@odla-ai/chapter 0.32.3 → 0.33.1

package/dist/worker/index.cjs

@@ -21,7 +21,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var worker_exports = {};
 __export(worker_exports, {
   chapterWorker: () => chapterWorker,
-  createWorkerContext: () => createWorkerContext
+  createWorkerContext: () => createWorkerContext,
+  deliverSignupControl: () => deliverSignupControl
 });
 module.exports = __toCommonJS(worker_exports);
 
@@ -195,6 +196,56 @@ async function applicationIdForSubmission(submissionId) {
 }
 
 // src/member.ts
+var DEFAULT_REQUIRED = ["firstName", "lastName", "email", "referral", "whoYouAre", "message"];
+var DEFAULT_OPTIONAL = ["referralName", "linkedin", "phone", "state"];
+var SCHEMA_FIELD = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+function resolveApplication(a) {
+  const required = a?.required ?? DEFAULT_REQUIRED;
+  const optional = a?.optional ?? DEFAULT_OPTIONAL;
+  for (const [name, arr] of [["required", required], ["optional", optional]]) {
+    if (!Array.isArray(arr) || !arr.every((f) => typeof f === "string" && f !== "")) {
+      throw new Error(`defineChapter.application.${name}: must be an array of field-name strings`);
+    }
+    const unsafe = arr.find((field) => !SCHEMA_FIELD.test(field));
+    if (unsafe) {
+      throw new Error(`defineChapter.application.${name}: field "${unsafe}" must match ${SCHEMA_FIELD.source}`);
+    }
+  }
+  const duplicate = [...required, ...optional].find((field, index, fields) => fields.indexOf(field) !== index);
+  if (duplicate) {
+    throw new Error(`defineChapter.application: duplicate field "${duplicate}" across required/optional lists`);
+  }
+  if (a?.profileFields !== void 0 && (!Array.isArray(a.profileFields) || !a.profileFields.every((f) => typeof f === "string" && f !== ""))) {
+    throw new Error("defineChapter.application.profileFields: must be an array of field-name strings");
+  }
+  if (a?.crmFields !== void 0 && (!Array.isArray(a.crmFields) || !a.crmFields.every((f) => typeof f === "string" && f !== ""))) {
+    throw new Error("defineChapter.application.crmFields: must be an array of field-name strings");
+  }
+  const conditions = a?.conditions ?? {};
+  for (const [field, declared] of Object.entries(conditions)) {
+    for (const key of ["visibleWhen", "requiredWhen"]) {
+      const expression = declared?.[key];
+      if (expression === void 0) continue;
+      if (typeof expression !== "string" || !expression.trim()) {
+        throw new Error(`defineChapter.application.conditions.${field}.${key}: must be a non-empty CEL condition`);
+      }
+      (0, import_crm.assertFieldCondition)(expression, `defineChapter.application.conditions.${field}.${key}`);
+    }
+  }
+  return {
+    required,
+    optional,
+    conditions,
+    maxLen: a?.maxLen ?? {},
+    defaultMaxLen: a?.defaultMaxLen ?? 2e3,
+    bodyCap: a?.bodyCap ?? 32768,
+    requireDisclaimerAck: a?.requireDisclaimerAck ?? true,
+    profileFields: a?.profileFields ?? [],
+    crmFields: a?.crmFields ?? [],
+    maxArrayLen: a?.maxArrayLen ?? 100,
+    validateEmail: a?.validateEmail ?? true
+  };
+}
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function isValidEmail(value) {
   return typeof value === "string" && EMAIL_RE.test(value);
@@ -471,6 +522,101 @@ function canApprove(status, p) {
   return p.approvableFrom.includes(status);
 }
 
+// src/signup-control-store.ts
+function asStored(row) {
+  if (!row || typeof row.document !== "object" || row.document === null) return null;
+  return row;
+}
+async function hasSignupControl(db, targetId, environment, active) {
+  const where = { targetId, environment, ...active ? { active: true } : {} };
+  if (db.aggregate) {
+    return Number((await db.aggregate("signupControls", { count: true }, { where })).count ?? 0) > 0;
+  }
+  const rows2 = (await db.query({ signupControls: {} })).signupControls;
+  return Array.isArray(rows2) && rows2.some((row) => row.targetId === targetId && row.environment === environment && (!active || row.active === true));
+}
+async function loadLatestSignupControl(db, targetId, environment) {
+  if (!await hasSignupControl(db, targetId, environment)) return null;
+  const rows2 = (await db.query({ signupControls: { $: {
+    where: { targetId, environment },
+    order: { revision: "desc" },
+    limit: 1
+  } } })).signupControls;
+  const latest = Array.isArray(rows2) ? [...rows2].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  return asStored(latest);
