@odla-ai/chapter 0.60.0 → 0.62.0

package/dist/worker/index.js

@@ -1,3 +1,17 @@
+// src/admin-second-factor.ts
+function sessionHasSecondFactor(payload) {
+  const fva = payload?.fva;
+  return Array.isArray(fva) && typeof fva[1] === "number" && fva[1] >= 0;
+}
+function adminSecondFactorAllows(mode, payload, who) {
+  if (mode === "off" || sessionHasSecondFactor(payload)) return true;
+  if (mode === "report") {
+    console.warn(JSON.stringify({ event: "chapter.admin_second_factor_missing", mode, who: who ?? null }));
+    return true;
+  }
+  return false;
+}
+
 // src/worker-context.ts
 import { initAdmin } from "@odla-ai/db";
 import { createRemoteJWKSet, jwtVerify } from "jose";
@@ -27,9 +41,9 @@ function canChangeRole(ctx) {
   }
   return { ok: true };
 }
-async function getVaultSecret(db, name) {
+async function getVaultSecret(db, name2) {
   try {
-    const value = await db.secrets.get(name);
+    const value = await db.secrets.get(name2);
     return typeof value === "string" && value !== "" ? value : void 0;
   } catch {
     return void 0;
@@ -362,7 +376,8 @@ function createWorkerContext(options) {
     return await isAdminEmail(db, u.email) ? auth.adminRole : auth.ladder[0];
   }
   async function isAdmin(db, u) {
-    return await isSuperAdminEmail(db, u.email, u.userId) || isAdminRole(await roleFor(db, u), auth);
+    const admin = await isSuperAdminEmail(db, u.email, u.userId) || isAdminRole(await roleFor(db, u), auth);
+    return admin && adminSecondFactorAllows(auth.adminSecondFactor ?? "off", u.payload, u.email ?? u.userId);
   }
   function crmSender(env) {
     if (!env.SEND_EMAIL || !env.EMAIL_FROM) return void 0;
@@ -850,14 +865,14 @@ function projectNetworkCommercialEvents(input, sources) {
     const prior = latest.get(key3);
     if (!prior || order(prior, fact) <= 0) latest.set(key3, row2);
   }
-  const rows5 = [...latest.values()];
-  const customers = rows5.filter((row2) => row2.objectKind === "customer");
-  const subscriptions = rows5.filter((row2) => row2.objectKind === "subscription");
-  const invoices = rows5.filter((row2) => row2.objectKind === "invoice");
-  const seatPayments = rows5.filter((row2) => row2.objectKind === "payment_intent" && row2.seatId && row2.membershipId && !row2.invoiceId);
-  const disputes = rows5.filter((row2) => row2.objectKind === "dispute");
-  const refunds = rows5.filter((row2) => row2.objectKind === "refund" && row2.eventType.startsWith("refund."));
-  for (const charge of rows5.filter((row2) => row2.eventType === "charge.refunded")) {
+  const rows6 = [...latest.values()];
+  const customers = rows6.filter((row2) => row2.objectKind === "customer");
+  const subscriptions = rows6.filter((row2) => row2.objectKind === "subscription");
+  const invoices = rows6.filter((row2) => row2.objectKind === "invoice");
+  const seatPayments = rows6.filter((row2) => row2.objectKind === "payment_intent" && row2.seatId && row2.membershipId && !row2.invoiceId);
+  const disputes = rows6.filter((row2) => row2.objectKind === "dispute");
+  const refunds = rows6.filter((row2) => row2.objectKind === "refund" && row2.eventType.startsWith("refund."));
+  for (const charge of rows6.filter((row2) => row2.eventType === "charge.refunded")) {
     if (!refunds.some((refund) => refund.chargeId === charge.objectId)) {
       exceptions.push({ eventId: charge.eventId, kind: "charge_refund_without_refund_object", sourceKey: charge.sourceKey, detail: { eventType: charge.eventType, objectId: charge.objectId } });
     }
@@ -1115,11 +1130,11 @@ async function readStripeRecoveryEvent(db, eventId) {
 }
 async function recoverNetworkCommercialEvent(db, sources, eventId, actorUserId, now = Date.now(), alerts) {
   const eventRowId2 = `network-commercial-event:${eventId}`, exceptionId2 = `network-commercial-exception:${eventId}:collision`;
-  const rows5 = await db.query({
+  const rows6 = await db.query({
     networkCommercialEvents: { $: { where: { id: eventRowId2 }, limit: 1 } },
     networkCommercialExceptions: { $: { where: { id: exceptionId2 }, limit: 1 } }
   });
-  const stored = rows5.networkCommercialEvents?.[0], exception = rows5.networkCommercialExceptions?.[0];
+  const stored = rows6.networkCommercialEvents?.[0], exception = rows6.networkCommercialExceptions?.[0];
   if (!stored) throw new Error("stored event not found");
   const provider = await readStripeRecoveryEvent(db, eventId);
   const fact = normalizeNetworkCommercialStripeEvent(provider.event, provider.digest);
@@ -1195,7 +1210,7 @@ function findGiftRef(obj) {
   const giftIntentId = pick(metaOf(obj)) ?? pick(metaOf(subscription));
   const subscriptionId = typeof obj.subscription === "string" ? obj.subscription : typeof subscription?.subscription === "string" ? String(subscription.subscription) : void 0;
   const candidates = [metaOf(obj), metaOf(subscription)];
-  const pickIdentity = (name) => candidates.map((metadata) => typeof metadata[name] === "string" ? String(metadata[name]) : void 0).find(Boolean);
+  const pickIdentity = (name2) => candidates.map((metadata) => typeof metadata[name2] === "string" ? String(metadata[name2]) : void 0).find(Boolean);
   const appId = pickIdentity("odlaAppId");
   const environment = pickIdentity("odlaEnvironment");
   const dataEnvironment = pickIdentity("odlaDataEnvironment");
@@ -1292,11 +1307,11 @@ async function archivedChapterMembershipEvent(db, rawBody, app, env, ctx) {
   if (!app.membershipRestartId) return false;
   const fact = normalizeNetworkCommercialStripeEvent(JSON.parse(rawBody), "");
   if (!fact.subscriptionId || fact.subscriptionId === app.stripeSubscriptionId) return false;
-  const rows5 = (await db.query({ membershipCheckoutHistory: { $: { where: {
+  const rows6 = (await db.query({ membershipCheckoutHistory: { $: { where: {
     applicationId: app.id,
     providerSubscriptionId: fact.subscriptionId
   }, limit: 2 } } })).membershipCheckoutHistory ?? [];
-  return rows5.length === 1 && rows5[0].appId === env.ODLA_APP_ID && rows5[0].chapterId === ctx.chapter.id && rows5[0].environment === env.ODLA_ENV && rows5[0].runtime === stripeRuntimeIdentity(env.ODLA_RUNTIME);
+  return rows6.length === 1 && rows6[0].appId === env.ODLA_APP_ID && rows6[0].chapterId === ctx.chapter.id && rows6[0].environment === env.ODLA_ENV && rows6[0].runtime === stripeRuntimeIdentity(env.ODLA_RUNTIME);
 }
 
 // src/crm-sync.ts
@@ -1492,10 +1507,10 @@ async function findSharedRecord(deps, record4, tag) {
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   const nameField = def.nameField ?? "name";
-  const name = record4.input[nameField];
-  if (record4.type === "company" && typeof name === "string" && name.trim()) {
+  const name2 = record4.input[nameField];
+  if (record4.type === "company" && typeof name2 === "string" && name2.trim()) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record4.type, name: name.trim() }, limit: 1 } }
+      crm_record: { $: { where: { type: record4.type, name: name2.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
@@ -1633,27 +1648,81 @@ async function backfillCrm(deps) {
 }
 
 // src/email-retirement.ts
-function isRetiredEmailCopy(subject, text10) {
+function isRetiredEmailCopy(subject, text11) {
   const subjectCopy = subject.trimStart().replace(/^\[dev\]\s*/i, "");
-  const bodyCopy = text10.trimStart().replace(/^\(dev redirect; original recipient: [^\r\n]*\)\r?\n\r?\n/, "");
+  const bodyCopy = text11.trimStart().replace(/^\(dev redirect; original recipient: [^\r\n]*\)\r?\n\r?\n/, "");
   return /^\(\s*unused\s*:/i.test(subjectCopy) || /^Unused\.\s*Switched off\b/i.test(bodyCopy);
 }
 
 // src/email.ts
 import { validateEmailCopy } from "@odla-ai/crm";
 
+// src/email-render.ts
+import { renderTemplate, templateLiveVars, templateSectionIssues, templateSectionNames, templateVars } from "@odla-ai/crm";
+
+// src/email-html.ts
+var URL_RE = /https?:\/\/[^\s<>"')\]]+[^\s<>"').,;:!?\]]/g;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function lineHtml(line) {
+  let out = "", last = 0;
+  for (const match of line.matchAll(URL_RE)) {
+    out += escapeHtml(line.slice(last, match.index));
+    const url = escapeHtml(match[0]);
+    out += `<a href="${url}">${url}</a>`;
+    last = match.index + match[0].length;
+  }
+  return out + escapeHtml(line.slice(last));
+}
+function textToHtml(text11) {
+  const paragraphs = text11.replace(/\r\n/g, "\n").trim().split(/\n{2,}/).filter((paragraph) => paragraph.trim());
+  const body = paragraphs.map((paragraph) => `<p>${paragraph.split("\n").map(lineHtml).join("<br>\n")}</p>`).join("\n");
+  return `<!doctype html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"></head>
+<body style="margin:0;padding:24px 16px;background:#ffffff;color:#1a1a1a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;font-size:16px;line-height:1.5">
+${body}
+</body></html>`;
+}
+
+// src/email-render.ts
+function render(template, vars) {
+  return renderTemplate(template, vars);
+}
+var HTML_BODY_LIMIT = 2e5;
+function renderHtmlBody(template, vars) {
+  const escaped = Object.fromEntries(Object.entries(vars).map(([name2, value]) => [name2, escapeHtml(value).replace(/\r?\n/g, "<br>")]));
+  return renderTemplate(template, escaped);
+}
+function htmlBodyIssues(html, options) {
+  const issues = [];
+  if (html.length > HTML_BODY_LIMIT) issues.push({ code: "html-invalid", message: `Keep the HTML body within ${HTML_BODY_LIMIT.toLocaleString("en-US")} characters.` });
+  for (const message of templateSectionIssues(html)) issues.push({ code: "section-invalid", message: `${message} (HTML body)` });
+  const unknown = new Set(templateVars(html).filter((variable) => options.allowedVariables && !options.allowedVariables.includes(variable)));
+  for (const variable of unknown) issues.push({ code: "variable-unknown", variable, message: `This event does not supply {{${variable}}} (HTML body).` });
+  if (options.values) {
+    for (const name2 of templateSectionNames(html)) if (typeof options.values[name2] !== "string") issues.push({ code: "value-missing", variable: name2, message: `Missing event value: ${name2} (HTML body).` });
+    for (const variable of templateLiveVars(html, options.values)) {
+      if (unknown.has(variable)) continue;
+      const value = options.values[variable];
+      if (typeof value !== "string" || !value.trim() && !options.optionalVariables?.includes(variable)) issues.push({ code: "value-missing", variable, message: `Missing event value: ${variable} (HTML body).` });
+    }
+  }
+  return issues;
+}
+
 // src/email-events.ts
 var identity = ["firstName", "lastName", "email", "phone", "state"];
 var policy = ["refundPolicyText", "commitmentText", "normsText"];
-var checkout = ["tier", "tierName", "paymentAmount", "paymentAmountSummary"];
-var optionalVariables = ["phone", "state", "paymentAmount", "paymentAmountSummary"];
+var checkout = ["tier", "tierName", "paymentAmount", "paymentAmountSummary", "namedSeat", "namedSeatRecipientName"];
+var optionalVariables = ["phone", "state", "paymentAmount", "paymentAmountSummary", "namedSeat", "namedSeatRecipientName"];
 var event = (label, trigger, audience, variables, requiresTier = true) => ({ label, trigger, audience, variables: [...variables, ...policy], optionalVariables, requiresTier });
 var CHAPTER_EMAIL_EVENTS = {
   adminNotification: event("Application notification", "Application submitted or payment received, according to notification settings", "Administrator", [...identity, ...checkout, "adminUrl", "membersUrl"]),
   submitConfirmation: event("Application receipt", "Application submitted", "Applicant", [...identity, ...checkout, "submitNextStep", "membersUrl"]),
   paymentConfirmation: event("Payment confirmation", "Membership payment received", "Applicant", ["firstName", ...checkout, "paymentNextStep"]),
   prepEmail: event("Call confirmation", "Introduction call booked", "Applicant", [...identity, ...checkout, "startAt", "endAt", "timezone", "meetUrl", "htmlLink", "meetingTime", "meetingLink"]),
-  onboardingInvite: event("Membership welcome", "Membership approved", "Member", ["firstName", "membersUrl", "tierName"]),
+  onboardingInvite: event("Membership welcome", "Membership approved", "Member", ["firstName", "membersUrl", "tierName", "namedSeat", "namedSeatRecipientName"]),
   namedSeatInvitation: event("Gift membership invitation", "A gift membership is ready to be accepted", "Gift recipient", ["firstName", "purchaserName", "chapterName", "acceptBy", "joinUrl", "tierName"]),
   seatAccepted: event("Gift accepted", "Gift recipient accepts their membership", "Purchaser", ["firstName", "purchaserName", "recipientName", "tierName", "chapterName", "membersUrl"])
 };
@@ -1668,9 +1737,6 @@ function chapterEmailEvents(chapter) {
 }
 
 // src/email.ts
-function render(template, vars) {
-  return template.replace(/\{\{(\w+)\}\}/g, (_, key3) => vars[key3] ?? "");
-}
 function groupVars(group, vars) {
   return {
     ...vars,
@@ -1703,7 +1769,9 @@ function planDelivery(input) {
     values: vars,
     tierId: vars.tierId
   });
-  if (issues.length) return { deliver: false, reason: "template-invalid", issues: issues.map((issue) => issue.message) };
+  const html = typeof tpl.html === "string" && tpl.html.trim() ? tpl.html : void 0;
+  const htmlIssues = html ? htmlBodyIssues(html, { allowedVariables: event2?.variables, optionalVariables: event2?.optionalVariables, values: vars }) : [];
+  if (issues.length || htmlIssues.length) return { deliver: false, reason: "template-invalid", issues: [...issues, ...htmlIssues].map((issue) => issue.message) };
   const isProd = input.envName === "prod";
   const redirect = !isProd && !!input.group.debugEmail;
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
@@ -1713,35 +1781,12 @@ function planDelivery(input) {
   if (isRetiredEmailCopy(renderedSubject, renderedText)) return { deliver: false, reason: "template-retired" };
   if (validateEmailCopy({ subject: renderedSubject, text: renderedText }, { allowedVariables: [] }).length) return { deliver: false, reason: "template-invalid" };
   const subject = (redirect ? "[dev] " : "") + renderedSubject;
-  const text10 = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text11 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + renderedText : renderedText;
-  return { deliver: true, transport, to, subject, text: text10, redirected: redirect };
-}
-
-// src/email-html.ts
-var URL_RE = /https?:\/\/[^\s<>"')\]]+[^\s<>"').,;:!?\]]/g;
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function lineHtml(line) {
-  let out = "", last = 0;
-  for (const match of line.matchAll(URL_RE)) {
-    out += escapeHtml(line.slice(last, match.index));
-    const url = escapeHtml(match[0]);
-    out += `<a href="${url}">${url}</a>`;
-    last = match.index + match[0].length;
-  }
-  return out + escapeHtml(line.slice(last));
-}
-function textToHtml(text10) {
-  const paragraphs = text10.replace(/\r\n/g, "\n").trim().split(/\n{2,}/).filter((paragraph) => paragraph.trim());
-  const body = paragraphs.map((paragraph) => `<p>${paragraph.split("\n").map(lineHtml).join("<br>\n")}</p>`).join("\n");
-  return `<!doctype html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"></head>
-<body style="margin:0;padding:24px 16px;background:#ffffff;color:#1a1a1a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;font-size:16px;line-height:1.5">
-${body}
-</body></html>`;
+  const renderedHtml = html ? renderHtmlBody(html, vars) : void 0;
+  const htmlOut = renderedHtml && redirect ? `<p style="font:13px monospace;color:#555;margin:0 0 12px">(dev redirect; original recipient: ${escapeHtml(input.to)})</p>` + renderedHtml : renderedHtml;
+  return { deliver: true, transport, to, subject, text: text11, ...htmlOut ? { html: htmlOut } : {}, redirected: redirect };
 }
 
 // src/email-deliverability.ts
@@ -1777,9 +1822,9 @@ function tierPayable(tier, group, hasSecretKey) {
 function byOrder(a, b) {
   return a.sortOrder - b.sortOrder || a.id.localeCompare(b.id);
 }
-function resolveTiers(group, rows5 = []) {
-  const stored = rows5.filter((tier) => tier.active);
-  if (rows5.length) return [...stored].sort(byOrder);
+function resolveTiers(group, rows6 = []) {
+  const stored = rows6.filter((tier) => tier.active);
+  if (rows6.length) return [...stored].sort(byOrder);
   return [{
     id: "standard",
     groupId: String(group.id ?? ""),
@@ -1835,16 +1880,16 @@ function rowToTier(row2, groupId) {
 }
 async function loadTiers(db, group) {
   const groupId = String(group.id ?? "");
-  let rows5;
+  let rows6;
   try {
-    rows5 = (await db.query({
+    rows6 = (await db.query({
       tiers: { $: { where: { groupId }, order: { sortOrder: "asc" }, limit: 100 } }
     })).tiers;
   } catch {
     throw Object.assign(new Error("membership tiers are unavailable"), { code: "tiers_unavailable" });
   }
-  if (!Array.isArray(rows5)) throw Object.assign(new Error("membership tiers response is invalid"), { code: "tiers_unavailable" });
-  const list = rows5.map((row2) => rowToTier(row2, groupId));
+  if (!Array.isArray(rows6)) throw Object.assign(new Error("membership tiers response is invalid"), { code: "tiers_unavailable" });
+  const list = rows6.map((row2) => rowToTier(row2, groupId));
   return resolveTiers(group, list);
 }
 async function loadOfferableTiers(db, group, hasSecretKey) {
@@ -1873,10 +1918,14 @@ async function frozenCheckoutVariables(db, app) {
   if (Number.isSafeInteger(amount) && Number(amount) > 0 && typeof currency === "string" && /^[a-z]{3}$/.test(currency)) {
     formatted = new Intl.NumberFormat("en-US", { style: "currency", currency: currency.toUpperCase() }).format(Number(amount) / 100);
   }
+  const seat = quote?.namedSeat, seatCents = quote?.lineItems?.namedSeatCents;
+  const namedSeatRecipientName = typeof seat?.recipientName === "string" ? seat.recipientName.trim() : "";
   return {
     paymentAmount: formatted,
     paymentAmountSummary: formatted ? ` of ${formatted}` : "",
-    tierName: typeof quote?.tierName === "string" ? quote.tierName : ""
+    tierName: typeof quote?.tierName === "string" ? quote.tierName : "",
+    namedSeat: namedSeatRecipientName ? Number.isSafeInteger(seatCents) && Number(seatCents) > 0 ? "paid" : "included" : "",
+    namedSeatRecipientName
   };
 }
 async function catalogTierName(db, group, app) {
@@ -1905,8 +1954,8 @@ function formatInstant(at2, timeZone) {
 var adminUrlFor = (origin) => `${origin}/admin/`;
 var membersUrlFor = (origin) => `${origin}/members/`;
 function applicantVariables(app) {
-  const text10 = (v) => typeof v === "string" ? v : "";
-  return { firstName: text10(app.firstName), lastName: text10(app.lastName), email: text10(app.email), phone: text10(app.phone), state: text10(app.state) };
+  const text11 = (v) => typeof v === "string" ? v : "";
+  return { firstName: text11(app.firstName), lastName: text11(app.lastName), email: text11(app.email), phone: text11(app.phone), state: text11(app.state) };
 }
 function sampleVariables(origin, timeZone, now = Date.now()) {
   const startAt = formatInstant(now + 864e5, timeZone);
@@ -1934,6 +1983,8 @@ function sampleVariables(origin, timeZone, now = Date.now()) {
     purchaserName: "Sample Purchaser",
     recipientName: "Sample Recipient",
     chapterName: "Sample Chapter",
+    namedSeat: "paid",
+    namedSeatRecipientName: "Sample Recipient",
     acceptBy: new Date(now + 7 * 864e5).toISOString().slice(0, 10),
     joinUrl: `${origin}/join?seat=sample`
   };
@@ -1950,8 +2001,8 @@ async function emailTierVariables(db, input) {
     if (!app || !group || app.groupId !== input.groupId) return { tierName: "", tier: "" };
     const tierId = input.tierId ?? (typeof app.tierId === "string" ? app.tierId : "");
     if (!tierId) return { tierName: "", tier: "" };
-    const name = input.tierId ? await catalogTierName(db, group, { ...app, tierId }) : (await checkoutVariables(db, group, app)).tierName;
-    const tierName2 = isEmailTierName(name, tierId) ? name.trim() : "";
+    const name2 = input.tierId ? await catalogTierName(db, group, { ...app, tierId }) : (await checkoutVariables(db, group, app)).tierName;
+    const tierName2 = isEmailTierName(name2, tierId) ? name2.trim() : "";
     return { tierName: tierName2, tier: tierName2, tierId };
   } catch {
     return { tierName: "", tier: "" };
@@ -1959,8 +2010,8 @@ async function emailTierVariables(db, input) {
 }
 
