@odla-ai/chapter 0.37.0 → 0.38.1

package/dist/index.cjs

@@ -22,6 +22,7 @@ var index_exports = {};
 __export(index_exports, {
   ADMISSION_GRANTS_PATH: () => ADMISSION_GRANTS_PATH,
   ADMISSION_GRANTS_SCHEMA_VERSION: () => ADMISSION_GRANTS_SCHEMA_VERSION,
+  CHAPTER_FLOW_FIELDS_SCHEMA_VERSION: () => CHAPTER_FLOW_FIELDS_SCHEMA_VERSION,
   CHAPTER_PROMOTION_ADAPTER: () => CHAPTER_PROMOTION_ADAPTER,
   DEFAULT_CHAPTER_COPY: () => DEFAULT_CHAPTER_COPY,
   DEFAULT_SHARE_FIELDS: () => DEFAULT_SHARE_FIELDS,
@@ -38,6 +39,7 @@ __export(index_exports, {
   SIGNUP_CONTROL_THEME_STYLE_ID: () => SIGNUP_CONTROL_THEME_STYLE_ID,
   applicantProfile: () => applicantProfile,
   applicationBookingUpdate: () => applicationBookingUpdate,
+  applicationFlowFields: () => applicationFlowFields,
   applicationSummary: () => applicationSummary,
   applyMembershipTierMarkdown: () => applyMembershipTierMarkdown,
   backfillCrm: () => backfillCrm,
@@ -55,6 +57,7 @@ __export(index_exports, {
   canonicalSignupControl: () => canonicalSignupControl,
   chapterBrandFromTokens: () => chapterBrandFromTokens,
   chapterDb: () => chapterDb,
+  chapterFlowFieldContract: () => chapterFlowFieldContract,
   clampArray: () => clampArray,
   clerkGetUser: () => clerkGetUser,
   clerkGetUserByEmail: () => clerkGetUserByEmail,
@@ -83,6 +86,7 @@ __export(index_exports, {
   firstPaymentPatch: () => firstPaymentPatch,
   formatChapterCopy: () => formatChapterCopy,
   formationFields: () => formationFields,
+  formationFlowFields: () => formationFlowFields,
   getVaultSecret: () => getVaultSecret,
   giftOfferActive: () => giftOfferActive,
   hasDisclaimerAck: () => hasDisclaimerAck,
@@ -111,6 +115,7 @@ __export(index_exports, {
   membershipTierPresentationFromMarkdown: () => membershipTierPresentationFromMarkdown,
   networkSourceTag: () => networkSourceTag,
   normalizeAdmissionEmail: () => normalizeAdmissionEmail,
+  normalizeChapterEmail: () => normalizeChapterEmail,
   normalizeSharedRecord: () => normalizeSharedRecord,
   normalizeWebhookEvent: () => normalizeWebhookEvent,
   offerableTiers: () => offerableTiers,
@@ -183,212 +188,10 @@ async function applicationIdForSubmission(submissionId) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
-// src/admission-grants-contract.ts
-var ADMISSION_GRANTS_SCHEMA_VERSION = 1;
-var ADMISSION_GRANTS_PATH = "/api/admission-grants";
-
-// src/signup-control-canonical.ts
-var encoder = new TextEncoder();
-function canonicalValue(value) {
-  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
-  if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
-  const record3 = value;
-  const entries = Object.keys(record3).sort().flatMap((key) => {
-    const item = record3[key];
-    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
-  });
-  return `{${entries.join(",")}}`;
-}
-function canonicalSignupControl(value) {
-  return canonicalValue(value);
-}
-async function signupControlDigest(document) {
-  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalSignupControl(document)));
-  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-async function createSignupControlEnvelope(document) {
-  return { document, digest: await signupControlDigest(document) };
-}
-
-// src/admission-grants.ts
-var ID = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
-var MAX_GRANTS = 2e3;
-var MAX_NOTE = 2e3;
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var isAdmissionEmail = (value) => EMAIL_RE.test(value);
-function normalizeAdmissionEmail(email) {
+// src/email-identity.ts
+function normalizeChapterEmail(email) {
   return email.trim().toLowerCase();
 }
-function validateAdmissionGrantDocument(input) {
-  const errors = [];
-  const root = input && typeof input === "object" ? input : {};
-  if (root.schemaVersion !== ADMISSION_GRANTS_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
-  const revision = Number(root.revision);
-  const generatedAt = Number(root.generatedAt);
-  if (!Number.isSafeInteger(revision) || revision < 1) errors.push("document.revision must be a positive integer");