+}
+async function loadActiveSignupControl(db, targetId, environment) {
+  if (!await hasSignupControl(db, targetId, environment, true)) return null;
+  const rows2 = (await db.query({ signupControls: { $: {
+    where: { targetId, environment, active: true },
+    order: { revision: "desc" },
+    limit: 1
+  } } })).signupControls;
+  const active = Array.isArray(rows2) ? [...rows2].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  return asStored(active);
+}
+function controlledApplication(base, document) {
+  const delegated = document?.application;
+  return delegated ? { ...base, required: delegated.required, optional: delegated.optional, conditions: { ...delegated.conditions ?? {} } } : base;
+}
+function validateControlledApplication(chapter, document) {
+  if (!document.application) return [];
+  const declared = /* @__PURE__ */ new Set([...chapter.application.required, ...chapter.application.optional]);
+  return [...document.application.required, ...document.application.optional].filter((field) => !declared.has(field)).map((field) => `document.application field "${field}" is not declared by this chapter schema`);
+}
+function groupAttrs(document) {
+  const first = [...document.tiers].filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder)[0];
+  const firstPaid = [...document.tiers].find((tier) => tier.available && tier.priceCents > 0);
+  return {
+    ...first ? { standardPriceCents: first.priceCents } : {},
+    foundingDiscountCents: 0,
+    stripePriceId: firstPaid?.stripePriceId ?? null,
+    ...document.policy ?? {},
+    ...document.scheduling ? { schedulingJson: document.scheduling } : {}
+  };
+}
+async function materializeSignupControl(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const currentRows = (await db.query({ tiers: { $: {
+    where: { groupId: document.target.chapterId },
+    limit: 100
+  } } })).tiers ?? [];
+  const incoming = new Set(document.tiers.map((tier) => tier.id));
+  const ops = [];
+  if (previous?.active) ops.push({ t: "update", ns: "signupControls", id: previous.id, attrs: { active: false } });
+  for (const row of currentRows) {
+    const id2 = String(row.id ?? "");
+    if (id2 && !incoming.has(id2)) ops.push({ t: "update", ns: "tiers", id: id2, attrs: { active: false } });
+  }
+  for (const tier of document.tiers) {
+    ops.push({ t: "update", ns: "tiers", id: tier.id, attrs: {
+      id: tier.id,
+      groupId: document.target.chapterId,
+      name: tier.name,
+      priceCents: tier.priceCents,
+      stripePriceId: tier.stripePriceId ?? null,
+      blurb: tier.blurb ?? null,
+      sortOrder: tier.sortOrder,
+      active: tier.available,
+      createdAt: receivedAt
+    } });
+  }
+  ops.push({ t: "update", ns: "groups", id: document.target.chapterId, attrs: groupAttrs(document) });
+  const id = `signup-control:${document.target.environment}:${document.revision}`;
+  ops.push({ t: "update", ns: "signupControls", id, attrs: {
+    id,
+    sourceId: document.source.appId,
+    targetId: document.target.chapterId,
+    environment: document.target.environment,
+    revision: document.revision,
+    digest,
+    document,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `signup-control:${document.target.environment}:${document.revision}:${digest}` });
+}
+
 // src/session.ts
 function applicationSummary(app) {
   return {
@@ -813,10 +959,10 @@ function planDelivery(input) {
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
   const to = redirect ? input.group.debugEmail : input.to;
   const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
-  const text = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text2 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + render(tpl.text, vars) : render(tpl.text, vars);
-  return { deliver: true, transport, to, subject, text, redirected: redirect };
+  return { deliver: true, transport, to, subject, text: text2, redirected: redirect };
 }
 
 // src/notify.ts
@@ -1105,9 +1251,18 @@ var handleMember = async (req, url, env, ctx) => {
       group,
       Boolean(stripeKey)
     );
+    const activeControl = chapter.signupControl ? await loadActiveSignupControl(db, chapter.id, env.ODLA_ENV) : null;
+    const application = controlledApplication(chapter.application, activeControl?.document);
     return json({
-      ...joinConfig(group, paymentsReady, joinConfigTiers(offered), chapter.application.conditions),
-      copy: chapter.copy.join
