founder-schema 0.3.0 → 0.4.0

package/dist/core/limits.d.ts

@@ -0,0 +1,99 @@
+/**
+ * founder-schema — Every length, size and count limit, by name
+ *
+ * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,
+ * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could
+ * read them, so the web client re-typed each one for its counters and the
+ * backend re-typed them as Mongoose `maxlength`. Three copies of one number is
+ * how the image alt text came to be 280 here and 500 in the backend.
+ *
+ * The rule from 0.2.0: a schema uses one of these constants, a consumer imports
+ * the same constant, and nobody writes the digits again.
+ *
+ * Imports nothing, so any module here can use it without a cycle. Limits that
+ * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,
+ * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their
+ * names; this file holds the ones that had none.
+ *
+ * ⚠️ Lowering a limit is a breaking change for stored data: a value that was
+ * valid when written fails the next edit. Raise freely; lower deliberately.
+ *
+ * @module founder-schema/core/limits
+ */
+export declare const DISPLAY_NAME_MAX = 80;
+export declare const HEADLINE_MAX = 120;
+export declare const ABOUT_MAX = 1000;
+/** Skills a member may list. Discover filters on them. */
+export declare const SKILLS_MAX = 8;
+/** Goals a member must pick at onboarding. The list itself caps the maximum. */
+export declare const GOALS_MIN = 1;
+export declare const CITY_MAX = 80;
+export declare const STATE_MAX = 80;
+export declare const COUNTRY_MAX = 80;
+export declare const VENTURE_NAME_MAX = 120;
+export declare const VENTURE_TAGLINE_MAX = 160;
+/** Team size including the founder. */
+export declare const TEAM_SIZE_MIN = 1;
+export declare const TEAM_SIZE_MAX = 100000;
+/** Earliest founding year accepted. The ceiling is "this year", read per parse. */
+export declare const FOUNDED_YEAR_MIN = 1900;
+/**
+ * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every
+ * member URL carries it: profile links, a venture website.
+ *
+ * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's
+ * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is
+ * ordinary, and one of them would otherwise fail a whole feed page.
+ */
+export declare const LINK_URL_MAX = 300;
+/** Author-supplied image description. The backend's stored copy uses this too. */
+export declare const MEDIA_ALT_MAX = 280;
+export declare const LINK_PREVIEW_TITLE_MAX = 200;
+export declare const LINK_PREVIEW_DESCRIPTION_MAX = 500;
+/** The free-text note on a report. */
+export declare const REPORT_NOTE_MAX = 1000;
+/** A moderator's note on a decision (why it was hidden, removed or dismissed). */
+export declare const MODERATION_NOTE_MAX = 500;
+/** What a post, poll or comment is shown as in a staff list: its first words. */
+export declare const MODERATION_EXCERPT_MAX = 160;
+/** Why a member was suspended. Shown to staff, and on record in the audit log. */
+export declare const SUSPENSION_REASON_MIN = 3;
+export declare const SUSPENSION_REASON_MAX = 500;
+/** The staff member directory's search box (a name, a handle or an email). */
+export declare const MEMBER_SEARCH_MAX = 120;
+export declare const TICKET_SUBJECT_MIN = 3;
+export declare const TICKET_SUBJECT_MAX = 120;
+/** One message in a ticket, the member's or an agent's. */
+export declare const TICKET_MESSAGE_MAX = 4000;
+/**
+ * Messages one ticket may hold. A conversation that long is a new problem, so
+ * the member is asked to open a new ticket rather than the thread growing
+ * without bound.
+ */
+export declare const TICKET_MESSAGES_MAX = 200;
+export declare const SAVED_REPLY_TITLE_MAX = 80;
+export declare const SAVED_REPLY_BODY_MAX = 4000;
+/** Saved replies kept in all: a team's library, not an archive. */
+export declare const SAVED_REPLIES_MAX = 200;
+/**
+ * Largest file accepted for upload: 10 MB.
