@veruna/api-contracts 19.1.0 → 20.1.0

package/build/shared/common-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"common-schemas.js","sourceRoot":"","sources":["../../shared/common-schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,mCAA0D;AAOnD,MAAM,gBAAgB,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;IAChD,MAAM,MAAM,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC,CAAC;AAPW,QAAA,gBAAgB,oBAO3B;AAKW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAKnC,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAU,CAAC;CACrC,CAAC,CAAC;AAMU,QAAA,kBAAkB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,2BAAmB,EAAE,uCAAuC,CAAC,CAAC;AAOlE,MAAM,qBAAqB,GAAG,CAAC,gBAAwB,EAAE,eAAuB,EAAE,EAAE,CACvF,OAAC;KACI,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;KACnC,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;KACtC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;KACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAN5D,QAAA,qBAAqB,yBAMuC"}
+{"version":3,"file":"common-schemas.js","sourceRoot":"","sources":["../../shared/common-schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,mCAA0D;AAE1D;;;;GAIG;AACI,MAAM,gBAAgB,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;IAChD,MAAM,MAAM,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC,CAAC;AAPW,QAAA,gBAAgB,oBAO3B;AAEF;;GAEG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhD;;GAEG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAU,CAAC;CACrC,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,2BAAmB,EAAE,uCAAuC,CAAC,CAAC;AAEzE;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CAAC,gBAAwB,EAAE,eAAuB,EAAE,EAAE,CACvF,OAAC;KACI,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;KACnC,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;KACtC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;KACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAN5D,QAAA,qBAAqB,yBAMuC"}

package/build/shared/constants.d.ts

@@ -1,5 +1,11 @@
 export declare const MESSAGE_TEXT_MAX_LENGTH = 500000;
+/**
+ * Time constants in milliseconds
+ */
 export declare const MS_PER_DAY = 86400000;
 export declare const MS_PER_WEEK = 604800000;
 export declare const MS_6_DAYS = 518400000;
+/**
+ * Fallback display name when user name is unavailable
+ */
 export declare const DEFAULT_USER_DISPLAY_NAME = "User";

package/build/shared/constants.js

@@ -2,8 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_USER_DISPLAY_NAME = exports.MS_6_DAYS = exports.MS_PER_WEEK = exports.MS_PER_DAY = exports.MESSAGE_TEXT_MAX_LENGTH = void 0;
 exports.MESSAGE_TEXT_MAX_LENGTH = 500_000;
-exports.MS_PER_DAY = 86_400_000;
-exports.MS_PER_WEEK = 604_800_000;
-exports.MS_6_DAYS = 518_400_000;
+/**
+ * Time constants in milliseconds
+ */
+exports.MS_PER_DAY = 86_400_000; // 24 * 60 * 60 * 1000
+exports.MS_PER_WEEK = 604_800_000; // 7 * 24 * 60 * 60 * 1000
+exports.MS_6_DAYS = 518_400_000; // 6 * 24 * 60 * 60 * 1000
+/**
+ * Fallback display name when user name is unavailable
+ */
 exports.DEFAULT_USER_DISPLAY_NAME = 'User';
 //# sourceMappingURL=constants.js.map

package/build/shared/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../shared/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAKlC,QAAA,UAAU,GAAG,UAAU,CAAC;AACxB,QAAA,WAAW,GAAG,WAAW,CAAC;AAC1B,QAAA,SAAS,GAAG,WAAW,CAAC;AAKxB,QAAA,yBAAyB,GAAG,MAAM,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../shared/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAE/C;;GAEG;AACU,QAAA,UAAU,GAAG,UAAU,CAAC,CAAC,sBAAsB;AAC/C,QAAA,WAAW,GAAG,WAAW,CAAC,CAAC,0BAA0B;AACrD,QAAA,SAAS,GAAG,WAAW,CAAC,CAAC,0BAA0B;AAEhE;;GAEG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC"}

package/build/shared/device-type.enum.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Device Type Enum
+ * Used for classifying devices based on User-Agent parsing
+ */
 export declare enum DeviceType {
     MOBILE = "MOBILE",
     TABLET = "TABLET",

package/build/shared/device-type.enum.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceType = void 0;
+/**
+ * Device Type Enum
+ * Used for classifying devices based on User-Agent parsing
+ */
 var DeviceType;
 (function (DeviceType) {
     DeviceType["MOBILE"] = "MOBILE";

