@odla-ai/chapter 0.22.1 → 0.24.0

package/dist/worker/index.d.cts

@@ -1,6 +1,58 @@
 import { CrmConfig, Crm } from '@odla-ai/crm';
 import { initAdmin } from '@odla-ai/db';
 
+type TextFields<Key extends string> = {
+    [Field in Key]: string;
+};
+/**
+ * Complete user-visible language owned by Chapter's packaged surfaces.
+ *
+ * Copy is serializable text; use render slots when presentation needs markup and
+ * `formatChapterCopy()` for typed placeholders.
+ */
+interface ChapterCopy {
+    common: TextFields<"loading" | "saved" | "unknown">;
+    join: {
+        form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
+        booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
+        /**
+         * `consent` is the affirmative statement a member agrees to before the card
+         * form appears, rendered beside the checkbox and beneath the policy text.
+         * It is what the member is shown at the moment of consent, so it says they
+         * agree rather than merely restating the policy. Set it to an empty string
+         * to render the checkbox with the policy as its only label.
+         */
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete" | "consent">;
+        done: TextFields<"label" | "calendarInvite" | "memberArea">;
+    };
+    members: {
+        loadFailed: string;
+        account: TextFields<"signOut" | "adminConsole">;
+        provisional: TextFields<"cardLabel" | "applicationNeeded" | "applicationNeededBody" | "apply" | "refunded" | "refundedBody" | "active" | "renews" | "introductionCall" | "calendarInvite" | "joinCall" | "bookCall" | "bookCallBody" | "chooseTime">;
+        full: TextFields<"welcome">;
+        reschedule: TextFields<"changeTime" | "unavailable" | "loadFailed" | "slotGone" | "loading" | "noTimes" | "rescheduling" | "keepTime">;
+    };
+    admin: {
+        auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
+        shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "settings" | "calendar" | "email" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel">;
+        dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
+        billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
+        availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
+            dayLabels: readonly string[];
+        };
+        email: TextFields<"loading" | "loadFailed" | "saved" | "sent" | "testFailed" | "delivery" | "notificationAddress" | "replyTo" | "debugInbox" | "debugInboxHint" | "sendTest" | "enabled" | "subject" | "body" | "save" | "sendLog" | "sentColumn" | "templateColumn" | "statusColumn" | "toColumn" | "failed" | "redirected" | "delivered">;
+        meetings: TextFields<"loading" | "loadFailed" | "cancelConfirm" | "newStartPrompt" | "parseFailed" | "agenda" | "empty" | "unknown" | "drift" | "meet" | "reschedule" | "cancel">;
+        network: TextFields<"title" | "allowlistDescription" | "sharing" | "shareWith" | "shared" | "shareFailed" | "deliveryFailed">;
+        records: TextFields<"workflowMissing" | "comms" | "commsHistory" | "scheduling" | "billing" | "notes" | "access" | "sharing" | "lifecycle" | "role" | "superAdminHint" | "noAccount" | "approve" | "refund" | "approved" | "refunded" | "roleSet" | "messageSent" | "messageNotSent" | "loadingTemplates" | "template" | "chooseTemplate" | "sending" | "send" | "noMessages" | "message" | "newStartPrompt" | "parseFailed" | "cancelConfirm" | "callCancelled" | "callRescheduled" | "noApplication" | "loadingMeetings" | "noMeetings" | "joinMeeting" | "openCalendar" | "reschedule" | "cancel">;
+    };
+}
+type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T extends object ? {
+    [Key in keyof T]?: DeepPartial<T[Key]>;
+} : T;
+/** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
+type ChapterCopyInput = DeepPartial<ChapterCopy>;
+
 /** Which feature profile a site runs. `chapter` is the full public member site
  * (join, Stripe membership, booking, member area, admin, CRM); `hub` is
  * admin-only and CRM-focused (a directory/registry over the same CRM). */
@@ -72,6 +124,8 @@ interface ChapterBrandTokens {
 interface ChapterBrand {
     /** Preloaded @odla-ai/ui theme name used by ThemeScope. */
     theme?: string;
+    /** Named accent family supplied by the selected @odla-ai/ui theme. */
+    accent?: string;
     /** Admin/application color mode. Explicit light is the safe default. */
     colorScheme?: "light" | "dark" | "system";
     tokens?: ChapterBrandTokens;
@@ -84,6 +138,9 @@ interface ChapterBrand {
      *  `:root[data-theme="dark"]` and `@media (prefers-color-scheme: dark)`, so a
      *  site brands both modes. */
