founder-schema 0.1.0

package/dist/common.d.ts

@@ -0,0 +1,228 @@
+/**
+ * founder-schema — Shared helpers and core enums
+ *
+ * The stable building blocks reused across every Founder Circle schema.
+ * Anything that both the backend and a client need to agree on lives here.
+ *
+ * @module founder-schema/common
+ */
+import { z } from 'zod';
+/**
+ * Converts empty / whitespace-only strings to `undefined` so Zod `.optional()`
+ * treats them as "not provided".
+ *
+ * Why this exists: an HTML form submits `""` for a cleared field, and without
+ * this an optional field would be stored as an empty string rather than left
+ * alone. Jansathi shipped that bug in dating onboarding.
+ */
+export declare const emptyStringToUndefined: (value: unknown) => unknown;
+/** Optional trimmed string. Empty strings are coerced to `undefined`. */
+export declare const optionalTrimmedString: (maxLength?: number) => z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+/** A Mongo ObjectId as it crosses the wire: 24 lowercase hex characters. */
+export declare const objectIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+/**
+ * A URL safe to store and, after the consumer's own check, to render.
+ *
+ * Use this for EVERY member-supplied URL. Never bare `z.url()`: it accepts any
+ * scheme the URL parser accepts, so `javascript:alert(document.cookie)`,
+ * `data:text/html,<script>...`, `vbscript:` and `file:///etc/passwd` all pass.
+ * Each of those is stored XSS the moment a client renders it as an `href`, and
+ * `data:` is the same in an `<img src>`.
+ *
+ * `hostname` is restricted too, not only the scheme. A bare host like
+ * `localhost` or a literal IP is refused, which closes server-side request
+ * forgery: this product runs on EC2 with an instance role, so a member-supplied
+ * `http://169.254.169.254/latest/meta-data/` that anything server-side ever
+ * fetches is a credential read.
+ *
+ * Validating here is necessary and not sufficient. A consumer still treats a
+ * stored URL as untrusted at render time, because rows written before this
+ * existed were never checked.
+ *
+ * ⚠️ IF THIS EVER GROWS A HOST ALLOWLIST, compare the PARSED hostname for
+ * exact equality. Never `includes`, never `endsWith`, never a regex over the
+ * whole URL. Each of these is a real bypass of a naive "is it YouTube" check,
+ * and all three read as obviously fine:
+ *
+ *   https://evil.example/?next=youtube.com/watch  contains the string
+ *   youtube.com.evil.example                      starts with it
+ *   youtu.be.evil.example                         a suffix check passes it
+ *
+ * The same mistake in the opposite direction to the `javascript:` hole: there
+ * the scheme was too permissive, here the host check only LOOKS strict.
+ * (krish hit this rendering inline video, 2026-09-21, and handles it by parsing
+ * and comparing the hostname exactly.)
+ */
+export declare const httpUrlSchema: z.ZodURL;
+/**
+ * Public handle a founder picks and can change later.
+ *
+ * Rules are deliberately narrow because the handle appears in URLs and in
+ * mentions: lowercase letters, digits, underscore and a single dot, 3 to 30
+ * characters, must start with a letter. Reserved words are refused by the
+ * backend, not here, so the list can change without a schema publish.
+ */
+export declare const USERNAME_MIN = 3;
+export declare const USERNAME_MAX = 30;
+export declare const usernameSchema: z.ZodString;
+export type Username = z.infer<typeof usernameSchema>;
+/**
+ * Stage of the founder's current venture.
+ *
+ * Ordered from earliest to latest so a range filter can compare by index. Add
+ * new stages at the END or the stored ordinal of existing rows shifts.
+ */
+export declare const STARTUP_STAGE_VALUES: readonly ["idea", "validation", "mvp", "pre_seed", "seed", "series_a_plus", "profitable", "exited"];
+export declare const startupStageSchema: z.ZodEnum<{
+    idea: "idea";
+    validation: "validation";
+    mvp: "mvp";
+    pre_seed: "pre_seed";
+    seed: "seed";
+    series_a_plus: "series_a_plus";
+    profitable: "profitable";
+    exited: "exited";
+}>;
+export type StartupStage = z.infer<typeof startupStageSchema>;
+/**
+ * Industry the venture operates in. Kept as a closed list so Discover filters
+ * are a single indexed equality match rather than a text search.
