@odla-ai/chapter 0.32.3 → 0.33.1

package/dist/index.d.cts

@@ -161,6 +161,22 @@ type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T ex
 /** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
 type ChapterCopyInput = DeepPartial<ChapterCopy>;
 
+/** Explicit authority a chapter grants to one Built Not Found-style hub. */
+interface ChapterSignupControl {
+    /** Stable app id expected in the signed delivery envelope. */
+    sourceId: string;
+    /** Follower-vault key holding the dedicated edge secret. */
+    secretName?: string;
+    /** Stripe mode this deployed environment accepts. */
+    stripeMode: "test" | "live";
+}
+/** Validated signup-control authority carried on a resolved Chapter. */
+interface ResolvedSignupControl {
+    sourceId: string;
+    secretName: string;
+    stripeMode: "test" | "live";
+}
+
 /** One follower site a leader can push CRM records to. The secret VALUE never
  * lives in config: `secretName` names the leader tenant's vaulted copy of the
  * follower's `network_share_secret`. */
@@ -294,6 +310,16 @@ interface DbOp {
  *  member routes consume — so route logic is testable against an in-memory fake. */
 interface ChapterDb {
     query(q: Record<string, unknown>): Promise<Record<string, Array<Record<string, unknown>>>>;
+    /** Optional bounded aggregate supported by the real privileged odla-db
+     * client. Routes use it to prove a result set is non-empty before issuing
+     * an ordered lookup, while small test doubles may continue to omit it. */
+    aggregate?(ns: string, spec: {
+        count?: boolean;
+    }, opts?: {
+        where?: Record<string, unknown>;
+    }): Promise<{
+        count?: number;
+    }>;
     transact(ops: DbOp[], opts?: {
         mutationId?: string;
     }): Promise<{
@@ -552,6 +578,8 @@ interface ChapterConfig {
     /** Signed network edges: leader delivery targets and follower-owned,
      * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
+    /** A separate signed edge that may control this chapter's complete signup. */
+    signupControl?: ChapterSignupControl;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
     thesis?: unknown;
@@ -646,6 +674,8 @@ interface Chapter {
     copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
+    /** Null unless this follower explicitly delegates signup authority. */
+    signupControl: ResolvedSignupControl | null;
     /** Resolved public formation intake contract (disabled when omitted). */
     formation: ResolvedLeaderFormation;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -678,6 +708,9 @@ interface Chapter {
  */
 declare function defineChapter(config: ChapterConfig): Chapter;
 
+/** Validate one deliberately separate signup-control edge. */
+declare function resolveSignupControl(input: ChapterSignupControl | undefined): ResolvedSignupControl | null;
+
 /** Options for {@link leaderCrmConfig}. */
 interface LeaderCrmOptions {
     /** Existing host CRM config to preserve. Defaults to Chapter's people +
@@ -773,7 +806,7 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `superAdmins` — with no `admins` table. */
-declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean, application?: ResolvedApplication): {
+declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean, application?: ResolvedApplication, includeSignupControl?: boolean): {
     schema: DbSchema;
     rules: DbRules;
 };
@@ -1921,6 +1954,101 @@ declare function validateMembershipPageDocument(input: unknown, options?: Member
 /** Validate a document or fail closed with all actionable validation errors. */
 declare function membershipPageDocument(input: unknown, options?: MembershipPageValidationOptions): MembershipPageDocument;
 
