@odla-ai/chapter 0.42.0 → 0.42.2

package/dist/worker/index.d.cts

@@ -185,6 +185,16 @@ interface ChapterNetworkTarget {
      * this follower. Omitted by default: a target never gains write permission
      * merely because its records are browsable. */
     sharedNotes?: readonly string[];
+    /** Per-record-type upper bound on profile fields this leader permits its
+     * admins to edit remotely. The follower must independently delegate the
+     * same field; readable fields never become writable implicitly. */
+    editableFields?: Record<string, readonly string[]>;
+    /** Record types on which this leader permits remote lifecycle transitions.
+     * The follower must independently opt in and remains pipeline authority. */
+    stageTransitions?: readonly string[];
+    /** Allow package-owned desired admission decisions for existing leader CRM
+     * people to be delivered to this target. Omitted means default deny. */
+    admissionGrants?: boolean;
 }
 /** One signed peer allowed to browse a privacy-bounded projection of this
  * site's CRM. The follower owns this allowlist; a leader target declaration
@@ -194,11 +204,21 @@ interface ChapterNetworkReader {
     id: string;
     /** Per-record-type field allowlist. Omitted types and fields never leave
      * this site. Record id, name, stage, and timestamps are bounded metadata. */
-    fields: Record<string, readonly string[]>;
+    fields?: Record<string, readonly string[]>;
     /** Record types on which this reader may append an explicitly shared note.
      * Omitted by default: browse permission never silently grants write access.
      * Shared notes land in the follower CRM activity feed. */
     sharedNotes?: readonly string[];
+    /** Exact local CRM fields this reader may edit remotely, by record type.
+     * Every field must also be readable so the peer can perform an optimistic
+     * edit against the value and revision it actually reviewed. */
+    editableFields?: Record<string, readonly string[]>;
+    /** Local CRM record types on which this reader may request a lifecycle
+     * transition. Chapter still enforces the local pipeline and gates. */
+    stageTransitions?: readonly string[];
+    /** Accept signed desired admission decisions from this reader. Independent
+     * of record browsing; an admission-only reader may omit `fields`. */
+    admissionGrants?: boolean;
 }
 /** Leader/follower network configuration. A follower needs no code config to
  * receive pushed records. It must explicitly declare `readers` before any peer
@@ -241,12 +261,18 @@ interface ResolvedNetworkTarget {
     secretName: string;
     fields?: Record<string, readonly string[]>;
     sharedNotes: readonly string[];
+    editableFields: Record<string, readonly string[]>;
+    stageTransitions: readonly string[];
+    admissionGrants?: boolean;
 }
 /** A validated follower-owned record projection for one signed reader. */
 interface ResolvedNetworkReader {
     id: string;
     fields: Record<string, readonly string[]>;
     sharedNotes: readonly string[];
+    editableFields: Record<string, readonly string[]>;
+    stageTransitions: readonly string[];
+    admissionGrants?: boolean;
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
@@ -1192,9 +1218,54 @@ interface AdmissionGrantDeliveryOptions {
     envelope: AdmissionGrantEnvelope;
     fetch?: typeof globalThis.fetch;
 }
+/** Structured follower rejection retained by the durable leader outbox. */
+declare class AdmissionGrantDeliveryError extends Error {
+    readonly status: number;
+    readonly reason: string;
+    constructor(status: number, reason: string);
+}
 /** Deliver one signed Parent admission revision. Durable retry belongs upstream. */
 declare function deliverAdmissionGrants(options: AdmissionGrantDeliveryOptions): Promise<AdmissionGrantReceipt>;
 
