founder-schema 0.15.0 → 0.17.0

package/README.md

@@ -86,8 +86,12 @@ SAME schema object, so the two can never disagree about what is allowed.
   (`ONBOARDING_STEP_SCHEMAS`), so a step the wizard lets through is a step the
   finish accepts. The step list (`FOUNDER_ONBOARDING_STEPS`) is built from those
   slices, including whether a step may be skipped.
-- **No copy.** Step titles, help lines and topic categories are translation keys
-  (`titleKey`, `helpKey`, `labelKey`); the words live in each client.
+- **No copy.** A step's label and title, a topic category and a goal category
+  are translation keys or plain keys (`labelKey`, `titleKey`, `key`); the words
+  live in each client. The web keys its category words by `key`, type-checked
+  against it, and its step words by the step's own key (`OnboardingStepKey`);
+  `labelKey` / `titleKey` are there for a translated client (i18n), and
+  nothing reads them yet.
 - **Bodies are typed JSON; only queries coerce.** `teamSize: "5"` is refused in a
   body, and `?limit=5` is read as 5.
 - **Shapes are derived, never copied.** One `locationSchema`, one
@@ -99,6 +103,189 @@ instance; this package must not bring its own.
 
 ---
 
+## Breaking in 0.17.0: the onboarding photo is saved, and onboarding's single source of truth (2026-10-19)
+
+Two pieces of the user's work on onboarding, 2026-10-19.
+
+**The photo.** Going back to the photo step showed no photo, though the member
+had pressed Save and continue on it. Every other answer came back from the
+draft; the photo was held for the visit only, so any reload or a resume the
+next day lost it.
+
+- **New:** `onboardingStatusSchema.photo` (optional, a `mediaImageSchema`): the
+  photo the member saved, as it will appear. Absent when there is none.
+- **Changed meaning:** a step save carrying `draft.avatarMediaId` (an upload id,
+  or `null`) is the photo step SAVING its photo. The server holds that upload
+  for the draft, so the 24 hour unattached sweep never deletes it, and lets go
+  of the one it replaces; `null` lets go of it. It is not kept in the draft:
+  `readOnboardingDraft` still gives `null` for it, and the photo comes back only
+  as `photo`, from what the server holds.
+- **Stricter:** `onboardingProgressUpdateSchema` refuses a `draft.avatarMediaId`
+  that is neither an upload id nor `null` (`invalidId`, at
+  `draft.avatarMediaId`). No client sent the key before 0.17.0.
+- **Backend:** a held photo is a media row attached to the member's onboarding
+  progress row (attachment kind `onboarding`, backend only). Finish moves it to
+  the new profile in the same transaction; a scheduled job lets go of a held
+  photo whose progress row the 90 day TTL deleted (Privacy: sign-up answers go
+  90 days after they were last changed). New partial index on `media` for that
+  job; run `sync-indexes --apply` after deploy.
+- **Deploy order: the backend, then the web.** The web reads the status with
+  `z.object`, which drops a key it does not know, so a 0.16 web on a 0.17
+  backend simply shows no photo on Back, as today.
+- **Rollback floor:** a backend below 0.17 does not know the `onboarding`
+  attachment, so photos held by then stay attached and are never swept until
+  0.17 runs again, and a member who finishes on the old build is told the photo
+  expired and asked to add it again (the old finish takes only an unattached
+  upload). A rollback that is KEPT therefore needs a one-off release of every
+  `media` row attached as kind `onboarding`, or those photos outlive the
+  Privacy's 90 days (account deletion still erases them).
+
+**One source of truth** (the user: "all the data for all the onboarding steps
+and all the errors and validation types ... should come from the founder
+circle schema"). What a client or the backend kept its own copy of now lives
+here, and each consumer reads it:
+
+- **New, data:** `GOAL_CATEGORIES` / `GOAL_CATEGORY_KEYS` (the goals step's
+  three groups, from the web); `domains/location/india`: `INDIA`,
+  `INDIA_DIALING_CODE`, `INDIA_STATES` (each state's cities and other names,
+  from the web) with names typed against `GST_STATES` (ONE list of state
+  names), `INDIA_STATE_NAMES`, `STATE_ALIASES`, `CITY_ALIASES`,
+  `findIndiaState`, `listedCityName`, `canonicalIndiaLocation`;
+  `ONBOARDING_DRAFT_RETENTION_DAYS` (90, from the backend's TTL);
+  `PHONE_DIGITS`.
