@odla-ai/chapter 0.0.2 → 0.4.0

package/dist/index.js

@@ -19,6 +19,14 @@ var admins = {
     note: attr("string", { optional: true })
   }
 };
+var superAdmins = {
+  attrs: {
+    id: id(),
+    email: attr("string", { unique: true, indexed: true }),
+    note: attr("string", { optional: true }),
+    createdAt: attr("number", { indexed: true })
+  }
+};
 var applications = {
   attrs: {
     id: id(),
@@ -106,8 +114,16 @@ var emailLog = {
     sentAt: attr("number", { indexed: true })
   }
 };
-function chapterDb(mode) {
-  const entities = mode === "hub" ? { admins } : { admins, applications, groups, meetings, emailLog };
+function chapterDb(mode, auth) {
+  const entities = {};
+  if (mode === "chapter") {
+    entities.applications = applications;
+    entities.groups = groups;
+    entities.meetings = meetings;
+    entities.emailLog = emailLog;
+  }
+  if (auth.source === "table") entities.admins = admins;
+  if (auth.superAdmins) entities.superAdmins = superAdmins;
   const schema = { entities, links: {} };
   const rules = {};
   for (const ns of Object.keys(entities)) {
@@ -264,6 +280,168 @@ function buildGroupSeed(config) {
   return row;
 }
 
+// src/auth.ts
+function resolveAuth(mode, auth) {
+  const a = auth ?? {};
+  const source = a.source ?? (mode === "hub" ? "table" : "claim");
+  if (source !== "claim" && source !== "table") {
+    throw new Error(`defineChapter.auth.source: must be "claim" or "table" \u2014 got ${JSON.stringify(a.source)}`);
+  }
+  const claim = a.claim ?? "role";
+  if (typeof claim !== "string" || claim === "") {
+    throw new Error("defineChapter.auth.claim: must be a non-empty string");
+  }
+  const ladder = a.ladder ?? ["provisional", "member", "admin"];
+  if (!Array.isArray(ladder) || ladder.length === 0 || !ladder.every((r) => typeof r === "string" && r !== "")) {
+    throw new Error("defineChapter.auth.ladder: must be a non-empty array of role strings");
+  }
+  const adminRole = ladder[ladder.length - 1];
+  const superAdmins2 = a.superAdmins ?? source === "claim";
+  return { source, claim, ladder, adminRole, superAdmins: superAdmins2 };
+}
+function roleFromClaim(payload, auth) {
+  const raw = payload[auth.claim];
+  return typeof raw === "string" && auth.ladder.includes(raw) ? raw : auth.ladder[0];
+}
+function isAdminRole(role, auth) {
+  return role === auth.adminRole;
+}
+function canChangeRole(ctx) {
+  const { auth } = ctx;
+  if (!auth.ladder.includes(ctx.newRole)) {
+    return { ok: false, status: 400, error: `role must be one of: ${auth.ladder.join(", ")}` };
+  }
+  if (ctx.actorId === ctx.targetId) {
+    return { ok: false, status: 400, error: "you cannot change your own role" };
+  }
+  if (ctx.targetIsSuper && !ctx.actorIsSuper) {
+    return { ok: false, status: 403, error: "this person is a super-admin; their access is managed in odla Studio" };
+  }
+  const touchesAdmin = ctx.newRole === auth.adminRole || ctx.targetCurrentRole === auth.adminRole;
+  if (auth.superAdmins && touchesAdmin && !ctx.actorIsSuper) {
+    return { ok: false, status: 403, error: `only super-admins can create or change an ${auth.adminRole}` };
+  }
+  return { ok: true };
+}
+async function getVaultSecret(db, name) {
+  try {
+    const value = await db.secrets.get(name);
+    return typeof value === "string" && value !== "" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/pipeline.ts
+var DEFAULT_STAGES = [
+  "submitted",
+  "paid_pending_vetting",
+  "call_scheduled",
+  "interviewed",
+  "approved",
+  "declined",
+  "refunded"
+];
+var DEFAULT_BOOKABLE = ["submitted", "paid_pending_vetting", "call_scheduled"];
+var DEFAULT_APPROVABLE = ["paid_pending_vetting", "call_scheduled", "interviewed"];
+function resolvePipeline(p) {
+  const usingDefaults = !p?.stages;
+  const stages = p?.stages ?? [...DEFAULT_STAGES];
+  if (!Array.isArray(stages) || stages.length === 0 || !stages.every((s) => typeof s === "string" && s !== "")) {
+    throw new Error("defineChapter.pipeline.stages: must be a non-empty array of status strings");
+  }
