gymmonk-schema 0.3.0 → 0.4.0

package/dist/file.d.ts

@@ -0,0 +1,116 @@
+/**
+ * gymmonk-schema — File uploads
+ * =============================
+ * Contracts for the signed-URL upload flow. GymMonk never streams file bytes
+ * through the API: the browser asks the backend for a short-lived v4 signed
+ * PUT URL, uploads straight to Google Cloud Storage, and stores the returned
+ * PERMANENT public URL.
+ *
+ * The download URL is deliberately NOT signed. A signed read URL expires,
+ * which would rot every image reference already written to Mongo; the bucket
+ * instead grants `allUsers` object-viewer and we store the plain public URL.
+ *
+ * Mirrors reform-backend's `shared/schemas/file.schema.ts`.
+ *
+ * @module gymmonk-schema/file
+ */
+import { z } from 'zod';
+/**
+ * Every folder an upload may target. This is an allow-list, not a hint: the
+ * backend rejects anything outside it, so a compromised client cannot scatter
+ * objects across the bucket. Adding a new upload surface means adding it here
+ * FIRST, then publishing the package.
+ *
+ * `userId` is appended by the backend, so the effective path is
+ * `<folder>/<userId>/<timestamp>-<random><ext>`. That per-user prefix is what
+ * makes ownership checkable on cleanup.
+ */
+export declare const UPLOAD_FOLDERS: readonly ["profile-photos", "center-photos", "logos", "member-documents", "equipment-photos", "announcement-media", "exercise-media", "progress-photos", "feedback-media"];
+export declare const uploadFolderSchema: z.ZodEnum<{
+    "profile-photos": "profile-photos";
+    "center-photos": "center-photos";
+    logos: "logos";
+    "member-documents": "member-documents";
+    "equipment-photos": "equipment-photos";
+    "announcement-media": "announcement-media";
+    "exercise-media": "exercise-media";
+    "progress-photos": "progress-photos";
+    "feedback-media": "feedback-media";
+}>;
+export type UploadFolder = z.infer<typeof uploadFolderSchema>;
+/** MIME types the signed-URL endpoint will sign for. */
+export declare const ALLOWED_UPLOAD_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/webp", "image/gif", "application/pdf"];
+export declare const uploadMimeTypeSchema: z.ZodEnum<{
+    "image/jpeg": "image/jpeg";
+    "image/png": "image/png";
+    "image/webp": "image/webp";
+    "image/gif": "image/gif";
+    "application/pdf": "application/pdf";
+}>;
+export type UploadMimeType = z.infer<typeof uploadMimeTypeSchema>;
+/**
+ * Default per-file ceiling, in MB. Validation runs on the RAW pick, before the
+ * client-side optimizer shrinks it — a modern phone camera produces 8-12 MB
+ * JPEGs that compress to well under 1 MB, so a tighter cap would reject
+ * perfectly ordinary photos.
+ */
+export declare const MAX_UPLOAD_SIZE_MB = 10;
+/** Per-folder overrides. Documents may be larger scans than a photo. */
+export declare const FOLDER_MAX_SIZE_MB: Partial<Record<UploadFolder, number>>;
+/**
+ * Request body for `POST /api/v1/files/signed-url`.
+ *
+ * `fileName` is restricted to a safe charset because it becomes part of the GCS
+ * object path — the client sanitises before sending, and this rejects anything
+ * that slipped through (path separators, control characters, unicode tricks).
+ */
+export declare const signedUploadUrlBodySchema: z.ZodObject<{
+    fileName: z.ZodString;
+    contentType: z.ZodEnum<{
+        "image/jpeg": "image/jpeg";
+        "image/png": "image/png";
+        "image/webp": "image/webp";
+        "image/gif": "image/gif";
+        "application/pdf": "application/pdf";
+    }>;
+    folder: z.ZodEnum<{
+        "profile-photos": "profile-photos";
+        "center-photos": "center-photos";
+        logos: "logos";
+        "member-documents": "member-documents";
+        "equipment-photos": "equipment-photos";
+        "announcement-media": "announcement-media";
+        "exercise-media": "exercise-media";
+        "progress-photos": "progress-photos";
+        "feedback-media": "feedback-media";
+    }>;
+    fileSize: z.ZodNumber;
+}, z.core.$strip>;
+export type SignedUploadUrlBody = z.infer<typeof signedUploadUrlBodySchema>;
+/** Response of `POST /api/v1/files/signed-url`. */
+export declare const signedUploadUrlResponseSchema: z.ZodObject<{
+    uploadUrl: z.ZodString;
+    downloadUrl: z.ZodString;
+    filePath: z.ZodString;
+    expiresAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type SignedUploadUrlResponse = z.infer<typeof signedUploadUrlResponseSchema>;
+/**
+ * Body for `POST /api/v1/files/cleanup-uploads`. Called when a user removes a
+ * photo they uploaded but never saved, so the orphaned object does not sit in
+ * the bucket forever.
+ *
+ * Ownership is enforced per-path from the `userId` segment the backend embedded
+ * at signing time. Paths belonging to someone else are skipped silently rather
+ * than 403-ing, so one foreign entry cannot void a legitimate batch.