+ *
+ * Checked on BOTH sides and for different reasons. The server refuses a bigger
+ * object when it is attached. The client checks before uploading, because a
+ * presigned PUT caps the content type but not the size, so a member on a phone
+ * connection would otherwise watch a 40 MB upload finish and then fail.
+ */
+export declare const UPLOAD_MAX_BYTES: number;
+/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */
+export declare const DISCOVER_FILTER_VALUES_MAX = 10;
+/** Discover's free-text inputs: the name search, city and country. */
+export declare const DISCOVER_TEXT_MAX = 80;
+/** Page size bounds for every cursor-paged list. */
+export declare const PAGE_SIZE_MAX = 50;
+export declare const PAGE_SIZE_DEFAULT = 20;
+/**
+ * Members one participants lookup may name. Bounded so the lookup cannot be
+ * used to page through the directory.
+ */
+export declare const CHAT_PARTICIPANTS_MAX = 100;
+//# sourceMappingURL=limits.d.ts.map

package/dist/core/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/core/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,YAAY,MAAM,CAAC;AAChC,eAAO,MAAM,SAAS,OAAO,CAAC;AAC9B,0DAA0D;AAC1D,eAAO,MAAM,UAAU,IAAI,CAAC;AAC5B,gFAAgF;AAChF,eAAO,MAAM,SAAS,IAAI,CAAC;AAI3B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,WAAW,KAAK,CAAC;AAI9B,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,uCAAuC;AACvC,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,eAAO,MAAM,aAAa,SAAU,CAAC;AACrC,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAIrC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,MAAM,CAAC;AAIhC,kFAAkF;AAClF,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,sCAAsC;AACtC,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAI1C,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAIrC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,2DAA2D;AAC3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAIrC;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAIjD,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,oDAAoD;AACpD,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC"}

package/dist/core/limits.js

@@ -0,0 +1,109 @@
+/**
+ * founder-schema — Every length, size and count limit, by name
+ *
+ * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,
+ * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could
+ * read them, so the web client re-typed each one for its counters and the
+ * backend re-typed them as Mongoose `maxlength`. Three copies of one number is
+ * how the image alt text came to be 280 here and 500 in the backend.
+ *
+ * The rule from 0.2.0: a schema uses one of these constants, a consumer imports
+ * the same constant, and nobody writes the digits again.
+ *
+ * Imports nothing, so any module here can use it without a cycle. Limits that
+ * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,
+ * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their
+ * names; this file holds the ones that had none.
+ *
+ * ⚠️ Lowering a limit is a breaking change for stored data: a value that was
+ * valid when written fails the next edit. Raise freely; lower deliberately.
+ *
+ * @module founder-schema/core/limits
+ */
+// ─── Profile ─────────────────────────────────────────────────────────────────
+export const DISPLAY_NAME_MAX = 80;
+export const HEADLINE_MAX = 120;
+export const ABOUT_MAX = 1000;
+/** Skills a member may list. Discover filters on them. */
+export const SKILLS_MAX = 8;
+/** Goals a member must pick at onboarding. The list itself caps the maximum. */
+export const GOALS_MIN = 1;
+// ─── Location ────────────────────────────────────────────────────────────────
+export const CITY_MAX = 80;
+export const STATE_MAX = 80;
+export const COUNTRY_MAX = 80;
+// ─── Venture ─────────────────────────────────────────────────────────────────
+export const VENTURE_NAME_MAX = 120;
+export const VENTURE_TAGLINE_MAX = 160;
+/** Team size including the founder. */
+export const TEAM_SIZE_MIN = 1;
+export const TEAM_SIZE_MAX = 100_000;
+/** Earliest founding year accepted. The ceiling is "this year", read per parse. */
+export const FOUNDED_YEAR_MIN = 1900;
+// ─── Links ───────────────────────────────────────────────────────────────────
+/**
+ * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every
+ * member URL carries it: profile links, a venture website.
+ *
+ * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's
+ * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is
+ * ordinary, and one of them would otherwise fail a whole feed page.