+- **New, rules every side applies the same way:** `normalizePhone`,
+  `normalizeLinkUrl`, `tidyFullName`, `teamSizeDigits` (from the web);
+  `isRealIsoDate`, `todayInIndia`, `dateOfBirthBounds` (a picker's window,
+  exact at both ends), `isUnderAgeDateOfBirth` (the draft's age rule, from the
+  backend, now with the real-date check), `isoDateToDate` / `dateToIsoDate`;
+  `goalListSchema` / `skillListSchema` (one list rule for the finish and Me).
+- **New, from the answers to what is sent** (`domains/onboarding/
+  onboarding-answers`, from the web): `emptyOnboardingForm`, `ventureStarted`,
+  `onboardingDraftForStep` (exactly a step's own fields), and
+  `completeOnboardingBodyFrom` (the finish body: every unanswered optional
+  answer absent, each answer cleaned as above), with the
+  `CompleteOnboardingBodyCandidate` type; `locationStarted` (a place opened
+  but nothing chosen is "no location").
+- **New, the keys of shapes** (so no consumer lists them by hand):
+  `FOUNDER_LINK_KEYS` / `FounderLinkKey`, `VENTURE_KEYS` /
+  `VENTURE_OPTIONAL_KEYS` / `VentureKey`; types `IndiaLocation`, `IndiaState`,
+  `IndiaStateName`, `GoalCategory`.
+- **New message keys:** `guidelinesRequired`, `photoUnavailable`,
+  `ventureRequired`, `stateRequired`, `stateUnknown`, `goalsDuplicate`,
+  `skillsDuplicate`. Each client words them in the same change (a client
+  holding its words as `Record<ValidationMessageKey, string>` fails to build
+  until it does).
+- **Stricter:**
+  - every location WRITE (`completeOnboardingBodySchema`,
+    `updateFounderProfileBodySchema`, `updateMyPersonalDetailsBodySchema`, and
+    the server's `suggestedLocationSchema`) is `indiaLocationSchema`: country
+    `India`, a state from the list (required: `stateRequired`; not on it:
+    `stateUnknown`; read in any common spelling, "KARNATAKA", "Orissa",
+    "Jammu & Kashmir", and kept as the list's name), a city. READS keep
+    `locationSchema`, so a place stored before this is read as it is;
+  - `businessType` / `legalStructure` without a `venture` are each refused ON
+    THEIR OWN FIELD (`ventureRequired`), on the finish body and the business
+    step; the backend used to drop them without a word, and the web dropped a
+    lone registration (hary's ruling: no silent drop). `ventureStarted` no
+    longer counts the type: it describes a business, it does not start one;
+  - `displayNameSchema` stores the name tidied (`tidyFullName`): every body
+    that writes a name, the Me patches included;
+  - goals and skills each once (`goalsDuplicate`, `skillsDuplicate`), on the
+    finish and the Me patch;
+  - the guidelines: a box left unticked is `guidelinesRequired` (it was
+    `guidelinesOutdated`, the words for an older text).
+- **Breaking:** `completeOnboardingBodySchema` and
+  `ONBOARDING_STEP_SCHEMAS.business` carry the venture rule (refinements), so
+  Zod 4.6 throws on `.pick`, `.omit`, `.partial` and `.merge` of them, and on
+  an `.extend` that overwrites a key. Read a field with `.shape.<field>`, and a
+  step's fields with `ONBOARDING_STEP_SCHEMAS.<step>` (picked before the rule;
+  the business slice carries it again). The web picked from the finish body in
+  three places (the `/dummy` showcase, at module scope, and two tests); they
+  read `.shape` now.
+- **Changed type:** `displayNameSchema` is a pipe (`.transform(tidyFullName)`),
+  no longer a `ZodString`, so `.min` / `.max` / `.regex` cannot be chained on
+  it. Nothing did; a length is read through the pipe.
+- **Breaking (no consumer reads it):** `FOUNDER_ONBOARDING_STEPS[i].helpKey`
+  is gone (there is no help line any more; the user, 2026-10-19), and
+  `labelKey` names the step's short label.
+- **Moved, same export name:** `suggestedLocationSchema` / `SuggestedLocation`
+  now come from `domains/location/india`.
