founder-schema 0.3.0 → 0.5.0

package/dist/core/validation.d.ts

@@ -0,0 +1,146 @@
+/**
+ * founder-schema — How a validation failure is described, on both sides
+ *
+ * TWO RULES, and they are what let the web client show any error, its own or
+ * the server's, on the right field in the member's language:
+ *
+ *  1. A CUSTOM MESSAGE IS A KEY, NEVER A SENTENCE. Where a schema needs its own
+ *     message (a refine, a regex), the message is one of `VALIDATION_MESSAGE`,
+ *     such as `phoneInvalid`. The client turns the key into text in English or
+ *     Hindi. Before 0.2.0 these were English sentences, so a Hindi screen showed
+ *     an English error, and a client that wanted to translate one had to match
+ *     on the wording.
+ *
+ *     Plain bounds carry NO custom message. `.min(1)` and `.max(80)` produce
+ *     Zod's own `too_small` / `too_big` issues, which already say which bound
+ *     and what it was (`minimum`, `maximum`, `origin`), and the client words
+ *     them from those. A hand-written "at most 80 characters" would only
+ *     restate the number in one language.
+ *
+ *  2. THE SERVER SENDS EVERY ISSUE, IN THIS SHAPE. A 400 answers with
+ *     `error.details.issues`, built by `toValidationIssues`, so the client can
+ *     put each one under its field. Until 0.2.0 the backend sent only the
+ *     first issue's message, with no path at all.
+ *
+ * ⚠️ `toValidationIssues` COPIES A WHITELIST OF FIELDS, it never spreads an
+ * issue. Zod can carry the rejected `input` on an issue, and these bodies hold a
+ * date of birth and a phone number. Echoing them into an error response sends
+ * them back to the client, into logs and into any proxy in between. A test
+ * proves `input` never survives.
+ *
+ * @module founder-schema/core/validation
+ */
+import { z } from 'zod';
+/**
+ * Every custom message a schema in this package can produce. Each is a
+ * translation key the clients define in every language they ship.
+ *
+ * ⚠️ Append only, and add the translation in the same change. Renaming one
+ * shows the raw key to every member until each client ships the new name.
+ */
+export declare const VALIDATION_MESSAGE: {
+    /** Not a 24-hex Mongo id. */
+    readonly invalidId: "invalidId";
+    /** Handle: wrong characters, or a dot in the wrong place. */
+    readonly usernameInvalid: "usernameInvalid";
+    /** Not a 10-digit Indian mobile number. */
+    readonly phoneInvalid: "phoneInvalid";
+    /** Not a `YYYY-MM-DD` date. */
+    readonly dateInvalid: "dateInvalid";
+    /** A date that does not exist, such as 30 February. */
+    readonly dobInvalid: "dobInvalid";
+    /** Under the minimum age. */
+    readonly dobUnderAge: "dobUnderAge";
+    /** Over the sanity ceiling: almost always a mistyped year. */
+    readonly dobTooOld: "dobTooOld";
+    /** A founding year after this year. */
+    readonly foundedYearFuture: "foundedYearFuture";
+    /** An upload key that is not one this product mints. */
+    readonly uploadKeyInvalid: "uploadKeyInvalid";
+    /** The same uploaded image attached twice to one post. */
+    readonly mediaDuplicate: "mediaDuplicate";
+    /** A post with neither text nor media. */
+    readonly postEmpty: "postEmpty";
+    /** Two poll options with the same label. */
+    readonly pollOptionsDuplicate: "pollOptionsDuplicate";
+    /** An empty string sent to clear a patch field; clearing is `null`. */
+    readonly clearWithNull: "clearWithNull";
+    /** Not a plain http(s) URL on a real domain (`javascript:`, `localhost`, an IP...). */
+    readonly urlInvalid: "urlInvalid";
+    /** A handle this product keeps for itself (`admin`, `support`...). */
+    readonly usernameReserved: "usernameReserved";
+    /** Agreed to a version of the guidelines that is not the current one. */
+    readonly guidelinesOutdated: "guidelinesOutdated";
+    /** An MPIN that is not exactly six digits. */
+    readonly mpinInvalid: "mpinInvalid";
+    /** The MPIN and its confirmation differ. */
+    readonly mpinMismatch: "mpinMismatch";
+    /** Switching to a staff role without the MPIN. */
+    readonly mpinRequired: "mpinRequired";
+    /** The same role twice in one list. */
+    readonly rolesDuplicate: "rolesDuplicate";
+};
+export type ValidationMessageKey = (typeof VALIDATION_MESSAGE)[keyof typeof VALIDATION_MESSAGE];
+/**
+ * Which part of the request an issue is about.