 // src/notify.ts
-function fromAddress(configured, name) {
-  const display = name?.trim();
+function fromAddress(configured, name2) {
+  const display = name2?.trim();
   if (!display) return configured;
   const angled = configured.match(/<([^>]+)>/);
   return { name: display, email: (angled ? angled[1] : configured).trim() };
@@ -2031,14 +2082,14 @@ async function sendTemplated(deps, input) {
   if (decision.transport === "log-only") return { sent: true };
   let messageId;
   try {
-    const text10 = String(row2.body);
-    const html = deps.renderHtml === false ? void 0 : (deps.renderHtml ?? textToHtml)(text10);
+    const text11 = String(row2.body);
+    const html = deps.renderHtml === false ? void 0 : decision.html ?? (deps.renderHtml ?? textToHtml)(text11);
     const headers = deliverabilityHeaders({ event: event2, replyTo: input.group.replyTo });
     const response = await deps.sender.send({
       from: fromAddress(deps.from, input.group.fromName),
       to: [decision.to],
       subject: String(row2.subject),
-      text: text10,
+      text: text11,
       ...html ? { html } : {},
       ...headers ? { headers } : {},
       replyTo: input.group.replyTo
@@ -2318,13 +2369,13 @@ async function authoritativeState(db, input) {
   return state;
 }
 async function currentPolicy(db, input, restartAware, state) {
-  const rows5 = await db.query({
+  const rows6 = await db.query({
     membershipOfferingVersion: { $: { where: { chapterId: input.chapterId }, limit: 200 } },
     discountPolicyVersion: { $: { where: { chapterId: input.chapterId }, limit: 200 } }
   });
-  if (!Array.isArray(rows5.membershipOfferingVersion) || !Array.isArray(rows5.discountPolicyVersion) || rows5.membershipOfferingVersion.length >= 200 || rows5.discountPolicyVersion.length >= 200) return reject("policy_history_incomplete");
-  const offerings = rows5.membershipOfferingVersion.map((row2) => membershipOfferingVersion(row2.snapshot)).filter((offer) => offer.chapterId === input.chapterId && offer.baseSkuId === input.skuId && offer.status === "published" && input.now >= offer.effectiveFrom && (offer.effectiveUntil === void 0 || input.now < offer.effectiveUntil));
-  const policies = rows5.discountPolicyVersion.map((row2) => membershipDiscountPolicyVersion(row2.snapshot)).filter((policy3) => policy3.chapterId === input.chapterId && policy3.status === "published" && policy3.cohortEligibleSkuIds.includes(input.skuId) && input.now >= policy3.qualifyingStartsAt && input.now < policy3.qualifyingEndsAt);
+  if (!Array.isArray(rows6.membershipOfferingVersion) || !Array.isArray(rows6.discountPolicyVersion) || rows6.membershipOfferingVersion.length >= 200 || rows6.discountPolicyVersion.length >= 200) return reject("policy_history_incomplete");
+  const offerings = rows6.membershipOfferingVersion.map((row2) => membershipOfferingVersion(row2.snapshot)).filter((offer) => offer.chapterId === input.chapterId && offer.baseSkuId === input.skuId && offer.status === "published" && input.now >= offer.effectiveFrom && (offer.effectiveUntil === void 0 || input.now < offer.effectiveUntil));
+  const policies = rows6.discountPolicyVersion.map((row2) => membershipDiscountPolicyVersion(row2.snapshot)).filter((policy3) => policy3.chapterId === input.chapterId && policy3.status === "published" && policy3.cohortEligibleSkuIds.includes(input.skuId) && input.now >= policy3.qualifyingStartsAt && input.now < policy3.qualifyingEndsAt);
   const offering = offerings.sort((a, b) => b.version - a.version)[0];
   const restart = restartAware && input.applicationId ? await load(db, "membershipRestart", (await membershipOfferIdForRequest({ ...input, applicationId: input.applicationId, requestId: "checkout_binding" })).replace(/^offer_/, "membership_")) : void 0;
   const policy2 = restart ? void 0 : policies.sort((a, b) => b.version - a.version)[0];
@@ -2442,13 +2493,13 @@ async function membershipRestartPayment(db, target, member, now) {
 // src/checkout-named-seat.ts
 function checkoutNamedSeatSelection(value, purchaserEmail) {
   const row2 = value;
-  const name = typeof row2?.recipientName === "string" ? row2.recipientName.trim().replace(/\s+/g, " ") : "";
+  const name2 = typeof row2?.recipientName === "string" ? row2.recipientName.trim().replace(/\s+/g, " ") : "";
   const email = normalizeChapterEmail(typeof row2?.recipientEmail === "string" ? row2.recipientEmail : "");
   const purchaser = normalizeChapterEmail(purchaserEmail);
-  if (!row2 || typeof row2 !== "object" || Array.isArray(row2) || name.length < 2 || name.length > 160 || /[\u0000-\u001f\u007f]/.test(row2.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(purchaser) || email === purchaser) {
+  if (!row2 || typeof row2 !== "object" || Array.isArray(row2) || name2.length < 2 || name2.length > 160 || /[\u0000-\u001f\u007f]/.test(row2.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(purchaser) || email === purchaser) {
     throw Object.assign(new Error("Enter a different recipient's name and email."), { code: "invalid_named_seat_recipient" });
   }
-  return { recipientName: name, recipientEmail: email };
+  return { recipientName: name2, recipientEmail: email };
 }
 async function checkoutNamedSeatIdentity(target, email) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([
@@ -2889,14 +2940,14 @@ async function readMembershipAccess(db, input, now) {
   const entitlement = await membershipLoad(db, "networkEntitlement", `${id7}:primary`);
   requireMembershipScope(entitlement, input);
   const endsAt = member.status === "payment_grace" ? Number(member.graceEndsAt) : Number(member.termEndsAt);
-  const allowed2 = ["active", "cancel_at_term_end", "payment_grace"].includes(String(member.status)) && member.journeyApprovedAt !== void 0 && Number.isSafeInteger(member.memberNumber) && Number(member.memberNumber) > 0 && member.refundedCents === 0 && entitlement.status === "active" && entitlement.membershipId === id7 && entitlement.kind === "primary" && Number.isSafeInteger(endsAt) && endsAt > now && Number(member.termStartedAt) <= now;
+  const allowed = ["active", "cancel_at_term_end", "payment_grace"].includes(String(member.status)) && member.journeyApprovedAt !== void 0 && Number.isSafeInteger(member.memberNumber) && Number(member.memberNumber) > 0 && member.refundedCents === 0 && entitlement.status === "active" && entitlement.membershipId === id7 && entitlement.kind === "primary" && Number.isSafeInteger(endsAt) && endsAt > now && Number(member.termStartedAt) <= now;
   return {
     membershipId: id7,
-    allowed: allowed2,
+    allowed,
     status: String(member.status),
     accessEndsAt: Number.isSafeInteger(endsAt) ? endsAt : 0,
     revision: Number(member.revision),
-    restartEligible: !allowed2 && membershipCanRestart(member, now)
+    restartEligible: !allowed && membershipCanRestart(member, now)
   };
 }
 async function verifyMembershipAccessReceipt(value, input, now) {
@@ -3041,11 +3092,11 @@ async function listStripeObjects(client, path, params = {}, maxPages = 20) {
     if (!Array.isArray(page.data) || typeof page.has_more !== "boolean") {
       throw new Error("Stripe returned an invalid commercial list response");
     }
-    const rows5 = page.data.map(asRaw).filter((row2) => row2 !== null);
-    if (rows5.length !== page.data.length) throw new Error("Stripe returned a malformed commercial object");
-    objects.push(...rows5);
+    const rows6 = page.data.map(asRaw).filter((row2) => row2 !== null);
+    if (rows6.length !== page.data.length) throw new Error("Stripe returned a malformed commercial object");
+    objects.push(...rows6);
     if (!page.has_more) return { objects, complete: true };
-    const cursor = rows5.at(-1)?.id;
+    const cursor = rows6.at(-1)?.id;
     if (typeof cursor !== "string" || !cursor) throw new Error("Stripe pagination did not provide a cursor");
     startingAfter = cursor;
   }
@@ -3178,7 +3229,7 @@ async function approveApplication(input) {
   try {
     if (!duplicate) {
       const write = await db.transact(
-        [{ t: "update", ns: "applications", id: id7, attrs: { status: "approved", approvalEffectsPending: true, approvalEffectsOrigin: input.origin } }],
+        [{ t: "update", ns: "applications", id: id7, attrs: { status: "approved", approvedAt: Date.now(), approvalEffectsPending: true, approvalEffectsOrigin: input.origin } }],
         { mutationId: `approve:${id7}`, guards: [{
           ns: "applications",
           id: id7,
@@ -3461,8 +3512,8 @@ async function issueGiftClaim(db, intent, provider, now) {
     throw new Error("gift issuance conflict");
   }
 }
-function buyerGiftClaims(rows5, now) {
-  return rows5.map((row2) => {
+function buyerGiftClaims(rows6, now) {
+  return rows6.map((row2) => {
     const stored = String(row2.status ?? "pending");
     const status2 = stored === "pending" && Number(row2.codeExpiresAt) <= now ? "expired" : stored;
     return {
@@ -3608,8 +3659,8 @@ async function revokeGiftClaim(db, claim, reason, now) {
 // src/payments-route-support.ts
 async function findPaymentApplication(db, event2) {
   if ("applicationId" in event2 && event2.applicationId) {
-    const rows5 = await db.query({ applications: { $: { where: { id: event2.applicationId }, limit: 1 } } });
-    return rows5.applications?.[0];
+    const rows6 = await db.query({ applications: { $: { where: { id: event2.applicationId }, limit: 1 } } });
+    return rows6.applications?.[0];
   }
   if (event2.kind !== "refunded" && "customerId" in event2 && event2.customerId) {
     const { applications } = await db.query({ applications: { $: { where: { stripeCustomerId: event2.customerId }, limit: 2 } } });
@@ -3800,6 +3851,306 @@ async function reconcileMembershipDispute(db, input, now, secretKey, resolved) {
   return membershipFail("membership_dispute_retry_required");
 }
 
+// src/member-system-authority.ts
+var rows2 = (group) => group.fields.map((id7) => ({ ...group, id: id7 }));
+var MEMBER_SYSTEM_AUTHORITY_MATRIX = [
+  ...rows2({
+    scope: "network",
+    writer: "network_person",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "pii",
+    memberAccess: "edit",
+    fields: [
+      "person.legalName",
+      "person.preferredName",
+      "person.namePronunciation",
+      "person.pronouns",
+      "person.displayLegalName",
+      "person.primaryEmail",
+      "person.secondaryEmails",
+      "person.phone",
+      "person.linkedinUrl",
+      "person.photo",
+      "person.homeAddress",
+      "person.fulfillmentFit",
+      "person.fulfillmentSize"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_person",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "ordinary",
+    memberAccess: "edit",
+    fields: [
+      "person.title",
+      "person.company",
+      "person.companyObservedAt",
+      "person.region",
+      "person.whyText",
+      "person.whyTokens",
+      "person.skillsOffered",
+      "person.openToRequests",
+      "person.directoryPhotoConsent",
+      "person.profilePrompts",
+      "person.introducedByText"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_person",
+    projections: ["bnf_admin", "chapter_admin"],
+    sensitivity: "restricted",
+    memberAccess: "none",
+    fields: [
+      "person.linkedinMemberId",
+      "person.identityClaims",
+      "person.aliases",
+      "person.mergeHistory",
+      "person.introducedByPersonId",
+      "person.introducedAt",
+      "person.firstTouch",
+      "person.globalSuppression",
+      "person.deceasedAt",
+      "person.archivedAt"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_person",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "sensitive",
+    memberAccess: "edit",
+    fields: ["person.accreditationSelfCertification", "person.accreditationCategory", "person.accreditationExpiresAt"]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_person",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "restricted",
+    memberAccess: "read",
+    fields: ["person.acknowledgements"]
+  }),
+  ...rows2({
+    scope: "provider",
+    writer: "clerk",
+    projections: ["clerk_identity", "bnf_admin", "chapter_admin"],
+    sensitivity: "restricted",
+    memberAccess: "none",
+    fields: ["identity.clerkUserIds", "identity.clerkEmailVerification"]
+  }),
+  ...rows2({
+    scope: "chapter",
+    writer: "chapter_journey",
+    projections: ["chapter_admin", "chapter_crm", "bnf_admin"],
+    sensitivity: "ordinary",
+    memberAccess: "none",
+    fields: [
+      "journey.chapterId",
+      "journey.stage",
+      "journey.stageEnteredAt",
+      "journey.stageHistory",
+      "journey.ending",
+      "journey.endingReason",
+      "journey.source",
+      "journey.entryChapterId",
+      "journey.route",
+      "journey.flags",
+      "journey.applicationStartedAt",
+      "journey.appliedAt",
+      "journey.paidAt",
+      "journey.callBookedAt",
+      "journey.metAt",
+      "journey.approvedAt",
+      "journey.onboardedAt",
+      "journey.firstLoginAt",
+      "journey.firstDealAt"
+    ]
+  }),
+  ...rows2({
+    scope: "chapter",
+    writer: "chapter_journey",
+    projections: ["chapter_admin", "chapter_crm"],
+    sensitivity: "sensitive",
+    memberAccess: "none",
+    fields: [
+      "journey.relationshipOwnerId",
+      "journey.lastContactAt",
+      "journey.nextAction",
+      "journey.owes",
+      "journey.asks",
+      "journey.preparation",
+      "journey.notes"
+    ]
+  }),
+  ...rows2({
+    scope: "chapter",
+    writer: "chapter_journey",
+    projections: ["chapter_admin", "chapter_crm", "member_self_service"],
+    sensitivity: "ordinary",
+    memberAccess: "edit",
+    fields: ["journey.dealFlowConsent", "journey.directoryConsent", "journey.emailConsent", "journey.smsConsent"]
+  }),
+  ...rows2({
+    scope: "chapter",
+    writer: "chapter_journey",
+    projections: ["chapter_admin", "bnf_admin", "member_self_service"],
+    sensitivity: "ordinary",
+    memberAccess: "read",
+    fields: ["journey.memberNumber"]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_membership",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "ordinary",
+    memberAccess: "read",
+    fields: [
+      "membership.chapterId",
+      "membership.journeyId",
+      "membership.termStartsAt",
+      "membership.termEndsAt",
+      "membership.tier",
+      "membership.status",
+      "membership.joinedAt",
+      "membership.autoRenews",
+      "membership.renewalAt",
+      "membership.cancelsAt",
+      "membership.graceEndsAt",
+      "membership.foundingCohort",
+      "membership.offeringPolicyVersion",
+      "membership.discountPolicyVersion"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_commercial_projection",
+    projections: ["bnf_admin", "chapter_admin"],
+    sensitivity: "restricted",
+    memberAccess: "none",
+    fields: [
+      "membership.stripeCustomerId",
+      "membership.stripeSubscriptionId",
+      "membership.stripePriceId",
+      "membership.lastInvoiceId",
+      "membership.paymentOutcome",
+      "membership.refundOutcome"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_discount_policy",
+    projections: ["bnf_admin", "chapter_admin", "stripe_billing"],
+    sensitivity: "ordinary",
+    memberAccess: "none",
+    fields: [
+      "discountPolicy.chapterId",
+      "discountPolicy.version",
+      "discountPolicy.eligibleOfferingIds",
+      "discountPolicy.percentOff",
+      "discountPolicy.amountOff",
+      "discountPolicy.activatesOn",
+      "discountPolicy.invoiceCount",
+      "discountPolicy.expiresAt",
+      "discountPolicy.stackingOrder",
+      "discountPolicy.status"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_entitlement",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service", "stripe_billing"],
+    sensitivity: "ordinary",
+    memberAccess: "read",
+    fields: [
+      "entitlement.membershipId",
+      "entitlement.kind",
+      "entitlement.priceCents",
+      "entitlement.currency",
+      "entitlement.payerPersonId",
+      "entitlement.purchasedAt",
+      "entitlement.termEndsAt",
+      "entitlement.renewsWithMembership",
+      "entitlement.status"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_seat",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "pii",
+    memberAccess: "read",
+    fields: [
+      "seat.membershipId",
+      "seat.entitlementId",
+      "seat.personId",
+      "seat.recipientName",
+      "seat.recipientEmail",
+      "seat.role",
+      "seat.status",
+      "seat.acceptanceExpiresAt",
+      "seat.acceptedAt",
+      "seat.activatedAt",
+      "seat.refundedAt"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_referral_ledger",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "ordinary",
+    memberAccess: "read",
+    fields: [
+      "referral.referrerPersonId",
+      "referral.referredPersonId",
+      "referral.qualifiedMembershipId",
+      "referral.creditCents",
+      "referral.status",
+      "referral.appliedInvoiceId",
+      "referral.carryForwardCents",
+      "referral.adjustmentOf"
+    ]
+  }),
+  ...rows2({
+    scope: "network",
+    writer: "network_investment_ledger",
+    projections: ["bnf_admin", "chapter_admin", "member_self_service"],
+    sensitivity: "restricted",
+    memberAccess: "read",
+    fields: [
+      "investment.personId",
+      "investment.chapterId",
+      "investment.season",
+      "investment.purpose",
+      "investment.targetCount",
+      "investment.status",
+      "investment.amountCents",
+      "investment.closedAt",
+      "investment.sourceReference"
+    ]
+  }),
+  ...rows2({
+    scope: "provider",
+    writer: "stripe",
+    projections: ["stripe_billing", "bnf_admin", "chapter_admin"],
+    sensitivity: "restricted",
+    memberAccess: "none",
+    fields: [
+      "commercial.charge",
+      "commercial.invoice",
+      "commercial.refund",
+      "commercial.providerSubscription",
+      "commercial.paymentMethod"
+    ]
+  })
+];
+var MEMBER_SELF_EDITABLE_FIELDS = new Set(
+  MEMBER_SYSTEM_AUTHORITY_MATRIX.filter((row2) => row2.memberAccess === "edit").map((row2) => row2.id)
+);
+var MEMBER_SELF_READABLE_FIELDS = new Set(
+  MEMBER_SYSTEM_AUTHORITY_MATRIX.filter((row2) => row2.memberAccess !== "none").map((row2) => row2.id)
+);
+
 // src/member-system-contract.ts
 function classifyMemberStripeEvent(identity2, target, hasProvenLegacyLocalLink) {
   const keys3 = ["appId", "environment", "dataEnvironment", "runtime", "chapterId"];
@@ -3811,8 +4162,8 @@ function classifyMemberStripeEvent(identity2, target, hasProvenLegacyLocalLink)
 
 // src/stripe-webhook-partition.ts
 var firstRow = async (db, ns, q) => {
-  const rows5 = (await db.query({ [ns]: { $: q } }))[ns];
-  return Array.isArray(rows5) ? rows5[0] : void 0;
+  const rows6 = (await db.query({ [ns]: { $: q } }))[ns];
+  return Array.isArray(rows6) ? rows6[0] : void 0;
 };
 var stripeEventIdentity = (event2) => ({
   ...event2.appId ? { appId: event2.appId } : {},
@@ -3919,8 +4270,8 @@ async function replayedStripeReceipt(db, eventId, digest, event2, legacyDigest,
 // src/stripe-event-reconcile.ts
 async function firstRow2(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows5 = res[ns];
-  return Array.isArray(rows5) ? rows5[0] : void 0;
+  const rows6 = res[ns];
+  return Array.isArray(rows6) ? rows6[0] : void 0;
 }
 async function reconcileChapterStripeEvent(input, env, ctx) {
   const db = ctx.makeDb(env);
@@ -4237,19 +4588,19 @@ var handlePaymentRecovery = async (req, url, env, ctx) => {
   const db = raw2, target = stripeEventTarget(env, ctx);
   const local4 = (row3) => row3.chapterId === target.chapterId && row3.appId === target.appId && row3.environment === target.environment && row3.runtime === target.runtime;
   if (req.method === "GET") {
-    const rows5 = (await db.query({ stripeEventReceipts: { $: {
+    const rows6 = (await db.query({ stripeEventReceipts: { $: {
       where: { chapterId: target.chapterId, runtime: target.runtime },
       order: { receivedAt: "desc" },
       limit: 500
     } } })).stripeEventReceipts ?? [];
-    const pending = rows5.filter((row3) => local4(row3) && (String(row3.disposition).startsWith("quarantine_") || row3.retryReady === true));
+    const pending = rows6.filter((row3) => local4(row3) && (String(row3.disposition).startsWith("quarantine_") || row3.retryReady === true));
     return json({ rows: pending.map((row3) => ({
       eventId: row3.eventId,
       kind: row3.kind,
       disposition: row3.disposition,
       receivedAt: row3.receivedAt,
       retryReady: row3.retryReady === true
-    })), truncated: rows5.length >= 500 });
+    })), truncated: rows6.length >= 500 });
   }
   let eventId;
   try {
@@ -4435,9 +4786,9 @@ function memberApplication(app, meeting, defaultTimezone) {
 var local = (row2, chapterId, runtime) => row2.groupId === chapterId && (runtime ? row2.stripeRuntime === runtime : row2.stripeRuntime === void 0 || row2.stripeRuntime === "default");
 async function memberSessionApplication(db, chapterId, runtime, identity2) {
   const lookup = async (where) => {
-    const rows5 = (await db.query({ applications: { $: { where: { groupId: chapterId, ...where }, limit: 100 } } })).applications;
-    if (!Array.isArray(rows5) || rows5.length >= 100) throw new Error("member identity lookup incomplete");
-    return rows5.filter((row2) => local(row2, chapterId, runtime));
+    const rows6 = (await db.query({ applications: { $: { where: { groupId: chapterId, ...where }, limit: 100 } } })).applications;
+    if (!Array.isArray(rows6) || rows6.length >= 100) throw new Error("member identity lookup incomplete");
+    return rows6.filter((row2) => local(row2, chapterId, runtime));
   };
   let apps = await lookup({ clerkUserId: identity2.userId });
   let emailFallback = false;
@@ -4814,10 +5165,10 @@ async function namedSeatRecipientClaimId(input, email) {
 }
 async function reserveNamedMembershipSeat(db, input, now) {
   membershipClock(now);
-  const name = typeof input.recipientName === "string" ? input.recipientName.trim().replace(/\s+/g, " ") : "";
+  const name2 = typeof input.recipientName === "string" ? input.recipientName.trim().replace(/\s+/g, " ") : "";
   const email = normalizeChapterEmail(typeof input.recipientEmail === "string" ? input.recipientEmail : "");
   const purchaser = normalizeChapterEmail(typeof input.purchaserEmail === "string" ? input.purchaserEmail : "");
-  if (name.length < 2 || name.length > 160 || /[\u0000-\u001f\u007f]/.test(input.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) || !purchaser || email === purchaser || !/^price_[A-Za-z0-9_]+$/.test(input.priceId) || !/^user_[A-Za-z0-9_]+$/.test(input.purchaserUserId)) membershipFail("invalid_named_seat_recipient");
+  if (name2.length < 2 || name2.length > 160 || /[\u0000-\u001f\u007f]/.test(input.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) || !purchaser || email === purchaser || !/^price_[A-Za-z0-9_]+$/.test(input.priceId) || !/^user_[A-Za-z0-9_]+$/.test(input.purchaserUserId)) membershipFail("invalid_named_seat_recipient");
   const state = await loadMembershipAuthorityState(db, input);
   const memberId = await networkMembershipId(input), member = await membershipLoad(db, "networkMembership", memberId);
   requireMembershipScope(member, input);
@@ -4834,7 +5185,7 @@ async function reserveNamedMembershipSeat(db, input, now) {
       id: id7,
       ...membershipScope(input),
       primaryMembershipId: memberId,
-      recipientName: name,
+      recipientName: name2,
       recipientEmailNormalized: email,
       purchaserUserId: input.purchaserUserId,
       recipientClaimId: claimId,
@@ -4881,7 +5232,7 @@ async function reserveNamedMembershipSeat(db, input, now) {
     if (!seat && await membershipLoad(db, "networkSeatRecipient", claimId)) membershipFail("named_seat_recipient_unavailable");
   }
   requireMembershipScope(seat, input);
-  if (seat.primaryMembershipId !== memberId || seat.recipientName !== name || seat.recipientEmailNormalized !== email || seat.priceId !== input.priceId || seat.purchaserUserId !== input.purchaserUserId) membershipFail("named_seat_purchase_conflict");
+  if (seat.primaryMembershipId !== memberId || seat.recipientName !== name2 || seat.recipientEmailNormalized !== email || seat.priceId !== input.priceId || seat.purchaserUserId !== input.purchaserUserId) membershipFail("named_seat_purchase_conflict");
   return seat;
 }
 
@@ -5072,9 +5423,9 @@ async function liftSeatPurchaseWindow(db, scope2, now, limit = 100) {
   membershipClock(now);
   if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new TypeError("invalid lift limit");
   const state = await loadMembershipAuthorityState(db, scope2);
-  const rows5 = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
+  const rows6 = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
   let lifted = 0;
-  for (const member of rows5.slice(0, limit)) {
+  for (const member of rows6.slice(0, limit)) {
     if (Object.entries(scope2).some(([key3, value]) => member[key3] !== value)) throw new Error("membership lift scope mismatch");
     const offering = membershipOfferingVersion(member.offeringSnapshot);
     if (offering.seatPurchaseWindowCalendarMonths === void 0) continue;
@@ -5090,7 +5441,7 @@ async function liftSeatPurchaseWindow(db, scope2, now, limit = 100) {
     ] });
     lifted++;
   }
-  return { lifted, more: rows5.length > limit };
+  return { lifted, more: rows6.length > limit };
 }
 