+ */
+export const LINK_URL_MAX = 300;
+// ─── Feed and moderation ─────────────────────────────────────────────────────
+/** Author-supplied image description. The backend's stored copy uses this too. */
+export const MEDIA_ALT_MAX = 280;
+export const LINK_PREVIEW_TITLE_MAX = 200;
+export const LINK_PREVIEW_DESCRIPTION_MAX = 500;
+/** The free-text note on a report. */
+export const REPORT_NOTE_MAX = 1000;
+/** A moderator's note on a decision (why it was hidden, removed or dismissed). */
+export const MODERATION_NOTE_MAX = 500;
+/** What a post, poll or comment is shown as in a staff list: its first words. */
+export const MODERATION_EXCERPT_MAX = 160;
+// ─── Staff ───────────────────────────────────────────────────────────────────
+/** Why a member was suspended. Shown to staff, and on record in the audit log. */
+export const SUSPENSION_REASON_MIN = 3;
+export const SUSPENSION_REASON_MAX = 500;
+/** The staff member directory's search box (a name, a handle or an email). */
+export const MEMBER_SEARCH_MAX = 120;
+// ─── Support ─────────────────────────────────────────────────────────────────
+export const TICKET_SUBJECT_MIN = 3;
+export const TICKET_SUBJECT_MAX = 120;
+/** One message in a ticket, the member's or an agent's. */
+export const TICKET_MESSAGE_MAX = 4000;
+/**
+ * Messages one ticket may hold. A conversation that long is a new problem, so
+ * the member is asked to open a new ticket rather than the thread growing
+ * without bound.
+ */
+export const TICKET_MESSAGES_MAX = 200;
+export const SAVED_REPLY_TITLE_MAX = 80;
+export const SAVED_REPLY_BODY_MAX = 4000;
+/** Saved replies kept in all: a team's library, not an archive. */
+export const SAVED_REPLIES_MAX = 200;
+// ─── Uploads ─────────────────────────────────────────────────────────────────
+/**
+ * Largest file accepted for upload: 10 MB.
+ *
+ * Checked on BOTH sides and for different reasons. The server refuses a bigger
+ * object when it is attached. The client checks before uploading, because a
+ * presigned PUT caps the content type but not the size, so a member on a phone
+ * connection would otherwise watch a 40 MB upload finish and then fail.
+ */
+export const UPLOAD_MAX_BYTES = 10 * 1024 * 1024;
+// ─── Lists and search ────────────────────────────────────────────────────────
+/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */
+export const DISCOVER_FILTER_VALUES_MAX = 10;
+/** Discover's free-text inputs: the name search, city and country. */
+export const DISCOVER_TEXT_MAX = 80;
+/** Page size bounds for every cursor-paged list. */
+export const PAGE_SIZE_MAX = 50;
+export const PAGE_SIZE_DEFAULT = 20;
+// ─── Chat ────────────────────────────────────────────────────────────────────
+/**
+ * Members one participants lookup may name. Bounded so the lookup cannot be
+ * used to page through the directory.
