@odla-ai/chapter 0.48.0 → 0.48.2

package/dist/worker/index.d.cts

@@ -287,7 +287,7 @@ interface LeaderFormationConfig {
     maxLen?: Record<string, number>;
     /** Per-string cap when `maxLen` has no field override. Default 4000. */
     defaultMaxLen?: number;
-    /** Maximum JSON request size in characters. Default 32768. */
+    /** Maximum JSON request size in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
 }
 /** Fully resolved formation intake policy. */
@@ -590,7 +590,7 @@ interface ChapterApplication {
     /** Per-field character cap. Fields not listed use `defaultMaxLen`. */
     maxLen?: Record<string, number>;
     defaultMaxLen?: number;
-    /** Max JSON request body in bytes. Default 32768. */
+    /** Max JSON request body in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
      *  writing a row with no consent record. Default `true`. Set `false`

package/dist/worker/index.d.ts

@@ -287,7 +287,7 @@ interface LeaderFormationConfig {
     maxLen?: Record<string, number>;
     /** Per-string cap when `maxLen` has no field override. Default 4000. */
     defaultMaxLen?: number;
-    /** Maximum JSON request size in characters. Default 32768. */
+    /** Maximum JSON request size in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
 }
 /** Fully resolved formation intake policy. */
@@ -590,7 +590,7 @@ interface ChapterApplication {
     /** Per-field character cap. Fields not listed use `defaultMaxLen`. */
     maxLen?: Record<string, number>;
     defaultMaxLen?: number;
-    /** Max JSON request body in bytes. Default 32768. */
+    /** Max JSON request body in UTF-8 bytes, enforced while streaming. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
      *  writing a row with no consent record. Default `true`. Set `false`

package/dist/worker/index.js

@@ -340,54 +340,6 @@ function createWorkerContext(options) {
   };
 }
 
-// src/worker-routes.ts
-import { createCrmRoutes } from "@odla-ai/crm";
-
-// src/discussion-reference-security.ts
-async function authorizeCrmDiscussionReference(req, env, fetcher = fetch) {
-  const match = req.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/);
-  const appIncarnation = env.ODLA_APP_INCARNATION;
-  const expectedTenant = env.ODLA_ENV === "prod" ? env.ODLA_APP_ID : `${env.ODLA_APP_ID}--${env.ODLA_ENV}`;
-  if (!match || env.ODLA_TENANT !== expectedTenant || typeof appIncarnation !== "string" || !/^[a-f0-9]{32}$/.test(appIncarnation)) return null;
-  const requestUrl = new URL(req.url);
-  requestUrl.search = "";
-  requestUrl.hash = "";
-  const audience = requestUrl.href;
-  try {
-    const url = new URL(
-      "/registry/discuss/reference-authority/verify",
-      env.ODLA_PLATFORM
-    );
-    const response = await fetcher(url, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        token: match[1],
-        appId: env.ODLA_APP_ID,
-        appIncarnation,
-        env: env.ODLA_ENV,
-        product: "crm",
-        projectCapability: "crm.read",
-        audience
-      }),
-      redirect: "manual"
-    });
-    if (!response.ok) return null;
-    const value = await response.json();
-    if (value.authority?.appId !== env.ODLA_APP_ID || value.authority.appIncarnation !== appIncarnation || value.authority.appEnv !== env.ODLA_ENV || value.authority.capability !== "product.reference.read" || value.authority.product !== "crm" || value.authority.projectCapability !== "crm.read" || value.authority.audience !== audience || typeof value.actor?.id !== "string" || value.actor.kind !== "human" && value.actor.kind !== "agent" || value.actor.email !== void 0 && typeof value.actor.email !== "string") return null;