+ *
+ * ONE PATH CONVENTION: `path` is ALWAYS relative to this part, so a body field
+ * reads `['venture', 'name']` with `location: 'body'`, never
+ * `['body', 'venture', 'name']`. A form maps body issues straight onto its
+ * fields without stripping a prefix, and a client that sees `query` or
+ * `params` knows the problem is the URL, not anything the member typed.
+ */
+export declare const REQUEST_PART_VALUES: readonly ["body", "query", "params"];
+export declare const requestPartSchema: z.ZodEnum<{
+    params: "params";
+    body: "body";
+    query: "query";
+}>;
+export type RequestPart = z.infer<typeof requestPartSchema>;
+/**
+ * One problem with one field, as it crosses the wire.
+ *
+ * `code` is Zod's issue code (`too_small`, `too_big`, `invalid_type`,
+ * `invalid_format`, `custom`...). `message` is either one of
+ * `VALIDATION_MESSAGE` or, for a plain bound, Zod's own English text, which the
+ * client ignores in favour of `code` plus `minimum` / `maximum`.
+ */
+export declare const validationIssueSchema: z.ZodObject<{
+    location: z.ZodOptional<z.ZodEnum<{
+        params: "params";
+        body: "body";
+        query: "query";
+    }>>;
+    path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    code: z.ZodString;
+    message: z.ZodString;
+    minimum: z.ZodOptional<z.ZodNumber>;
+    maximum: z.ZodOptional<z.ZodNumber>;
+    origin: z.ZodOptional<z.ZodString>;
+    format: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ValidationIssue = z.infer<typeof validationIssueSchema>;
+/** The loosest shape this needs from a Zod issue, so it works across 4.x. */
+interface ZodIssueLike {
+    path: readonly PropertyKey[];
+    code: string;
+    message: string;
+    minimum?: unknown;
+    maximum?: unknown;
+    origin?: unknown;
+    format?: unknown;
+}
+/**
+ * A Zod error as the wire shape. Use this on the server for every 400, and on
+ * the client to treat its own errors and the server's the same way.
+ *
+ * `location` is stamped on every issue when given; the server always gives it.
+ *
+ * Copies a WHITELIST of fields (see the module note). A path segment that is a
+ * symbol, which JSON cannot carry, becomes its description.
+ */
+export declare function toValidationIssues(error: {
+    issues: readonly ZodIssueLike[];
+}, location?: RequestPart): ValidationIssue[];
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/core/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/core/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;IAC7B,6BAA6B;;IAE7B,6DAA6D;;IAE7D,2CAA2C;;IAE3C,+BAA+B;;IAE/B,uDAAuD;;IAEvD,6BAA6B;;IAE7B,8DAA8D;;IAE9D,uCAAuC;;IAEvC,wDAAwD;;IAExD,0DAA0D;;IAE1D,0CAA0C;;IAE1C,4CAA4C;;IAE5C,uEAAuE;;IAEvE,uFAAuF;;IAEvF,sEAAsE;;IAEtE,yEAAyE;;IAEzE,8CAA8C;;IAE9C,4CAA4C;;IAE5C,kDAAkD;;IAElD,uCAAuC;;CAE/B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,sCAAuC,CAAC;AACxE,eAAO,MAAM,iBAAiB;;;;EAA8B,CAAC;AAC7D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAkBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,UAAU,YAAY;IACpB,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,EAC1C,QAAQ,CAAC,EAAE,WAAW,GACrB,eAAe,EAAE,CAkBnB"}

package/dist/core/validation.js

@@ -0,0 +1,152 @@
+/**
+ * founder-schema — How a validation failure is described, on both sides
+ *
+ * TWO RULES, and they are what let the web client show any error, its own or
+ * the server's, on the right field in the member's language:
+ *
+ *  1. A CUSTOM MESSAGE IS A KEY, NEVER A SENTENCE. Where a schema needs its own
+ *     message (a refine, a regex), the message is one of `VALIDATION_MESSAGE`,
+ *     such as `phoneInvalid`. The client turns the key into text in English or
+ *     Hindi. Before 0.2.0 these were English sentences, so a Hindi screen showed
+ *     an English error, and a client that wanted to translate one had to match
+ *     on the wording.
+ *
+ *     Plain bounds carry NO custom message. `.min(1)` and `.max(80)` produce
+ *     Zod's own `too_small` / `too_big` issues, which already say which bound
+ *     and what it was (`minimum`, `maximum`, `origin`), and the client words
+ *     them from those. A hand-written "at most 80 characters" would only
+ *     restate the number in one language.