+ */
+export declare const INDUSTRY_VALUES: readonly ["agritech", "ai_ml", "b2b_saas", "consumer", "climate", "d2c", "deeptech", "edtech", "fintech", "gaming", "healthtech", "logistics", "manufacturing", "marketplace", "media", "mobility", "proptech", "robotics", "services", "space", "other"];
+export declare const industrySchema: z.ZodEnum<{
+    agritech: "agritech";
+    ai_ml: "ai_ml";
+    b2b_saas: "b2b_saas";
+    consumer: "consumer";
+    climate: "climate";
+    d2c: "d2c";
+    deeptech: "deeptech";
+    edtech: "edtech";
+    fintech: "fintech";
+    gaming: "gaming";
+    healthtech: "healthtech";
+    logistics: "logistics";
+    manufacturing: "manufacturing";
+    marketplace: "marketplace";
+    media: "media";
+    mobility: "mobility";
+    proptech: "proptech";
+    robotics: "robotics";
+    services: "services";
+    space: "space";
+    other: "other";
+}>;
+export type Industry = z.infer<typeof industrySchema>;
+/**
+ * What the founder brings. Free-text skills were considered and rejected: two
+ * people typing "growth" and "Growth Marketing" would never match each other in
+ * a filter, and the Discover tab is the whole point of the product.
+ */
+export declare const SKILL_VALUES: readonly ["engineering", "product", "design", "data", "growth", "sales", "marketing", "operations", "finance", "legal", "hr_people", "supply_chain", "research", "fundraising", "community"];
+export declare const skillSchema: z.ZodEnum<{
+    engineering: "engineering";
+    product: "product";
+    design: "design";
+    data: "data";
+    growth: "growth";
+    sales: "sales";
+    marketing: "marketing";
+    operations: "operations";
+    finance: "finance";
+    legal: "legal";
+    hr_people: "hr_people";
+    supply_chain: "supply_chain";
+    research: "research";
+    fundraising: "fundraising";
+    community: "community";
+}>;
+export type Skill = z.infer<typeof skillSchema>;
+/**
+ * What the member is here for. ONE list, replacing three.
+ *
+ * This was `lookingFor` with six values. The design draws eight "Goals &
+ * Passion" tiles and four more on the business step; all three were the same
+ * idea at three grains, and shipping them together would have meant nobody
+ * could say which one Discover filters on - the answer settled by whichever
+ * query got written first. Merged on hary's ruling, 2026-09-21, while there
+ * were still no rows in any database.
+ *
+ * ⚠️ Stored per member and used as a Mongoose enum. Append only; removing a
+ * value orphans documents already saved with it.
+ *
+ * ⚠️ `start_company` READS ODDLY next to its neighbours and is correct. It was
+ * queried on the grounds that it restates `venture.stage: 'idea'`; it does not,
+ * and the reason is worth keeping so nobody re-opens it. Inferring it from the
+ * venture works only for a member who ALREADY HAS a venture row, and somebody
+ * who wants to start a company is precisely the member with no venture at all,
+ * so there is nothing to infer from. It also cannot express a founder with a
+ * running company who wants to start another. Every other value is an ask of
+ * other people and this one is an ask of the product, which is the whole of the
+ * oddness. (hary, 2026-09-21.)
+ */
+export declare const GOAL_VALUES: readonly ["find_cofounder", "find_investors", "find_customers", "hiring", "partnerships", "mentorship", "grow_network", "business_ideas", "market_insights", "learn_startup", "start_company"];
+export declare const goalSchema: z.ZodEnum<{
+    find_cofounder: "find_cofounder";
+    find_investors: "find_investors";
+    find_customers: "find_customers";
+    hiring: "hiring";
+    partnerships: "partnerships";
+    mentorship: "mentorship";
+    grow_network: "grow_network";
+    business_ideas: "business_ideas";
+    market_insights: "market_insights";
+    learn_startup: "learn_startup";
+    start_company: "start_company";
+}>;
+export type Goal = z.infer<typeof goalSchema>;
+/**
+ * Demographic only. Nothing here computes anything from it, unlike the sibling
+ * gym product where gender feeds body-metric maths.
+ *
+ * Takes the family's three values and ADDS one rather than renaming any: a
+ * network for founders should let somebody decline the question without having
+ * to describe themselves as "other".
+ */
+export declare const GENDER_VALUES: readonly ["male", "female", "other", "prefer_not_to_say"];
+export declare const genderSchema: z.ZodEnum<{
+    other: "other";
+    male: "male";
+    female: "female";
+    prefer_not_to_say: "prefer_not_to_say";
+}>;
+export type Gender = z.infer<typeof genderSchema>;
+/**
+ * Indian mobile number: ten raw digits, no country code, matching the standard
+ * used across this family. Display adds the `+91`.
+ *
+ * ⚠️ WHERE IT IS STORED IS NOT A SCHEMA QUESTION, and it has been ruled: the
+ * phone lives on the account mirror, never as a second copy on the profile.
+ * Two stored copies drift the first time somebody edits one, and the profile's
+ * would be the copy nobody keeps in sync.
+ */
+export declare const phoneSchema: z.ZodString;
+/**
+ * Where the founder is based. City and country are what Discover filters on;
+ * coordinates are optional and only present when the member granted location.