-    return {
-      userId: value.actor.id,
-      discussionReferenceScope: "all",
-      ...value.actor.email ? { email: value.actor.email } : {}
-    };
-  } catch {
-    return null;
-  }
-}
-
-// src/member.ts
-import { assertFieldCondition, resolveFieldStates } from "@odla-ai/crm";
-
 // src/application-id.ts
 var APPLICATION_ID_DOMAIN = "odla-ai/chapter/application/v1:";
 async function applicationIdForSubmission(submissionId) {
@@ -399,7 +351,26 @@ async function applicationIdForSubmission(submissionId) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
+// src/clerk-signup.ts
+async function findSignupAccount(secret, email, fetchImpl = fetch) {
+  const response = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(normalizeChapterEmail(email))}&limit=2`, {
+    headers: { authorization: `Bearer ${secret}` },
+    redirect: "manual",
+    signal: AbortSignal.timeout(5e3)
+  });
+  if (!response.ok) throw new Error("signup account lookup unavailable");
+  const users = await response.json();
+  if (!Array.isArray(users) || users.length > 1 || users.length === 1 && (typeof users[0]?.id !== "string" || !users[0].id)) {
+    throw new Error("signup account lookup unavailable");
+  }
+  return users[0] ?? null;
+}
+function belongsToSignup(account, applicationId) {
+  return typeof applicationId === "string" && applicationId.length > 0 && account.private_metadata?.applicationId === applicationId;
+}
+
 // src/member.ts
+import { assertFieldCondition, resolveFieldStates } from "@odla-ai/crm";
 var DEFAULT_REQUIRED = ["firstName", "lastName", "email", "referral", "whoYouAre", "message"];
 var DEFAULT_OPTIONAL = ["referralName", "linkedin", "phone", "state"];
 var SCHEMA_FIELD = /^[A-Za-z_][A-Za-z0-9_-]*$/;
@@ -503,8 +474,10 @@ async function submitApplication(db, chapter, fields, opts) {
   if (fields.focus !== void 0) row2.focus = clampArray(fields.focus, app.maxArrayLen);
   if (opts.groupId) row2.groupId = opts.groupId;
   if (opts.runtime) row2.stripeRuntime = opts.runtime;
+  if (chapter.account !== "none") row2.clerkAccountPending = true;
   if (typeof fields.email === "string" && isValidEmail(fields.email.trim())) {
     row2.emailNormalized = normalizeChapterEmail(fields.email);
+    row2.signupEmailKey = row2.emailNormalized;
   }
   if (opts.admissionGrant?.decision === "waive_interview") {
     row2.admissionGrantId = opts.admissionGrant.id;
@@ -528,11 +501,21 @@ async function submitApplication(db, chapter, fields, opts) {
       consumedApplicationId: id6
     } });
   }
-  const { duplicate } = await db.transact(
-    ops,
-    opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
-  );
-  return { ok: true, id: id6, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
+  try {
+    const { duplicate } = await db.transact(
+      ops,
+      opts.submissionId ? { mutationId: `join:${opts.submissionId}` } : void 0
+    );
+    return { ok: true, id: id6, duplicate, status: chapter.pipeline.initial, disclaimerAckAt: acked ? opts.now : null };
+  } catch (error) {
+    if (error.code === "unique_violation") return {
+      ok: false,
+      code: "account_already_exists",
+      status: 409,
+      error: "An account or application already exists for this email. Please sign in to continue."