 // src/membership-seat-reprice.ts
@@ -5103,9 +5454,9 @@ async function lowerSeatPrice(db, scope2, now, limit = 100) {
   const current = versions.map((row2) => membershipOfferingVersion(row2.snapshot)).filter((offer) => offer.baseSkuId === scope2.skuId && offer.status === "published" && now >= offer.effectiveFrom && (offer.effectiveUntil === void 0 || now < offer.effectiveUntil)).sort((a, b) => b.version - a.version)[0];
   if (!current) throw Object.assign(new Error("ambiguous_membership_policy"), { code: "ambiguous_membership_policy" });
   const target = current.seatPriceCents;
-  const rows5 = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
-  const receipt = { seatPriceCents: target, repriced: 0, skipped: [], more: rows5.length > limit };
-  for (const member of rows5.slice(0, limit)) {
+  const rows6 = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
+  const receipt = { seatPriceCents: target, repriced: 0, skipped: [], more: rows6.length > limit };
+  for (const member of rows6.slice(0, limit)) {
     if (Object.entries(scope2).some(([key3, value]) => member[key3] !== value)) throw new Error("membership reprice scope mismatch");
     const id7 = String(member.id), skip = (reason) => {
       receipt.skipped.push({ membershipId: id7, reason });
@@ -5204,8 +5555,8 @@ var handleAdminMembershipSeats = async (req, url, env, ctx) => {
     }
   }
   if (!one) {
-    const rows5 = (await db.query({ networkSeat: { $: { where: { environment: env.ODLA_ENV }, order: { updatedAt: "desc" }, limit: 201 } } })).networkSeat ?? [];
-    return json({ seats: rows5.slice(0, 200).map(project), truncated: rows5.length > 200 });
+    const rows6 = (await db.query({ networkSeat: { $: { where: { environment: env.ODLA_ENV }, order: { updatedAt: "desc" }, limit: 201 } } })).networkSeat ?? [];
+    return json({ seats: rows6.slice(0, 200).map(project), truncated: rows6.length > 200 });
   }
   const seat = await membershipLoad(db, "networkSeat", one[1]);
   if (!seat || seat.environment !== env.ODLA_ENV) return json({ error: "not found" }, 404);
@@ -5424,8 +5775,8 @@ var handleAdminMembershipDisputes = async (req, url, env, ctx) => {
     const page = { $: { where: { environment: env.ODLA_ENV }, order: { updatedAt: "desc" }, limit: 500 } };
     const found = await db.query({ networkMembership: page, networkSeat: page });
     const memberships = found.networkMembership ?? [], seats = found.networkSeat ?? [];
-    const rows5 = [...memberships.map((row2) => ({ ...project2(row2), kind: "membership" })), ...seats.map((row2) => ({ ...project2(row2), kind: "seat" }))];
-    const disputes = rows5.filter((row2) => typeof row2.disputeId === "string").sort((a, b) => Number(b.disputedAt ?? 0) - Number(a.disputedAt ?? 0));
+    const rows6 = [...memberships.map((row2) => ({ ...project2(row2), kind: "membership" })), ...seats.map((row2) => ({ ...project2(row2), kind: "seat" }))];
+    const disputes = rows6.filter((row2) => typeof row2.disputeId === "string").sort((a, b) => Number(b.disputedAt ?? 0) - Number(a.disputedAt ?? 0));
     return json({ disputes, truncated: memberships.length >= 500 || seats.length >= 500 });
   }
   const secret = await getVaultSecret(db, operator.stripeSecretName ?? "stripe_secret_key");
@@ -5475,9 +5826,9 @@ function stateOf(item, all, now, window, rivals) {
 var mechanism = (policy2) => policy2.percentOffBps === 0 || policy2.discountEligibleSkuIds.length === 0 ? "none" : policy2.benefitDuration.kind === "while_active" ? "stripe_coupon_forever" : policy2.benefitDuration.kind === "first_term" ? "stripe_coupon_once" : "stripe_coupon_term_bound";
 var sharesSku = (a, b) => a.cohortEligibleSkuIds.some((sku) => b.cohortEligibleSkuIds.includes(sku));
 var byChapter = (a, b) => a.chapterId.localeCompare(b.chapterId);
-function normalize(rows5, collection, parse, invalid2) {
+function normalize(rows6, collection, parse, invalid2) {
   const out = [];
-  for (const row2 of rows5) {
+  for (const row2 of rows6) {
     try {
       out.push({ value: parse(row2.snapshot), row: row2 });
     } catch (error) {
@@ -5488,11 +5839,11 @@ function normalize(rows5, collection, parse, invalid2) {
 }
 async function listMembershipPolicyVersions(db, input) {
   const where = input.chapterId ? { chapterId: input.chapterId } : {};
-  const rows5 = await db.query({
+  const rows6 = await db.query({
     membershipOfferingVersion: { $: { where, limit: LIMIT } },
     discountPolicyVersion: { $: { where, limit: LIMIT } }
   });
-  const offeringRows = rows5.membershipOfferingVersion ?? [], policyRows = rows5.discountPolicyVersion ?? [];
+  const offeringRows = rows6.membershipOfferingVersion ?? [], policyRows = rows6.discountPolicyVersion ?? [];
   const invalid2 = [];
   const offerings = normalize(offeringRows, "membershipOfferingVersion", membershipOfferingVersion, invalid2);
   const policies = normalize(policyRows, "discountPolicyVersion", membershipDiscountPolicyVersion, invalid2);
@@ -5632,22 +5983,22 @@ async function retermMembershipDiscount(db, stripeSecretKey, scope2, input, now)
   const skip = (membershipId, reason) => {
     receipt.skipped.push({ membershipId, reason });
   };
-  let rows5;
+  let rows6;
   if (input.membershipIds) {
-    rows5 = [];
+    rows6 = [];
     for (const id7 of input.membershipIds) {
       const member = await membershipLoad(db, "networkMembership", id7);
       if (!member) skip(id7, "not_found");
       else if (Object.entries(scope2).some(([key3, value]) => member[key3] !== value)) skip(id7, "scope_mismatch");
-      else rows5.push(member);
+      else rows6.push(member);
     }
   } else {
     const found = (await db.query({ networkMembership: { $: { where: { ...scope2 }, order: { updatedAt: "asc" }, limit: limit + 1 } } })).networkMembership ?? [];
     if (found.some((member) => Object.entries(scope2).some(([key3, value]) => member[key3] !== value))) throw new Error("membership reterm scope mismatch");
     receipt.more = found.length > limit;
-    rows5 = found.slice(0, limit);
+    rows6 = found.slice(0, limit);
   }
-  for (const member of rows5) {
+  for (const member of rows6) {
     const id7 = String(member.id);
     if (member.discountPolicyVersionId === policy2.id) {
       receipt.unchanged.push(id7);
@@ -5943,13 +6294,13 @@ var SCHEMA_FIELD = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 function resolveApplication(a) {
   const required = a?.required ?? DEFAULT_REQUIRED;
   const optional = a?.optional ?? DEFAULT_OPTIONAL;
-  for (const [name, arr] of [["required", required], ["optional", optional]]) {
+  for (const [name2, arr] of [["required", required], ["optional", optional]]) {
     if (!Array.isArray(arr) || !arr.every((f) => typeof f === "string" && f !== "")) {
-      throw new Error(`defineChapter.application.${name}: must be an array of field-name strings`);
+      throw new Error(`defineChapter.application.${name2}: must be an array of field-name strings`);
     }
     const unsafe = arr.find((field) => !SCHEMA_FIELD.test(field));
     if (unsafe) {
-      throw new Error(`defineChapter.application.${name}: field "${unsafe}" must match ${SCHEMA_FIELD.source}`);
+      throw new Error(`defineChapter.application.${name2}: field "${unsafe}" must match ${SCHEMA_FIELD.source}`);
     }
   }
   const duplicate = [...required, ...optional].find((field, index2, fields) => fields.indexOf(field) !== index2);
@@ -6001,14 +6352,14 @@ function hasDisclaimerAck(fields) {
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const app = chapter.application;
-  const allowed2 = (f) => app.profileFields.includes(f);
+  const allowed = (f) => app.profileFields.includes(f);
   const profile = {};
   for (const f of [...app.required, ...app.optional]) {
-    if (IDENTITY_FIELDS.has(f) || !allowed2(f)) continue;
+    if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
     const v = fields[f];
     if (typeof v === "string" && v.trim() !== "") profile[f] = v.trim();
   }
-  if (fields.focus !== void 0 && allowed2("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
+  if (fields.focus !== void 0 && allowed("focus")) profile.focus = clampArray(fields.focus, app.maxArrayLen);
   return Object.keys(profile).length > 0 ? profile : void 0;
 }
 async function submitApplication(db, chapter, fields, opts) {
@@ -6127,10 +6478,10 @@ async function resolveSignupEligibility(db, chapter, fields, submissionId) {
       applications: { $: { where: { emailNormalized: email }, limit: 10 } },
       $users: { $: { where: { email }, limit: 2 } }
     });
-    const rows5 = data.applications ?? [], others = rows5.filter((row2) => row2.id !== applicationId);
+    const rows6 = data.applications ?? [], others = rows6.filter((row2) => row2.id !== applicationId);
     const closed = others.filter((row2) => row2.groupId === chapter.id && closedApplication(row2)).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0));
     if (others.length !== closed.length) return conflict();
-    const original = rows5.find((row2) => row2.id === applicationId && row2.groupId === chapter.id);
+    const original = rows6.find((row2) => row2.id === applicationId && row2.groupId === chapter.id);
     const owned = (userId) => original?.clerkUserId === userId || closed.some((row2) => row2.clerkUserId === userId);
     if ((data.$users ?? []).some((row2) => row2.deleted !== true && !owned(row2.id))) return conflict();
     const predecessor = (clerkUserId) => closed.length ? { id: String(closed[0].id), ...clerkUserId ? { clerkUserId } : {} } : null;
@@ -6254,15 +6605,15 @@ async function signupControlDigest(document) {
 
 // src/admission-store-read.ts
 async function readAdmissionRows(db, namespace, where, maximum) {
-  const rows5 = [];
+  const rows6 = [];
   for (let offset = 0; offset <= maximum; offset += 500) {
     const result = await db.query({ [namespace]: { $: { where, order: { id: "asc" }, limit: 500, offset } } });
     const page = Array.isArray(result[namespace]) ? result[namespace] : [];
-    rows5.push(...page);
-    if (rows5.length > maximum) throw new Error("admission_assignment_limit");
+    rows6.push(...page);
+    if (rows6.length > maximum) throw new Error("admission_assignment_limit");
     if (page.length < 500) break;
   }
-  return rows5;
+  return rows6;
 }
 
 // src/admission-grants.ts
@@ -6345,7 +6696,7 @@ async function createAdmissionGrantEnvelope(document) {
   if (!checked.ok) throw new TypeError(`Invalid admission grant document: ${checked.errors.join("; ")}`);
   return { document: checked.value, digest: await signupControlDigest(checked.value) };
 }
-var rows2 = (value) => Array.isArray(value) ? value : [];
+var rows3 = (value) => Array.isArray(value) ? value : [];
 function asGrant(row2) {
   if (typeof row2.id !== "string" || typeof row2.emailNormalized !== "string") return null;
   if (row2.sourceScope !== "local" && row2.sourceScope !== "parent") return null;
@@ -6356,7 +6707,7 @@ async function findAdmissionGrant(db, targetId, email, now) {
   const emailNormalized = normalizeAdmissionEmail(email);
   if (!isAdmissionEmail(emailNormalized)) return null;
   const result = await db.query({ admissionGrants: { $: { where: { emailNormalized }, limit: 100 } } });
-  const active = rows2(result.admissionGrants).map(asGrant).filter((grant) => Boolean(
+  const active = rows3(result.admissionGrants).map(asGrant).filter((grant) => Boolean(
     grant && grant.targetId === targetId && grant.active === true && !grant.revokedAt && (!grant.expiresAt || grant.expiresAt > now) && !grant.consumedApplicationId
   )).sort((a, b) => {
     const scope2 = Number(b.sourceScope === "local") - Number(a.sourceScope === "local");
@@ -6370,7 +6721,7 @@ async function hasAdmissionRevision(db, sourceId, targetId, environment) {
     return Number((await db.aggregate("admissionGrantRevisions", { count: true }, { where })).count ?? 0) > 0;
   }
   const found = await db.query({ admissionGrantRevisions: {} });
-  return rows2(found.admissionGrantRevisions).some((row2) => row2.sourceId === sourceId && row2.targetId === targetId && row2.environment === environment);
+  return rows3(found.admissionGrantRevisions).some((row2) => row2.sourceId === sourceId && row2.targetId === targetId && row2.environment === environment);
 }
 async function loadLatestAdmissionRevision(db, sourceId, targetId, environment) {
   if (!await hasAdmissionRevision(db, sourceId, targetId, environment)) return null;
@@ -6379,7 +6730,7 @@ async function loadLatestAdmissionRevision(db, sourceId, targetId, environment)
     order: { revision: "desc" },
     limit: 1
   } } });
-  const row2 = rows2(result.admissionGrantRevisions).sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0];
+  const row2 = rows3(result.admissionGrantRevisions).sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0];
   return row2 ? row2 : null;
 }
 async function materializeAdmissionGrants(db, envelope, previous, receivedAt) {
@@ -6458,8 +6809,8 @@ var APPLICATION_LABELS = {
   state: "State"
 };
 function humanize(id7) {
-  const text10 = id7.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
-  return text10 ? `${text10[0].toUpperCase()}${text10.slice(1)}` : id7;
+  const text11 = id7.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text11 ? `${text11[0].toUpperCase()}${text11.slice(1)}` : id7;
 }
 function applicationDefs(chapter) {
   try {
@@ -6552,8 +6903,8 @@ function validateGiftOfferCatalog(input, tierIds) {
       errors.push(`${path} must be an object`);
       continue;
     }
-    const allowed2 = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
-    for (const key3 of Object.keys(item)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
+    const allowed = /* @__PURE__ */ new Set(["id", "target", "billingMode", "stripePriceId", "priceCents", "currency", "redemptionLifetimeHours", "activeFrom", "activeUntil", "title", "description", "ctaLabel"]);
+    for (const key3 of Object.keys(item)) if (!allowed.has(key3)) errors.push(`${path}.${key3} is not supported`);
     const id7 = text5(item.id, `${path}.id`, errors, 80);
     if (id7 && !ID3.test(id7)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (ids2.has(id7)) errors.push(`${path}.id duplicates "${id7}"`);
@@ -6617,27 +6968,27 @@ async function hasSignupControl(db, targetId, environment, active) {
   if (db.aggregate) {
     return Number((await db.aggregate("signupControls", { count: true }, { where })).count ?? 0) > 0;
   }
-  const rows5 = (await db.query({ signupControls: {} })).signupControls;
-  return Array.isArray(rows5) && rows5.some((row2) => row2.targetId === targetId && row2.environment === environment && (!active || row2.active === true));
+  const rows6 = (await db.query({ signupControls: {} })).signupControls;
+  return Array.isArray(rows6) && rows6.some((row2) => row2.targetId === targetId && row2.environment === environment && (!active || row2.active === true));
 }
 async function loadLatestSignupControl(db, targetId, environment) {
   if (!await hasSignupControl(db, targetId, environment)) return null;
-  const rows5 = (await db.query({ signupControls: { $: {
+  const rows6 = (await db.query({ signupControls: { $: {
     where: { targetId, environment },
     order: { revision: "desc" },
     limit: 1
   } } })).signupControls;
-  const latest = Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  const latest = Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
   return asStored(latest);
 }
 async function loadActiveSignupControl(db, targetId, environment) {
   if (!await hasSignupControl(db, targetId, environment, true)) return null;
-  const rows5 = (await db.query({ signupControls: { $: {
+  const rows6 = (await db.query({ signupControls: { $: {
     where: { targetId, environment, active: true },
     order: { revision: "desc" },
     limit: 1
   } } })).signupControls;
-  const active = Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
+  const active = Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision ?? 0) - Number(a.revision ?? 0))[0] : void 0;
   return asStored(active);
 }
 function controlledApplication(base, document) {
@@ -7010,17 +7361,17 @@ async function readBoundedRequestText(req, maxBytes) {
     if (!reader) return "";
     const decoder = new TextDecoder();
     let bytes = 0;
-    let text10 = "";
+    let text11 = "";
     for (; ; ) {
       const { done, value } = await reader.read();
       if (req.signal.aborted) return invalid2();
       if (done) {
         complete = true;
-        return text10 + decoder.decode();
+        return text11 + decoder.decode();
       }
       bytes += value.byteLength;
       if (bytes > maxBytes) return json({ error: "request body too large" }, 413);
-      text10 += decoder.decode(value, { stream: true });
+      text11 += decoder.decode(value, { stream: true });
     }
   } catch {
     return invalid2();
@@ -7124,9 +7475,9 @@ async function paymentQuoteRoute(url, env, ctx, prepare = false, request) {
   let selection;
   if (request?.body) {
     try {
-      const text10 = await readBoundedRequestText(request, 2048);
-      if (text10 instanceof Response) return text10;
-      const body = JSON.parse(text10);
+      const text11 = await readBoundedRequestText(request, 2048);
+      if (text11 instanceof Response) return text11;
+      const body = JSON.parse(text11);
       if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key3) => key3 !== "namedSeat")) throw new Error("invalid body");
       selection = body.namedSeat;
     } catch {
@@ -7279,9 +7630,9 @@ async function namedSeatPurchaserName(db, applicationId, chapterId, runtime) {
   if (!app || app.groupId !== chapterId || stripeRuntimeIdentity(app.stripeRuntime) !== stripeRuntimeIdentity(runtime)) {
     throw new Error("invitation purchaser unavailable");
   }
-  const name = [app.firstName, app.lastName].filter((value) => typeof value === "string").join(" ").replace(/\s+/g, " ").trim();
-  if (!name) throw new Error("invitation purchaser name unavailable");
-  return name.slice(0, 160);
+  const name2 = [app.firstName, app.lastName].filter((value) => typeof value === "string").join(" ").replace(/\s+/g, " ").trim();
+  if (!name2) throw new Error("invitation purchaser name unavailable");
+  return name2.slice(0, 160);
 }
 async function namedSeatApplicationContext(req, seatId, env, ctx) {
   const seats = ctx.membershipAuthority?.namedSeats;
@@ -7310,10 +7661,10 @@ async function namedSeatApplicationContext(req, seatId, env, ctx) {
 }
 async function existingNamedSeatApplication(context, env, ctx) {
   const { db, userId, email, invitation } = context;
-  const rows5 = (await db.query({ applications: { $: { where: { emailNormalized: normalizeChapterEmail(email) }, limit: 10 } } })).applications ?? [];
-  const apps = rows5.filter((row2) => !closedApplication(row2));
+  const rows6 = (await db.query({ applications: { $: { where: { emailNormalized: normalizeChapterEmail(email) }, limit: 10 } } })).applications ?? [];
+  const apps = rows6.filter((row2) => !closedApplication(row2));
   if (!apps.length) {
-    const closed = rows5.filter((row2) => row2.groupId === ctx.chapter.id).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
+    const closed = rows6.filter((row2) => row2.groupId === ctx.chapter.id).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
     return { predecessor: closed ? { id: String(closed.id) } : null };
   }
   const app = apps[0];
@@ -7678,6 +8029,111 @@ async function notifySubmitConfirmed(db, env, notice) {
   }
 }
 
+// src/member-entitlement.ts
+function entitledTierId(app, now = Date.now()) {
+  const granted = typeof app.entitlementTierId === "string" && app.entitlementTierId ? app.entitlementTierId : null;
+  const endsAt = typeof app.entitlementTierEndsAt === "number" ? app.entitlementTierEndsAt : null;
+  if (granted && (endsAt === null || endsAt > now)) return granted;
+  return typeof app.tierId === "string" && app.tierId ? app.tierId : null;
+}
+
+// src/portal-member.ts
+var text6 = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+async function activeHubGrant(db, identity2) {
+  const byUser = (await db.query({ hubMemberGrants: { $: { where: { userId: identity2.userId }, limit: 5 } } })).hubMemberGrants ?? [];
+  const byEmail = identity2.email ? (await db.query({ hubMemberGrants: { $: { where: { emailNormalized: normalizeChapterEmail(identity2.email) }, limit: 1 } } })).hubMemberGrants ?? [] : [];
+  return [...byUser, ...byEmail].find((row2) => row2.status === "active") ?? null;
+}
+async function resolvePortalMember(db, env, ctx, identity2) {
+  try {
+    if (ctx.chapter.mode === "hub") {
+      const grant = await activeHubGrant(db, identity2);
+      if (!grant || !identity2.email) return { status: "not-member" };
+      return { status: "member", member: {
+        memberId: String(grant.id),
+        source: "hub-grant",
+        email: identity2.email,
+        ...text6(grant.firstName) ? { firstName: text6(grant.firstName) } : {},
+        ...text6(grant.lastName) ? { lastName: text6(grant.lastName) } : {},
+        tierId: null,
+        memberSince: Number(grant.grantedAt) || null,
+        row: grant
+      } };
+    }
+    const session = await memberSessionApplication(db, ctx.chapter.id, env.ODLA_RUNTIME, identity2);
+    if (!session) return { status: "not-member" };
+    const app = session.source;
+    if (!await chapterMembershipAccess(db, env, ctx, app)) return { status: "not-member", row: app };
+    return { status: "member", member: {
+      memberId: String(app.id),
+      source: "application",
+      email: String(app.email ?? identity2.email ?? ""),
+      ...text6(app.firstName) ? { firstName: text6(app.firstName) } : {},
+      ...text6(app.lastName) ? { lastName: text6(app.lastName) } : {},
+      tierId: entitledTierId(app),
+      memberSince: Number(app.approvedAt ?? app.namedSeatAcceptedAt ?? app.createdAt) || null,
+      row: app
+    } };
+  } catch {
+    return { status: "unavailable" };
+  }
+}
+function initialsOf(name2) {
+  const words2 = name2.trim().split(/\s+/).filter(Boolean);
+  const letters = words2.length > 1 ? [words2[0], words2[words2.length - 1]] : words2;
+  return letters.map((word) => [...word][0].toUpperCase()).join("") || "?";
+}
+async function portalIdentity(db, ctx, member) {
+  const profile = (await db.query({ memberProfiles: { $: { where: { id: member.memberId }, limit: 1 } } })).memberProfiles?.[0];
+  let tier = null;
+  if (member.tierId) {
+    const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
+    const match = group ? (await loadTiers(db, group)).find((candidate) => candidate.id === member.tierId) : void 0;
+    tier = { id: member.tierId, name: match?.name ?? member.tierId };
+  }
+  const legal = [member.firstName, member.lastName].filter(Boolean).join(" ");
+  const displayName = text6(profile?.preferredName) ?? (legal || member.email);
+  const photoPath = text6(profile?.photoPath);
+  const photoUrl = photoPath && db.storage && ctx.chapter.memberPortal?.photos ? await db.storage.sign(photoPath, 3600).catch(() => null) : null;
+  return {
+    memberId: member.memberId,
+    tier,
+    memberSince: member.memberSince,
+    displayName,
+    firstName: text6(profile?.preferredName)?.split(/\s+/)[0] ?? member.firstName ?? null,
+    initials: initialsOf(displayName),
+    location: text6(profile?.location) ?? null,
+    photoUrl
+  };
+}
+
+// src/portal-me.ts
+var servesMembers = (ctx) => ctx.chapter.mode === "chapter" || Boolean(ctx.chapter.memberPortal || ctx.chapter.memberContent);
+async function hubMe(db, env, ctx, identity2, base) {
+  if (!servesMembers(ctx)) return base;
+  const result = await resolvePortalMember(db, env, ctx, identity2);
+  if (result.status === "unavailable") return { ...base, memberAccess: null, portal: null };
+  if (result.status !== "member") return { ...base, memberAccess: false, portal: null };
+  return { ...base, memberAccess: true, portal: await identityOrNull(db, ctx, result.member) };
+}
+async function chapterPortalIdentity(db, ctx, memberAccess, app) {
+  if (!memberAccess || !app || !ctx.chapter.memberPortal) return null;
+  const text11 = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+  return identityOrNull(db, ctx, {
+    memberId: String(app.id),
+    source: "application",
+    email: String(app.email ?? ""),
+    ...text11(app.firstName) ? { firstName: text11(app.firstName) } : {},
+    ...text11(app.lastName) ? { lastName: text11(app.lastName) } : {},
+    tierId: entitledTierId(app),
+    memberSince: Number(app.approvedAt ?? app.namedSeatAcceptedAt ?? app.createdAt) || null,
+    row: app
+  });
+}
+async function identityOrNull(db, ctx, member) {
+  return portalIdentity(db, ctx, member).catch(() => null);
+}
+
 // src/worker-routes-health.ts
 var handleConfig = async (_req, url, env, ctx) => {
   if (url.pathname !== "/api/config") return null;
@@ -7692,13 +8148,13 @@ var handleHealth = async (_req, url, env, ctx) => {
   if (url.pathname !== "/api/health") return null;
   const response = json({ ok: true });
   response.headers.set("cache-control", "no-store");
-  for (const [name, value] of Object.entries({
+  for (const [name2, value] of Object.entries({
     "x-odla-app-id": env.ODLA_APP_ID,
     "x-odla-chapter-id": ctx.chapter.id,
     "x-odla-data-environment": env.ODLA_ENV,
     "x-odla-runtime": env.ODLA_RUNTIME || "default"
   })) {
-    if (typeof value === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value)) response.headers.set(name, value);
+    if (typeof value === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value)) response.headers.set(name2, value);
   }
   return response;
 };
@@ -7712,8 +8168,10 @@ var handleMe = async (req, url, env, ctx) => {
   const db = ctx.makeDb(env);
   const role = await ctx.roleFor(db, u);
   const superAdmin = await ctx.isSuperAdminEmail(db, u.email, u.userId);
-  const base = { authorized: superAdmin || isAdminRole(role, ctx.auth), role, superAdmin, email: u.email ?? null };
-  if (ctx.chapter.mode !== "chapter") return json(base);
+  const admin = superAdmin || isAdminRole(role, ctx.auth);
+  const secondFactorOk = !admin || adminSecondFactorAllows(ctx.auth.adminSecondFactor ?? "off", u.payload, u.email);
+  const base = { authorized: admin && secondFactorOk, role, superAdmin, email: u.email ?? null, ...admin && !secondFactorOk ? { secondFactorRequired: true } : {} };
+  if (ctx.chapter.mode !== "chapter") return json(await hubMe(db, env, ctx, u, base));
   let member;
   try {
     member = await memberSessionApplication(
@@ -7749,7 +8207,8 @@ var handleMe = async (req, url, env, ctx) => {
     } catch {
     }
   }
-  return json({ ...base, memberAccess, membershipRestart, application: member?.application ?? null, namedSeatsEnabled: Boolean(ctx.membershipAuthority?.namedSeats && member?.application.paid && member.source.status !== "submitted") });
+  const portal = await chapterPortalIdentity(db, ctx, memberAccess, member?.source);
+  return json({ ...base, memberAccess, membershipRestart, application: member?.application ?? null, portal, namedSeatsEnabled: Boolean(ctx.membershipAuthority?.namedSeats && member?.application.paid && member.source.status !== "submitted") });
 };
 var handleCrm = async (req, url, env, ctx) => {
   const crmBase = ctx.crmBase;
@@ -7994,9 +8453,9 @@ var MAX_BENEFITS = 24;
 var MAX_MARKDOWN = 65536;
 var MAX_LABEL = 160;
 var objectRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function rejectUnknownKeys(value, allowed2, path, errors) {
+function rejectUnknownKeys(value, allowed, path, errors) {
   for (const key3 of Object.keys(value)) {
-    if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
+    if (!allowed.has(key3)) errors.push(`${path}.${key3} is not supported`);
   }
 }
 function boundedString(value, path, errors, max, required = false) {
@@ -8008,10 +8467,10 @@ function boundedString(value, path, errors, max, required = false) {
     errors.push(`${path} must be a string`);
     return void 0;
   }
-  const text10 = value.trim();
-  if (required && !text10) errors.push(`${path} is required`);
-  if (text10.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
-  return text10;
+  const text11 = value.trim();
+  if (required && !text11) errors.push(`${path} is required`);
+  if (text11.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text11;
 }
 function validateMembershipPageDocument(input, options = {}) {
   const errors = [];
@@ -8060,8 +8519,8 @@ function validateMembershipPageDocument(input, options = {}) {
       else {
         if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
         benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
-          const text10 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
-          return text10 ? [text10] : [];
+          const text11 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text11 ? [text11] : [];
         });
       }
     }
@@ -8152,10 +8611,10 @@ var ROOT_KEYS2 = /* @__PURE__ */ new Set([
 ]);
 var TIER_KEYS2 = /* @__PURE__ */ new Set(["id", "name", "available", "sortOrder", "priceCents", "currency", "interval", "stripePriceId", "blurb"]);
 var recordOf = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function unknownKeys(value, allowed2, path, errors) {
-  for (const key3 of Object.keys(value)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
+function unknownKeys(value, allowed, path, errors) {
+  for (const key3 of Object.keys(value)) if (!allowed.has(key3)) errors.push(`${path}.${key3} is not supported`);
 }
-function text6(value, path, errors, max = 65536) {
+function text7(value, path, errors, max = 65536) {
   if (typeof value !== "string" || !value.trim()) {
     errors.push(`${path} is required`);
     return "";
@@ -8178,11 +8637,11 @@ function tiersOf(value, errors) {
       return [];
     }
     unknownKeys(item, TIER_KEYS2, path, errors);
-    const id7 = text6(item.id, `${path}.id`, errors, 80);
+    const id7 = text7(item.id, `${path}.id`, errors, 80);
     if (id7 && !TIER.test(id7)) errors.push(`${path}.id must be a lowercase kebab-case id`);
     if (seen.has(id7)) errors.push(`${path}.id duplicates "${id7}"`);
     seen.add(id7);
-    const name = text6(item.name, `${path}.name`, errors, 160);
+    const name2 = text7(item.name, `${path}.name`, errors, 160);
     if (typeof item.available !== "boolean") errors.push(`${path}.available must be boolean`);
     if (!Number.isInteger(item.sortOrder) || Number(item.sortOrder) < 0) errors.push(`${path}.sortOrder must be a non-negative integer`);
     if (!Number.isInteger(item.priceCents) || Number(item.priceCents) < 0 || Number(item.priceCents) > 1e8) {
@@ -8200,10 +8659,10 @@ function tiersOf(value, errors) {
     if (item.interval !== void 0 && item.interval !== "year" && item.interval !== "month") {
       errors.push(`${path}.interval must be year or month`);
     }
-    const blurb = item.blurb === void 0 ? void 0 : text6(item.blurb, `${path}.blurb`, errors, 4e3);
+    const blurb = item.blurb === void 0 ? void 0 : text7(item.blurb, `${path}.blurb`, errors, 4e3);
     return [{
       id: id7,
-      name,
+      name: name2,
       available: item.available === true,
       sortOrder: Number(item.sortOrder) || 0,
       priceCents: Number(item.priceCents) || 0,
@@ -8246,7 +8705,7 @@ function policyOf(value, errors, tiers) {
     errors.push("document.policy must be an object");
     return void 0;
   }
-  const allowed2 = /* @__PURE__ */ new Set([
+  const allowed = /* @__PURE__ */ new Set([
     "disclaimerText",
     "refundPolicyText",
     "merchantDisclosureText",
@@ -8254,11 +8713,11 @@ function policyOf(value, errors, tiers) {
     "commitmentText",
     "normsText"
   ]);
-  unknownKeys(input, /* @__PURE__ */ new Set([...allowed2, "tierPolicies"]), "document.policy", errors);
+  unknownKeys(input, /* @__PURE__ */ new Set([...allowed, "tierPolicies"]), "document.policy", errors);
   const result = {};
-  for (const key3 of allowed2) {
+  for (const key3 of allowed) {
     if (input[key3] === void 0 && key3 !== "disclaimerText" && key3 !== "refundPolicyText") continue;
-    result[key3] = text6(input[key3], `document.policy.${key3}`, errors);
+    result[key3] = text7(input[key3], `document.policy.${key3}`, errors);
   }
   const tierPolicies = {};
   if (input.tierPolicies !== void 0) {
@@ -8273,8 +8732,8 @@ function policyOf(value, errors, tiers) {
       }
       unknownKeys(policy2, /* @__PURE__ */ new Set(["refundPolicyText", "trustCopy"]), path, errors);
       tierPolicies[id7] = {
-        refundPolicyText: text6(policy2.refundPolicyText, `${path}.refundPolicyText`, errors),
-        ...policy2.trustCopy !== void 0 ? { trustCopy: text6(policy2.trustCopy, `${path}.trustCopy`, errors) } : {}
+        refundPolicyText: text7(policy2.refundPolicyText, `${path}.refundPolicyText`, errors),
+        ...policy2.trustCopy !== void 0 ? { trustCopy: text7(policy2.trustCopy, `${path}.trustCopy`, errors) } : {}
       };
     }
   }
@@ -8314,9 +8773,9 @@ function validateSignupControlDocument(input) {
   if (!Number.isSafeInteger(root.generatedAt) || Number(root.generatedAt) < 1) errors.push("document.generatedAt must be epoch milliseconds");
   const source = recordOf(root.source);
   const target = recordOf(root.target);
-  const appId = text6(source?.appId, "document.source.appId", errors, 63);
-  const chapterId = text6(target?.chapterId, "document.target.chapterId", errors, 63);
-  const environment = text6(target?.environment, "document.target.environment", errors, 63);
+  const appId = text7(source?.appId, "document.source.appId", errors, 63);
+  const chapterId = text7(target?.chapterId, "document.target.chapterId", errors, 63);
+  const environment = text7(target?.environment, "document.target.environment", errors, 63);
   if (appId && !SLUG.test(appId)) errors.push("document.source.appId must be a lowercase app slug");
   if (chapterId && !SLUG.test(chapterId)) errors.push("document.target.chapterId must be a lowercase app slug");
   if (environment && !ENVIRONMENT.test(environment)) errors.push("document.target.environment is invalid");
@@ -8457,14 +8916,45 @@ async function memberContentDigest(document) {
   return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 
+// src/member-content-kinds.ts
+var MEMBER_PAGE_FEATURES = ["course", "share"];
+var MEMBER_PAGE_ICONS = [
+  "home",
+  "course",
+  "library",
+  "deals",
+  "training",
+  "events",
+  "members",
+  "share",
+  "profile",
+  "document",
+  "calendar",
+  "chat",
+  "star"
+];
+var MEMBER_PAGE_TAGS = ["new"];
+function composeMemberSections(parent, chapter, pages) {
+  const parentDeclared = new Map((parent?.sections ?? []).map((section) => [section.id, section]));
+  const out = /* @__PURE__ */ new Map();
+  for (const section of chapter?.sections ?? []) {
+    const label = section.label ?? parentDeclared.get(section.id)?.label;
+    out.set(section.id, { id: section.id, ...label ? { label } : {} });
+  }
+  for (const section of parent?.sections ?? []) if (!out.has(section.id)) out.set(section.id, section);
+  const named = [...new Set(pages.map((page) => page.navigation.section))];
+  for (const id7 of named.filter((id8) => !out.has(id8)).sort((a, b) => a.localeCompare(b))) out.set(id7, { id: id7, label: id7 });
+  return [...out.values()].filter((section) => named.includes(section.id));
+}
+
 // src/member-content-validation-helpers.ts
 var ID4 = /^[a-z][a-z0-9-]{0,79}$/;
 var SLUG2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var ROOT_KEYS3 = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides"]);
+var ROOT_KEYS3 = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "pages", "upsellOverrides", "sections"]);
 var SOURCE_KEYS = /* @__PURE__ */ new Set(["type", "appId"]);
 var TARGET_KEYS = /* @__PURE__ */ new Set(["chapterId", "environment"]);
-var PAGE_KEYS = /* @__PURE__ */ new Set(["id", "slug", "title", "summary", "navigation", "audience", "teaserMarkdown", "bodyMarkdown", "upsell"]);
-var NAV_KEYS = /* @__PURE__ */ new Set(["section", "order", "parentId"]);
+var PAGE_KEYS = /* @__PURE__ */ new Set(["id", "slug", "title", "summary", "navigation", "audience", "teaserMarkdown", "bodyMarkdown", "upsell", "kind", "placeholder", "feature"]);
+var NAV_KEYS = /* @__PURE__ */ new Set(["section", "order", "parentId", "tag", "icon"]);
 var AUDIENCE_KEYS = /* @__PURE__ */ new Set(["kind", "tierIds"]);
 var UPSELL_KEYS = /* @__PURE__ */ new Set(["owner", "offer"]);
 var OFFER_KEYS = /* @__PURE__ */ new Set(["tierId", "label", "bodyMarkdown", "ctaLabel"]);
@@ -8473,8 +8963,8 @@ var MAX_PAGES = 100;
 var MAX_MARKDOWN2 = 65536;
 var MAX_TEXT = 240;
 var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function unknownKeys2(value, allowed2, path, errors) {
-  for (const key3 of Object.keys(value)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
+function unknownKeys2(value, allowed, path, errors) {
+  for (const key3 of Object.keys(value)) if (!allowed.has(key3)) errors.push(`${path}.${key3} is not supported`);
 }
 function textValue(value, path, errors, max = MAX_TEXT, required = false) {
   if (value === void 0) {
@@ -8514,13 +9004,140 @@ function offerValue(value, path, errors, tiers, audience) {
   };
 }
 