+ *
+ * Note for later: this is a DECLARED location, not a GPS reading. Jansathi's
+ * rule applies here too — never write a declared location from a GPS capture.
+ */
+export declare const locationSchema: z.ZodObject<{
+    city: z.ZodString;
+    state: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+    country: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type FounderLocation = z.infer<typeof locationSchema>;
+/**
+ * Cursor pagination query. Feed and Discover both use it.
+ *
+ * Cursor, not page number: the community feed changes under the reader, and an
+ * offset would repeat or skip posts as new ones land.
+ */
+export declare const paginationQuerySchema: z.ZodObject<{
+    limit: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>, unknown>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type PaginationQuery = z.infer<typeof paginationQuerySchema>;
+//# sourceMappingURL=common.d.ts.map

package/dist/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAGvD,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,GAAI,kBAAe,yDAC8B,CAAC;AAEpF,4EAA4E;AAC5E,eAAO,MAAM,cAAc,wDAGS,CAAC;AAIrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,aAAa,UAGxB,CAAC;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,eAAO,MAAM,cAAc,aASxB,CAAC;AACJ,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qGASvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;;;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe,2PAsBlB,CAAC;AACX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,YAAY,8LAgBf,CAAC;AACX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAAuB,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,gMAYd,CAAC;AACX,eAAO,MAAM,UAAU;;;;;;;;;;;;EAAsB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAI9C;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,eAAO,MAAM,YAAY;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,aAGkC,CAAC;AAI3D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI7D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;iBAShC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/common.js

@@ -0,0 +1,248 @@
+/**
+ * founder-schema — Shared helpers and core enums
+ *
+ * The stable building blocks reused across every Founder Circle schema.
+ * Anything that both the backend and a client need to agree on lives here.
+ *
+ * @module founder-schema/common
+ */
+import { z } from 'zod';
+// ─── String helpers ──────────────────────────────────────────────────────────
+/**
+ * Converts empty / whitespace-only strings to `undefined` so Zod `.optional()`
+ * treats them as "not provided".
+ *
+ * Why this exists: an HTML form submits `""` for a cleared field, and without
+ * this an optional field would be stored as an empty string rather than left
+ * alone. Jansathi shipped that bug in dating onboarding.
+ */
+export const emptyStringToUndefined = (value) => {
+    if (typeof value === 'string' && value.trim() === '')
+        return undefined;
+    return value;
+};
+/** Optional trimmed string. Empty strings are coerced to `undefined`. */
+export const optionalTrimmedString = (maxLength = 100) => z.preprocess(emptyStringToUndefined, z.string().trim().max(maxLength).optional());
+/** A Mongo ObjectId as it crosses the wire: 24 lowercase hex characters. */
+export const objectIdSchema = z
+    .string()
+    .regex(/^[0-9a-f]{24}$/i, 'Invalid id')
+    .transform((v) => v.toLowerCase());
+// ─── URLs ────────────────────────────────────────────────────────────────────
+/**
+ * A URL safe to store and, after the consumer's own check, to render.
+ *
+ * Use this for EVERY member-supplied URL. Never bare `z.url()`: it accepts any
+ * scheme the URL parser accepts, so `javascript:alert(document.cookie)`,
+ * `data:text/html,<script>...`, `vbscript:` and `file:///etc/passwd` all pass.
+ * Each of those is stored XSS the moment a client renders it as an `href`, and
+ * `data:` is the same in an `<img src>`.
+ *
+ * `hostname` is restricted too, not only the scheme. A bare host like
+ * `localhost` or a literal IP is refused, which closes server-side request
+ * forgery: this product runs on EC2 with an instance role, so a member-supplied
+ * `http://169.254.169.254/latest/meta-data/` that anything server-side ever
+ * fetches is a credential read.
+ *
+ * Validating here is necessary and not sufficient. A consumer still treats a
+ * stored URL as untrusted at render time, because rows written before this
+ * existed were never checked.
+ *
+ * ⚠️ IF THIS EVER GROWS A HOST ALLOWLIST, compare the PARSED hostname for
+ * exact equality. Never `includes`, never `endsWith`, never a regex over the
+ * whole URL. Each of these is a real bypass of a naive "is it YouTube" check,
+ * and all three read as obviously fine:
+ *
+ *   https://evil.example/?next=youtube.com/watch  contains the string
+ *   youtube.com.evil.example                      starts with it
+ *   youtu.be.evil.example                         a suffix check passes it
+ *
+ * The same mistake in the opposite direction to the `javascript:` hole: there
+ * the scheme was too permissive, here the host check only LOOKS strict.
+ * (krish hit this rendering inline video, 2026-09-21, and handles it by parsing
+ * and comparing the hostname exactly.)