+ */
+export const CHAT_PARTICIPANTS_MAX = 100;
+//# sourceMappingURL=limits.js.map

package/dist/core/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/core/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAC9B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,gFAAgF;AAChF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;AAE3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,uCAAuC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEhC,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AACzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC","sourcesContent":["/**\n * founder-schema — Every length, size and count limit, by name\n *\n * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,\n * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could\n * read them, so the web client re-typed each one for its counters and the\n * backend re-typed them as Mongoose `maxlength`. Three copies of one number is\n * how the image alt text came to be 280 here and 500 in the backend.\n *\n * The rule from 0.2.0: a schema uses one of these constants, a consumer imports\n * the same constant, and nobody writes the digits again.\n *\n * Imports nothing, so any module here can use it without a cycle. Limits that\n * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,\n * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their\n * names; this file holds the ones that had none.\n *\n * ⚠️ Lowering a limit is a breaking change for stored data: a value that was\n * valid when written fails the next edit. Raise freely; lower deliberately.\n *\n * @module founder-schema/core/limits\n */\n\n// ─── Profile ─────────────────────────────────────────────────────────────────\n\nexport const DISPLAY_NAME_MAX = 80;\nexport const HEADLINE_MAX = 120;\nexport const ABOUT_MAX = 1000;\n/** Skills a member may list. Discover filters on them. */\nexport const SKILLS_MAX = 8;\n/** Goals a member must pick at onboarding. The list itself caps the maximum. */\nexport const GOALS_MIN = 1;\n\n// ─── Location ────────────────────────────────────────────────────────────────\n\nexport const CITY_MAX = 80;\nexport const STATE_MAX = 80;\nexport const COUNTRY_MAX = 80;\n\n// ─── Venture ─────────────────────────────────────────────────────────────────\n\nexport const VENTURE_NAME_MAX = 120;\nexport const VENTURE_TAGLINE_MAX = 160;\n/** Team size including the founder. */\nexport const TEAM_SIZE_MIN = 1;\nexport const TEAM_SIZE_MAX = 100_000;\n/** Earliest founding year accepted. The ceiling is \"this year\", read per parse. */\nexport const FOUNDED_YEAR_MIN = 1900;\n\n// ─── Links ───────────────────────────────────────────────────────────────────\n\n/**\n * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every\n * member URL carries it: profile links, a venture website.\n *\n * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's\n * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is\n * ordinary, and one of them would otherwise fail a whole feed page.\n */\nexport const LINK_URL_MAX = 300;\n\n// ─── Feed and moderation ─────────────────────────────────────────────────────\n\n/** Author-supplied image description. The backend's stored copy uses this too. */\nexport const MEDIA_ALT_MAX = 280;\nexport const LINK_PREVIEW_TITLE_MAX = 200;\nexport const LINK_PREVIEW_DESCRIPTION_MAX = 500;\n/** The free-text note on a report. */\nexport const REPORT_NOTE_MAX = 1000;\n/** A moderator's note on a decision (why it was hidden, removed or dismissed). */\nexport const MODERATION_NOTE_MAX = 500;\n/** What a post, poll or comment is shown as in a staff list: its first words. */\nexport const MODERATION_EXCERPT_MAX = 160;\n\n// ─── Staff ───────────────────────────────────────────────────────────────────\n\n/** Why a member was suspended. Shown to staff, and on record in the audit log. */\nexport const SUSPENSION_REASON_MIN = 3;\nexport const SUSPENSION_REASON_MAX = 500;\n/** The staff member directory's search box (a name, a handle or an email). */\nexport const MEMBER_SEARCH_MAX = 120;\n\n// ─── Support ─────────────────────────────────────────────────────────────────\n\nexport const TICKET_SUBJECT_MIN = 3;\nexport const TICKET_SUBJECT_MAX = 120;\n/** One message in a ticket, the member's or an agent's. */\nexport const TICKET_MESSAGE_MAX = 4000;\n/**\n * Messages one ticket may hold. A conversation that long is a new problem, so\n * the member is asked to open a new ticket rather than the thread growing\n * without bound.\n */\nexport const TICKET_MESSAGES_MAX = 200;\nexport const SAVED_REPLY_TITLE_MAX = 80;\nexport const SAVED_REPLY_BODY_MAX = 4000;\n/** Saved replies kept in all: a team's library, not an archive. */\nexport const SAVED_REPLIES_MAX = 200;\n\n// ─── Uploads ─────────────────────────────────────────────────────────────────\n\n/**\n * Largest file accepted for upload: 10 MB.\n *\n * Checked on BOTH sides and for different reasons. The server refuses a bigger\n * object when it is attached. The client checks before uploading, because a\n * presigned PUT caps the content type but not the size, so a member on a phone\n * connection would otherwise watch a 40 MB upload finish and then fail.\n */\nexport const UPLOAD_MAX_BYTES = 10 * 1024 * 1024;\n\n// ─── Lists and search ────────────────────────────────────────────────────────\n\n/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */\nexport const DISCOVER_FILTER_VALUES_MAX = 10;\n/** Discover's free-text inputs: the name search, city and country. */\nexport const DISCOVER_TEXT_MAX = 80;\n/** Page size bounds for every cursor-paged list. */\nexport const PAGE_SIZE_MAX = 50;\nexport const PAGE_SIZE_DEFAULT = 20;\n\n// ─── Chat ────────────────────────────────────────────────────────────────────\n\n/**\n * Members one participants lookup may name. Bounded so the lookup cannot be\n * used to page through the directory.\n */\nexport const CHAT_PARTICIPANTS_MAX = 100;\n"]}

package/dist/core/responses.d.ts

@@ -0,0 +1,195 @@
+/**
+ * founder-schema — API response envelope
+ *
+ * Every Founder Circle endpoint answers in this shape. The clients read the
+ * failure reason at `error.message`, so a handler must never return a bare
+ * string body.
