@odla-ai/chapter 0.36.0 → 0.37.0

package/dist/worker/index.cjs

@@ -23,6 +23,7 @@ __export(worker_exports, {
   chapterWorker: () => chapterWorker,
   createWorkerContext: () => createWorkerContext,
   deliverAdmissionGrants: () => deliverAdmissionGrants,
+  deliverMemberContent: () => deliverMemberContent,
   deliverSignupControl: () => deliverSignupControl,
   renderActiveSignupControlHtml: () => renderActiveSignupControlHtml,
   withActiveSignupControlTheme: () => withActiveSignupControlTheme
@@ -210,9 +211,9 @@ function canonicalValue(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
   if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
-  const record2 = value;
-  const entries = Object.keys(record2).sort().flatMap((key) => {
-    const item = record2[key];
+  const record3 = value;
+  const entries = Object.keys(record3).sort().flatMap((key) => {
+    const item = record3[key];
     return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
   });
   return `{${entries.join(",")}}`;
@@ -462,14 +463,14 @@ function hasDisclaimerAck(fields) {
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const app = chapter.application;
-  const allowed = (f) => app.profileFields.includes(f);
+  const allowed2 = (f) => app.profileFields.includes(f);
   const profile = {};
   for (const f of [...app.required, ...app.optional]) {
-    if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
+    if (IDENTITY_FIELDS.has(f) || !allowed2(f)) continue;
     const v = fields[f];
     if (typeof v === "string" && v.trim() !== "") profile[f] = v.trim();
   }
-  if (fields.focus !== void 0 && allowed("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
+  if (fields.focus !== void 0 && allowed2("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
   return Object.keys(profile).length > 0 ? profile : void 0;
 }
 async function submitApplication(db, chapter, fields, opts) {
@@ -762,8 +763,8 @@ function validateGiftOfferCatalog(input, tierIds) {
       errors.push(`${path} must be an object`);
       continue;
     }
-    const allowed = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
-    for (const key of Object.keys(item)) if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+    const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
+    for (const key of Object.keys(item)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
     const id = text(item.id, `${path}.id`, errors, 80);
     if (id && !ID2.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (ids.has(id)) errors.push(`${path}.id duplicates "${id}"`);
@@ -860,8 +861,8 @@ async function clerkListUsers(secretKey, fetchImpl = fetch) {
     const data = await clerkGet(`/v1/users?limit=${PAGE}&offset=${offset}`, secretKey, fetchImpl);
     const page = Array.isArray(data) ? data : [];
     for (const u of page) {
-      const record2 = toRecord(u);
-      if (record2) out.push(record2);
+      const record3 = toRecord(u);
+      if (record3) out.push(record3);
     }
     if (page.length < PAGE) break;
   }
@@ -918,34 +919,34 @@ function networkSourceTag(type, hubRecordId, sourceId) {
   if (readable && raw.length <= 64) return raw;
   return `network:${typeKey.slice(0, 16)}:${shortHash(`${sourceId ?? ""}\0${type}\0${hubRecordId}`)}`;
 }
-function normalizeSharedRecord(record2, fallbackSourceId = "legacy-source") {
-  if ("input" in record2 && record2.version === 2) {
+function normalizeSharedRecord(record3, fallbackSourceId = "legacy-source") {
+  if ("input" in record3 && record3.version === 2) {
     return {
       version: 2,
-      sourceId: record2.source.siteId,
-      sourceRecordId: record2.source.recordId,
-      type: record2.type,
-      input: record2.input
+      sourceId: record3.source.siteId,
+      sourceRecordId: record3.source.recordId,
+      type: record3.type,
+      input: record3.input
     };
   }
-  if ("input" in record2) {
+  if ("input" in record3) {
     return {
       version: 1,
       sourceId: fallbackSourceId,
-      sourceRecordId: record2.hubRecordId,
-      type: record2.type,
-      input: record2.input
+      sourceRecordId: record3.hubRecordId,
+      type: record3.type,
+      input: record3.input
     };
   }
-  if ("type" in record2 && record2.type === "company") {
-    const input = { name: record2.name };
+  if ("type" in record3 && record3.type === "company") {
+    const input = { name: record3.name };
     for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
-      if (record2[key]) input[key] = record2[key];
+      if (record3[key]) input[key] = record3[key];
     }
     return {
       version: 1,
       sourceId: fallbackSourceId,
-      sourceRecordId: record2.hubRecordId,
+      sourceRecordId: record3.hubRecordId,
       type: "company",
       input
     };
@@ -953,28 +954,28 @@ function normalizeSharedRecord(record2, fallbackSourceId = "legacy-source") {
   return {
     version: 1,
     sourceId: fallbackSourceId,
-    sourceRecordId: record2.hubRecordId,
+    sourceRecordId: record3.hubRecordId,
     type: "person",
-    input: sharedPersonInput(record2)
+    input: sharedPersonInput(record3)
   };
 }
-function sharedRecordFromCrm(crm, record2, target, sourceId) {
-  if (target.fields && !target.fields[record2.type]) {
-    throw new Error(`${target.name} does not accept "${record2.type}" records`);
+function sharedRecordFromCrm(crm, record3, target, sourceId) {
+  if (target.fields && !target.fields[record3.type]) {
+    throw new Error(`${target.name} does not accept "${record3.type}" records`);
   }
-  const def = crm.type(record2.type);
-  const fields = target.fields?.[record2.type] ?? DEFAULT_SHARE_FIELDS[record2.type];
+  const def = crm.type(record3.type);
+  const fields = target.fields?.[record3.type] ?? DEFAULT_SHARE_FIELDS[record3.type];
   if (!fields) {
-    throw new Error(`${target.name} requires an explicit field allowlist for "${record2.type}" records`);
+    throw new Error(`${target.name} requires an explicit field allowlist for "${record3.type}" records`);
   }
   const nameField = def.nameField ?? "name";
   const input = {};
   for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
-    const value = record2.fields?.[field];
+    const value = record3.fields?.[field];
     if (value !== void 0) input[field] = value;
   }
-  if (input[nameField] === void 0) input[nameField] = record2.name;
-  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record2.id }, type: record2.type, input } : { version: 1, type: record2.type, hubRecordId: record2.id, input };
+  if (input[nameField] === void 0) input[nameField] = record3.name;
+  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record3.id }, type: record3.type, input } : { version: 1, type: record3.type, hubRecordId: record3.id, input };
 }
 async function upsertPerson(deps, opts) {
   const email = opts.email.toLowerCase();
@@ -988,11 +989,11 @@ async function upsertPerson(deps, opts) {
   const created = await (0, import_crm2.createRecord)(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
   return { recordId: created.id };
 }
-async function findSharedRecord(deps, record2, tag) {
+async function findSharedRecord(deps, record3, tag) {
   const structured = await (0, import_crm2.getRecordByOrigin)(
     { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
-    record2.sourceId,
-    record2.sourceRecordId
+    record3.sourceId,
+    record3.sourceRecordId
   );
   if (structured) return structured;
   const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
