founder-schema 0.1.0 → 0.2.0

package/dist/onboarding.js

@@ -1,12 +1,13 @@
 /**
  * founder-schema — Onboarding: steps, enums, and the two shapes of the answers
  *
- * ONE LIST DEFINES THE FLOW. `FOUNDER_ONBOARDING_STEPS` carries the screen
- * title, the help line, the progress denominator AND the fields each step
- * gates on. GymMonk arrived here after keeping two lists in sync by hand, where
- * a step could exist with no title or, worse, be left with no validation gate
- * at all. Dating reached the same place independently. One list makes both
- * impossible.
+ * ONE LIST DEFINES THE FLOW, AND IT IS DERIVED. Each step's fields are a pick
+ * of the finish body (`ONBOARDING_STEP_SCHEMAS`), and `FOUNDER_ONBOARDING_STEPS`
+ * is built FROM those picks: its `fields`, and even whether a step may be
+ * skipped, come from the schema rather than from a second hand-written list.
+ * GymMonk arrived at one list after keeping two in sync by hand, where a step
+ * could exist with no title or, worse, no validation gate at all; until 0.2.0
+ * this file still wrote the field lists twice.
  *
  * TWO SHAPES, ONE SET OF RULES. A half-filled form legitimately holds `null`
  * for a choice nobody has made yet; the finalize body only ever sees completed
@@ -15,10 +16,19 @@
  * for the end. Letting those two drift is how a wizard says a step is optional
  * and then answers 422 at Finish.
  *
+ * NO COPY IN HERE. Step titles, help lines and topic category names are
+ * translation KEYS (`titleKey`, `helpKey`, `labelKey`), Jansathi's rule for
+ * every config string: an English sentence in a shared package is a sentence
+ * every other language has to match by wording.
+ *
  * @module founder-schema/onboarding
  */
 import { z } from 'zod';
-import { GOAL_VALUES, genderSchema, goalSchema, httpUrlSchema, industrySchema, optionalTrimmedString, phoneSchema, skillSchema, startupStageSchema, } from './common.js';
+import { GOAL_VALUES, genderSchema, goalSchema, industrySchema, locationSchema, optionalTrimmedString, phoneSchema, skillSchema, startupStageSchema, } from './common.js';
+import { founderLinksSchema, ventureSchema } from './founder-profile.js';
+import { ABOUT_MAX, CITY_MAX, COUNTRY_MAX, DISPLAY_NAME_MAX, GOALS_MIN, HEADLINE_MAX, SKILLS_MAX, STATE_MAX, VENTURE_NAME_MAX, VENTURE_TAGLINE_MAX, } from './limits.js';
+import { uploadKeySchema } from './uploads.js';
+import { VALIDATION_MESSAGE } from './validation.js';
 // ─── Age ─────────────────────────────────────────────────────────────────────
 /**
  * 18, ruled by the user 2026-09-21. Under-18 would pull in parental-consent
@@ -61,7 +71,7 @@ export function ageInYears(isoDate, now = new Date()) {
 export const isoDateSchema = z
     .string()
     .trim()
-    .regex(/^\d{4}-\d{2}-\d{2}$/, 'Expected a YYYY-MM-DD date');
+    .regex(/^\d{4}-\d{2}-\d{2}$/, VALIDATION_MESSAGE.dateInvalid);
 /** True only for a date that exists. Rejects 2026-02-30 and 2026-13-01. */
 function isRealDate(iso) {
     const [y, m, d] = iso.split('-').map(Number);
@@ -80,11 +90,9 @@ function isRealDate(iso) {
  * discoverable profile, because the client was the only thing checking.
  */
 export const dateOfBirthSchema = isoDateSchema
-    .refine(isRealDate, { message: 'That date does not exist' })
-    .refine((v) => ageInYears(v) >= MIN_AGE_YEARS, {
-    message: `You must be at least ${MIN_AGE_YEARS} to join`,
-})
-    .refine((v) => ageInYears(v) <= MAX_AGE_YEARS, { message: 'Check the year of birth' });
+    .refine(isRealDate, { error: VALIDATION_MESSAGE.dobInvalid })
+    .refine((v) => ageInYears(v) >= MIN_AGE_YEARS, { error: VALIDATION_MESSAGE.dobUnderAge })
+    .refine((v) => ageInYears(v) <= MAX_AGE_YEARS, { error: VALIDATION_MESSAGE.dobTooOld });
 // ─── Business ────────────────────────────────────────────────────────────────
 export const BUSINESS_TYPE_VALUES = ['startup', 'sme', 'enterprise'];
 export const businessTypeSchema = z.enum(BUSINESS_TYPE_VALUES);
@@ -197,113 +205,111 @@ export const TOPIC_VALUES = [
     'education_access',
 ];
 export const topicSchema = z.enum(TOPIC_VALUES);
+/**
+ * The grouping the picker renders.
