@odla-ai/chapter 0.26.0 → 0.27.0

package/dist/index.d.cts

@@ -42,7 +42,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -70,17 +70,41 @@ interface ChapterNetworkTarget {
     name?: string;
     /** Absolute follower origin, e.g. `https://chapter.example.com`. */
     url: string;
+    /** Optional Cloudflare service-binding name for Worker-to-Worker delivery.
+     * The URL still defines the signed request origin; the binding only supplies
+     * the transport when a `workers.dev` subrequest cannot enter another Worker. */
+    binding?: string;
     /** Leader-vault key holding this follower's share secret. Defaults to
      * `network_share_<id-with-underscores>`. */
     secretName?: string;
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -112,12 +136,21 @@ interface ResolvedNetworkTarget {
     id: string;
     name: string;
     url: string;
+    binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -400,8 +433,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -584,9 +617,8 @@ interface ChapterIntegrationDescriptor {
     }>;
     /** Runbooks that bear on THIS chapter's role, so tooling can point at the
      * right procedure without the operator knowing it exists. A chapter declaring
-     * `network.targets` is a leader hub; one declaring none is a follower site,
-     * and the two follow different procedures for the same words ("connect",
-     * "share records"). */
+     * `network.targets` is a leader hub; one with no targets is a follower site
+     * (and may declare `network.readers` for bounded CRM browsing). */
     runbooks: ChapterRunbookHints;
 }
 /** Which runbooks apply, and why. */
@@ -613,7 +645,7 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `superAdmins` — with no `admins` table. */
-declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth): {
+declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean): {
     schema: DbSchema;
     rules: DbRules;
 };
@@ -1065,6 +1097,52 @@ interface NetworkRollup {
     }>;
     targets: NetworkRollupTarget[];
 }
+/** Privacy-bounded CRM record returned by a follower to one configured,
+ * authenticated reader. */
+interface NetworkRecord {
+    id: string;
+    type: string;
+    name: string;
+    stage?: string;
+    fields: Record<string, unknown>;
+    createdAt: number;
+    updatedAt: number;
+}
+/** One bounded, offset-paged follower record window. */
+interface NetworkRecordPage {
+    version: 1;
+    site: {
+        id: string;
+        name: string;
+    };
+    type: string;
+    records: NetworkRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** Leader-private note attached to a stable remote record identity. */
+interface NetworkRecordNote {
+    id: string;
+    targetId: string;
+    recordType: string;
+    recordId: string;
+    body: string;
+    authorId: string;
+    authorEmail?: string;
+    createdAt: number;
+}
+/** A note deliberately shared across the federation edge and stored in the
+ * follower CRM activity feed. Unlike NetworkRecordNote, this is visible to
+ * the follower's own CRM admins. */
+interface NetworkSharedNote {
+    id: string;
+    sourceId: string;
+    recordType: string;
+    recordId: string;
+    body: string;
+    createdAt: number;
+}
 interface NormalizedSharedRecord {
     version: 1 | 2;
     sourceId: string;
@@ -1631,4 +1709,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NetworkRollup, type NetworkRollupTarget, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, leaderCrmConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, leaderCrmConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateScheduling, verifyStripeSignature, webhookMutationId };

