@odla-ai/chapter 0.43.1 → 0.44.0

package/dist/index.cjs

@@ -168,6 +168,7 @@ __export(index_exports, {
   resolveJoinContinuation: () => resolveJoinContinuation,
   resolveLeaderFormation: () => resolveLeaderFormation,
   resolveMemberContent: () => resolveMemberContent,
+  resolveNetworkPersonRegistry: () => resolveNetworkPersonRegistry,
   resolvePipeline: () => resolvePipeline,
   resolveScheduling: () => resolveScheduling,
   resolveSignupControl: () => resolveSignupControl,
@@ -319,8 +320,8 @@ async function submitApplication(db, chapter, fields, opts) {
   if (app.requireDisclaimerAck && !acked) {
     return { ok: false, error: "disclaimerAck is required" };
   }
-  const id4 = opts.submissionId ? await applicationIdForSubmission(opts.submissionId) : opts.newId();
-  const row = { id: id4, status: chapter.pipeline.initial, createdAt: opts.now };
+  const id5 = opts.submissionId ? await applicationIdForSubmission(opts.submissionId) : opts.newId();
+  const row = { id: id5, status: chapter.pipeline.initial, createdAt: opts.now };
   for (const f of [...app.required, ...app.optional]) {
     if (fieldStates[f]?.visible === false) continue;
     if (typeof fields[f] === "string") row[f] = fields[f].trim();
@@ -344,19 +345,19 @@ async function submitApplication(db, chapter, fields, opts) {
   }
   if (acked) row.disclaimerAckAt = opts.now;
   const ops = [
-    { t: "update", ns: "applications", id: id4, attrs: row }
+    { t: "update", ns: "applications", id: id5, attrs: row }
   ];
   if (opts.admissionGrant?.decision === "waive_interview") {
     ops.push({ t: "update", ns: "admissionGrants", id: opts.admissionGrant.id, attrs: {
       consumedAt: opts.now,
-      consumedApplicationId: id4
+      consumedApplicationId: id5
     } });
   }
   const { duplicate } = await db.transact(
     ops,
     opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
   );
-  return { ok: true, id: id4, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
+  return { ok: true, id: id5, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
 }
 function joinConfig(group, paymentsReady2, tiers2 = [], conditions = {}) {
   return {
@@ -670,6 +671,88 @@ var stripeEventReceiptsEntity = {
   }
 };
 
+// src/schema-network-person.ts
+var string = (flags = {}) => ({
+  type: "string",
+  unique: flags.unique ?? false,
+  indexed: flags.indexed ?? false,
+  optional: flags.optional ?? false
+});
+var number = (flags = {}) => ({
+  type: "number",
+  unique: false,
+  indexed: flags.indexed ?? false,
+  optional: flags.optional ?? false
+});
+var json = (flags = {}) => ({
+  type: "json",
+  unique: false,
+  indexed: false,
+  optional: flags.optional ?? false
+});
+var id3 = () => string({ unique: true, indexed: true });
+var networkPersonsEntity = { attrs: {
+  id: id3(),
+  displayName: string({ indexed: true }),
+  state: string({ indexed: true }),
+  mergedIntoId: string({ indexed: true, optional: true }),
+  contactPolicy: json(),
+  revision: number({ indexed: true }),
+  createdAt: number({ indexed: true }),
+  updatedAt: number({ indexed: true })
+} };
+var networkIdentityClaimsEntity = { attrs: {
+  id: id3(),
+  personId: string({ indexed: true }),
+  kind: string({ indexed: true }),
+  value: string(),
+  hint: string({ optional: true }),
+  verifiedAt: number({ indexed: true }),
+  createdAt: number({ indexed: true })
+} };
+var networkPersonAliasesEntity = { attrs: {
+  id: id3(),
+  sourceSystem: string({ indexed: true }),
+  sourceRecordId: string({ indexed: true }),
+  sourceKey: string({ unique: true, indexed: true }),
+  displayName: string({ indexed: true }),
+  provenance: string(),
+  consent: json(),
+  status: string({ indexed: true }),
+  personId: string({ indexed: true, optional: true }),
+  candidatePersonIds: json({ optional: true }),
+  identityClaims: json(),
+  chapterLinks: json(),
+  revision: number({ indexed: true }),
+  createdAt: number({ indexed: true }),
+  updatedAt: number({ indexed: true })
+} };
+var networkChapterPersonLinksEntity = { attrs: {
+  id: id3(),
+  personId: string({ indexed: true }),
+  chapterId: string({ indexed: true }),
+  chapterPersonId: string({ indexed: true }),
+  state: string({ indexed: true }),
+  createdAt: number({ indexed: true })
+} };
+var networkPersonEventsEntity = { attrs: {
+  id: id3(),
+  kind: string({ indexed: true }),
+  personId: string({ indexed: true, optional: true }),