package/build/shared/device-type.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-type.enum.js","sourceRoot":"","sources":["../../shared/device-type.enum.ts"],"names":[],"mappings":";;;AAIA,IAAY,UAMX;AAND,WAAY,UAAU;IAClB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,kCAAoB,CAAA;IACpB,mCAAqB,CAAA;IACrB,iCAAmB,CAAA;AACvB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB"}
+{"version":3,"file":"device-type.enum.js","sourceRoot":"","sources":["../../shared/device-type.enum.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,IAAY,UAMX;AAND,WAAY,UAAU;IAClB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,kCAAoB,CAAA;IACpB,mCAAqB,CAAA;IACrB,iCAAmB,CAAA;AACvB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB"}

package/build/shared/error-metadata.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Error metadata interface
+ * Describes error code and HTTP status
+ * Message mapping is handled on the frontend
+ */
 export interface ErrorMetadata {
     code: string;
     statusCode: number;

package/build/shared/frontend-routes.d.ts

@@ -1,13 +1,33 @@
 import { ProfileAnchor } from './profile-anchor.enum';
 import { ProfileTab } from './profile-tab.enum';
 import { TariffsAnchor } from './tariffs-anchor.enum';
+/**
+ * Frontend page routes used to build notification CTA links (ctaUrl / ctaPath).
+ * Single source of truth shared by the backend (notification registry + email
+ * templates) and the frontend, so a route rename never desyncs the two.
+ */
 export declare const PAGE_ROUTES: {
     readonly HOME: "/";
     readonly DAILY_REWARDS: "/daily-rewards";
     readonly TARIFFS: "/tariffs";
+    /**
+     * Страница подтверждения отписки из письма. Сама по GET ничего не меняет — почтовые
+     * сканеры заранее открывают ссылки; отписывает кнопка на странице (POST в API).
+     */
     readonly UNSUBSCRIBE: (messageId: string, token: string) => string;
 };
+/**
+ * Query-параметр, которым промокод доезжает до чекаута. Единственная точка правды: бэк кладёт
+ * его в ссылку кнопки, фронт снимает и подставляет в оплату. Без него конверсия оффера
+ * недостижима — она считается только по погашению кода.
+ */
 export declare const PROMO_CODE_QUERY_PARAM: "promo";
+/** Дописывает промокод к ссылке, сохраняя уже имеющиеся query-параметры и якорь. */
 export declare function withPromoCode(url: string, promoCode: string): string;
+/** Builds a profile deep-link: /profile/my?tab=<tab>[#<anchor>]. */
 export declare function buildProfileUrl(tab: ProfileTab, anchor?: ProfileAnchor): string;
+/**
+ * Builds a tariffs deep-link: /tariffs[#<anchor>]. Without an anchor the page opens on
+ * subscriptions; `TariffsAnchor.PACKAGES` opens the one-time packages view.
+ */
 export declare function buildTariffsUrl(anchor?: TariffsAnchor): string;

package/build/shared/frontend-routes.js

@@ -4,22 +4,42 @@ exports.PROMO_CODE_QUERY_PARAM = exports.PAGE_ROUTES = void 0;
 exports.withPromoCode = withPromoCode;
 exports.buildProfileUrl = buildProfileUrl;
 exports.buildTariffsUrl = buildTariffsUrl;
+/**
+ * Frontend page routes used to build notification CTA links (ctaUrl / ctaPath).
+ * Single source of truth shared by the backend (notification registry + email
+ * templates) and the frontend, so a route rename never desyncs the two.
+ */
 exports.PAGE_ROUTES = {
     HOME: '/',
     DAILY_REWARDS: '/daily-rewards',
     TARIFFS: '/tariffs',
+    /**
+     * Страница подтверждения отписки из письма. Сама по GET ничего не меняет — почтовые
+     * сканеры заранее открывают ссылки; отписывает кнопка на странице (POST в API).
+     */
     UNSUBSCRIBE: (messageId, token) => `/unsubscribe/${messageId}/${token}`,
 };
+/**
+ * Query-параметр, которым промокод доезжает до чекаута. Единственная точка правды: бэк кладёт
+ * его в ссылку кнопки, фронт снимает и подставляет в оплату. Без него конверсия оффера
+ * недостижима — она считается только по погашению кода.
+ */
 exports.PROMO_CODE_QUERY_PARAM = 'promo';
+/** Дописывает промокод к ссылке, сохраняя уже имеющиеся query-параметры и якорь. */
 function withPromoCode(url, promoCode) {
     const [withoutHash, hash] = url.split('#');
     const separator = withoutHash.includes('?') ? '&' : '?';
     const withPromo = `${withoutHash}${separator}${exports.PROMO_CODE_QUERY_PARAM}=${encodeURIComponent(promoCode)}`;
     return hash === undefined ? withPromo : `${withPromo}#${hash}`;
 }
+/** Builds a profile deep-link: /profile/my?tab=<tab>[#<anchor>]. */
 function buildProfileUrl(tab, anchor) {
     return `/profile/my?tab=${tab}${anchor ? `#${anchor}` : ''}`;
 }
+/**
+ * Builds a tariffs deep-link: /tariffs[#<anchor>]. Without an anchor the page opens on
+ * subscriptions; `TariffsAnchor.PACKAGES` opens the one-time packages view.
+ */
 function buildTariffsUrl(anchor) {
     return `${exports.PAGE_ROUTES.TARIFFS}${anchor ? `#${anchor}` : ''}`;
 }