-  if (!Number.isFinite(generatedAt) || generatedAt <= 0) errors.push("document.generatedAt must be epoch milliseconds");
-  const source = root.source && typeof root.source === "object" ? root.source : {};
-  const target = root.target && typeof root.target === "object" ? root.target : {};
-  const sourceId = typeof source.appId === "string" ? source.appId : "";
-  const sourceActor = typeof source.actor === "string" ? source.actor.trim() : "";
-  const chapterId = typeof target.chapterId === "string" ? target.chapterId : "";
-  const environment = typeof target.environment === "string" ? target.environment : "";
-  if (!ID.test(sourceId)) errors.push("document.source.appId must be an identifier");
-  if (!sourceActor || sourceActor.length > 256) errors.push("document.source.actor must be 1-256 characters");
-  if (!ID.test(chapterId)) errors.push("document.target.chapterId must be an identifier");
-  if (!ID.test(environment)) errors.push("document.target.environment must be an identifier");
-  if (!Array.isArray(root.grants)) errors.push("document.grants must be an array");
-  const rawGrants = Array.isArray(root.grants) ? root.grants : [];
-  if (rawGrants.length > MAX_GRANTS) errors.push(`document.grants supports at most ${MAX_GRANTS} entries`);
-  const grants = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  const seenEmails = /* @__PURE__ */ new Set();
-  for (const [index, raw] of rawGrants.slice(0, MAX_GRANTS).entries()) {
-    const grant = raw && typeof raw === "object" ? raw : {};
-    const id4 = typeof grant.id === "string" ? grant.id : "";
-    const email = typeof grant.email === "string" ? grant.email.trim() : "";
-    const normalized = normalizeAdmissionEmail(email);
-    const decision = grant.decision;
-    const note = typeof grant.note === "string" ? grant.note.trim() : void 0;
-    const expiresAt = grant.expiresAt === void 0 ? void 0 : Number(grant.expiresAt);
-    if (!ID.test(id4)) errors.push(`document.grants[${index}].id must be an identifier`);
-    if (seenIds.has(id4)) errors.push(`document.grants repeats id "${id4}"`);
-    if (!isAdmissionEmail(normalized)) errors.push(`document.grants[${index}].email must be valid`);
-    if (seenEmails.has(normalized)) errors.push(`document.grants repeats email "${normalized}"`);
-    if (decision !== "waive_interview" && decision !== "require_interview") {
-      errors.push(`document.grants[${index}].decision is invalid`);
-    }
-    if (note && note.length > MAX_NOTE) errors.push(`document.grants[${index}].note is too long`);
-    if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= 0)) {
-      errors.push(`document.grants[${index}].expiresAt must be epoch milliseconds`);
-    }
-    seenIds.add(id4);
-    seenEmails.add(normalized);
-    grants.push({
-      id: id4,
-      email,
-      decision,
-      ...note ? { note } : {},
-      ...expiresAt !== void 0 ? { expiresAt } : {}
-    });
-  }
-  if (errors.length) return { ok: false, errors };
-  return {
-    ok: true,
-    value: {
-      schemaVersion: ADMISSION_GRANTS_SCHEMA_VERSION,
-      revision,
-      generatedAt,
-      source: { appId: sourceId, actor: sourceActor },
-      target: { chapterId, environment },
-      grants
-    }
-  };
-}
-async function createAdmissionGrantEnvelope(document) {
-  const checked = validateAdmissionGrantDocument(document);
-  if (!checked.ok) throw new TypeError(`Invalid admission grant document: ${checked.errors.join("; ")}`);
-  return { document: checked.value, digest: await signupControlDigest(checked.value) };
-}
-var rows = (value) => Array.isArray(value) ? value : [];
-function asGrant(row) {
-  if (typeof row.id !== "string" || typeof row.emailNormalized !== "string") return null;
-  if (row.sourceScope !== "local" && row.sourceScope !== "parent") return null;
-  if (row.decision !== "waive_interview" && row.decision !== "require_interview") return null;
-  return row;
-}
-async function findAdmissionGrant(db, targetId, email, now) {
-  const emailNormalized = normalizeAdmissionEmail(email);
-  if (!isAdmissionEmail(emailNormalized)) return null;
-  const result = await db.query({ admissionGrants: { $: { where: { emailNormalized }, limit: 100 } } });