package/dist/index.d.ts

@@ -42,7 +42,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -70,17 +70,41 @@ interface ChapterNetworkTarget {
     name?: string;
     /** Absolute follower origin, e.g. `https://chapter.example.com`. */
     url: string;
+    /** Optional Cloudflare service-binding name for Worker-to-Worker delivery.
+     * The URL still defines the signed request origin; the binding only supplies
+     * the transport when a `workers.dev` subrequest cannot enter another Worker. */
+    binding?: string;
     /** Leader-vault key holding this follower's share secret. Defaults to
      * `network_share_<id-with-underscores>`. */
     secretName?: string;
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -112,12 +136,21 @@ interface ResolvedNetworkTarget {
     id: string;
     name: string;
     url: string;
+    binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -400,8 +433,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -584,9 +617,8 @@ interface ChapterIntegrationDescriptor {
     }>;
     /** Runbooks that bear on THIS chapter's role, so tooling can point at the
      * right procedure without the operator knowing it exists. A chapter declaring
-     * `network.targets` is a leader hub; one declaring none is a follower site,
-     * and the two follow different procedures for the same words ("connect",
-     * "share records"). */
+     * `network.targets` is a leader hub; one with no targets is a follower site
+     * (and may declare `network.readers` for bounded CRM browsing). */
     runbooks: ChapterRunbookHints;
 }
 /** Which runbooks apply, and why. */
@@ -613,7 +645,7 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `superAdmins` — with no `admins` table. */
-declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth): {
+declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean): {
     schema: DbSchema;
     rules: DbRules;
 };
@@ -1065,6 +1097,52 @@ interface NetworkRollup {
     }>;
     targets: NetworkRollupTarget[];
 }
+/** Privacy-bounded CRM record returned by a follower to one configured,
+ * authenticated reader. */
+interface NetworkRecord {
+    id: string;
+    type: string;
+    name: string;
+    stage?: string;
+    fields: Record<string, unknown>;
+    createdAt: number;
+    updatedAt: number;
+}
+/** One bounded, offset-paged follower record window. */
+interface NetworkRecordPage {
+    version: 1;
+    site: {
+        id: string;
+        name: string;
+    };
+    type: string;
+    records: NetworkRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** Leader-private note attached to a stable remote record identity. */
+interface NetworkRecordNote {
+    id: string;
+    targetId: string;
+    recordType: string;
+    recordId: string;
+    body: string;
+    authorId: string;
+    authorEmail?: string;
+    createdAt: number;
+}
+/** A note deliberately shared across the federation edge and stored in the
+ * follower CRM activity feed. Unlike NetworkRecordNote, this is visible to
+ * the follower's own CRM admins. */
+interface NetworkSharedNote {
+    id: string;
+    sourceId: string;
+    recordType: string;
+    recordId: string;
+    body: string;
+    createdAt: number;
+}
 interface NormalizedSharedRecord {
     version: 1 | 2;
     sourceId: string;
@@ -1631,4 +1709,4 @@ type ApplicationBookingPatch = {
  *  already there (never backward). */
 declare function applicationBookingUpdate(currentStatus: string, startAt: number, htmlLink?: string | null): ApplicationBookingPatch;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NetworkRollup, type NetworkRollupTarget, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, leaderCrmConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateScheduling, verifyStripeSignature, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, leaderCrmConfig, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, stripeForm, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateScheduling, verifyStripeSignature, webhookMutationId };

package/dist/index.js

@@ -27,6 +27,19 @@ var superAdmins = {
     createdAt: attr("number", { indexed: true })
   }
 };
+var networkNotes = {
+  attrs: {
+    id: id(),
+    recordKey: attr("string", { indexed: true }),
+    targetId: attr("string", { indexed: true }),
+    recordType: attr("string", { indexed: true }),
+    recordId: attr("string", { indexed: true }),
+    body: attr("string"),
+    authorId: attr("string", { indexed: true }),
+    authorEmail: attr("string", { optional: true }),
+    createdAt: attr("number", { indexed: true })
+  }
+};
 var applications = {
   attrs: {
     id: id(),
@@ -118,7 +131,7 @@ var emailLog = {
     sentAt: attr("number", { indexed: true })
   }
 };
-function chapterDb(mode, auth) {
+function chapterDb(mode, auth, includeNetworkNotes = false) {
   const entities = {};
   if (mode === "chapter") {
     entities.applications = applications;
@@ -128,6 +141,7 @@ function chapterDb(mode, auth) {
   }
   if (auth.source === "table") entities.admins = admins;
   if (auth.superAdmins) entities.superAdmins = superAdmins;
+  if (includeNetworkNotes) entities.networkNotes = networkNotes;
   const schema = { entities, links: {} };
   const rules = {};
   for (const ns of Object.keys(entities)) {
@@ -519,6 +533,7 @@ var DEFAULT_ADMIN_COPY = {
     overview: "Overview",
     billing: "Billing",
     people: "People",
+    network: "Network",
     portfolio: "Portfolio",
     settings: "Settings",
     calendar: "Calendar",
@@ -880,9 +895,17 @@ function formationFields(crm, formation) {
   });
 }
 