+  if (new Set(stages).size !== stages.length) {
+    throw new Error("defineChapter.pipeline.stages: statuses must be unique");
+  }
+  const initial = p?.initial ?? stages[0];
+  if (!stages.includes(initial)) {
+    throw new Error(`defineChapter.pipeline.initial: "${initial}" is not one of the stages`);
+  }
+  const bookableFrom = p?.bookableFrom ?? (usingDefaults ? [...DEFAULT_BOOKABLE] : []);
+  const approvableFrom = p?.approvableFrom ?? (usingDefaults ? [...DEFAULT_APPROVABLE] : []);
+  for (const [name, subset] of [
+    ["bookableFrom", bookableFrom],
+    ["approvableFrom", approvableFrom]
+  ]) {
+    for (const s of subset) {
+      if (!stages.includes(s)) throw new Error(`defineChapter.pipeline.${name}: "${s}" is not one of the stages`);
+    }
+  }
+  return { stages, bookableFrom, approvableFrom, initial };
+}
+function stageIndex(status, p) {
+  return p.stages.indexOf(status);
+}
+function canTransition(from, to, p) {
+  const fi = p.stages.indexOf(from);
+  const ti = p.stages.indexOf(to);
+  return fi >= 0 && ti >= 0 && ti >= fi;
+}
+function canBook(status, p) {
+  return p.bookableFrom.includes(status);
+}
+function canApprove(status, p) {
+  return p.approvableFrom.includes(status);
+}
+
+// src/member.ts
+var DEFAULT_REQUIRED = ["firstName", "lastName", "email", "referral", "whoYouAre", "message"];
+var DEFAULT_OPTIONAL = ["referralName", "linkedin", "phone", "state"];
+function resolveApplication(a) {
+  const required = a?.required ?? DEFAULT_REQUIRED;
+  const optional = a?.optional ?? DEFAULT_OPTIONAL;
+  for (const [name, arr] of [["required", required], ["optional", optional]]) {
+    if (!Array.isArray(arr) || !arr.every((f) => typeof f === "string" && f !== "")) {
+      throw new Error(`defineChapter.application.${name}: must be an array of field-name strings`);
+    }
+  }
+  return {
+    required,
+    optional,
+    maxLen: a?.maxLen ?? {},
+    defaultMaxLen: a?.defaultMaxLen ?? 2e3,
+    bodyCap: a?.bodyCap ?? 32768
+  };
+}
+async function submitApplication(db, chapter, fields, opts) {
+  const app = chapter.application;
+  for (const f of app.required) {
+    const v = fields[f];
+    if (typeof v !== "string" || v.trim() === "") return { ok: false, error: `${f} is required` };
+  }
+  for (const f of [...app.required, ...app.optional]) {
+    const v = fields[f];
+    const cap = app.maxLen[f] ?? app.defaultMaxLen;
+    if (typeof v === "string" && v.length > cap) return { ok: false, error: `${f} exceeds ${cap} characters` };
+  }
+  const id2 = opts.newId();
+  const row = { id: id2, status: chapter.pipeline.initial, createdAt: opts.now };
+  for (const f of [...app.required, ...app.optional]) {
+    if (typeof fields[f] === "string") row[f] = fields[f].trim();
+  }
+  if (fields.focus !== void 0) row.focus = fields.focus;
+  if (opts.groupId) row.groupId = opts.groupId;
+  const { duplicate } = await db.transact(
+    [{ t: "update", ns: "applications", id: id2, attrs: row }],
+    opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
+  );
+  return { ok: true, id: id2, duplicate, status: chapter.pipeline.initial };
+}
+function joinConfig(group, paymentsReady2) {
+  return {
+    id: group.id,
+    name: group.name,
+    standardPriceCents: group.standardPriceCents ?? 0,
+    foundingDiscountCents: group.foundingDiscountCents ?? 0,
+    disclaimerText: group.disclaimerText ?? "",
+    refundPolicyText: group.refundPolicyText ?? "",
+    trustCopy: group.trustCopy ?? "",
+    commitmentText: group.commitmentText ?? "",
+    normsText: group.normsText ?? "",
+    paymentsReady: paymentsReady2
+  };
+}
+
 // src/config.ts
 var SLUG = /^[a-z0-9][a-z0-9-]{1,62}$/;
 function isResolvedCrm(x) {
@@ -287,7 +465,10 @@ function defineChapter(config) {
       throw new Error("defineChapter.prices.standardCents: required in chapter mode");
     }
   }
-  const { schema, rules } = chapterDb(mode);
+  const auth = resolveAuth(mode, config.auth);
+  const pipeline = resolvePipeline(config.pipeline);
+  const application = resolveApplication(config.application);
+  const { schema, rules } = chapterDb(mode, auth);
   const services = config.services ?? ["db", "calendar", "o11y"];
   const chapter = {
     config,
@@ -295,6 +476,9 @@ function defineChapter(config) {
     name,
     mode,
     crm,
+    auth,
+    pipeline,
+    application,
     schema,
     rules,
     services,
@@ -335,11 +519,355 @@ function createChapterIntegration(chapter, options = {}) {
     probes: [...crmDesc.probes ?? []]
   };
 }
+
+// src/email.ts
+function render(template, vars) {
+  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
+}
+function groupVars(group, vars) {
+  return {
+    ...vars,
+    refundPolicyText: group.refundPolicyText ?? "",
+    commitmentText: group.commitmentText ?? "",
+    normsText: group.normsText ?? ""
+  };
+}
+function renderTemplateBody(group, template, vars) {
+  const tpl = group.emailTemplates?.[template];
+  if (!tpl) return null;
+  return render(tpl.text, groupVars(group, vars));
+}
+function isAlreadySent(priorRows) {
+  return priorRows.some((row) => !row.error);
+}
+function planDelivery(input) {
+  const tpl = input.group.emailTemplates?.[input.template];
+  if (!tpl) return { deliver: false, reason: "template-missing" };
+  if (tpl.enabled === false && !input.force) return { deliver: false, reason: "disabled" };
+  const vars = groupVars(input.group, input.vars);
+  const isProd = input.envName === "prod";
+  const redirect = !isProd && !!input.group.debugEmail;
+  const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
+  const to = redirect ? input.group.debugEmail : input.to;
+  const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
+  const text = redirect ? `(dev redirect; original recipient: ${input.to})
+
+` + render(tpl.text, vars) : render(tpl.text, vars);
+  return { deliver: true, transport, to, subject, text, redirected: redirect };
+}
+
+// src/payments.ts
+function parseSigHeader(header) {
+  const parts = {};
+  for (const p of header.split(",")) {
+    const [k, v] = p.split("=", 2);
+    if (k && v !== void 0) parts[k] = v;
+  }
+  return { t: parts.t, v1: parts.v1 };
+}
+function toHex(buf) {
+  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function verifyStripeSignature(payload, header, secret, opts = {}) {
+  const { t, v1 } = parseSigHeader(header);
+  if (!t || !v1) return false;
+  const ts = Number(t);
+  if (!Number.isFinite(ts)) return false;
+  const nowSec = (opts.now ?? Date.now()) / 1e3;
+  const tolerance = opts.toleranceSec ?? 300;
+  if (Math.abs(nowSec - ts) > tolerance) return false;
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const mac = await crypto.subtle.sign("HMAC", key, enc.encode(`${t}.${payload}`));
+  return timingSafeEqual(toHex(mac), v1);
+}
+function paymentsReady(group, hasSecretKey) {
+  return Boolean(group.stripePublishableKey && group.stripePriceId && hasSecretKey);
+}
+function stripeForm(params) {
+  const out = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v === void 0 || v === null) continue;
+    if (typeof v === "object") {
+      for (const [k2, v2] of Object.entries(v)) {
+        if (v2 !== void 0 && v2 !== null) out.append(`${k}[${k2}]`, String(v2));
+      }
+    } else {
+      out.append(k, String(v));
+    }
+  }
+  return out.toString();
+}
+function subscriptionIdempotencyKey(applicationId) {
+  return `sub:${applicationId}`;
+}
+function webhookMutationId(eventId) {
+  return `stripe:${eventId}`;
+}
+function findApplicationRef(obj) {
+  const metaOf = (v) => v && typeof v === "object" ? v.metadata ?? {} : {};
+  const pick = (m) => typeof m.applicationId === "string" ? m.applicationId : void 0;
+  const applicationId = pick(metaOf(obj)) ?? pick(metaOf(obj.subscription_details)) ?? pick(metaOf(obj.parent?.subscription_details));
+  const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
+  return { ...applicationId ? { applicationId } : {}, ...customerId ? { customerId } : {} };
+}
+function normalizeWebhookEvent(event) {
+  const obj = event.data?.object ?? {};
+  const ref = findApplicationRef(obj);
+  switch (event.type) {
+    case "invoice.paid": {
+      const lines = obj.lines?.data ?? [];
+      const periodEnd = lines[0]?.period?.end;
+      const renewalAt = typeof periodEnd === "number" ? periodEnd * 1e3 : void 0;
+      const kind = obj.billing_reason === "subscription_create" ? "first_payment" : "renewal";
+      return { kind, ...ref, ...renewalAt !== void 0 ? { renewalAt } : {} };
+    }
+    case "charge.refunded":
+      return { kind: "refunded", ...ref };
+    case "customer.subscription.deleted":
+      return { kind: "canceled", ...ref };
+    default:
+      return { kind: "ignored", type: event.type };
+  }
+}
+function firstPaymentPatch(currentStatus, renewalAt) {
+  return {
+    ...currentStatus === "submitted" ? { status: "paid_pending_vetting" } : {},
+    ...renewalAt !== void 0 ? { renewalAt } : {}
+  };
+}
+function renewalPatch(renewalAt) {
+  return { renewalAt };
+}
+function refundedPatch() {
+  return { status: "refunded" };
+}
+function canceledPatch() {
+  return { canceled: true };
+}
+
+// src/network.ts
+import { createRecord, updateRecord } from "@odla-ai/crm";
+function sharedPersonInput(person) {
+  const email = person.email.toLowerCase();
+  const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
+  const input = { name: person.name ?? fullName ?? email, email };
+  if (input.name === "") input.name = email;
+  if (person.firstName) input.firstName = person.firstName;
+  if (person.lastName) input.lastName = person.lastName;
+  if (person.phone) input.phone = person.phone;
+  if (person.linkedin) input.linkedin = person.linkedin;
+  return input;
+}
+async function projectSharedRecord(deps, person) {
+  const email = person.email.toLowerCase();
+  const input = sharedPersonInput(person);
+  const crmDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const { crm_record } = await deps.db.query({
+    crm_record: { $: { where: { type: "person", primaryEmail: email }, limit: 1 } }
+  });
+  const existing = crm_record?.[0];
+  if (existing && typeof existing.id === "string") {
+    await updateRecord(crmDeps, { id: existing.id, input });
+    return { recordId: existing.id };
+  }
+  const created = await createRecord(crmDeps, { type: "person", input, mutationId: `share:${person.hubRecordId}` });
+  return { recordId: created.id };
+}
+
+// src/session.ts
+function applicationSummary(app) {
+  return {
+    id: app.id,
+    firstName: app.firstName ?? null,
+    lastName: app.lastName ?? null,
+    email: app.email ?? null,
+    status: app.status,
+    createdAt: app.createdAt ?? null,
+    meetingLink: app.meetingLink ?? null,
+    paid: Boolean(app.stripeSubscriptionId) && app.status !== "refunded",
+    renewalAt: app.renewalAt ?? null,
+    canceled: app.canceled === true
+  };
+}
+function memberApplication(app, meeting, defaultTimezone) {
+  const summary = applicationSummary(app);
+  let meetingAt = app.meetingAt ?? null;
+  let meetUrl = null;
+  let timezone = defaultTimezone;
+  if (meeting) {
+    timezone = meeting.timezone ?? timezone;
+    if (meeting.status === "scheduled") {
+      meetingAt = meeting.startAt ?? null;
+      meetUrl = meeting.meetUrl ?? null;
+    } else {
+      meetingAt = null;
+    }
+  }
+  return { ...summary, meetingAt, meetUrl, timezone };
+}
+function memberSession(user, opts) {
+  return {
+    userId: user.userId,
+    email: user.email ?? null,
+    role: user.role,
+    superAdmin: opts.superAdmin,
+    application: opts.application
+  };
+}
+
+// src/scheduling.ts
+var SCHEDULING_DEFAULTS = {
+  slotMinutes: 45,
+  days: [1, 2, 3, 4, 5],
+  startHour: 9,
+  endHour: 17,
+  timezone: "America/Los_Angeles",
+  minNoticeHours: 24,
+  windowDays: 14,
+  summaryTemplate: "Introduction call with {{firstName}} {{lastName}}"
+};
+function isValidTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat(void 0, { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveScheduling(config) {
+  const d = config ?? {};
+  const c = {
+    slotMinutes: d.slotMinutes ?? SCHEDULING_DEFAULTS.slotMinutes,
+    days: d.days ?? SCHEDULING_DEFAULTS.days,
+    startHour: d.startHour ?? SCHEDULING_DEFAULTS.startHour,
+    endHour: d.endHour ?? SCHEDULING_DEFAULTS.endHour,
+    timezone: d.timezone ?? SCHEDULING_DEFAULTS.timezone,
+    minNoticeHours: d.minNoticeHours ?? SCHEDULING_DEFAULTS.minNoticeHours,
+    windowDays: d.windowDays ?? SCHEDULING_DEFAULTS.windowDays,
+    summaryTemplate: d.summaryTemplate ?? SCHEDULING_DEFAULTS.summaryTemplate
+  };
+  const fail = (msg) => {
+    throw new Error(`scheduling: ${msg}`);
+  };
+  if (!(c.slotMinutes >= 15 && c.slotMinutes <= 240)) fail("slotMinutes must be 15\u2013240");
+  if (!(c.windowDays >= 1 && c.windowDays <= 62)) fail("windowDays must be 1\u201362 (FreeBusy caps at 62)");
+  if (!(c.minNoticeHours >= 0 && c.minNoticeHours <= 336)) fail("minNoticeHours must be 0\u2013336");
+  if (!(c.startHour >= 0 && c.startHour < c.endHour && c.endHour <= 24)) fail("require 0 \u2264 startHour < endHour \u2264 24");
+  const days = [...c.days];
+  if (!days.length || !days.every((n) => Number.isInteger(n) && n >= 0 && n <= 6)) {
+    fail("days must be a non-empty list of weekday integers 0\u20136");
+  }
+  if (typeof c.timezone !== "string" || !isValidTimeZone(c.timezone)) fail(`invalid IANA timezone "${c.timezone}"`);
+  if (typeof c.summaryTemplate !== "string") fail("summaryTemplate must be a string");
+  return { ...c, days };
+}
+var BOOKABLE_STATUSES = ["submitted", "paid_pending_vetting", "call_scheduled"];
+function canBookFrom(status) {
+  return BOOKABLE_STATUSES.includes(status);
+}
+function slotWindow(now, windowDays) {
+  return { from: now, to: now + windowDays * 864e5 };
+}
+function endForSlot(startAt, slotMinutes) {
+  return startAt + slotMinutes * 6e4;
+}
+function isSlotAvailable(slots, startAt) {
+  return slots.some((s) => s.startAt === startAt);
+}
+function renderSummary(template, app) {
+  return template.replace("{{firstName}}", app.firstName ?? "").replace("{{lastName}}", app.lastName ?? "");
+}
+function bookingDecision(existing) {
+  const eventId = existing?.googleEventId ?? null;
+  return { reschedule: Boolean(eventId), eventId };
+}
+function introIdempotencyKey(applicationId) {
+  return `application:${applicationId}:intro`;
+}
+function meetingCreateRow(i) {
+  return {
+    id: i.meetingId,
+    applicationId: i.applicationId,
+    groupId: i.groupId,
+    startAt: i.startAt,
+    endAt: i.endAt,
+    timezone: i.timezone,
+    status: "scheduled",
+    googleEventId: i.googleEventId,
+    ...i.meetUrl ? { meetUrl: i.meetUrl } : {},
+    ...i.htmlLink ? { htmlLink: i.htmlLink } : {},
+    drift: "none",
+    createdAt: i.createdAt
+  };
+}
+function meetingRescheduleUpdate(startAt, endAt) {
+  return { startAt, endAt, drift: "none" };
+}
+function applicationBookingUpdate(currentStatus, startAt, htmlLink) {
+  return {
+    meetingAt: startAt,
+    ...htmlLink ? { meetingLink: htmlLink } : {},
+    ...currentStatus !== "call_scheduled" ? { status: "call_scheduled" } : {}
+  };
+}
 export {
+  BOOKABLE_STATUSES,
+  SCHEDULING_DEFAULTS,
+  applicationBookingUpdate,
+  applicationSummary,
+  bookingDecision,
   buildGroupSeed,
+  canApprove,
+  canBook,
+  canBookFrom,
+  canChangeRole,
+  canTransition,
+  canceledPatch,
   chapterDb,
   createChapterIntegration,
   defaultCrm,
-  defineChapter
+  defineChapter,
+  endForSlot,
+  findApplicationRef,
+  firstPaymentPatch,
+  getVaultSecret,
+  introIdempotencyKey,
+  isAdminRole,
+  isAlreadySent,
+  isSlotAvailable,
+  joinConfig,
+  meetingCreateRow,
+  meetingRescheduleUpdate,
+  memberApplication,
+  memberSession,
+  normalizeWebhookEvent,
+  paymentsReady,
+  planDelivery,
+  projectSharedRecord,
+  refundedPatch,
+  render,
+  renderSummary,
+  renderTemplateBody,
+  renewalPatch,
+  resolveApplication,
+  resolveAuth,
+  resolvePipeline,
+  resolveScheduling,
+  roleFromClaim,
+  sharedPersonInput,
+  slotWindow,
+  stageIndex,
+  stripeForm,
+  submitApplication,
+  subscriptionIdempotencyKey,
+  verifyStripeSignature,
+  webhookMutationId
 };
 //# sourceMappingURL=index.js.map