package/build/shared/frontend-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-routes.js","sourceRoot":"","sources":["../../shared/frontend-routes.ts"],"names":[],"mappings":";;;AA4BA,sCAMC;AAGD,0CAEC;AAMD,0CAEC;AAtCY,QAAA,WAAW,GAAG;IACvB,IAAI,EAAE,GAAG;IACT,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IAKnB,WAAW,EAAE,CAAC,SAAiB,EAAE,KAAa,EAAE,EAAE,CAAC,gBAAgB,SAAS,IAAI,KAAK,EAAE;CACjF,CAAC;AAOE,QAAA,sBAAsB,GAAG,OAAgB,CAAC;AAGvD,SAAgB,aAAa,CAAC,GAAW,EAAE,SAAiB;IACxD,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,WAAW,GAAG,SAAS,GAAG,8BAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAEzG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;AACnE,CAAC;AAGD,SAAgB,eAAe,CAAC,GAAe,EAAE,MAAsB;IACnE,OAAO,mBAAmB,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC;AAMD,SAAgB,eAAe,CAAC,MAAsB;IAClD,OAAO,GAAG,mBAAW,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"frontend-routes.js","sourceRoot":"","sources":["../../shared/frontend-routes.ts"],"names":[],"mappings":";;;AA4BA,sCAMC;AAGD,0CAEC;AAMD,0CAEC;AA3CD;;;;GAIG;AACU,QAAA,WAAW,GAAG;IACvB,IAAI,EAAE,GAAG;IACT,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,UAAU;IACnB;;;OAGG;IACH,WAAW,EAAE,CAAC,SAAiB,EAAE,KAAa,EAAE,EAAE,CAAC,gBAAgB,SAAS,IAAI,KAAK,EAAE;CACjF,CAAC;AAEX;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,OAAgB,CAAC;AAEvD,oFAAoF;AACpF,SAAgB,aAAa,CAAC,GAAW,EAAE,SAAiB;IACxD,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,WAAW,GAAG,SAAS,GAAG,8BAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAEzG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAAC,GAAe,EAAE,MAAsB;IACnE,OAAO,mBAAmB,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAsB;IAClD,OAAO,GAAG,mBAAW,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC"}

package/build/shared/http-method.enum.d.ts

@@ -1,3 +1,6 @@
+/**
+ * HTTP Methods enum
+ */
 export declare enum HttpMethod {
     GET = "GET",
     POST = "POST",

package/build/shared/http-method.enum.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HttpMethod = void 0;
+/**
+ * HTTP Methods enum
+ */
 var HttpMethod;
 (function (HttpMethod) {
     HttpMethod["GET"] = "GET";

package/build/shared/http-method.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-method.enum.js","sourceRoot":"","sources":["../../shared/http-method.enum.ts"],"names":[],"mappings":";;;AAGA,IAAY,UAMX;AAND,WAAY,UAAU;IAClB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;AACrB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB"}
+{"version":3,"file":"http-method.enum.js","sourceRoot":"","sources":["../../shared/http-method.enum.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,IAAY,UAMX;AAND,WAAY,UAAU;IAClB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;AACrB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB"}