+  aliasId: string({ indexed: true, optional: true }),
+  actorId: string({ indexed: true }),
+  mutationId: string({ unique: true, indexed: true }),
+  detail: json(),
+  createdAt: number({ indexed: true })
+} };
+var networkPersonEntities = {
+  networkPersons: networkPersonsEntity,
+  networkIdentityClaims: networkIdentityClaimsEntity,
+  networkPersonAliases: networkPersonAliasesEntity,
+  networkChapterPersonLinks: networkChapterPersonLinksEntity,
+  networkPersonEvents: networkPersonEventsEntity
+};
+
 // src/schema.ts
 function attr5(type, flags = {}) {
   return {
@@ -679,10 +762,10 @@ function attr5(type, flags = {}) {
     optional: flags.optional ?? false
   };
 }
-var id3 = () => attr5("string", { unique: true, indexed: true });
+var id4 = () => attr5("string", { unique: true, indexed: true });
 var admins = {
   attrs: {
-    id: id3(),
+    id: id4(),
     email: attr5("string", { unique: true, indexed: true }),
     name: attr5("string", { optional: true }),
     note: attr5("string", { optional: true })
@@ -690,7 +773,7 @@ var admins = {
 };
 var superAdmins = {
   attrs: {
-    id: id3(),
+    id: id4(),
     email: attr5("string", { unique: true, indexed: true }),
     note: attr5("string", { optional: true }),
     createdAt: attr5("number", { indexed: true })
@@ -698,7 +781,7 @@ var superAdmins = {
 };
 var networkNotes = {
   attrs: {
-    id: id3(),
+    id: id4(),
     recordKey: attr5("string", { indexed: true }),
     targetId: attr5("string", { indexed: true }),
     recordType: attr5("string", { indexed: true }),
@@ -711,7 +794,7 @@ var networkNotes = {
 };
 var signupControls = {
   attrs: {
-    id: id3(),
+    id: id4(),
     sourceId: attr5("string", { indexed: true }),
     targetId: attr5("string", { indexed: true }),
     environment: attr5("string", { indexed: true }),
@@ -724,7 +807,7 @@ var signupControls = {
 };
 var memberContentControls = {
   attrs: {
-    id: id3(),
+    id: id4(),
     sourceId: attr5("string", { indexed: true }),
     targetId: attr5("string", { indexed: true }),
     environment: attr5("string", { indexed: true }),
@@ -737,7 +820,7 @@ var memberContentControls = {
 };
 var memberContentLocal = {
   attrs: {
-    id: id3(),
+    id: id4(),
     chapterId: attr5("string", { indexed: true }),
     environment: attr5("string", { indexed: true }),
     revision: attr5("number", { indexed: true }),
@@ -748,7 +831,7 @@ var memberContentLocal = {
 };
 var builderLibraryControls = {
   attrs: {
-    id: id3(),
+    id: id4(),
     sourceId: attr5("string", { indexed: true }),
     targetId: attr5("string", { indexed: true }),
     environment: attr5("string", { indexed: true }),
@@ -761,7 +844,7 @@ var builderLibraryControls = {
 };
 var builderLibraryLocal = {
   attrs: {
-    id: id3(),
+    id: id4(),
     appId: attr5("string", { indexed: true }),
     environment: attr5("string", { indexed: true }),
     revision: attr5("number", { indexed: true }),
@@ -772,7 +855,7 @@ var builderLibraryLocal = {
 };
 var groups = {
   attrs: {
-    id: id3(),
+    id: id4(),
     name: attr5("string"),
     standardPriceCents: attr5("number"),
     foundingDiscountCents: attr5("number"),
@@ -795,7 +878,7 @@ var groups = {
 };
 var tiers = {
   attrs: {
-    id: id3(),
+    id: id4(),
     groupId: attr5("string", { indexed: true }),
     name: attr5("string"),
     priceCents: attr5("number"),
@@ -808,7 +891,7 @@ var tiers = {
 };
 var meetings = {
   attrs: {
-    id: id3(),
+    id: id4(),
     applicationId: attr5("string", { indexed: true }),
     groupId: attr5("string", { indexed: true }),
     startAt: attr5("number", { indexed: true }),
@@ -827,7 +910,7 @@ var meetings = {
 };
 var emailLog = {
   attrs: {
-    id: id3(),
+    id: id4(),
     groupId: attr5("string", { indexed: true }),
     applicationId: attr5("string", { indexed: true, optional: true }),
     to: attr5("string", { indexed: true }),
@@ -842,7 +925,7 @@ var emailLog = {
     sentAt: attr5("number", { indexed: true })
   }
 };
-function chapterDb(mode, auth, includeNetworkNotes = false, application = resolveApplication(void 0), includeSignupControl = false, includeMemberContent = false, includeBuilderLibrary = false, includeLeaderAdmissions = false) {
+function chapterDb(mode, auth, includeNetworkNotes = false, application = resolveApplication(void 0), includeSignupControl = false, includeMemberContent = false, includeBuilderLibrary = false, includeLeaderAdmissions = false, includeNetworkPersonRegistry = false) {