-  const active = rows(result.admissionGrants).map(asGrant).filter((grant) => Boolean(
-    grant && grant.targetId === targetId && grant.active === true && !grant.revokedAt && (!grant.expiresAt || grant.expiresAt > now) && !grant.consumedApplicationId
-  )).sort((a, b) => {
-    const scope = Number(b.sourceScope === "local") - Number(a.sourceScope === "local");
-    return scope || b.createdAt - a.createdAt;
-  });
-  return active[0] ?? null;
-}
-async function hasAdmissionRevision(db, sourceId, targetId, environment) {
-  const where = { sourceId, targetId, environment };
-  if (db.aggregate) {
-    return Number((await db.aggregate("admissionGrantRevisions", { count: true }, { where })).count ?? 0) > 0;
-  }
-  const found = await db.query({ admissionGrantRevisions: {} });
-  return rows(found.admissionGrantRevisions).some((row) => row.sourceId === sourceId && row.targetId === targetId && row.environment === environment);
-}
-async function loadLatestAdmissionRevision(db, sourceId, targetId, environment) {
-  if (!await hasAdmissionRevision(db, sourceId, targetId, environment)) return null;
-  const result = await db.query({ admissionGrantRevisions: { $: {
-    where: { sourceId, targetId, environment },
-    order: { revision: "desc" },
-    limit: 1
-  } } });
-  const row = rows(result.admissionGrantRevisions).sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0];
-  return row ? row : null;
-}
-async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
-  const { document, digest } = envelope;
-  const current = rows((await db.query({ admissionGrants: { $: {
-    where: { sourceScope: "parent", sourceId: document.source.appId, targetId: document.target.chapterId },
-    limit: MAX_GRANTS
-  } } })).admissionGrants);
-  const incomingIds = new Set(document.grants.map((grant) => `admission:parent:${document.source.appId}:${grant.id}`));
-  const ops = [];
-  for (const row of current) {
-    const id4 = String(row.id ?? "");
-    if (id4 && !incomingIds.has(id4)) ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
-      active: false,
-      revokedAt: receivedAt,
-      revokedBy: document.source.actor,
-      updatedAt: receivedAt,
-      updatedBy: document.source.actor
-    } });
-  }
-  for (const grant of document.grants) {
-    const id4 = `admission:parent:${document.source.appId}:${grant.id}`;
-    const existing = current.find((row) => row.id === id4);
-    ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
-      id: id4,
-      sourceGrantId: grant.id,
-      sourceScope: "parent",
-      sourceId: document.source.appId,
-      targetId: document.target.chapterId,
-      email: grant.email,
-      emailNormalized: normalizeAdmissionEmail(grant.email),
-      decision: grant.decision,
-      ...grant.note ? { note: grant.note } : {},
-      ...grant.expiresAt ? { expiresAt: grant.expiresAt } : {},
-      active: true,
-      sourceRevision: document.revision,
-      createdAt: Number(existing?.createdAt ?? receivedAt),
-      createdBy: String(existing?.createdBy ?? document.source.actor),
-      updatedAt: receivedAt,
-      updatedBy: document.source.actor
-    } });
-    const retract = [
-      ...!grant.note && existing?.note !== void 0 ? ["note"] : [],
-      ...grant.expiresAt === void 0 && existing?.expiresAt !== void 0 ? ["expiresAt"] : []
-    ];
-    if (retract.length) ops.push({ t: "retract", ns: "admissionGrants", id: id4, attrs: retract });
-  }
-  if (previous?.active) ops.push({ t: "update", ns: "admissionGrantRevisions", id: previous.id, attrs: { active: false } });
-  const revisionId = `admission-revision:${document.source.appId}:${document.target.environment}:${document.revision}`;
-  ops.push({ t: "update", ns: "admissionGrantRevisions", id: revisionId, attrs: {
-    id: revisionId,
-    sourceId: document.source.appId,
-    targetId: document.target.chapterId,
-    environment: document.target.environment,
-    revision: document.revision,
-    digest,
-    active: true,
-    receivedAt
-  } });
