@odla-ai/chapter 0.35.0 → 0.37.0

package/dist/worker/index.js

@@ -167,6 +167,205 @@ async function applicationIdForSubmission(submissionId) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
+// src/admission-grants-contract.ts
+var ADMISSION_GRANTS_SCHEMA_VERSION = 1;
+var ADMISSION_GRANTS_PATH = "/api/admission-grants";
+
+// src/signup-control-canonical.ts
+var encoder = new TextEncoder();
+function canonicalValue(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
+  const record3 = value;
+  const entries = Object.keys(record3).sort().flatMap((key) => {
+    const item = record3[key];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
+  });
+  return `{${entries.join(",")}}`;
+}
+function canonicalSignupControl(value) {
+  return canonicalValue(value);
+}
+async function signupControlDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalSignupControl(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/admission-grants.ts
+var ID = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
+var MAX_GRANTS = 2e3;
+var MAX_NOTE = 2e3;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var isAdmissionEmail = (value) => EMAIL_RE.test(value);
+function normalizeAdmissionEmail(email) {
+  return email.trim().toLowerCase();
+}
+function validateAdmissionGrantDocument(input) {
+  const errors = [];
+  const root = input && typeof input === "object" ? input : {};
+  if (root.schemaVersion !== ADMISSION_GRANTS_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  const revision = Number(root.revision);
+  const generatedAt = Number(root.generatedAt);
+  if (!Number.isSafeInteger(revision) || revision < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isFinite(generatedAt) || generatedAt <= 0) errors.push("document.generatedAt must be epoch milliseconds");
+  const source = root.source && typeof root.source === "object" ? root.source : {};
+  const target = root.target && typeof root.target === "object" ? root.target : {};
+  const sourceId = typeof source.appId === "string" ? source.appId : "";
+  const sourceActor = typeof source.actor === "string" ? source.actor.trim() : "";
+  const chapterId = typeof target.chapterId === "string" ? target.chapterId : "";
+  const environment = typeof target.environment === "string" ? target.environment : "";
+  if (!ID.test(sourceId)) errors.push("document.source.appId must be an identifier");
+  if (!sourceActor || sourceActor.length > 256) errors.push("document.source.actor must be 1-256 characters");
+  if (!ID.test(chapterId)) errors.push("document.target.chapterId must be an identifier");
+  if (!ID.test(environment)) errors.push("document.target.environment must be an identifier");
+  if (!Array.isArray(root.grants)) errors.push("document.grants must be an array");
+  const rawGrants = Array.isArray(root.grants) ? root.grants : [];
+  if (rawGrants.length > MAX_GRANTS) errors.push(`document.grants supports at most ${MAX_GRANTS} entries`);
+  const grants = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  const seenEmails = /* @__PURE__ */ new Set();
+  for (const [index, raw] of rawGrants.slice(0, MAX_GRANTS).entries()) {
+    const grant = raw && typeof raw === "object" ? raw : {};
+    const id = typeof grant.id === "string" ? grant.id : "";
+    const email = typeof grant.email === "string" ? grant.email.trim() : "";
+    const normalized = normalizeAdmissionEmail(email);
+    const decision = grant.decision;
+    const note = typeof grant.note === "string" ? grant.note.trim() : void 0;
+    const expiresAt = grant.expiresAt === void 0 ? void 0 : Number(grant.expiresAt);
+    if (!ID.test(id)) errors.push(`document.grants[${index}].id must be an identifier`);
+    if (seenIds.has(id)) errors.push(`document.grants repeats id "${id}"`);
+    if (!isAdmissionEmail(normalized)) errors.push(`document.grants[${index}].email must be valid`);
+    if (seenEmails.has(normalized)) errors.push(`document.grants repeats email "${normalized}"`);
+    if (decision !== "waive_interview" && decision !== "require_interview") {
+      errors.push(`document.grants[${index}].decision is invalid`);
+    }
+    if (note && note.length > MAX_NOTE) errors.push(`document.grants[${index}].note is too long`);
+    if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= 0)) {
+      errors.push(`document.grants[${index}].expiresAt must be epoch milliseconds`);
+    }
+    seenIds.add(id);
+    seenEmails.add(normalized);
+    grants.push({
+      id,
+      email,
+      decision,
+      ...note ? { note } : {},
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    });
+  }
+  if (errors.length) return { ok: false, errors };
+  return {
+    ok: true,
+    value: {
+      schemaVersion: ADMISSION_GRANTS_SCHEMA_VERSION,
+      revision,
+      generatedAt,
+      source: { appId: sourceId, actor: sourceActor },
+      target: { chapterId, environment },
+      grants
+    }
+  };
+}
+var rows = (value) => Array.isArray(value) ? value : [];
+function asGrant(row) {
+  if (typeof row.id !== "string" || typeof row.emailNormalized !== "string") return null;
+  if (row.sourceScope !== "local" && row.sourceScope !== "parent") return null;
+  if (row.decision !== "waive_interview" && row.decision !== "require_interview") return null;
+  return row;
+}
+async function findAdmissionGrant(db, targetId, email, now) {
+  const emailNormalized = normalizeAdmissionEmail(email);
+  if (!isAdmissionEmail(emailNormalized)) return null;
+  const result = await db.query({ admissionGrants: { $: { where: { emailNormalized }, limit: 100 } } });
+  const active = rows(result.admissionGrants).map(asGrant).filter((grant) => Boolean(
+    grant && grant.targetId === targetId && grant.active === true && !grant.revokedAt && (!grant.expiresAt || grant.expiresAt > now) && !grant.consumedApplicationId
+  )).sort((a, b) => {
+    const scope = Number(b.sourceScope === "local") - Number(a.sourceScope === "local");
+    return scope || b.createdAt - a.createdAt;
+  });
+  return active[0] ?? null;
+}
+async function hasAdmissionRevision(db, sourceId, targetId, environment) {
+  const where = { sourceId, targetId, environment };
+  if (db.aggregate) {
+    return Number((await db.aggregate("admissionGrantRevisions", { count: true }, { where })).count ?? 0) > 0;
+  }
+  const found = await db.query({ admissionGrantRevisions: {} });
+  return rows(found.admissionGrantRevisions).some((row) => row.sourceId === sourceId && row.targetId === targetId && row.environment === environment);
+}
+async function loadLatestAdmissionRevision(db, sourceId, targetId, environment) {
+  if (!await hasAdmissionRevision(db, sourceId, targetId, environment)) return null;
+  const result = await db.query({ admissionGrantRevisions: { $: {
+    where: { sourceId, targetId, environment },
+    order: { revision: "desc" },
+    limit: 1
+  } } });
+  const row = rows(result.admissionGrantRevisions).sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0];
+  return row ? row : null;
+}
+async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const current = rows((await db.query({ admissionGrants: { $: {
+    where: { sourceScope: "parent", sourceId: document.source.appId, targetId: document.target.chapterId },
+    limit: MAX_GRANTS
+  } } })).admissionGrants);
+  const incomingIds = new Set(document.grants.map((grant) => `admission:parent:${document.source.appId}:${grant.id}`));
+  const ops = [];
+  for (const row of current) {
+    const id = String(row.id ?? "");
+    if (id && !incomingIds.has(id)) ops.push({ t: "update", ns: "admissionGrants", id, attrs: {
+      active: false,
+      revokedAt: receivedAt,
+      revokedBy: document.source.actor,
+      updatedAt: receivedAt,
+      updatedBy: document.source.actor
+    } });
+  }
+  for (const grant of document.grants) {
+    const id = `admission:parent:${document.source.appId}:${grant.id}`;
+    const existing = current.find((row) => row.id === id);
+    ops.push({ t: "update", ns: "admissionGrants", id, attrs: {
+      id,
+      sourceGrantId: grant.id,
+      sourceScope: "parent",
+      sourceId: document.source.appId,
+      targetId: document.target.chapterId,
+      email: grant.email,
+      emailNormalized: normalizeAdmissionEmail(grant.email),
+      decision: grant.decision,
+      ...grant.note ? { note: grant.note } : {},
+      ...grant.expiresAt ? { expiresAt: grant.expiresAt } : {},
+      active: true,
+      sourceRevision: document.revision,
+      createdAt: Number(existing?.createdAt ?? receivedAt),
+      createdBy: String(existing?.createdBy ?? document.source.actor),
+      updatedAt: receivedAt,
+      updatedBy: document.source.actor
+    } });
+    const retract = [
+      ...!grant.note && existing?.note !== void 0 ? ["note"] : [],
+      ...grant.expiresAt === void 0 && existing?.expiresAt !== void 0 ? ["expiresAt"] : []
+    ];
+    if (retract.length) ops.push({ t: "retract", ns: "admissionGrants", id, attrs: retract });
+  }
+  if (previous?.active) ops.push({ t: "update", ns: "admissionGrantRevisions", id: previous.id, attrs: { active: false } });
+  const revisionId = `admission-revision:${document.source.appId}:${document.target.environment}:${document.revision}`;
+  ops.push({ t: "update", ns: "admissionGrantRevisions", id: revisionId, attrs: {
+    id: revisionId,
+    sourceId: document.source.appId,
+    targetId: document.target.chapterId,
+    environment: document.target.environment,
+    revision: document.revision,
+    digest,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `admission-grants:${document.source.appId}:${document.target.environment}:${document.revision}:${digest}` });
+}
+
 // src/member.ts
 var DEFAULT_REQUIRED = ["firstName", "lastName", "email", "referral", "whoYouAre", "message"];
 var DEFAULT_OPTIONAL = ["referralName", "linkedin", "phone", "state"];
@@ -218,9 +417,9 @@ function resolveApplication(a) {
     validateEmail: a?.validateEmail ?? true
   };
 }
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function isValidEmail(value) {
-  return typeof value === "string" && EMAIL_RE.test(value);
+  return typeof value === "string" && EMAIL_RE2.test(value);
 }
 function clampArray(value, max) {
   if (!Array.isArray(value)) return value;
@@ -232,14 +431,14 @@ function hasDisclaimerAck(fields) {
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const app = chapter.application;
-  const allowed = (f) => app.profileFields.includes(f);
+  const allowed2 = (f) => app.profileFields.includes(f);
   const profile = {};
   for (const f of [...app.required, ...app.optional]) {
-    if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
+    if (IDENTITY_FIELDS.has(f) || !allowed2(f)) continue;
     const v = fields[f];
     if (typeof v === "string" && v.trim() !== "") profile[f] = v.trim();
   }
-  if (fields.focus !== void 0 && allowed("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
+  if (fields.focus !== void 0 && allowed2("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
   return Object.keys(profile).length > 0 ? profile : void 0;
 }
 async function submitApplication(db, chapter, fields, opts) {
@@ -270,6 +469,15 @@ async function submitApplication(db, chapter, fields, opts) {
   }
   if (fields.focus !== void 0) row.focus = clampArray(fields.focus, app.maxArrayLen);
   if (opts.groupId) row.groupId = opts.groupId;
+  if (typeof fields.email === "string" && isValidEmail(fields.email.trim())) {
+    row.emailNormalized = normalizeAdmissionEmail(fields.email);
+  }
+  if (opts.admissionGrant?.decision === "waive_interview") {
+    row.admissionGrantId = opts.admissionGrant.id;
+    row.admissionSource = opts.admissionGrant.sourceScope;
+    row.interviewWaivedAt = opts.now;
+  }
+  if (opts.giftOfferId) row.giftOfferId = opts.giftOfferId;
   if (typeof fields.tierId === "string" && fields.tierId) {
     if (opts.tierIds && !opts.tierIds.includes(fields.tierId)) {
       return { ok: false, error: "tierId is not an offered tier" };
@@ -277,8 +485,17 @@ async function submitApplication(db, chapter, fields, opts) {
     row.tierId = fields.tierId;
   }
   if (acked) row.disclaimerAckAt = opts.now;
+  const ops = [
+    { t: "update", ns: "applications", id, attrs: row }
+  ];
+  if (opts.admissionGrant?.decision === "waive_interview") {
+    ops.push({ t: "update", ns: "admissionGrants", id: opts.admissionGrant.id, attrs: {
+      consumedAt: opts.now,
+      consumedApplicationId: id
+    } });
+  }
   const { duplicate } = await db.transact(
-    [{ t: "update", ns: "applications", id, attrs: row }],
+    ops,
     opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
   );
   return { ok: true, id, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
@@ -312,8 +529,8 @@ function tierPayable(tier, group, hasSecretKey) {
 function byOrder(a, b) {
   return a.sortOrder - b.sortOrder || a.id.localeCompare(b.id);
 }
-function resolveTiers(group, rows2 = []) {
-  const stored = rows2.filter((tier) => tier.active);
+function resolveTiers(group, rows4 = []) {
+  const stored = rows4.filter((tier) => tier.active);
   if (stored.length) return [...stored].sort(byOrder);
   return [{
     id: "standard",
@@ -359,15 +576,15 @@ function rowToTier(row, groupId) {
 }
 async function loadTiers(db, group) {
   const groupId = String(group.id ?? "");
-  let rows2;
+  let rows4;
   try {
-    rows2 = (await db.query({
+    rows4 = (await db.query({
       tiers: { $: { where: { groupId }, order: { sortOrder: "asc" }, limit: 100 } }
     })).tiers;
   } catch {
-    rows2 = void 0;
+    rows4 = void 0;
   }
-  const list = Array.isArray(rows2) ? rows2.map((row) => rowToTier(row, groupId)) : [];
+  const list = Array.isArray(rows4) ? rows4.map((row) => rowToTier(row, groupId)) : [];
   return resolveTiers(group, list);
 }
 async function loadOfferableTiers(db, group, hasSecretKey) {
@@ -481,346 +698,257 @@ function applicationBookingUpdate(currentStatus, startAt, htmlLink) {
   };
 }
 
-// src/pipeline.ts
-function canTransition(from, to, p) {
-  const fi = p.stages.indexOf(from);
-  const ti = p.stages.indexOf(to);
-  return fi >= 0 && ti >= 0 && ti >= fi;
+// src/gift-offers.ts
+var GIFT_OFFER_CATALOG_VERSION = 1;
+var MAX_GIFT_OFFERS = 20;
+var ID2 = /^[a-z][a-z0-9-]{1,79}$/;
+var PRICE = /^price_[A-Za-z0-9]{12,}$/;
+var CURRENCY = /^[a-z]{3}$/;
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var text = (value, path, errors, max) => {
+  if (typeof value !== "string" || !value.trim()) {
+    errors.push(`${path} is required`);
+    return "";
+  }
+  if (value.trim().length > max) errors.push(`${path} must be at most ${max} characters`);
+  return value.trim();
+};
+function validateGiftOfferCatalog(input, tierIds) {
+  const errors = [];
+  const root = record(input);
+  if (!root) return { ok: false, errors: ["document.giftOffers must be an object"] };
+  for (const key of Object.keys(root)) if (key !== "schemaVersion" && key !== "offers") errors.push(`document.giftOffers.${key} is not supported`);
+  if (root.schemaVersion !== GIFT_OFFER_CATALOG_VERSION) errors.push("document.giftOffers.schemaVersion must be 1");
+  if (!Array.isArray(root.offers)) errors.push("document.giftOffers.offers must be an array");
+  const rawOffers = Array.isArray(root.offers) ? root.offers : [];
+  if (rawOffers.length > MAX_GIFT_OFFERS) errors.push(`document.giftOffers.offers supports at most ${MAX_GIFT_OFFERS} entries`);
+  const ids = /* @__PURE__ */ new Set();
+  const offers = [];
+  for (const [index, raw] of rawOffers.slice(0, MAX_GIFT_OFFERS).entries()) {
+    const path = `document.giftOffers.offers[${index}]`;
+    const item = record(raw);
+    if (!item) {
+      errors.push(`${path} must be an object`);
+      continue;
+    }
+    const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
+    for (const key of Object.keys(item)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
+    const id = text(item.id, `${path}.id`, errors, 80);
+    if (id && !ID2.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (ids.has(id)) errors.push(`${path}.id duplicates "${id}"`);
+    ids.add(id);
+    const targetRaw = record(item.target);
+    let target = { type: "entitlement", entitlementKey: "invalid" };
+    if (targetRaw?.type === "tier") {
+      const tierId = text(targetRaw.tierId, `${path}.target.tierId`, errors, 80);
+      if (!tierIds.has(tierId)) errors.push(`${path}.target.tierId must reference a declared tier`);
+      target = { type: "tier", tierId };
+    } else if (targetRaw?.type === "entitlement") {
+      const entitlementKey = text(targetRaw.entitlementKey, `${path}.target.entitlementKey`, errors, 80);
+      if (entitlementKey && !ID2.test(entitlementKey)) errors.push(`${path}.target.entitlementKey must be a lowercase kebab-case id`);
+      target = { type: "entitlement", entitlementKey };
+    } else errors.push(`${path}.target.type must be tier or entitlement`);
+    if (item.billingMode !== "one_time" && item.billingMode !== "subscription") errors.push(`${path}.billingMode must be one_time or subscription`);
+    const stripePriceId = text(item.stripePriceId, `${path}.stripePriceId`, errors, 128);
+    if (stripePriceId && !PRICE.test(stripePriceId)) errors.push(`${path}.stripePriceId must be a real Stripe Price id`);
+    if (!Number.isSafeInteger(item.priceCents) || Number(item.priceCents) < 1 || Number(item.priceCents) > 1e8) errors.push(`${path}.priceCents must be an integer from 1 to 100,000,000`);
+    const currency = typeof item.currency === "string" ? item.currency.trim().toLowerCase() : "";
+    if (!CURRENCY.test(currency)) errors.push(`${path}.currency must be a lowercase ISO currency code`);
+    const lifetime = Number(item.redemptionLifetimeHours);
+    if (!Number.isSafeInteger(lifetime) || lifetime < 1 || lifetime > 8760) errors.push(`${path}.redemptionLifetimeHours must be an integer from 1 to 8760`);
+    const activeFrom = item.activeFrom === void 0 ? void 0 : Number(item.activeFrom);
+    const activeUntil = item.activeUntil === void 0 ? void 0 : Number(item.activeUntil);
+    if (activeFrom !== void 0 && (!Number.isSafeInteger(activeFrom) || activeFrom < 1)) errors.push(`${path}.activeFrom must be epoch milliseconds`);
+    if (activeUntil !== void 0 && (!Number.isSafeInteger(activeUntil) || activeUntil < 1)) errors.push(`${path}.activeUntil must be epoch milliseconds`);
+    if (activeFrom !== void 0 && activeUntil !== void 0 && activeUntil <= activeFrom) errors.push(`${path}.activeUntil must follow activeFrom`);
+    offers.push({
+      id,
+      target,
+      billingMode: item.billingMode,
+      stripePriceId,
+      priceCents: Number(item.priceCents),
+      currency,
+      redemptionLifetimeHours: lifetime,
+      ...activeFrom !== void 0 ? { activeFrom } : {},
+      ...activeUntil !== void 0 ? { activeUntil } : {},
+      title: text(item.title, `${path}.title`, errors, 160),
+      description: text(item.description, `${path}.description`, errors, 2e3),
+      ctaLabel: text(item.ctaLabel, `${path}.ctaLabel`, errors, 120)
+    });
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, value: { schemaVersion: 1, offers } };
 }
-function canBook(status, p) {
-  return p.bookableFrom.includes(status);
+var giftOfferActive = (offer, now) => (!offer.activeFrom || offer.activeFrom <= now) && (!offer.activeUntil || offer.activeUntil > now);
+function publicGiftOffers(catalog, now) {
+  return (catalog?.offers ?? []).filter((offer) => giftOfferActive(offer, now)).map(({ stripePriceId: _stripe, target: _target, ...offer }) => offer);
 }
-function canApprove(status, p) {
-  return p.approvableFrom.includes(status);
+function findGiftOffer(catalog, offerId, now) {
+  return catalog?.offers.find((offer) => offer.id === offerId && giftOfferActive(offer, now)) ?? null;
 }
 