+- **Deploy order: still the backend first.** A 0.16 web is refused a little
+  that it used to send, on its field: a place with no state (an old draft's,
+  or the 0.16 Me editor saving an OLD stateless place, which it sends without
+  one) at `location.state`. (It never sends a lone business type: its
+  `ventureStarted` counted the type, so a type on its own went with an empty
+  venture, refused at `venture.name` / `industry` / `stage` as on 0.16.) A
+  0.17 web needs the 0.17 backend for the photo. It reads the location
+  suggestion with the strict write shape, which takes a state in any common
+  spelling ("KARNATAKA"), so a 0.16 backend's answer is read unless it has no
+  state, or one the list does not know: then it is no suggestion.
+- **Rollback floor (also):** the 0.17 web on a backend rolled below 0.17 saves
+  no photo, and shows no suggestion where the old backend answered without a
+  state the list knows.
+- **Known, follow-up (hary, 2026-10-19), not in 0.17.0:**
+  - a step save racing a finish when the member has NO progress row (the TTL
+    deleted it while a tab stayed open) can leave a photo held for a finished
+    member, until the TTL takes that new row: the finish's update of a row
+    that is not there writes nothing, so the two transactions never conflict.
+    Fix: the finish upserts its completion stamp;
+  - finish's retry loop sets its result inside the transaction callback, so a
+    commit that fails and a retry that then meets a username clash could
+    answer success for a profile never committed. Fix: reset the result on
+    every attempt. Do both together: an 11000 on that upsert would otherwise
+    read as a username clash.
+
+## Breaking in 0.16.0: onboarding in nine steps (2026-10-18)
+
+The user's rework of onboarding. The finish body takes the same answers plus one.
+
+- **Breaking:** `ONBOARDING_STEP_KEYS` is nine: `basics` (full name, gender,
+  date of birth, nothing else), `photo`, `professional` (title, about, skills),
+  then `contact`, `location`, `goals`, `interests`, `business`, `guidelines` as
+  before. `identity` and `ONBOARDING_STEP_SCHEMAS.identity` are gone;
+  `ONBOARDING_TOTAL_STEPS` is 9. The resume cursor is an index into this list:
+  the backend translates a cursor saved under the seven steps once, by step
+  name (its progress rows carry `stepsVersion`), so nobody resumes on the wrong
+  step or loses an answer.
+- **Breaking:** `onboardingFormSchema` gains `legalStructure` (nullable), so a
+  form built from it must hold the key.
+- **New:** `LEGAL_STRUCTURE_VALUES` / `legalStructureSchema` / `LegalStructure`:
+  how a venture is registered in India (sole proprietorship, partnership, LLP,
+  OPC, private and public limited, Section 8, trust or society, co-operative),
+  or not yet, or outside India. Optional on the finish body and the business
+  step; stored on the profile's venture beside `businessType`, and shown only
+  to the member (below).
+- **New: the member's private answers in Me** (`domains/profile/my-profile.ts`,
+  the user, 2026-10-18): `GET`/`PUT /profiles/me/business` (`myBusinessSchema`,
+  `putMyBusinessBodySchema`: the WHOLE venture with its `businessType` and
+  `legalStructure`, which are `myVentureSchema`, or `null` to remove it) and
+  `GET`/`PUT /profiles/me/interests` (`myInterestsSchema`,
+  `putMyInterestsBodySchema`). Owner only: none of the three is on
+  `founderProfileSchema`, a card, a byline or a member's page.
+- **Stricter:** `interestsSchema` is the ONE interests rule, used by the finish
+  body and the Me editor, and it now refuses a topic twice (`topicsDuplicate`):
+  three copies of one topic met the minimum of three. Neither client sends one.
+- **New:** `splitFullName(fullName)`: the first and last name a full name
+  deduces to, at the first space; a one-word name is whole. Derived, never
+  stored: `displayName` stays the one owner of a name.
+- **Appended:** `GOAL_VALUES` +7 (`get_feedback`, `find_testers`,
+  `mentor_others`, `invest_in_startups`, `join_startup`,
+  `find_service_providers`, `attend_events`); `BUSINESS_TYPE_VALUES` +5
+  (`freelancer`, `agency`, `social_enterprise`, `family_business`, `franchise`).
+  Nothing renamed or removed.
+- **Deploy order: the backend, then the web straight after.** A 0.15 backend
+  refuses the `legalStructure` draft key and steps above 7, so a 0.16 web on it
+  is stuck at the business step; a 0.15 web cannot parse a 9-step status or a
+  card holding a new goal. Open tabs and an installed app's cached copy keep the
+  old bundle until they update.