+      ...joinConfig(group, paymentsReady, joinConfigTiers(offered), application.conditions),
+      copy: { ...chapter.copy.join, ...activeControl?.document.application?.copy ?? {} },
+      ...activeControl ? { signupControl: {
+        revision: activeControl.revision,
+        digest: activeControl.digest,
+        membershipPage: activeControl.document.membershipPage,
+        application: activeControl.document.application,
+        theme: activeControl.document.theme
+      } } : {}
     });
   }
   if (req.method === "GET" && url.pathname === "/api/join/resume") {
@@ -1170,8 +1325,10 @@ var handleMember = async (req, url, env, ctx) => {
     }
     const submissionId = typeof parsed.submissionId === "string" ? parsed.submissionId : void 0;
     const db = ctx.makeDb(env);
+    const activeControl = chapter.signupControl ? await loadActiveSignupControl(db, chapter.id, env.ODLA_ENV) : null;
+    const effectiveChapter = activeControl ? { ...chapter, application: controlledApplication(chapter.application, activeControl.document) } : chapter;
     const offeredTierIds = typeof parsed.tierId === "string" && parsed.tierId ? (await loadTiers(db, { id: chapter.id })).map((tier) => tier.id) : void 0;
-    const result = await submitApplication(db, chapter, parsed, {
+    const result = await submitApplication(db, effectiveChapter, parsed, {
       submissionId,
       groupId: chapter.id,
       now: Date.now(),
@@ -1180,10 +1337,10 @@ var handleMember = async (req, url, env, ctx) => {
     });
     if (!result.ok) return json({ error: result.error }, 400);
     if (!result.duplicate) {
-      if (chapter.sends.adminNotification === "submit") {
+      if (effectiveChapter.sends.adminNotification === "submit") {
         await notifyAdminOfApplication(db, env, chapter.id, result.id, parsed);
       }
-      await provisionApplicant(db, chapter, result.id, parsed);
+      await provisionApplicant(db, effectiveChapter, result.id, parsed);
     }
     return json({
       id: result.id,
@@ -1253,6 +1410,433 @@ var handleNetworkShared = async (req, url, env, ctx) => {
   }
 };
 
+// src/worker-routes-signup-control.ts
+var import_db3 = require("@odla-ai/db");
+
+// src/signup-control-canonical.ts
+var encoder = new TextEncoder();
+function canonicalValue(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
+  const record = value;
+  const entries = Object.keys(record).sort().flatMap((key) => {
+    const item = record[key];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
+  });
+  return `{${entries.join(",")}}`;
+}
+function canonicalSignupControl(value) {
+  return canonicalValue(value);
+}
+async function signupControlDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalSignupControl(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/signup-control-contract.ts
+var SIGNUP_CONTROL_PATH = "/api/signup-control";
+
+// src/membership-page.ts
+var MEMBERSHIP_PAGE_RENDERER = "membership-cards-v1";
+var TIER_ID = /^[a-z][a-z0-9-]{0,79}$/;
+var VARIANTS = /* @__PURE__ */ new Set(["standard", "featured", "supporting"]);
+var ROOT_KEYS = /* @__PURE__ */ new Set(["schemaVersion", "renderer", "tiers", "footnoteMarkdown"]);
+var TIER_KEYS = /* @__PURE__ */ new Set([
+  "tierId",
+  "variant",
+  "badge",
+  "summaryMarkdown",
+  "priceEyebrow",
+  "compareAtPriceCents",
+  "billingLabel",
+  "priceNoteMarkdown",
+  "capacity",
+  "benefits",
+  "callout",
+  "ctaLabel"
+]);
+var CALLOUT_KEYS = /* @__PURE__ */ new Set(["label", "bodyMarkdown"]);
+var CAPACITY_KEYS = /* @__PURE__ */ new Set(["total", "label"]);
+var MAX_TIERS = 20;
+var MAX_BENEFITS = 24;
+var MAX_MARKDOWN = 65536;
+var MAX_LABEL = 160;
+var objectRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function rejectUnknownKeys(value, allowed, path, errors) {
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+  }
+}
+function boundedString(value, path, errors, max, required = false) {
+  if (value === void 0) {
+    if (required) errors.push(`${path} is required`);
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    errors.push(`${path} must be a string`);
+    return void 0;
+  }
+  const text2 = value.trim();
+  if (required && !text2) errors.push(`${path} is required`);
+  if (text2.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text2;
+}
+function validateMembershipPageDocument(input, options = {}) {
+  const errors = [];
+  const root = objectRecord(input);
+  if (!root) return { ok: false, errors: ["document must be an object"] };
