@odla-ai/chapter 0.22.1 → 0.24.0

package/dist/worker/index.cjs

@@ -138,68 +138,6 @@ function createWorkerContext(options) {
 // src/worker-routes.ts
 var import_crm2 = require("@odla-ai/crm");
 
-// src/clerk.ts
-var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
-function clerkInviteRequest(input) {
-  return {
-    path: "/v1/invitations",
-    body: {
-      email_address: input.email,
-      notify: true,
-      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
-    }
-  };
-}
-async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkInviteRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  return res.ok ? { ok: true, status: res.status } : heal(res.status);
-}
-function clerkUserRequest(input) {
-  return {
-    path: "/v1/users",
-    body: {
-      email_address: [input.email],
-      skip_password_requirement: true,
-      ...input.firstName ? { first_name: input.firstName } : {},
-      ...input.lastName ? { last_name: input.lastName } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
-    }
-  };
-}
-async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
-  const auth = { authorization: `Bearer ${secretKey}` };
-  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
-  if (!found.ok) return false;
-  const users = await found.json().catch(() => null);
-  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
-  if (!id) return false;
-  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
-    method: "PATCH",
-    headers: { ...auth, "content-type": "application/json" },
-    body: JSON.stringify({ public_metadata: publicMetadata })
-  });
-  return patched.ok;
-}
-async function createClerkUser(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkUserRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (res.ok) return { ok: true, status: res.status };
-  const healed = heal(res.status);
-  if (!healed.existed || !input.publicMetadata) return healed;
-  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
-  return { ...healed, refreshed };
-}
-
 // src/member.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function isValidEmail(value) {
@@ -215,7 +153,7 @@ function hasDisclaimerAck(fields) {
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const app = chapter.application;
-  const allowed = (f) => app.profileFields === null || app.profileFields.includes(f);
+  const allowed = (f) => app.profileFields.includes(f);
   const profile = {};
   for (const f of [...app.required, ...app.optional]) {
     if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
@@ -533,6 +471,19 @@ function applicationBookingUpdate(currentStatus, startAt, htmlLink) {
   };
 }
 
+// src/pipeline.ts
+function canTransition(from, to, p) {
+  const fi = p.stages.indexOf(from);
+  const ti = p.stages.indexOf(to);
+  return fi >= 0 && ti >= 0 && ti >= fi;
+}
+function canBook(status, p) {
+  return p.bookableFrom.includes(status);
+}
+function canApprove(status, p) {
+  return p.approvableFrom.includes(status);
+}
+
 // src/session.ts
 function applicationSummary(app) {
   return {
@@ -565,6 +516,68 @@ function memberApplication(app, meeting, defaultTimezone) {
   return { ...summary, meetingAt, meetUrl, timezone };
 }
 
+// src/clerk.ts
+var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
+function clerkInviteRequest(input) {
+  return {
+    path: "/v1/invitations",
+    body: {
+      email_address: input.email,
+      notify: true,
+      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
+      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+    }
+  };
+}
+async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkInviteRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  return res.ok ? { ok: true, status: res.status } : heal(res.status);
+}
+function clerkUserRequest(input) {
+  return {
+    path: "/v1/users",
+    body: {
+      email_address: [input.email],
+      skip_password_requirement: true,
+      ...input.firstName ? { first_name: input.firstName } : {},
+      ...input.lastName ? { last_name: input.lastName } : {},
+      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+    }
+  };
+}
+async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
+  const auth = { authorization: `Bearer ${secretKey}` };
+  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
+  if (!found.ok) return false;
+  const users = await found.json().catch(() => null);
