@odla-ai/chapter 0.45.0 → 0.47.0

package/README.md

@@ -811,6 +811,8 @@ export const chapter = defineChapter({
       name: "Example Chapter",
       url: "https://chapter.example.com",
       fields: { person: ["name", "email"] },
+      // Independent consent to compare the chapter's commercial projection.
+      commercialParity: true,
     }],
   },
 });
@@ -900,6 +902,20 @@ removing it changes no customer-facing behavior. The BNF frontend may be down
 while the webhook continues to ingest. Registering a Stripe endpoint and
 enabling production remain separate reviewed operations.
 
+`POST` with `{ command: "reconcile-chapters" }` is a separate, two-sided opt-in
+comparison. A hub target and the matching follower reader must both set
+`commercialParity: true`; neither record browsing nor Stripe shadow mode grants
+it implicitly. The hub signs a `GET /api/network/commercial-parity` request with
+the edge's `network_share_*` secret. The chapter returns only bounded status,
+cancellation, counts, completeness, and domain-separated HMAC-SHA-256 digests of
+application, Stripe customer, and Stripe subscription identifiers. Name, email,
+raw identifiers, and arbitrary application fields never cross the edge. The hub
+compares those digests with its exact Stripe partition and reports chapter-only,
+shadow-only, cancellation, count, unavailable, invalid, and truncation
+exceptions without persisting or changing either side. Chapter application
+status and Stripe subscription status remain distinct vocabularies and are shown
+side by side rather than falsely compared for equality.
+
 For a hub with network targets, the standard admin catalog is Dashboard,
 Network, People, Portfolio, and Settings. Dashboard Overview renders aggregate network
 health; People contains CRM types whose `workspace` is absent or `"people"`;
@@ -934,6 +950,8 @@ export const chapter = defineChapter({
       editableFields: { person: ["name", "email", "phone", "linkedin"] },
       stageTransitions: ["person"],
       admissionGrants: true,
+      // Independent disclosure consent. This may be the reader's only ability.
+      commercialParity: true,
     }],
   },
 });
@@ -1493,8 +1511,10 @@ These bite silently — a smoke test won't catch them:
 - **Bootstrap the first admin according to the selected auth source.** Chapter
   mode defaults to Clerk claims: set the first operator's Clerk
   `public_metadata.role` to `admin`. If that operator also needs the
-  read-only cross-site tier, add their lowercase email to `superAdmins` in odla
-  Studio. Hub mode defaults to table auth: add the first operator's lowercase
+  super-admin tier, prefer `auth: { superAdminSource: "odla" }` and grant their
+  app-scoped role on Database → Users in odla Studio. Existing sites retain the
+  legacy `superAdmins` table until they opt in. Hub mode defaults to table auth:
+  add the first operator's lowercase
   email to `admins` in Studio. Neither allowlist is ever written by a worker
   route or provisioning seed; that is deliberate, so the running app cannot
   grant itself admin. Confirm the result by signing in, not merely by inspecting

package/dist/{copy-context-CIxmneHI.d.ts → copy-context-20WFI5TI.d.ts}

@@ -229,6 +229,10 @@ interface ChapterNetworkTarget {
     /** Allow package-owned desired admission decisions for existing leader CRM
      * people to be delivered to this target. Omitted means default deny. */
     admissionGrants?: boolean;
+    /** Allow this leader to request a PII-free commercial parity snapshot from
+     * this follower. The follower must independently enable the same reader;
+     * omitted means no application or Stripe identifier digest crosses. */
+    commercialParity?: boolean;
 }
 /** One signed peer allowed to browse a privacy-bounded projection of this
  * site's CRM. The follower owns this allowlist; a leader target declaration
@@ -253,6 +257,9 @@ interface ChapterNetworkReader {
     /** Accept signed desired admission decisions from this reader. Independent
      * of record browsing; an admission-only reader may omit `fields`. */
     admissionGrants?: boolean;
+    /** Disclose a bounded, PII-free commercial parity snapshot to this signed
+     * reader. Identifiers leave only as edge-keyed, domain-separated HMACs. */
+    commercialParity?: boolean;
 }
 /** Leader/follower network configuration. A follower needs no code config to