+ */
+export declare const cleanupUploadsBodySchema: z.ZodObject<{
+    filePaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type CleanupUploadsBody = z.infer<typeof cleanupUploadsBodySchema>;
+export declare const cleanupUploadsResponseSchema: z.ZodObject<{
+    deleted: z.ZodNumber;
+    skipped: z.ZodNumber;
+}, z.core.$strip>;
+export type CleanupUploadsResponse = z.infer<typeof cleanupUploadsResponseSchema>;
+//# sourceMappingURL=file.d.ts.map

package/dist/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../src/file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,4KAmBjB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;;;;;;;EAAyB,CAAC;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,oFAM5B,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;EAAoC,CAAC;AACtE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAEpE,CAAC;AAMF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;iBA0BlC,CAAC;AAEL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,mDAAmD;AACnD,eAAO,MAAM,6BAA6B;;;;;iBAUxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/file.js

@@ -0,0 +1,137 @@
+/**
+ * gymmonk-schema — File uploads
+ * =============================
+ * Contracts for the signed-URL upload flow. GymMonk never streams file bytes
+ * through the API: the browser asks the backend for a short-lived v4 signed
+ * PUT URL, uploads straight to Google Cloud Storage, and stores the returned
+ * PERMANENT public URL.
+ *
+ * The download URL is deliberately NOT signed. A signed read URL expires,
+ * which would rot every image reference already written to Mongo; the bucket
+ * instead grants `allUsers` object-viewer and we store the plain public URL.
+ *
+ * Mirrors reform-backend's `shared/schemas/file.schema.ts`.
+ *
+ * @module gymmonk-schema/file
+ */
+import { z } from 'zod';
+// ─── Folders ─────────────────────────────────────────────────────────────────
+/**
+ * Every folder an upload may target. This is an allow-list, not a hint: the
+ * backend rejects anything outside it, so a compromised client cannot scatter
+ * objects across the bucket. Adding a new upload surface means adding it here
+ * FIRST, then publishing the package.
+ *
+ * `userId` is appended by the backend, so the effective path is
+ * `<folder>/<userId>/<timestamp>-<random><ext>`. That per-user prefix is what
+ * makes ownership checkable on cleanup.
+ */
+export const UPLOAD_FOLDERS = [
+    /** Member + owner + staff avatars. Square, cropped round in the UI. */
+    'profile-photos',
+    /** Gym/center gallery photos. Multi-select, uncropped. */
+    'center-photos',
+    /** Organisation and center logos. */
+    'logos',
+    /** Member ID proof / address proof captured at the front desk. */
+    'member-documents',
+    /** Equipment photos in the gym inventory. */
+    'equipment-photos',
+    /** Images attached to an announcement. */
+    'announcement-media',
+    /** Custom exercise thumbnails added by a gym. */
+    'exercise-media',
+    /** Progress photos a member uploads against a measurement entry. */
+    'progress-photos',
+    /** Screenshots and photos attached to feedback or a complaint. */
+    'feedback-media',
+];
+export const uploadFolderSchema = z.enum(UPLOAD_FOLDERS);
+// ─── Content types ───────────────────────────────────────────────────────────
+/** MIME types the signed-URL endpoint will sign for. */
+export const ALLOWED_UPLOAD_MIME_TYPES = [
+    'image/jpeg',
+    'image/png',
+    'image/webp',
+    'image/gif',
+    'application/pdf',
+];
+export const uploadMimeTypeSchema = z.enum(ALLOWED_UPLOAD_MIME_TYPES);
+// ─── Size limits ─────────────────────────────────────────────────────────────
+/**
+ * Default per-file ceiling, in MB. Validation runs on the RAW pick, before the
+ * client-side optimizer shrinks it — a modern phone camera produces 8-12 MB
+ * JPEGs that compress to well under 1 MB, so a tighter cap would reject
+ * perfectly ordinary photos.
+ */
+export const MAX_UPLOAD_SIZE_MB = 10;
+/** Per-folder overrides. Documents may be larger scans than a photo. */
+export const FOLDER_MAX_SIZE_MB = {
+    'member-documents': 20,
+};
+const HARD_CAP_MB = Math.max(MAX_UPLOAD_SIZE_MB, ...Object.values(FOLDER_MAX_SIZE_MB));
+// ─── Signed upload URL ───────────────────────────────────────────────────────
+/**
+ * Request body for `POST /api/v1/files/signed-url`.
+ *
+ * `fileName` is restricted to a safe charset because it becomes part of the GCS
+ * object path — the client sanitises before sending, and this rejects anything
+ * that slipped through (path separators, control characters, unicode tricks).
+ */
+export const signedUploadUrlBodySchema = z
+    .object({
+    fileName: z
+        .string()
+        .min(1)
+        .max(255)
+        .regex(/^[a-zA-Z0-9_.-]+$/, 'Invalid file name'),
+    contentType: uploadMimeTypeSchema,
+    folder: uploadFolderSchema,
+    fileSize: z
+        .number()
+        .int()
+        .min(1)
+        .max(HARD_CAP_MB * 1024 * 1024, `File must be smaller than ${HARD_CAP_MB}MB`),
+})
+    .superRefine((data, ctx) => {
+    // Tighten to the per-folder cap. The outer `.max` is only the widest
+    // ceiling any folder allows; this is the one that actually applies.
+    const capMb = FOLDER_MAX_SIZE_MB[data.folder] ?? MAX_UPLOAD_SIZE_MB;
+    if (data.fileSize > capMb * 1024 * 1024) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['fileSize'],
+            message: `File must be smaller than ${capMb}MB for ${data.folder}`,
+        });
+    }
+});
+/** Response of `POST /api/v1/files/signed-url`. */
+export const signedUploadUrlResponseSchema = z.object({
+    /** Short-lived v4 signed URL — PUT the bytes here. */
+    uploadUrl: z.string(),
+    /** Permanent public URL. This is what gets stored in Mongo. */
+    downloadUrl: z.string(),
+    /** Object path inside the bucket, without the bucket prefix. Used to
+     *  delete an object the user abandoned before saving. */
+    filePath: z.string(),
+    /** When `uploadUrl` stops working. */
+    expiresAt: z.iso.datetime(),
+});
+// ─── Cleanup ─────────────────────────────────────────────────────────────────
+/**
+ * Body for `POST /api/v1/files/cleanup-uploads`. Called when a user removes a
+ * photo they uploaded but never saved, so the orphaned object does not sit in
+ * the bucket forever.