package/build/shared/metadata.schema.d.ts

@@ -1,12 +1,49 @@
 import { z } from 'zod';
+/**
+ * Configuration for `createMetadataSchema`. Every module that
+ * accepts free-form JSON metadata must declare explicit limits —
+ * there is no default size because it varies by use case.
+ */
 export interface MetadataSchemaOptions {
+    /** Max serialized size in bytes (after `JSON.stringify`). */
     maxBytes: number;
+    /** Max nesting depth for objects and arrays. */
     maxDepth: number;
+    /** Max number of top-level keys. */
     maxKeys: number;
+    /** Max length of each individual string value. Defaults to 1000. */
     maxStringLength?: number;
+    /** Max length of each array value. Defaults to 50. */
     maxArrayLength?: number;
 }
+/**
+ * Builds a Zod schema for free-form JSON metadata with security
+ * protections baked in:
+ *
+ *  - **Prototype pollution guard** — rejects objects that contain
+ *    `__proto__`, `constructor`, or `prototype` at any depth.
+ *  - **Safe key names** — keys must match
+ *    `^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$`.
+ *  - **Typed primitive values** — string / number / boolean / null,
+ *    plus bounded arrays and nested records.
+ *  - **Size / depth / key count limits** — configurable per caller.
+ *
+ * The returned schema is intentionally NOT wrapped in
+ * `.optional()` / `.nullable()` — callers compose those as needed.
+ *
+ * Refinement messages use i18n-style keys (`metadata.tooLarge`,
+ * `metadata.tooDeep`, …) so frontends can localise them.
+ */
 export declare function createMetadataSchema(options: MetadataSchemaOptions): z.ZodRecord<z.ZodString, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+/**
+ * Generic success/failure helper for modules that want a simple
+ * "validate this unknown blob" entrypoint. Handles `null` /
+ * `undefined` as "no metadata" (valid with `data: null`) so callers
+ * don't need to special-case empty input.
+ *
+ * Returns the parsed record on success so callers know they can
+ * persist it verbatim.
+ */
 export declare function validateMetadataWith(schema: ReturnType<typeof createMetadataSchema>, metadata: unknown): {
     valid: true;
     data: Record<string, unknown> | null;

package/build/shared/metadata.schema.js

@@ -3,8 +3,36 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMetadataSchema = createMetadataSchema;
 exports.validateMetadataWith = validateMetadataWith;
 const zod_1 = require("zod");
+/**
+ * Keys that could be used for prototype pollution attacks.
+ * Any metadata object containing these keys is rejected outright.
+ */
 const FORBIDDEN_KEYS = ['__proto__', 'constructor', 'prototype'];
+/**
+ * Safe key regex: starts with a letter or underscore, then up to 63
+ * alphanumerics / underscores / dashes. Matches wallet module's
+ * original validation; chosen to be portable across JSON databases
+ * and common UI frameworks.
+ */
 const SAFE_KEY_REGEX = /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/;
+/**
+ * Builds a Zod schema for free-form JSON metadata with security
+ * protections baked in:
+ *
+ *  - **Prototype pollution guard** — rejects objects that contain
+ *    `__proto__`, `constructor`, or `prototype` at any depth.
+ *  - **Safe key names** — keys must match
+ *    `^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$`.
+ *  - **Typed primitive values** — string / number / boolean / null,
+ *    plus bounded arrays and nested records.
+ *  - **Size / depth / key count limits** — configurable per caller.
+ *
+ * The returned schema is intentionally NOT wrapped in
+ * `.optional()` / `.nullable()` — callers compose those as needed.
+ *
+ * Refinement messages use i18n-style keys (`metadata.tooLarge`,
+ * `metadata.tooDeep`, …) so frontends can localise them.
+ */
 function createMetadataSchema(options) {
     const maxStringLength = options.maxStringLength ?? 1000;
     const maxArrayLength = options.maxArrayLength ?? 50;
@@ -24,6 +52,9 @@ function createMetadataSchema(options) {
             return JSON.stringify(obj).length <= options.maxBytes;
         }
         catch {
+            // JSON.stringify throws on BigInt, circular refs, or
+            // similar non-serialisable values. Reject them outright
+            // — metadata must be plain serialisable JSON.
             return false;
         }
     }, { message: 'metadata.tooLarge' })
@@ -37,9 +68,20 @@ function createMetadataSchema(options) {
         message: 'metadata.tooDeep',
     });
 }
+/**
+ * Type guard: narrows `unknown` to a plain record (non-null object
+ * that is not an array). Used by `hasForbiddenKeys` and `getDepth`
+ * so we can access keys without a type assertion.
+ */
 function isPlainRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/**
+ * Recursively walks an object / array checking for prototype-pollution
+ * key names. Uses a generous safety rail on recursion depth so it
+ * cannot be abused to blow the call stack even if depth validation
+ * is somehow bypassed.
+ */
 function hasForbiddenKeys(obj, depth = 0) {
     const MAX_RECURSION = 64;
     if (depth > MAX_RECURSION)
@@ -57,6 +99,16 @@ function hasForbiddenKeys(obj, depth = 0) {
     }
     return false;
 }
+/**
+ * Calculates the maximum nesting depth of an object / array graph.
+ * Primitive values (and empty objects / arrays) count as depth 0.
+ *
+ * Uses a generous `MAX_RECURSION` safety rail so a maliciously
+ * crafted deeply-nested payload cannot blow the call stack. Payloads
+ * that exceed the rail bottom out at the rail depth and will
+ * consequently fail the caller's `maxDepth` refinement (which is
+ * always lower than `MAX_RECURSION`), rejecting the input cleanly.
+ */
 function getDepth(obj, currentDepth = 0) {
     const MAX_RECURSION = 64;
     if (currentDepth > MAX_RECURSION) {
@@ -75,6 +127,15 @@ function getDepth(obj, currentDepth = 0) {
         return currentDepth;
     return Math.max(...values.map((value) => getDepth(value, currentDepth + 1)));
 }
+/**
+ * Generic success/failure helper for modules that want a simple
+ * "validate this unknown blob" entrypoint. Handles `null` /
+ * `undefined` as "no metadata" (valid with `data: null`) so callers
+ * don't need to special-case empty input.
+ *
+ * Returns the parsed record on success so callers know they can
+ * persist it verbatim.
+ */
 function validateMetadataWith(schema, metadata) {
     if (metadata === undefined || metadata === null) {
         return { valid: true, data: null };

