founder-schema 0.16.0 → 0.18.0

package/dist/access/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAGlD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK;IACL,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,SAAS;IACT,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AA6FpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["/**\n * founder-schema: what a role may do, in CASL's terms\n *\n * Permissions are ACTION on SUBJECT, optionally narrowed by conditions on the\n * subject's fields (\"update a Post whose authorId is mine\"). The backend writes\n * one small policy per role from these words; the web receives the resulting\n * rules and asks the same questions to decide what to draw. Because both sides\n * spell actions and subjects from this file, a permission check with a typo is\n * a compile error, not a button that silently never shows.\n *\n * The SERVER decides; the web only mirrors. Every rule the web holds came from\n * the server for the role being acted as, and every request is checked again\n * on the server, so a tampered client can show itself a button and nothing\n * more.\n *\n * @module founder-schema/access/permissions\n */\n\nimport type { ForcedSubject, MongoAbility } from '@casl/ability';\nimport { z } from 'zod';\nimport type { PurchaseKind } from '../domains/billing/billing.js';\nimport type { PlatformRole } from './roles.js';\nimport type { Standing } from './standing.js';\n\n/**\n * The verbs.\n *\n *   manage    every action (CASL's wildcard). Only superadmin holds it on `all`.\n *   create, read, update, delete\n *   moderate  hide, restore or remove someone else's content, act on a report\n *   assign    grant or revoke (a platform role); take or hand over (a ticket)\n *   suspend   stop a member signing in to the product, and lift it\n *   resolve   close a support ticket or a report\n *   reset     clear a credential its owner forgot (a staff member's MPIN)\n *   represent act for a product as one of its team: tag a post with it, reply\n *             to its reviews, mark feedback helpful, confirm a tester\n *\n * Taking part (0.12.0, membership): the verbs a viewer is refused and a member\n * holds. Creating content stays `create`; these are the rest.\n *\n *   react     a reaction on a post, poll or comment; an upvote on a product;\n *             marking a review helpful\n *   vote      vote in a poll\n *   save      bookmark a post or poll\n *   join      join a community, ask to, or accept its invitation; accept an\n *             invitation to a product's team\n *   message   start a conversation with a Member\n *   refund    give a payment's money back (staff)\n *\n * Append only: a stored or packed rule names these.\n */\nexport const ACTION_VALUES = [\n  'manage',\n  'create',\n  'read',\n  'update',\n  'delete',\n  'moderate',\n  'assign',\n  'suspend',\n  'resolve',\n  'reset',\n  'represent',\n  'react',\n  'vote',\n  'save',\n  'join',\n  'message',\n  'refund',\n] as const;\nexport const actionSchema = z.enum(ACTION_VALUES);\nexport type Action = z.infer<typeof actionSchema>;\n\n/**\n * The things.\n *\n *   all               CASL's wildcard subject\n *   Dashboard         the staff overview: counts and trends\n *   Member            a person's account in this product\n *   FounderProfile    a member's public profile\n *   Post, Poll, Comment\n *   Report            a member's report of a post, poll or comment\n *   SupportTicket     a member's request for help\n *   SavedReply        a support agent's reusable answer\n *   PlatformRole      a staff role, as something granted and revoked\n *   AuditEntry        the record of a staff action\n *   PlatformSettings  product-wide configuration\n *   Product           something a founder builds, with its team\n *   Review            a member's stars and words on a product\n *   Community         an official community (0.9.0)\n *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)\n *   Membership        a person's platform membership: granted, revoked (0.12.0)\n *   Payment           a purchase and its invoice, and its refund (0.12.0)\n *   Coupon            a code that gives a membership or a discount (0.12.0)\n */\nexport const SUBJECT_VALUES = [\n  'all',\n  'Dashboard',\n  'Member',\n  'FounderProfile',\n  'Post',\n  'Poll',\n  'Comment',\n  'Report',\n  'SupportTicket',\n  'SavedReply',\n  'PlatformRole',\n  'AuditEntry',\n  'PlatformSettings',\n  'Product',\n  'Review',\n  'Community',\n  'CommunitySuggestion',\n  'Membership',\n  'Payment',\n  'Coupon',\n] as const;\nexport const subjectSchema = z.enum(SUBJECT_VALUES);\nexport type Subject = z.infer<typeof subjectSchema>;\n\n/**\n * The fields a rule may set CONDITIONS on, per subject: the server's stored\n * names, ids as strings. Declared here so a condition on a field the subject\n * does not have (`{ ownerId: me }` on a Post) is a compile error, on both sides.\n *\n * A web screen does not evaluate these against an API response: a response\n * names things differently (`author.userId`, not `authorId`). Row-level answers\n * come from the server on the item itself (`viewer.canEdit`); the web's own\n * checks are type-level (\"may I moderate Reports at all\").\n */\nexport interface SubjectFields {\n  Dashboard: Record<never, never>;\n  /**\n   * `appRoles` is the staff roles held, so a rule can protect a role (\"never\n   * suspend a superadmin\").\n   *\n   * For `message` (0.12.0), what the asker's relation to them is:\n   * `contact` says the asker knows them (a teammate, a private community in\n   * common, a conversation already); `standing` is theirs, so nobody starts a\n   * conversation with a viewer, who cannot chat; `acceptsStrangers` is their\n   * own setting (Premium and Business members may start one, or only people\n   * they know). Optional because only the messaging check computes them: a\n   * rule on a field that is absent never matches, so a check that forgets them\n   * is refused, never let through.