@odla-ai/chapter 0.47.4 → 0.47.6

package/dist/worker/index.cjs

@@ -375,8 +375,8 @@ function tierPayable(tier, group, hasSecretKey) {
 function byOrder(a, b) {
   return a.sortOrder - b.sortOrder || a.id.localeCompare(b.id);
 }
-function resolveTiers(group, rows6 = []) {
-  const stored = rows6.filter((tier) => tier.active);
+function resolveTiers(group, rows5 = []) {
+  const stored = rows5.filter((tier) => tier.active);
   if (stored.length) return [...stored].sort(byOrder);
   return [{
     id: "standard",
@@ -422,15 +422,15 @@ function rowToTier(row, groupId) {
 }
 async function loadTiers(db, group) {
   const groupId = String(group.id ?? "");
-  let rows6;
+  let rows5;
   try {
-    rows6 = (await db.query({
+    rows5 = (await db.query({
       tiers: { $: { where: { groupId }, order: { sortOrder: "asc" }, limit: 100 } }
     })).tiers;
   } catch {
-    rows6 = void 0;
+    rows5 = void 0;
   }
-  const list = Array.isArray(rows6) ? rows6.map((row) => rowToTier(row, groupId)) : [];
+  const list = Array.isArray(rows5) ? rows5.map((row) => rowToTier(row, groupId)) : [];
   return resolveTiers(group, list);
 }
 async function loadOfferableTiers(db, group, hasSecretKey) {
@@ -1484,27 +1484,27 @@ async function hasSignupControl(db, targetId, environment, active) {
   if (db.aggregate) {
     return Number((await db.aggregate("signupControls", { count: true }, { where })).count ?? 0) > 0;
   }
-  const rows6 = (await db.query({ signupControls: {} })).signupControls;
-  return Array.isArray(rows6) && rows6.some((row) => row.targetId === targetId && row.environment === environment && (!active || row.active === true));
+  const rows5 = (await db.query({ signupControls: {} })).signupControls;
+  return Array.isArray(rows5) && rows5.some((row) => row.targetId === targetId && row.environment === environment && (!active || row.active === true));
 }
 async function loadLatestSignupControl(db, targetId, environment) {
   if (!await hasSignupControl(db, targetId, environment)) return null;
-  const rows6 = (await db.query({ signupControls: { $: {
+  const rows5 = (await db.query({ signupControls: { $: {
     where: { targetId, environment },
     order: { revision: "desc" },
     limit: 1
   } } })).signupControls;
-  const latest = Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  const latest = Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
   return asStored(latest);
 }
 async function loadActiveSignupControl(db, targetId, environment) {
   if (!await hasSignupControl(db, targetId, environment, true)) return null;
-  const rows6 = (await db.query({ signupControls: { $: {
+  const rows5 = (await db.query({ signupControls: { $: {
     where: { targetId, environment, active: true },
     order: { revision: "desc" },
     limit: 1
   } } })).signupControls;
-  const active = Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  const active = Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
   return asStored(active);
 }
 function controlledApplication(base, document) {
@@ -2880,33 +2880,33 @@ var control = (row) => row && row.document && typeof row.document === "object" ?
 var local = (row) => row && row.document && typeof row.document === "object" ? row : null;
 async function exists(db, ns, where) {
   if (db.aggregate) return Number((await db.aggregate(ns, { count: true }, { where })).count ?? 0) > 0;
-  const rows6 = (await db.query({ [ns]: {} }))[ns] ?? [];
-  return rows6.some((row) => Object.entries(where).every(([key, value]) => row[key] === value));
+  const rows5 = (await db.query({ [ns]: {} }))[ns] ?? [];
+  return rows5.some((row) => Object.entries(where).every(([key, value]) => row[key] === value));
 }
 async function loadActiveMemberContentControl(db, targetId, environment) {
   const where = { targetId, environment, active: true };
   if (!await exists(db, "memberContentControls", where)) return null;
-  const rows6 = (await db.query({ memberContentControls: { $: {
+  const rows5 = (await db.query({ memberContentControls: { $: {
     where,
     order: { revision: "desc" },
     limit: 1
   } } })).memberContentControls;
-  return control(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  return control(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLatestMemberContentControl(db, targetId, environment) {
   const where = { targetId, environment };
   if (!await exists(db, "memberContentControls", where)) return null;
-  const rows6 = (await db.query({ memberContentControls: { $: {
+  const rows5 = (await db.query({ memberContentControls: { $: {
     where,
     order: { revision: "desc" },
     limit: 1
   } } })).memberContentControls;
-  return control(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  return control(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLocalMemberContent(db, chapterId, environment) {
   const id = `member-content-local:${environment}`;
-  const rows6 = (await db.query({ memberContentLocal: { $: { where: { id }, limit: 1 } } })).memberContentLocal;
-  return local(Array.isArray(rows6) ? rows6[0] : void 0);
+  const rows5 = (await db.query({ memberContentLocal: { $: { where: { id }, limit: 1 } } })).memberContentLocal;
+  return local(Array.isArray(rows5) ? rows5[0] : void 0);
 }
 async function materializeMemberContentControl(db, envelope, previous, receivedAt) {
   const { document, digest: digest2 } = envelope;
@@ -2961,12 +2961,12 @@ async function groupAndTiers(db, chapterId) {
 }
 async function memberTierId(db, chapterId, email) {
   if (!email) return null;
-  let rows6 = (await db.query({ applications: { $: {
+  let rows5 = (await db.query({ applications: { $: {
     where: { emailNormalized: normalizeAdmissionEmail(email) },
     limit: 20
   } } })).applications;
-  if (!rows6?.length) rows6 = (await db.query({ applications: { $: { where: { email }, limit: 20 } } })).applications;
-  const latest = Array.isArray(rows6) ? [...rows6].filter((row) => String(row.groupId ?? chapterId) === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0] : void 0;
+  if (!rows5?.length) rows5 = (await db.query({ applications: { $: { where: { email }, limit: 20 } } })).applications;
+  const latest = Array.isArray(rows5) ? [...rows5].filter((row) => String(row.groupId ?? chapterId) === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0] : void 0;
   return typeof latest?.tierId === "string" && latest.tierId ? latest.tierId : null;
 }
 async function activeDocuments(db, chapterId, environment) {
@@ -3692,8 +3692,8 @@ function makeCalendar(env) {
 }
 async function firstRow(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows6 = res[ns];
-  return Array.isArray(rows6) ? rows6[0] : void 0;
+  const rows5 = res[ns];
+  return Array.isArray(rows5) ? rows5[0] : void 0;
 }
 async function computeSlots(cal, cfg) {
   const { from, to } = slotWindow(Date.now(), cfg.windowDays);
@@ -4093,8 +4093,8 @@ function createStripeProvider(config) {
       const sk = requireSecret(secretKey);
       const charges = await stripeCall(sk, "GET", "/v1/charges", { customer: input.customerId, limit: 100 });
       if (!charges.ok) fail("charges list", charges);
-      const rows6 = charges.body.data ?? [];
-      const paid = rows6.filter((c) => c.status === "succeeded" && c.refunded !== true);
+      const rows5 = charges.body.data ?? [];
+      const paid = rows5.filter((c) => c.status === "succeeded" && c.refunded !== true);
       const charge = paid[paid.length - 1];
       if (!charge) {
         const err = new Error("no paid charge to refund");
@@ -4202,8 +4202,8 @@ async function issueGiftClaim(db, intent, provider, now) {
     throw new Error("gift issuance conflict");
   }
 }
-function buyerGiftClaims(rows6, now) {
-  return rows6.map((row) => {
+function buyerGiftClaims(rows5, now) {
+  return rows5.map((row) => {