+ */
+export const httpUrlSchema = z.url({
+    protocol: /^https?$/,
+    hostname: z.regexes.domain,
+});
+// ─── Username ────────────────────────────────────────────────────────────────
+/**
+ * Public handle a founder picks and can change later.
+ *
+ * Rules are deliberately narrow because the handle appears in URLs and in
+ * mentions: lowercase letters, digits, underscore and a single dot, 3 to 30
+ * characters, must start with a letter. Reserved words are refused by the
+ * backend, not here, so the list can change without a schema publish.
+ */
+export const USERNAME_MIN = 3;
+export const USERNAME_MAX = 30;
+export const usernameSchema = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .min(USERNAME_MIN, `Username must be at least ${USERNAME_MIN} characters`)
+    .max(USERNAME_MAX, `Username must be at most ${USERNAME_MAX} characters`)
+    .regex(/^[a-z][a-z0-9_]*(\.[a-z0-9_]+)?$/, 'Use letters, numbers and underscore. One dot allowed, and it cannot start with a dot.');
+// ─── Founder-facing enums ────────────────────────────────────────────────────
+/**
+ * Stage of the founder's current venture.
+ *
+ * Ordered from earliest to latest so a range filter can compare by index. Add
+ * new stages at the END or the stored ordinal of existing rows shifts.
+ */
+export const STARTUP_STAGE_VALUES = [
+    'idea',
+    'validation',
+    'mvp',
+    'pre_seed',
+    'seed',
+    'series_a_plus',
+    'profitable',
+    'exited',
+];
+export const startupStageSchema = z.enum(STARTUP_STAGE_VALUES);
+/**
+ * Industry the venture operates in. Kept as a closed list so Discover filters
+ * are a single indexed equality match rather than a text search.
+ */
+export const INDUSTRY_VALUES = [
+    'agritech',
+    'ai_ml',
+    'b2b_saas',
+    'consumer',
+    'climate',
+    'd2c',
+    'deeptech',
+    'edtech',
+    'fintech',
+    'gaming',
+    'healthtech',
+    'logistics',
+    'manufacturing',
+    'marketplace',
+    'media',
+    'mobility',
+    'proptech',
+    'robotics',
+    'services',
+    'space',
+    'other',
+];
+export const industrySchema = z.enum(INDUSTRY_VALUES);
+/**
+ * What the founder brings. Free-text skills were considered and rejected: two
+ * people typing "growth" and "Growth Marketing" would never match each other in
+ * a filter, and the Discover tab is the whole point of the product.
+ */
+export const SKILL_VALUES = [
+    'engineering',
+    'product',
+    'design',
+    'data',
+    'growth',
+    'sales',
+    'marketing',
+    'operations',
+    'finance',
+    'legal',
+    'hr_people',
+    'supply_chain',
+    'research',
+    'fundraising',
+    'community',
+];
+export const skillSchema = z.enum(SKILL_VALUES);
+/**
+ * What the member is here for. ONE list, replacing three.
+ *
+ * This was `lookingFor` with six values. The design draws eight "Goals &
+ * Passion" tiles and four more on the business step; all three were the same
+ * idea at three grains, and shipping them together would have meant nobody
+ * could say which one Discover filters on - the answer settled by whichever
+ * query got written first. Merged on hary's ruling, 2026-09-21, while there
+ * were still no rows in any database.
+ *
+ * ⚠️ Stored per member and used as a Mongoose enum. Append only; removing a
+ * value orphans documents already saved with it.
+ *
+ * ⚠️ `start_company` READS ODDLY next to its neighbours and is correct. It was
+ * queried on the grounds that it restates `venture.stage: 'idea'`; it does not,
+ * and the reason is worth keeping so nobody re-opens it. Inferring it from the
+ * venture works only for a member who ALREADY HAS a venture row, and somebody
+ * who wants to start a company is precisely the member with no venture at all,
+ * so there is nothing to infer from. It also cannot express a founder with a
+ * running company who wants to start another. Every other value is an ask of
+ * other people and this one is an ask of the product, which is the whole of the
+ * oddness. (hary, 2026-09-21.)
+ */
+export const GOAL_VALUES = [
+    'find_cofounder',
+    'find_investors',
+    'find_customers',
+    'hiring',
+    'partnerships',
+    'mentorship',
+    'grow_network',
+    'business_ideas',
+    'market_insights',
+    'learn_startup',
+    'start_company',
+];
+export const goalSchema = z.enum(GOAL_VALUES);
+// ─── Gender ──────────────────────────────────────────────────────────────────
+/**
+ * Demographic only. Nothing here computes anything from it, unlike the sibling
+ * gym product where gender feeds body-metric maths.
+ *
+ * Takes the family's three values and ADDS one rather than renaming any: a
+ * network for founders should let somebody decline the question without having
+ * to describe themselves as "other".