  * receive pushed records. It must explicitly declare `readers` before any peer
@@ -298,6 +305,7 @@ interface ResolvedNetworkTarget {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** A validated follower-owned record projection for one signed reader. */
 interface ResolvedNetworkReader {
@@ -307,6 +315,7 @@ interface ResolvedNetworkReader {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
@@ -449,7 +458,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -461,10 +470,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -474,6 +486,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to

package/dist/index.cjs

@@ -61,6 +61,7 @@ __export(index_exports, {
   brandTokens: () => brandTokens,
   bucketSeries: () => bucketSeries,
   buildBuilderLibraryManifest: () => buildBuilderLibraryManifest,
+  buildChapterCommercialParitySnapshot: () => buildChapterCommercialParitySnapshot,
   buildGroupSeed: () => buildGroupSeed,
   buildTierSeeds: () => buildTierSeeds,
   builderLibraryDigest: () => builderLibraryDigest,
@@ -86,6 +87,7 @@ __export(index_exports, {
   clerkListUsers: () => clerkListUsers,
   clerkSetRole: () => clerkSetRole,
   clerkUserRequest: () => clerkUserRequest,
+  commercialParityDigest: () => commercialParityDigest,
   composeMemberContent: () => composeMemberContent,
   createAdmissionGrantEnvelope: () => createAdmissionGrantEnvelope,
   createBuilderLibraryEnvelope: () => createBuilderLibraryEnvelope,
@@ -158,6 +160,7 @@ __export(index_exports, {
   projectSharedRecord: () => projectSharedRecord,
   promoteBuilderLibraryResource: () => promoteBuilderLibraryResource,
   publicGiftOffers: () => publicGiftOffers,
+  reconcileCommercialParitySnapshot: () => reconcileCommercialParitySnapshot,
   reconcileMeetings: () => reconcileMeetings,
   reconcileStripeSnapshot: () => reconcileStripeSnapshot,
   refundedPatch: () => refundedPatch,
@@ -1012,7 +1015,7 @@ function chapterDb(mode, auth, includeNetworkNotes = false, application = resolv
     }
   }
   if (auth.source === "table") entities.admins = admins;
-  if (auth.superAdmins) entities.superAdmins = superAdmins;
+  if (auth.superAdminSource === "table") entities.superAdmins = superAdmins;
   if (includeNetworkNotes) entities.networkNotes = networkNotes;
   if (includeBuilderLibrary) {
     entities.builderLibraryControls = builderLibraryControls;
@@ -1195,7 +1198,12 @@ function resolveAuth(mode, auth) {
   }
   const adminRole = ladder[ladder.length - 1];
   const superAdmins2 = a.superAdmins ?? source === "claim";
-  return { source, claim, ladder, adminRole, superAdmins: superAdmins2 };
+  const configuredSuperSource = a.superAdminSource ?? "table";
+  if (configuredSuperSource !== "table" && configuredSuperSource !== "odla") {
+    throw new Error(`defineChapter.auth.superAdminSource: must be "table" or "odla" \u2014 got ${JSON.stringify(a.superAdminSource)}`);
+  }
+  const superAdminSource = superAdmins2 ? configuredSuperSource : "none";
+  return { source, claim, ladder, adminRole, superAdmins: superAdmins2, superAdminSource };
 }
 function roleFromClaim(payload, auth) {
   const raw2 = payload[auth.claim];
@@ -1679,8 +1687,8 @@ var APPLICATION_LABELS = {
   state: "State"
 };
 function humanize(id6) {
-  const text5 = id6.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
-  return text5 ? `${text5[0].toUpperCase()}${text5.slice(1)}` : id6;
+  const text6 = id6.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text6 ? `${text6[0].toUpperCase()}${text6.slice(1)}` : id6;
 }
 function applicationDefs(chapter) {
   try {
@@ -1938,7 +1946,8 @@ function resolveNetwork(config, crm) {
       sharedNotes,
       editableFields,
       stageTransitions,
-      ...target.admissionGrants === true ? { admissionGrants: true } : {}
+      ...target.admissionGrants === true ? { admissionGrants: true } : {},
+      ...target.commercialParity === true ? { commercialParity: true } : {}
     });
   }
   const readerIds = /* @__PURE__ */ new Set();
@@ -1953,9 +1962,9 @@ function resolveNetwork(config, crm) {
     readerIds.add(reader.id);
     const readerFields = reader.fields ?? {};
     const entries = Object.entries(readerFields);
-    if (entries.length === 0 && !reader.admissionGrants) {
+    if (entries.length === 0 && !reader.admissionGrants && !reader.commercialParity) {
       throw new Error(
