- Shipped
- November 15, 2026 at 10:02 PM UTC
- Author
- Kamo
- Commit
- b298fcb
- **************** (X-Internal-Auth from APIService; per-visitor limits on X-Real-IP): create returns draftId + one-time edit token (SHA-256 stored) + plan fit; PATCH merges with X-Universe-Draft-Token; plan-fit without a draft. Every field is a wish: invalid values dropped and listed. - Logo fetched server-side through SafeSiteFetcher (public addresses only), type sniffed from bytes, 2 MB cap. - GET **************** only what /start shows; OPEN -> OPENED; 410 spent/expired. - start-organization {otk, universeDraftId}: typed /start values win, the draft fills the rest (universe, colours, logo, website, plan intent into UA.2's org_plan_intents path), address country, language and appSelections for every mapped product (worlds never limit). Spent only after the org exists. - marketing.visitor.org-created carries **************** - UniverseDraftExpiryJob hourly under SingletonTaskRunner: expired drafts wiped, never deleted. CONTRACT §1-2.