founder-schema 0.3.0 → 0.5.0

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,gFAAgF;IAChF,gBAAgB;IAChB,yEAAyE;IACzE,kBAAkB;IAClB,2EAA2E;IAC3E,WAAW;IACX,wEAAwE;IACxE,UAAU;IACV,uEAAuE;IACvE,cAAc;IACd,2EAA2E;IAC3E,qBAAqB;IAErB,oBAAoB;IACpB,4BAA4B;IAC5B,cAAc;IACd,sDAAsD;IACtD,eAAe;IACf,qEAAqE;IACrE,eAAe;IACf,oEAAoE;IACpE,qBAAqB;IACrB,6CAA6C;IAC7C,WAAW;IAEX,mBAAmB;IACnB,mFAAmF;IACnF,uBAAuB;IACvB,gFAAgF;IAChF,mBAAmB;IACnB,uEAAuE;IACvE,WAAW;IAEX,kDAAkD;IAClD;;;;;OAKG;IACH,uBAAuB;IACvB,sCAAsC;IACtC,kBAAkB;IAClB;;;OAGG;IACH,mBAAmB;IACnB,2EAA2E;IAC3E,qBAAqB;IACrB;;;;OAIG;IACH,mBAAmB;IACnB,0FAA0F;IAC1F,mBAAmB;IACnB,mEAAmE;IACnE,wBAAwB;IACxB,sEAAsE;IACtE,sBAAsB;IACtB,wFAAwF;IACxF,eAAe;IAEf,iBAAiB;IACjB,+CAA+C;IAC/C,oBAAoB;IACpB,iEAAiE;IACjE,mBAAmB;IACnB,kDAAkD;IAClD,aAAa;IACb,oFAAoF;IACpF,qBAAqB;IACrB,qDAAqD;IACrD,gBAAgB;IAChB,gDAAgD;IAChD,mBAAmB;IAEnB,aAAa;IACb,4CAA4C;IAC5C,gBAAgB;IAEhB,oBAAoB;IACpB,qFAAqF;IACrF,mBAAmB;IAEnB,2BAA2B;IAC3B;;;OAGG;IACH,eAAe;IACf,4EAA4E;IAC5E,cAAc;IACd,8DAA8D;IAC9D,kBAAkB;IAClB,4EAA4E;IAC5E,gBAAgB;IAChB,0EAA0E;IAC1E,aAAa;IACb,oDAAoD;IACpD,yBAAyB;IACzB,qEAAqE;IACrE,oBAAoB;IAEpB,gBAAgB;IAChB,uEAAuE;IACvE,aAAa;IACb,0EAA0E;IAC1E,oBAAoB;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;AAGhE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC","sourcesContent":["/**\n * founder-schema — Every error code the API answers with\n *\n * THE CODE IS WHAT A CLIENT ACTS ON; the `message` beside it is English for\n * logs and for a client too old to know the code. A client words each code in\n * the member's language, and a test on the web side asserts every value here\n * has a message in every locale it ships.\n *\n * Before 0.2.0 the backend kept this list to itself, and every domain refusal\n * (a closed poll, a reply to a reply, the edit window) went out as\n * `VALIDATION_ERROR` with an English sentence, so the only way for a client to\n * tell them apart was to match on the wording.\n *\n * WHEN TO USE WHICH:\n *   - A request that does not match its schema: `VALIDATION_ERROR`, with every\n *     problem in `error.details.issues`.\n *   - A well-formed request the current STATE of things refuses: its own code\n *     below. These carry no issues; the code says it all.\n *\n * ⚠ Append freely; remove deliberately. A code removed here that an older\n * server still sends fails the client's parse of the error envelope.\n *\n * @module founder-schema/core/errors\n */\n\nimport { z } from 'zod';\n\n/**\n * As a tuple, the way `GENDER_VALUES` is, so a consumer can iterate it (a\n * translation-coverage test does exactly that) and TypeScript keeps the union.\n */\nexport const API_ERROR_CODE_VALUES = [\n  // ── Anything ──\n  /** A bug or an outage on our side. The message says nothing more on purpose. */\n  'INTERNAL_ERROR',\n  /** The request did not match its schema. `details.issues` says where. */\n  'VALIDATION_ERROR',\n  /** No such thing, or not one you may see. Deliberately the same answer. */\n  'NOT_FOUND',\n  /** Two writes raced for something unique; retrying usually succeeds. */\n  'CONFLICT',\n  /** Too many requests from this member or address. Wait, then retry. */\n  'RATE_LIMITED',\n  /** Something we depend on (the chat server) is down or not switched on. */\n  'SERVICE_UNAVAILABLE',\n\n  // ── Who you are ──\n  /** No credential at all. */\n  'UNAUTHORIZED',\n  /** A credential that is not ours, or not readable. */\n  'INVALID_TOKEN',\n  /** A credential that was ours and has expired. Refresh and retry. */\n  'TOKEN_EXPIRED',\n  /** Signed out everywhere, or the account changed. Sign in again. */\n  'SESSION_INVALIDATED',\n  /** Signed in, and not allowed to do this. */\n  'FORBIDDEN',\n\n  // ── Onboarding ──\n  /** Finish onboarding first. The client routes here instead of showing an error. */\n  'ONBOARDING_INCOMPLETE',\n  /** Onboarding is already finished; there is nothing to save or finish again. */\n  'ALREADY_ONBOARDED',\n  /** Under `MIN_AGE_YEARS`. Refused at the draft and again at finish. */\n  'UNDER_AGE',\n\n  // ── Uploads: completing one, and attaching it ──\n  /**\n   * Not an upload of yours, not processed yet, already attached somewhere, or\n   * for the other purpose (an avatar upload on a post). One code for all of\n   * them on purpose: telling \"someone else's\" apart from \"does not exist\" would\n   * let a caller probe other members' media ids.\n   */\n  'UPLOAD_NOT_ATTACHABLE',\n  /** Larger than `UPLOAD_MAX_BYTES`. */\n  'UPLOAD_TOO_LARGE',\n  /**\n   * Not one of the image types this product accepts (by the file's own bytes,\n   * whatever its name or declared type), or not an image at all.\n   */\n  'UPLOAD_WRONG_TYPE',\n  /** Completed before the file reached storage: upload it, then complete. */\n  'UPLOAD_NOT_RECEIVED',\n  /**\n   * Another request is processing this upload right now (a retry or a double\n   * tap). Nothing is wrong: complete again in a moment and it answers with\n   * the image. 