+ */
+export const GENDER_VALUES = ['male', 'female', 'other', 'prefer_not_to_say'];
+export const genderSchema = z.enum(GENDER_VALUES);
+// ─── Phone ───────────────────────────────────────────────────────────────────
+/**
+ * Indian mobile number: ten raw digits, no country code, matching the standard
+ * used across this family. Display adds the `+91`.
+ *
+ * ⚠️ WHERE IT IS STORED IS NOT A SCHEMA QUESTION, and it has been ruled: the
+ * phone lives on the account mirror, never as a second copy on the profile.
+ * Two stored copies drift the first time somebody edits one, and the profile's
+ * would be the copy nobody keeps in sync.
+ */
+export const phoneSchema = z
+    .string()
+    .trim()
+    .regex(/^[6-9]\d{9}$/, 'Enter a 10 digit mobile number');
+// ─── Location ────────────────────────────────────────────────────────────────
+/**
+ * Where the founder is based. City and country are what Discover filters on;
+ * coordinates are optional and only present when the member granted location.
+ *
+ * Note for later: this is a DECLARED location, not a GPS reading. Jansathi's
+ * rule applies here too — never write a declared location from a GPS capture.
+ */
+export const locationSchema = z.object({
+    city: z.string().trim().min(1).max(80),
+    state: optionalTrimmedString(80),
+    country: z.string().trim().min(1).max(80).default('India'),
+});
+// ─── Pagination ──────────────────────────────────────────────────────────────
+/**
+ * Cursor pagination query. Feed and Discover both use it.
+ *
+ * Cursor, not page number: the community feed changes under the reader, and an
+ * offset would repeat or skip posts as new ones land.
+ */
+export const paginationQuerySchema = z.object({
+    /**
+     * `?limit=` with nothing after it is treated as "not provided", not as a
+     * validation failure. A client that clears the control sends the empty
+     * string, and `z.coerce.number()` turns that into 0, which then fails
+     * `.min(1)`: the member sees a 400 for a page they never asked to size.
+     */
+    limit: z.preprocess(emptyStringToUndefined, z.coerce.number().int().min(1).max(50).default(20)),
+    cursor: z.string().trim().min(1).optional(),
+});
+//# sourceMappingURL=common.js.map

package/dist/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CACvD,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEpF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC;KACtC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAErC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC;IACjC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;CAC3B,CAAC,CAAC;AAEH,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,EAAE;KACb,GAAG,CAAC,YAAY,EAAE,6BAA6B,YAAY,aAAa,CAAC;KACzE,GAAG,CAAC,YAAY,EAAE,4BAA4B,YAAY,aAAa,CAAC;KACxE,KAAK,CACJ,kCAAkC,EAClC,uFAAuF,CACxF,CAAC;AAGJ,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM;IACN,YAAY;IACZ,KAAK;IACL,UAAU;IACV,MAAM;IACN,eAAe;IACf,YAAY;IACZ,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAG/D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,UAAU;IACV,OAAO;IACP,UAAU;IACV,UAAU;IACV,SAAS;IACT,KAAK;IACL,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,eAAe;IACf,aAAa;IACb,OAAO;IACP,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,OAAO;IACP,OAAO;CACC,CAAC;AACX,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAGtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,WAAW;IACX,YAAY;IACZ,SAAS;IACT,OAAO;IACP,WAAW;IACX,cAAc;IACd,UAAU;IACV,aAAa;IACb,WAAW;CACH,CAAC;AACX,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,eAAe;CACP,CAAC;AACX,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAG9C,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAU,CAAC;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAGlD,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;AAE3D,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAC3D,CAAC,CAAC;AAGH,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC","sourcesContent":["/**\n * founder-schema — Shared helpers and core enums\n *\n * The stable building blocks reused across every Founder Circle schema.\n * Anything that both the backend and a client need to agree on lives here.\n *\n * @module founder-schema/common\n */\n\nimport { z } from 'zod';\n\n// ─── String helpers ──────────────────────────────────────────────────────────\n\n/**\n * Converts empty / whitespace-only strings to `undefined` so Zod `.optional()`\n * treats them as \"not provided\".\n *\n * Why this exists: an HTML form submits `\"\"` for a cleared field, and without\n * this an optional field would be stored as an empty string rather than left\n * alone. Jansathi shipped that bug in dating onboarding.