@@ -1001,53 +1002,53 @@ async function findSharedRecord(deps, record2, tag) {
     const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const def = deps.crm.type(record2.type);
+  const def = deps.crm.type(record3.type);
   const emailField = def.emailField;
-  if (emailField && typeof record2.input[emailField] === "string") {
-    const primaryEmail = record2.input[emailField].toLowerCase();
+  if (emailField && typeof record3.input[emailField] === "string") {
+    const primaryEmail = record3.input[emailField].toLowerCase();
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record2.type, primaryEmail }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, primaryEmail }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const domain = record2.input.domain;
+  const domain = record3.input.domain;
   const domainSlot = def.fields.domain?.slot;
   if (typeof domain === "string" && domainSlot) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record2.type, [domainSlot]: domain }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, [domainSlot]: domain }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   const nameField = def.nameField ?? "name";
-  const name = record2.input[nameField];
-  if (record2.type === "company" && typeof name === "string" && name.trim()) {
+  const name = record3.input[nameField];
+  if (record3.type === "company" && typeof name === "string" && name.trim()) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record2.type, name: name.trim() }, limit: 1 } }
+      crm_record: { $: { where: { type: record3.type, name: name.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   return void 0;
 }
 async function projectSharedRecord(deps, shared, options = {}) {
-  const record2 = normalizeSharedRecord(shared, options.sourceId);
-  if (!record2.type.trim() || !record2.sourceId.trim() || !record2.sourceRecordId.trim()) {
+  const record3 = normalizeSharedRecord(shared, options.sourceId);
+  if (!record3.type.trim() || !record3.sourceId.trim() || !record3.sourceRecordId.trim()) {
     throw new Error("type, source site id, and source record id must be non-empty");
   }
-  if (options.sourceId && options.sourceId !== record2.sourceId) {
+  if (options.sourceId && options.sourceId !== record3.sourceId) {
     throw new Error("signed sender does not match payload source");
   }
-  const tag = networkSourceTag(record2.type, record2.sourceRecordId, record2.version === 2 ? record2.sourceId : void 0);
+  const tag = networkSourceTag(record3.type, record3.sourceRecordId, record3.version === 2 ? record3.sourceId : void 0);
   const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const existing = await findSharedRecord(deps, record2, tag);
+  const existing = await findSharedRecord(deps, record3, tag);
   let recordId;
   if (existing && typeof existing.id === "string") {
-    await (0, import_crm2.updateRecord)(crmDeps3, { id: existing.id, input: record2.input });
+    await (0, import_crm2.updateRecord)(crmDeps3, { id: existing.id, input: record3.input });
     recordId = existing.id;
   } else {
-    recordId = `network_${shortHash(`${record2.sourceId}\0${record2.type}\0${record2.sourceRecordId}`)}`;
+    recordId = `network_${shortHash(`${record3.sourceId}\0${record3.type}\0${record3.sourceRecordId}`)}`;
     await (0, import_crm2.createRecord)({ ...crmDeps3, newId: () => recordId }, {
-      type: record2.type,
-      input: record2.input,
+      type: record3.type,
+      input: record3.input,
       mutationId: `share-create:${tag}`
     });
   }
@@ -1057,10 +1058,10 @@ async function projectSharedRecord(deps, shared, options = {}) {
   );
   await (0, import_crm2.upsertRecordOrigin)(crmDeps3, {
     recordId,
-    sourceId: record2.sourceId,
-    sourceRecordId: record2.sourceRecordId,
+    sourceId: record3.sourceId,
+    sourceRecordId: record3.sourceRecordId,
     ...options.sourceUrl ? { sourceUrl: options.sourceUrl } : {},
-    payloadVersion: record2.version
+    payloadVersion: record3.version
   });
   return { recordId };
 }
@@ -1509,7 +1510,8 @@ function applicationSummary(app) {
     meetingLink: app.meetingLink ?? null,
     paid: Boolean(app.stripeSubscriptionId) && app.status !== "refunded",
     renewalAt: app.renewalAt ?? null,
-    canceled: app.canceled === true
+    canceled: app.canceled === true,
+    tierId: app.tierId ?? null
   };
 }
 function memberApplication(app, meeting, defaultTimezone) {
@@ -1983,8 +1985,8 @@ var handleNetworkShared = async (req, url, env, ctx) => {
       payload,
       sourceId ? { sourceId } : {}
     );
-    const record2 = normalizeSharedRecord(payload, sourceId);
-    return json({ recordId, type: record2.type });
+    const record3 = normalizeSharedRecord(payload, sourceId);
+    return json({ recordId, type: record3.type });
   } catch (error) {
     return json({
       error: error instanceof Error ? error.message : "invalid shared record"
@@ -2024,9 +2026,9 @@ var MAX_BENEFITS = 24;
 var MAX_MARKDOWN = 65536;
 var MAX_LABEL = 160;
 var objectRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function rejectUnknownKeys(value, allowed, path, errors) {
+function rejectUnknownKeys(value, allowed2, path, errors) {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+    if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
   }
 }
 function boundedString(value, path, errors, max, required = false) {
@@ -2182,8 +2184,8 @@ var ROOT_KEYS2 = /* @__PURE__ */ new Set([
 ]);
 var TIER_KEYS2 = /* @__PURE__ */ new Set(["id", "name", "available", "sortOrder", "priceCents", "stripePriceId", "blurb"]);
 var recordOf = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function unknownKeys(value, allowed, path, errors) {
-  for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push(`${path}.${key} is not supported`);
+function unknownKeys(value, allowed2, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
 }
 function text2(value, path, errors, max = 65536) {
   if (typeof value !== "string" || !value.trim()) {
@@ -2268,10 +2270,10 @@ function policyOf(value, errors) {
     errors.push("document.policy must be an object");
     return void 0;
   }
-  const allowed = /* @__PURE__ */ new Set(["disclaimerText", "refundPolicyText", "trustCopy", "commitmentText", "normsText"]);
-  unknownKeys(input, allowed, "document.policy", errors);
+  const allowed2 = /* @__PURE__ */ new Set(["disclaimerText", "refundPolicyText", "trustCopy", "commitmentText", "normsText"]);
+  unknownKeys(input, allowed2, "document.policy", errors);
   const result = {};
-  for (const key of allowed) {
+  for (const key of allowed2) {
     if (input[key] === void 0 && key !== "disclaimerText" && key !== "refundPolicyText") continue;
     result[key] = text2(input[key], `document.policy.${key}`, errors);
   }
@@ -2410,9 +2412,589 @@ var handleSignupControl = async (req, url, env, ctx) => {
   });
 };
 
-// src/worker-routes-admission-grants.ts
+// src/worker-routes-member-content.ts
 var import_db4 = require("@odla-ai/db");
+
+// src/member-content-canonical.ts
+var encoder2 = new TextEncoder();
+function canonicalValue2(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalValue2).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("member content contains an unsupported value");
+  const record3 = value;
+  const entries = Object.keys(record3).sort().flatMap((key) => {
+    const item = record3[key];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue2(item)}`];
+  });
+  return `{${entries.join(",")}}`;