-// src/signup-control-store.ts
-function asStored(row) {
-  if (!row || typeof row.document !== "object" || row.document === null) return null;
-  return row;
+// src/clerk-roles.ts
+var CLERK_API = "https://api.clerk.com";
+var DEFAULT_ROLE = "provisional";
+var PAGE = 100;
+function toRecord(u) {
+  if (typeof u.id !== "string") return null;
+  const pm = u.public_metadata ?? {};
+  const privateMetadata = u.private_metadata ?? {};
+  const rawProfile = privateMetadata.profile;
+  const profile = rawProfile && typeof rawProfile === "object" && !Array.isArray(rawProfile) ? rawProfile : {};
+  const applicationId = typeof privateMetadata.applicationId === "string" ? privateMetadata.applicationId : void 0;
+  const role = typeof pm.role === "string" && pm.role ? pm.role : DEFAULT_ROLE;
+  const email = u.email_addresses?.[0]?.email_address;
+  return {
+    id: u.id,
+    email: typeof email === "string" ? email : void 0,
+    role,
+    publicMetadata: pm,
+    privateMetadata,
+    profile,
+    ...applicationId ? { applicationId } : {}
+  };
 }
-async function hasSignupControl(db, targetId, environment, active) {
-  const where = { targetId, environment, ...active ? { active: true } : {} };
-  if (db.aggregate) {
-    return Number((await db.aggregate("signupControls", { count: true }, { where })).count ?? 0) > 0;
+async function clerkGet(path, secretKey, fetchImpl) {
+  const res = await fetchImpl(`${CLERK_API}${path}`, { headers: { authorization: `Bearer ${secretKey}` } });
+  if (!res.ok) throw new Error(`clerk GET ${path} \u2192 ${res.status}`);
+  return res.json();
+}
+async function clerkGetUserByEmail(secretKey, email, fetchImpl = fetch) {
+  const data = await clerkGet(`/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, secretKey, fetchImpl).catch(() => null);
+  const user = Array.isArray(data) ? data[0] : void 0;
+  return user ? toRecord(user) : null;
+}
+async function clerkGetUser(secretKey, id, fetchImpl = fetch) {
+  const data = await clerkGet(`/v1/users/${encodeURIComponent(id)}`, secretKey, fetchImpl).catch(() => null);
+  return data ? toRecord(data) : null;
+}
+async function clerkListUsers(secretKey, fetchImpl = fetch) {
+  const out = [];
+  for (let offset = 0; ; offset += PAGE) {
+    const data = await clerkGet(`/v1/users?limit=${PAGE}&offset=${offset}`, secretKey, fetchImpl);
+    const page = Array.isArray(data) ? data : [];
+    for (const u of page) {
+      const record3 = toRecord(u);
+      if (record3) out.push(record3);
+    }
+    if (page.length < PAGE) break;
   }
-  const rows2 = (await db.query({ signupControls: {} })).signupControls;
-  return Array.isArray(rows2) && rows2.some((row) => row.targetId === targetId && row.environment === environment && (!active || row.active === true));
+  return out;
 }
-async function loadLatestSignupControl(db, targetId, environment) {
-  if (!await hasSignupControl(db, targetId, environment)) return null;
-  const rows2 = (await db.query({ signupControls: { $: {
-    where: { targetId, environment },
-    order: { revision: "desc" },
-    limit: 1
-  } } })).signupControls;
-  const latest = Array.isArray(rows2) ? [...rows2].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
-  return asStored(latest);
+async function clerkSetRole(secretKey, id, role, fetchImpl = fetch) {
+  const res = await fetchImpl(`${CLERK_API}/v1/users/${encodeURIComponent(id)}/metadata`, {
+    method: "PATCH",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify({ public_metadata: { role } })
+  });
+  return res.ok;
 }
-async function loadActiveSignupControl(db, targetId, environment) {
-  if (!await hasSignupControl(db, targetId, environment, true)) return null;
-  const rows2 = (await db.query({ signupControls: { $: {
-    where: { targetId, environment, active: true },
-    order: { revision: "desc" },
-    limit: 1
-  } } })).signupControls;
-  const active = Array.isArray(rows2) ? [...rows2].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
-  return asStored(active);
+
+// src/crm-sync.ts
+import { createRecord as createRecord2, updateRecord as updateRecord2, setStage, linkIdentity } from "@odla-ai/crm";
+
+// src/network.ts
+import {
+  createRecord,
+  getRecordByOrigin,
+  updateRecord,
+  upsertRecordOrigin
+} from "@odla-ai/crm";
+
+// src/network-contract.ts
+var DEFAULT_SHARE_FIELDS = {
+  person: ["name", "email", "firstName", "lastName", "phone", "linkedin"],
+  company: ["name", "domain", "industry", "location", "linkedin", "notes"]
+};
+
+// src/network.ts
+function sharedPersonInput(person) {
+  const email = person.email.toLowerCase();
+  const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
+  const input = { name: person.name ?? fullName ?? email, email };
+  if (input.name === "") input.name = email;
+  if (person.firstName) input.firstName = person.firstName;
+  if (person.lastName) input.lastName = person.lastName;
+  if (person.phone) input.phone = person.phone;
+  if (person.linkedin) input.linkedin = person.linkedin;
+  return input;
 }
-function controlledApplication(base, document) {
-  const delegated = document?.application;
-  return delegated ? { ...base, required: delegated.required, optional: delegated.optional, conditions: { ...delegated.conditions ?? {} } } : base;
+function shortHash(value) {
+  let a = 2166136261;
+  let b = 2654435769;
+  for (let i = 0; i < value.length; i += 1) {
+    const n = value.charCodeAt(i);
+    a = Math.imul(a ^ n, 16777619);
+    b = Math.imul(b ^ n, 2246822507);
+  }
+  return `${(a >>> 0).toString(36)}${(b >>> 0).toString(36)}`;
 }
-function validateControlledApplication(chapter, document) {
-  if (!document.application) return [];
-  const declared = /* @__PURE__ */ new Set([...chapter.application.required, ...chapter.application.optional]);
-  return [...document.application.required, ...document.application.optional].filter((field) => !declared.has(field)).map((field) => `document.application field "${field}" is not declared by this chapter schema`);
+function networkSourceTag(type, hubRecordId, sourceId) {
+  const typeKey = type.toLowerCase();
+  const readable = /^[a-z0-9_-]+$/.test(hubRecordId);
+  const prefix = sourceId ? `network:${sourceId.toLowerCase()}:${typeKey}` : `network:${typeKey}`;
+  const raw = `${prefix}:${hubRecordId}`;
+  if (readable && raw.length <= 64) return raw;
+  return `network:${typeKey.slice(0, 16)}:${shortHash(`${sourceId ?? ""}\0${type}\0${hubRecordId}`)}`;
 }
-function groupAttrs(document) {
-  const first = [...document.tiers].filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder)[0];
-  const firstPaid = [...document.tiers].find((tier) => tier.available && tier.priceCents > 0);
+function normalizeSharedRecord(record3, fallbackSourceId = "legacy-source") {
+  if ("input" in record3 && record3.version === 2) {
+    return {
+      version: 2,
+      sourceId: record3.source.siteId,
+      sourceRecordId: record3.source.recordId,
+      type: record3.type,
+      input: record3.input
+    };
+  }
+  if ("input" in record3) {
+    return {
+      version: 1,
+      sourceId: fallbackSourceId,
+      sourceRecordId: record3.hubRecordId,
+      type: record3.type,
+      input: record3.input
+    };
+  }
+  if ("type" in record3 && record3.type === "company") {
+    const input = { name: record3.name };
+    for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
+      if (record3[key]) input[key] = record3[key];
+    }
+    return {
+      version: 1,
+      sourceId: fallbackSourceId,
+      sourceRecordId: record3.hubRecordId,
+      type: "company",
+      input
+    };
+  }
   return {
-    ...first ? { standardPriceCents: first.priceCents } : {},
-    foundingDiscountCents: 0,
-    ...firstPaid?.stripePriceId ? { stripePriceId: firstPaid.stripePriceId } : {},
-    ...document.policy ?? {},
-    ...document.scheduling ? { schedulingJson: document.scheduling } : {}
+    version: 1,
+    sourceId: fallbackSourceId,
+    sourceRecordId: record3.hubRecordId,
+    type: "person",
+    input: sharedPersonInput(record3)
   };
 }
-var byPublicId = (ns, value) => ({
-  ns,
-  attr: "id",
-  value
-});
-async function materializeSignupControl(db, envelope, previous, receivedAt) {
-  const { document, digest } = envelope;
-  const currentRows = (await db.query({ tiers: { $: {
-    where: { groupId: document.target.chapterId },
-    limit: 100
-  } } })).tiers ?? [];
-  const incoming = new Set(document.tiers.map((tier) => tier.id));
-  const ops = [];
-  if (previous?.active) ops.push({ t: "update", ns: "signupControls", id: previous.id, attrs: { active: false } });
-  for (const row of currentRows) {
-    const id2 = String(row.id ?? "");
-    if (id2 && !incoming.has(id2)) {
-      ops.push({ t: "update", ns: "tiers", id: byPublicId("tiers", id2), attrs: { active: false } });
-    }
-  }
-  for (const tier of document.tiers) {
-    const tierRef = byPublicId("tiers", tier.id);
-    ops.push({ t: "update", ns: "tiers", id: tierRef, attrs: {
-      id: tier.id,
-      groupId: document.target.chapterId,
-      name: tier.name,
-      priceCents: tier.priceCents,
-      ...tier.stripePriceId ? { stripePriceId: tier.stripePriceId } : {},
-      ...tier.blurb ? { blurb: tier.blurb } : {},
-      sortOrder: tier.sortOrder,
-      active: tier.available,
-      createdAt: receivedAt
-    } });
-    const retract = [
-      ...!tier.stripePriceId ? ["stripePriceId"] : [],
-      ...!tier.blurb ? ["blurb"] : []
-    ];
-    if (retract.length) ops.push({ t: "retract", ns: "tiers", id: tierRef, attrs: retract });
-  }
-  const groupRef = byPublicId("groups", document.target.chapterId);
-  const attrs = groupAttrs(document);
-  ops.push({
-    t: "update",
-    ns: "groups",
-    id: groupRef,
-    attrs
-  });
-  if (!("stripePriceId" in attrs)) {
-    ops.push({ t: "retract", ns: "groups", id: groupRef, attrs: ["stripePriceId"] });
-  }
-  const id = `signup-control:${document.target.environment}:${document.revision}`;
-  ops.push({ t: "update", ns: "signupControls", id, attrs: {
-    id,
-    sourceId: document.source.appId,
-    targetId: document.target.chapterId,
-    environment: document.target.environment,
-    revision: document.revision,
-    digest,
-    document,
-    active: true,
-    receivedAt
-  } });
-  await db.transact(ops, { mutationId: `signup-control:${document.target.environment}:${document.revision}:${digest}` });
-}
-
-// src/session.ts
-function applicationSummary(app) {
-  return {
-    id: app.id,
-    firstName: app.firstName ?? null,
-    lastName: app.lastName ?? null,
-    email: app.email ?? null,
-    status: app.status,
-    createdAt: app.createdAt ?? null,
-    meetingLink: app.meetingLink ?? null,
-    paid: Boolean(app.stripeSubscriptionId) && app.status !== "refunded",
-    renewalAt: app.renewalAt ?? null,
-    canceled: app.canceled === true
-  };
-}
-function memberApplication(app, meeting, defaultTimezone) {
-  const summary = applicationSummary(app);
-  let meetingAt = app.meetingAt ?? null;
-  let meetUrl = null;
-  let timezone = defaultTimezone;
-  if (meeting) {
-    timezone = meeting.timezone ?? timezone;
-    if (meeting.status === "scheduled") {
-      meetingAt = meeting.startAt ?? null;
-      meetUrl = meeting.meetUrl ?? null;
-    } else {
-      meetingAt = null;
-    }
-  }
-  return { ...summary, meetingAt, meetUrl, timezone };
-}
-
-// src/clerk.ts
-var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
-function clerkInviteRequest(input) {
-  return {
-    path: "/v1/invitations",
-    body: {
-      email_address: input.email,
-      notify: true,
-      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
-    }
-  };
-}
-async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkInviteRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  return res.ok ? { ok: true, status: res.status } : heal(res.status);
-}
-function clerkUserRequest(input) {
-  return {
-    path: "/v1/users",
-    body: {
-      email_address: [input.email],
-      skip_password_requirement: true,
-      ...input.firstName ? { first_name: input.firstName } : {},
-      ...input.lastName ? { last_name: input.lastName } : {},
-      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
-      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
-    }
-  };
-}
-async function updateClerkUserMetadata(secretKey, userId, input, fetchImpl = fetch) {
-  const res = await fetchImpl(`https://api.clerk.com/v1/users/${encodeURIComponent(userId)}/metadata`, {
-    method: "PATCH",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify({
-      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
-      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
-    })
-  });
-  return res.ok;
-}
-async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl = fetch) {
-  const auth = { authorization: `Bearer ${secretKey}` };
-  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
-  if (!found.ok) return false;
-  const users = await found.json().catch(() => null);
-  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
-  if (!id) return false;
-  return updateClerkUserMetadata(secretKey, id, input, fetchImpl);
-}
-async function createClerkUser(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkUserRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (res.ok) return { ok: true, status: res.status };
-  const healed = heal(res.status);
-  const repair = input.repairMetadata ?? {
-    ...input.publicMetadata !== void 0 ? { publicMetadata: input.publicMetadata } : {},
-    ...input.privateMetadata !== void 0 ? { privateMetadata: input.privateMetadata } : {}
-  };
-  if (!healed.existed || repair.publicMetadata === void 0 && repair.privateMetadata === void 0) return healed;
-  const refreshed = await updateClerkUserMetadataByEmail(secretKey, input.email, {
-    ...repair.publicMetadata !== void 0 ? { publicMetadata: repair.publicMetadata } : {},
-    ...repair.privateMetadata !== void 0 ? { privateMetadata: repair.privateMetadata } : {}
-  }, fetchImpl).catch(() => false);
-  return { ...healed, refreshed };
-}
-
-// src/network.ts
-import {
-  createRecord,
-  getRecordByOrigin,
-  updateRecord,
-  upsertRecordOrigin
-} from "@odla-ai/crm";
-
-// src/network-contract.ts
-var DEFAULT_SHARE_FIELDS = {
-  person: ["name", "email", "firstName", "lastName", "phone", "linkedin"],
-  company: ["name", "domain", "industry", "location", "linkedin", "notes"]
-};
-
-// src/network.ts
-function sharedPersonInput(person) {
-  const email = person.email.toLowerCase();
-  const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
-  const input = { name: person.name ?? fullName ?? email, email };
-  if (input.name === "") input.name = email;
-  if (person.firstName) input.firstName = person.firstName;
-  if (person.lastName) input.lastName = person.lastName;
-  if (person.phone) input.phone = person.phone;
-  if (person.linkedin) input.linkedin = person.linkedin;
-  return input;
-}
-function shortHash(value) {
-  let a = 2166136261;
-  let b = 2654435769;
-  for (let i = 0; i < value.length; i += 1) {
-    const n = value.charCodeAt(i);
-    a = Math.imul(a ^ n, 16777619);
-    b = Math.imul(b ^ n, 2246822507);
-  }
-  return `${(a >>> 0).toString(36)}${(b >>> 0).toString(36)}`;
-}
-function networkSourceTag(type, hubRecordId, sourceId) {
-  const typeKey = type.toLowerCase();
-  const readable = /^[a-z0-9_-]+$/.test(hubRecordId);
-  const prefix = sourceId ? `network:${sourceId.toLowerCase()}:${typeKey}` : `network:${typeKey}`;
-  const raw = `${prefix}:${hubRecordId}`;
-  if (readable && raw.length <= 64) return raw;
-  return `network:${typeKey.slice(0, 16)}:${shortHash(`${sourceId ?? ""}\0${type}\0${hubRecordId}`)}`;
-}
-function normalizeSharedRecord(record, fallbackSourceId = "legacy-source") {
-  if ("input" in record && record.version === 2) {
-    return {
-      version: 2,
-      sourceId: record.source.siteId,
-      sourceRecordId: record.source.recordId,
-      type: record.type,
-      input: record.input
-    };
-  }
-  if ("input" in record) {
-    return {
-      version: 1,
-      sourceId: fallbackSourceId,
-      sourceRecordId: record.hubRecordId,
-      type: record.type,
-      input: record.input
-    };
-  }
-  if ("type" in record && record.type === "company") {
-    const input = { name: record.name };
-    for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
-      if (record[key]) input[key] = record[key];
-    }
-    return {
-      version: 1,
-      sourceId: fallbackSourceId,
-      sourceRecordId: record.hubRecordId,
-      type: "company",
-      input
-    };
-  }
-  return {
-    version: 1,
-    sourceId: fallbackSourceId,
-    sourceRecordId: record.hubRecordId,
-    type: "person",
-    input: sharedPersonInput(record)
-  };
-}
-function sharedRecordFromCrm(crm, record, target, sourceId) {
-  if (target.fields && !target.fields[record.type]) {
-    throw new Error(`${target.name} does not accept "${record.type}" records`);
+function sharedRecordFromCrm(crm, record3, target, sourceId) {
+  if (target.fields && !target.fields[record3.type]) {
+    throw new Error(`${target.name} does not accept "${record3.type}" records`);
   }
-  const def = crm.type(record.type);
-  const fields = target.fields?.[record.type] ?? DEFAULT_SHARE_FIELDS[record.type];
+  const def = crm.type(record3.type);
+  const fields = target.fields?.[record3.type] ?? DEFAULT_SHARE_FIELDS[record3.type];
   if (!fields) {
-    throw new Error(`${target.name} requires an explicit field allowlist for "${record.type}" records`);
+    throw new Error(`${target.name} requires an explicit field allowlist for "${record3.type}" records`);
   }
   const nameField = def.nameField ?? "name";
   const input = {};
   for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
-    const value = record.fields?.[field];
+    const value = record3.fields?.[field];
     if (value !== void 0) input[field] = value;
   }
-  if (input[nameField] === void 0) input[nameField] = record.name;
-  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record.id }, type: record.type, input } : { version: 1, type: record.type, hubRecordId: record.id, input };
+  if (input[nameField] === void 0) input[nameField] = record3.name;
+  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record3.id }, type: record3.type, input } : { version: 1, type: record3.type, hubRecordId: record3.id, input };
 }
 async function upsertPerson(deps, opts) {
   const email = opts.email.toLowerCase();
@@ -834,11 +962,11 @@ async function upsertPerson(deps, opts) {
   const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
   return { recordId: created.id };
 }
-async function findSharedRecord(deps, record, tag) {
+async function findSharedRecord(deps, record3, tag) {
   const structured = await getRecordByOrigin(
     { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
-    record.sourceId,
-    record.sourceRecordId
+    record3.sourceId,
+    record3.sourceRecordId
   );
   if (structured) return structured;
   const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
@@ -847,53 +975,53 @@ async function findSharedRecord(deps, record, tag) {
     const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const def = deps.crm.type(record.type);
+  const def = deps.crm.type(record3.type);
   const emailField = def.emailField;
-  if (emailField && typeof record.input[emailField] === "string") {
-    const primaryEmail = record.input[emailField].toLowerCase();
+  if (emailField && typeof record3.input[emailField] === "string") {
+    const primaryEmail = record3.input[emailField].toLowerCase();
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, primaryEmail }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, primaryEmail }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const domain = record.input.domain;
+  const domain = record3.input.domain;
   const domainSlot = def.fields.domain?.slot;
   if (typeof domain === "string" && domainSlot) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, [domainSlot]: domain }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, [domainSlot]: domain }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   const nameField = def.nameField ?? "name";
-  const name = record.input[nameField];
-  if (record.type === "company" && typeof name === "string" && name.trim()) {
+  const name = record3.input[nameField];
+  if (record3.type === "company" && typeof name === "string" && name.trim()) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, name: name.trim() }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, name: name.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   return void 0;
 }
 async function projectSharedRecord(deps, shared, options = {}) {
-  const record = normalizeSharedRecord(shared, options.sourceId);
-  if (!record.type.trim() || !record.sourceId.trim() || !record.sourceRecordId.trim()) {
+  const record3 = normalizeSharedRecord(shared, options.sourceId);
+  if (!record3.type.trim() || !record3.sourceId.trim() || !record3.sourceRecordId.trim()) {
     throw new Error("type, source site id, and source record id must be non-empty");
   }
-  if (options.sourceId && options.sourceId !== record.sourceId) {
+  if (options.sourceId && options.sourceId !== record3.sourceId) {
     throw new Error("signed sender does not match payload source");
   }
-  const tag = networkSourceTag(record.type, record.sourceRecordId, record.version === 2 ? record.sourceId : void 0);
+  const tag = networkSourceTag(record3.type, record3.sourceRecordId, record3.version === 2 ? record3.sourceId : void 0);
   const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const existing = await findSharedRecord(deps, record, tag);
+  const existing = await findSharedRecord(deps, record3, tag);
   let recordId;
   if (existing && typeof existing.id === "string") {
-    await updateRecord(crmDeps3, { id: existing.id, input: record.input });
+    await updateRecord(crmDeps3, { id: existing.id, input: record3.input });
     recordId = existing.id;
   } else {
-    recordId = `network_${shortHash(`${record.sourceId}\0${record.type}\0${record.sourceRecordId}`)}`;
+    recordId = `network_${shortHash(`${record3.sourceId}\0${record3.type}\0${record3.sourceRecordId}`)}`;
     await createRecord({ ...crmDeps3, newId: () => recordId }, {
-      type: record.type,
-      input: record.input,
+      type: record3.type,
+      input: record3.input,
       mutationId: `share-create:${tag}`
     });
   }
@@ -903,10 +1031,10 @@ async function projectSharedRecord(deps, shared, options = {}) {
   );
   await upsertRecordOrigin(crmDeps3, {
     recordId,
-    sourceId: record.sourceId,
-    sourceRecordId: record.sourceRecordId,
+    sourceId: record3.sourceId,
+    sourceRecordId: record3.sourceRecordId,
     ...options.sourceUrl ? { sourceUrl: options.sourceUrl } : {},
-    payloadVersion: record.version
+    payloadVersion: record3.version
   });
   return { recordId };
 }
@@ -929,29 +1057,115 @@ async function projectApplicant(deps, applicant) {
   }
 }
 
-// src/email.ts
-function render(template, vars) {
-  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
-}
-function groupVars(group, vars) {
-  return {
-    ...vars,
-    refundPolicyText: group.refundPolicyText ?? "",
-    commitmentText: group.commitmentText ?? "",
-    normsText: group.normsText ?? ""
-  };
-}
-function renderTemplateBody(group, template, vars) {
-  const tpl = group.emailTemplates?.[template];
-  if (!tpl) return null;
-  return render(tpl.text, groupVars(group, vars));
-}
-function isAlreadySent(priorRows) {
-  return priorRows.some((row) => !row.error);
-}
-function planDelivery(input) {
-  const tpl = input.group.emailTemplates?.[input.template];
-  if (!tpl) return { deliver: false, reason: "template-missing" };
+// src/crm-sync.ts
+var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
+var crmDeps = (db, ctx) => ({
+  crm: ctx.chapter.crm,
+  db,
+  now: () => Date.now(),
+  newId: () => crypto.randomUUID(),
+  chapter: ctx.chapter
+});
+function personInputFromApp(chapter, app) {
+  const input = sharedPersonInput({
+    email: str(app.email),
+    firstName: str(app.firstName) || void 0,
+    lastName: str(app.lastName) || void 0,
+    phone: str(app.phone) || void 0,
+    linkedin: str(app.linkedin) || void 0,
+    hubRecordId: str(app.id)
+  });
+  for (const f of chapter.application.crmFields) {
+    if (app[f] !== void 0) input[f] = app[f];
+  }
+  if (app.id !== void 0) input.applicationId = str(app.id);
+  return input;
+}
+function billingColumns(app) {
+  const status = str(app.status);
+  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
+  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
+  const cols = { billingStatus };
+  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
+  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
+  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
+  return cols;
+}
+async function syncApplicationToCrm(deps, opts) {
+  const emailKey = str(opts.app.email).toLowerCase();
+  if (!emailKey) return null;
+  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const input = personInputFromApp(deps.chapter, opts.app);
+  const { crm_record } = await deps.db.query({
+    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
+  });
+  const existing = crm_record?.[0] ?? null;
+  const stage = opts.stage || void 0;
+  let recordId;
+  if (existing && typeof existing.id === "string") {
+    recordId = existing.id;
+    await updateRecord2(recordDeps, { id: recordId, input });
+  } else {
+    const created = await createRecord2(recordDeps, { type: "person", input, ...stage ? { stage } : {} });
+    recordId = created.id;
+  }
+  if (existing && stage && existing.stage !== stage) {
+    await setStage(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
+  }
+  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
+  await linkIdentity(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
+  return recordId;
+}
+async function backfillCrm(deps) {
+  const [appsRes, usersRes] = await Promise.all([
+    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
+    deps.db.query({ $users: { $: { limit: 1e3 } } })
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  let synced = 0;
+  const errors = [];
+  const run = async (app, stage) => {
+    const key = str(app.email).toLowerCase();
+    if (!key || seen.has(key)) return;
+    seen.add(key);
+    try {
+      await syncApplicationToCrm(deps, { app, stage });
+      synced += 1;
+    } catch (err) {
+      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
+    }
+  };
+  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
+  for (const u of usersRes.$users ?? []) {
+    if (u.deleted === true) continue;
+    await run({ email: u.email, firstName: str(u.name) });
+  }
+  return { synced, errors };
+}
+
+// src/email.ts
+function render(template, vars) {
+  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
+}
+function groupVars(group, vars) {
+  return {
+    ...vars,
+    refundPolicyText: group.refundPolicyText ?? "",
+    commitmentText: group.commitmentText ?? "",
+    normsText: group.normsText ?? ""
+  };
+}
+function renderTemplateBody(group, template, vars) {
+  const tpl = group.emailTemplates?.[template];
+  if (!tpl) return null;
+  return render(tpl.text, groupVars(group, vars));
+}
+function isAlreadySent(priorRows) {
+  return priorRows.some((row) => !row.error);
+}
+function planDelivery(input) {
+  const tpl = input.group.emailTemplates?.[input.template];
+  if (!tpl) return { deliver: false, reason: "template-missing" };
   if (tpl.enabled === false && !input.force) return { deliver: false, reason: "disabled" };
   const vars = groupVars(input.group, input.vars);
   const isProd = input.envName === "prod";
@@ -959,10 +1173,10 @@ function planDelivery(input) {
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
   const to = redirect ? input.group.debugEmail : input.to;
   const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
-  const text2 = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text3 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + render(tpl.text, vars) : render(tpl.text, vars);
-  return { deliver: true, transport, to, subject, text: text2, redirected: redirect };
+  return { deliver: true, transport, to, subject, text: text3, redirected: redirect };
 }
 
 // src/notify.ts
@@ -1032,144 +1246,482 @@ function emailGroupFrom(row) {
   };
 }
 