+- **Rollback floor:** once a member saves a new goal, a build below 0.16
+  cannot parse their card, member page or own profile; roll back only after a
+  backfill. A new business type or registration travels on none of those (only
+  on the owner's own `/profiles/me/business`, new in 0.16), so it does not
+  move the floor.
+- **Backend, at deploy:** no new index and no migration (old cursors are
+  translated on the member's next visit).
+
 ## Breaking in 0.15.0: the launch waitlist (2026-10-16)
 
 Until the launch instant `FC_LAUNCH_AT` (a server-only env on BOTH the backend
@@ -574,8 +761,13 @@ is imported, so a server process still up on 1 January rejects the new year unti
 somebody restarts it.
 
 **Changing a member of an enum array is a data change, not a type change.** The
-four `*_VALUES` arrays are Mongoose `enum` constraints in the backend. Removing or
-renaming a value orphans documents already saved with it. Appending is safe.
+`*_VALUES` arrays the backend's profile model uses (stage, industry, skill, goal,
+gender, topic, business type, legal structure) are Mongoose `enum` constraints.
+Removing or renaming a value orphans documents already saved with it. Appending
+is safe for the database, but not for an OLDER CLIENT, which parses strictly and
+refuses a value it does not know: deploy the readers (backend, then web) before
+anything can write the new value, and a rollback below the version that added it
+needs a backfill first.
 `STARTUP_STAGE_VALUES` is ordered earliest to latest and that order is load
 bearing, so append at the end and never insert.
 
@@ -584,7 +776,7 @@ bearing, so append at the end and never insert.
 ## Settled since the scaffold
 
 - **The npm name and the first publish:** `founder-schema`, 0.1.0, by the user.
-- **The onboarding steps:** seven, ruled 2026-09-22; see `src/domains/onboarding/onboarding.ts`.
+- **The onboarding steps:** nine since 0.16.0 (the user, 2026-10-18), seven before (ruled 2026-09-22); see `src/domains/onboarding/onboarding.ts`.
 
 ## Contract decisions, 2026-09-21
 

package/dist/core/common.d.ts

@@ -78,6 +78,14 @@ export type SafeUrl = z.infer<typeof safeUrlSchema>;
  */
 export declare const httpUrlSchema: z.ZodURL;
 export type HttpUrl = z.infer<typeof httpUrlSchema>;
+/**
+ * A link as people paste it, made into what `httpUrlSchema` checks (0.17.0,
+ * moved here from the web so every client cleans a link the same way):
+ * `linkedin.com/in/asha` gains `https://`; blank stays blank. Something that
+ * already names a scheme keeps it, so `javascript:` is never quietly "fixed"
+ * into a link: the schema then refuses it, as it only takes http and https.
+ */
+export declare function normalizeLinkUrl(raw: string): string;
 /**
  * True when `url` parses and its hostname is EXACTLY one of `hosts`
  * (lowercase). The one host check in this package, written the way the warning
@@ -238,11 +246,12 @@ export type Skill = z.infer<typeof skillSchema>;
  * venture works only for a member who ALREADY HAS a venture row, and somebody
  * who wants to start a company is precisely the member with no venture at all,
  * so there is nothing to infer from. It also cannot express a founder with a
- * running company who wants to start another. Every other value is an ask of
- * other people and this one is an ask of the product, which is the whole of the
- * oddness. (hary, 2026-09-21.)
+ * running company who wants to start another. The others were all asks of other
+ * people and this one an ask of the product, which is the whole of the oddness.
+ * (hary, 2026-09-21.) Since 0.16.0 the list also holds offers (`mentor_others`,
+ * `invest_in_startups`) and a second ask of the product (`attend_events`).
  */
-export declare const GOAL_VALUES: readonly ["find_cofounder", "find_investors", "find_customers", "hiring", "partnerships", "mentorship", "grow_network", "business_ideas", "market_insights", "learn_startup", "start_company"];
+export declare const GOAL_VALUES: readonly ["find_cofounder", "find_investors", "find_customers", "hiring", "partnerships", "mentorship", "grow_network", "business_ideas", "market_insights", "learn_startup", "start_company", "get_feedback", "find_testers", "mentor_others", "invest_in_startups", "join_startup", "find_service_providers", "attend_events"];
 export declare const goalSchema: z.ZodEnum<{
     find_cofounder: "find_cofounder";
     find_investors: "find_investors";
@@ -255,8 +264,59 @@ export declare const goalSchema: z.ZodEnum<{
     market_insights: "market_insights";
     learn_startup: "learn_startup";
     start_company: "start_company";
+    get_feedback: "get_feedback";
+    find_testers: "find_testers";
+    mentor_others: "mentor_others";
+    invest_in_startups: "invest_in_startups";
+    join_startup: "join_startup";
+    find_service_providers: "find_service_providers";
+    attend_events: "attend_events";
 }>;
 export type Goal = z.infer<typeof goalSchema>;
+/**
+ * A member's goals as a list (0.17.0): each goal once, at most every goal.
