@odla-ai/chapter 0.42.1 → 0.42.3

package/dist/worker/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/worker.ts
 var worker_exports = {};
 __export(worker_exports, {
+  AdmissionGrantDeliveryError: () => AdmissionGrantDeliveryError,
   chapterWorker: () => chapterWorker,
   createWorkerContext: () => createWorkerContext,
   deliverAdmissionGrants: () => deliverAdmissionGrants,
@@ -27,6 +28,7 @@ __export(worker_exports, {
   deliverMemberContent: () => deliverMemberContent,
   deliverSignupControl: () => deliverSignupControl,
   renderActiveSignupControlHtml: () => renderActiveSignupControlHtml,
+  retryLeaderAdmissionDeliveries: () => retryLeaderAdmissionDeliveries,
   withActiveSignupControlTheme: () => withActiveSignupControlTheme
 });
 module.exports = __toCommonJS(worker_exports);
@@ -640,6 +642,11 @@ function validateAdmissionGrantDocument(input) {
     }
   };
 }
+async function createAdmissionGrantEnvelope(document) {
+  const checked = validateAdmissionGrantDocument(document);
+  if (!checked.ok) throw new TypeError(`Invalid admission grant document: ${checked.errors.join("; ")}`);
+  return { document: checked.value, digest: await signupControlDigest(checked.value) };
+}
 var rows = (value) => Array.isArray(value) ? value : [];
 function asGrant(row) {
   if (typeof row.id !== "string" || typeof row.emailNormalized !== "string") return null;
@@ -3138,12 +3145,17 @@ var import_db5 = require("@odla-ai/db");
 var reject3 = (reason, status, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status);
 var handleAdmissionGrants = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== ADMISSION_GRANTS_PATH) return null;
-  const authority = ctx.chapter.signupControl;
-  if (!authority) return json({ error: "not found" }, 404);
+  const claimedSender = req.headers.get("x-odla-federation-sender") ?? "";
+  const networkReader = ctx.chapter.network.readers.find((reader) => reader.id === claimedSender && reader.admissionGrants);
+  const signupAuthority = ctx.chapter.signupControl?.sourceId === claimedSender ? ctx.chapter.signupControl : void 0;
+  if (!networkReader && !signupAuthority) return json({ error: "not found" }, 404);
   const db = ctx.makeDb(env);
-  const secret = await getVaultSecret(db, authority.secretName);
+  const secret = await getVaultSecret(
+    db,
+    networkReader ? "network_share_secret" : signupAuthority.secretName
+  );
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db5.verifyFederatedRequest)(req, { secret, senders: [authority.sourceId] });
+  const verified = await (0, import_db5.verifyFederatedRequest)(req, { secret, senders: [claimedSender] });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   let input;
   try {
@@ -3155,11 +3167,11 @@ var handleAdmissionGrants = async (req, url, env, ctx) => {
   const checked = validateAdmissionGrantDocument(input.document);
   if (!checked.ok) return reject3("invalid_document", 400, checked.errors);
   const document = checked.value;
-  if (document.source.appId !== authority.sourceId) return reject3("wrong_source", 403);
+  if (document.source.appId !== claimedSender) return reject3("wrong_source", 403);
   if (document.target.chapterId !== ctx.chapter.id) return reject3("wrong_target", 409);
   if (document.target.environment !== env.ODLA_ENV) return reject3("wrong_environment", 409);
   if (!digest || await signupControlDigest(document) !== digest) return reject3("invalid_digest", 400);
-  const latest = await loadLatestAdmissionRevision(db, authority.sourceId, ctx.chapter.id, env.ODLA_ENV);
+  const latest = await loadLatestAdmissionRevision(db, claimedSender, ctx.chapter.id, env.ODLA_ENV);
   if (latest && document.revision < latest.revision) return reject3("stale_revision", 409);
   if (latest && document.revision === latest.revision) {
     if (latest.digest !== digest) return reject3("conflicting_revision", 409);
@@ -3284,6 +3296,384 @@ var handleAdminAdmissionGrants = async (req, url, env, ctx) => {
   return null;
 };
 
+// src/worker-routes-network-admission.ts
+var import_crm6 = require("@odla-ai/crm");
+
+// src/admission-grants-delivery.ts
+var import_db6 = require("@odla-ai/db");
+var AdmissionGrantDeliveryError = class extends Error {
+  constructor(status, reason) {
+    super(`admission grants rejected (${status}): ${reason}`);
+    this.status = status;
+    this.reason = reason;
+    this.name = "AdmissionGrantDeliveryError";
+  }
+  status;
+  reason;
+};
+async function deliverAdmissionGrants(options) {
+  const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await (0, import_db6.signFederatedRequest)({
+    secret: options.secret,
+    sender: options.sender,
+    method: "POST",
+    url: destination,
+    body
+  });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, {
+    method: "POST",
+    headers: { ...signed, "content-type": "application/json" },
+    body
+  });
+  const result = await response.json();
+  if (!response.ok || !("ok" in result) || result.ok !== true) {
+    const failure = result;
+    throw new AdmissionGrantDeliveryError(
+      response.status,
+      failure.reason ?? failure.error ?? "unknown"
+    );
+  }
+  return result;
+}
+
+// src/worker-network-fetch.ts
+var NetworkTargetTransportError = class extends Error {
+  code = "binding_unavailable";
+  binding;
+  constructor(binding) {
+    super(`service binding "${binding}" is unavailable`);
+    this.name = "NetworkTargetTransportError";
+    this.binding = binding;
+  }
+};
+function resolveNetworkTargetTransport(env, target) {
+  if (!target.binding) {
+    return {
+      kind: "url",
+      fetch: (destination, init) => globalThis.fetch(destination, init)
+    };
+  }
+  const candidate = env[target.binding];
+  if (typeof candidate !== "object" || candidate === null || !("fetch" in candidate) || typeof candidate.fetch !== "function") {
+    throw new NetworkTargetTransportError(target.binding);
+  }
+  const binding = candidate;
+  return {
+    kind: "binding",
+    binding: target.binding,
+    // Keep the receiver attached: Cloudflare service bindings require it.
