@odla-ai/chapter 0.22.1 → 0.23.0

package/dist/index.d.cts

@@ -1,5 +1,57 @@
 import { CrmConfig, Crm, CrmRecord } from '@odla-ai/crm';
 
+/** Complete default language resolved beneath partial Chapter copy overrides. */
+declare const DEFAULT_CHAPTER_COPY: ChapterCopy;
+/** Resolve a partial copy contract and validate every supplied leaf. */
+declare function resolveChapterCopy(input?: ChapterCopyInput): ChapterCopy;
+/** Replace `{name}` placeholders without interpreting the resulting text as HTML. */
+declare function formatChapterCopy(template: string, values: Readonly<Record<string, string | number>>): string;
+
+type TextFields<Key extends string> = {
+    [Field in Key]: string;
+};
+/**
+ * Complete user-visible language owned by Chapter's packaged surfaces.
+ *
+ * Copy is serializable text; use render slots when presentation needs markup and
+ * `formatChapterCopy()` for typed placeholders.
+ */
+interface ChapterCopy {
+    common: TextFields<"loading" | "saved" | "unknown">;
+    join: {
+        form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
+        booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete">;
+        done: TextFields<"label" | "calendarInvite" | "memberArea">;
+    };
+    members: {
+        loadFailed: string;
+        account: TextFields<"signOut" | "adminConsole">;
+        provisional: TextFields<"cardLabel" | "applicationNeeded" | "applicationNeededBody" | "apply" | "refunded" | "refundedBody" | "active" | "renews" | "introductionCall" | "calendarInvite" | "joinCall" | "bookCall" | "bookCallBody" | "chooseTime">;
+        full: TextFields<"welcome">;
+        reschedule: TextFields<"changeTime" | "unavailable" | "loadFailed" | "slotGone" | "loading" | "noTimes" | "rescheduling" | "keepTime">;
+    };
+    admin: {
+        auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
+        shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "settings" | "calendar" | "email" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel">;
+        dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
+        billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
+        availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
+            dayLabels: readonly string[];
+        };
+        email: TextFields<"loading" | "loadFailed" | "saved" | "sent" | "testFailed" | "delivery" | "notificationAddress" | "replyTo" | "debugInbox" | "debugInboxHint" | "sendTest" | "enabled" | "subject" | "body" | "save" | "sendLog" | "sentColumn" | "templateColumn" | "statusColumn" | "toColumn" | "failed" | "redirected" | "delivered">;
+        meetings: TextFields<"loading" | "loadFailed" | "cancelConfirm" | "newStartPrompt" | "parseFailed" | "agenda" | "empty" | "unknown" | "drift" | "meet" | "reschedule" | "cancel">;
+        network: TextFields<"title" | "allowlistDescription" | "sharing" | "shareWith" | "shared" | "shareFailed" | "deliveryFailed">;
+        records: TextFields<"workflowMissing" | "comms" | "commsHistory" | "scheduling" | "billing" | "notes" | "access" | "sharing" | "lifecycle" | "role" | "superAdminHint" | "noAccount" | "approve" | "refund" | "approved" | "refunded" | "roleSet" | "messageSent" | "messageNotSent" | "loadingTemplates" | "template" | "chooseTemplate" | "sending" | "send" | "noMessages" | "message" | "newStartPrompt" | "parseFailed" | "cancelConfirm" | "callCancelled" | "callRescheduled" | "noApplication" | "loadingMeetings" | "noMeetings" | "joinMeeting" | "openCalendar" | "reschedule" | "cancel">;
+    };
+}
+type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T extends object ? {
+    [Key in keyof T]?: DeepPartial<T[Key]>;
+} : T;
+/** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
+type ChapterCopyInput = DeepPartial<ChapterCopy>;
+
 /** Which feature profile a site runs. `chapter` is the full public member site
  * (join, Stripe membership, booking, member area, admin, CRM); `hub` is
  * admin-only and CRM-focused (a directory/registry over the same CRM). */
@@ -93,6 +145,8 @@ interface ChapterBrandTokens {
 interface ChapterBrand {
     /** Preloaded @odla-ai/ui theme name used by ThemeScope. */
     theme?: string;
+    /** Named accent family supplied by the selected @odla-ai/ui theme. */
+    accent?: string;
     /** Admin/application color mode. Explicit light is the safe default. */
     colorScheme?: "light" | "dark" | "system";
     tokens?: ChapterBrandTokens;
@@ -105,6 +159,9 @@ interface ChapterBrand {
      *  `:root[data-theme="dark"]` and `@media (prefers-color-scheme: dark)`, so a
      *  site brands both modes. */
     paletteDark?: Record<string, string>;
+    /** Full token map for `.ui-invert` islands. A compiled custom theme normally