+ *
+ *  2. THE SERVER SENDS EVERY ISSUE, IN THIS SHAPE. A 400 answers with
+ *     `error.details.issues`, built by `toValidationIssues`, so the client can
+ *     put each one under its field. Until 0.2.0 the backend sent only the
+ *     first issue's message, with no path at all.
+ *
+ * ⚠️ `toValidationIssues` COPIES A WHITELIST OF FIELDS, it never spreads an
+ * issue. Zod can carry the rejected `input` on an issue, and these bodies hold a
+ * date of birth and a phone number. Echoing them into an error response sends
+ * them back to the client, into logs and into any proxy in between. A test
+ * proves `input` never survives.
+ *
+ * @module founder-schema/core/validation
+ */
+import { z } from 'zod';
+/**
+ * Every custom message a schema in this package can produce. Each is a
+ * translation key the clients define in every language they ship.
+ *
+ * ⚠️ Append only, and add the translation in the same change. Renaming one
+ * shows the raw key to every member until each client ships the new name.
+ */
+export const VALIDATION_MESSAGE = {
+    /** Not a 24-hex Mongo id. */
+    invalidId: 'invalidId',
+    /** Handle: wrong characters, or a dot in the wrong place. */
+    usernameInvalid: 'usernameInvalid',
+    /** Not a 10-digit Indian mobile number. */
+    phoneInvalid: 'phoneInvalid',
+    /** Not a `YYYY-MM-DD` date. */
+    dateInvalid: 'dateInvalid',
+    /** A date that does not exist, such as 30 February. */
+    dobInvalid: 'dobInvalid',
+    /** Under the minimum age. */
+    dobUnderAge: 'dobUnderAge',
+    /** Over the sanity ceiling: almost always a mistyped year. */
+    dobTooOld: 'dobTooOld',
+    /** A founding year after this year. */
+    foundedYearFuture: 'foundedYearFuture',
+    /** An upload key that is not one this product mints. */
+    uploadKeyInvalid: 'uploadKeyInvalid',
+    /** The same uploaded image attached twice to one post. */
+    mediaDuplicate: 'mediaDuplicate',
+    /** A post with neither text nor media. */
+    postEmpty: 'postEmpty',
+    /** Two poll options with the same label. */
+    pollOptionsDuplicate: 'pollOptionsDuplicate',
+    /** An empty string sent to clear a patch field; clearing is `null`. */
+    clearWithNull: 'clearWithNull',
+    /** Not a plain http(s) URL on a real domain (`javascript:`, `localhost`, an IP...). */
+    urlInvalid: 'urlInvalid',
+    /** A handle this product keeps for itself (`admin`, `support`...). */
+    usernameReserved: 'usernameReserved',
+    /** Agreed to a version of the guidelines that is not the current one. */
+    guidelinesOutdated: 'guidelinesOutdated',
+    /** An MPIN that is not exactly six digits. */
+    mpinInvalid: 'mpinInvalid',
+    /** The MPIN and its confirmation differ. */
+    mpinMismatch: 'mpinMismatch',
+    /** Switching to a staff role without the MPIN. */
+    mpinRequired: 'mpinRequired',
+    /** The same role twice in one list. */
+    rolesDuplicate: 'rolesDuplicate',
+};
+/**
+ * Which part of the request an issue is about.
+ *
+ * ONE PATH CONVENTION: `path` is ALWAYS relative to this part, so a body field
+ * reads `['venture', 'name']` with `location: 'body'`, never
+ * `['body', 'venture', 'name']`. A form maps body issues straight onto its
+ * fields without stripping a prefix, and a client that sees `query` or
+ * `params` knows the problem is the URL, not anything the member typed.
+ */
+export const REQUEST_PART_VALUES = ['body', 'query', 'params'];
+export const requestPartSchema = z.enum(REQUEST_PART_VALUES);
+/**
+ * One problem with one field, as it crosses the wire.
+ *
+ * `code` is Zod's issue code (`too_small`, `too_big`, `invalid_type`,
+ * `invalid_format`, `custom`...). `message` is either one of
+ * `VALIDATION_MESSAGE` or, for a plain bound, Zod's own English text, which the
+ * client ignores in favour of `code` plus `minimum` / `maximum`.
+ */
+export const validationIssueSchema = z.object({
+    /** Set by the server on every issue it sends; absent on a client's own parse. */
+    location: requestPartSchema.optional(),
+    /**
+     * Where the problem is, RELATIVE TO `location`: `['venture', 'name']`,
+     * `['options', 2, 'label']`, `['contentId']`.
