@odla-ai/chapter 0.45.0 → 0.47.0

package/dist/worker/index.d.cts

@@ -228,6 +228,10 @@ interface ChapterNetworkTarget {
     /** Allow package-owned desired admission decisions for existing leader CRM
      * people to be delivered to this target. Omitted means default deny. */
     admissionGrants?: boolean;
+    /** Allow this leader to request a PII-free commercial parity snapshot from
+     * this follower. The follower must independently enable the same reader;
+     * omitted means no application or Stripe identifier digest crosses. */
+    commercialParity?: boolean;
 }
 /** One signed peer allowed to browse a privacy-bounded projection of this
  * site's CRM. The follower owns this allowlist; a leader target declaration
@@ -252,6 +256,9 @@ interface ChapterNetworkReader {
     /** Accept signed desired admission decisions from this reader. Independent
      * of record browsing; an admission-only reader may omit `fields`. */
     admissionGrants?: boolean;
+    /** Disclose a bounded, PII-free commercial parity snapshot to this signed
+     * reader. Identifiers leave only as edge-keyed, domain-separated HMACs. */
+    commercialParity?: boolean;
 }
 /** Leader/follower network configuration. A follower needs no code config to
  * receive pushed records. It must explicitly declare `readers` before any peer
@@ -297,6 +304,7 @@ interface ResolvedNetworkTarget {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** A validated follower-owned record projection for one signed reader. */
 interface ResolvedNetworkReader {
@@ -306,6 +314,7 @@ interface ResolvedNetworkReader {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
@@ -505,7 +514,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -517,10 +526,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -530,6 +542,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to

package/dist/worker/index.d.ts

@@ -228,6 +228,10 @@ interface ChapterNetworkTarget {
     /** Allow package-owned desired admission decisions for existing leader CRM
      * people to be delivered to this target. Omitted means default deny. */
     admissionGrants?: boolean;
+    /** Allow this leader to request a PII-free commercial parity snapshot from
+     * this follower. The follower must independently enable the same reader;
+     * omitted means no application or Stripe identifier digest crosses. */
+    commercialParity?: boolean;
 }
 /** One signed peer allowed to browse a privacy-bounded projection of this
  * site's CRM. The follower owns this allowlist; a leader target declaration
@@ -252,6 +256,9 @@ interface ChapterNetworkReader {
     /** Accept signed desired admission decisions from this reader. Independent
      * of record browsing; an admission-only reader may omit `fields`. */
     admissionGrants?: boolean;
+    /** Disclose a bounded, PII-free commercial parity snapshot to this signed
+     * reader. Identifiers leave only as edge-keyed, domain-separated HMACs. */
+    commercialParity?: boolean;
 }
 /** Leader/follower network configuration. A follower needs no code config to
  * receive pushed records. It must explicitly declare `readers` before any peer
@@ -297,6 +304,7 @@ interface ResolvedNetworkTarget {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** A validated follower-owned record projection for one signed reader. */
 interface ResolvedNetworkReader {
@@ -306,6 +314,7 @@ interface ResolvedNetworkReader {
     editableFields: Record<string, readonly string[]>;
     stageTransitions: readonly string[];
     admissionGrants?: boolean;
+    commercialParity?: boolean;
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
@@ -505,7 +514,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -517,10 +526,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -530,6 +542,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to