+ *
+ * ⚠️ `TOPIC_VALUES` above is the single source of truth and this is typed
+ * against it, so a typo here is a compile error rather than a chip that renders
+ * and can never be selected. The dating product keeps a categorised list and a
+ * flat list side by side and they have already drifted apart by two values;
+ * a test in this package asserts these two agree exactly, in both directions.
+ */
+export const TOPIC_CATEGORY_KEYS = [
+    'career',
+    'tech',
+    'business',
+    'growth',
+    'creative',
+    'impact',
+];
+const topicCategory = (key, values) => ({
+    key,
+    labelKey: `topics.category.${key}`,
+    values,
+});
 export const TOPIC_CATEGORIES = [
-    {
-        key: 'career',
-        label: 'Career Growth',
-        values: [
-            'mentoring',
-            'leadership',
-            'networking',
-            'public_speaking',
-            'teaching',
-            'hiring_talent',
-            'personal_branding',
-            'career_transition',
-            'remote_work',
-        ],
-    },
-    {
-        key: 'tech',
-        label: 'Innovation & Tech',
-        values: [
-            'ai_ml',
-            'blockchain',
-            'crypto_web3',
-            'robotics',
-            'data_science',
-            'cybersecurity',
-            'game_dev',
-            'ux_design',
-            'app_development',
-            'open_source',
-            'electronics',
-            'space_exploration',
-            'green_tech',
-            'deeptech',
-            'no_code',
-        ],
-    },
-    {
-        key: 'business',
-        label: 'Business',
-        values: [
-            'entrepreneurship',
-            'investing',
-            'stock_trading',
-            'personal_finance',
-            'fundraising',
-            'marketing',
-            'sales',
-            'consulting',
-            'ecommerce',
-            'retail',
-            'real_estate',
-            'supply_chain',
-            'product_management',
-            'growth',
-            'b2b_saas',
-            'd2c',
-        ],
-    },
-    {
-        key: 'growth',
-        label: 'Personal Development',
-        values: [
-            'meditation',
-            'journaling',
-            'self_improvement',
-            'productivity',
-            'reading',
-            'online_courses',
-            'philosophy',
-            'psychology',
-            'therapy',
-            'sleep_optimization',
-            'gym',
-            'yoga',
-        ],
-    },
-    {
-        key: 'creative',
-        label: 'Creative Arts',
-        values: [
-            'photography',
-            'writing',
-            'graphic_design',
-            'filmmaking',
-            'digital_art',
-            'content_creation',
-            'blogging',
-            'vlogging',
-            'podcasts',
-            'animation',
-            'music_production',
-        ],
-    },
-    {
-        key: 'impact',
-        label: 'Impact & Community',
-        values: [
-            'volunteering',
-            'ngo_work',
-            'environmental',
-            'women_empowerment',
-            'community_service',
-            'social_enterprise',
-            'education_access',
-        ],
-    },
+    topicCategory('career', [
+        'mentoring',
+        'leadership',
+        'networking',
+        'public_speaking',
+        'teaching',
+        'hiring_talent',
+        'personal_branding',
+        'career_transition',
+        'remote_work',
+    ]),
+    topicCategory('tech', [
+        'ai_ml',
+        'blockchain',
+        'crypto_web3',
+        'robotics',
+        'data_science',
+        'cybersecurity',
+        'game_dev',
+        'ux_design',
+        'app_development',
+        'open_source',
+        'electronics',
+        'space_exploration',
+        'green_tech',
+        'deeptech',
+        'no_code',
+    ]),
+    topicCategory('business', [
+        'entrepreneurship',
+        'investing',
+        'stock_trading',
+        'personal_finance',
+        'fundraising',
+        'marketing',
+        'sales',
+        'consulting',
+        'ecommerce',
+        'retail',
+        'real_estate',
+        'supply_chain',
+        'product_management',
+        'growth',
+        'b2b_saas',
+        'd2c',
+    ]),
+    topicCategory('growth', [
+        'meditation',
+        'journaling',
+        'self_improvement',
+        'productivity',
+        'reading',
+        'online_courses',
+        'philosophy',
+        'psychology',
+        'therapy',
+        'sleep_optimization',
+        'gym',
+        'yoga',
+    ]),
+    topicCategory('creative', [
+        'photography',
+        'writing',
+        'graphic_design',
+        'filmmaking',
+        'digital_art',
+        'content_creation',
+        'blogging',
+        'vlogging',
+        'podcasts',
+        'animation',
+        'music_production',
+    ]),
+    topicCategory('impact', [
+        'volunteering',
+        'ngo_work',
+        'environmental',
+        'women_empowerment',
+        'community_service',
+        'social_enterprise',
+        'education_access',
+    ]),
 ];
 /**
  * How many a member must pick. A minimum exists because these drive feed
@@ -314,82 +320,51 @@ export const TOPIC_CATEGORIES = [
  * minimum at all, and its own field config says "pick up to 10" while every
  * screen and schema enforces 20.