+     */
+    path: z.array(z.union([z.string(), z.number()])),
+    code: z.string(),
+    message: z.string(),
+    /** `too_small`: the bound that was missed. */
+    minimum: z.number().optional(),
+    /** `too_big`: the bound that was passed. */
+    maximum: z.number().optional(),
+    /** What was measured: `string`, `array`, `number`... */
+    origin: z.string().optional(),
+    /** `invalid_format`: which format, e.g. `url`, `regex`, `email`. */
+    format: z.string().optional(),
+});
+const toNumber = (v) => typeof v === 'number' ? v : typeof v === 'bigint' ? Number(v) : undefined;
+/**
+ * A Zod error as the wire shape. Use this on the server for every 400, and on
+ * the client to treat its own errors and the server's the same way.
+ *
+ * `location` is stamped on every issue when given; the server always gives it.
+ *
+ * Copies a WHITELIST of fields (see the module note). A path segment that is a
+ * symbol, which JSON cannot carry, becomes its description.
+ */
+export function toValidationIssues(error, location) {
+    return error.issues.map((issue) => {
+        const out = {
+            ...(location ? { location } : {}),
+            path: issue.path.map((p) => typeof p === 'number' ? p : typeof p === 'string' ? p : String(p.description ?? '')),
+            code: issue.code,
+            message: issue.message,
+        };
+        const minimum = toNumber(issue.minimum);
+        const maximum = toNumber(issue.maximum);
+        if (minimum !== undefined)
+            out.minimum = minimum;
+        if (maximum !== undefined)
+            out.maximum = maximum;
+        if (typeof issue.origin === 'string')
+            out.origin = issue.origin;
+        if (typeof issue.format === 'string')
+            out.format = issue.format;
+        return out;
+    });
+}
+//# sourceMappingURL=validation.js.map

package/dist/core/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/core/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,6BAA6B;IAC7B,SAAS,EAAE,WAAW;IACtB,6DAA6D;IAC7D,eAAe,EAAE,iBAAiB;IAClC,2CAA2C;IAC3C,YAAY,EAAE,cAAc;IAC5B,+BAA+B;IAC/B,WAAW,EAAE,aAAa;IAC1B,uDAAuD;IACvD,UAAU,EAAE,YAAY;IACxB,6BAA6B;IAC7B,WAAW,EAAE,aAAa;IAC1B,8DAA8D;IAC9D,SAAS,EAAE,WAAW;IACtB,uCAAuC;IACvC,iBAAiB,EAAE,mBAAmB;IACtC,wDAAwD;IACxD,gBAAgB,EAAE,kBAAkB;IACpC,0DAA0D;IAC1D,cAAc,EAAE,gBAAgB;IAChC,0CAA0C;IAC1C,SAAS,EAAE,WAAW;IACtB,4CAA4C;IAC5C,oBAAoB,EAAE,sBAAsB;IAC5C,uEAAuE;IACvE,aAAa,EAAE,eAAe;IAC9B,uFAAuF;IACvF,UAAU,EAAE,YAAY;IACxB,sEAAsE;IACtE,gBAAgB,EAAE,kBAAkB;IACpC,yEAAyE;IACzE,kBAAkB,EAAE,oBAAoB;IACxC,8CAA8C;IAC9C,WAAW,EAAE,aAAa;IAC1B,4CAA4C;IAC5C,YAAY,EAAE,cAAc;IAC5B,kDAAkD;IAClD,YAAY,EAAE,cAAc;IAC5B,uCAAuC;IACvC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAGX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAG7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACtC;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,4CAA4C;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oEAAoE;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAcH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAsB,EAAE,CAClD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAA0C,EAC1C,QAAsB;IAEtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,GAAG,GAAoB;YAC3B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CACpF;YACD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACjD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * founder-schema — How a validation failure is described, on both sides\n *\n * TWO RULES, and they are what let the web client show any error, its own or\n * the server's, on the right field in the member's language:\n *\n *  1. A CUSTOM MESSAGE IS A KEY, NEVER A SENTENCE. Where a schema needs its own\n *     message (a refine, a regex), the message is one of `VALIDATION_MESSAGE`,\n *     such as `phoneInvalid`. The client turns the key into text in English or\n *     Hindi. Before 0.2.0 these were English sentences, so a Hindi screen showed\n *     an English error, and a client that wanted to translate one had to match\n *     on the wording.\n *\n *     Plain bounds carry NO custom message. `.min(1)` and `.max(80)` produce\n *     Zod's own `too_small` / `too_big` issues, which already say which bound\n *     and what it was (`minimum`, `maximum`, `origin`), and the client words\n *     them from those. A hand-written \"at most 80 characters\" would only\n *     restate the number in one language.