+ *
+ * Ownership is enforced per-path from the `userId` segment the backend embedded
+ * at signing time. Paths belonging to someone else are skipped silently rather
+ * than 403-ing, so one foreign entry cannot void a legitimate batch.
+ */
+export const cleanupUploadsBodySchema = z.object({
+    filePaths: z.array(z.string().min(1)).min(1).max(20),
+});
+export const cleanupUploadsResponseSchema = z.object({
+    deleted: z.number().int().min(0),
+    skipped: z.number().int().min(0),
+});
+//# sourceMappingURL=file.js.map

package/dist/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../src/file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,uEAAuE;IACvE,gBAAgB;IAChB,0DAA0D;IAC1D,eAAe;IACf,qCAAqC;IACrC,OAAO;IACP,kEAAkE;IAClE,kBAAkB;IAClB,6CAA6C;IAC7C,kBAAkB;IAClB,0CAA0C;IAC1C,oBAAoB;IACpB,iDAAiD;IACjD,gBAAgB;IAChB,oEAAoE;IACpE,iBAAiB;IACjB,kEAAkE;IAClE,gBAAgB;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAGzD,gFAAgF;AAEhF,wDAAwD;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAGtE,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAA0C;IACvE,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEvF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,6BAA6B,WAAW,IAAI,CAAC;CAChF,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC;IACpE,IAAI,IAAI,CAAC,QAAQ,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,6BAA6B,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,mDAAmD;AACnD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,sDAAsD;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB;6DACyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC","sourcesContent":["/**\n * gymmonk-schema — File uploads\n * =============================\n * Contracts for the signed-URL upload flow. GymMonk never streams file bytes\n * through the API: the browser asks the backend for a short-lived v4 signed\n * PUT URL, uploads straight to Google Cloud Storage, and stores the returned\n * PERMANENT public URL.\n *\n * The download URL is deliberately NOT signed. A signed read URL expires,\n * which would rot every image reference already written to Mongo; the bucket\n * instead grants `allUsers` object-viewer and we store the plain public URL.\n *\n * Mirrors reform-backend's `shared/schemas/file.schema.ts`.\n *\n * @module gymmonk-schema/file\n */\n\nimport { z } from 'zod';\n\n// ─── Folders ─────────────────────────────────────────────────────────────────\n\n/**\n * Every folder an upload may target. This is an allow-list, not a hint: the\n * backend rejects anything outside it, so a compromised client cannot scatter\n * objects across the bucket. Adding a new upload surface means adding it here\n * FIRST, then publishing the package.\n *\n * `userId` is appended by the backend, so the effective path is\n * `<folder>/<userId>/<timestamp>-<random><ext>`. That per-user prefix is what\n * makes ownership checkable on cleanup.\n */\nexport const UPLOAD_FOLDERS = [\n  /** Member + owner + staff avatars. Square, cropped round in the UI. */\n  'profile-photos',\n  /** Gym/center gallery photos. Multi-select, uncropped. */\n  'center-photos',\n  /** Organisation and center logos. */\n  'logos',\n  /** Member ID proof / address proof captured at the front desk. */\n  'member-documents',\n  /** Equipment photos in the gym inventory. */\n  'equipment-photos',\n  /** Images attached to an announcement. */\n  'announcement-media',\n  /** Custom exercise thumbnails added by a gym. */\n  'exercise-media',\n  /** Progress photos a member uploads against a measurement entry. */\n  'progress-photos',\n  /** Screenshots and photos attached to feedback or a complaint. */\n  'feedback-media',\n] as const;\n\nexport const uploadFolderSchema = z.enum(UPLOAD_FOLDERS);\nexport type UploadFolder = z.infer<typeof uploadFolderSchema>;\n\n// ─── Content types ───────────────────────────────────────────────────────────\n\n/** MIME types the signed-URL endpoint will sign for. */\nexport const ALLOWED_UPLOAD_MIME_TYPES = [\n  'image/jpeg',\n  'image/png',\n  'image/webp',\n  'image/gif',\n  'application/pdf',\n] as const;\n\nexport const uploadMimeTypeSchema = z.enum(ALLOWED_UPLOAD_MIME_TYPES);\nexport type UploadMimeType = z.infer<typeof uploadMimeTypeSchema>;\n\n// ─── Size limits ─────────────────────────────────────────────────────────────\n\n/**\n * Default per-file ceiling, in MB. Validation runs on the RAW pick, before the\n * client-side optimizer shrinks it — a modern phone camera produces 8-12 MB\n * JPEGs that compress to well under 1 MB, so a tighter cap would reject\n * perfectly ordinary photos.\n */\nexport const MAX_UPLOAD_SIZE_MB = 10;\n\n/** Per-folder overrides. Documents may be larger scans than a photo. */\nexport const FOLDER_MAX_SIZE_MB: Partial<Record<UploadFolder, number>> = {\n  'member-documents': 20,\n};\n\nconst HARD_CAP_MB = Math.max(MAX_UPLOAD_SIZE_MB, ...Object.values(FOLDER_MAX_SIZE_MB));\n\n// ─── Signed upload URL ───────────────────────────────────────────────────────\n\n/**\n * Request body for `POST /api/v1/files/signed-url`.\n *\n * `fileName` is restricted to a safe charset because it becomes part of the GCS\n * object path — the client sanitises before sending, and this rejects anything\n * that slipped through (path separators, control characters, unicode tricks).\n */\nexport const signedUploadUrlBodySchema = z\n  .object({\n    fileName: z\n      .string()\n      .min(1)\n      .max(255)\n      .regex(/^[a-zA-Z0-9_.-]+$/, 'Invalid file name'),\n    contentType: uploadMimeTypeSchema,\n    folder: uploadFolderSchema,\n    fileSize: z\n      .number()\n      .int()\n      .min(1)\n      .max(HARD_CAP_MB * 1024 * 1024, `File must be smaller than ${HARD_CAP_MB}MB`),\n  })\n  .superRefine((data, ctx) => {\n    // Tighten to the per-folder cap. The outer `.max` is only the widest\n    // ceiling any folder allows; this is the one that actually applies.