-// src/config.ts
+// src/config-network.ts
 var SLUG = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var FIELD = /^[a-z][a-zA-Z0-9_]*$/;
+var BINDING = /^[A-Z][A-Z0-9_]{0,127}$/;
+function validateSharedNotes(opts) {
+  const duplicate = opts.values.some((type, index) => opts.values.indexOf(type) !== index);
+  const invalid = opts.values.some((type) => !FIELD.test(type) || !opts.crm.config.types[type] || (opts.fields ? !opts.fields[type] : false));
+  if (duplicate || invalid) {
+    throw new Error(`${opts.path}: must contain unique CRM types allowed by fields`);
+  }
+}
 function resolveNetwork(config, crm) {
   const seen = /* @__PURE__ */ new Set();
   const targets = [];
@@ -928,23 +951,87 @@ function resolveNetwork(config, crm) {
     if (!/^[a-zA-Z][a-zA-Z0-9_-]{1,127}$/.test(secretName)) {
       throw new Error(`defineChapter.network.targets.${target.id}.secretName: must be a vault-key identifier`);
     }
+    const binding = target.binding?.trim();
+    if (binding && !BINDING.test(binding)) {
+      throw new Error(
+        `defineChapter.network.targets.${target.id}.binding: must be an uppercase Worker binding identifier`
+      );
+    }
+    const sharedNotes = target.sharedNotes ?? [];
+    validateSharedNotes({
+      path: `defineChapter.network.targets.${target.id}.sharedNotes`,
+      values: sharedNotes,
+      crm,
+      fields
+    });
     targets.push({
       id: target.id,
       name: target.name?.trim() || target.id,
       url: url.origin,
+      ...binding ? { binding } : {},
       secretName,
-      ...fields ? { fields } : {}
+      ...fields ? { fields } : {},
+      sharedNotes
+    });
+  }
+  const readerIds = /* @__PURE__ */ new Set();
+  const readers = [];
+  for (const reader of config.network?.readers ?? []) {
+    if (!SLUG.test(reader.id)) {
+      throw new Error(`defineChapter.network.readers.id: must be a lowercase slug \u2014 got ${JSON.stringify(reader.id)}`);
+    }
+    if (readerIds.has(reader.id)) {
+      throw new Error(`defineChapter.network.readers: duplicate reader "${reader.id}"`);
+    }
+    readerIds.add(reader.id);
+    const entries = Object.entries(reader.fields ?? {});
+    if (entries.length === 0) {
+      throw new Error(`defineChapter.network.readers.${reader.id}.fields: at least one CRM type is required`);
+    }
+    for (const [type, names] of entries) {
+      if (!FIELD.test(type) || names.length === 0 || names.some((name) => !FIELD.test(name))) {
+        throw new Error(
+          `defineChapter.network.readers.${reader.id}.fields.${type}: type and field names must be non-empty CRM identifiers`
+        );
+      }
+      const def = crm.config.types[type];
+      if (!def) {
+        throw new Error(`defineChapter.network.readers.${reader.id}.fields: unknown local CRM type "${type}"`);
+      }
+      const unknown = names.filter((field) => !def.fields[field]);
+      if (unknown.length > 0) {
+        throw new Error(
+          `defineChapter.network.readers.${reader.id}.fields.${type}: ${unknown.map((field) => `"${field}"`).join(", ")} not declared on the local CRM type`
+        );
+      }
+      const nameField = def.nameField ?? "name";
+      if (!names.includes(nameField)) {
+        throw new Error(
+          `defineChapter.network.readers.${reader.id}.fields.${type}: must include required name field "${nameField}"`
+        );
+      }
+    }
+    const sharedNotes = reader.sharedNotes ?? [];
+    validateSharedNotes({
+      path: `defineChapter.network.readers.${reader.id}.sharedNotes`,
+      values: sharedNotes,
+      crm,
+      fields: reader.fields
     });
+    readers.push({ id: reader.id, fields: reader.fields, sharedNotes });
   }
-  return { targets };
+  return { targets, readers };
 }
+
+// src/config.ts
+var SLUG2 = /^[a-z0-9][a-z0-9-]{1,62}$/;
 function isResolvedCrm(x) {
   return !!x && typeof x === "object" && "prepare" in x && typeof x.prepare === "function";
 }
 function defineChapter(config) {
   if (!config || typeof config !== "object") throw new Error("defineChapter: a config object is required");
   const { id: id2, name } = config;
-  if (typeof id2 !== "string" || !SLUG.test(id2)) {
+  if (typeof id2 !== "string" || !SLUG2.test(id2)) {
     throw new Error(`defineChapter.id: must be a lowercase slug [a-z0-9-] (2-63 chars) \u2014 got ${JSON.stringify(id2)}`);
   }
   if (typeof name !== "string" || name.trim() === "") throw new Error("defineChapter.name: a non-empty name is required");
@@ -969,7 +1056,7 @@ function defineChapter(config) {
   const copy = resolveChapterCopy(config.copy);
   const network = resolveNetwork(config, crm);
   const formation = resolveLeaderFormation(config.formation, crm);
-  const { schema, rules } = chapterDb(mode, auth);
+  const { schema, rules } = chapterDb(mode, auth, network.targets.length > 0);
   const services = config.services ?? ["db", "calendar", "o11y"];
   const account = config.account ?? "none";
   if (account !== "invite" && account !== "create" && account !== "none") {
@@ -1225,6 +1312,11 @@ function createChapterIntegration(chapter, options = {}) {
       // The snapshot route is deliberately private. A credential-free smoke
       // request must prove that the route is mounted and closed.
       { path: "/api/network/snapshot", expectedStatus: 401 },
+      ...chapter.network.readers.length > 0 ? [{ path: "/api/network/records?type=person", expectedStatus: 401 }] : [],
+      ...chapter.network.readers.some((reader) => reader.sharedNotes.length > 0) ? [{
+        path: "/api/network/shared-notes?type=person&recordId=probe",
+        expectedStatus: 401
+      }] : [],
       // Formation metadata is public only when the host explicitly enables
       // the bounded intake contract.
       ...chapter.formation.enabled ? [{ path: "/api/formation/config", expectedStatus: 200 }] : []