+    fetch: (destination, init) => binding.fetch(new Request(destination, init))
+  };
+}
+function fetchNetworkTarget(env, target, destination, init) {
+  return resolveNetworkTargetTransport(env, target).fetch(destination, init);
+}
+
+// src/worker-network-admission-state.ts
+var import_crm5 = require("@odla-ai/crm");
+var MAX_ASSIGNMENTS = 2e3;
+var admissionRows = (value) => Array.isArray(value) ? value : [];
+function assignmentId(targetId, personId) {
+  return `leader-admission:${targetId}:${personId}`;
+}
+function deliveryId(targetId, environment) {
+  return `leader-admission-delivery:${targetId}:${environment}`;
+}
+async function loadLeaderAdmissionAssignments(db, targetId) {
+  const result = await db.query({ leaderAdmissionAssignments: { $: {
+    where: { targetId },
+    order: { updatedAt: "desc" },
+    limit: MAX_ASSIGNMENTS
+  } } });
+  return admissionRows(result.leaderAdmissionAssignments);
+}
+async function loadLeaderAdmissionDelivery(db, targetId, environment) {
+  const id = deliveryId(targetId, environment);
+  const result = await db.query({ leaderAdmissionDeliveries: { $: { where: { id }, limit: 1 } } });
+  return admissionRows(result.leaderAdmissionDeliveries)[0] ?? null;
+}
+function personAdmissionEmail(ctx, record4) {
+  if (record4.type !== "person") return null;
+  const field = ctx.chapter.crm.config.types.person?.emailField;
+  if (!field) return null;
+  const raw = record4.fields[field] ?? record4.primaryEmail;
+  if (typeof raw !== "string") return null;
+  const normalized = normalizeAdmissionEmail(raw);
+  return isValidEmail(normalized) ? normalized : null;
+}
+async function grantInput(db, ctx, assignment) {
+  const person = await (0, import_crm5.getRecord)({ crm: ctx.chapter.crm, db }, assignment.personId);
+  const email = person ? personAdmissionEmail(ctx, person) : null;
+  if (!email) throw new Error(`person ${assignment.personId} has no valid authoritative email`);
+  return {
+    id: assignment.grantId,
+    email,
+    decision: assignment.decision,
+    ...assignment.note ? { note: assignment.note } : {},
+    ...assignment.expiresAt !== void 0 ? { expiresAt: assignment.expiresAt } : {}
+  };
+}
+async function persistLeaderAdmissionDesiredSet(opts) {
+  const now = Date.now();
+  const current = await loadLeaderAdmissionAssignments(opts.db, opts.target.id);
+  const id = assignmentId(opts.target.id, opts.personId);
+  const existing = current.find((row) => row.id === id);
+  const digest = await signupControlDigest({
+    targetId: opts.target.id,
+    personId: opts.personId,
+    decision: opts.decision,
+    note: opts.note ?? null,
+    expiresAt: opts.expiresAt ?? null,
+    active: opts.active
+  });
+  const mutationReceiptId = `leader-admission-mutation:${opts.target.id}:${opts.mutationId}`;
+  const priorMutation2 = await opts.db.query({ leaderAdmissionMutations: { $: {
+    where: { id: mutationReceiptId },
+    limit: 1
+  } } });
+  const receipt = admissionRows(priorMutation2.leaderAdmissionMutations)[0];
+  if (receipt) {
+    if (receipt.requestDigest !== digest || receipt.personId !== opts.personId) {
+      throw new Error("mutation_conflict");
+    }
+    const saved = await loadLeaderAdmissionDelivery(opts.db, opts.target.id, opts.env.ODLA_ENV);
+    if (!saved) throw new Error("delivery_missing");
+    return { delivery: saved, duplicate: true };
+  }
+  if (existing?.lastMutationId === opts.mutationId) {
+    if (existing.lastRequestDigest !== digest) throw new Error("mutation_conflict");
+    const saved = await loadLeaderAdmissionDelivery(opts.db, opts.target.id, opts.env.ODLA_ENV);
+    if (!saved) throw new Error("delivery_missing");
+    return { delivery: saved, duplicate: true };
+  }
+  const assignment = {
+    id,
+    targetId: opts.target.id,
+    personId: opts.personId,
+    grantId: existing?.grantId ?? crypto.randomUUID().replaceAll("-", ""),
+    decision: opts.decision,
+    ...opts.note ? { note: opts.note } : {},
+    ...opts.expiresAt !== void 0 ? { expiresAt: opts.expiresAt } : {},
+    active: opts.active,
+    lastMutationId: opts.mutationId,
+    lastRequestDigest: digest,
+    createdAt: existing?.createdAt ?? now,
+    createdBy: existing?.createdBy ?? opts.actor,
+    updatedAt: now,
+    updatedBy: opts.actor
+  };
+  const desired = current.filter((row) => row.id !== id && row.active).concat(assignment.active ? [assignment] : []);
+  const grants = await Promise.all(desired.map((row) => grantInput(opts.db, opts.ctx, row)));
+  const previous = await loadLeaderAdmissionDelivery(opts.db, opts.target.id, opts.env.ODLA_ENV);
+  const revision = (previous?.revision ?? 0) + 1;
+  const envelope = await createAdmissionGrantEnvelope({
+    schemaVersion: 1,
+    revision,
+    generatedAt: now,
+    source: { appId: opts.ctx.chapter.id, actor: opts.actor },
+    target: { chapterId: opts.target.id, environment: opts.env.ODLA_ENV },
+    grants
+  });
+  const delivery = {
+    id: deliveryId(opts.target.id, opts.env.ODLA_ENV),
+    targetId: opts.target.id,
+    environment: opts.env.ODLA_ENV,
+    revision,
+    digest: envelope.digest,
+    envelope,
+    status: "saved",
+    attempts: 0,
+    updatedAt: now
+  };
+  const ops = [
+    { t: "update", ns: "leaderAdmissionAssignments", id, attrs: assignment },
+    { t: "update", ns: "leaderAdmissionDeliveries", id: delivery.id, attrs: delivery },
+    { t: "update", ns: "leaderAdmissionMutations", id: mutationReceiptId, attrs: {
+      id: mutationReceiptId,
+      targetId: opts.target.id,
+      personId: opts.personId,
+      requestDigest: digest,
+      revision,
+      createdAt: now
+    } }
+  ];
+  const retract = [
+    ...!opts.note && existing?.note !== void 0 ? ["note"] : [],
+    ...opts.expiresAt === void 0 && existing?.expiresAt !== void 0 ? ["expiresAt"] : []
+  ];
+  if (retract.length) ops.push({ t: "retract", ns: "leaderAdmissionAssignments", id, attrs: retract });
+  const tx = await opts.db.transact(ops, {
+    mutationId: `leader-admission:${opts.target.id}:${opts.mutationId}`,
+    guards: previous ? [{ ns: "leaderAdmissionDeliveries", id: previous.id, exists: true, equals: { revision: previous.revision } }] : [{ ns: "leaderAdmissionDeliveries", id: delivery.id, exists: false }]
+  });
+  return { delivery, duplicate: tx.duplicate };
+}
+
+// src/worker-routes-network-admission.ts
+var PATH = "/api/admin/network/admissions";
+var RETRY_PATH = "/api/admin/network/admissions/retry";
+var REVOKE_PATH = "/api/admin/network/admissions/revoke";
+var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var MAX_NOTE2 = 2e3;
+var reject4 = (status, code, error) => json({ ok: false, code, error }, status);
+async function gate2(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: reject4(401, "unauthorized", "unauthorized") };
+  if (!await ctx.isAdmin(db, user)) return { response: reject4(403, "forbidden", "forbidden") };
+  return { db, user };
+}
+function targetFor(ctx, id) {
+  return ctx.chapter.network.targets.find((target) => target.id === id && target.admissionGrants);
+}
+async function deliverSaved(db, env, ctx, target, delivery) {
+  if (delivery.status === "acknowledged") return delivery;