  */
-/**
- * ⚠️ TRANSLATION KEY SHAPE, for whoever builds the picker:
- * `<fieldKey>.<value>` for a value and `<fieldKey>._label` for the field name.
- * The dating product's interests JSON is keyed by CATEGORY instead, so all five
- * of its label lookups miss and every chip renders its raw English in every
- * locale, with a fully translated Hindi file sitting unreachable. Lift the
- * translations, reshape the keys.
- */
 export const INTERESTS_MIN = 3;
 export const INTERESTS_MAX = 10;
-export const FOUNDER_ONBOARDING_STEPS = [
-    {
-        key: 'identity',
-        title: "We'd love to hear more about you",
-        helpText: 'This is what other founders see first.',
-        fields: ['displayName', 'gender', 'dateOfBirth', 'headline', 'about', 'avatarUploadKey'],
-        required: true,
-    },
-    {
-        key: 'contact',
-        title: 'How can people reach you?',
-        helpText: 'Your number is never shown on your profile.',
-        fields: ['phone', 'links'],
-        required: true,
-    },
-    {
-        key: 'location',
-        title: 'Where are you based?',
-        helpText: 'Used to show founders near you. You can skip this.',
-        fields: ['location'],
-        required: false,
-    },
-    {
-        key: 'goals',
-        title: 'Goals & Passion',
-        helpText: 'Pick what matters most to you.',
-        fields: ['goals'],
-        required: true,
-    },
-    {
-        key: 'interests',
-        title: 'What inspires you the most?',
-        helpText: 'We use these to shape your feed.',
-        fields: ['interests'],
-        required: true,
-    },
-    {
-        key: 'business',
-        title: 'Tell us about your business',
-        helpText: 'Skip it if you are still figuring things out.',
-        fields: ['venture', 'businessType'],
-        required: false,
-    },
-    {
-        key: 'guidelines',
-        title: 'How we behave here',
-        helpText: 'A short read, and the only rule that matters.',
-        fields: ['guidelinesVersion'],
-        required: true,
-    },
+// ─── The step keys ───────────────────────────────────────────────────────────
+/**
+ * The step keys, in order, as a literal union, so a consumer can key a table by
+ * step and have TypeScript insist on every one. Before 0.2.0 `key` was a plain
+ * string and the web client kept its own copy of this list to get the same
+ * check; a test there held the two together. Now there is one list.
+ */
+export const ONBOARDING_STEP_KEYS = [
+    'identity',
+    'contact',
+    'location',
+    'goals',
+    'interests',
+    'business',
+    'guidelines',
 ];
-export const ONBOARDING_TOTAL_STEPS = FOUNDER_ONBOARDING_STEPS.length;
+// ─── Guidelines ──────────────────────────────────────────────────────────────
 /**
- * Fields gating each step, DERIVED from the list above so the two can never
- * disagree.
+ * The community guidelines a member agrees to at the last step, by version.
+ *
+ * The finish body accepts THIS version and no other: an old tab still showing
+ * last month's text cannot record agreement to text it never displayed, and
+ * `'whatever'` is not a version. Until 0.2.0 any non-empty string passed, and
+ * the web client held this constant on its own.
+ *
+ * ⚠ Changing the guidelines text means bumping this, in the same publish.
+ * Every member who agreed to an earlier version keeps that version on their
+ * profile; that record is the point.