409.\n   */\n  'UPLOAD_PROCESSING',\n  /** A JPEG, PNG, WebP or GIF by its bytes that cannot be decoded: truncated or corrupt. */\n  'UPLOAD_UNREADABLE',\n  /** More than `MEDIA_MAX_INPUT_PIXELS`; refused before decoding. */\n  'UPLOAD_TOO_MANY_PIXELS',\n  /** `MEDIA_PENDING_MAX` uploads are already waiting to be attached. */\n  'UPLOAD_LIMIT_REACHED',\n  /** Discarding an upload that is attached: remove it from its post or avatar instead. */\n  'UPLOAD_IN_USE',\n\n  // ── The feed ──\n  /** The post is older than `EDIT_WINDOW_MS`. */\n  'EDIT_WINDOW_CLOSED',\n  /** A poll is never editable: people have already voted on it. */\n  'POLL_NOT_EDITABLE',\n  /** The poll has closed, by the server's clock. */\n  'POLL_CLOSED',\n  /** No option, several on a single-choice poll, or an option that does not exist. */\n  'POLL_CHOICE_INVALID',\n  /** A reply to a reply. One level of nesting only. */\n  'REPLY_TOO_DEEP',\n  /** Reporting your own post, poll or comment. */\n  'CANNOT_REPORT_OWN',\n\n  // ── Chat ──\n  /** Opening a conversation with yourself. */\n  'CHAT_WITH_SELF',\n\n  // ── The account ──\n  /** Staff suspended this account: nothing in the product works until it is lifted. */\n  'ACCOUNT_SUSPENDED',\n\n  // ── Roles and the MPIN ──\n  /**\n   * Switching to a role this person does not hold (or no longer holds), or\n   * setting an MPIN while holding no staff role at all.\n   */\n  'ROLE_NOT_HELD',\n  /** A staff role needs an MPIN, and none has been set yet. Set one first. */\n  'MPIN_NOT_SET',\n  /** An MPIN is set once; changing it needs the current one. */\n  'MPIN_ALREADY_SET',\n  /** The MPIN is wrong. `details.attemptsLeft` says how many tries remain. */\n  'MPIN_INCORRECT',\n  /** Too many wrong MPINs. `details.lockedUntil` says when to try again. */\n  'MPIN_LOCKED',\n  /** Changing your own roles. Someone else has to. */\n  'CANNOT_CHANGE_OWN_ROLES',\n  /** Granting or revoking a role the role you act as may not touch. */\n  'ROLE_NOT_GRANTABLE',\n\n  // ── Support ──\n  /** The ticket holds `TICKET_MESSAGES_MAX` messages. Open a new one. */\n  'TICKET_FULL',\n  /** The team keeps `SAVED_REPLIES_MAX` saved replies. Delete one first. */\n  'SAVED_REPLIES_FULL',\n] as const;\n\nexport const apiErrorCodeSchema = z.enum(API_ERROR_CODE_VALUES);\nexport type ApiErrorCode = z.infer<typeof apiErrorCodeSchema>;\n\n/** The same codes by name: `API_ERROR_CODE.POLL_CLOSED`. */\nexport const API_ERROR_CODE = apiErrorCodeSchema.enum;\n"]}

package/dist/core/limits.d.ts

@@ -0,0 +1,122 @@
+/**
+ * founder-schema — Every length, size and count limit, by name
+ *
+ * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,
+ * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could
+ * read them, so the web client re-typed each one for its counters and the
+ * backend re-typed them as Mongoose `maxlength`. Three copies of one number is
+ * how the image alt text came to be 280 here and 500 in the backend.
+ *
+ * The rule from 0.2.0: a schema uses one of these constants, a consumer imports
+ * the same constant, and nobody writes the digits again.
+ *
+ * Imports nothing, so any module here can use it without a cycle. Limits that
+ * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,
+ * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their
+ * names; this file holds the ones that had none.
+ *
+ * ⚠️ Lowering a limit is a breaking change for stored data: a value that was
+ * valid when written fails the next edit. Raise freely; lower deliberately.
+ *
+ * @module founder-schema/core/limits
+ */
+export declare const DISPLAY_NAME_MAX = 80;
+export declare const HEADLINE_MAX = 120;
+export declare const ABOUT_MAX = 1000;
+/** Skills a member may list. Discover filters on them. */
+export declare const SKILLS_MAX = 8;
+/** Goals a member must pick at onboarding. The list itself caps the maximum. */
+export declare const GOALS_MIN = 1;
+export declare const CITY_MAX = 80;
+export declare const STATE_MAX = 80;
+export declare const COUNTRY_MAX = 80;
+export declare const VENTURE_NAME_MAX = 120;
+export declare const VENTURE_TAGLINE_MAX = 160;
+/** Team size including the founder. */
+export declare const TEAM_SIZE_MIN = 1;
+export declare const TEAM_SIZE_MAX = 100000;
+/** Earliest founding year accepted. The ceiling is "this year", read per parse. */
+export declare const FOUNDED_YEAR_MIN = 1900;
+/**
+ * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every
+ * member URL carries it: profile links, a venture website.
+ *
+ * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's
+ * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is
+ * ordinary, and one of them would otherwise fail a whole feed page.