+  const secret = await getVaultSecret(db, target.secretName);
+  const attemptedAt = Date.now();
+  const attempts = delivery.attempts + 1;
+  let patch;
+  if (!secret) {
+    patch = {
+      status: delivery.attempts > 0 ? "retrying" : "pending",
+      attempts,
+      lastAttemptAt: attemptedAt,
+      lastError: "edge secret is missing",
+      updatedAt: attemptedAt
+    };
+  } else {
+    try {
+      const receipt = await deliverAdmissionGrants({
+        secret,
+        sender: ctx.chapter.id,
+        targetUrl: target.url,
+        envelope: delivery.envelope,
+        fetch: ((input, init) => fetchNetworkTarget(env, target, new URL(String(input)), init ?? {}))
+      });
+      patch = {
+        status: "acknowledged",
+        attempts,
+        lastAttemptAt: attemptedAt,
+        acknowledgedAt: receipt.acknowledgedAt,
+        updatedAt: attemptedAt
+      };
+    } catch (error) {
+      const permanent = error instanceof AdmissionGrantDeliveryError && error.status >= 400 && error.status < 500;
+      patch = {
+        status: permanent ? "rejected" : delivery.attempts > 0 ? "retrying" : "pending",
+        attempts,
+        lastAttemptAt: attemptedAt,
+        lastError: error instanceof Error ? error.message.slice(0, 2e3) : "delivery failed",
+        updatedAt: attemptedAt
+      };
+    }
+  }
+  const ops = [{
+    t: "update",
+    ns: "leaderAdmissionDeliveries",
+    id: delivery.id,
+    attrs: patch
+  }];
+  if (patch.status === "acknowledged" && delivery.lastError) {
+    ops.push({ t: "retract", ns: "leaderAdmissionDeliveries", id: delivery.id, attrs: ["lastError"] });
+  }
+  await db.transact(ops, {
+    mutationId: `leader-admission-attempt:${delivery.targetId}:${delivery.revision}:${attempts}:${patch.status}`
+  });
+  return { ...delivery, ...patch };
+}
+async function parseBody(req) {
+  try {
+    return await req.json();
+  } catch {
+    return null;
+  }
+}
+var handleAdminNetworkAdmissions = async (req, url, env, ctx) => {
+  if (![PATH, RETRY_PATH, REVOKE_PATH].includes(url.pathname)) return null;
+  const auth = await gate2(req, env, ctx);
+  if ("response" in auth) return auth.response;
+  const db = auth.db;
+  if (url.pathname === PATH && req.method === "GET") {
+    const targetId2 = url.searchParams.get("targetId") ?? "";
+    const target2 = targetFor(ctx, targetId2);
+    if (!target2) return reject4(404, "unknown_target", "admission target is not configured");
+    return json({
+      ok: true,
+      target: { id: target2.id, name: target2.name },
+      assignments: await loadLeaderAdmissionAssignments(db, target2.id),
+      delivery: await loadLeaderAdmissionDelivery(db, target2.id, env.ODLA_ENV)
+    });
+  }
+  if (req.method !== "POST") return null;
+  const body = await parseBody(req);
+  if (!body) return reject4(422, "invalid_request", "request body must be JSON");
+  const targetId = typeof body.targetId === "string" ? body.targetId : "";
+  const target = targetFor(ctx, targetId);
+  if (!target) return reject4(404, "unknown_target", "admission target is not configured");
+  if (url.pathname === RETRY_PATH) {
+    const delivery = await loadLeaderAdmissionDelivery(db, target.id, env.ODLA_ENV);
+    if (!delivery) return reject4(404, "not_found", "no saved admission delivery exists");
+    return json({ ok: true, delivery: await deliverSaved(db, env, ctx, target, delivery) });
+  }
+  const personId = typeof body.personId === "string" ? body.personId : "";
+  const mutationId = typeof body.mutationId === "string" ? body.mutationId : "";
+  if (!personId || !MUTATION_ID.test(mutationId)) {
+    return reject4(422, "invalid_request", "personId and a stable mutationId are required");
+  }
+  const person = await (0, import_crm6.getRecord)({ crm: ctx.chapter.crm, db: auth.db }, personId);
+  if (!person) return reject4(404, "person_not_found", "person not found");
+  if (!personAdmissionEmail(ctx, person)) {
+    return reject4(422, "invalid_email", "person has no valid authoritative email");
+  }
+  const decision = body.decision ?? "waive_interview";
+  if (decision !== "waive_interview" && decision !== "require_interview") {
+    return reject4(422, "invalid_decision", "decision must be waive_interview or require_interview");
+  }
+  const note = typeof body.note === "string" ? body.note.trim() : "";
+  if (note.length > MAX_NOTE2) return reject4(422, "invalid_note", "note is too long");
+  const expiresAt = body.expiresAt == null ? void 0 : Number(body.expiresAt);
+  if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= Date.now())) {
+    return reject4(422, "invalid_expiry", "expiresAt must be a future epoch timestamp");
+  }
+  try {
+    const saved = await persistLeaderAdmissionDesiredSet({
+      db,
+      ctx,
+      env,
+      target,
+      personId,
+      decision,
+      ...note ? { note } : {},
+      ...expiresAt !== void 0 ? { expiresAt } : {},
+      active: url.pathname !== REVOKE_PATH,
+      mutationId,
+      actor: auth.user.email ?? auth.user.userId
+    });
+    const delivery = await deliverSaved(db, env, ctx, target, saved.delivery);
+    return json({ ok: true, duplicate: saved.duplicate, delivery }, delivery.status === "acknowledged" ? 200 : 202);
+  } catch (error) {
+    if (error instanceof Error && error.message === "mutation_conflict") {
+      return reject4(409, "mutation_conflict", "mutationId was already used for another request");
+    }
+    if (error instanceof Error && /valid authoritative email/.test(error.message)) {
+      return reject4(422, "invalid_email", error.message);
+    }
+    return reject4(409, "revision_conflict", "admission assignments changed; reload and retry");
+  }
+};
+async function retryLeaderAdmissionDeliveries(env, ctx, limit = 100) {
+  const db = ctx.makeDb(env);
+  const result = await db.query({ leaderAdmissionDeliveries: { $: { limit } } });
+  const pending = admissionRows(result.leaderAdmissionDeliveries).filter((delivery) => delivery.status !== "acknowledged" && delivery.status !== "rejected").slice(0, Math.max(1, Math.min(limit, 500)));
+  const delivered = [];
+  for (const item of pending) {
+    const target = targetFor(ctx, item.targetId);
+    if (target) delivered.push(await deliverSaved(db, env, ctx, target, item));
+  }
+  return delivered;
+}
+
 // src/worker-routes-schedule.ts
 var import_calendar = require("@odla-ai/calendar");
 function errCode(err) {
@@ -4545,16 +4935,16 @@ var crmDeps2 = (db, ctx) => ({
 });
 var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
-  const gate9 = await adminGate(req, env, ctx);
-  if (gate9 instanceof Response) return gate9;
-  const result = await backfillCrm(crmDeps2(gate9.db, ctx));
+  const gate10 = await adminGate(req, env, ctx);
+  if (gate10 instanceof Response) return gate10;
+  const result = await backfillCrm(crmDeps2(gate10.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people") return null;
-  const gate9 = await adminGate(req, env, ctx);
-  if (gate9 instanceof Response) return gate9;
-  const { db } = gate9;
+  const gate10 = await adminGate(req, env, ctx);
+  if (gate10 instanceof Response) return gate10;
+  const { db } = gate10;
   const sk = await getVaultSecret(db, "clerk_secret_key");