\n *\n *  2. THE SERVER SENDS EVERY ISSUE, IN THIS SHAPE. A 400 answers with\n *     `error.details.issues`, built by `toValidationIssues`, so the client can\n *     put each one under its field. Until 0.2.0 the backend sent only the\n *     first issue's message, with no path at all.\n *\n * ⚠️ `toValidationIssues` COPIES A WHITELIST OF FIELDS, it never spreads an\n * issue. Zod can carry the rejected `input` on an issue, and these bodies hold a\n * date of birth and a phone number. Echoing them into an error response sends\n * them back to the client, into logs and into any proxy in between. A test\n * proves `input` never survives.\n *\n * @module founder-schema/core/validation\n */\n\nimport { z } from 'zod';\n\n/**\n * Every custom message a schema in this package can produce. Each is a\n * translation key the clients define in every language they ship.\n *\n * ⚠️ Append only, and add the translation in the same change. Renaming one\n * shows the raw key to every member until each client ships the new name.\n */\nexport const VALIDATION_MESSAGE = {\n  /** Not a 24-hex Mongo id. */\n  invalidId: 'invalidId',\n  /** Handle: wrong characters, or a dot in the wrong place. */\n  usernameInvalid: 'usernameInvalid',\n  /** Not a 10-digit Indian mobile number. */\n  phoneInvalid: 'phoneInvalid',\n  /** Not a `YYYY-MM-DD` date. */\n  dateInvalid: 'dateInvalid',\n  /** A date that does not exist, such as 30 February. */\n  dobInvalid: 'dobInvalid',\n  /** Under the minimum age. */\n  dobUnderAge: 'dobUnderAge',\n  /** Over the sanity ceiling: almost always a mistyped year. */\n  dobTooOld: 'dobTooOld',\n  /** A founding year after this year. */\n  foundedYearFuture: 'foundedYearFuture',\n  /** An upload key that is not one this product mints. */\n  uploadKeyInvalid: 'uploadKeyInvalid',\n  /** The same uploaded image attached twice to one post. */\n  mediaDuplicate: 'mediaDuplicate',\n  /** A post with neither text nor media. */\n  postEmpty: 'postEmpty',\n  /** Two poll options with the same label. */\n  pollOptionsDuplicate: 'pollOptionsDuplicate',\n  /** An empty string sent to clear a patch field; clearing is `null`. */\n  clearWithNull: 'clearWithNull',\n  /** Not a plain http(s) URL on a real domain (`javascript:`, `localhost`, an IP...). */\n  urlInvalid: 'urlInvalid',\n  /** A handle this product keeps for itself (`admin`, `support`...). */\n  usernameReserved: 'usernameReserved',\n  /** Agreed to a version of the guidelines that is not the current one. */\n  guidelinesOutdated: 'guidelinesOutdated',\n  /** An MPIN that is not exactly six digits. */\n  mpinInvalid: 'mpinInvalid',\n  /** The MPIN and its confirmation differ. */\n  mpinMismatch: 'mpinMismatch',\n  /** Switching to a staff role without the MPIN. */\n  mpinRequired: 'mpinRequired',\n  /** The same role twice in one list. */\n  rolesDuplicate: 'rolesDuplicate',\n} as const;\nexport type ValidationMessageKey = (typeof VALIDATION_MESSAGE)[keyof typeof VALIDATION_MESSAGE];\n\n/**\n * Which part of the request an issue is about.\n *\n * ONE PATH CONVENTION: `path` is ALWAYS relative to this part, so a body field\n * reads `['venture', 'name']` with `location: 'body'`, never\n * `['body', 'venture', 'name']`. A form maps body issues straight onto its\n * fields without stripping a prefix, and a client that sees `query` or\n * `params` knows the problem is the URL, not anything the member typed.\n */\nexport const REQUEST_PART_VALUES = ['body', 'query', 'params'] as const;\nexport const requestPartSchema = z.enum(REQUEST_PART_VALUES);\nexport type RequestPart = z.infer<typeof requestPartSchema>;\n\n/**\n * One problem with one field, as it crosses the wire.\n *\n * `code` is Zod's issue code (`too_small`, `too_big`, `invalid_type`,\n * `invalid_format`, `custom`...). `message` is either one of\n * `VALIDATION_MESSAGE` or, for a plain bound, Zod's own English text, which the\n * client ignores in favour of `code` plus `minimum` / `maximum`.\n */\nexport const validationIssueSchema = z.object({\n  /** Set by the server on every issue it sends; absent on a client's own parse. */\n  location: requestPartSchema.optional(),\n  /**\n   * Where the problem is, RELATIVE TO `location`: `['venture', 'name']`,\n   * `['options', 2, 'label']`, `['contentId']`.