+/** Durable state of the latest desired admission document for one target. */
+type LeaderAdmissionDeliveryStatus = "saved" | "pending" | "acknowledged" | "retrying" | "rejected";
+/** Leader-owned desired admission decision for one authoritative CRM person. */
+interface LeaderAdmissionAssignment {
+    id: string;
+    targetId: string;
+    personId: string;
+    grantId: string;
+    decision: AdmissionDecision;
+    note?: string;
+    expiresAt?: number;
+    active: boolean;
+    lastMutationId: string;
+    lastRequestDigest: string;
+    createdAt: number;
+    createdBy: string;
+    updatedAt: number;
+    updatedBy: string;
+}
+/** Persisted desired admission envelope and its latest delivery evidence. */
+interface LeaderAdmissionDelivery {
+    id: string;
+    targetId: string;
+    environment: string;
+    revision: number;
+    digest: string;
+    envelope: AdmissionGrantEnvelope;
+    status: LeaderAdmissionDeliveryStatus;
+    attempts: number;
+    lastAttemptAt?: number;
+    lastError?: string;
+    acknowledgedAt?: number;
+    updatedAt: number;
+}
+
+/** Retry every non-final saved delivery. Hosts may call this from a cron using
+ * the same Worker context; request retries use the packaged admin route. */
+declare function retryLeaderAdmissionDeliveries(env: ChapterEnv, ctx: WorkerContext, limit?: number): Promise<LeaderAdmissionDelivery[]>;
+
 /** Identity shared by initial HTML, response caching, and client hydration. */
 interface SignupControlThemeMetadata {
     source: "active" | "bootstrap";
@@ -1265,4 +1336,4 @@ declare function chapterWorker(options: ChapterWorkerOptions): {
     fetch(req: Request, env: ChapterEnv): Promise<Response>;
 };
 
-export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type MemberContentDeliveryOptions, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterWorker, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverSignupControl, renderActiveSignupControlHtml, withActiveSignupControlTheme };
+export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, AdmissionGrantDeliveryError, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type LeaderAdmissionAssignment, type LeaderAdmissionDelivery, type LeaderAdmissionDeliveryStatus, type MemberContentDeliveryOptions, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterWorker, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverSignupControl, renderActiveSignupControlHtml, retryLeaderAdmissionDeliveries, withActiveSignupControlTheme };

package/dist/worker/index.d.ts

@@ -185,6 +185,16 @@ interface ChapterNetworkTarget {
      * this follower. Omitted by default: a target never gains write permission
      * merely because its records are browsable. */
     sharedNotes?: readonly string[];
+    /** Per-record-type upper bound on profile fields this leader permits its
+     * admins to edit remotely. The follower must independently delegate the
+     * same field; readable fields never become writable implicitly. */
+    editableFields?: Record<string, readonly string[]>;
+    /** Record types on which this leader permits remote lifecycle transitions.
+     * The follower must independently opt in and remains pipeline authority. */
+    stageTransitions?: readonly string[];
+    /** Allow package-owned desired admission decisions for existing leader CRM
+     * people to be delivered to this target. Omitted means default deny. */
+    admissionGrants?: boolean;
 }
 /** One signed peer allowed to browse a privacy-bounded projection of this
  * site's CRM. The follower owns this allowlist; a leader target declaration
@@ -194,11 +204,21 @@ interface ChapterNetworkReader {
     id: string;
     /** Per-record-type field allowlist. Omitted types and fields never leave
      * this site. Record id, name, stage, and timestamps are bounded metadata. */
-    fields: Record<string, readonly string[]>;
+    fields?: Record<string, readonly string[]>;
     /** Record types on which this reader may append an explicitly shared note.
      * Omitted by default: browse permission never silently grants write access.
      * Shared notes land in the follower CRM activity feed. */
     sharedNotes?: readonly string[];
+    /** Exact local CRM fields this reader may edit remotely, by record type.
+     * Every field must also be readable so the peer can perform an optimistic
+     * edit against the value and revision it actually reviewed. */
+    editableFields?: Record<string, readonly string[]>;
+    /** Local CRM record types on which this reader may request a lifecycle
+     * transition. Chapter still enforces the local pipeline and gates. */
+    stageTransitions?: readonly string[];
+    /** Accept signed desired admission decisions from this reader. Independent
+     * of record browsing; an admission-only reader may omit `fields`. */
+    admissionGrants?: boolean;
 }
 /** Leader/follower network configuration. A follower needs no code config to
  * receive pushed records. It must explicitly declare `readers` before any peer
@@ -241,12 +261,18 @@ interface ResolvedNetworkTarget {
     secretName: string;
     fields?: Record<string, readonly string[]>;
     sharedNotes: readonly string[];
+    editableFields: Record<string, readonly string[]>;
+    stageTransitions: readonly string[];
+    admissionGrants?: boolean;
 }
 /** A validated follower-owned record projection for one signed reader. */
 interface ResolvedNetworkReader {
     id: string;
     fields: Record<string, readonly string[]>;
     sharedNotes: readonly string[];
+    editableFields: Record<string, readonly string[]>;
+    stageTransitions: readonly string[];
+    admissionGrants?: boolean;
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
@@ -1192,9 +1218,54 @@ interface AdmissionGrantDeliveryOptions {
     envelope: AdmissionGrantEnvelope;
     fetch?: typeof globalThis.fetch;
 }
+/** Structured follower rejection retained by the durable leader outbox. */
+declare class AdmissionGrantDeliveryError extends Error {
+    readonly status: number;
+    readonly reason: string;
+    constructor(status: number, reason: string);
+}
 /** Deliver one signed Parent admission revision. Durable retry belongs upstream. */
 declare function deliverAdmissionGrants(options: AdmissionGrantDeliveryOptions): Promise<AdmissionGrantReceipt>;
 