+    };
+    throw error;
+  }
 }
 function joinConfig(group, paymentsReady, tiers = [], conditions = {}) {
   return {
@@ -555,6 +538,82 @@ function joinConfig(group, paymentsReady, tiers = [], conditions = {}) {
   };
 }
 
+// src/signup-eligibility.ts
+var signupConflict = { code: "account_already_exists", message: "An account or application already exists for this email. Please sign in to continue." };
+async function checkSignupEligibility(db, chapter, fields, submissionId) {
+  if (typeof fields.email !== "string" || !isValidEmail(fields.email.trim())) return null;
+  const email = normalizeChapterEmail(fields.email);
+  const applicationId = submissionId ? await applicationIdForSubmission(submissionId) : void 0;
+  const conflict = () => Response.json({ error: signupConflict }, { status: 409 });
+  try {
+    const data = await db.query({
+      applications: { $: { where: { emailNormalized: email }, limit: 2 } },
+      $users: { $: { where: { email }, limit: 2 } }
+    });
+    if ((data.applications ?? []).some((row2) => row2.id !== applicationId)) return conflict();
+    const original = (data.applications ?? []).find((row2) => row2.id === applicationId && row2.groupId === chapter.id);
+    if ((data.$users ?? []).some((row2) => row2.deleted !== true && row2.id !== original?.clerkUserId)) return conflict();
+    if (chapter.account === "none") return null;
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return Response.json({ error: { code: "clerk_secret_unavailable", message: "account provisioning credential is unavailable" } }, { status: 503 });
+    const account = await findSignupAccount(secret, email);
+    if (account && !(original && (original.clerkUserId === account.id || belongsToSignup(account, original.id)))) return conflict();
+    return null;
+  } catch {
+    return Response.json({ error: { code: "signup_lookup_unavailable", message: "Signup is temporarily unavailable. Please try again." } }, { status: 503 });
+  }
+}
+async function rejectUnprovisionedSignup(db, applicationId, status2) {
+  await db.transact([{ t: "update", ns: "applications", id: applicationId, attrs: { status: "declined" } }], {
+    guards: [{ ns: "applications", id: applicationId, exists: true, equals: { status: status2 }, absent: ["clerkUserId"] }]
+  });
+}
+
+// src/worker-routes.ts
+import { createCrmRoutes } from "@odla-ai/crm";
+
+// src/discussion-reference-security.ts
+async function authorizeCrmDiscussionReference(req, env, fetcher = fetch) {
+  const match = req.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/);
+  const appIncarnation = env.ODLA_APP_INCARNATION;
+  const expectedTenant = env.ODLA_ENV === "prod" ? env.ODLA_APP_ID : `${env.ODLA_APP_ID}--${env.ODLA_ENV}`;
+  if (!match || env.ODLA_TENANT !== expectedTenant || typeof appIncarnation !== "string" || !/^[a-f0-9]{32}$/.test(appIncarnation)) return null;
+  const requestUrl = new URL(req.url);
+  requestUrl.search = "";
+  requestUrl.hash = "";
+  const audience = requestUrl.href;
+  try {
+    const url = new URL(
+      "/registry/discuss/reference-authority/verify",
+      env.ODLA_PLATFORM
+    );
+    const response = await fetcher(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        token: match[1],
+        appId: env.ODLA_APP_ID,
+        appIncarnation,
+        env: env.ODLA_ENV,
+        product: "crm",
+        projectCapability: "crm.read",
+        audience
+      }),
+      redirect: "manual"
+    });
+    if (!response.ok) return null;
+    const value = await response.json();
+    if (value.authority?.appId !== env.ODLA_APP_ID || value.authority.appIncarnation !== appIncarnation || value.authority.appEnv !== env.ODLA_ENV || value.authority.capability !== "product.reference.read" || value.authority.product !== "crm" || value.authority.projectCapability !== "crm.read" || value.authority.audience !== audience || typeof value.actor?.id !== "string" || value.actor.kind !== "human" && value.actor.kind !== "agent" || value.actor.email !== void 0 && typeof value.actor.email !== "string") return null;
+    return {