+// src/member-content-validation-v2.ts
+var SECTION_KEYS = /* @__PURE__ */ new Set(["id", "label"]);
+var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set(["availableYear", "badge", "actionLabel"]);
+var FEATURE_KEYS = /* @__PURE__ */ new Set(["name", "ref"]);
+var MAX_SECTIONS = 24;
+var V2_ROOT_KEYS = ["sections"];
+var V2_PAGE_KEYS = ["kind", "placeholder", "feature"];
+var V2_NAV_KEYS = ["tag", "icon"];
+function rejectV2Fields(raw2, keys3, path, errors) {
+  for (const key3 of keys3) if (raw2[key3] !== void 0) errors.push(`${path}.${key3} requires schemaVersion 2`);
+}
+function sectionsValue(value, errors) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    errors.push("document.sections must be an array");
+    return void 0;
+  }
+  if (value.length > MAX_SECTIONS) errors.push(`document.sections supports at most ${MAX_SECTIONS} entries`);
+  const seen = /* @__PURE__ */ new Set();
+  const sections = [];
+  for (const [index2, item] of value.slice(0, MAX_SECTIONS).entries()) {
+    const path = `document.sections[${index2}]`;
+    const raw2 = record2(item);
+    if (!raw2) {
+      errors.push(`${path} must be an object`);
+      continue;
+    }
+    unknownKeys2(raw2, SECTION_KEYS, path, errors);
+    const id7 = textValue(raw2.id, `${path}.id`, errors, 80, true) ?? "";
+    if (id7 && !ID4.test(id7)) errors.push(`${path}.id must be a lowercase kebab-case id`);
+    if (seen.has(id7)) errors.push(`${path}.id duplicates section "${id7}"`);
+    seen.add(id7);
+    const label = textValue(raw2.label, `${path}.label`, errors, 120);
+    sections.push({ id: id7, ...label ? { label } : {} });
+  }
+  return sections;
+}
+var oneOf = (values, value) => typeof value === "string" && values.includes(value);
+function navigationV2(raw2, path, errors) {
+  const out = {};
+  if (raw2.tag !== void 0) {
+    if (oneOf(MEMBER_PAGE_TAGS, raw2.tag)) out.tag = raw2.tag;
+    else errors.push(`${path}.tag must be one of ${MEMBER_PAGE_TAGS.join(", ")}`);
+  }
+  if (raw2.icon !== void 0) {
+    if (oneOf(MEMBER_PAGE_ICONS, raw2.icon)) out.icon = raw2.icon;
+    else errors.push(`${path}.icon must be one of ${MEMBER_PAGE_ICONS.join(", ")}`);
+  }
+  return out;
+}
+function placeholderValue(value, path, errors) {
+  const raw2 = record2(value);
+  if (!raw2) {
+    errors.push(`${path} must be an object`);
+    return {};
+  }
+  unknownKeys2(raw2, PLACEHOLDER_KEYS, path, errors);
+  const year = raw2.availableYear;
+  if (year !== void 0 && (!Number.isInteger(year) || Number(year) < 2e3 || Number(year) > 2100)) {
+    errors.push(`${path}.availableYear must be a year from 2000 to 2100`);
+  }
+  const badge = textValue(raw2.badge, `${path}.badge`, errors, 60);
+  const actionLabel = textValue(raw2.actionLabel, `${path}.actionLabel`, errors, 80);
+  return {
+    ...Number.isInteger(year) ? { availableYear: Number(year) } : {},
+    ...badge ? { badge } : {},
+    ...actionLabel ? { actionLabel } : {}
+  };
+}
+function featureValue(value, path, errors) {
+  const raw2 = record2(value);
+  if (!raw2) {
+    errors.push(`${path} must be an object`);
+    return void 0;
+  }
+  unknownKeys2(raw2, FEATURE_KEYS, path, errors);
+  if (!oneOf(MEMBER_PAGE_FEATURES, raw2.name)) {
+    errors.push(`${path}.name must be one of ${MEMBER_PAGE_FEATURES.join(", ")}`);
+    return void 0;
+  }
+  const ref = textValue(raw2.ref, `${path}.ref`, errors, 80);
+  if (ref && !SLUG2.test(ref)) errors.push(`${path}.ref must be a lowercase slug`);
+  return { name: raw2.name, ...ref ? { ref } : {} };
+}
+function pageKindValue(raw2, path, errors) {
+  const kind = raw2.kind ?? "markdown";
+  if (kind !== "markdown" && kind !== "placeholder" && kind !== "feature") {
+    errors.push(`${path}.kind must be markdown, placeholder or feature`);
+    return {};
+  }
+  if (kind !== "placeholder" && raw2.placeholder !== void 0) errors.push(`${path}.placeholder requires kind placeholder`);
+  if (kind !== "feature" && raw2.feature !== void 0) errors.push(`${path}.feature requires kind feature`);
+  if (kind === "markdown" && raw2.bodyMarkdown === void 0) errors.push(`${path}.bodyMarkdown is required`);
+  if (kind === "feature" && raw2.bodyMarkdown !== void 0) errors.push(`${path}.bodyMarkdown is not supported on a feature page`);
+  const out = raw2.kind === void 0 ? {} : { kind };
+  if (kind === "placeholder") out.placeholder = placeholderValue(raw2.placeholder ?? {}, `${path}.placeholder`, errors);
+  if (kind === "feature") {
+    if (raw2.feature === void 0) errors.push(`${path}.feature is required for kind feature`);
+    else {
+      const feature = featureValue(raw2.feature, `${path}.feature`, errors);
+      if (feature) out.feature = feature;
+    }
+  }
+  return out;
+}
+function duplicateFeatures(pages, errors) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index2, page] of pages.entries()) {
+    if (!page.feature) continue;
+    const key3 = `${page.feature.name}:${page.feature.ref ?? ""}`;
+    if (seen.has(key3)) errors.push(`document.pages[${index2}].feature duplicates ${page.feature.name}${page.feature.ref ? ` "${page.feature.ref}"` : ""}`);
+    seen.add(key3);
+  }
+}
+function sectionReferences(pages, sections, parentPages, errors) {
+  if (!sections) return;
+  const known = /* @__PURE__ */ new Set([...sections.map((section) => section.id), ...parentPages.map((page) => page.navigation.section)]);
+  for (const [index2, page] of pages.entries()) {
+    if (!known.has(page.navigation.section)) {
+      errors.push(`document.pages[${index2}].navigation.section references undeclared section "${page.navigation.section}"`);
+    }
+  }
+}
+
 // src/member-content-validation.ts
 function validateMemberContentDocument(input, options = {}) {
   const errors = [];
   const root = record2(input);
   if (!root) return { ok: false, errors: ["document must be an object"] };
   unknownKeys2(root, ROOT_KEYS3, "document", errors);
-  if (root.schemaVersion !== MEMBER_CONTENT_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  if (root.schemaVersion !== 1 && root.schemaVersion !== 2) errors.push("document.schemaVersion must be 1 or 2");
+  const v2 = root.schemaVersion === 2;
+  if (!v2) rejectV2Fields(root, V2_ROOT_KEYS, "document", errors);
+  const sections = v2 ? sectionsValue(root.sections, errors) : void 0;
   if (!Number.isInteger(root.revision) || Number(root.revision) < 1) errors.push("document.revision must be a positive integer");
   if (!Number.isInteger(root.generatedAt) || Number(root.generatedAt) < 0) errors.push("document.generatedAt must be a non-negative integer timestamp");
   const sourceRaw = record2(root.source);
@@ -8565,6 +9182,8 @@ function validateMemberContentDocument(input, options = {}) {
       continue;
     }
     unknownKeys2(raw2, PAGE_KEYS, path, errors);
+    if (!v2) rejectV2Fields(raw2, V2_PAGE_KEYS, path, errors);
+    const kindFields = v2 ? pageKindValue(raw2, path, errors) : {};
     const id7 = textValue(raw2.id, `${path}.id`, errors, 80, true) ?? "";
     const slug = textValue(raw2.slug, `${path}.slug`, errors, 120, true) ?? "";
     const title = textValue(raw2.title, `${path}.title`, errors, MAX_TEXT, true) ?? "";
@@ -8579,13 +9198,19 @@ function validateMemberContentDocument(input, options = {}) {
     if (!navRaw) errors.push(`${path}.navigation must be an object`);
     else {
       unknownKeys2(navRaw, NAV_KEYS, `${path}.navigation`, errors);
+      if (!v2) rejectV2Fields(navRaw, V2_NAV_KEYS, `${path}.navigation`, errors);
       const section = textValue(navRaw.section, `${path}.navigation.section`, errors, 120, true) ?? "";
       const order2 = navRaw.order;
       if (!Number.isInteger(order2) || Number(order2) < 0 || Number(order2) > 1e6) {
         errors.push(`${path}.navigation.order must be an integer from 0 to 1,000,000`);
       }
       const parentId = textValue(navRaw.parentId, `${path}.navigation.parentId`, errors, 80);
-      navigation = { section, order: Number.isInteger(order2) ? Number(order2) : index2, ...parentId ? { parentId } : {} };
+      navigation = {
+        section,
+        order: Number.isInteger(order2) ? Number(order2) : index2,
+        ...parentId ? { parentId } : {},
+        ...v2 ? navigationV2(navRaw, `${path}.navigation`, errors) : {}
+      };
     }
     const audienceRaw = record2(raw2.audience);
     let audience = { kind: "all-members" };
@@ -8611,7 +9236,7 @@ function validateMemberContentDocument(input, options = {}) {
     }
     const summary = textValue(raw2.summary, `${path}.summary`, errors, 2e3);
     const teaserMarkdown = textValue(raw2.teaserMarkdown, `${path}.teaserMarkdown`, errors, MAX_MARKDOWN2);
-    const bodyMarkdown = textValue(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, true) ?? "";
+    const bodyMarkdown = textValue(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN2, !v2);
     let upsell;
     if (raw2.upsell !== void 0) {
       const upsellRaw = record2(raw2.upsell);
@@ -8628,7 +9253,22 @@ function validateMemberContentDocument(input, options = {}) {
         else if (owner === "chapter") upsell = { owner, ...offer ? { offer } : {} };
       }
     }
-    pages.push({ id: id7, slug, title, ...summary ? { summary } : {}, navigation, audience, ...teaserMarkdown ? { teaserMarkdown } : {}, bodyMarkdown, ...upsell ? { upsell } : {} });
+    pages.push({
+      id: id7,
+      slug,
+      title,
+      ...summary ? { summary } : {},
+      navigation,
+      audience,
+      ...teaserMarkdown ? { teaserMarkdown } : {},
+      ...bodyMarkdown !== void 0 ? { bodyMarkdown } : {},
+      ...upsell ? { upsell } : {},
+      ...kindFields
+    });
+  }
+  if (v2) {
+    duplicateFeatures(pages, errors);
+    sectionReferences(pages, sections, options.parentPages ?? [], errors);
   }
   const allIds = /* @__PURE__ */ new Set([...knownParentIds, ...ids2]);
   for (const [index2, page] of pages.entries()) {
@@ -8675,21 +9315,21 @@ function validateMemberContentDocument(input, options = {}) {
   }
   if (errors.length) return { ok: false, errors };
   return { ok: true, value: {
-    schemaVersion: MEMBER_CONTENT_SCHEMA_VERSION,
+    schemaVersion: v2 ? 2 : 1,
     revision: Number(root.revision),
     generatedAt: Number(root.generatedAt),
     source,
     ...target ? { target } : {},
     pages,
-    ...upsellOverrides ? { upsellOverrides } : {}
+    ...upsellOverrides ? { upsellOverrides } : {},
+    ...sections ? { sections } : {}
   } };
 }
 
