clientFoodSearchQuerySchema = exports.MIN_CLIENT_FOOD_SEARCH_LENGTH = void 0;
+const zod_1 = require("zod");
+const pagination_schema_js_1 = require("../common/pagination.schema.js");
+const food_dto_js_1 = require("./food.dto.js");
+exports.MIN_CLIENT_FOOD_SEARCH_LENGTH = 2;
+exports.clientFoodSearchQuerySchema = pagination_schema_js_1.paginationQuerySchema.extend({
+    search: zod_1.z
+        .string()
+        .trim()
+        .min(exports.MIN_CLIENT_FOOD_SEARCH_LENGTH)
+        .max(food_dto_js_1.MAX_FOOD_SEARCH_LENGTH),
+});
+/** A library food as a client sees it: what they need to log it, and nothing about who added it. */
+exports.clientFoodResponseSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    name: zod_1.z.string(),
+    nameHi: zod_1.z.string().nullable(),
+    namePa: zod_1.z.string().nullable(),
+    englishAlias: zod_1.z.string().nullable(),
+    serving: food_dto_js_1.servingResponseSchema,
+    per100: food_dto_js_1.nutrientValuesResponseSchema,
+    perServing: food_dto_js_1.nutrientValuesResponseSchema,
+    tags: zod_1.z.array(zod_1.z.object({ typeKey: zod_1.z.string(), label: zod_1.z.string() })),
+});

package/dist/cjs/food/food-import.dto.d.ts

@@ -0,0 +1,160 @@
+import { z } from 'zod';
+/** The file limits the API enforces, shared so the upload screen can say them up front. */
+export declare const FOOD_IMPORT_LIMITS: {
+    readonly maxFileBytes: number;
+    readonly maxRows: 5000;
+    readonly extensions: readonly [".csv", ".xlsx"];
+};
+export declare const importIdParamSchema: z.ZodUUID;
+/**
+ * One spreadsheet row after its cells are read. Values per 100 g (or per 100 ml
+ * for a serving in ml). Metadata are keys such as `protein` or `high-protein`,
+ * matched to the library's values. Has no defaults, so it also serves as the
+ * preview response.
+ */
+export declare const foodImportRowSchema: z.ZodObject<{
+    name: z.ZodString;
+    nameHi: z.ZodNullable<z.ZodString>;
+    namePa: z.ZodNullable<z.ZodString>;
+    englishAlias: z.ZodNullable<z.ZodString>;
+    category: z.ZodString;
+    subcategory: z.ZodNullable<z.ZodString>;
+    servingLabel: z.ZodString;
+    servingQuantity: z.ZodNumber;
+    servingUnit: z.ZodEnum<{
+        g: "g";
+        ml: "ml";
+    }>;
+    calories: z.ZodNumber;
+    protein: z.ZodNumber;
+    carbs: z.ZodNumber;
+    fat: z.ZodNumber;
+    sugar: z.ZodNullable<z.ZodNumber>;
+    fiber: z.ZodNullable<z.ZodNumber>;
+    solubleFiber: z.ZodNullable<z.ZodNumber>;
+    insolubleFiber: z.ZodNullable<z.ZodNumber>;
+    tags: z.ZodArray<z.ZodString>;
+    mealTimings: z.ZodArray<z.ZodString>;
+    notes: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type FoodImportRow = z.output<typeof foodImportRowSchema>;
+export declare const commitFoodImportSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        SKIP_DUPLICATES: "SKIP_DUPLICATES";
+        UPDATE_EXISTING: "UPDATE_EXISTING";
+    }>>;
+    createMissingMetadata: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type CommitFoodImportInput = z.input<typeof commitFoodImportSchema>;
+export type CommitFoodImportBody = z.output<typeof commitFoodImportSchema>;
+export declare const foodImportListQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const foodImportRowsQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        valid: "valid";
+        invalid: "invalid";
+        duplicate_in_file: "duplicate_in_file";