   const entities = {};
   if (mode === "chapter") {
     entities.applications = applicationsFor(application);
@@ -876,6 +959,9 @@ function chapterDb(mode, auth, includeNetworkNotes = false, application = resolv
     entities.leaderAdmissionDeliveries = leaderAdmissionDeliveriesEntity;
     entities.leaderAdmissionMutations = leaderAdmissionMutationsEntity;
   }
+  if (includeNetworkPersonRegistry) {
+    Object.assign(entities, networkPersonEntities);
+  }
   const schema = { entities, links: {} };
   const rules = {};
   for (const ns of Object.keys(entities)) {
@@ -1527,9 +1613,9 @@ var APPLICATION_LABELS = {
   phone: "Phone",
   state: "State"
 };
-function humanize(id4) {
-  const text4 = id4.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
-  return text4 ? `${text4[0].toUpperCase()}${text4.slice(1)}` : id4;
+function humanize(id5) {
+  const text4 = id5.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text4 ? `${text4[0].toUpperCase()}${text4.slice(1)}` : id5;
 }
 function applicationDefs(chapter) {
   try {
@@ -1538,23 +1624,23 @@ function applicationDefs(chapter) {
     return {};
   }
 }
-function applicationType(id4, def) {
+function applicationType(id5, def) {
   if (def && ["string", "email", "url", "enum"].includes(def.type)) return def.type;
-  return id4 === "email" ? "email" : id4 === "linkedin" ? "url" : "string";
+  return id5 === "email" ? "email" : id5 === "linkedin" ? "url" : "string";
 }
 function applicationFlowFields(chapter, application = chapter.application) {
   const defs = applicationDefs(chapter);
-  return [...application.required, ...application.optional].map((id4, order) => {
-    const def = defs[id4];
-    const conditions = application.conditions[id4];
-    const type = applicationType(id4, def);
+  return [...application.required, ...application.optional].map((id5, order) => {
+    const def = defs[id5];
+    const conditions = application.conditions[id5];
+    const type = applicationType(id5, def);
     return {
-      id: id4,
-      label: def?.label ?? APPLICATION_LABELS[id4] ?? humanize(id4),
+      id: id5,
+      label: def?.label ?? APPLICATION_LABELS[id5] ?? humanize(id5),
       type,
-      required: application.required.includes(id4),
+      required: application.required.includes(id5),
       order,
-      maxLength: application.maxLen[id4] ?? application.defaultMaxLen,
+      maxLength: application.maxLen[id5] ?? application.defaultMaxLen,
       ...type === "enum" && def?.options ? { options: [...def.options] } : {},
       ...conditions ? { conditions: { ...conditions } } : {},
       ...type === "email" ? { emailIdentity: "literal" } : {}
@@ -1564,17 +1650,17 @@ function applicationFlowFields(chapter, application = chapter.application) {
 function resolveFormationFlowFields(crm, formation) {
   if (!formation.enabled) return [];
   const def = crm.type(formation.type);
-  return [...formation.required, ...formation.optional].map((id4, order) => {
-    const field = def.fields[id4];
+  return [...formation.required, ...formation.optional].map((id5, order) => {
+    const field = def.fields[id5];
     return {
-      id: id4,
-      label: field.label ?? humanize(id4),
+      id: id5,
+      label: field.label ?? humanize(id5),
       type: field.type,
-      required: formation.required.includes(id4),
+      required: formation.required.includes(id5),
       order,
-      maxLength: formation.maxLen[id4] ?? formation.defaultMaxLen,
+      maxLength: formation.maxLen[id5] ?? formation.defaultMaxLen,
       ...field.options ? { options: [...field.options] } : {},
-      ...id4 === def.emailField || field.type === "email" ? { emailIdentity: "literal" } : {}
+      ...id5 === def.emailField || field.type === "email" ? { emailIdentity: "literal" } : {}
     };
   });
 }
@@ -1868,12 +1954,30 @@ function resolveNetwork(config, crm) {
   return { targets, readers };
 }
 
+// src/config-network-person.ts
+var SLUG2 = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function resolveNetworkPersonRegistry(mode, input, targetIds) {
+  if (!input) return null;
+  if (mode !== "hub") throw new Error("defineChapter.networkPersonRegistry: only hub mode may own network Person authority");
+  if (input.mode !== "shadow") throw new Error('defineChapter.networkPersonRegistry.mode: must be "shadow"');