     const stored = String(row.status ?? "pending");
     const status = stored === "pending" && Number(row.codeExpiresAt) <= now ? "expired" : stored;
     return {
@@ -4495,8 +4495,8 @@ function classifyMemberStripeEvent(identity, target, hasProvenLegacyLocalLink) {
 
 // src/stripe-webhook-partition.ts
 var firstRow2 = async (db, ns, q) => {
-  const rows6 = (await db.query({ [ns]: { $: q } }))[ns];
-  return Array.isArray(rows6) ? rows6[0] : void 0;
+  const rows5 = (await db.query({ [ns]: { $: q } }))[ns];
+  return Array.isArray(rows5) ? rows5[0] : void 0;
 };
 var stripeEventDigest = async (rawBody) => {
   const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(rawBody));
@@ -4566,8 +4566,8 @@ async function replayedStripeReceipt(db, eventId, digest2, event) {
 // src/worker-routes-payments.ts
 async function firstRow3(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows6 = res[ns];
-  return Array.isArray(rows6) ? rows6[0] : void 0;
+  const rows5 = res[ns];
+  return Array.isArray(rows5) ? rows5[0] : void 0;
 }
 async function findApplication(db, event) {
   if ("applicationId" in event && event.applicationId) {
@@ -5033,8 +5033,8 @@ async function upcomingEvents(env) {
   const res = await cal.availability.upcoming();
   return res.events.map((e) => ({ eventId: e.eventId, status: e.status, startAt: e.startAt, endAt: e.endAt }));
 }
-function toReconcile(rows6) {
-  return rows6.map((m) => ({
+function toReconcile(rows5) {
+  return rows5.map((m) => ({
     id: String(m.id),
     applicationId: String(m.applicationId),
     googleEventId: typeof m.googleEventId === "string" ? m.googleEventId : null,
@@ -5056,12 +5056,12 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   const query = await db.query({
     meetings: { $: { where: all ? {} : { status: "scheduled" }, order: { startAt: "asc" }, limit: 500 } }
   });
-  let rows6 = Array.isArray(query.meetings) ? query.meetings : [];
-  if (Number.isFinite(from)) rows6 = rows6.filter((m) => Number(m.startAt ?? 0) >= from);
-  if (Number.isFinite(to)) rows6 = rows6.filter((m) => Number(m.startAt ?? 0) <= to);
+  let rows5 = Array.isArray(query.meetings) ? query.meetings : [];
+  if (Number.isFinite(from)) rows5 = rows5.filter((m) => Number(m.startAt ?? 0) >= from);
+  if (Number.isFinite(to)) rows5 = rows5.filter((m) => Number(m.startAt ?? 0) <= to);
   let decisions = [];
   try {
-    decisions = reconcileMeetings(toReconcile(rows6), await upcomingEvents(env), Date.now());
+    decisions = reconcileMeetings(toReconcile(rows5), await upcomingEvents(env), Date.now());
   } catch {
   }
   const patched = /* @__PURE__ */ new Map();
@@ -5088,7 +5088,7 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   };
   const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
   const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  const meetings = rows6.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
+  const meetings = rows5.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
   return json({ meetings, adopted: decisions.length, timezone });
 };
 
@@ -5164,10 +5164,10 @@ var handleAdminPeople = async (req, url, env, ctx) => {
       });
     }
   }
-  const rows6 = [...people.values()].sort(
+  const rows5 = [...people.values()].sort(
     (x, y) => (y.application?.createdAt ?? -1) - (x.application?.createdAt ?? -1)
   );
-  return json({ people: rows6 });
+  return json({ people: rows5 });
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
@@ -6894,6 +6894,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
 // src/network-person-registry.ts
 var TOKEN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
 var CHAPTER_ID = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var FIXTURE_MARKER = /fixture|(?:^|[\s._:-])(dummy|sample|test(?:case)?)(?:$|[\s._:-])/i;
 function normalizeNetworkIdentity(kind, value) {
   const trimmed = value.trim();
   if (kind === "email") return trimmed.toLowerCase();
@@ -6920,6 +6921,9 @@ function validateNetworkPersonImport(input, allowedChapterIds) {
   if (!sourceRecordId || sourceRecordId.length > 200) errors.push("sourceRecordId is required and bounded");
   if (!provenance || provenance.length > 500) errors.push("provenance is required and bounded");
   if (!displayName || displayName.length > 200) errors.push("displayName is required and bounded");
+  if (FIXTURE_MARKER.test(sourceRecordId) || FIXTURE_MARKER.test(displayName)) {
+    errors.push("fixture, test, sample, and dummy rows cannot become network Persons");
+  }
   const rawConsent = raw2.consent && typeof raw2.consent === "object" && !Array.isArray(raw2.consent) ? raw2.consent : {};
   const consentStates = ["unknown", "granted", "denied"];
   const marketing = typeof rawConsent.marketing === "string" ? rawConsent.marketing : "";
@@ -7033,7 +7037,7 @@ function canonicalNetworkPersonId(personId, persons) {
   }
 }
 
-// src/network-person-store.ts
+// src/network-person-store-state.ts
 var NetworkPersonRegistryError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -7041,29 +7045,112 @@ var NetworkPersonRegistryError = class extends Error {
   }
   code;
 };
-var rows4 = (value) => Array.isArray(value) ? value : [];
-async function loadNetworkPersonRegistry(db) {
-  const result = await db.query({
-    networkPersons: { $: { order: { updatedAt: "desc" }, limit: 1e3 } },
-    networkIdentityClaims: { $: { limit: 1e3 } },
-    networkPersonAliases: { $: { order: { updatedAt: "desc" }, limit: 1e3 } },
-    networkChapterPersonLinks: { $: { limit: 1e3 } },
-    networkPersonEvents: { $: { order: { createdAt: "desc" }, limit: 1e3 } }
-  });
-  return {
-    persons: rows4(result.networkPersons),
-    claims: rows4(result.networkIdentityClaims),
-    aliases: rows4(result.networkPersonAliases),
-    links: rows4(result.networkChapterPersonLinks),
-    events: rows4(result.networkPersonEvents)
-  };
-}
-var eventOp = (kind, mutationId, actor, now, detail, ids = {}) => ({
+var networkPersonEventOp = (kind, mutationId, actor, now, detail, ids = {}) => ({
   t: "update",
   ns: "networkPersonEvents",
   id: `network_person_event:${mutationId}`,
   attrs: { id: `network_person_event:${mutationId}`, kind, actorId: actor.id, ...ids, mutationId, detail, createdAt: now }
 });
+var asRows = (value) => Array.isArray(value) ? value : [];
+var MAX_ROWS = 1e4;
+async function boundedRows(db, ns, order2) {
+  const collected = [];
+  const pageSize = 500;
+  for (let offset = 0; offset <= MAX_ROWS; offset += pageSize) {
+    const result = await db.query({ [ns]: { $: { limit: pageSize, offset, ...order2 ? { order: order2 } : {} } } });
+    const page = asRows(result[ns]);
+    collected.push(...page);
+    if (collected.length > MAX_ROWS) {
+      throw new NetworkPersonRegistryError(
+        "registry_too_large",
+        `network Person registry ${ns} exceeds the ${MAX_ROWS.toLocaleString()}-row operational bound`
+      );
+    }
+    if (page.length < pageSize) return collected;
+  }
+  return collected;
+}
+async function loadNetworkPersonRegistry(db) {
+  const [persons, claims, aliases, links, events] = await Promise.all([
+    boundedRows(db, "networkPersons", { updatedAt: "desc" }),
+    boundedRows(db, "networkIdentityClaims"),
+    boundedRows(db, "networkPersonAliases", { updatedAt: "desc" }),
+    boundedRows(db, "networkChapterPersonLinks"),
+    boundedRows(db, "networkPersonEvents", { createdAt: "desc" })
+  ]);
+  return { persons, claims, aliases, links, events };
+}
+
+// src/network-person-link-store.ts
+async function linkNetworkChapterPerson(db, input, mutationId, actor, now = Date.now()) {
+  const state = await loadNetworkPersonRegistry(db);
+  const canonicalId = canonicalNetworkPersonId(input.personId, state.persons);
+  const person = state.persons.find((row) => row.id === input.personId);
