@odla-ai/chapter 0.10.1 → 0.11.0

package/README.md

@@ -165,9 +165,20 @@ These bite silently — a smoke test won't catch them:
 - **Disclaimer acknowledgement.** A truthy `disclaimerAck` on the submit body
   (boolean or the string a plain form posts) stamps `disclaimerAckAt` from the
   *server* clock; no ack leaves the attr absent, and a client-supplied
-  `disclaimerAckAt` is ignored. If your join page collects consent, post the flag —
-  an unstamped row is the honest record that nobody acked, so a missing flag
-  fails silently in exactly the way a compliance record must not.
+  `disclaimerAckAt` is ignored.
+
+  Unlike most data loss this is **unreconstructible** — you cannot later
+  determine whether someone checked a box — so the submit response always echoes
+  `disclaimerAckAt` (a number, or `null` when nothing was recorded). Assert it in
+  one integration test and a join page that quietly stops posting the flag can't
+  go unnoticed.
+
+  **If the disclaimer is a compliance record, set
+  `application: { requireDisclaimerAck: true }`** and a submit with no ack is a
+  400 instead of a row with no consent. It defaults to `false` so an upgrade
+  never starts rejecting traffic; enabling it fails *deterministically* on your
+  first test submit, not intermittently in production. Expect this to default to
+  `true` at 1.0.
 - **CRM projection points.** chapter projects the person on application submit
   (`projectApplicant`), not on booking or on webhook status change. If you mirror
   pipeline stage into the CRM, keep those routes.
@@ -177,6 +188,13 @@ These bite silently — a smoke test won't catch them:
 
 ### Install + scope notes
 
+- **Your first admin is seeded in odla Studio, by hand — and the email must be
+  lowercased.** Neither `admins` nor `superAdmins` is ever written by a worker
+  route or a provisioning seed; that is deliberate, so nothing running in the app
+  (or injected into a page) can grant admin. The gate looks the email up
+  lowercased, so a row saved as `Ada@Example.com` matches nothing and the account
+  silently isn't an admin — with no error to tell you. Save it lowercase, then
+  confirm by signing in, not by looking at the row.
 - **`@odla-ai/auth-clerk` is not a chapter peer.** It is deliberately absent from
   this package's manifest, because only one entry imports it: the worker verifies
   JWTs with `jose` via `ctx.verifyUser`, and `@odla-ai/chapter/ui/member` is

package/dist/index.cjs

@@ -45,6 +45,7 @@ __export(index_exports, {
   findApplicationRef: () => findApplicationRef,
   firstPaymentPatch: () => firstPaymentPatch,
   getVaultSecret: () => getVaultSecret,
+  hasDisclaimerAck: () => hasDisclaimerAck,
   introIdempotencyKey: () => introIdempotencyKey,
   isAdminRole: () => isAdminRole,
   isAlreadySent: () => isAlreadySent,
@@ -486,9 +487,13 @@ function resolveApplication(a) {
     optional,
     maxLen: a?.maxLen ?? {},
     defaultMaxLen: a?.defaultMaxLen ?? 2e3,
-    bodyCap: a?.bodyCap ?? 32768
+    bodyCap: a?.bodyCap ?? 32768,
+    requireDisclaimerAck: a?.requireDisclaimerAck ?? false
   };
 }
+function hasDisclaimerAck(fields) {
+  return fields.disclaimerAck === true || fields.disclaimerAck === "true";
+}
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const profile = {};
@@ -511,6 +516,10 @@ async function submitApplication(db, chapter, fields, opts) {
     const cap = app.maxLen[f] ?? app.defaultMaxLen;
     if (typeof v === "string" && v.length > cap) return { ok: false, error: `${f} exceeds ${cap} characters` };
   }
+  const acked = hasDisclaimerAck(fields);
+  if (app.requireDisclaimerAck && !acked) {
+    return { ok: false, error: "disclaimerAck is required" };
+  }
   const id2 = opts.newId();
   const row = { id: id2, status: chapter.pipeline.initial, createdAt: opts.now };
   for (const f of [...app.required, ...app.optional]) {
@@ -518,12 +527,12 @@ async function submitApplication(db, chapter, fields, opts) {
   }
   if (fields.focus !== void 0) row.focus = fields.focus;
   if (opts.groupId) row.groupId = opts.groupId;
-  if (fields.disclaimerAck === true || fields.disclaimerAck === "true") row.disclaimerAckAt = opts.now;
+  if (acked) row.disclaimerAckAt = opts.now;
   const { duplicate } = await db.transact(
     [{ t: "update", ns: "applications", id: id2, attrs: row }],
     opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
   );
-  return { ok: true, id: id2, duplicate, status: chapter.pipeline.initial };
+  return { ok: true, id: id2, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
 }
 function joinConfig(group, paymentsReady2) {
   return {