     paletteDark?: Record<string, string>;
+    /** Full token map for `.ui-invert` islands. A compiled custom theme normally
+     * uses its dark map here so inverted content never inherits stale composites. */
+    paletteInvert?: Record<string, string>;
     fonts?: {
         display?: string;
         body?: string;
@@ -239,17 +296,13 @@ interface ChapterApplication {
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
-     *  writing a row with no consent record. Default `false` for back-compat —
-     *  but turn it on if the disclaimer is a compliance record: a missing ack is
-     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
-     *  and surfaces on the first test submit, not intermittently in production. */
+     *  writing a row with no consent record. Default `true`. Set `false`
+     *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
     /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default (unset) projects every non-identity
-     *  configured field — convenient, but it also exposes free-text and
-     *  third-party fields (`message`, `referral`). Set this to a curated list
-     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
-     *  Expected to become required-in-spirit at 1.0. */
+     *  `public_metadata.profile`. Default `[]`, so application details remain
+     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
+     *  fields the browser may read. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person
@@ -273,8 +326,8 @@ interface ResolvedApplication {
     defaultMaxLen: number;
     bodyCap: number;
     requireDisclaimerAck: boolean;
-    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
-    profileFields: readonly string[] | null;
+    /** Resolved Clerk-metadata allowlist. Empty means no profile projection. */
+    profileFields: readonly string[];
     crmFields: readonly string[];
     maxArrayLen: number;
     validateEmail: boolean;
@@ -290,6 +343,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** User-visible language for packaged Chapter surfaces. Recursively partial;
+     * `defineChapter()` resolves every omitted leaf from the package defaults. */
+    copy?: ChapterCopyInput;
     /** Leader → follower delivery targets. Secret values stay in the leader
      * tenant vault; see {@link ChapterNetworkTarget}. */
     network?: ChapterNetwork;
@@ -308,13 +364,10 @@ interface ChapterConfig {
     auth?: ChapterAuth;
     /** odla services (db implied). Default `["db","calendar","o11y"]`. */
     services?: readonly string[];
-    /** Apply-time account provisioning. **Default `"none"`** — it provisions
-     *  nothing, because the alternatives have an outbound side effect and a site
-     *  that never made the choice must not be mailing people. `"create"` makes the
-     *  Clerk account server-side (so join can say the account is ready);
-     *  `"invite"` **emails the applicant a Clerk invitation**. Both non-default
-     *  models need a `clerk_secret_key` vault secret to act. Opt in explicitly —
-     *  leaving this unset provisions no accounts. */
+    /** Apply-time account provisioning. Required in `chapter` mode so a site must
+     *  make the decision explicitly. `"none"` provisions nothing, `"create"` makes
+     *  the Clerk account server-side, and `"invite"` emails a real invitation.
+     *  Both side-effecting models need a `clerk_secret_key` vault secret. */
     account?: AccountModel;
     /** WHEN lifecycle email fires. Addressing and content live on the group row
      *  (owner-editable at runtime); this is the trigger, which is a build-time
@@ -382,6 +435,8 @@ interface Chapter {
     /** Resolved site identity. `wordmark` always falls back to `name`, so the
      * admin/member UI never needs a second brand declaration. */
     brand: ChapterBrand;
+    /** Fully resolved user-visible text for packaged Chapter surfaces. */
+    copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -396,7 +451,7 @@ interface Chapter {
     schema: DbSchema;
     rules: DbRules;
     services: readonly string[];
-    /** Resolved apply-time account provisioning model (default `"none"`). */
+    /** Resolved apply-time account provisioning model. */
     account: AccountModel;
     /** Resolved send policy — when each lifecycle email fires. */
     sends: ResolvedSends;

package/dist/worker/index.d.ts

@@ -1,6 +1,58 @@
 import { CrmConfig, Crm } from '@odla-ai/crm';
 import { initAdmin } from '@odla-ai/db';
 
+type TextFields<Key extends string> = {
+    [Field in Key]: string;
+};
+/**
+ * Complete user-visible language owned by Chapter's packaged surfaces.