\n   */\n  Member: {\n    _id: string;\n    appRoles: PlatformRole[];\n    contact?: boolean;\n    standing?: Standing;\n    acceptsStrangers?: boolean;\n  };\n  FounderProfile: { userId: string };\n  Post: { authorId: string };\n  Poll: { authorId: string };\n  Comment: { authorId: string };\n  Report: { reporterId: string; status: string };\n  SupportTicket: { memberId: string; assigneeId: string | null };\n  SavedReply: { authorId: string };\n  /** One role on one person: `memberId` is whose, so \"never your own\" is a rule too. */\n  PlatformRole: { role: PlatformRole; memberId: string };\n  /** `actorId` is null for an entry a server script wrote. */\n  AuditEntry: { actorId: string | null };\n  PlatformSettings: Record<never, never>;\n  /**\n   * The team, as three lists of member ids, so a rule reads \"a product whose\n   * managers include me\" (`{ managerIds: me }`). `managerIds` is the owner and\n   * the co-founders; `memberIds` is everyone on the team, owner included.\n   */\n  Product: { ownerId: string; managerIds: string[]; memberIds: string[] };\n  Review: { authorId: string };\n  /**\n   * Its admins and moderators as id lists (0.9.0), so a rule reads \"a\n   * community whose admins include me\" (`{ adminIds: me }`). Both short by\n   * nature; ordinary members are never listed here (a community has no cap).\n   */\n  Community: { _id: string; adminIds: string[]; moderatorIds: string[] };\n  /** `suggestedBy` so \"your own\" is a rule; `status` so only open ones are decided. */\n  CommunitySuggestion: { suggestedBy: string; status: string };\n  /** Whose membership (0.12.0), so \"never your own\" is a rule. */\n  Membership: { userId: string };\n  /**\n   * Who pays (0.12.0), what for, and where it stands: a viewer may buy only a\n   * membership (a plan needs one), only a paid one is refunded, and never by\n   * its own payer.\n   */\n  Payment: { userId: string; status: string; kind: PurchaseKind };\n  /** Coupons are the platform's (0.12.0): no condition is ever written on one. */\n  Coupon: Record<never, never>;\n}\n\n/** A document tagged with its subject type, as CASL's `subject('Post', doc)` makes one. */\nexport type SubjectInstance = {\n  [K in keyof SubjectFields]: SubjectFields[K] & ForcedSubject<K>;\n}[keyof SubjectFields];\n\n/**\n * The ability both sides build: the backend from its policy, the web from the\n * rules the backend sends. Mongo-style conditions, typed by `SubjectFields`.\n */\nexport type AppAbility = MongoAbility<[Action, Subject | SubjectInstance]>;\n\n/**\n * Compile-time proof that `SubjectFields` names exactly the subjects, no more\n * and no fewer: adding a subject without its fields fails the build here.\n */\ntype Same<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;\ntype Assert<T extends true> = T;\nexport type EverySubjectHasFields = Assert<Same<keyof SubjectFields, Exclude<Subject, 'all'>>>;\n\n/**\n * Rules as they cross the wire: CASL's `packRules` output, an array of\n * compact arrays. The web unpacks them with `unpackRules` before building its\n * ability; their inner shape is CASL's, so it is not re-described here.\n */\nexport const packedRulesSchema = z.array(z.array(z.unknown()));\nexport type PackedRules = z.infer<typeof packedRulesSchema>;\n"]}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/access/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;CACA,CAAC;AAGX;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK;IACL,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,SAAS;IACT,QAAQ;IACR,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,SAAS;IACT,QAAQ;CACA,CAAC;AACX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AA6FpD;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,KAAK,CAAC;QACN,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,EAAE;QACX,SAAS;QACT,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,MAAM,EAAE;KACX,CAAC;CACH,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAM3D,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,KAAoC,EAAE,KAA0B,EAAE,EAAE,CACnF,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAG5B;IACC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * founder-schema: what a role may do, in CASL's terms\n *\n * Permissions are ACTION on SUBJECT, optionally narrowed by conditions on the\n * subject's fields (\"update a Post whose authorId is mine\"). The backend writes\n * one small policy per role from these words; the web receives the resulting\n * rules and asks the same questions to decide what to draw. Because both sides\n * spell actions and subjects from this file, a permission check with a typo is\n * a compile error, not a button that silently never shows.\n *\n * The SERVER decides; the web only mirrors. Every rule the web holds came from\n * the server for the role being acted as, and every request is checked again\n * on the server, so a tampered client can show itself a button and nothing\n * more.\n *\n * @module founder-schema/access/permissions\n */\n\nimport type { ForcedSubject, MongoAbility, RawRuleOf } from '@casl/ability';\nimport { z } from 'zod';\nimport type { OrderStatus, PurchaseKind } from '../domains/billing/billing.js';\nimport type { CommunitySuggestionStatus } from '../domains/communities/communities.js';\nimport type { ReportStatus } from '../domains/feed/feed.js';\nimport type { PlatformRole } from './roles.js';\nimport type { Standing } from './standing.js';\n\n/**\n * The verbs.\n *\n *   manage    every action (CASL's wildcard). Only superadmin holds it on `all`.