+ */
+export declare const LINK_URL_MAX = 300;
+/** Author-supplied image description. The backend's stored copy uses this too. */
+export declare const MEDIA_ALT_MAX = 280;
+export declare const LINK_PREVIEW_TITLE_MAX = 200;
+export declare const LINK_PREVIEW_DESCRIPTION_MAX = 500;
+/** The free-text note on a report. */
+export declare const REPORT_NOTE_MAX = 1000;
+/** A moderator's note on a decision (why it was hidden, removed or dismissed). */
+export declare const MODERATION_NOTE_MAX = 500;
+/** What a post, poll or comment is shown as in a staff list: its first words. */
+export declare const MODERATION_EXCERPT_MAX = 160;
+/** Why a member was suspended. Shown to staff, and on record in the audit log. */
+export declare const SUSPENSION_REASON_MIN = 3;
+export declare const SUSPENSION_REASON_MAX = 500;
+/** The staff member directory's search box (a name, a handle or an email). */
+export declare const MEMBER_SEARCH_MAX = 120;
+export declare const TICKET_SUBJECT_MIN = 3;
+export declare const TICKET_SUBJECT_MAX = 120;
+/** One message in a ticket, the member's or an agent's. */
+export declare const TICKET_MESSAGE_MAX = 4000;
+/**
+ * Messages one ticket may hold. A conversation that long is a new problem, so
+ * the member is asked to open a new ticket rather than the thread growing
+ * without bound.
+ */
+export declare const TICKET_MESSAGES_MAX = 200;
+export declare const SAVED_REPLY_TITLE_MAX = 80;
+export declare const SAVED_REPLY_BODY_MAX = 4000;
+/** Saved replies kept in all: a team's library, not an archive. */
+export declare const SAVED_REPLIES_MAX = 200;
+/**
+ * Largest file accepted for upload: 10 MB.
+ *
+ * Enforced three times. The upload-slot body refuses a bigger `contentLength`;
+ * the size is SIGNED INTO the upload URL, so storage refuses a body of any other
+ * size; and the server checks the stored object again before processing it.
+ * The client checks first only to fail fast: it shrinks a photo well below this
+ * before uploading (see `MEDIA_SIZES`), so a member rarely meets the limit.
+ */
+export declare const UPLOAD_MAX_BYTES: number;
+/**
+ * Largest image, in pixels, the server will decode: 50 megapixels, one frame.
+ *
+ * Bytes do not bound memory. A 50,000 x 50,000 PNG of one colour compresses to
+ * a few kilobytes and decodes to ten gigabytes. The server reads the dimensions
+ * first and refuses anything above this before decoding (`UPLOAD_TOO_MANY_PIXELS`).
+ * 50 MP admits every phone camera's full-resolution photo up to 48 MP.
+ */
+export declare const MEDIA_MAX_INPUT_PIXELS = 50000000;
+/**
+ * Hours an upload may wait to be attached to a post or set as an avatar. After
+ * that the server deletes it: the composer was abandoned, or the tab closed.
+ */
+export declare const MEDIA_UNATTACHED_TTL_HOURS = 24;
+/**
+ * Uploads one member may have waiting (requested or processed, not yet
+ * attached) at once. A full post is `POST_MAX_MEDIA` (10); this leaves room for
+ * a retry or two without letting one account fill storage.
+ */
+export declare const MEDIA_PENDING_MAX = 30;
+/** Longest placeholder string: a base64 ThumbHash is about 30 characters. */
+export declare const MEDIA_PLACEHOLDER_MAX = 100;
+/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */
+export declare const DISCOVER_FILTER_VALUES_MAX = 10;
+/** Discover's free-text inputs: the name search, city and country. */
+export declare const DISCOVER_TEXT_MAX = 80;
+/** Page size bounds for every cursor-paged list. */
+export declare const PAGE_SIZE_MAX = 50;
+export declare const PAGE_SIZE_DEFAULT = 20;
+/**
+ * Members one participants lookup may name. Bounded so the lookup cannot be
+ * used to page through the directory.
+ */
+export declare const CHAT_PARTICIPANTS_MAX = 100;
+//# sourceMappingURL=limits.d.ts.map

package/dist/core/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/core/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,YAAY,MAAM,CAAC;AAChC,eAAO,MAAM,SAAS,OAAO,CAAC;AAC9B,0DAA0D;AAC1D,eAAO,MAAM,UAAU,IAAI,CAAC;AAC5B,gFAAgF;AAChF,eAAO,MAAM,SAAS,IAAI,CAAC;AAI3B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,WAAW,KAAK,CAAC;AAI9B,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,uCAAuC;AACvC,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,eAAO,MAAM,aAAa,SAAU,CAAC;AACrC,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAIrC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,MAAM,CAAC;AAIhC,kFAAkF;AAClF,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,sCAAsC;AACtC,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAI1C,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAIrC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,2DAA2D;AAC3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAIrC;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,WAAa,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAIzC,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,oDAAoD;AACpD,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAIpC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC"}

package/dist/core/limits.js

@@ -0,0 +1,132 @@
+/**
+ * founder-schema — Every length, size and count limit, by name
+ *
+ * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,
+ * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could
+ * read them, so the web client re-typed each one for its counters and the
+ * backend re-typed them as Mongoose `maxlength`. Three copies of one number is
+ * how the image alt text came to be 280 here and 500 in the backend.
+ *
+ * The rule from 0.2.0: a schema uses one of these constants, a consumer imports
+ * the same constant, and nobody writes the digits again.
+ *
+ * Imports nothing, so any module here can use it without a cycle. Limits that
+ * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,
+ * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their
+ * names; this file holds the ones that had none.
+ *
+ * ⚠️ Lowering a limit is a breaking change for stored data: a value that was
+ * valid when written fails the next edit. Raise freely; lower deliberately.