-        `defineChapter.network.readers.${reader.id}.fields: at least one CRM type is required unless this is an admission-only reader`
+        `defineChapter.network.readers.${reader.id}.fields: at least one CRM type is required unless this is an admission-only or commercial-parity reader`
       );
     }
     for (const [type, names] of entries) {
@@ -2013,7 +2022,8 @@ function resolveNetwork(config, crm) {
       sharedNotes,
       editableFields,
       stageTransitions,
-      ...reader.admissionGrants === true ? { admissionGrants: true } : {}
+      ...reader.admissionGrants === true ? { admissionGrants: true } : {},
+      ...reader.commercialParity === true ? { commercialParity: true } : {}
     });
   }
   return { targets, readers };
@@ -2580,6 +2590,149 @@ function reconcileStripeSnapshot(shadow, snapshots, sources) {
   };
 }
 
+// src/network-commercial-parity.ts
+var DIGEST = /^[0-9a-f]{64}$/;
+var MAX_RECORDS = 500;
+var text2 = (value, max = 255) => typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
+function parityMessage(partition, kind, value) {
+  return [
+    "chapter-commercial-parity",
+    "v1",
+    partition.appId,
+    partition.chapterId,
+    partition.environment,
+    partition.dataEnvironment,
+    partition.runtime,
+    kind,
+    value
+  ].join("");
+}
+async function parityKey(secret) {
+  const encoder4 = new TextEncoder();
+  return crypto.subtle.importKey(
+    "raw",
+    encoder4.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+}
+async function digestWithKey(key, partition, kind, value) {
+  const encoder4 = new TextEncoder();
+  const signed = await crypto.subtle.sign("HMAC", key, encoder4.encode(parityMessage(partition, kind, value)));
+  return [...new Uint8Array(signed)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function commercialParityDigest(secret, partition, kind, value) {
+  return digestWithKey(await parityKey(secret), partition, kind, value);
+}
+async function buildChapterCommercialParitySnapshot(input) {
+  const requestedMax = input.maxRecords ?? MAX_RECORDS;
+  const maxRecords = Number.isSafeInteger(requestedMax) ? Math.max(0, Math.min(requestedMax, MAX_RECORDS)) : MAX_RECORDS;
+  const eligible = input.rows.filter((row) => text2(row.id) && (text2(row.stripeCustomerId) || text2(row.stripeSubscriptionId)));
+  const selected2 = eligible.slice(0, maxRecords);
+  const key = await parityKey(input.secret);
+  const records = await Promise.all(selected2.map(async (row) => {
+    const applicationId = text2(row.id);
+    const customerId = text2(row.stripeCustomerId);
+    const subscriptionId = text2(row.stripeSubscriptionId);
+    return {
+      applicationDigest: await digestWithKey(key, input.partition, "application", applicationId),
+      customerDigest: customerId ? await digestWithKey(key, input.partition, "customer", customerId) : null,
+      subscriptionDigest: subscriptionId ? await digestWithKey(key, input.partition, "subscription", subscriptionId) : null,
+      status: text2(row.status, 64),
+      canceled: row.canceled === true
+    };
+  }));
+  records.sort((left, right) => left.applicationDigest.localeCompare(right.applicationDigest));
+  const truncated = input.scanTruncated || eligible.length > maxRecords;
+  return {
+    version: 1,
+    site: { id: input.siteId },
+    partition: input.partition,
+    generatedAt: input.now ?? Date.now(),
+    complete: !truncated,
+    truncated,
+    counts: { scanned: input.scanned, eligible: eligible.length, returned: records.length },
+    records
+  };
+}
+function recordKey(record4) {
+  return `${record4.applicationDigest}:${record4.customerDigest ?? "-"}:${record4.subscriptionDigest ?? "-"}`;
+}
+function validSnapshot(snapshot, source) {
+  const partition = snapshot?.partition;
+  const records = snapshot?.records;
+  if (snapshot?.version !== 1 || snapshot.site?.id !== source.chapterId || !partition || !Array.isArray(records) || records.length > MAX_RECORDS || partition.appId !== source.appId || partition.chapterId !== source.chapterId || partition.environment !== source.environment || partition.dataEnvironment !== source.dataEnvironment || partition.runtime !== source.runtime || typeof snapshot.complete !== "boolean" || typeof snapshot.truncated !== "boolean" || !snapshot.counts) return false;
+  const seen = /* @__PURE__ */ new Set();
+  for (const record4 of records) {