+      userId: value.actor.id,
+      discussionReferenceScope: "all",
+      ...value.actor.email ? { email: value.actor.email } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+
 // src/tiers.ts
 function tierIsFree(tier) {
   return !(tier.priceCents > 0) && !tier.stripePriceId;
@@ -3539,13 +3598,13 @@ async function memberSessionApplication(db, chapterId, runtime, identity) {
     const normalizedRows = await lookup({ emailNormalized: normalized });
     const legacyRows = await lookup({ email: identity.email });
     apps = [...new Map([...normalizedRows, ...legacyRows].map((row2) => [row2.id, row2])).values()];
-    if (apps.length !== 1 || apps[0]?.clerkUserId !== void 0) return null;
+    if (apps.length !== 1 || apps[0]?.clerkUserId !== void 0 || apps[0]?.clerkAccountPending === true || ["declined", "canceled", "refunded"].includes(String(apps[0]?.status))) return null;
     emailFallback = true;
   }
   let app = apps.sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
   if (!app) return null;
   if (emailFallback) {
-    const keys3 = ["groupId", "stripeRuntime", "email", "emailNormalized", "status"];
+    const keys3 = ["groupId", "stripeRuntime", "email", "emailNormalized", "status", "clerkAccountPending"];
     try {
       await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: { clerkUserId: identity.userId } }], {
         mutationId: `member-account-link:${app.id}:${identity.userId}`,
@@ -3578,8 +3637,53 @@ async function memberSessionApplication(db, chapterId, runtime, identity) {
   ) };
 }
 
+// src/bounded-request-text.ts
+async function readBoundedRequestText(req, maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new TypeError("invalid request body cap");
+  const reader = req.body?.getReader();
+  const cancel = () => {
+    void reader?.cancel().catch(() => {
+    });
+  };
+  const invalid2 = () => json({ error: "invalid JSON body" }, 400);
+  let complete = false;
+  req.signal.addEventListener("abort", cancel, { once: true });
+  try {
+    if (req.signal.aborted) return invalid2();
+    const declared = req.headers.get("content-length");
+    if (declared && /^\d+$/.test(declared) && Number(declared) > maxBytes) {
+      return json({ error: "request body too large" }, 413);
+    }
+    if (!reader) return "";
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let text6 = "";
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (req.signal.aborted) return invalid2();
+      if (done) {
+        complete = true;
+        return text6 + decoder.decode();
+      }
+      bytes += value.byteLength;
+      if (bytes > maxBytes) return json({ error: "request body too large" }, 413);
+      text6 += decoder.decode(value, { stream: true });
+    }
+  } catch {
+    return invalid2();
+  } finally {
+    req.signal.removeEventListener("abort", cancel);
+    if (!complete) cancel();
+    reader?.releaseLock();
+  }
+}
+
 // src/clerk.ts
-var heal = (status2) => status2 === 422 ? { ok: true, status: status2, existed: true } : { ok: false, status: status2 };
+async function rejectedCreate(res) {
+  const body = typeof res.json === "function" ? await res.json().catch(() => null) : null;
+  const existed = Array.isArray(body?.errors) && body.errors.some((error) => error?.code === "form_identifier_exists" || error?.code === "duplicate_record");
+  return { ok: false, status: res.status, ...existed ? { existed: true } : {} };
+}
 function clerkInviteRequest(input) {
   return {
     path: "/v1/invitations",
@@ -3598,7 +3702,7 @@ async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
     headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  return res.ok ? { ok: true, status: res.status } : heal(res.status);
+  return res.ok ? { ok: true, status: res.status } : rejectedCreate(res);
 }
 function clerkUserRequest(input) {
   return {
@@ -3624,17 +3728,6 @@ async function updateClerkUserMetadata(secretKey, userId, input, fetchImpl = fet
   });
   return res.ok;
 }
-async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl = fetch) {
-  const id6 = await existingClerkUserId(secretKey, email, fetchImpl);