+ *
+ * @module founder-schema/core/limits
+ */
+// ─── Profile ─────────────────────────────────────────────────────────────────
+export const DISPLAY_NAME_MAX = 80;
+export const HEADLINE_MAX = 120;
+export const ABOUT_MAX = 1000;
+/** Skills a member may list. Discover filters on them. */
+export const SKILLS_MAX = 8;
+/** Goals a member must pick at onboarding. The list itself caps the maximum. */
+export const GOALS_MIN = 1;
+// ─── Location ────────────────────────────────────────────────────────────────
+export const CITY_MAX = 80;
+export const STATE_MAX = 80;
+export const COUNTRY_MAX = 80;
+// ─── Venture ─────────────────────────────────────────────────────────────────
+export const VENTURE_NAME_MAX = 120;
+export const VENTURE_TAGLINE_MAX = 160;
+/** Team size including the founder. */
+export const TEAM_SIZE_MIN = 1;
+export const TEAM_SIZE_MAX = 100_000;
+/** Earliest founding year accepted. The ceiling is "this year", read per parse. */
+export const FOUNDED_YEAR_MIN = 1900;
+// ─── Links ───────────────────────────────────────────────────────────────────
+/**
+ * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every
+ * member URL carries it: profile links, a venture website.
+ *
+ * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's
+ * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is
+ * ordinary, and one of them would otherwise fail a whole feed page.
+ */
+export const LINK_URL_MAX = 300;
+// ─── Feed and moderation ─────────────────────────────────────────────────────
+/** Author-supplied image description. The backend's stored copy uses this too. */
+export const MEDIA_ALT_MAX = 280;
+export const LINK_PREVIEW_TITLE_MAX = 200;
+export const LINK_PREVIEW_DESCRIPTION_MAX = 500;
+/** The free-text note on a report. */
+export const REPORT_NOTE_MAX = 1000;
+/** A moderator's note on a decision (why it was hidden, removed or dismissed). */
+export const MODERATION_NOTE_MAX = 500;
+/** What a post, poll or comment is shown as in a staff list: its first words. */
+export const MODERATION_EXCERPT_MAX = 160;
+// ─── Staff ───────────────────────────────────────────────────────────────────
+/** Why a member was suspended. Shown to staff, and on record in the audit log. */
+export const SUSPENSION_REASON_MIN = 3;
+export const SUSPENSION_REASON_MAX = 500;
+/** The staff member directory's search box (a name, a handle or an email). */
+export const MEMBER_SEARCH_MAX = 120;
+// ─── Support ─────────────────────────────────────────────────────────────────
+export const TICKET_SUBJECT_MIN = 3;
+export const TICKET_SUBJECT_MAX = 120;
+/** One message in a ticket, the member's or an agent's. */
+export const TICKET_MESSAGE_MAX = 4000;
+/**
+ * Messages one ticket may hold. A conversation that long is a new problem, so
+ * the member is asked to open a new ticket rather than the thread growing
+ * without bound.
+ */
+export const TICKET_MESSAGES_MAX = 200;
+export const SAVED_REPLY_TITLE_MAX = 80;
+export const SAVED_REPLY_BODY_MAX = 4000;
+/** Saved replies kept in all: a team's library, not an archive. */
+export const SAVED_REPLIES_MAX = 200;
+// ─── Uploads ─────────────────────────────────────────────────────────────────
+/**
+ * Largest file accepted for upload: 10 MB.
+ *
+ * Enforced three times. The upload-slot body refuses a bigger `contentLength`;
+ * the size is SIGNED INTO the upload URL, so storage refuses a body of any other
+ * size; and the server checks the stored object again before processing it.
+ * The client checks first only to fail fast: it shrinks a photo well below this
+ * before uploading (see `MEDIA_SIZES`), so a member rarely meets the limit.
+ */
+export const UPLOAD_MAX_BYTES = 10 * 1024 * 1024;
+/**
+ * Largest image, in pixels, the server will decode: 50 megapixels, one frame.
+ *
+ * Bytes do not bound memory. A 50,000 x 50,000 PNG of one colour compresses to
+ * a few kilobytes and decodes to ten gigabytes. The server reads the dimensions
+ * first and refuses anything above this before decoding (`UPLOAD_TOO_MANY_PIXELS`).
+ * 50 MP admits every phone camera's full-resolution photo up to 48 MP.
+ */
+export const MEDIA_MAX_INPUT_PIXELS = 50_000_000;
+/**
+ * Hours an upload may wait to be attached to a post or set as an avatar. After
+ * that the server deletes it: the composer was abandoned, or the tab closed.
+ */
+export const MEDIA_UNATTACHED_TTL_HOURS = 24;
+/**
+ * Uploads one member may have waiting (requested or processed, not yet
+ * attached) at once. A full post is `POST_MAX_MEDIA` (10); this leaves room for
+ * a retry or two without letting one account fill storage.
+ */
+export const MEDIA_PENDING_MAX = 30;
+/** Longest placeholder string: a base64 ThumbHash is about 30 characters. */
+export const MEDIA_PLACEHOLDER_MAX = 100;
+// ─── Lists and search ────────────────────────────────────────────────────────
+/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */
+export const DISCOVER_FILTER_VALUES_MAX = 10;
+/** Discover's free-text inputs: the name search, city and country. */
+export const DISCOVER_TEXT_MAX = 80;
+/** Page size bounds for every cursor-paged list. */
+export const PAGE_SIZE_MAX = 50;
+export const PAGE_SIZE_DEFAULT = 20;
+// ─── Chat ────────────────────────────────────────────────────────────────────
+/**
+ * Members one participants lookup may name. Bounded so the lookup cannot be
+ * used to page through the directory.