+ *
+ * Copy is serializable text; use render slots when presentation needs markup and
+ * `formatChapterCopy()` for typed placeholders.
+ */
+interface ChapterCopy {
+    common: TextFields<"loading" | "saved" | "unknown">;
+    join: {
+        form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
+        booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
+        /**
+         * `consent` is the affirmative statement a member agrees to before the card
+         * form appears, rendered beside the checkbox and beneath the policy text.
+         * It is what the member is shown at the moment of consent, so it says they
+         * agree rather than merely restating the policy. Set it to an empty string
+         * to render the checkbox with the policy as its only label.
+         */
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete" | "consent">;
+        done: TextFields<"label" | "calendarInvite" | "memberArea">;
+    };
+    members: {
+        loadFailed: string;
+        account: TextFields<"signOut" | "adminConsole">;
+        provisional: TextFields<"cardLabel" | "applicationNeeded" | "applicationNeededBody" | "apply" | "refunded" | "refundedBody" | "active" | "renews" | "introductionCall" | "calendarInvite" | "joinCall" | "bookCall" | "bookCallBody" | "chooseTime">;
+        full: TextFields<"welcome">;
+        reschedule: TextFields<"changeTime" | "unavailable" | "loadFailed" | "slotGone" | "loading" | "noTimes" | "rescheduling" | "keepTime">;
+    };
+    admin: {
+        auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
+        shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "settings" | "calendar" | "email" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel">;
+        dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
+        billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
+        availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
+            dayLabels: readonly string[];
+        };
+        email: TextFields<"loading" | "loadFailed" | "saved" | "sent" | "testFailed" | "delivery" | "notificationAddress" | "replyTo" | "debugInbox" | "debugInboxHint" | "sendTest" | "enabled" | "subject" | "body" | "save" | "sendLog" | "sentColumn" | "templateColumn" | "statusColumn" | "toColumn" | "failed" | "redirected" | "delivered">;
+        meetings: TextFields<"loading" | "loadFailed" | "cancelConfirm" | "newStartPrompt" | "parseFailed" | "agenda" | "empty" | "unknown" | "drift" | "meet" | "reschedule" | "cancel">;
+        network: TextFields<"title" | "allowlistDescription" | "sharing" | "shareWith" | "shared" | "shareFailed" | "deliveryFailed">;
+        records: TextFields<"workflowMissing" | "comms" | "commsHistory" | "scheduling" | "billing" | "notes" | "access" | "sharing" | "lifecycle" | "role" | "superAdminHint" | "noAccount" | "approve" | "refund" | "approved" | "refunded" | "roleSet" | "messageSent" | "messageNotSent" | "loadingTemplates" | "template" | "chooseTemplate" | "sending" | "send" | "noMessages" | "message" | "newStartPrompt" | "parseFailed" | "cancelConfirm" | "callCancelled" | "callRescheduled" | "noApplication" | "loadingMeetings" | "noMeetings" | "joinMeeting" | "openCalendar" | "reschedule" | "cancel">;
+    };
+}
+type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T extends object ? {
+    [Key in keyof T]?: DeepPartial<T[Key]>;
+} : T;
+/** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
+type ChapterCopyInput = DeepPartial<ChapterCopy>;
+
 /** Which feature profile a site runs. `chapter` is the full public member site
  * (join, Stripe membership, booking, member area, admin, CRM); `hub` is
  * admin-only and CRM-focused (a directory/registry over the same CRM). */
@@ -72,6 +124,8 @@ interface ChapterBrandTokens {
 interface ChapterBrand {
     /** Preloaded @odla-ai/ui theme name used by ThemeScope. */
     theme?: string;
+    /** Named accent family supplied by the selected @odla-ai/ui theme. */
+    accent?: string;
     /** Admin/application color mode. Explicit light is the safe default. */
     colorScheme?: "light" | "dark" | "system";
     tokens?: ChapterBrandTokens;
@@ -84,6 +138,9 @@ interface ChapterBrand {
      *  `:root[data-theme="dark"]` and `@media (prefers-color-scheme: dark)`, so a
      *  site brands both modes. */
     paletteDark?: Record<string, string>;
+    /** Full token map for `.ui-invert` islands. A compiled custom theme normally