-  return id6 ? updateClerkUserMetadata(secretKey, id6, input, fetchImpl) : false;
-}
-async function existingClerkUserId(secretKey, email, fetchImpl) {
-  const auth = { authorization: `Bearer ${secretKey}` };
-  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=2`, { headers: auth });
-  if (!found.ok) return null;
-  const users = await found.json().catch(() => null);
-  return Array.isArray(users) && users.length === 1 && typeof users[0]?.id === "string" ? users[0].id : null;
-}
 async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   const { path, body } = clerkUserRequest(input);
   const res = await fetchImpl(`https://api.clerk.com${path}`, {
@@ -3650,20 +3743,10 @@ async function createClerkUser(secretKey, input, fetchImpl = fetch) {
       ...typeof body2?.id === "string" && body2.id ? { userId: body2.id } : {}
     };
   }
-  const errorBody = res.status === 400 && typeof res.json === "function" ? await res.json().catch(() => null) : null;
-  const existingIdentifier = Array.isArray(errorBody?.errors) && errorBody.errors.some((error) => error.code === "form_identifier_exists");
-  const healed = existingIdentifier ? { ok: true, status: res.status, existed: true } : heal(res.status);
-  const repair = input.repairMetadata ?? {
-    ...input.publicMetadata !== void 0 ? { publicMetadata: input.publicMetadata } : {},
-    ...input.privateMetadata !== void 0 ? { privateMetadata: input.privateMetadata } : {}
-  };
-  if (!healed.existed || repair.publicMetadata === void 0 && repair.privateMetadata === void 0) return healed;
-  const userId = await existingClerkUserId(secretKey, input.email, fetchImpl).catch(() => null);
-  const refreshed = userId ? await updateClerkUserMetadata(secretKey, userId, {
-    ...repair.publicMetadata !== void 0 ? { publicMetadata: repair.publicMetadata } : {},
-    ...repair.privateMetadata !== void 0 ? { privateMetadata: repair.privateMetadata } : {}
-  }, fetchImpl).catch(() => false) : false;
-  return { ...healed, refreshed, ...refreshed && userId ? { userId } : {} };
+  const failure = await rejectedCreate(res);
+  if (!failure.existed) return failure;
+  const account = await findSignupAccount(secretKey, input.email, fetchImpl).catch(() => null);
+  return account && belongsToSignup(account, input.privateMetadata?.applicationId) ? { ok: true, status: res.status, existed: true, userId: account.id } : failure;
 }
 
 // src/crm-provisioned-identity.ts
@@ -3718,6 +3801,7 @@ async function markPrivateMetadataSynced(db, applicationId, clerkUserId) {
     id: applicationId,
     attrs: {
       clerkPrivateMetadataSyncedAt: Date.now(),
+      clerkAccountPending: false,
       ...clerkUserId ? { clerkUserId } : {}
     }
   }]);
@@ -3772,7 +3856,7 @@ async function provisionApplicantForRoute(db, chapter, applicationId, fields) {
       body: {
         error: {
           code: error.code,
-          message: error.code === "clerk_secret_unavailable" ? "account provisioning credential is unavailable" : "account provisioning failed"
+          message: error.code === "account_already_exists" ? signupConflict.message : error.code === "clerk_secret_unavailable" ? "account provisioning credential is unavailable" : "account provisioning failed"
         },
         applicationId
       }
@@ -3782,7 +3866,53 @@ async function provisionApplicantForRoute(db, chapter, applicationId, fields) {
 async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
+  if (typeof fields.clerkPrivateMetadataSyncedAt === "number" && typeof fields.clerkUserId === "string") return;
   const stringValue = (value) => typeof value === "string" ? value : void 0;
+  if (chapter.account !== "none") {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) throw new AccountProvisioningError("clerk_secret_unavailable", 503);
+    try {
+      const existing = await findSignupAccount(secret, email);
+      if (existing) {
+        if (existing.id !== fields.clerkUserId && !belongsToSignup(existing, applicationId)) {
+          throw new AccountProvisioningError("account_already_exists", 409);