+ */
+export const CHAT_PARTICIPANTS_MAX = 100;
+//# sourceMappingURL=limits.js.map

package/dist/core/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/core/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAC9B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,gFAAgF;AAChF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;AAE3B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,uCAAuC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEhC,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AACzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC","sourcesContent":["/**\n * founder-schema — Every length, size and count limit, by name\n *\n * ONE PLACE FOR EVERY NUMBER a client and the server must agree on. Before this,\n * the limits lived inline (`.max(80)`, `.max(1000)`) where nothing else could\n * read them, so the web client re-typed each one for its counters and the\n * backend re-typed them as Mongoose `maxlength`. Three copies of one number is\n * how the image alt text came to be 280 here and 500 in the backend.\n *\n * The rule from 0.2.0: a schema uses one of these constants, a consumer imports\n * the same constant, and nobody writes the digits again.\n *\n * Imports nothing, so any module here can use it without a cycle. Limits that\n * already had a name in their own module (POST_MAX_BODY_CHARS, POLL_*,\n * USERNAME_*, INTERESTS_*, MIN_AGE_YEARS...) stay where they are and keep their\n * names; this file holds the ones that had none.\n *\n * ⚠️ Lowering a limit is a breaking change for stored data: a value that was\n * valid when written fails the next edit. Raise freely; lower deliberately.\n *\n * @module founder-schema/core/limits\n */\n\n// ─── Profile ─────────────────────────────────────────────────────────────────\n\nexport const DISPLAY_NAME_MAX = 80;\nexport const HEADLINE_MAX = 120;\nexport const ABOUT_MAX = 1000;\n/** Skills a member may list. Discover filters on them. */\nexport const SKILLS_MAX = 8;\n/** Goals a member must pick at onboarding. The list itself caps the maximum. */\nexport const GOALS_MIN = 1;\n\n// ─── Location ────────────────────────────────────────────────────────────────\n\nexport const CITY_MAX = 80;\nexport const STATE_MAX = 80;\nexport const COUNTRY_MAX = 80;\n\n// ─── Venture ─────────────────────────────────────────────────────────────────\n\nexport const VENTURE_NAME_MAX = 120;\nexport const VENTURE_TAGLINE_MAX = 160;\n/** Team size including the founder. */\nexport const TEAM_SIZE_MIN = 1;\nexport const TEAM_SIZE_MAX = 100_000;\n/** Earliest founding year accepted. The ceiling is \"this year\", read per parse. */\nexport const FOUNDED_YEAR_MIN = 1900;\n\n// ─── Links ───────────────────────────────────────────────────────────────────\n\n/**\n * Longest URL a member may TYPE. Applied by `httpUrlSchema` itself, so every\n * member URL carries it: profile links, a venture website.\n *\n * ⚠ NOT applied to URLs the server reads from elsewhere (a link preview's\n * page or image), which use `safeUrlSchema`: a 314-character CDN image URL is\n * ordinary, and one of them would otherwise fail a whole feed page.\n */\nexport const LINK_URL_MAX = 300;\n\n// ─── Feed and moderation ─────────────────────────────────────────────────────\n\n/** Author-supplied image description. The backend's stored copy uses this too. */\nexport const MEDIA_ALT_MAX = 280;\nexport const LINK_PREVIEW_TITLE_MAX = 200;\nexport const LINK_PREVIEW_DESCRIPTION_MAX = 500;\n/** The free-text note on a report. */\nexport const REPORT_NOTE_MAX = 1000;\n/** A moderator's note on a decision (why it was hidden, removed or dismissed). */\nexport const MODERATION_NOTE_MAX = 500;\n/** What a post, poll or comment is shown as in a staff list: its first words. */\nexport const MODERATION_EXCERPT_MAX = 160;\n\n// ─── Staff ───────────────────────────────────────────────────────────────────\n\n/** Why a member was suspended. Shown to staff, and on record in the audit log. */\nexport const SUSPENSION_REASON_MIN = 3;\nexport const SUSPENSION_REASON_MAX = 500;\n/** The staff member directory's search box (a name, a handle or an email). */\nexport const MEMBER_SEARCH_MAX = 120;\n\n// ─── Support ─────────────────────────────────────────────────────────────────\n\nexport const TICKET_SUBJECT_MIN = 3;\nexport const TICKET_SUBJECT_MAX = 120;\n/** One message in a ticket, the member's or an agent's. */\nexport const TICKET_MESSAGE_MAX = 4000;\n/**\n * Messages one ticket may hold. A conversation that long is a new problem, so\n * the member is asked to open a new ticket rather than the thread growing\n * without bound.\n */\nexport const TICKET_MESSAGES_MAX = 200;\nexport const SAVED_REPLY_TITLE_MAX = 80;\nexport const SAVED_REPLY_BODY_MAX = 4000;\n/** Saved replies kept in all: a team's library, not an archive. */\nexport const SAVED_REPLIES_MAX = 200;\n\n// ─── Uploads ─────────────────────────────────────────────────────────────────\n\n/**\n * Largest file accepted for upload: 10 MB.\n *\n * Enforced three times. The upload-slot body refuses a bigger `contentLength`;\n * the size is SIGNED INTO the upload URL, so storage refuses a body of any other\n * size; and the server checks the stored object again before processing it.\n * The client checks first only to fail fast: it shrinks a photo well below this\n * before uploading (see `MEDIA_SIZES`), so a member rarely meets the limit.\n */\nexport const UPLOAD_MAX_BYTES = 10 * 1024 * 1024;\n\n/**\n * Largest image, in pixels, the server will decode: 50 megapixels, one frame.\n *\n * Bytes do not bound memory. A 50,000 x 50,000 PNG of one colour compresses to\n * a few kilobytes and decodes to ten gigabytes. The server reads the dimensions\n * first and refuses anything above this before decoding (`UPLOAD_TOO_MANY_PIXELS`).\n * 50 MP admits every phone camera's full-resolution photo up to 48 MP.\n */\nexport const MEDIA_MAX_INPUT_PIXELS = 50_000_000;\n\n/**\n * Hours an upload may wait to be attached to a post or set as an avatar. After\n * that the server deletes it: the composer was abandoned, or the tab closed.\n */\nexport const MEDIA_UNATTACHED_TTL_HOURS = 24;\n\n/**\n * Uploads one member may have waiting (requested or processed, not yet\n * attached) at once. A full post is `POST_MAX_MEDIA` (10); this leaves room for\n * a retry or two without letting one account fill storage.\n */\nexport const MEDIA_PENDING_MAX = 30;\n\n/** Longest placeholder string: a base64 ThumbHash is about 30 characters. */\nexport const MEDIA_PLACEHOLDER_MAX = 100;\n\n// ─── Lists and search ────────────────────────────────────────────────────────\n\n/** Values one Discover multi-select filter may carry (`?skill=a&skill=b`). */\nexport const DISCOVER_FILTER_VALUES_MAX = 10;\n/** Discover's free-text inputs: the name search, city and country. */\nexport const DISCOVER_TEXT_MAX = 80;\n/** Page size bounds for every cursor-paged list. */\nexport const PAGE_SIZE_MAX = 50;\nexport const PAGE_SIZE_DEFAULT = 20;\n\n// ─── Chat ────────────────────────────────────────────────────────────────────\n\n/**\n * Members one participants lookup may name. Bounded so the lookup cannot be\n * used to page through the directory.\n */\nexport const CHAT_PARTICIPANTS_MAX = 100;\n"]}

package/dist/core/responses.d.ts

@@ -0,0 +1,207 @@
+/**
+ * founder-schema — API response envelope
+ *
+ * Every Founder Circle endpoint answers in this shape. The clients read the
+ * failure reason at `error.message`, so a handler must never return a bare
+ * string body.