+ *
+ * @module founder-schema/core/responses
+ */
+import { z } from 'zod';
+/**
+ * What an error carries beyond its code, each field named by the code that
+ * sends it. Declared here, not loosely typed, because a client parses errors
+ * with this schema and Zod drops a key the schema does not name.
+ *
+ * `issues` is EVERY problem of a 400, each with its path, built on the server
+ * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings
+ * that nothing ever sent, while the real 400s carried only the first issue's
+ * message, so a client could not tell which field to mark.
+ */
+export declare const apiErrorDetailsSchema: z.ZodObject<{
+    issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        location: z.ZodOptional<z.ZodEnum<{
+            params: "params";
+            body: "body";
+            query: "query";
+        }>>;
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        code: z.ZodString;
+        message: z.ZodString;
+        minimum: z.ZodOptional<z.ZodNumber>;
+        maximum: z.ZodOptional<z.ZodNumber>;
+        origin: z.ZodOptional<z.ZodString>;
+        format: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    attemptsLeft: z.ZodOptional<z.ZodNumber>;
+    lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ApiErrorDetails = z.infer<typeof apiErrorDetailsSchema>;
+/**
+ * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.
+ * `message` is English, for logs and for a client that predates the code.
+ */
+export declare const apiErrorSchema: z.ZodObject<{
+    code: z.ZodEnum<{
+        INTERNAL_ERROR: "INTERNAL_ERROR";
+        VALIDATION_ERROR: "VALIDATION_ERROR";
+        NOT_FOUND: "NOT_FOUND";
+        CONFLICT: "CONFLICT";
+        RATE_LIMITED: "RATE_LIMITED";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+        UNAUTHORIZED: "UNAUTHORIZED";
+        INVALID_TOKEN: "INVALID_TOKEN";
+        TOKEN_EXPIRED: "TOKEN_EXPIRED";
+        SESSION_INVALIDATED: "SESSION_INVALIDATED";
+        FORBIDDEN: "FORBIDDEN";
+        ONBOARDING_INCOMPLETE: "ONBOARDING_INCOMPLETE";
+        ALREADY_ONBOARDED: "ALREADY_ONBOARDED";
+        UNDER_AGE: "UNDER_AGE";
+        UPLOAD_NOT_ATTACHABLE: "UPLOAD_NOT_ATTACHABLE";
+        UPLOAD_TOO_LARGE: "UPLOAD_TOO_LARGE";
+        UPLOAD_WRONG_TYPE: "UPLOAD_WRONG_TYPE";
+        EDIT_WINDOW_CLOSED: "EDIT_WINDOW_CLOSED";
+        POLL_NOT_EDITABLE: "POLL_NOT_EDITABLE";
+        POLL_CLOSED: "POLL_CLOSED";
+        POLL_CHOICE_INVALID: "POLL_CHOICE_INVALID";
+        REPLY_TOO_DEEP: "REPLY_TOO_DEEP";
+        CANNOT_REPORT_OWN: "CANNOT_REPORT_OWN";
+        CHAT_WITH_SELF: "CHAT_WITH_SELF";
+        ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+        ROLE_NOT_HELD: "ROLE_NOT_HELD";
+        MPIN_NOT_SET: "MPIN_NOT_SET";
+        MPIN_ALREADY_SET: "MPIN_ALREADY_SET";
+        MPIN_INCORRECT: "MPIN_INCORRECT";
+        MPIN_LOCKED: "MPIN_LOCKED";
+        CANNOT_CHANGE_OWN_ROLES: "CANNOT_CHANGE_OWN_ROLES";
+        ROLE_NOT_GRANTABLE: "ROLE_NOT_GRANTABLE";
+        TICKET_FULL: "TICKET_FULL";
+        SAVED_REPLIES_FULL: "SAVED_REPLIES_FULL";
+    }>;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodObject<{
+        issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            location: z.ZodOptional<z.ZodEnum<{
+                params: "params";
+                body: "body";
+                query: "query";
+            }>>;