\n *   create, read, update, delete\n *   moderate  hide, restore or remove someone else's content, act on a report\n *   assign    grant or revoke (a platform role); take or hand over (a ticket)\n *   suspend   stop a member signing in to the product, and lift it\n *   resolve   close a support ticket or a report\n *   reset     clear a credential its owner forgot (a staff member's MPIN)\n *   represent act for a product as one of its team: tag a post with it, reply\n *             to its reviews, mark feedback helpful, confirm a tester\n *\n * Taking part (0.12.0, membership): the verbs a viewer is refused and a member\n * holds. Creating content stays `create`; these are the rest.\n *\n *   react     a reaction on a post, poll or comment; an upvote on a product;\n *             marking a review helpful\n *   vote      vote in a poll\n *   save      bookmark a post or poll\n *   join      join a community, ask to, or accept its invitation; accept an\n *             invitation to a product's team\n *   message   start a conversation with a Member\n *   refund    give a payment's money back (staff)\n *\n * Append only: a stored or packed rule names these.\n */\nexport const ACTION_VALUES = [\n  'manage',\n  'create',\n  'read',\n  'update',\n  'delete',\n  'moderate',\n  'assign',\n  'suspend',\n  'resolve',\n  'reset',\n  'represent',\n  'react',\n  'vote',\n  'save',\n  'join',\n  'message',\n  'refund',\n] as const;\nexport type Action = (typeof ACTION_VALUES)[number];\n\n/**\n * The things.\n *\n *   all               CASL's wildcard subject\n *   Dashboard         the staff overview: counts and trends\n *   Member            a person's account in this product\n *   FounderProfile    a member's public profile\n *   Post, Poll, Comment\n *   Report            a member's report of a post, poll or comment\n *   SupportTicket     a member's request for help\n *   SavedReply        a support agent's reusable answer\n *   PlatformRole      a staff role, as something granted and revoked\n *   AuditEntry        the record of a staff action\n *   PlatformSettings  product-wide configuration\n *   Product           something a founder builds, with its team\n *   Review            a member's stars and words on a product\n *   Community         an official community (0.9.0)\n *   CommunitySuggestion  a member's suggestion for a new community (0.9.0)\n *   Membership        a person's platform membership: granted, revoked (0.12.0)\n *   Payment           a purchase and its invoice, and its refund (0.12.0)\n *   Coupon            a code that gives a membership or a discount (0.12.0)\n */\nexport const SUBJECT_VALUES = [\n  'all',\n  'Dashboard',\n  'Member',\n  'FounderProfile',\n  'Post',\n  'Poll',\n  'Comment',\n  'Report',\n  'SupportTicket',\n  'SavedReply',\n  'PlatformRole',\n  'AuditEntry',\n  'PlatformSettings',\n  'Product',\n  'Review',\n  'Community',\n  'CommunitySuggestion',\n  'Membership',\n  'Payment',\n  'Coupon',\n] as const;\nexport const subjectSchema = z.enum(SUBJECT_VALUES);\nexport type Subject = z.infer<typeof subjectSchema>;\n\n/**\n * The fields a rule may set CONDITIONS on, per subject: the server's stored\n * names, ids as strings. Declared here so a condition on a field the subject\n * does not have (`{ ownerId: me }` on a Post) is a compile error, on both sides.\n *\n * A web screen does not evaluate these against an API response: a response\n * names things differently (`author.userId`, not `authorId`). Row-level answers\n * come from the server on the item itself (`viewer.canEdit`); the web's own\n * checks are type-level (\"may I moderate Reports at all\").\n */\nexport interface SubjectFields {\n  Dashboard: Record<never, never>;\n  /**\n   * `appRoles` is the staff roles held, so a rule can protect a role (\"never\n   * suspend a superadmin\").\n   *\n   * For `message` (0.12.0), what the asker's relation to them is:\n   * `contact` says the asker knows them (a teammate, a private community in\n   * common, a conversation already); `standing` is theirs, so nobody starts a\n   * conversation with a viewer, who cannot chat; `acceptsStrangers` is their\n   * own setting (Premium and Business members may start one, or only people\n   * they know). Optional because only the messaging check computes them: a\n   * rule on a field that is absent never matches, so a check that forgets them\n   * is refused, never let through.\n   */\n  Member: {\n    _id: string;\n    appRoles: PlatformRole[];\n    contact?: boolean;\n    standing?: Standing;\n    acceptsStrangers?: boolean;\n  };\n  FounderProfile: { userId: string };\n  Post: { authorId: string };\n  Poll: { authorId: string };\n  Comment: { authorId: string };\n  Report: { reporterId: string; status: ReportStatus };\n  SupportTicket: { memberId: string; assigneeId: string | null };\n  SavedReply: { authorId: string };\n  /** One role on one person: `memberId` is whose, so \"never your own\" is a rule too. */\n  PlatformRole: { role: PlatformRole; memberId: string };\n  /** `actorId` is null for an entry a server script wrote. */\n  AuditEntry: { actorId: string | null };\n  PlatformSettings: Record<never, never>;\n  /**\n   * The team, as three lists of member ids, so a rule reads \"a product whose\n   * managers include me\" (`{ managerIds: me }`). `managerIds` is the owner and\n   * the co-founders; `memberIds` is everyone on the team, owner included.\n   */\n  Product: { ownerId: string; managerIds: string[]; memberIds: string[] };\n  Review: { authorId: string };\n  /**\n   * Its admins and moderators as id lists (0.9.0), so a rule reads \"a\n   * community whose admins include me\" (`{ adminIds: me }`). Both short by\n   * nature; ordinary members are never listed here (a community has no cap).