+  const chapterIds = input.chapterIds ? [...input.chapterIds] : [...targetIds];
+  if (chapterIds.length === 0) throw new Error("defineChapter.networkPersonRegistry.chapterIds: at least one chapter is required");
+  if (new Set(chapterIds).size !== chapterIds.length || chapterIds.some((id5) => !SLUG2.test(id5))) {
+    throw new Error("defineChapter.networkPersonRegistry.chapterIds: expected distinct lowercase slugs");
+  }
+  const unknown = chapterIds.filter((id5) => !targetIds.includes(id5));
+  if (unknown.length) {
+    throw new Error(`defineChapter.networkPersonRegistry.chapterIds: ${unknown.map((id5) => `"${id5}"`).join(", ")} are not configured network targets`);
+  }
+  return { mode: "shadow", chapterIds };
+}
+
 // src/config-signup-control.ts
-var SLUG2 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var SLUG3 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var SECRET_NAME = /^[a-z][a-z0-9_]{1,127}$/;
 function resolveSignupControl(input) {
   if (!input) return null;
-  if (!SLUG2.test(input.sourceId)) {
+  if (!SLUG3.test(input.sourceId)) {
     throw new Error("defineChapter.signupControl.sourceId: must be a lowercase app slug");
   }
   if (input.stripeMode !== "test" && input.stripeMode !== "live") {
@@ -1887,12 +1991,12 @@ function resolveSignupControl(input) {
 }
 
 // src/config-member-content.ts
-var SLUG3 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var SLUG4 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var SECRET_NAME2 = /^[a-z][a-z0-9_]{1,127}$/;
 function resolveMemberContent(input) {
   if (!input) return null;
   const parent = input.parent;
-  if (parent && !SLUG3.test(parent.sourceId)) {
+  if (parent && !SLUG4.test(parent.sourceId)) {
     throw new Error("defineChapter.memberContent.parent.sourceId: must be a lowercase app slug");
   }
   const secretName = parent?.secretName?.trim() || "member_content_control_secret";
@@ -1907,7 +2011,7 @@ function resolveMemberContent(input) {
 }
 
 // src/config-builder-library.ts
-var SLUG4 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var SLUG5 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 function resolveBuilderLibrary(mode, input, network = { targets: [], readers: [] }) {
   if (!input) return null;
   if (input.sources !== void 0 && !Array.isArray(input.sources)) {
@@ -1915,7 +2019,7 @@ function resolveBuilderLibrary(mode, input, network = { targets: [], readers: []
   }
   const seen = /* @__PURE__ */ new Set();
   const sources = (input.sources ?? []).map((source, index) => {
-    if (!source || typeof source !== "object" || !SLUG4.test(source.sourceId)) {
+    if (!source || typeof source !== "object" || !SLUG5.test(source.sourceId)) {
       throw new Error(`defineChapter.builderLibrary.sources[${index}].sourceId: must be a lowercase app slug`);
     }
     if (source.sourceId === "built-not-found" && mode === "hub") {
@@ -1946,15 +2050,15 @@ function resolveBuilderLibrary(mode, input, network = { targets: [], readers: []
 }
 
 // src/config.ts
-var SLUG5 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var SLUG6 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 function isResolvedCrm(x) {
   return !!x && typeof x === "object" && "prepare" in x && typeof x.prepare === "function";
 }
 function defineChapter(config) {
   if (!config || typeof config !== "object") throw new Error("defineChapter: a config object is required");
-  const { id: id4, name } = config;
-  if (typeof id4 !== "string" || !SLUG5.test(id4)) {
-    throw new Error(`defineChapter.id: must be a lowercase slug [a-z0-9-] (2-63 chars) \u2014 got ${JSON.stringify(id4)}`);
+  const { id: id5, name } = config;
+  if (typeof id5 !== "string" || !SLUG6.test(id5)) {
+    throw new Error(`defineChapter.id: must be a lowercase slug [a-z0-9-] (2-63 chars) \u2014 got ${JSON.stringify(id5)}`);
   }
   if (typeof name !== "string" || name.trim() === "") throw new Error("defineChapter.name: a non-empty name is required");
   const mode = config.mode ?? "chapter";
@@ -1977,6 +2081,11 @@ function defineChapter(config) {
   const brand = { ...config.brand, wordmark: config.brand?.wordmark ?? name };
   const copy = resolveChapterCopy(config.copy);
   const network = resolveNetwork(config, crm);
+  const networkPersonRegistry = resolveNetworkPersonRegistry(
+    mode,
+    config.networkPersonRegistry,