+ *
+ * @module founder-schema/core/responses
+ */
+import { z } from 'zod';
+/**
+ * What an error carries beyond its code, each field named by the code that
+ * sends it. Declared here, not loosely typed, because a client parses errors
+ * with this schema and Zod drops a key the schema does not name.
+ *
+ * `issues` is EVERY problem of a 400, each with its path, built on the server
+ * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings
+ * that nothing ever sent, while the real 400s carried only the first issue's
+ * message, so a client could not tell which field to mark.
+ */
+export declare const apiErrorDetailsSchema: z.ZodObject<{
+    issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        location: z.ZodOptional<z.ZodEnum<{
+            params: "params";
+            body: "body";
+            query: "query";
+        }>>;
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        code: z.ZodString;
+        message: z.ZodString;
+        minimum: z.ZodOptional<z.ZodNumber>;
+        maximum: z.ZodOptional<z.ZodNumber>;
+        origin: z.ZodOptional<z.ZodString>;
+        format: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    attemptsLeft: z.ZodOptional<z.ZodNumber>;
+    lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ApiErrorDetails = z.infer<typeof apiErrorDetailsSchema>;
+/**
+ * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.
+ * `message` is English, for logs and for a client that predates the code.
+ */
+export declare const apiErrorSchema: z.ZodObject<{
+    code: z.ZodEnum<{
+        INTERNAL_ERROR: "INTERNAL_ERROR";
+        VALIDATION_ERROR: "VALIDATION_ERROR";
+        NOT_FOUND: "NOT_FOUND";
+        CONFLICT: "CONFLICT";
+        RATE_LIMITED: "RATE_LIMITED";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+        UNAUTHORIZED: "UNAUTHORIZED";
+        INVALID_TOKEN: "INVALID_TOKEN";
+        TOKEN_EXPIRED: "TOKEN_EXPIRED";
+        SESSION_INVALIDATED: "SESSION_INVALIDATED";
+        FORBIDDEN: "FORBIDDEN";
+        ONBOARDING_INCOMPLETE: "ONBOARDING_INCOMPLETE";
+        ALREADY_ONBOARDED: "ALREADY_ONBOARDED";
+        UNDER_AGE: "UNDER_AGE";
+        UPLOAD_NOT_ATTACHABLE: "UPLOAD_NOT_ATTACHABLE";
+        UPLOAD_TOO_LARGE: "UPLOAD_TOO_LARGE";
+        UPLOAD_WRONG_TYPE: "UPLOAD_WRONG_TYPE";
+        UPLOAD_NOT_RECEIVED: "UPLOAD_NOT_RECEIVED";
+        UPLOAD_PROCESSING: "UPLOAD_PROCESSING";
+        UPLOAD_UNREADABLE: "UPLOAD_UNREADABLE";
+        UPLOAD_TOO_MANY_PIXELS: "UPLOAD_TOO_MANY_PIXELS";
+        UPLOAD_LIMIT_REACHED: "UPLOAD_LIMIT_REACHED";
+        UPLOAD_IN_USE: "UPLOAD_IN_USE";
+        EDIT_WINDOW_CLOSED: "EDIT_WINDOW_CLOSED";
+        POLL_NOT_EDITABLE: "POLL_NOT_EDITABLE";
+        POLL_CLOSED: "POLL_CLOSED";
+        POLL_CHOICE_INVALID: "POLL_CHOICE_INVALID";
+        REPLY_TOO_DEEP: "REPLY_TOO_DEEP";
+        CANNOT_REPORT_OWN: "CANNOT_REPORT_OWN";
+        CHAT_WITH_SELF: "CHAT_WITH_SELF";
+        ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+        ROLE_NOT_HELD: "ROLE_NOT_HELD";
+        MPIN_NOT_SET: "MPIN_NOT_SET";
+        MPIN_ALREADY_SET: "MPIN_ALREADY_SET";
+        MPIN_INCORRECT: "MPIN_INCORRECT";
+        MPIN_LOCKED: "MPIN_LOCKED";
+        CANNOT_CHANGE_OWN_ROLES: "CANNOT_CHANGE_OWN_ROLES";
+        ROLE_NOT_GRANTABLE: "ROLE_NOT_GRANTABLE";
+        TICKET_FULL: "TICKET_FULL";
+        SAVED_REPLIES_FULL: "SAVED_REPLIES_FULL";
+    }>;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodObject<{
+        issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            location: z.ZodOptional<z.ZodEnum<{
+                params: "params";
+                body: "body";
+                query: "query";
+            }>>;
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            code: z.ZodString;
+            message: z.ZodString;
+            minimum: z.ZodOptional<z.ZodNumber>;
+            maximum: z.ZodOptional<z.ZodNumber>;
+            origin: z.ZodOptional<z.ZodString>;
+            format: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        attemptsLeft: z.ZodOptional<z.ZodNumber>;
+        lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiError = z.infer<typeof apiErrorSchema>;
+/** Success envelope. `T` is the payload schema. */
+export declare const successResponseSchema: <T extends z.ZodType>(data: T) => z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    data: T;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const errorResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            INTERNAL_ERROR: "INTERNAL_ERROR";
+            VALIDATION_ERROR: "VALIDATION_ERROR";
+            NOT_FOUND: "NOT_FOUND";
+            CONFLICT: "CONFLICT";
+            RATE_LIMITED: "RATE_LIMITED";
+            SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+            UNAUTHORIZED: "UNAUTHORIZED";
+            INVALID_TOKEN: "INVALID_TOKEN";