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            code: z.ZodString;
+            message: z.ZodString;
+            minimum: z.ZodOptional<z.ZodNumber>;
+            maximum: z.ZodOptional<z.ZodNumber>;
+            origin: z.ZodOptional<z.ZodString>;
+            format: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        attemptsLeft: z.ZodOptional<z.ZodNumber>;
+        lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiError = z.infer<typeof apiErrorSchema>;
+/** Success envelope. `T` is the payload schema. */
+export declare const successResponseSchema: <T extends z.ZodType>(data: T) => z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    data: T;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const errorResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            INTERNAL_ERROR: "INTERNAL_ERROR";
+            VALIDATION_ERROR: "VALIDATION_ERROR";
+            NOT_FOUND: "NOT_FOUND";
+            CONFLICT: "CONFLICT";
+            RATE_LIMITED: "RATE_LIMITED";
+            SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+            UNAUTHORIZED: "UNAUTHORIZED";
+            INVALID_TOKEN: "INVALID_TOKEN";
+            TOKEN_EXPIRED: "TOKEN_EXPIRED";
+            SESSION_INVALIDATED: "SESSION_INVALIDATED";
+            FORBIDDEN: "FORBIDDEN";
+            ONBOARDING_INCOMPLETE: "ONBOARDING_INCOMPLETE";
+            ALREADY_ONBOARDED: "ALREADY_ONBOARDED";
+            UNDER_AGE: "UNDER_AGE";
+            UPLOAD_NOT_ATTACHABLE: "UPLOAD_NOT_ATTACHABLE";
+            UPLOAD_TOO_LARGE: "UPLOAD_TOO_LARGE";
+            UPLOAD_WRONG_TYPE: "UPLOAD_WRONG_TYPE";
+            EDIT_WINDOW_CLOSED: "EDIT_WINDOW_CLOSED";
+            POLL_NOT_EDITABLE: "POLL_NOT_EDITABLE";
+            POLL_CLOSED: "POLL_CLOSED";
+            POLL_CHOICE_INVALID: "POLL_CHOICE_INVALID";
+            REPLY_TOO_DEEP: "REPLY_TOO_DEEP";
+            CANNOT_REPORT_OWN: "CANNOT_REPORT_OWN";
+            CHAT_WITH_SELF: "CHAT_WITH_SELF";
+            ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+            ROLE_NOT_HELD: "ROLE_NOT_HELD";
+            MPIN_NOT_SET: "MPIN_NOT_SET";
+            MPIN_ALREADY_SET: "MPIN_ALREADY_SET";
+            MPIN_INCORRECT: "MPIN_INCORRECT";
+            MPIN_LOCKED: "MPIN_LOCKED";
+            CANNOT_CHANGE_OWN_ROLES: "CANNOT_CHANGE_OWN_ROLES";
+            ROLE_NOT_GRANTABLE: "ROLE_NOT_GRANTABLE";
+            TICKET_FULL: "TICKET_FULL";
+            SAVED_REPLIES_FULL: "SAVED_REPLIES_FULL";
+        }>;
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodObject<{
+            issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                location: z.ZodOptional<z.ZodEnum<{
+                    params: "params";
+                    body: "body";
+                    query: "query";
+                }>>;
+                path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+                code: z.ZodString;
+                message: z.ZodString;
+                minimum: z.ZodOptional<z.ZodNumber>;
+                maximum: z.ZodOptional<z.ZodNumber>;
+                origin: z.ZodOptional<z.ZodString>;
+                format: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+            attemptsLeft: z.ZodOptional<z.ZodNumber>;
+            lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ErrorResponse = z.infer<typeof errorResponseSchema>;
+/**
+ * Cursor-paginated list envelope.