   const [data, roleList] = await Promise.all([
     db.query({
@@ -4607,9 +4997,9 @@ var handleAdminPeople = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
-  const gate9 = await adminGate(req, env, ctx);
-  if (gate9 instanceof Response) return gate9;
-  const { db } = gate9;
+  const gate10 = await adminGate(req, env, ctx);
+  if (gate10 instanceof Response) return gate10;
+  const { db } = gate10;
   const targetId = url.searchParams.get("userId") ?? "";
   if (!targetId.startsWith("user_")) return json({ error: "invalid userId" }, 400);
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -4620,9 +5010,9 @@ var handleAdminPeopleAccess = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleRole = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/people/role") return null;
-  const gate9 = await adminGate(req, env, ctx);
-  if (gate9 instanceof Response) return gate9;
-  const { db, actor } = gate9;
+  const gate10 = await adminGate(req, env, ctx);
+  if (gate10 instanceof Response) return gate10;
+  const { db, actor } = gate10;
   let body;
   try {
     body = await req.json();
@@ -4769,7 +5159,7 @@ function subAnnualCents(sub) {
 }
 
 // src/worker-routes-admin-dashboard.ts
-async function gate2(req, env, ctx) {
+async function gate3(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
@@ -4779,7 +5169,7 @@ async function gate2(req, env, ctx) {
 var rows3 = (v) => Array.isArray(v) ? v : [];
 var handleAdminDashboard = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/dashboard") return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const now = Date.now();
@@ -4862,7 +5252,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
 };
 var handleAdminBilling = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/billing") return null;
-  const got = await gate2(req, env, ctx);
+  const got = await gate3(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const sk = await getVaultSecret(db, "stripe_secret_key");
@@ -4922,7 +5312,7 @@ var handleAdminBilling = async (req, url, env, ctx) => {
 
 // src/worker-routes-admin-lifecycle.ts
 var import_calendar3 = require("@odla-ai/calendar");
-async function gate3(req, env, ctx) {
+async function gate4(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
@@ -4948,7 +5338,7 @@ async function loadGroup(db, id) {
 var handleAdminMeetingReschedule = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/meetings\/([0-9a-f-]+)\/reschedule$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const body = await readJson(req);
@@ -4989,7 +5379,7 @@ var handleAdminMeetingReschedule = async (req, url, env, ctx) => {
 var handleAdminMeetingCancel = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/meetings\/([0-9a-f-]+)\/cancel$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const { meetings } = await db.query({ meetings: { $: { where: { id: m[1] }, limit: 1 } } });
@@ -5012,7 +5402,7 @@ var handleAdminMeetingCancel = async (req, url, env, ctx) => {
 var handleAdminApprove = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)\/approve$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const id = m[1];
@@ -5025,7 +5415,7 @@ var handleAdminApprove = async (req, url, env, ctx) => {
 var handleAdminRefund = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)\/refund$/);
   if (req.method !== "POST" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const app = await loadApp(db, m[1]);
@@ -5057,7 +5447,7 @@ var handleAdminRefund = async (req, url, env, ctx) => {
 var handleAdminApplicationPatch = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/applications\/([0-9a-f-]+)$/);
   if (req.method !== "PATCH" || !m) return null;
-  const got = await gate3(req, env, ctx);
+  const got = await gate4(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const id = m[1];
@@ -5085,7 +5475,7 @@ var handleAdminApplicationPatch = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-admin-comms.ts
-async function gate4(req, env, ctx) {
+async function gate5(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
   if (!u) return json({ error: "unauthorized" }, 401);
@@ -5107,7 +5497,7 @@ var notifyDeps = (db, env) => ({
 });
 var handleAdminGroupEmail = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/group/email" || req.method !== "GET" && req.method !== "PUT") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const group = await loadGroup2(db, ctx.chapter.id);
@@ -5169,7 +5559,7 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
 };
 var handleAdminEmailLog = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/email/log") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if (got instanceof Response) return got;
   const { emailLog } = await got.query({ emailLog: { $: { order: { sentAt: "desc" }, limit: 50 } } });
   const sends = (emailLog ?? []).map((r) => ({
@@ -5186,7 +5576,7 @@ var handleAdminEmailLog = async (req, url, env, ctx) => {
 };
 var handleAdminEmailTest = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/email/test") return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   let body;
@@ -5214,7 +5604,7 @@ var handleAdminEmailTest = async (req, url, env, ctx) => {
 var handleAdminComms = async (req, url, env, ctx) => {
   const m = url.pathname.match(/^\/api\/admin\/people\/([0-9a-fA-F-]+)\/comms$/);
   if (req.method !== "GET" || !m) return null;
-  const got = await gate4(req, env, ctx);
+  const got = await gate5(req, env, ctx);
   if (got instanceof Response) return got;
   const db = got;
   const appId = m[1];
@@ -5252,26 +5642,12 @@ var handleAdminComms = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network.ts
-var import_crm6 = require("@odla-ai/crm");
-var import_db7 = require("@odla-ai/db");
-
-// src/worker-network-fetch.ts
-function targetFetcher(env, target) {
-  if (!target.binding) return null;
-  const candidate = env[target.binding];
-  if (typeof candidate !== "object" || candidate === null || !("fetch" in candidate) || typeof candidate.fetch !== "function") {
-    throw new Error(`service binding "${target.binding}" is unavailable`);
-  }
-  return candidate;
-}
-function fetchNetworkTarget(env, target, destination, init) {
-  const binding = targetFetcher(env, target);
-  return binding ? binding.fetch(new Request(destination, init)) : globalThis.fetch(destination, init);
-}
+var import_crm8 = require("@odla-ai/crm");
+var import_db8 = require("@odla-ai/db");
 
 // src/worker-network-push.ts
-var import_crm5 = require("@odla-ai/crm");
-var import_db6 = require("@odla-ai/db");
+var import_crm7 = require("@odla-ai/crm");
+var import_db7 = require("@odla-ai/db");
 async function pushNetworkRecord(db, env, ctx, target, record4) {
   const secret = await getVaultSecret(db, target.secretName);
   const crmDeps3 = {
@@ -5282,7 +5658,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
   };
   if (!secret) {
     const error = `vault secret "${target.secretName}" is missing`;
-    await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
+    await (0, import_crm7.recordDeliveryAttempt)(crmDeps3, {
       recordId: record4.id,
       targetId: target.id,
       status: "failed",
@@ -5305,7 +5681,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