\n   */\n  path: z.array(z.union([z.string(), z.number()])),\n  code: z.string(),\n  message: z.string(),\n  /** `too_small`: the bound that was missed. */\n  minimum: z.number().optional(),\n  /** `too_big`: the bound that was passed. */\n  maximum: z.number().optional(),\n  /** What was measured: `string`, `array`, `number`... */\n  origin: z.string().optional(),\n  /** `invalid_format`: which format, e.g. `url`, `regex`, `email`. */\n  format: z.string().optional(),\n});\nexport type ValidationIssue = z.infer<typeof validationIssueSchema>;\n\n/** The loosest shape this needs from a Zod issue, so it works across 4.x. */\ninterface ZodIssueLike {\n  path: readonly PropertyKey[];\n  code: string;\n  message: string;\n  minimum?: unknown;\n  maximum?: unknown;\n  origin?: unknown;\n  format?: unknown;\n}\n\nconst toNumber = (v: unknown): number | undefined =>\n  typeof v === 'number' ? v : typeof v === 'bigint' ? Number(v) : undefined;\n\n/**\n * A Zod error as the wire shape. Use this on the server for every 400, and on\n * the client to treat its own errors and the server's the same way.\n *\n * `location` is stamped on every issue when given; the server always gives it.\n *\n * Copies a WHITELIST of fields (see the module note). A path segment that is a\n * symbol, which JSON cannot carry, becomes its description.\n */\nexport function toValidationIssues(\n  error: { issues: readonly ZodIssueLike[] },\n  location?: RequestPart,\n): ValidationIssue[] {\n  return error.issues.map((issue) => {\n    const out: ValidationIssue = {\n      ...(location ? { location } : {}),\n      path: issue.path.map((p) =>\n        typeof p === 'number' ? p : typeof p === 'string' ? p : String(p.description ?? ''),\n      ),\n      code: issue.code,\n      message: issue.message,\n    };\n    const minimum = toNumber(issue.minimum);\n    const maximum = toNumber(issue.maximum);\n    if (minimum !== undefined) out.minimum = minimum;\n    if (maximum !== undefined) out.maximum = maximum;\n    if (typeof issue.origin === 'string') out.origin = issue.origin;\n    if (typeof issue.format === 'string') out.format = issue.format;\n    return out;\n  });\n}\n"]}

package/dist/domains/account/account.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The member's Founder Circle account
+ * ===================================
+ * Deleting it is PER PRODUCT. It removes the member from Founder Circle and
+ * leaves their central-auth account, and every other product they use,
+ * exactly as it was. Central auth deleting the whole account arrives here as
+ * its `user.deleted` webhook and has the same outcome.
+ *
+ * @module founder-schema/domains/account
+ */
+import { z } from 'zod';
+/**
+ * `DELETE /api/v1/users/me`. No body: the confirmation (typing the account's
+ * email) is the client's, and the server's check is the signed-in session.
+ *
+ * What it does, all of it before it answers:
+ *   - the founder profile stops being listed or reachable;
+ *   - the member's posts, polls and comments are deleted, and the comment
+ *     counts on other people's posts go down with them;
+ *   - their reactions, bookmarks and their votes on polls still open are
+ *     withdrawn (a closed poll's result is final and is not rewritten);
+ *   - their messages are erased from chat and they leave every conversation;
+ *   - every image they uploaded (their photo, their posts' images) is deleted
+ *     from storage, so a copied image link stops working too;
+ *   - the onboarding draft is discarded.
+ *
+ * Signing in to Founder Circle again later starts a NEW, empty account.
+ *
+ * Refusals: `SERVICE_UNAVAILABLE` (503) when the chat server could not erase
+ * the messages. NOTHING was deleted then, and retrying is safe.
+ * `RATE_LIMITED` (429). `UNAUTHORIZED` / `TOKEN_EXPIRED` /
+ * `SESSION_INVALIDATED` (401) and `FORBIDDEN` (403, an account that is not
+ * active) as for every signed-in call.
+ *
+ * The client signs out after a success: the account is gone, the cookies on
+ * the device are not.
+ */
+export declare const deleteAccountResponseSchema: z.ZodObject<{
+    deleted: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type DeleteAccountResponse = z.infer<typeof deleteAccountResponseSchema>;
+//# sourceMappingURL=account.d.ts.map

package/dist/domains/account/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/domains/account/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/domains/account/account.js

@@ -0,0 +1,41 @@
+/**
+ * The member's Founder Circle account
+ * ===================================
+ * Deleting it is PER PRODUCT. It removes the member from Founder Circle and
+ * leaves their central-auth account, and every other product they use,
+ * exactly as it was. Central auth deleting the whole account arrives here as
+ * its `user.deleted` webhook and has the same outcome.