-// src/worker-provisioning.ts
-var applicantPrivateMetadata = (chapter, applicationId, fields, removeMissingProfile = false) => {
-  const profile = applicantProfile(chapter, fields);
-  return {
-    applicationId,
-    ...profile ? { profile } : removeMissingProfile ? { profile: null } : {}
-  };
-};
-var publicProfileRemoval = { applicationId: null, profile: null };
-async function markPrivateMetadataSynced(db, applicationId, clerkUserId) {
-  await db.transact([{
-    t: "update",
-    ns: "applications",
-    id: applicationId,
-    attrs: {
-      clerkPrivateMetadataSyncedAt: Date.now(),
-      ...clerkUserId ? { clerkUserId } : {}
-    }
-  }]);
+// src/pipeline.ts
+function canTransition(from, to, p) {
+  const fi = p.stages.indexOf(from);
+  const ti = p.stages.indexOf(to);
+  return fi >= 0 && ti >= 0 && ti >= fi;
 }
-async function syncApplicantPrivateMetadata(db, chapter, applicationId, fields, clerkUserId) {
-  if (chapter.account === "none") return false;
-  try {
-    const secret = await getVaultSecret(db, "clerk_secret_key");
-    if (!secret) return false;
-    const ok = await updateClerkUserMetadata(secret, clerkUserId, {
-      publicMetadata: publicProfileRemoval,
-      privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
-    });
-    if (!ok) return false;
-    await markPrivateMetadataSynced(db, applicationId, clerkUserId);
-    return true;
-  } catch {
-    return false;
-  }
+function canBook(status, p) {
+  return p.bookableFrom.includes(status);
 }
-async function provisionApplicant(db, chapter, applicationId, fields) {
-  const email = typeof fields.email === "string" ? fields.email : "";
-  if (!email) return;
-  const stringValue = (value) => typeof value === "string" ? value : void 0;
-  const extra = {};
-  for (const field of chapter.application.crmFields) {
-    if (fields[field] !== void 0) extra[field] = fields[field];
-  }
-  try {
-    await projectApplicant(
-      { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      {
-        applicationId,
-        email,
-        firstName: stringValue(fields.firstName),
-        lastName: stringValue(fields.lastName),
-        phone: stringValue(fields.phone),
-        linkedin: stringValue(fields.linkedin),
-        extra
-      }
-    );
-  } catch {
+function canApprove(status, p) {
+  return p.approvableFrom.includes(status);
+}
+
+// src/approve-application.ts
+async function approveApplication(input) {
+  const { db, env, ctx, app } = input;
+  const id = String(app.id ?? "");
+  const status = String(app.status ?? "");
+  if (!id) return { ok: false, status: 404, error: "not found" };
+  if (input.reason === "manual" && status !== "approved" && !canApprove(status, ctx.chapter.pipeline)) {
+    return { ok: false, status: 409, error: `cannot approve from status "${status}"` };
+  }
+  if (input.reason === "interview_waiver") {
+    if (typeof app.interviewWaivedAt !== "number") return { ok: false, status: 409, error: "interview waiver required" };
+    if (status !== "approved" && !canTransition(status, "approved", ctx.chapter.pipeline)) {
+      return { ok: false, status: 409, error: `cannot approve from status "${status}"` };
+    }
   }
-  if (chapter.account === "none") return;
-  try {
-    const secret = await getVaultSecret(db, "clerk_secret_key");
-    if (!secret) return;
-    const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
-    if (chapter.account === "create") {
-      const result = await createClerkUser(secret, {
-        email,
-        firstName: stringValue(fields.firstName),
-        lastName: stringValue(fields.lastName),
-        privateMetadata,
-        repairMetadata: {
-          publicMetadata: publicProfileRemoval,
-          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
-        }
-      });
-      if (result.ok && (!result.existed || result.refreshed)) {
-        await markPrivateMetadataSynced(db, applicationId);
-      }
-    } else {
-      const result = await createClerkInvitation(secret, { email });
-      if (result.existed) {
-        const refreshed = await updateClerkUserMetadataByEmail(secret, email, {
-          publicMetadata: publicProfileRemoval,
-          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
-        });
-        if (refreshed) await markPrivateMetadataSynced(db, applicationId);
-      }
+  const write = await db.transact(
+    [{ t: "update", ns: "applications", id, attrs: { status: "approved" } }],
+    { mutationId: `approve:${id}` }
+  );
+  const approved = { ...app, status: "approved" };
+  await syncApplicationToCrm(crmDeps(db, ctx), { app: approved, stage: "approved" }).catch(() => void 0);
+  const { promoteTo, send } = ctx.chapter.operations.onApprove;
+  let rolePromoted = false;
+  const secret = await getVaultSecret(db, "clerk_secret_key");
+  if (promoteTo !== false && secret) {
+    let userId = typeof app.clerkUserId === "string" ? app.clerkUserId : null;
+    if (!userId && typeof app.email === "string") {
+      const found = await clerkGetUserByEmail(secret, app.email);
+      userId = found?.id ?? null;
+      if (userId) await db.transact([{ t: "update", ns: "applications", id, attrs: { clerkUserId: userId } }]);
     }
-  } catch {
+    if (userId) rolePromoted = await clerkSetRole(secret, userId, promoteTo);
   }
-}
-async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
-  try {
-    const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
-    const group = Array.isArray(groups) ? groups[0] : void 0;
-    if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const stringValue = (value) => typeof value === "string" ? value : "";
-    await sendTemplated(
-      {
-        db,
-        envName: env.ODLA_ENV,
-        sender: env.SEND_EMAIL,
-        from: env.EMAIL_FROM,
-        now: () => Date.now(),
-        newId: () => crypto.randomUUID()
-      },
+  let emailLogged = false;
+  const groups = (await db.query({ groups: { $: { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 } } })).groups;
+  const group = Array.isArray(groups) ? groups[0] : void 0;
+  if (send !== false && group && typeof app.email === "string") {
+    const result = await sendTemplated(
+      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
       {
         group: emailGroupFrom(group),
-        template: "adminNotification",
-        to: group.notificationEmail,
-        vars: {
-          firstName: stringValue(fields.firstName),
-          lastName: stringValue(fields.lastName),
-          email: stringValue(fields.email),
-          phone: stringValue(fields.phone),
-          state: stringValue(fields.state)
-        },
-        dedupeKey: `apply:${applicationId}:admin`,
-        applicationId
+        template: send,
+        to: app.email,
+        vars: { firstName: String(app.firstName ?? ""), membersUrl: `${input.origin}/members/` },
+        applicationId: id,
+        dedupeKey: `approve:${id}`
       }
     );
-  } catch {
+    emailLogged = result.sent;
   }
+  return { ok: true, status: 200, rolePromoted, emailLogged, duplicate: write.duplicate };
 }
 
-// src/worker-routes.ts
-async function memberSessionApplication(db, chapterId, email) {
-  const apps = (await db.query({ applications: { $: { where: { email }, order: { createdAt: "desc" }, limit: 1 } } })).applications;
-  const app = Array.isArray(apps) ? apps[0] : void 0;
-  if (!app) return null;
-  const meetings = (await db.query({ meetings: { $: { where: { applicationId: app.id, status: "scheduled" }, order: { createdAt: "desc" }, limit: 1 } } })).meetings;
-  const meeting = Array.isArray(meetings) ? meetings[0] : void 0;
-  const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
-  const group = Array.isArray(groups) ? groups[0] : void 0;
-  const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  return {
-    application: memberApplication(app, meeting, timezone),
-    source: app
+// src/join-continuation.ts
+function resolveJoinContinuation(input) {
+  if (input.status === "approved") return "accepted";
+  if (input.interviewWaived) {
+    if (!input.payable) return "approve";
+    if (input.status === input.initialStatus) {
+      return input.subscriptionStarted ? "paymentPending" : "payment";
+    }
+    return "approve";
+  }
+  if (!input.payable) return "booking";
+  if (input.status === input.initialStatus) {
+    return input.subscriptionStarted ? "paymentPending" : "payment";
+  }
+  if (canBook(input.status, input.pipeline)) return "booking";
+  return null;
+}
+
+// src/join-continuation-server.ts
+async function continueJoin(db, ctx, env, origin, app, group) {
+  if (typeof app.giftOfferId === "string") {
+    if (typeof app.giftClaimId === "string") return "gift";
+    return typeof app.giftCheckoutStartedAt === "number" ? "paymentPending" : "payment";
+  }
+  const stripeKey = await getVaultSecret(db, "stripe_secret_key");
+  const offered = await loadOfferableTiers(db, group, Boolean(stripeKey));
+  const tier = findTier(offered, typeof app.tierId === "string" ? app.tierId : null);
+  const payable = Boolean(tier) && !tierIsFree(tier) && tierPayable(tier, group, Boolean(stripeKey));
+  const state = resolveJoinContinuation({
+    status: String(app.status ?? ""),
+    initialStatus: ctx.chapter.pipeline.initial,
+    pipeline: ctx.chapter.pipeline,
+    payable,
+    subscriptionStarted: typeof app.stripeSubscriptionId === "string" && app.stripeSubscriptionId !== "",
+    interviewWaived: typeof app.interviewWaivedAt === "number"
+  });
+  if (state !== "approve") return state;
+  const approved = await approveApplication({ db, env, ctx, app, origin, reason: "interview_waiver" });
+  return approved.ok ? "accepted" : null;
+}
+
+// src/signup-control-store.ts
+function asStored(row) {
+  if (!row || typeof row.document !== "object" || row.document === null) return null;
+  return row;
+}
+async function hasSignupControl(db, targetId, environment, active) {
+  const where = { targetId, environment, ...active ? { active: true } : {} };
+  if (db.aggregate) {
+    return Number((await db.aggregate("signupControls", { count: true }, { where })).count ?? 0) > 0;
+  }
+  const rows4 = (await db.query({ signupControls: {} })).signupControls;
+  return Array.isArray(rows4) && rows4.some((row) => row.targetId === targetId && row.environment === environment && (!active || row.active === true));
+}
+async function loadLatestSignupControl(db, targetId, environment) {
+  if (!await hasSignupControl(db, targetId, environment)) return null;
+  const rows4 = (await db.query({ signupControls: { $: {
+    where: { targetId, environment },
+    order: { revision: "desc" },
+    limit: 1
+  } } })).signupControls;
+  const latest = Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  return asStored(latest);
+}
+async function loadActiveSignupControl(db, targetId, environment) {
+  if (!await hasSignupControl(db, targetId, environment, true)) return null;
+  const rows4 = (await db.query({ signupControls: { $: {
+    where: { targetId, environment, active: true },
+    order: { revision: "desc" },
+    limit: 1
+  } } })).signupControls;
+  const active = Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  return asStored(active);
+}
+function controlledApplication(base, document) {
+  const delegated = document?.application;
+  return delegated ? { ...base, required: delegated.required, optional: delegated.optional, conditions: { ...delegated.conditions ?? {} } } : base;
+}
+function validateControlledApplication(chapter, document) {
+  if (!document.application) return [];
+  const declared = /* @__PURE__ */ new Set([...chapter.application.required, ...chapter.application.optional]);
+  return [...document.application.required, ...document.application.optional].filter((field) => !declared.has(field)).map((field) => `document.application field "${field}" is not declared by this chapter schema`);
+}
+function groupAttrs(document) {
+  const first4 = [...document.tiers].filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder)[0];
+  const firstPaid = [...document.tiers].find((tier) => tier.available && tier.priceCents > 0);
+  return {
+    ...first4 ? { standardPriceCents: first4.priceCents } : {},
+    foundingDiscountCents: 0,
+    ...firstPaid?.stripePriceId ? { stripePriceId: firstPaid.stripePriceId } : {},
+    ...document.policy ?? {},
+    ...document.scheduling ? { schedulingJson: document.scheduling } : {}
+  };
+}
+var byPublicId = (ns, value) => ({
+  ns,
+  attr: "id",
+  value
+});
+async function materializeSignupControl(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const currentRows = (await db.query({ tiers: { $: {
+    where: { groupId: document.target.chapterId },
+    limit: 100
+  } } })).tiers ?? [];
+  const incoming = new Set(document.tiers.map((tier) => tier.id));
+  const ops = [];
+  if (previous?.active) ops.push({ t: "update", ns: "signupControls", id: previous.id, attrs: { active: false } });
+  for (const row of currentRows) {
+    const id2 = String(row.id ?? "");
+    if (id2 && !incoming.has(id2)) {
+      ops.push({ t: "update", ns: "tiers", id: byPublicId("tiers", id2), attrs: { active: false } });
+    }
+  }
+  for (const tier of document.tiers) {
+    const tierRef = byPublicId("tiers", tier.id);
+    ops.push({ t: "update", ns: "tiers", id: tierRef, attrs: {
+      id: tier.id,
+      groupId: document.target.chapterId,
+      name: tier.name,
+      priceCents: tier.priceCents,
+      ...tier.stripePriceId ? { stripePriceId: tier.stripePriceId } : {},
+      ...tier.blurb ? { blurb: tier.blurb } : {},
+      sortOrder: tier.sortOrder,
+      active: tier.available,
+      createdAt: receivedAt
+    } });
+    const retract = [
+      ...!tier.stripePriceId ? ["stripePriceId"] : [],
+      ...!tier.blurb ? ["blurb"] : []
+    ];
+    if (retract.length) ops.push({ t: "retract", ns: "tiers", id: tierRef, attrs: retract });
+  }
+  const groupRef = byPublicId("groups", document.target.chapterId);
+  const attrs = groupAttrs(document);
+  ops.push({
+    t: "update",
+    ns: "groups",
+    id: groupRef,
+    attrs
+  });
+  if (!("stripePriceId" in attrs)) {
+    ops.push({ t: "retract", ns: "groups", id: groupRef, attrs: ["stripePriceId"] });
+  }
+  const id = `signup-control:${document.target.environment}:${document.revision}`;
+  ops.push({ t: "update", ns: "signupControls", id, attrs: {
+    id,
+    sourceId: document.source.appId,
+    targetId: document.target.chapterId,
+    environment: document.target.environment,
+    revision: document.revision,
+    digest,
+    document,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `signup-control:${document.target.environment}:${document.revision}:${digest}` });
+}
+
+// src/session.ts
+function applicationSummary(app) {
+  return {
+    id: app.id,
+    firstName: app.firstName ?? null,
+    lastName: app.lastName ?? null,
+    email: app.email ?? null,
+    status: app.status,
+    createdAt: app.createdAt ?? null,
+    meetingLink: app.meetingLink ?? null,
+    paid: Boolean(app.stripeSubscriptionId) && app.status !== "refunded",
+    renewalAt: app.renewalAt ?? null,
+    canceled: app.canceled === true,
+    tierId: app.tierId ?? null
+  };
+}
+function memberApplication(app, meeting, defaultTimezone) {
+  const summary = applicationSummary(app);
+  let meetingAt = app.meetingAt ?? null;
+  let meetUrl = null;
+  let timezone = defaultTimezone;
+  if (meeting) {
+    timezone = meeting.timezone ?? timezone;
+    if (meeting.status === "scheduled") {
+      meetingAt = meeting.startAt ?? null;
+      meetUrl = meeting.meetUrl ?? null;
+    } else {
+      meetingAt = null;
+    }
+  }
+  return { ...summary, meetingAt, meetUrl, timezone };
+}
+
+// src/clerk.ts
+var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
+function clerkInviteRequest(input) {
+  return {
+    path: "/v1/invitations",
+    body: {
+      email_address: input.email,
+      notify: true,
+      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
+      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+    }
+  };
+}
+async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkInviteRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  return res.ok ? { ok: true, status: res.status } : heal(res.status);
+}
+function clerkUserRequest(input) {
+  return {
+    path: "/v1/users",
+    body: {
+      email_address: [input.email],
+      skip_password_requirement: true,
+      ...input.firstName ? { first_name: input.firstName } : {},
+      ...input.lastName ? { last_name: input.lastName } : {},
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
+    }
+  };
+}
+async function updateClerkUserMetadata(secretKey, userId, input, fetchImpl = fetch) {
+  const res = await fetchImpl(`https://api.clerk.com/v1/users/${encodeURIComponent(userId)}/metadata`, {
+    method: "PATCH",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
+    })
+  });
+  return res.ok;
+}
+async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl = fetch) {
+  const auth = { authorization: `Bearer ${secretKey}` };
+  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
+  if (!found.ok) return false;
+  const users = await found.json().catch(() => null);
+  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
+  if (!id) return false;
+  return updateClerkUserMetadata(secretKey, id, input, fetchImpl);
+}
+async function createClerkUser(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkUserRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (res.ok) return { ok: true, status: res.status };
+  const healed = heal(res.status);
+  const repair = input.repairMetadata ?? {
+    ...input.publicMetadata !== void 0 ? { publicMetadata: input.publicMetadata } : {},
+    ...input.privateMetadata !== void 0 ? { privateMetadata: input.privateMetadata } : {}
+  };
+  if (!healed.existed || repair.publicMetadata === void 0 && repair.privateMetadata === void 0) return healed;
+  const refreshed = await updateClerkUserMetadataByEmail(secretKey, input.email, {
+    ...repair.publicMetadata !== void 0 ? { publicMetadata: repair.publicMetadata } : {},
+    ...repair.privateMetadata !== void 0 ? { privateMetadata: repair.privateMetadata } : {}
+  }, fetchImpl).catch(() => false);
+  return { ...healed, refreshed };
+}
+
+// src/worker-provisioning.ts
+var applicantPrivateMetadata = (chapter, applicationId, fields, removeMissingProfile = false) => {
+  const profile = applicantProfile(chapter, fields);
+  return {
+    applicationId,
+    ...profile ? { profile } : removeMissingProfile ? { profile: null } : {}
+  };
+};
+var publicProfileRemoval = { applicationId: null, profile: null };
+async function markPrivateMetadataSynced(db, applicationId, clerkUserId) {
+  await db.transact([{
+    t: "update",
+    ns: "applications",
+    id: applicationId,
+    attrs: {
+      clerkPrivateMetadataSyncedAt: Date.now(),
+      ...clerkUserId ? { clerkUserId } : {}
+    }
+  }]);
+}
+async function syncApplicantPrivateMetadata(db, chapter, applicationId, fields, clerkUserId) {
+  if (chapter.account === "none") return false;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return false;
+    const ok = await updateClerkUserMetadata(secret, clerkUserId, {
+      publicMetadata: publicProfileRemoval,
+      privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+    });
+    if (!ok) return false;
+    await markPrivateMetadataSynced(db, applicationId, clerkUserId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function provisionApplicant(db, chapter, applicationId, fields) {
+  const email = typeof fields.email === "string" ? fields.email : "";
+  if (!email) return;
+  const stringValue = (value) => typeof value === "string" ? value : void 0;
+  const extra = {};
+  for (const field of chapter.application.crmFields) {
+    if (fields[field] !== void 0) extra[field] = fields[field];
+  }
+  try {
+    await projectApplicant(
+      { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
+      {
+        applicationId,
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        phone: stringValue(fields.phone),
+        linkedin: stringValue(fields.linkedin),
+        extra
+      }
+    );
+  } catch {
+  }
+  if (chapter.account === "none") return;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return;
+    const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
+    if (chapter.account === "create") {
+      const result = await createClerkUser(secret, {
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        privateMetadata,
+        repairMetadata: {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        }
+      });
+      if (result.ok && (!result.existed || result.refreshed)) {
+        await markPrivateMetadataSynced(db, applicationId);
+      }
+    } else {
+      const result = await createClerkInvitation(secret, { email });
+      if (result.existed) {
+        const refreshed = await updateClerkUserMetadataByEmail(secret, email, {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        });
+        if (refreshed) await markPrivateMetadataSynced(db, applicationId);
+      }
+    }
+  } catch {
+  }
+}
+async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
+  try {
+    const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
+    const group = Array.isArray(groups) ? groups[0] : void 0;
+    if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
+    const stringValue = (value) => typeof value === "string" ? value : "";
+    await sendTemplated(
+      {
+        db,
+        envName: env.ODLA_ENV,
+        sender: env.SEND_EMAIL,
+        from: env.EMAIL_FROM,
+        now: () => Date.now(),
+        newId: () => crypto.randomUUID()
+      },
+      {
+        group: emailGroupFrom(group),
+        template: "adminNotification",
+        to: group.notificationEmail,
+        vars: {
+          firstName: stringValue(fields.firstName),
+          lastName: stringValue(fields.lastName),
+          email: stringValue(fields.email),
+          phone: stringValue(fields.phone),
+          state: stringValue(fields.state)
+        },
+        dedupeKey: `apply:${applicationId}:admin`,
+        applicationId
+      }
+    );
+  } catch {
+  }
+}
+
+// src/worker-routes.ts
+async function memberSessionApplication(db, chapterId, email) {
+  let apps = (await db.query({ applications: { $: {
+    where: { emailNormalized: normalizeAdmissionEmail(email) },
+    limit: 20
+  } } })).applications;
+  if (!apps?.length) apps = (await db.query({ applications: { $: { where: { email }, limit: 20 } } })).applications;
+  const app = Array.isArray(apps) ? [...apps].sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0] : void 0;
+  if (!app) return null;
+  const meetings = (await db.query({ meetings: { $: { where: { applicationId: app.id, status: "scheduled" }, order: { createdAt: "desc" }, limit: 1 } } })).meetings;
+  const meeting = Array.isArray(meetings) ? meetings[0] : void 0;
+  const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
+  const group = Array.isArray(groups) ? groups[0] : void 0;
+  const timezone = resolveScheduling(group?.schedulingJson).timezone;
+  return {
+    application: memberApplication(app, meeting, timezone),
+    source: app
   };
 }
 var handleHealth = async (_req, url) => url.pathname === "/api/health" ? json({ ok: true }) : null;
@@ -1262,7 +1814,8 @@ var handleMember = async (req, url, env, ctx) => {
         membershipPage: activeControl.document.membershipPage,
         application: activeControl.document.application,
         theme: activeControl.document.theme
-      } } : {}
+      } } : {},
+      giftOffers: publicGiftOffers(activeControl?.document.giftOffers, Date.now())
     });
   }
   if (req.method === "GET" && url.pathname === "/api/join/resume") {
@@ -1301,18 +1854,9 @@ var handleMember = async (req, url, env, ctx) => {
     })).groups;
     const group = Array.isArray(groups) ? groups[0] : void 0;
     if (!group) return json({ error: "not found" }, 404);
-    const stripeKey = await getVaultSecret(db, "stripe_secret_key");
-    const status = String(app.status ?? "");
-    const offered = await loadOfferableTiers(db, group, Boolean(stripeKey));
-    const tier = findTier(offered, typeof app.tierId === "string" ? app.tierId : null);
-    const payable = Boolean(tier) && !tierIsFree(tier) && tierPayable(tier, group, Boolean(stripeKey));
-    if (!payable) return json({ state: "booking", applicationId });
-    if (status === chapter.pipeline.initial && app.stripeSubscriptionId) {
-      return json({ state: "paymentPending", applicationId });
-    }
-    if (status === chapter.pipeline.initial) return json({ state: "payment", applicationId });
-    if (canBook(status, chapter.pipeline)) return json({ state: "booking", applicationId });
-    return json({ error: `application cannot resume from status "${status}"` }, 409);
+    const state = await continueJoin(db, ctx, env, url.origin, app, group);
+    if (state) return json({ state, applicationId, ...state === "gift" ? { claimId: app.giftClaimId } : {} });
+    return json({ error: `application cannot resume from status "${String(app.status ?? "")}"` }, 409);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
     const raw = await req.text();
@@ -1328,12 +1872,19 @@ var handleMember = async (req, url, env, ctx) => {
     const activeControl = chapter.signupControl ? await loadActiveSignupControl(db, chapter.id, env.ODLA_ENV) : null;
     const effectiveChapter = activeControl ? { ...chapter, application: controlledApplication(chapter.application, activeControl.document) } : chapter;
     const offeredTierIds = typeof parsed.tierId === "string" && parsed.tierId ? (await loadTiers(db, { id: chapter.id })).map((tier) => tier.id) : void 0;
+    const now = Date.now();
+    const requestedGiftId = typeof parsed.giftOfferId === "string" ? parsed.giftOfferId : "";
+    const giftOffer = requestedGiftId ? findGiftOffer(activeControl?.document.giftOffers, requestedGiftId, now) : null;
+    if (requestedGiftId && !giftOffer) return json({ error: "gift offer is unavailable" }, 400);
+    const effectiveGrant = !giftOffer && typeof parsed.email === "string" ? await findAdmissionGrant(db, chapter.id, parsed.email, now) : null;
     const result = await submitApplication(db, effectiveChapter, parsed, {
       submissionId,
       groupId: chapter.id,
-      now: Date.now(),
+      now,
       newId: () => crypto.randomUUID(),
-      ...offeredTierIds ? { tierIds: offeredTierIds } : {}
+      ...offeredTierIds ? { tierIds: offeredTierIds } : {},
+      ...effectiveGrant?.decision === "waive_interview" ? { admissionGrant: effectiveGrant } : {},
+      ...giftOffer ? { giftOfferId: giftOffer.id } : {}
     });
     if (!result.ok) return json({ error: result.error }, 400);
     if (!result.duplicate) {
@@ -1342,10 +1893,16 @@ var handleMember = async (req, url, env, ctx) => {
       }
       await provisionApplicant(db, effectiveChapter, result.id, parsed);
     }
+    const apps = (await db.query({ applications: { $: { where: { id: result.id }, limit: 1 } } })).applications;
+    const canonical2 = Array.isArray(apps) ? apps[0] : void 0;
+    const groups = (await db.query({ groups: { $: { where: { id: chapter.id }, limit: 1 } } })).groups;
+    const group = Array.isArray(groups) ? groups[0] : void 0;
+    const state = canonical2 && group ? await continueJoin(db, ctx, env, url.origin, canonical2, group) : null;
     return json({
       id: result.id,
       duplicate: result.duplicate,
       status: result.status,
+      ...state ? { state } : {},
       // Echoed so a site can see (and assert in an integration test) whether its
       // join page actually posted the ack. Absent consent is otherwise invisible.
       disclaimerAckAt: result.disclaimerAckAt
@@ -1401,8 +1958,8 @@ var handleNetworkShared = async (req, url, env, ctx) => {
       payload,
       sourceId ? { sourceId } : {}
     );
-    const record = normalizeSharedRecord(payload, sourceId);
-    return json({ recordId, type: record.type });
+    const record3 = normalizeSharedRecord(payload, sourceId);
+    return json({ recordId, type: record3.type });
   } catch (error) {
     return json({
       error: error instanceof Error ? error.message : "invalid shared record"
@@ -1410,31 +1967,8 @@ var handleNetworkShared = async (req, url, env, ctx) => {
   }
 };
 