   const payloadBody = JSON.stringify(payload);
   const destination = new URL("/api/network/shared", target.url);
   try {
-    const signed = await (0, import_db6.signFederatedRequest)({
+    const signed = await (0, import_db7.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "POST",
@@ -5321,7 +5697,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
     const responseBody = await res.json().catch(() => ({}));
     if (!res.ok) {
       const error = responseBody.error ?? "follower rejected the record";
-      await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
+      await (0, import_crm7.recordDeliveryAttempt)(crmDeps3, {
         recordId: record4.id,
         targetId: target.id,
         status: "failed",
@@ -5336,7 +5712,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
         error
       };
     }
-    await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
+    await (0, import_crm7.recordDeliveryAttempt)(crmDeps3, {
       recordId: record4.id,
       targetId: target.id,
       status: "delivered",
@@ -5352,7 +5728,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
     };
   } catch (err) {
     const error = err instanceof Error ? err.message : "delivery failed";
-    await (0, import_crm5.recordDeliveryAttempt)(crmDeps3, {
+    await (0, import_crm7.recordDeliveryAttempt)(crmDeps3, {
       recordId: record4.id,
       targetId: target.id,
       status: "failed",
@@ -5364,7 +5740,7 @@ async function pushNetworkRecord(db, env, ctx, target, record4) {
 }
 
 // src/worker-routes-network.ts
-async function gate5(req, env, ctx) {
+async function gate6(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -5373,7 +5749,7 @@ async function gate5(req, env, ctx) {
 }
 var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/network/targets") return null;
-  const got = await gate5(req, env, ctx);
+  const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
   return json({
     targets: ctx.chapter.network.targets.map(({
@@ -5400,31 +5776,55 @@ var handleNetworkSnapshot = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   if (!secret) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db7.verifyFederatedRequest)(req, { secret });
+  const verified = await (0, import_db8.verifyFederatedRequest)(req, { secret });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const types = await Promise.all(
-    Object.keys(ctx.chapter.crm.config.types).map((type) => (0, import_crm6.typeSummary)({ crm: ctx.chapter.crm, db }, type))
+    Object.keys(ctx.chapter.crm.config.types).map((type) => (0, import_crm8.typeSummary)({ crm: ctx.chapter.crm, db }, type))
   );
+  const activeConfiguration = ctx.chapter.signupControl ? await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV) : null;
   const snapshot = {
     version: 1,
     site: { id: ctx.chapter.id, name: ctx.chapter.name, mode: ctx.chapter.mode },
     generatedAt: Date.now(),
+    configuration: {
+      activeRevision: activeConfiguration?.revision ?? null,
+      ...activeConfiguration ? { digest: activeConfiguration.digest } : {}
+    },
     types
   };
   return json(snapshot);
 };
 async function snapshotOne(db, env, ctx, target) {
+  const transportKind = target.binding ? "binding" : "url";
+  const base = {
+    id: target.id,
+    name: target.name,
+    url: target.url,
+    configuration: { activeRevision: null },
+    publicSite: { available: null }
+  };
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return { id: target.id, name: target.name, url: target.url, available: false, error: "edge secret is missing" };
+  if (!secret) return {
+    ...base,
+    available: false,
+    transport: {
+      kind: transportKind,
+      ...target.binding ? { binding: target.binding } : {},
+      reachable: null,
+      error: { code: "edge_secret_missing", message: "edge secret is missing" }
+    },
+    error: "edge secret is missing"
+  };
   const destination = new URL("/api/network/snapshot", target.url);
   try {
-    const headers = await (0, import_db7.signFederatedRequest)({
+    const transport = resolveNetworkTargetTransport(env, target);
+    const headers = await (0, import_db8.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
       url: destination
     });
-    const response = await fetchNetworkTarget(env, target, destination, {
+    const response = await transport.fetch(destination, {
       headers,
       signal: AbortSignal.timeout(1e4)
     });
@@ -5432,34 +5832,53 @@ async function snapshotOne(db, env, ctx, target) {
     if (!response.ok || !body || !("version" in body) || body.version !== 1 || !("site" in body) || body.site.id !== target.id || !Array.isArray(body.types)) {
       const upstream = body && "error" in body && typeof body.error === "string" ? body.error : void 0;
       return {
-        id: target.id,
-        name: target.name,
-        url: target.url,
+        ...base,
         available: false,
+        transport: {
+          kind: transport.kind,
+          ...transport.binding ? { binding: transport.binding } : {},
+          reachable: true
+        },
+        publicSite: { available: transport.kind === "url" ? true : null },
         error: upstream ?? (response.ok ? "invalid follower snapshot" : `follower returned ${response.status}`)
       };
     }
     return {
-      id: target.id,
-      name: target.name,
-      url: target.url,
+      ...base,
       available: true,
+      transport: {
+        kind: transport.kind,
+        ...transport.binding ? { binding: transport.binding } : {},
+        reachable: true
+      },
+      configuration: body.configuration ?? { activeRevision: null },
+      publicSite: { available: transport.kind === "url" ? true : null },
       generatedAt: body.generatedAt,
       types: body.types
     };
   } catch (error) {
+    const bindingError = error instanceof NetworkTargetTransportError;
+    const message = error instanceof Error ? error.message : "snapshot failed";
     return {
-      id: target.id,
-      name: target.name,
-      url: target.url,
+      ...base,
       available: false,
-      error: error instanceof Error ? error.message : "snapshot failed"
+      transport: {
+        kind: transportKind,
+        ...target.binding ? { binding: target.binding } : {},
+        reachable: false,
+        error: {
+          code: bindingError ? "binding_unavailable" : target.binding ? "binding_request_failed" : "url_request_failed",
+          message
+        }
+      },
+      publicSite: { available: target.binding ? null : false },
+      error: message
     };
   }
 }
 var handleAdminNetworkRollup = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/network/rollup") return null;
-  const got = await gate5(req, env, ctx);
+  const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
   const targets = await Promise.all(
     ctx.chapter.network.targets.map((target) => snapshotOne(got.db, env, ctx, target))
@@ -5486,7 +5905,7 @@ var handleAdminNetworkRollup = async (req, url, env, ctx) => {
 };
 var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/network/push") return null;
-  const got = await gate5(req, env, ctx);
+  const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