+ * ONE rule for onboarding's finish (which adds its minimum, `GOALS_MIN`) and
+ * the Me tab's editor: two copies of one goal met the minimum while meaning
+ * one, and the profile would show it twice.
+ */
+export declare const goalListSchema: z.ZodArray<z.ZodEnum<{
+    find_cofounder: "find_cofounder";
+    find_investors: "find_investors";
+    find_customers: "find_customers";
+    hiring: "hiring";
+    partnerships: "partnerships";
+    mentorship: "mentorship";
+    grow_network: "grow_network";
+    business_ideas: "business_ideas";
+    market_insights: "market_insights";
+    learn_startup: "learn_startup";
+    start_company: "start_company";
+    get_feedback: "get_feedback";
+    find_testers: "find_testers";
+    mentor_others: "mentor_others";
+    invest_in_startups: "invest_in_startups";
+    join_startup: "join_startup";
+    find_service_providers: "find_service_providers";
+    attend_events: "attend_events";
+}>>;
+/** A member's skills (0.17.0): each skill once, at most `SKILLS_MAX`. ONE rule for onboarding and Me. */
+export declare const skillListSchema: z.ZodArray<z.ZodEnum<{
+    engineering: "engineering";
+    product: "product";
+    design: "design";
+    data: "data";
+    growth: "growth";
+    sales: "sales";
+    marketing: "marketing";
+    operations: "operations";
+    finance: "finance";
+    legal: "legal";
+    hr_people: "hr_people";
+    supply_chain: "supply_chain";
+    research: "research";
+    fundraising: "fundraising";
+    community: "community";
+}>>;
 /**
  * Demographic only. Nothing here computes anything from it, unlike the sibling
  * gym product where gender feeds body-metric maths.
@@ -273,14 +333,42 @@ export declare const genderSchema: z.ZodEnum<{
     prefer_not_to_say: "prefer_not_to_say";
 }>;
 export type Gender = z.infer<typeof genderSchema>;
+/**
+ * A full name as it is sent and stored (0.17.0, moved here from the web):
+ * trimmed, and every run of spaces made one. `displayNameSchema` applies it,
+ * so the server stores it from every client; a client applies it to show the
+ * member what will be kept. What `splitFullName` reads.
+ */
+export declare const tidyFullName: (fullName: string) => string;
 /**
  * The name a member is shown by. ONE rule for every body that writes it:
  * onboarding's finish, the profile patch and the personal-details patch, so a
- * name one accepts the others can never refuse. Plain bounds, no custom
- * message: `too_small` with minimum 1 already says "required", and the client
- * words it.
+ * name one accepts the others can never refuse, and each stores it TIDIED
+ * (`tidyFullName`, 0.17.0: "Asha   Rao" from the Me editor was stored as
+ * typed, while onboarding sent it tidy). Plain bounds, no custom message:
+ * `too_small` with minimum 1 already says "required", and the client words it.
  */
-export declare const displayNameSchema: z.ZodString;
+export declare const displayNameSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+/**
+ * A full name's first and last name, DEDUCED, never asked (the user,
+ * 2026-10-18: onboarding asks one "Full name" and works the two out from the
+ * space). The first word is the first name and everything after the first
+ * space is the last name, kept as written ("Asha Rao Kulkarni" is Asha and
+ * Rao Kulkarni).
+ *
+ * ⚠ A ONE-WORD NAME IS A WHOLE NAME. Many people in India go by a single name,
+ * so `lastName` is then `''`, and nothing may refuse it for that.
+ *
+ * Derived wherever it is needed, never stored as a second copy of the name:
+ * `displayName` stays the one owner of a member's name, so a rename can never
+ * leave a stale first name behind.