-  await db.transact(ops, { mutationId: `admission-grants:${document.source.appId}:${document.target.environment}:${document.revision}:${digest}` });
-}
 
 // src/member.ts
 var DEFAULT_REQUIRED = ["firstName", "lastName", "email", "referral", "whoYouAre", "message"];
@@ -441,9 +244,9 @@ function resolveApplication(a) {
     validateEmail: a?.validateEmail ?? true
   };
 }
-var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function isValidEmail(value) {
-  return typeof value === "string" && EMAIL_RE2.test(value);
+  return typeof value === "string" && EMAIL_RE.test(value);
 }
 function clampArray(value, max) {
   if (!Array.isArray(value)) return value;
@@ -478,7 +281,7 @@ async function submitApplication(db, chapter, fields, opts) {
     const cap = app.maxLen[f] ?? app.defaultMaxLen;
     if (typeof v === "string" && v.length > cap) return { ok: false, error: `${f} exceeds ${cap} characters` };
   }
-  if (app.validateEmail && typeof fields.email === "string" && !isValidEmail(fields.email)) {
+  if (app.validateEmail && typeof fields.email === "string" && !isValidEmail(fields.email.trim())) {
     return { ok: false, error: "email must be a valid email address" };
   }
   const acked = hasDisclaimerAck(fields);
@@ -494,7 +297,7 @@ async function submitApplication(db, chapter, fields, opts) {
   if (fields.focus !== void 0) row.focus = clampArray(fields.focus, app.maxArrayLen);
   if (opts.groupId) row.groupId = opts.groupId;
   if (typeof fields.email === "string" && isValidEmail(fields.email.trim())) {
-    row.emailNormalized = normalizeAdmissionEmail(fields.email);
+    row.emailNormalized = normalizeChapterEmail(fields.email);
   }
   if (opts.admissionGrant?.decision === "waive_interview") {
     row.admissionGrantId = opts.admissionGrant.id;
@@ -1556,6 +1359,82 @@ function formatChapterCopy(template, values) {
   );
 }
 
+// src/flow-fields.ts
+var CHAPTER_FLOW_FIELDS_SCHEMA_VERSION = 1;
+var APPLICATION_LABELS = {
+  firstName: "First name",
+  lastName: "Last name",
+  email: "Email",
+  referral: "Referral source",
+  referralName: "Referral name",
+  whoYouAre: "Who you are",
+  linkedin: "LinkedIn",
+  message: "Intro message",
+  phone: "Phone",
+  state: "State"
+};
+function humanize(id4) {
+  const text3 = id4.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text3 ? `${text3[0].toUpperCase()}${text3.slice(1)}` : id4;
+}
+function applicationDefs(chapter) {
+  try {
+    return chapter.crm.type("person").fields;
+  } catch {
+    return {};
+  }
+}
+function applicationType(id4, def) {
+  if (def && ["string", "email", "url", "enum"].includes(def.type)) return def.type;
+  return id4 === "email" ? "email" : id4 === "linkedin" ? "url" : "string";
+}
+function applicationFlowFields(chapter, application = chapter.application) {
+  const defs = applicationDefs(chapter);
+  return [...application.required, ...application.optional].map((id4, order) => {
+    const def = defs[id4];
+    const conditions = application.conditions[id4];
+    const type = applicationType(id4, def);
+    return {
+      id: id4,
+      label: def?.label ?? APPLICATION_LABELS[id4] ?? humanize(id4),
+      type,
+      required: application.required.includes(id4),
+      order,
+      maxLength: application.maxLen[id4] ?? application.defaultMaxLen,
+      ...type === "enum" && def?.options ? { options: [...def.options] } : {},
+      ...conditions ? { conditions: { ...conditions } } : {},
+      ...type === "email" ? { emailIdentity: "literal" } : {}
+    };
+  });
+}
+function resolveFormationFlowFields(crm, formation) {
+  if (!formation.enabled) return [];
+  const def = crm.type(formation.type);
+  return [...formation.required, ...formation.optional].map((id4, order) => {
+    const field = def.fields[id4];
+    return {
+      id: id4,
+      label: field.label ?? humanize(id4),
+      type: field.type,
+      required: formation.required.includes(id4),
+      order,
+      maxLength: formation.maxLen[id4] ?? formation.defaultMaxLen,
+      ...field.options ? { options: [...field.options] } : {},
+      ...id4 === def.emailField || field.type === "email" ? { emailIdentity: "literal" } : {}