   let body;
   try {
@@ -5501,7 +5920,7 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (requested.size !== body.targetIds.length) return json({ error: "targetIds must contain unique strings" }, 400);
   const targets = ctx.chapter.network.targets.filter((target) => requested.has(target.id));
   if (targets.length !== requested.size) return json({ error: "one or more targetIds are not configured" }, 400);
-  const record4 = await (0, import_crm6.getRecord)({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
+  const record4 = await (0, import_crm8.getRecord)({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
   if (!record4) return json({ error: "record not found" }, 404);
   const results = await Promise.all(
     targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record4))
@@ -5510,8 +5929,8 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network-records-follower.ts
-var import_crm7 = require("@odla-ai/crm");
-var import_db8 = require("@odla-ai/db");
+var import_crm9 = require("@odla-ai/crm");
+var import_db9 = require("@odla-ai/db");
 
 // src/worker-routes-network-records-common.ts
 var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
@@ -5520,7 +5939,7 @@ var MAX_OFFSET = 1e4;
 var MAX_SEARCH = 200;
 var MAX_BODY = 32768;
 var RECORD_ID = /^[a-zA-Z0-9][a-zA-Z0-9:_-]{0,191}$/;
-var MUTATION_ID = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{7,127}$/;
+var MUTATION_ID2 = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{7,127}$/;
 function bodyTooLarge(body) {
   return new TextEncoder().encode(body).byteLength > MAX_BODY;
 }
@@ -5594,16 +6013,16 @@ function mutationError(error) {
   if (error?.code === "transact_guard_failed") {
     return json({ error: "record changed since it was reviewed", code: "stale_revision" }, 409);
   }
-  if (error instanceof import_crm7.CrmInputError) {
+  if (error instanceof import_crm9.CrmInputError) {
     return json({ error: error.message, code: "invalid_transition_or_fields", ...error.fields ? { fields: error.fields } : {} }, 422);
   }
   return json({ error: "follower mutation failed", code: "mutation_failed" }, 500);
 }
 async function priorMutation(db, id) {
   const result = await db.query({
-    [import_crm7.CRM_NS.activity]: { $: { where: { id }, limit: 1 } }
+    [import_crm9.CRM_NS.activity]: { $: { where: { id }, limit: 1 } }
   });
-  const row = (result[import_crm7.CRM_NS.activity] ?? [])[0];
+  const row = (result[import_crm9.CRM_NS.activity] ?? [])[0];
   const meta = row?.meta;
   const receipt = meta?.[NETWORK_MUTATION_META];
   return typeof receipt?.fingerprint === "string" ? { fingerprint: receipt.fingerprint } : null;
@@ -5617,7 +6036,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db8.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db9.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -5638,7 +6057,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     const hasFields = Boolean(fields && typeof fields === "object" && !Array.isArray(fields));
     const hasStage = typeof input?.stage === "string";
     const actor = input?.actor;
-    if (!input || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID.test(input.mutationId) || !actor || typeof actor.id !== "string" || !RECORD_ID.test(actor.id) || hasFields === hasStage) {
+    if (!input || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID2.test(input.mutationId) || !actor || typeof actor.id !== "string" || !RECORD_ID.test(actor.id) || hasFields === hasStage) {
       return json({ error: "invalid network mutation", code: "invalid_mutation" }, 422);
     }
     const editable = reader.editableFields[input.type];
@@ -5657,7 +6076,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
       if (prior.fingerprint !== fingerprint) {
         return json({ error: "mutationId was already used for different input", code: "mutation_conflict" }, 409);
       }
-      const replayed = await (0, import_crm7.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
+      const replayed = await (0, import_crm9.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
       if (!replayed || replayed.type !== input.type) return json({ error: "record not found", code: "not_found" }, 404);
       const result = {
         version: 1,
@@ -5667,7 +6086,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
       };
       return json(result);
     }
-    const record4 = await (0, import_crm7.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
+    const record4 = await (0, import_crm9.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
     if (!record4 || record4.type !== input.type) return json({ error: "record not found", code: "not_found" }, 404);
     if (record4.updatedAt !== input.expectedRevision) {
       return json({ error: "record changed since it was reviewed", code: "stale_revision" }, 409);
@@ -5688,7 +6107,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     };
     try {
       const deps = { crm: ctx.chapter.crm, db };
-      const updated = hasFields ? await (0, import_crm7.updateRecord)(deps, {
+      const updated = hasFields ? await (0, import_crm9.updateRecord)(deps, {
         id: record4.id,
         input: fields,
         mutationId: activityId,
@@ -5699,7 +6118,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
           authorId: `network:${verified.sender}`,
           meta: auditMeta
         }
-      }) : await (0, import_crm7.setStage)(deps, {
+      }) : await (0, import_crm9.setStage)(deps, {
         id: record4.id,
         to: input.stage,
         authorId: `network:${verified.sender}`,
@@ -5729,7 +6148,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   if (limit == null || offset == null || search.length > MAX_SEARCH) {
     return json({ error: "invalid pagination or search parameters" }, 400);
   }
-  const page = await (0, import_crm7.listRecords)(
+  const page = await (0, import_crm9.listRecords)(
     { crm: ctx.chapter.crm, db },
     {
       type,
@@ -5752,15 +6171,15 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network-records-admin.ts
-var import_db9 = require("@odla-ai/db");
-async function gate6(req, env, ctx) {
+var import_db10 = require("@odla-ai/db");
+async function gate7(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
   if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
   return { db, user };
 }
-function targetFor(ctx, id) {
+function targetFor2(ctx, id) {
   return ctx.chapter.network.targets.find((target) => target.id === id);
 }
 async function readTargetRecords(db, env, ctx, target, query) {
@@ -5769,7 +6188,7 @@ async function readTargetRecords(db, env, ctx, target, query) {
   const destination = new URL("/api/network/records", target.url);
   destination.search = query.toString();
   try {
-    const headers = await (0, import_db9.signFederatedRequest)({ secret, sender: ctx.chapter.id, method: "GET", url: destination });
+    const headers = await (0, import_db10.signFederatedRequest)({ secret, sender: ctx.chapter.id, method: "GET", url: destination });
     const response = await fetchNetworkTarget(env, target, destination, {
       headers,
       signal: AbortSignal.timeout(1e4)
@@ -5805,7 +6224,7 @@ async function mutateTargetRecord(db, env, ctx, target, input) {