+ *
+ * @module founder-schema/domains/account
+ */
+import { z } from 'zod';
+/**
+ * `DELETE /api/v1/users/me`. No body: the confirmation (typing the account's
+ * email) is the client's, and the server's check is the signed-in session.
+ *
+ * What it does, all of it before it answers:
+ *   - the founder profile stops being listed or reachable;
+ *   - the member's posts, polls and comments are deleted, and the comment
+ *     counts on other people's posts go down with them;
+ *   - their reactions, bookmarks and their votes on polls still open are
+ *     withdrawn (a closed poll's result is final and is not rewritten);
+ *   - their messages are erased from chat and they leave every conversation;
+ *   - every image they uploaded (their photo, their posts' images) is deleted
+ *     from storage, so a copied image link stops working too;
+ *   - the onboarding draft is discarded.
+ *
+ * Signing in to Founder Circle again later starts a NEW, empty account.
+ *
+ * Refusals: `SERVICE_UNAVAILABLE` (503) when the chat server could not erase
+ * the messages. NOTHING was deleted then, and retrying is safe.
+ * `RATE_LIMITED` (429). `UNAUTHORIZED` / `TOKEN_EXPIRED` /
+ * `SESSION_INVALIDATED` (401) and `FORBIDDEN` (403, an account that is not
+ * active) as for every signed-in call.
+ *
+ * The client signs out after a success: the account is gone, the cookies on
+ * the device are not.
+ */
+export const deleteAccountResponseSchema = z.object({
+    deleted: z.literal(true),
+});
+//# sourceMappingURL=account.js.map

package/dist/domains/account/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/domains/account/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACzB,CAAC,CAAC","sourcesContent":["/**\n * The member's Founder Circle account\n * ===================================\n * Deleting it is PER PRODUCT. It removes the member from Founder Circle and\n * leaves their central-auth account, and every other product they use,\n * exactly as it was. Central auth deleting the whole account arrives here as\n * its `user.deleted` webhook and has the same outcome.\n *\n * @module founder-schema/domains/account\n */\n\nimport { z } from 'zod';\n\n/**\n * `DELETE /api/v1/users/me`. No body: the confirmation (typing the account's\n * email) is the client's, and the server's check is the signed-in session.\n *\n * What it does, all of it before it answers:\n *   - the founder profile stops being listed or reachable;\n *   - the member's posts, polls and comments are deleted, and the comment\n *     counts on other people's posts go down with them;\n *   - their reactions, bookmarks and their votes on polls still open are\n *     withdrawn (a closed poll's result is final and is not rewritten);\n *   - their messages are erased from chat and they leave every conversation;\n *   - every image they uploaded (their photo, their posts' images) is deleted\n *     from storage, so a copied image link stops working too;\n *   - the onboarding draft is discarded.\n *\n * Signing in to Founder Circle again later starts a NEW, empty account.\n *\n * Refusals: `SERVICE_UNAVAILABLE` (503) when the chat server could not erase\n * the messages. NOTHING was deleted then, and retrying is safe.\n * `RATE_LIMITED` (429). `UNAUTHORIZED` / `TOKEN_EXPIRED` /\n * `SESSION_INVALIDATED` (401) and `FORBIDDEN` (403, an account that is not\n * active) as for every signed-in call.\n *\n * The client signs out after a success: the account is gone, the cookies on\n * the device are not.\n */\nexport const deleteAccountResponseSchema = z.object({\n  deleted: z.literal(true),\n});\nexport type DeleteAccountResponse = z.infer<typeof deleteAccountResponseSchema>;\n"]}

package/dist/domains/audit/audit.d.ts

@@ -0,0 +1,169 @@
+/**
+ * founder-schema: the audit log
+ *
+ *   GET /api/v1/audit   staff actions, newest first
+ *
+ * Every action a staff member takes on a MEMBER or on what a member wrote
+ * (roles, MPIN resets, suspensions, moderation decisions, taking and closing
+ * tickets) is written here, at the moment it happens, by the server: who did
+ * it, AS WHICH ROLE, what they did, to what, and anything that explains it.
+ * The support team's own library (saved replies) is not a member's, so its
+ * edits are not entries. Entries are never edited or
+ * deleted. It is how a dispute ("who removed my post, and why") gets an
+ * answer, and how a misused staff account is noticed.
+ *
+ * WHO READS WHAT is the reader's permissions, applied to the query: a
+ * superadmin reads every entry; any other staff role reads the entries it
+ * wrote itself (its History).
+ *
+ * The action list grows with the staff features; it never shrinks, because an
+ * old entry must still parse.