  */
-export const ONBOARDING_STEP_FIELDS = FOUNDER_ONBOARDING_STEPS.map((s) => s.fields);
+export const GUIDELINES_VERSION = '2026-10-03';
+export const guidelinesVersionSchema = z.literal(GUIDELINES_VERSION, {
+    error: VALIDATION_MESSAGE.guidelinesOutdated,
+});
 // ─── Contact ─────────────────────────────────────────────────────────────────
 /**
- * Indian mobile number, ten digits, stored raw with no country code, matching
- * the standard used across this family. Display adds `+91`.
+ * The links the contact step collects, picked from the profile's own links so
+ * the two cannot disagree on what a link is. The phone is `phoneSchema`: ten
+ * digits, stored raw with no country code, on the account rather than here.
  */
-export const contactLinksSchema = z.object({
-    linkedin: httpUrlSchema.optional(),
-    x: httpUrlSchema.optional(),
-    instagram: httpUrlSchema.optional(),
+export const contactLinksSchema = founderLinksSchema.pick({
+    linkedin: true,
+    x: true,
+    instagram: true,
 });
 // ─── The form, mid-flight ────────────────────────────────────────────────────
 /**
@@ -400,29 +375,34 @@ export const contactLinksSchema = z.object({
  * this schema is required, on purpose: it describes a form somebody is halfway
  * through, and the rules that decide whether they may FINISH live in
  * `completeOnboardingBodySchema`.
+ *
+ * Text inputs stay text here (`teamSize`, `dateOfBirth`), because that is what
+ * an input holds while somebody types; the form converts them when it builds
+ * the finish body, which takes real numbers.
  */
 export const onboardingFormSchema = z.object({
-    displayName: z.string().trim().max(80),
+    displayName: z.string().trim().max(DISPLAY_NAME_MAX),
     gender: genderSchema.nullable(),
     dateOfBirth: z.string().trim(),
-    headline: z.string().trim().max(120),
-    about: z.string().trim().max(1000),
-    avatarUploadKey: z.string().trim().nullable(),
+    headline: z.string().trim().max(HEADLINE_MAX),
+    about: z.string().trim().max(ABOUT_MAX),
+    /** Only ever a key the server minted for this member. */
+    avatarUploadKey: uploadKeySchema.nullable(),
     phone: z.string().trim(),
     links: contactLinksSchema,
     location: z
         .object({
-        city: z.string().trim().max(80),
-        state: z.string().trim().max(80),
-        country: z.string().trim().max(80),
+        city: z.string().trim().max(CITY_MAX),
+        state: z.string().trim().max(STATE_MAX),
+        country: z.string().trim().max(COUNTRY_MAX),
     })
         .nullable(),
     goals: z.array(goalSchema).max(GOAL_VALUES.length),
     interests: z.array(topicSchema).max(INTERESTS_MAX),
     venture: z
         .object({
-        name: z.string().trim().max(120),
-        tagline: z.string().trim().max(160),
+        name: z.string().trim().max(VENTURE_NAME_MAX),
+        tagline: z.string().trim().max(VENTURE_TAGLINE_MAX),
         website: z.string().trim(),
         industry: industrySchema.nullable(),
         stage: startupStageSchema.nullable(),
@@ -430,7 +410,7 @@ export const onboardingFormSchema = z.object({
     })
         .nullable(),
     businessType: businessTypeSchema.nullable(),
-    skills: z.array(skillSchema).max(8),
+    skills: z.array(skillSchema).max(SKILLS_MAX),
     guidelinesVersion: z.string().trim().nullable(),
 });
 // ─── The finalize body ───────────────────────────────────────────────────────
@@ -447,9 +427,14 @@ export const onboardingFormSchema = z.object({
  * at finalize. `isOnboarded` may be set here and nowhere else: four of the
  * profile's partial indexes are gated on it, so a half-built profile carrying
  * it true appears in Discover half-built.
+ *
+ * Location, venture and links are the profile's own shapes, not copies: the
+ * copies are how the profile model came to lack Instagram.
  */
 export const completeOnboardingBodySchema = z.object({
-    displayName: z.string().trim().min(1, 'Tell us your name').max(80),
+    // Plain bounds, no custom message: `too_small` with minimum 1 already says
+    // "required", and the client words it in the member's language.
+    displayName: z.string().trim().min(1).max(DISPLAY_NAME_MAX),
     /**
      * ⚠️ NO `username` HERE, and its absence is deliberate.