package/build/shared/metadata.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.schema.js","sourceRoot":"","sources":["../../shared/metadata.schema.ts"],"names":[],"mappings":";;AAoDA,oDAyCC;AA8ED,oDAsBC;AAjMD,6BAAwB;AAMxB,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAQjE,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAsCxD,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAEpD,MAAM,aAAa,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAuB,OAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAChD,OAAC,CAAC,KAAK,CAAC;QACJ,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,OAAC,CAAC,MAAM,EAAE;QACV,OAAC,CAAC,OAAO,EAAE;QACX,OAAC,CAAC,IAAI,EAAE;QACR,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,OAAC,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;KACvC,CAAC,CACL,CAAC;IAEF,OAAO,OAAC;SACH,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;SAClC,MAAM,CACH,CAAC,GAAG,EAAE,EAAE;QACJ,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YAIL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,EACD,EAAE,OAAO,EAAE,mBAAmB,EAAE,CACnC;SACA,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE;QACzD,OAAO,EAAE,sBAAsB;KAClC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE;QACrC,OAAO,EAAE,wBAAwB;KACpC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE;QAChD,OAAO,EAAE,kBAAkB;KAC9B,CAAC,CAAC;AACX,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAQD,SAAS,gBAAgB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC7C,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,aAAa;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAYD,SAAS,QAAQ,CAAC,GAAY,EAAE,YAAY,GAAG,CAAC;IAC5C,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC1C,OAAO,IAAI,CAAC,GAAG,CACX,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CACzD,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CACX,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;AACN,CAAC;AAWD,SAAgB,oBAAoB,CAChC,MAA+C,EAC/C,QAAiB;IAIjB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,kBAAkB;SAC/D,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,MAAM,CAAC,IAAsC;KACtD,CAAC;AACN,CAAC"}
+{"version":3,"file":"metadata.schema.js","sourceRoot":"","sources":["../../shared/metadata.schema.ts"],"names":[],"mappings":";;AAoDA,oDAyCC;AA8ED,oDAsBC;AAjMD,6BAAwB;AAExB;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAoBxD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAEpD,MAAM,aAAa,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAuB,OAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAChD,OAAC,CAAC,KAAK,CAAC;QACJ,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,OAAC,CAAC,MAAM,EAAE;QACV,OAAC,CAAC,OAAO,EAAE;QACX,OAAC,CAAC,IAAI,EAAE;QACR,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,OAAC,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;KACvC,CAAC,CACL,CAAC;IAEF,OAAO,OAAC;SACH,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;SAClC,MAAM,CACH,CAAC,GAAG,EAAE,EAAE;QACJ,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACL,qDAAqD;YACrD,wDAAwD;YACxD,8CAA8C;YAC9C,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,EACD,EAAE,OAAO,EAAE,mBAAmB,EAAE,CACnC;SACA,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE;QACzD,OAAO,EAAE,sBAAsB;KAClC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE;QACrC,OAAO,EAAE,wBAAwB;KACpC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE;QAChD,OAAO,EAAE,kBAAkB;KAC9B,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IAC7C,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,aAAa;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,GAAY,EAAE,YAAY,GAAG,CAAC;IAC5C,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC1C,OAAO,IAAI,CAAC,GAAG,CACX,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CACzD,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CACX,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAChC,MAA+C,EAC/C,QAAiB;IAIjB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,kBAAkB;SAC/D,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,MAAM,CAAC,IAAsC;KACtD,CAAC;AACN,CAAC"}