+  if (!person || person.state !== "active" || canonicalId !== person.id) {
+    throw new NetworkPersonRegistryError("person_not_active", "link target must be an active canonical Person");
+  }
+  const sourceKey = await networkChapterPersonSourceKey(input.chapterId, input.chapterPersonId);
+  const existingSource = state.links.find((link2) => link2.state === "shadow" && (link2.sourceKey === sourceKey || link2.chapterId === input.chapterId && link2.chapterPersonId === input.chapterPersonId));
+  if (existingSource) {
+    if (existingSource.personId !== person.id) {
+      throw new NetworkPersonRegistryError("source_already_linked", "chapter source row is linked to another Person");
+    }
+    return { person, link: existingSource, replayed: true };
+  }
+  if (person.revision !== input.expectedPersonRevision) {
+    throw new NetworkPersonRegistryError("stale_source_link", "Person changed; reload before linking this source row");
+  }
+  const expectedClaim = await networkIdentityClaim({ kind: "email", value: input.verifiedEmail, verifiedAt: 1 });
+  if (!state.claims.some((claim) => claim.id === expectedClaim.id && claim.personId === person.id && claim.kind === "email")) {
+    throw new NetworkPersonRegistryError("identity_mismatch", "source email is not an exact verified identity on this Person");
+  }
+  const id = await networkChapterLinkId(person.id, input.chapterId, input.chapterPersonId);
+  const previous = state.links.find((link2) => link2.id === id);
+  const link = {
+    id,
+    personId: person.id,
+    chapterId: input.chapterId,
+    chapterPersonId: input.chapterPersonId,
+    sourceKey,
+    state: "shadow",
+    createdAt: previous?.createdAt ?? now
+  };
+  const nextPerson = { ...person, revision: person.revision + 1, updatedAt: now };
+  await db.transact([
+    { t: "update", ns: "networkPersons", id: person.id, attrs: { ...nextPerson } },
+    { t: "update", ns: "networkChapterPersonLinks", id, attrs: { ...link } },
+    networkPersonEventOp("chapter_source_linked", mutationId, actor, now, { chapterId: input.chapterId }, { personId: person.id })
+  ], { mutationId, guards: [
+    { ns: "networkPersons", id: person.id, exists: true, equals: { revision: person.revision, state: "active" } },
+    { ns: "networkChapterPersonLinks", id, exists: Boolean(previous), ...previous ? { equals: { state: "revoked" } } : {} }
+  ] });
+  return { person: nextPerson, link };
+}
+async function unlinkNetworkChapterPerson(db, input, mutationId, actor, now = Date.now()) {
+  const reason = input.reason.trim();
+  if (!reason || reason.length > 500) throw new NetworkPersonRegistryError("invalid_unlink", "a bounded unlink reason is required");
+  const state = await loadNetworkPersonRegistry(db);
+  const person = state.persons.find((row) => row.id === input.personId);
+  const link = state.links.find((row) => row.id === input.linkId && row.personId === input.personId);
+  if (!person || person.state !== "active" || person.revision !== input.expectedPersonRevision || !link || link.state !== "shadow") {
+    throw new NetworkPersonRegistryError("stale_source_unlink", "Person or source link changed; reload before undoing the link");
+  }
+  const nextPerson = { ...person, revision: person.revision + 1, updatedAt: now };
+  const nextLink = { ...link, state: "revoked" };
+  delete nextLink.sourceKey;
+  await db.transact([
+    { t: "update", ns: "networkPersons", id: person.id, attrs: { ...nextPerson } },
+    { t: "update", ns: "networkChapterPersonLinks", id: link.id, attrs: { state: "revoked" } },
+    { t: "retract", ns: "networkChapterPersonLinks", id: link.id, attrs: ["sourceKey"] },
+    networkPersonEventOp("chapter_source_unlinked", mutationId, actor, now, { chapterId: link.chapterId, reason }, { personId: person.id })
+  ], { mutationId, guards: [
+    { ns: "networkPersons", id: person.id, exists: true, equals: { revision: person.revision, state: "active" } },
+    { ns: "networkChapterPersonLinks", id: link.id, exists: true, equals: { state: "shadow", personId: person.id } }
+  ] });
+  return { person: nextPerson, link: nextLink };
+}
+
+// src/network-person-store.ts
 var defaultPolicy = (now, consent) => ({
   marketingSuppressed: consent.marketing !== "granted",
   discretionarySuppressed: consent.discretionary !== "granted",
@@ -7073,7 +7160,8 @@ var isGuardConflict = (error) => error instanceof Error && error.code === "trans
 async function linkOps(personId, links, now) {
   return Promise.all(links.map(async (link) => {
     const id = await networkChapterLinkId(personId, link.chapterId, link.chapterPersonId);
-    return { t: "update", ns: "networkChapterPersonLinks", id, attrs: { id, personId, chapterId: link.chapterId, chapterPersonId: link.chapterPersonId, state: "shadow", createdAt: now } };
+    const sourceKey = await networkChapterPersonSourceKey(link.chapterId, link.chapterPersonId);
+    return { t: "update", ns: "networkChapterPersonLinks", id, attrs: { id, personId, chapterId: link.chapterId, chapterPersonId: link.chapterPersonId, sourceKey, state: "shadow", createdAt: now } };
   }));
 }
 async function ambiguousAlias(db, input, aliasId, claims, candidates, mutationId, actor, now) {
@@ -7095,7 +7183,7 @@ async function ambiguousAlias(db, input, aliasId, claims, candidates, mutationId
   };
   await db.transact([
     { t: "update", ns: "networkPersonAliases", id: alias.id, attrs: { ...alias } },
-    eventOp("import_queued_ambiguous", mutationId, actor, now, { candidateCount: candidates.length, sourceSystem: input.sourceSystem }, { aliasId })
+    networkPersonEventOp("import_queued_ambiguous", mutationId, actor, now, { candidateCount: candidates.length, sourceSystem: input.sourceSystem }, { aliasId })
   ], { mutationId, guards: [{ ns: "networkPersonAliases", id: alias.id, exists: false }] });
   return { status: "ambiguous", alias };
 }
@@ -7131,7 +7219,7 @@ async function importNetworkPerson(db, input, mutationId, actor, now = Date.now(
     { t: "update", ns: "networkPersonAliases", id: aliasId, attrs: { ...alias } },
     ...claimOps,
     ...await linkOps(personId, input.chapterLinks ?? [], now),
-    eventOp("person_imported", mutationId, actor, now, { sourceSystem: input.sourceSystem, identityCount: claims.length }, { personId, aliasId })
+    networkPersonEventOp("person_imported", mutationId, actor, now, { sourceSystem: input.sourceSystem, identityCount: claims.length }, { personId, aliasId })
   ];
   try {
     await db.transact(ops, { mutationId, guards: [
@@ -7153,12 +7241,21 @@ async function reviewNetworkPersonAlias(db, input, mutationId, actor, now = Date
   const state = await loadNetworkPersonRegistry(db);
   const alias = state.aliases.find((row) => row.id === input.aliasId);
   if (!alias) throw new NetworkPersonRegistryError("alias_not_found", "source alias not found");
-  if (alias.revision !== input.expectedRevision || alias.status !== "ambiguous") throw new NetworkPersonRegistryError("stale_review", "source alias changed; reload before reviewing");
+  const expectedStatus = input.decision === "reopen" ? "excluded" : "ambiguous";
+  if (alias.revision !== input.expectedRevision || alias.status !== expectedStatus) throw new NetworkPersonRegistryError("stale_review", "source alias changed; reload before reviewing");
+  if (input.decision === "reopen") {
+    const next2 = { ...alias, status: "ambiguous", revision: alias.revision + 1, updatedAt: now };
+    await db.transact([
+      { t: "update", ns: "networkPersonAliases", id: alias.id, attrs: { ...next2 } },
+      networkPersonEventOp("alias_reopened", mutationId, actor, now, { sourceSystem: alias.sourceSystem }, { aliasId: alias.id })
+    ], { mutationId, guards: [{ ns: "networkPersonAliases", id: alias.id, exists: true, equals: { revision: alias.revision, status: "excluded" } }] });