 // src/member-content.ts
-var MEMBER_CONTENT_SCHEMA_VERSION = 1;
 var MEMBER_CONTENT_PATH = "/api/member-content";
 var MEMBER_CONTENT_CONTROL_PATH = "/api/member-content-control";
-var pageOrder = (a, b) => a.navigation.section.localeCompare(b.navigation.section) || a.navigation.order - b.navigation.order || a.title.localeCompare(b.title) || a.id.localeCompare(b.id);
+var pageOrder = (rank) => (a, b) => (rank.get(a.navigation.section) ?? 0) - (rank.get(b.navigation.section) ?? 0) || a.navigation.order - b.navigation.order || a.title.localeCompare(b.title) || a.id.localeCompare(b.id);
 function composeMemberContent(parent, chapter) {
   const pages = [];
   const parentPages = /* @__PURE__ */ new Map();
@@ -8708,20 +9348,24 @@ function composeMemberContent(parent, chapter) {
     }
     pages.push({ ...page, source: chapter.source });
   }
+  const sections = composeMemberSections(parent, chapter, pages);
+  const rank = new Map(sections.map((section, index2) => [section.id, index2]));
   return {
-    pages: pages.sort(pageOrder),
+    pages: pages.sort(pageOrder(rank)),
+    sections,
     parentRevision: parent?.revision ?? null,
     chapterRevision: chapter?.revision ?? null
   };
 }
-var allowed = (page, viewer) => viewer.admin || page.audience.kind === "all-members" || viewer.tierId !== null && page.audience.tierIds.includes(viewer.tierId);
+var memberPageAllowed = (page, viewer) => viewer.admin || page.audience.kind === "all-members" || viewer.tierId !== null && page.audience.tierIds.includes(viewer.tierId);
 function projectMemberContent(content, viewer, tiers) {
   const authority = new Map(tiers.filter((tier) => tier.active !== false).map((tier) => [tier.id, tier]));
   return {
     viewer: { ...viewer },
     revisions: { parent: content.parentRevision, chapter: content.chapterRevision },
+    sections: content.sections ?? composeMemberSections(null, null, content.pages),
     pages: content.pages.map((page) => {
-      const canRead = allowed(page, viewer);
+      const canRead = memberPageAllowed(page, viewer);
       const offer = !canRead ? page.upsell?.offer : void 0;
       const tier = offer ? authority.get(offer.tierId) : void 0;
       const upsell = offer && tier && typeof tier.name === "string" && typeof tier.priceCents === "number" ? { ...offer, tierName: tier.name, priceCents: tier.priceCents } : void 0;
@@ -8734,8 +9378,11 @@ function projectMemberContent(content, viewer, tiers) {
         audience: page.audience,
         source: page.source,
         access: canRead ? "allowed" : "locked",
+        kind: page.kind ?? "markdown",
+        ...page.placeholder ? { placeholder: page.placeholder } : {},
+        ...page.feature ? { feature: page.feature } : {},
         ...page.teaserMarkdown ? { teaserMarkdown: page.teaserMarkdown } : {},
-        ...canRead ? { bodyMarkdown: page.bodyMarkdown } : {},
+        ...canRead && page.bodyMarkdown !== void 0 ? { bodyMarkdown: page.bodyMarkdown } : {},
         ...upsell ? { upsell } : {}
       };
     })
@@ -8747,33 +9394,33 @@ var control = (row2) => row2 && row2.document && typeof row2.document === "objec
 var local2 = (row2) => row2 && row2.document && typeof row2.document === "object" ? row2 : null;
 async function exists(db, ns, where) {
   if (db.aggregate) return Number((await db.aggregate(ns, { count: true }, { where })).count ?? 0) > 0;
-  const rows5 = (await db.query({ [ns]: {} }))[ns] ?? [];
-  return rows5.some((row2) => Object.entries(where).every(([key3, value]) => row2[key3] === value));
+  const rows6 = (await db.query({ [ns]: {} }))[ns] ?? [];
+  return rows6.some((row2) => Object.entries(where).every(([key3, value]) => row2[key3] === value));
 }
 async function loadActiveMemberContentControl(db, targetId, environment) {
   const where = { targetId, environment, active: true };
   if (!await exists(db, "memberContentControls", where)) return null;
-  const rows5 = (await db.query({ memberContentControls: { $: {
+  const rows6 = (await db.query({ memberContentControls: { $: {
     where,
     order: { revision: "desc" },
     limit: 1
   } } })).memberContentControls;
-  return control(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  return control(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLatestMemberContentControl(db, targetId, environment) {
   const where = { targetId, environment };
   if (!await exists(db, "memberContentControls", where)) return null;
-  const rows5 = (await db.query({ memberContentControls: { $: {
+  const rows6 = (await db.query({ memberContentControls: { $: {
     where,
     order: { revision: "desc" },
     limit: 1
   } } })).memberContentControls;
-  return control(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  return control(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLocalMemberContent(db, chapterId, environment) {
   const id7 = `member-content-local:${environment}`;
-  const rows5 = (await db.query({ memberContentLocal: { $: { where: { id: id7 }, limit: 1 } } })).memberContentLocal;
-  return local2(Array.isArray(rows5) ? rows5[0] : void 0);
+  const rows6 = (await db.query({ memberContentLocal: { $: { where: { id: id7 }, limit: 1 } } })).memberContentLocal;
+  return local2(Array.isArray(rows6) ? rows6[0] : void 0);
 }
 async function materializeMemberContentControl(db, envelope, previous, receivedAt) {
   const { document, digest } = envelope;
@@ -8820,7 +9467,8 @@ async function saveLocalMemberContent(db, document, environment, expectedRevisio
 var ADMIN_PATH = "/api/admin/member-content";
 var BODY_CAP = 1e6;
 var reject4 = (reason, status2, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status2);
-async function groupAndTiers(db, chapterId) {
+async function groupAndTiers(db, chapterId, mode = "chapter") {
+  if (mode === "hub") return { group: null, tiers: [] };
   const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
   const group = Array.isArray(groups) ? groups[0] : void 0;
   if (!group) return { group: null, tiers: [] };
@@ -8857,7 +9505,7 @@ var handleMemberContentControl = async (req, url, env, ctx) => {
   if (document.source.appId !== settings.sourceId) return reject4("wrong_source", 403);
   if (document.target?.chapterId !== ctx.chapter.id) return reject4("wrong_target", 409);
   if (document.target.environment !== env.ODLA_ENV) return reject4("wrong_environment", 409);
-  const { tiers } = await groupAndTiers(db, ctx.chapter.id);
+  const { tiers } = await groupAndTiers(db, ctx.chapter.id, ctx.chapter.mode);
   const checked = validateMemberContentDocument(document, {
     sourceType: "parent",
     sourceAppId: settings.sourceId,
@@ -8911,17 +9559,13 @@ var handleMemberContent = async (req, url, env, ctx) => {
   const user = await ctx.verifyUser(req, env);
   if (!user) return json({ error: "unauthorized" }, 401);
   const db = ctx.makeDb(env);
-  let tierId;
-  try {
-    const member = await memberSessionApplication(db, ctx.chapter.id, env.ODLA_RUNTIME, { userId: user.userId, email: user.email });
-    if (!member || !await chapterMembershipAccess(db, env, ctx, member.source)) return json({ error: "member access required" }, 403);
-    tierId = typeof member.source.tierId === "string" ? member.source.tierId : null;
-  } catch {
-    return json({ error: "membership access unavailable" }, 503);
-  }
+  const resolved = await resolvePortalMember(db, env, ctx, user);
+  if (resolved.status === "unavailable") return json({ error: "membership access unavailable" }, 503);
+  if (resolved.status !== "member") return json({ error: "member access required" }, 403);
+  const tierId = resolved.member.tierId;
   const [{ parent, chapter }, { group, tiers }] = await Promise.all([
     activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
-    groupAndTiers(db, ctx.chapter.id)
+    groupAndTiers(db, ctx.chapter.id, ctx.chapter.mode)
   ]);
   const effective = composeMemberContent(parent?.document, chapter?.document);
   let offerable = tiers;
@@ -8940,7 +9584,7 @@ var handleAdminMemberContent = async (req, url, env, ctx) => {
   if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
   const [{ parent, chapter }, { tiers }] = await Promise.all([
     activeDocuments(db, ctx.chapter.id, env.ODLA_ENV),
-    groupAndTiers(db, ctx.chapter.id)
+    groupAndTiers(db, ctx.chapter.id, ctx.chapter.mode)
   ]);
   if (req.method === "GET") {
     const effective = composeMemberContent(parent?.document, chapter?.document);
@@ -8948,7 +9592,7 @@ var handleAdminMemberContent = async (req, url, env, ctx) => {
       parent: parent ? { revision: parent.revision, digest: parent.digest, document: parent.document } : null,
       chapter: chapter ? { revision: chapter.revision, document: chapter.document } : null,
       effective,
-      tiers: tiers.map(({ id: id7, name, priceCents, active }) => ({ id: id7, name, priceCents, active })),
+      tiers: tiers.map(({ id: id7, name: name2, priceCents, active }) => ({ id: id7, name: name2, priceCents, active })),
       localAuthoring: ctx.chapter.memberContent.localAuthoring
     });
   }
@@ -8975,6 +9619,8 @@ var handleAdminMemberContent = async (req, url, env, ctx) => {
     parentPages: parent?.document.pages ?? []
   });
   if (!checked.ok) return json({ error: "invalid member content", errors: checked.errors }, 400);
+  const tiered = ctx.chapter.mode === "hub" ? checked.value.pages.findIndex((page) => page.audience.kind === "tiers") : -1;
+  if (tiered >= 0) return json({ error: "invalid member content", errors: [`document.pages[${tiered}].audience must be all-members: a hub has no tiers`] }, 400);
   try {
     const saved = await saveLocalMemberContent(
       db,
@@ -8996,13 +9642,521 @@ function withLocalAuthority(value, revision, generatedAt, appId) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return value;
   return {
     ...value,
-    schemaVersion: 1,
+    // The author chooses the contract version; anything else defaults to 1.
+    schemaVersion: value.schemaVersion === 2 ? 2 : 1,
     revision,
     generatedAt,
     source: { type: "chapter", appId }
   };
 }
 
+// src/portal-http.ts
+async function readJsonObject(req, maxBytes) {
+  const text11 = await readBoundedRequestText(req, maxBytes);
+  if (text11 instanceof Response) return text11;
+  try {
+    const value = JSON.parse(text11);
+    if (value && typeof value === "object" && !Array.isArray(value)) return value;
+  } catch {
+  }
+  return json({ error: "invalid JSON body" }, 400);
+}
+
+// src/worker-routes-hub-members.ts
+var HUB_MEMBERS_PATH = "/api/admin/hub-members";
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+async function grantId(emailNormalized) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(emailNormalized));
+  return `hub-member:${Array.from(new Uint8Array(digest).slice(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+var view = (row2) => ({
+  id: row2.id,
+  email: row2.emailNormalized,
+  firstName: row2.firstName ?? null,
+  lastName: row2.lastName ?? null,
+  status: row2.status,
+  grantedBy: row2.grantedBy,
+  grantedAt: row2.grantedAt,
+  revokedBy: row2.revokedBy ?? null,
+  revokedAt: row2.revokedAt ?? null,
+  revision: row2.revision
+});
+var name = (value) => typeof value === "string" && value.trim() ? value.trim().slice(0, 80) : void 0;
+var handleAdminHubMembers = async (req, url, env, ctx) => {
+  if (url.pathname !== HUB_MEMBERS_PATH && !url.pathname.startsWith(`${HUB_MEMBERS_PATH}/`)) return null;
+  if (ctx.chapter.mode !== "hub" || !servesMembers(ctx)) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  const actor = user.email ?? user.userId;
+  if (req.method === "GET" && url.pathname === HUB_MEMBERS_PATH) {
+    const rows6 = (await db.query({ hubMemberGrants: { $: { limit: 1e3 } } })).hubMemberGrants ?? [];
+    return json({ members: rows6.map(view).sort((a, b) => Number(b.grantedAt) - Number(a.grantedAt)) });
+  }
+  if (req.method === "POST" && url.pathname === HUB_MEMBERS_PATH) {
+    const body = await readJsonObject(req, 8192);
+    if (body instanceof Response) return body;
+    const email = typeof body.email === "string" ? body.email.trim() : "";
+    if (!EMAIL.test(email)) return json({ error: "a valid email is required" }, 400);
+    const emailNormalized = normalizeChapterEmail(email);
+    const id7 = await grantId(emailNormalized);
+    const current = (await db.query({ hubMemberGrants: { $: { where: { id: id7 }, limit: 1 } } })).hubMemberGrants?.[0];
+    if (current?.status === "active") return json({ member: view(current), status: "already-active" });
+    const revision = Number(current?.revision ?? 0) + 1;
+    const attrs = {
+      id: id7,
+      emailNormalized,
+      status: "active",
+      grantedBy: actor,
+      grantedAt: Date.now(),
+      revision,
+      ...name(body.firstName) ? { firstName: name(body.firstName) } : {},
+      ...name(body.lastName) ? { lastName: name(body.lastName) } : {}
+    };
+    const ops = [{ t: "update", ns: "hubMemberGrants", id: id7, attrs }];
+    if (current) ops.push({ t: "retract", ns: "hubMemberGrants", id: id7, attrs: ["revokedBy", "revokedAt"] });
+    try {
+      await db.transact(ops, { mutationId: `hub-member-grant:${id7}:${revision}`, guards: [current ? { ns: "hubMemberGrants", id: id7, exists: true, equals: { revision: current.revision } } : { ns: "hubMemberGrants", id: id7, exists: false }] });
+    } catch {
+      return json({ error: "the roster changed; reload and try again" }, 409);
+    }
+    return json({ member: view({ ...current, ...attrs, revokedBy: void 0, revokedAt: void 0 }), status: current ? "re-granted" : "granted" }, current ? 200 : 201);
+  }
+  if (req.method === "DELETE" && url.pathname.startsWith(`${HUB_MEMBERS_PATH}/`)) {
+    const id7 = decodeURIComponent(url.pathname.slice(HUB_MEMBERS_PATH.length + 1));
+    const current = (await db.query({ hubMemberGrants: { $: { where: { id: id7 }, limit: 1 } } })).hubMemberGrants?.[0];
+    if (!current) return json({ error: "not found" }, 404);
+    if (current.status !== "active") return json({ member: view(current), status: "already-revoked" });
+    const attrs = { status: "revoked", revokedBy: actor, revokedAt: Date.now(), revision: Number(current.revision) + 1 };
+    try {
+      await db.transact([{ t: "update", ns: "hubMemberGrants", id: id7, attrs }], {
+        mutationId: `hub-member-revoke:${id7}:${attrs.revision}`,
+        guards: [{ ns: "hubMemberGrants", id: id7, exists: true, equals: { revision: current.revision } }]
+      });
+    } catch {
+      return json({ error: "the roster changed; reload and try again" }, 409);
+    }
+    return json({ member: view({ ...current, ...attrs }), status: "revoked" });
+  }
+  return json({ error: "method not allowed" }, 405);
+};
+
+// src/image-metadata.ts
+var PNG_SIGNATURE = [137, 80, 78, 71, 13, 10, 26, 10];
+var PNG_KEEP = /* @__PURE__ */ new Set(["IHDR", "PLTE", "IDAT", "IEND", "tRNS", "gAMA", "cHRM", "sRGB", "sBIT", "bKGD", "pHYs"]);
+var JPEG_KEEP = (marker) => marker === 224 || marker === 238 || marker === 219 || marker === 196 || marker === 221 || marker >= 192 && marker <= 207 && marker !== 200;
+var u16 = (b, i) => b[i] << 8 | b[i + 1];
+var u32 = (b, i) => (b[i] << 24 >>> 0) + (b[i + 1] << 16) + (b[i + 2] << 8) + b[i + 3];
+function concat(parts) {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+function cleanPng(bytes) {
+  const parts = [bytes.subarray(0, 8)];
+  let width = 0, height = 0, offset = 8, ended = false;
+  while (offset + 12 <= bytes.length) {
+    const length = u32(bytes, offset);
+    const end = offset + 12 + length;
+    if (end > bytes.length) return null;
+    const type = String.fromCharCode(...bytes.subarray(offset + 4, offset + 8));
+    if (type === "IHDR") {
+      width = u32(bytes, offset + 8);
+      height = u32(bytes, offset + 12);
+    }
+    if (PNG_KEEP.has(type)) parts.push(bytes.subarray(offset, end));
+    offset = end;
+    if (type === "IEND") {
+      ended = true;
+      break;
+    }
+  }
+  if (!ended || !width || !height) return null;
+  return { contentType: "image/png", extension: "png", width, height, bytes: concat(parts) };
+}
+function cleanJpeg(bytes) {
+  const parts = [bytes.subarray(0, 2)];
+  let width = 0, height = 0, offset = 2;
+  while (offset + 4 <= bytes.length) {
+    if (bytes[offset] !== 255) return null;
+    const marker = bytes[offset + 1];
+    if (marker === 255) {
+      offset += 1;
+      continue;
+    }
+    const length = u16(bytes, offset + 2);
+    const end = offset + 2 + length;
+    if (length < 2 || end > bytes.length) return null;
+    if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+      height = u16(bytes, offset + 5);
+      width = u16(bytes, offset + 7);
+    }
+    if (marker === 218) {
+      parts.push(bytes.subarray(offset));
+      return width && height ? { contentType: "image/jpeg", extension: "jpg", width, height, bytes: concat(parts) } : null;
+    }
+    if (JPEG_KEEP(marker)) parts.push(bytes.subarray(offset, end));
+    offset = end;
+  }
+  return null;
+}
+function cleanImage(bytes) {
+  if (bytes.length > 8 && PNG_SIGNATURE.every((byte, index2) => bytes[index2] === byte)) return cleanPng(bytes);
+  if (bytes.length > 4 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return cleanJpeg(bytes);
+  return null;
+}
+
+// src/member-profile.ts
+var MEMBER_PROFILE_FIELDS = {
+  preferredName: "person.preferredName",
+  location: "person.region",
+  prompts: "person.profilePrompts",
+  introducedByText: "person.introducedByText"
+};
+var MAX_PROMPT_ANSWER = 280;
+var clean = (value) => value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
+function optionalText(body, key3, max, errors) {
+  if (!(key3 in body)) return void 0;
+  const value = body[key3];
+  if (value === null || value === "") return null;
+  if (typeof value !== "string") {
+    errors.push(`${key3} must be a string`);
+    return void 0;
+  }
+  const text11 = clean(value);
+  if (text11.length > max) errors.push(`${key3} must be at most ${max} characters`);
+  return text11 || null;
+}
+function validateProfilePatch(body, portal) {
+  const errors = [];
+  for (const key3 of Object.keys(body)) {
+    if (key3 === "expectedRevision") continue;
+    if (!(key3 in MEMBER_PROFILE_FIELDS)) errors.push(`${key3} is not an editable profile field`);
+    else if (!MEMBER_SELF_EDITABLE_FIELDS.has(MEMBER_PROFILE_FIELDS[key3])) errors.push(`${key3} is read-only`);
+  }
+  const patch = {};
+  const preferredName = optionalText(body, "preferredName", 80, errors);
+  if (preferredName !== void 0) patch.preferredName = preferredName;
+  const location = optionalText(body, "location", 80, errors);
+  if (location !== void 0) patch.location = location;
+  const introducedByText = optionalText(body, "introducedByText", 120, errors);
+  if (introducedByText !== void 0) patch.introducedByText = introducedByText;
+  if ("prompts" in body) {
+    const raw2 = body.prompts;
+    if (!Array.isArray(raw2)) errors.push("prompts must be an array");
+    else {
+      if (raw2.length > portal.maxPrompts) errors.push(`prompts supports at most ${portal.maxPrompts} answers`);
+      const seen = /* @__PURE__ */ new Set();
+      const prompts = [];
+      for (const [index2, item] of raw2.entries()) {
+        const entry = item && typeof item === "object" ? item : {};
+        const prompt = typeof entry.prompt === "string" ? entry.prompt.trim() : "";
+        const answer = typeof entry.answer === "string" ? clean(entry.answer) : "";
+        if (!portal.profilePrompts.includes(prompt)) errors.push(`prompts[${index2}].prompt is not one of this site's prompts`);
+        if (seen.has(prompt)) errors.push(`prompts[${index2}].prompt is already answered`);
+        if (entry.answer !== void 0 && typeof entry.answer !== "string") errors.push(`prompts[${index2}].answer must be a string`);
+        if (answer.length > MAX_PROMPT_ANSWER) errors.push(`prompts[${index2}].answer must be at most ${MAX_PROMPT_ANSWER} characters`);
+        seen.add(prompt);
+        prompts.push({ prompt, answer });
+      }
+      patch.prompts = prompts;
+    }
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, patch };
+}
+var nameKey = (value) => value.toLowerCase().normalize("NFKC").replace(/[^\p{L}\p{N}\s'-]/gu, " ").replace(/\s+/g, " ").trim();
+
+// src/member-profile-store.ts
+async function loadMemberProfile(db, memberId) {
+  return (await db.query({ memberProfiles: { $: { where: { id: memberId }, limit: 1 } } })).memberProfiles?.[0] ?? null;
+}
+async function membersNamed(db, mode, chapterId, text11, selfId) {
+  const wanted = nameKey(text11);
+  if (!wanted) return [];
+  const rows6 = mode === "hub" ? (await db.query({ hubMemberGrants: { $: { where: { status: "active" }, limit: 5e3 } } })).hubMemberGrants ?? [] : ((await db.query({ applications: { $: { where: { groupId: chapterId, status: "approved" }, limit: 5e3 } } })).applications ?? []).filter((row2) => row2.canceled !== true);
+  return rows6.filter((row2) => String(row2.id) !== selfId && nameKey(`${row2.firstName ?? ""} ${row2.lastName ?? ""}`) === wanted).map((row2) => String(row2.id));
+}
+function reviewItemOp(id7, kind, detail, memberId, relatedMemberId) {
+  return { t: "update", ns: "portalReviewItems", id: id7, attrs: {
+    id: id7,
+    kind,
+    detail,
+    status: "open",
+    createdAt: Date.now(),
+    ...memberId ? { memberId } : {},
+    ...relatedMemberId ? { relatedMemberId } : {}
+  } };
+}
+async function saveMemberProfile(db, input) {
+  const current = await loadMemberProfile(db, input.memberId);
+  if (Number(current?.revision ?? 0) !== input.expectedRevision) throw new Error("member_profile_revision_conflict");
+  const now = Date.now();
+  const revision = input.expectedRevision + 1;
+  const attrs = { id: input.memberId, memberId: input.memberId, revision, updatedAt: now };
+  const retract = [];
+  const set = (key3, value) => {
+    if (value === null) retract.push(key3);
+    else attrs[key3] = value;
+  };
+  if (input.patch.preferredName !== void 0) set("preferredName", input.patch.preferredName);
+  if (input.patch.location !== void 0) set("location", input.patch.location);
+  if (input.patch.prompts !== void 0) attrs.prompts = input.patch.prompts;
+  const ops = [];
+  let review = null;
+  const introduced = input.patch.introducedByText;
+  if (introduced !== void 0 && introduced !== (current?.introducedByText ?? null)) {
+    set("introducedByText", introduced);
+    if (introduced === null) retract.push("introducedByMemberId", "introducedAt");
+    else {
+      const matches2 = await membersNamed(db, input.mode, input.chapterId, introduced, input.memberId);
+      if (matches2.length === 1) {
+        Object.assign(attrs, { introducedByMemberId: matches2[0], introducedAt: now });
+        review = "matched";
+      } else {
+        retract.push("introducedByMemberId", "introducedAt");
+        ops.push(reviewItemOp(
+          `introduction:${input.memberId}:${revision}`,
+          "introduction_unmatched",
+          { text: introduced, candidates: matches2.length },
+          input.memberId
+        ));
+        review = "queued";
+      }
+    }
+  }
+  ops.unshift({ t: "update", ns: "memberProfiles", id: input.memberId, attrs });
+  const absent = retract.filter((key3) => current && current[key3] !== void 0);
+  if (absent.length) ops.splice(1, 0, { t: "retract", ns: "memberProfiles", id: input.memberId, attrs: absent });
+  await db.transact(ops, {
+    mutationId: `member-profile:${input.memberId}:${revision}`,
+    guards: [current ? { ns: "memberProfiles", id: input.memberId, exists: true, equals: { revision: input.expectedRevision } } : { ns: "memberProfiles", id: input.memberId, exists: false }]
+  });
+  const row2 = { ...current, ...attrs };
+  for (const key3 of absent) delete row2[key3];
+  return { row: row2, review };
+}
+
+// src/worker-routes-member-profile.ts
+var MEMBER_PROFILE_PATH = "/api/member/profile";
+var MEMBER_PHOTO_PATH = "/api/member/profile/photo";
+var MAX_PHOTO_BYTES = 10 * 1024 * 1024;
+var PHOTO_SIZE = 400;
+async function portalMemberGate(req, env, ctx) {
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  const resolved = await resolvePortalMember(db, env, ctx, user);
+  if (resolved.status === "unavailable") return json({ error: "membership access unavailable" }, 503);
+  if (resolved.status !== "member") return json({ error: "member access required" }, 403);
+  return { db, member: resolved.member };
+}
+async function profileView(db, ctx, member) {
+  const row2 = await loadMemberProfile(db, member.memberId);
+  const portal = ctx.chapter.memberPortal;
+  return {
+    revision: Number(row2?.revision ?? 0),
+    identity: await portalIdentity(db, ctx, member),
+    profile: {
+      preferredName: row2?.preferredName ?? null,
+      location: row2?.location ?? null,
+      prompts: Array.isArray(row2?.prompts) ? row2.prompts : [],
+      introducedByText: row2?.introducedByText ?? null,
+      introducedByMatched: typeof row2?.introducedByMemberId === "string"
+    },
+    promptChoices: portal.profilePrompts,
+    maxPrompts: portal.maxPrompts,
+    photos: portal.photos
+  };
+}
+var handleMemberProfile = async (req, url, env, ctx) => {
+  if (url.pathname !== MEMBER_PROFILE_PATH && url.pathname !== MEMBER_PHOTO_PATH) return null;
+  const portal = ctx.chapter.memberPortal;
+  if (!portal) return json({ error: "not found" }, 404);
+  const gate12 = await portalMemberGate(req, env, ctx);
+  if (gate12 instanceof Response) return gate12;
+  const { db, member } = gate12;
+  if (url.pathname === MEMBER_PHOTO_PATH) return uploadPhoto(req, db, ctx, member);
+  if (req.method === "GET") return json(await profileView(db, ctx, member));
+  if (req.method !== "PUT") return json({ error: "method not allowed" }, 405);
+  const body = await readJsonObject(req, 16384);
+  if (body instanceof Response) return body;
+  const expectedRevision = body.expectedRevision;
+  if (!Number.isInteger(expectedRevision) || Number(expectedRevision) < 0) {
+    return json({ error: "expectedRevision must be a non-negative integer" }, 400);
+  }
+  const checked = validateProfilePatch(body, portal);
+  if (!checked.ok) return json({ error: "invalid profile", errors: checked.errors }, 400);
+  try {
+    const saved = await saveMemberProfile(db, {
+      mode: ctx.chapter.mode,
+      chapterId: ctx.chapter.id,
+      memberId: member.memberId,
+      patch: checked.patch,
+      expectedRevision: Number(expectedRevision)
+    });
+    return json({ ...await profileView(db, ctx, member), introducedBy: saved.review });
+  } catch (error) {
+    if (error instanceof Error && error.message === "member_profile_revision_conflict") {
+      return json({ error: "your profile changed elsewhere; reload before saving" }, 409);
+    }
+    return json({ error: "profile could not be saved" }, 503);
+  }
+};
+async function uploadPhoto(req, db, ctx, member) {
+  if (req.method !== "POST") return json({ error: "method not allowed" }, 405);
+  if (!ctx.chapter.memberPortal?.photos || !db.storage) return json({ error: "photos are not enabled" }, 404);
+  const declared = Number(req.headers.get("content-length") ?? 0);
+  if (declared > MAX_PHOTO_BYTES) return json({ error: "photo is larger than 10 MB" }, 413);
+  const bytes = new Uint8Array(await req.arrayBuffer());
+  if (bytes.length > MAX_PHOTO_BYTES) return json({ error: "photo is larger than 10 MB" }, 413);
+  const image = cleanImage(bytes);
+  if (!image) return json({ error: "photo must be a JPEG or PNG" }, 415);
+  if (image.width > PHOTO_SIZE || image.height > PHOTO_SIZE) {
+    return json({ error: `photo must be at most ${PHOTO_SIZE} by ${PHOTO_SIZE} pixels` }, 422);
+  }
+  const now = Date.now();
+  const path = `member-photos/${encodeURIComponent(member.memberId)}/${now}.${image.extension}`;
+  await db.storage.upload(path, new Blob([image.bytes], { type: image.contentType }), image.contentType, { private: true });
+  const previous = await loadMemberProfile(db, member.memberId);
+  await db.transact([{ t: "update", ns: "memberProfiles", id: member.memberId, attrs: {
+    id: member.memberId,
+    memberId: member.memberId,
+    photoPath: path,
+    photoUpdatedAt: now,
+    updatedAt: now,
+    ...previous ? {} : { revision: 0 }
+  } }], { mutationId: `member-photo:${member.memberId}:${now}` });
+  const old = typeof previous?.photoPath === "string" ? previous.photoPath : null;
+  if (old && old !== path) await db.storage.delete(old).catch(() => void 0);
+  return json({ photoUrl: await db.storage.sign(path, 3600), width: image.width, height: image.height });
+}
+
+// src/worker-routes-admin-member-tier.ts
+var PATH5 = /^\/api\/admin\/applications\/([^/]+)\/entitlement-tier$/;
+var handleAdminMemberTier = async (req, url, env, ctx) => {
+  const match = PATH5.exec(url.pathname);
+  if (!match) return null;
+  if (ctx.chapter.mode !== "chapter") return json({ error: "not found" }, 404);
+  if (!["GET", "POST", "DELETE"].includes(req.method)) return json({ error: "method not allowed" }, 405);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  const id7 = decodeURIComponent(match[1]);
+  const app = (await db.query({ applications: { $: { where: { id: id7 }, limit: 1 } } })).applications?.[0];
+  if (!app || app.groupId !== ctx.chapter.id) return json({ error: "not found" }, 404);
+  const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
+  const tiers = group ? await loadTiers(db, group) : [];
+  if (req.method === "GET") {
+    const history = (await db.query({ memberTierChanges: { $: { where: { applicationId: id7 }, limit: 50 } } })).memberTierChanges ?? [];
+    return json({
+      purchasedTierId: app.tierId ?? null,
+      entitledTierId: entitledTierId(app),
+      entitlementTierEndsAt: app.entitlementTierEndsAt ?? null,
+      tiers: tiers.filter((tier) => tier.active !== false).map(({ id: tierId, name: name2 }) => ({ id: tierId, name: name2 })),
+      history: history.sort((a, b) => Number(b.at) - Number(a.at))
+    });
+  }
+  const body = await readJsonObject(req, 8192);
+  if (body instanceof Response) return body;
+  if (app.status !== "approved" || app.canceled === true) return json({ error: "only an approved member can change tier" }, 409);
+  const reason = typeof body.reason === "string" ? body.reason.trim() : "";
+  if (!reason || reason.length > 500) return json({ error: "a reason of up to 500 characters is required" }, 400);
+  const paymentReference = typeof body.paymentReference === "string" && body.paymentReference.trim() ? body.paymentReference.trim().slice(0, 200) : void 0;
+  const now = Date.now();
+  let toTierId;
+  let endsAt;
+  if (req.method === "POST") {
+    toTierId = typeof body.tierId === "string" ? body.tierId : "";
+    const tier = tiers.find((candidate) => candidate.id === toTierId);
+    if (!tier || tier.active === false) return json({ error: "tierId must be an active tier" }, 400);
+    if (body.endsAt !== void 0) {
+      endsAt = Number(body.endsAt);
+      if (!Number.isSafeInteger(endsAt) || endsAt <= now) return json({ error: "endsAt must be a future timestamp" }, 400);
+    }
+  } else if (app.entitlementTierId === void 0) return json({ error: "no entitlement tier to revert" }, 409);
+  const fromTierId = entitledTierId(app, now) ?? void 0;
+  const changeId = `tier-change:${id7}:${now}`;
+  const ops = [
+    { t: "update", ns: "memberTierChanges", id: changeId, attrs: {
+      id: changeId,
+      applicationId: id7,
+      reason,
+      actor: user.email ?? user.userId,
+      at: now,
+      ...fromTierId ? { fromTierId } : {},
+      ...toTierId ? { toTierId } : {},
+      ...endsAt ? { endsAt } : {},
+      ...paymentReference ? { paymentReference } : {}
+    } },
+    toTierId ? { t: "update", ns: "applications", id: id7, attrs: { entitlementTierId: toTierId, ...endsAt ? { entitlementTierEndsAt: endsAt } : {} } } : { t: "retract", ns: "applications", id: id7, attrs: ["entitlementTierId", "entitlementTierEndsAt"] }
+  ];
+  if (toTierId && !endsAt && app.entitlementTierEndsAt !== void 0) ops.push({ t: "retract", ns: "applications", id: id7, attrs: ["entitlementTierEndsAt"] });
+  const current = app.entitlementTierId;
+  try {
+    await db.transact(ops, { mutationId: changeId, guards: [current === void 0 ? { ns: "applications", id: id7, exists: true, equals: { status: "approved" }, absent: ["entitlementTierId"] } : { ns: "applications", id: id7, exists: true, equals: { status: "approved", entitlementTierId: current } }] });
+  } catch {
+    return json({ error: "this member changed; reload and try again" }, 409);
+  }
+  return json({ ok: true, applicationId: id7, fromTierId: fromTierId ?? null, toTierId: toTierId ?? (typeof app.tierId === "string" ? app.tierId : null), endsAt: endsAt ?? null });
+};
+
+// src/worker-routes-admin-portal-review.ts
+var PORTAL_REVIEW_PATH = "/api/admin/portal-review";
+var handleAdminPortalReview = async (req, url, env, ctx) => {
+  if (url.pathname !== PORTAL_REVIEW_PATH && !url.pathname.startsWith(`${PORTAL_REVIEW_PATH}/`)) return null;
+  if (!ctx.chapter.memberPortal) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  if (req.method === "GET" && url.pathname === PORTAL_REVIEW_PATH) {
+    const status2 = url.searchParams.get("status") ?? "open";
+    const where = status2 === "all" ? {} : { status: status2 };
+    const items = (await db.query({ portalReviewItems: { $: { where, limit: 1e3 } } })).portalReviewItems ?? [];
+    return json({ items: items.sort((a, b) => Number(b.createdAt) - Number(a.createdAt)) });
+  }
+  if (req.method !== "POST") return json({ error: "method not allowed" }, 405);
+  const id7 = decodeURIComponent(url.pathname.slice(PORTAL_REVIEW_PATH.length + 1));
+  const body = await readJsonObject(req, 4096);
+  if (body instanceof Response) return body;
+  const decision = typeof body.decision === "string" ? body.decision.trim() : "";
+  if (!decision || decision.length > 1e3) return json({ error: "a decision of up to 1,000 characters is required" }, 400);
+  const item = (await db.query({ portalReviewItems: { $: { where: { id: id7 }, limit: 1 } } })).portalReviewItems?.[0];
+  if (!item) return json({ error: "not found" }, 404);
+  if (item.status !== "open") return json({ error: "already resolved" }, 409);
+  const attrs = { status: "resolved", decision, resolvedBy: user.email ?? user.userId, resolvedAt: Date.now() };
+  try {
+    await db.transact([{ t: "update", ns: "portalReviewItems", id: id7, attrs }], {
+      mutationId: `portal-review:${id7}:resolve`,
+      guards: [{ ns: "portalReviewItems", id: id7, exists: true, equals: { status: "open" } }]
+    });
+  } catch {
+    return json({ error: "already resolved" }, 409);
+  }
+  return json({ item: { ...item, ...attrs } });
+};
+
+// src/worker-routes-member-portal.ts
+var PORTAL_ROUTES = [
+  handleMemberProfile,
+  handleAdminHubMembers,
+  handleAdminMemberTier,
+  handleAdminPortalReview
+];
+var handleMemberPortal = async (req, url, env, ctx) => {
+  for (const route of PORTAL_ROUTES) {
+    const response = await route(req, url, env, ctx);
+    if (response) return response;
+  }
+  return null;
+};
+
 // src/worker-routes-admission-grants.ts
 import { verifyFederatedRequest as verifyFederatedRequest4 } from "@odla-ai/db";
 var reject5 = (reason, status2, errors) => json({ ok: false, reason, ...errors ? { errors } : {} }, status2);
@@ -9383,9 +10537,9 @@ function integer3(value, fallback, min, max) {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
 }
-function projectRecord(record4, allowed2, editable, stagesEnabled, crm) {
+function projectRecord(record4, allowed, editable, stagesEnabled, crm) {
   const fields = Object.fromEntries(
-    allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record4.fields, name) ? [[name, record4.fields[name]]] : [])
+    allowed.flatMap((name2) => Object.prototype.hasOwnProperty.call(record4.fields, name2) ? [[name2, record4.fields[name2]]] : [])
   );
   const def = crm.type(record4.type);
   const editFields = editable.map((id7) => {
@@ -9495,7 +10649,7 @@ async function deliverAdmissionGrants(options) {
 }
 