\n */\nexport const emptyStringToUndefined = (value: unknown): unknown => {\n  if (typeof value === 'string' && value.trim() === '') return undefined;\n  return value;\n};\n\n/** Optional trimmed string. Empty strings are coerced to `undefined`. */\nexport const optionalTrimmedString = (maxLength = 100) =>\n  z.preprocess(emptyStringToUndefined, z.string().trim().max(maxLength).optional());\n\n/** A Mongo ObjectId as it crosses the wire: 24 lowercase hex characters. */\nexport const objectIdSchema = z\n  .string()\n  .regex(/^[0-9a-f]{24}$/i, 'Invalid id')\n  .transform((v) => v.toLowerCase());\n\n// ─── URLs ────────────────────────────────────────────────────────────────────\n\n/**\n * A URL safe to store and, after the consumer's own check, to render.\n *\n * Use this for EVERY member-supplied URL. Never bare `z.url()`: it accepts any\n * scheme the URL parser accepts, so `javascript:alert(document.cookie)`,\n * `data:text/html,<script>...`, `vbscript:` and `file:///etc/passwd` all pass.\n * Each of those is stored XSS the moment a client renders it as an `href`, and\n * `data:` is the same in an `<img src>`.\n *\n * `hostname` is restricted too, not only the scheme. A bare host like\n * `localhost` or a literal IP is refused, which closes server-side request\n * forgery: this product runs on EC2 with an instance role, so a member-supplied\n * `http://169.254.169.254/latest/meta-data/` that anything server-side ever\n * fetches is a credential read.\n *\n * Validating here is necessary and not sufficient. A consumer still treats a\n * stored URL as untrusted at render time, because rows written before this\n * existed were never checked.\n *\n * ⚠️ IF THIS EVER GROWS A HOST ALLOWLIST, compare the PARSED hostname for\n * exact equality. Never `includes`, never `endsWith`, never a regex over the\n * whole URL. Each of these is a real bypass of a naive \"is it YouTube\" check,\n * and all three read as obviously fine:\n *\n *   https://evil.example/?next=youtube.com/watch  contains the string\n *   youtube.com.evil.example                      starts with it\n *   youtu.be.evil.example                         a suffix check passes it\n *\n * The same mistake in the opposite direction to the `javascript:` hole: there\n * the scheme was too permissive, here the host check only LOOKS strict.\n * (krish hit this rendering inline video, 2026-09-21, and handles it by parsing\n * and comparing the hostname exactly.)\n */\nexport const httpUrlSchema = z.url({\n  protocol: /^https?$/,\n  hostname: z.regexes.domain,\n});\n\n// ─── Username ────────────────────────────────────────────────────────────────\n\n/**\n * Public handle a founder picks and can change later.\n *\n * Rules are deliberately narrow because the handle appears in URLs and in\n * mentions: lowercase letters, digits, underscore and a single dot, 3 to 30\n * characters, must start with a letter. Reserved words are refused by the\n * backend, not here, so the list can change without a schema publish.\n */\nexport const USERNAME_MIN = 3;\nexport const USERNAME_MAX = 30;\n\nexport const usernameSchema = z\n  .string()\n  .trim()\n  .toLowerCase()\n  .min(USERNAME_MIN, `Username must be at least ${USERNAME_MIN} characters`)\n  .max(USERNAME_MAX, `Username must be at most ${USERNAME_MAX} characters`)\n  .regex(\n    /^[a-z][a-z0-9_]*(\\.[a-z0-9_]+)?$/,\n    'Use letters, numbers and underscore. One dot allowed, and it cannot start with a dot.',\n  );\nexport type Username = z.infer<typeof usernameSchema>;\n\n// ─── Founder-facing enums ────────────────────────────────────────────────────\n\n/**\n * Stage of the founder's current venture.\n *\n * Ordered from earliest to latest so a range filter can compare by index. Add\n * new stages at the END or the stored ordinal of existing rows shifts.\n */\nexport const STARTUP_STAGE_VALUES = [\n  'idea',\n  'validation',\n  'mvp',\n  'pre_seed',\n  'seed',\n  'series_a_plus',\n  'profitable',\n  'exited',\n] as const;\nexport const startupStageSchema = z.enum(STARTUP_STAGE_VALUES);\nexport type StartupStage = z.infer<typeof startupStageSchema>;\n\n/**\n * Industry the venture operates in. Kept as a closed list so Discover filters\n * are a single indexed equality match rather than a text search.\n */\nexport const INDUSTRY_VALUES = [\n  'agritech',\n  'ai_ml',\n  'b2b_saas',\n  'consumer',\n  'climate',\n  'd2c',\n  'deeptech',\n  'edtech',\n  'fintech',\n  'gaming',\n  'healthtech',\n  'logistics',\n  'manufacturing',\n  'marketplace',\n  'media',\n  'mobility',\n  'proptech',\n  'robotics',\n  'services',\n  'space',\n  'other',\n] as const;\nexport const industrySchema = z.enum(INDUSTRY_VALUES);\nexport type Industry = z.infer<typeof industrySchema>;\n\n/**\n * What the founder brings. Free-text skills were considered and rejected: two\n * people typing \"growth\" and \"Growth Marketing\" would never match each other in\n * a filter, and the Discover tab is the whole point of the product.