+  rejectUnknownKeys(root, ROOT_KEYS, "document", errors);
+  if (root.schemaVersion !== 1) errors.push("document.schemaVersion must be 1");
+  if (root.renderer !== MEMBERSHIP_PAGE_RENDERER) {
+    errors.push(`document.renderer must be "${MEMBERSHIP_PAGE_RENDERER}"`);
+  }
+  if (!Array.isArray(root.tiers)) errors.push("document.tiers must be an array");
+  const rawTiers = Array.isArray(root.tiers) ? root.tiers : [];
+  if (Array.isArray(root.tiers) && rawTiers.length === 0) errors.push("document.tiers must include at least one tier");
+  if (rawTiers.length > MAX_TIERS) errors.push(`document.tiers supports at most ${MAX_TIERS} entries`);
+  const authority = new Map((options.tiers ?? []).map((tier) => [tier.id, tier]));
+  const seen = /* @__PURE__ */ new Set();
+  const tiers = [];
+  for (const [index, raw] of rawTiers.slice(0, MAX_TIERS).entries()) {
+    const path = `document.tiers[${index}]`;
+    const item = objectRecord(raw);
+    if (!item) {
+      errors.push(`${path} must be an object`);
+      continue;
+    }
+    rejectUnknownKeys(item, TIER_KEYS, path, errors);
+    const tierId = boundedString(item.tierId, `${path}.tierId`, errors, 80, true) ?? "";
+    if (tierId && !TIER_ID.test(tierId)) errors.push(`${path}.tierId must be a lowercase kebab-case id`);
+    if (seen.has(tierId)) errors.push(`${path}.tierId duplicates "${tierId}"`);
+    seen.add(tierId);
+    if (authority.size && !authority.has(tierId)) errors.push(`${path}.tierId "${tierId}" is not an offered tier`);
+    const variant = item.variant;
+    if (variant !== void 0 && (typeof variant !== "string" || !VARIANTS.has(variant))) {
+      errors.push(`${path}.variant must be standard, featured, or supporting`);
+    }
+    const compareAt = item.compareAtPriceCents;
+    if (compareAt !== void 0 && (!Number.isInteger(compareAt) || Number(compareAt) < 0 || Number(compareAt) > 1e8)) {
+      errors.push(`${path}.compareAtPriceCents must be an integer from 0 to 100,000,000`);
+    }
+    const actual = authority.get(tierId)?.priceCents;
+    if (Number.isInteger(compareAt) && actual !== void 0 && Number(compareAt) <= actual) {
+      errors.push(`${path}.compareAtPriceCents must be greater than the authoritative tier price`);
+    }
+    let benefits;
+    if (item.benefits !== void 0) {
+      if (!Array.isArray(item.benefits)) errors.push(`${path}.benefits must be an array`);
+      else {
+        if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
+        benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
+          const text2 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text2 ? [text2] : [];
+        });
+      }
+    }
+    let callout;
+    if (item.callout !== void 0) {
+      const rawCallout = objectRecord(item.callout);
+      if (!rawCallout) errors.push(`${path}.callout must be an object`);
+      else {
+        rejectUnknownKeys(rawCallout, CALLOUT_KEYS, `${path}.callout`, errors);
+        const bodyMarkdown = boundedString(rawCallout.bodyMarkdown, `${path}.callout.bodyMarkdown`, errors, MAX_MARKDOWN, true);
+        const label = boundedString(rawCallout.label, `${path}.callout.label`, errors, MAX_LABEL);
+        if (bodyMarkdown) callout = { ...label ? { label } : {}, bodyMarkdown };
+      }
+    }
+    let capacity;
+    if (item.capacity !== void 0) {
+      const rawCapacity = objectRecord(item.capacity);
+      if (!rawCapacity) errors.push(`${path}.capacity must be an object`);
+      else {
+        rejectUnknownKeys(rawCapacity, CAPACITY_KEYS, `${path}.capacity`, errors);
+        const total = rawCapacity.total;
+        if (!Number.isInteger(total) || Number(total) < 1 || Number(total) > 1e6) {
+          errors.push(`${path}.capacity.total must be an integer from 1 to 1,000,000`);
+        }
+        const label = boundedString(rawCapacity.label, `${path}.capacity.label`, errors, MAX_LABEL);
+        if (Number.isInteger(total) && Number(total) >= 1 && Number(total) <= 1e6) {
+          capacity = { total: Number(total), ...label ? { label } : {} };
+        }
+      }
+    }
+    const badge = boundedString(item.badge, `${path}.badge`, errors, MAX_LABEL);
+    const summaryMarkdown = boundedString(item.summaryMarkdown, `${path}.summaryMarkdown`, errors, MAX_MARKDOWN);
+    const priceEyebrow = boundedString(item.priceEyebrow, `${path}.priceEyebrow`, errors, MAX_LABEL);
+    const billingLabel = boundedString(item.billingLabel, `${path}.billingLabel`, errors, MAX_LABEL);