\n   */\n  Community: { _id: string; adminIds: string[]; moderatorIds: string[] };\n  /** `suggestedBy` so \"your own\" is a rule; `status` so only open ones are decided. */\n  CommunitySuggestion: { suggestedBy: string; status: CommunitySuggestionStatus };\n  /** Whose membership (0.12.0), so \"never your own\" is a rule. */\n  Membership: { userId: string };\n  /**\n   * Who pays (0.12.0), what for, and where it stands: a viewer may buy only a\n   * membership (a plan needs one), only a paid one is refunded, and never by\n   * its own payer.\n   */\n  Payment: { userId: string; status: OrderStatus; kind: PurchaseKind };\n  /** Coupons are the platform's (0.12.0): no condition is ever written on one. */\n  Coupon: Record<never, never>;\n}\n\n/** A document tagged with its subject type, as CASL's `subject('Post', doc)` makes one. */\nexport type SubjectInstance = {\n  [K in keyof SubjectFields]: SubjectFields[K] & ForcedSubject<K>;\n}[keyof SubjectFields];\n\n/**\n * The ability both sides build: the backend from its policy, the web from the\n * rules the backend sends. Mongo-style conditions, typed by `SubjectFields`.\n */\nexport type AppAbility = MongoAbility<[Action, Subject | SubjectInstance]>;\n\n/**\n * Compile-time proof that `SubjectFields` names exactly the subjects, no more\n * and no fewer: adding a subject without its fields fails the build here.\n */\ntype Same<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;\ntype Assert<T extends true> = T;\nexport type EverySubjectHasFields = Assert<Same<keyof SubjectFields, Exclude<Subject, 'all'>>>;\n\n/**\n * Rules as they cross the wire: CASL's `packRules` output, an array of\n * compact arrays. The web unpacks them with `unpackRules` before building its\n * ability. Each starts with its action(s) and subject(s), comma-joined\n * strings (checked, 0.18.0: an unchecked rule list could silently turn staff\n * routing off); what follows (conditions, inverted, fields, reason) is CASL's\n * own compact form.\n */\nconst zeroOrOne = z.union([z.literal(0), z.literal(1)]);\n/**\n * One packed rule, in exactly the shapes CASL's `PackRule` takes (a union of\n * tuples, not a rest: `unpackRules` needs one of these), with `conditions` as\n * `unknown`, which `isAppRawRule` and the ability itself then judge.\n */\nexport const packedRuleSchema = z.union([\n  z.tuple([z.string().min(1), z.string().min(1)]),\n  z.tuple([z.string().min(1), z.string().min(1), z.unknown()]),\n  z.tuple([z.string().min(1), z.string().min(1), z.unknown(), z.literal(1)]),\n  z.tuple([z.string().min(1), z.string().min(1), z.unknown(), zeroOrOne, z.string()]),\n  z.tuple([\n    z.string().min(1),\n    z.string().min(1),\n    z.unknown(),\n    zeroOrOne,\n    z.union([z.string(), z.literal(0)]),\n    z.string(),\n  ]),\n]);\nexport const packedRulesSchema = z.array(packedRuleSchema);\nexport type PackedRules = z.infer<typeof packedRulesSchema>;\n\n/** One rule as CASL's `unpackRules` gives it back, typed for this app. */\nexport type AppRawRule = RawRuleOf<AppAbility>;\n\nconst ACTION_SET: ReadonlySet<string> = new Set(ACTION_VALUES);\nconst SUBJECT_SET: ReadonlySet<string> = new Set(SUBJECT_VALUES);\nconst everyIn = (value: string | string[] | undefined, known: ReadonlySet<string>) =>\n  value !== undefined && (Array.isArray(value) ? value : [value]).every((v) => known.has(v));\n\n/**\n * Whether an UNPACKED rule names only this app's actions and subjects\n * (0.18.0). Packed rules cross the wire as strings (`packRules` joins several\n * actions or subjects with commas, so the wire shape cannot be an enum); this\n * is the check that turns them back into `AppRawRule`s, with no cast:\n * `rules.every(isAppRawRule)` narrows the list, and a list that fails is a\n * contract mismatch, never an ability built from it.\n */\nexport function isAppRawRule(rule: {\n  action: string | string[];\n  subject?: string | string[];\n}): rule is AppRawRule {\n  return everyIn(rule.action, ACTION_SET) && everyIn(rule.subject, SUBJECT_SET);\n}\n"]}

package/dist/core/common.d.ts

@@ -16,8 +16,14 @@ import { z } from 'zod';
  * alone. Jansathi shipped that bug in dating onboarding.
  */
 export declare const emptyStringToUndefined: (value: unknown) => unknown;
-/** Optional trimmed string. Empty strings are coerced to `undefined`. */
-export declare const optionalTrimmedString: (maxLength?: number) => z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+/**
+ * Optional trimmed string: a blank one (`''`, spaces) is absent (`undefined`).
+ * Trimmed, checked, then blank dropped, never a preprocess (0.18.0: a
+ * preprocess types its INPUT as `unknown`, so a caller typing a body by
+ * `z.input` could send a number and still compile). `.optional()` OUTSIDE, so
+ * the key stays optional in the output type as well as the input.
+ */
+export declare const optionalTrimmedString: (maxLength?: number) => z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
 /**
  * A repeated query param (`?skill=growth&skill=sales`) or a single value,
  * always as an array, at most `max` values.
@@ -78,6 +84,14 @@ export type SafeUrl = z.infer<typeof safeUrlSchema>;
  */
 export declare const httpUrlSchema: z.ZodURL;
 export type HttpUrl = z.infer<typeof httpUrlSchema>;
+/**
+ * A link as people paste it, made into what `httpUrlSchema` checks (0.17.0,
+ * moved here from the web so every client cleans a link the same way):
+ * `linkedin.com/in/asha` gains `https://`; blank stays blank. Something that
+ * already names a scheme keeps it, so `javascript:` is never quietly "fixed"
+ * into a link: the schema then refuses it, as it only takes http and https.
+ */
+export declare function normalizeLinkUrl(raw: string): string;
 /**
  * True when `url` parses and its hostname is EXACTLY one of `hosts`
  * (lowercase). The one host check in this package, written the way the warning
@@ -104,12 +118,13 @@ export type ProductListingRequirement = z.infer<typeof productListingRequirement
  * is shared as a link and played in the card, never uploaded. The web plays it
  * through youtube-nocookie.com, the one video frame its CSP admits.