\n */\nexport const SKILL_VALUES = [\n  'engineering',\n  'product',\n  'design',\n  'data',\n  'growth',\n  'sales',\n  'marketing',\n  'operations',\n  'finance',\n  'legal',\n  'hr_people',\n  'supply_chain',\n  'research',\n  'fundraising',\n  'community',\n] as const;\nexport const skillSchema = z.enum(SKILL_VALUES);\nexport type Skill = z.infer<typeof skillSchema>;\n\n/**\n * What the member is here for. ONE list, replacing three.\n *\n * This was `lookingFor` with six values. The design draws eight \"Goals &\n * Passion\" tiles and four more on the business step; all three were the same\n * idea at three grains, and shipping them together would have meant nobody\n * could say which one Discover filters on - the answer settled by whichever\n * query got written first. Merged on hary's ruling, 2026-09-21, while there\n * were still no rows in any database.\n *\n * ⚠️ Stored per member and used as a Mongoose enum. Append only; removing a\n * value orphans documents already saved with it.\n *\n * ⚠️ `start_company` READS ODDLY next to its neighbours and is correct. It was\n * queried on the grounds that it restates `venture.stage: 'idea'`; it does not,\n * and the reason is worth keeping so nobody re-opens it. Inferring it from the\n * venture works only for a member who ALREADY HAS a venture row, and somebody\n * who wants to start a company is precisely the member with no venture at all,\n * so there is nothing to infer from. It also cannot express a founder with a\n * running company who wants to start another. Every other value is an ask of\n * other people and this one is an ask of the product, which is the whole of the\n * oddness. (hary, 2026-09-21.)\n */\nexport const GOAL_VALUES = [\n  'find_cofounder',\n  'find_investors',\n  'find_customers',\n  'hiring',\n  'partnerships',\n  'mentorship',\n  'grow_network',\n  'business_ideas',\n  'market_insights',\n  'learn_startup',\n  'start_company',\n] as const;\nexport const goalSchema = z.enum(GOAL_VALUES);\nexport type Goal = z.infer<typeof goalSchema>;\n\n// ─── Gender ──────────────────────────────────────────────────────────────────\n\n/**\n * Demographic only. Nothing here computes anything from it, unlike the sibling\n * gym product where gender feeds body-metric maths.\n *\n * Takes the family's three values and ADDS one rather than renaming any: a\n * network for founders should let somebody decline the question without having\n * to describe themselves as \"other\".\n */\nexport const GENDER_VALUES = ['male', 'female', 'other', 'prefer_not_to_say'] as const;\nexport const genderSchema = z.enum(GENDER_VALUES);\nexport type Gender = z.infer<typeof genderSchema>;\n\n// ─── Phone ───────────────────────────────────────────────────────────────────\n\n/**\n * Indian mobile number: ten raw digits, no country code, matching the standard\n * used across this family. Display adds the `+91`.\n *\n * ⚠️ WHERE IT IS STORED IS NOT A SCHEMA QUESTION, and it has been ruled: the\n * phone lives on the account mirror, never as a second copy on the profile.\n * Two stored copies drift the first time somebody edits one, and the profile's\n * would be the copy nobody keeps in sync.\n */\nexport const phoneSchema = z\n  .string()\n  .trim()\n  .regex(/^[6-9]\\d{9}$/, 'Enter a 10 digit mobile number');\n\n// ─── Location ────────────────────────────────────────────────────────────────\n\n/**\n * Where the founder is based. City and country are what Discover filters on;\n * coordinates are optional and only present when the member granted location.\n *\n * Note for later: this is a DECLARED location, not a GPS reading. Jansathi's\n * rule applies here too — never write a declared location from a GPS capture.\n */\nexport const locationSchema = z.object({\n  city: z.string().trim().min(1).max(80),\n  state: optionalTrimmedString(80),\n  country: z.string().trim().min(1).max(80).default('India'),\n});\nexport type FounderLocation = z.infer<typeof locationSchema>;\n\n// ─── Pagination ──────────────────────────────────────────────────────────────\n\n/**\n * Cursor pagination query. Feed and Discover both use it.\n *\n * Cursor, not page number: the community feed changes under the reader, and an\n * offset would repeat or skip posts as new ones land.\n */\nexport const paginationQuerySchema = z.object({\n  /**\n   * `?limit=` with nothing after it is treated as \"not provided\", not as a\n   * validation failure. A client that clears the control sends the empty\n   * string, and `z.coerce.number()` turns that into 0, which then fails\n   * `.min(1)`: the member sees a 400 for a page they never asked to size.\n   */\n  limit: z.preprocess(emptyStringToUndefined, z.coerce.number().int().min(1).max(50).default(20)),\n  cursor: z.string().trim().min(1).optional(),\n});\nexport type PaginationQuery = z.infer<typeof paginationQuerySchema>;\n"]}

package/dist/discover.d.ts

@@ -0,0 +1,153 @@
+/**
+ * founder-schema — Discover search and filters
+ *
+ * Search is by name; the filters are industry, skill, startup stage and
+ * location. The community surface the Discover tab will grow later is not
+ * modelled yet.
+ *
+ * @module founder-schema/discover
+ */
+import { z } from 'zod';
+/**
+ * Every free-text filter here is `optionalTrimmedString`, so an EMPTY one is
+ * treated as "not provided" rather than as a validation failure.
+ *
+ * A search box the member has just cleared sends `?q=`, and a select they reset
+ * sends `?city=`. Refusing those turns an ordinary interaction into a 400 with
+ * nothing useful to show for it: the member asked for fewer filters, not for an
+ * error. This is the one place the create-body rule and the patch-body rule
+ * agree, because a query has nothing to erase.
+ */
+export declare const discoverQuerySchema: z.ZodObject<{
+    limit: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>, unknown>;
+    cursor: z.ZodOptional<z.ZodString>;
+    q: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+    industry: z.ZodPreprocess<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        agritech: "agritech";
+        ai_ml: "ai_ml";
+        b2b_saas: "b2b_saas";
+        consumer: "consumer";
+        climate: "climate";
+        d2c: "d2c";
+        deeptech: "deeptech";
+        edtech: "edtech";
+        fintech: "fintech";
+        gaming: "gaming";
+        healthtech: "healthtech";
+        logistics: "logistics";
+        manufacturing: "manufacturing";
+        marketplace: "marketplace";
+        media: "media";
+        mobility: "mobility";
+        proptech: "proptech";
+        robotics: "robotics";
+        services: "services";
+        space: "space";
+        other: "other";
+    }>>>, unknown>;
+    skill: z.ZodPreprocess<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        engineering: "engineering";
+        product: "product";
+        design: "design";
+        data: "data";
+        growth: "growth";
+        sales: "sales";
+        marketing: "marketing";
+        operations: "operations";
+        finance: "finance";
+        legal: "legal";
+        hr_people: "hr_people";
+        supply_chain: "supply_chain";
+        research: "research";
+        fundraising: "fundraising";
+        community: "community";
+    }>>>, unknown>;
+    stage: z.ZodPreprocess<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        idea: "idea";
+        validation: "validation";
+        mvp: "mvp";
+        pre_seed: "pre_seed";
+        seed: "seed";
+        series_a_plus: "series_a_plus";
+        profitable: "profitable";
+        exited: "exited";
+    }>>>, unknown>;
+    city: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+    country: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+}, z.core.$strip>;
+export type DiscoverQuery = z.infer<typeof discoverQuerySchema>;
+/**
+ * The filter set the Discover UI renders. Served by the backend rather than
+ * hard-coded in each client, so adding an industry does not need three
+ * releases.
+ */
+export declare const discoverFacetsSchema: z.ZodObject<{
+    industries: z.ZodArray<z.ZodObject<{
+        value: z.ZodEnum<{
+            agritech: "agritech";
+            ai_ml: "ai_ml";
+            b2b_saas: "b2b_saas";
+            consumer: "consumer";
+            climate: "climate";
+            d2c: "d2c";
+            deeptech: "deeptech";
+            edtech: "edtech";
+            fintech: "fintech";
+            gaming: "gaming";
+            healthtech: "healthtech";
+            logistics: "logistics";
+            manufacturing: "manufacturing";
+            marketplace: "marketplace";
+            media: "media";
+            mobility: "mobility";
+            proptech: "proptech";
+            robotics: "robotics";
+            services: "services";
+            space: "space";
+            other: "other";
+        }>;
+        label: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    skills: z.ZodArray<z.ZodObject<{
+        value: z.ZodEnum<{
+            engineering: "engineering";
+            product: "product";
+            design: "design";
+            data: "data";
+            growth: "growth";
+            sales: "sales";
+            marketing: "marketing";
+            operations: "operations";
+            finance: "finance";
+            legal: "legal";
+            hr_people: "hr_people";
+            supply_chain: "supply_chain";
+            research: "research";
+            fundraising: "fundraising";
+            community: "community";
+        }>;
+        label: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    stages: z.ZodArray<z.ZodObject<{
+        value: z.ZodEnum<{
+            idea: "idea";
+            validation: "validation";
+            mvp: "mvp";
+            pre_seed: "pre_seed";
+            seed: "seed";
+            series_a_plus: "series_a_plus";
+            profitable: "profitable";
+            exited: "exited";
+        }>;
+        label: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    cities: z.ZodArray<z.ZodObject<{
+        value: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DiscoverFacets = z.infer<typeof discoverFacetsSchema>;
+//# sourceMappingURL=discover.d.ts.map