+}
+function canonicalMemberContent(value) {
+  return canonicalValue2(value);
+}
+async function memberContentDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder2.encode(canonicalMemberContent(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/member-content-validation-helpers.ts
+var ID3 = /^[a-z][a-z0-9-]{0,79}$/;
+var SLUG2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var ROOT_KEYS3 = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides"]);
+var SOURCE_KEYS = /* @__PURE__ */ new Set(["type", "appId"]);
+var TARGET_KEYS = /* @__PURE__ */ new Set(["chapterId", "environment"]);
+var PAGE_KEYS = /* @__PURE__ */ new Set(["id", "slug", "title", "summary", "navigation", "audience", "teaserMarkdown", "bodyMarkdown", "upsell"]);
+var NAV_KEYS = /* @__PURE__ */ new Set(["section", "order", "parentId"]);
+var AUDIENCE_KEYS = /* @__PURE__ */ new Set(["kind", "tierIds"]);
+var UPSELL_KEYS = /* @__PURE__ */ new Set(["owner", "offer"]);
+var OFFER_KEYS = /* @__PURE__ */ new Set(["tierId", "label", "bodyMarkdown", "ctaLabel"]);
+var OVERRIDE_KEYS = /* @__PURE__ */ new Set(["pageId", "offer"]);
+var MAX_PAGES = 100;
+var MAX_MARKDOWN2 = 65536;
+var MAX_TEXT = 240;
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function unknownKeys2(value, allowed2, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
+}
+function textValue(value, path, errors, max = MAX_TEXT, required = false) {
+  if (value === void 0) {
+    if (required) errors.push(`${path} is required`);
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    errors.push(`${path} must be a string`);
+    return void 0;
+  }
+  const valueText = value.trim();
+  if (required && !valueText) errors.push(`${path} is required`);
+  if (valueText.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return valueText;
+}
+function offerValue(value, path, errors, tiers, audience) {
+  const raw = record2(value);
+  if (!raw) {
+    errors.push(`${path} must be an object`);
+    return void 0;
+  }
+  unknownKeys2(raw, OFFER_KEYS, path, errors);
+  const tierId = textValue(raw.tierId, `${path}.tierId`, errors, 80, true) ?? "";
+  if (tierId && !ID3.test(tierId)) errors.push(`${path}.tierId must be a lowercase kebab-case id`);
+  if (tiers.size && !tiers.has(tierId)) errors.push(`${path}.tierId must reference a declared tier`);
+  if (audience?.kind === "tiers" && tierId && !audience.tierIds.includes(tierId)) {
+    errors.push(`${path}.tierId must grant access to this page`);
+  }
+  const label = textValue(raw.label, `${path}.label`, errors);
+  const bodyMarkdown = textValue(raw.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2);
+  const ctaLabel = textValue(raw.ctaLabel, `${path}.ctaLabel`, errors);
+  return {
+    tierId,
+    ...label ? { label } : {},
+    ...bodyMarkdown ? { bodyMarkdown } : {},
+    ...ctaLabel ? { ctaLabel } : {}
+  };
+}
+
+// src/member-content-validation.ts
+function validateMemberContentDocument(input, options = {}) {
+  const errors = [];
+  const root = record2(input);
+  if (!root) return { ok: false, errors: ["document must be an object"] };
+  unknownKeys2(root, ROOT_KEYS3, "document", errors);
+  if (root.schemaVersion !== MEMBER_CONTENT_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  if (!Number.isInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isInteger(root.generatedAt) || Number(root.generatedAt) < 0) errors.push("document.generatedAt must be a non-negative integer timestamp");
+  const sourceRaw = record2(root.source);
+  let source = { type: "chapter", appId: "invalid" };
+  if (!sourceRaw) errors.push("document.source must be an object");
+  else {
+    unknownKeys2(sourceRaw, SOURCE_KEYS, "document.source", errors);
+    const type = sourceRaw.type;
+    const appId = textValue(sourceRaw.appId, "document.source.appId", errors, 63, true) ?? "";
+    if (type !== "parent" && type !== "chapter") errors.push("document.source.type must be parent or chapter");
+    if (appId && !ID3.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+    if (options.sourceType && type !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
+    if (options.sourceAppId && appId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
+    if (type === "parent" || type === "chapter") source = { type, appId };
+  }
+  let target;
+  if (root.target !== void 0) {
+    const targetRaw = record2(root.target);
+    if (!targetRaw) errors.push("document.target must be an object");
+    else {
+      unknownKeys2(targetRaw, TARGET_KEYS, "document.target", errors);
+      const chapterId = textValue(targetRaw.chapterId, "document.target.chapterId", errors, 63, true) ?? "";
+      const environment = textValue(targetRaw.environment, "document.target.environment", errors, 80, true) ?? "";
+      target = { chapterId, environment };
+    }
+  }
+  if (source.type === "parent" && !target) errors.push("document.target is required for parent content");
+  if (source.type === "chapter" && target) errors.push("document.target is not supported for chapter content");
+  if (!Array.isArray(root.pages)) errors.push("document.pages must be an array");
+  const rawPages = Array.isArray(root.pages) ? root.pages : [];
+  if (rawPages.length > MAX_PAGES) errors.push(`document.pages supports at most ${MAX_PAGES} entries`);
+  const tierIds = new Set((options.tiers ?? []).map((tier) => tier.id));
+  const knownParentIds = new Set((options.parentPages ?? []).map((page) => page.id));
+  const ids = /* @__PURE__ */ new Set();
+  const slugs = /* @__PURE__ */ new Set();
+  const pages = [];
+  for (const [index, value] of rawPages.slice(0, MAX_PAGES).entries()) {
+    const path = `document.pages[${index}]`;
+    const raw = record2(value);
+    if (!raw) {
+      errors.push(`${path} must be an object`);
+      continue;
+    }
+    unknownKeys2(raw, PAGE_KEYS, path, errors);
+    const id = textValue(raw.id, `${path}.id`, errors, 80, true) ?? "";
+    const slug = textValue(raw.slug, `${path}.slug`, errors, 120, true) ?? "";
+    const title = textValue(raw.title, `${path}.title`, errors, MAX_TEXT, true) ?? "";
+    if (id && !ID3.test(id)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (slug && !SLUG2.test(slug)) errors.push(`${path}.slug must be a lowercase URL slug`);
+    if (ids.has(id) || knownParentIds.has(id)) errors.push(`${path}.id duplicates page "${id}"`);
+    if (slugs.has(slug) || (options.parentPages ?? []).some((page) => page.slug === slug)) errors.push(`${path}.slug duplicates "${slug}"`);
+    ids.add(id);
+    slugs.add(slug);
+    const navRaw = record2(raw.navigation);
+    let navigation = { section: "General", order: index };
+    if (!navRaw) errors.push(`${path}.navigation must be an object`);
+    else {
+      unknownKeys2(navRaw, NAV_KEYS, `${path}.navigation`, errors);
+      const section = textValue(navRaw.section, `${path}.navigation.section`, errors, 120, true) ?? "";
+      const order = navRaw.order;
+      if (!Number.isInteger(order) || Number(order) < 0 || Number(order) > 1e6) {
+        errors.push(`${path}.navigation.order must be an integer from 0 to 1,000,000`);
+      }
+      const parentId = textValue(navRaw.parentId, `${path}.navigation.parentId`, errors, 80);
+      navigation = { section, order: Number.isInteger(order) ? Number(order) : index, ...parentId ? { parentId } : {} };
+    }
+    const audienceRaw = record2(raw.audience);
+    let audience = { kind: "all-members" };
+    if (!audienceRaw) errors.push(`${path}.audience must be an object`);
