@odla-ai/chapter 0.26.0 → 0.27.0

package/dist/worker/index.d.cts

@@ -36,7 +36,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -64,17 +64,41 @@ interface ChapterNetworkTarget {
     name?: string;
     /** Absolute follower origin, e.g. `https://chapter.example.com`. */
     url: string;
+    /** Optional Cloudflare service-binding name for Worker-to-Worker delivery.
+     * The URL still defines the signed request origin; the binding only supplies
+     * the transport when a `workers.dev` subrequest cannot enter another Worker. */
+    binding?: string;
     /** Leader-vault key holding this follower's share secret. Defaults to
      * `network_share_<id-with-underscores>`. */
     secretName?: string;
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -106,12 +130,21 @@ interface ResolvedNetworkTarget {
     id: string;
     name: string;
     url: string;
+    binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -372,8 +405,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -582,7 +615,7 @@ type Route = (req: Request, url: URL, env: ChapterEnv, ctx: WorkerContext) => Pr
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the source-aware admin gate, the mounted @odla-ai/crm routes, the
  * hub→chapter network projection, and the static-asset fallback. Hub mode serves
- * /api/health, /api/config, /api/me, /api/crm/*, /api/network/shared; chapter mode
+ * /api/health, /api/config, /api/me, /api/crm/*, /api/network/*; chapter mode
  * adds the public member surface (join/apply/pay/book) and the admin surface
  * (/api/admin/*).
  *

package/dist/worker/index.d.ts

@@ -36,7 +36,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -64,17 +64,41 @@ interface ChapterNetworkTarget {
     name?: string;
     /** Absolute follower origin, e.g. `https://chapter.example.com`. */
     url: string;
+    /** Optional Cloudflare service-binding name for Worker-to-Worker delivery.
+     * The URL still defines the signed request origin; the binding only supplies
+     * the transport when a `workers.dev` subrequest cannot enter another Worker. */
+    binding?: string;
     /** Leader-vault key holding this follower's share secret. Defaults to
      * `network_share_<id-with-underscores>`. */
     secretName?: string;
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -106,12 +130,21 @@ interface ResolvedNetworkTarget {
     id: string;
     name: string;
     url: string;
+    binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -372,8 +405,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -582,7 +615,7 @@ type Route = (req: Request, url: URL, env: ChapterEnv, ctx: WorkerContext) => Pr
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the source-aware admin gate, the mounted @odla-ai/crm routes, the
  * hub→chapter network projection, and the static-asset fallback. Hub mode serves
- * /api/health, /api/config, /api/me, /api/crm/*, /api/network/shared; chapter mode
+ * /api/health, /api/config, /api/me, /api/crm/*, /api/network/*; chapter mode
  * adds the public member surface (join/apply/pay/book) and the admin surface
  * (/api/admin/*).
  *