+/** Durable state of the latest desired admission document for one target. */
+type LeaderAdmissionDeliveryStatus = "saved" | "pending" | "acknowledged" | "retrying" | "rejected";
+/** Leader-owned desired admission decision for one authoritative CRM person. */
+interface LeaderAdmissionAssignment {
+    id: string;
+    targetId: string;
+    personId: string;
+    grantId: string;
+    decision: AdmissionDecision;
+    note?: string;
+    expiresAt?: number;
+    active: boolean;
+    lastMutationId: string;
+    lastRequestDigest: string;
+    createdAt: number;
+    createdBy: string;
+    updatedAt: number;
+    updatedBy: string;
+}
+/** Persisted desired admission envelope and its latest delivery evidence. */
+interface LeaderAdmissionDelivery {
+    id: string;
+    targetId: string;
+    environment: string;
+    revision: number;
+    digest: string;
+    envelope: AdmissionGrantEnvelope;
+    status: LeaderAdmissionDeliveryStatus;
+    attempts: number;
+    lastAttemptAt?: number;
+    lastError?: string;
+    acknowledgedAt?: number;
+    updatedAt: number;
+}
+
+/** Retry every non-final saved delivery. Hosts may call this from a cron using
+ * the same Worker context; request retries use the packaged admin route. */
+declare function retryLeaderAdmissionDeliveries(env: ChapterEnv, ctx: WorkerContext, limit?: number): Promise<LeaderAdmissionDelivery[]>;
+
 /** Identity shared by initial HTML, response caching, and client hydration. */
 interface SignupControlThemeMetadata {
     source: "active" | "bootstrap";
@@ -1265,4 +1336,4 @@ declare function chapterWorker(options: ChapterWorkerOptions): {
     fetch(req: Request, env: ChapterEnv): Promise<Response>;
 };
 
-export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type MemberContentDeliveryOptions, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterWorker, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverSignupControl, renderActiveSignupControlHtml, withActiveSignupControlTheme };
+export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, AdmissionGrantDeliveryError, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type LeaderAdmissionAssignment, type LeaderAdmissionDelivery, type LeaderAdmissionDeliveryStatus, type MemberContentDeliveryOptions, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterWorker, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverSignupControl, renderActiveSignupControlHtml, retryLeaderAdmissionDeliveries, withActiveSignupControlTheme };