+    else {
+      unknownKeys2(audienceRaw, AUDIENCE_KEYS, `${path}.audience`, errors);
+      if (audienceRaw.kind === "all-members") {
+        if (audienceRaw.tierIds !== void 0) errors.push(`${path}.audience.tierIds is not supported for all-members`);
+      } else if (audienceRaw.kind === "tiers") {
+        if (!Array.isArray(audienceRaw.tierIds) || audienceRaw.tierIds.length === 0) {
+          errors.push(`${path}.audience.tierIds must be a non-empty array`);
+        }
+        const values = Array.isArray(audienceRaw.tierIds) ? audienceRaw.tierIds : [];
+        const normalized = [];
+        for (const [tierIndex, value2] of values.entries()) {
+          const tier = textValue(value2, `${path}.audience.tierIds[${tierIndex}]`, errors, 80, true) ?? "";
+          if (normalized.includes(tier)) errors.push(`${path}.audience.tierIds duplicates "${tier}"`);
+          if (tierIds.size && !tierIds.has(tier)) errors.push(`${path}.audience.tierIds references undeclared tier "${tier}"`);
+          normalized.push(tier);
+        }
+        audience = { kind: "tiers", tierIds: normalized };
+      } else errors.push(`${path}.audience.kind must be all-members or tiers`);
+    }
+    const summary = textValue(raw.summary, `${path}.summary`, errors, 2e3);
+    const teaserMarkdown = textValue(raw.teaserMarkdown, `${path}.teaserMarkdown`, errors, MAX_MARKDOWN2);
+    const bodyMarkdown = textValue(raw.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, true) ?? "";
+    let upsell;
+    if (raw.upsell !== void 0) {
+      const upsellRaw = record2(raw.upsell);
+      if (!upsellRaw) errors.push(`${path}.upsell must be an object`);
+      else {
+        unknownKeys2(upsellRaw, UPSELL_KEYS, `${path}.upsell`, errors);
+        const owner = upsellRaw.owner;
+        if (owner !== "parent" && owner !== "chapter") errors.push(`${path}.upsell.owner must be parent or chapter`);
+        if (source.type === "chapter" && owner === "parent") errors.push(`${path}.upsell.owner cannot be parent on a chapter page`);
+        if (source.type === "parent" && owner === "parent" && upsellRaw.offer === void 0) errors.push(`${path}.upsell.offer is required when the parent owns the offer`);
+        if (source.type === "parent" && owner === "chapter" && upsellRaw.offer !== void 0) errors.push(`${path}.upsell.offer must be set by the chapter after delegation`);
+        const offer = upsellRaw.offer === void 0 ? void 0 : offerValue(upsellRaw.offer, `${path}.upsell.offer`, errors, tierIds, audience);
+        if (owner === "parent") upsell = { owner, offer: offer ?? { tierId: "" } };
+        else if (owner === "chapter") upsell = { owner, ...offer ? { offer } : {} };
+      }
+    }
+    pages.push({ id, slug, title, ...summary ? { summary } : {}, navigation, audience, ...teaserMarkdown ? { teaserMarkdown } : {}, bodyMarkdown, ...upsell ? { upsell } : {} });
+  }
+  const allIds = /* @__PURE__ */ new Set([...knownParentIds, ...ids]);
+  for (const [index, page] of pages.entries()) {
+    const parentId = page.navigation.parentId;
+    if (parentId && !allIds.has(parentId)) errors.push(`document.pages[${index}].navigation.parentId references unknown page "${parentId}"`);
+    if (parentId === page.id) errors.push(`document.pages[${index}].navigation.parentId cannot reference itself`);
+  }
+  for (const page of pages) {
+    const seen = /* @__PURE__ */ new Set([page.id]);
+    let parentId = page.navigation.parentId;
+    while (parentId) {
+      if (seen.has(parentId)) {
+        errors.push(`document.pages contains a navigation cycle at "${page.id}"`);
+        break;
+      }
+      seen.add(parentId);
+      parentId = pages.find((candidate) => candidate.id === parentId)?.navigation.parentId;
+    }
+  }
+  let upsellOverrides;
+  if (root.upsellOverrides !== void 0) {
+    if (source.type !== "chapter") errors.push("document.upsellOverrides is supported only for chapter content");
+    if (!Array.isArray(root.upsellOverrides)) errors.push("document.upsellOverrides must be an array");
+    const values = Array.isArray(root.upsellOverrides) ? root.upsellOverrides : [];
+    const seen = /* @__PURE__ */ new Set();
+    upsellOverrides = [];
+    for (const [index, value] of values.entries()) {
+      const path = `document.upsellOverrides[${index}]`;
+      const raw = record2(value);
+      if (!raw) {
+        errors.push(`${path} must be an object`);
+        continue;
+      }
+      unknownKeys2(raw, OVERRIDE_KEYS, path, errors);
+      const pageId = textValue(raw.pageId, `${path}.pageId`, errors, 80, true) ?? "";
+      if (seen.has(pageId)) errors.push(`${path}.pageId duplicates "${pageId}"`);
+      seen.add(pageId);
+      const parentPage = (options.parentPages ?? []).find((page) => page.id === pageId);
+      if (!parentPage) errors.push(`${path}.pageId must reference a parent page`);
+      else if (parentPage.upsell?.owner !== "chapter") errors.push(`${path}.pageId does not delegate upsell authority to the chapter`);
+      const offer = offerValue(raw.offer, `${path}.offer`, errors, tierIds, parentPage?.audience);
+      if (offer) upsellOverrides.push({ pageId, offer });
+    }
+  }
+  if (errors.length) return { ok: false, errors };
+  return { ok: true, value: {
+    schemaVersion: MEMBER_CONTENT_SCHEMA_VERSION,
+    revision: Number(root.revision),
+    generatedAt: Number(root.generatedAt),
+    source,
+    ...target ? { target } : {},
+    pages,
+    ...upsellOverrides ? { upsellOverrides } : {}
+  } };
+}
+
+// src/member-content.ts
+var MEMBER_CONTENT_SCHEMA_VERSION = 1;
+var MEMBER_CONTENT_PATH = "/api/member-content";
+var MEMBER_CONTENT_CONTROL_PATH = "/api/member-content-control";
+var pageOrder = (a, b) => a.navigation.section.localeCompare(b.navigation.section) || a.navigation.order - b.navigation.order || a.title.localeCompare(b.title) || a.id.localeCompare(b.id);
+function composeMemberContent(parent, chapter) {
+  const pages = [];
+  const parentPages = /* @__PURE__ */ new Map();
+  for (const page of parent?.pages ?? []) {
+    const effective = { ...page, source: parent.source };
+    parentPages.set(page.id, effective);
+    pages.push(effective);
+  }
+  for (const override of chapter?.upsellOverrides ?? []) {
+    const page = parentPages.get(override.pageId);
+    if (page?.upsell?.owner === "chapter") page.upsell = { owner: "chapter", offer: override.offer };
+  }
+  for (const page of chapter?.pages ?? []) {
+    if (parentPages.has(page.id) || pages.some((candidate) => candidate.slug === page.slug)) {
+      throw new TypeError(`Chapter member page "${page.id}" conflicts with parent content`);
+    }
+    pages.push({ ...page, source: chapter.source });
+  }
+  return {
+    pages: pages.sort(pageOrder),
+    parentRevision: parent?.revision ?? null,
+    chapterRevision: chapter?.revision ?? null
+  };
+}
+var allowed = (page, viewer) => viewer.admin || page.audience.kind === "all-members" || viewer.tierId !== null && page.audience.tierIds.includes(viewer.tierId);
+function projectMemberContent(content, viewer, tiers) {
+  const authority = new Map(tiers.filter((tier) => tier.active !== false).map((tier) => [tier.id, tier]));
+  return {
+    viewer: { ...viewer },
+    revisions: { parent: content.parentRevision, chapter: content.chapterRevision },
+    pages: content.pages.map((page) => {
+      const canRead = allowed(page, viewer);
+      const offer = !canRead ? page.upsell?.offer : void 0;
+      const tier = offer ? authority.get(offer.tierId) : void 0;