+    };
+  });
+}
+function formationFlowFields(chapter, formation = chapter.formation) {
+  return resolveFormationFlowFields(chapter.crm, formation);
+}
+function chapterFlowFieldContract(chapter, flow, application = chapter.application) {
+  return {
+    schemaVersion: CHAPTER_FLOW_FIELDS_SCHEMA_VERSION,
+    flow,
+    fields: flow === "join" ? applicationFlowFields(chapter, application) : formationFlowFields(chapter)
+  };
+}
+
 // src/formation.ts
 var DEFAULT_REQUIRED2 = ["name", "email", "location", "thesis"];
 var DEFAULT_OPTIONAL2 = ["proposedChapter", "experience", "collaborators"];
@@ -1618,17 +1497,7 @@ function resolveLeaderFormation(input, crm) {
   };
 }
 function formationFields(crm, formation) {
-  const def = crm.type(formation.type);
-  return [...formation.required, ...formation.optional].map((id4) => {
-    const field = def.fields[id4];
-    return {
-      id: id4,
-      label: field.label ?? id4,
-      type: field.type,
-      required: formation.required.includes(id4),
-      ...field.options ? { options: field.options } : {}
-    };
-  });
+  return resolveFormationFlowFields(crm, formation);
 }
 
 // src/config-network.ts
@@ -2207,7 +2076,7 @@ function createChapterIntegration(chapter, options = {}) {
 }
 
 // src/member-content-validation-helpers.ts
-var ID2 = /^[a-z][a-z0-9-]{0,79}$/;
+var ID = /^[a-z][a-z0-9-]{0,79}$/;
 var SLUG5 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var ROOT_KEYS = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides"]);
 var SOURCE_KEYS = /* @__PURE__ */ new Set(["type", "appId"]);
@@ -2247,7 +2116,7 @@ function offerValue(value, path, errors, tiers2, audience) {
   }
   unknownKeys(raw, OFFER_KEYS, path, errors);
   const tierId = textValue(raw.tierId, `${path}.tierId`, errors, 80, true) ?? "";
-  if (tierId && !ID2.test(tierId)) errors.push(`${path}.tierId must be a lowercase kebab-case id`);
+  if (tierId && !ID.test(tierId)) errors.push(`${path}.tierId must be a lowercase kebab-case id`);
   if (tiers2.size && !tiers2.has(tierId)) errors.push(`${path}.tierId must reference a declared tier`);
   if (audience?.kind === "tiers" && tierId && !audience.tierIds.includes(tierId)) {
     errors.push(`${path}.tierId must grant access to this page`);
@@ -2280,7 +2149,7 @@ function validateMemberContentDocument(input, options = {}) {
     const type = sourceRaw.type;
     const appId = textValue(sourceRaw.appId, "document.source.appId", errors, 63, true) ?? "";
     if (type !== "parent" && type !== "chapter") errors.push("document.source.type must be parent or chapter");
-    if (appId && !ID2.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+    if (appId && !ID.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
     if (options.sourceType && type !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
     if (options.sourceAppId && appId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
     if (type === "parent" || type === "chapter") source = { type, appId };
@@ -2317,7 +2186,7 @@ function validateMemberContentDocument(input, options = {}) {
     const id4 = textValue(raw.id, `${path}.id`, errors, 80, true) ?? "";
     const slug = textValue(raw.slug, `${path}.slug`, errors, 120, true) ?? "";
     const title = textValue(raw.title, `${path}.title`, errors, MAX_TEXT, true) ?? "";
-    if (id4 && !ID2.test(id4)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (id4 && !ID.test(id4)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (slug && !SLUG5.test(slug)) errors.push(`${path}.slug must be a lowercase URL slug`);
     if (ids.has(id4) || knownParentIds.has(id4)) errors.push(`${path}.id duplicates page "${id4}"`);
     if (slugs.has(slug) || (options.parentPages ?? []).some((page) => page.slug === slug)) errors.push(`${path}.slug duplicates "${slug}"`);
@@ -2497,25 +2366,25 @@ function projectMemberContent(content, viewer, tiers2) {
 }
 
 // src/member-content-canonical.ts
-var encoder2 = new TextEncoder();
-function canonicalValue2(value) {
+var encoder = new TextEncoder();
+function canonicalValue(value) {
   if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