+    network.targets.map((target) => target.id)
+  );
   const signupControl = resolveSignupControl(config.signupControl);
   const memberContent = resolveMemberContent(config.memberContent);
   const builderLibrary = resolveBuilderLibrary(mode, config.builderLibrary, network);
@@ -1995,7 +2104,8 @@ function defineChapter(config) {
     Boolean(signupControl),
     Boolean(memberContent),
     Boolean(builderLibrary),
-    network.targets.some((target) => target.admissionGrants)
+    network.targets.some((target) => target.admissionGrants),
+    Boolean(networkPersonRegistry)
   );
   const services = config.services ?? ["db", "calendar", "o11y"];
   const account = config.account ?? "none";
@@ -2045,7 +2155,7 @@ function defineChapter(config) {
   };
   const chapter = {
     config,
-    id: id4,
+    id: id5,
     name,
     mode,
     brand,
@@ -2054,6 +2164,7 @@ function defineChapter(config) {
     signupControl,
     memberContent,
     builderLibrary,
+    networkPersonRegistry,
     formation,
     crm,
     auth,
@@ -2365,7 +2476,8 @@ function createChapterIntegration(chapter, options = {}) {
         { path: "/api/builder-library-control", expectedStatus: 401 },
         { path: "/api/admin/builder-library", expectedStatus: 401 },
         { path: "/api/admin/builder-library/manifest", expectedStatus: 401 }
-      ] : []
+      ] : [],
+      ...chapter.networkPersonRegistry ? [{ path: "/api/admin/network-person-registry", expectedStatus: 401 }] : []
     ],
     runbooks
   };
@@ -2373,7 +2485,7 @@ function createChapterIntegration(chapter, options = {}) {
 
 // src/member-content-validation-helpers.ts
 var ID = /^[a-z][a-z0-9-]{0,79}$/;
-var SLUG6 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SLUG7 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var ROOT_KEYS = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides"]);
 var SOURCE_KEYS = /* @__PURE__ */ new Set(["type", "appId"]);
 var TARGET_KEYS = /* @__PURE__ */ new Set(["chapterId", "environment"]);
@@ -2479,14 +2591,14 @@ function validateMemberContentDocument(input, options = {}) {
       continue;
     }
     unknownKeys(raw, PAGE_KEYS, path, errors);
-    const id4 = textValue(raw.id, `${path}.id`, errors, 80, true) ?? "";
+    const id5 = textValue(raw.id, `${path}.id`, errors, 80, true) ?? "";
     const slug = textValue(raw.slug, `${path}.slug`, errors, 120, true) ?? "";
     const title = textValue(raw.title, `${path}.title`, errors, MAX_TEXT, true) ?? "";
-    if (id4 && !ID.test(id4)) errors.push(`${path}.id must be a lowercase kebab-case id`);
-    if (slug && !SLUG6.test(slug)) errors.push(`${path}.slug must be a lowercase URL slug`);
-    if (ids.has(id4) || knownParentIds.has(id4)) errors.push(`${path}.id duplicates page "${id4}"`);
+    if (id5 && !ID.test(id5)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (slug && !SLUG7.test(slug)) errors.push(`${path}.slug must be a lowercase URL slug`);
+    if (ids.has(id5) || knownParentIds.has(id5)) errors.push(`${path}.id duplicates page "${id5}"`);
     if (slugs.has(slug) || (options.parentPages ?? []).some((page) => page.slug === slug)) errors.push(`${path}.slug duplicates "${slug}"`);
-    ids.add(id4);
+    ids.add(id5);
     slugs.add(slug);
     const navRaw = record(raw.navigation);
     let navigation = { section: "General", order: index };
@@ -2542,7 +2654,7 @@ function validateMemberContentDocument(input, options = {}) {
         else if (owner === "chapter") upsell = { owner, ...offer ? { offer } : {} };
       }
     }
-    pages.push({ id: id4, slug, title, ...summary ? { summary } : {}, navigation, audience, ...teaserMarkdown ? { teaserMarkdown } : {}, bodyMarkdown, ...upsell ? { upsell } : {} });
+    pages.push({ id: id5, slug, title, ...summary ? { summary } : {}, navigation, audience, ...teaserMarkdown ? { teaserMarkdown } : {}, bodyMarkdown, ...upsell ? { upsell } : {} });
   }
   const allIds = /* @__PURE__ */ new Set([...knownParentIds, ...ids]);
   for (const [index, page] of pages.entries()) {
@@ -2748,8 +2860,8 @@ function resourceValue(value, path, errors) {
     return null;
   }
   unknownKeys2(raw, RESOURCE_KEYS, path, errors);
-  const id4 = text(raw.id, `${path}.id`, errors, 80) ?? "";
-  if (id4 && !ID2.test(id4)) errors.push(`${path}.id must be lowercase kebab-case`);
+  const id5 = text(raw.id, `${path}.id`, errors, 80) ?? "";
+  if (id5 && !ID2.test(id5)) errors.push(`${path}.id must be lowercase kebab-case`);