+     * uses its dark map here so inverted content never inherits stale composites. */
+    paletteInvert?: Record<string, string>;
     fonts?: {
         display?: string;
         body?: string;
@@ -239,17 +296,13 @@ interface ChapterApplication {
     /** Max JSON request body in bytes. Default 32768. */
     bodyCap?: number;
     /** Reject a submit that carries no truthy `disclaimerAck` (400), instead of
-     *  writing a row with no consent record. Default `false` for back-compat —
-     *  but turn it on if the disclaimer is a compliance record: a missing ack is
-     *  otherwise silent, permanent and unreconstructible. Failure is deterministic
-     *  and surfaces on the first test submit, not intermittently in production. */
+     *  writing a row with no consent record. Default `true`. Set `false`
+     *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
     /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default (unset) projects every non-identity
-     *  configured field — convenient, but it also exposes free-text and
-     *  third-party fields (`message`, `referral`). Set this to a curated list
-     *  (e.g. `["phone", "state", "focus"]`) to keep confidential fields db-only.
-     *  Expected to become required-in-spirit at 1.0. */
+     *  `public_metadata.profile`. Default `[]`, so application details remain
+     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
+     *  fields the browser may read. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person
@@ -273,8 +326,8 @@ interface ResolvedApplication {
     defaultMaxLen: number;
     bodyCap: number;
     requireDisclaimerAck: boolean;
-    /** Resolved Clerk-metadata allowlist; `null` means "all non-identity fields". */
-    profileFields: readonly string[] | null;
+    /** Resolved Clerk-metadata allowlist. Empty means no profile projection. */
+    profileFields: readonly string[];
     crmFields: readonly string[];
     maxArrayLen: number;
     validateEmail: boolean;
@@ -290,6 +343,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** User-visible language for packaged Chapter surfaces. Recursively partial;
+     * `defineChapter()` resolves every omitted leaf from the package defaults. */
+    copy?: ChapterCopyInput;
     /** Leader → follower delivery targets. Secret values stay in the leader
      * tenant vault; see {@link ChapterNetworkTarget}. */
     network?: ChapterNetwork;
@@ -308,13 +364,10 @@ interface ChapterConfig {
     auth?: ChapterAuth;
     /** odla services (db implied). Default `["db","calendar","o11y"]`. */
     services?: readonly string[];
-    /** Apply-time account provisioning. **Default `"none"`** — it provisions
-     *  nothing, because the alternatives have an outbound side effect and a site
-     *  that never made the choice must not be mailing people. `"create"` makes the
-     *  Clerk account server-side (so join can say the account is ready);
-     *  `"invite"` **emails the applicant a Clerk invitation**. Both non-default
-     *  models need a `clerk_secret_key` vault secret to act. Opt in explicitly —
-     *  leaving this unset provisions no accounts. */
+    /** Apply-time account provisioning. Required in `chapter` mode so a site must
+     *  make the decision explicitly. `"none"` provisions nothing, `"create"` makes
+     *  the Clerk account server-side, and `"invite"` emails a real invitation.
+     *  Both side-effecting models need a `clerk_secret_key` vault secret. */
     account?: AccountModel;
     /** WHEN lifecycle email fires. Addressing and content live on the group row
      *  (owner-editable at runtime); this is the trigger, which is a build-time
@@ -382,6 +435,8 @@ interface Chapter {
     /** Resolved site identity. `wordmark` always falls back to `name`, so the
      * admin/member UI never needs a second brand declaration. */
     brand: ChapterBrand;
+    /** Fully resolved user-visible text for packaged Chapter surfaces. */
+    copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -396,7 +451,7 @@ interface Chapter {
     schema: DbSchema;
     rules: DbRules;
     services: readonly string[];
-    /** Resolved apply-time account provisioning model (default `"none"`). */
+    /** Resolved apply-time account provisioning model. */
     account: AccountModel;
     /** Resolved send policy — when each lifecycle email fires. */
     sends: ResolvedSends;