+ *
+ * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the
+ * key is not the same thing and does not validate: a handler must decide
+ * whether there is another page and say so, because "the key is missing" and
+ * "there are no more results" are indistinguishable to a client that has to
+ * choose between showing a Load more button and not showing one.
+ *
+ * An earlier version of this comment said absence and null were equivalent.
+ * They never were; the schema has always required the key. Corrected
+ * 2026-09-21, and pinned by a test.
+ */
+export declare const paginatedSchema: <T extends z.ZodType>(item: T) => z.ZodObject<{
+    items: z.ZodArray<T>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * What a create, an edit or a delete answers: the id of the thing it touched.
+ * A client that needs the whole item reads it, so a write never ships a second
+ * projection of it that could drift from the read path's.
+ */
+export declare const idResponseSchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>;
+export type IdResponse = z.infer<typeof idResponseSchema>;
+//# sourceMappingURL=responses.d.ts.map

package/dist/core/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/core/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;;;;iBAK9D,CAAC;AAEL,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;;;iBAIxD,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;iBAAmC,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/core/responses.js

@@ -0,0 +1,73 @@
+/**
+ * founder-schema — API response envelope
+ *
+ * Every Founder Circle endpoint answers in this shape. The clients read the
+ * failure reason at `error.message`, so a handler must never return a bare
+ * string body.
+ *
+ * @module founder-schema/core/responses
+ */
+import { z } from 'zod';
+import { objectIdSchema } from './common.js';
+import { apiErrorCodeSchema } from './errors.js';
+import { validationIssueSchema } from './validation.js';
+/**
+ * What an error carries beyond its code, each field named by the code that
+ * sends it. Declared here, not loosely typed, because a client parses errors
+ * with this schema and Zod drops a key the schema does not name.
+ *
+ * `issues` is EVERY problem of a 400, each with its path, built on the server
+ * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings
+ * that nothing ever sent, while the real 400s carried only the first issue's
+ * message, so a client could not tell which field to mark.
+ */
+export const apiErrorDetailsSchema = z.object({
+    issues: z.array(validationIssueSchema).optional(),
+    /** `MPIN_INCORRECT`: wrong tries left before the MPIN locks. */
+    attemptsLeft: z.number().int().min(0).optional(),
+    /** `MPIN_LOCKED`: when the MPIN can be tried again. */
+    lockedUntil: z.iso.datetime().optional(),
+});
+/**
+ * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.
+ * `message` is English, for logs and for a client that predates the code.
+ */
+export const apiErrorSchema = z.object({
+    code: apiErrorCodeSchema,
+    message: z.string(),
+    details: apiErrorDetailsSchema.optional(),
+});
+/** Success envelope. `T` is the payload schema. */
+export const successResponseSchema = (data) => z.object({
+    success: z.literal(true),
+    data,
+    message: z.string().optional(),
+});
+export const errorResponseSchema = z.object({
+    success: z.literal(false),
+    error: apiErrorSchema,
+});
+/**
+ * Cursor-paginated list envelope.
+ *
+ * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the
+ * key is not the same thing and does not validate: a handler must decide
+ * whether there is another page and say so, because "the key is missing" and
+ * "there are no more results" are indistinguishable to a client that has to
+ * choose between showing a Load more button and not showing one.
+ *
+ * An earlier version of this comment said absence and null were equivalent.