+    return next2;
+  }
   if (input.decision === "exclude") {
     const next2 = { ...alias, status: "excluded", revision: alias.revision + 1, updatedAt: now };
     await db.transact([
       { t: "update", ns: "networkPersonAliases", id: alias.id, attrs: { ...next2 } },
-      eventOp("alias_excluded", mutationId, actor, now, { sourceSystem: alias.sourceSystem }, { aliasId: alias.id })
+      networkPersonEventOp("alias_excluded", mutationId, actor, now, { sourceSystem: alias.sourceSystem }, { aliasId: alias.id })
     ], { mutationId, guards: [{ ns: "networkPersonAliases", id: alias.id, exists: true, equals: { revision: alias.revision, status: "ambiguous" } }] });
     return next2;
   }
@@ -7174,7 +7271,7 @@ async function reviewNetworkPersonAlias(db, input, mutationId, actor, now = Date
     { t: "retract", ns: "networkPersonAliases", id: alias.id, attrs: ["candidatePersonIds"] },
     ...missing.map((claim) => ({ t: "update", ns: "networkIdentityClaims", id: claim.id, attrs: { ...claim, personId: canonicalId, createdAt: now } })),
     ...await linkOps(canonicalId, alias.chapterLinks, now),
-    eventOp("alias_linked", mutationId, actor, now, { identityCount: alias.identityClaims.length }, { personId: canonicalId, aliasId: alias.id })
+    networkPersonEventOp("alias_linked", mutationId, actor, now, { identityCount: alias.identityClaims.length }, { personId: canonicalId, aliasId: alias.id })
   ], { mutationId, guards: [
     { ns: "networkPersonAliases", id: alias.id, exists: true, equals: { revision: alias.revision, status: "ambiguous" } },
     ...missing.map((claim) => ({ ns: "networkIdentityClaims", id: claim.id, exists: false }))
@@ -7204,7 +7301,7 @@ async function mergeNetworkPersons(db, input, mutationId, actor, now = Date.now(
   await db.transact([
     { t: "update", ns: "networkPersons", id: source.id, attrs: { ...sourceNext } },
     { t: "update", ns: "networkPersons", id: target.id, attrs: { ...targetNext } },
-    eventOp("persons_merged", mutationId, actor, now, { targetPersonId: target.id }, { personId: source.id })
+    networkPersonEventOp("persons_merged", mutationId, actor, now, { targetPersonId: target.id }, { personId: source.id })
   ], { mutationId, guards: [
     { ns: "networkPersons", id: source.id, exists: true, equals: { revision: source.revision, state: "active" } },
     { ns: "networkPersons", id: target.id, exists: true, equals: { revision: target.revision, state: "active" } }
@@ -7220,7 +7317,7 @@ async function unmergeNetworkPerson(db, input, mutationId, actor, now = Date.now
   await db.transact([
     { t: "update", ns: "networkPersons", id: person.id, attrs: { state: "active", revision: next.revision, updatedAt: now } },
     { t: "retract", ns: "networkPersons", id: person.id, attrs: ["mergedIntoId"] },
-    eventOp("person_unmerged", mutationId, actor, now, {}, { personId: person.id })
+    networkPersonEventOp("person_unmerged", mutationId, actor, now, {}, { personId: person.id })
   ], { mutationId, guards: [{ ns: "networkPersons", id: person.id, exists: true, equals: { revision: person.revision, state: "merged", mergedIntoId: person.mergedIntoId } }] });
   return next;
 }
@@ -7234,50 +7331,257 @@ async function suppressNetworkPerson(db, input, mutationId, actor, now = Date.no
   const next = { ...person, contactPolicy: policy, revision: person.revision + 1, updatedAt: now };
   await db.transact([
     { t: "update", ns: "networkPersons", id: person.id, attrs: { ...next } },
-    eventOp("contact_suppression_changed", mutationId, actor, now, { marketingSuppressed: policy.marketingSuppressed, discretionarySuppressed: policy.discretionarySuppressed }, { personId: person.id })
+    networkPersonEventOp("contact_suppression_changed", mutationId, actor, now, { marketingSuppressed: policy.marketingSuppressed, discretionarySuppressed: policy.discretionarySuppressed }, { personId: person.id })
   ], { mutationId, guards: [{ ns: "networkPersons", id: person.id, exists: true, equals: { revision: person.revision } }] });
   return next;
 }
 
-// src/network-person-reveal.ts
-async function revealNetworkPersonRegistryRecord(db, input, mutationId, actor, now = Date.now()) {
-  const reason = input.reason.trim();
-  if (!reason || reason.length > 500) {
-    throw new NetworkPersonRegistryError("invalid_reveal", "a bounded reveal reason is required");
+// src/network-person-bulk-preview.ts
+var NETWORK_PERSON_BULK_IMPORT_MAX_ROWS = 5e3;
+var NETWORK_PERSON_BULK_IMPORT_VERSION = 1;
+var networkPersonBulkEmptyCounts = () => ({
+  new: 0,
+  replay: 0,
+  exactMatchReview: 0,
+  invalid: 0,
+  rejected: 0,
+  failed: 0
+});
+var incrementNetworkPersonBulkCount = (counts, status) => {
+  if (status === "exact_match_review") counts.exactMatchReview += 1;
+  else counts[status] += 1;
+};
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stableValue(item)]));
+  }
+  return value;
+}
+async function networkPersonBulkSha256(value) {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return [...new Uint8Array(bytes)].map((part) => part.toString(16).padStart(2, "0")).join("");
+}
+function assertNetworkPersonBulkRows(rows5) {
+  if (!Array.isArray(rows5) || rows5.length < 1) {
+    throw new NetworkPersonRegistryError("bulk_rows_required", "bulk import requires at least one row");
   }
+  if (rows5.length > NETWORK_PERSON_BULK_IMPORT_MAX_ROWS) {
+    throw new NetworkPersonRegistryError(
+      "bulk_rows_exceeded",
+      `bulk import is limited to ${NETWORK_PERSON_BULK_IMPORT_MAX_ROWS.toLocaleString()} rows`
+    );
+  }
+  return rows5;
+}
+async function networkPersonBulkBatchDigest(rows5) {
+  const bounded = assertNetworkPersonBulkRows(rows5);
+  return networkPersonBulkSha256(JSON.stringify(stableValue({ version: NETWORK_PERSON_BULK_IMPORT_VERSION, rows: bounded })));
+}
+async function networkPersonRegistryStateDigest(state) {
+  const snapshot = {
+    persons: state.persons.map(({ id, revision, state: personState, mergedIntoId }) => ({ id, revision, state: personState, mergedIntoId })).sort((a, b) => a.id.localeCompare(b.id)),
+    claims: state.claims.map(({ id, personId }) => ({ id, personId })).sort((a, b) => a.id.localeCompare(b.id)),
+    aliases: state.aliases.map(({ id, revision, status, personId }) => ({ id, revision, status, personId })).sort((a, b) => a.id.localeCompare(b.id)),
+    links: state.links.map(({ id, personId, state: linkState }) => ({ id, personId, state: linkState })).sort((a, b) => a.id.localeCompare(b.id))
+  };
+  return networkPersonBulkSha256(JSON.stringify(stableValue(snapshot)));
+}
+function rejectedValidation(errors) {
+  return errors.some((error) => /approved|real person|non-development|development or invalid email|fixture, test, sample/i.test(error));
+}
+async function classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state) {
+  const aliasIds = new Set(state.aliases.map((alias) => alias.id));
+  const batchAliases = /* @__PURE__ */ new Set();
+  const claimOwners = /* @__PURE__ */ new Map();
+  for (const claim of state.claims) {
+    const owners = claimOwners.get(claim.id) ?? /* @__PURE__ */ new Set();
+    owners.add(claim.personId);
+    claimOwners.set(claim.id, owners);
+  }
+  const results = [];
+  const values = [];
+  for (let index2 = 0; index2 < rows5.length; index2 += 1) {
+    const validation = validateNetworkPersonImport(rows5[index2], allowedChapterIds);
+    if (!validation.ok || !validation.value) {
+      const errors = validation.errors.slice(0, 8);
+      results.push({ rowNumber: index2 + 2, status: rejectedValidation(errors) ? "rejected" : "invalid", errors });
+      values.push(null);
+      continue;
+    }
+    const value = validation.value;