-// src/worker-routes-signup-control.ts
-import { verifyFederatedRequest as verifyFederatedRequest2 } from "@odla-ai/db";
-
-// src/signup-control-canonical.ts
-var encoder = new TextEncoder();
-function canonicalValue(value) {
-  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
-  if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
-  const record = value;
-  const entries = Object.keys(record).sort().flatMap((key) => {
-    const item = record[key];
-    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
-  });
-  return `{${entries.join(",")}}`;
-}
-function canonicalSignupControl(value) {
-  return canonicalValue(value);
-}
-async function signupControlDigest(document) {
-  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalSignupControl(document)));
-  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
+// src/worker-routes-signup-control.ts
+import { verifyFederatedRequest as verifyFederatedRequest2 } from "@odla-ai/db";
 
 // src/signup-control-contract.ts
 var SIGNUP_CONTROL_PATH = "/api/signup-control";
@@ -1465,9 +1999,9 @@ var MAX_BENEFITS = 24;
 var MAX_MARKDOWN = 65536;
 var MAX_LABEL = 160;
 var objectRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function rejectUnknownKeys(value, allowed, path, errors) {
+function rejectUnknownKeys(value, allowed2, path, errors) {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+    if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
   }
 }
 function boundedString(value, path, errors, max, required = false) {
@@ -1479,10 +2013,10 @@ function boundedString(value, path, errors, max, required = false) {
     errors.push(`${path} must be a string`);
     return void 0;
   }
-  const text2 = value.trim();
-  if (required && !text2) errors.push(`${path} is required`);
-  if (text2.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
-  return text2;
+  const text3 = value.trim();
+  if (required && !text3) errors.push(`${path} is required`);
+  if (text3.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text3;
 }
 function validateMembershipPageDocument(input, options = {}) {
   const errors = [];
@@ -1531,8 +2065,8 @@ function validateMembershipPageDocument(input, options = {}) {
       else {
         if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
         benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
-          const text2 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
-          return text2 ? [text2] : [];
+          const text3 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text3 ? [text3] : [];
         });
       }
     }
@@ -1606,7 +2140,7 @@ function validateMembershipPageDocument(input, options = {}) {
 var SLUG = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var ENVIRONMENT = /^[a-z][a-z0-9_-]{0,62}$/;
 var TIER = /^[a-z][a-z0-9-]{0,79}$/;
-var PRICE = /^price_[A-Za-z0-9]{12,}$/;
+var PRICE2 = /^price_[A-Za-z0-9]{12,}$/;
 var ROOT_KEYS2 = /* @__PURE__ */ new Set([
   "schemaVersion",
   "revision",
@@ -1618,14 +2152,15 @@ var ROOT_KEYS2 = /* @__PURE__ */ new Set([
   "application",
   "policy",
   "scheduling",
-  "theme"
+  "theme",
+  "giftOffers"
 ]);
 var TIER_KEYS2 = /* @__PURE__ */ new Set(["id", "name", "available", "sortOrder", "priceCents", "stripePriceId", "blurb"]);
 var recordOf = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function unknownKeys(value, allowed, path, errors) {
-  for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+function unknownKeys(value, allowed2, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
 }
-function text(value, path, errors, max = 65536) {
+function text2(value, path, errors, max = 65536) {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -1648,23 +2183,23 @@ function tiersOf(value, errors) {
       return [];
     }
     unknownKeys(item, TIER_KEYS2, path, errors);
-    const id = text(item.id, `${path}.id`, errors, 80);
+    const id = text2(item.id, `${path}.id`, errors, 80);
     if (id && !TIER.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (seen.has(id)) errors.push(`${path}.id duplicates "${id}"`);
     seen.add(id);
-    const name = text(item.name, `${path}.name`, errors, 160);
+    const name = text2(item.name, `${path}.name`, errors, 160);
     if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
     if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
     if (!Number.isInteger(item.priceCents) || Number(item.priceCents) < 0 || Number(item.priceCents) > 1e8) {
       errors.push(`${path}.priceCents must be an integer from 0 to 100,000,000`);
     }
-    if (item.stripePriceId !== void 0 && (typeof item.stripePriceId !== "string" || !PRICE.test(item.stripePriceId))) {
+    if (item.stripePriceId !== void 0 && (typeof item.stripePriceId !== "string" || !PRICE2.test(item.stripePriceId))) {
       errors.push(`${path}.stripePriceId must be a real Stripe Price id`);
     }
     if (item.available === true && Number(item.priceCents) > 0 && !item.stripePriceId) {
       errors.push(`${path}.stripePriceId is required for an available paid tier`);
     }
-    const blurb = item.blurb === void 0 ? void 0 : text(item.blurb, `${path}.blurb`, errors, 4e3);
+    const blurb = item.blurb === void 0 ? void 0 : text2(item.blurb, `${path}.blurb`, errors, 4e3);
     return [{
       id,
       name,
@@ -1685,143 +2220,781 @@ function applicationOf(value, errors) {
   }
   unknownKeys(input, /* @__PURE__ */ new Set(["required", "optional", "conditions", "copy"]), "document.application", errors);
   try {
-    const resolved = resolveApplication(input);
-    const copy = recordOf(input.copy);
-    if (input.copy !== void 0 && (!copy || Object.values(copy).some((item) => typeof item !== "string"))) {
-      errors.push("document.application.copy must contain only string values");
+    const resolved = resolveApplication(input);
+    const copy = recordOf(input.copy);
+    if (input.copy !== void 0 && (!copy || Object.values(copy).some((item) => typeof item !== "string"))) {
+      errors.push("document.application.copy must contain only string values");
+    }
+    return {
+      required: resolved.required,
+      optional: resolved.optional,
+      ...Object.keys(resolved.conditions).length ? { conditions: resolved.conditions } : {},
+      ...copy ? { copy } : {}
+    };
+  } catch (error) {
+    errors.push(error instanceof Error ? error.message : "document.application is invalid");
+    return void 0;
+  }
+}
+function policyOf(value, errors) {
+  if (value === void 0) return void 0;
+  const input = recordOf(value);
+  if (!input) {
+    errors.push("document.policy must be an object");
+    return void 0;
+  }
+  const allowed2 = /* @__PURE__ */ new Set(["disclaimerText", "refundPolicyText", "trustCopy", "commitmentText", "normsText"]);
+  unknownKeys(input, allowed2, "document.policy", errors);
+  const result = {};
+  for (const key of allowed2) {
+    if (input[key] === void 0 && key !== "disclaimerText" && key !== "refundPolicyText") continue;
+    result[key] = text2(input[key], `document.policy.${key}`, errors);
+  }
+  return result;
+}
+function themeOf(value, errors) {
+  if (value === void 0) return void 0;
+  const input = recordOf(value);
+  const tokens = recordOf(input?.tokens);
+  if (!input || !tokens) {
+    errors.push("document.theme.tokens must be an object");
+    return void 0;
+  }
+  unknownKeys(input, /* @__PURE__ */ new Set(["tokens"]), "document.theme", errors);
+  if (Object.keys(tokens).length > 256) errors.push("document.theme.tokens supports at most 256 entries");
+  let serializedLength = 0;
+  for (const [key, token] of Object.entries(tokens)) {
+    if (!/^--ui-[a-z0-9][a-z0-9-]{0,94}$/.test(key)) {
+      errors.push(`document.theme.tokens.${key} must be an allowlisted --ui-* custom property`);
+    }
+    const rendered = String(token).trim();
+    serializedLength += key.length + rendered.length + 4;
+    if (typeof token !== "string" && typeof token !== "number" || typeof token === "number" && !Number.isFinite(token) || !rendered || rendered.length > 1e3 || /[\u0000-\u001f\u007f\\<>{};]|\/\*|\*\/|(?:^|[^a-z])(?:url|expression)\s*\(|@import/i.test(rendered)) {
+      errors.push(`document.theme.tokens.${key} must be a bounded breakout-safe CSS value`);
+    }
+  }
+  if (serializedLength > 65536) errors.push("document.theme.tokens exceeds the serialized size bound");
+  return { tokens };
+}
+function validateSignupControlDocument(input) {
+  const errors = [];
+  const root = recordOf(input);
+  if (!root) return { ok: false, errors: ["document must be an object"] };
+  unknownKeys(root, ROOT_KEYS2, "document", errors);
+  if (root.schemaVersion !== 1) errors.push("document.schemaVersion must be 1");
+  if (!Number.isSafeInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
+  const source = recordOf(root.source);
+  const target = recordOf(root.target);
+  const appId = text2(source?.appId, "document.source.appId", errors, 63);
+  const chapterId = text2(target?.chapterId, "document.target.chapterId", errors, 63);
+  const environment = text2(target?.environment, "document.target.environment", errors, 63);
+  if (appId && !SLUG.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+  if (chapterId && !SLUG.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
+  if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
+  if (target?.stripeMode !== "test" && target?.stripeMode !== "live") errors.push("document.target.stripeMode must be test or live");
+  const tiers = tiersOf(root.tiers, errors);
+  const available = tiers.filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder);
+  const page = validateMembershipPageDocument(root.membershipPage, { tiers: available });
+  if (!page.ok) errors.push(...page.errors);
+  else if (page.value.tiers.some((tier, index) => tier.tierId !== available[index]?.id)) {
+    errors.push("document.membershipPage.tiers must follow the available tier display order");
+  }
+  const application = applicationOf(root.application, errors);
+  const policy = policyOf(root.policy, errors);
+  let scheduling;
+  if (root.scheduling !== void 0) {
+    const checked = validateScheduling(root.scheduling);
+    if (!checked.ok) errors.push(...Object.entries(checked.errors).map(([key, value]) => `document.scheduling.${key}: ${value}`));
+    else scheduling = root.scheduling;
+  }
+  const theme = themeOf(root.theme, errors);
+  const giftOffers = root.giftOffers === void 0 ? void 0 : validateGiftOfferCatalog(root.giftOffers, new Set(tiers.map((tier) => tier.id)));
+  if (giftOffers && !giftOffers.ok) errors.push(...giftOffers.errors);
+  if (errors.length || !page.ok) return { ok: false, errors };
+  return { ok: true, value: {
+    schemaVersion: 1,
+    revision: Number(root.revision),
+    generatedAt: Number(root.generatedAt),
+    source: { appId },
+    target: { chapterId, environment, stripeMode: target?.stripeMode },
+    tiers,
+    membershipPage: page.value,
+    ...application ? { application } : {},
+    ...policy ? { policy } : {},
+    ...scheduling ? { scheduling } : {},
+    ...theme ? { theme } : {},
+    ...giftOffers?.ok ? { giftOffers: giftOffers.value } : {}
+  } };
+}
+
+// src/worker-routes-signup-control.ts
+var reject = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
+var handleSignupControl = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== SIGNUP_CONTROL_PATH) return null;
+  const authority = ctx.chapter.signupControl;
+  if (!authority) return json({ error: "not found" }, 404);
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, authority.secretName);
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest2(req, { secret, senders: [authority.sourceId] });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return reject("invalid_document", 400, ["request body must be JSON"]);
+  }
+  const digest = typeof input.digest === "string" ? input.digest : "";
+  const checked = validateSignupControlDocument(input.document);
+  if (!checked.ok) return reject("invalid_document", 400, checked.errors);
+  const document = checked.value;
+  if (document.source.appId !== authority.sourceId) return reject("wrong_source", 403);
+  if (document.target.chapterId !== ctx.chapter.id) return reject("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject("wrong_environment", 409);
+  if (document.target.stripeMode !== authority.stripeMode) return reject("wrong_stripe_mode", 409);
+  const applicationErrors = validateControlledApplication(ctx.chapter, document);
+  if (applicationErrors.length) return reject("invalid_document", 400, applicationErrors);
+  if (!digest || await signupControlDigest(document) !== digest) return reject("invalid_digest", 400);
+  const latest = await loadLatestSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return reject("stale_revision", 409);
+  if (latest && document.revision === latest.revision) {
+    if (latest.digest !== digest) return reject("conflicting_revision", 409);
+    return json({
+      ok: true,
+      target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
+      revision: latest.revision,
+      digest: latest.digest,
+      status: "replayed",
+      acknowledgedAt: latest.receivedAt
+    });
+  }
+  const receivedAt = Date.now();
+  try {
+    await materializeSignupControl(db, { digest, document }, latest, receivedAt);
+  } catch {
+    return reject("materialization_failed", 503);
+  }
+  return json({
+    ok: true,
+    target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
+    revision: document.revision,
+    digest,
+    status: "accepted",
+    acknowledgedAt: receivedAt
+  });
+};
+
+// src/worker-routes-member-content.ts
+import { verifyFederatedRequest as verifyFederatedRequest3 } from "@odla-ai/db";
+
+// src/member-content-canonical.ts
+var encoder2 = new TextEncoder();
+function canonicalValue2(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalValue2).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("member content contains an unsupported value");
+  const record3 = value;
+  const entries = Object.keys(record3).sort().flatMap((key) => {
+    const item = record3[key];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue2(item)}`];
+  });
+  return `{${entries.join(",")}}`;
+}
+function canonicalMemberContent(value) {
+  return canonicalValue2(value);
+}
+async function memberContentDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder2.encode(canonicalMemberContent(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/member-content-validation-helpers.ts
+var ID3 = /^[a-z][a-z0-9-]{0,79}$/;
+var SLUG2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var ROOT_KEYS3 = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides"]);
+var SOURCE_KEYS = /* @__PURE__ */ new Set(["type", "appId"]);
+var TARGET_KEYS = /* @__PURE__ */ new Set(["chapterId", "environment"]);
+var PAGE_KEYS = /* @__PURE__ */ new Set(["id", "slug", "title", "summary", "navigation", "audience", "teaserMarkdown", "bodyMarkdown", "upsell"]);
+var NAV_KEYS = /* @__PURE__ */ new Set(["section", "order", "parentId"]);
+var AUDIENCE_KEYS = /* @__PURE__ */ new Set(["kind", "tierIds"]);
+var UPSELL_KEYS = /* @__PURE__ */ new Set(["owner", "offer"]);
+var OFFER_KEYS = /* @__PURE__ */ new Set(["tierId", "label", "bodyMarkdown", "ctaLabel"]);
+var OVERRIDE_KEYS = /* @__PURE__ */ new Set(["pageId", "offer"]);
+var MAX_PAGES = 100;
+var MAX_MARKDOWN2 = 65536;
+var MAX_TEXT = 240;
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function unknownKeys2(value, allowed2, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
+}
+function textValue(value, path, errors, max = MAX_TEXT, required = false) {
+  if (value === void 0) {
+    if (required) errors.push(`${path} is required`);
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    errors.push(`${path} must be a string`);
+    return void 0;
+  }
+  const valueText = value.trim();
+  if (required && !valueText) errors.push(`${path} is required`);
+  if (valueText.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return valueText;
+}
+function offerValue(value, path, errors, tiers, audience) {
+  const raw = record2(value);
+  if (!raw) {
+    errors.push(`${path} must be an object`);
+    return void 0;
+  }
+  unknownKeys2(raw, OFFER_KEYS, path, errors);
+  const tierId = textValue(raw.tierId, `${path}.tierId`, errors, 80, true) ?? "";
+  if (tierId && !ID3.test(tierId)) errors.push(`${path}.tierId must be a lowercase kebab-case id`);
+  if (tiers.size && !tiers.has(tierId)) errors.push(`${path}.tierId must reference a declared tier`);
+  if (audience?.kind === "tiers" && tierId && !audience.tierIds.includes(tierId)) {
+    errors.push(`${path}.tierId must grant access to this page`);
+  }
+  const label = textValue(raw.label, `${path}.label`, errors);
+  const bodyMarkdown = textValue(raw.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2);
+  const ctaLabel = textValue(raw.ctaLabel, `${path}.ctaLabel`, errors);
+  return {
+    tierId,
+    ...label ? { label } : {},
+    ...bodyMarkdown ? { bodyMarkdown } : {},
+    ...ctaLabel ? { ctaLabel } : {}
+  };
+}
+
+// src/member-content-validation.ts
+function validateMemberContentDocument(input, options = {}) {
+  const errors = [];
+  const root = record2(input);
+  if (!root) return { ok: false, errors: ["document must be an object"] };
+  unknownKeys2(root, ROOT_KEYS3, "document", errors);
+  if (root.schemaVersion !== MEMBER_CONTENT_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  if (!Number.isInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isInteger(root.generatedAt) || Number(root.generatedAt) < 0) errors.push("document.generatedAt must be a non-negative integer timestamp");
+  const sourceRaw = record2(root.source);
+  let source = { type: "chapter", appId: "invalid" };
+  if (!sourceRaw) errors.push("document.source must be an object");
+  else {
+    unknownKeys2(sourceRaw, SOURCE_KEYS, "document.source", errors);
+    const type = sourceRaw.type;
+    const appId = textValue(sourceRaw.appId, "document.source.appId", errors, 63, true) ?? "";
+    if (type !== "parent" && type !== "chapter") errors.push("document.source.type must be parent or chapter");
+    if (appId && !ID3.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+    if (options.sourceType && type !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
+    if (options.sourceAppId && appId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
+    if (type === "parent" || type === "chapter") source = { type, appId };
+  }
+  let target;
+  if (root.target !== void 0) {
+    const targetRaw = record2(root.target);
+    if (!targetRaw) errors.push("document.target must be an object");
+    else {
+      unknownKeys2(targetRaw, TARGET_KEYS, "document.target", errors);
+      const chapterId = textValue(targetRaw.chapterId, "document.target.chapterId", errors, 63, true) ?? "";
+      const environment = textValue(targetRaw.environment, "document.target.environment", errors, 80, true) ?? "";
+      target = { chapterId, environment };
+    }
+  }
+  if (source.type === "parent" && !target) errors.push("document.target is required for parent content");
+  if (source.type === "chapter" && target) errors.push("document.target is not supported for chapter content");
+  if (!Array.isArray(root.pages)) errors.push("document.pages must be an array");
+  const rawPages = Array.isArray(root.pages) ? root.pages : [];
+  if (rawPages.length > MAX_PAGES) errors.push(`document.pages supports at most ${MAX_PAGES} entries`);
+  const tierIds = new Set((options.tiers ?? []).map((tier) => tier.id));
+  const knownParentIds = new Set((options.parentPages ?? []).map((page) => page.id));
+  const ids = /* @__PURE__ */ new Set();
+  const slugs = /* @__PURE__ */ new Set();
+  const pages = [];
+  for (const [index, value] of rawPages.slice(0, MAX_PAGES).entries()) {
+    const path = `document.pages[${index}]`;
+    const raw = record2(value);
+    if (!raw) {
+      errors.push(`${path} must be an object`);
+      continue;
+    }
+    unknownKeys2(raw, PAGE_KEYS, path, errors);
+    const id = textValue(raw.id, `${path}.id`, errors, 80, true) ?? "";
+    const slug = textValue(raw.slug, `${path}.slug`, errors, 120, true) ?? "";
+    const title = textValue(raw.title, `${path}.title`, errors, MAX_TEXT, true) ?? "";
+    if (id && !ID3.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (slug && !SLUG2.test(slug)) errors.push(`${path}.slug must be a lowercase URL slug`);
+    if (ids.has(id) || knownParentIds.has(id)) errors.push(`${path}.id duplicates page "${id}"`);
+    if (slugs.has(slug) || (options.parentPages ?? []).some((page) => page.slug === slug)) errors.push(`${path}.slug duplicates "${slug}"`);
+    ids.add(id);
+    slugs.add(slug);
+    const navRaw = record2(raw.navigation);
+    let navigation = { section: "General", order: index };
+    if (!navRaw) errors.push(`${path}.navigation must be an object`);
+    else {
+      unknownKeys2(navRaw, NAV_KEYS, `${path}.navigation`, errors);
+      const section = textValue(navRaw.section, `${path}.navigation.section`, errors, 120, true) ?? "";
+      const order = navRaw.order;
+      if (!Number.isInteger(order) || Number(order) < 0 || Number(order) > 1e6) {
+        errors.push(`${path}.navigation.order must be an integer from 0 to 1,000,000`);
+      }
+      const parentId = textValue(navRaw.parentId, `${path}.navigation.parentId`, errors, 80);
+      navigation = { section, order: Number.isInteger(order) ? Number(order) : index, ...parentId ? { parentId } : {} };
+    }
+    const audienceRaw = record2(raw.audience);
+    let audience = { kind: "all-members" };
+    if (!audienceRaw) errors.push(`${path}.audience must be an object`);
+    else {
+      unknownKeys2(audienceRaw, AUDIENCE_KEYS, `${path}.audience`, errors);
+      if (audienceRaw.kind === "all-members") {
+        if (audienceRaw.tierIds !== void 0) errors.push(`${path}.audience.tierIds is not supported for all-members`);
+      } else if (audienceRaw.kind === "tiers") {
+        if (!Array.isArray(audienceRaw.tierIds) || audienceRaw.tierIds.length === 0) {
+          errors.push(`${path}.audience.tierIds must be a non-empty array`);
+        }
+        const values = Array.isArray(audienceRaw.tierIds) ? audienceRaw.tierIds : [];
+        const normalized = [];
+        for (const [tierIndex, value2] of values.entries()) {
+          const tier = textValue(value2, `${path}.audience.tierIds[${tierIndex}]`, errors, 80, true) ?? "";
+          if (normalized.includes(tier)) errors.push(`${path}.audience.tierIds duplicates "${tier}"`);
+          if (tierIds.size && !tierIds.has(tier)) errors.push(`${path}.audience.tierIds references undeclared tier "${tier}"`);
+          normalized.push(tier);
+        }
+        audience = { kind: "tiers", tierIds: normalized };
+      } else errors.push(`${path}.audience.kind must be all-members or tiers`);
+    }
+    const summary = textValue(raw.summary, `${path}.summary`, errors, 2e3);
+    const teaserMarkdown = textValue(raw.teaserMarkdown, `${path}.teaserMarkdown`, errors, MAX_MARKDOWN2);