+            TOKEN_EXPIRED: "TOKEN_EXPIRED";
+            SESSION_INVALIDATED: "SESSION_INVALIDATED";
+            FORBIDDEN: "FORBIDDEN";
+            ONBOARDING_INCOMPLETE: "ONBOARDING_INCOMPLETE";
+            ALREADY_ONBOARDED: "ALREADY_ONBOARDED";
+            UNDER_AGE: "UNDER_AGE";
+            UPLOAD_NOT_ATTACHABLE: "UPLOAD_NOT_ATTACHABLE";
+            UPLOAD_TOO_LARGE: "UPLOAD_TOO_LARGE";
+            UPLOAD_WRONG_TYPE: "UPLOAD_WRONG_TYPE";
+            UPLOAD_NOT_RECEIVED: "UPLOAD_NOT_RECEIVED";
+            UPLOAD_PROCESSING: "UPLOAD_PROCESSING";
+            UPLOAD_UNREADABLE: "UPLOAD_UNREADABLE";
+            UPLOAD_TOO_MANY_PIXELS: "UPLOAD_TOO_MANY_PIXELS";
+            UPLOAD_LIMIT_REACHED: "UPLOAD_LIMIT_REACHED";
+            UPLOAD_IN_USE: "UPLOAD_IN_USE";
+            EDIT_WINDOW_CLOSED: "EDIT_WINDOW_CLOSED";
+            POLL_NOT_EDITABLE: "POLL_NOT_EDITABLE";
+            POLL_CLOSED: "POLL_CLOSED";
+            POLL_CHOICE_INVALID: "POLL_CHOICE_INVALID";
+            REPLY_TOO_DEEP: "REPLY_TOO_DEEP";
+            CANNOT_REPORT_OWN: "CANNOT_REPORT_OWN";
+            CHAT_WITH_SELF: "CHAT_WITH_SELF";
+            ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+            ROLE_NOT_HELD: "ROLE_NOT_HELD";
+            MPIN_NOT_SET: "MPIN_NOT_SET";
+            MPIN_ALREADY_SET: "MPIN_ALREADY_SET";
+            MPIN_INCORRECT: "MPIN_INCORRECT";
+            MPIN_LOCKED: "MPIN_LOCKED";
+            CANNOT_CHANGE_OWN_ROLES: "CANNOT_CHANGE_OWN_ROLES";
+            ROLE_NOT_GRANTABLE: "ROLE_NOT_GRANTABLE";
+            TICKET_FULL: "TICKET_FULL";
+            SAVED_REPLIES_FULL: "SAVED_REPLIES_FULL";
+        }>;
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodObject<{
+            issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                location: z.ZodOptional<z.ZodEnum<{
+                    params: "params";
+                    body: "body";
+                    query: "query";
+                }>>;
+                path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+                code: z.ZodString;
+                message: z.ZodString;
+                minimum: z.ZodOptional<z.ZodNumber>;
+                maximum: z.ZodOptional<z.ZodNumber>;
+                origin: z.ZodOptional<z.ZodString>;
+                format: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+            attemptsLeft: z.ZodOptional<z.ZodNumber>;
+            lockedUntil: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ErrorResponse = z.infer<typeof errorResponseSchema>;
+/**
+ * Cursor-paginated list envelope.
+ *
+ * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the
+ * key is not the same thing and does not validate: a handler must decide
+ * whether there is another page and say so, because "the key is missing" and
+ * "there are no more results" are indistinguishable to a client that has to
+ * choose between showing a Load more button and not showing one.
+ *
+ * An earlier version of this comment said absence and null were equivalent.
+ * They never were; the schema has always required the key. Corrected
+ * 2026-09-21, and pinned by a test.
+ */
+export declare const paginatedSchema: <T extends z.ZodType>(item: T) => z.ZodObject<{
+    items: z.ZodArray<T>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * What a create, an edit or a delete answers: the id of the thing it touched.
+ * A client that needs the whole item reads it, so a write never ships a second
+ * projection of it that could drift from the read path's.
+ */
+export declare const idResponseSchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>;
+export type IdResponse = z.infer<typeof idResponseSchema>;
+//# sourceMappingURL=responses.d.ts.map

package/dist/core/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/core/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;iBAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;;;;iBAK9D,CAAC;AAEL,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;;;iBAIxD,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;iBAAmC,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/core/responses.js

@@ -0,0 +1,73 @@
+/**
+ * founder-schema — API response envelope
+ *
+ * Every Founder Circle endpoint answers in this shape. The clients read the
+ * failure reason at `error.message`, so a handler must never return a bare
+ * string body.
+ *
+ * @module founder-schema/core/responses
+ */
+import { z } from 'zod';
+import { objectIdSchema } from './common.js';
+import { apiErrorCodeSchema } from './errors.js';
+import { validationIssueSchema } from './validation.js';
+/**
+ * What an error carries beyond its code, each field named by the code that
+ * sends it. Declared here, not loosely typed, because a client parses errors
+ * with this schema and Zod drops a key the schema does not name.