 // src/worker-routes-network-admission.ts
-var PATH5 = "/api/admin/network/admissions";
+var PATH6 = "/api/admin/network/admissions";
 var RETRY_PATH = "/api/admin/network/admissions/retry";
 var REVOKE_PATH = "/api/admin/network/admissions/revoke";
 var MUTATION_ID2 = /^[A-Za-z0-9_-]{16,128}$/;
@@ -9575,11 +10729,11 @@ async function parseBody(req) {
   }
 }
 var handleAdminNetworkAdmissions = async (req, url, env, ctx) => {
-  if (![PATH5, RETRY_PATH, REVOKE_PATH].includes(url.pathname)) return null;
+  if (![PATH6, RETRY_PATH, REVOKE_PATH].includes(url.pathname)) return null;
   const auth = await gate2(req, env, ctx);
   if ("response" in auth) return auth.response;
   const db = auth.db;
-  if (url.pathname === PATH5 && req.method === "GET") {
+  if (url.pathname === PATH6 && req.method === "GET") {
     const targetId2 = url.searchParams.get("targetId") ?? "";
     const target2 = targetFor(ctx, targetId2);
     if (!target2) return reject6(404, "unknown_target", "admission target is not configured");
@@ -9727,8 +10881,8 @@ function makeCalendar(env) {
 }
 async function firstRow3(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
-  const rows5 = res[ns];
-  return Array.isArray(rows5) ? rows5[0] : void 0;
+  const rows6 = res[ns];
+  return Array.isArray(rows6) ? rows6[0] : void 0;
 }
 async function computeSlots(cal, cfg) {
   const { from, to } = slotWindow(Date.now(), cfg.windowDays);
@@ -10587,18 +11741,18 @@ async function startSubscription(req, env, ctx) {
 
 // src/worker-payment-receipt.ts
 var json2 = (value, status2 = 200) => Response.json(value, { status: status2, headers: { "cache-control": "no-store", "referrer-policy": "no-referrer" } });
-var escape = (text10) => text10.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
+var escape = (text11) => text11.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
 async function paymentReceiptRoute(req, url, env, ctx) {
   const id7 = url.searchParams.get("application");
   if (!id7 || id7.length > 160) return json2({ error: "application required" }, 400);
   if (req.method === "POST" && req.headers.has("origin") && req.headers.get("origin") !== url.origin) return json2({ error: "forbidden" }, 403);
   const db = ctx.makeDb(env);
-  const rows5 = await db.query({ applications: { $: { where: { id: id7 }, limit: 1 } }, subscriptionCheckoutIntents: { $: { where: { id: id7 }, limit: 1 } } });
-  const app = rows5.applications?.[0], intent = rows5.subscriptionCheckoutIntents?.[0];
+  const rows6 = await db.query({ applications: { $: { where: { id: id7 }, limit: 1 } }, subscriptionCheckoutIntents: { $: { where: { id: id7 }, limit: 1 } } });
+  const app = rows6.applications?.[0], intent = rows6.subscriptionCheckoutIntents?.[0];
   if (!app || app.groupId !== ctx.chapter.id || !intent || intent.applicationId !== id7 || intent.appId !== env.ODLA_APP_ID || intent.chapterId !== ctx.chapter.id || intent.environment !== env.ODLA_ENV || intent.runtime !== stripeRuntimeIdentity(env.ODLA_RUNTIME) || app.stripeRuntime !== intent.runtime || app.stripeSubscriptionId !== intent.providerSubscriptionId) return json2({ error: "receipt not found" }, 404);
   const receipt = intent.paymentReceipt;
   if (!receipt) return json2({ pending: true }, 202);
-  const text10 = paymentReceiptText(receipt, ctx.chapter.name);
+  const text11 = paymentReceiptText(receipt, ctx.chapter.name);
   if (req.method === "POST") {
     if (!env.SEND_EMAIL || !env.EMAIL_FROM) return json2({ error: "Email is unavailable. You can print or save your receipt." }, 503);
     const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
@@ -10616,7 +11770,7 @@ async function paymentReceiptRoute(req, url, env, ctx) {
       template: "paymentReceipt",
       to: String(intent.purchaserEmailNormalized),
       applicationId: id7,
-      vars: { chapterName: ctx.chapter.name, receiptText: text10 },
+      vars: { chapterName: ctx.chapter.name, receiptText: text11 },
       dedupeKey: `requested-payment-receipt:${receipt.invoiceId}`,
       event: { label: "Payment receipt", trigger: "Purchaser requests their receipt", audience: "Purchaser", variables: ["chapterName", "receiptText"] }
     });
@@ -10626,7 +11780,7 @@ async function paymentReceiptRoute(req, url, env, ctx) {
   const nonce = crypto.randomUUID();
   return new Response(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Payment receipt</title>
     <style>body{font:16px/1.6 system-ui;max-width:680px;margin:48px auto;padding:24px;color:#17252d}pre{font:inherit;white-space:pre-wrap}button{font:inherit;padding:10px 16px}@media print{button{display:none}body{margin:0}}</style>
-    <h1>Payment receipt</h1><pre>${escape(text10)}</pre><button id="print">Print / save PDF</button>
+    <h1>Payment receipt</h1><pre>${escape(text11)}</pre><button id="print">Print / save PDF</button>
     <script nonce="${nonce}">document.getElementById('print').addEventListener('click',()=>window.print())</script></html>`, {
     headers: {
       "content-type": "text/html; charset=utf-8",
@@ -10659,7 +11813,7 @@ var handlePayments = async (req, url, env, ctx) => {
 
 // src/worker-routes-gifts.ts
 var first4 = (value) => Array.isArray(value) ? value[0] : void 0;
-var rows3 = (value) => Array.isArray(value) ? value : [];
+var rows4 = (value) => Array.isArray(value) ? value : [];
 var invalid = () => json({ error: "gift code is invalid or unavailable" }, 400);
 var userFor = async (req, env, ctx) => {
   const user = await ctx.verifyUser(req, env);
@@ -10697,7 +11851,7 @@ var handleGifts = async (req, url, env, ctx) => {
     const group = first4((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
     return json({
       offers: publicGiftOffers(control3?.document.giftOffers, Date.now()),
-      claims: buyerGiftClaims(rows3(found.giftClaims).sort((a, b) => Number(b.createdAt) - Number(a.createdAt)), Date.now()),
+      claims: buyerGiftClaims(rows4(found.giftClaims).sort((a, b) => Number(b.createdAt) - Number(a.createdAt)), Date.now()),
       refundPolicyText: typeof group?.refundPolicyText === "string" ? group.refundPolicyText : "",
       merchantDisclosureText: typeof group?.merchantDisclosureText === "string" ? group.merchantDisclosureText : ""
     });
@@ -10720,7 +11874,7 @@ var handleGifts = async (req, url, env, ctx) => {
     const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
     if (!group || !stripeSecret || typeof group.stripePublishableKey !== "string") return json({ error: "payments not configured" }, 503);
     const emailNormalized = normalizeChapterEmail(user.email);
-    const applications = rows3((await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications);
+    const applications = rows4((await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications);
     const app = applications.sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
     try {
       return json(await startGiftIntent(db, {
@@ -10850,9 +12004,9 @@ var receiptFor2 = (seat, released) => ({
 });
 async function regiftNamedSeat(db, input, now) {
   membershipClock(now);
-  const name = typeof input.recipientName === "string" ? input.recipientName.trim().replace(/\s+/g, " ") : "";
+  const name2 = typeof input.recipientName === "string" ? input.recipientName.trim().replace(/\s+/g, " ") : "";
   const email = normalizeChapterEmail(typeof input.recipientEmail === "string" ? input.recipientEmail : "");
-  if (name.length < 2 || name.length > 160 || /[\u0000-\u001f\u007f]/.test(input.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) membershipFail("invalid_named_seat_recipient");
+  if (name2.length < 2 || name2.length > 160 || /[\u0000-\u001f\u007f]/.test(input.recipientName) || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) membershipFail("invalid_named_seat_recipient");
   const state = await loadMembershipAuthorityState(db, input);
   const seat = await membershipLoad(db, "networkSeat", input.seatId);
   requireMembershipScope(seat, input);
@@ -10861,7 +12015,7 @@ async function regiftNamedSeat(db, input, now) {
   if (member.namedSeatId !== seat.id) membershipFail("named_seat_primary_conflict");
   if (typeof seat.purchaserEmailNormalized === "string" && seat.purchaserEmailNormalized === email) membershipFail("invalid_named_seat_recipient");
   const history = Array.isArray(seat.formerRecipients) ? seat.formerRecipients : [];
-  if (seat.recipientEmailNormalized === email && seat.recipientName === name && seat.regiftedAt !== void 0 && seat.status === "pending_acceptance") {
+  if (seat.recipientEmailNormalized === email && seat.recipientName === name2 && seat.regiftedAt !== void 0 && seat.status === "pending_acceptance") {
     return receiptFor2(seat, history.at(-1)?.recipientApplicationId ?? null);
   }
   if (!namedSeatRegiftable(seat)) membershipFail("named_seat_not_regiftable");
@@ -10899,7 +12053,7 @@ async function regiftNamedSeat(db, input, now) {
   });
   const ops = [
     membershipUpdate("networkSeat", String(seat.id), {
-      recipientName: name,
+      recipientName: name2,
       recipientEmailNormalized: email,
       recipientClaimId: claimId,
       status: "pending_acceptance",
@@ -11096,16 +12250,16 @@ var handleNamedSeat = async (req, url, env, ctx) => {
 };
 
 // src/named-seat-accepted-notice.ts
-var text7 = (value) => typeof value === "string" ? value : "";
+var text8 = (value) => typeof value === "string" ? value : "";
 async function notifyNamedSeatAccepted(db, env, ctx, input) {
   const purchaser = await membershipLoad(db, "applications", input.primaryApplicationId);
-  if (!purchaser || !chapterBillingApplication(purchaser, ctx.chapter.id, env.ODLA_RUNTIME) || !text7(purchaser.email)) {
+  if (!purchaser || !chapterBillingApplication(purchaser, ctx.chapter.id, env.ODLA_RUNTIME) || !text8(purchaser.email)) {
     return { sent: false, reason: "purchaser-missing" };
   }
   const group = await membershipLoad(db, "groups", ctx.chapter.id);
   if (!group) return { sent: false, reason: "group-missing" };
   const config = emailGroupFrom(group);
-  const purchaserName = [purchaser.firstName, purchaser.lastName].map(text7).join(" ").replace(/\s+/g, " ").trim();
+  const purchaserName = [purchaser.firstName, purchaser.lastName].map(text8).join(" ").replace(/\s+/g, " ").trim();
   return sendTemplated({
     db,
     envName: env.ODLA_ENV,
@@ -11117,12 +12271,12 @@ async function notifyNamedSeatAccepted(db, env, ctx, input) {
   }, {
     group: config,
     template: "seatAccepted",
-    to: text7(purchaser.email),
+    to: text8(purchaser.email),
     dedupeKey: `named-seat-accepted:${input.seatId}`,
     applicationId: input.primaryApplicationId,
     tierId: input.skuId,
     vars: {
-      firstName: text7(purchaser.firstName),
+      firstName: text8(purchaser.firstName),
       purchaserName,
       recipientName: input.recipientName,
       tierName: await tierName(db, group, input.skuId),
@@ -11583,8 +12737,8 @@ async function upcomingEvents(env) {
   const res = await cal.availability.upcoming();
   return res.events.map((e) => ({ eventId: e.eventId, status: e.status, startAt: e.startAt, endAt: e.endAt }));
 }
-function toReconcile(rows5) {
-  return rows5.map((m) => ({
+function toReconcile(rows6) {
+  return rows6.map((m) => ({
     id: String(m.id),
     applicationId: String(m.applicationId),
     googleEventId: typeof m.googleEventId === "string" ? m.googleEventId : null,
@@ -11606,12 +12760,12 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   const query = await db.query({
     meetings: { $: { where: all ? {} : { status: "scheduled" }, order: { startAt: "asc" }, limit: 500 } }
   });
-  let rows5 = Array.isArray(query.meetings) ? query.meetings : [];
-  if (Number.isFinite(from)) rows5 = rows5.filter((m) => Number(m.startAt ?? 0) >= from);
-  if (Number.isFinite(to)) rows5 = rows5.filter((m) => Number(m.startAt ?? 0) <= to);
+  let rows6 = Array.isArray(query.meetings) ? query.meetings : [];
+  if (Number.isFinite(from)) rows6 = rows6.filter((m) => Number(m.startAt ?? 0) >= from);
+  if (Number.isFinite(to)) rows6 = rows6.filter((m) => Number(m.startAt ?? 0) <= to);
   let decisions = [];
   try {
-    decisions = reconcileMeetings(toReconcile(rows5), await upcomingEvents(env), Date.now());
+    decisions = reconcileMeetings(toReconcile(rows6), await upcomingEvents(env), Date.now());
   } catch {
   }
   const patched = /* @__PURE__ */ new Map();
@@ -11638,7 +12792,7 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   };
   const group = (await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups?.[0];
   const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  const meetings = rows5.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
+  const meetings = rows6.map((m) => ({ ...m, ...patched.get(String(m.id)) ?? {}, applicant: applicantOf(m) })).filter((m) => all || m.status === "scheduled");
   return json({ meetings, adopted: decisions.length, timezone });
 };
 
@@ -11777,15 +12931,15 @@ var handleAdminPeople = async (req, url, env, ctx) => {
   for (const a of data.applications ?? []) {
     const key3 = String(a.email ?? "").toLowerCase();
     if (!key3) continue;
-    const name = `${a.firstName ?? ""} ${a.lastName ?? ""}`.trim();
+    const name2 = `${a.firstName ?? ""} ${a.lastName ?? ""}`.trim();
     const row2 = people.get(key3);
     if (row2) {
       if (!row2.application) row2.application = applicationSummary(a);
-      if (!row2.name) row2.name = name;
+      if (!row2.name) row2.name = name2;
     } else {
       people.set(key3, {
         email: String(a.email),
-        name,
+        name: name2,
         userId: null,
         role: null,
         profile: null,
@@ -11794,10 +12948,10 @@ var handleAdminPeople = async (req, url, env, ctx) => {
       });
     }
   }
-  const rows5 = [...people.values()].sort(
+  const rows6 = [...people.values()].sort(
     (x, y) => (y.application?.createdAt ?? -1) - (x.application?.createdAt ?? -1)
   );
-  return json({ people: rows5 });
+  return json({ people: rows6 });
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
@@ -11998,7 +13152,7 @@ async function gate3(req, env, ctx) {
   if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   return rawDb;
 }
-var rows4 = (v) => Array.isArray(v) ? v : [];
+var rows5 = (v) => Array.isArray(v) ? v : [];
 var handleAdminDashboard = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/dashboard") return null;
   const got = await gate3(req, env, ctx);
@@ -12020,8 +13174,8 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
     crm_record: { $: { where: { type: "person" }, limit: 1e3 } },
     groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } }
   });
-  const apps = rows4(data.applications).filter((app) => chapterBillingApplication(app, ctx.chapter.id, env.ODLA_RUNTIME));
-  const incomplete = rows4(data.applications).length >= 1e3 || rows4(data.crm_record).length >= 1e3 || rows4(data.meetings).length >= 500;
+  const apps = rows5(data.applications).filter((app) => chapterBillingApplication(app, ctx.chapter.id, env.ODLA_RUNTIME));
+  const incomplete = rows5(data.applications).length >= 1e3 || rows5(data.crm_record).length >= 1e3 || rows5(data.meetings).length >= 500;
   const applications = {
     total: apps.length,
     last7: apps.filter((a) => a.createdAt >= d7).length,
@@ -12037,7 +13191,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
   for (const a of apps) {
     if (String(a.status) in pipeline) pipeline[String(a.status)] = (pipeline[String(a.status)] ?? 0) + 1;
   }
-  for (const r of rows4(data.crm_record)) {
+  for (const r of rows5(data.crm_record)) {
     if (!appById.has(r.fields?.applicationId)) continue;
     const s = r.stage;
     if (s in pipeline) {
@@ -12045,7 +13199,7 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
       if (Number.isFinite(sc) && sc >= d7) pipelineDelta[s] = (pipelineDelta[s] ?? 0) + 1;
     }
   }
-  const meetings = rows4(data.meetings).filter((m) => appById.has(m.applicationId));
+  const meetings = rows5(data.meetings).filter((m) => appById.has(m.applicationId));
   const upcoming = meetings.filter((m) => m.startAt >= now - 36e5);
   const calls = { upcoming: upcoming.length, needsAttention: meetings.filter((m) => m.drift && m.drift !== "none").length };
   const agenda = upcoming.slice(0, 8).map((m) => {
@@ -12068,12 +13222,12 @@ var handleAdminDashboard = async (req, url, env, ctx) => {
   const sk = await getVaultSecret(db, "stripe_secret_key");
   if (sk) {
     const subsRes = await chapterBillingSubscriptions(sk, ctx.chapter.id, env).catch(() => null);
-    if (subsRes?.complete && rows4(data.applications).length < 1e3) {
+    if (subsRes?.complete && rows5(data.applications).length < 1e3) {
       const subs = subsRes.objects.filter((s) => {
         const a = appById.get(s.metadata?.applicationId);
         return a?.stripeSubscriptionId === s.id && a?.stripeCustomerId === s.customer;
       });
-      const intents = new Map(rows4(data.subscriptionCheckoutIntents).map((i) => [i.applicationId, i]));
+      const intents = new Map(rows5(data.subscriptionCheckoutIntents).map((i) => [i.applicationId, i]));
       const amount = (s) => chapterBillingAmount(s, intents.get(s.metadata?.applicationId), env);
       const subMs = (s) => (s.created ?? 0) * 1e3;
       membersSeries = dashboardMetricData(subs.map((s) => ({ t: subMs(s), v: 1 })), now);
@@ -12112,9 +13266,9 @@ var handleAdminBilling = async (req, url, env, ctx) => {
   const testMode = String(data.groups?.[0]?.stripePublishableKey ?? "").startsWith("pk_test");
   if (!subsRes) return json({ error: "billing lookup failed upstream" }, 502);
   const subById = new Map(subsRes.objects.map((s) => [s.id, s]));
-  const intents = new Map(rows4(data.subscriptionCheckoutIntents).map((i) => [i.applicationId, i]));
+  const intents = new Map(rows5(data.subscriptionCheckoutIntents).map((i) => [i.applicationId, i]));
   const billingRows = [];
-  for (const a of rows4(data.applications)) {
+  for (const a of rows5(data.applications)) {
     if (!chapterBillingApplication(a, ctx.chapter.id, env.ODLA_RUNTIME)) continue;
     if (!a.stripeCustomerId && !a.stripeSubscriptionId) continue;
     const candidate = a.stripeSubscriptionId ? subById.get(a.stripeSubscriptionId) : void 0;
@@ -12150,9 +13304,9 @@ var handleAdminBilling = async (req, url, env, ctx) => {
   return json({
     billingReady: true,
     testMode,
-    truncated: !subsRes.complete || rows4(data.applications).length >= 200,
+    truncated: !subsRes.complete || rows5(data.applications).length >= 200,
     rows: billingRows,
-    summary: subsRes.complete && rows4(data.applications).length < 200 ? summary : null
+    summary: subsRes.complete && rows5(data.applications).length < 200 ? summary : null
   });
 };
 