+    const priceNoteMarkdown = boundedString(item.priceNoteMarkdown, `${path}.priceNoteMarkdown`, errors, MAX_MARKDOWN);
+    const ctaLabel = boundedString(item.ctaLabel, `${path}.ctaLabel`, errors, MAX_LABEL);
+    tiers.push({
+      tierId,
+      ...typeof variant === "string" && VARIANTS.has(variant) ? { variant } : {},
+      ...badge ? { badge } : {},
+      ...summaryMarkdown ? { summaryMarkdown } : {},
+      ...priceEyebrow ? { priceEyebrow } : {},
+      ...Number.isInteger(compareAt) ? { compareAtPriceCents: Number(compareAt) } : {},
+      ...billingLabel ? { billingLabel } : {},
+      ...priceNoteMarkdown ? { priceNoteMarkdown } : {},
+      ...capacity ? { capacity } : {},
+      ...benefits ? { benefits } : {},
+      ...callout ? { callout } : {},
+      ...ctaLabel ? { ctaLabel } : {}
+    });
+  }
+  if (authority.size) {
+    for (const tierId of authority.keys()) {
+      if (!seen.has(tierId)) errors.push(`document.tiers is missing offered tier "${tierId}"`);
+    }
+  }
+  const footnoteMarkdown = boundedString(root.footnoteMarkdown, "document.footnoteMarkdown", errors, MAX_MARKDOWN);
+  if (errors.length) return { ok: false, errors };
+  return {
+    ok: true,
+    value: {
+      schemaVersion: 1,
+      renderer: MEMBERSHIP_PAGE_RENDERER,
+      tiers,
+      ...footnoteMarkdown ? { footnoteMarkdown } : {}
+    }
+  };
+}
+
+// src/signup-control-validate.ts
+var SLUG = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var ENVIRONMENT = /^[a-z][a-z0-9_-]{0,62}$/;
+var TIER = /^[a-z][a-z0-9-]{0,79}$/;
+var PRICE = /^price_[A-Za-z0-9]{12,}$/;
+var ROOT_KEYS2 = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "revision",
+  "generatedAt",
+  "source",
+  "target",
+  "tiers",
+  "membershipPage",
+  "application",
+  "policy",
+  "scheduling",
+  "theme"
+]);
+var TIER_KEYS2 = /* @__PURE__ */ new Set(["id", "name", "available", "sortOrder", "priceCents", "stripePriceId", "blurb"]);
+var recordOf = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function unknownKeys(value, allowed, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+}
+function text(value, path, errors, max = 65536) {
+  if (typeof value !== "string" || !value.trim()) {
+    errors.push(`${path} is required`);
+    return "";
+  }
+  if (value.length > max) errors.push(`${path} must be at most ${max} characters`);
+  return value.trim();
+}
+function tiersOf(value, errors) {
+  if (!Array.isArray(value) || !value.length) {
+    errors.push("document.tiers must be a non-empty array");
+    return [];
+  }
+  if (value.length > 20) errors.push("document.tiers supports at most 20 entries");
+  const seen = /* @__PURE__ */ new Set();
+  return value.slice(0, 20).flatMap((raw, index) => {
+    const path = `document.tiers[${index}]`;
+    const item = recordOf(raw);
+    if (!item) {
+      errors.push(`${path} must be an object`);
+      return [];
+    }
+    unknownKeys(item, TIER_KEYS2, path, errors);
+    const id = text(item.id, `${path}.id`, errors, 80);
+    if (id && !TIER.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (seen.has(id)) errors.push(`${path}.id duplicates "${id}"`);
+    seen.add(id);
+    const name = text(item.name, `${path}.name`, errors, 160);
+    if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
+    if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
+    if (!Number.isInteger(item.priceCents) || Number(item.priceCents) < 0 || Number(item.priceCents) > 1e8) {
+      errors.push(`${path}.priceCents must be an integer from 0 to 100,000,000`);
+    }
+    if (item.stripePriceId !== void 0 && (typeof item.stripePriceId !== "string" || !PRICE.test(item.stripePriceId))) {
+      errors.push(`${path}.stripePriceId must be a real Stripe Price id`);
+    }
+    if (item.available === true && Number(item.priceCents) > 0 && !item.stripePriceId) {
+      errors.push(`${path}.stripePriceId is required for an available paid tier`);
+    }
+    const blurb = item.blurb === void 0 ? void 0 : text(item.blurb, `${path}.blurb`, errors, 4e3);
+    return [{
+      id,
+      name,
+      available: item.available === true,
+      sortOrder: Number(item.sortOrder) || 0,
+      priceCents: Number(item.priceCents) || 0,
+      ...typeof item.stripePriceId === "string" ? { stripePriceId: item.stripePriceId } : {},
+      ...blurb ? { blurb } : {}
+    }];
+  });
+}
+function applicationOf(value, errors) {
+  if (value === void 0) return void 0;
+  const input = recordOf(value);