  */
-export declare const YOUTUBE_HOSTS: readonly ["youtube.com", "www.youtube.com", "m.youtube.com", "youtu.be", "youtube-nocookie.com", "www.youtube-nocookie.com"];
+export declare const YOUTUBE_HOSTS: readonly ["youtube.com", "www.youtube.com", "m.youtube.com", "music.youtube.com", "youtu.be", "www.youtu.be", "youtube-nocookie.com", "www.youtube-nocookie.com"];
 /**
  * The 11-character id of a YouTube VIDEO link, or null for anything else (a
  * channel, a playlist, the home page, another site): what a page can embed.
- * Reads `youtu.be/<id>`, `/watch?v=<id>`, and `/shorts/`, `/embed/`, `/live/<id>`
- * on a `YOUTUBE_HOSTS` host (0.7.0).
+ * Reads `youtu.be/<id>`, `/watch?v=<id>`, and `/shorts/`, `/embed/`, `/live/`,
+ * `/v/<id>` on a `YOUTUBE_HOSTS` host (0.7.0; `/v/` and the feed's hosts
+ * 0.18.0). THE rule for a product's video and a post's embed alike.
  */
 export declare function youtubeVideoId(url: string): string | null;
 /**
@@ -265,6 +280,80 @@ export declare const goalSchema: z.ZodEnum<{
     attend_events: "attend_events";
 }>;
 export type Goal = z.infer<typeof goalSchema>;
+/**
+ * True when no value is in the list twice: THE duplicate rule (0.18.0, exported;
+ * every list in this package refines with it instead of its own copy).
+ */
+export declare const eachOnce: (items: readonly unknown[]) => boolean;
+/**
+ * A member's goals as a list (0.17.0): each goal once, at most every goal.
+ * ONE rule for onboarding's finish and the Me tab's editor, which both add the
+ * minimum (`requiredGoalListSchema`, 0.18.0): two copies of one goal met the
+ * minimum while meaning one, and the profile would show it twice.
+ */
+export declare const goalListSchema: z.ZodArray<z.ZodEnum<{
+    find_cofounder: "find_cofounder";
+    find_investors: "find_investors";
+    find_customers: "find_customers";
+    hiring: "hiring";
+    partnerships: "partnerships";
+    mentorship: "mentorship";
+    grow_network: "grow_network";
+    business_ideas: "business_ideas";
+    market_insights: "market_insights";
+    learn_startup: "learn_startup";
+    start_company: "start_company";
+    get_feedback: "get_feedback";
+    find_testers: "find_testers";
+    mentor_others: "mentor_others";
+    invest_in_startups: "invest_in_startups";
+    join_startup: "join_startup";
+    find_service_providers: "find_service_providers";
+    attend_events: "attend_events";
+}>>;
+/**
+ * A member's goals where they are REQUIRED (0.18.0): at least `GOALS_MIN`.
+ * ONE schema for onboarding's finish and the Me editor (the user: "we already
+ * have at least one goal required"), so the two can never disagree.
+ */
+export declare const requiredGoalListSchema: z.ZodArray<z.ZodEnum<{
+    find_cofounder: "find_cofounder";
+    find_investors: "find_investors";
+    find_customers: "find_customers";
+    hiring: "hiring";
+    partnerships: "partnerships";
+    mentorship: "mentorship";
+    grow_network: "grow_network";
+    business_ideas: "business_ideas";
+    market_insights: "market_insights";
+    learn_startup: "learn_startup";
+    start_company: "start_company";
+    get_feedback: "get_feedback";
+    find_testers: "find_testers";
+    mentor_others: "mentor_others";
+    invest_in_startups: "invest_in_startups";
+    join_startup: "join_startup";
+    find_service_providers: "find_service_providers";
+    attend_events: "attend_events";
+}>>;
+/** A member's skills (0.17.0): each skill once, at most `SKILLS_MAX`. ONE rule for onboarding and Me. */
+export declare const skillListSchema: z.ZodArray<z.ZodEnum<{
+    engineering: "engineering";
+    product: "product";
+    design: "design";
+    data: "data";
+    growth: "growth";
+    sales: "sales";
+    marketing: "marketing";
+    operations: "operations";
+    finance: "finance";
+    legal: "legal";
+    hr_people: "hr_people";
+    supply_chain: "supply_chain";
+    research: "research";
+    fundraising: "fundraising";
+    community: "community";
+}>>;
 /**
  * Demographic only. Nothing here computes anything from it, unlike the sibling
  * gym product where gender feeds body-metric maths.
@@ -281,14 +370,22 @@ export declare const genderSchema: z.ZodEnum<{
     prefer_not_to_say: "prefer_not_to_say";
 }>;
 export type Gender = z.infer<typeof genderSchema>;
+/**
+ * A full name as it is sent and stored (0.17.0, moved here from the web):
+ * trimmed, and every run of spaces made one. `displayNameSchema` applies it,
+ * so the server stores it from every client; a client applies it to show the
+ * member what will be kept. What `splitFullName` reads.
+ */
+export declare const tidyFullName: (fullName: string) => string;
 /**
  * The name a member is shown by. ONE rule for every body that writes it:
  * onboarding's finish, the profile patch and the personal-details patch, so a
- * name one accepts the others can never refuse. Plain bounds, no custom
- * message: `too_small` with minimum 1 already says "required", and the client
- * words it.
+ * name one accepts the others can never refuse, and each stores it TIDIED
+ * (`tidyFullName`, 0.17.0: "Asha   Rao" from the Me editor was stored as
+ * typed, while onboarding sent it tidy). Plain bounds, no custom message:
+ * `too_small` with minimum 1 already says "required", and the client words it.
  */
-export declare const displayNameSchema: z.ZodString;
+export declare const displayNameSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
 /**
  * A full name's first and last name, DEDUCED, never asked (the user,
  * 2026-10-18: onboarding asks one "Full name" and works the two out from the
@@ -307,6 +404,8 @@ export declare function splitFullName(fullName: string): {
     firstName: string;
     lastName: string;
 };
+/** The digits an Indian mobile number has: what `phoneSchema` takes and the field keeps. */
+export declare const PHONE_DIGITS = 10;
 /**
  * Indian mobile number: ten raw digits, no country code, matching the standard
  * used across this family. Display adds the `+91`.