\n    const capMb = FOLDER_MAX_SIZE_MB[data.folder] ?? MAX_UPLOAD_SIZE_MB;\n    if (data.fileSize > capMb * 1024 * 1024) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['fileSize'],\n        message: `File must be smaller than ${capMb}MB for ${data.folder}`,\n      });\n    }\n  });\n\nexport type SignedUploadUrlBody = z.infer<typeof signedUploadUrlBodySchema>;\n\n/** Response of `POST /api/v1/files/signed-url`. */\nexport const signedUploadUrlResponseSchema = z.object({\n  /** Short-lived v4 signed URL — PUT the bytes here. */\n  uploadUrl: z.string(),\n  /** Permanent public URL. This is what gets stored in Mongo. */\n  downloadUrl: z.string(),\n  /** Object path inside the bucket, without the bucket prefix. Used to\n   *  delete an object the user abandoned before saving. */\n  filePath: z.string(),\n  /** When `uploadUrl` stops working. */\n  expiresAt: z.iso.datetime(),\n});\n\nexport type SignedUploadUrlResponse = z.infer<typeof signedUploadUrlResponseSchema>;\n\n// ─── Cleanup ─────────────────────────────────────────────────────────────────\n\n/**\n * Body for `POST /api/v1/files/cleanup-uploads`. Called when a user removes a\n * photo they uploaded but never saved, so the orphaned object does not sit in\n * the bucket forever.\n *\n * Ownership is enforced per-path from the `userId` segment the backend embedded\n * at signing time. Paths belonging to someone else are skipped silently rather\n * than 403-ing, so one foreign entry cannot void a legitimate batch.\n */\nexport const cleanupUploadsBodySchema = z.object({\n  filePaths: z.array(z.string().min(1)).min(1).max(20),\n});\n\nexport type CleanupUploadsBody = z.infer<typeof cleanupUploadsBodySchema>;\n\nexport const cleanupUploadsResponseSchema = z.object({\n  deleted: z.number().int().min(0),\n  skipped: z.number().int().min(0),\n});\n\nexport type CleanupUploadsResponse = z.infer<typeof cleanupUploadsResponseSchema>;\n"]}

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export * from './common.js';
 export * from './equipment.js';
 export * from './exercise.js';
 export * from './feedback.js';
+export * from './file.js';
 export * from './home.js';
 export * from './insights.js';
 export * from './member.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAE5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAE9B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,sBAAsB,CAAC;AAErC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAE5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAE9B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAE9B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,sBAAsB,CAAC;AAErC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -16,6 +16,8 @@ export * from './equipment.js';
 // ─── Training ────────────────────────────────────────────────────────────────
 export * from './exercise.js';
 export * from './feedback.js';
+// ─── Uploads ─────────────────────────────────────────────────────────────────
+export * from './file.js';
 export * from './home.js';
 export * from './insights.js';
 // ─── People ──────────────────────────────────────────────────────────────────

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,gFAAgF;AAChF,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,gFAAgF;AAChF,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,gFAAgF;AAChF,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,gFAAgF;AAChF,cAAc,sBAAsB,CAAC;AACrC,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC","sourcesContent":["/**\n * gymmonk-schema — Public API\n * ===========================\n * Shared Zod schemas, enums and domain types for GymMonk (fitness SaaS).\n * Single source of truth (SSOT) for data shapes, TypeScript types and\n * validation, consumed by both gymmonk-backend and gymmonk-web-client.\n *\n * Every domain module is re-exported through this barrel. Import names are\n * globally unique across modules, so `export *` composes without collisions.\n */\n\nexport * from './announcement.js';\nexport * from './center.js';\n// ─── Foundation ──────────────────────────────────────────────────────────────\nexport * from './common.js';\nexport * from './equipment.js';\n// ─── Training ────────────────────────────────────────────────────────────────\nexport * from './exercise.js';\nexport * from './feedback.js';\nexport * from './home.js';\nexport * from './insights.js';\n// ─── People ──────────────────────────────────────────────────────────────────\nexport * from './member.js';\nexport * from './member-profile.js';\nexport * from './membership.js';\n// ─── Membership ──────────────────────────────────────────────────────────────\nexport * from './membership-plan.js';\n// ─── Engagement & analytics ──────────────────────────────────────────────────\nexport * from './notification.js';\nexport * from './onboarding.js';\n// ─── Gym structure & onboarding ──────────────────────────────────────────────\nexport * from './organisation.js';\nexport * from './owner-profile.js';\nexport * from './pricing.js';\nexport * from './session.js';\nexport * from './shared.js';\nexport * from './staff.js';\nexport * from './subscription.js';\nexport * from './user.js';\nexport * from './workout-plan.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,gFAAgF;AAChF,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,gFAAgF;AAChF,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,gFAAgF;AAChF,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,gFAAgF;AAChF,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,gFAAgF;AAChF,cAAc,sBAAsB,CAAC;AACrC,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC","sourcesContent":["/**\n * gymmonk-schema — Public API\n * ===========================\n * Shared Zod schemas, enums and domain types for GymMonk (fitness SaaS).\n * Single source of truth (SSOT) for data shapes, TypeScript types and\n * validation, consumed by both gymmonk-backend and gymmonk-web-client.