+    const aliasId = await networkSourceKey(value.sourceSystem, value.sourceRecordId);
+    if (batchAliases.has(aliasId)) {
+      results.push({ rowNumber: index2 + 2, status: "rejected", errors: ["duplicate source record in this batch"] });
+      values.push(null);
+      continue;
+    }
+    batchAliases.add(aliasId);
+    if (aliasIds.has(aliasId)) {
+      results.push({ rowNumber: index2 + 2, status: "replay" });
+      values.push(value);
+      continue;
+    }
+    const claims = await Promise.all(value.identities.map(networkIdentityClaim));
+    const candidates = new Set(claims.flatMap((claim) => [...claimOwners.get(claim.id) ?? []]));
+    results.push(candidates.size ? { rowNumber: index2 + 2, status: "exact_match_review", candidateCount: candidates.size } : { rowNumber: index2 + 2, status: "new" });
+    const plannedOwner = `bulk_row_${index2 + 2}`;
+    for (const claim of claims) {
+      const owners = claimOwners.get(claim.id) ?? /* @__PURE__ */ new Set();
+      owners.add(plannedOwner);
+      claimOwners.set(claim.id, owners);
+    }
+    values.push(value);
+  }
+  return { rows: results, values };
+}
+async function previewNetworkPersonBulkImport(db, rows5, allowedChapterIds) {
+  const bounded = assertNetworkPersonBulkRows(rows5);
   const state = await loadNetworkPersonRegistry(db);
-  const target = input.kind === "person" ? state.persons.find((row) => row.id === input.id) : state.aliases.find((row) => row.id === input.id);
-  if (!target) throw new NetworkPersonRegistryError("reveal_not_found", "registry record not found");
-  const ids = input.kind === "person" ? { personId: input.id } : { aliasId: input.id };
-  const event = {
-    t: "update",
-    ns: "networkPersonEvents",
-    id: `network_person_event:${mutationId}`,
-    attrs: {
-      id: `network_person_event:${mutationId}`,
-      kind: "pii_revealed",
-      actorId: actor.id,
-      ...ids,
-      mutationId,
-      detail: { targetKind: input.kind, reason },
-      createdAt: now
+  const classified = await classifyNetworkPersonBulkRows(bounded, allowedChapterIds, state);
+  const counts = networkPersonBulkEmptyCounts();
+  for (const row of classified.rows) incrementNetworkPersonBulkCount(counts, row.status);
+  return {
+    version: NETWORK_PERSON_BULK_IMPORT_VERSION,
+    batchDigest: await networkPersonBulkBatchDigest(bounded),
+    stateDigest: await networkPersonRegistryStateDigest(state),
+    rowCount: bounded.length,
+    counts,
+    rows: classified.rows
+  };
+}
+
+// src/network-person-bulk-import.ts
+async function derivedMutationId(batchMutationId, part) {
+  return `bulk_${await networkPersonBulkSha256(`${batchMutationId}\0${part}`)}`;
+}
+function matchingEvent(events, mutationId, kind) {
+  return events.find((event) => event.mutationId === mutationId && event.kind === kind);
+}
+function eventString(event, key) {
+  return typeof event.detail[key] === "string" ? String(event.detail[key]) : "";
+}
+function eventCounts(event) {
+  const value = event.detail.counts;
+  return value && typeof value === "object" && !Array.isArray(value) ? { ...networkPersonBulkEmptyCounts(), ...value } : networkPersonBulkEmptyCounts();
+}
+async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, allowedChapterIds, now = Date.now()) {
+  if (input.reviewed !== true) throw new NetworkPersonRegistryError("bulk_review_required", "the exact preview must be explicitly reviewed before apply");
+  const rows5 = assertNetworkPersonBulkRows(input.rows);
+  const batchDigest = await networkPersonBulkBatchDigest(rows5);
+  if (!/^[a-f0-9]{64}$/.test(input.expectedBatchDigest) || batchDigest !== input.expectedBatchDigest) {
+    throw new NetworkPersonRegistryError("bulk_digest_changed", "bulk import rows changed after preview; preview again");
+  }
+  if (!/^[a-f0-9]{64}$/.test(input.expectedStateDigest)) {
+    throw new NetworkPersonRegistryError("bulk_state_digest_required", "a reviewed registry state digest is required");
+  }
+  const startedMutationId = await derivedMutationId(batchMutationId, "started");
+  const completedMutationId = await derivedMutationId(batchMutationId, "completed");
+  let state = await loadNetworkPersonRegistry(db);
+  const completed = matchingEvent(state.events, completedMutationId, "bulk_import_completed");
+  if (completed) {
+    if (eventString(completed, "batchDigest") !== batchDigest) {
+      throw new NetworkPersonRegistryError("bulk_mutation_conflict", "batch mutation id was already used for different rows");
+    }
+    return {
+      version: NETWORK_PERSON_BULK_IMPORT_VERSION,
+      batchDigest,
+      stateDigest: eventString(completed, "stateDigest"),
+      rowCount: Number(completed.detail.rowCount) || rows5.length,
+      counts: eventCounts(completed),
+      rows: [],
+      replayed: true
+    };
+  }
+  let started = matchingEvent(state.events, startedMutationId, "bulk_import_started");
+  if (!started) {
+    const preview = await previewNetworkPersonBulkImport(db, rows5, allowedChapterIds);
+    if (preview.stateDigest !== input.expectedStateDigest) {
+      throw new NetworkPersonRegistryError("bulk_state_changed", "network Person registry changed after preview; preview again");
+    }
+    try {
+      await db.transact([
+        networkPersonEventOp("bulk_import_started", startedMutationId, actor, now, {
+          batchDigest,
+          stateDigest: input.expectedStateDigest,
+          rowCount: rows5.length,
+          previewCounts: preview.counts
+        })
+      ], {
+        mutationId: startedMutationId,
+        guards: [{ ns: "networkPersonEvents", id: `network_person_event:${startedMutationId}`, exists: false }]
+      });
+    } catch (error) {
+      if (!(error instanceof Error) || error.code !== "transact_guard_failed") throw error;
+    }
+    state = await loadNetworkPersonRegistry(db);
+    started = matchingEvent(state.events, startedMutationId, "bulk_import_started");
+  }
+  if (!started || eventString(started, "batchDigest") !== batchDigest || eventString(started, "stateDigest") !== input.expectedStateDigest) {
+    throw new NetworkPersonRegistryError("bulk_mutation_conflict", "batch mutation id does not match the reviewed preview");
+  }
+  const classified = await classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state);
+  const results = [];
+  const counts = networkPersonBulkEmptyCounts();
+  for (let index2 = 0; index2 < classified.rows.length; index2 += 1) {
+    const row = classified.rows[index2];
+    const value = classified.values[index2];
+    if (!value) {
+      results.push(row);
+      incrementNetworkPersonBulkCount(counts, row.status);
+      continue;
+    }
+    try {
+      const result = await importNetworkPerson(
+        db,
+        value,
+        await derivedMutationId(batchMutationId, `row_${index2 + 2}`),
+        actor,
+        now + index2 + 1
+      );
+      const status = "replayed" in result && result.replayed ? "replay" : result.status === "ambiguous" ? "exact_match_review" : "new";
+      const applied = {
+        rowNumber: index2 + 2,
+        status,
+        ...result.status === "ambiguous" ? { candidateCount: result.alias.candidatePersonIds?.length ?? 0 } : {}
+      };
+      results.push(applied);
+      incrementNetworkPersonBulkCount(counts, status);
+    } catch (error) {
+      const failed = {
+        rowNumber: index2 + 2,
+        status: "failed",
+        errors: [error instanceof Error ? error.message : "row failed"]
+      };
+      results.push(failed);
+      incrementNetworkPersonBulkCount(counts, failed.status);
     }
+  }
+  if (counts.failed === 0) {
+    await db.transact([
+      networkPersonEventOp("bulk_import_completed", completedMutationId, actor, now + rows5.length + 1, {
+        batchDigest,
+        stateDigest: input.expectedStateDigest,