+    if (!DIGEST.test(record4.applicationDigest) || record4.customerDigest !== null && !DIGEST.test(record4.customerDigest) || record4.subscriptionDigest !== null && !DIGEST.test(record4.subscriptionDigest) || record4.status !== null && text2(record4.status, 64) === null || typeof record4.canceled !== "boolean") return false;
+    const key = recordKey(record4);
+    if (seen.has(key)) return false;
+    seen.add(key);
+  }
+  return Number.isSafeInteger(snapshot.counts.scanned) && Number.isSafeInteger(snapshot.counts.eligible) && Number.isSafeInteger(snapshot.counts.returned) && snapshot.counts.returned === records.length && snapshot.counts.scanned >= snapshot.counts.eligible && snapshot.counts.eligible >= snapshot.counts.returned;
+}
+async function reconcileCommercialParitySnapshot(input) {
+  if (!validSnapshot(input.snapshot, input.source)) throw new Error("invalid chapter commercial parity snapshot");
+  const sourceKey = networkCommercialSourceKey(input.source);
+  const key = await parityKey(input.secret);
+  const shadow = await Promise.all(input.projection.subscriptions.filter((row) => row.sourceKey === sourceKey && text2(row.applicationId) && text2(row.objectId)).map(async (row) => {
+    const customerId = text2(row.customerId);
+    const subscriptionId = text2(row.subscriptionId) ?? text2(row.objectId);
+    return {
+      applicationDigest: await digestWithKey(key, input.snapshot.partition, "application", row.applicationId),
+      customerDigest: customerId ? await digestWithKey(key, input.snapshot.partition, "customer", customerId) : null,
+      subscriptionDigest: subscriptionId ? await digestWithKey(key, input.snapshot.partition, "subscription", subscriptionId) : null,
+      status: null,
+      canceled: false,
+      stripeStatus: text2(row.status, 64),
+      stripeCanceled: row.status === "canceled"
+    };
+  }));
+  const chapterByKey = new Map(input.snapshot.records.map((record4) => [recordKey(record4), record4]));
+  const shadowByKey = new Map(shadow.map((record4) => [recordKey(record4), record4]));
+  const exceptions2 = [];
+  const records = [];
+  for (const [key2, chapter] of chapterByKey) {
+    const stripe = shadowByKey.get(key2);
+    if (!stripe) {
+      exceptions2.push({ kind: "chapter_only", applicationDigest: chapter.applicationDigest, detail: { chapterStatus: chapter.status } });
+      continue;
+    }
+    const compared = { ...chapter, stripeStatus: stripe.stripeStatus, stripeCanceled: stripe.stripeCanceled };
+    records.push(compared);
+    if (chapter.canceled !== stripe.stripeCanceled) {
+      exceptions2.push({
+        kind: "cancellation_mismatch",
+        applicationDigest: chapter.applicationDigest,
+        detail: { chapterCanceled: chapter.canceled, stripeCanceled: stripe.stripeCanceled }
+      });
+    }
+  }
+  for (const [key2, stripe] of shadowByKey) {
+    if (!chapterByKey.has(key2)) {
+      exceptions2.push({ kind: "shadow_only", applicationDigest: stripe.applicationDigest, detail: { stripeStatus: stripe.stripeStatus } });
+    }
+  }
+  if (!input.snapshot.complete || input.snapshot.truncated) {
+    exceptions2.push({
+      kind: "chapter_truncated",
+      detail: { scanned: input.snapshot.counts.scanned, eligible: input.snapshot.counts.eligible, returned: input.snapshot.counts.returned }
+    });
+  }
+  if (chapterByKey.size !== shadowByKey.size) {
+    exceptions2.push({ kind: "count_mismatch", detail: { chapter: chapterByKey.size, shadow: shadowByKey.size } });
+  }
+  records.sort((left, right) => left.applicationDigest.localeCompare(right.applicationDigest));
+  return {
+    ok: input.snapshot.complete && exceptions2.length === 0,
+    complete: input.snapshot.complete,
+    counts: { chapter: chapterByKey.size, shadow: shadowByKey.size, matched: records.length },
+    records,
+    exceptions: exceptions2
+  };
+}
+
 // src/leader.ts
 var import_crm3 = require("@odla-ai/crm");
 function leaderCrmConfig(options = {}) {
@@ -2869,6 +3022,7 @@ function createChapterIntegration(chapter, options = {}) {
         path: "/api/network/shared-notes",
         expectedStatus: 401
       }] : [],
+      ...chapter.network.readers.some((reader) => reader.commercialParity) ? [{ path: "/api/network/commercial-parity", expectedStatus: 401 }] : [],
       // Formation metadata is public only when the host explicitly enables
       // the bounded intake contract.