\n *\n * Every domain module is re-exported through this barrel. Import names are\n * globally unique across modules, so `export *` composes without collisions.\n */\n\nexport * from './announcement.js';\nexport * from './center.js';\n// ─── Foundation ──────────────────────────────────────────────────────────────\nexport * from './common.js';\nexport * from './equipment.js';\n// ─── Training ────────────────────────────────────────────────────────────────\nexport * from './exercise.js';\nexport * from './feedback.js';\n// ─── Uploads ─────────────────────────────────────────────────────────────────\nexport * from './file.js';\nexport * from './home.js';\nexport * from './insights.js';\n// ─── People ──────────────────────────────────────────────────────────────────\nexport * from './member.js';\nexport * from './member-profile.js';\nexport * from './membership.js';\n// ─── Membership ──────────────────────────────────────────────────────────────\nexport * from './membership-plan.js';\n// ─── Engagement & analytics ──────────────────────────────────────────────────\nexport * from './notification.js';\nexport * from './onboarding.js';\n// ─── Gym structure & onboarding ──────────────────────────────────────────────\nexport * from './organisation.js';\nexport * from './owner-profile.js';\nexport * from './pricing.js';\nexport * from './session.js';\nexport * from './shared.js';\nexport * from './staff.js';\nexport * from './subscription.js';\nexport * from './user.js';\nexport * from './workout-plan.js';\n"]}

package/dist/onboarding.d.ts

@@ -54,6 +54,7 @@ export declare const memberOnboardingBodySchema: z.ZodObject<{
         "AB+": "AB+";
         "AB-": "AB-";
     }>;
+    avatarUrl: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
 }, z.core.$strip>;
 export type MemberOnboardingBody = z.infer<typeof memberOnboardingBodySchema>;
 /** The owner's personal basics captured before the organisation/center. */
@@ -358,4 +359,64 @@ export declare const ownerOnboardingBodySchema: z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type OwnerOnboardingBody = z.infer<typeof ownerOnboardingBodySchema>;
+/**
+ * In-progress onboarding draft: the UI-shaped, partially-filled form the client
+ * persists so a returning user resumes with their typed data intact. Opaque to
+ * the backend by design — the client owns the form shape, and the data is
+ * re-validated strictly by the member/owner body schemas at finalize. Keys are
+ * form field names; the backend caps the stored size.
+ */
+export declare const onboardingDraftSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export type OnboardingDraft = z.infer<typeof onboardingDraftSchema>;
+/**
+ * The server-persisted onboarding cursor: which role the user picked, how far
+ * they reached (`step`, the 1-indexed sub-step of the current form), the gym a
+ * member chose, and the drafts. Read on app entry to resume to the exact step.
+ * `welcomed` records that the one-time welcome carousel has been seen.
+ */
+export declare const onboardingProgressSchema: z.ZodObject<{
+    welcomed: z.ZodBoolean;
+    role: z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+    }>>;
+    step: z.ZodNumber;
+    gymCode: z.ZodOptional<z.ZodString>;
+    memberDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ownerDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type OnboardingProgress = z.infer<typeof onboardingProgressSchema>;
+/** `PUT /onboarding/progress` body — any subset of the cursor, merged server-side. */
+export declare const onboardingProgressUpdateSchema: z.ZodObject<{
+    welcomed: z.ZodOptional<z.ZodBoolean>;
+    role: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+    }>>>;
+    step: z.ZodOptional<z.ZodNumber>;
+    gymCode: z.ZodOptional<z.ZodString>;
+    memberDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ownerDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type OnboardingProgressUpdate = z.infer<typeof onboardingProgressUpdateSchema>;
+/**
+ * `GET /onboarding/status` response: completion truth (derived from the user's
+ * domain data) plus the resume cursor. `onboarded` is authoritative — an owner
+ * with an organisation, or a member with a profile, is onboarded regardless of
+ * the cursor.
+ */
+export declare const onboardingStatusSchema: z.ZodObject<{
+    onboarded: z.ZodBoolean;
+    role: z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+    }>>;
+    organisationId: z.ZodOptional<z.ZodString>;
+    welcomed: z.ZodBoolean;
+    step: z.ZodNumber;
+    gymCode: z.ZodOptional<z.ZodString>;
+    memberDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ownerDraft: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type OnboardingStatus = z.infer<typeof onboardingStatusSchema>;
 //# sourceMappingURL=onboarding.d.ts.map

package/dist/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,oBAAoB;;;EAA8B,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwBnC,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,mEAAmE;AACnE,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,oBAAoB;;;EAA8B,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BnC,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,mEAAmE;AACnE,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI5E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,wCAAoC,CAAC;AACvE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAOnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAS/B,CAAC;AACb,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBASjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/onboarding.js

@@ -31,6 +31,9 @@ export const memberOnboardingBodySchema = z
     body: bodyMetricsSchema,
     emergencyContact: emergencyContactSchema,
     bloodGroup: bloodGroupSchema,
+    /** Uploaded profile photo → stored on the shared `User.avatar`.
+     *  Mirrors `ownerBasicsSchema.avatarUrl`. */
+    avatarUrl: optionalTrimmedString(2000),
 })
     .refine((v) => v.body.heightCm != null && v.body.weightKg != null, {
     message: 'Height and weight are required',
@@ -71,4 +74,54 @@ export const ownerOnboardingBodySchema = z.object({
     center: createCenterBodySchema,
     subscription: onboardingPlanSelectionSchema,
 });
+// ─── Onboarding progress & resume ─────────────────────────────────────────────
+/**
+ * In-progress onboarding draft: the UI-shaped, partially-filled form the client
+ * persists so a returning user resumes with their typed data intact. Opaque to
+ * the backend by design — the client owns the form shape, and the data is
+ * re-validated strictly by the member/owner body schemas at finalize. Keys are
+ * form field names; the backend caps the stored size.
+ */
+export const onboardingDraftSchema = z.record(z.string(), z.unknown());
+/**
+ * The server-persisted onboarding cursor: which role the user picked, how far
+ * they reached (`step`, the 1-indexed sub-step of the current form), the gym a
+ * member chose, and the drafts. Read on app entry to resume to the exact step.
+ * `welcomed` records that the one-time welcome carousel has been seen.
+ */
+export const onboardingProgressSchema = z.object({
+    welcomed: z.boolean(),
+    role: onboardingRoleSchema.nullable(),
+    step: z.number().int().min(0).max(20),
+    gymCode: gymCodeSchema.optional(),
+    memberDraft: onboardingDraftSchema.optional(),
+    ownerDraft: onboardingDraftSchema.optional(),
+});
+/** `PUT /onboarding/progress` body — any subset of the cursor, merged server-side. */
+export const onboardingProgressUpdateSchema = z
+    .object({
+    welcomed: z.boolean(),
+    role: onboardingRoleSchema.nullable(),
+    step: z.number().int().min(0).max(20),
+    gymCode: gymCodeSchema,
+    memberDraft: onboardingDraftSchema,
+    ownerDraft: onboardingDraftSchema,
+})
+    .partial();
+/**
+ * `GET /onboarding/status` response: completion truth (derived from the user's
+ * domain data) plus the resume cursor. `onboarded` is authoritative — an owner
+ * with an organisation, or a member with a profile, is onboarded regardless of
+ * the cursor.
+ */
+export const onboardingStatusSchema = z.object({
+    onboarded: z.boolean(),
+    role: onboardingRoleSchema.nullable(),
+    organisationId: z.string().optional(),
+    welcomed: z.boolean(),
+    step: z.number().int().min(0),
+    gymCode: z.string().optional(),
+    memberDraft: onboardingDraftSchema.optional(),
+    ownerDraft: onboardingDraftSchema.optional(),
+});
 //# sourceMappingURL=onboarding.js.map

package/dist/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGhE,gFAAgF;AAEhF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,kEAAkE;IAClE,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACnC,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,aAAa;IAClB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,iBAAiB;IACvB,gBAAgB,EAAE,sBAAsB;IACxC,UAAU,EAAE,gBAAgB;CAC7B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;IACjE,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;IAC9D,OAAO,EAAE,6BAA6B;IACtC,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;IAC7D,OAAO,EAAE,8BAA8B;IACvC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CACzB,CAAC,CAAC;AAGL,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACnC,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,mBAAmB;IAC7B,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC;IACnC,OAAO,EAAE,iBAAiB;IAC1B,yEAAyE;IACzE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,mEAAmE;IACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC;CACvC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,iBAAiB;IACxB,YAAY,EAAE,4BAA4B;IAC1C,MAAM,EAAE,sBAAsB;IAC9B,YAAY,EAAE,6BAA6B;CAC5C,CAAC,CAAC","sourcesContent":["/**\n * gymmonk-schema — Onboarding submit payloads\n * ============================================\n * The end-of-flow POST bodies. The frontend forms stay flat (three-part DOB,\n * etc.); at submit they map to these structured payloads, which compose the\n * canonical create schemas so the backend can fan out to the right collections.\n *\n *   member → member-profile + a pending membership (join a gym by code)\n *   owner  → organisation + first center + SaaS subscription selection\n *\n * @module gymmonk-schema/onboarding\n */\n\nimport { z } from 'zod';\nimport { createCenterBodySchema, gymCodeSchema } from './center.js';\nimport {\n  isoDateSchema,\n  optionalEmailSchema,\n  optionalTrimmedString,\n  phoneSchema,\n} from './common.js';\nimport { bodyMetricsSchema, emergencyContactSchema } from './member-profile.js';\nimport { createOrganisationBodySchema } from './organisation.js';\nimport { addressSchema, bloodGroupSchema, genderSchema, socialLinksSchema } from './shared.js';\n\n// ─── Role ────────────────────────────────────────────────────────────────────\n\nexport const onboardingRoleSchema = z.enum(['owner', 'member']);\nexport type OnboardingRole = z.infer<typeof onboardingRoleSchema>;\n\n// ─── Member onboarding ───────────────────────────────────────────────────────\n\nexport const memberOnboardingBodySchema = z\n  .object({\n    /** The gym code the member picked at the \"find your gym\" step. */\n    gymCode: gymCodeSchema,\n    firstName: z.string().trim().min(1, 'First name is required').max(80),\n    lastName: optionalTrimmedString(80),\n    gender: genderSchema,\n    dob: isoDateSchema,\n    phone: phoneSchema,\n    body: bodyMetricsSchema,\n    emergencyContact: emergencyContactSchema,\n    bloodGroup: bloodGroupSchema,\n  })\n  .refine((v) => v.body.heightCm != null && v.body.weightKg != null, {\n    message: 'Height and weight are required',\n    path: ['body'],\n  })\n  .refine((v) => v.body.neckCm != null && v.body.waistCm != null, {\n    message: 'Neck and waist are required',\n    path: ['body'],\n  })\n  .refine((v) => v.gender !== 'female' || v.body.hipsCm != null, {\n    message: 'Hips measurement is required',\n    path: ['body', 'hipsCm'],\n  });\nexport type MemberOnboardingBody = z.infer<typeof memberOnboardingBodySchema>;\n\n// ─── Owner onboarding ────────────────────────────────────────────────────────\n\n/** The owner's personal basics captured before the organisation/center. */\nexport const ownerBasicsSchema = z.object({\n  firstName: z.string().trim().min(1, 'First name is required').max(80),\n  lastName: optionalTrimmedString(80),\n  gender: genderSchema,\n  dob: isoDateSchema.optional(),\n  phone: phoneSchema,\n  altEmail: optionalEmailSchema,\n  website: optionalTrimmedString(200),\n  socials: socialLinksSchema,\n  /** The owner's personal contact address (step-2 of owner onboarding). */\n  address: addressSchema.optional(),\n  /** Uploaded profile photo → stored on the shared `User.avatar`. */\n  avatarUrl: optionalTrimmedString(2000),\n});\nexport type OwnerBasics = z.infer<typeof ownerBasicsSchema>;\n\n/** The SaaS plan an owner selects at the final onboarding step. */\nexport const onboardingPlanSelectionSchema = z.object({\n  planId: z.string().trim().min(1),\n  tenureId: z.string().trim().min(1).nullable(),\n});\nexport type OnboardingPlanSelection = z.infer<typeof onboardingPlanSelectionSchema>;\n\nexport const ownerOnboardingBodySchema = z.object({\n  owner: ownerBasicsSchema,\n  organisation: createOrganisationBodySchema,\n  center: createCenterBodySchema,\n  subscription: onboardingPlanSelectionSchema,\n});\nexport type OwnerOnboardingBody = z.infer<typeof ownerOnboardingBodySchema>;\n"]}
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGhE,gFAAgF;AAEhF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,kEAAkE;IAClE,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACnC,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,aAAa;IAClB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,iBAAiB;IACvB,gBAAgB,EAAE,sBAAsB;IACxC,UAAU,EAAE,gBAAgB;IAC5B;iDAC6C;IAC7C,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC;CACvC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;IACjE,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;IAC9D,OAAO,EAAE,6BAA6B;IACtC,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;IAC7D,OAAO,EAAE,8BAA8B;IACvC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CACzB,CAAC,CAAC;AAGL,gFAAgF;AAEhF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;IACnC,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,mBAAmB;IAC7B,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC;IACnC,OAAO,EAAE,iBAAiB;IAC1B,yEAAyE;IACzE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,mEAAmE;IACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC;CACvC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,iBAAiB;IACxB,YAAY,EAAE,4BAA4B;IAC1C,MAAM,EAAE,sBAAsB;IAC9B,YAAY,EAAE,6BAA6B;CAC5C,CAAC,CAAC;AAGH,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,sFAAsF;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,OAAO,EAAE,aAAa;IACtB,WAAW,EAAE,qBAAqB;IAClC,UAAU,EAAE,qBAAqB;CAClC,CAAC;KACD,OAAO,EAAE,CAAC;AAGb;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC","sourcesContent":["/**\n * gymmonk-schema — Onboarding submit payloads\n * ============================================\n * The end-of-flow POST bodies. The frontend forms stay flat (three-part DOB,\n * etc.); at submit they map to these structured payloads, which compose the\n * canonical create schemas so the backend can fan out to the right collections.\n *\n *   member → member-profile + a pending membership (join a gym by code)\n *   owner  → organisation + first center + SaaS subscription selection\n *\n * @module gymmonk-schema/onboarding\n */\n\nimport { z } from 'zod';\nimport { createCenterBodySchema, gymCodeSchema } from './center.js';\nimport {\n  isoDateSchema,\n  optionalEmailSchema,\n  optionalTrimmedString,\n  phoneSchema,\n} from './common.js';\nimport { bodyMetricsSchema, emergencyContactSchema } from './member-profile.js';\nimport { createOrganisationBodySchema } from './organisation.js';\nimport { addressSchema, bloodGroupSchema, genderSchema, socialLinksSchema } from './shared.js';\n\n// ─── Role ────────────────────────────────────────────────────────────────────\n\nexport const onboardingRoleSchema = z.enum(['owner', 'member']);\nexport type OnboardingRole = z.infer<typeof onboardingRoleSchema>;\n\n// ─── Member onboarding ───────────────────────────────────────────────────────\n\nexport const memberOnboardingBodySchema = z\n  .object({\n    /** The gym code the member picked at the \"find your gym\" step. */\n    gymCode: gymCodeSchema,\n    firstName: z.string().trim().min(1, 'First name is required').max(80),\n    lastName: optionalTrimmedString(80),\n    gender: genderSchema,\n    dob: isoDateSchema,\n    phone: phoneSchema,\n    body: bodyMetricsSchema,\n    emergencyContact: emergencyContactSchema,\n    bloodGroup: bloodGroupSchema,\n    /** Uploaded profile photo → stored on the shared `User.avatar`.