@odla-ai/chapter 0.46.0 → 0.47.1

package/dist/index.d.cts

@@ -604,7 +604,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -616,10 +616,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -629,6 +632,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to
@@ -1199,8 +1203,9 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  *
  * Operational tables (`applications`/`groups`/`meetings`/`emailLog`) are added in
  * `chapter` mode only. The auth tables follow {@link ResolvedAuth}: `source:
- * "table"` adds the `admins` allowlist (hub/BNF); `superAdmins` adds the
- * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
+ * "table"` adds the `admins` allowlist (hub/BNF); `superAdminSource: "table"`
+ * adds the legacy read-only super-admin tier (the backward-compatible default).
+ * `superAdminSource: "odla"` uses reserved `$users` and adds no app namespace. A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `stripeEventReceipts`, `superAdmins` — with
  * no `admins` table. */
@@ -1563,6 +1568,8 @@ declare function buildGroupSeed(config: ChapterConfig): Record<string, unknown>;
  * Apply defaults + validate the auth config into a {@link ResolvedAuth}. Defaults
  * by mode: `chapter` → the `provisional/member/admin` claim ladder with the
  * `superAdmins` tier; `hub` → the `admins` allowlist table with no super tier.
+ * Existing sites retain the legacy `superAdmins` table unless they explicitly
+ * select protected odla user roles.
  * Throws at import on a bad policy.
  */
 declare function resolveAuth(mode: ChapterMode, auth: ChapterAuth | undefined): ResolvedAuth;
@@ -1572,7 +1579,7 @@ declare function roleFromClaim(payload: Record<string, unknown>, auth: ResolvedA
 /** Does a role meet the admin bar (the highest ladder rung)? */
 declare function isAdminRole(role: string, auth: ResolvedAuth): boolean;
 /** Inputs to the role-change guard — resolved by the caller (route) from the
- *  identity provider + the read-only `superAdmins` table. */
+ *  identity provider + the configured Studio-managed super-admin authority. */
 interface RoleChangeContext {
     actorId: string;
     actorIsSuper: boolean;
@@ -1596,8 +1603,8 @@ type GuardResult = {
  * none re-derives it. Denies: an out-of-ladder role; changing your own role;
  * touching a super-admin unless you are one; and (when a `superAdmins` tier
  * exists) creating or altering an admin unless you are a super-admin. Note the
- * super-admin tier itself is never writable here — it lives in the read-only
- * `superAdmins` table, set only in odla Studio.
+ * super-admin tier itself is never writable here — it is set only in odla
+ * Studio, either as a protected `$users.role` or in the legacy allowlist.
  */
 declare function canChangeRole(ctx: RoleChangeContext): GuardResult;
 /** Structural view of odla-db's tenant-vault read, so chapter takes no runtime
@@ -2289,7 +2296,29 @@ interface NetworkRecordPage {
     total: number;
     limit: number;
     offset: number;
+    /** Follower-authored options that may safely be used for this type. Older
+     * followers omit this, so leaders must not offer source-side filters unless
+     * the capability is present. */
+    filters?: {
+        stages: Array<{
+            id: string;
+            label: string;
+        }>;
+        sorts: Array<{
+            id: NetworkRecordSort;
+            label: string;
+        }>;
+    };
+    /** Normalized query the follower actually applied. A leader checks this
+     * echo before presenting filtered results, preventing an older follower
+     * from silently ignoring newer query parameters. */
+    appliedQuery?: {
+        stage?: string;
+        sort: NetworkRecordSort;
+    };
 }
+/** Bounded source-side ordering supported by the federated record route. */
+type NetworkRecordSort = "updated_desc" | "updated_asc" | "name_asc" | "name_desc";
 /** Leader-private note attached to a stable remote record identity. */
 interface NetworkRecordNote {
     id: string;
@@ -3357,4 +3386,4 @@ declare const SILVER_SALT_P0_FIXTURE: {
     };
 };
 
-export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipPageDocument, membershipTierPresentationFromMarkdown, networkCommercialSourceKey, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, reconcileCommercialParitySnapshot, reconcileMeetings, reconcileStripeSnapshot, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };
+export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRecordSort, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipPageDocument, membershipTierPresentationFromMarkdown, networkCommercialSourceKey, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, reconcileCommercialParitySnapshot, reconcileMeetings, reconcileStripeSnapshot, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };

package/dist/index.d.ts

@@ -604,7 +604,7 @@ interface ChapterScheduling {
  *
  * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
- *   read-only `superAdmins` tier sits above it.
+ *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
  *   a binary "email is an admin or isn't", set only in odla Studio.
  *
@@ -616,10 +616,13 @@ interface ChapterAuth {
     /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
-    /** Provision the read-only `superAdmins` tier table — the only tier that may
-     *  create/modify admins, and (like every namespace) deny-all + written only in
-     *  odla Studio. Default: `true` for `"claim"`, `false` for `"table"`. */
+    /** Enable the Studio-managed super-admin tier — the only tier that may
+     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
     superAdmins?: boolean;
+    /** Authority behind the super-admin tier. `"table"` preserves the legacy
+     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
+     * for backward compatibility. */
+    superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
@@ -629,6 +632,7 @@ interface ResolvedAuth {
     /** The highest ladder rung (last entry) — the "admin" gate. */
     adminRole: string;
     superAdmins: boolean;
+    superAdminSource: "none" | "table" | "odla";
 }
 /** The application status pipeline. Which statuses exist, and the subsets a site
  *  allows a call to be booked from / an application approved from. Defaults to
@@ -1199,8 +1203,9 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  *
  * Operational tables (`applications`/`groups`/`meetings`/`emailLog`) are added in
  * `chapter` mode only. The auth tables follow {@link ResolvedAuth}: `source:
- * "table"` adds the `admins` allowlist (hub/BNF); `superAdmins` adds the
- * read-only super-admin tier (default on for the `"claim"` ladder). A `"claim"`
+ * "table"` adds the `admins` allowlist (hub/BNF); `superAdminSource: "table"`
+ * adds the legacy read-only super-admin tier (the backward-compatible default).
+ * `superAdminSource: "odla"` uses reserved `$users` and adds no app namespace. A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `stripeEventReceipts`, `superAdmins` — with
  * no `admins` table. */
@@ -1563,6 +1568,8 @@ declare function buildGroupSeed(config: ChapterConfig): Record<string, unknown>;
  * Apply defaults + validate the auth config into a {@link ResolvedAuth}. Defaults
  * by mode: `chapter` → the `provisional/member/admin` claim ladder with the
  * `superAdmins` tier; `hub` → the `admins` allowlist table with no super tier.
+ * Existing sites retain the legacy `superAdmins` table unless they explicitly
+ * select protected odla user roles.
  * Throws at import on a bad policy.
  */
 declare function resolveAuth(mode: ChapterMode, auth: ChapterAuth | undefined): ResolvedAuth;
@@ -1572,7 +1579,7 @@ declare function roleFromClaim(payload: Record<string, unknown>, auth: ResolvedA
 /** Does a role meet the admin bar (the highest ladder rung)? */
 declare function isAdminRole(role: string, auth: ResolvedAuth): boolean;
 /** Inputs to the role-change guard — resolved by the caller (route) from the
- *  identity provider + the read-only `superAdmins` table. */
+ *  identity provider + the configured Studio-managed super-admin authority. */
 interface RoleChangeContext {
     actorId: string;
     actorIsSuper: boolean;
@@ -1596,8 +1603,8 @@ type GuardResult = {
  * none re-derives it. Denies: an out-of-ladder role; changing your own role;
  * touching a super-admin unless you are one; and (when a `superAdmins` tier
  * exists) creating or altering an admin unless you are a super-admin. Note the
- * super-admin tier itself is never writable here — it lives in the read-only
- * `superAdmins` table, set only in odla Studio.
+ * super-admin tier itself is never writable here — it is set only in odla
+ * Studio, either as a protected `$users.role` or in the legacy allowlist.
  */
 declare function canChangeRole(ctx: RoleChangeContext): GuardResult;
 /** Structural view of odla-db's tenant-vault read, so chapter takes no runtime
@@ -2289,7 +2296,29 @@ interface NetworkRecordPage {
     total: number;
     limit: number;
     offset: number;
+    /** Follower-authored options that may safely be used for this type. Older
+     * followers omit this, so leaders must not offer source-side filters unless
+     * the capability is present. */
+    filters?: {
+        stages: Array<{
+            id: string;
+            label: string;
+        }>;
+        sorts: Array<{
+            id: NetworkRecordSort;
+            label: string;
+        }>;
+    };
+    /** Normalized query the follower actually applied. A leader checks this
+     * echo before presenting filtered results, preventing an older follower
+     * from silently ignoring newer query parameters. */
+    appliedQuery?: {
+        stage?: string;
+        sort: NetworkRecordSort;
+    };
 }
+/** Bounded source-side ordering supported by the federated record route. */
+type NetworkRecordSort = "updated_desc" | "updated_asc" | "name_asc" | "name_desc";
 /** Leader-private note attached to a stable remote record identity. */
 interface NetworkRecordNote {
     id: string;
@@ -3357,4 +3386,4 @@ declare const SILVER_SALT_P0_FIXTURE: {
     };
 };
 
-export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipPageDocument, membershipTierPresentationFromMarkdown, networkCommercialSourceKey, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, reconcileCommercialParitySnapshot, reconcileMeetings, reconcileStripeSnapshot, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };
+export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRecordSort, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipPageDocument, membershipTierPresentationFromMarkdown, networkCommercialSourceKey, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, reconcileCommercialParitySnapshot, reconcileMeetings, reconcileStripeSnapshot, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };

package/dist/index.js

@@ -801,7 +801,7 @@ function chapterDb(mode, auth, includeNetworkNotes = false, application = resolv
     }
   }
   if (auth.source === "table") entities.admins = admins;
-  if (auth.superAdmins) entities.superAdmins = superAdmins;
+  if (auth.superAdminSource === "table") entities.superAdmins = superAdmins;
   if (includeNetworkNotes) entities.networkNotes = networkNotes;
   if (includeBuilderLibrary) {
     entities.builderLibraryControls = builderLibraryControls;
@@ -984,7 +984,12 @@ function resolveAuth(mode, auth) {
   }
   const adminRole = ladder[ladder.length - 1];
   const superAdmins2 = a.superAdmins ?? source === "claim";
-  return { source, claim, ladder, adminRole, superAdmins: superAdmins2 };
+  const configuredSuperSource = a.superAdminSource ?? "table";
+  if (configuredSuperSource !== "table" && configuredSuperSource !== "odla") {
+    throw new Error(`defineChapter.auth.superAdminSource: must be "table" or "odla" \u2014 got ${JSON.stringify(a.superAdminSource)}`);
+  }
+  const superAdminSource = superAdmins2 ? configuredSuperSource : "none";
+  return { source, claim, ladder, adminRole, superAdmins: superAdmins2, superAdminSource };
 }
 function roleFromClaim(payload, auth) {
   const raw2 = payload[auth.claim];