+      const upsell = offer && tier && typeof tier.name === "string" && typeof tier.priceCents === "number" ? { ...offer, tierName: tier.name, priceCents: tier.priceCents } : void 0;
+      return {
+        id: page.id,
+        slug: page.slug,
+        title: page.title,
+        ...page.summary ? { summary: page.summary } : {},
+        navigation: page.navigation,
+        audience: page.audience,
+        source: page.source,
+        access: canRead ? "allowed" : "locked",
+        ...page.teaserMarkdown ? { teaserMarkdown: page.teaserMarkdown } : {},
+        ...canRead ? { bodyMarkdown: page.bodyMarkdown } : {},
+        ...upsell ? { upsell } : {}
+      };
+    })
+  };
+}
+
+// src/member-content-store.ts
+var control = (row) => row && row.document && typeof row.document === "object" ? row : null;
+var local = (row) => row && row.document && typeof row.document === "object" ? row : null;
+async function exists(db, ns, where) {
+  if (db.aggregate) return Number((await db.aggregate(ns, { count: true }, { where })).count ?? 0) > 0;
+  const rows4 = (await db.query({ [ns]: {} }))[ns] ?? [];
+  return rows4.some((row) => Object.entries(where).every(([key, value]) => row[key] === value));
+}
+async function loadActiveMemberContentControl(db, targetId, environment) {
+  const where = { targetId, environment, active: true };
+  if (!await exists(db, "memberContentControls", where)) return null;
+  const rows4 = (await db.query({ memberContentControls: { $: {
+    where,
+    order: { revision: "desc" },
+    limit: 1
+  } } })).memberContentControls;
+  return control(Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+}
+async function loadLatestMemberContentControl(db, targetId, environment) {
+  const where = { targetId, environment };
+  if (!await exists(db, "memberContentControls", where)) return null;
+  const rows4 = (await db.query({ memberContentControls: { $: {
+    where,
+    order: { revision: "desc" },
+    limit: 1
+  } } })).memberContentControls;
+  return control(Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+}
+async function loadLocalMemberContent(db, chapterId, environment) {
+  const id = `member-content-local:${environment}`;
+  const rows4 = (await db.query({ memberContentLocal: { $: { where: { id }, limit: 1 } } })).memberContentLocal;
+  return local(Array.isArray(rows4) ? rows4[0] : void 0);
+}
+async function materializeMemberContentControl(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const target = document.target;
+  const id = `member-content-control:${target.environment}:${document.revision}`;
+  const ops = [];
+  if (previous?.active) {
+    ops.push({ t: "update", ns: "memberContentControls", id: previous.id, attrs: { active: false } });
+  }
+  ops.push({ t: "update", ns: "memberContentControls", id, attrs: {
+    id,
+    sourceId: document.source.appId,
+    targetId: target.chapterId,
+    environment: target.environment,
+    revision: document.revision,
+    digest,
+    document,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `member-content-control:${target.environment}:${document.revision}:${digest}` });
+}
+async function saveLocalMemberContent(db, document, environment, expectedRevision, updatedAt, updatedBy) {
+  const id = `member-content-local:${environment}`;
+  const current = await loadLocalMemberContent(db, document.source.appId, environment);
+  if ((current?.revision ?? 0) !== expectedRevision) throw new Error("member_content_revision_conflict");
+  const row = {
+    id,
+    chapterId: document.source.appId,
+    environment,
+    revision: document.revision,
+    document,
+    updatedAt,
+    ...updatedBy ? { updatedBy } : {}
+  };
+  await db.transact([{ t: "update", ns: "memberContentLocal", id, attrs: row }], {
+    mutationId: `member-content-local:${environment}:${document.revision}`,
+    guards: current ? [{ ns: "memberContentLocal", id, exists: true, equals: { revision: expectedRevision } }] : [{ ns: "memberContentLocal", id, exists: false }]
+  });
+  return row;
+}
+
+// src/worker-routes-member-content.ts
+var ADMIN_PATH = "/api/admin/member-content";
+var BODY_CAP = 1e6;
 var reject2 = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
+async function groupAndTiers(db, chapterId) {
+  const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
+  const group = Array.isArray(groups) ? groups[0] : void 0;
+  if (!group) return { group: null, tiers: [] };
+  return { group, tiers: await loadTiers(db, group) };
+}
+async function memberTierId(db, chapterId, email) {
+  if (!email) return null;
+  let rows4 = (await db.query({ applications: { $: {
+    where: { emailNormalized: normalizeAdmissionEmail(email) },
+    limit: 20
+  } } })).applications;
+  if (!rows4?.length) rows4 = (await db.query({ applications: { $: { where: { email }, limit: 20 } } })).applications;
+  const latest = Array.isArray(rows4) ? [...rows4].filter((row) => String(row.groupId ?? chapterId) === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0] : void 0;
+  return typeof latest?.tierId === "string" && latest.tierId ? latest.tierId : null;
+}
+async function activeDocuments(db, chapterId, environment) {
+  const [parent, chapter] = await Promise.all([
+    loadActiveMemberContentControl(db, chapterId, environment),
+    loadLocalMemberContent(db, chapterId, environment)
+  ]);
+  return { parent, chapter };
+}
+var handleMemberContentControl = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== MEMBER_CONTENT_CONTROL_PATH) return null;
+  const settings = ctx.chapter.memberContent?.parent;
+  if (!settings) return json({ error: "not found" }, 404);
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, settings.secretName);
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  const verified = await (0, import_db4.verifyFederatedRequest)(req, { secret, senders: [settings.sourceId] });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return reject2("invalid_document", 400, ["request body must be JSON"]);
+  }
+  const digest = typeof input.digest === "string" ? input.digest : "";
+  const initial = validateMemberContentDocument(input.document, {
+    sourceType: "parent"
+  });
+  if (!initial.ok) return reject2("invalid_document", 400, initial.errors);
+  const document = initial.value;
+  if (document.source.appId !== settings.sourceId) return reject2("wrong_source", 403);
+  if (document.target?.chapterId !== ctx.chapter.id) return reject2("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject2("wrong_environment", 409);
+  const { tiers } = await groupAndTiers(db, ctx.chapter.id);
+  const checked = validateMemberContentDocument(document, {
+    sourceType: "parent",
+    sourceAppId: settings.sourceId,
+    tiers
+  });
+  if (!checked.ok) return reject2("invalid_document", 400, checked.errors);
+  const local2 = await loadLocalMemberContent(db, ctx.chapter.id, env.ODLA_ENV);
+  if (local2) {
+    const localCheck = validateMemberContentDocument(local2.document, {
+      sourceType: "chapter",
+      sourceAppId: ctx.chapter.id,
+      tiers,
+      parentPages: document.pages
+    });
+    if (!localCheck.ok) {
+      return reject2("invalid_document", 409, localCheck.errors.map((error) => `existing chapter content: ${error}`));
+    }
+  }
+  if (!digest || await memberContentDigest(document) !== digest) return reject2("invalid_digest", 400);
+  const latest = await loadLatestMemberContentControl(db, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return reject2("stale_revision", 409);