+     * uses its dark map here so inverted content never inherits stale composites. */
+    paletteInvert?: Record<string, string>;
     fonts?: {
         display?: string;
         body?: string;
@@ -260,17 +317,13 @@ interface ChapterApplication {
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
-     *  writing a row with no consent record. Default `false` for back-compat —
-     *  but turn it on if the disclaimer is a compliance record: a missing ack is
-     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
-     *  and surfaces on the first test submit, not intermittently in production. */
+     *  writing a row with no consent record. Default `true`. Set `false`
+     *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
     /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default (unset) projects every non-identity
-     *  configured field — convenient, but it also exposes free-text and
-     *  third-party fields (`message`, `referral`). Set this to a curated list
-     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
-     *  Expected to become required-in-spirit at 1.0. */
+     *  `public_metadata.profile`. Default `[]`, so application details remain
+     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
+     *  fields the browser may read. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person
@@ -294,8 +347,8 @@ interface ResolvedApplication {
     defaultMaxLen: number;
     bodyCap: number;
     requireDisclaimerAck: boolean;
-    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
-    profileFields: readonly string[] | null;
+    /** Resolved Clerk-metadata allowlist. Empty means no profile projection. */
+    profileFields: readonly string[];
     crmFields: readonly string[];
     maxArrayLen: number;
     validateEmail: boolean;
@@ -311,6 +364,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** User-visible language for packaged Chapter surfaces. Recursively partial;
+     * `defineChapter()` resolves every omitted leaf from the package defaults. */
+    copy?: ChapterCopyInput;
     /** Leader → follower delivery targets. Secret values stay in the leader
      * tenant vault; see {@link ChapterNetworkTarget}. */
     network?: ChapterNetwork;
@@ -329,13 +385,10 @@ interface ChapterConfig {
     auth?: ChapterAuth;
     /** odla services (db implied). Default `["db","calendar","o11y"]`. */
     services?: readonly string[];
-    /** Apply-time account provisioning. **Default `"none"`** — it provisions
-     *  nothing, because the alternatives have an outbound side effect and a site
-     *  that never made the choice must not be mailing people. `"create"` makes the
-     *  Clerk account server-side (so join can say the account is ready);
-     *  `"invite"` **emails the applicant a Clerk invitation**. Both non-default
-     *  models need a `clerk_secret_key` vault secret to act. Opt in explicitly —
-     *  leaving this unset provisions no accounts. */
+    /** Apply-time account provisioning. Required in `chapter` mode so a site must
+     *  make the decision explicitly. `"none"` provisions nothing, `"create"` makes
+     *  the Clerk account server-side, and `"invite"` emails a real invitation.
+     *  Both side-effecting models need a `clerk_secret_key` vault secret. */
     account?: AccountModel;
     /** WHEN lifecycle email fires. Addressing and content live on the group row
      *  (owner-editable at runtime); this is the trigger, which is a build-time
@@ -403,6 +456,8 @@ interface Chapter {
     /** Resolved site identity. `wordmark` always falls back to `name`, so the
      * admin/member UI never needs a second brand declaration. */
     brand: ChapterBrand;
+    /** Fully resolved user-visible text for packaged Chapter surfaces. */
+    copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -417,7 +472,7 @@ interface Chapter {
     schema: DbSchema;
     rules: DbRules;
     services: readonly string[];
-    /** Resolved apply-time account provisioning model (default `"none"`). */
+    /** Resolved apply-time account provisioning model. */
     account: AccountModel;
     /** Resolved send policy — when each lifecycle email fires. */
     sends: ResolvedSends;
@@ -803,10 +858,10 @@ declare function hasDisclaimerAck(fields: Record<string, unknown>): boolean;
 /**
  * The applicant profile written to the Clerk account's client-readable
  * `public_metadata.profile`. Projects each configured non-identity field, plus
- * `focus` (clamped) — but ONLY those in `application.profileFields` when that
- * allowlist is set, so a site keeps confidential fields (`message`, `referral`)
- * db-only. Derived from config, so a site's own field names project without this
- * package knowing them. Pure; returns `undefined` when there is nothing to write.