   const kind = text(raw.kind, `${path}.kind`, errors) ?? "";
   if (!KINDS.has(kind)) errors.push(`${path}.kind is unsupported`);
   const title = text(raw.title, `${path}.title`, errors, 240) ?? "";
@@ -2806,7 +2918,7 @@ function resourceValue(value, path, errors) {
     updatedAt: integer(provenanceRaw?.updatedAt, `${path}.provenance.updatedAt`, errors, 0),
     ...promotedFrom ? { promotedFrom } : {}
   };
-  return { id: id4, kind, title, ...summary ? { summary } : {}, tags, scope, status, revision, ...bodyMarkdown ? { bodyMarkdown } : {}, ...url ? { url } : {}, ...brandAsset ? { brandAsset } : {}, provenance };
+  return { id: id5, kind, title, ...summary ? { summary } : {}, tags, scope, status, revision, ...bodyMarkdown ? { bodyMarkdown } : {}, ...url ? { url } : {}, ...brandAsset ? { brandAsset } : {}, provenance };
 }
 function validateBuilderLibraryDocument(value, options = {}) {
   const errors = [];
@@ -2837,7 +2949,7 @@ function validateBuilderLibraryDocument(value, options = {}) {
   const inputs = Array.isArray(raw.resources) ? raw.resources : [];
   if (inputs.length > MAX_RESOURCES) errors.push(`document.resources may contain at most ${MAX_RESOURCES} items`);
   const resources = inputs.map((item, index) => resourceValue(item, `document.resources[${index}]`, errors)).filter(Boolean);
-  const ids = resources.map(({ id: id4 }) => id4);
+  const ids = resources.map(({ id: id5 }) => id5);
   if (new Set(ids).size !== ids.length) errors.push("document.resources ids must be unique");
   for (const resource of resources) {
     if (sourceType === "chapter" && (resource.scope.kind !== "chapter" || resource.scope.chapterId !== sourceAppId)) {
@@ -2992,9 +3104,9 @@ async function sendTemplated(deps, input) {
       error = e instanceof Error ? e.message : String(e);
     }
   }
-  const id4 = deps.newId();
+  const id5 = deps.newId();
   const row = {
-    id: id4,
+    id: id5,
     groupId: input.group.id,
     to: decision.to,
     template: input.template,
@@ -3008,7 +3120,7 @@ async function sendTemplated(deps, input) {
     ...messageId ? { messageId } : {},
     ...error ? { error } : {}
   };
-  await deps.db.transact([{ t: "update", ns: "emailLog", id: id4, attrs: row }], error ? void 0 : { mutationId: `email:${input.dedupeKey}` });
+  await deps.db.transact([{ t: "update", ns: "emailLog", id: id5, attrs: row }], error ? void 0 : { mutationId: `email:${input.dedupeKey}` });
   return error ? { sent: false, reason: error } : { sent: true };
 }
 function emailGroupFrom(row) {
@@ -3196,14 +3308,14 @@ function validateAdmissionGrantDocument(input) {
   const seenEmails = /* @__PURE__ */ new Set();
   for (const [index, raw] of rawGrants.slice(0, MAX_GRANTS).entries()) {
     const grant = raw && typeof raw === "object" ? raw : {};
-    const id4 = typeof grant.id === "string" ? grant.id : "";
+    const id5 = typeof grant.id === "string" ? grant.id : "";
     const email = typeof grant.email === "string" ? grant.email.trim() : "";
     const normalized = normalizeAdmissionEmail(email);
     const decision = grant.decision;
     const note = typeof grant.note === "string" ? grant.note.trim() : void 0;
     const expiresAt = grant.expiresAt === void 0 ? void 0 : Number(grant.expiresAt);
-    if (!ID3.test(id4)) errors.push(`document.grants[${index}].id must be an identifier`);
-    if (seenIds.has(id4)) errors.push(`document.grants repeats id "${id4}"`);
+    if (!ID3.test(id5)) errors.push(`document.grants[${index}].id must be an identifier`);
+    if (seenIds.has(id5)) errors.push(`document.grants repeats id "${id5}"`);
     if (!isAdmissionEmail(normalized)) errors.push(`document.grants[${index}].email must be valid`);
     if (seenEmails.has(normalized)) errors.push(`document.grants repeats email "${normalized}"`);
     if (decision !== "waive_interview" && decision !== "require_interview") {
@@ -3213,10 +3325,10 @@ function validateAdmissionGrantDocument(input) {
     if (expiresAt !== void 0 && (!Number.isFinite(expiresAt) || expiresAt <= 0)) {
       errors.push(`document.grants[${index}].expiresAt must be epoch milliseconds`);
     }
-    seenIds.add(id4);
+    seenIds.add(id5);
     seenEmails.add(normalized);
     grants.push({
-      id: id4,
+      id: id5,
       email,
       decision,
       ...note ? { note } : {},
@@ -3287,8 +3399,8 @@ async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