@@ -318,6 +417,13 @@ export declare function splitFullName(fullName: string): {
  */
 export declare const phoneSchema: z.ZodString;
 export type Phone = z.infer<typeof phoneSchema>;
+/**
+ * An Indian mobile number as `phoneSchema`'s ten digits, from however it was
+ * typed (0.17.0, moved here from the web): `98765 43210`, `+91 98765-43210`,
+ * `091 9876543210`. Anything else comes back digits only and fails the schema
+ * with `phoneInvalid`, rather than being guessed at.
+ */
+export declare function normalizePhone(raw: string): string;
 /**
  * Where the founder is based. City and country are what Discover filters on.
  *
@@ -337,7 +443,7 @@ export type Phone = z.infer<typeof phoneSchema>;
  */
 export declare const locationSchema: z.ZodObject<{
     city: z.ZodString;
-    state: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+    state: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
     country: z.ZodString;
 }, z.core.$strip>;
 export type FounderLocation = z.infer<typeof locationSchema>;
@@ -354,18 +460,6 @@ export declare const coordinatesQuerySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type CoordinatesQuery = z.infer<typeof coordinatesQuerySchema>;
 export type CoordinatesQueryInput = z.input<typeof coordinatesQuerySchema>;
-/**
- * The city these coordinates look like, for the member to CONFIRM, or `null`
- * when the lookup could not place them confidently (or they are outside India,
- * whose area data is all there is). A suggestion, never a write: only what the
- * member then submits becomes their location.
- */
-export declare const suggestedLocationSchema: z.ZodNullable<z.ZodObject<{
-    city: z.ZodString;
-    state: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
-    country: z.ZodString;
-}, z.core.$strip>>;
-export type SuggestedLocation = z.infer<typeof suggestedLocationSchema>;
 /**
  * Cursor pagination query. Feed and Discover both use it.
  *
@@ -374,7 +468,7 @@ export type SuggestedLocation = z.infer<typeof suggestedLocationSchema>;
  */
 export declare const paginationQuerySchema: z.ZodObject<{
     limit: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>, unknown>;
-    cursor: z.ZodOptional<z.ZodString>;
+    cursor: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
 }, z.core.$strip>;
 export type PaginationQuery = z.infer<typeof paginationQuerySchema>;
 /** What a client may put IN the URL: every field optional, numbers as strings. */

package/dist/core/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/core/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAGvD,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,GAAI,kBAAe,yDAC8B,CAAC;AAEpF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,2DAKlC,CAAC;AAEzC,4EAA4E;AAC5E,eAAO,MAAM,cAAc,wDAGS,CAAC;AACrC,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,aAAa,UAIxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,UAAkC,CAAC;AAC7D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM1E;AAED,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GAAI,OAAO,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,aACI,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,4CAA6C,CAAC;AAC7F,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,aAAa,8HAQhB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBzD;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,eAAO,MAAM,cAAc,aAOqD,CAAC;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,uNAqBrB,CAAC;AAIX,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qGASvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;;;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe,2PAsBlB,CAAC;AACX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,YAAY,8LAgBf,CAAC;AACX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAAuB,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,WAAW,kUAwBd,CAAC;AACX,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;EAAsB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAI9C;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,eAAO,MAAM,YAAY;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAAiD,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMvF;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,aAGiC,CAAC;AAC1D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAIhD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;kBAA4B,CAAC;AACjE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/core/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAGvD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,kBAAe,sFAMtC,CAAC;AAEhB;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,2DAKlC,CAAC;AAEzC,4EAA4E;AAC5E,eAAO,MAAM,cAAc,wDAGS,CAAC;AACrC,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,aAAa,UAIxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,UAAkC,CAAC;AAC7D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM1E;AAED,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GAAI,OAAO,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,aACI,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,4CAA6C,CAAC;AAC7F,eAAO,MAAM,+BAA+B;;;;EAA6C,CAAC;AAC1F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,aAAa,mKAWhB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBzD;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,eAAO,MAAM,cAAc,aAOqD,CAAC;AACjF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,uNAqBrB,CAAC;AAIX,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAIH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qGASvB,CAAC;AACX,eAAO,MAAM,kBAAkB;;;;;;;;;EAA+B,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe,2PAsBlB,CAAC;AACX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,YAAY,8LAgBf,CAAC;AACX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;EAAuB,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,WAAW,kUAwBd,CAAC;AACX,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;EAAsB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,SAAS,OAAO,EAAE,KAAG,OACf,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;GAGsC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;GAAgC,CAAC;AAEpE,yGAAyG;AACzG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;GAGsC,CAAC;AAInE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,2DAA4D,CAAC;AACvF,eAAO,MAAM,YAAY;;;;;EAAwB,CAAC;AAClD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,UAAU,MAAM,KAAG,MAA8C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,wDAKJ,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMvF;AAID,4FAA4F;AAC5F,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,aAGgE,CAAC;AACzF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAI3E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;iBAiBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/core/common.js

@@ -7,7 +7,7 @@
  * @module founder-schema/core/common
  */
 import { z } from 'zod';
-import { CITY_MAX, COUNTRY_MAX, DISPLAY_NAME_MAX, LINK_URL_MAX, PAGE_SIZE_DEFAULT, PAGE_SIZE_MAX, STATE_MAX, } from './limits.js';
+import { CITY_MAX, COUNTRY_MAX, CURSOR_MAX, DISPLAY_NAME_MAX, GOALS_MIN, LINK_URL_MAX, PAGE_SIZE_DEFAULT, PAGE_SIZE_MAX, SKILLS_MAX, STATE_MAX, } from './limits.js';
 import { VALIDATION_MESSAGE } from './validation.js';
 // ─── String helpers ──────────────────────────────────────────────────────────
 /**
@@ -23,8 +23,19 @@ export const emptyStringToUndefined = (value) => {
         return undefined;
     return value;
 };
-/** Optional trimmed string. Empty strings are coerced to `undefined`. */
-export const optionalTrimmedString = (maxLength = 100) => z.preprocess(emptyStringToUndefined, z.string().trim().max(maxLength).optional());
+/**
+ * Optional trimmed string: a blank one (`''`, spaces) is absent (`undefined`).