+/** Current wire-format version for complete signup-control documents. */
+declare const SIGNUP_CONTROL_SCHEMA_VERSION: 1;
+/** Package-owned follower endpoint for signed signup-control delivery. */
+declare const SIGNUP_CONTROL_PATH: "/api/signup-control";
+/** One authoritative membership tier in a signup-control revision. */
+interface SignupControlTier {
+    id: string;
+    name: string;
+    available: boolean;
+    sortOrder: number;
+    priceCents: number;
+    stripePriceId?: string;
+    blurb?: string;
+}
+/** A bounded application contract. Fields must already exist in the follower schema. */
+interface SignupControlApplication {
+    required: readonly string[];
+    optional: readonly string[];
+    conditions?: Readonly<Record<string, FieldConditions>>;
+    copy?: Readonly<Record<string, string>>;
+}
+/** Delegated legal and trust copy used by the packaged join journey. */
+interface SignupControlPolicy {
+    disclaimerText: string;
+    refundPolicyText: string;
+    trustCopy?: string;
+    commitmentText?: string;
+    normsText?: string;
+}
+/** Bounded semantic design tokens delegated to the chapter signup surface. */
+interface SignupControlTheme {
+    /** Includes color, spacing, and typography tokens such as font families. */
+    tokens: Readonly<Record<string, string | number>>;
+}
+/** Complete desired state delivered by a controlling hub. */
+interface SignupControlDocument {
+    schemaVersion: typeof SIGNUP_CONTROL_SCHEMA_VERSION;
+    revision: number;
+    generatedAt: number;
+    source: {
+        appId: string;
+    };
+    target: {
+        chapterId: string;
+        environment: string;
+        stripeMode: "test" | "live";
+    };
+    tiers: readonly SignupControlTier[];
+    membershipPage: MembershipPageDocument;
+    application?: SignupControlApplication;
+    policy?: SignupControlPolicy;
+    scheduling?: ChapterScheduling;
+    theme?: SignupControlTheme;
+}
+/** Digest travels beside the document so the exact desired state is attestable. */
+interface SignupControlEnvelope {
+    digest: string;
+    document: SignupControlDocument;
+}
+/** Exact follower acknowledgement for one accepted or replayed revision. */
+interface SignupControlReceipt {
+    ok: true;
+    target: {
+        chapterId: string;
+        environment: string;
+    };
+    revision: number;
+    digest: string;
+    status: "accepted" | "replayed";
+    acknowledgedAt: number;
+}
+/** Stable reason codes returned when a follower refuses desired state. */
+type SignupControlRejection = "invalid_document" | "invalid_digest" | "wrong_source" | "wrong_target" | "wrong_environment" | "wrong_stripe_mode" | "stale_revision" | "conflicting_revision";
+/** Normalized document result returned by the package validator. */
+type SignupControlValidation = {
+    ok: true;
+    value: SignupControlDocument;
+} | {
+    ok: false;
+    errors: readonly string[];
+};
+
+/** Serialize JSON-like signup state with recursively sorted object keys. */
+declare function canonicalSignupControl(value: unknown): string;
+/** Compute the protocol's canonical SHA-256 digest for desired signup state. */
+declare function signupControlDigest(document: unknown): Promise<string>;
+/** Pair one desired-state document with its canonical digest for delivery. */
+declare function createSignupControlEnvelope(document: SignupControlDocument): Promise<{
+    document: SignupControlDocument;
+    digest: string;
+}>;
+
+/** Validate and normalize one complete desired signup state. */
+declare function validateSignupControlDocument(input: unknown): SignupControlValidation;
+
 /** A presentation overlay parsed from the constrained membership Markdown convention. */
 type MembershipTierMarkdownResult = {
     ok: true;
@@ -1944,4 +2072,4 @@ declare function applyMembershipTierMarkdown(presentation: MembershipTierPresent
 /** Apply constrained membership Markdown or fail closed with actionable errors. */
 declare function membershipTierPresentationFromMarkdown(presentation: MembershipTierPresentation, source: string): MembershipTierPresentation;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type JoinConfigTier, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MEMBERSHIP_PAGE_RENDERER, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, buildTierSeeds, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, findTier, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, loadOfferableTiers, loadTiers, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, membershipPageDocument, membershipTierPresentationFromMarkdown, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateMembershipPageDocument, validateScheduling, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type JoinConfigTier, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MEMBERSHIP_PAGE_RENDERER, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, buildTierSeeds, canApprove, canBook, canChangeRole, canTransition, canceledPatch, canonicalSignupControl, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, findTier, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, loadOfferableTiers, loadTiers, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, membershipPageDocument, membershipTierPresentationFromMarkdown, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };

package/dist/index.d.ts

@@ -161,6 +161,22 @@ type DeepPartial<T> = T extends readonly (infer Item)[] ? readonly Item[] : T ex
 /** Recursively partial copy overrides accepted by `defineChapter({ copy })`. */
 type ChapterCopyInput = DeepPartial<ChapterCopy>;
 