     return JSON.stringify(value);
   }
-  if (Array.isArray(value)) return `[${value.map(canonicalValue2).join(",")}]`;
+  if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
   if (typeof value !== "object") throw new TypeError("member content contains an unsupported value");
   const record3 = value;
   const entries = Object.keys(record3).sort().flatMap((key) => {
     const item = record3[key];
-    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue2(item)}`];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
   });
   return `{${entries.join(",")}}`;
 }
 function canonicalMemberContent(value) {
-  return canonicalValue2(value);
+  return canonicalValue(value);
 }
 async function memberContentDigest(document) {
-  const digest = await crypto.subtle.digest("SHA-256", encoder2.encode(canonicalMemberContent(document)));
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonicalMemberContent(document)));
   return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 async function createMemberContentEnvelope(document) {
@@ -2695,6 +2564,213 @@ function canceledPatch() {
   return { canceled: true };
 }
 
+// src/admission-grants-contract.ts
+var ADMISSION_GRANTS_SCHEMA_VERSION = 1;
+var ADMISSION_GRANTS_PATH = "/api/admission-grants";
+
+// src/signup-control-canonical.ts
+var encoder2 = new TextEncoder();
+function canonicalValue2(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalValue2).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
+  const record3 = value;
+  const entries = Object.keys(record3).sort().flatMap((key) => {
+    const item = record3[key];
+    return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue2(item)}`];
+  });
+  return `{${entries.join(",")}}`;
+}
+function canonicalSignupControl(value) {
+  return canonicalValue2(value);
+}
+async function signupControlDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder2.encode(canonicalSignupControl(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+async function createSignupControlEnvelope(document) {
+  return { document, digest: await signupControlDigest(document) };
+}
+
+// src/admission-grants.ts
+var ID2 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/;
+var MAX_GRANTS = 2e3;
+var MAX_NOTE = 2e3;
+var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var isAdmissionEmail = (value) => EMAIL_RE2.test(value);
+function normalizeAdmissionEmail(email) {
+  return normalizeChapterEmail(email);
+}
+function validateAdmissionGrantDocument(input) {
+  const errors = [];
+  const root = input && typeof input === "object" ? input : {};
+  if (root.schemaVersion !== ADMISSION_GRANTS_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  const revision = Number(root.revision);
+  const generatedAt = Number(root.generatedAt);
+  if (!Number.isSafeInteger(revision) || revision < 1) errors.push("document.revision must be a positive integer");
+  if (!Number.isFinite(generatedAt) || generatedAt <= 0) errors.push("document.generatedAt must be epoch milliseconds");
+  const source = root.source && typeof root.source === "object" ? root.source : {};
+  const target = root.target && typeof root.target === "object" ? root.target : {};
+  const sourceId = typeof source.appId === "string" ? source.appId : "";
+  const sourceActor = typeof source.actor === "string" ? source.actor.trim() : "";
+  const chapterId = typeof target.chapterId === "string" ? target.chapterId : "";
+  const environment = typeof target.environment === "string" ? target.environment : "";
+  if (!ID2.test(sourceId)) errors.push("document.source.appId must be an identifier");
+  if (!sourceActor || sourceActor.length > 256) errors.push("document.source.actor must be 1-256 characters");
+  if (!ID2.test(chapterId)) errors.push("document.target.chapterId must be an identifier");
+  if (!ID2.test(environment)) errors.push("document.target.environment must be an identifier");
+  if (!Array.isArray(root.grants)) errors.push("document.grants must be an array");
+  const rawGrants = Array.isArray(root.grants) ? root.grants : [];