+        rowCount: rows5.length,
+        counts
+      })
+    ], { mutationId: completedMutationId });
+  }
+  return {
+    version: NETWORK_PERSON_BULK_IMPORT_VERSION,
+    batchDigest,
+    stateDigest: input.expectedStateDigest,
+    rowCount: rows5.length,
+    counts,
+    rows: results
   };
-  await db.transact([event], {
-    mutationId,
-    guards: [{ ns: "networkPersonEvents", id: `network_person_event:${mutationId}`, exists: false }]
-  });
-  return input.kind === "person" ? { kind: "person", person: target, identities: state.claims.filter((claim) => claim.personId === input.id) } : { kind: "alias", alias: target };
 }
 
-// src/worker-routes-network-person-registry.ts
-var PATH2 = "/api/admin/network-person-registry";
-var MAX_BODY2 = 32e3;
-var MUTATION_ID4 = /^[A-Za-z0-9_-]{16,128}$/;
+// src/network-person-route-projection.ts
 function redactedName(displayName) {
   return displayName.split(/\s+/).filter(Boolean).map((part) => `${part[0]?.toUpperCase() ?? ""}\u2026`).join(" ");
 }
-var redactedLink = async (link) => ({
+var redactedNetworkPersonLink = async (link) => ({
   id: link.id,
   personId: link.personId,
   chapterId: link.chapterId,
@@ -7285,13 +7589,13 @@ var redactedLink = async (link) => ({
   state: link.state,
   createdAt: link.createdAt
 });
-var safePolicy = (policy) => ({
+var safeNetworkContactPolicy = (policy) => ({
   marketingSuppressed: policy.marketingSuppressed,
   discretionarySuppressed: policy.discretionarySuppressed,
   hasReason: Boolean(policy.reason),
   updatedAt: policy.updatedAt
 });
-var safeAlias = (alias) => ({
+var safeNetworkPersonAlias = async (alias) => ({
   id: alias.id,
   sourceSystem: alias.sourceSystem,
   displayNameHint: redactedName(alias.displayName),
@@ -7306,17 +7610,91 @@ var safeAlias = (alias) => ({
   },
   identityClaims: alias.identityClaims.map(({ id, kind, hint, verifiedAt }) => ({ id, kind, hint: hint ?? null, verifiedAt })),
   chapterIds: [...new Set(alias.chapterLinks.map((link) => link.chapterId))],
+  chapterSources: await Promise.all(alias.chapterLinks.map(async (link) => ({
+    chapterId: link.chapterId,
+    sourceKey: await networkChapterPersonSourceKey(link.chapterId, link.chapterPersonId)
+  }))),
   revision: alias.revision,
   updatedAt: alias.updatedAt
 });
-var safePerson = (person) => ({
+var safeNetworkPerson = (person, claims = []) => ({
   id: person.id,
+  displayName: person.displayName,
   displayNameHint: redactedName(person.displayName),
+  verifiedEmails: claims.filter((claim) => claim.kind === "email").map((claim) => ({ value: claim.value, verifiedAt: claim.verifiedAt })).sort((left, right) => right.verifiedAt - left.verifiedAt || left.value.localeCompare(right.value)),
   state: person.state,
   mergedIntoId: person.mergedIntoId ?? null,
   revision: person.revision,
-  contactPolicy: safePolicy(person.contactPolicy)
+  contactPolicy: safeNetworkContactPolicy(person.contactPolicy)
 });
+async function projectNetworkPersonRegistryState(state) {
+  const persons = await Promise.all(state.persons.map(async (person) => {
+    const claims = state.claims.filter((claim) => claim.personId === person.id);
+    const links = state.links.filter((link) => link.personId === person.id && link.state === "shadow");
+    const safeLinks = await Promise.all(links.map(redactedNetworkPersonLink));
+    const canonicalId = canonicalNetworkPersonId(person.id, state.persons);
+    const canonical2 = state.persons.find((candidate) => candidate.id === canonicalId) ?? person;
+    return {
+      ...safeNetworkPerson(person, claims),
+      canonicalPersonId: canonicalId,
+      identityClaims: claims.map(({ id, kind, hint, verifiedAt }) => ({ id, kind, hint: hint ?? null, verifiedAt })),
+      chapterLinks: safeLinks,
+      chapterProjections: projectNetworkContactPolicy(canonical2.contactPolicy, safeLinks).map(({ contactPolicy, ...projection }) => ({ ...projection, contactPolicy: safeNetworkContactPolicy(contactPolicy) }))
+    };
+  }));
+  const aliases = await Promise.all(state.aliases.map(safeNetworkPersonAlias));
+  return {
+    persons,
+    aliases,
+    reviewQueue: aliases.filter((alias) => alias.status === "ambiguous"),
+    excluded: aliases.filter((alias) => alias.status === "excluded"),
+    recentEvents: state.events.slice(0, 100).map((event) => ({
+      id: event.id,
+      kind: event.kind,
+      personId: event.personId ?? null,
+      aliasId: event.aliasId ?? null,
+      actorId: event.actorId,
+      mutationId: event.mutationId,
+      createdAt: event.createdAt
+    }))
+  };
+}
+
+// src/network-person-reveal.ts
+async function revealNetworkPersonRegistryRecord(db, input, mutationId, actor, now = Date.now()) {
+  const reason = input.reason.trim();
+  if (!reason || reason.length > 500) {
+    throw new NetworkPersonRegistryError("invalid_reveal", "a bounded reveal reason is required");
+  }
+  const state = await loadNetworkPersonRegistry(db);
+  const target = input.kind === "person" ? state.persons.find((row) => row.id === input.id) : state.aliases.find((row) => row.id === input.id);
+  if (!target) throw new NetworkPersonRegistryError("reveal_not_found", "registry record not found");
+  const ids = input.kind === "person" ? { personId: input.id } : { aliasId: input.id };
+  const event = {
+    t: "update",
+    ns: "networkPersonEvents",
+    id: `network_person_event:${mutationId}`,
+    attrs: {
+      id: `network_person_event:${mutationId}`,
+      kind: "pii_revealed",
+      actorId: actor.id,
+      ...ids,
+      mutationId,
+      detail: { targetKind: input.kind, reason },
+      createdAt: now
+    }
+  };
+  await db.transact([event], {
+    mutationId,
+    guards: [{ ns: "networkPersonEvents", id: `network_person_event:${mutationId}`, exists: false }]
+  });
+  return input.kind === "person" ? { kind: "person", person: target, identities: state.claims.filter((claim) => claim.personId === input.id) } : { kind: "alias", alias: target };
+}
+
+// src/worker-routes-network-person-registry.ts
+var PATH2 = "/api/admin/network-person-registry";
+var MAX_BODY2 = 8 * 1024 * 1024;
+var MUTATION_ID4 = /^[A-Za-z0-9_-]{16,128}$/;
 var positiveRevision = (value) => {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
@@ -7330,7 +7708,7 @@ async function gate10(req, env, ctx) {
 }
 function registryError(error) {
   if (error instanceof NetworkPersonRegistryError) {
-    const status = error.code.includes("stale") || error.code === "identity_conflict" ? 409 : error.code.endsWith("not_found") ? 404 : 400;
+    const status = error.code.includes("stale") || error.code === "identity_conflict" || error.code === "bulk_state_changed" || error.code === "bulk_digest_changed" || error.code === "bulk_mutation_conflict" ? 409 : error.code.endsWith("not_found") ? 404 : 400;
     return json({ error: error.message, code: error.code }, status);
   }
   if (error instanceof Error && error.code === "transact_guard_failed") {
@@ -7365,6 +7743,23 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
     if (!MUTATION_ID4.test(mutationId)) return json({ error: "a valid mutationId is required" }, 400);
     const actionActor = { id: got.user.userId };
     try {
+      if (command === "preview-bulk-import") {
+        const result = await previewNetworkPersonBulkImport(
+          db,
+          input.rows,
+          ctx.chapter.networkPersonRegistry.chapterIds
+        );
+        return json({ result });
+      }
+      if (command === "apply-bulk-import") {
+        const result = await applyNetworkPersonBulkImport(db, {
+          rows: input.rows,
+          expectedBatchDigest: typeof input.expectedBatchDigest === "string" ? input.expectedBatchDigest : "",
+          expectedStateDigest: typeof input.expectedStateDigest === "string" ? input.expectedStateDigest : "",