+  if (latest && document.revision === latest.revision) {
+    if (latest.digest !== digest) return reject2("conflicting_revision", 409);
+    return json({
+      ok: true,
+      target: document.target,
+      revision: latest.revision,
+      digest: latest.digest,
+      status: "replayed",
+      acknowledgedAt: latest.receivedAt
+    });
+  }
+  const receivedAt = Date.now();
+  try {
+    await materializeMemberContentControl(db, { digest, document }, latest, receivedAt);
+  } catch {
+    return reject2("materialization_failed", 503);
+  }
+  return json({
+    ok: true,
+    target: document.target,
+    revision: document.revision,
+    digest,
+    status: "accepted",
+    acknowledgedAt: receivedAt
+  });
+};
+var handleMemberContent = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== MEMBER_CONTENT_PATH) return null;
+  if (!ctx.chapter.memberContent) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  const role = await ctx.roleFor(db, user);
+  const admin = await ctx.isAdmin(db, user);
+  const roleIndex = ctx.chapter.auth.ladder.indexOf(role);
+  const memberIndex = Math.max(0, ctx.chapter.auth.ladder.length - 2);
+  if (!admin && roleIndex < memberIndex) return json({ error: "member access required" }, 403);
+  const [{ parent, chapter }, { group, tiers }, tierId] = await Promise.all([
+    activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
+    groupAndTiers(db, ctx.chapter.id),
+    memberTierId(db, ctx.chapter.id, user.email)
+  ]);
+  const effective = composeMemberContent(parent?.document, chapter?.document);
+  let offerable = tiers;
+  if (group) {
+    const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
+    offerable = await loadOfferableTiers(db, group, Boolean(stripeSecret));
+  }
+  return json(projectMemberContent(effective, { tierId, admin }, offerable));
+};
+var handleAdminMemberContent = async (req, url, env, ctx) => {
+  if (url.pathname !== ADMIN_PATH) return null;
+  if (!ctx.chapter.memberContent) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  const [{ parent, chapter }, { tiers }] = await Promise.all([
+    activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
+    groupAndTiers(db, ctx.chapter.id)
+  ]);
+  if (req.method === "GET") {
+    const effective = composeMemberContent(parent?.document, chapter?.document);
+    return json({
+      parent: parent ? { revision: parent.revision, digest: parent.digest, document: parent.document } : null,
+      chapter: chapter ? { revision: chapter.revision, document: chapter.document } : null,
+      effective,
+      tiers: tiers.map(({ id, name, priceCents, active }) => ({ id, name, priceCents, active })),
+      localAuthoring: ctx.chapter.memberContent.localAuthoring
+    });
+  }
+  if (req.method !== "PUT") return json({ error: "method not allowed" }, 405);
+  if (!ctx.chapter.memberContent.localAuthoring) return json({ error: "local authoring is disabled" }, 403);
+  const raw = await req.text();
+  if (raw.length > BODY_CAP) return json({ error: "request body too large" }, 413);
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const expectedRevision = Number(input.expectedRevision);
+  if (!Number.isInteger(expectedRevision) || expectedRevision < 0) {
+    return json({ error: "expectedRevision must be a non-negative integer" }, 400);
+  }
+  const now = Date.now();
+  const documentInput = withLocalAuthority(input.document, expectedRevision + 1, now, ctx.chapter.id);
+  const checked = validateMemberContentDocument(documentInput, {
+    sourceType: "chapter",
+    sourceAppId: ctx.chapter.id,
+    tiers,
+    parentPages: parent?.document.pages ?? []
+  });
+  if (!checked.ok) return json({ error: "invalid member content", errors: checked.errors }, 400);
+  try {
+    const saved = await saveLocalMemberContent(
+      db,
+      checked.value,
+      env.ODLA_ENV,
+      expectedRevision,
+      now,
+      user.email ?? user.userId
+    );
+    return json({ ok: true, revision: saved.revision, document: saved.document });
+  } catch (error) {
+    if (error instanceof Error && error.message === "member_content_revision_conflict") {
+      return json({ error: "member content changed; reload before saving" }, 409);
+    }
+    return json({ error: "member content could not be saved" }, 503);
+  }
+};
+function withLocalAuthority(value, revision, generatedAt, appId) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  return {
+    ...value,
+    schemaVersion: 1,
+    revision,
+    generatedAt,
+    source: { type: "chapter", appId }
+  };
+}
+
+// src/worker-routes-admission-grants.ts
+var import_db5 = require("@odla-ai/db");
+var reject3 = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
 var handleAdmissionGrants = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== ADMISSION_GRANTS_PATH) return null;
   const authority = ctx.chapter.signupControl;
@@ -2420,26 +3002,26 @@ var handleAdmissionGrants = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, authority.secretName);
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db4.verifyFederatedRequest)(req, { secret, senders: [authority.sourceId] });
+  const verified = await (0, import_db5.verifyFederatedRequest)(req, { secret, senders: [authority.sourceId] });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   let input;
   try {
     input = JSON.parse(verified.body);
   } catch {
-    return reject2("invalid_document", 400, ["request body must be JSON"]);
+    return reject3("invalid_document", 400, ["request body must be JSON"]);
   }
   const digest = typeof input.digest === "string" ? input.digest : "";
   const checked = validateAdmissionGrantDocument(input.document);
-  if (!checked.ok) return reject2("invalid_document", 400, checked.errors);
+  if (!checked.ok) return reject3("invalid_document", 400, checked.errors);
   const document = checked.value;
-  if (document.source.appId !== authority.sourceId) return reject2("wrong_source", 403);
-  if (document.target.chapterId !== ctx.chapter.id) return reject2("wrong_target", 409);
-  if (document.target.environment !== env.ODLA_ENV) return reject2("wrong_environment", 409);
-  if (!digest || await signupControlDigest(document) !== digest) return reject2("invalid_digest", 400);
+  if (document.source.appId !== authority.sourceId) return reject3("wrong_source", 403);
+  if (document.target.chapterId !== ctx.chapter.id) return reject3("wrong_target", 409);
+  if (document.target.environment !== env.ODLA_ENV) return reject3("wrong_environment", 409);
+  if (!digest || await signupControlDigest(document) !== digest) return reject3("invalid_digest", 400);
   const latest = await loadLatestAdmissionRevision(db, authority.sourceId, ctx.chapter.id, env.ODLA_ENV);
-  if (latest && document.revision < latest.revision) return reject2("stale_revision", 409);
+  if (latest && document.revision < latest.revision) return reject3("stale_revision", 409);
   if (latest && document.revision === latest.revision) {
-    if (latest.digest !== digest) return reject2("conflicting_revision", 409);
+    if (latest.digest !== digest) return reject3("conflicting_revision", 409);
     return json({
       ok: true,
       target: { chapterId: ctx.chapter.id, environment: env.ODLA_ENV },
@@ -2453,7 +3035,7 @@ var handleAdmissionGrants = async (req, url, env, ctx) => {
   try {
     await materializeAdmissionGrants(db, { digest, document }, latest, receivedAt);
   } catch {
-    return reject2("materialization_failed", 503);