       ...chapter.formation.enabled ? [{ path: "/api/formation/config", expectedStatus: 200 }] : [],
@@ -3228,7 +3382,7 @@ var record2 = (value) => value !== null && typeof value === "object" && !Array.i
 function unknownKeys2(value, allowed2, path, errors) {
   for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
 }
-function text2(value, path, errors, max = MAX_TEXT2, required = true) {
+function text3(value, path, errors, max = MAX_TEXT2, required = true) {
   if (value === void 0 && !required) return void 0;
   if (typeof value !== "string" || required && !value.trim()) {
     errors.push(`${path} must be a non-empty string`);
@@ -3254,7 +3408,7 @@ function scopeValue(value, path, errors) {
     return { kind: raw2.kind };
   }
   if (raw2.kind === "chapter") {
-    const chapterId = text2(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
+    const chapterId = text3(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
     if (chapterId && !APP_ID.test(chapterId)) errors.push(`${path}.chapterId must be a lowercase app slug`);
     return { kind: "chapter", chapterId };
   }
@@ -3268,22 +3422,22 @@ function resourceValue(value, path, errors) {
     return null;
   }
   unknownKeys2(raw2, RESOURCE_KEYS, path, errors);
-  const id6 = text2(raw2.id, `${path}.id`, errors, 80) ?? "";
+  const id6 = text3(raw2.id, `${path}.id`, errors, 80) ?? "";
   if (id6 && !ID2.test(id6)) errors.push(`${path}.id must be lowercase kebab-case`);
-  const kind = text2(raw2.kind, `${path}.kind`, errors) ?? "";
+  const kind = text3(raw2.kind, `${path}.kind`, errors) ?? "";
   if (!KINDS.has(kind)) errors.push(`${path}.kind is unsupported`);
-  const title = text2(raw2.title, `${path}.title`, errors, 240) ?? "";
-  const summary = text2(raw2.summary, `${path}.summary`, errors, 1e3, false);
-  const status = text2(raw2.status, `${path}.status`, errors) ?? "";
+  const title = text3(raw2.title, `${path}.title`, errors, 240) ?? "";
+  const summary = text3(raw2.summary, `${path}.summary`, errors, 1e3, false);
+  const status = text3(raw2.status, `${path}.status`, errors) ?? "";
   if (!STATUSES.has(status)) errors.push(`${path}.status must be draft, published, or archived`);
   const revision = integer2(raw2.revision, `${path}.revision`, errors);
   const scope = scopeValue(raw2.scope, `${path}.scope`, errors) ?? { kind: "global" };
-  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text2(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
+  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text3(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
   if (!Array.isArray(raw2.tags)) errors.push(`${path}.tags must be an array`);
   if (tags.length > MAX_TAGS) errors.push(`${path}.tags may contain at most ${MAX_TAGS} items`);
   if (new Set(tags).size !== tags.length) errors.push(`${path}.tags must be unique`);
-  const bodyMarkdown = text2(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, false);
-  const url = text2(raw2.url, `${path}.url`, errors, 2048, false);
+  const bodyMarkdown = text3(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, false);
+  const url = text3(raw2.url, `${path}.url`, errors, 2048, false);
   if (url) {
     try {
       if (new URL(url).protocol !== "https:") errors.push(`${path}.url must use https`);
@@ -3295,9 +3449,9 @@ function resourceValue(value, path, errors) {
   if (raw2.brandAsset !== void 0 && !asset) errors.push(`${path}.brandAsset must be an object`);
   if (asset) unknownKeys2(asset, ASSET_KEYS, `${path}.brandAsset`, errors);
   const brandAsset = asset ? {
-    bookId: text2(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
-    assetId: text2(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
-    ...asset.filename === void 0 ? {} : { filename: text2(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
+    bookId: text3(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
+    assetId: text3(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
+    ...asset.filename === void 0 ? {} : { filename: text3(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
   } : void 0;
   if ((kind === "document" || kind === "note") && !bodyMarkdown) errors.push(`${path}.bodyMarkdown is required for ${kind}`);
   if ((kind === "link" || kind === "inspiration") && !url) errors.push(`${path}.url is required for ${kind}`);
