@odla-ai/chapter 0.10.1 → 0.12.0

package/dist/index.d.cts

@@ -175,6 +175,32 @@ interface ChapterApplication {
     defaultMaxLen?: number;
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
+    /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
+     *  writing a row with no consent record. Default `false` for back-compat —
+     *  but turn it on if the disclaimer is a compliance record: a missing ack is
+     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
+     *  and surfaces on the first test submit, not intermittently in production. */
+    requireDisclaimerAck?: boolean;
+    /** Allowlist of fields that reach the Clerk account's client-readable
+     *  `public_metadata.profile`. Default (unset) projects every non-identity
+     *  configured field — convenient, but it also exposes free-text and
+     *  third-party fields (`message`, `referral`). Set this to a curated list
+     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
+     *  Expected to become required-in-spirit at 1.0. */
+    profileFields?: readonly string[];
+    /** Extra application fields carried into the one-way CRM projection, on top of
+     *  the built-in identity/contact set. Each MUST be declared on your crm person
+     *  type or the enrichment is dropped (the base person still projects). Default
+     *  none. */
+    crmFields?: readonly string[];
+    /** Cap on the element count of array-valued fields (e.g. `focus`), so a client
+     *  cannot post a 10k-element array into a row or into Clerk metadata.
+     *  Non-primitive elements are dropped. Default 100. */
+    maxArrayLen?: number;
+    /** Validate that a field literally named `email` looks like an email address,
+     *  returning a 400 rather than accepting input the downstream Clerk create will
+     *  reject anyway. Default `true`; a valid application is never newly rejected. */
+    validateEmail?: boolean;
 }
 /** The fully-resolved application config carried on the {@link Chapter}. */
 interface ResolvedApplication {
@@ -183,6 +209,12 @@ interface ResolvedApplication {
     maxLen: Record<string, number>;
     defaultMaxLen: number;
     bodyCap: number;
+    requireDisclaimerAck: boolean;
+    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
+    profileFields: readonly string[] | null;
+    crmFields: readonly string[];
+    maxArrayLen: number;
+    validateEmail: boolean;
 }
 /** The `defineChapter()` config a site fills in. */
 interface ChapterConfig {
@@ -625,20 +657,35 @@ declare function canceledPatch(): {
 
 /** Apply defaults + validate the application config. Throws at import on bad shape. */
 declare function resolveApplication(a: ChapterApplication | undefined): ResolvedApplication;
+/** Whether a string looks like an email address (see {@link EMAIL_RE}). Exported
+ *  so a site building its own submit path applies the same rule chapter does. */
+declare function isValidEmail(value: unknown): boolean;
+/** Bound an array-valued field: drop non-primitive elements and cap the length,
+ *  so a client cannot post an unbounded array. Non-arrays pass through unchanged. */
+declare function clampArray(value: unknown, max: number): unknown;
+/** Whether a submit body carries a genuine disclaimer acknowledgement. Accepts
+ *  the boolean an API client sends and the string a plain HTML form posts. */
+declare function hasDisclaimerAck(fields: Record<string, unknown>): boolean;
 /**
- * The applicant profile written to the Clerk account's `public_metadata.profile`:
- * every configured application field Clerk does not already carry natively, plus
- * `focus`. Derived from `application.required`/`optional`, so a site's own field
- * names project without this package knowing them. Pure; returns `undefined` when
- * there is nothing to write.
+ * The applicant profile written to the Clerk account's client-readable
+ * `public_metadata.profile`. Projects each configured non-identity field, plus
+ * `focus` (clamped) — but ONLY those in `application.profileFields` when that
+ * allowlist is set, so a site keeps confidential fields (`message`, `referral`)
+ * db-only. Derived from config, so a site's own field names project without this
+ * package knowing them. Pure; returns `undefined` when there is nothing to write.
  */
 declare function applicantProfile(chapter: Chapter, fields: Record<string, unknown>): Record<string, unknown> | undefined;
-/** A validated submission, or a 400-worthy validation error the route returns. */
+/** A validated submission, or a 400-worthy validation error the route returns.
+ *  `disclaimerAckAt` reports what THIS request recorded — a number when consent
+ *  was stamped, `null` when none was supplied. It is always present so a missing
+ *  consent record is visible in the response rather than silently absent from a
+ *  row nobody reads until an audit. */
 type SubmitResult = {
     ok: true;
     id: string;
     duplicate: boolean;
     status: string;
+    disclaimerAckAt: number | null;
 } | {
     ok: false;
     error: string;
@@ -707,7 +754,9 @@ interface ProjectionDeps {
 declare function projectSharedRecord(deps: ProjectionDeps, person: SharedPerson): Promise<{
     recordId: string;
 }>;
-/** An arriving applicant, as far as the CRM projection cares. */
+/** An arriving applicant, as far as the CRM projection cares. `extra` carries the
+ *  site-configured `crmFields` (values from the application), merged on top of the
+ *  built-in identity/contact set. */
 interface Applicant {
     applicationId: string;
     email: string;
@@ -715,12 +764,18 @@ interface Applicant {
     lastName?: string;
     phone?: string;
     linkedin?: string;
+    extra?: Record<string, unknown>;
 }
 /**
  * Project an arriving applicant into this chapter's `crm_record`, so a new
  * application shows up in the CRM immediately, unified by email with any prior
  * record. Idempotent per application (`apply:${applicationId}`). Best-effort at
  * the call site — a projection failure never fails the application.
+ *
+ * `extra` fields (a site's `crmFields`) are merged on top of the base person. If
+ * an extra field is not on the crm person type, crm validation throws — so the
+ * projection retries with the base person alone, ensuring a misconfigured
+ * enrichment never silently drops the applicant from the CRM entirely.
  */
 declare function projectApplicant(deps: ProjectionDeps, applicant: Applicant): Promise<{
     recordId: string;
@@ -1016,4 +1071,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretStore, type SessionUser, type SharedPerson, type StripeEvent, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, bookingDecision, brandTokens, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clerkInviteRequest, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, normalizeWebhookEvent, paymentsReady, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, slotWindow, stageIndex, stripeForm, submitApplication, subscriptionIdempotencyKey, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretStore, type SessionUser, type SharedPerson, type StripeEvent, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, bookingDecision, brandTokens, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clampArray, clerkInviteRequest, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, normalizeWebhookEvent, paymentsReady, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, slotWindow, stageIndex, stripeForm, submitApplication, subscriptionIdempotencyKey, validateScheduling, verifyStripeSignature, webhookMutationId };