+        duplicate_existing: "duplicate_existing";
+    }>>;
+}, z.core.$strip>;
+export type FoodImportRowsQuery = z.output<typeof foodImportRowsQuerySchema>;
+export declare const foodImportIssueSchema: z.ZodObject<{
+    column: z.ZodNullable<z.ZodString>;
+    code: z.ZodString;
+    message: z.ZodString;
+    severity: z.ZodEnum<{
+        error: "error";
+        warning: "warning";
+    }>;
+}, z.core.$strip>;
+export type FoodImportIssue = z.output<typeof foodImportIssueSchema>;
+export declare const foodImportBatchResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    fileName: z.ZodString;
+    fileType: z.ZodEnum<{
+        csv: "csv";
+        xlsx: "xlsx";
+    }>;
+    sheetName: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        previewed: "previewed";
+        completed: "completed";
+        expired: "expired";
+    }>;
+    mode: z.ZodNullable<z.ZodEnum<{
+        SKIP_DUPLICATES: "SKIP_DUPLICATES";
+        UPDATE_EXISTING: "UPDATE_EXISTING";
+    }>>;
+    createMissingMetadata: z.ZodBoolean;
+    totalRows: z.ZodNumber;
+    validRows: z.ZodNumber;
+    invalidRows: z.ZodNumber;
+    duplicateRows: z.ZodNumber;
+    emptyRows: z.ZodNumber;
+    createdCount: z.ZodNumber;
+    updatedCount: z.ZodNumber;
+    skippedCount: z.ZodNumber;
+    unknownMetadata: z.ZodArray<z.ZodObject<{
+        typeKey: z.ZodString;
+        values: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    ignoredColumns: z.ZodArray<z.ZodString>;
+    ignoredSheets: z.ZodArray<z.ZodString>;
+    uploadedBy: z.ZodUUID;
+    expiresAt: z.ZodISODateTime;
+    committedAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type FoodImportBatchResponse = z.output<typeof foodImportBatchResponseSchema>;
+export declare const foodImportRowResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    rowNumber: z.ZodNumber;
+    status: z.ZodEnum<{
+        valid: "valid";
+        invalid: "invalid";
+        duplicate_in_file: "duplicate_in_file";
+        duplicate_existing: "duplicate_existing";
+    }>;
+    raw: z.ZodRecord<z.ZodString, z.ZodString>;
+    parsed: z.ZodNullable<z.ZodObject<{
+        name: z.ZodString;
+        nameHi: z.ZodNullable<z.ZodString>;
+        namePa: z.ZodNullable<z.ZodString>;
+        englishAlias: z.ZodNullable<z.ZodString>;
+        category: z.ZodString;
+        subcategory: z.ZodNullable<z.ZodString>;
+        servingLabel: z.ZodString;
+        servingQuantity: z.ZodNumber;
+        servingUnit: z.ZodEnum<{
+            g: "g";
+            ml: "ml";
+        }>;
+        calories: z.ZodNumber;
+        protein: z.ZodNumber;
+        carbs: z.ZodNumber;
+        fat: z.ZodNumber;
+        sugar: z.ZodNullable<z.ZodNumber>;
+        fiber: z.ZodNullable<z.ZodNumber>;
+        solubleFiber: z.ZodNullable<z.ZodNumber>;
+        insolubleFiber: z.ZodNullable<z.ZodNumber>;
+        tags: z.ZodArray<z.ZodString>;
+        mealTimings: z.ZodArray<z.ZodString>;
+        notes: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    issues: z.ZodArray<z.ZodObject<{
+        column: z.ZodNullable<z.ZodString>;
+        code: z.ZodString;
+        message: z.ZodString;
+        severity: z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+        }>;
+    }, z.core.$strip>>;
+    matchedFoodId: z.ZodNullable<z.ZodUUID>;
+    resultFoodId: z.ZodNullable<z.ZodUUID>;
+}, z.core.$strip>;
+export type FoodImportRowResponse = z.output<typeof foodImportRowResponseSchema>;