+ * `focus` (clamped), but ONLY those in `application.profileFields`, so a site
+ * keeps confidential fields (`message`, `referral`) db-only. Derived from
+ * config, so a site's own field names project without this package knowing
+ * them. Pure; returns `undefined` when there is nothing to write.
  */
 declare function applicantProfile(chapter: Chapter, fields: Record<string, unknown>): Record<string, unknown> | undefined;
 /** A validated submission, or a 400-worthy validation error the route returns.
@@ -1243,6 +1298,17 @@ declare function memberSession(user: SessionUser, opts: {
 declare function brandTokens(brand: ChapterBrand | undefined, options?: {
     selector?: string;
 }): string;
+/** Structural output accepted from `@odla-ai/brand`'s pure token compiler. */
+interface CompiledChapterBrandTokens {
+    light: Record<string, string>;
+    dark: Record<string, string>;
+}
+/**
+ * Turn a complete compiled token pair into Chapter's brand contract without
+ * coupling Chapter's runtime to the brand-book/agent package. Explicit values in
+ * `base` win, so a host can make final per-site adjustments after compilation.
+ */
+declare function chapterBrandFromTokens(compiled: CompiledChapterBrandTokens, base?: ChapterBrand): ChapterBrand;
 
 /** A `meetings` row, as far as reconciliation cares. */
 interface MeetingForReconcile {
@@ -1404,4 +1470,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, validateScheduling, verifyStripeSignature, webhookMutationId };

package/dist/index.d.ts

@@ -1,5 +1,57 @@
 import { CrmConfig, Crm, CrmRecord } from '@odla-ai/crm';
 
+/** Complete default language resolved beneath partial Chapter copy overrides. */
+declare const DEFAULT_CHAPTER_COPY: ChapterCopy;
+/** Resolve a partial copy contract and validate every supplied leaf. */
+declare function resolveChapterCopy(input?: ChapterCopyInput): ChapterCopy;
+/** Replace `{name}` placeholders without interpreting the resulting text as HTML. */
+declare function formatChapterCopy(template: string, values: Readonly<Record<string, string | number>>): string;
+
+type TextFields<Key extends string> = {
+    [Field in Key]: string;
+};
+/**
+ * Complete user-visible language owned by Chapter's packaged surfaces.
+ *
+ * Copy is serializable text; use render slots when presentation needs markup and
+ * `formatChapterCopy()` for typed placeholders.