   const incomingIds = new Set(document.grants.map((grant) => `admission:parent:${document.source.appId}:${grant.id}`));
   const ops = [];
   for (const row of current) {
-    const id4 = String(row.id ?? "");
-    if (id4 && !incomingIds.has(id4)) ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
+    const id5 = String(row.id ?? "");
+    if (id5 && !incomingIds.has(id5)) ops.push({ t: "update", ns: "admissionGrants", id: id5, attrs: {
       active: false,
       revokedAt: receivedAt,
       revokedBy: document.source.actor,
@@ -3297,10 +3409,10 @@ async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
     } });
   }
   for (const grant of document.grants) {
-    const id4 = `admission:parent:${document.source.appId}:${grant.id}`;
-    const existing = current.find((row) => row.id === id4);
-    ops.push({ t: "update", ns: "admissionGrants", id: id4, attrs: {
-      id: id4,
+    const id5 = `admission:parent:${document.source.appId}:${grant.id}`;
+    const existing = current.find((row) => row.id === id5);
+    ops.push({ t: "update", ns: "admissionGrants", id: id5, attrs: {
+      id: id5,
       sourceGrantId: grant.id,
       sourceScope: "parent",
       sourceId: document.source.appId,
@@ -3321,7 +3433,7 @@ async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
       ...!grant.note && existing?.note !== void 0 ? ["note"] : [],
       ...grant.expiresAt === void 0 && existing?.expiresAt !== void 0 ? ["expiresAt"] : []
     ];
-    if (retract.length) ops.push({ t: "retract", ns: "admissionGrants", id: id4, attrs: retract });
+    if (retract.length) ops.push({ t: "retract", ns: "admissionGrants", id: id5, attrs: retract });
   }
   if (previous?.active) ops.push({ t: "update", ns: "admissionGrantRevisions", id: previous.id, attrs: { active: false } });
   const revisionId = `admission-revision:${document.source.appId}:${document.target.environment}:${document.revision}`;
@@ -3391,10 +3503,10 @@ function validateGiftOfferCatalog(input, tierIds) {
     }
     const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
     for (const key of Object.keys(item)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
-    const id4 = text2(item.id, `${path}.id`, errors, 80);
-    if (id4 && !ID4.test(id4)) errors.push(`${path}.id must be a lowercase kebab-case id`);
-    if (ids.has(id4)) errors.push(`${path}.id duplicates "${id4}"`);
-    ids.add(id4);
+    const id5 = text2(item.id, `${path}.id`, errors, 80);
+    if (id5 && !ID4.test(id5)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (ids.has(id5)) errors.push(`${path}.id duplicates "${id5}"`);
+    ids.add(id5);
     const targetRaw = record3(item.target);
     let target = { type: "entitlement", entitlementKey: "invalid" };
     if (targetRaw?.type === "tier") {
@@ -3420,7 +3532,7 @@ function validateGiftOfferCatalog(input, tierIds) {
     if (activeUntil !== void 0 && (!Number.isSafeInteger(activeUntil) || activeUntil < 1)) errors.push(`${path}.activeUntil must be epoch milliseconds`);
     if (activeFrom !== void 0 && activeUntil !== void 0 && activeUntil <= activeFrom) errors.push(`${path}.activeUntil must follow activeFrom`);
     offers.push({
-      id: id4,
+      id: id5,
       target,
       billingMode: item.billingMode,
       stripePriceId,
@@ -3833,9 +3945,9 @@ async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl
   const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
   if (!found.ok) return false;
   const users = await found.json().catch(() => null);
-  const id4 = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
-  if (!id4) return false;
-  return updateClerkUserMetadata(secretKey, id4, input, fetchImpl);
+  const id5 = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
+  if (!id5) return false;
+  return updateClerkUserMetadata(secretKey, id5, input, fetchImpl);
 }
 async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   const { path, body } = clerkUserRequest(input);
@@ -3898,8 +4010,8 @@ async function clerkGetUserByEmail(secretKey, email, fetchImpl = fetch) {
   const user = Array.isArray(data) ? data[0] : void 0;
   return user ? toRecord(user) : null;
 }
-async function clerkGetUser(secretKey, id4, fetchImpl = fetch) {
-  const data = await clerkGet(`/v1/users/${encodeURIComponent(id4)}`, secretKey, fetchImpl).catch(() => null);
+async function clerkGetUser(secretKey, id5, fetchImpl = fetch) {