+    const bodyMarkdown = textValue(raw.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, true) ?? "";
+    let upsell;
+    if (raw.upsell !== void 0) {
+      const upsellRaw = record2(raw.upsell);
+      if (!upsellRaw) errors.push(`${path}.upsell must be an object`);
+      else {
+        unknownKeys2(upsellRaw, UPSELL_KEYS, `${path}.upsell`, errors);
+        const owner = upsellRaw.owner;
+        if (owner !== "parent" && owner !== "chapter") errors.push(`${path}.upsell.owner must be parent or chapter`);
+        if (source.type === "chapter" && owner === "parent") errors.push(`${path}.upsell.owner cannot be parent on a chapter page`);
+        if (source.type === "parent" && owner === "parent" && upsellRaw.offer === void 0) errors.push(`${path}.upsell.offer is required when the parent owns the offer`);
+        if (source.type === "parent" && owner === "chapter" && upsellRaw.offer !== void 0) errors.push(`${path}.upsell.offer must be set by the chapter after delegation`);
+        const offer = upsellRaw.offer === void 0 ? void 0 : offerValue(upsellRaw.offer, `${path}.upsell.offer`, errors, tierIds, audience);
+        if (owner === "parent") upsell = { owner, offer: offer ?? { tierId: "" } };
+        else if (owner === "chapter") upsell = { owner, ...offer ? { offer } : {} };
+      }
+    }
+    pages.push({ id, slug, title, ...summary ? { summary } : {}, navigation, audience, ...teaserMarkdown ? { teaserMarkdown } : {}, bodyMarkdown, ...upsell ? { upsell } : {} });
+  }
+  const allIds = /* @__PURE__ */ new Set([...knownParentIds, ...ids]);
+  for (const [index, page] of pages.entries()) {
+    const parentId = page.navigation.parentId;
+    if (parentId && !allIds.has(parentId)) errors.push(`document.pages[${index}].navigation.parentId references unknown page "${parentId}"`);
+    if (parentId === page.id) errors.push(`document.pages[${index}].navigation.parentId cannot reference itself`);
+  }
+  for (const page of pages) {
+    const seen = /* @__PURE__ */ new Set([page.id]);
+    let parentId = page.navigation.parentId;
+    while (parentId) {
+      if (seen.has(parentId)) {
+        errors.push(`document.pages contains a navigation cycle at "${page.id}"`);
+        break;
+      }
+      seen.add(parentId);
+      parentId = pages.find((candidate) => candidate.id === parentId)?.navigation.parentId;
+    }
+  }
+  let upsellOverrides;
+  if (root.upsellOverrides !== void 0) {
+    if (source.type !== "chapter") errors.push("document.upsellOverrides is supported only for chapter content");
+    if (!Array.isArray(root.upsellOverrides)) errors.push("document.upsellOverrides must be an array");
+    const values = Array.isArray(root.upsellOverrides) ? root.upsellOverrides : [];
+    const seen = /* @__PURE__ */ new Set();
+    upsellOverrides = [];
+    for (const [index, value] of values.entries()) {
+      const path = `document.upsellOverrides[${index}]`;
+      const raw = record2(value);
+      if (!raw) {
+        errors.push(`${path} must be an object`);
+        continue;
+      }
+      unknownKeys2(raw, OVERRIDE_KEYS, path, errors);
+      const pageId = textValue(raw.pageId, `${path}.pageId`, errors, 80, true) ?? "";
+      if (seen.has(pageId)) errors.push(`${path}.pageId duplicates "${pageId}"`);
+      seen.add(pageId);
+      const parentPage = (options.parentPages ?? []).find((page) => page.id === pageId);
+      if (!parentPage) errors.push(`${path}.pageId must reference a parent page`);
+      else if (parentPage.upsell?.owner !== "chapter") errors.push(`${path}.pageId does not delegate upsell authority to the chapter`);
+      const offer = offerValue(raw.offer, `${path}.offer`, errors, tierIds, parentPage?.audience);
+      if (offer) upsellOverrides.push({ pageId, offer });
+    }
+  }
+  if (errors.length) return { ok: false, errors };
+  return { ok: true, value: {
+    schemaVersion: MEMBER_CONTENT_SCHEMA_VERSION,
+    revision: Number(root.revision),
+    generatedAt: Number(root.generatedAt),
+    source,
+    ...target ? { target } : {},
+    pages,
+    ...upsellOverrides ? { upsellOverrides } : {}
+  } };
+}
+
+// src/member-content.ts
+var MEMBER_CONTENT_SCHEMA_VERSION = 1;
+var MEMBER_CONTENT_PATH = "/api/member-content";
+var MEMBER_CONTENT_CONTROL_PATH = "/api/member-content-control";
+var pageOrder = (a, b) => a.navigation.section.localeCompare(b.navigation.section) || a.navigation.order - b.navigation.order || a.title.localeCompare(b.title) || a.id.localeCompare(b.id);
+function composeMemberContent(parent, chapter) {
+  const pages = [];
+  const parentPages = /* @__PURE__ */ new Map();
+  for (const page of parent?.pages ?? []) {
+    const effective = { ...page, source: parent.source };
+    parentPages.set(page.id, effective);
+    pages.push(effective);
+  }
+  for (const override of chapter?.upsellOverrides ?? []) {
+    const page = parentPages.get(override.pageId);
+    if (page?.upsell?.owner === "chapter") page.upsell = { owner: "chapter", offer: override.offer };
+  }
+  for (const page of chapter?.pages ?? []) {
+    if (parentPages.has(page.id) || pages.some((candidate) => candidate.slug === page.slug)) {
+      throw new TypeError(`Chapter member page "${page.id}" conflicts with parent content`);
+    }
+    pages.push({ ...page, source: chapter.source });
+  }
+  return {
+    pages: pages.sort(pageOrder),
+    parentRevision: parent?.revision ?? null,
+    chapterRevision: chapter?.revision ?? null
+  };
+}
+var allowed = (page, viewer) => viewer.admin || page.audience.kind === "all-members" || viewer.tierId !== null && page.audience.tierIds.includes(viewer.tierId);
+function projectMemberContent(content, viewer, tiers) {
+  const authority = new Map(tiers.filter((tier) => tier.active !== false).map((tier) => [tier.id, tier]));
+  return {
+    viewer: { ...viewer },
+    revisions: { parent: content.parentRevision, chapter: content.chapterRevision },
+    pages: content.pages.map((page) => {
+      const canRead = allowed(page, viewer);
+      const offer = !canRead ? page.upsell?.offer : void 0;
+      const tier = offer ? authority.get(offer.tierId) : void 0;
+      const upsell = offer && tier && typeof tier.name === "string" && typeof tier.priceCents === "number" ? { ...offer, tierName: tier.name, priceCents: tier.priceCents } : void 0;
+      return {
+        id: page.id,
+        slug: page.slug,
+        title: page.title,
+        ...page.summary ? { summary: page.summary } : {},
+        navigation: page.navigation,
+        audience: page.audience,
+        source: page.source,
+        access: canRead ? "allowed" : "locked",
+        ...page.teaserMarkdown ? { teaserMarkdown: page.teaserMarkdown } : {},
+        ...canRead ? { bodyMarkdown: page.bodyMarkdown } : {},
+        ...upsell ? { upsell } : {}
+      };
+    })
+  };
+}
+
+// src/member-content-store.ts
+var control = (row) => row && row.document && typeof row.document === "object" ? row : null;
+var local = (row) => row && row.document && typeof row.document === "object" ? row : null;
+async function exists(db, ns, where) {
+  if (db.aggregate) return Number((await db.aggregate(ns, { count: true }, { where })).count ?? 0) > 0;
+  const rows4 = (await db.query({ [ns]: {} }))[ns] ?? [];
+  return rows4.some((row) => Object.entries(where).every(([key, value]) => row[key] === value));
+}
+async function loadActiveMemberContentControl(db, targetId, environment) {
+  const where = { targetId, environment, active: true };
+  if (!await exists(db, "memberContentControls", where)) return null;
+  const rows4 = (await db.query({ memberContentControls: { $: {
+    where,
+    order: { revision: "desc" },
+    limit: 1
+  } } })).memberContentControls;
+  return control(Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+}
+async function loadLatestMemberContentControl(db, targetId, environment) {
+  const where = { targetId, environment };
+  if (!await exists(db, "memberContentControls", where)) return null;
+  const rows4 = (await db.query({ memberContentControls: { $: {
+    where,
+    order: { revision: "desc" },
+    limit: 1
+  } } })).memberContentControls;
+  return control(Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+}
+async function loadLocalMemberContent(db, chapterId, environment) {
+  const id = `member-content-local:${environment}`;
+  const rows4 = (await db.query({ memberContentLocal: { $: { where: { id }, limit: 1 } } })).memberContentLocal;
+  return local(Array.isArray(rows4) ? rows4[0] : void 0);
+}
+async function materializeMemberContentControl(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const target = document.target;
+  const id = `member-content-control:${target.environment}:${document.revision}`;
+  const ops = [];
+  if (previous?.active) {
+    ops.push({ t: "update", ns: "memberContentControls", id: previous.id, attrs: { active: false } });
+  }
+  ops.push({ t: "update", ns: "memberContentControls", id, attrs: {
+    id,
+    sourceId: document.source.appId,
+    targetId: target.chapterId,
+    environment: target.environment,
+    revision: document.revision,
+    digest,
+    document,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `member-content-control:${target.environment}:${document.revision}:${digest}` });
+}
+async function saveLocalMemberContent(db, document, environment, expectedRevision, updatedAt, updatedBy) {
+  const id = `member-content-local:${environment}`;
+  const current = await loadLocalMemberContent(db, document.source.appId, environment);
+  if ((current?.revision ?? 0) !== expectedRevision) throw new Error("member_content_revision_conflict");
+  const row = {
+    id,
+    chapterId: document.source.appId,
+    environment,
+    revision: document.revision,
+    document,
+    updatedAt,
+    ...updatedBy ? { updatedBy } : {}
+  };
+  await db.transact([{ t: "update", ns: "memberContentLocal", id, attrs: row }], {
+    mutationId: `member-content-local:${environment}:${document.revision}`,
+    guards: current ? [{ ns: "memberContentLocal", id, exists: true, equals: { revision: expectedRevision } }] : [{ ns: "memberContentLocal", id, exists: false }]
+  });
+  return row;
+}
+
+// src/worker-routes-member-content.ts
+var ADMIN_PATH = "/api/admin/member-content";
+var BODY_CAP = 1e6;
+var reject2 = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
+async function groupAndTiers(db, chapterId) {
+  const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
+  const group = Array.isArray(groups) ? groups[0] : void 0;
+  if (!group) return { group: null, tiers: [] };
+  return { group, tiers: await loadTiers(db, group) };
+}
+async function memberTierId(db, chapterId, email) {
+  if (!email) return null;
+  let rows4 = (await db.query({ applications: { $: {
+    where: { emailNormalized: normalizeAdmissionEmail(email) },
+    limit: 20
+  } } })).applications;
+  if (!rows4?.length) rows4 = (await db.query({ applications: { $: { where: { email }, limit: 20 } } })).applications;
+  const latest = Array.isArray(rows4) ? [...rows4].filter((row) => String(row.groupId ?? chapterId) === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0] : void 0;
+  return typeof latest?.tierId === "string" && latest.tierId ? latest.tierId : null;
+}
+async function activeDocuments(db, chapterId, environment) {
+  const [parent, chapter] = await Promise.all([
+    loadActiveMemberContentControl(db, chapterId, environment),
+    loadLocalMemberContent(db, chapterId, environment)
+  ]);
+  return { parent, chapter };
+}
+var handleMemberContentControl = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== MEMBER_CONTENT_CONTROL_PATH) return null;
+  const settings = ctx.chapter.memberContent?.parent;
+  if (!settings) return json({ error: "not found" }, 404);
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, settings.secretName);
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest3(req, { secret, senders: [settings.sourceId] });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return reject2("invalid_document", 400, ["request body must be JSON"]);
+  }
+  const digest = typeof input.digest === "string" ? input.digest : "";
+  const initial = validateMemberContentDocument(input.document, {
+    sourceType: "parent"
+  });
+  if (!initial.ok) return reject2("invalid_document", 400, initial.errors);
+  const document = initial.value;
+  if (document.source.appId !== settings.sourceId) return reject2("wrong_source", 403);
+  if (document.target?.chapterId !== ctx.chapter.id) return reject2("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject2("wrong_environment", 409);
+  const { tiers } = await groupAndTiers(db, ctx.chapter.id);
+  const checked = validateMemberContentDocument(document, {
+    sourceType: "parent",
+    sourceAppId: settings.sourceId,
+    tiers
+  });
+  if (!checked.ok) return reject2("invalid_document", 400, checked.errors);
+  const local2 = await loadLocalMemberContent(db, ctx.chapter.id, env.ODLA_ENV);
+  if (local2) {
+    const localCheck = validateMemberContentDocument(local2.document, {
+      sourceType: "chapter",
+      sourceAppId: ctx.chapter.id,
+      tiers,
+      parentPages: document.pages
+    });
+    if (!localCheck.ok) {
+      return reject2("invalid_document", 409, localCheck.errors.map((error) => `existing chapter content: ${error}`));
     }
-    return {
-      required: resolved.required,
-      optional: resolved.optional,
-      ...Object.keys(resolved.conditions).length ? { conditions: resolved.conditions } : {},
-      ...copy ? { copy } : {}
-    };
-  } catch (error) {
-    errors.push(error instanceof Error ? error.message : "document.application is invalid");
-    return void 0;
   }
-}
-function policyOf(value, errors) {
-  if (value === void 0) return void 0;
-  const input = recordOf(value);
-  if (!input) {
-    errors.push("document.policy must be an object");
-    return void 0;
+  if (!digest || await memberContentDigest(document) !== digest) return reject2("invalid_digest", 400);
+  const latest = await loadLatestMemberContentControl(db, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return reject2("stale_revision", 409);
+  if (latest && document.revision === latest.revision) {
+    if (latest.digest !== digest) return reject2("conflicting_revision", 409);
+    return json({
+      ok: true,
+      target: document.target,
+      revision: latest.revision,
+      digest: latest.digest,
+      status: "replayed",
+      acknowledgedAt: latest.receivedAt
+    });
   }
-  const allowed = /* @__PURE__ */ new Set(["disclaimerText", "refundPolicyText", "trustCopy", "commitmentText", "normsText"]);
-  unknownKeys(input, allowed, "document.policy", errors);
-  const result = {};
-  for (const key of allowed) {
-    if (input[key] === void 0 && key !== "disclaimerText" && key !== "refundPolicyText") continue;
-    result[key] = text(input[key], `document.policy.${key}`, errors);
+  const receivedAt = Date.now();
+  try {
+    await materializeMemberContentControl(db, { digest, document }, latest, receivedAt);
+  } catch {
+    return reject2("materialization_failed", 503);
   }
-  return result;
-}
-function themeOf(value, errors) {
-  if (value === void 0) return void 0;
-  const input = recordOf(value);
-  const tokens = recordOf(input?.tokens);
-  if (!input || !tokens) {
-    errors.push("document.theme.tokens must be an object");
-    return void 0;
+  return json({
+    ok: true,
+    target: document.target,
+    revision: document.revision,
+    digest,
+    status: "accepted",
+    acknowledgedAt: receivedAt
+  });
+};
+var handleMemberContent = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== MEMBER_CONTENT_PATH) return null;
+  if (!ctx.chapter.memberContent) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  const role = await ctx.roleFor(db, user);
+  const admin = await ctx.isAdmin(db, user);
+  const roleIndex = ctx.chapter.auth.ladder.indexOf(role);
+  const memberIndex = Math.max(0, ctx.chapter.auth.ladder.length - 2);
+  if (!admin && roleIndex < memberIndex) return json({ error: "member access required" }, 403);
+  const [{ parent, chapter }, { group, tiers }, tierId] = await Promise.all([
+    activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
+    groupAndTiers(db, ctx.chapter.id),
+    memberTierId(db, ctx.chapter.id, user.email)
+  ]);
+  const effective = composeMemberContent(parent?.document, chapter?.document);
+  let offerable = tiers;
+  if (group) {
+    const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
+    offerable = await loadOfferableTiers(db, group, Boolean(stripeSecret));
   }
-  unknownKeys(input, /* @__PURE__ */ new Set(["tokens"]), "document.theme", errors);
-  if (Object.keys(tokens).length > 256) errors.push("document.theme.tokens supports at most 256 entries");
-  let serializedLength = 0;
-  for (const [key, token] of Object.entries(tokens)) {
-    if (!/^--ui-[a-z0-9][a-z0-9-]{0,94}$/.test(key)) {
-      errors.push(`document.theme.tokens.${key} must be an allowlisted --ui-* custom property`);
-    }
-    const rendered = String(token).trim();
-    serializedLength += key.length + rendered.length + 4;
-    if (typeof token !== "string" && typeof token !== "number" || typeof token === "number" && !Number.isFinite(token) || !rendered || rendered.length > 1e3 || /[\u0000-\u001f\u007f\\<>{};]|\/\*|\*\/|(?:^|[^a-z])(?:url|expression)\s*\(|@import/i.test(rendered)) {
-      errors.push(`document.theme.tokens.${key} must be a bounded breakout-safe CSS value`);
-    }
+  return json(projectMemberContent(effective, { tierId, admin }, offerable));
+};
+var handleAdminMemberContent = async (req, url, env, ctx) => {
+  if (url.pathname !== ADMIN_PATH) return null;
+  if (!ctx.chapter.memberContent) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  const [{ parent, chapter }, { tiers }] = await Promise.all([
+    activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
+    groupAndTiers(db, ctx.chapter.id)
+  ]);
+  if (req.method === "GET") {
+    const effective = composeMemberContent(parent?.document, chapter?.document);
+    return json({
+      parent: parent ? { revision: parent.revision, digest: parent.digest, document: parent.document } : null,
+      chapter: chapter ? { revision: chapter.revision, document: chapter.document } : null,
+      effective,
+      tiers: tiers.map(({ id, name, priceCents, active }) => ({ id, name, priceCents, active })),
+      localAuthoring: ctx.chapter.memberContent.localAuthoring
+    });
   }
-  if (serializedLength > 65536) errors.push("document.theme.tokens exceeds the serialized size bound");
-  return { tokens };
-}
-function validateSignupControlDocument(input) {
-  const errors = [];
-  const root = recordOf(input);
-  if (!root) return { ok: false, errors: ["document must be an object"] };
-  unknownKeys(root, ROOT_KEYS2, "document", errors);
-  if (root.schemaVersion !== 1) errors.push("document.schemaVersion must be 1");
-  if (!Number.isSafeInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
-  if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
-  const source = recordOf(root.source);
-  const target = recordOf(root.target);
-  const appId = text(source?.appId, "document.source.appId", errors, 63);
-  const chapterId = text(target?.chapterId, "document.target.chapterId", errors, 63);
-  const environment = text(target?.environment, "document.target.environment", errors, 63);
-  if (appId && !SLUG.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
-  if (chapterId && !SLUG.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
-  if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
-  if (target?.stripeMode !== "test" && target?.stripeMode !== "live") errors.push("document.target.stripeMode must be test or live");
-  const tiers = tiersOf(root.tiers, errors);
-  const available = tiers.filter((tier) => tier.available).sort((a, b) => a.sortOrder - b.sortOrder);
-  const page = validateMembershipPageDocument(root.membershipPage, { tiers: available });
-  if (!page.ok) errors.push(...page.errors);
-  else if (page.value.tiers.some((tier, index) => tier.tierId !== available[index]?.id)) {
-    errors.push("document.membershipPage.tiers must follow the available tier display order");
+  if (req.method !== "PUT") return json({ error: "method not allowed" }, 405);
+  if (!ctx.chapter.memberContent.localAuthoring) return json({ error: "local authoring is disabled" }, 403);
+  const raw = await req.text();
+  if (raw.length > BODY_CAP) return json({ error: "request body too large" }, 413);
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
   }
-  const application = applicationOf(root.application, errors);
-  const policy = policyOf(root.policy, errors);
-  let scheduling;
-  if (root.scheduling !== void 0) {
-    const checked = validateScheduling(root.scheduling);
-    if (!checked.ok) errors.push(...Object.entries(checked.errors).map(([key, value]) => `document.scheduling.${key}: ${value}`));
-    else scheduling = root.scheduling;
+  const expectedRevision = Number(input.expectedRevision);
+  if (!Number.isInteger(expectedRevision) || expectedRevision < 0) {
+    return json({ error: "expectedRevision must be a non-negative integer" }, 400);
   }
-  const theme = themeOf(root.theme, errors);
-  if (errors.length || !page.ok) return { ok: false, errors };
-  return { ok: true, value: {
-    schemaVersion: 1,
-    revision: Number(root.revision),
-    generatedAt: Number(root.generatedAt),
-    source: { appId },
-    target: { chapterId, environment, stripeMode: target?.stripeMode },
+  const now = Date.now();
+  const documentInput = withLocalAuthority(input.document, expectedRevision + 1, now, ctx.chapter.id);
+  const checked = validateMemberContentDocument(documentInput, {
+    sourceType: "chapter",
+    sourceAppId: ctx.chapter.id,
     tiers,
-    membershipPage: page.value,
-    ...application ? { application } : {},
-    ...policy ? { policy } : {},
-    ...scheduling ? { scheduling } : {},
-    ...theme ? { theme } : {}
-  } };
+    parentPages: parent?.document.pages ?? []
+  });
+  if (!checked.ok) return json({ error: "invalid member content", errors: checked.errors }, 400);
+  try {
+    const saved = await saveLocalMemberContent(
+      db,
+      checked.value,
+      env.ODLA_ENV,
+      expectedRevision,
+      now,
+      user.email ?? user.userId
+    );
+    return json({ ok: true, revision: saved.revision, document: saved.document });
+  } catch (error) {
+    if (error instanceof Error && error.message === "member_content_revision_conflict") {
+      return json({ error: "member content changed; reload before saving" }, 409);
+    }
+    return json({ error: "member content could not be saved" }, 503);
+  }
+};
+function withLocalAuthority(value, revision, generatedAt, appId) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  return {
+    ...value,
+    schemaVersion: 1,
+    revision,
+    generatedAt,
+    source: { type: "chapter", appId }
+  };
 }
 