+  if (rawGrants.length > MAX_GRANTS) errors.push(`document.grants supports at most ${MAX_GRANTS} entries`);
+  const grants = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  const seenEmails = /* @__PURE__ */ new Set();
+  for (const [index, raw] of rawGrants.slice(0, MAX_GRANTS).entries()) {
+    const grant = raw && typeof raw === "object" ? raw : {};
+    const id4 = typeof grant.id === "string" ? grant.id : "";
+    const email = typeof grant.email === "string" ? grant.email.trim() : "";
+    const normalized = normalizeAdmissionEmail(email);
+    const decision = grant.decision;
+    const note = typeof grant.note === "string" ? grant.note.trim() : void 0;
+    const expiresAt = grant.expiresAt === void 0 ? void 0 : Number(grant.expiresAt);
+    if (!ID2.test(id4)) errors.push(`document.grants[${index}].id must be an identifier`);
+    if (seenIds.has(id4)) errors.push(`document.grants repeats id "${id4}"`);
+    if (!isAdmissionEmail(normalized)) errors.push(`document.grants[${index}].email must be valid`);
+    if (seenEmails.has(normalized)) errors.push(`document.grants repeats email "${normalized}"`);
+    if (decision !== "waive_interview" && decision !== "require_interview") {
+      errors.push(`document.grants[${index}].decision is invalid`);
+    }
+    if (note && note.length > MAX_NOTE) errors.push(`document.grants[${index}].note is too long`);
+    if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= 0)) {
+      errors.push(`document.grants[${index}].expiresAt must be epoch milliseconds`);
+    }
+    seenIds.add(id4);
+    seenEmails.add(normalized);
+    grants.push({
+      id: id4,
+      email,
+      decision,
+      ...note ? { note } : {},
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    });
+  }
+  if (errors.length) return { ok: false, errors };
+  return {
+    ok: true,
+    value: {
+      schemaVersion: ADMISSION_GRANTS_SCHEMA_VERSION,
+      revision,
+      generatedAt,
+      source: { appId: sourceId, actor: sourceActor },
+      target: { chapterId, environment },
+      grants
+    }
+  };
+}
+async function createAdmissionGrantEnvelope(document) {
+  const checked = validateAdmissionGrantDocument(document);
+  if (!checked.ok) throw new TypeError(`Invalid admission grant document: ${checked.errors.join("; ")}`);
+  return { document: checked.value, digest: await signupControlDigest(checked.value) };
+}
+var rows = (value) => Array.isArray(value) ? value : [];
+function asGrant(row) {
+  if (typeof row.id !== "string" || typeof row.emailNormalized !== "string") return null;
+  if (row.sourceScope !== "local" && row.sourceScope !== "parent") return null;
+  if (row.decision !== "waive_interview" && row.decision !== "require_interview") return null;
+  return row;
+}
+async function findAdmissionGrant(db, targetId, email, now) {
+  const emailNormalized = normalizeAdmissionEmail(email);
+  if (!isAdmissionEmail(emailNormalized)) return null;
+  const result = await db.query({ admissionGrants: { $: { where: { emailNormalized }, limit: 100 } } });
+  const active = rows(result.admissionGrants).map(asGrant).filter((grant) => Boolean(
+    grant && grant.targetId === targetId && grant.active === true && !grant.revokedAt && (!grant.expiresAt || grant.expiresAt > now) && !grant.consumedApplicationId
+  )).sort((a, b) => {
+    const scope = Number(b.sourceScope === "local") - Number(a.sourceScope === "local");
+    return scope || b.createdAt - a.createdAt;
+  });
+  return active[0] ?? null;
+}
+async function hasAdmissionRevision(db, sourceId, targetId, environment) {
+  const where = { sourceId, targetId, environment };
+  if (db.aggregate) {
+    return Number((await db.aggregate("admissionGrantRevisions", { count: true }, { where })).count ?? 0) > 0;
+  }
+  const found = await db.query({ admissionGrantRevisions: {} });
+  return rows(found.admissionGrantRevisions).some((row) => row.sourceId === sourceId && row.targetId === targetId && row.environment === environment);
+}
+async function loadLatestAdmissionRevision(db, sourceId, targetId, environment) {
+  if (!await hasAdmissionRevision(db, sourceId, targetId, environment)) return null;