      *
@@ -467,48 +452,103 @@ export const completeOnboardingBodySchema = z.object({
      */
     gender: genderSchema,
     dateOfBirth: dateOfBirthSchema,
-    headline: optionalTrimmedString(120),
-    about: optionalTrimmedString(1000),
-    avatarUploadKey: z.string().trim().min(1).optional(),
+    headline: optionalTrimmedString(HEADLINE_MAX),
+    about: optionalTrimmedString(ABOUT_MAX),
+    /**
+     * The key the presign handed out, in the minted format. It was a bare
+     * string until 0.2.0, so `'../../etc/passwd'` passed this schema and only
+     * the server's own commit check stood in the way.
+     */
+    avatarUploadKey: uploadKeySchema.optional(),
     phone: phoneSchema,
     links: contactLinksSchema.optional(),
     /** Absent when the member skipped the step or refused the permission. */
-    location: z
-        .object({
-        city: z.string().trim().min(1).max(80),
-        state: optionalTrimmedString(80),
-        country: z.string().trim().min(1).max(80),
-    })
-        .optional(),
-    goals: z.array(goalSchema).min(1, 'Pick at least one').max(GOAL_VALUES.length),
-    interests: z
-        .array(topicSchema)
-        .min(INTERESTS_MIN, `Pick at least ${INTERESTS_MIN}`)
-        .max(INTERESTS_MAX),
-    skills: z.array(skillSchema).max(8).optional(),
-    /** Absent when the member skipped the business step. */
-    venture: z
-        .object({
-        name: z.string().trim().min(1).max(120),
-        tagline: optionalTrimmedString(160),
-        website: httpUrlSchema.optional(),
-        industry: industrySchema,
-        stage: startupStageSchema,
-        teamSize: z.coerce.number().int().min(1).max(100000).optional(),
-    })
-        .optional(),
+    location: locationSchema.optional(),
+    goals: z.array(goalSchema).min(GOALS_MIN).max(GOAL_VALUES.length),
+    interests: z.array(topicSchema).min(INTERESTS_MIN).max(INTERESTS_MAX),
+    skills: z.array(skillSchema).max(SKILLS_MAX).optional(),
+    /**
+     * Absent when the member skipped the business step. The profile's venture
+     * without `foundedYear`, which onboarding does not ask; the Me tab does.
+     */
+    venture: ventureSchema.omit({ foundedYear: true }).optional(),
     businessType: businessTypeSchema.optional(),
     /**
-     * The version of the guidelines this member read.
+     * The version of the guidelines this member read: `GUIDELINES_VERSION`,
+     * exactly.
      *
      * A version and not a boolean, and the server stamps the time. A boolean says
      * somebody agreed; a version and a timestamp say WHAT they agreed to and
      * WHEN, which is the only form worth anything the day the text changes or a
      * moderation decision is disputed.
      */
-    guidelinesVersion: z.string().trim().min(1),
+    guidelinesVersion: guidelinesVersionSchema,
+});
+// ─── The steps ───────────────────────────────────────────────────────────────
+/**
+ * Each step's slice of the finish body, picked FROM it, so a client validating
+ * "may I leave this step" and the server validating the finish apply the very
+ * same rules. A copy would drift, and the drift shows up as a wizard that lets
+ * a step pass and a finish that refuses it, on the last screen.
+ *
+ * THIS IS THE ONE PLACE A STEP'S FIELDS ARE WRITTEN. `FOUNDER_ONBOARDING_STEPS`
+ * below reads them from here. A test asserts that every finish field belongs to
+ * exactly one step.
+ *
+ * These validate the FINISH shape (skipped = absent), not the in-progress form:
+ * a client maps its form state to the slice first. The server does not run them
+ * on a draft save, because a half-answered step must be storable.
+ */
+export const ONBOARDING_STEP_SCHEMAS = {
+    identity: completeOnboardingBodySchema.pick({
+        displayName: true,
+        gender: true,
+        dateOfBirth: true,
+        headline: true,
+        about: true,
+        avatarUploadKey: true,
+        // Here because ruling D8 folded the design's orphan "title, achievements,
+        // skills" screen into step one. It was on no step until 0.2.0, which made
+        // it the one finish field no step owned.