\n     *  Mirrors `ownerBasicsSchema.avatarUrl`. */\n    avatarUrl: optionalTrimmedString(2000),\n  })\n  .refine((v) => v.body.heightCm != null && v.body.weightKg != null, {\n    message: 'Height and weight are required',\n    path: ['body'],\n  })\n  .refine((v) => v.body.neckCm != null && v.body.waistCm != null, {\n    message: 'Neck and waist are required',\n    path: ['body'],\n  })\n  .refine((v) => v.gender !== 'female' || v.body.hipsCm != null, {\n    message: 'Hips measurement is required',\n    path: ['body', 'hipsCm'],\n  });\nexport type MemberOnboardingBody = z.infer<typeof memberOnboardingBodySchema>;\n\n// ─── Owner onboarding ────────────────────────────────────────────────────────\n\n/** The owner's personal basics captured before the organisation/center. */\nexport const ownerBasicsSchema = z.object({\n  firstName: z.string().trim().min(1, 'First name is required').max(80),\n  lastName: optionalTrimmedString(80),\n  gender: genderSchema,\n  dob: isoDateSchema.optional(),\n  phone: phoneSchema,\n  altEmail: optionalEmailSchema,\n  website: optionalTrimmedString(200),\n  socials: socialLinksSchema,\n  /** The owner's personal contact address (step-2 of owner onboarding). */\n  address: addressSchema.optional(),\n  /** Uploaded profile photo → stored on the shared `User.avatar`. */\n  avatarUrl: optionalTrimmedString(2000),\n});\nexport type OwnerBasics = z.infer<typeof ownerBasicsSchema>;\n\n/** The SaaS plan an owner selects at the final onboarding step. */\nexport const onboardingPlanSelectionSchema = z.object({\n  planId: z.string().trim().min(1),\n  tenureId: z.string().trim().min(1).nullable(),\n});\nexport type OnboardingPlanSelection = z.infer<typeof onboardingPlanSelectionSchema>;\n\nexport const ownerOnboardingBodySchema = z.object({\n  owner: ownerBasicsSchema,\n  organisation: createOrganisationBodySchema,\n  center: createCenterBodySchema,\n  subscription: onboardingPlanSelectionSchema,\n});\nexport type OwnerOnboardingBody = z.infer<typeof ownerOnboardingBodySchema>;\n\n// ─── Onboarding progress & resume ─────────────────────────────────────────────\n\n/**\n * In-progress onboarding draft: the UI-shaped, partially-filled form the client\n * persists so a returning user resumes with their typed data intact. Opaque to\n * the backend by design — the client owns the form shape, and the data is\n * re-validated strictly by the member/owner body schemas at finalize. Keys are\n * form field names; the backend caps the stored size.\n */\nexport const onboardingDraftSchema = z.record(z.string(), z.unknown());\nexport type OnboardingDraft = z.infer<typeof onboardingDraftSchema>;\n\n/**\n * The server-persisted onboarding cursor: which role the user picked, how far\n * they reached (`step`, the 1-indexed sub-step of the current form), the gym a\n * member chose, and the drafts. Read on app entry to resume to the exact step.\n * `welcomed` records that the one-time welcome carousel has been seen.\n */\nexport const onboardingProgressSchema = z.object({\n  welcomed: z.boolean(),\n  role: onboardingRoleSchema.nullable(),\n  step: z.number().int().min(0).max(20),\n  gymCode: gymCodeSchema.optional(),\n  memberDraft: onboardingDraftSchema.optional(),\n  ownerDraft: onboardingDraftSchema.optional(),\n});\nexport type OnboardingProgress = z.infer<typeof onboardingProgressSchema>;\n\n/** `PUT /onboarding/progress` body — any subset of the cursor, merged server-side. */\nexport const onboardingProgressUpdateSchema = z\n  .object({\n    welcomed: z.boolean(),\n    role: onboardingRoleSchema.nullable(),\n    step: z.number().int().min(0).max(20),\n    gymCode: gymCodeSchema,\n    memberDraft: onboardingDraftSchema,\n    ownerDraft: onboardingDraftSchema,\n  })\n  .partial();\nexport type OnboardingProgressUpdate = z.infer<typeof onboardingProgressUpdateSchema>;\n\n/**\n * `GET /onboarding/status` response: completion truth (derived from the user's\n * domain data) plus the resume cursor. `onboarded` is authoritative — an owner\n * with an organisation, or a member with a profile, is onboarded regardless of\n * the cursor.\n */\nexport const onboardingStatusSchema = z.object({\n  onboarded: z.boolean(),\n  role: onboardingRoleSchema.nullable(),\n  organisationId: z.string().optional(),\n  welcomed: z.boolean(),\n  step: z.number().int().min(0),\n  gymCode: z.string().optional(),\n  memberDraft: onboardingDraftSchema.optional(),\n  ownerDraft: onboardingDraftSchema.optional(),\n});\nexport type OnboardingStatus = z.infer<typeof onboardingStatusSchema>;\n"]}

package/dist/user.d.ts

@@ -20,8 +20,8 @@ export type AppRole = z.infer<typeof appRoleSchema>;
 export declare const userStatusSchema: z.ZodEnum<{
     active: "active";
     inactive: "inactive";
-    suspended: "suspended";
     deleted: "deleted";
+    suspended: "suspended";
 }>;
 export type UserStatus = z.infer<typeof userStatusSchema>;
 export declare const meSchema: z.ZodObject<{
@@ -41,8 +41,8 @@ export declare const meSchema: z.ZodObject<{
     status: z.ZodEnum<{
         active: "active";
         inactive: "inactive";
-        suspended: "suspended";
         deleted: "deleted";
+        suspended: "suspended";
     }>;
     createdAt: z.ZodISODateTime;
     updatedAt: z.ZodISODateTime;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "gymmonk-schema",
-  "version": "0.3.0",
-  "description": "Shared Zod schemas, enums and domain types for GymMonk (fitness SaaS) — single source of truth (SSOT) consumed by gymmonk-backend and gymmonk-web-client.",
+  "version": "0.4.0",
+  "description": "Shared Zod schemas, enums and domain types for GymMonk (fitness SaaS) — single source of truth (SSOT) consumed by gymmonk-backend and gymmonk-web-client.",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",