+ * Trimmed, checked, then blank dropped, never a preprocess (0.18.0: a
+ * preprocess types its INPUT as `unknown`, so a caller typing a body by
+ * `z.input` could send a number and still compile). `.optional()` OUTSIDE, so
+ * the key stays optional in the output type as well as the input.
+ */
+export const optionalTrimmedString = (maxLength = 100) => z
+    .string()
+    .trim()
+    .max(maxLength)
+    .transform((value) => value || undefined)
+    .optional();
 /**
  * A repeated query param (`?skill=growth&skill=sales`) or a single value,
  * always as an array, at most `max` values.
@@ -94,6 +105,19 @@ export const safeUrlSchema = z.url({
  * `imageUrl` would have failed a whole feed page.
  */
 export const httpUrlSchema = safeUrlSchema.max(LINK_URL_MAX);
+/**
+ * A link as people paste it, made into what `httpUrlSchema` checks (0.17.0,
+ * moved here from the web so every client cleans a link the same way):
+ * `linkedin.com/in/asha` gains `https://`; blank stays blank. Something that
+ * already names a scheme keeps it, so `javascript:` is never quietly "fixed"
+ * into a link: the schema then refuses it, as it only takes http and https.
+ */
+export function normalizeLinkUrl(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return '';
+    return /^[a-z][a-z0-9+.-]*:/i.test(trimmed) ? trimmed : `https://${trimmed}`;
+}
 /**
  * True when `url` parses and its hostname is EXACTLY one of `hosts`
  * (lowercase). The one host check in this package, written the way the warning
@@ -126,7 +150,10 @@ export const YOUTUBE_HOSTS = [
     'youtube.com',
     'www.youtube.com',
     'm.youtube.com',
+    // 0.18.0: the feed's links too, so one rule plays a post's video and a product's.
+    'music.youtube.com',
     'youtu.be',
+    'www.youtu.be',
     // The privacy-mode player's own links (0.7.0).
     'youtube-nocookie.com',
     'www.youtube-nocookie.com',
@@ -134,8 +161,9 @@ export const YOUTUBE_HOSTS = [
 /**
  * The 11-character id of a YouTube VIDEO link, or null for anything else (a
  * channel, a playlist, the home page, another site): what a page can embed.
- * Reads `youtu.be/<id>`, `/watch?v=<id>`, and `/shorts/`, `/embed/`, `/live/<id>`
- * on a `YOUTUBE_HOSTS` host (0.7.0).
+ * Reads `youtu.be/<id>`, `/watch?v=<id>`, and `/shorts/`, `/embed/`, `/live/`,
+ * `/v/<id>` on a `YOUTUBE_HOSTS` host (0.7.0; `/v/` and the feed's hosts
+ * 0.18.0). THE rule for a product's video and a post's embed alike.
  */
 export function youtubeVideoId(url) {
     let u;
@@ -148,11 +176,11 @@ export function youtubeVideoId(url) {
     const host = u.hostname.toLowerCase();
     if (!YOUTUBE_HOSTS.includes(host))
         return null;
-    const id = host === 'youtu.be'
+    const id = host === 'youtu.be' || host === 'www.youtu.be'
         ? (u.pathname.split('/')[1] ?? null)
         : u.pathname === '/watch'
             ? u.searchParams.get('v')
-            : (/^\/(?:shorts|embed|live)\/([^/]+)/.exec(u.pathname)?.[1] ?? null);
+            : (/^\/(?:shorts|embed|live|v)\/([^/]+)/.exec(u.pathname)?.[1] ?? null);
     return id && /^[A-Za-z0-9_-]{11}$/.test(id) ? id : null;
 }
 // ─── Username ────────────────────────────────────────────────────────────────
@@ -343,6 +371,32 @@ export const GOAL_VALUES = [
     'attend_events',
 ];
 export const goalSchema = z.enum(GOAL_VALUES);
+/**
+ * True when no value is in the list twice: THE duplicate rule (0.18.0, exported;
+ * every list in this package refines with it instead of its own copy).
+ */
+export const eachOnce = (items) => new Set(items).size === items.length;
+/**
+ * A member's goals as a list (0.17.0): each goal once, at most every goal.
+ * ONE rule for onboarding's finish and the Me tab's editor, which both add the
+ * minimum (`requiredGoalListSchema`, 0.18.0): two copies of one goal met the
+ * minimum while meaning one, and the profile would show it twice.
+ */
+export const goalListSchema = z
+    .array(goalSchema)
+    .max(GOAL_VALUES.length)
+    .refine(eachOnce, { error: VALIDATION_MESSAGE.goalsDuplicate });
+/**
+ * A member's goals where they are REQUIRED (0.18.0): at least `GOALS_MIN`.
+ * ONE schema for onboarding's finish and the Me editor (the user: "we already
+ * have at least one goal required"), so the two can never disagree.