package/build/shared/pagination.schema.d.ts

@@ -1,9 +1,16 @@
 import { z } from 'zod';
+/**
+ * Pagination query params schema
+ * Error messages: PaginationQuery.{field}.{rule}
+ */
 export declare const PaginationQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
 }, z.core.$strip>;
 export type PaginationQuery = z.infer<typeof PaginationQuerySchema>;
+/**
+ * Pagination metadata schema
+ */
 export declare const PaginationMetaSchema: z.ZodObject<{
     page: z.ZodNumber;
     limit: z.ZodNumber;
@@ -13,6 +20,9 @@ export declare const PaginationMetaSchema: z.ZodObject<{
     hasPrev: z.ZodBoolean;
 }, z.core.$strip>;
 export type PaginationMeta = z.infer<typeof PaginationMetaSchema>;
+/**
+ * Paginated response schema
+ */
 export declare const createPaginatedResponseSchema: <T extends z.ZodType>(itemSchema: T) => z.ZodObject<{
     data: z.ZodArray<T>;
     meta: z.ZodObject<{

package/build/shared/pagination.schema.js

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPaginatedResponseSchema = exports.PaginationMetaSchema = exports.PaginationQuerySchema = void 0;
 const zod_1 = require("zod");
+/**
+ * Pagination query params schema
+ * Error messages: PaginationQuery.{field}.{rule}
+ */
 exports.PaginationQuerySchema = zod_1.z.object({
     page: zod_1.z.coerce
         .number()
@@ -15,6 +19,9 @@ exports.PaginationQuerySchema = zod_1.z.object({
         .max(100, { message: 'PaginationQuery.limit.max' })
         .default(10),
 });
+/**
+ * Pagination metadata schema
+ */
 exports.PaginationMetaSchema = zod_1.z.object({
     page: zod_1.z.number().int().positive(),
     limit: zod_1.z.number().int().positive(),
@@ -23,6 +30,9 @@ exports.PaginationMetaSchema = zod_1.z.object({
     hasNext: zod_1.z.boolean(),
     hasPrev: zod_1.z.boolean(),
 });
+/**
+ * Paginated response schema
+ */
 const createPaginatedResponseSchema = (itemSchema) => zod_1.z.object({
     data: zod_1.z.array(itemSchema),
     meta: exports.PaginationMetaSchema,

package/build/shared/pagination.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.schema.js","sourceRoot":"","sources":["../../shared/pagination.schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAMX,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,MAAM;SACX,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;SAChD,QAAQ,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;SACrD,OAAO,CAAC,CAAC,CAAC;IACb,KAAK,EAAE,OAAC,CAAC,MAAM;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SACjD,QAAQ,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SACtD,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;SAClD,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAOU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAOI,MAAM,6BAA6B,GAAG,CAAsB,UAAa,EAAE,EAAE,CAClF,OAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACzB,IAAI,EAAE,4BAAoB;CAC3B,CAAC,CAAC;AAJQ,QAAA,6BAA6B,iCAIrC"}
+{"version":3,"file":"pagination.schema.js","sourceRoot":"","sources":["../../shared/pagination.schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB;;;GAGG;AACU,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,MAAM;SACX,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;SAChD,QAAQ,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;SACrD,OAAO,CAAC,CAAC,CAAC;IACb,KAAK,EAAE,OAAC,CAAC,MAAM;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SACjD,QAAQ,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;SACtD,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;SAClD,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAIH;;GAEG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAIH;;GAEG;AACI,MAAM,6BAA6B,GAAG,CAAsB,UAAa,EAAE,EAAE,CAClF,OAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACzB,IAAI,EAAE,4BAAoB;CAC3B,CAAC,CAAC;AAJQ,QAAA,6BAA6B,iCAIrC"}

package/build/shared/profile-anchor.enum.d.ts

@@ -1,3 +1,4 @@
+/** Deep-link anchors inside a profile tab (…#<anchor>). */
 export declare enum ProfileAnchor {
     EMAIL = "email",
     CHANGE_TARIFF = "change-tariff",

package/build/shared/profile-anchor.enum.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProfileAnchor = void 0;
+/** Deep-link anchors inside a profile tab (…#<anchor>). */
 var ProfileAnchor;
 (function (ProfileAnchor) {
     ProfileAnchor["EMAIL"] = "email";

package/build/shared/profile-anchor.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile-anchor.enum.js","sourceRoot":"","sources":["../../shared/profile-anchor.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,aAIX;AAJD,WAAY,aAAa;IACrB,gCAAe,CAAA;IACf,gDAA+B,CAAA;IAC/B,sCAAqB,CAAA;AACzB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB"}
+{"version":3,"file":"profile-anchor.enum.js","sourceRoot":"","sources":["../../shared/profile-anchor.enum.ts"],"names":[],"mappings":";;;AAAA,2DAA2D;AAC3D,IAAY,aAIX;AAJD,WAAY,aAAa;IACrB,gCAAe,CAAA;IACf,gDAA+B,CAAA;IAC/B,sCAAqB,CAAA;AACzB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB"}