+  if (!input) {
+    errors.push("document.application must be an object");
+    return void 0;
+  }
+  unknownKeys(input, /* @__PURE__ */ new Set(["required", "optional", "conditions", "copy"]), "document.application", errors);
+  try {
+    const resolved = resolveApplication(input);
+    const copy = recordOf(input.copy);
+    if (input.copy !== void 0 && (!copy || Object.values(copy).some((item) => typeof item !== "string"))) {
+      errors.push("document.application.copy must contain only string values");
+    }
+    return {
+      required: resolved.required,
+      optional: resolved.optional,
+      ...Object.keys(resolved.conditions).length ? { conditions: resolved.conditions } : {},
+      ...copy ? { copy } : {}
+    };
+  } catch (error) {
+    errors.push(error instanceof Error ? error.message : "document.application is invalid");
+    return void 0;
+  }
+}
+function policyOf(value, errors) {
+  if (value === void 0) return void 0;
+  const input = recordOf(value);
+  if (!input) {
+    errors.push("document.policy must be an object");
+    return void 0;
+  }
+  const allowed = /* @__PURE__ */ new Set(["disclaimerText", "refundPolicyText", "trustCopy", "commitmentText", "normsText"]);
+  unknownKeys(input, allowed, "document.policy", errors);
+  const result = {};
+  for (const key of allowed) {
+    if (input[key] === void 0 && key !== "disclaimerText" && key !== "refundPolicyText") continue;
+    result[key] = text(input[key], `document.policy.${key}`, errors);
+  }
+  return result;
+}
+function themeOf(value, errors) {
+  if (value === void 0) return void 0;
+  const input = recordOf(value);
+  const tokens = recordOf(input?.tokens);
+  if (!input || !tokens) {
+    errors.push("document.theme.tokens must be an object");
+    return void 0;
+  }
+  unknownKeys(input, /* @__PURE__ */ new Set(["tokens"]), "document.theme", errors);
+  if (Object.keys(tokens).length > 256) errors.push("document.theme.tokens supports at most 256 entries");
+  for (const [key, token] of Object.entries(tokens)) {
+    if (!/^--[a-z0-9-]{1,100}$/.test(key)) errors.push(`document.theme.tokens.${key} must be a CSS custom-property name`);
+    if (typeof token !== "string" && typeof token !== "number" || String(token).length > 1e3) {
+      errors.push(`document.theme.tokens.${key} must be a bounded string or number`);
+    }
+  }
+  return { tokens };
+}
+function validateSignupControlDocument(input) {
+  const errors = [];
+  const root = recordOf(input);
+  if (!root) return { ok: false, errors: ["document must be an object"] };
+  unknownKeys(root, ROOT_KEYS2, "document", errors);
+  if (root.schemaVersion !== 1) errors.push("document.schemaVersion must be 1");
+  if (!Number.isSafeInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
+  const source = recordOf(root.source);
+  const target = recordOf(root.target);
+  const appId = text(source?.appId, "document.source.appId", errors, 63);
+  const chapterId = text(target?.chapterId, "document.target.chapterId", errors, 63);
+  const environment = text(target?.environment, "document.target.environment", errors, 63);
+  if (appId && !SLUG.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+  if (chapterId && !SLUG.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
+  if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
+  if (target?.stripeMode !== "test" && target?.stripeMode !== "live") errors.push("document.target.stripeMode must be test or live");
+  const tiers = tiersOf(root.tiers, errors);
+  const available = tiers.filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder);
+  const page = validateMembershipPageDocument(root.membershipPage, { tiers: available });
+  if (!page.ok) errors.push(...page.errors);
+  else if (page.value.tiers.some((tier, index) => tier.tierId !== available[index]?.id)) {
+    errors.push("document.membershipPage.tiers must follow the available tier display order");
+  }
+  const application = applicationOf(root.application, errors);
+  const policy = policyOf(root.policy, errors);
+  let scheduling;
+  if (root.scheduling !== void 0) {
+    const checked = validateScheduling(root.scheduling);
+    if (!checked.ok) errors.push(...Object.entries(checked.errors).map(([key, value]) => `document.scheduling.${key}: ${value}`));
+    else scheduling = root.scheduling;
+  }
+  const theme = themeOf(root.theme, errors);
+  if (errors.length || !page.ok) return { ok: false, errors };
+  return { ok: true, value: {