@@ -3312,17 +3466,17 @@ function resourceValue(value, path, errors) {
   if (provenanceRaw?.promotedFrom !== void 0 && !promotedRaw) errors.push(`${path}.provenance.promotedFrom must be an object`);
   if (promotedRaw) unknownKeys2(promotedRaw, PROMOTION_KEYS, `${path}.provenance.promotedFrom`, errors);
   const promotedFrom = promotedRaw ? {
-    chapterId: text2(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
-    resourceId: text2(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
+    chapterId: text3(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
+    resourceId: text3(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
     resourceRevision: integer2(promotedRaw.resourceRevision, `${path}.provenance.promotedFrom.resourceRevision`, errors),
     documentRevision: integer2(promotedRaw.documentRevision, `${path}.provenance.promotedFrom.documentRevision`, errors),
-    promotedBy: text2(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
+    promotedBy: text3(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
     promotedAt: integer2(promotedRaw.promotedAt, `${path}.provenance.promotedFrom.promotedAt`, errors, 0)
   } : void 0;
   const provenance = {
-    createdBy: text2(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
+    createdBy: text3(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
     createdAt: integer2(provenanceRaw?.createdAt, `${path}.provenance.createdAt`, errors, 0),
-    updatedBy: text2(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
+    updatedBy: text3(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
     updatedAt: integer2(provenanceRaw?.updatedAt, `${path}.provenance.updatedAt`, errors, 0),
     ...promotedFrom ? { promotedFrom } : {}
   };
@@ -3341,7 +3495,7 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (sourceRaw) unknownKeys2(sourceRaw, SOURCE_KEYS2, "document.source", errors);
   const sourceType = sourceRaw?.type;
   if (sourceType !== "chapter" && sourceType !== "built_not_found") errors.push("document.source.type must be chapter or built_not_found");
-  const sourceAppId = text2(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
+  const sourceAppId = text3(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
   if (sourceAppId && !APP_ID.test(sourceAppId)) errors.push("document.source.appId must be a lowercase app slug");
   if (options.sourceType && sourceType !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
   if (options.sourceAppId && sourceAppId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
@@ -3349,8 +3503,8 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (raw2.target !== void 0 && !targetRaw) errors.push("document.target must be an object");
   if (targetRaw) unknownKeys2(targetRaw, TARGET_KEYS2, "document.target", errors);
   const target = targetRaw ? {
-    appId: text2(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
-    environment: text2(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
+    appId: text3(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
+    environment: text3(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
   } : void 0;
   if (options.targetAppId && target?.appId !== options.targetAppId) errors.push(`document.target.appId must be ${options.targetAppId}`);
   if (!Array.isArray(raw2.resources)) errors.push("document.resources must be an array");
@@ -3474,10 +3628,10 @@ function planDelivery(input) {
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
   const to = redirect ? input.group.debugEmail : input.to;
   const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
-  const text5 = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text6 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + render(tpl.text, vars) : render(tpl.text, vars);
-  return { deliver: true, transport, to, subject, text: text5, redirected: redirect };
+  return { deliver: true, transport, to, subject, text: text6, redirected: redirect };
 }
 
 // src/notify.ts
@@ -3883,7 +4037,7 @@ var ID4 = /^[a-z][a-z0-9-]{1,79}$/;
 var PRICE = /^price_[A-Za-z0-9]{12,}$/;
 var CURRENCY = /^[a-z]{3}$/;
 var record3 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var text3 = (value, path, errors, max) => {