package/build/shared/profile-tab.enum.d.ts

@@ -1,3 +1,4 @@
+/** Tabs on the frontend profile page (/profile/my?tab=<tab>). */
 export declare enum ProfileTab {
     PROFILE = "profile",
     SUBSCRIPTION = "subscription",

package/build/shared/profile-tab.enum.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProfileTab = void 0;
+/** Tabs on the frontend profile page (/profile/my?tab=<tab>). */
 var ProfileTab;
 (function (ProfileTab) {
     ProfileTab["PROFILE"] = "profile";

package/build/shared/profile-tab.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile-tab.enum.js","sourceRoot":"","sources":["../../shared/profile-tab.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,UAUX;AAVD,WAAY,UAAU;IAClB,iCAAmB,CAAA;IACnB,2CAA6B,CAAA;IAC7B,mCAAqB,CAAA;IACrB,6CAA+B,CAAA;IAC/B,2CAA6B,CAAA;IAC7B,2CAA6B,CAAA;IAC7B,6BAAe,CAAA;IACf,iCAAmB,CAAA;IACnB,uCAAyB,CAAA;AAC7B,CAAC,EAVW,UAAU,0BAAV,UAAU,QAUrB"}
+{"version":3,"file":"profile-tab.enum.js","sourceRoot":"","sources":["../../shared/profile-tab.enum.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AACjE,IAAY,UAUX;AAVD,WAAY,UAAU;IAClB,iCAAmB,CAAA;IACnB,2CAA6B,CAAA;IAC7B,mCAAqB,CAAA;IACrB,6CAA+B,CAAA;IAC/B,2CAA6B,CAAA;IAC7B,2CAA6B,CAAA;IAC7B,6BAAe,CAAA;IACf,iCAAmB,CAAA;IACnB,uCAAyB,CAAA;AAC7B,CAAC,EAVW,UAAU,0BAAV,UAAU,QAUrB"}

package/build/shared/regex.d.ts

@@ -1,3 +1,6 @@
+/**
+ * Common regex patterns for validation
+ */
 export declare const EMAIL_REGEX: RegExp;
 export declare const UUID_REGEX: RegExp;
 export declare const DATETIME_REGEX: RegExp;

package/build/shared/regex.js

@@ -1,17 +1,33 @@
 "use strict";
+/**
+ * Common regex patterns for validation
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAUTH_STATE_MAX_LENGTH = exports.OAUTH_STATE_REGEX = exports.POSITIVE_BIGINT_STRING_REGEX = exports.BIGINT_STRING_REGEX = exports.HEX_COLOR_REGEX = exports.SLUG_REGEX = exports.UNSUBSCRIBE_TOKEN_REGEX = exports.ATR_TOKEN_REGEX = exports.PASSWORD_RESET_TOKEN_REGEX = exports.EMAIL_VERIFICATION_TOKEN_REGEX = exports.DATETIME_REGEX = exports.UUID_REGEX = exports.EMAIL_REGEX = void 0;
+// RFC 5322 email regex (simplified)
 exports.EMAIL_REGEX = /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
+// UUID v4 regex
 exports.UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+// ISO 8601 datetime regex
 exports.DATETIME_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+// 32-byte random token encoded as hex string (64 chars)
 exports.EMAIL_VERIFICATION_TOKEN_REGEX = /^[A-Fa-f0-9]{64}$/;
 exports.PASSWORD_RESET_TOKEN_REGEX = /^[A-Fa-f0-9]{64}$/;
 exports.ATR_TOKEN_REGEX = /^(?:[A-Fa-f0-9]{64}|[A-Za-z0-9_-]{16,64}\.[A-Za-z0-9_-]{16,128})$/;
+// HMAC-SHA256 в base64url — ровно 43 символа без выравнивающих '='.
 exports.UNSUBSCRIBE_TOKEN_REGEX = /^[A-Za-z0-9_-]{43}$/;
+// Slug/alias regex (lowercase letters, numbers, hyphens)
 exports.SLUG_REGEX = /^[a-z0-9-]+$/;
+// Hex color regex: #RRGGBB
 exports.HEX_COLOR_REGEX = /^#[0-9A-Fa-f]{6}$/;
+// BigInt string regex (non-negative integer as string)
 exports.BIGINT_STRING_REGEX = /^\d+$/;
+// Positive (non-zero) BigInt string regex: rejects `0`, rejects leading
+// zeros, and caps at 19 digits (fits safely within i64 / PostgreSQL bigint).
+// Use this for amounts and counters that must always be > 0 when serialized
+// over the wire as a JSON string.
 exports.POSITIVE_BIGINT_STRING_REGEX = /^[1-9][0-9]{0,18}$/;
+// OAuth state parameter: base64url-safe characters only
 exports.OAUTH_STATE_REGEX = /^[A-Za-z0-9_-]+$/;
 exports.OAUTH_STATE_MAX_LENGTH = 128;
 //# sourceMappingURL=regex.js.map