@@ -12508,7 +13662,7 @@ var handleAdminApplicationPatch = async (req, url, env, ctx) => {
 import { getConfig, saveConfig, validateEmailCopy as validateEmailCopy4 } from "@odla-ai/crm";
 
 // src/email-readiness.ts
-import { isEmailTierName as isEmailTierName2, validateEmailCopy as validateEmailCopy3 } from "@odla-ai/crm";
+import { isEmailTierName as isEmailTierName2, templateSectionNames as templateSectionNames2, templateVars as templateVars2, validateEmailCopy as validateEmailCopy3 } from "@odla-ai/crm";
 
 // src/email-spam-signals.ts
 var TRIGGER_PHRASES = [
@@ -12544,7 +13698,8 @@ var words = (s) => strip(s).split(/\s+/).filter(Boolean);
 var phraseIn = (phrases, haystack) => phrases.find((phrase) => new RegExp(`(?:^|[^a-z0-9])${phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![a-z0-9])`, "i").test(haystack));
 function emailSpamSignals(copy) {
   const subject = typeof copy.subject === "string" ? copy.subject : "";
-  const text10 = typeof copy.text === "string" ? copy.text : "";
+  const text11 = typeof copy.text === "string" ? copy.text : "";
+  const html = typeof copy.html === "string" ? copy.html : "";
   const out = [];
   const letters = strip(subject).replace(/[^A-Za-z]/g, "");
   const shouting = letters.length >= 6 && letters.replace(/[^A-Z]/g, "").length / letters.length > 0.5 || words(subject).some((word) => /^[A-Z]{4,}$/.test(word.replace(/[^A-Za-z]/g, "")));
@@ -12553,11 +13708,12 @@ function emailSpamSignals(copy) {
   if (/^\s*(?:re|fw|fwd)\s*:/i.test(subject)) out.push({ code: "subject-fake-reply", message: "A subject that starts like a reply or forward reads as a spoof when the recipient never wrote first." });
   const subjectHit = phraseIn(SUBJECT_TRIGGERS, strip(subject));
   if (subjectHit) out.push({ code: "subject-trigger-words", message: `The subject uses "${subjectHit}", a word filters weight against the sender.` });
-  const bodyHit = phraseIn(TRIGGER_PHRASES, strip(text10));
+  const bodyHit = phraseIn(TRIGGER_PHRASES, strip(text11));
   if (bodyHit) out.push({ code: "body-trigger-words", message: `The body uses "${bodyHit}", a phrase filters weight against the sender.` });
-  if (/(?:^|\s)[A-Z]{3,}(?:\s+[A-Z]{3,}){2,}(?=\s|$)/.test(strip(text10))) out.push({ code: "body-caps", message: "The body shouts a run of capitalised words; use sentence case." });
-  if (/!{2,}/.test(text10)) out.push({ code: "body-punctuation", message: "Repeated exclamation marks in the body are a classic spam signal." });
-  const urls = [...text10.matchAll(URL_RE2)].map((match) => match[0]);
+  if (/(?:^|\s)[A-Z]{3,}(?:\s+[A-Z]{3,}){2,}(?=\s|$)/.test(strip(text11))) out.push({ code: "body-caps", message: "The body shouts a run of capitalised words; use sentence case." });
+  if (/!{2,}/.test(text11)) out.push({ code: "body-punctuation", message: "Repeated exclamation marks in the body are a classic spam signal." });
+  const urls = [...`${text11}
+${html}`.matchAll(URL_RE2)].map((match) => match[0].replace(/&quot;.*$/, ""));
   const hosts = urls.map((url) => {
     try {
       return new URL(url).hostname;
@@ -12569,7 +13725,7 @@ function emailSpamSignals(copy) {
   if (hosts.some((host) => DEV_HOSTS.test(host) || /^\d+\.\d+\.\d+\.\d+$/.test(host))) out.push({ code: "link-origin", message: "A link points at a development host (workers.dev, pages.dev, localhost or a raw IP). Link to the site's own domain." });
   if (hosts.some((host) => SHORTENERS.test(host))) out.push({ code: "link-shortener", message: "A link uses a URL shortener, which hides the destination and is heavily abused. Link to the real address." });
   if (new Set(urls).size > 5) out.push({ code: "link-many", message: "The body has more than five links. Keep lifecycle mail to the one or two the reader needs." });
-  if (urls.length && words(text10).length < 20) out.push({ code: "body-link-only", message: "The body is little more than a link. Say what the reader is being sent and why before the address." });
+  if (urls.length && words(text11).length < 20) out.push({ code: "body-link-only", message: "The body is little more than a link. Say what the reader is being sent and why before the address." });
   return out;
 }
 function emailSenderWarnings(input) {
@@ -12602,11 +13758,15 @@ function validateEmailReadiness(input) {
     const template = input.templates[key3];
     const problems = !template ? [{ code: "template-missing", message: "No email is configured for this event." }] : validateEmailCopy3(template, { allowedVariables: event2.variables });
     if (template && typeof template.enabled !== "boolean") problems.push({ code: "enabled-missing", message: "Choose explicitly whether this email is enabled. Sending is blocked until then." });
+    const html = typeof template?.html === "string" && template.html.trim() ? template.html : "";
+    if (html) problems.push(...htmlBodyIssues(html, { allowedVariables: event2.variables }));
     if (template) {
-      const used = [...`${template.subject ?? ""}
-${template.text ?? ""}`.matchAll(/\{\{(\w+)\}\}/g)].map((match) => match[1]);
-      for (const name of used) if (name in input.groupValues && !input.groupValues[name]?.trim()) {
-        problems.push({ code: "value-missing", variable: name, message: `Add the ${name} used by this email.` });
+      const copy = `${template.subject ?? ""}
+${template.text ?? ""}
+${html}`;
+      const sectionOnly = new Set(templateSectionNames2(copy));
+      for (const name2 of templateVars2(copy)) if (name2 in input.groupValues && !input.groupValues[name2]?.trim() && !sectionOnly.has(name2)) {
+        problems.push({ code: "value-missing", variable: name2, message: `Add the ${name2} used by this email.` });
       }
     }
     if (event2.requiresTier && input.tiersUnavailable) problems.push({ code: "tiers-unavailable", message: "Tier names are unavailable; delivery checks will block unresolved memberships." });
@@ -12634,6 +13794,7 @@ async function emailSettings(db, ctx, env) {
   const emailTemplates = Object.fromEntries(Object.keys(events).filter((key3) => key3 in stored).map((key3) => [key3, {
     subject: str2(stored[key3]?.subject),
     text: str2(stored[key3]?.text),
+    html: str2(stored[key3]?.html),
     enabled: stored[key3]?.enabled
   }]));
   let tiers = [], tiersUnavailable = false;
@@ -12674,18 +13835,20 @@ async function updateEmailSettings(db, ctx, env, body) {
   if (!group && ctx.chapter.mode !== "hub") return json({ error: "Email settings have not been configured for this chapter." }, 409);
   const templates = body.emailTemplates;
   if (!templates || typeof templates !== "object" || Array.isArray(templates)) return json({ error: "emailTemplates object required" }, 400);
-  const clean = {};
+  const clean2 = {};
   for (const [key3, value] of Object.entries(templates)) {
     if (!events[key3]) continue;
     if (!value || typeof value !== "object" || Array.isArray(value)) return json({ error: `Invalid template: ${key3}` }, 400);
     const t = value;
     if (typeof t.enabled !== "boolean") return json({ error: `Choose whether ${key3} is enabled.` }, 400);
-    const subject = str2(t.subject).trim(), text10 = str2(t.text);
-    const issues = validateEmailCopy4({ subject, text: text10 }, { allowedVariables: events[key3].variables });
-    if (t.enabled && issues.length || issues.some((issue) => ["subject-invalid", "body-invalid"].includes(issue.code))) {
-      return json({ error: `${events[key3].label} is incomplete.`, errors: issues.map((issue) => issue.message) }, 400);
+    const subject = str2(t.subject).trim(), text11 = str2(t.text), html = str2(t.html);
+    if (t.html !== void 0 && typeof t.html !== "string") return json({ error: `Invalid HTML body: ${key3}` }, 400);
+    const issues = validateEmailCopy4({ subject, text: text11 }, { allowedVariables: events[key3].variables });
+    const htmlIssues = html.trim() ? htmlBodyIssues(html, { allowedVariables: events[key3].variables }) : [];
+    if (t.enabled && (issues.length || htmlIssues.length) || issues.some((issue) => ["subject-invalid", "body-invalid"].includes(issue.code)) || html.length > HTML_BODY_LIMIT) {
+      return json({ error: `${events[key3].label} is incomplete.`, errors: [...issues, ...htmlIssues].map((issue) => issue.message) }, 400);
     }
-    clean[key3] = { subject, text: text10, enabled: t.enabled };
+    clean2[key3] = { subject, text: text11, ...html.trim() ? { html } : {}, enabled: t.enabled };
   }
   const notificationEmail = str2(body.notificationEmail).trim(), replyTo = str2(body.replyTo).trim(), debugEmail = str2(body.debugEmail).trim();
   const emailish = /^[^\s@,;<>]+@[^\s@,;<>]+\.[^\s@,;<>]+$/;
@@ -12698,15 +13861,15 @@ async function updateEmailSettings(db, ctx, env, body) {
   if (commitmentText.length > 5e3 || normsText.length > 5e3) return json({ error: "commitment/norms text is too long" }, 400);
   if (ctx.chapter.mode === "hub") {
     const missing = Object.fromEntries(Object.keys(events).filter((key3) => !group?.emailTemplates?.[key3]).map((key3) => [key3, { subject: "", text: "", enabled: false }]));
-    await saveConfig({ db, crm: ctx.chapter.crm }, { emailTemplates: { ...missing, ...clean }, notificationEmail, replyTo, debugEmail });
+    await saveConfig({ db, crm: ctx.chapter.crm }, { emailTemplates: { ...missing, ...clean2 }, notificationEmail, replyTo, debugEmail });
   } else {
     const id7 = { ns: "groups", attr: "id", value: ctx.chapter.id };
     await db.transact([
-      { t: "merge", ns: "groups", id: id7, attrs: { emailTemplates: clean } },
+      { t: "merge", ns: "groups", id: id7, attrs: { emailTemplates: clean2 } },
       { t: "update", ns: "groups", id: id7, attrs: { commitmentText, normsText, notificationEmail, replyTo, debugEmail, fromName } }
     ]);
   }
-  const warnings = Object.fromEntries(Object.entries(clean).map(([key3, template]) => [key3, emailSpamSignals(template)]).filter(([, found]) => found.length));
+  const warnings = Object.fromEntries(Object.entries(clean2).map(([key3, template]) => [key3, emailSpamSignals(template)]).filter(([, found]) => found.length));
   return json({ ok: true, warnings });
 }
 
@@ -12744,8 +13907,8 @@ var handleAdminEmailLog = async (req, url, env, ctx) => {
   const got = await gate5(req, env, ctx);
   if (got instanceof Response) return got;
   if (ctx.chapter.mode === "hub") {
-    const rows5 = await listEmailLog({ db: got, crm: ctx.chapter.crm }, { limit: 50 });
-    return json({ sends: rows5.map((row2) => ({ ...row2, template: row2.templateId })) });
+    const rows6 = await listEmailLog({ db: got, crm: ctx.chapter.crm }, { limit: 50 });
+    return json({ sends: rows6.map((row2) => ({ ...row2, template: row2.templateId })) });
   }
   const { emailLog } = await got.query({ emailLog: { $: { where: { groupId: ctx.chapter.id }, order: { sentAt: "desc" }, limit: 50 } } });
   const visible = [];
@@ -12975,7 +14138,7 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   return json({
     targets: ctx.chapter.network.targets.map(({
       id: id7,
-      name,
+      name: name2,
       url: targetUrl,
       fields,
       sharedNotes,
@@ -12984,7 +14147,7 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
       commercialParity
     }) => ({
       id: id7,
-      name,
+      name: name2,
       url: targetUrl,
       types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS),
       sharedNotes,
@@ -13323,8 +14486,8 @@ function terms(value) {
 function matchesReaderIdentity(record4, search, includeEmail) {
   const query = terms(search);
   if (!query.length) return true;
-  const name = folded(record4.name);
-  const visible = [name, ...name.split(/\s+/u).filter(Boolean)];
+  const name2 = folded(record4.name);
+  const visible = [name2, ...name2.split(/\s+/u).filter(Boolean)];
   if (includeEmail && record4.primaryEmail) visible.push(folded(record4.primaryEmail));
   return query.every((term) => visible.some((candidate) => candidate.includes(term)));
 }
@@ -13353,14 +14516,14 @@ async function listVisibleSearchPopulation(db, where, window, count) {
   })));
   return pages.flatMap((page) => (page[CRM_NS.record] ?? []).map(rowToRecord));
 }
-async function listReaderRecords(db, type, allowed2, emailField, window) {
+async function listReaderRecords(db, type, allowed, emailField, window) {
   const where = baseWhere(type, window.stage);
   const crmDb = db;
   const aggregate = await crmDb.aggregate(CRM_NS.record, { count: true }, { where });
   const candidateCount = aggregate.count ?? 0;
   if (window.search) {
     const population = await listVisibleSearchPopulation(crmDb, where, window, candidateCount);
-    const includeEmail = Boolean(emailField && allowed2.includes(emailField));
+    const includeEmail = Boolean(emailField && allowed.includes(emailField));
     const matches2 = population.filter((record4) => matchesReaderIdentity(record4, window.search, includeEmail));
     return {
       records: matches2.slice(window.offset, window.offset + window.limit),
@@ -13453,7 +14616,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     const editable = reader.editableFields[input.type];
     if (hasFields) {
       const names = Object.keys(fields);
-      if (!editable || names.length === 0 || names.length > 32 || names.some((name) => !editable.includes(name))) {
+      if (!editable || names.length === 0 || names.length > 32 || names.some((name2) => !editable.includes(name2))) {
         return json({ error: "profile fields are not delegated for this reader", code: "field_forbidden" }, 403);
       }
     } else if (!reader.stageTransitions.includes(input.type)) {
@@ -13518,7 +14681,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
         });
       }
       const capabilities = await operationalReaderRecord(record4, reader, db, env, ctx);
-      if (hasFields && Object.keys(fields).some((name) => !capabilities.edit?.fields.some((field) => field.id === name))) {
+      if (hasFields && Object.keys(fields).some((name2) => !capabilities.edit?.fields.some((field) => field.id === name2))) {
         return json({ error: "use the verified identity or application workflow for these fields", code: "field_forbidden" }, 403);
       }
       const deps = { crm: ctx.chapter.crm, db };
@@ -13573,8 +14736,8 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     }
   }
   const type = url.searchParams.get("type") ?? "";
-  const allowed2 = reader.fields[type];
-  if (!IDENTIFIER.test(type) || !allowed2) return json({ error: "record type is not shared with this reader" }, 403);
+  const allowed = reader.fields[type];
+  if (!IDENTIFIER.test(type) || !allowed) return json({ error: "record type is not shared with this reader" }, 403);
   const recordId = url.searchParams.get("recordId");
   if (recordId !== null) {
     if (!RECORD_ID.test(recordId)) return json({ error: "invalid record id" }, 400);
@@ -13602,7 +14765,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     page = await listReaderRecords(
       db,
       type,
-      allowed2,
+      allowed,
       typeDef.emailField,
       window
     );
@@ -13683,8 +14846,8 @@ async function readTargetRecords(db, env, ctx, target, query) {
 async function mutateTargetRecord(db, env, ctx, target, input) {
   const fields = input.fields;
   if (fields) {
-    const allowed2 = target.editableFields[input.type];
-    if (!allowed2 || Object.keys(fields).some((name) => !allowed2.includes(name))) {
+    const allowed = target.editableFields[input.type];
+    if (!allowed || Object.keys(fields).some((name2) => !allowed.includes(name2))) {
       return json({ error: "profile fields are not enabled for this target", code: "field_forbidden" }, 403);
     }
   } else if (!target.stageTransitions.includes(input.type)) {
@@ -14532,20 +15695,20 @@ async function networkPersonBulkSha256(value) {
   const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
   return [...new Uint8Array(bytes)].map((part) => part.toString(16).padStart(2, "0")).join("");
 }
-function assertNetworkPersonBulkRows(rows5) {
-  if (!Array.isArray(rows5) || rows5.length < 1) {
+function assertNetworkPersonBulkRows(rows6) {
+  if (!Array.isArray(rows6) || rows6.length < 1) {
     throw new NetworkPersonRegistryError("bulk_rows_required", "bulk import requires at least one row");
   }
-  if (rows5.length > NETWORK_PERSON_BULK_IMPORT_MAX_ROWS) {
+  if (rows6.length > NETWORK_PERSON_BULK_IMPORT_MAX_ROWS) {
     throw new NetworkPersonRegistryError(
       "bulk_rows_exceeded",
       `bulk import is limited to ${NETWORK_PERSON_BULK_IMPORT_MAX_ROWS.toLocaleString()} rows`
     );
   }
-  return rows5;
+  return rows6;
 }
-async function networkPersonBulkBatchDigest(rows5) {
-  const bounded = assertNetworkPersonBulkRows(rows5);
+async function networkPersonBulkBatchDigest(rows6) {
+  const bounded = assertNetworkPersonBulkRows(rows6);
   return networkPersonBulkSha256(JSON.stringify(stableValue({ version: NETWORK_PERSON_BULK_IMPORT_VERSION, rows: bounded })));
 }
 async function networkPersonRegistryStateDigest(state) {
@@ -14560,7 +15723,7 @@ async function networkPersonRegistryStateDigest(state) {
 function rejectedValidation(errors) {
   return errors.some((error) => /approved|real person|non-development|development or invalid email|fixture, test, sample/i.test(error));
 }
-async function classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state) {
+async function classifyNetworkPersonBulkRows(rows6, allowedChapterIds, state) {
   const aliasIds = new Set(state.aliases.map((alias) => alias.id));
   const batchAliases = /* @__PURE__ */ new Set();
   const claimOwners = /* @__PURE__ */ new Map();
@@ -14571,8 +15734,8 @@ async function classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state) {
   }
   const results = [];
   const values = [];
-  for (let index2 = 0; index2 < rows5.length; index2 += 1) {
-    const validation = validateNetworkPersonImport(rows5[index2], allowedChapterIds);
+  for (let index2 = 0; index2 < rows6.length; index2 += 1) {
+    const validation = validateNetworkPersonImport(rows6[index2], allowedChapterIds);
     if (!validation.ok || !validation.value) {
       const errors = validation.errors.slice(0, 8);
       results.push({ rowNumber: index2 + 2, status: rejectedValidation(errors) ? "rejected" : "invalid", errors });
@@ -14605,8 +15768,8 @@ async function classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state) {
   }
   return { rows: results, values };
 }
-async function previewNetworkPersonBulkImport(db, rows5, allowedChapterIds) {
-  const bounded = assertNetworkPersonBulkRows(rows5);
+async function previewNetworkPersonBulkImport(db, rows6, allowedChapterIds) {
+  const bounded = assertNetworkPersonBulkRows(rows6);
   const state = await loadNetworkPersonRegistry(db);
   const classified = await classifyNetworkPersonBulkRows(bounded, allowedChapterIds, state);
   const counts = networkPersonBulkEmptyCounts();
@@ -14637,8 +15800,8 @@ function eventCounts(event2) {
 }
 async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, allowedChapterIds, now = Date.now()) {
   if (input.reviewed !== true) throw new NetworkPersonRegistryError("bulk_review_required", "the exact preview must be explicitly reviewed before apply");
-  const rows5 = assertNetworkPersonBulkRows(input.rows);
-  const batchDigest = await networkPersonBulkBatchDigest(rows5);
+  const rows6 = assertNetworkPersonBulkRows(input.rows);
+  const batchDigest = await networkPersonBulkBatchDigest(rows6);
   if (!/^[a-f0-9]{64}$/.test(input.expectedBatchDigest) || batchDigest !== input.expectedBatchDigest) {
     throw new NetworkPersonRegistryError("bulk_digest_changed", "bulk import rows changed after preview; preview again");
   }
@@ -14657,7 +15820,7 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
       version: NETWORK_PERSON_BULK_IMPORT_VERSION,
       batchDigest,
       stateDigest: eventString(completed, "stateDigest"),
-      rowCount: Number(completed.detail.rowCount) || rows5.length,
+      rowCount: Number(completed.detail.rowCount) || rows6.length,
       counts: eventCounts(completed),
       rows: [],
       replayed: true
@@ -14665,7 +15828,7 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
   }
   let started = matchingEvent(state.events, startedMutationId, "bulk_import_started");
   if (!started) {
-    const preview = await previewNetworkPersonBulkImport(db, rows5, allowedChapterIds);
+    const preview = await previewNetworkPersonBulkImport(db, rows6, allowedChapterIds);
     if (preview.stateDigest !== input.expectedStateDigest) {
       throw new NetworkPersonRegistryError("bulk_state_changed", "network Person registry changed after preview; preview again");
     }
@@ -14674,7 +15837,7 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
         networkPersonEventOp("bulk_import_started", startedMutationId, actor, now, {
           batchDigest,
           stateDigest: input.expectedStateDigest,
-          rowCount: rows5.length,
+          rowCount: rows6.length,
           previewCounts: preview.counts
         })
       ], {
@@ -14690,7 +15853,7 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
   if (!started || eventString(started, "batchDigest") !== batchDigest || eventString(started, "stateDigest") !== input.expectedStateDigest) {
     throw new NetworkPersonRegistryError("bulk_mutation_conflict", "batch mutation id does not match the reviewed preview");
   }
-  const classified = await classifyNetworkPersonBulkRows(rows5, allowedChapterIds, state);
+  const classified = await classifyNetworkPersonBulkRows(rows6, allowedChapterIds, state);
   const results = [];
   const counts = networkPersonBulkEmptyCounts();
   for (let index2 = 0; index2 < classified.rows.length; index2 += 1) {
@@ -14729,10 +15892,10 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
   }
   if (counts.failed === 0) {
     await db.transact([
-      networkPersonEventOp("bulk_import_completed", completedMutationId, actor, now + rows5.length + 1, {
+      networkPersonEventOp("bulk_import_completed", completedMutationId, actor, now + rows6.length + 1, {
         batchDigest,
         stateDigest: input.expectedStateDigest,
-        rowCount: rows5.length,
+        rowCount: rows6.length,
         counts
       })
     ], { mutationId: completedMutationId });
@@ -14741,7 +15904,7 @@ async function applyNetworkPersonBulkImport(db, input, batchMutationId, actor, a
     version: NETWORK_PERSON_BULK_IMPORT_VERSION,
     batchDigest,
     stateDigest: input.expectedStateDigest,
-    rowCount: rows5.length,
+    rowCount: rows6.length,
     counts,
     rows: results
   };
@@ -14862,7 +16025,7 @@ async function revealNetworkPersonRegistryRecord(db, input, mutationId, actor, n
 }
 