+          reviewed: input.reviewed === true
+        }, mutationId, actionActor, ctx.chapter.networkPersonRegistry.chapterIds);
+        return json({ result }, result.replayed ? 200 : 201);
+      }
       if (command === "import") {
         const validated = validateNetworkPersonImport(input, ctx.chapter.networkPersonRegistry.chapterIds);
         if (!validated.ok || !validated.value) return json({ error: "invalid import", details: validated.errors }, 400);
@@ -7372,14 +7767,14 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
         return json({
           result: {
             status: result.status,
-            alias: safeAlias(result.alias),
-            ..."person" in result && result.person ? { person: safePerson(result.person) } : {},
+            alias: await safeNetworkPersonAlias(result.alias),
+            ..."person" in result && result.person ? { person: safeNetworkPerson(result.person, result.alias.identityClaims) } : {},
             ..."replayed" in result ? { replayed: result.replayed } : {}
           }
         }, 201);
       }
       if (command === "review") {
-        if (input.decision !== "link" && input.decision !== "exclude") return json({ error: "review decision must be link or exclude" }, 400);
+        if (input.decision !== "link" && input.decision !== "exclude" && input.decision !== "reopen") return json({ error: "review decision must be link, exclude, or reopen" }, 400);
         const expectedRevision = positiveRevision(input.expectedRevision);
         if (!expectedRevision) return json({ error: "expectedRevision is required" }, 400);
         if (input.decision === "link" && typeof input.personId !== "string") return json({ error: "personId is required when linking" }, 400);
@@ -7389,7 +7784,42 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
           decision: input.decision,
           ...typeof input.personId === "string" ? { personId: input.personId } : {}
         }, mutationId, actionActor);
-        return json({ result: safeAlias(result) });
+        return json({ result: await safeNetworkPersonAlias(result) });
+      }
+      if (command === "link-source") {
+        const expectedPersonRevision = positiveRevision(input.expectedPersonRevision);
+        const chapterId = typeof input.chapterId === "string" ? input.chapterId : "";
+        const chapterPersonId = typeof input.chapterPersonId === "string" ? input.chapterPersonId.trim() : "";
+        const verifiedEmail = typeof input.verifiedEmail === "string" ? input.verifiedEmail.trim() : "";
+        if (!expectedPersonRevision || !ctx.chapter.networkPersonRegistry.chapterIds.includes(chapterId) || !chapterPersonId || chapterPersonId.length > 200 || !verifiedEmail || verifiedEmail.length > 320) return json({ error: "a configured source row, exact email, and Person revision are required" }, 400);
+        const result = await linkNetworkChapterPerson(db, {
+          personId: typeof input.personId === "string" ? input.personId : "",
+          expectedPersonRevision,
+          chapterId,
+          chapterPersonId,
+          verifiedEmail
+        }, mutationId, actionActor);
+        return json({
+          result: {
+            person: safeNetworkPerson(result.person),
+            link: await redactedNetworkPersonLink(result.link),
+            ...result.replayed ? { replayed: true } : {}
+          }
+        });
+      }
+      if (command === "unlink-source") {
+        const expectedPersonRevision = positiveRevision(input.expectedPersonRevision);
+        const reason = typeof input.reason === "string" ? input.reason.trim() : "";
+        if (!expectedPersonRevision || !reason || reason.length > 500) {
+          return json({ error: "a Person revision and bounded unlink reason are required" }, 400);
+        }
+        const result = await unlinkNetworkChapterPerson(db, {
+          personId: typeof input.personId === "string" ? input.personId : "",
+          linkId: typeof input.linkId === "string" ? input.linkId : "",
+          expectedPersonRevision,
+          reason
+        }, mutationId, actionActor);
+        return json({ result: { person: safeNetworkPerson(result.person), linkState: result.link.state } });
       }
       if (command === "merge") {
         const expectedRevision = positiveRevision(input.expectedRevision);
@@ -7401,7 +7831,7 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
           expectedRevision,
           expectedTargetRevision
         }, mutationId, actionActor);
-        return json({ result: { source: safePerson(result.source), target: safePerson(result.target) } });
+        return json({ result: { source: safeNetworkPerson(result.source), target: safeNetworkPerson(result.target) } });
       }
       if (command === "unmerge") {
         const expectedRevision = positiveRevision(input.expectedRevision);
@@ -7410,7 +7840,7 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
           personId: typeof input.personId === "string" ? input.personId : "",
           expectedRevision
         }, mutationId, actionActor);
-        return json({ result: safePerson(result) });
+        return json({ result: safeNetworkPerson(result) });
       }
       if (command === "suppression") {
         const expectedRevision = positiveRevision(input.expectedRevision);
@@ -7426,7 +7856,7 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
           discretionarySuppressed: input.discretionarySuppressed,
           ...reason ? { reason } : {}
         }, mutationId, actionActor);
-        return json({ result: safePerson(result) });
+        return json({ result: safeNetworkPerson(result) });
       }
       if (command === "reveal") {
         if (input.kind !== "person" && input.kind !== "alias") return json({ error: "reveal kind must be person or alias" }, 400);
@@ -7445,48 +7875,19 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
     }
   }
   const state = await loadNetworkPersonRegistry(db);
-  const persons = await Promise.all(state.persons.map(async (person) => {
-    const links = state.links.filter((link) => link.personId === person.id);
-    const safeLinks = await Promise.all(links.map(redactedLink));
-    const canonicalId = canonicalNetworkPersonId(person.id, state.persons);
-    const canonical2 = state.persons.find((candidate) => candidate.id === canonicalId) ?? person;
-    return {
-      id: person.id,
-      displayNameHint: redactedName(person.displayName),
-      state: person.state,
-      canonicalPersonId: canonicalId,
-      mergedIntoId: person.mergedIntoId ?? null,
-      revision: person.revision,
-      contactPolicy: safePolicy(person.contactPolicy),
-      identityClaims: state.claims.filter((claim) => claim.personId === person.id).map(({ id, kind, hint, verifiedAt }) => ({ id, kind, hint: hint ?? null, verifiedAt })),
-      chapterLinks: safeLinks,
-      chapterProjections: projectNetworkContactPolicy(canonical2.contactPolicy, safeLinks).map(({ contactPolicy, ...projection }) => ({ ...projection, contactPolicy: safePolicy(contactPolicy) }))
-    };
-  }));
-  const aliases = state.aliases.map(safeAlias);
+  const projection = await projectNetworkPersonRegistryState(state);
   return json({
     version: 1,
     mode: "shadow",
     writable: true,
     authoritativeForChapterOperation: false,
-    // loadNetworkPersonRegistry deliberately bounds each collection at 1,000.
-    // Exactly 1,000 links may mean there are more, so fail closed rather than
-    // letting a consumer mistake an omitted explicit link for "source only".
-    chapterLinkProjectionComplete: state.links.length < 1e3,
+    // The store pages every collection to its explicit 10,000-row operational
+    // bound and rejects larger state instead of returning a partial projection.