package/build/shared/regex.js.map

@@ -1 +1 @@
-{"version":3,"file":"regex.js","sourceRoot":"","sources":["../../shared/regex.ts"],"names":[],"mappings":";;;AAKa,QAAA,WAAW,GACpB,uIAAuI,CAAC;AAG/H,QAAA,UAAU,GAAG,wEAAwE,CAAC;AAGtF,QAAA,cAAc,GAAG,oDAAoD,CAAC;AAGtE,QAAA,8BAA8B,GAAG,mBAAmB,CAAC;AACrD,QAAA,0BAA0B,GAAG,mBAAmB,CAAC;AACjD,QAAA,eAAe,GACxB,mEAAmE,CAAC;AAE3D,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAGhD,QAAA,UAAU,GAAG,cAAc,CAAC;AAG5B,QAAA,eAAe,GAAG,mBAAmB,CAAC;AAGtC,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAM9B,QAAA,4BAA4B,GAAG,oBAAoB,CAAC;AAGpD,QAAA,iBAAiB,GAAG,kBAAkB,CAAC;AACvC,QAAA,sBAAsB,GAAG,GAAG,CAAC"}
+{"version":3,"file":"regex.js","sourceRoot":"","sources":["../../shared/regex.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,oCAAoC;AACvB,QAAA,WAAW,GACpB,uIAAuI,CAAC;AAE5I,gBAAgB;AACH,QAAA,UAAU,GAAG,wEAAwE,CAAC;AAEnG,0BAA0B;AACb,QAAA,cAAc,GAAG,oDAAoD,CAAC;AAEnF,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,mBAAmB,CAAC;AACrD,QAAA,0BAA0B,GAAG,mBAAmB,CAAC;AACjD,QAAA,eAAe,GACxB,mEAAmE,CAAC;AACxE,oEAAoE;AACvD,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,yDAAyD;AAC5C,QAAA,UAAU,GAAG,cAAc,CAAC;AAEzC,2BAA2B;AACd,QAAA,eAAe,GAAG,mBAAmB,CAAC;AAEnD,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAE3C,wEAAwE;AACxE,6EAA6E;AAC7E,4EAA4E;AAC5E,kCAAkC;AACrB,QAAA,4BAA4B,GAAG,oBAAoB,CAAC;AAEjE,wDAAwD;AAC3C,QAAA,iBAAiB,GAAG,kBAAkB,CAAC;AACvC,QAAA,sBAAsB,GAAG,GAAG,CAAC"}

package/build/shared/tariffs-anchor.enum.d.ts

@@ -1,3 +1,5 @@
+/** Deep-link anchors on the tariffs page (/tariffs#<anchor>). */
 export declare enum TariffsAnchor {
+    /** Open the one-time packages view instead of the default subscriptions view. */
     PACKAGES = "packages"
 }

package/build/shared/tariffs-anchor.enum.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TariffsAnchor = void 0;
+/** Deep-link anchors on the tariffs page (/tariffs#<anchor>). */
 var TariffsAnchor;
 (function (TariffsAnchor) {
+    /** Open the one-time packages view instead of the default subscriptions view. */
     TariffsAnchor["PACKAGES"] = "packages";
 })(TariffsAnchor || (exports.TariffsAnchor = TariffsAnchor = {}));
 //# sourceMappingURL=tariffs-anchor.enum.js.map

package/build/shared/tariffs-anchor.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"tariffs-anchor.enum.js","sourceRoot":"","sources":["../../shared/tariffs-anchor.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,aAGX;AAHD,WAAY,aAAa;IAErB,sCAAqB,CAAA;AACzB,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB"}
+{"version":3,"file":"tariffs-anchor.enum.js","sourceRoot":"","sources":["../../shared/tariffs-anchor.enum.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AACjE,IAAY,aAGX;AAHD,WAAY,aAAa;IACrB,iFAAiF;IACjF,sCAAqB,CAAA;AACzB,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB"}