+ */
+interface ChapterCopy {
+    common: TextFields<"loading" | "saved" | "unknown">;
+    join: {
+        form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
+        booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete">;
+        done: TextFields<"label" | "calendarInvite" | "memberArea">;
+    };
+    members: {
+        loadFailed: string;
+        account: TextFields<"signOut" | "adminConsole">;
+        provisional: TextFields<"cardLabel" | "applicationNeeded" | "applicationNeededBody" | "apply" | "refunded" | "refundedBody" | "active" | "renews" | "introductionCall" | "calendarInvite" | "joinCall" | "bookCall" | "bookCallBody" | "chooseTime">;
+        full: TextFields<"welcome">;
+        reschedule: TextFields<"changeTime" | "unavailable" | "loadFailed" | "slotGone" | "loading" | "noTimes" | "rescheduling" | "keepTime">;
+    };
+    admin: {
+        auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
+        shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "settings" | "calendar" | "email" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel">;
+        dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
+        billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
+        availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
+            dayLabels: readonly string[];
+        };
+        email: TextFields<"loading" | "loadFailed" | "saved" | "sent" | "testFailed" | "delivery" | "notificationAddress" | "replyTo" | "debugInbox" | "debugInboxHint" | "sendTest" | "enabled" | "subject" | "body" | "save" | "sendLog" | "sentColumn" | "templateColumn" | "statusColumn" | "toColumn" | "failed" | "redirected" | "delivered">;
+        meetings: TextFields<"loading" | "loadFailed" | "cancelConfirm" | "newStartPrompt" | "parseFailed" | "agenda" | "empty" | "unknown" | "drift" | "meet" | "reschedule" | "cancel">;
+        network: TextFields<"title" | "allowlistDescription" | "sharing" | "shareWith" | "shared" | "shareFailed" | "deliveryFailed">;
+        records: TextFields<"workflowMissing" | "comms" | "commsHistory" | "scheduling" | "billing" | "notes" | "access" | "sharing" | "lifecycle" | "role" | "superAdminHint" | "noAccount" | "approve" | "refund" | "approved" | "refunded" | "roleSet" | "messageSent" | "messageNotSent" | "loadingTemplates" | "template" | "chooseTemplate" | "sending" | "send" | "noMessages" | "message" | "newStartPrompt" | "parseFailed" | "cancelConfirm" | "callCancelled" | "callRescheduled" | "noApplication" | "loadingMeetings" | "noMeetings" | "joinMeeting" | "openCalendar" | "reschedule" | "cancel">;
+    };
+}
+type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T extends object ? {
+    [Key in keyof T]?: DeepPartial<T[Key]>;
+} : T;
+/** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
+type ChapterCopyInput = DeepPartial<ChapterCopy>;
+
 /** Which feature profile a site runs. `chapter` is the full public member site
  * (join, Stripe membership, booking, member area, admin, CRM); `hub` is
  * admin-only and CRM-focused (a directory/registry over the same CRM). */
@@ -93,6 +145,8 @@ interface ChapterBrandTokens {
 interface ChapterBrand {
     /** Preloaded @odla-ai/ui theme name used by ThemeScope. */
     theme?: string;
+    /** Named accent family supplied by the selected @odla-ai/ui theme. */
+    accent?: string;
     /** Admin/application color mode. Explicit light is the safe default. */
     colorScheme?: "light" | "dark" | "system";
     tokens?: ChapterBrandTokens;
@@ -105,6 +159,9 @@ interface ChapterBrand {
      *  `:root[data-theme="dark"]` and `@media (prefers-color-scheme: dark)`, so a
      *  site brands both modes. */
     paletteDark?: Record<string, string>;
+    /** Full token map for `.ui-invert` islands. A compiled custom theme normally
+     * uses its dark map here so inverted content never inherits stale composites. */
+    paletteInvert?: Record<string, string>;
     fonts?: {
         display?: string;
         body?: string;
@@ -260,17 +317,13 @@ interface ChapterApplication {
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
-     *  writing a row with no consent record. Default `false` for back-compat —
-     *  but turn it on if the disclaimer is a compliance record: a missing ack is
-     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
-     *  and surfaces on the first test submit, not intermittently in production. */
+     *  writing a row with no consent record. Default `true`. Set `false`
+     *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
     /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default (unset) projects every non-identity
-     *  configured field — convenient, but it also exposes free-text and
-     *  third-party fields (`message`, `referral`). Set this to a curated list
-     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
-     *  Expected to become required-in-spirit at 1.0. */
+     *  `public_metadata.profile`. Default `[]`, so application details remain
+     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
+     *  fields the browser may read. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person
@@ -294,8 +347,8 @@ interface ResolvedApplication {
     defaultMaxLen: number;
     bodyCap: number;
     requireDisclaimerAck: boolean;
-    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
-    profileFields: readonly string[] | null;
+    /** Resolved Clerk-metadata allowlist. Empty means no profile projection. */
+    profileFields: readonly string[];
     crmFields: readonly string[];
     maxArrayLen: number;
     validateEmail: boolean;
@@ -311,6 +364,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** User-visible language for packaged Chapter surfaces. Recursively partial;
+     * `defineChapter()` resolves every omitted leaf from the package defaults. */
+    copy?: ChapterCopyInput;
     /** Leader → follower delivery targets. Secret values stay in the leader
      * tenant vault; see {@link ChapterNetworkTarget}. */
     network?: ChapterNetwork;
@@ -329,13 +385,10 @@ interface ChapterConfig {
     auth?: ChapterAuth;
     /** odla services (db implied). Default `["db","calendar","o11y"]`. */
     services?: readonly string[];
-    /** Apply-time account provisioning. **Default `"none"`** — it provisions
-     *  nothing, because the alternatives have an outbound side effect and a site
-     *  that never made the choice must not be mailing people. `"create"` makes the
-     *  Clerk account server-side (so join can say the account is ready);
-     *  `"invite"` **emails the applicant a Clerk invitation**. Both non-default
-     *  models need a `clerk_secret_key` vault secret to act. Opt in explicitly —
-     *  leaving this unset provisions no accounts. */
+    /** Apply-time account provisioning. Required in `chapter` mode so a site must
+     *  make the decision explicitly. `"none"` provisions nothing, `"create"` makes
+     *  the Clerk account server-side, and `"invite"` emails a real invitation.