+  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
+  if (!id) return false;
+  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
+    method: "PATCH",
+    headers: { ...auth, "content-type": "application/json" },
+    body: JSON.stringify({ public_metadata: publicMetadata })
+  });
+  return patched.ok;
+}
+async function createClerkUser(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkUserRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (res.ok) return { ok: true, status: res.status };
+  const healed = heal(res.status);
+  if (!healed.existed || !input.publicMetadata) return healed;
+  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
+  return { ...healed, refreshed };
+}
+
 // src/email.ts
 function render(template, vars) {
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
@@ -668,36 +681,47 @@ function emailGroupFrom(row) {
   };
 }
 
-// src/worker-routes.ts
+// src/worker-provisioning.ts
 async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
-  const s = (v) => typeof v === "string" ? v : void 0;
+  const stringValue = (value) => typeof value === "string" ? value : void 0;
   const extra = {};
-  for (const f of chapter.application.crmFields) {
-    if (fields[f] !== void 0) extra[f] = fields[f];
+  for (const field of chapter.application.crmFields) {
+    if (fields[field] !== void 0) extra[field] = fields[field];
   }
   try {
     await projectApplicant(
       { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      { applicationId, email, firstName: s(fields.firstName), lastName: s(fields.lastName), phone: s(fields.phone), linkedin: s(fields.linkedin), extra }
+      {
+        applicationId,
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        phone: stringValue(fields.phone),
+        linkedin: stringValue(fields.linkedin),
+        extra
+      }
     );
   } catch {
   }
-  if (chapter.account !== "none") {
-    try {
-      const secret = await getVaultSecret(db, "clerk_secret_key");
-      if (secret) {
-        const profile = applicantProfile(chapter, fields);
-        const publicMetadata = { applicationId, ...profile ? { profile } : {} };
-        if (chapter.account === "create") {
-          await createClerkUser(secret, { email, firstName: s(fields.firstName), lastName: s(fields.lastName), publicMetadata });
-        } else {
-          await createClerkInvitation(secret, { email, publicMetadata });
-        }
-      }
-    } catch {
+  if (chapter.account === "none") return;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return;
+    const profile = applicantProfile(chapter, fields);
+    const publicMetadata = { applicationId, ...profile ? { profile } : {} };
+    if (chapter.account === "create") {
+      await createClerkUser(secret, {
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        publicMetadata
+      });
+    } else {
+      await createClerkInvitation(secret, { email, publicMetadata });
     }
+  } catch {
   }
 }
 async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
@@ -705,14 +729,27 @@ async function notifyAdminOfApplication(db, env, chapterId, applicationId, field
     const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
     const group = Array.isArray(groups) ? groups[0] : void 0;
     if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const s = (v) => typeof v === "string" ? v : "";
+    const stringValue = (value) => typeof value === "string" ? value : "";
     await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
+      {
+        db,
+        envName: env.ODLA_ENV,
+        sender: env.SEND_EMAIL,
+        from: env.EMAIL_FROM,
+        now: () => Date.now(),
+        newId: () => crypto.randomUUID()
+      },
       {
         group: emailGroupFrom(group),
         template: "adminNotification",
         to: group.notificationEmail,
-        vars: { firstName: s(fields.firstName), lastName: s(fields.lastName), email: s(fields.email), phone: s(fields.phone), state: s(fields.state) },
+        vars: {
+          firstName: stringValue(fields.firstName),
+          lastName: stringValue(fields.lastName),
+          email: stringValue(fields.email),
+          phone: stringValue(fields.phone),
+          state: stringValue(fields.state)
+        },
         dedupeKey: `apply:${applicationId}:admin`,
         applicationId
       }
@@ -720,6 +757,8 @@ async function notifyAdminOfApplication(db, env, chapterId, applicationId, field
   } catch {
   }
 }
+
+// src/worker-routes.ts
 async function memberSessionApplication(db, chapterId, email) {
   const apps = (await db.query({ applications: { $: { where: { email }, order: { createdAt: "desc" }, limit: 1 } } })).applications;
   const app = Array.isArray(apps) ? apps[0] : void 0;
@@ -824,7 +863,54 @@ var handleMember = async (req, url, env, ctx) => {
     if (!group) return json({ error: "not found" }, 404);
     const stripeKey = await getVaultSecret(db, "stripe_secret_key");
     const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
-    return json(joinConfig(group, paymentsReady));
+    return json({ ...joinConfig(group, paymentsReady), copy: chapter.copy.join });
+  }
+  if (req.method === "GET" && url.pathname === "/api/join/resume") {
+    const applicationId = url.searchParams.get("application") ?? "";
+    if (!applicationId) return json({ error: "application is required" }, 400);
+    const db = ctx.makeDb(env);
+    const apps = (await db.query({
+      applications: { $: { where: { id: applicationId }, limit: 1 } }
+    })).applications;
+    const app = Array.isArray(apps) ? apps[0] : void 0;
+    if (!app || String(app.groupId ?? "") !== chapter.id) return json({ error: "not found" }, 404);
+    const meetings = (await db.query({
+      meetings: {
+        $: {
+          where: { applicationId, status: "scheduled" },
+          order: { createdAt: "desc" },
+          limit: 1
+        }
+      }
+    })).meetings;
+    const meeting = Array.isArray(meetings) ? meetings[0] : void 0;
+    if (meeting && typeof meeting.startAt === "number") {
+      const groups2 = (await db.query({
+        groups: { $: { where: { id: chapter.id }, limit: 1 } }
+      })).groups;
+      const group2 = Array.isArray(groups2) ? groups2[0] : void 0;
+      const timezone = resolveScheduling(group2?.schedulingJson).timezone;
+      return json({
+        state: "done",
+        applicationId,
+        booked: { startAt: meeting.startAt, timezone }
+      });
+    }
+    const groups = (await db.query({
+      groups: { $: { where: { id: chapter.id }, limit: 1 } }
+    })).groups;
+    const group = Array.isArray(groups) ? groups[0] : void 0;
+    if (!group) return json({ error: "not found" }, 404);
+    const stripeKey = await getVaultSecret(db, "stripe_secret_key");
+    const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
+    const status = String(app.status ?? "");
+    if (!paymentsReady) return json({ state: "booking", applicationId });
+    if (status === chapter.pipeline.initial && app.stripeSubscriptionId) {
+      return json({ state: "paymentPending", applicationId });
+    }
+    if (status === chapter.pipeline.initial) return json({ state: "payment", applicationId });
+    if (canBook(status, chapter.pipeline)) return json({ state: "booking", applicationId });
+    return json({ error: `application cannot resume from status "${status}"` }, 409);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
     const raw = await req.text();
@@ -862,23 +948,95 @@ var handleMember = async (req, url, env, ctx) => {
   return null;
 };
 
-// src/worker-routes-schedule.ts
-var import_calendar = require("@odla-ai/calendar");
-
-// src/pipeline.ts
-function canTransition(from, to, p) {
-  const fi = p.stages.indexOf(from);
-  const ti = p.stages.indexOf(to);
-  return fi >= 0 && ti >= 0 && ti >= fi;
+// src/crm-sync.ts
+var import_crm3 = require("@odla-ai/crm");
+var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
+var crmDeps = (db, ctx) => ({
+  crm: ctx.chapter.crm,
+  db,
+  now: () => Date.now(),
+  newId: () => crypto.randomUUID(),
+  chapter: ctx.chapter
+});
+function personInputFromApp(chapter, app) {
+  const input = sharedPersonInput({
+    email: str(app.email),
+    firstName: str(app.firstName) || void 0,
+    lastName: str(app.lastName) || void 0,
+    phone: str(app.phone) || void 0,
+    linkedin: str(app.linkedin) || void 0,
+    hubRecordId: str(app.id)
+  });
+  for (const f of chapter.application.crmFields) {
+    if (app[f] !== void 0) input[f] = app[f];
+  }
+  if (app.id !== void 0) input.applicationId = str(app.id);
+  return input;
 }
-function canBook(status, p) {
-  return p.bookableFrom.includes(status);
+function billingColumns(app) {
+  const status = str(app.status);
+  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
+  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
+  const cols = { billingStatus };
+  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
+  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
+  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
+  return cols;
 }
-function canApprove(status, p) {
-  return p.approvableFrom.includes(status);
+async function syncApplicationToCrm(deps, opts) {
+  const emailKey = str(opts.app.email).toLowerCase();
+  if (!emailKey) return null;
+  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const input = personInputFromApp(deps.chapter, opts.app);
+  const { crm_record } = await deps.db.query({
+    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
+  });
+  const existing = crm_record?.[0] ?? null;
+  const stage = opts.stage || void 0;
+  let recordId;
+  if (existing && typeof existing.id === "string") {
+    recordId = existing.id;
+    await (0, import_crm3.updateRecord)(recordDeps, { id: recordId, input });
+  } else {
+    const created = await (0, import_crm3.createRecord)(recordDeps, { type: "person", input, ...stage ? { stage } : {} });
+    recordId = created.id;
+  }
+  if (existing && stage && existing.stage !== stage) {
+    await (0, import_crm3.setStage)(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
+  }
+  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
+  await (0, import_crm3.linkIdentity)(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
+  return recordId;
+}
+async function backfillCrm(deps) {
+  const [appsRes, usersRes] = await Promise.all([
+    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
+    deps.db.query({ $users: { $: { limit: 1e3 } } })
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  let synced = 0;
+  const errors = [];
+  const run = async (app, stage) => {
+    const key = str(app.email).toLowerCase();
+    if (!key || seen.has(key)) return;
+    seen.add(key);
+    try {
+      await syncApplicationToCrm(deps, { app, stage });
+      synced += 1;
+    } catch (err) {
+      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
+    }
+  };
+  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
+  for (const u of usersRes.$users ?? []) {
+    if (u.deleted === true) continue;
+    await run({ email: u.email, firstName: str(u.name) });
+  }
+  return { synced, errors };
 }
 
 // src/worker-routes-schedule.ts
+var import_calendar = require("@odla-ai/calendar");
 function errCode(err) {
   if (err && typeof err === "object") {
     const code = err.code;
@@ -980,8 +1138,11 @@ async function bookSlot(req, env, ctx) {
     if (code === "calendar_slot_unavailable") return json({ error: "slot no longer available", code }, 409);
     return json({ error: "booking failed", code }, 502);
   }
-  const appOp = { t: "update", ns: "applications", id: applicationId, attrs: applicationBookingUpdate(status, startAt, htmlLink) };
+  const bookingAttrs = applicationBookingUpdate(status, startAt, htmlLink);
+  const appOp = { t: "update", ns: "applications", id: applicationId, attrs: bookingAttrs };
   await db.transact([meetingOp, appOp]);
+  const booked = { ...app, ...bookingAttrs };
+  await syncApplicationToCrm(crmDeps(db, ctx), { app: booked, stage: String(booked.status ?? "") }).catch(() => void 0);
   if (typeof app.email === "string" && app.email) {
     await sendTemplated(
       { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
@@ -1331,6 +1492,8 @@ async function ingestWebhook(req, env, ctx) {
   const patch = webhookPatch(event, String(app.status ?? ""));
   if (Object.keys(patch).length) {
     await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: patch }], { mutationId: webhookMutationId(eventId) });
+    const next = { ...app, ...patch };
+    await syncApplicationToCrm(crmDeps(db, ctx), { app: next, stage: String(next.status ?? "") }).catch(() => void 0);
   }
   if (event.kind === "first_payment") {
     await notifyPaymentConfirmed(db, env, eventId, app);
@@ -1338,37 +1501,10 @@ async function ingestWebhook(req, env, ctx) {
   }
   return json({ ok: true });
 }
-async function refundApplication(req, url, env, ctx) {
-  const rawDb = ctx.makeDb(env);
-  const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
-  const id = url.pathname.split("/")[4] ?? "";
-  const db = rawDb;
-  const app = await firstRow2(db, "applications", { where: { id }, limit: 1 });
-  if (!app) return json({ error: "not found" }, 404);
-  if (app.status === "refunded") return json({ error: "already refunded" }, 409);
-  if (app.status === "approved") return json({ error: "approved memberships are non-refundable" }, 409);
-  if (!app.stripeSubscriptionId) return json({ error: "no subscription on file" }, 409);
-  if (!app.stripeCustomerId) return json({ error: "no customer on file" }, 409);
-  const secretKey = await getVaultSecret(db, "stripe_secret_key");
-  if (!secretKey) return json({ error: "payments not configured" }, 503);
-  try {
-    const result = await createStripeProvider({ secretKey }).refund({
-      customerId: String(app.stripeCustomerId),
-      subscriptionId: String(app.stripeSubscriptionId)
-    });
-    return json({ ok: true, refundedCents: result.refundedCents, subscriptionCanceled: result.subscriptionCanceled });
-  } catch (err) {
-    const code = codeOf(err);
-    return json({ error: "refund failed", code }, code === "no_charge" ? 409 : 502);
-  }
-}
-var REFUND_PATH = /^\/api\/admin\/applications\/[^/]+\/refund$/;
 var handlePayments = async (req, url, env, ctx) => {
   if (ctx.chapter.mode !== "chapter") return null;
   if (req.method === "POST" && url.pathname === "/api/payments/subscription") return startSubscription(req, env, ctx);
   if (req.method === "POST" && url.pathname === "/api/webhooks/stripe") return ingestWebhook(req, env, ctx);
-  if (req.method === "POST" && REFUND_PATH.test(url.pathname)) return refundApplication(req, url, env, ctx);
   return null;
 };
 
@@ -1411,7 +1547,8 @@ function reconcileMeetings(meetings, events, now) {
 async function adminGroup(req, env, ctx, url) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
+  if (!u) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   const db = rawDb;
   const groupId = url.searchParams.get("group") ?? ctx.chapter.id;
   const group = (await db.query({ groups: { $: { where: { id: groupId }, limit: 1 } } })).groups?.[0];
@@ -1456,7 +1593,8 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/meetings") return null;
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
+  if (!u) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   const db = rawDb;
   const all = url.searchParams.get("all") === "1";
   const from = Number(url.searchParams.get("from"));
@@ -1547,86 +1685,6 @@ async function clerkSetRole(secretKey, id, role, fetchImpl = fetch) {
   return res.ok;
 }
 
-// src/crm-sync.ts
-var import_crm3 = require("@odla-ai/crm");
-var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
-function personInputFromApp(chapter, app) {
-  const input = sharedPersonInput({
-    email: str(app.email),
-    firstName: str(app.firstName) || void 0,
-    lastName: str(app.lastName) || void 0,
-    phone: str(app.phone) || void 0,
-    linkedin: str(app.linkedin) || void 0,
-    hubRecordId: str(app.id)
-  });
-  for (const f of chapter.application.crmFields) {
-    if (app[f] !== void 0) input[f] = app[f];
-  }
-  if (app.id !== void 0) input.applicationId = str(app.id);
-  return input;
-}
-function billingColumns(app) {
-  const status = str(app.status);
-  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
-  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
-  const cols = { billingStatus };
-  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
-  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
-  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
-  return cols;
-}
-async function syncApplicationToCrm(deps, opts) {
-  const emailKey = str(opts.app.email).toLowerCase();
-  if (!emailKey) return null;
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const input = personInputFromApp(deps.chapter, opts.app);
-  const { crm_record } = await deps.db.query({
-    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
-  });
-  const existing = crm_record?.[0] ?? null;
-  const stage = opts.stage || void 0;
-  let recordId;
-  if (existing && typeof existing.id === "string") {
-    recordId = existing.id;
-    await (0, import_crm3.updateRecord)(crmDeps3, { id: recordId, input });
-  } else {
-    const created = await (0, import_crm3.createRecord)(crmDeps3, { type: "person", input, ...stage ? { stage } : {} });
-    recordId = created.id;
-  }
-  if (existing && stage && existing.stage !== stage) {
-    await (0, import_crm3.setStage)(crmDeps3, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
-  }
-  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
-  await (0, import_crm3.linkIdentity)(crmDeps3, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
-  return recordId;
-}
-async function backfillCrm(deps) {
-  const [appsRes, usersRes] = await Promise.all([
-    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
-    deps.db.query({ $users: { $: { limit: 1e3 } } })
-  ]);
-  const seen = /* @__PURE__ */ new Set();
-  let synced = 0;
-  const errors = [];
-  const run = async (app, stage) => {
-    const key = str(app.email).toLowerCase();
-    if (!key || seen.has(key)) return;
-    seen.add(key);
-    try {
-      await syncApplicationToCrm(deps, { app, stage });
-      synced += 1;
-    } catch (err) {
-      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
-    }
-  };
-  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
-  for (const u of usersRes.$users ?? []) {
-    if (u.deleted === true) continue;
-    await run({ email: u.email, firstName: str(u.name) });
-  }
-  return { synced, errors };
-}
-
 // src/worker-routes-admin-people.ts
 async function adminGate(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
@@ -1635,7 +1693,7 @@ async function adminGate(req, env, ctx) {
   if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   return { db: rawDb, actor: { userId: u.userId, email: u.email ?? void 0 } };
 }
-var crmDeps = (db, ctx) => ({
+var crmDeps2 = (db, ctx) => ({
   crm: ctx.chapter.crm,
   db,
   now: () => Date.now(),
@@ -1646,7 +1704,7 @@ var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
   const gate5 = await adminGate(req, env, ctx);
   if (gate5 instanceof Response) return gate5;
-  const result = await backfillCrm(crmDeps(gate5.db, ctx));
+  const result = await backfillCrm(crmDeps2(gate5.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
@@ -1926,7 +1984,6 @@ async function gate2(req, env, ctx) {
   return rawDb;
 }
 var calFor = (env) => (0, import_calendar3.initCalendar)({ appId: env.ODLA_APP_ID, env: env.ODLA_ENV, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_PLATFORM });
-var crmDeps2 = (db, ctx) => ({ crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID(), chapter: ctx.chapter });
 var readJson = async (req) => {
   try {
     return await req.json();
@@ -2012,7 +2069,7 @@ var handleAdminApprove = async (req, url, env, ctx) => {
   if (!canApprove(String(app.status), ctx.chapter.pipeline)) return json({ error: `cannot approve from status "${String(app.status)}"` }, 409);
   const target = "approved";
   await db.transact([{ t: "update", ns: "applications", id, attrs: { status: target } }]);
-  await syncApplicationToCrm(crmDeps2(db, ctx), { app: { ...app, status: target }, stage: target }).catch(() => void 0);
+  await syncApplicationToCrm(crmDeps(db, ctx), { app: { ...app, status: target }, stage: target }).catch(() => void 0);
   const { promoteTo, send } = ctx.chapter.operations.onApprove;
   let rolePromoted = false;
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -2093,7 +2150,7 @@ var handleAdminApplicationPatch = async (req, url, env, ctx) => {
   if (Object.keys(attrs).length === 0) return json({ error: "nothing to update" }, 400);
   await db.transact([{ t: "update", ns: "applications", id, attrs }]);
   if (attrs.status !== void 0) {
-    await syncApplicationToCrm(crmDeps2(db, ctx), { app: { ...app, ...attrs }, stage: String(attrs.status) }).catch(() => void 0);
+    await syncApplicationToCrm(crmDeps(db, ctx), { app: { ...app, ...attrs }, stage: String(attrs.status) }).catch(() => void 0);
   }
   return json({ ok: true });
 };
@@ -2368,7 +2425,11 @@ var BUILTIN_ROUTES = [
   handleAdminComms,
   // Leader → follower record delivery
   handleAdminNetworkTargets,
-  handleAdminNetworkPush
+  handleAdminNetworkPush,
+  // API requests must never fall through to an SPA asset response. Hosts still
+  // get first refusal through options.routes, then this terminates unknown API
+  // paths with an explicit machine-readable 404.
+  async (_req, url) => url.pathname.startsWith("/api/") ? json({ error: "not found" }, 404) : null
 ];
 function chapterWorker(options) {
   const ctx = createWorkerContext(options);