+/** Explicit authority a chapter grants to one Built Not Found-style hub. */
+interface ChapterSignupControl {
+    /** Stable app id expected in the signed delivery envelope. */
+    sourceId: string;
+    /** Follower-vault key holding the dedicated edge secret. */
+    secretName?: string;
+    /** Stripe mode this deployed environment accepts. */
+    stripeMode: "test" | "live";
+}
+/** Validated signup-control authority carried on a resolved Chapter. */
+interface ResolvedSignupControl {
+    sourceId: string;
+    secretName: string;
+    stripeMode: "test" | "live";
+}
+
 /** One follower site a leader can push CRM records to. The secret VALUE never
  * lives in config: `secretName` names the leader tenant's vaulted copy of the
  * follower's `network_share_secret`. */
@@ -294,6 +310,16 @@ interface DbOp {
  *  member routes consume — so route logic is testable against an in-memory fake. */
 interface ChapterDb {
     query(q: Record<string, unknown>): Promise<Record<string, Array<Record<string, unknown>>>>;
+    /** Optional bounded aggregate supported by the real privileged odla-db
+     * client. Routes use it to prove a result set is non-empty before issuing
+     * an ordered lookup, while small test doubles may continue to omit it. */
+    aggregate?(ns: string, spec: {
+        count?: boolean;
+    }, opts?: {
+        where?: Record<string, unknown>;
+    }): Promise<{
+        count?: number;
+    }>;
     transact(ops: DbOp[], opts?: {
         mutationId?: string;
     }): Promise<{
@@ -552,6 +578,8 @@ interface ChapterConfig {
     /** Signed network edges: leader delivery targets and follower-owned,
      * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
+    /** A separate signed edge that may control this chapter's complete signup. */
+    signupControl?: ChapterSignupControl;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
     thesis?: unknown;
@@ -646,6 +674,8 @@ interface Chapter {
     copy: ChapterCopy;
     /** Validated follower targets for leader-driven record pushes. */
     network: ResolvedNetwork;
+    /** Null unless this follower explicitly delegates signup authority. */
+    signupControl: ResolvedSignupControl | null;
     /** Resolved public formation intake contract (disabled when omitted). */
     formation: ResolvedLeaderFormation;
     /** Resolved CRM engine (from `defineCrm`). */
@@ -678,6 +708,9 @@ interface Chapter {
  */
 declare function defineChapter(config: ChapterConfig): Chapter;
 
+/** Validate one deliberately separate signup-control edge. */
+declare function resolveSignupControl(input: ChapterSignupControl | undefined): ResolvedSignupControl | null;
+
 /** Options for {@link leaderCrmConfig}. */
 interface LeaderCrmOptions {
     /** Existing host CRM config to preserve. Defaults to Chapter's people +
@@ -773,7 +806,7 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `superAdmins` — with no `admins` table. */
-declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean, application?: ResolvedApplication): {
+declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean, application?: ResolvedApplication, includeSignupControl?: boolean): {
     schema: DbSchema;
     rules: DbRules;
 };
@@ -1921,6 +1954,101 @@ declare function validateMembershipPageDocument(input: unknown, options?: Member
 /** Validate a document or fail closed with all actionable validation errors. */
 declare function membershipPageDocument(input: unknown, options?: MembershipPageValidationOptions): MembershipPageDocument;
 