+    return reject3("materialization_failed", 503);
   }
   return json({
     ok: true,
@@ -3281,8 +3863,8 @@ async function startSubscription(req, env, ctx) {
   const secretKey = await getVaultSecret(db, "stripe_secret_key");
   if (!group || !secretKey) return json({ error: "payments not configured" }, 503);
   if (typeof app.giftOfferId === "string") {
-    const control = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
-    const offer = findGiftOffer(control?.document.giftOffers, app.giftOfferId, Date.now());
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control2?.document.giftOffers, app.giftOfferId, Date.now());
     if (!offer || typeof group.stripePublishableKey !== "string" || !group.stripePublishableKey) {
       return json({ error: "gift offer is unavailable" }, 409);
     }
@@ -3441,14 +4023,14 @@ var handleGifts = async (req, url, env, ctx) => {
   if (req.method === "GET" && url.pathname === "/api/gifts") {
     const user = await userFor(req, env, ctx);
     if (!user) return json({ error: "unauthorized" }, 401);
-    const control = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
     const found = await db.query({ giftClaims: { $: { where: {
       purchaserEmailNormalized: normalizeAdmissionEmail(user.email),
       chapterId: ctx.chapter.id
     }, limit: 200 } } });
     const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
     return json({
-      offers: publicGiftOffers(control?.document.giftOffers, Date.now()),
+      offers: publicGiftOffers(control2?.document.giftOffers, Date.now()),
       claims: buyerGiftClaims(rows2(found.giftClaims).sort((a, b) => Number(b.createdAt) - Number(a.createdAt)), Date.now()),
       refundPolicyText: typeof group?.refundPolicyText === "string" ? group.refundPolicyText : ""
     });
@@ -3464,8 +4046,8 @@ var handleGifts = async (req, url, env, ctx) => {
     }
     const purchaseId = typeof body.purchaseId === "string" ? body.purchaseId : "";
     if (!/^[A-Za-z0-9_-]{16,128}$/.test(purchaseId)) return json({ error: "purchaseId is invalid" }, 400);
-    const control = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
-    const offer = findGiftOffer(control?.document.giftOffers, typeof body.offerId === "string" ? body.offerId : "", Date.now());
+    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control2?.document.giftOffers, typeof body.offerId === "string" ? body.offerId : "", Date.now());
     if (!offer) return json({ error: "gift offer is unavailable" }, 409);
     const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
     const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
@@ -4386,7 +4968,7 @@ var handleAdminComms = async (req, url, env, ctx) => {
 
 // src/worker-routes-network.ts
 var import_crm6 = require("@odla-ai/crm");
-var import_db6 = require("@odla-ai/db");
+var import_db7 = require("@odla-ai/db");
 
 // src/worker-network-fetch.ts
 function targetFetcher(env, target) {
@@ -4404,8 +4986,8 @@ function fetchNetworkTarget(env, target, destination, init) {
 
 // src/worker-network-push.ts
 var import_crm5 = require("@odla-ai/crm");
-var import_db5 = require("@odla-ai/db");
-async function pushNetworkRecord(db, env, ctx, target, record2) {
+var import_db6 = require("@odla-ai/db");
+async function pushNetworkRecord(db, env, ctx, target, record3) {
   const secret = await getVaultSecret(db, target.secretName);
   const crmDeps3 = {
     crm: ctx.chapter.crm,
@@ -4416,7 +4998,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
   if (!secret) {
     const error = `vault secret "${target.secretName}" is missing`;
     await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
-      recordId: record2.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -4426,7 +5008,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
   }
   let payload;
   try {
-    payload = sharedRecordFromCrm(ctx.chapter.crm, record2, target, ctx.chapter.id);
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record3, target, ctx.chapter.id);
   } catch (err) {
     return {
       id: target.id,
@@ -4438,7 +5020,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
   const payloadBody = JSON.stringify(payload);
   const destination = new URL("/api/network/shared", target.url);
   try {
-    const signed = await (0, import_db5.signFederatedRequest)({
+    const signed = await (0, import_db6.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "POST",
@@ -4455,7 +5037,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
     if (!res.ok) {
       const error = responseBody.error ?? "follower rejected the record";
       await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
-        recordId: record2.id,
+        recordId: record3.id,
         targetId: target.id,
         status: "failed",
         payloadVersion: 2,
@@ -4470,7 +5052,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
       };
     }
     await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
-      recordId: record2.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "delivered",
       payloadVersion: 2,
@@ -4486,7 +5068,7 @@ async function pushNetworkRecord(db, env, ctx, target, record2) {
   } catch (err) {
     const error = err instanceof Error ? err.message : "delivery failed";
     await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
-      recordId: record2.id,
+      recordId: record3.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -4523,7 +5105,7 @@ var handleNetworkSnapshot = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db6.verifyFederatedRequest)(req, { secret });
+  const verified = await (0, import_db7.verifyFederatedRequest)(req, { secret });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const types = await Promise.all(
     Object.keys(ctx.chapter.crm.config.types).map((type) => (0, import_crm6.typeSummary)({ crm: ctx.chapter.crm, db }, type))
@@ -4541,7 +5123,7 @@ async function snapshotOne(db, env, ctx, target) {
   if (!secret) return { id: target.id, name: target.name, url: target.url, available: false, error: "edge secret is missing" };
   const destination = new URL("/api/network/snapshot", target.url);
   try {
-    const headers = await (0, import_db6.signFederatedRequest)({
+    const headers = await (0, import_db7.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
@@ -4624,17 +5206,17 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (requested.size !== body.targetIds.length) return json({ error: "targetIds must contain unique strings" }, 400);
   const targets = ctx.chapter.network.targets.filter((target) => requested.has(target.id));
   if (targets.length !== requested.size) return json({ error: "one or more targetIds are not configured" }, 400);
-  const record2 = await (0, import_crm6.getRecord)({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
-  if (!record2) return json({ error: "record not found" }, 404);
+  const record3 = await (0, import_crm6.getRecord)({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
+  if (!record3) return json({ error: "record not found" }, 404);
   const results = await Promise.all(
-    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record2))
+    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record3))
   );
   return json({ ok: results.every((result) => result.ok), results });
 };
 
 // src/worker-routes-network-records.ts
 var import_crm7 = require("@odla-ai/crm");
-var import_db7 = require("@odla-ai/db");
+var import_db8 = require("@odla-ai/db");