-// src/worker-routes-signup-control.ts
-var reject = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
-var handleSignupControl = async (req, url, env, ctx) => {
-  if (req.method !== "POST" || url.pathname !== SIGNUP_CONTROL_PATH) return null;
+// src/worker-routes-admission-grants.ts
+import { verifyFederatedRequest as verifyFederatedRequest4 } from "@odla-ai/db";
+var reject3 = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
+var handleAdmissionGrants = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== ADMISSION_GRANTS_PATH) return null;
   const authority = ctx.chapter.signupControl;
   if (!authority) return json({ error: "not found" }, 404);
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, authority.secretName);
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await verifyFederatedRequest2(req, { secret, senders: [authority.sourceId] });
+  const verified = await verifyFederatedRequest4(req, { secret, senders: [authority.sourceId] });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   let input;
   try {
     input = JSON.parse(verified.body);
   } catch {
-    return reject("invalid_document", 400, ["request body must be JSON"]);
+    return reject3("invalid_document", 400, ["request body must be JSON"]);
   }
   const digest = typeof input.digest === "string" ? input.digest : "";
-  const checked = validateSignupControlDocument(input.document);
-  if (!checked.ok) return reject("invalid_document", 400, checked.errors);
+  const checked = validateAdmissionGrantDocument(input.document);
+  if (!checked.ok) return reject3("invalid_document", 400, checked.errors);
   const document = checked.value;
-  if (document.source.appId !== authority.sourceId) return reject("wrong_source", 403);
-  if (document.target.chapterId !== ctx.chapter.id) return reject("wrong_target", 409);
-  if (document.target.environment !== env.ODLA_ENV) return reject("wrong_environment", 409);
-  if (document.target.stripeMode !== authority.stripeMode) return reject("wrong_stripe_mode", 409);
-  const applicationErrors = validateControlledApplication(ctx.chapter, document);
-  if (applicationErrors.length) return reject("invalid_document", 400, applicationErrors);
-  if (!digest || await signupControlDigest(document) !== digest) return reject("invalid_digest", 400);
-  const latest = await loadLatestSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
-  if (latest && document.revision < latest.revision) return reject("stale_revision", 409);
+  if (document.source.appId !== authority.sourceId) return reject3("wrong_source", 403);
+  if (document.target.chapterId !== ctx.chapter.id) return reject3("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject3("wrong_environment", 409);
+  if (!digest || await signupControlDigest(document) !== digest) return reject3("invalid_digest", 400);
+  const latest = await loadLatestAdmissionRevision(db, authority.sourceId, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return reject3("stale_revision", 409);
   if (latest && document.revision === latest.revision) {
-    if (latest.digest !== digest) return reject("conflicting_revision", 409);
+    if (latest.digest !== digest) return reject3("conflicting_revision", 409);
     return json({
       ok: true,
       target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
@@ -1833,9 +3006,9 @@ var handleSignupControl = async (req, url, env, ctx) => {
   }
   const receivedAt = Date.now();
   try {
-    await materializeSignupControl(db, { digest, document }, latest, receivedAt);
+    await materializeAdmissionGrants(db, { digest, document }, latest, receivedAt);
   } catch {
-    return reject("materialization_failed", 503);
+    return reject3("materialization_failed", 503);
   }
   return json({
     ok: true,
@@ -1847,92 +3020,101 @@ var handleSignupControl = async (req, url, env, ctx) => {
   });
 };
 
-// src/crm-sync.ts
-import { createRecord as createRecord2, updateRecord as updateRecord2, setStage, linkIdentity } from "@odla-ai/crm";
-var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
-var crmDeps = (db, ctx) => ({
-  crm: ctx.chapter.crm,
-  db,
-  now: () => Date.now(),
-  newId: () => crypto.randomUUID(),
-  chapter: ctx.chapter
-});
-function personInputFromApp(chapter, app) {
-  const input = sharedPersonInput({
-    email: str(app.email),
-    firstName: str(app.firstName) || void 0,
-    lastName: str(app.lastName) || void 0,
-    phone: str(app.phone) || void 0,
-    linkedin: str(app.linkedin) || void 0,
-    hubRecordId: str(app.id)
-  });
-  for (const f of chapter.application.crmFields) {
-    if (app[f] !== void 0) input[f] = app[f];
-  }
-  if (app.id !== void 0) input.applicationId = str(app.id);
-  return input;
-}
-function billingColumns(app) {
-  const status = str(app.status);
-  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
-  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
-  const cols = { billingStatus };
-  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
-  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
-  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
-  return cols;
-}
-async function syncApplicationToCrm(deps, opts) {
-  const emailKey = str(opts.app.email).toLowerCase();
-  if (!emailKey) return null;
-  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const input = personInputFromApp(deps.chapter, opts.app);
-  const { crm_record } = await deps.db.query({
-    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
-  });
-  const existing = crm_record?.[0] ?? null;
-  const stage = opts.stage || void 0;
-  let recordId;
-  if (existing && typeof existing.id === "string") {
-    recordId = existing.id;
-    await updateRecord2(recordDeps, { id: recordId, input });
-  } else {
-    const created = await createRecord2(recordDeps, { type: "person", input, ...stage ? { stage } : {} });
-    recordId = created.id;
-  }
-  if (existing && stage && existing.stage !== stage) {
-    await setStage(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
-  }
-  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
-  await linkIdentity(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
-  return recordId;
-}
-async function backfillCrm(deps) {
-  const [appsRes, usersRes] = await Promise.all([
-    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
-    deps.db.query({ $users: { $: { limit: 1e3 } } })
-  ]);
-  const seen = /* @__PURE__ */ new Set();
-  let synced = 0;
-  const errors = [];
-  const run = async (app, stage) => {
-    const key = str(app.email).toLowerCase();
-    if (!key || seen.has(key)) return;
-    seen.add(key);
+// src/worker-routes-admin-admission.ts
+async function gate(req, env, ctx) {
+  const rawDb = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, user)) return json({ error: "forbidden" }, 403);
+  return { db: rawDb, user };
+}
+var handleAdminAdmissionGrants = async (req, url, env, ctx) => {
+  if (url.pathname === "/api/admin/admission-grants" && req.method === "GET") {
+    const auth = await gate(req, env, ctx);
+    if (auth instanceof Response) return auth;
+    const result = await auth.db.query({ admissionGrants: { $: {
+      where: { targetId: ctx.chapter.id },
+      order: { createdAt: "desc" },
+      limit: 500
+    } } });
+    const grants = Array.isArray(result.admissionGrants) ? result.admissionGrants.map((row) => ({ ...row, emailNormalized: void 0 })) : [];
+    return json({ grants });
+  }
+  if (url.pathname === "/api/admin/admission-grants" && req.method === "POST") {
+    const auth = await gate(req, env, ctx);
+    if (auth instanceof Response) return auth;
+    let body;
     try {
-      await syncApplicationToCrm(deps, { app, stage });
-      synced += 1;
-    } catch (err) {
-      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
+      body = JSON.parse(await req.text());
+    } catch {
+      return json({ error: "invalid JSON body" }, 400);
+    }
+    const email = typeof body.email === "string" ? body.email.trim() : "";
+    const emailNormalized = normalizeAdmissionEmail(email);
+    if (!isValidEmail(emailNormalized)) return json({ error: "email must be valid" }, 400);
+    const decision = body.decision ?? "waive_interview";
+    if (decision !== "waive_interview" && decision !== "require_interview") {
+      return json({ error: "decision must be waive_interview or require_interview" }, 400);
+    }
+    const note = typeof body.note === "string" ? body.note.trim() : "";
+    if (note.length > 2e3) return json({ error: "note is too long" }, 400);
+    const expiresAt = body.expiresAt === void 0 || body.expiresAt === null ? void 0 : Number(body.expiresAt);
+    if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= Date.now())) {
+      return json({ error: "expiresAt must be a future epoch timestamp" }, 400);
+    }
+    const sourceGrantId = crypto.randomUUID();
+    const id = `admission:local:${ctx.chapter.id}:${sourceGrantId}`;
+    const createdAt = Date.now();
+    const actor = auth.user.email ?? auth.user.userId;
+    await auth.db.transact([{ t: "update", ns: "admissionGrants", id, attrs: {
+      id,
+      sourceGrantId,
+      sourceScope: "local",
+      sourceId: ctx.chapter.id,
+      targetId: ctx.chapter.id,
+      email,
+      emailNormalized,
+      decision,
+      ...note ? { note } : {},
+      ...expiresAt !== void 0 ? { expiresAt } : {},
+      active: true,
+      createdAt,
+      createdBy: actor,
+      updatedAt: createdAt,
+      updatedBy: actor
+    } }], { mutationId: `admission-local-create:${sourceGrantId}` });
+    return json({ grant: { id, sourceGrantId, sourceScope: "local", email, decision, active: true, createdAt, ...note ? { note } : {}, ...expiresAt ? { expiresAt } : {} } }, 201);
+  }
+  const prefix = "/api/admin/admission-grants/";
+  let revokeId = "";
+  if (url.pathname.startsWith(prefix)) {
+    try {
+      revokeId = decodeURIComponent(url.pathname.slice(prefix.length));
+    } catch {
+      revokeId = "";
     }
-  };
-  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
-  for (const u of usersRes.$users ?? []) {
-    if (u.deleted === true) continue;
-    await run({ email: u.email, firstName: str(u.name) });
   }
-  return { synced, errors };
-}
+  if (/^admission:local:[a-z0-9-]+:[0-9a-f-]+$/.test(revokeId) && req.method === "DELETE") {
+    const auth = await gate(req, env, ctx);
+    if (auth instanceof Response) return auth;
+    const id = revokeId;
+    const found = await auth.db.query({ admissionGrants: { $: { where: { id }, limit: 1 } } });
+    const row = Array.isArray(found.admissionGrants) ? found.admissionGrants[0] : void 0;
+    if (!row || row.targetId !== ctx.chapter.id || row.sourceScope !== "local") return json({ error: "not found" }, 404);
+    if (row.active !== true) return json({ ok: true, replayed: true });
+    const revokedAt = Date.now();
+    const actor = auth.user.email ?? auth.user.userId;
+    await auth.db.transact([{ t: "update", ns: "admissionGrants", id, attrs: {
+      active: false,
+      revokedAt,
+      revokedBy: actor,
+      updatedAt: revokedAt,
+      updatedBy: actor
+    } }], { mutationId: `admission-local-revoke:${id}` });
+    return json({ ok: true, replayed: false });
+  }
+  return null;
+};
 
 // src/worker-routes-schedule.ts
 import { computeBookableSlots, initCalendar } from "@odla-ai/calendar";
@@ -1948,8 +3130,8 @@ function makeCalendar(env) {
 }
 async function firstRow(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows2 = res[ns];
-  return Array.isArray(rows2) ? rows2[0] : void 0;
+  const rows4 = res[ns];
+  return Array.isArray(rows4) ? rows4[0] : void 0;
 }
 async function computeSlots(cal, cfg) {
   const { from, to } = slotWindow(Date.now(), cfg.windowDays);
@@ -2086,8 +3268,26 @@ function findApplicationRef(obj) {
   const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
   return { ...applicationId ? { applicationId } : {}, ...customerId ? { customerId } : {} };
 }
+function findGiftRef(obj) {
+  const metaOf = (value) => value && typeof value === "object" ? value.metadata ?? {} : {};
+  const pick = (metadata) => typeof metadata.giftIntentId === "string" ? metadata.giftIntentId : void 0;
+  const parent = obj.parent;
+  const subscription = obj.subscription_details ?? parent?.subscription_details;
+  const giftIntentId = pick(metaOf(obj)) ?? pick(metaOf(subscription));
+  const subscriptionId = typeof obj.subscription === "string" ? obj.subscription : typeof subscription?.subscription === "string" ? String(subscription.subscription) : void 0;
+  return { ...giftIntentId ? { giftIntentId } : {}, providerObjectId: subscriptionId ?? String(obj.id ?? "") };
+}
 function normalizeWebhookEvent(event) {
   const obj = event.data?.object ?? {};
+  const gift = findGiftRef(obj);
+  if (gift.giftIntentId) {
+    if (event.type === "payment_intent.succeeded" || event.type === "invoice.paid" && obj.billing_reason === "subscription_create") {
+      return { kind: "gift_paid", giftIntentId: gift.giftIntentId, providerObjectId: gift.providerObjectId };
+    }
+    if (event.type === "charge.refunded") return { kind: "gift_revoked", giftIntentId: gift.giftIntentId, reason: "refunded" };
+    if (event.type === "customer.subscription.deleted") return { kind: "gift_revoked", giftIntentId: gift.giftIntentId, reason: "canceled" };
+    return { kind: "ignored", type: event.type };
+  }
   const ref = findApplicationRef(obj);
   switch (event.type) {
     case "invoice.paid": {
@@ -2188,9 +3388,9 @@ function createStripeProvider(config) {
         `sub:${input.applicationId}`
       );
       if (!sub.ok) fail("subscription create", sub);
-      const clientSecret = clientSecretOf(sub.body);
-      if (!clientSecret) fail("subscription confirmation-secret missing", sub);
-      return { customerId, subscriptionId: String(sub.body.id), clientSecret };
+      const clientSecret2 = clientSecretOf(sub.body);
+      if (!clientSecret2) fail("subscription confirmation-secret missing", sub);
+      return { customerId, subscriptionId: String(sub.body.id), clientSecret: clientSecret2 };
     },
     async ingestWebhook(rawBody, sigHeader) {
       if (!webhookSecret || !await verifyStripeSignature2(rawBody, sigHeader, webhookSecret)) {
@@ -2203,8 +3403,8 @@ function createStripeProvider(config) {
       const sk = requireSecret(secretKey);
       const charges = await stripeCall(sk, "GET", "/v1/charges", { customer: input.customerId, limit: 100 });
       if (!charges.ok) fail("charges list", charges);
-      const rows2 = charges.body.data ?? [];
-      const paid = rows2.filter((c) => c.status === "succeeded" && c.refunded !== true);
+      const rows4 = charges.body.data ?? [];
+      const paid = rows4.filter((c) => c.status === "succeeded" && c.refunded !== true);
       const charge = paid[paid.length - 1];
       if (!charge) {
         const err = new Error("no paid charge to refund");
@@ -2220,12 +3420,337 @@ function createStripeProvider(config) {
   };
 }
 