+    schemaVersion: 1,
+    revision: Number(root.revision),
+    generatedAt: Number(root.generatedAt),
+    source: { appId },
+    target: { chapterId, environment, stripeMode: target?.stripeMode },
+    tiers,
+    membershipPage: page.value,
+    ...application ? { application } : {},
+    ...policy ? { policy } : {},
+    ...scheduling ? { scheduling } : {},
+    ...theme ? { theme } : {}
+  } };
+}
+
+// src/worker-routes-signup-control.ts
+var reject = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
+var handleSignupControl = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== SIGNUP_CONTROL_PATH) return null;
+  const authority = ctx.chapter.signupControl;
+  if (!authority) return json({ error: "not found" }, 404);
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, authority.secretName);
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  const verified = await (0, import_db3.verifyFederatedRequest)(req, { secret, senders: [authority.sourceId] });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return reject("invalid_document", 400, ["request body must be JSON"]);
+  }
+  const digest = typeof input.digest === "string" ? input.digest : "";
+  const checked = validateSignupControlDocument(input.document);
+  if (!checked.ok) return reject("invalid_document", 400, checked.errors);
+  const document = checked.value;
+  if (document.source.appId !== authority.sourceId) return reject("wrong_source", 403);
+  if (document.target.chapterId !== ctx.chapter.id) return reject("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject("wrong_environment", 409);
+  if (document.target.stripeMode !== authority.stripeMode) return reject("wrong_stripe_mode", 409);
+  const applicationErrors = validateControlledApplication(ctx.chapter, document);
+  if (applicationErrors.length) return reject("invalid_document", 400, applicationErrors);
+  if (!digest || await signupControlDigest(document) !== digest) return reject("invalid_digest", 400);
+  const latest = await loadLatestSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return reject("stale_revision", 409);
+  if (latest && document.revision === latest.revision) {
+    if (latest.digest !== digest) return reject("conflicting_revision", 409);
+    return json({
+      ok: true,
+      target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
+      revision: latest.revision,
+      digest: latest.digest,
+      status: "replayed",
+      acknowledgedAt: latest.receivedAt
+    });
+  }
+  const receivedAt = Date.now();
+  await materializeSignupControl(db, { digest, document }, latest, receivedAt);
+  return json({
+    ok: true,
+    target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
+    revision: document.revision,
+    digest,
+    status: "accepted",
+    acknowledgedAt: receivedAt
+  });
+};
+
 // src/crm-sync.ts
 var import_crm4 = require("@odla-ai/crm");
 var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
@@ -2600,11 +3184,11 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
   for (const key of EMAIL_TEMPLATE_NAMES) {
     const t = templates[key];
     const subject = typeof t?.subject === "string" ? t.subject.trim() : "";
-    const text = typeof t?.text === "string" ? t.text : "";
-    if (!subject || !text.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
+    const text2 = typeof t?.text === "string" ? t.text : "";
+    if (!subject || !text2.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
     if (/[\r\n]/.test(subject) || subject.length > 200) return json({ error: `template "${key}" subject must be a single line under 200 characters` }, 400);
-    if (text.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
-    clean[key] = { subject, text, enabled: t?.enabled !== false };
+    if (text2.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
+    clean[key] = { subject, text: text2, enabled: t?.enabled !== false };
   }
   const emailish = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   const notificationEmail = str2(body.notificationEmail).trim();
@@ -2699,7 +3283,7 @@ var handleAdminComms = async (req, url, env, ctx) => {
 
 // src/worker-routes-network.ts
 var import_crm6 = require("@odla-ai/crm");
-var import_db4 = require("@odla-ai/db");
+var import_db5 = require("@odla-ai/db");
 
 // src/worker-network-fetch.ts
 function targetFetcher(env, target) {
@@ -2717,7 +3301,7 @@ function fetchNetworkTarget(env, target, destination, init) {
 
 // src/worker-network-push.ts