+ */
+export declare function splitFullName(fullName: string): {
+    firstName: string;
+    lastName: string;
+};
+/** The digits an Indian mobile number has: what `phoneSchema` takes and the field keeps. */
+export declare const PHONE_DIGITS = 10;
 /**
  * Indian mobile number: ten raw digits, no country code, matching the standard
  * used across this family. Display adds the `+91`.
@@ -292,6 +380,13 @@ export declare const displayNameSchema: z.ZodString;
  */
 export declare const phoneSchema: z.ZodString;
 export type Phone = z.infer<typeof phoneSchema>;
+/**
+ * An Indian mobile number as `phoneSchema`'s ten digits, from however it was
+ * typed (0.17.0, moved here from the web): `98765 43210`, `+91 98765-43210`,
+ * `091 9876543210`. Anything else comes back digits only and fails the schema
+ * with `phoneInvalid`, rather than being guessed at.
+ */
+export declare function normalizePhone(raw: string): string;
 /**
  * Where the founder is based. City and country are what Discover filters on.
  *
@@ -328,18 +423,6 @@ export declare const coordinatesQuerySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type CoordinatesQuery = z.infer<typeof coordinatesQuerySchema>;
 export type CoordinatesQueryInput = z.input<typeof coordinatesQuerySchema>;
-/**
- * The city these coordinates look like, for the member to CONFIRM, or `null`
- * when the lookup could not place them confidently (or they are outside India,
- * whose area data is all there is). A suggestion, never a write: only what the
- * member then submits becomes their location.
- */
-export declare const suggestedLocationSchema: z.ZodNullable<z.ZodObject<{
-    city: z.ZodString;
-    state: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
-    country: z.ZodString;
-}, z.core.$strip>>;
-export type SuggestedLocation = z.infer<typeof suggestedLocationSchema>;
 /**
  * Cursor pagination query. Feed and Discover both use it.
  *

package/dist/core/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/core/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAGvD,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,GAAI,kBAAe,yDAC8B,CAAC;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,2DAKlC,CAAC;AAEzC,4EAA4E;AAC5E,eAAO,MAAM,cAAc,wDAGS,CAAC;AACrC,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,aAAa,UAIxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,UAAkC,CAAC;AAC7D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM1E;AAED,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GAAI,OAAO,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,aACI,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,4CAA6C,CAAC;AAC7F,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,aAAa,8HAQhB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBzD;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,eAAO,MAAM,cAAc,aAOqD,CAAC;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,uNAqBrB,CAAC;AAIX,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qGASvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;;;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe,2PAsBlB,CAAC;AACX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,YAAY,8LAgBf,CAAC;AACX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAAuB,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,gMAYd,CAAC;AACX,eAAO,MAAM,UAAU;;;;;;;;;;;;EAAsB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAI9C;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,eAAO,MAAM,YAAY;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAAiD,CAAC;AAIhF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,aAGiC,CAAC;AAC1D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAIhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;kBAA4B,CAAC;AACjE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/core/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAGvD,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,GAAI,kBAAe,yDAC8B,CAAC;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,2DAKlC,CAAC;AAEzC,4EAA4E;AAC5E,eAAO,MAAM,cAAc,wDAGS,CAAC;AACrC,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,aAAa,UAIxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,UAAkC,CAAC;AAC7D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM1E;AAED,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GAAI,OAAO,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,aACI,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,4CAA6C,CAAC;AAC7F,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,aAAa,8HAQhB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBzD;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,eAAO,MAAM,cAAc,aAOqD,CAAC;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,uNAqBrB,CAAC;AAIX,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qGASvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;;;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe,2PAsBlB,CAAC;AACX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,YAAY,8LAgBf,CAAC;AACX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAAuB,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,WAAW,kUAwBd,CAAC;AACX,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;EAAsB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAK9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;GAGsC,CAAC;AAElE,yGAAyG;AACzG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;GAGsC,CAAC;AAInE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,eAAO,MAAM,YAAY;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,UAAU,MAAM,KAAG,MAA8C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,wDAKJ,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMvF;AAID,4FAA4F;AAC5F,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,aAGgE,CAAC;AACzF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAI3E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/core/common.js

@@ -7,7 +7,7 @@
  * @module founder-schema/core/common
  */
 import { z } from 'zod';
-import { CITY_MAX, COUNTRY_MAX, DISPLAY_NAME_MAX, LINK_URL_MAX, PAGE_SIZE_DEFAULT, PAGE_SIZE_MAX, STATE_MAX, } from './limits.js';
+import { CITY_MAX, COUNTRY_MAX, DISPLAY_NAME_MAX, LINK_URL_MAX, PAGE_SIZE_DEFAULT, PAGE_SIZE_MAX, SKILLS_MAX, STATE_MAX, } from './limits.js';
 import { VALIDATION_MESSAGE } from './validation.js';
 // ─── String helpers ──────────────────────────────────────────────────────────
 /**
@@ -94,6 +94,19 @@ export const safeUrlSchema = z.url({
  * `imageUrl` would have failed a whole feed page.