+     *  Both side-effecting models need a `clerk_secret_key` vault secret. */
     account?: AccountModel;
     /** WHEN lifecycle email fires. Addressing and content live on the group row
      *  (owner-editable at runtime); this is the trigger, which is a build-time
@@ -403,6 +456,8 @@ interface Chapter {
     /** Resolved site identity. `wordmark` always falls back to `name`, so the
      * admin/member UI never needs a second brand declaration. */
     brand: ChapterBrand;
+    /** Fully resolved user-visible text for packaged Chapter surfaces. */
+    copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -417,7 +472,7 @@ interface Chapter {
     schema: DbSchema;
     rules: DbRules;
     services: readonly string[];
-    /** Resolved apply-time account provisioning model (default `"none"`). */
+    /** Resolved apply-time account provisioning model. */
     account: AccountModel;
     /** Resolved send policy — when each lifecycle email fires. */
     sends: ResolvedSends;
@@ -803,10 +858,10 @@ declare function hasDisclaimerAck(fields: Record<string, unknown>): boolean;
 /**
  * The applicant profile written to the Clerk account's client-readable
  * `public_metadata.profile`. Projects each configured non-identity field, plus
- * `focus` (clamped) — but ONLY those in `application.profileFields` when that
- * allowlist is set, so a site keeps confidential fields (`message`, `referral`)
- * db-only. Derived from config, so a site's own field names project without this
- * package knowing them. Pure; returns `undefined` when there is nothing to write.
+ * `focus` (clamped), but ONLY those in `application.profileFields`, so a site
+ * keeps confidential fields (`message`, `referral`) db-only. Derived from
+ * config, so a site's own field names project without this package knowing
+ * them. Pure; returns `undefined` when there is nothing to write.
  */
 declare function applicantProfile(chapter: Chapter, fields: Record<string, unknown>): Record<string, unknown> | undefined;
 /** A validated submission, or a 400-worthy validation error the route returns.
@@ -1243,6 +1298,17 @@ declare function memberSession(user: SessionUser, opts: {
 declare function brandTokens(brand: ChapterBrand | undefined, options?: {
     selector?: string;
 }): string;
+/** Structural output accepted from `@odla-ai/brand`'s pure token compiler. */
+interface CompiledChapterBrandTokens {
+    light: Record<string, string>;
+    dark: Record<string, string>;
+}
+/**
+ * Turn a complete compiled token pair into Chapter's brand contract without
+ * coupling Chapter's runtime to the brand-book/agent package. Explicit values in
+ * `base` win, so a host can make final per-site adjustments after compilation.
+ */
+declare function chapterBrandFromTokens(compiled: CompiledChapterBrandTokens, base?: ChapterBrand): ChapterBrand;
 
 /** A `meetings` row, as far as reconciliation cares. */
 interface MeetingForReconcile {
@@ -1404,4 +1470,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, validateScheduling, verifyStripeSignature, webhookMutationId };