+        }
+        await markPrivateMetadataSynced(db, applicationId, existing.id);
+        return;
+      }
+      const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
+      if (chapter.account === "create") {
+        const result = await createClerkUser(secret, {
+          email,
+          firstName: stringValue(fields.firstName),
+          lastName: stringValue(fields.lastName),
+          privateMetadata
+        });
+        if (!result.ok) throw new AccountProvisioningError(
+          result.existed ? "account_already_exists" : "clerk_account_provisioning_failed",
+          result.existed ? 409 : 502
+        );
+        if (!result.userId) throw new AccountProvisioningError("clerk_account_provisioning_failed", 502);
+        await markPrivateMetadataSynced(db, applicationId, result.userId);
+      } else {
+        if (typeof fields.clerkInvitationSentAt === "number") return;
+        const result = await createClerkInvitation(secret, { email });
+        if (!result.ok) throw new AccountProvisioningError(
+          result.existed ? "account_already_exists" : "clerk_account_provisioning_failed",
+          result.existed ? 409 : 502
+        );
+        await db.transact([{
+          t: "update",
+          ns: "applications",
+          id: applicationId,
+          attrs: { clerkInvitationSentAt: Date.now(), clerkAccountPending: false }
+        }]);
+      }
+    } catch (error) {
+      if (error instanceof AccountProvisioningError) throw error;
+      throw new AccountProvisioningError("clerk_account_provisioning_failed", 502);
+    }
+  }
   const extra = {};
   for (const field of chapter.application.crmFields) {
     if (fields[field] !== void 0) extra[field] = fields[field];
@@ -3801,44 +3931,9 @@ async function provisionApplicant(db, chapter, applicationId, fields) {
         extra
       }
     );
+    if (chapter.account === "create") await linkProvisionedApplicant(db, chapter.id, applicationId);
   } catch {
   }
-  if (chapter.account === "none") return;
-  const secret = await getVaultSecret(db, "clerk_secret_key");
-  if (!secret) throw new AccountProvisioningError("clerk_secret_unavailable", 503);
-  try {
-    const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
-    if (chapter.account === "create") {
-      const result = await createClerkUser(secret, {
-        email,
-        firstName: stringValue(fields.firstName),
-        lastName: stringValue(fields.lastName),
-        privateMetadata,
-        repairMetadata: {
-          publicMetadata: publicProfileRemoval,
-          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
-        }
-      });
-      if (!result.ok || result.existed && !result.refreshed) {
-        throw new AccountProvisioningError("clerk_account_provisioning_failed", 502);
-      }
-      await markPrivateMetadataSynced(db, applicationId, result.userId);
-      await linkProvisionedApplicant(db, chapter.id, applicationId).catch(() => false);
-    } else {
-      const result = await createClerkInvitation(secret, { email });
-      if (!result.ok) throw new AccountProvisioningError("clerk_account_provisioning_failed", 502);
-      if (result.existed) {
-        const refreshed = await updateClerkUserMetadataByEmail(secret, email, {
-          publicMetadata: publicProfileRemoval,
-          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
-        });
-        if (refreshed) await markPrivateMetadataSynced(db, applicationId);
-      }
-    }
-  } catch (error) {
-    if (error instanceof AccountProvisioningError) throw error;
-    throw new AccountProvisioningError("clerk_account_provisioning_failed", 502);
-  }
 }
 async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
   try {
@@ -4001,8 +4096,8 @@ var handleMember = async (req, url, env, ctx) => {
     return resumeJoin(url, env, ctx);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
-    const raw2 = await req.text();
-    if (raw2.length > chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
+    const raw2 = await readBoundedRequestText(req, chapter.application.bodyCap);