  */
 export const httpUrlSchema = safeUrlSchema.max(LINK_URL_MAX);
+/**
+ * A link as people paste it, made into what `httpUrlSchema` checks (0.17.0,
+ * moved here from the web so every client cleans a link the same way):
+ * `linkedin.com/in/asha` gains `https://`; blank stays blank. Something that
+ * already names a scheme keeps it, so `javascript:` is never quietly "fixed"
+ * into a link: the schema then refuses it, as it only takes http and https.
+ */
+export function normalizeLinkUrl(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return '';
+    return /^[a-z][a-z0-9+.-]*:/i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
 /**
  * True when `url` parses and its hostname is EXACTLY one of `hosts`
  * (lowercase). The one host check in this package, written the way the warning
@@ -312,9 +325,10 @@ export const skillSchema = z.enum(SKILL_VALUES);
  * venture works only for a member who ALREADY HAS a venture row, and somebody
  * who wants to start a company is precisely the member with no venture at all,
  * so there is nothing to infer from. It also cannot express a founder with a
- * running company who wants to start another. Every other value is an ask of
- * other people and this one is an ask of the product, which is the whole of the
- * oddness. (hary, 2026-09-21.)
+ * running company who wants to start another. The others were all asks of other
+ * people and this one an ask of the product, which is the whole of the oddness.
+ * (hary, 2026-09-21.) Since 0.16.0 the list also holds offers (`mentor_others`,
+ * `invest_in_startups`) and a second ask of the product (`attend_events`).
  */
 export const GOAL_VALUES = [
     'find_cofounder',
@@ -328,8 +342,37 @@ export const GOAL_VALUES = [
     'market_insights',
     'learn_startup',
     'start_company',
+    // 0.16.0 (the user, 2026-10-18: "a few more ... cover most of the goals"):
+    // the journey's own asks (feedback on an idea, early testers), the other
+    // side of mentorship and of fundraising (mentoring, investing), and three
+    // more a founder network is asked for: joining a startup, finding
+    // service providers, and events. Appended, per the rule above.
+    'get_feedback',
+    'find_testers',
+    'mentor_others',
+    'invest_in_startups',
+    'join_startup',
+    'find_service_providers',
+    'attend_events',
 ];
 export const goalSchema = z.enum(GOAL_VALUES);
+/** True when no value is in the list twice. */
+const eachOnce = (items) => new Set(items).size === items.length;
+/**
+ * A member's goals as a list (0.17.0): each goal once, at most every goal.
+ * ONE rule for onboarding's finish (which adds its minimum, `GOALS_MIN`) and
+ * the Me tab's editor: two copies of one goal met the minimum while meaning
+ * one, and the profile would show it twice.
+ */
+export const goalListSchema = z
+    .array(goalSchema)
+    .max(GOAL_VALUES.length)
+    .refine(eachOnce, { error: VALIDATION_MESSAGE.goalsDuplicate });
+/** A member's skills (0.17.0): each skill once, at most `SKILLS_MAX`. ONE rule for onboarding and Me. */
+export const skillListSchema = z
+    .array(skillSchema)
+    .max(SKILLS_MAX)
+    .refine(eachOnce, { error: VALIDATION_MESSAGE.skillsDuplicate });
 // ─── Gender ──────────────────────────────────────────────────────────────────
 /**
  * Demographic only. Nothing here computes anything from it, unlike the sibling
@@ -342,15 +385,51 @@ export const goalSchema = z.enum(GOAL_VALUES);
 export const GENDER_VALUES = ['male', 'female', 'other', 'prefer_not_to_say'];
 export const genderSchema = z.enum(GENDER_VALUES);
 // ─── Display name ────────────────────────────────────────────────────────────
+/**
+ * A full name as it is sent and stored (0.17.0, moved here from the web):
+ * trimmed, and every run of spaces made one. `displayNameSchema` applies it,
+ * so the server stores it from every client; a client applies it to show the
+ * member what will be kept. What `splitFullName` reads.