+var text4 = (value, path, errors, max) => {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -3911,23 +4065,23 @@ function validateGiftOfferCatalog(input, tierIds) {
     }
     const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
     for (const key of Object.keys(item)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
-    const id6 = text3(item.id, `${path}.id`, errors, 80);
+    const id6 = text4(item.id, `${path}.id`, errors, 80);
     if (id6 && !ID4.test(id6)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (ids.has(id6)) errors.push(`${path}.id duplicates "${id6}"`);
     ids.add(id6);
     const targetRaw = record3(item.target);
     let target = { type: "entitlement", entitlementKey: "invalid" };
     if (targetRaw?.type === "tier") {
-      const tierId = text3(targetRaw.tierId, `${path}.target.tierId`, errors, 80);
+      const tierId = text4(targetRaw.tierId, `${path}.target.tierId`, errors, 80);
       if (!tierIds.has(tierId)) errors.push(`${path}.target.tierId must reference a declared tier`);
       target = { type: "tier", tierId };
     } else if (targetRaw?.type === "entitlement") {
-      const entitlementKey = text3(targetRaw.entitlementKey, `${path}.target.entitlementKey`, errors, 80);
+      const entitlementKey = text4(targetRaw.entitlementKey, `${path}.target.entitlementKey`, errors, 80);
       if (entitlementKey && !ID4.test(entitlementKey)) errors.push(`${path}.target.entitlementKey must be a lowercase kebab-case id`);
       target = { type: "entitlement", entitlementKey };
     } else errors.push(`${path}.target.type must be tier or entitlement`);
     if (item.billingMode !== "one_time" && item.billingMode !== "subscription") errors.push(`${path}.billingMode must be one_time or subscription`);
-    const stripePriceId = text3(item.stripePriceId, `${path}.stripePriceId`, errors, 128);
+    const stripePriceId = text4(item.stripePriceId, `${path}.stripePriceId`, errors, 128);
     if (stripePriceId && !PRICE.test(stripePriceId)) errors.push(`${path}.stripePriceId must be a real Stripe Price id`);
     if (!Number.isSafeInteger(item.priceCents) || Number(item.priceCents) < 1 || Number(item.priceCents) > 1e8) errors.push(`${path}.priceCents must be an integer from 1 to 100,000,000`);
     const currency = typeof item.currency === "string" ? item.currency.trim().toLowerCase() : "";
@@ -3949,9 +4103,9 @@ function validateGiftOfferCatalog(input, tierIds) {
       redemptionLifetimeHours: lifetime,
       ...activeFrom !== void 0 ? { activeFrom } : {},
       ...activeUntil !== void 0 ? { activeUntil } : {},
-      title: text3(item.title, `${path}.title`, errors, 160),
-      description: text3(item.description, `${path}.description`, errors, 2e3),
-      ctaLabel: text3(item.ctaLabel, `${path}.ctaLabel`, errors, 120)
+      title: text4(item.title, `${path}.title`, errors, 160),
+      description: text4(item.description, `${path}.description`, errors, 2e3),
+      ctaLabel: text4(item.ctaLabel, `${path}.ctaLabel`, errors, 120)
     });
   }
   return errors.length ? { ok: false, errors } : { ok: true, value: { schemaVersion: 1, offers } };
@@ -4873,10 +5027,10 @@ function boundedString(value, path, errors, max, required = false) {
     errors.push(`${path} must be a string`);
     return void 0;
   }
-  const text5 = value.trim();
-  if (required && !text5) errors.push(`${path} is required`);
-  if (text5.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
-  return text5;
+  const text6 = value.trim();
+  if (required && !text6) errors.push(`${path} is required`);
+  if (text6.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text6;
 }
 function validateMembershipPageDocument(input, options = {}) {
   const errors = [];
@@ -4925,8 +5079,8 @@ function validateMembershipPageDocument(input, options = {}) {
       else {
         if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
         benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
-          const text5 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
-          return text5 ? [text5] : [];
+          const text6 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text6 ? [text6] : [];
         });
       }
     }
@@ -5025,7 +5179,7 @@ var recordOf = (value) => value !== null && typeof value === "object" && !Array.