+    chapterLinkProjectionComplete: true,
+    personProjectionComplete: true,
+    aliasProjectionComplete: true,
     configuredChapterIds: ctx.chapter.networkPersonRegistry.chapterIds,
-    persons,
-    aliases,
-    reviewQueue: aliases.filter((alias) => alias.status === "ambiguous"),
-    excluded: aliases.filter((alias) => alias.status === "excluded"),
-    recentEvents: state.events.slice(0, 100).map((event) => ({
-      id: event.id,
-      kind: event.kind,
-      personId: event.personId ?? null,
-      aliasId: event.aliasId ?? null,
-      actorId: event.actorId,
-      mutationId: event.mutationId,
-      createdAt: event.createdAt
-    }))
+    ...projection
   });
 };
 
@@ -7679,12 +8080,12 @@ function projectNetworkCommercialEvents(input, sources) {
     const prior = latest.get(key);
     if (!prior || order(prior, fact) <= 0) latest.set(key, row);
   }
-  const rows6 = [...latest.values()];
-  const customers = rows6.filter((row) => row.objectKind === "customer");
-  const subscriptions = rows6.filter((row) => row.objectKind === "subscription");
-  const invoices = rows6.filter((row) => row.objectKind === "invoice");
-  const refunds = rows6.filter((row) => row.objectKind === "refund" && row.eventType.startsWith("refund."));
-  for (const charge of rows6.filter((row) => row.eventType === "charge.refunded")) {
+  const rows5 = [...latest.values()];
+  const customers = rows5.filter((row) => row.objectKind === "customer");
+  const subscriptions = rows5.filter((row) => row.objectKind === "subscription");
+  const invoices = rows5.filter((row) => row.objectKind === "invoice");
+  const refunds = rows5.filter((row) => row.objectKind === "refund" && row.eventType.startsWith("refund."));
+  for (const charge of rows5.filter((row) => row.eventType === "charge.refunded")) {
     if (!refunds.some((refund) => refund.chargeId === charge.objectId)) {
       exceptions.push({ eventId: charge.eventId, kind: "charge_refund_without_refund_object", sourceKey: charge.sourceKey, detail: { eventType: charge.eventType, objectId: charge.objectId } });
     }
@@ -7713,7 +8114,7 @@ var materializedNamespaces = [
   "networkCommercialInvoices",
   "networkCommercialRefunds"
 ];
-async function rows5(db, ns) {
+async function rows4(db, ns) {
   const all = [];
   const pageSize = 500;
   for (let offset = 0; ; offset += pageSize) {
@@ -7724,9 +8125,9 @@ async function rows5(db, ns) {
   }
 }
 async function loadNetworkCommercialProjection(db, sources) {
-  const stored = await rows5(db, "networkCommercialEvents");
+  const stored = await rows4(db, "networkCommercialEvents");
   const projection = projectNetworkCommercialEvents(stored.map((row) => row.fact), sources);
-  const persisted = await rows5(db, "networkCommercialExceptions");
+  const persisted = await rows4(db, "networkCommercialExceptions");
   for (const row of persisted) {
     if (row.status !== "active" || row.kind !== "collision") continue;
     if (projection.exceptions.some((item) => item.eventId === row.eventId && item.kind === "collision")) continue;
@@ -7764,8 +8165,8 @@ function projectionOps(projection, now) {
 async function rebuildNetworkCommercialProjection(db, sources, mutationId, now = Date.now()) {
   const projection = await loadNetworkCommercialProjection(db, sources);
   const [existing, ...materialized] = await Promise.all([
-    rows5(db, "networkCommercialExceptions"),
-    ...materializedNamespaces.map((ns) => rows5(db, ns))
+    rows4(db, "networkCommercialExceptions"),
+    ...materializedNamespaces.map((ns) => rows4(db, ns))
   ]);
   const activeIds = new Set(projection.exceptions.map((item) => exceptionId(item.eventId, item.kind)));
   const projectedIds = new Set(projectionOps(projection, now).map((op) => String(op.id)));
@@ -7874,11 +8275,11 @@ async function listStripeObjects(client, path, params = {}, maxPages = 20) {
     if (!Array.isArray(page.data) || typeof page.has_more !== "boolean") {
       throw new Error("Stripe returned an invalid commercial list response");
     }
-    const rows6 = page.data.map(asRaw).filter((row) => row !== null);
-    if (rows6.length !== page.data.length) throw new Error("Stripe returned a malformed commercial object");
-    objects.push(...rows6);
+    const rows5 = page.data.map(asRaw).filter((row) => row !== null);
+    if (rows5.length !== page.data.length) throw new Error("Stripe returned a malformed commercial object");
+    objects.push(...rows5);
     if (!page.has_more) return { objects, complete: true };
-    const cursor = rows6.at(-1)?.id;
+    const cursor = rows5.at(-1)?.id;
     if (typeof cursor !== "string" || !cursor) throw new Error("Stripe pagination did not provide a cursor");
     startingAfter = cursor;
   }
@@ -8130,14 +8531,14 @@ var PAGE2 = 500;
 var MAX_SCAN = 5e3;
 var MAX_RECORDS2 = 500;
 async function localCommercialRows(db) {
-  const rows6 = [];
+  const rows5 = [];
   for (let offset = 0; offset < MAX_SCAN; offset += PAGE2) {
     const result = await db.query({ applications: { $: { limit: PAGE2, offset, order: { createdAt: "asc" } } } });
     const page = Array.isArray(result.applications) ? result.applications : [];
-    rows6.push(...page.slice(0, MAX_SCAN - rows6.length));
-    if (page.length < PAGE2) return { rows: rows6, truncated: false };
+    rows5.push(...page.slice(0, MAX_SCAN - rows5.length));
+    if (page.length < PAGE2) return { rows: rows5, truncated: false };
   }
-  return { rows: rows6, truncated: true };
+  return { rows: rows5, truncated: true };
 }
 var handleNetworkCommercialParity = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== PARITY_PATH) return null;
@@ -8696,17 +9097,17 @@ async function builderLibraryDigest(document) {
 var control2 = (row) => row?.document && typeof row.document === "object" ? row : null;
 var local2 = (row) => row?.document && typeof row.document === "object" ? row : null;
 async function loadActiveBuilderLibraryControls(db, targetId, environment) {
-  const rows6 = (await db.query({ builderLibraryControls: { $: { where: { targetId, environment, active: true }, limit: 500 } } })).builderLibraryControls;
-  return Array.isArray(rows6) ? rows6.map(control2).filter(Boolean) : [];
+  const rows5 = (await db.query({ builderLibraryControls: { $: { where: { targetId, environment, active: true }, limit: 500 } } })).builderLibraryControls;
+  return Array.isArray(rows5) ? rows5.map(control2).filter(Boolean) : [];
 }
 async function loadLatestBuilderLibraryControl(db, sourceId, targetId, environment) {
-  const rows6 = (await db.query({ builderLibraryControls: { $: { where: { sourceId, targetId, environment }, order: { revision: "desc" }, limit: 20 } } })).builderLibraryControls;
-  return control2(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  const rows5 = (await db.query({ builderLibraryControls: { $: { where: { sourceId, targetId, environment }, order: { revision: "desc" }, limit: 20 } } })).builderLibraryControls;
+  return control2(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLocalBuilderLibrary(db, appId, environment) {
   const id = `builder-library-local:${environment}`;
-  const rows6 = (await db.query({ builderLibraryLocal: { $: { where: { id }, limit: 1 } } })).builderLibraryLocal;
-  return local2(Array.isArray(rows6) ? rows6[0] : void 0);
+  const rows5 = (await db.query({ builderLibraryLocal: { $: { where: { id }, limit: 1 } } })).builderLibraryLocal;
+  return local2(Array.isArray(rows5) ? rows5[0] : void 0);
 }
 async function materializeBuilderLibraryControl(db, envelope, previous, receivedAt) {
   const { document, digest: digest2 } = envelope;