+ */
+export const tidyFullName = (fullName) => fullName.trim().replace(/\s+/g, ' ');
 /**
  * The name a member is shown by. ONE rule for every body that writes it:
  * onboarding's finish, the profile patch and the personal-details patch, so a
- * name one accepts the others can never refuse. Plain bounds, no custom
- * message: `too_small` with minimum 1 already says "required", and the client
- * words it.
+ * name one accepts the others can never refuse, and each stores it TIDIED
+ * (`tidyFullName`, 0.17.0: "Asha   Rao" from the Me editor was stored as
+ * typed, while onboarding sent it tidy). Plain bounds, no custom message:
+ * `too_small` with minimum 1 already says "required", and the client words it.
  */
-export const displayNameSchema = z.string().trim().min(1).max(DISPLAY_NAME_MAX);
+export const displayNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(DISPLAY_NAME_MAX)
+    .transform(tidyFullName);
+/**
+ * A full name's first and last name, DEDUCED, never asked (the user,
+ * 2026-10-18: onboarding asks one "Full name" and works the two out from the
+ * space). The first word is the first name and everything after the first
+ * space is the last name, kept as written ("Asha Rao Kulkarni" is Asha and
+ * Rao Kulkarni).
+ *
+ * ⚠ A ONE-WORD NAME IS A WHOLE NAME. Many people in India go by a single name,
+ * so `lastName` is then `''`, and nothing may refuse it for that.
+ *
+ * Derived wherever it is needed, never stored as a second copy of the name:
+ * `displayName` stays the one owner of a member's name, so a rename can never
+ * leave a stale first name behind.
+ */
+export function splitFullName(fullName) {
+    const name = tidyFullName(fullName);
+    const space = name.indexOf(' ');
+    return space === -1
+        ? { firstName: name, lastName: '' }
+        : { firstName: name.slice(0, space), lastName: name.slice(space + 1) };
+}
 // ─── Phone ───────────────────────────────────────────────────────────────────
+/** The digits an Indian mobile number has: what `phoneSchema` takes and the field keeps. */
+export const PHONE_DIGITS = 10;
 /**
  * Indian mobile number: ten raw digits, no country code, matching the standard
  * used across this family. Display adds the `+91`.
@@ -363,7 +442,23 @@ export const displayNameSchema = z.string().trim().min(1).max(DISPLAY_NAME_MAX);
 export const phoneSchema = z
     .string()
     .trim()
-    .regex(/^[6-9]\d{9}$/, VALIDATION_MESSAGE.phoneInvalid);
+    .regex(new RegExp(`^[6-9]\\d{${PHONE_DIGITS - 1}}$`), VALIDATION_MESSAGE.phoneInvalid);
+/**
+ * An Indian mobile number as `phoneSchema`'s ten digits, from however it was
+ * typed (0.17.0, moved here from the web): `98765 43210`, `+91 98765-43210`,
+ * `091 9876543210`. Anything else comes back digits only and fails the schema
+ * with `phoneInvalid`, rather than being guessed at.
+ */
+export function normalizePhone(raw) {
+    let digits = raw.replace(/\D/g, '');
+    if (digits.length === PHONE_DIGITS + 2 && digits.startsWith('91'))
+        digits = digits.slice(2);
+    else if (digits.length === PHONE_DIGITS + 1 && digits.startsWith('0'))
+        digits = digits.slice(1);
+    else if (digits.length === PHONE_DIGITS + 3 && digits.startsWith('091'))
+        digits = digits.slice(3);
+    return digits;
+}
 // ─── Location ────────────────────────────────────────────────────────────────
 /**
  * Where the founder is based. City and country are what Discover filters on.
@@ -398,13 +493,6 @@ export const coordinatesQuerySchema = z.object({
     lat: z.preprocess(emptyStringToUndefined, z.coerce.number().min(-90).max(90)),
     lng: z.preprocess(emptyStringToUndefined, z.coerce.number().min(-180).max(180)),
 });
-/**
- * The city these coordinates look like, for the member to CONFIRM, or `null`
- * when the lookup could not place them confidently (or they are outside India,
- * whose area data is all there is). A suggestion, never a write: only what the
- * member then submits becomes their location.
- */
-export const suggestedLocationSchema = locationSchema.nullable();
 // ─── Pagination ──────────────────────────────────────────────────────────────
 /**
  * Cursor pagination query. Feed and Discover both use it.