+// src/gift-codes.ts
+var GIFT_CODE_VERSION = 1;
+var GIFT_CODE_BYTES = 32;
+var base64url = (bytes) => {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+};
+function createGiftCode() {
+  const bytes = new Uint8Array(GIFT_CODE_BYTES);
+  crypto.getRandomValues(bytes);
+  return `gift${GIFT_CODE_VERSION}_${base64url(bytes)}`;
+}
+async function hashGiftCode(chapterId, code, version = GIFT_CODE_VERSION) {
+  const bytes = new TextEncoder().encode(`odla-gift:${version}:${chapterId}:${code}`);
+  return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+async function giftRequesterBucket(chapterId, requester) {
+  const bytes = new TextEncoder().encode(`odla-gift-rate:${chapterId}:${requester}`);
+  return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))).slice(0, 32);
+}
+
+// src/gift-store.ts
+var first = (value) => Array.isArray(value) ? value[0] : void 0;
+async function prepareGiftCode(chapterId) {
+  const code = createGiftCode();
+  return { code, codeHash: await hashGiftCode(chapterId, code), codeVersion: GIFT_CODE_VERSION };
+}
+async function issueGiftClaim(db, intent, provider, now) {
+  const existing = first((await db.query({ giftClaims: { $: { where: { intentId: intent.id }, limit: 1 } } })).giftClaims);
+  if (existing) return { claimId: String(existing.id), orderId: String(existing.orderId), duplicate: true };
+  const offer = intent.offerSnapshot;
+  const orderId = `gift-order:${intent.id}`;
+  const claimId = `gift-claim:${intent.id}`;
+  const shared = {
+    chapterId: intent.chapterId,
+    offerId: intent.offerId,
+    ...intent.purchaserApplicationId ? { purchaserApplicationId: intent.purchaserApplicationId } : {},
+    ...intent.purchaserUserId ? { purchaserUserId: intent.purchaserUserId } : {},
+    purchaserEmailNormalized: intent.purchaserEmailNormalized
+  };
+  const ops = [
+    { t: "update", ns: "giftOrders", id: orderId, attrs: {
+      id: orderId,
+      intentId: intent.id,
+      ...shared,
+      environment: intent.environment,
+      offerSnapshot: offer,
+      purchaserType: intent.purchaserType,
+      providerEventId: provider.eventId,
+      providerObjectId: provider.objectId,
+      amountCents: offer.priceCents,
+      currency: offer.currency,
+      billingMode: offer.billingMode,
+      createdAt: now
+    } },
+    { t: "update", ns: "giftClaims", id: claimId, attrs: {
+      id: claimId,
+      orderId,
+      intentId: intent.id,
+      ...shared,
+      target: offer.target,
+      codeHash: intent.codeHash,
+      codeVersion: intent.codeVersion,
+      rotationCount: 0,
+      codeIssuedAt: intent.codeIssuedAt,
+      codeExpiresAt: now + offer.redemptionLifetimeHours * 36e5,
+      attemptCount: 0,
+      attemptWindowStartedAt: now,
+      status: "pending",
+      createdAt: now
+    } },
+    { t: "update", ns: "giftPurchaseIntents", id: intent.id, attrs: { status: "paid", paidAt: now, claimId, updatedAt: now } }
+  ];
+  if (intent.purchaserApplicationId) ops.push({
+    t: "update",
+    ns: "applications",
+    id: intent.purchaserApplicationId,
+    attrs: { giftPaidAt: now, giftClaimId: claimId }
+  });
+  try {
+    const result = await db.transact(ops, {
+      mutationId: `gift-paid:${provider.eventId}`,
+      guards: [{ ns: "giftPurchaseIntents", id: intent.id, exists: true, equals: { status: "checkout_ready" } }]
+    });
+    return { claimId, orderId, duplicate: result.duplicate };
+  } catch {
+    const raced = first((await db.query({ giftClaims: { $: { where: { intentId: intent.id }, limit: 1 } } })).giftClaims);
+    if (raced) return { claimId: String(raced.id), orderId: String(raced.orderId), duplicate: true };
+    throw new Error("gift issuance conflict");
+  }
+}
+function buyerGiftClaims(rows4, now) {
+  return rows4.map((row) => {
+    const stored = String(row.status ?? "pending");
+    const status = stored === "pending" && Number(row.codeExpiresAt) <= now ? "expired" : stored;
+    return {
+      id: String(row.id),
+      offerId: String(row.offerId),
+      status,
+      createdAt: Number(row.createdAt),
+      codeExpiresAt: Number(row.codeExpiresAt),
+      ...typeof row.redeemedAt === "number" ? { redeemedAt: row.redeemedAt } : {},
+      ...typeof row.revokedAt === "number" ? { revokedAt: row.revokedAt } : {}
+    };
+  });
+}
+async function rotateGiftClaim(db, claim, now) {
+  if (claim.status !== "pending" || Number(claim.codeExpiresAt) <= now) return null;
+  const prepared = await prepareGiftCode(String(claim.chapterId));
+  const currentRotation = Number(claim.rotationCount ?? 0);
+  try {
+    const write = await db.transact([{ t: "update", ns: "giftClaims", id: String(claim.id), attrs: {
+      codeHash: prepared.codeHash,
+      codeVersion: prepared.codeVersion,
+      rotationCount: currentRotation + 1,
+      codeIssuedAt: now,
+      rotatedAt: now,
+      attemptCount: 0,
+      attemptWindowStartedAt: now
+    } }], {
+      mutationId: `gift-rotate:${String(claim.id)}:${currentRotation + 1}`,
+      guards: [{ ns: "giftClaims", id: String(claim.id), exists: true, equals: { status: "pending", rotationCount: currentRotation } }]
+    });
+    return write.duplicate ? null : { code: prepared.code };
+  } catch {
+    return null;
+  }
+}
+async function redeemGiftClaim(db, claim, beneficiary, now) {
+  if (claim.status !== "pending" || Number(claim.codeExpiresAt) <= now) return null;
+  const chapterId = String(claim.chapterId);
+  const emailNormalized = normalizeAdmissionEmail(beneficiary.email);
+  const target = claim.target;
+  const ops = [];
+  let result;
+  if (target.type === "tier") {
+    const apps = (await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications;
+    const existing = apps?.filter((row) => row.groupId === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
+    const id = existing ? String(existing.id) : `gift-application:${String(claim.id)}`;
+    const status = existing && existing.status !== "submitted" ? String(existing.status) : "paid_pending_vetting";
+    ops.push({ t: "update", ns: "applications", id, attrs: {
+      id,
+      groupId: chapterId,
+      email: beneficiary.email,
+      emailNormalized,
+      tierId: target.tierId,
+      status,
+      giftClaimId: String(claim.id),
+      giftOrderId: String(claim.orderId),
+      clerkUserId: beneficiary.userId,
+      ...existing ? {} : { createdAt: now }
+    } });
+    result = { kind: "application", id };
+  } else {
+    const id = `gift-entitlement:${String(claim.id)}`;
+    ops.push({ t: "update", ns: "giftEntitlements", id, attrs: {
+      id,
+      claimId: String(claim.id),
+      orderId: String(claim.orderId),
+      chapterId,
+      entitlementKey: target.entitlementKey,
+      beneficiaryEmailNormalized: emailNormalized,
+      beneficiaryUserId: beneficiary.userId,
+      active: true,
+      createdAt: now
+    } });
+    result = { kind: "entitlement", id };
+  }
+  ops.unshift({ t: "update", ns: "giftClaims", id: String(claim.id), attrs: {
+    status: "redeemed",
+    redeemedAt: now,
+    beneficiaryEmailNormalized: emailNormalized,
+    beneficiaryUserId: beneficiary.userId,
+    ...result.kind === "application" ? { applicationId: result.id } : { entitlementId: result.id },
+    attemptCount: Number(claim.attemptCount ?? 0) + 1
+  } });
+  try {
+    await db.transact(ops, {
+      mutationId: `gift-redeem:${String(claim.id)}:${beneficiary.userId}`,
+      guards: [{ ns: "giftClaims", id: String(claim.id), exists: true, equals: {
+        status: "pending",
+        codeVersion: Number(claim.codeVersion),
+        codeHash: String(claim.codeHash)
+      } }]
+    });
+    return result;
+  } catch {
+    return null;
+  }
+}
+async function revokeGiftClaim(db, claim, reason, now) {
+  if (claim.status === "revoked") return false;
+  const ops = [{ t: "update", ns: "giftClaims", id: String(claim.id), attrs: {
+    status: "revoked",
+    revokedAt: now,
+    revokedReason: reason
+  } }];
+  if (claim.entitlementId) ops.push({ t: "update", ns: "giftEntitlements", id: String(claim.entitlementId), attrs: { active: false, revokedAt: now } });
+  if (claim.applicationId) ops.push({ t: "update", ns: "applications", id: String(claim.applicationId), attrs: {
+    giftRevokedAt: now,
+    ...reason === "refunded" ? { status: "refunded" } : { canceled: true }
+  } });
+  try {
+    await db.transact(ops, {
+      mutationId: `gift-revoke:${String(claim.id)}:${reason}`,
+      guards: [{ ns: "giftClaims", id: String(claim.id), exists: true, equals: { status: String(claim.status) } }]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/gift-checkout.ts
+var clientSecret = (value) => {
+  const direct = value.client_secret;
+  if (typeof direct === "string" && direct) return direct;
+  const invoice = value.latest_invoice;
+  const confirmation = invoice?.confirmation_secret;
+  const intent = invoice?.payment_intent;
+  const nested = confirmation?.client_secret ?? intent?.client_secret;
+  return typeof nested === "string" && nested ? nested : null;
+};
+async function startGiftProviderCheckout(secretKey, intent, email, existingCustomerId) {
+  const offer = intent.offerSnapshot;
+  const metadata = {
+    giftIntentId: intent.id,
+    chapterId: intent.chapterId,
+    environment: intent.environment,
+    offerId: intent.offerId
+  };
+  let customerId = existingCustomerId;
+  if (!customerId) {
+    const customer = await stripeCall(secretKey, "POST", "/v1/customers", { email, metadata }, `gift-customer:${intent.id}`);
+    if (!customer.ok) throw new Error(`gift customer create failed (${customer.status})`);
+    customerId = String(customer.body.id);
+  }
+  if (offer.billingMode === "subscription") {
+    const created2 = await stripeCall(secretKey, "POST", "/v1/subscriptions", {
+      customer: customerId,
+      "items[0][price]": offer.stripePriceId,
+      payment_behavior: "default_incomplete",
+      "payment_settings[save_default_payment_method]": "on_subscription",
+      "payment_settings[payment_method_types][0]": "card",
+      "expand[0]": "latest_invoice.confirmation_secret",
+      metadata
+    }, `gift-subscription:${intent.id}`);
+    const secret2 = created2.ok ? clientSecret(created2.body) : null;
+    if (!created2.ok || !secret2) throw new Error(`gift subscription create failed (${created2.status})`);
+    return { clientSecret: secret2, providerObjectId: String(created2.body.id), customerId };
+  }
+  const price = await stripeCall(secretKey, "GET", `/v1/prices/${encodeURIComponent(offer.stripePriceId)}`);
+  if (!price.ok || price.body.active === false || price.body.unit_amount !== offer.priceCents || price.body.currency !== offer.currency) {
+    throw new Error("gift price does not match the signed offer");
+  }
+  const created = await stripeCall(secretKey, "POST", "/v1/payment_intents", {
+    customer: customerId,
+    amount: offer.priceCents,
+    currency: offer.currency,
+    "automatic_payment_methods[enabled]": true,
+    metadata
+  }, `gift-payment:${intent.id}`);
+  const secret = created.ok ? clientSecret(created.body) : null;
+  if (!created.ok || !secret) throw new Error(`gift payment create failed (${created.status})`);
+  return { clientSecret: secret, providerObjectId: String(created.body.id), customerId };
+}
+
+// src/gift-intents.ts
+var first2 = (value) => Array.isArray(value) ? value[0] : void 0;
+async function startGiftIntent(db, input) {
+  let stored = first2((await db.query({ giftPurchaseIntents: { $: { where: { id: input.id }, limit: 1 } } })).giftPurchaseIntents);
+  let giftCode;
+  if (!stored) {
+    const prepared = await prepareGiftCode(input.chapterId);
+    const attrs = {
+      id: input.id,
+      chapterId: input.chapterId,
+      environment: input.environment,
+      purchaserType: input.purchaserType,
+      purchaserEmailNormalized: input.purchaserEmailNormalized,
+      ...input.purchaserApplicationId ? { purchaserApplicationId: input.purchaserApplicationId } : {},
+      ...input.purchaserUserId ? { purchaserUserId: input.purchaserUserId } : {},
+      offerId: input.offer.id,
+      offerSnapshot: input.offer,
+      status: "created",
+      codeHash: prepared.codeHash,
+      codeVersion: prepared.codeVersion,
+      codeIssuedAt: input.now,
+      createdAt: input.now,
+      updatedAt: input.now
+    };
+    const write = await db.transact([{ t: "update", ns: "giftPurchaseIntents", id: input.id, attrs }], {
+      mutationId: `gift-intent:${input.id}`
+    });
+    stored = write.duplicate ? first2((await db.query({ giftPurchaseIntents: { $: { where: { id: input.id }, limit: 1 } } })).giftPurchaseIntents) : attrs;
+    if (!write.duplicate) giftCode = prepared.code;
+  }
+  if (!stored || stored.chapterId !== input.chapterId || stored.environment !== input.environment || stored.offerId !== input.offer.id || stored.purchaserEmailNormalized !== input.purchaserEmailNormalized) {
+    throw new Error("gift purchase intent does not match this checkout");
+  }
+  if (stored.status === "paid") throw new Error("gift purchase is already paid");
+  const checkout = await startGiftProviderCheckout(
+    input.stripeSecret,
+    stored,
+    input.purchaserEmail,
+    typeof stored.providerCustomerId === "string" ? stored.providerCustomerId : input.existingCustomerId
+  );
+  await db.transact([{ t: "update", ns: "giftPurchaseIntents", id: input.id, attrs: {
+    status: "checkout_ready",
+    providerObjectId: checkout.providerObjectId,
+    ...checkout.customerId ? { providerCustomerId: checkout.customerId } : {},
+    checkoutStartedAt: input.now,
+    updatedAt: input.now
+  } }], { mutationId: `gift-checkout-ready:${input.id}:${checkout.providerObjectId}` });
+  return {
+    gift: true,
+    intentId: input.id,
+    clientSecret: checkout.clientSecret,
+    publishableKey: input.publishableKey,
+    lineItems: { standardCents: input.offer.priceCents, discountCents: 0, dueTodayCents: input.offer.priceCents },
+    ...giftCode ? { giftCode } : {}
+  };
+}
+
 // src/worker-routes-payments.ts
 var codeOf = (err) => err && typeof err === "object" && typeof err.code === "string" ? err.code : "unknown";
 async function firstRow2(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows2 = res[ns];
-  return Array.isArray(rows2) ? rows2[0] : void 0;
+  const rows4 = res[ns];
+  return Array.isArray(rows4) ? rows4[0] : void 0;
 }
 function lineItems(group) {
   const standard = Number(group.standardPriceCents ?? 0);
@@ -2310,6 +3835,36 @@ async function startSubscription(req, env, ctx) {
   const group = await firstRow2(db, "groups", { where: { id: String(app.groupId ?? ctx.chapter.id) }, limit: 1 });
   const secretKey = await getVaultSecret(db, "stripe_secret_key");
   if (!group || !secretKey) return json({ error: "payments not configured" }, 503);
+  if (typeof app.giftOfferId === "string") {
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control2?.document.giftOffers, app.giftOfferId, Date.now());
+    if (!offer || typeof group.stripePublishableKey !== "string" || !group.stripePublishableKey) {
+      return json({ error: "gift offer is unavailable" }, 409);
+    }
+    try {
+      const started = await startGiftIntent(db, {
+        id: typeof app.giftIntentId === "string" ? app.giftIntentId : `gift-intent:${applicationId}`,
+        chapterId: ctx.chapter.id,
+        environment: env.ODLA_ENV,
+        offer,
+        purchaserType: "application",
+        purchaserEmail: String(app.email ?? ""),
+        purchaserEmailNormalized: normalizeAdmissionEmail(String(app.email ?? "")),
+        purchaserApplicationId: applicationId,
+        stripeSecret: secretKey,
+        publishableKey: group.stripePublishableKey,
+        now: Date.now()
+      });
+      await db.transact([{ t: "update", ns: "applications", id: applicationId, attrs: {
+        giftIntentId: started.intentId,
+        giftCheckoutStartedAt: Date.now(),
+        refundPolicyAckAt: Date.now()
+      } }]);
+      return json(started);
+    } catch (error) {
+      return json({ error: error instanceof Error ? error.message : "gift checkout failed" }, 502);
+    }
+  }
   const tier = findTier(
     await loadTiers(db, group),
     typeof app.tierId === "string" ? app.tierId : null
@@ -2351,17 +3906,54 @@ async function ingestWebhook(req, env, ctx) {
   if (!ingest.ok) return json({ error: "invalid signature" }, 400);
   const { eventId, event } = ingest;
   if (event.kind === "ignored") return json({ ok: true, ignored: event.type });
+  if (event.kind === "gift_paid" || event.kind === "gift_revoked") {
+    const intent = await firstRow2(db, "giftPurchaseIntents", { where: { id: event.giftIntentId }, limit: 1 });
+    if (!intent || intent.chapterId !== ctx.chapter.id || intent.environment !== env.ODLA_ENV) {
+      return json({ ok: true, matched: false });
+    }
+    if (event.kind === "gift_paid") {
+      if (intent.providerObjectId !== event.providerObjectId) return json({ ok: true, matched: false });
+      if (intent.status === "refunded" || intent.status === "canceled") return json({ ok: true, matched: false });
+      try {
+        const issued = await issueGiftClaim(db, intent, {
+          eventId,
+          objectId: event.providerObjectId
+        }, Date.now());
+        return json({ ok: true, matched: true, claimId: issued.claimId });
+      } catch {
+        return json({ error: "gift issuance failed" }, 503);
+      }
+    }
+    await db.transact([{ t: "update", ns: "giftPurchaseIntents", id: event.giftIntentId, attrs: {
+      status: event.reason,
+      updatedAt: Date.now()
+    } }], { mutationId: `gift-revoked-intent:${eventId}` });
+    const claim = await firstRow2(db, "giftClaims", { where: { intentId: event.giftIntentId }, limit: 1 });
+    if (claim) await revokeGiftClaim(db, claim, event.reason, Date.now());
+    return json({ ok: true, matched: Boolean(claim) });
+  }
   const app = await findApplication(db, event);
   if (!app) return json({ ok: true, matched: false });
   const patch = webhookPatch(event, String(app.status ?? ""));
+  let next = app;
   if (Object.keys(patch).length) {
     await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: patch }], { mutationId: webhookMutationId(eventId) });
-    const next = { ...app, ...patch };
+    next = { ...app, ...patch };
     await syncApplicationToCrm(crmDeps(db, ctx), { app: next, stage: String(next.status ?? "") }).catch(() => void 0);
   }
   if (event.kind === "first_payment") {
     await notifyPaymentConfirmed(db, env, eventId, app);
     if (ctx.chapter.sends.adminNotification === "payment") await notifyAdminOfPayment(db, env, eventId, app);
+    if (typeof next.interviewWaivedAt === "number") {
+      await approveApplication({
+        db,
+        env,
+        ctx,
+        app: next,
+        origin: new URL(req.url).origin,
+        reason: "interview_waiver"
+      });
+    }
   }
   return json({ ok: true });
 }
@@ -2372,6 +3964,144 @@ var handlePayments = async (req, url, env, ctx) => {
   return null;
 };
 
+// src/worker-routes-gifts.ts
+var first3 = (value) => Array.isArray(value) ? value[0] : void 0;
+var rows2 = (value) => Array.isArray(value) ? value : [];
+var invalid = () => json({ error: "gift code is invalid or unavailable" }, 400);
+var userFor = async (req, env, ctx) => {
+  const user = await ctx.verifyUser(req, env);
+  return user?.email ? user : null;
+};
+var loadClaim = async (db, id) => first3((await db.query({ giftClaims: { $: { where: { id }, limit: 1 } } })).giftClaims);
+async function consumeRateLimit(db, chapterId, requester, now) {
+  const bucket = await giftRequesterBucket(chapterId, requester);
+  const id = `gift-rate:${chapterId}:${bucket}`;
+  const current = first3((await db.query({ giftRedemptionAttempts: { $: { where: { id }, limit: 1 } } })).giftRedemptionAttempts);
+  const within = Boolean(current && now - Number(current.windowStartedAt) < 15 * 6e4);
+  const attemptCount = within ? Number(current?.attemptCount ?? 0) + 1 : 1;
+  if (attemptCount > 10) return false;
+  await db.transact([{ t: "update", ns: "giftRedemptionAttempts", id, attrs: {
+    id,
+    chapterId,
+    bucket,
+    attemptCount,
+    windowStartedAt: within ? Number(current?.windowStartedAt) : now,
+    updatedAt: now
+  } }]);
+  return true;
+}
+var handleGifts = async (req, url, env, ctx) => {
+  if (ctx.chapter.mode !== "chapter" || !url.pathname.startsWith("/api/gifts")) return null;
+  const db = ctx.makeDb(env);
+  if (req.method === "GET" && url.pathname === "/api/gifts") {
+    const user = await userFor(req, env, ctx);
+    if (!user) return json({ error: "unauthorized" }, 401);
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const found = await db.query({ giftClaims: { $: { where: {
+      purchaserEmailNormalized: normalizeAdmissionEmail(user.email),
+      chapterId: ctx.chapter.id
+    }, limit: 200 } } });
+    const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
+    return json({
+      offers: publicGiftOffers(control2?.document.giftOffers, Date.now()),
+      claims: buyerGiftClaims(rows2(found.giftClaims).sort((a, b) => Number(b.createdAt) - Number(a.createdAt)), Date.now()),
+      refundPolicyText: typeof group?.refundPolicyText === "string" ? group.refundPolicyText : ""
+    });
+  }
+  if (req.method === "POST" && url.pathname === "/api/gifts/checkout") {
+    const user = await userFor(req, env, ctx);
+    if (!user) return json({ error: "unauthorized" }, 401);
+    let body;
+    try {
+      body = JSON.parse(await req.text());
+    } catch {
+      return json({ error: "invalid JSON body" }, 400);
+    }
+    const purchaseId = typeof body.purchaseId === "string" ? body.purchaseId : "";
+    if (!/^[A-Za-z0-9_-]{16,128}$/.test(purchaseId)) return json({ error: "purchaseId is invalid" }, 400);
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control2?.document.giftOffers, typeof body.offerId === "string" ? body.offerId : "", Date.now());
+    if (!offer) return json({ error: "gift offer is unavailable" }, 409);
+    const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
+    const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
+    if (!group || !stripeSecret || typeof group.stripePublishableKey !== "string") return json({ error: "payments not configured" }, 503);
+    const emailNormalized = normalizeAdmissionEmail(user.email);
+    const applications = rows2((await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications);
+    const app = applications.sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
+    try {
+      return json(await startGiftIntent(db, {
+        id: `gift-intent:${ctx.chapter.id}:${purchaseId}`,
+        chapterId: ctx.chapter.id,
+        environment: env.ODLA_ENV,
+        offer,
+        purchaserType: "member",
+        purchaserEmail: user.email,
+        purchaserEmailNormalized: emailNormalized,
+        purchaserUserId: user.userId,
+        ...typeof app?.stripeCustomerId === "string" ? { existingCustomerId: app.stripeCustomerId } : {},
+        stripeSecret,
+        publishableKey: group.stripePublishableKey,
+        now: Date.now()
+      }));
+    } catch (error) {
+      return json({ error: error instanceof Error ? error.message : "gift checkout failed" }, 502);
+    }
+  }
+  const rotateMatch = url.pathname.match(/^\/api\/gifts\/([^/]+)\/rotate$/);
+  if (req.method === "POST" && rotateMatch) {
+    let claimId = "";
+    try {
+      claimId = decodeURIComponent(rotateMatch[1]);
+    } catch {
+      return invalid();
+    }
+    if (!claimId.startsWith("gift-claim:")) return invalid();
+    const claim = await loadClaim(db, claimId);
+    if (!claim || claim.chapterId !== ctx.chapter.id || Number(claim.rotationCount ?? 0) >= 10) return invalid();
+    const user = await userFor(req, env, ctx);
+    let applicationId = "";
+    if (!user) {
+      try {
+        applicationId = String(JSON.parse(await req.text()).applicationId ?? "");
+      } catch {
+        return invalid();
+      }
+    }
+    const owns = user ? claim.purchaserEmailNormalized === normalizeAdmissionEmail(user.email) : claim.purchaserApplicationId === applicationId;
+    if (!owns) return invalid();
+    const rotated = await rotateGiftClaim(db, claim, Date.now());
+    return rotated ? json(rotated) : invalid();
+  }
+  if (req.method === "POST" && url.pathname === "/api/gifts/redeem") {
+    const user = await userFor(req, env, ctx);
+    if (!user) return json({ error: "unauthorized" }, 401);
+    const now = Date.now();
+    if (!await consumeRateLimit(db, ctx.chapter.id, `${user.userId}:${req.headers.get("cf-connecting-ip") ?? "no-ip"}`, now)) {
+      return json({ error: "too many attempts" }, 429);
+    }
+    let code = "";
+    try {
+      code = String(JSON.parse(await req.text()).code ?? "").trim();
+    } catch {
+      return invalid();
+    }
+    if (!/^gift1_[A-Za-z0-9_-]{43}$/.test(code)) return invalid();
+    const codeHash = await hashGiftCode(ctx.chapter.id, code);
+    const claim = first3((await db.query({ giftClaims: { $: { where: { codeHash }, limit: 1 } } })).giftClaims);
+    if (!claim || claim.chapterId !== ctx.chapter.id) return invalid();
+    if (claim.status !== "pending" || Number(claim.codeExpiresAt) <= now) {
+      await db.transact([{ t: "update", ns: "giftClaims", id: String(claim.id), attrs: {
+        attemptCount: Number(claim.attemptCount ?? 0) + 1,
+        ...claim.status === "pending" ? { status: "expired" } : {}
+      } }]).catch(() => void 0);
+      return invalid();
+    }
+    const redeemed = await redeemGiftClaim(db, claim, { email: user.email, userId: user.userId }, now);
+    return redeemed ? json({ ok: true, ...redeemed }) : invalid();
+  }
+  return null;
+};
+
 // src/worker-routes-admin.ts
 import { initCalendar as initCalendar2 } from "@odla-ai/calendar";
 
@@ -2443,8 +4173,8 @@ async function upcomingEvents(env) {
   const res = await cal.availability.upcoming();
   return res.events.map((e) => ({ eventId: e.eventId, status: e.status, startAt: e.startAt, endAt: e.endAt }));
 }
-function toReconcile(rows2) {
-  return rows2.map((m) => ({
+function toReconcile(rows4) {
+  return rows4.map((m) => ({
     id: String(m.id),
     applicationId: String(m.applicationId),
     googleEventId: typeof m.googleEventId === "string" ? m.googleEventId : null,
@@ -2466,12 +4196,12 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   const query = await db.query({
     meetings: { $: { where: all ? {} : { status: "scheduled" }, order: { startAt: "asc" }, limit: 500 } }
   });
-  let rows2 = Array.isArray(query.meetings) ? query.meetings : [];
-  if (Number.isFinite(from)) rows2 = rows2.filter((m) => Number(m.startAt ?? 0) >= from);
-  if (Number.isFinite(to)) rows2 = rows2.filter((m) => Number(m.startAt ?? 0) <= to);
+  let rows4 = Array.isArray(query.meetings) ? query.meetings : [];
+  if (Number.isFinite(from)) rows4 = rows4.filter((m) => Number(m.startAt ?? 0) >= from);
+  if (Number.isFinite(to)) rows4 = rows4.filter((m) => Number(m.startAt ?? 0) <= to);
   let decisions = [];
   try {
-    decisions = reconcileMeetings(toReconcile(rows2), await upcomingEvents(env), Date.now());
+    decisions = reconcileMeetings(toReconcile(rows4), await upcomingEvents(env), Date.now());
   } catch {
   }
   const patched = /* @__PURE__ */ new Map();
@@ -2498,69 +4228,10 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   };
   const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
   const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  const meetings = rows2.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
+  const meetings = rows4.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
   return json({ meetings, adopted: decisions.length, timezone });
 };
 
-// src/clerk-roles.ts
-var CLERK_API = "https://api.clerk.com";
-var DEFAULT_ROLE = "provisional";
-var PAGE = 100;
-function toRecord(u) {
-  if (typeof u.id !== "string") return null;
-  const pm = u.public_metadata ?? {};
-  const privateMetadata = u.private_metadata ?? {};
-  const rawProfile = privateMetadata.profile;
-  const profile = rawProfile && typeof rawProfile === "object" && !Array.isArray(rawProfile) ? rawProfile : {};
-  const applicationId = typeof privateMetadata.applicationId === "string" ? privateMetadata.applicationId : void 0;
-  const role = typeof pm.role === "string" && pm.role ? pm.role : DEFAULT_ROLE;
-  const email = u.email_addresses?.[0]?.email_address;
-  return {
-    id: u.id,
-    email: typeof email === "string" ? email : void 0,
-    role,
-    publicMetadata: pm,
-    privateMetadata,
-    profile,
-    ...applicationId ? { applicationId } : {}
-  };
-}
-async function clerkGet(path, secretKey, fetchImpl) {
-  const res = await fetchImpl(`${CLERK_API}${path}`, { headers: { authorization: `Bearer ${secretKey}` } });
-  if (!res.ok) throw new Error(`clerk GET ${path} \u2192 ${res.status}`);
-  return res.json();
-}
-async function clerkGetUserByEmail(secretKey, email, fetchImpl = fetch) {
-  const data = await clerkGet(`/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, secretKey, fetchImpl).catch(() => null);
-  const user = Array.isArray(data) ? data[0] : void 0;
-  return user ? toRecord(user) : null;
-}
-async function clerkGetUser(secretKey, id, fetchImpl = fetch) {
-  const data = await clerkGet(`/v1/users/${encodeURIComponent(id)}`, secretKey, fetchImpl).catch(() => null);
-  return data ? toRecord(data) : null;
-}
-async function clerkListUsers(secretKey, fetchImpl = fetch) {
-  const out = [];
-  for (let offset = 0; ; offset += PAGE) {
-    const data = await clerkGet(`/v1/users?limit=${PAGE}&offset=${offset}`, secretKey, fetchImpl);
-    const page = Array.isArray(data) ? data : [];
-    for (const u of page) {
-      const record = toRecord(u);
-      if (record) out.push(record);
-    }
-    if (page.length < PAGE) break;
-  }
-  return out;
-}
-async function clerkSetRole(secretKey, id, role, fetchImpl = fetch) {
-  const res = await fetchImpl(`${CLERK_API}/v1/users/${encodeURIComponent(id)}/metadata`, {
-    method: "PATCH",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify({ public_metadata: { role } })
-  });
-  return res.ok;
-}
-
 // src/worker-routes-admin-people.ts
 async function adminGate(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
@@ -2578,16 +4249,16 @@ var crmDeps2 = (db, ctx) => ({
 });
 var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
-  const gate8 = await adminGate(req, env, ctx);
-  if (gate8 instanceof Response) return gate8;
-  const result = await backfillCrm(crmDeps2(gate8.db, ctx));
+  const gate9 = await adminGate(req, env, ctx);
+  if (gate9 instanceof Response) return gate9;
+  const result = await backfillCrm(crmDeps2(gate9.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people") return null;
-  const gate8 = await adminGate(req, env, ctx);
-  if (gate8 instanceof Response) return gate8;
-  const { db } = gate8;
+  const gate9 = await adminGate(req, env, ctx);
+  if (gate9 instanceof Response) return gate9;
+  const { db } = gate9;
   const sk = await getVaultSecret(db, "clerk_secret_key");
   const [appsRes, usersRes, roleList] = await Promise.all([
     db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 200 } } }),
@@ -2631,16 +4302,16 @@ var handleAdminPeople = async (req, url, env, ctx) => {
       });
     }
   }
-  const rows2 = [...people.values()].sort(
+  const rows4 = [...people.values()].sort(
     (x, y) => (y.application?.createdAt ?? -1) - (x.application?.createdAt ?? -1)
   );
-  return json({ people: rows2 });
+  return json({ people: rows4 });
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
-  const gate8 = await adminGate(req, env, ctx);
-  if (gate8 instanceof Response) return gate8;
-  const { db } = gate8;
+  const gate9 = await adminGate(req, env, ctx);
+  if (gate9 instanceof Response) return gate9;
+  const { db } = gate9;
   const targetId = url.searchParams.get("userId") ?? "";
   if (!targetId.startsWith("user_")) return json({ error: "invalid userId" }, 400);
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -2651,9 +4322,9 @@ var handleAdminPeopleAccess = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleRole = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/people/role") return null;
-  const gate8 = await adminGate(req, env, ctx);
-  if (gate8 instanceof Response) return gate8;
-  const { db, actor } = gate8;
+  const gate9 = await adminGate(req, env, ctx);
+  if (gate9 instanceof Response) return gate9;
+  const { db, actor } = gate9;
   let body;
   try {
     body = await req.json();
@@ -2800,17 +4471,17 @@ function subAnnualCents(sub) {
 }
 