+  const result = await db.query({ admissionGrantRevisions: { $: {
+    where: { sourceId, targetId, environment },
+    order: { revision: "desc" },
+    limit: 1
+  } } });
+  const row = rows(result.admissionGrantRevisions).sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0];
+  return row ? row : null;
+}
+async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const current = rows((await db.query({ admissionGrants: { $: {
+    where: { sourceScope: "parent", sourceId: document.source.appId, targetId: document.target.chapterId },
+    limit: MAX_GRANTS
+  } } })).admissionGrants);
+  const incomingIds = new Set(document.grants.map((grant) => `admission:parent:${document.source.appId}:${grant.id}`));
+  const ops = [];
+  for (const row of current) {
+    const id4 = String(row.id ?? "");
+    if (id4 && !incomingIds.has(id4)) ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
+      active: false,
+      revokedAt: receivedAt,
+      revokedBy: document.source.actor,
+      updatedAt: receivedAt,
+      updatedBy: document.source.actor
+    } });
+  }
+  for (const grant of document.grants) {
+    const id4 = `admission:parent:${document.source.appId}:${grant.id}`;
+    const existing = current.find((row) => row.id === id4);
+    ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
+      id: id4,
+      sourceGrantId: grant.id,
+      sourceScope: "parent",
+      sourceId: document.source.appId,
+      targetId: document.target.chapterId,
+      email: grant.email,
+      emailNormalized: normalizeAdmissionEmail(grant.email),
+      decision: grant.decision,
+      ...grant.note ? { note: grant.note } : {},
+      ...grant.expiresAt ? { expiresAt: grant.expiresAt } : {},
+      active: true,
+      sourceRevision: document.revision,
+      createdAt: Number(existing?.createdAt ?? receivedAt),
+      createdBy: String(existing?.createdBy ?? document.source.actor),
+      updatedAt: receivedAt,
+      updatedBy: document.source.actor
+    } });
+    const retract = [
+      ...!grant.note && existing?.note !== void 0 ? ["note"] : [],
+      ...grant.expiresAt === void 0 && existing?.expiresAt !== void 0 ? ["expiresAt"] : []
+    ];
+    if (retract.length) ops.push({ t: "retract", ns: "admissionGrants", id: id4, attrs: retract });
+  }
+  if (previous?.active) ops.push({ t: "update", ns: "admissionGrantRevisions", id: previous.id, attrs: { active: false } });
+  const revisionId = `admission-revision:${document.source.appId}:${document.target.environment}:${document.revision}`;
+  ops.push({ t: "update", ns: "admissionGrantRevisions", id: revisionId, attrs: {
+    id: revisionId,
+    sourceId: document.source.appId,
+    targetId: document.target.chapterId,
+    environment: document.target.environment,
+    revision: document.revision,
+    digest,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `admission-grants:${document.source.appId}:${document.target.environment}:${document.revision}:${digest}` });
+}
+
 // src/join-continuation.ts
 function resolveJoinContinuation(input) {
   if (input.status === "approved") return "accepted";
@@ -3059,10 +3135,10 @@ async function syncApplicationToCrm(deps, opts) {
   return recordId;
 }
 async function backfillCrm(deps) {
-  const [appsRes, usersRes] = await Promise.all([
-    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
-    deps.db.query({ $users: { $: { limit: 1e3 } } })
-  ]);
+  const data = await deps.db.query({
+    applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } },
+    $users: { $: { limit: 1e3 } }
+  });
   const seen = /* @__PURE__ */ new Set();
   let synced = 0;
   const errors = [];
@@ -3077,8 +3153,8 @@ async function backfillCrm(deps) {
       errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
     }
   };
-  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
-  for (const u of usersRes.$users ?? []) {
+  for (const a of data.applications ?? []) await run(a, str(a.status));
+  for (const u of data.$users ?? []) {
     if (u.deleted === true) continue;
     await run({ email: u.email, firstName: str(u.name) });
   }