+/** Current wire-format version for complete signup-control documents. */
+declare const SIGNUP_CONTROL_SCHEMA_VERSION: 1;
+/** Package-owned follower endpoint for signed signup-control delivery. */
+declare const SIGNUP_CONTROL_PATH: "/api/signup-control";
+/** One authoritative membership tier in a signup-control revision. */
+interface SignupControlTier {
+    id: string;
+    name: string;
+    available: boolean;
+    sortOrder: number;
+    priceCents: number;
+    stripePriceId?: string;
+    blurb?: string;
+}
+/** A bounded application contract. Fields must already exist in the follower schema. */
+interface SignupControlApplication {
+    required: readonly string[];
+    optional: readonly string[];
+    conditions?: Readonly<Record<string, FieldConditions>>;
+    copy?: Readonly<Record<string, string>>;
+}
+/** Delegated legal and trust copy used by the packaged join journey. */
+interface SignupControlPolicy {
+    disclaimerText: string;
+    refundPolicyText: string;
+    trustCopy?: string;
+    commitmentText?: string;
+    normsText?: string;
+}
+/** Bounded semantic design tokens delegated to the chapter signup surface. */
+interface SignupControlTheme {
+    /** Includes color, spacing, and typography tokens such as font families. */
+    tokens: Readonly<Record<string, string | number>>;
+}
+/** Complete desired state delivered by a controlling hub. */
+interface SignupControlDocument {
+    schemaVersion: typeof SIGNUP_CONTROL_SCHEMA_VERSION;
+    revision: number;
+    generatedAt: number;
+    source: {
+        appId: string;
+    };
+    target: {
+        chapterId: string;
+        environment: string;
+        stripeMode: "test" | "live";
+    };
+    tiers: readonly SignupControlTier[];
+    membershipPage: MembershipPageDocument;
+    application?: SignupControlApplication;
+    policy?: SignupControlPolicy;
+    scheduling?: ChapterScheduling;
+    theme?: SignupControlTheme;
+}
+/** Digest travels beside the document so the exact desired state is attestable. */
+interface SignupControlEnvelope {
+    digest: string;
+    document: SignupControlDocument;
+}
+/** Exact follower acknowledgement for one accepted or replayed revision. */
+interface SignupControlReceipt {
+    ok: true;
+    target: {
+        chapterId: string;
+        environment: string;
+    };
+    revision: number;
+    digest: string;
+    status: "accepted" | "replayed";
+    acknowledgedAt: number;
+}
+/** Stable reason codes returned when a follower refuses desired state. */
+type SignupControlRejection = "invalid_document" | "invalid_digest" | "wrong_source" | "wrong_target" | "wrong_environment" | "wrong_stripe_mode" | "stale_revision" | "conflicting_revision";
+/** Normalized document result returned by the package validator. */
+type SignupControlValidation = {
+    ok: true;
+    value: SignupControlDocument;
+} | {
+    ok: false;
+    errors: readonly string[];
+};
+
+/** Serialize JSON-like signup state with recursively sorted object keys. */
+declare function canonicalSignupControl(value: unknown): string;
+/** Compute the protocol's canonical SHA-256 digest for desired signup state. */
+declare function signupControlDigest(document: unknown): Promise<string>;
+/** Pair one desired-state document with its canonical digest for delivery. */
+declare function createSignupControlEnvelope(document: SignupControlDocument): Promise<{
+    document: SignupControlDocument;
+    digest: string;
+}>;
+
+/** Validate and normalize one complete desired signup state. */
+declare function validateSignupControlDocument(input: unknown): SignupControlValidation;
+
 /** A presentation overlay parsed from the constrained membership Markdown convention. */
 type MembershipTierMarkdownResult = {
     ok: true;
@@ -1944,4 +2072,4 @@ declare function applyMembershipTierMarkdown(presentation: MembershipTierPresent
 /** Apply constrained membership Markdown or fail closed with actionable errors. */
 declare function membershipTierPresentationFromMarkdown(presentation: MembershipTierPresentation, source: string): MembershipTierPresentation;
 
-export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type JoinConfigTier, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MEMBERSHIP_PAGE_RENDERER, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, buildTierSeeds, canApprove, canBook, canChangeRole, canTransition, canceledPatch, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, findTier, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, loadOfferableTiers, loadTiers, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, membershipPageDocument, membershipTierPresentationFromMarkdown, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateMembershipPageDocument, validateScheduling, webhookMutationId };
+export { type AccountModel, type AdminNotificationTrigger, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmails, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type JoinConfigGroup, type JoinConfigTier, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MEMBERSHIP_PAGE_RENDERER, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberSession, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkRecord, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type ReconcileDecision, type ResolvedApplication, type ResolvedAuth, type ResolvedLeaderFormation, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildGroupSeed, buildTierSeeds, canApprove, canBook, canChangeRole, canTransition, canceledPatch, canonicalSignupControl, chapterBrandFromTokens, chapterDb, clampArray, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, createChapterIntegration, createClerkInvitation, createClerkUser, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, findApplicationRef, findTier, firstPaymentPatch, formatChapterCopy, formationFields, getVaultSecret, hasDisclaimerAck, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, loadOfferableTiers, loadTiers, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberSession, membershipPageDocument, membershipTierPresentationFromMarkdown, networkSourceTag, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, projectApplicant, projectSharedRecord, reconcileMeetings, refundedPatch, render, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveChapterCopy, resolveLeaderFormation, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };