@odla-ai/chapter 0.3.0 → 0.4.0

package/dist/worker/index.js

@@ -1,6 +1,5 @@
-// src/worker.ts
+// src/worker-context.ts
 import { initAdmin } from "@odla-ai/db";
-import { createCrmRoutes } from "@odla-ai/crm";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/auth.ts
@@ -20,6 +19,81 @@ async function getVaultSecret(db, name) {
   }
 }
 
+// src/worker-context.ts
+var json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+function createWorkerContext(options) {
+  const { chapter } = options;
+  const auth = chapter.auth;
+  const crmBase = options.crmBasePath ?? "/api/crm";
+  let publicConfigCache = null;
+  const jwksByIssuer = /* @__PURE__ */ new Map();
+  async function getPublicConfig(env) {
+    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 6e4) return publicConfigCache.value;
+    const res = await fetch(`${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`);
+    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);
+    const value = await res.json();
+    publicConfigCache = { value, at: Date.now() };
+    return value;
+  }
+  async function verifyUser(req, env) {
+    const header = req.headers.get("authorization") ?? "";
+    if (!header.startsWith("Bearer ")) return null;
+    const token = header.slice(7);
+    const { issuer } = await getPublicConfig(env);
+    if (!issuer) return null;
+    let jwks = jwksByIssuer.get(issuer);
+    if (!jwks) {
+      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));
+      jwksByIssuer.set(issuer, jwks);
+    }
+    try {
+      const { payload } = await jwtVerify(token, jwks, { issuer });
+      if (!payload.sub) return null;
+      return {
+        userId: payload.sub,
+        email: typeof payload.email === "string" ? payload.email : void 0,
+        payload
+      };
+    } catch {
+      return null;
+    }
+  }
+  function makeDb(env) {
+    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });
+  }
+  async function isAdminEmail(db, email) {
+    if (!email) return false;
+    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
+    return Array.isArray(admins) && admins.length > 0;
+  }
+  async function isSuperAdminEmail(db, email) {
+    if (!auth.superAdmins || !email) return false;
+    const { superAdmins } = await db.query({ superAdmins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
+    return Array.isArray(superAdmins) && superAdmins.length > 0;
+  }
+  async function roleFor(db, u) {
+    if (auth.source === "claim") return roleFromClaim(u.payload, auth);
+    return await isAdminEmail(db, u.email) ? auth.adminRole : auth.ladder[0];
+  }
+  async function isAdmin(db, u) {
+    if (auth.source === "claim") return isAdminRole(roleFromClaim(u.payload, auth), auth);
+    return isAdminEmail(db, u.email);
+  }
+  function crmSender(env) {
+    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return void 0;
+    const binding = env.SEND_EMAIL;
+    return {
+      async send(payload) {
+        return binding.send(payload);
+      }
+    };
+  }
+  return { chapter, auth, crmBase, getPublicConfig, verifyUser, makeDb, isAdminEmail, isSuperAdminEmail, roleFor, isAdmin, crmSender };
+}
+
+// src/worker-routes.ts
+import { createCrmRoutes } from "@odla-ai/crm";
+
 // src/member.ts
 async function submitApplication(db, chapter, fields, opts) {
   const app = chapter.application;
@@ -89,171 +163,708 @@ async function projectSharedRecord(deps, person) {
   return { recordId: created.id };
 }
 
-// src/worker.ts
-var json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
-function chapterWorker(options) {
-  const { chapter } = options;
-  const auth = chapter.auth;
-  const crmBase = options.crmBasePath ?? "/api/crm";
-  let publicConfigCache = null;
-  const jwksByIssuer = /* @__PURE__ */ new Map();
-  async function getPublicConfig(env) {
-    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 6e4) return publicConfigCache.value;
-    const res = await fetch(
-      `${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`
-    );
-    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);
-    const value = await res.json();
-    publicConfigCache = { value, at: Date.now() };
-    return value;
+// src/scheduling.ts
+var SCHEDULING_DEFAULTS = {
+  slotMinutes: 45,
+  days: [1, 2, 3, 4, 5],
+  startHour: 9,
+  endHour: 17,
+  timezone: "America/Los_Angeles",
+  minNoticeHours: 24,
+  windowDays: 14,
+  summaryTemplate: "Introduction call with {{firstName}} {{lastName}}"
+};
+function isValidTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat(void 0, { timeZone: tz });
+    return true;
+  } catch {
+    return false;
   }
-  async function verifyUser(req, env) {
-    const header = req.headers.get("authorization") ?? "";
-    if (!header.startsWith("Bearer ")) return null;
-    const token = header.slice(7);
-    const { issuer } = await getPublicConfig(env);
-    if (!issuer) return null;
-    let jwks = jwksByIssuer.get(issuer);
-    if (!jwks) {
-      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));
-      jwksByIssuer.set(issuer, jwks);
+}
+function resolveScheduling(config) {
+  const d = config ?? {};
+  const c = {
+    slotMinutes: d.slotMinutes ?? SCHEDULING_DEFAULTS.slotMinutes,
+    days: d.days ?? SCHEDULING_DEFAULTS.days,
+    startHour: d.startHour ?? SCHEDULING_DEFAULTS.startHour,
+    endHour: d.endHour ?? SCHEDULING_DEFAULTS.endHour,
+    timezone: d.timezone ?? SCHEDULING_DEFAULTS.timezone,
+    minNoticeHours: d.minNoticeHours ?? SCHEDULING_DEFAULTS.minNoticeHours,
+    windowDays: d.windowDays ?? SCHEDULING_DEFAULTS.windowDays,
+    summaryTemplate: d.summaryTemplate ?? SCHEDULING_DEFAULTS.summaryTemplate
+  };
+  const fail2 = (msg) => {
+    throw new Error(`scheduling: ${msg}`);
+  };
+  if (!(c.slotMinutes >= 15 && c.slotMinutes <= 240)) fail2("slotMinutes must be 15\u2013240");
+  if (!(c.windowDays >= 1 && c.windowDays <= 62)) fail2("windowDays must be 1\u201362 (FreeBusy caps at 62)");
+  if (!(c.minNoticeHours >= 0 && c.minNoticeHours <= 336)) fail2("minNoticeHours must be 0\u2013336");
+  if (!(c.startHour >= 0 && c.startHour < c.endHour && c.endHour <= 24)) fail2("require 0 \u2264 startHour < endHour \u2264 24");
+  const days = [...c.days];
+  if (!days.length || !days.every((n) => Number.isInteger(n) && n >= 0 && n <= 6)) {
+    fail2("days must be a non-empty list of weekday integers 0\u20136");
+  }
+  if (typeof c.timezone !== "string" || !isValidTimeZone(c.timezone)) fail2(`invalid IANA timezone "${c.timezone}"`);
+  if (typeof c.summaryTemplate !== "string") fail2("summaryTemplate must be a string");
+  return { ...c, days };
+}
+var BOOKABLE_STATUSES = ["submitted", "paid_pending_vetting", "call_scheduled"];
+function canBookFrom(status) {
+  return BOOKABLE_STATUSES.includes(status);
+}
+function slotWindow(now, windowDays) {
+  return { from: now, to: now + windowDays * 864e5 };
+}
+function endForSlot(startAt, slotMinutes) {
+  return startAt + slotMinutes * 6e4;
+}
+function isSlotAvailable(slots, startAt) {
+  return slots.some((s) => s.startAt === startAt);
+}
+function renderSummary(template, app) {
+  return template.replace("{{firstName}}", app.firstName ?? "").replace("{{lastName}}", app.lastName ?? "");
+}
+function bookingDecision(existing) {
+  const eventId = existing?.googleEventId ?? null;
+  return { reschedule: Boolean(eventId), eventId };
+}
+function introIdempotencyKey(applicationId) {
+  return `application:${applicationId}:intro`;
+}
+function meetingCreateRow(i) {
+  return {
+    id: i.meetingId,
+    applicationId: i.applicationId,
+    groupId: i.groupId,
+    startAt: i.startAt,
+    endAt: i.endAt,
+    timezone: i.timezone,
+    status: "scheduled",
+    googleEventId: i.googleEventId,
+    ...i.meetUrl ? { meetUrl: i.meetUrl } : {},
+    ...i.htmlLink ? { htmlLink: i.htmlLink } : {},
+    drift: "none",
+    createdAt: i.createdAt
+  };
+}
+function meetingRescheduleUpdate(startAt, endAt) {
+  return { startAt, endAt, drift: "none" };
+}
+function applicationBookingUpdate(currentStatus, startAt, htmlLink) {
+  return {
+    meetingAt: startAt,
+    ...htmlLink ? { meetingLink: htmlLink } : {},
+    ...currentStatus !== "call_scheduled" ? { status: "call_scheduled" } : {}
+  };
+}
+
+// src/session.ts
+function applicationSummary(app) {
+  return {
+    id: app.id,
+    firstName: app.firstName ?? null,
+    lastName: app.lastName ?? null,
+    email: app.email ?? null,
+    status: app.status,
+    createdAt: app.createdAt ?? null,
+    meetingLink: app.meetingLink ?? null,
+    paid: Boolean(app.stripeSubscriptionId) && app.status !== "refunded",
+    renewalAt: app.renewalAt ?? null,
+    canceled: app.canceled === true
+  };
+}
+function memberApplication(app, meeting, defaultTimezone) {
+  const summary = applicationSummary(app);
+  let meetingAt = app.meetingAt ?? null;
+  let meetUrl = null;
+  let timezone = defaultTimezone;
+  if (meeting) {
+    timezone = meeting.timezone ?? timezone;
+    if (meeting.status === "scheduled") {
+      meetingAt = meeting.startAt ?? null;
+      meetUrl = meeting.meetUrl ?? null;
+    } else {
+      meetingAt = null;
     }
+  }
+  return { ...summary, meetingAt, meetUrl, timezone };
+}
+
+// src/worker-routes.ts
+async function memberSessionApplication(db, chapterId, email) {
+  const apps = (await db.query({ applications: { $: { where: { email }, order: { createdAt: "desc" }, limit: 1 } } })).applications;
+  const app = Array.isArray(apps) ? apps[0] : void 0;
+  if (!app) return null;
+  const meetings = (await db.query({ meetings: { $: { where: { applicationId: app.id, status: "scheduled" }, order: { createdAt: "desc" }, limit: 1 } } })).meetings;
+  const meeting = Array.isArray(meetings) ? meetings[0] : void 0;
+  const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
+  const group = Array.isArray(groups) ? groups[0] : void 0;
+  const timezone = resolveScheduling(group?.schedulingJson).timezone;
+  return memberApplication(app, meeting, timezone);
+}
+var handleConfig = async (_req, url, env, ctx) => {
+  if (url.pathname !== "/api/config") return null;
+  try {
+    const { clerkPublishableKey } = await ctx.getPublicConfig(env);
+    return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });
+  } catch {
+    return json({ clerkPublishableKey: null, env: env.ODLA_ENV });
+  }
+};
+var handleMe = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/me") return null;
+  const u = await ctx.verifyUser(req, env);
+  if (!u) return json({ authorized: false }, 401);
+  const db = ctx.makeDb(env);
+  const role = await ctx.roleFor(db, u);
+  const superAdmin = await ctx.isSuperAdminEmail(db, u.email);
+  const base = { authorized: isAdminRole(role, ctx.auth), role, superAdmin, email: u.email ?? null };
+  if (ctx.chapter.mode !== "chapter" || !u.email) return json(base);
+  const application = await memberSessionApplication(db, ctx.chapter.id, u.email);
+  return json({ ...base, application });
+};
+var handleCrm = async (req, url, env, ctx) => {
+  const crmBase = ctx.crmBase;
+  if (url.pathname !== crmBase && !url.pathname.startsWith(crmBase + "/")) return null;
+  const db = ctx.makeDb(env);
+  const routes = createCrmRoutes({
+    crm: ctx.chapter.crm,
+    db,
+    authorize: async (r) => {
+      const u = await ctx.verifyUser(r, env);
+      if (!u || !await ctx.isAdmin(db, u)) return null;
+      return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };
+    },
+    sender: ctx.crmSender(env),
+    from: env.EMAIL_FROM,
+    envName: env.ODLA_ENV,
+    baseUrl: url.origin,
+    basePath: crmBase
+  });
+  const res = await routes(req);
+  if (res) return res;
+  return json({ error: "not found" }, 404);
+};
+var handleNetworkShared = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== "/api/network/shared") return null;
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  const provided = (req.headers.get("authorization") ?? "").replace(/^Bearer /, "");
+  if (!secret || provided.length !== secret.length || provided !== secret) {
+    return json({ error: "unauthorized" }, 401);
+  }
+  let person;
+  try {
+    person = JSON.parse(await req.text());
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  if (typeof person.email !== "string" || typeof person.hubRecordId !== "string") {
+    return json({ error: "email and hubRecordId are required" }, 400);
+  }
+  const { recordId } = await projectSharedRecord(
+    { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
+    person
+  );
+  return json({ recordId });
+};
+var handleMember = async (req, url, env, ctx) => {
+  const chapter = ctx.chapter;
+  if (chapter.mode !== "chapter") return null;
+  if (req.method === "GET" && url.pathname === "/api/join-config") {
+    const db = ctx.makeDb(env);
+    const groupId = url.searchParams.get("group") ?? chapter.id;
+    const { groups } = await db.query({ groups: { $: { where: { id: groupId }, limit: 1 } } });
+    const group = Array.isArray(groups) ? groups[0] : void 0;
+    if (!group) return json({ error: "not found" }, 404);
+    const stripeKey = await getVaultSecret(db, "stripe_secret_key");
+    const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
+    return json(joinConfig(group, paymentsReady));
+  }
+  if (req.method === "POST" && url.pathname === "/api/applications") {
+    const raw = await req.text();
+    if (raw.length > chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
+    let parsed;
     try {
-      const { payload } = await jwtVerify(token, jwks, { issuer });
-      if (!payload.sub) return null;
-      return {
-        userId: payload.sub,
-        email: typeof payload.email === "string" ? payload.email : void 0,
-        payload
-      };
+      parsed = JSON.parse(raw);
     } catch {
-      return null;
+      return json({ error: "invalid JSON body" }, 400);
     }
+    const submissionId = typeof parsed.submissionId === "string" ? parsed.submissionId : void 0;
+    const result = await submitApplication(ctx.makeDb(env), chapter, parsed, {
+      submissionId,
+      groupId: chapter.id,
+      now: Date.now(),
+      newId: () => crypto.randomUUID()
+    });
+    if (!result.ok) return json({ error: result.error }, 400);
+    return json({ id: result.id, duplicate: result.duplicate, status: result.status });
   }
-  function makeDb(env) {
-    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });
+  return null;
+};
+
+// src/worker-routes-schedule.ts
+import { computeBookableSlots, initCalendar } from "@odla-ai/calendar";
+function errCode(err) {
+  if (err && typeof err === "object") {
+    const code = err.code;
+    if (typeof code === "string") return code;
   }
-  async function isAdminEmail(db, email) {
-    if (!email) return false;
-    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
-    return Array.isArray(admins) && admins.length > 0;
+  return "calendar_unavailable";
+}
+function makeCalendar(env) {
+  return initCalendar({ appId: env.ODLA_APP_ID, env: env.ODLA_ENV, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_PLATFORM });
+}
+async function firstRow(db, ns, q) {
+  const res = await db.query({ [ns]: { $: q } });
+  const rows = res[ns];
+  return Array.isArray(rows) ? rows[0] : void 0;
+}
+async function computeSlots(cal, cfg) {
+  const { from, to } = slotWindow(Date.now(), cfg.windowDays);
+  const fb = await cal.availability.freeBusy({ timeMin: from, timeMax: to });
+  return computeBookableSlots(fb.busy, {
+    from: fb.timeMin,
+    to: fb.timeMax,
+    timezone: cfg.timezone,
+    slotMinutes: cfg.slotMinutes,
+    businessHours: { days: [...cfg.days], startHour: cfg.startHour, endHour: cfg.endHour },
+    minNoticeMs: cfg.minNoticeHours * 36e5
+  });
+}
+async function bookSlot(req, env, ctx) {
+  let body;
+  try {
+    body = JSON.parse(await req.text());
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
   }
-  async function isSuperAdminEmail(db, email) {
-    if (!auth.superAdmins || !email) return false;
-    const { superAdmins } = await db.query({ superAdmins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });
-    return Array.isArray(superAdmins) && superAdmins.length > 0;
+  const applicationId = typeof body.applicationId === "string" ? body.applicationId : "";
+  const startAt = Number(body.startAt);
+  if (!applicationId || !Number.isFinite(startAt)) return json({ error: "applicationId and startAt required" }, 400);
+  const db = ctx.makeDb(env);
+  const app = await firstRow(db, "applications", { where: { id: applicationId }, limit: 1 });
+  if (!app) return json({ error: "not found" }, 404);
+  const status = String(app.status ?? "");
+  if (!canBookFrom(status)) return json({ error: `cannot book from status "${status}"` }, 409);
+  const group = await firstRow(db, "groups", { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 });
+  if (!group) return json({ error: "group not found" }, 500);
+  const cfg = resolveScheduling(group.schedulingJson);
+  const endAt = endForSlot(startAt, cfg.slotMinutes);
+  const cal = makeCalendar(env);
+  let slots;
+  try {
+    slots = await computeSlots(cal, cfg);
+  } catch (err) {
+    return json({ error: "scheduling unavailable", code: errCode(err) }, 503);
   }
-  async function roleFor(db, u) {
-    if (auth.source === "claim") return roleFromClaim(u.payload, auth);
-    return await isAdminEmail(db, u.email) ? auth.adminRole : auth.ladder[0];
+  if (!isSlotAvailable(slots, startAt)) return json({ error: "slot no longer available", code: "calendar_slot_unavailable" }, 409);
+  const summary = renderSummary(cfg.summaryTemplate, { firstName: app.firstName, lastName: app.lastName });
+  const existing = await firstRow(db, "meetings", {
+    where: { applicationId, status: "scheduled" },
+    order: { createdAt: "desc" },
+    limit: 1
+  });
+  const decision = bookingDecision(existing);
+  let meetUrl = null;
+  let htmlLink = null;
+  let meetingOp;
+  try {
+    if (decision.reschedule && decision.eventId) {
+      await cal.actions.reschedule(decision.eventId, { startAt, endAt });
+      meetUrl = existing?.meetUrl ?? null;
+      htmlLink = existing?.htmlLink ?? null;
+      meetingOp = { t: "update", ns: "meetings", id: String(existing?.id), attrs: meetingRescheduleUpdate(startAt, endAt) };
+    } else {
+      const { booking } = await cal.actions.create(
+        { summary, startAt, endAt, attendees: [String(app.email)], timezone: cfg.timezone, meet: true },
+        { idempotencyKey: introIdempotencyKey(applicationId) }
+      );
+      meetUrl = booking.meetUrl ?? null;
+      htmlLink = booking.htmlLink ?? null;
+      const meetingId = crypto.randomUUID();
+      meetingOp = {
+        t: "update",
+        ns: "meetings",
+        id: meetingId,
+        attrs: meetingCreateRow({
+          meetingId,
+          applicationId,
+          groupId: String(group.id),
+          startAt,
+          endAt,
+          timezone: cfg.timezone,
+          googleEventId: booking.eventId,
+          meetUrl: booking.meetUrl,
+          htmlLink: booking.htmlLink,
+          createdAt: Date.now()
+        })
+      };
+    }
+  } catch (err) {
+    const code = errCode(err);
+    if (code === "calendar_slot_unavailable") return json({ error: "slot no longer available", code }, 409);
+    return json({ error: "booking failed", code }, 502);
   }
-  async function isAdmin(db, u) {
-    if (auth.source === "claim") return isAdminRole(roleFromClaim(u.payload, auth), auth);
-    return isAdminEmail(db, u.email);
+  const appOp = { t: "update", ns: "applications", id: applicationId, attrs: applicationBookingUpdate(status, startAt, htmlLink) };
+  await db.transact([meetingOp, appOp]);
+  return json({ ok: true, startAt, endAt, meetUrl, rescheduled: decision.reschedule });
+}
+var handleSchedule = async (req, url, env, ctx) => {
+  if (ctx.chapter.mode !== "chapter") return null;
+  if (req.method === "GET" && url.pathname === "/api/schedule/slots") {
+    const db = ctx.makeDb(env);
+    const group = await firstRow(db, "groups", { where: { id: url.searchParams.get("group") ?? ctx.chapter.id }, limit: 1 });
+    if (!group) return json({ error: "not found" }, 404);
+    const cfg = resolveScheduling(group.schedulingJson);
+    try {
+      const slots = await computeSlots(makeCalendar(env), cfg);
+      return json({ schedulingReady: true, timezone: cfg.timezone, slotMinutes: cfg.slotMinutes, slots });
+    } catch (err) {
+      return json({ schedulingReady: false, code: errCode(err) });
+    }
   }
-  function crmSender(env) {
-    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return void 0;
-    const binding = env.SEND_EMAIL;
-    return { async send(payload) {
-      return binding.send(payload);
-    } };
+  if (req.method === "POST" && url.pathname === "/api/schedule/book") {
+    return bookSlot(req, env, ctx);
   }
-  const handler = {
-    async fetch(req, env) {
-      const url = new URL(req.url);
-      if (url.pathname === "/api/config") {
-        try {
-          const { clerkPublishableKey } = await getPublicConfig(env);
-          return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });
-        } catch {
-          return json({ clerkPublishableKey: null, env: env.ODLA_ENV });
-        }
+  return null;
+};
+
+// src/payments.ts
+function parseSigHeader(header) {
+  const parts = {};
+  for (const p of header.split(",")) {
+    const [k, v] = p.split("=", 2);
+    if (k && v !== void 0) parts[k] = v;
+  }
+  return { t: parts.t, v1: parts.v1 };
+}
+function toHex(buf) {
+  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function verifyStripeSignature(payload, header, secret, opts = {}) {
+  const { t, v1 } = parseSigHeader(header);
+  if (!t || !v1) return false;
+  const ts = Number(t);
+  if (!Number.isFinite(ts)) return false;
+  const nowSec = (opts.now ?? Date.now()) / 1e3;
+  const tolerance = opts.toleranceSec ?? 300;
+  if (Math.abs(nowSec - ts) > tolerance) return false;
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const mac = await crypto.subtle.sign("HMAC", key, enc.encode(`${t}.${payload}`));
+  return timingSafeEqual(toHex(mac), v1);
+}
+function stripeForm(params) {
+  const out = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v === void 0 || v === null) continue;
+    if (typeof v === "object") {
+      for (const [k2, v2] of Object.entries(v)) {
+        if (v2 !== void 0 && v2 !== null) out.append(`${k}[${k2}]`, String(v2));
       }
-      if (url.pathname === "/api/me") {
-        const u = await verifyUser(req, env);
-        if (!u) return json({ authorized: false }, 401);
-        const db = makeDb(env);
-        const role = await roleFor(db, u);
-        const superAdmin = await isSuperAdminEmail(db, u.email);
-        return json({ authorized: isAdminRole(role, auth), role, superAdmin, email: u.email ?? null });
+    } else {
+      out.append(k, String(v));
+    }
+  }
+  return out.toString();
+}
+function webhookMutationId(eventId) {
+  return `stripe:${eventId}`;
+}
+function findApplicationRef(obj) {
+  const metaOf = (v) => v && typeof v === "object" ? v.metadata ?? {} : {};
+  const pick = (m) => typeof m.applicationId === "string" ? m.applicationId : void 0;
+  const applicationId = pick(metaOf(obj)) ?? pick(metaOf(obj.subscription_details)) ?? pick(metaOf(obj.parent?.subscription_details));
+  const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
+  return { ...applicationId ? { applicationId } : {}, ...customerId ? { customerId } : {} };
+}
+function normalizeWebhookEvent(event) {
+  const obj = event.data?.object ?? {};
+  const ref = findApplicationRef(obj);
+  switch (event.type) {
+    case "invoice.paid": {
+      const lines = obj.lines?.data ?? [];
+      const periodEnd = lines[0]?.period?.end;
+      const renewalAt = typeof periodEnd === "number" ? periodEnd * 1e3 : void 0;
+      const kind = obj.billing_reason === "subscription_create" ? "first_payment" : "renewal";
+      return { kind, ...ref, ...renewalAt !== void 0 ? { renewalAt } : {} };
+    }
+    case "charge.refunded":
+      return { kind: "refunded", ...ref };
+    case "customer.subscription.deleted":
+      return { kind: "canceled", ...ref };
+    default:
+      return { kind: "ignored", type: event.type };
+  }
+}
+function firstPaymentPatch(currentStatus, renewalAt) {
+  return {
+    ...currentStatus === "submitted" ? { status: "paid_pending_vetting" } : {},
+    ...renewalAt !== void 0 ? { renewalAt } : {}
+  };
+}
+function renewalPatch(renewalAt) {
+  return { renewalAt };
+}
+function refundedPatch() {
+  return { status: "refunded" };
+}
+function canceledPatch() {
+  return { canceled: true };
+}
+
+// src/payments-stripe.ts
+async function stripeCall(sk, method, path, params, idempotencyKey) {
+  const qs = method === "GET" && params ? `?${stripeForm(params)}` : "";
+  const headers = { authorization: `Bearer ${sk}` };
+  if (idempotencyKey) headers["idempotency-key"] = idempotencyKey;
+  const init = { method, headers };
+  if (method === "POST" && params) {
+    headers["content-type"] = "application/x-www-form-urlencoded";
+    init.body = stripeForm(params);
+  }
+  const res = await fetch(`https://api.stripe.com${path}${qs}`, init);
+  const body = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, body };
+}
+function fail(op, r) {
+  const err = new Error(`stripe ${op} failed: ${r.status}`);
+  err.code = "stripe_error";
+  throw err;
+}
+function clientSecretOf(sub) {
+  const inv = sub.latest_invoice;
+  const confirmation = inv?.confirmation_secret;
+  const intent = inv?.payment_intent;
+  const secret = confirmation?.client_secret ?? intent?.client_secret;
+  return typeof secret === "string" ? secret : void 0;
+}
+function requireSecret(secretKey) {
+  if (!secretKey) {
+    const err = new Error("stripe secret key missing");
+    err.code = "not_configured";
+    throw err;
+  }
+  return secretKey;
+}
+function createStripeProvider(config) {
+  const { secretKey, webhookSecret } = config;
+  return {
+    async createSubscription(input) {
+      const sk = requireSecret(secretKey);
+      const meta = { applicationId: input.applicationId, groupId: input.groupId, email: input.email };
+      let customerId = input.existingCustomerId;
+      if (!customerId) {
+        const cust = await stripeCall(
+          sk,
+          "POST",
+          "/v1/customers",
+          { email: input.email, name: input.name, metadata: meta },
+          `cus:${input.applicationId}`
+        );
+        if (!cust.ok) fail("customer create", cust);
+        customerId = String(cust.body.id);
       }
-      if (url.pathname === crmBase || url.pathname.startsWith(crmBase + "/")) {
-        const db = makeDb(env);
-        const routes = createCrmRoutes({
-          crm: chapter.crm,
-          db,
-          authorize: async (r) => {
-            const u = await verifyUser(r, env);
-            if (!u || !await isAdmin(db, u)) return null;
-            return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };
-          },
-          sender: crmSender(env),
-          from: env.EMAIL_FROM,
-          envName: env.ODLA_ENV,
-          baseUrl: url.origin,
-          basePath: crmBase
-        });
-        const res = await routes(req);
-        if (res) return res;
-        return json({ error: "not found" }, 404);
+      const sub = await stripeCall(
+        sk,
+        "POST",
+        "/v1/subscriptions",
+        {
+          customer: customerId,
+          "items[0][price]": input.priceId,
+          payment_behavior: "default_incomplete",
+          "payment_settings[save_default_payment_method]": "on_subscription",
+          "payment_settings[payment_method_types][0]": "card",
+          "expand[0]": "latest_invoice.confirmation_secret",
+          metadata: meta
+        },
+        // The hardening S&S lacked: one subscription per application, so a client
+        // retry between create and the db write can't orphan a second one.
+        `sub:${input.applicationId}`
+      );
+      if (!sub.ok) fail("subscription create", sub);
+      const clientSecret = clientSecretOf(sub.body);
+      if (!clientSecret) fail("subscription confirmation-secret missing", sub);
+      return { customerId, subscriptionId: String(sub.body.id), clientSecret };
+    },
+    async ingestWebhook(rawBody, sigHeader) {
+      if (!webhookSecret || !await verifyStripeSignature(rawBody, sigHeader, webhookSecret)) {
+        return { ok: false, reason: "bad_signature" };
       }
-      if (req.method === "POST" && url.pathname === "/api/network/shared") {
-        const db = makeDb(env);
-        const secret = await getVaultSecret(db, "network_share_secret");
-        const provided = (req.headers.get("authorization") ?? "").replace(/^Bearer /, "");
-        if (!secret || provided.length !== secret.length || provided !== secret) {
-          return json({ error: "unauthorized" }, 401);
-        }
-        let person;
-        try {
-          person = JSON.parse(await req.text());
-        } catch {
-          return json({ error: "invalid JSON body" }, 400);
-        }
-        if (typeof person.email !== "string" || typeof person.hubRecordId !== "string") {
-          return json({ error: "email and hubRecordId are required" }, 400);
-        }
-        const { recordId } = await projectSharedRecord(
-          { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-          person
-        );
-        return json({ recordId });
+      const event = JSON.parse(rawBody);
+      return { ok: true, eventId: event.id, event: normalizeWebhookEvent(event) };
+    },
+    async refund(input) {
+      const sk = requireSecret(secretKey);
+      const charges = await stripeCall(sk, "GET", "/v1/charges", { customer: input.customerId, limit: 100 });
+      if (!charges.ok) fail("charges list", charges);
+      const rows = charges.body.data ?? [];
+      const paid = rows.filter((c) => c.status === "succeeded" && c.refunded !== true);
+      const charge = paid[paid.length - 1];
+      if (!charge) {
+        const err = new Error("no paid charge to refund");
+        err.code = "no_charge";
+        throw err;
       }
-      if (chapter.mode === "chapter") {
-        if (req.method === "GET" && url.pathname === "/api/join-config") {
-          const db = makeDb(env);
-          const groupId = url.searchParams.get("group") ?? chapter.id;
-          const { groups } = await db.query({ groups: { $: { where: { id: groupId }, limit: 1 } } });
-          const group = Array.isArray(groups) ? groups[0] : void 0;
-          if (!group) return json({ error: "not found" }, 404);
-          const stripeKey = await getVaultSecret(db, "stripe_secret_key");
-          const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
-          return json(joinConfig(group, paymentsReady));
-        }
-        if (req.method === "POST" && url.pathname === "/api/applications") {
-          const raw = await req.text();
-          if (raw.length > chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
-          let parsed;
-          try {
-            parsed = JSON.parse(raw);
-          } catch {
-            return json({ error: "invalid JSON body" }, 400);
-          }
-          const submissionId = typeof parsed.submissionId === "string" ? parsed.submissionId : void 0;
-          const result = await submitApplication(makeDb(env), chapter, parsed, {
-            submissionId,
-            groupId: chapter.id,
-            now: Date.now(),
-            newId: () => crypto.randomUUID()
-          });
-          if (!result.ok) return json({ error: result.error }, 400);
-          return json({ id: result.id, duplicate: result.duplicate, status: result.status });
-        }
+      const refund = await stripeCall(sk, "POST", "/v1/refunds", { charge: String(charge.id) });
+      if (!refund.ok) fail("refund", refund);
+      const cancel = await stripeCall(sk, "DELETE", `/v1/subscriptions/${input.subscriptionId}`);
+      const amount = refund.body.amount;
+      return { refundedCents: typeof amount === "number" ? amount : null, subscriptionCanceled: cancel.ok };
+    }
+  };
+}
+
+// src/worker-routes-payments.ts
+var codeOf = (err) => err && typeof err === "object" && typeof err.code === "string" ? err.code : "unknown";
+async function firstRow2(db, ns, q) {
+  const res = await db.query({ [ns]: { $: q } });
+  const rows = res[ns];
+  return Array.isArray(rows) ? rows[0] : void 0;
+}
+function lineItems(group) {
+  const standard = Number(group.standardPriceCents ?? 0);
+  const discount = Number(group.foundingDiscountCents ?? 0);
+  return { standardCents: standard, discountCents: discount, dueTodayCents: standard - discount };
+}
+async function findApplication(db, event) {
+  if ("applicationId" in event && event.applicationId) {
+    return firstRow2(db, "applications", { where: { id: event.applicationId }, limit: 1 });
+  }
+  if ("customerId" in event && event.customerId) {
+    return firstRow2(db, "applications", { where: { stripeCustomerId: event.customerId }, order: { createdAt: "desc" }, limit: 1 });
+  }
+  return void 0;
+}
+function webhookPatch(event, status) {
+  switch (event.kind) {
+    case "first_payment":
+      return firstPaymentPatch(status, event.renewalAt);
+    case "renewal":
+      return event.renewalAt !== void 0 ? renewalPatch(event.renewalAt) : {};
+    case "refunded":
+      return refundedPatch();
+    case "canceled":
+      return canceledPatch();
+    default:
+      return {};
+  }
+}
+async function startSubscription(req, env, ctx) {
+  let body;
+  try {
+    body = JSON.parse(await req.text());
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const applicationId = typeof body.applicationId === "string" ? body.applicationId : "";
+  if (!applicationId) return json({ error: "applicationId required" }, 400);
+  if (body.refundPolicyAck !== true) return json({ error: "refundPolicyAck required" }, 400);
+  const db = ctx.makeDb(env);
+  const app = await firstRow2(db, "applications", { where: { id: applicationId }, limit: 1 });
+  if (!app) return json({ error: "not found" }, 404);
+  if (app.status !== "submitted") return json({ error: "already processed" }, 409);
+  const group = await firstRow2(db, "groups", { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 });
+  const priceId = group?.stripePriceId;
+  const secretKey = await getVaultSecret(db, "stripe_secret_key");
+  if (!group || !priceId || !secretKey) return json({ error: "payments not configured" }, 503);
+  const provider = createStripeProvider({ secretKey });
+  let result;
+  try {
+    result = await provider.createSubscription({
+      applicationId,
+      groupId: String(group.id),
+      email: String(app.email ?? ""),
+      name: `${app.firstName ?? ""} ${app.lastName ?? ""}`.trim(),
+      priceId: String(priceId),
+      existingCustomerId: typeof app.stripeCustomerId === "string" ? app.stripeCustomerId : void 0
+    });
+  } catch (err) {
+    return json({ error: "payment setup failed", code: codeOf(err) }, 502);
+  }
+  await db.transact([
+    {
+      t: "update",
+      ns: "applications",
+      id: applicationId,
+      attrs: { stripeCustomerId: result.customerId, stripeSubscriptionId: result.subscriptionId, refundPolicyAckAt: Date.now() }
+    }
+  ]);
+  return json({ clientSecret: result.clientSecret, publishableKey: group.stripePublishableKey ?? null, lineItems: lineItems(group) });
+}
+async function ingestWebhook(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const webhookSecret = await getVaultSecret(db, "stripe_webhook_secret");
+  if (!webhookSecret) return json({ error: "webhook not configured" }, 503);
+  const rawBody = await req.text();
+  const ingest = await createStripeProvider({ webhookSecret }).ingestWebhook(rawBody, req.headers.get("stripe-signature") ?? "");
+  if (!ingest.ok) return json({ error: "invalid signature" }, 400);
+  const { eventId, event } = ingest;
+  if (event.kind === "ignored") return json({ ok: true, ignored: event.type });
+  const app = await findApplication(db, event);
+  if (!app) return json({ ok: true, matched: false });
+  const patch = webhookPatch(event, String(app.status ?? ""));
+  if (Object.keys(patch).length) {
+    await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: patch }], { mutationId: webhookMutationId(eventId) });
+  }
+  return json({ ok: true });
+}
+async function refundApplication(req, url, env, ctx) {
+  const rawDb = ctx.makeDb(env);
+  const u = await ctx.verifyUser(req, env);
+  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
+  const id = url.pathname.split("/")[4] ?? "";
+  const db = rawDb;
+  const app = await firstRow2(db, "applications", { where: { id }, limit: 1 });
+  if (!app) return json({ error: "not found" }, 404);
+  if (app.status === "refunded") return json({ error: "already refunded" }, 409);
+  if (app.status === "approved") return json({ error: "approved memberships are non-refundable" }, 409);
+  if (!app.stripeSubscriptionId) return json({ error: "no subscription on file" }, 409);
+  if (!app.stripeCustomerId) return json({ error: "no customer on file" }, 409);
+  const secretKey = await getVaultSecret(db, "stripe_secret_key");
+  if (!secretKey) return json({ error: "payments not configured" }, 503);
+  try {
+    const result = await createStripeProvider({ secretKey }).refund({
+      customerId: String(app.stripeCustomerId),
+      subscriptionId: String(app.stripeSubscriptionId)
+    });
+    return json({ ok: true, refundedCents: result.refundedCents, subscriptionCanceled: result.subscriptionCanceled });
+  } catch (err) {
+    const code = codeOf(err);
+    return json({ error: "refund failed", code }, code === "no_charge" ? 409 : 502);
+  }
+}
+var REFUND_PATH = /^\/api\/admin\/applications\/[^/]+\/refund$/;
+var handlePayments = async (req, url, env, ctx) => {
+  if (ctx.chapter.mode !== "chapter") return null;
+  if (req.method === "POST" && url.pathname === "/api/payments/subscription") return startSubscription(req, env, ctx);
+  if (req.method === "POST" && url.pathname === "/api/webhooks/stripe") return ingestWebhook(req, env, ctx);
+  if (req.method === "POST" && REFUND_PATH.test(url.pathname)) return refundApplication(req, url, env, ctx);
+  return null;
+};
+
+// src/worker.ts
+var ROUTES = [handleConfig, handleMe, handleCrm, handleNetworkShared, handleMember, handleSchedule, handlePayments];
+function chapterWorker(options) {
+  const ctx = createWorkerContext(options);
+  return {
+    async fetch(req, env) {
+      const url = new URL(req.url);
+      for (const route of ROUTES) {
+        const res = await route(req, url, env, ctx);
+        if (res) return res;
       }
       return env.ASSETS.fetch(req);
     }
   };
-  return handler;
 }
 export {
   chapterWorker