 var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
 var MAX_PAGE = 50;
 var MAX_OFFSET = 1e4;
@@ -4652,18 +5234,18 @@ function integer(value, fallback, min, max) {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
 }
-function projectRecord(record2, allowed) {
+function projectRecord(record3, allowed2) {
   const fields = Object.fromEntries(
-    allowed.flatMap((name) => Object.prototype.hasOwnProperty.call(record2.fields, name) ? [[name, record2.fields[name]]] : [])
+    allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record3.fields, name) ? [[name, record3.fields[name]]] : [])
   );
   return {
-    id: record2.id,
-    type: record2.type,
-    name: record2.name,
-    ...record2.stage ? { stage: record2.stage } : {},
+    id: record3.id,
+    type: record3.type,
+    name: record3.name,
+    ...record3.stage ? { stage: record3.stage } : {},
     fields,
-    createdAt: record2.createdAt,
-    updatedAt: record2.updatedAt
+    createdAt: record3.createdAt,
+    updatedAt: record3.updatedAt
   };
 }
 var handleNetworkRecords = async (req, url, env, ctx) => {
@@ -4672,15 +5254,15 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db7.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db8.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const reader = readers.find((candidate) => candidate.id === verified.sender);
   const type = url.searchParams.get("type") ?? "";
-  const allowed = reader?.fields[type];
-  if (!IDENTIFIER.test(type) || !allowed) return json({ error: "record type is not shared with this reader" }, 403);
+  const allowed2 = reader?.fields[type];
+  if (!IDENTIFIER.test(type) || !allowed2) return json({ error: "record type is not shared with this reader" }, 403);
   const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
   const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
   const search = (url.searchParams.get("search") ?? "").trim();
@@ -4701,7 +5283,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     version: 1,
     site: { id: ctx.chapter.id, name: ctx.chapter.name },
     type,
-    records: page.records.map((record2) => projectRecord(record2, allowed)),
+    records: page.records.map((record3) => projectRecord(record3, allowed2)),
     total: page.total,
     limit: page.limit,
     offset: page.offset
@@ -4717,7 +5299,7 @@ async function readTargetRecords(db, env, ctx, target, query) {
   const destination = new URL("/api/network/records", target.url);
   destination.search = query.toString();
   try {
-    const headers = await (0, import_db7.signFederatedRequest)({
+    const headers = await (0, import_db8.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
@@ -4852,7 +5434,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
 
 // src/worker-routes-network-shared-notes.ts
 var import_crm8 = require("@odla-ai/crm");
-var import_db8 = require("@odla-ai/db");
+var import_db9 = require("@odla-ai/db");
 var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
@@ -4911,7 +5493,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db8.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db9.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -4922,8 +5504,8 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
     return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
   }
-  const record2 = await (0, import_crm8.getRecord)({ crm: ctx.chapter.crm, db }, recordId);
-  if (!record2 || record2.type !== recordType) return json({ error: "record not found" }, 404);
+  const record3 = await (0, import_crm8.getRecord)({ crm: ctx.chapter.crm, db }, recordId);
+  if (!record3 || record3.type !== recordType) return json({ error: "record not found" }, 404);
   if (req.method === "GET") {
     return json({
       version: 1,
@@ -5008,7 +5590,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   const destination = new URL("/api/network/shared-notes", target.url);
   destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
   try {
-    const headers = await (0, import_db8.signFederatedRequest)({
+    const headers = await (0, import_db9.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: req.method,
@@ -5077,15 +5659,15 @@ var handleFormation = async (req, url, env, ctx) => {
   if (submissionId && !SUBMISSION.test(submissionId)) {
     return json({ error: "submissionId must be an 8\u2013128 character base64url value" }, 400);
   }
-  const allowed = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
-  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed.has(field));
+  const allowed2 = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
+  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed2.has(field));
   if (unknown.length) return json({ error: `field "${unknown[0]}" is not accepted` }, 400);
   for (const field of formation.required) {
     const value = body[field];
     if (typeof value !== "string" || value.trim() === "") return json({ error: `${field} is required` }, 400);
   }
   const input = {};
-  for (const field of allowed) {
+  for (const field of allowed2) {
     const value = body[field];
     if (value === void 0) continue;
     const cap = formation.maxLen[field] ?? formation.defaultMaxLen;
@@ -5129,11 +5711,11 @@ var handleFormation = async (req, url, env, ctx) => {
 };
 
 // src/signup-control-delivery.ts
-var import_db9 = require("@odla-ai/db");
+var import_db10 = require("@odla-ai/db");
 async function deliverSignupControl(options) {
   const destination = new URL(SIGNUP_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db9.signFederatedRequest)({
+  const signed = await (0, import_db10.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -5153,12 +5735,37 @@ async function deliverSignupControl(options) {
   return result;
 }
 
+// src/member-content-delivery.ts
+var import_db11 = require("@odla-ai/db");
+async function deliverMemberContent(options) {
+  const destination = new URL(MEMBER_CONTENT_CONTROL_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await (0, import_db11.signFederatedRequest)({
+    secret: options.secret,
+    sender: options.sender,
+    method: "POST",
+    url: destination,
+    body
+  });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, {
+    method: "POST",
+    headers: { ...signed, "content-type": "application/json" },
+    body
+  });
+  const result = await response.json();
+  if (!response.ok || !("ok" in result) || result.ok !== true) {
+    const failure = result;
+    throw new Error(`member content rejected (${response.status}): ${failure.reason ?? failure.error ?? "unknown"}`);
+  }
+  return result;
+}
+
 // src/admission-grants-delivery.ts
-var import_db10 = require("@odla-ai/db");
+var import_db12 = require("@odla-ai/db");
 async function deliverAdmissionGrants(options) {
   const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db10.signFederatedRequest)({
+  const signed = await (0, import_db12.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -5317,12 +5924,14 @@ var BUILTIN_ROUTES = [
   handleCrm,
   handleNetworkShared,
   handleSignupControl,
+  handleMemberContentControl,
   handleAdmissionGrants,
   handleNetworkSnapshot,
   handleNetworkRecords,
   handleNetworkSharedNotes,
   handleFormation,
   handleMember,
+  handleMemberContent,
   handleGifts,
   handleSchedule,
   handlePayments,
@@ -5338,6 +5947,7 @@ var BUILTIN_ROUTES = [
   // Aggregation
   handleAdminDashboard,
   handleAdminBilling,
+  handleAdminMemberContent,
   // Lifecycle actions
   handleAdminMeetingReschedule,
   handleAdminMeetingCancel,