package/dist/index.d.ts

@@ -175,6 +175,32 @@ interface ChapterApplication {
     defaultMaxLen?: number;
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
+    /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
+     *  writing a row with no consent record. Default `false` for back-compat —
+     *  but turn it on if the disclaimer is a compliance record: a missing ack is
+     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
+     *  and surfaces on the first test submit, not intermittently in production. */
+    requireDisclaimerAck?: boolean;
+    /** Allowlist of fields that reach the Clerk account's client-readable
+     *  `public_metadata.profile`. Default (unset) projects every non-identity
+     *  configured field — convenient, but it also exposes free-text and
+     *  third-party fields (`message`, `referral`). Set this to a curated list
+     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
+     *  Expected to become required-in-spirit at 1.0. */
+    profileFields?: readonly string[];
+    /** Extra application fields carried into the one-way CRM projection, on top of
+     *  the built-in identity/contact set. Each MUST be declared on your crm person
+     *  type or the enrichment is dropped (the base person still projects). Default
+     *  none. */
+    crmFields?: readonly string[];
+    /** Cap on the element count of array-valued fields (e.g. `focus`), so a client
+     *  cannot post a 10k-element array into a row or into Clerk metadata.
+     *  Non-primitive elements are dropped. Default 100. */
+    maxArrayLen?: number;
+    /** Validate that a field literally named `email` looks like an email address,
+     *  returning a 400 rather than accepting input the downstream Clerk create will
+     *  reject anyway. Default `true`; a valid application is never newly rejected. */
+    validateEmail?: boolean;
 }
 /** The fully-resolved application config carried on the {@link Chapter}. */
 interface ResolvedApplication {
@@ -183,6 +209,12 @@ interface ResolvedApplication {
     maxLen: Record<string, number>;
     defaultMaxLen: number;
     bodyCap: number;
+    requireDisclaimerAck: boolean;
+    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
+    profileFields: readonly string[] | null;
+    crmFields: readonly string[];
+    maxArrayLen: number;
+    validateEmail: boolean;
 }
 /** The `defineChapter()` config a site fills in. */
 interface ChapterConfig {
@@ -625,20 +657,35 @@ declare function canceledPatch(): {
 
 /** Apply defaults + validate the application config. Throws at import on bad shape. */
 declare function resolveApplication(a: ChapterApplication | undefined): ResolvedApplication;
+/** Whether a string looks like an email address (see {@link EMAIL_RE}). Exported
+ *  so a site building its own submit path applies the same rule chapter does. */
+declare function isValidEmail(value: unknown): boolean;
+/** Bound an array-valued field: drop non-primitive elements and cap the length,
+ *  so a client cannot post an unbounded array. Non-arrays pass through unchanged. */
+declare function clampArray(value: unknown, max: number): unknown;
+/** Whether a submit body carries a genuine disclaimer acknowledgement. Accepts
+ *  the boolean an API client sends and the string a plain HTML form posts. */
+declare function hasDisclaimerAck(fields: Record<string, unknown>): boolean;
 /**
- * The applicant profile written to the Clerk account's `public_metadata.profile`:
- * every configured application field Clerk does not already carry natively, plus
- * `focus`. Derived from `application.required`/`optional`, so a site's own field
- * names project without this package knowing them. Pure; returns `undefined` when
- * there is nothing to write.
+ * The applicant profile written to the Clerk account's client-readable
+ * `public_metadata.profile`. Projects each configured non-identity field, plus
+ * `focus` (clamped) — but ONLY those in `application.profileFields` when that
+ * allowlist is set, so a site keeps confidential fields (`message`, `referral`)
+ * db-only. Derived from config, so a site's own field names project without this
+ * package knowing them. Pure; returns `undefined` when there is nothing to write.
  */
 declare function applicantProfile(chapter: Chapter, fields: Record<string, unknown>): Record<string, unknown> | undefined;
-/** A validated submission, or a 400-worthy validation error the route returns. */
+/** A validated submission, or a 400-worthy validation error the route returns.
+ *  `disclaimerAckAt` reports what THIS request recorded — a number when consent
+ *  was stamped, `null` when none was supplied. It is always present so a missing
+ *  consent record is visible in the response rather than silently absent from a
+ *  row nobody reads until an audit. */
 type SubmitResult = {
     ok: true;
     id: string;
     duplicate: boolean;
     status: string;
+    disclaimerAckAt: number | null;
 } | {
     ok: false;
     error: string;
@@ -707,7 +754,9 @@ interface ProjectionDeps {
 declare function projectSharedRecord(deps: ProjectionDeps, person: SharedPerson): Promise<{
     recordId: string;
 }>;
-/** An arriving applicant, as far as the CRM projection cares. */
+/** An arriving applicant, as far as the CRM projection cares. `extra` carries the
+ *  site-configured `crmFields` (values from the application), merged on top of the
+ *  built-in identity/contact set. */
 interface Applicant {
     applicationId: string;
     email: string;
@@ -715,12 +764,18 @@ interface Applicant {
     lastName?: string;
     phone?: string;
     linkedin?: string;
+    extra?: Record<string, unknown>;
 }
 /**
  * Project an arriving applicant into this chapter's `crm_record`, so a new
  * application shows up in the CRM immediately, unified by email with any prior
  * record. Idempotent per application (`apply:${applicationId}`). Best-effort at
  * the call site — a projection failure never fails the application.
+ *
+ * `extra` fields (a site's `crmFields`) are merged on top of the base person. If
+ * an extra field is not on the crm person type, crm validation throws — so the
+ * projection retries with the base person alone, ensuring a misconfigured
+ * enrichment never silently drops the applicant from the CRM entirely.
  */
 declare function projectApplicant(deps: ProjectionDeps, applicant: Applicant): Promise<{
     recordId: string;
@@ -1016,4 +1071,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretStore, type SessionUser, type SharedPerson, type StripeEvent, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, bookingDecision, brandTokens, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clerkInviteRequest, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, normalizeWebhookEvent, paymentsReady, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, slotWindow, stageIndex, stripeForm, submitApplication, subscriptionIdempotencyKey, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretStore, type SessionUser, type SharedPerson, type StripeEvent, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, bookingDecision, brandTokens, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clampArray, clerkInviteRequest, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, normalizeWebhookEvent, paymentsReady, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, slotWindow, stageIndex, stripeForm, submitApplication, subscriptionIdempotencyKey, validateScheduling, verifyStripeSignature, webhookMutationId };

package/dist/index.js

@@ -395,23 +395,47 @@ function resolveApplication(a) {
       throw new Error(`defineChapter.application.${name}: must be an array of field-name strings`);
     }
   }
+  if (a?.profileFields !== void 0 && (!Array.isArray(a.profileFields) || !a.profileFields.every((f) => typeof f === "string" && f !== ""))) {
+    throw new Error("defineChapter.application.profileFields: must be an array of field-name strings");
+  }
+  if (a?.crmFields !== void 0 && (!Array.isArray(a.crmFields) || !a.crmFields.every((f) => typeof f === "string" && f !== ""))) {
+    throw new Error("defineChapter.application.crmFields: must be an array of field-name strings");
+  }
   return {
     required,
     optional,
     maxLen: a?.maxLen ?? {},
     defaultMaxLen: a?.defaultMaxLen ?? 2e3,
-    bodyCap: a?.bodyCap ?? 32768
+    bodyCap: a?.bodyCap ?? 32768,
+    requireDisclaimerAck: a?.requireDisclaimerAck ?? false,
+    profileFields: a?.profileFields ?? null,
+    crmFields: a?.crmFields ?? [],
+    maxArrayLen: a?.maxArrayLen ?? 100,
+    validateEmail: a?.validateEmail ?? true
   };
 }
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(value) {
+  return typeof value === "string" && EMAIL_RE.test(value);
+}
+function clampArray(value, max) {
+  if (!Array.isArray(value)) return value;
+  return value.filter((x) => typeof x === "string" || typeof x === "number" || typeof x === "boolean").slice(0, max);
+}
+function hasDisclaimerAck(fields) {
+  return fields.disclaimerAck === true || fields.disclaimerAck === "true";
+}
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
+  const app = chapter.application;
+  const allowed = (f) => app.profileFields === null || app.profileFields.includes(f);
   const profile = {};
-  for (const f of [...chapter.application.required, ...chapter.application.optional]) {
-    if (IDENTITY_FIELDS.has(f)) continue;
+  for (const f of [...app.required, ...app.optional]) {
+    if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
     const v = fields[f];
     if (typeof v === "string" && v.trim() !== "") profile[f] = v.trim();
   }
-  if (fields.focus !== void 0) profile.focus = fields.focus;
+  if (fields.focus !== void 0 && allowed("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
   return Object.keys(profile).length > 0 ? profile : void 0;
 }
 async function submitApplication(db, chapter, fields, opts) {
@@ -425,19 +449,26 @@ async function submitApplication(db, chapter, fields, opts) {
     const cap = app.maxLen[f] ?? app.defaultMaxLen;
     if (typeof v === "string" && v.length > cap) return { ok: false, error: `${f} exceeds ${cap} characters` };
   }
+  if (app.validateEmail && typeof fields.email === "string" && !isValidEmail(fields.email)) {
+    return { ok: false, error: "email must be a valid email address" };
+  }
+  const acked = hasDisclaimerAck(fields);
+  if (app.requireDisclaimerAck && !acked) {
+    return { ok: false, error: "disclaimerAck is required" };
+  }
   const id2 = opts.newId();
   const row = { id: id2, status: chapter.pipeline.initial, createdAt: opts.now };
   for (const f of [...app.required, ...app.optional]) {
     if (typeof fields[f] === "string") row[f] = fields[f].trim();
   }
-  if (fields.focus !== void 0) row.focus = fields.focus;
+  if (fields.focus !== void 0) row.focus = clampArray(fields.focus, app.maxArrayLen);
   if (opts.groupId) row.groupId = opts.groupId;
-  if (fields.disclaimerAck === true || fields.disclaimerAck === "true") row.disclaimerAckAt = opts.now;
+  if (acked) row.disclaimerAckAt = opts.now;
   const { duplicate } = await db.transact(
     [{ t: "update", ns: "applications", id: id2, attrs: row }],
     opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
   );
-  return { ok: true, id: id2, duplicate, status: chapter.pipeline.initial };
+  return { ok: true, id: id2, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
 }
 function joinConfig(group, paymentsReady2) {
   return {
@@ -772,7 +803,7 @@ async function projectSharedRecord(deps, person) {
   return upsertPerson(deps, { email: person.email, input: sharedPersonInput(person), mutationId: `share:${person.hubRecordId}` });
 }
 async function projectApplicant(deps, applicant) {
-  const input = sharedPersonInput({
+  const base = sharedPersonInput({
     email: applicant.email,
     firstName: applicant.firstName,
     lastName: applicant.lastName,
@@ -780,7 +811,14 @@ async function projectApplicant(deps, applicant) {
     linkedin: applicant.linkedin,
     hubRecordId: applicant.applicationId
   });
-  return upsertPerson(deps, { email: applicant.email, input, mutationId: `apply:${applicant.applicationId}` });
+  const mutationId = `apply:${applicant.applicationId}`;
+  const extra = applicant.extra ?? {};
+  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  try {
+    return await upsertPerson(deps, { email: applicant.email, input: { ...base, ...extra }, mutationId });
+  } catch {
+    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  }
 }
 
 // src/clerk.ts
@@ -1061,6 +1099,7 @@ export {
   canTransition,
   canceledPatch,
   chapterDb,
+  clampArray,
   clerkInviteRequest,
   clerkUserRequest,
   createChapterIntegration,
@@ -1073,11 +1112,13 @@ export {
   findApplicationRef,
   firstPaymentPatch,
   getVaultSecret,
+  hasDisclaimerAck,
   introIdempotencyKey,
   isAdminRole,
   isAlreadySent,
   isReconcilable,
   isSlotAvailable,
+  isValidEmail,
   joinConfig,
   meetingCreateRow,
   meetingRescheduleUpdate,