 // src/worker-routes-network-person-registry.ts
-var PATH6 = "/api/admin/network-person-registry";
+var PATH7 = "/api/admin/network-person-registry";
 var MAX_BODY2 = 8 * 1024 * 1024;
 var MUTATION_ID4 = /^[A-Za-z0-9_-]{16,128}$/;
 var positiveRevision = (value) => {
@@ -14887,7 +16050,7 @@ function registryError(error) {
   return null;
 }
 var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
-  if (url.pathname !== PATH6) return null;
+  if (url.pathname !== PATH7) return null;
   if (!ctx.chapter.networkPersonRegistry) return json({ error: "not found" }, 404);
   if (req.method !== "GET" && req.method !== "POST") return json({ error: "method not allowed" }, 405);
   if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_BODY2) {
@@ -14899,9 +16062,9 @@ var handleAdminNetworkPersonRegistry = async (req, url, env, ctx) => {
   if (req.method === "POST") {
     let body;
     try {
-      const text10 = await req.text();
-      if (new TextEncoder().encode(text10).byteLength > MAX_BODY2) return json({ error: "request is too large" }, 413);
-      const parsed = JSON.parse(text10);
+      const text11 = await req.text();
+      if (new TextEncoder().encode(text11).byteLength > MAX_BODY2) return json({ error: "request is too large" }, 413);
+      const parsed = JSON.parse(text11);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("invalid");
       body = parsed;
     } catch {
@@ -15070,7 +16233,7 @@ import { signFederatedRequest as signFederatedRequest7, verifyFederatedRequest a
 // src/network-commercial-parity.ts
 var DIGEST = /^[0-9a-f]{64}$/;
 var MAX_RECORDS = 500;
-var text8 = (value, max = 255) => typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
+var text9 = (value, max = 255) => typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
 function parityMessage(partition, kind, value) {
   return [
     "chapter-commercial-parity",
@@ -15102,18 +16265,18 @@ async function digestWithKey(key3, partition, kind, value) {
 async function buildChapterCommercialParitySnapshot(input) {
   const requestedMax = input.maxRecords ?? MAX_RECORDS;
   const maxRecords = Number.isSafeInteger(requestedMax) ? Math.max(0, Math.min(requestedMax, MAX_RECORDS)) : MAX_RECORDS;
-  const eligible = input.rows.filter((row2) => text8(row2.id) && (text8(row2.stripeCustomerId) || text8(row2.stripeSubscriptionId)));
+  const eligible = input.rows.filter((row2) => text9(row2.id) && (text9(row2.stripeCustomerId) || text9(row2.stripeSubscriptionId)));
   const selected2 = eligible.slice(0, maxRecords);
   const key3 = await parityKey(input.secret);
   const records = await Promise.all(selected2.map(async (row2) => {
-    const applicationId = text8(row2.id);
-    const customerId = text8(row2.stripeCustomerId);
-    const subscriptionId = text8(row2.stripeSubscriptionId);
+    const applicationId = text9(row2.id);
+    const customerId = text9(row2.stripeCustomerId);
+    const subscriptionId = text9(row2.stripeSubscriptionId);
     return {
       applicationDigest: await digestWithKey(key3, input.partition, "application", applicationId),
       customerDigest: customerId ? await digestWithKey(key3, input.partition, "customer", customerId) : null,
       subscriptionDigest: subscriptionId ? await digestWithKey(key3, input.partition, "subscription", subscriptionId) : null,
-      status: text8(row2.status, 64),
+      status: text9(row2.status, 64),
       canceled: row2.canceled === true
     };
   }));
@@ -15139,7 +16302,7 @@ function validSnapshot(snapshot, source) {
   if (snapshot?.version !== 1 || snapshot.site?.id !== source.chapterId || !partition || !Array.isArray(records) || records.length > MAX_RECORDS || partition.appId !== source.appId || partition.chapterId !== source.chapterId || partition.environment !== source.environment || partition.dataEnvironment !== source.dataEnvironment || partition.runtime !== source.runtime || typeof snapshot.complete !== "boolean" || typeof snapshot.truncated !== "boolean" || !snapshot.counts) return false;
   const seen = /* @__PURE__ */ new Set();
   for (const record4 of records) {
-    if (!DIGEST.test(record4.applicationDigest) || record4.customerDigest !== null && !DIGEST.test(record4.customerDigest) || record4.subscriptionDigest !== null && !DIGEST.test(record4.subscriptionDigest) || record4.status !== null && text8(record4.status, 64) === null || typeof record4.canceled !== "boolean") return false;
+    if (!DIGEST.test(record4.applicationDigest) || record4.customerDigest !== null && !DIGEST.test(record4.customerDigest) || record4.subscriptionDigest !== null && !DIGEST.test(record4.subscriptionDigest) || record4.status !== null && text9(record4.status, 64) === null || typeof record4.canceled !== "boolean") return false;
     const key3 = recordKey(record4);
     if (seen.has(key3)) return false;
     seen.add(key3);
@@ -15150,16 +16313,16 @@ async function reconcileCommercialParitySnapshot(input) {
   if (!validSnapshot(input.snapshot, input.source)) throw new Error("invalid chapter commercial parity snapshot");
   const sourceKey = networkCommercialSourceKey(input.source);
   const key3 = await parityKey(input.secret);
-  const shadow = await Promise.all(input.projection.subscriptions.filter((row2) => row2.sourceKey === sourceKey && text8(row2.applicationId) && text8(row2.objectId)).map(async (row2) => {
-    const customerId = text8(row2.customerId);
-    const subscriptionId = text8(row2.subscriptionId) ?? text8(row2.objectId);
+  const shadow = await Promise.all(input.projection.subscriptions.filter((row2) => row2.sourceKey === sourceKey && text9(row2.applicationId) && text9(row2.objectId)).map(async (row2) => {
+    const customerId = text9(row2.customerId);
+    const subscriptionId = text9(row2.subscriptionId) ?? text9(row2.objectId);
     return {
       applicationDigest: await digestWithKey(key3, input.snapshot.partition, "application", row2.applicationId),
       customerDigest: customerId ? await digestWithKey(key3, input.snapshot.partition, "customer", customerId) : null,
       subscriptionDigest: subscriptionId ? await digestWithKey(key3, input.snapshot.partition, "subscription", subscriptionId) : null,
       status: null,
       canceled: false,
-      stripeStatus: text8(row2.status, 64),
+      stripeStatus: text9(row2.status, 64),
       stripeCanceled: row2.status === "canceled"
     };
   }));
@@ -15241,14 +16404,14 @@ var PAGE2 = 500;
 var MAX_SCAN = 5e3;
 var MAX_RECORDS2 = 500;
 async function localCommercialRows(db) {
-  const rows5 = [];
+  const rows6 = [];
   for (let offset = 0; offset < MAX_SCAN; offset += PAGE2) {
     const result = await db.query({ applications: { $: { limit: PAGE2, offset, order: { createdAt: "asc" } } } });
     const page = Array.isArray(result.applications) ? result.applications : [];
-    rows5.push(...page.slice(0, MAX_SCAN - rows5.length));
-    if (page.length < PAGE2) return { rows: rows5, truncated: false };
+    rows6.push(...page.slice(0, MAX_SCAN - rows6.length));
+    if (page.length < PAGE2) return { rows: rows6, truncated: false };
   }
-  return { rows: rows5, truncated: true };
+  return { rows: rows6, truncated: true };
 }
 var handleNetworkCommercialParity = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== PARITY_PATH) return null;
@@ -15383,8 +16546,8 @@ async function applyHostedMembershipDispute(env, ctx, fact, now) {
     const receipt2 = await reconcileMembershipDispute(db, { ...scopeOf(seat), eventId: fact.eventId }, now, secret, charge);
     return { disposition: "applied", membershipId: receipt2.membershipId, seatId: charge.seatId };
   }
-  const rows5 = (await db.query({ networkMembership: { $: { where: { providerCustomerId: charge.customerId, environment: env.ODLA_ENV }, limit: 5 } } })).networkMembership ?? [];
-  const member = rows5.find((row2) => disputedChargeCoversMembership(charge, row2));
+  const rows6 = (await db.query({ networkMembership: { $: { where: { providerCustomerId: charge.customerId, environment: env.ODLA_ENV }, limit: 5 } } })).networkMembership ?? [];
+  const member = rows6.find((row2) => disputedChargeCoversMembership(charge, row2));
   if (!member) return { disposition: "not_applicable" };
   const receipt = await reconcileMembershipDispute(db, { ...scopeOf(member), eventId: fact.eventId }, now, secret, charge);
   return { disposition: "applied", membershipId: receipt.membershipId };
@@ -15628,15 +16791,15 @@ var handleFormation = async (req, url, env, ctx) => {
   if (submissionId && !SUBMISSION.test(submissionId)) {
     return json({ error: "submissionId must be an 8\u2013128 character base64url value" }, 400);
   }
-  const allowed2 = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
-  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed2.has(field));
+  const allowed = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
+  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed.has(field));
   if (unknown.length) return json({ error: `field "${unknown[0]}" is not accepted` }, 400);
   for (const field of formation.required) {
     const value = body[field];
     if (typeof value !== "string" || value.trim() === "") return json({ error: `${field} is required` }, 400);
   }
   const input = {};
-  for (const field of allowed2) {
+  for (const field of allowed) {
     const value = body[field];
     if (value === void 0) continue;
     const cap = formation.maxLen[field] ?? formation.defaultMaxLen;
@@ -15700,10 +16863,10 @@ var ASSET_KEYS = /* @__PURE__ */ new Set(["bookId", "assetId", "filename"]);
 var PROVENANCE_KEYS = /* @__PURE__ */ new Set(["createdBy", "createdAt", "updatedBy", "updatedAt", "promotedFrom"]);
 var PROMOTION_KEYS = /* @__PURE__ */ new Set(["chapterId", "resourceId", "resourceRevision", "documentRevision", "promotedBy", "promotedAt"]);
 var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-function unknownKeys3(value, allowed2, path, errors) {
-  for (const key3 of Object.keys(value)) if (!allowed2.has(key3)) errors.push(`${path}.${key3} is not supported`);
+function unknownKeys3(value, allowed, path, errors) {
+  for (const key3 of Object.keys(value)) if (!allowed.has(key3)) errors.push(`${path}.${key3} is not supported`);
 }
-function text9(value, path, errors, max = MAX_TEXT2, required = true) {
+function text10(value, path, errors, max = MAX_TEXT2, required = true) {
   if (value === void 0 && !required) return void 0;
   if (typeof value !== "string" || required && !value.trim()) {
     errors.push(`${path} must be a non-empty string`);
@@ -15729,7 +16892,7 @@ function scopeValue(value, path, errors) {
     return { kind: raw2.kind };
   }
   if (raw2.kind === "chapter") {
-    const chapterId = text9(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
+    const chapterId = text10(raw2.chapterId, `${path}.chapterId`, errors, 63) ?? "";
     if (chapterId && !APP_ID.test(chapterId)) errors.push(`${path}.chapterId must be a lowercase app slug`);
     return { kind: "chapter", chapterId };
   }
@@ -15743,22 +16906,22 @@ function resourceValue(value, path, errors) {
     return null;
   }
   unknownKeys3(raw2, RESOURCE_KEYS, path, errors);
-  const id7 = text9(raw2.id, `${path}.id`, errors, 80) ?? "";
+  const id7 = text10(raw2.id, `${path}.id`, errors, 80) ?? "";
   if (id7 && !ID5.test(id7)) errors.push(`${path}.id must be lowercase kebab-case`);
-  const kind = text9(raw2.kind, `${path}.kind`, errors) ?? "";
+  const kind = text10(raw2.kind, `${path}.kind`, errors) ?? "";
   if (!KINDS.has(kind)) errors.push(`${path}.kind is unsupported`);
-  const title = text9(raw2.title, `${path}.title`, errors, 240) ?? "";
-  const summary = text9(raw2.summary, `${path}.summary`, errors, 1e3, false);
-  const status2 = text9(raw2.status, `${path}.status`, errors) ?? "";
+  const title = text10(raw2.title, `${path}.title`, errors, 240) ?? "";
+  const summary = text10(raw2.summary, `${path}.summary`, errors, 1e3, false);
+  const status2 = text10(raw2.status, `${path}.status`, errors) ?? "";
   if (!STATUSES.has(status2)) errors.push(`${path}.status must be draft, published, or archived`);
   const revision = integer4(raw2.revision, `${path}.revision`, errors);
   const scope2 = scopeValue(raw2.scope, `${path}.scope`, errors) ?? { kind: "global" };
-  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text9(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
+  const tags = Array.isArray(raw2.tags) ? raw2.tags.map((tag, index2) => text10(tag, `${path}.tags[${index2}]`, errors, 80) ?? "") : [];
   if (!Array.isArray(raw2.tags)) errors.push(`${path}.tags must be an array`);
   if (tags.length > MAX_TAGS) errors.push(`${path}.tags may contain at most ${MAX_TAGS} items`);
   if (new Set(tags).size !== tags.length) errors.push(`${path}.tags must be unique`);
-  const bodyMarkdown = text9(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN3, false);
-  const url = text9(raw2.url, `${path}.url`, errors, 2048, false);
+  const bodyMarkdown = text10(raw2.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN3, false);
+  const url = text10(raw2.url, `${path}.url`, errors, 2048, false);
   if (url) {
     try {
       if (new URL(url).protocol !== "https:") errors.push(`${path}.url must use https`);
@@ -15770,9 +16933,9 @@ function resourceValue(value, path, errors) {
   if (raw2.brandAsset !== void 0 && !asset) errors.push(`${path}.brandAsset must be an object`);
   if (asset) unknownKeys3(asset, ASSET_KEYS, `${path}.brandAsset`, errors);
   const brandAsset = asset ? {
-    bookId: text9(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
-    assetId: text9(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
-    ...asset.filename === void 0 ? {} : { filename: text9(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
+    bookId: text10(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
+    assetId: text10(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
+    ...asset.filename === void 0 ? {} : { filename: text10(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
   } : void 0;
   if ((kind === "document" || kind === "note") && !bodyMarkdown) errors.push(`${path}.bodyMarkdown is required for ${kind}`);
   if ((kind === "link" || kind === "inspiration") && !url) errors.push(`${path}.url is required for ${kind}`);
@@ -15787,17 +16950,17 @@ function resourceValue(value, path, errors) {
   if (provenanceRaw?.promotedFrom !== void 0 && !promotedRaw) errors.push(`${path}.provenance.promotedFrom must be an object`);
   if (promotedRaw) unknownKeys3(promotedRaw, PROMOTION_KEYS, `${path}.provenance.promotedFrom`, errors);
   const promotedFrom = promotedRaw ? {
-    chapterId: text9(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
-    resourceId: text9(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
+    chapterId: text10(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
+    resourceId: text10(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
     resourceRevision: integer4(promotedRaw.resourceRevision, `${path}.provenance.promotedFrom.resourceRevision`, errors),
     documentRevision: integer4(promotedRaw.documentRevision, `${path}.provenance.promotedFrom.documentRevision`, errors),
-    promotedBy: text9(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
+    promotedBy: text10(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
     promotedAt: integer4(promotedRaw.promotedAt, `${path}.provenance.promotedFrom.promotedAt`, errors, 0)
   } : void 0;
   const provenance2 = {
-    createdBy: text9(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
+    createdBy: text10(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
     createdAt: integer4(provenanceRaw?.createdAt, `${path}.provenance.createdAt`, errors, 0),
-    updatedBy: text9(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
+    updatedBy: text10(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
     updatedAt: integer4(provenanceRaw?.updatedAt, `${path}.provenance.updatedAt`, errors, 0),
     ...promotedFrom ? { promotedFrom } : {}
   };
@@ -15816,7 +16979,7 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (sourceRaw) unknownKeys3(sourceRaw, SOURCE_KEYS2, "document.source", errors);
   const sourceType = sourceRaw?.type;
   if (sourceType !== "chapter" && sourceType !== "built_not_found") errors.push("document.source.type must be chapter or built_not_found");
-  const sourceAppId = text9(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
+  const sourceAppId = text10(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
   if (sourceAppId && !APP_ID.test(sourceAppId)) errors.push("document.source.appId must be a lowercase app slug");
   if (options.sourceType && sourceType !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
   if (options.sourceAppId && sourceAppId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
@@ -15824,8 +16987,8 @@ function validateBuilderLibraryDocument(value, options = {}) {
   if (raw2.target !== void 0 && !targetRaw) errors.push("document.target must be an object");
   if (targetRaw) unknownKeys3(targetRaw, TARGET_KEYS2, "document.target", errors);
   const target = targetRaw ? {
-    appId: text9(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
-    environment: text9(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
+    appId: text10(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
+    environment: text10(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
   } : void 0;
   if (options.targetAppId && target?.appId !== options.targetAppId) errors.push(`document.target.appId must be ${options.targetAppId}`);
   if (!Array.isArray(raw2.resources)) errors.push("document.resources must be an array");
@@ -15913,17 +17076,17 @@ async function builderLibraryDigest(document) {
 var control2 = (row2) => row2?.document && typeof row2.document === "object" ? row2 : null;
 var local3 = (row2) => row2?.document && typeof row2.document === "object" ? row2 : null;
 async function loadActiveBuilderLibraryControls(db, targetId, environment) {
-  const rows5 = (await db.query({ builderLibraryControls: { $: { where: { targetId, environment, active: true }, limit: 500 } } })).builderLibraryControls;
-  return Array.isArray(rows5) ? rows5.map(control2).filter(Boolean) : [];
+  const rows6 = (await db.query({ builderLibraryControls: { $: { where: { targetId, environment, active: true }, limit: 500 } } })).builderLibraryControls;
+  return Array.isArray(rows6) ? rows6.map(control2).filter(Boolean) : [];
 }
 async function loadLatestBuilderLibraryControl(db, sourceId, targetId, environment) {
-  const rows5 = (await db.query({ builderLibraryControls: { $: { where: { sourceId, targetId, environment }, order: { revision: "desc" }, limit: 20 } } })).builderLibraryControls;
-  return control2(Array.isArray(rows5) ? [...rows5].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+  const rows6 = (await db.query({ builderLibraryControls: { $: { where: { sourceId, targetId, environment }, order: { revision: "desc" }, limit: 20 } } })).builderLibraryControls;
+  return control2(Array.isArray(rows6) ? [...rows6].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
 }
 async function loadLocalBuilderLibrary(db, appId, environment) {
   const id7 = `builder-library-local:${environment}`;
-  const rows5 = (await db.query({ builderLibraryLocal: { $: { where: { id: id7 }, limit: 1 } } })).builderLibraryLocal;
-  return local3(Array.isArray(rows5) ? rows5[0] : void 0);
+  const rows6 = (await db.query({ builderLibraryLocal: { $: { where: { id: id7 }, limit: 1 } } })).builderLibraryLocal;
+  return local3(Array.isArray(rows6) ? rows6[0] : void 0);
 }
 async function materializeBuilderLibraryControl(db, envelope, previous, receivedAt) {
   const { document, digest } = envelope;
@@ -17566,8 +18729,8 @@ var readable = /* @__PURE__ */ new Set([
   "networkCommercialEvents",
   "networkCommercialExceptions"
 ]);
-var check = (ns, allowed2) => {
-  if (!allowed2.has(ns)) throw new TypeError("namespace outside membership authority contract");
+var check = (ns, allowed) => {
+  if (!allowed.has(ns)) throw new TypeError("namespace outside membership authority contract");
   return physical(ns);
 };
 function createMembershipAuthorityStorage(db, secretNames) {
@@ -17593,9 +18756,9 @@ function createMembershipAuthorityStorage(db, secretNames) {
       const guards = opts?.guards?.map((guard) => ({ ...guard, ns: check(guard.ns, readable) }));
       return db.transact(mapped, { ...opts, ...guards ? { guards } : {} });
     },
-    secrets: { get(name) {
-      if (!secrets.has(name)) return Promise.reject(new TypeError("vault slot outside membership authority contract"));
-      return db.secrets.get(name);
+    secrets: { get(name2) {
+      if (!secrets.has(name2)) return Promise.reject(new TypeError("vault slot outside membership authority contract"));
+      return db.secrets.get(name2);
     } }
   };
 }
@@ -17765,7 +18928,7 @@ async function retryChapterApprovalEffects(ctx, env, options) {
   const origin = new URL(options.origin), limit = options.limit ?? 100;
   if (origin.protocol !== "https:" || origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash || !Number.isSafeInteger(limit) || limit < 1 || limit > 2e3) throw new TypeError("invalid approval recovery configuration");
   const db = ctx.makeDb(env);
-  const rows5 = (await db.query({ applications: { $: {
+  const rows6 = (await db.query({ applications: { $: {
     where: {
       groupId: ctx.chapter.id,
       stripeRuntime: env.ODLA_RUNTIME ?? "default",
@@ -17776,7 +18939,7 @@ async function retryChapterApprovalEffects(ctx, env, options) {
     limit: limit + 1
   } } })).applications ?? [];
   let repaired = 0, pending = 0;
-  for (const app of rows5.slice(0, limit)) {
+  for (const app of rows6.slice(0, limit)) {
     if (app.groupId !== ctx.chapter.id || app.stripeRuntime !== (env.ODLA_RUNTIME ?? "default") || app.status !== "approved" || app.approvalEffectsPending !== true) throw new Error("approval recovery scope mismatch");
     try {
       await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: { approvalEffectsLastAttemptAt: Date.now() } }], {
@@ -17801,7 +18964,7 @@ async function retryChapterApprovalEffects(ctx, env, options) {
       pending++;
     }
   }
-  return { repaired, pending, more: rows5.length > limit };
+  return { repaired, pending, more: rows6.length > limit };
 }
 
 // src/membership-chapter-delivery.ts
@@ -17817,7 +18980,7 @@ async function readBoundedJson(response, signal, maxBytes, label) {
   };
   signal.addEventListener("abort", cancel, { once: true });
   let size = 0;
-  let text10 = "";
+  let text11 = "";
   const decoder = new TextDecoder();
   try {
     while (true) {
@@ -17827,10 +18990,10 @@ async function readBoundedJson(response, signal, maxBytes, label) {
       if (done) break;
       size += value.byteLength;
       if (size > maxBytes) throw new TypeError(`${label} exceeds limit`);
-      text10 += decoder.decode(value, { stream: true });
+      text11 += decoder.decode(value, { stream: true });
     }
     try {
-      return JSON.parse(text10 + decoder.decode());
+      return JSON.parse(text11 + decoder.decode());
     } catch {
       throw new TypeError(`invalid ${label}`);
     }
@@ -17849,8 +19012,8 @@ import { validateEmailCopy as validateEmailCopy5 } from "@odla-ai/crm";
 function invitationDelivery(env, recipientEmail) {
   const normal = { sender: env.SEND_EMAIL, from: env.EMAIL_FROM, debugEmail: env.ODLA_DEBUG_EMAIL };
   if (env.ODLA_ENV !== "dev" || !env.SEND_INVITATION_TEST) return normal;
-  const allowed2 = (env.ODLA_INVITATION_TEST_RECIPIENTS ?? "").split(",").map((value) => value.trim().toLowerCase()).filter(Boolean);
-  if (!allowed2.includes(recipientEmail.trim().toLowerCase())) return normal;
+  const allowed = (env.ODLA_INVITATION_TEST_RECIPIENTS ?? "").split(",").map((value) => value.trim().toLowerCase()).filter(Boolean);
+  if (!allowed.includes(recipientEmail.trim().toLowerCase())) return normal;
   const to = env.ODLA_INVITATION_TEST_TO?.trim();
   const from = env.ODLA_INVITATION_TEST_FROM?.trim();
   const valid = (value) => value && /^[^\s@,;<>]+@[^\s@,;<>]+\.[^\s@,;<>]+$/.test(value);
@@ -18370,27 +19533,27 @@ function validatedTokens(input) {
   }
   const tokens = {};
   let serializedLength = 0;
-  for (const [name, raw2] of entries.sort(([left], [right]) => left.localeCompare(right))) {
-    if (!TOKEN_NAME.test(name)) {
-      throw new TypeError(`signup-control theme token "${name}" must be an allowlisted --ui-* property`);
+  for (const [name2, raw2] of entries.sort(([left], [right]) => left.localeCompare(right))) {
+    if (!TOKEN_NAME.test(name2)) {
+      throw new TypeError(`signup-control theme token "${name2}" must be an allowlisted --ui-* property`);
     }
     if (typeof raw2 !== "string" && typeof raw2 !== "number" || typeof raw2 === "number" && !Number.isFinite(raw2)) {
-      throw new TypeError(`signup-control theme token "${name}" must be a finite string or number`);
+      throw new TypeError(`signup-control theme token "${name2}" must be a finite string or number`);
     }
     const value = String(raw2).trim();
     if (!value || value.length > MAX_VALUE_LENGTH || UNSAFE_VALUE.test(value)) {
-      throw new TypeError(`signup-control theme token "${name}" has an unsafe or oversized value`);
+      throw new TypeError(`signup-control theme token "${name2}" has an unsafe or oversized value`);
     }
-    serializedLength += name.length + value.length + 4;
+    serializedLength += name2.length + value.length + 4;
     if (serializedLength > MAX_SERIALIZED_LENGTH) {
       throw new TypeError("signup-control theme exceeds the serialized size bound");
     }
-    tokens[name] = value;
+    tokens[name2] = value;
   }
   return tokens;
 }
 function cssFor(tokens) {
-  const declarations = Object.entries(tokens).map(([name, value]) => `  ${name}: ${value};`);
+  const declarations = Object.entries(tokens).map(([name2, value]) => `  ${name2}: ${value};`);
   return declarations.length ? `:root {
 ${declarations.join("\n")}
 }` : "";
@@ -18505,6 +19668,7 @@ var BUILTIN_ROUTES = [
   handleFormation,
   handleMember,
   handleMemberContent,
+  handleMemberPortal,
   handleGifts,
   handleNamedSeat,
   handleNamedSeatRegift,