   const destination = new URL("/api/network/records", target.url);
   const body = JSON.stringify(input);
   try {
-    const headers = await (0, import_db9.signFederatedRequest)({
+    const headers = await (0, import_db10.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: "PATCH",
@@ -5837,7 +6256,7 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
   if (req.method === "PATCH" && Number(req.headers.get("content-length") ?? 0) > MAX_BODY) {
     return json({ error: "mutation body is too large", code: "body_too_large" }, 413);
   }
-  const got = await gate6(req, env, ctx);
+  const got = await gate7(req, env, ctx);
   if ("response" in got) return got.response;
   if (req.method === "PATCH") {
     let input;
@@ -5850,10 +6269,10 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
     } catch {
       return json({ error: "invalid JSON body", code: "invalid_json" }, 422);
     }
-    const target2 = targetFor(ctx, input?.targetId);
+    const target2 = targetFor2(ctx, input?.targetId);
     const hasFields = Boolean(input?.fields && typeof input.fields === "object" && !Array.isArray(input.fields));
     const hasStage = typeof input?.stage === "string";
-    if (!target2 || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID.test(input.mutationId) || hasFields === hasStage) {
+    if (!target2 || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID2.test(input.mutationId) || hasFields === hasStage) {
       return json({ error: "invalid network mutation", code: "invalid_mutation" }, 422);
     }
     return mutateTargetRecord(got.db, env, ctx, target2, {
@@ -5868,7 +6287,7 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
   }
   const targetId = url.searchParams.get("targetId") ?? "";
   const type = url.searchParams.get("type") ?? "";
-  const target = targetFor(ctx, targetId);
+  const target = targetFor2(ctx, targetId);
   if (!target || !IDENTIFIER.test(type)) return json({ error: "configured targetId and record type are required" }, 400);
   const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
   const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
@@ -5885,8 +6304,8 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
 // src/worker-routes-network-notes.ts
 var IDENTIFIER2 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
-var MAX_NOTE2 = 4e3;
-async function gate7(req, env, ctx) {
+var MAX_NOTE3 = 4e3;
+async function gate8(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -5920,7 +6339,7 @@ function asNote(row) {
 }
 var handleAdminNetworkNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/network/notes" || req.method !== "GET" && req.method !== "POST") return null;
-  const got = await gate7(req, env, ctx);
+  const got = await gate8(req, env, ctx);
   if ("response" in got) return got.response;
   const identity = noteIdentity(url, ctx);
   if (!identity) return json({ error: "valid targetId, type, and recordId are required" }, 400);
@@ -5937,7 +6356,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
     return json({ notes: (result.networkNotes ?? []).map((row) => asNote(row)) });
   }
   const contentLength = Number(req.headers.get("content-length") ?? 0);
-  if (contentLength > MAX_NOTE2 * 2) return json({ error: "note is too large" }, 413);
+  if (contentLength > MAX_NOTE3 * 2) return json({ error: "note is too large" }, 413);
   let input;
   try {
     input = await req.json();
@@ -5945,7 +6364,7 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
     return json({ error: "invalid JSON body" }, 400);
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
-  if (!body || body.length > MAX_NOTE2) return json({ error: `note must be 1\u2013${MAX_NOTE2} characters` }, 400);
+  if (!body || body.length > MAX_NOTE3) return json({ error: `note must be 1\u2013${MAX_NOTE3} characters` }, 400);
   const id = crypto.randomUUID();
   const note = {
     id,
@@ -5967,14 +6386,14 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network-shared-notes.ts
-var import_crm8 = require("@odla-ai/crm");
-var import_db10 = require("@odla-ai/db");
+var import_crm10 = require("@odla-ai/crm");
+var import_db11 = require("@odla-ai/db");
 var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
 var RECORD_ID3 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
-var MUTATION_ID2 = /^[A-Za-z0-9_-]{16,128}$/;
-var MAX_NOTE3 = 4e3;
+var MUTATION_ID3 = /^[A-Za-z0-9_-]{16,128}$/;
+var MAX_NOTE4 = 4e3;
 var NETWORK_META = "chapterNetwork";
-async function gate8(req, env, ctx) {
+async function gate9(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
   if (!user) return { response: json({ error: "unauthorized" }, 401) };
@@ -5997,7 +6416,7 @@ function sharedNote(activity, sourceId) {
 }
 async function listSharedNotes(db, sourceId, recordId) {
   const result = await db.query({
-    [import_crm8.CRM_NS.activity]: {
+    [import_crm10.CRM_NS.activity]: {
       $: {
         where: {
           and: [
@@ -6010,7 +6429,7 @@ async function listSharedNotes(db, sourceId, recordId) {
       }
     }
   });
-  return (result[import_crm8.CRM_NS.activity] ?? []).flatMap((activity) => {
+  return (result[import_crm10.CRM_NS.activity] ?? []).flatMap((activity) => {
     const note = sharedNote(activity, sourceId);
     return note ? [note] : [];
   });
@@ -6020,14 +6439,14 @@ function sourceLabel(sourceId) {
 }
 var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
-  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE3 * 2) {
+  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE4 * 2) {
     return json({ error: "note is too large" }, 413);
   }
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db10.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db11.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -6038,7 +6457,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (!IDENTIFIER3.test(recordType) || !RECORD_ID3.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
     return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
   }
-  const record4 = await (0, import_crm8.getRecord)({ crm: ctx.chapter.crm, db }, recordId);
+  const record4 = await (0, import_crm10.getRecord)({ crm: ctx.chapter.crm, db }, recordId);
   if (!record4 || record4.type !== recordType) return json({ error: "record not found" }, 404);
   if (req.method === "GET") {
     return json({
@@ -6055,12 +6474,12 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const mutationId = typeof input.mutationId === "string" ? input.mutationId : "";
-  if (!body || body.length > MAX_NOTE3 || !MUTATION_ID2.test(mutationId)) {
-    return json({ error: `body must be 1\u2013${MAX_NOTE3} characters and mutationId must be valid` }, 400);
+  if (!body || body.length > MAX_NOTE4 || !MUTATION_ID3.test(mutationId)) {
+    return json({ error: `body must be 1\u2013${MAX_NOTE4} characters and mutationId must be valid` }, 400);
   }
   const createdAt = Date.now();
   const id = `network:${verified.sender}:${mutationId}`;
-  const result = await (0, import_crm8.addActivity)(
+  const result = await (0, import_crm10.addActivity)(
     {
       crm: ctx.chapter.crm,
       db,
@@ -6093,17 +6512,17 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   };
