<!-- source-hash: 1d5aefc0169fc550dd115556a5cdbf7e -->
Pure standalone utility functions for validating and consuming access codes via HTTP, designed to be React-free and SSR-safe by requiring explicit endpoint URLs rather than reading from context.

## Key Components

### `AccessCodeEndpoints` (interface)
Defines the two endpoint URLs required by all client functions:
- `validateUrl` — POST endpoint for code validation
- `consumeUrl` — POST endpoint for code consumption

### `validateAccessCode(email, code, endpoints)`
POSTs credentials to `validateUrl` and returns an `AccessCodeValidationResponse`. On HTTP or network errors, returns `{ valid: false, message }` rather than throwing.

### `consumeAccessCode(email, code, endpoints)`
POSTs credentials to `consumeUrl` to mark a code as used. Should only be called **after** successful registration. On failure returns `{ success: false, consumed: false, message }`.

### `validateAndConsumeAccessCode(email, code, endpoints)`
Convenience wrapper that sequentially calls validate → consume. Short-circuits and returns the validation failure immediately if the code is invalid. Returns a merged `AccessCodeValidationResponse & { consumed? }`.

## Usage Example

```typescript
import {
  validateAndConsumeAccessCode,
  AccessCodeEndpoints
} from './access-code-client';

const endpoints: AccessCodeEndpoints = {
  validateUrl: '/api/access-codes/validate',
  consumeUrl: '/api/access-codes/consume',
};

const result = await validateAndConsumeAccessCode(
  'user@example.com',
  'ABC123XY',
  endpoints,
);

if (result.valid && result.consumed) {
  console.log(`Welcome to ${result.cohort_name}!`);
} else {
  console.error(result.message);
}
```

> **Note:** Endpoint binding from `EndpointsRuntimeContext` is handled by the React-side hook `hooks/use-access-code-integration.ts` (`useAccessCodeIntegration`). Keeping this file React-free allows it to be safely bundled in the server-side `utils/index` tsup build without crashing SSR.