+ *
+ * `issues` is EVERY problem of a 400, each with its path, built on the server
+ * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings
+ * that nothing ever sent, while the real 400s carried only the first issue's
+ * message, so a client could not tell which field to mark.
+ */
+export const apiErrorDetailsSchema = z.object({
+    issues: z.array(validationIssueSchema).optional(),
+    /** `MPIN_INCORRECT`: wrong tries left before the MPIN locks. */
+    attemptsLeft: z.number().int().min(0).optional(),
+    /** `MPIN_LOCKED`: when the MPIN can be tried again. */
+    lockedUntil: z.iso.datetime().optional(),
+});
+/**
+ * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.
+ * `message` is English, for logs and for a client that predates the code.
+ */
+export const apiErrorSchema = z.object({
+    code: apiErrorCodeSchema,
+    message: z.string(),
+    details: apiErrorDetailsSchema.optional(),
+});
+/** Success envelope. `T` is the payload schema. */
+export const successResponseSchema = (data) => z.object({
+    success: z.literal(true),
+    data,
+    message: z.string().optional(),
+});
+export const errorResponseSchema = z.object({
+    success: z.literal(false),
+    error: apiErrorSchema,
+});
+/**
+ * Cursor-paginated list envelope.
+ *
+ * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the
+ * key is not the same thing and does not validate: a handler must decide
+ * whether there is another page and say so, because "the key is missing" and
+ * "there are no more results" are indistinguishable to a client that has to
+ * choose between showing a Load more button and not showing one.
+ *
+ * An earlier version of this comment said absence and null were equivalent.
+ * They never were; the schema has always required the key. Corrected
+ * 2026-09-21, and pinned by a test.
+ */
+export const paginatedSchema = (item) => z.object({
+    items: z.array(item),
+    nextCursor: z.string().nullable(),
+});
+/**
+ * What a create, an edit or a delete answers: the id of the thing it touched.
+ * A client that needs the whole item reads it, so a write never ships a second
+ * projection of it that could drift from the read path's.
+ */
+export const idResponseSchema = z.object({ id: objectIdSchema });
+//# sourceMappingURL=responses.js.map

package/dist/core/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/core/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACjD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAsB,IAAO,EAAE,EAAE,CACpE,CAAC,CAAC,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI;IACJ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,KAAK,EAAE,cAAc;CACtB,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAsB,IAAO,EAAE,EAAE,CAC9D,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC","sourcesContent":["/**\n * founder-schema — API response envelope\n *\n * Every Founder Circle endpoint answers in this shape. The clients read the\n * failure reason at `error.message`, so a handler must never return a bare\n * string body.\n *\n * @module founder-schema/core/responses\n */\n\nimport { z } from 'zod';\nimport { objectIdSchema } from './common.js';\nimport { apiErrorCodeSchema } from './errors.js';\nimport { validationIssueSchema } from './validation.js';\n\n/**\n * What an error carries beyond its code, each field named by the code that\n * sends it. Declared here, not loosely typed, because a client parses errors\n * with this schema and Zod drops a key the schema does not name.\n *\n * `issues` is EVERY problem of a 400, each with its path, built on the server\n * by `toValidationIssues`. Until 0.2.0 this was typed as a record of strings\n * that nothing ever sent, while the real 400s carried only the first issue's\n * message, so a client could not tell which field to mark.\n */\nexport const apiErrorDetailsSchema = z.object({\n  issues: z.array(validationIssueSchema).optional(),\n  /** `MPIN_INCORRECT`: wrong tries left before the MPIN locks. */\n  attemptsLeft: z.number().int().min(0).optional(),\n  /** `MPIN_LOCKED`: when the MPIN can be tried again. */\n  lockedUntil: z.iso.datetime().optional(),\n});\nexport type ApiErrorDetails = z.infer<typeof apiErrorDetailsSchema>;\n\n/**\n * `code` is one of `API_ERROR_CODE_VALUES`, and it is what a client acts on.\n * `message` is English, for logs and for a client that predates the code.\n */\nexport const apiErrorSchema = z.object({\n  code: apiErrorCodeSchema,\n  message: z.string(),\n  details: apiErrorDetailsSchema.optional(),\n});\nexport type ApiError = z.infer<typeof apiErrorSchema>;\n\n/** Success envelope. `T` is the payload schema. */\nexport const successResponseSchema = <T extends z.ZodType>(data: T) =>\n  z.object({\n    success: z.literal(true),\n    data,\n    message: z.string().optional(),\n  });\n\nexport const errorResponseSchema = z.object({\n  success: z.literal(false),\n  error: apiErrorSchema,\n});\nexport type ErrorResponse = z.infer<typeof errorResponseSchema>;\n\n/**\n * Cursor-paginated list envelope.\n *\n * `nextCursor` is REQUIRED and is `null` at the end of the list. Omitting the\n * key is not the same thing and does not validate: a handler must decide\n * whether there is another page and say so, because \"the key is missing\" and\n * \"there are no more results\" are indistinguishable to a client that has to\n * choose between showing a Load more button and not showing one.\n *\n * An earlier version of this comment said absence and null were equivalent.\n * They never were; the schema has always required the key. Corrected\n * 2026-09-21, and pinned by a test.\n */\nexport const paginatedSchema = <T extends z.ZodType>(item: T) =>\n  z.object({\n    items: z.array(item),\n    nextCursor: z.string().nullable(),\n  });\n\n/**\n * What a create, an edit or a delete answers: the id of the thing it touched.\n * A client that needs the whole item reads it, so a write never ships a second\n * projection of it that could drift from the read path's.\n */\nexport const idResponseSchema = z.object({ id: objectIdSchema });\nexport type IdResponse = z.infer<typeof idResponseSchema>;\n"]}