@odla-ai/chapter 0.42.4 → 0.43.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/chapter",
-  "version": "0.42.4",
+  "version": "0.43.1",
   "description": "A leader/follower foundation for branded membership sites: shared CRM, admin, auth, payments, booking, and explicit record delivery from one defineChapter config.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/chapter",

package/runbooks/adopt-existing.md

@@ -581,6 +581,22 @@ this release. Preserve a host UI/route for non-USD or mismatched pricing. Test
 successful payment, duplicate webhook, failure, refund, and subscription
 cancellation before switching the UI.
 
+For a shared Stripe account, preserve Chapter's closed partition metadata on
+every new customer, subscription, payment intent, and refund: app, chapter,
+environment, data environment, and stable runtime. Do not infer ownership from
+the Stripe account or Price alone. A Worker with a named runtime prefers its
+`stripe_webhook_secret__<runtime>` endpoint secret. During an existing app's
+upgrade, Chapter falls back to the historical `stripe_webhook_secret` slot only
+when the scoped slot is absent; replace that compatibility path by reconciling a
+dedicated endpoint, without reading or manually copying either secret. The
+signed webhook must apply an exact target
+once, acknowledge a fully tagged sibling with zero local writes, quarantine an
+unmatched event for operators, and accept a metadata-free legacy object only
+when its Stripe customer, subscription, or gift id is already linked to this
+chapter and runtime. Exercise all four paths in development, including a replay
+of the identical body and an event-id collision with changed content, before
+removing any legacy payment adapter.
+
 ### Calendar and email
 
 Complete dev Google booking consent, reconnecting any grant from the retired

package/runbooks/greenfield.md

@@ -762,7 +762,10 @@ deployed dev origin.
    endpoint, stores `stripe_webhook_secret__<name>` under write-only custody,
    and binds `ODLA_RUNTIME`; do not manually reuse one signing secret across
    endpoints. A legacy single-Worker app may still store
-   `stripe_webhook_secret` directly.
+   `stripe_webhook_secret` directly. An upgraded named-runtime Worker falls back
+   to that historical slot only while its scoped endpoint secret is absent;
+   reconcile the dedicated endpoint to end the compatibility period without
+   reading or copying either secret.
 4. In the guarded `groups` row, set `stripePublishableKey` and `stripePriceId`.
 5. Confirm `policy.merchantDisclosureText` names the merchant the customer will
    see on the charge or receipt, including the chapter relationship when the
@@ -778,6 +781,18 @@ non-USD or unmatched pricing needs a host UI/route and cannot use the stock
 payment presentation. Never accept money until the provider equality check and
 webhook test prove authoritative paid/refunded state and idempotent replay.
 
+Chapter tags every newly created Stripe customer, subscription, payment intent,
+and refund with its app, chapter, environment, data environment, and stable
+runtime identity. Do not replace or omit those fields in a host payment route.
+The signed webhook acknowledges a fully tagged sibling event without a local
+write, accepts an untagged legacy event only when the referenced Stripe object is
+already linked to a local application or gift intent, and records a content-free
+receipt for each applied or unmatched event. Prove all three dispositions with
+synthetic test objects: exact target applies once, a sibling target writes zero
+rows, and an unmatched legacy event is quarantined and observable. Replaying the
+same event body must be a no-op; reusing its event id with different content must
+raise a collision signal and must not apply.
+
 ### Google Calendar
 
 Complete the human Google booking consent from provisioning, then: