founder-schema 0.10.0 → 0.12.0

package/README.md

@@ -99,6 +99,104 @@ instance; this package must not bring its own.
 
 ---
 
+## Breaking in 0.12.0: membership, plans and payments (2026-10-11)
+
+Looking is free; taking part needs a membership (Rs 99 once), and Premium and
+Business add live products and new people to message. Design:
+`founder-circle-backend/docs/membership-and-plans.md`. No export removed.
+
+- **Required on answers, so the BACKEND DEPLOYS FIRST.** A 0.12.0 client
+  refuses a 0.11.0 server's answer to: `/me/access` (`standing`), a product
+  (`viewer.canSetLive`), `/chat/open` (`via`), a staff member's detail
+  (`standing`, `membership`, `plan`, `viewer.canGrantMembership`,
+  `canRevokeMembership`, `canReadPayments`, `canReadMembership`), the
+  Overview (`billing`, with `paymentsNeedingAction`), an order's state
+  (`notApplied`), the staff payments list (`needsAction`), a staff payment's
+  detail (`refundedOutside`: what dashboard refunds already gave back;
+  `strayPayments`: second payments and whether each is refunded) and a
+  review's viewer flags (`canRemoveReply`: the team takes its reply back,
+  member or not). A comment's `canMarkHelpful` on a MARKED comment now means
+  "may take the mark back" (on the team, member or not).
+- **The price list is here:** `MEMBERSHIP_PRICE_PAISE`, `MEMBER_LIMIT_VALUES`,
+  `PLAN_SPECS` (each plan's name, prices and limits) and `FOUNDING_PLACES`.
+  The backend charges and counts from them and the web's Terms are written
+  from them, so a price change is a schema release.
+- **Money taken but not used** is refunded by itself: `orderStateSchema.notApplied`
+  says so to the buyer; staff list it with `staffPaymentsQuerySchema.needsAction`
+  and see `staffPaymentSummarySchema.needsAction`. `PLAN_CHANGED` (409) is an
+  upgrade whose plan moved while paying.
+- **A free coupon needs no billing details:** `createOrderBodySchema.billing` is
+  optional; a paid order without it is refused with the validation key
+  `billingStateRequired` on `billing.stateCode`.
+- **Why a product is paused:** `productSchema.pausedBy` (`PRODUCT_PAUSED_BY_VALUES`:
+  `limit` comes back by itself, `owner` stays down), set with `paused`.
+- **Access:** actions `react`, `vote`, `save`, `join`, `message`, `refund`
+  and subjects `Membership`, `Payment`, `Coupon` are appended (never
+  reordered: rules are packed by index). `access/standing.ts` adds
+  `STANDING_VALUES` (`viewer`, `member`) and `ACCESS_REASON_VALUES`
+  (`MEMBERSHIP_REQUIRED`, `PLAN_REQUIRED`, `MESSAGE_NOT_ACCEPTED`): the
+  reason a packed rule carries, which the web reads to open the Join sheet or
+  the plans instead of drawing a dead control.
+- **Added domains:** `domains/membership` (kinds, tiers, periods, the plan
+  catalogue, `meMembershipSchema`), `domains/billing` (quotes, orders,
+  checkout, payments, invoices and credit notes, refunds, coupons, the staff
+  payment shapes) and `domains/billing/gst` (the 36 GST state codes, the
+  GSTIN checksum, `billingDetailsSchema`).
+- **Chat:** `openChatBodySchema.useAllowance` (spend one of this month's new
+  people, only when the member agreed), `chatReachSchema` (`GET
+  /chat/reach/:userId`), `messagingSettingsSchema` (`/me/messaging`). A staff
+  role reaches anyone who can chat: reach `staff`, `openChatResponseSchema.via`
+  `staff` (both enums appended).
+- **Products:** card `paused?` (optional), `setProductLiveBodySchema`
+  (`PUT /products/:id/live`). `PRODUCTS_OWNED_MAX` is DEPRECATED: the limit is
+  per plan now and counts LIVE products (`GET /me/membership`'s `limits`).
+- **Notifications:** kinds `plan_ending`, `plan_ended`, `payment_refunded`
+  (from Founder Circle, no actor). **Audit:** `membership.granted`,
+  `membership.revoked`, `payment.refunded`, `coupon.created`,
+  `coupon.updated`. **Errors:** 23 codes, from `PRODUCT_PAUSED` to
+  `MESSAGE_NOT_ACCEPTED`; `apiErrorDetails` gains `limit`, `left`, `resetsAt`.
+- **Limits:** `REFUND_WINDOW_DAYS` 7, `ORDER_TTL_MINUTES` 30,
+  `PLAN_AHEAD_MAX_YEARS` 3, `PLAN_REMINDER_DAYS` [7, 1],
+  `PRODUCTS_LIVE_SAFETY_MAX` 100, and the coupon and billing text bounds.
+- **Deploy:** backend, then `sync-indexes --apply`, then
+  `membership-setup sync-mirror`, `seed-coupon` (and `dev-grant` on dev only),
+  then web. The backend design doc's section 16 has the full order.
+
+---
+
+## Changes in 0.11.0: erasure retention, and a member's page (2026-10-11)
+
+No export removed. The backend deploys BEFORE the web, as always, and here
+it matters three ways if not: (1) one read gains a REQUIRED field
+(`visibility` on `myPersonalDetailsSchema`), so a 0.11.0 web against a 0.10.0
+server cannot load Me's personal details or their editor; (2) a 0.10.0 server
+has no member page, so every member link answers "not here"; (3) a 0.10.0
+server's `GET /products/by-member/:userId` still lists a member's UNLISTED
+products to everyone, and the 0.11.0 web shows that list on the member page.
+Backend first is safe: a 0.10.0 web ignores `visibility`, `PATCH /profiles/me`
+still takes `location`, and no 0.10.0 web code calls the two new reads.
+
+- **Added: `ERASURE_RETENTION_DAYS` (180)**, `core/limits.ts`: how long what a
+  deleted account leaves behind, and the text of content its author deleted or
+  moderation removed, is kept before the backend's `erasure-purge` job purges
+  it (the user's ruling; the IT Rules 2021 floor). The web's Privacy Policy
+  states the same number and its test reads this constant.
+- **Added: what a member chooses to show** (the user's ruling): email, phone,
+  gender and birthday are private until the member switches each on.
+  `CONTACT_VISIBILITY_FIELDS`, `contactVisibilitySchema` (four booleans);
+  `myPersonalDetailsSchema.visibility` (the switches, as stored);
+  `updateMyPersonalDetailsBodySchema.visibility` (a PARTIAL: only the
+  switches that moved) and `.location` (the city moved to the personal card;
+  `null` removes it). `PATCH /profiles/me` still takes `location` too.
+- **Added: a member's page**, `GET /founders/by-username/:username`:
+  `memberHandleParamsSchema` and `memberProfileSchema`, the public profile
+  plus `shown` (only what the member switched on, decided by the server for
+  this viewer: email and phone only to signed-in members) and `viewer`
+  (`isSelf`, `canMessage`, the server's answers). A shown birthday is
+  `publicBirthdaySchema`, a day and a month: the year never leaves the
+  server. `memberProfileSchema` is in the "never public at top level" test:
+  nothing private sits outside `shown`.
+
 ## Changes in 0.10.0: the Me hub (2026-10-11)
 
 Me becomes a hub: the member's own details, their public profile, and a

package/dist/access/access.d.ts

@@ -30,32 +30,36 @@ export declare const mpinSchema: z.ZodString;
 /** The answer to `GET /me/access`, and to every switch. */
 export declare const meAccessResponseSchema: z.ZodObject<{
     roles: z.ZodArray<z.ZodEnum<{
+        moderator: "moderator";
         superadmin: "superadmin";
+        member: "member";
         manager: "manager";
-        moderator: "moderator";
         support_agent: "support_agent";
-        member: "member";
     }>>;
     activeRole: z.ZodEnum<{
+        moderator: "moderator";
         superadmin: "superadmin";
+        member: "member";
         manager: "manager";
-        moderator: "moderator";
         support_agent: "support_agent";
-        member: "member";
     }>;
     activeRoleExpiresAt: z.ZodNullable<z.ZodISODateTime>;
     mpinSet: z.ZodBoolean;
+    standing: z.ZodEnum<{
+        viewer: "viewer";
+        member: "member";
+    }>;
     rules: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
 }, z.core.$strip>;
 export type MeAccessResponse = z.infer<typeof meAccessResponseSchema>;
 /** `PUT /me/active-role`. Back to member needs nothing; any staff role needs the MPIN. */
 export declare const switchRoleBodySchema: z.ZodObject<{
     role: z.ZodEnum<{
+        moderator: "moderator";
         superadmin: "superadmin";
+        member: "member";
         manager: "manager";
-        moderator: "moderator";
         support_agent: "support_agent";
-        member: "member";
     }>;
     mpin: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/access/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/access/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,2CAA2C;AAC3C,eAAO,MAAM,YAAY,QAAiB,CAAC;AAE3C,eAAO,MAAM,UAAU,aAA8D,CAAC;AAEtF,2DAA2D;AAC3D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAWjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB;;;;;;;;;iBAQ7B,CAAC;AACL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,oDAAoD;AACpD,eAAO,MAAM,iBAAiB;;;iBAEA,CAAC;AAC/B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,sEAAsE;AACtE,eAAO,MAAM,oBAAoB;;;;iBAEH,CAAC;AAC/B,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/access/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,2CAA2C;AAC3C,eAAO,MAAM,YAAY,QAAiB,CAAC;AAE3C,eAAO,MAAM,UAAU,aAA8D,CAAC;AAEtF,2DAA2D;AAC3D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;iBAiBjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB;;;;;;;;;iBAQ7B,CAAC;AACL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,oDAAoD;AACpD,eAAO,MAAM,iBAAiB;;;iBAEA,CAAC;AAC/B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,sEAAsE;AACtE,eAAO,MAAM,oBAAoB;;;;iBAEH,CAAC;AAC/B,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/access/access.js

@@ -24,6 +24,7 @@ import { z } from 'zod';
 import { VALIDATION_MESSAGE } from '../core/validation.js';
 import { packedRulesSchema } from './permissions.js';
 import { MEMBER_ROLE, roleSchema } from './roles.js';
+import { standingSchema } from './standing.js';
 export const MPIN_LENGTH = 6;
 /** Wrong tries before the MPIN locks. */
 export const MPIN_MAX_ATTEMPTS = 5;
@@ -40,7 +41,13 @@ export const meAccessResponseSchema = z.object({
     activeRoleExpiresAt: z.iso.datetime().nullable(),
     /** Whether an MPIN is set, so the switcher knows to ask for one or to offer setting one. */
     mpinSet: z.boolean(),
-    /** The active role's permissions, packed (`packRules`). */
+    /**
+     * Whether they take part or only look (0.12.0, `access/standing`). The
+     * rules already say what follows from it; this says it plainly, for the
+     * places that word it ("Become a member to take part").
+     */
+    standing: standingSchema,
+    /** The active role's permissions, packed (`packRules`), refusals with their reasons. */
     rules: packedRulesSchema,
 });
 /** `PUT /me/active-role`. Back to member needs nothing; any staff role needs the MPIN. */

package/dist/access/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/access/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAEtF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,6EAA6E;IAC7E,UAAU,EAAE,UAAU;IACtB,uFAAuF;IACvF,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,2DAA2D;IAC3D,KAAK,EAAE,iBAAiB;CACzB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE;IACtE,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC,YAAY;CACvC,CAAC,CAAC;AAGL,MAAM,SAAS,GAAG,CAAkD,IAAO,EAAE,EAAE,CAC7E,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;AACjC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,YAAY,EAAE,CAAC;AAEnF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KACrD,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAG/B,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC9E,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC","sourcesContent":["/**\n * founder-schema: the access API\n *\n *   GET  /api/v1/me/access        who I am acting as, what I hold, my rules\n *   PUT  /api/v1/me/active-role   switch role (a staff role needs the MPIN)\n *   POST /api/v1/me/mpin          set the MPIN, once\n *   PUT  /api/v1/me/mpin          change it, with the current one\n *\n * THE MPIN is a 6-digit code that stands between a signed-in member and their\n * staff roles. Signing in proves who you are; the MPIN proves it is still you\n * at the moment you pick up admin powers, on a phone that may have been left\n * unlocked. Set once by its owner; a forgotten one is cleared by a superadmin\n * (an audited action), after which the owner sets a new one. `MPIN_MAX_ATTEMPTS`\n * wrong tries lock it for `MPIN_LOCK_MS`.\n *\n * THE ACTIVE ROLE is per account (the user's ruling, 2026-10-05): switching on\n * one device switches every device. It lasts `ACTIVE_ROLE_TTL_MS`, and the\n * server re-checks it on EVERY request: a role that was revoked, or that\n * expired, is acting as a member again at once, not at the next sign-in.\n *\n * @module founder-schema/access/access\n */\n\nimport { z } from 'zod';\nimport { VALIDATION_MESSAGE } from '../core/validation.js';\nimport { packedRulesSchema } from './permissions.js';\nimport { MEMBER_ROLE, roleSchema } from './roles.js';\n\nexport const MPIN_LENGTH = 6;\n/** Wrong tries before the MPIN locks. */\nexport const MPIN_MAX_ATTEMPTS = 5;\n/** How long a locked MPIN stays locked. */\nexport const MPIN_LOCK_MS = 15 * 60 * 1000;\n\nexport const mpinSchema = z.string().regex(/^\\d{6}$/, VALIDATION_MESSAGE.mpinInvalid);\n\n/** The answer to `GET /me/access`, and to every switch. */\nexport const meAccessResponseSchema = z.object({\n  /** Every role held, member always among them, highest first. */\n  roles: z.array(roleSchema).min(1),\n  /** The role being acted as now. Member when no staff role is switched on. */\n  activeRole: roleSchema,\n  /** When the active staff role lapses back to member. Null while acting as a member. */\n  activeRoleExpiresAt: z.iso.datetime().nullable(),\n  /** Whether an MPIN is set, so the switcher knows to ask for one or to offer setting one. */\n  mpinSet: z.boolean(),\n  /** The active role's permissions, packed (`packRules`). */\n  rules: packedRulesSchema,\n});\nexport type MeAccessResponse = z.infer<typeof meAccessResponseSchema>;\n\n/** `PUT /me/active-role`. Back to member needs nothing; any staff role needs the MPIN. */\nexport const switchRoleBodySchema = z\n  .object({\n    role: roleSchema,\n    mpin: mpinSchema.optional(),\n  })\n  .refine((body) => body.role === MEMBER_ROLE || body.mpin !== undefined, {\n    path: ['mpin'],\n    error: VALIDATION_MESSAGE.mpinRequired,\n  });\nexport type SwitchRoleBody = z.infer<typeof switchRoleBodySchema>;\n\nconst confirmed = <T extends { mpin: string; confirmMpin: string }>(body: T) =>\n  body.mpin === body.confirmMpin;\nconst mismatch = { path: ['confirmMpin'], error: VALIDATION_MESSAGE.mpinMismatch };\n\n/** `POST /me/mpin`: the first MPIN, typed twice. */\nexport const setMpinBodySchema = z\n  .object({ mpin: mpinSchema, confirmMpin: mpinSchema })\n  .refine(confirmed, mismatch);\nexport type SetMpinBody = z.infer<typeof setMpinBodySchema>;\n\n/** `PUT /me/mpin`: the current MPIN, then the new one typed twice. */\nexport const changeMpinBodySchema = z\n  .object({ currentMpin: mpinSchema, mpin: mpinSchema, confirmMpin: mpinSchema })\n  .refine(confirmed, mismatch);\nexport type ChangeMpinBody = z.infer<typeof changeMpinBodySchema>;\n"]}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/access/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAEtF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,6EAA6E;IAC7E,UAAU,EAAE,UAAU;IACtB,uFAAuF;IACvF,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,4FAA4F;IAC5F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB;;;;OAIG;IACH,QAAQ,EAAE,cAAc;IACxB,wFAAwF;IACxF,KAAK,EAAE,iBAAiB;CACzB,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE;IACtE,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC,YAAY;CACvC,CAAC,CAAC;AAGL,MAAM,SAAS,GAAG,CAAkD,IAAO,EAAE,EAAE,CAC7E,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;AACjC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,YAAY,EAAE,CAAC;AAEnF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KACrD,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAG/B,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC9E,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC","sourcesContent":["/**\n * founder-schema: the access API\n *\n *   GET  /api/v1/me/access        who I am acting as, what I hold, my rules\n *   PUT  /api/v1/me/active-role   switch role (a staff role needs the MPIN)\n *   POST /api/v1/me/mpin          set the MPIN, once\n *   PUT  /api/v1/me/mpin          change it, with the current one\n *\n * THE MPIN is a 6-digit code that stands between a signed-in member and their\n * staff roles. Signing in proves who you are; the MPIN proves it is still you\n * at the moment you pick up admin powers, on a phone that may have been left\n * unlocked. Set once by its owner; a forgotten one is cleared by a superadmin\n * (an audited action), after which the owner sets a new one. `MPIN_MAX_ATTEMPTS`\n * wrong tries lock it for `MPIN_LOCK_MS`.\n *\n * THE ACTIVE ROLE is per account (the user's ruling, 2026-10-05): switching on\n * one device switches every device. It lasts `ACTIVE_ROLE_TTL_MS`, and the\n * server re-checks it on EVERY request: a role that was revoked, or that\n * expired, is acting as a member again at once, not at the next sign-in.\n *\n * @module founder-schema/access/access\n */\n\nimport { z } from 'zod';\nimport { VALIDATION_MESSAGE } from '../core/validation.js';\nimport { packedRulesSchema } from './permissions.js';\nimport { MEMBER_ROLE, roleSchema } from './roles.js';\nimport { standingSchema } from './standing.js';\n\nexport const MPIN_LENGTH = 6;\n/** Wrong tries before the MPIN locks. */\nexport const MPIN_MAX_ATTEMPTS = 5;\n/** How long a locked MPIN stays locked. */\nexport const MPIN_LOCK_MS = 15 * 60 * 1000;\n\nexport const mpinSchema = z.string().regex(/^\\d{6}$/, VALIDATION_MESSAGE.mpinInvalid);\n\n/** The answer to `GET /me/access`, and to every switch. */\nexport const meAccessResponseSchema = z.object({\n  /** Every role held, member always among them, highest first. */\n  roles: z.array(roleSchema).min(1),\n  /** The role being acted as now. Member when no staff role is switched on. */\n  activeRole: roleSchema,\n  /** When the active staff role lapses back to member. Null while acting as a member. */\n  activeRoleExpiresAt: z.iso.datetime().nullable(),\n  /** Whether an MPIN is set, so the switcher knows to ask for one or to offer setting one. */\n  mpinSet: z.boolean(),\n  /**\n   * Whether they take part or only look (0.12.0, `access/standing`). The\n   * rules already say what follows from it; this says it plainly, for the\n   * places that word it (\"Become a member to take part\").\n   */\n  standing: standingSchema,\n  /** The active role's permissions, packed (`packRules`), refusals with their reasons. */\n  rules: packedRulesSchema,\n});\nexport type MeAccessResponse = z.infer<typeof meAccessResponseSchema>;\n\n/** `PUT /me/active-role`. Back to member needs nothing; any staff role needs the MPIN. */\nexport const switchRoleBodySchema = z\n  .object({\n    role: roleSchema,\n    mpin: mpinSchema.optional(),\n  })\n  .refine((body) => body.role === MEMBER_ROLE || body.mpin !== undefined, {\n    path: ['mpin'],\n    error: VALIDATION_MESSAGE.mpinRequired,\n  });\nexport type SwitchRoleBody = z.infer<typeof switchRoleBodySchema>;\n\nconst confirmed = <T extends { mpin: string; confirmMpin: string }>(body: T) =>\n  body.mpin === body.confirmMpin;\nconst mismatch = { path: ['confirmMpin'], error: VALIDATION_MESSAGE.mpinMismatch };\n\n/** `POST /me/mpin`: the first MPIN, typed twice. */\nexport const setMpinBodySchema = z\n  .object({ mpin: mpinSchema, confirmMpin: mpinSchema })\n  .refine(confirmed, mismatch);\nexport type SetMpinBody = z.infer<typeof setMpinBodySchema>;\n\n/** `PUT /me/mpin`: the current MPIN, then the new one typed twice. */\nexport const changeMpinBodySchema = z\n  .object({ currentMpin: mpinSchema, mpin: mpinSchema, confirmMpin: mpinSchema })\n  .refine(confirmed, mismatch);\nexport type ChangeMpinBody = z.infer<typeof changeMpinBodySchema>;\n"]}

package/dist/access/permissions.d.ts

@@ -17,7 +17,9 @@
  */
 import type { ForcedSubject, MongoAbility } from '@casl/ability';
 import { z } from 'zod';
+import type { PurchaseKind } from '../domains/billing/billing.js';
 import type { PlatformRole } from './roles.js';
+import type { Standing } from './standing.js';
 /**
  * The verbs.
  *
@@ -31,10 +33,24 @@ import type { PlatformRole } from './roles.js';
  *   represent act for a product as one of its team: tag a post with it, reply
  *             to its reviews, mark feedback helpful, confirm a tester
  *
+ * Taking part (0.12.0, membership): the verbs a viewer is refused and a member
+ * holds. Creating content stays `create`; these are the rest.
+ *
+ *   react     a reaction on a post, poll or comment; an upvote on a product;
+ *             marking a review helpful
+ *   vote      vote in a poll
+ *   save      bookmark a post or poll
+ *   join      join a community, ask to, or accept its invitation; accept an
+ *             invitation to a product's team
+ *   message   start a conversation with a Member
+ *   refund    give a payment's money back (staff)
+ *
  * Append only: a stored or packed rule names these.
  */
-export declare const ACTION_VALUES: readonly ["manage", "create", "read", "update", "delete", "moderate", "assign", "suspend", "resolve", "reset", "represent"];
+export declare const ACTION_VALUES: readonly ["manage", "create", "read", "update", "delete", "moderate", "assign", "suspend", "resolve", "reset", "represent", "react", "vote", "save", "join", "message", "refund"];
 export declare const actionSchema: z.ZodEnum<{
+    join: "join";
+    message: "message";
     manage: "manage";
     create: "create";
     read: "read";
@@ -46,6 +62,10 @@ export declare const actionSchema: z.ZodEnum<{
     resolve: "resolve";
     reset: "reset";
     represent: "represent";
+    react: "react";
+    vote: "vote";
+    save: "save";
+    refund: "refund";
 }>;
 export type Action = z.infer<typeof actionSchema>;
 /**
@@ -66,8 +86,11 @@ export type Action = z.infer<typeof actionSchema>;
  *   Review            a member's stars and words on a product
  *   Community         an official community (0.9.0)
  *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)
+ *   Membership        a person's platform membership: granted, revoked (0.12.0)
+ *   Payment           a purchase and its invoice, and its refund (0.12.0)
+ *   Coupon            a code that gives a membership or a discount (0.12.0)
  */
-export declare const SUBJECT_VALUES: readonly ["all", "Dashboard", "Member", "FounderProfile", "Post", "Poll", "Comment", "Report", "SupportTicket", "SavedReply", "PlatformRole", "AuditEntry", "PlatformSettings", "Product", "Review", "Community", "CommunitySuggestion"];
+export declare const SUBJECT_VALUES: readonly ["all", "Dashboard", "Member", "FounderProfile", "Post", "Poll", "Comment", "Report", "SupportTicket", "SavedReply", "PlatformRole", "AuditEntry", "PlatformSettings", "Product", "Review", "Community", "CommunitySuggestion", "Membership", "Payment", "Coupon"];
 export declare const subjectSchema: z.ZodEnum<{
     all: "all";
     Dashboard: "Dashboard";
@@ -86,6 +109,9 @@ export declare const subjectSchema: z.ZodEnum<{
     Review: "Review";
     Community: "Community";
     CommunitySuggestion: "CommunitySuggestion";
+    Membership: "Membership";
+    Payment: "Payment";
+    Coupon: "Coupon";
 }>;
 export type Subject = z.infer<typeof subjectSchema>;
 /**
@@ -100,10 +126,25 @@ export type Subject = z.infer<typeof subjectSchema>;
  */
 export interface SubjectFields {
     Dashboard: Record<never, never>;
-    /** `appRoles` is the staff roles held, so a rule can protect a role ("never suspend a superadmin"). */
+    /**
+     * `appRoles` is the staff roles held, so a rule can protect a role ("never
+     * suspend a superadmin").
+     *
+     * For `message` (0.12.0), what the asker's relation to them is:
+     * `contact` says the asker knows them (a teammate, a private community in
+     * common, a conversation already); `standing` is theirs, so nobody starts a
+     * conversation with a viewer, who cannot chat; `acceptsStrangers` is their
+     * own setting (Premium and Business members may start one, or only people
+     * they know). Optional because only the messaging check computes them: a
+     * rule on a field that is absent never matches, so a check that forgets them
+     * is refused, never let through.
+     */
     Member: {
         _id: string;
         appRoles: PlatformRole[];
+        contact?: boolean;
+        standing?: Standing;
+        acceptsStrangers?: boolean;
     };
     FounderProfile: {
         userId: string;
@@ -166,6 +207,22 @@ export interface SubjectFields {
         suggestedBy: string;
         status: string;
     };
+    /** Whose membership (0.12.0), so "never your own" is a rule. */
+    Membership: {
+        userId: string;
+    };
+    /**
+     * Who pays (0.12.0), what for, and where it stands: a viewer may buy only a
+     * membership (a plan needs one), only a paid one is refunded, and never by
+     * its own payer.
+     */
+    Payment: {
+        userId: string;
+        status: string;
+        kind: PurchaseKind;
+    };
+    /** Coupons are the platform's (0.12.0): no condition is ever written on one. */
+    Coupon: Record<never, never>;
 }
 /** A document tagged with its subject type, as CASL's `subject('Post', doc)` makes one. */
 export type SubjectInstance = {

package/dist/access/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,6HAYhB,CAAC;AACX,eAAO,MAAM,YAAY;;;;;;;;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,0OAkBjB,CAAC;AACX,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAAyB,CAAC;AACpD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,uGAAuG;IACvG,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IAClD,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,aAAa,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/D,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,sFAAsF;IACtF,YAAY,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,4DAA4D;IAC5D,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC;;;;OAIG;IACH,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxE,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B;;;;OAIG;IACH,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE,qFAAqF;IACrF,mBAAmB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG;KAC3B,CAAC,IAAI,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;CAChE,CAAC,MAAM,aAAa,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC;AAE3E;;;GAGG;AACH,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAC7E,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sCAAgC,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,mLAkBhB,CAAC;AACX,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,6QAqBjB,CAAC;AACX,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;EAAyB,CAAC;AACpD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,aAAa,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/D,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,sFAAsF;IACtF,YAAY,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,4DAA4D;IAC5D,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC;;;;OAIG;IACH,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxE,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B;;;;OAIG;IACH,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE,qFAAqF;IACrF,mBAAmB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,gEAAgE;IAChE,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B;;;;OAIG;IACH,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAC;IAChE,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;CAC9B;AAED,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG;KAC3B,CAAC,IAAI,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;CAChE,CAAC,MAAM,aAAa,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC;AAE3E;;;GAGG;AACH,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;AAC7E,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sCAAgC,CAAC;AAC/D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/access/permissions.js

@@ -29,6 +29,18 @@ import { z } from 'zod';
  *   represent act for a product as one of its team: tag a post with it, reply
  *             to its reviews, mark feedback helpful, confirm a tester
  *
+ * Taking part (0.12.0, membership): the verbs a viewer is refused and a member
+ * holds. Creating content stays `create`; these are the rest.
+ *
+ *   react     a reaction on a post, poll or comment; an upvote on a product;
+ *             marking a review helpful
+ *   vote      vote in a poll
+ *   save      bookmark a post or poll
+ *   join      join a community, ask to, or accept its invitation; accept an
+ *             invitation to a product's team
+ *   message   start a conversation with a Member
+ *   refund    give a payment's money back (staff)
+ *
  * Append only: a stored or packed rule names these.
  */
 export const ACTION_VALUES = [
@@ -43,6 +55,12 @@ export const ACTION_VALUES = [
     'resolve',
     'reset',
     'represent',
+    'react',
+    'vote',
+    'save',
+    'join',
+    'message',
+    'refund',
 ];
 export const actionSchema = z.enum(ACTION_VALUES);
 /**
@@ -63,6 +81,9 @@ export const actionSchema = z.enum(ACTION_VALUES);
  *   Review            a member's stars and words on a product
  *   Community         an official community (0.9.0)
  *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)
+ *   Membership        a person's platform membership: granted, revoked (0.12.0)
+ *   Payment           a purchase and its invoice, and its refund (0.12.0)
+ *   Coupon            a code that gives a membership or a discount (0.12.0)
  */
 export const SUBJECT_VALUES = [
     'all',
@@ -82,6 +103,9 @@ export const SUBJECT_VALUES = [
     'Review',
     'Community',
     'CommunitySuggestion',
+    'Membership',
+    'Payment',
+    'Coupon',
 ];
 export const subjectSchema = z.enum(SUBJECT_VALUES);
 /**

package/dist/access/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,WAAW;CACH,CAAC;AACX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAGlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK;IACL,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,WAAW;IACX,qBAAqB;CACb,CAAC;AACX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAiEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["/**\n * founder-schema: what a role may do, in CASL's terms\n *\n * Permissions are ACTION on SUBJECT, optionally narrowed by conditions on the\n * subject's fields (\"update a Post whose authorId is mine\"). The backend writes\n * one small policy per role from these words; the web receives the resulting\n * rules and asks the same questions to decide what to draw. Because both sides\n * spell actions and subjects from this file, a permission check with a typo is\n * a compile error, not a button that silently never shows.\n *\n * The SERVER decides; the web only mirrors. Every rule the web holds came from\n * the server for the role being acted as, and every request is checked again\n * on the server, so a tampered client can show itself a button and nothing\n * more.\n *\n * @module founder-schema/access/permissions\n */\n\nimport type { ForcedSubject, MongoAbility } from '@casl/ability';\nimport { z } from 'zod';\nimport type { PlatformRole } from './roles.js';\n\n/**\n * The verbs.\n *\n *   manage    every action (CASL's wildcard). Only superadmin holds it on `all`.\n *   create, read, update, delete\n *   moderate  hide, restore or remove someone else's content, act on a report\n *   assign    grant or revoke (a platform role); take or hand over (a ticket)\n *   suspend   stop a member signing in to the product, and lift it\n *   resolve   close a support ticket or a report\n *   reset     clear a credential its owner forgot (a staff member's MPIN)\n *   represent act for a product as one of its team: tag a post with it, reply\n *             to its reviews, mark feedback helpful, confirm a tester\n *\n * Append only: a stored or packed rule names these.\n */\nexport const ACTION_VALUES = [\n  'manage',\n  'create',\n  'read',\n  'update',\n  'delete',\n  'moderate',\n  'assign',\n  'suspend',\n  'resolve',\n  'reset',\n  'represent',\n] as const;\nexport const actionSchema = z.enum(ACTION_VALUES);\nexport type Action = z.infer<typeof actionSchema>;\n\n/**\n * The things.\n *\n *   all               CASL's wildcard subject\n *   Dashboard         the staff overview: counts and trends\n *   Member            a person's account in this product\n *   FounderProfile    a member's public profile\n *   Post, Poll, Comment\n *   Report            a member's report of a post, poll or comment\n *   SupportTicket     a member's request for help\n *   SavedReply        a support agent's reusable answer\n *   PlatformRole      a staff role, as something granted and revoked\n *   AuditEntry        the record of a staff action\n *   PlatformSettings  product-wide configuration\n *   Product           something a founder builds, with its team\n *   Review            a member's stars and words on a product\n *   Community         an official community (0.9.0)\n *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)\n */\nexport const SUBJECT_VALUES = [\n  'all',\n  'Dashboard',\n  'Member',\n  'FounderProfile',\n  'Post',\n  'Poll',\n  'Comment',\n  'Report',\n  'SupportTicket',\n  'SavedReply',\n  'PlatformRole',\n  'AuditEntry',\n  'PlatformSettings',\n  'Product',\n  'Review',\n  'Community',\n  'CommunitySuggestion',\n] as const;\nexport const subjectSchema = z.enum(SUBJECT_VALUES);\nexport type Subject = z.infer<typeof subjectSchema>;\n\n/**\n * The fields a rule may set CONDITIONS on, per subject: the server's stored\n * names, ids as strings. Declared here so a condition on a field the subject\n * does not have (`{ ownerId: me }` on a Post) is a compile error, on both sides.\n *\n * A web screen does not evaluate these against an API response: a response\n * names things differently (`author.userId`, not `authorId`). Row-level answers\n * come from the server on the item itself (`viewer.canEdit`); the web's own\n * checks are type-level (\"may I moderate Reports at all\").\n */\nexport interface SubjectFields {\n  Dashboard: Record<never, never>;\n  /** `appRoles` is the staff roles held, so a rule can protect a role (\"never suspend a superadmin\"). */\n  Member: { _id: string; appRoles: PlatformRole[] };\n  FounderProfile: { userId: string };\n  Post: { authorId: string };\n  Poll: { authorId: string };\n  Comment: { authorId: string };\n  Report: { reporterId: string; status: string };\n  SupportTicket: { memberId: string; assigneeId: string | null };\n  SavedReply: { authorId: string };\n  /** One role on one person: `memberId` is whose, so \"never your own\" is a rule too. */\n  PlatformRole: { role: PlatformRole; memberId: string };\n  /** `actorId` is null for an entry a server script wrote. */\n  AuditEntry: { actorId: string | null };\n  PlatformSettings: Record<never, never>;\n  /**\n   * The team, as three lists of member ids, so a rule reads \"a product whose\n   * managers include me\" (`{ managerIds: me }`). `managerIds` is the owner and\n   * the co-founders; `memberIds` is everyone on the team, owner included.\n   */\n  Product: { ownerId: string; managerIds: string[]; memberIds: string[] };\n  Review: { authorId: string };\n  /**\n   * Its admins and moderators as id lists (0.9.0), so a rule reads \"a\n   * community whose admins include me\" (`{ adminIds: me }`). Both short by\n   * nature; ordinary members are never listed here (a community has no cap).\n   */\n  Community: { _id: string; adminIds: string[]; moderatorIds: string[] };\n  /** `suggestedBy` so \"your own\" is a rule; `status` so only open ones are decided. */\n  CommunitySuggestion: { suggestedBy: string; status: string };\n}\n\n/** A document tagged with its subject type, as CASL's `subject('Post', doc)` makes one. */\nexport type SubjectInstance = {\n  [K in keyof SubjectFields]: SubjectFields[K] & ForcedSubject<K>;\n}[keyof SubjectFields];\n\n/**\n * The ability both sides build: the backend from its policy, the web from the\n * rules the backend sends. Mongo-style conditions, typed by `SubjectFields`.\n */\nexport type AppAbility = MongoAbility<[Action, Subject | SubjectInstance]>;\n\n/**\n * Compile-time proof that `SubjectFields` names exactly the subjects, no more\n * and no fewer: adding a subject without its fields fails the build here.\n */\ntype Same<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;\ntype Assert<T extends true> = T;\nexport type EverySubjectHasFields = Assert<Same<keyof SubjectFields, Exclude<Subject, 'all'>>>;\n\n/**\n * Rules as they cross the wire: CASL's `packRules` output, an array of\n * compact arrays. The web unpacks them with `unpackRules` before building its\n * ability; their inner shape is CASL's, so it is not re-described here.\n */\nexport const packedRulesSchema = z.array(z.array(z.unknown()));\nexport type PackedRules = z.infer<typeof packedRulesSchema>;\n"]}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK;IACL,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,SAAS;IACT,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AA6FpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["/**\n * founder-schema: what a role may do, in CASL's terms\n *\n * Permissions are ACTION on SUBJECT, optionally narrowed by conditions on the\n * subject's fields (\"update a Post whose authorId is mine\"). The backend writes\n * one small policy per role from these words; the web receives the resulting\n * rules and asks the same questions to decide what to draw. Because both sides\n * spell actions and subjects from this file, a permission check with a typo is\n * a compile error, not a button that silently never shows.\n *\n * The SERVER decides; the web only mirrors. Every rule the web holds came from\n * the server for the role being acted as, and every request is checked again\n * on the server, so a tampered client can show itself a button and nothing\n * more.\n *\n * @module founder-schema/access/permissions\n */\n\nimport type { ForcedSubject, MongoAbility } from '@casl/ability';\nimport { z } from 'zod';\nimport type { PurchaseKind } from '../domains/billing/billing.js';\nimport type { PlatformRole } from './roles.js';\nimport type { Standing } from './standing.js';\n\n/**\n * The verbs.\n *\n *   manage    every action (CASL's wildcard). Only superadmin holds it on `all`.\n *   create, read, update, delete\n *   moderate  hide, restore or remove someone else's content, act on a report\n *   assign    grant or revoke (a platform role); take or hand over (a ticket)\n *   suspend   stop a member signing in to the product, and lift it\n *   resolve   close a support ticket or a report\n *   reset     clear a credential its owner forgot (a staff member's MPIN)\n *   represent act for a product as one of its team: tag a post with it, reply\n *             to its reviews, mark feedback helpful, confirm a tester\n *\n * Taking part (0.12.0, membership): the verbs a viewer is refused and a member\n * holds. Creating content stays `create`; these are the rest.\n *\n *   react     a reaction on a post, poll or comment; an upvote on a product;\n *             marking a review helpful\n *   vote      vote in a poll\n *   save      bookmark a post or poll\n *   join      join a community, ask to, or accept its invitation; accept an\n *             invitation to a product's team\n *   message   start a conversation with a Member\n *   refund    give a payment's money back (staff)\n *\n * Append only: a stored or packed rule names these.\n */\nexport const ACTION_VALUES = [\n  'manage',\n  'create',\n  'read',\n  'update',\n  'delete',\n  'moderate',\n  'assign',\n  'suspend',\n  'resolve',\n  'reset',\n  'represent',\n  'react',\n  'vote',\n  'save',\n  'join',\n  'message',\n  'refund',\n] as const;\nexport const actionSchema = z.enum(ACTION_VALUES);\nexport type Action = z.infer<typeof actionSchema>;\n\n/**\n * The things.\n *\n *   all               CASL's wildcard subject\n *   Dashboard         the staff overview: counts and trends\n *   Member            a person's account in this product\n *   FounderProfile    a member's public profile\n *   Post, Poll, Comment\n *   Report            a member's report of a post, poll or comment\n *   SupportTicket     a member's request for help\n *   SavedReply        a support agent's reusable answer\n *   PlatformRole      a staff role, as something granted and revoked\n *   AuditEntry        the record of a staff action\n *   PlatformSettings  product-wide configuration\n *   Product           something a founder builds, with its team\n *   Review            a member's stars and words on a product\n *   Community         an official community (0.9.0)\n *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)\n *   Membership        a person's platform membership: granted, revoked (0.12.0)\n *   Payment           a purchase and its invoice, and its refund (0.12.0)\n *   Coupon            a code that gives a membership or a discount (0.12.0)\n */\nexport const SUBJECT_VALUES = [\n  'all',\n  'Dashboard',\n  'Member',\n  'FounderProfile',\n  'Post',\n  'Poll',\n  'Comment',\n  'Report',\n  'SupportTicket',\n  'SavedReply',\n  'PlatformRole',\n  'AuditEntry',\n  'PlatformSettings',\n  'Product',\n  'Review',\n  'Community',\n  'CommunitySuggestion',\n  'Membership',\n  'Payment',\n  'Coupon',\n] as const;\nexport const subjectSchema = z.enum(SUBJECT_VALUES);\nexport type Subject = z.infer<typeof subjectSchema>;\n\n/**\n * The fields a rule may set CONDITIONS on, per subject: the server's stored\n * names, ids as strings. Declared here so a condition on a field the subject\n * does not have (`{ ownerId: me }` on a Post) is a compile error, on both sides.\n *\n * A web screen does not evaluate these against an API response: a response\n * names things differently (`author.userId`, not `authorId`). Row-level answers\n * come from the server on the item itself (`viewer.canEdit`); the web's own\n * checks are type-level (\"may I moderate Reports at all\").\n */\nexport interface SubjectFields {\n  Dashboard: Record<never, never>;\n  /**\n   * `appRoles` is the staff roles held, so a rule can protect a role (\"never\n   * suspend a superadmin\").\n   *\n   * For `message` (0.12.0), what the asker's relation to them is:\n   * `contact` says the asker knows them (a teammate, a private community in\n   * common, a conversation already); `standing` is theirs, so nobody starts a\n   * conversation with a viewer, who cannot chat; `acceptsStrangers` is their\n   * own setting (Premium and Business members may start one, or only people\n   * they know). Optional because only the messaging check computes them: a\n   * rule on a field that is absent never matches, so a check that forgets them\n   * is refused, never let through.\n   */\n  Member: {\n    _id: string;\n    appRoles: PlatformRole[];\n    contact?: boolean;\n    standing?: Standing;\n    acceptsStrangers?: boolean;\n  };\n  FounderProfile: { userId: string };\n  Post: { authorId: string };\n  Poll: { authorId: string };\n  Comment: { authorId: string };\n  Report: { reporterId: string; status: string };\n  SupportTicket: { memberId: string; assigneeId: string | null };\n  SavedReply: { authorId: string };\n  /** One role on one person: `memberId` is whose, so \"never your own\" is a rule too. */\n  PlatformRole: { role: PlatformRole; memberId: string };\n  /** `actorId` is null for an entry a server script wrote. */\n  AuditEntry: { actorId: string | null };\n  PlatformSettings: Record<never, never>;\n  /**\n   * The team, as three lists of member ids, so a rule reads \"a product whose\n   * managers include me\" (`{ managerIds: me }`). `managerIds` is the owner and\n   * the co-founders; `memberIds` is everyone on the team, owner included.\n   */\n  Product: { ownerId: string; managerIds: string[]; memberIds: string[] };\n  Review: { authorId: string };\n  /**\n   * Its admins and moderators as id lists (0.9.0), so a rule reads \"a\n   * community whose admins include me\" (`{ adminIds: me }`). Both short by\n   * nature; ordinary members are never listed here (a community has no cap).\n   */\n  Community: { _id: string; adminIds: string[]; moderatorIds: string[] };\n  /** `suggestedBy` so \"your own\" is a rule; `status` so only open ones are decided. */\n  CommunitySuggestion: { suggestedBy: string; status: string };\n  /** Whose membership (0.12.0), so \"never your own\" is a rule. */\n  Membership: { userId: string };\n  /**\n   * Who pays (0.12.0), what for, and where it stands: a viewer may buy only a\n   * membership (a plan needs one), only a paid one is refunded, and never by\n   * its own payer.\n   */\n  Payment: { userId: string; status: string; kind: PurchaseKind };\n  /** Coupons are the platform's (0.12.0): no condition is ever written on one. */\n  Coupon: Record<never, never>;\n}\n\n/** A document tagged with its subject type, as CASL's `subject('Post', doc)` makes one. */\nexport type SubjectInstance = {\n  [K in keyof SubjectFields]: SubjectFields[K] & ForcedSubject<K>;\n}[keyof SubjectFields];\n\n/**\n * The ability both sides build: the backend from its policy, the web from the\n * rules the backend sends. Mongo-style conditions, typed by `SubjectFields`.\n */\nexport type AppAbility = MongoAbility<[Action, Subject | SubjectInstance]>;\n\n/**\n * Compile-time proof that `SubjectFields` names exactly the subjects, no more\n * and no fewer: adding a subject without its fields fails the build here.\n */\ntype Same<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;\ntype Assert<T extends true> = T;\nexport type EverySubjectHasFields = Assert<Same<keyof SubjectFields, Exclude<Subject, 'all'>>>;\n\n/**\n * Rules as they cross the wire: CASL's `packRules` output, an array of\n * compact arrays. The web unpacks them with `unpackRules` before building its\n * ability; their inner shape is CASL's, so it is not re-described here.\n */\nexport const packedRulesSchema = z.array(z.array(z.unknown()));\nexport type PackedRules = z.infer<typeof packedRulesSchema>;\n"]}

package/dist/access/roles.d.ts

@@ -25,9 +25,9 @@ import { z } from 'zod';
 /** The staff roles, highest first. */
 export declare const PLATFORM_ROLE_VALUES: readonly ["superadmin", "manager", "moderator", "support_agent"];
 export declare const platformRoleSchema: z.ZodEnum<{
+    moderator: "moderator";
     superadmin: "superadmin";
     manager: "manager";
-    moderator: "moderator";
     support_agent: "support_agent";
 }>;
 export type PlatformRole = z.infer<typeof platformRoleSchema>;
@@ -40,11 +40,11 @@ export declare const MEMBER_ROLE: "member";
  */
 export declare const ROLE_VALUES: readonly ["superadmin", "manager", "moderator", "support_agent", "member"];
 export declare const roleSchema: z.ZodEnum<{
+    moderator: "moderator";
     superadmin: "superadmin";
+    member: "member";
     manager: "manager";
-    moderator: "moderator";
     support_agent: "support_agent";
-    member: "member";
 }>;
 export type Role = z.infer<typeof roleSchema>;
 export declare function isPlatformRole(value: unknown): value is PlatformRole;

package/dist/access/standing.d.ts

@@ -0,0 +1,59 @@
+/**
+ * founder-schema: standing, whether someone takes part or only looks (0.12.0)
+ *
+ * The user's ruling (2026-10-11): LOOKING IS FREE, TAKING PART IS PAID. Every
+ * signed-in person has a standing:
+ *
+ *   viewer   signed in and onboarded, no membership: reads everything a member
+ *            reads, reports, asks support, manages their own account; takes
+ *            part in nothing
+ *   member   holds a platform membership (Rs 99 once, a founding coupon, a
+ *            grant) or any staff role: takes part
+ *
+ * The server builds it into the CASL ability on every request, from the
+ * member's record; the web learns it from `GET /me/access` and from the rules
+ * themselves. A refusal for want of it is not a bare "forbidden": the rule
+ * carries a REASON (`ACCESS_REASON_VALUES`), packed with the rules, so the web
+ * can open the Join sheet or the Upgrade tab instead of drawing a dead button,
+ * and the server answers that same reason as the error code.
+ *
+ * @module founder-schema/access/standing
+ */
+import { z } from 'zod';
+import type { ApiErrorCode } from '../core/errors.js';
+/** ⚠ Read back from packed rules (a condition on `Member.standing`): append only. */
+export declare const STANDING_VALUES: readonly ["viewer", "member"];
+export declare const standingSchema: z.ZodEnum<{
+    viewer: "viewer";
+    member: "member";
+}>;
+export type Standing = z.infer<typeof standingSchema>;
+/**
+ * Why a rule refuses, as CASL's `because()` carries it. Each is also an API
+ * error code (checked below), so the server answers the reason as the code
+ * and the web maps both to the same sheet.
+ *
+ *   MEMBERSHIP_REQUIRED   a viewer taking part: offer the membership
+ *   PLAN_REQUIRED         a member without a plan starting a conversation with
+ *                         someone they do not know: offer Premium or Business
+ *   MESSAGE_NOT_ACCEPTED  starting a conversation with someone who cannot chat
+ *                         (a viewer): nothing to offer
+ *
+ * ⚠ When several refusals match, CASL reports the LAST one written. The
+ * server writes the viewer's refusals after everything else, so a viewer is
+ * always told about the membership first.
+ */
+export declare const ACCESS_REASON_VALUES: readonly ["MEMBERSHIP_REQUIRED", "PLAN_REQUIRED", "MESSAGE_NOT_ACCEPTED"];
+export declare const accessReasonSchema: z.ZodEnum<{
+    MEMBERSHIP_REQUIRED: "MEMBERSHIP_REQUIRED";
+    PLAN_REQUIRED: "PLAN_REQUIRED";
+    MESSAGE_NOT_ACCEPTED: "MESSAGE_NOT_ACCEPTED";
+}>;
+export type AccessReason = z.infer<typeof accessReasonSchema>;
+/** Compile-time proof that every reason is an error code the API answers. */
+type Assert<T extends true> = T;
+export type EveryReasonIsAnErrorCode = Assert<AccessReason extends ApiErrorCode ? true : false>;
+/** A reason off a rule (`relevantRuleFor(...)?.reason`), if it is one of ours. */
+export declare function accessReasonOf(reason: unknown): AccessReason | null;
+export {};
+//# sourceMappingURL=standing.d.ts.map

package/dist/access/standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.d.ts","sourceRoot":"","sources":["../../src/access/standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,eAAe,+BAAgC,CAAC;AAC7D,eAAO,MAAM,cAAc;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,2EAIvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,6EAA6E;AAC7E,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,YAAY,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAEhG,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAGnE"}

package/dist/access/standing.js

@@ -0,0 +1,52 @@
+/**
+ * founder-schema: standing, whether someone takes part or only looks (0.12.0)
+ *
+ * The user's ruling (2026-10-11): LOOKING IS FREE, TAKING PART IS PAID. Every
+ * signed-in person has a standing:
+ *
+ *   viewer   signed in and onboarded, no membership: reads everything a member
+ *            reads, reports, asks support, manages their own account; takes
+ *            part in nothing
+ *   member   holds a platform membership (Rs 99 once, a founding coupon, a
+ *            grant) or any staff role: takes part
+ *
+ * The server builds it into the CASL ability on every request, from the
+ * member's record; the web learns it from `GET /me/access` and from the rules
+ * themselves. A refusal for want of it is not a bare "forbidden": the rule
+ * carries a REASON (`ACCESS_REASON_VALUES`), packed with the rules, so the web
+ * can open the Join sheet or the Upgrade tab instead of drawing a dead button,
+ * and the server answers that same reason as the error code.
+ *
+ * @module founder-schema/access/standing
+ */
+import { z } from 'zod';
+/** ⚠ Read back from packed rules (a condition on `Member.standing`): append only. */
+export const STANDING_VALUES = ['viewer', 'member'];
+export const standingSchema = z.enum(STANDING_VALUES);
+/**
+ * Why a rule refuses, as CASL's `because()` carries it. Each is also an API
+ * error code (checked below), so the server answers the reason as the code
+ * and the web maps both to the same sheet.
+ *
+ *   MEMBERSHIP_REQUIRED   a viewer taking part: offer the membership
+ *   PLAN_REQUIRED         a member without a plan starting a conversation with
+ *                         someone they do not know: offer Premium or Business
+ *   MESSAGE_NOT_ACCEPTED  starting a conversation with someone who cannot chat
+ *                         (a viewer): nothing to offer
+ *
+ * ⚠ When several refusals match, CASL reports the LAST one written. The
+ * server writes the viewer's refusals after everything else, so a viewer is
+ * always told about the membership first.
+ */
+export const ACCESS_REASON_VALUES = [
+    'MEMBERSHIP_REQUIRED',
+    'PLAN_REQUIRED',
+    'MESSAGE_NOT_ACCEPTED',
+];
+export const accessReasonSchema = z.enum(ACCESS_REASON_VALUES);
+/** A reason off a rule (`relevantRuleFor(...)?.reason`), if it is one of ours. */
+export function accessReasonOf(reason) {
+    const parsed = accessReasonSchema.safeParse(reason);
+    return parsed.success ? parsed.data : null;
+}
+//# sourceMappingURL=standing.js.map

package/dist/access/standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.js","sourceRoot":"","sources":["../../src/access/standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAGtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,qBAAqB;IACrB,eAAe;IACf,sBAAsB;CACd,CAAC;AACX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAO/D,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC","sourcesContent":["/**\n * founder-schema: standing, whether someone takes part or only looks (0.12.0)\n *\n * The user's ruling (2026-10-11): LOOKING IS FREE, TAKING PART IS PAID. Every\n * signed-in person has a standing:\n *\n *   viewer   signed in and onboarded, no membership: reads everything a member\n *            reads, reports, asks support, manages their own account; takes\n *            part in nothing\n *   member   holds a platform membership (Rs 99 once, a founding coupon, a\n *            grant) or any staff role: takes part\n *\n * The server builds it into the CASL ability on every request, from the\n * member's record; the web learns it from `GET /me/access` and from the rules\n * themselves. A refusal for want of it is not a bare \"forbidden\": the rule\n * carries a REASON (`ACCESS_REASON_VALUES`), packed with the rules, so the web\n * can open the Join sheet or the Upgrade tab instead of drawing a dead button,\n * and the server answers that same reason as the error code.\n *\n * @module founder-schema/access/standing\n */\n\nimport { z } from 'zod';\nimport type { ApiErrorCode } from '../core/errors.js';\n\n/** ⚠ Read back from packed rules (a condition on `Member.standing`): append only. */\nexport const STANDING_VALUES = ['viewer', 'member'] as const;\nexport const standingSchema = z.enum(STANDING_VALUES);\nexport type Standing = z.infer<typeof standingSchema>;\n\n/**\n * Why a rule refuses, as CASL's `because()` carries it. Each is also an API\n * error code (checked below), so the server answers the reason as the code\n * and the web maps both to the same sheet.\n *\n *   MEMBERSHIP_REQUIRED   a viewer taking part: offer the membership\n *   PLAN_REQUIRED         a member without a plan starting a conversation with\n *                         someone they do not know: offer Premium or Business\n *   MESSAGE_NOT_ACCEPTED  starting a conversation with someone who cannot chat\n *                         (a viewer): nothing to offer\n *\n * ⚠ When several refusals match, CASL reports the LAST one written. The\n * server writes the viewer's refusals after everything else, so a viewer is\n * always told about the membership first.\n */\nexport const ACCESS_REASON_VALUES = [\n  'MEMBERSHIP_REQUIRED',\n  'PLAN_REQUIRED',\n  'MESSAGE_NOT_ACCEPTED',\n] as const;\nexport const accessReasonSchema = z.enum(ACCESS_REASON_VALUES);\nexport type AccessReason = z.infer<typeof accessReasonSchema>;\n\n/** Compile-time proof that every reason is an error code the API answers. */\ntype Assert<T extends true> = T;\nexport type EveryReasonIsAnErrorCode = Assert<AccessReason extends ApiErrorCode ? true : false>;\n\n/** A reason off a rule (`relevantRuleFor(...)?.reason`), if it is one of ours. */\nexport function accessReasonOf(reason: unknown): AccessReason | null {\n  const parsed = accessReasonSchema.safeParse(reason);\n  return parsed.success ? parsed.data : null;\n}\n"]}