+ */
+export const requiredGoalListSchema = goalListSchema.min(GOALS_MIN);
+/** A member's skills (0.17.0): each skill once, at most `SKILLS_MAX`. ONE rule for onboarding and Me. */
+export const skillListSchema = z
+    .array(skillSchema)
+    .max(SKILLS_MAX)
+    .refine(eachOnce, { error: VALIDATION_MESSAGE.skillsDuplicate });
 // ─── Gender ──────────────────────────────────────────────────────────────────
 /**
  * Demographic only. Nothing here computes anything from it, unlike the sibling
@@ -355,14 +409,27 @@ export const goalSchema = z.enum(GOAL_VALUES);
 export const GENDER_VALUES = ['male', 'female', 'other', 'prefer_not_to_say'];
 export const genderSchema = z.enum(GENDER_VALUES);
 // ─── Display name ────────────────────────────────────────────────────────────
+/**
+ * A full name as it is sent and stored (0.17.0, moved here from the web):
+ * trimmed, and every run of spaces made one. `displayNameSchema` applies it,
+ * so the server stores it from every client; a client applies it to show the
+ * member what will be kept. What `splitFullName` reads.
+ */
+export const tidyFullName = (fullName) => fullName.trim().replace(/\s+/g, ' ');
 /**
  * The name a member is shown by. ONE rule for every body that writes it:
  * onboarding's finish, the profile patch and the personal-details patch, so a
- * name one accepts the others can never refuse. Plain bounds, no custom
- * message: `too_small` with minimum 1 already says "required", and the client
- * words it.
+ * name one accepts the others can never refuse, and each stores it TIDIED
+ * (`tidyFullName`, 0.17.0: "Asha   Rao" from the Me editor was stored as
+ * typed, while onboarding sent it tidy). Plain bounds, no custom message:
+ * `too_small` with minimum 1 already says "required", and the client words it.
  */
-export const displayNameSchema = z.string().trim().min(1).max(DISPLAY_NAME_MAX);
+export const displayNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(DISPLAY_NAME_MAX)
+    .transform(tidyFullName);
 /**
  * A full name's first and last name, DEDUCED, never asked (the user,
  * 2026-10-18: onboarding asks one "Full name" and works the two out from the
@@ -378,13 +445,15 @@ export const displayNameSchema = z.string().trim().min(1).max(DISPLAY_NAME_MAX);
  * leave a stale first name behind.
  */
 export function splitFullName(fullName) {
-    const name = fullName.trim().replace(/\s+/g, ' ');
+    const name = tidyFullName(fullName);
     const space = name.indexOf(' ');
     return space === -1
         ? { firstName: name, lastName: '' }
         : { firstName: name.slice(0, space), lastName: name.slice(space + 1) };
 }
 // ─── Phone ───────────────────────────────────────────────────────────────────
+/** The digits an Indian mobile number has: what `phoneSchema` takes and the field keeps. */
+export const PHONE_DIGITS = 10;
 /**
  * Indian mobile number: ten raw digits, no country code, matching the standard
  * used across this family. Display adds the `+91`.
@@ -397,7 +466,23 @@ export function splitFullName(fullName) {
 export const phoneSchema = z
     .string()
     .trim()
-    .regex(/^[6-9]\d{9}$/, VALIDATION_MESSAGE.phoneInvalid);
+    .regex(new RegExp(`^[6-9]\\d{${PHONE_DIGITS - 1}}$`), VALIDATION_MESSAGE.phoneInvalid);
+/**
+ * An Indian mobile number as `phoneSchema`'s ten digits, from however it was
+ * typed (0.17.0, moved here from the web): `98765 43210`, `+91 98765-43210`,
+ * `091 9876543210`. Anything else comes back digits only and fails the schema
+ * with `phoneInvalid`, rather than being guessed at.
+ */
+export function normalizePhone(raw) {
+    let digits = raw.replace(/\D/g, '');
+    if (digits.length === PHONE_DIGITS + 2 && digits.startsWith('91'))
+        digits = digits.slice(2);
+    else if (digits.length === PHONE_DIGITS + 1 && digits.startsWith('0'))
+        digits = digits.slice(1);
+    else if (digits.length === PHONE_DIGITS + 3 && digits.startsWith('091'))
+        digits = digits.slice(3);
+    return digits;
+}
 // ─── Location ────────────────────────────────────────────────────────────────
 /**
  * Where the founder is based. City and country are what Discover filters on.
@@ -432,13 +517,6 @@ export const coordinatesQuerySchema = z.object({
     lat: z.preprocess(emptyStringToUndefined, z.coerce.number().min(-90).max(90)),
     lng: z.preprocess(emptyStringToUndefined, z.coerce.number().min(-180).max(180)),
 });
-/**
- * The city these coordinates look like, for the member to CONFIRM, or `null`
- * when the lookup could not place them confidently (or they are outside India,
- * whose area data is all there is). A suggestion, never a write: only what the
- * member then submits becomes their location.
- */
-export const suggestedLocationSchema = locationSchema.nullable();
 // ─── Pagination ──────────────────────────────────────────────────────────────
 /**
  * Cursor pagination query. Feed and Discover both use it.
@@ -454,6 +532,11 @@ export const paginationQuerySchema = z.object({
      * `.min(1)`: the member sees a 400 for a page they never asked to size.
      */
     limit: z.preprocess(emptyStringToUndefined, z.coerce.number().int().min(1).max(PAGE_SIZE_MAX).default(PAGE_SIZE_DEFAULT)),
-    cursor: z.string().trim().min(1).optional(),
+    /**
+     * The opaque cursor a page answered with. Empty means "not provided" (the
+     * same as `limit`, 0.18.0: an emptied control answered 400), and it is
+     * bounded: the server's cursors are short, so a long one is not one of them.
+     */
+    cursor: z.preprocess(emptyStringToUndefined, z.string().trim().min(1).max(CURSOR_MAX).optional()),
 });
 //# sourceMappingURL=common.js.map