+    if (raw2 instanceof Response) return raw2;
     let parsed;
     try {
       parsed = JSON.parse(raw2);
@@ -4012,6 +4107,8 @@ var handleMember = async (req, url, env, ctx) => {
     }
     const submissionId = typeof parsed.submissionId === "string" ? parsed.submissionId : void 0;
     const db = ctx.makeDb(env);
+    const signupFailure = await checkSignupEligibility(db, chapter, parsed, submissionId);
+    if (signupFailure) return signupFailure;
     const activeControl = chapter.signupControl ? await loadActiveSignupControl(db, chapter.id, env.ODLA_ENV) : null;
     const effectiveChapter = activeControl ? { ...chapter, application: controlledApplication(chapter.application, activeControl.document) } : chapter;
     const offeredTierIds = typeof parsed.tierId === "string" && parsed.tierId ? (await loadTiers(db, { id: chapter.id })).map((tier) => tier.id) : void 0;
@@ -4030,7 +4127,7 @@ var handleMember = async (req, url, env, ctx) => {
       ...effectiveGrant?.decision === "waive_interview" ? { admissionGrant: effectiveGrant } : {},
       ...giftOffer ? { giftOfferId: giftOffer.id } : {}
     });
-    if (!result.ok) return json({ error: result.error }, 400);
+    if (!result.ok) return json({ error: result.error, ...result.code ? { code: result.code } : {} }, result.status ?? 400);
     const apps = (await db.query({ applications: { $: { where: { id: result.id }, limit: 1 } } })).applications;
     const canonical2 = Array.isArray(apps) ? apps[0] : void 0;
     if (!canonical2 || canonical2.groupId !== chapter.id) return json({ error: "application state unavailable" }, 503);
@@ -4043,13 +4140,14 @@ var handleMember = async (req, url, env, ctx) => {
     if (normalizeChapterEmail(String(canonical2.email ?? "")) !== normalizeChapterEmail(String(parsed.email ?? ""))) {
       return json({ error: "submission belongs to a different application", code: "application_submission_conflict" }, 409);
     }
-    if (!result.duplicate) {
-      if (effectiveChapter.sends.adminNotification === "submit") {
-        await notifyAdminOfApplication(db, env, chapter.id, result.id, canonical2);
-      }
-    }
     const provisioningFailure = await provisionApplicantForRoute(db, effectiveChapter, result.id, canonical2);
-    if (provisioningFailure) return json(provisioningFailure.body, provisioningFailure.status);
+    if (provisioningFailure) {
+      if (provisioningFailure.status === 409) await rejectUnprovisionedSignup(db, result.id, canonical2.status);
+      return json(provisioningFailure.body, provisioningFailure.status);
+    }
+    if (!result.duplicate && effectiveChapter.sends.adminNotification === "submit") {
+      await notifyAdminOfApplication(db, env, chapter.id, result.id, canonical2);
+    }
     const groups = (await db.query({ groups: { $: { where: { id: chapter.id }, limit: 1 } } })).groups;
     const group = Array.isArray(groups) ? groups[0] : void 0;
     const state = canonical2 && group ? await continueJoin(db, ctx, env, url.origin, canonical2, group) : null;
@@ -6894,8 +6992,8 @@ async function firstRow2(db, ns, q) {
 async function startSubscription(req, env, ctx) {
   let body;
   try {
-    const raw2 = await req.text();
-    if (raw2.length > ctx.chapter.application.bodyCap) return json({ error: "request body too large" }, 413);
+    const raw2 = await readBoundedRequestText(req, ctx.chapter.application.bodyCap);
+    if (raw2 instanceof Response) return raw2;
     body = JSON.parse(raw2);
     if (!body || typeof body !== "object" || Array.isArray(body)) throw new TypeError("body");
   } catch {
@@ -11766,8 +11864,8 @@ var handleFormation = async (req, url, env, ctx) => {
     });
   }
   if (req.method !== "POST" || url.pathname !== "/api/formation/applications") return null;
-  const raw2 = await req.text();
-  if (raw2.length > formation.bodyCap) return json({ error: "request body too large" }, 413);
+  const raw2 = await readBoundedRequestText(req, formation.bodyCap);
+  if (raw2 instanceof Response) return raw2;
   let body;
   try {
     body = JSON.parse(raw2);