 var import_crm5 = require("@odla-ai/crm");
-var import_db3 = require("@odla-ai/db");
+var import_db4 = require("@odla-ai/db");
 async function pushNetworkRecord(db, env, ctx, target, record) {
   const secret = await getVaultSecret(db, target.secretName);
   const crmDeps3 = {
@@ -2751,7 +3335,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
   const payloadBody = JSON.stringify(payload);
   const destination = new URL("/api/network/shared", target.url);
   try {
-    const signed = await (0, import_db3.signFederatedRequest)({
+    const signed = await (0, import_db4.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "POST",
@@ -2836,7 +3420,7 @@ var handleNetworkSnapshot = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db4.verifyFederatedRequest)(req, { secret });
+  const verified = await (0, import_db5.verifyFederatedRequest)(req, { secret });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const types = await Promise.all(
     Object.keys(ctx.chapter.crm.config.types).map((type) => (0, import_crm6.typeSummary)({ crm: ctx.chapter.crm, db }, type))
@@ -2854,7 +3438,7 @@ async function snapshotOne(db, env, ctx, target) {
   if (!secret) return { id: target.id, name: target.name, url: target.url, available: false, error: "edge secret is missing" };
   const destination = new URL("/api/network/snapshot", target.url);
   try {
-    const headers = await (0, import_db4.signFederatedRequest)({
+    const headers = await (0, import_db5.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
@@ -2947,7 +3531,7 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
 
 // src/worker-routes-network-records.ts
 var import_crm7 = require("@odla-ai/crm");
-var import_db5 = require("@odla-ai/db");
+var import_db6 = require("@odla-ai/db");
 var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
 var MAX_PAGE = 50;
 var MAX_OFFSET = 1e4;
@@ -2985,7 +3569,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db5.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db6.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -3030,7 +3614,7 @@ async function readTargetRecords(db, env, ctx, target, query) {
   const destination = new URL("/api/network/records", target.url);
   destination.search = query.toString();
   try {
-    const headers = await (0, import_db5.signFederatedRequest)({
+    const headers = await (0, import_db6.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
@@ -3165,7 +3749,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
 
 // src/worker-routes-network-shared-notes.ts
 var import_crm8 = require("@odla-ai/crm");
-var import_db6 = require("@odla-ai/db");
+var import_db7 = require("@odla-ai/db");
 var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
@@ -3224,7 +3808,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db6.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db7.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -3321,7 +3905,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   const destination = new URL("/api/network/shared-notes", target.url);
   destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
   try {
-    const headers = await (0, import_db6.signFederatedRequest)({
+    const headers = await (0, import_db7.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: req.method,
@@ -3441,6 +4025,31 @@ var handleFormation = async (req, url, env, ctx) => {
   }
 };
 
+// src/signup-control-delivery.ts
+var import_db8 = require("@odla-ai/db");
+async function deliverSignupControl(options) {
+  const destination = new URL(SIGNUP_CONTROL_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await (0, import_db8.signFederatedRequest)({
+    secret: options.secret,
+    sender: options.sender,
+    method: "POST",
+    url: destination,
+    body
+  });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, {
+    method: "POST",
+    headers: { ...signed, "content-type": "application/json" },
+    body
+  });
+  const result = await response.json();
+  if (!response.ok || (!("ok" in result) || result.ok !== true)) {
+    const rejection = result;
+    throw new Error(`signup control rejected (${response.status}): ${rejection.reason ?? rejection.error ?? "unknown"}`);
+  }
+  return result;
+}
+
 // src/worker.ts
 var BUILTIN_ROUTES = [
   handleHealth,
@@ -3448,6 +4057,7 @@ var BUILTIN_ROUTES = [
   handleMe,
   handleCrm,
   handleNetworkShared,
+  handleSignupControl,
   handleNetworkSnapshot,
   handleNetworkRecords,
   handleNetworkSharedNotes,