+ * They never were; the schema has always required the key. Corrected
+ * 2026-09-21, and pinned by a test.
+ */
+export const paginatedSchema = (item) => z.object({
+    items: z.array(item),
+    nextCursor: z.string().nullable(),
+});
+/**
+ * What a create, an edit or a delete answers: the id of the thing it touched.
+ * A client that needs the whole item reads it, so a write never ships a second
+ * projection of it that could drift from the read path's.
+ */
+export const idResponseSchema = z.object({ id: objectIdSchema });
+//# sourceMappingURL=responses.js.map

package/dist/core/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/core/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACjD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAsB,IAAO,EAAE,EAAE,CACpE,CAAC,CAAC,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI;IACJ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,KAAK,EAAE,cAAc;CACtB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAsB,IAAO,EAAE,EAAE,CAC9D,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC","sourcesContent":["/**\n * founder-schema — API response envelope\n *\n * Every Founder Circle endpoint answers in this shape. The clients read the\n * failure reason at `error.message`, so a handler must never return a bare\n * string body.\n *\n * @module founder-schema/core/responses\n */\n\nimport { z } from 'zod';\nimport { objectIdSchema } from './common.js';\nimport { apiErrorCodeSchema } from './errors.js';\nimport { validationIssueSchema } from './validation.js';\n\n/**\n * What an error carries beyond its code, each field named by the code that\n * sends it. Declared here, not loosely typed, because a client parses errors\n * with this schema and Zod drops a key the schema does not name.\n *\n * `issues` is EVERY problem of a 400, each with its path, built on the server\n * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings\n * that nothing ever sent, while the real 400s carried only the first issue's\n * message, so a client could not tell which field to mark.\n */\nexport const apiErrorDetailsSchema = z.object({\n  issues: z.array(validationIssueSchema).optional(),\n  /** `MPIN_INCORRECT`: wrong tries left before the MPIN locks. */\n  attemptsLeft: z.number().int().min(0).optional(),\n  /** `MPIN_LOCKED`: when the MPIN can be tried again. */\n  lockedUntil: z.iso.datetime().optional(),\n});\nexport type ApiErrorDetails = z.infer<typeof apiErrorDetailsSchema>;\n\n/**\n * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.\n * `message` is English, for logs and for a client that predates the code.\n */\nexport const apiErrorSchema = z.object({\n  code: apiErrorCodeSchema,\n  message: z.string(),\n  details: apiErrorDetailsSchema.optional(),\n});\nexport type ApiError = z.infer<typeof apiErrorSchema>;\n\n/** Success envelope. `T` is the payload schema. */\nexport const successResponseSchema = <T extends z.ZodType>(data: T) =>\n  z.object({\n    success: z.literal(true),\n    data,\n    message: z.string().optional(),\n  });\n\nexport const errorResponseSchema = z.object({\n  success: z.literal(false),\n  error: apiErrorSchema,\n});\nexport type ErrorResponse = z.infer<typeof errorResponseSchema>;\n\n/**\n * Cursor-paginated list envelope.\n *\n * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the\n * key is not the same thing and does not validate: a handler must decide\n * whether there is another page and say so, because \"the key is missing\" and\n * \"there are no more results\" are indistinguishable to a client that has to\n * choose between showing a Load more button and not showing one.\n *\n * An earlier version of this comment said absence and null were equivalent.\n * They never were; the schema has always required the key. Corrected\n * 2026-09-21, and pinned by a test.\n */\nexport const paginatedSchema = <T extends z.ZodType>(item: T) =>\n  z.object({\n    items: z.array(item),\n    nextCursor: z.string().nullable(),\n  });\n\n/**\n * What a create, an edit or a delete answers: the id of the thing it touched.\n * A client that needs the whole item reads it, so a write never ships a second\n * projection of it that could drift from the read path's.\n */\nexport const idResponseSchema = z.object({ id: objectIdSchema });\nexport type IdResponse = z.infer<typeof idResponseSchema>;\n"]}