+        skills: true,
+    }),
+    contact: completeOnboardingBodySchema.pick({ phone: true, links: true }),
+    location: completeOnboardingBodySchema.pick({ location: true }),
+    goals: completeOnboardingBodySchema.pick({ goals: true }),
+    interests: completeOnboardingBodySchema.pick({ interests: true }),
+    business: completeOnboardingBodySchema.pick({ venture: true, businessType: true }),
+    guidelines: completeOnboardingBodySchema.pick({ guidelinesVersion: true }),
+};
+export const FOUNDER_ONBOARDING_STEPS = ONBOARDING_STEP_KEYS.map((key) => {
+    const slice = ONBOARDING_STEP_SCHEMAS[key];
+    return {
+        key,
+        titleKey: `onboarding.steps.${key}.title`,
+        helpKey: `onboarding.steps.${key}.help`,
+        fields: Object.keys(slice.shape),
+        required: !slice.safeParse({}).success,
+    };
+});
+export const ONBOARDING_TOTAL_STEPS = FOUNDER_ONBOARDING_STEPS.length;
+/** Fields gating each step, in step order. Read from the same picks. */
+export const ONBOARDING_STEP_FIELDS = FOUNDER_ONBOARDING_STEPS.map((s) => s.fields);
+/** What finishing answers: the new profile's id and the handle derived for it. */
+export const completeOnboardingResponseSchema = z.object({
+    id: z.string(),
+    username: z.string(),
 });
 // ─── The resume cursor ───────────────────────────────────────────────────────
+/**
+ * The keys a draft may hold: exactly the in-progress form's fields.
+ *
+ * ⚠ The server writes each key as a dot path (`draft.<key>`). Unchecked, a key
+ * holding a dot writes somewhere nested the form never asked for, and the
+ * collection fills with whatever a client invents. Until 0.2.0 the backend
+ * kept its own copy of this list and DROPPED unknown keys without a word; now a
+ * draft carrying one is refused, with the key in the issue's path.
+ */
+export const onboardingDraftKeySchema = onboardingFormSchema.keyof();
+export const ONBOARDING_DRAFT_KEYS = onboardingDraftKeySchema.options;
 /**
  * Where the member got to, kept in its own collection, separate from the
  * profile.
@@ -517,22 +557,29 @@ export const completeOnboardingBodySchema = z.object({
  * pair: one number is what lets a member start on the web and resume elsewhere,
  * provided both ends agree on the encoding.
  *
- * `draft` is opaque here on purpose. The client owns the form's shape, and it is
- * re-validated strictly at finalize, so this schema has no business describing
- * it.
+ * The draft's KEYS come from the form; its VALUES are opaque on purpose. A
+ * half-answered step must be storable even though it would fail the finish,
+ * and everything in it is re-validated strictly at finalize.
+ *
+ * `partialRecord`, not `record`: in Zod 4 an enum-keyed `z.record` demands
+ * every key, and a draft holds whichever steps the member has reached.
  */
-export const onboardingDraftSchema = z.record(z.string(), z.unknown());
+export const onboardingDraftSchema = z.partialRecord(onboardingDraftKeySchema, z.unknown());
 export const onboardingProgressSchema = z.object({
     step: z.number().int().min(0).max(ONBOARDING_TOTAL_STEPS),
     draft: onboardingDraftSchema.optional(),
 });
-/** `PUT` body: any subset of the cursor, merged server-side. No defaults. */
+/**
+ * `PATCH` body: any subset of the cursor, merged server-side. No defaults.
+ * `step` may equal `ONBOARDING_TOTAL_STEPS`: "past the last step", which the
+ * client sends on its way to finish.
+ */
 export const onboardingProgressUpdateSchema = z.object({
     step: z.number().int().min(0).max(ONBOARDING_TOTAL_STEPS).optional(),
     draft: onboardingDraftSchema.optional(),
 });
 /**
- * What the client reads on return.
+ * What the client reads on return, from `GET` and from every `PATCH`.
  *
  * ⚠️ `onboarded` is the gate and it comes from the profile, not from the
  * cursor: a finished member on a new device must be recognised even when the
@@ -541,7 +588,7 @@ export const onboardingProgressUpdateSchema = z.object({
  */
 export const onboardingStatusSchema = z.object({
     onboarded: z.boolean(),
-    step: z.number().int().min(0),
+    step: z.number().int().min(0).max(ONBOARDING_TOTAL_STEPS),
     draft: onboardingDraftSchema.optional(),
 });
 //# sourceMappingURL=onboarding.js.map