 function unknownKeys3(value, allowed2, path, errors) {
   for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
 }
-function text4(value, path, errors, max = 65536) {
+function text5(value, path, errors, max = 65536) {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -5048,11 +5202,11 @@ function tiersOf(value, errors) {
       return [];
     }
     unknownKeys3(item, TIER_KEYS2, path, errors);
-    const id6 = text4(item.id, `${path}.id`, errors, 80);
+    const id6 = text5(item.id, `${path}.id`, errors, 80);
     if (id6 && !TIER.test(id6)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (seen.has(id6)) errors.push(`${path}.id duplicates "${id6}"`);
     seen.add(id6);
-    const name = text4(item.name, `${path}.name`, errors, 160);
+    const name = text5(item.name, `${path}.name`, errors, 160);
     if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
     if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
     if (!Number.isInteger(item.priceCents) || Number(item.priceCents) < 0 || Number(item.priceCents) > 1e8) {
@@ -5064,7 +5218,7 @@ function tiersOf(value, errors) {
     if (item.available === true && Number(item.priceCents) > 0 && !item.stripePriceId) {
       errors.push(`${path}.stripePriceId is required for an available paid tier`);
     }
-    const blurb = item.blurb === void 0 ? void 0 : text4(item.blurb, `${path}.blurb`, errors, 4e3);
+    const blurb = item.blurb === void 0 ? void 0 : text5(item.blurb, `${path}.blurb`, errors, 4e3);
     return [{
       id: id6,
       name,
@@ -5120,7 +5274,7 @@ function policyOf(value, errors) {
   const result = {};
   for (const key of allowed2) {
     if (input[key] === void 0 && key !== "disclaimerText" && key !== "refundPolicyText") continue;
-    result[key] = text4(input[key], `document.policy.${key}`, errors);
+    result[key] = text5(input[key], `document.policy.${key}`, errors);
   }
   return result;
 }
@@ -5158,9 +5312,9 @@ function validateSignupControlDocument(input) {
   if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
   const source = recordOf(root.source);
   const target = recordOf(root.target);
-  const appId = text4(source?.appId, "document.source.appId", errors, 63);
-  const chapterId = text4(target?.chapterId, "document.target.chapterId", errors, 63);
-  const environment = text4(target?.environment, "document.target.environment", errors, 63);
+  const appId = text5(source?.appId, "document.source.appId", errors, 63);
+  const chapterId = text5(target?.chapterId, "document.target.chapterId", errors, 63);
+  const environment = text5(target?.environment, "document.target.environment", errors, 63);
   if (appId && !SLUG9.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
   if (chapterId && !SLUG9.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
   if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
@@ -5204,7 +5358,7 @@ function validateSignupControlDocument(input) {
 var SIGNUP_CONTROL_THEME_MARKER = "<!--odla:signup-control-theme-->";
 var SIGNUP_CONTROL_THEME_STYLE_ID = "odla-signup-control-theme";
 var TOKEN_NAME = /^--ui-[a-z0-9][a-z0-9-]{0,94}$/;
-var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
 var UNSAFE_VALUE = /[\u0000-\u001f\u007f\\<>{};]|\/\*|\*\/|(?:^|[^a-z])(?:url|expression)\s*\(|@import/i;
 var MAX_TOKENS = 256;
 var MAX_VALUE_LENGTH = 1e3;
@@ -5248,7 +5402,7 @@ function stateFor(revision, options) {
       metadata: { source: "bootstrap", revision: null, digest: null, cacheKey: "signup-control:bootstrap" }
     };
   }
-  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1 || !DIGEST.test(revision.digest)) {
+  if (!Number.isSafeInteger(revision.revision) || revision.revision < 1 || !DIGEST2.test(revision.digest)) {
     throw new TypeError("signup-control theme revision metadata is invalid");
   }
   return {
@@ -5337,9 +5491,9 @@ function markdownBenefits(lines, path, errors) {
       errors.push(`${path} line ${index2 + 1} must be a Markdown bullet`);
       continue;
     }
-    const text5 = (match[1] ?? "").trim();
-    if (text5.length > 2e3) errors.push(`${path} line ${index2 + 1} must be at most 2,000 characters`);
-    if (text5) benefits.push(text5);
+    const text6 = (match[1] ?? "").trim();
+    if (text6.length > 2e3) errors.push(`${path} line ${index2 + 1} must be at most 2,000 characters`);
+    if (text6) benefits.push(text6);
   }
   if (benefits.length > MAX_BENEFITS2) errors.push(`${path} supports at most ${MAX_BENEFITS2} entries`);
   return benefits.slice(0, MAX_BENEFITS2);