+  const data = await clerkGet(`/v1/users/${encodeURIComponent(id5)}`, secretKey, fetchImpl).catch(() => null);
   return data ? toRecord(data) : null;
 }
 async function clerkListUsers(secretKey, fetchImpl = fetch) {
@@ -3915,8 +4027,8 @@ async function clerkListUsers(secretKey, fetchImpl = fetch) {
   }
   return out;
 }
-async function clerkSetRole(secretKey, id4, role, fetchImpl = fetch) {
-  const res = await fetchImpl(`${CLERK_API}/v1/users/${encodeURIComponent(id4)}/metadata`, {
+async function clerkSetRole(secretKey, id5, role, fetchImpl = fetch) {
+  const res = await fetchImpl(`${CLERK_API}/v1/users/${encodeURIComponent(id5)}/metadata`, {
     method: "PATCH",
     headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
     body: JSON.stringify({ public_metadata: { role } })
@@ -4482,7 +4594,7 @@ function membershipPageDocument(input, options = {}) {
 }
 
 // src/signup-control-validate.ts
-var SLUG7 = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var SLUG8 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var ENVIRONMENT = /^[a-z][a-z0-9_-]{0,62}$/;
 var TIER = /^[a-z][a-z0-9-]{0,79}$/;
 var PRICE2 = /^price_[A-Za-z0-9]{12,}$/;
@@ -4528,10 +4640,10 @@ function tiersOf(value, errors) {
       return [];
     }
     unknownKeys3(item, TIER_KEYS2, path, errors);
-    const id4 = text3(item.id, `${path}.id`, errors, 80);
-    if (id4 && !TIER.test(id4)) errors.push(`${path}.id must be a lowercase kebab-case id`);
-    if (seen.has(id4)) errors.push(`${path}.id duplicates "${id4}"`);
-    seen.add(id4);
+    const id5 = text3(item.id, `${path}.id`, errors, 80);
+    if (id5 && !TIER.test(id5)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (seen.has(id5)) errors.push(`${path}.id duplicates "${id5}"`);
+    seen.add(id5);
     const name = text3(item.name, `${path}.name`, errors, 160);
     if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
     if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
@@ -4546,7 +4658,7 @@ function tiersOf(value, errors) {
     }
     const blurb = item.blurb === void 0 ? void 0 : text3(item.blurb, `${path}.blurb`, errors, 4e3);
     return [{
-      id: id4,
+      id: id5,
       name,
       available: item.available === true,
       sortOrder: Number(item.sortOrder) || 0,
@@ -4641,8 +4753,8 @@ function validateSignupControlDocument(input) {
   const appId = text3(source?.appId, "document.source.appId", errors, 63);
   const chapterId = text3(target?.chapterId, "document.target.chapterId", errors, 63);
   const environment = text3(target?.environment, "document.target.environment", errors, 63);
-  if (appId && !SLUG7.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
-  if (chapterId && !SLUG7.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
+  if (appId && !SLUG8.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
+  if (chapterId && !SLUG8.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
   if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
   if (target?.stripeMode !== "test" && target?.stripeMode !== "live") errors.push("document.target.stripeMode must be test or live");
   const tiers2 = tiersOf(root.tiers, errors);
@@ -4919,7 +5031,7 @@ var exclusions = (chapterId, paidTierIds) => [
     id: chapterId,
     reason: "provider_identity",
     paths: [
-      ...paidTierIds.map((id4) => `tiers[${id4}].stripePriceId`),
+      ...paidTierIds.map((id5) => `tiers[${id5}].stripePriceId`),
       "groups.stripePublishableKey",
       "applications.stripeCustomerId",
       "applications.stripeSubscriptionId",
@@ -4961,9 +5073,9 @@ async function exportChapterPromotion(input) {
     sourceIds: [`signup-control:${document.revision}`, document.source.appId, document.target.chapterId].sort(),
     receiptDigests: [input.digest]
   };
-  const artifact = (kind, id4, content) => ({
+  const artifact = (kind, id5, content) => ({
     kind,
-    id: id4,
+    id: id5,
     sourceRevision: revision,
     provenance: promotionProvenance,
     content: (0, import_promotion.canonicalPromotionValue)(content)
@@ -5002,7 +5114,7 @@ async function exportChapterPromotion(input) {
 }
 
 // src/member-system-authority.ts
-var rows2 = (group) => group.fields.map((id4) => ({ ...group, id: id4 }));
+var rows2 = (group) => group.fields.map((id5) => ({ ...group, id: id5 }));
 var MEMBER_SYSTEM_AUTHORITY_MATRIX = [
   ...rows2({
     scope: "network",