   return json({ version: 1, site: { id: ctx.chapter.id, name: ctx.chapter.name }, note, duplicate: result.duplicate }, 201);
 };
-function targetFor2(ctx, id) {
+function targetFor3(ctx, id) {
   return ctx.chapter.network.targets.find((target) => target.id === id);
 }
 var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   if (url.pathname !== "/api/admin/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
-  const got = await gate8(req, env, ctx);
+  const got = await gate9(req, env, ctx);
   if ("response" in got) return got.response;
   const targetId = url.searchParams.get("targetId") ?? "";
   const recordType = url.searchParams.get("type") ?? "";
   const recordId = url.searchParams.get("recordId") ?? "";
-  const target = targetFor2(ctx, targetId);
+  const target = targetFor3(ctx, targetId);
   if (!target || !target.sharedNotes.includes(recordType) || !IDENTIFIER3.test(recordType) || !RECORD_ID3.test(recordId)) {
     return json({ error: "configured targetId, type, and recordId are required" }, 400);
   }
@@ -6116,7 +6535,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
       return json({ error: "invalid JSON body" }, 400);
     }
     const note = typeof input.body === "string" ? input.body.trim() : "";
-    if (!note || note.length > MAX_NOTE3) return json({ error: `note must be 1\u2013${MAX_NOTE3} characters` }, 400);
+    if (!note || note.length > MAX_NOTE4) return json({ error: `note must be 1\u2013${MAX_NOTE4} characters` }, 400);
     body = JSON.stringify({ body: note, mutationId: crypto.randomUUID() });
   }
   const secret = await getVaultSecret(got.db, target.secretName);
@@ -6124,7 +6543,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   const destination = new URL("/api/network/shared-notes", target.url);
   destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
   try {
-    const headers = await (0, import_db10.signFederatedRequest)({
+    const headers = await (0, import_db11.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: req.method,
@@ -6151,7 +6570,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-formation.ts
-var import_crm9 = require("@odla-ai/crm");
+var import_crm11 = require("@odla-ai/crm");
 var SUBMISSION = /^[A-Za-z0-9_-]{8,128}$/;
 var handleFormation = async (req, url, env, ctx) => {
   const formation = ctx.chapter.formation;
@@ -6203,7 +6622,7 @@ var handleFormation = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const id = submissionId ? await applicationIdForSubmission(`formation:${ctx.chapter.id}:${submissionId}`) : crypto.randomUUID();
   try {
-    const created = await (0, import_crm9.createRecord)(
+    const created = await (0, import_crm11.createRecord)(
       {
         crm: ctx.chapter.crm,
         db,
@@ -6231,7 +6650,7 @@ var handleFormation = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-builder-library.ts
-var import_db11 = require("@odla-ai/db");
+var import_db12 = require("@odla-ai/db");
 
 // src/builder-library-validation.ts
 var ID4 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -6514,7 +6933,7 @@ async function verifySource(req, db, ctx) {
   if (ctx.chapter.mode === "chapter") {
     const secret = await getVaultSecret(db, "network_share_secret");
     if (!secret) return null;
-    const verified = await (0, import_db11.verifyFederatedRequest)(req, {
+    const verified = await (0, import_db12.verifyFederatedRequest)(req, {
       secret,
       senders: sources.map((source2) => source2.sourceId)
     });
@@ -6527,7 +6946,7 @@ async function verifySource(req, db, ctx) {
     if (!target) continue;
     const secret = await getVaultSecret(db, target.secretName);
     if (!secret) continue;
-    const verified = await (0, import_db11.verifyFederatedRequest)(req.clone(), { secret, senders: [source.sourceId] });
+    const verified = await (0, import_db12.verifyFederatedRequest)(req.clone(), { secret, senders: [source.sourceId] });
     if (verified.ok) return { source, body: verified.body };
   }
   return null;
@@ -6716,11 +7135,11 @@ var handleAdminBuilderLibrary = async (req, url, env, ctx) => {
 };
 
 // src/signup-control-delivery.ts
-var import_db12 = require("@odla-ai/db");
+var import_db13 = require("@odla-ai/db");
 async function deliverSignupControl(options) {
   const destination = new URL(SIGNUP_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db12.signFederatedRequest)({
+  const signed = await (0, import_db13.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -6741,11 +7160,11 @@ async function deliverSignupControl(options) {
 }
 
 // src/member-content-delivery.ts
-var import_db13 = require("@odla-ai/db");
+var import_db14 = require("@odla-ai/db");
 async function deliverMemberContent(options) {
   const destination = new URL(MEMBER_CONTENT_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db13.signFederatedRequest)({
+  const signed = await (0, import_db14.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -6766,11 +7185,11 @@ async function deliverMemberContent(options) {
 }
 
 // src/builder-library-delivery.ts
-var import_db14 = require("@odla-ai/db");
+var import_db15 = require("@odla-ai/db");
 async function deliverBuilderLibrary(options) {
   const destination = new URL(BUILDER_LIBRARY_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db14.signFederatedRequest)({ secret: options.secret, sender: options.sender, method: "POST", url: destination, body });
+  const signed = await (0, import_db15.signFederatedRequest)({ secret: options.secret, sender: options.sender, method: "POST", url: destination, body });
   const response = await (options.fetch ?? globalThis.fetch)(destination, { method: "POST", headers: { ...signed, "content-type": "application/json" }, body });
   const result = await response.json();
   if (!response.ok || !("ok" in result) || result.ok !== true) {
@@ -6780,31 +7199,6 @@ async function deliverBuilderLibrary(options) {
   return result;
 }
 
-// src/admission-grants-delivery.ts
-var import_db15 = require("@odla-ai/db");
-async function deliverAdmissionGrants(options) {
-  const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
-  const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db15.signFederatedRequest)({
-    secret: options.secret,
-    sender: options.sender,
-    method: "POST",
-    url: destination,
-    body
-  });
-  const response = await (options.fetch ?? globalThis.fetch)(destination, {
-    method: "POST",
-    headers: { ...signed, "content-type": "application/json" },
-    body
-  });
-  const result = await response.json();
-  if (!response.ok || !("ok" in result) || result.ok !== true) {
-    const failure = result;
-    throw new Error(`admission grants rejected (${response.status}): ${failure.reason ?? failure.error ?? "unknown"}`);
-  }
-  return result;
-}
-
 // src/signup-control-theme.ts
 var SIGNUP_CONTROL_THEME_MARKER = "<!--odla:signup-control-theme-->";
 var SIGNUP_CONTROL_THEME_STYLE_ID = "odla-signup-control-theme";
@@ -6964,6 +7358,7 @@ var BUILTIN_ROUTES = [
   handleAdminPeopleRole,
   handleAdminCrmSync,
   handleAdminAdmissionGrants,
+  handleAdminNetworkAdmissions,
   handleAdminClerkPrivateProfileSync,
   // Aggregation
   handleAdminDashboard,