+ *
+ * @module founder-schema/domains/audit
+ */
+import { z } from 'zod';
+export declare const AUDIT_ACTION_VALUES: readonly ["role.granted", "role.revoked", "mpin.cleared", "content.removed", "content.hidden", "content.restored", "report.dismissed", "member.suspended", "member.unsuspended", "ticket.claimed", "ticket.resolved"];
+export declare const auditActionSchema: z.ZodEnum<{
+    "role.granted": "role.granted";
+    "role.revoked": "role.revoked";
+    "mpin.cleared": "mpin.cleared";
+    "content.removed": "content.removed";
+    "content.hidden": "content.hidden";
+    "content.restored": "content.restored";
+    "report.dismissed": "report.dismissed";
+    "member.suspended": "member.suspended";
+    "member.unsuspended": "member.unsuspended";
+    "ticket.claimed": "ticket.claimed";
+    "ticket.resolved": "ticket.resolved";
+}>;
+export type AuditAction = z.infer<typeof auditActionSchema>;
+/**
+ * Who did it. A person, acting as one of their roles; or a server script, which
+ * is the only way a superadmin is ever made.
+ */
+export declare const auditActorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"staff">;
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    displayName: z.ZodString;
+    actingAs: z.ZodEnum<{
+        superadmin: "superadmin";
+        manager: "manager";
+        moderator: "moderator";
+        support_agent: "support_agent";
+        member: "member";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"script">;
+    name: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type AuditActor = z.infer<typeof auditActorSchema>;
+export declare const auditEntrySchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"staff">;
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        displayName: z.ZodString;
+        actingAs: z.ZodEnum<{
+            superadmin: "superadmin";
+            manager: "manager";
+            moderator: "moderator";
+            support_agent: "support_agent";
+            member: "member";
+        }>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"script">;
+        name: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    action: z.ZodEnum<{
+        "role.granted": "role.granted";
+        "role.revoked": "role.revoked";
+        "mpin.cleared": "mpin.cleared";
+        "content.removed": "content.removed";
+        "content.hidden": "content.hidden";
+        "content.restored": "content.restored";
+        "report.dismissed": "report.dismissed";
+        "member.suspended": "member.suspended";
+        "member.unsuspended": "member.unsuspended";
+        "ticket.claimed": "ticket.claimed";
+        "ticket.resolved": "ticket.resolved";
+    }>;
+    target: z.ZodObject<{
+        subject: z.ZodEnum<{
+            all: "all";
+            Dashboard: "Dashboard";
+            Member: "Member";
+            FounderProfile: "FounderProfile";
+            Post: "Post";
+            Poll: "Poll";
+            Comment: "Comment";
+            Report: "Report";
+            SupportTicket: "SupportTicket";
+            SavedReply: "SavedReply";
+            PlatformRole: "PlatformRole";
+            AuditEntry: "AuditEntry";
+            PlatformSettings: "PlatformSettings";
+        }>;
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        label: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    detail: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+    at: z.ZodISODateTime;
+}, z.core.$strip>;
+export type AuditEntry = z.infer<typeof auditEntrySchema>;
+export declare const auditPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"staff">;
+            id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            displayName: z.ZodString;
+            actingAs: z.ZodEnum<{
+                superadmin: "superadmin";
+                manager: "manager";
+                moderator: "moderator";
+                support_agent: "support_agent";
+                member: "member";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"script">;
+            name: z.ZodString;
+        }, z.core.$strip>], "kind">;
+        action: z.ZodEnum<{
+            "role.granted": "role.granted";
+            "role.revoked": "role.revoked";
+            "mpin.cleared": "mpin.cleared";
+            "content.removed": "content.removed";
+            "content.hidden": "content.hidden";
+            "content.restored": "content.restored";
+            "report.dismissed": "report.dismissed";
+            "member.suspended": "member.suspended";
+            "member.unsuspended": "member.unsuspended";
+            "ticket.claimed": "ticket.claimed";
+            "ticket.resolved": "ticket.resolved";
+        }>;
+        target: z.ZodObject<{
+            subject: z.ZodEnum<{
+                all: "all";
+                Dashboard: "Dashboard";
+                Member: "Member";
+                FounderProfile: "FounderProfile";
+                Post: "Post";
+                Poll: "Poll";
+                Comment: "Comment";
+                Report: "Report";
+                SupportTicket: "SupportTicket";
+                SavedReply: "SavedReply";
+                PlatformRole: "PlatformRole";
+                AuditEntry: "AuditEntry";
+                PlatformSettings: "PlatformSettings";
+            }>;
+            id: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+            label: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        detail: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+        at: z.ZodISODateTime;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuditPage = z.infer<typeof auditPageSchema>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/domains/audit/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/domains/audit/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB,uNAuBtB,CAAC;AACX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAA8B,CAAC;AAC7D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;2BAc3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAoC,CAAC;AACjE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}