 // src/worker-routes-admin-dashboard.ts
-async function gate(req, env, ctx) {
+async function gate2(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
   if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   return rawDb;
 }
-var rows = (v) => Array.isArray(v) ? v : [];
+var rows3 = (v) => Array.isArray(v) ? v : [];
 var handleAdminDashboard = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/dashboard") return null;
-  const got = await gate(req, env, ctx);
+  const got = await gate2(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const now = Date.now();
@@ -2822,7 +4493,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
     db.query({ crm_record: { $: { where: { type: "person" }, limit: 1e3 } } }),
     db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })
   ]);
-  const apps = rows(appsRes.applications);
+  const apps = rows3(appsRes.applications);
   const applications = {
     total: apps.length,
     last7: apps.filter((a) => a.createdAt >= d7).length,
@@ -2834,7 +4505,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
     pipeline[s] = 0;
     pipelineDelta[s] = 0;
   }
-  for (const r of rows(recsRes.crm_record)) {
+  for (const r of rows3(recsRes.crm_record)) {
     const s = r.stage;
     if (s in pipeline) {
       pipeline[s] = (pipeline[s] ?? 0) + 1;
@@ -2842,7 +4513,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
       if (Number.isFinite(sc) && sc >= d7) pipelineDelta[s] = (pipelineDelta[s] ?? 0) + 1;
     }
   }
-  const meetings = rows(meetingsRes.meetings);
+  const meetings = rows3(meetingsRes.meetings);
   const appById = new Map(apps.map((a) => [a.id, a]));
   const upcoming = meetings.filter((m) => m.startAt >= now - 36e5);
   const calls = { upcoming: upcoming.length, needsAttention: meetings.filter((m) => m.drift && m.drift !== "none").length };
@@ -2867,7 +4538,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
   if (sk) {
     const subsRes = await stripeCall(sk, "GET", "/v1/subscriptions", { limit: 100, status: "all" });
     if (subsRes.ok) {
-      const subs = rows(subsRes.body.data);
+      const subs = rows3(subsRes.body.data);
       const subMs = (s) => (s.created ?? 0) * 1e3;
       membersSeries = dashboardMetricData(subs.map((s) => ({ t: subMs(s), v: 1 })), now);
       revenueSeries = dashboardMetricData(subs.map((s) => ({ t: subMs(s), v: subAnnualCents(s) })), now);
@@ -2887,7 +4558,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
 };
 var handleAdminBilling = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/billing") return null;
-  const got = await gate(req, env, ctx);
+  const got = await gate2(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const sk = await getVaultSecret(db, "stripe_secret_key");
@@ -2899,9 +4570,9 @@ var handleAdminBilling = async (req, url, env, ctx) => {
   ]);
   const testMode = String(groupRes.groups?.[0]?.stripePublishableKey ?? "").startsWith("pk_test");
   if (!subsRes.ok) return json({ error: "billing lookup failed upstream" }, 502);
-  const subById = new Map(rows(subsRes.body.data).map((s) => [s.id, s]));
+  const subById = new Map(rows3(subsRes.body.data).map((s) => [s.id, s]));
   const billingRows = [];
-  for (const a of rows(appsRes.applications)) {
+  for (const a of rows3(appsRes.applications)) {
     if (!a.stripeCustomerId && !a.stripeSubscriptionId) continue;
     const sub = a.stripeSubscriptionId ? subById.get(a.stripeSubscriptionId) : void 0;
     const items = sub?.items?.data ?? [];
@@ -2945,7 +4616,7 @@ var handleAdminBilling = async (req, url, env, ctx) => {
 
 // src/worker-routes-admin-lifecycle.ts
 import { computeBookableSlots as computeBookableSlots2, initCalendar as initCalendar3 } from "@odla-ai/calendar";
-async function gate2(req, env, ctx) {
+async function gate3(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
@@ -2971,7 +4642,7 @@ async function loadGroup(db, id) {
 var handleAdminMeetingReschedule = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/meetings\/([0-9a-f-]+)\/reschedule$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const body = await readJson(req);
@@ -3012,7 +4683,7 @@ var handleAdminMeetingReschedule = async (req, url, env, ctx) => {
 var handleAdminMeetingCancel = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/meetings\/([0-9a-f-]+)\/cancel$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const { meetings } = await db.query({ meetings: { $: { where: { id: m[1] }, limit: 1 } } });
@@ -3035,43 +4706,20 @@ var handleAdminMeetingCancel = async (req, url, env, ctx) => {
 var handleAdminApprove = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)\/approve$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const id = m[1];
   const app = await loadApp(db, id);
   if (!app) return json({ error: "not found" }, 404);
-  if (!canApprove(String(app.status), ctx.chapter.pipeline)) return json({ error: `cannot approve from status "${String(app.status)}"` }, 409);
-  const target = "approved";
-  await db.transact([{ t: "update", ns: "applications", id, attrs: { status: target } }]);
-  await syncApplicationToCrm(crmDeps(db, ctx), { app: { ...app, status: target }, stage: target }).catch(() => void 0);
-  const { promoteTo, send } = ctx.chapter.operations.onApprove;
-  let rolePromoted = false;
-  const sk = await getVaultSecret(db, "clerk_secret_key");
-  if (promoteTo !== false && sk) {
-    let userId = app.clerkUserId || null;
-    if (!userId) {
-      const found = await clerkGetUserByEmail(sk, String(app.email));
-      userId = found?.id ?? null;
-      if (userId) await db.transact([{ t: "update", ns: "applications", id, attrs: { clerkUserId: userId } }]);
-    }
-    if (userId) rolePromoted = await clerkSetRole(sk, userId, promoteTo);
-  }
-  let emailLogged = false;
-  const group = await loadGroup(db, String(app.groupId ?? ctx.chapter.id));
-  if (send !== false && group) {
-    const res = await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      { group: emailGroupFrom(group), template: send, to: String(app.email), vars: { firstName: String(app.firstName ?? ""), membersUrl: `${url.origin}/members/` }, applicationId: id, dedupeKey: `approve:${id}` }
-    );
-    emailLogged = res.sent;
-  }
-  return json({ ok: true, status: target, rolePromoted, emailLogged });
+  const result = await approveApplication({ db, env, ctx, app, origin: url.origin, reason: "manual" });
+  if (!result.ok) return json({ error: result.error }, result.status);
+  return json({ ok: true, status: "approved", rolePromoted: result.rolePromoted, emailLogged: result.emailLogged });
 };
 var handleAdminRefund = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)\/refund$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const app = await loadApp(db, m[1]);
@@ -3103,7 +4751,7 @@ var handleAdminRefund = async (req, url, env, ctx) => {
 var handleAdminApplicationPatch = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)$/);
   if (req.method !== "PATCH" || !m) return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const id = m[1];
@@ -3131,7 +4779,7 @@ var handleAdminApplicationPatch = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-admin-comms.ts
-async function gate3(req, env, ctx) {
+async function gate4(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
@@ -3153,7 +4801,7 @@ var notifyDeps = (db, env) => ({
 });
 var handleAdminGroupEmail = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/group/email" || req.method !== "GET" && req.method !== "PUT") return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const group = await loadGroup2(db, ctx.chapter.id);
@@ -3194,11 +4842,11 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
   for (const key of EMAIL_TEMPLATE_NAMES) {
     const t = templates[key];
     const subject = typeof t?.subject === "string" ? t.subject.trim() : "";
-    const text2 = typeof t?.text === "string" ? t.text : "";
-    if (!subject || !text2.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
+    const text3 = typeof t?.text === "string" ? t.text : "";
+    if (!subject || !text3.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
     if (/[\r\n]/.test(subject) || subject.length > 200) return json({ error: `template "${key}" subject must be a single line under 200 characters` }, 400);
-    if (text2.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
-    clean[key] = { subject, text: text2, enabled: t?.enabled !== false };
+    if (text3.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
+    clean[key] = { subject, text: text3, enabled: t?.enabled !== false };
   }
   const emailish = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   const notificationEmail = str2(body.notificationEmail).trim();
@@ -3215,7 +4863,7 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
 };
 var handleAdminEmailLog = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/email/log") return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const { emailLog } = await got.query({ emailLog: { $: { order: { sentAt: "desc" }, limit: 50 } } });
   const sends = (emailLog ?? []).map((r) => ({
@@ -3232,7 +4880,7 @@ var handleAdminEmailLog = async (req, url, env, ctx) => {
 };
 var handleAdminEmailTest = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/email/test") return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   let body;
@@ -3260,7 +4908,7 @@ var handleAdminEmailTest = async (req, url, env, ctx) => {
 var handleAdminComms = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/people\/([0-9a-fA-F-]+)\/comms$/);
   if (req.method !== "GET" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const appId = m[1];
@@ -3293,7 +4941,7 @@ var handleAdminComms = async (req, url, env, ctx) => {
 
 // src/worker-routes-network.ts
 import { getRecord, typeSummary } from "@odla-ai/crm";
-import { signFederatedRequest as signFederatedRequest2, verifyFederatedRequest as verifyFederatedRequest3 } from "@odla-ai/db";
+import { signFederatedRequest as signFederatedRequest2, verifyFederatedRequest as verifyFederatedRequest5 } from "@odla-ai/db";
 
 // src/worker-network-fetch.ts
 function targetFetcher(env, target) {
@@ -3312,7 +4960,7 @@ function fetchNetworkTarget(env, target, destination, init) {
 // src/worker-network-push.ts
 import { recordDeliveryAttempt } from "@odla-ai/crm";
 import { signFederatedRequest } from "@odla-ai/db";
-async function pushNetworkRecord(db, env, ctx, target, record) {
+async function pushNetworkRecord(db, env, ctx, target, record3) {
   const secret = await getVaultSecret(db, target.secretName);
   const crmDeps3 = {
     crm: ctx.chapter.crm,
@@ -3323,7 +4971,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
   if (!secret) {
     const error = `vault secret "${target.secretName}" is missing`;
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -3333,7 +4981,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
   }
   let payload;
   try {
-    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target, ctx.chapter.id);
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record3, target, ctx.chapter.id);
   } catch (err) {
     return {
       id: target.id,
@@ -3362,7 +5010,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
     if (!res.ok) {
       const error = responseBody.error ?? "follower rejected the record";
       await recordDeliveryAttempt(crmDeps3, {
-        recordId: record.id,
+        recordId: record3.id,
         targetId: target.id,
         status: "failed",
         payloadVersion: 2,
@@ -3377,7 +5025,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
       };
     }
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "delivered",
       payloadVersion: 2,
@@ -3393,7 +5041,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
   } catch (err) {
     const error = err instanceof Error ? err.message : "delivery failed";
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -3404,7 +5052,7 @@ async function pushNetworkRecord(db, env, ctx, target, record) {
 }
 
 // src/worker-routes-network.ts
-async function gate4(req, env, ctx) {
+async function gate5(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -3413,7 +5061,7 @@ async function gate4(req, env, ctx) {
 }
 var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/network/targets") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if ("response" in got) return got.response;
   return json({
     targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields, sharedNotes }) => ({
@@ -3430,7 +5078,7 @@ var handleNetworkSnapshot = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await verifyFederatedRequest3(req, { secret });
+  const verified = await verifyFederatedRequest5(req, { secret });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const types = await Promise.all(
     Object.keys(ctx.chapter.crm.config.types).map((type) => typeSummary({ crm: ctx.chapter.crm, db }, type))
@@ -3489,7 +5137,7 @@ async function snapshotOne(db, env, ctx, target) {
 }
 var handleAdminNetworkRollup = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/network/rollup") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if ("response" in got) return got.response;
   const targets = await Promise.all(
     ctx.chapter.network.targets.map((target) => snapshotOne(got.db, env, ctx, target))
@@ -3516,7 +5164,7 @@ var handleAdminNetworkRollup = async (req, url, env, ctx) => {
 };
 var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/network/push") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if ("response" in got) return got.response;
   let body;
   try {
@@ -3531,22 +5179,22 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (requested.size !== body.targetIds.length) return json({ error: "targetIds must contain unique strings" }, 400);
   const targets = ctx.chapter.network.targets.filter((target) => requested.has(target.id));
   if (targets.length !== requested.size) return json({ error: "one or more targetIds are not configured" }, 400);
-  const record = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
-  if (!record) return json({ error: "record not found" }, 404);
+  const record3 = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
+  if (!record3) return json({ error: "record not found" }, 404);
   const results = await Promise.all(
-    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record))
+    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record3))
   );
   return json({ ok: results.every((result) => result.ok), results });
 };
 
 // src/worker-routes-network-records.ts
 import { listRecords } from "@odla-ai/crm";
-import { signFederatedRequest as signFederatedRequest3, verifyFederatedRequest as verifyFederatedRequest4 } from "@odla-ai/db";
+import { signFederatedRequest as signFederatedRequest3, verifyFederatedRequest as verifyFederatedRequest6 } from "@odla-ai/db";
 var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
 var MAX_PAGE = 50;
 var MAX_OFFSET = 1e4;
 var MAX_SEARCH = 200;
-async function gate5(req, env, ctx) {
+async function gate6(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -3559,18 +5207,18 @@ function integer(value, fallback, min, max) {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
 }
-function projectRecord(record, allowed) {
+function projectRecord(record3, allowed2) {
   const fields = Object.fromEntries(
-    allowed.flatMap((name) => Object.prototype.hasOwnProperty.call(record.fields, name) ? [[name, record.fields[name]]] : [])
+    allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record3.fields, name) ? [[name, record3.fields[name]]] : [])
   );
   return {
-    id: record.id,
-    type: record.type,
-    name: record.name,
-    ...record.stage ? { stage: record.stage } : {},
+    id: record3.id,
+    type: record3.type,
+    name: record3.name,
+    ...record3.stage ? { stage: record3.stage } : {},
     fields,
-    createdAt: record.createdAt,
-    updatedAt: record.updatedAt
+    createdAt: record3.createdAt,
+    updatedAt: record3.updatedAt
   };
 }
 var handleNetworkRecords = async (req, url, env, ctx) => {
@@ -3579,15 +5227,15 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await verifyFederatedRequest4(req, {
+  const verified = await verifyFederatedRequest6(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const reader = readers.find((candidate) => candidate.id === verified.sender);
   const type = url.searchParams.get("type") ?? "";
-  const allowed = reader?.fields[type];
-  if (!IDENTIFIER.test(type) || !allowed) return json({ error: "record type is not shared with this reader" }, 403);
+  const allowed2 = reader?.fields[type];
+  if (!IDENTIFIER.test(type) || !allowed2) return json({ error: "record type is not shared with this reader" }, 403);
   const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
   const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
   const search = (url.searchParams.get("search") ?? "").trim();
@@ -3608,7 +5256,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     version: 1,
     site: { id: ctx.chapter.id, name: ctx.chapter.name },
     type,
-    records: page.records.map((record) => projectRecord(record, allowed)),
+    records: page.records.map((record3) => projectRecord(record3, allowed2)),
     total: page.total,
     limit: page.limit,
     offset: page.offset
@@ -3649,7 +5297,7 @@ async function readTargetRecords(db, env, ctx, target, query) {
 }
 var handleAdminNetworkRecords = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/network/records") return null;
-  const got = await gate5(req, env, ctx);
+  const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
   const targetId = url.searchParams.get("targetId") ?? "";
   const type = url.searchParams.get("type") ?? "";
@@ -3676,8 +5324,8 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
 // src/worker-routes-network-notes.ts
 var IDENTIFIER2 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
-var MAX_NOTE = 4e3;
-async function gate6(req, env, ctx) {
+var MAX_NOTE2 = 4e3;
+async function gate7(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -3711,7 +5359,7 @@ function asNote(row) {
 }
 var handleAdminNetworkNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/network/notes" || req.method !== "GET" && req.method !== "POST") return null;
-  const got = await gate6(req, env, ctx);
+  const got = await gate7(req, env, ctx);
   if ("response" in got) return got.response;
   const identity = noteIdentity(url, ctx);
   if (!identity) return json({ error: "valid targetId, type, and recordId are required" }, 400);
@@ -3728,7 +5376,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
     return json({ notes: (result.networkNotes ?? []).map((row) => asNote(row)) });
   }
   const contentLength = Number(req.headers.get("content-length") ?? 0);
-  if (contentLength > MAX_NOTE * 2) return json({ error: "note is too large" }, 413);
+  if (contentLength > MAX_NOTE2 * 2) return json({ error: "note is too large" }, 413);
   let input;
   try {
     input = await req.json();
@@ -3736,7 +5384,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
     return json({ error: "invalid JSON body" }, 400);
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
-  if (!body || body.length > MAX_NOTE) return json({ error: `note must be 1\u2013${MAX_NOTE} characters` }, 400);
+  if (!body || body.length > MAX_NOTE2) return json({ error: `note must be 1\u2013${MAX_NOTE2} characters` }, 400);
   const id = crypto.randomUUID();
   const note = {
     id,
@@ -3763,13 +5411,13 @@ import {
   CRM_NS,
   getRecord as getRecord2
 } from "@odla-ai/crm";
-import { signFederatedRequest as signFederatedRequest4, verifyFederatedRequest as verifyFederatedRequest5 } from "@odla-ai/db";
+import { signFederatedRequest as signFederatedRequest4, verifyFederatedRequest as verifyFederatedRequest7 } from "@odla-ai/db";
 var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
-var MAX_NOTE2 = 4e3;
+var MAX_NOTE3 = 4e3;
 var NETWORK_META = "chapterNetwork";
-async function gate7(req, env, ctx) {
+async function gate8(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -3815,14 +5463,14 @@ function sourceLabel(sourceId) {
 }
 var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
-  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE2 * 2) {
+  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE3 * 2) {
     return json({ error: "note is too large" }, 413);
   }
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await verifyFederatedRequest5(req, {
+  const verified = await verifyFederatedRequest7(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -3833,8 +5481,8 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
     return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
   }
-  const record = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
-  if (!record || record.type !== recordType) return json({ error: "record not found" }, 404);
+  const record3 = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
+  if (!record3 || record3.type !== recordType) return json({ error: "record not found" }, 404);
   if (req.method === "GET") {
     return json({
       version: 1,
@@ -3850,8 +5498,8 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const mutationId = typeof input.mutationId === "string" ? input.mutationId : "";
-  if (!body || body.length > MAX_NOTE2 || !MUTATION_ID.test(mutationId)) {
-    return json({ error: `body must be 1\u2013${MAX_NOTE2} characters and mutationId must be valid` }, 400);
+  if (!body || body.length > MAX_NOTE3 || !MUTATION_ID.test(mutationId)) {
+    return json({ error: `body must be 1\u2013${MAX_NOTE3} characters and mutationId must be valid` }, 400);
   }
   const createdAt = Date.now();
   const id = `network:${verified.sender}:${mutationId}`;
@@ -3893,7 +5541,7 @@ function targetFor2(ctx, id) {
 }
 var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
-  const got = await gate7(req, env, ctx);
+  const got = await gate8(req, env, ctx);
   if ("response" in got) return got.response;
   const targetId = url.searchParams.get("targetId") ?? "";
   const recordType = url.searchParams.get("type") ?? "";
@@ -3911,7 +5559,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
       return json({ error: "invalid JSON body" }, 400);
     }
     const note = typeof input.body === "string" ? input.body.trim() : "";
-    if (!note || note.length > MAX_NOTE2) return json({ error: `note must be 1\u2013${MAX_NOTE2} characters` }, 400);
+    if (!note || note.length > MAX_NOTE3) return json({ error: `note must be 1\u2013${MAX_NOTE3} characters` }, 400);
     body = JSON.stringify({ body: note, mutationId: crypto.randomUUID() });
   }
   const secret = await getVaultSecret(got.db, target.secretName);
@@ -3988,15 +5636,15 @@ var handleFormation = async (req, url, env, ctx) => {
   if (submissionId && !SUBMISSION.test(submissionId)) {
     return json({ error: "submissionId must be an 8\u2013128 character base64url value" }, 400);
   }
-  const allowed = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
-  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed.has(field));
+  const allowed2 = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
+  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed2.has(field));
   if (unknown.length) return json({ error: `field "${unknown[0]}" is not accepted` }, 400);
   for (const field of formation.required) {
     const value = body[field];
     if (typeof value !== "string" || value.trim() === "") return json({ error: `${field} is required` }, 400);
   }
   const input = {};
-  for (const field of allowed) {
+  for (const field of allowed2) {
     const value = body[field];
     if (value === void 0) continue;
     const cap = formation.maxLen[field] ?? formation.defaultMaxLen;
@@ -4064,6 +5712,56 @@ async function deliverSignupControl(options) {
   return result;
 }
 
+// src/member-content-delivery.ts
+import { signFederatedRequest as signFederatedRequest6 } from "@odla-ai/db";
+async function deliverMemberContent(options) {
+  const destination = new URL(MEMBER_CONTENT_CONTROL_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await signFederatedRequest6({
+    secret: options.secret,
+    sender: options.sender,
+    method: "POST",
+    url: destination,
+    body
+  });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, {
+    method: "POST",
+    headers: { ...signed, "content-type": "application/json" },
+    body
+  });
+  const result = await response.json();
+  if (!response.ok || !("ok" in result) || result.ok !== true) {
+    const failure = result;
+    throw new Error(`member content rejected (${response.status}): ${failure.reason ?? failure.error ?? "unknown"}`);
+  }
+  return result;
+}
+
+// src/admission-grants-delivery.ts
+import { signFederatedRequest as signFederatedRequest7 } from "@odla-ai/db";
+async function deliverAdmissionGrants(options) {
+  const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await signFederatedRequest7({
+    secret: options.secret,
+    sender: options.sender,
+    method: "POST",
+    url: destination,
+    body
+  });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, {
+    method: "POST",
+    headers: { ...signed, "content-type": "application/json" },
+    body
+  });
+  const result = await response.json();
+  if (!response.ok || !("ok" in result) || result.ok !== true) {
+    const failure = result;
+    throw new Error(`admission grants rejected (${response.status}): ${failure.reason ?? failure.error ?? "unknown"}`);
+  }
+  return result;
+}
+
 // src/signup-control-theme.ts
 var SIGNUP_CONTROL_THEME_MARKER = "<!--odla:signup-control-theme-->";
 var SIGNUP_CONTROL_THEME_STYLE_ID = "odla-signup-control-theme";
@@ -4203,11 +5901,15 @@ var BUILTIN_ROUTES = [
   handleCrm,
   handleNetworkShared,
   handleSignupControl,
+  handleMemberContentControl,
+  handleAdmissionGrants,
   handleNetworkSnapshot,
   handleNetworkRecords,
   handleNetworkSharedNotes,
   handleFormation,
   handleMember,
+  handleMemberContent,
+  handleGifts,
   handleSchedule,
   handlePayments,
   handleAdminMeetings,
@@ -4217,10 +5919,12 @@ var BUILTIN_ROUTES = [
   handleAdminPeopleAccess,
   handleAdminPeopleRole,
   handleAdminCrmSync,
+  handleAdminAdmissionGrants,
   handleAdminClerkPrivateProfileSync,
   // Aggregation
   handleAdminDashboard,
   handleAdminBilling,
+  handleAdminMemberContent,
   // Lifecycle actions
   handleAdminMeetingReschedule,
   handleAdminMeetingCancel,
@@ -4261,6 +5965,8 @@ function chapterWorker(options) {
 export {
   chapterWorker,
   createWorkerContext,
+  deliverAdmissionGrants,
+  deliverMemberContent,
   deliverSignupControl,
   renderActiveSignupControlHtml,
   withActiveSignupControlTheme