@odla-ai/chapter 0.47.10 → 0.48.1

package/dist/index.d.ts

@@ -185,6 +185,8 @@ interface ChapterSignupControl {
     sourceId: string;
     /** Follower-vault key holding the dedicated edge secret. */
     secretName?: string;
+    /** Optional per-runtime vault keys. When present, unlisted runtimes and legacy untargeted deliveries fail closed. */
+    runtimeSecrets?: Readonly<Record<string, string>>;
     /** Stripe mode this deployed environment accepts. */
     stripeMode: "test" | "live";
 }
@@ -192,6 +194,7 @@ interface ChapterSignupControl {
 interface ResolvedSignupControl {
     sourceId: string;
     secretName: string;
+    runtimeSecrets?: Readonly<Record<string, string>>;
     stripeMode: "test" | "live";
 }
 
@@ -367,6 +370,9 @@ interface ChapterNetworkReader {
  * receive pushed records. It must explicitly declare `readers` before any peer
  * can browse its CRM. */
 interface ChapterNetwork {
+    /** Require the protected super-admin tier for remote mutations and operational
+     * detail. Ordinary admins retain routine name/email directory reads. */
+    requireSuperAdminWrites?: boolean;
     targets?: readonly ChapterNetworkTarget[];
     readers?: readonly ChapterNetworkReader[];
 }
@@ -421,6 +427,7 @@ interface ResolvedNetworkReader {
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
+    requireSuperAdminWrites?: boolean;
     targets: readonly ResolvedNetworkTarget[];
     readers: readonly ResolvedNetworkReader[];
 }
@@ -615,7 +622,9 @@ interface ChapterScheduling {
 }
 /** How a signed-in user's role is determined.
  *
- * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
+ * - `"clerk"` reads backend-only private Clerk roles for each authorization
+ *   check, without trusting public metadata or stale session roles.
+ * - `"claim"` reads a role ladder from a JWT claim (the legacy member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
  *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
@@ -623,23 +632,25 @@ interface ChapterScheduling {
  *
  * Defaults: `"claim"` in `chapter` mode, `"table"` in `hub` mode. */
 interface ChapterAuth {
-    source?: "claim" | "table";
+    /** `clerk` reads backend-only private_metadata.role on each request, ignoring
+     * JWT/public roles. Select explicitly after the coordinated role migration. */
+    source?: "claim" | "table" | "clerk";
     /** JWT claim holding the role, for `source: "claim"`. Default `"role"`. */
     claim?: string;
-    /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
+    /** Role ladder low→high, for claim or private Clerk roles. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
     /** Enable the Studio-managed super-admin tier — the only tier that may
-     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
+     *  create/modify admins. Default: `true` for `"claim"`/`"clerk"`, `false` for `"table"`. */
     superAdmins?: boolean;
     /** Authority behind the super-admin tier. `"table"` preserves the legacy
-     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
-     * for backward compatibility. */
+     * app allowlist; `"odla"` reads protected `$users.role` by exact subject ID.
+     * Default `"odla"` for private Clerk mode, `"table"` for legacy modes. */
     superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
-    source: "claim" | "table";
+    source: "claim" | "table" | "clerk";
     claim: string;
     ladder: readonly string[];
     /** The highest ladder rung (last entry) — the "admin" gate. */
@@ -919,12 +930,13 @@ interface NetworkCommercialFact {
     eventType: string;
     eventCreated: number;
     livemode: boolean;
-    objectKind: CommercialObjectKind | "ignored";
+    objectKind: CommercialObjectKind | "payment_intent" | "ignored";
     objectId: string;
     identity: CommercialIdentity;
     applicationId?: string;
     personId?: string;
     membershipId?: string;
+    seatId?: string;
     customerId?: string;
     subscriptionId?: string;
     invoiceId?: string;
@@ -936,6 +948,18 @@ interface NetworkCommercialFact {
     currency?: string;
     amountCents?: number;
     amountPaidCents?: number;
+    amountReceivedCents?: number;
+    invoiceTotalCents?: number;
+    billingReason?: string;
+    invoicePaidAt?: number;
+    invoicePeriodEndsAt?: number;
+    /** Complete, non-prorated recurring invoice lines; absent when ambiguous or truncated. */
+    recurringInvoiceLines?: Array<{
+        priceId: string;
+        quantity: number;
+        startsAt: number;
+        endsAt: number;
+    }>;
     amountRemainingCents?: number;
     currentPeriodStart?: number;
     currentPeriodEnd?: number;
@@ -957,6 +981,8 @@ interface NetworkCommercialException {
 }
 /** Complete deterministic view rebuilt from the append-only commercial event log. */
 interface NetworkCommercialProjection {
+    /** Standalone named-seat payments; subscription PaymentIntents are already counted in invoices. */
+    seatPayments?: NetworkCommercialProjectedRow[];
     customers: NetworkCommercialProjectedRow[];
     subscriptions: NetworkCommercialProjectedRow[];
     invoices: NetworkCommercialProjectedRow[];
@@ -997,6 +1023,7 @@ declare function reconcileStripeSnapshot(shadow: NetworkCommercialProjection, sn
     subscriptions: StripeObjectSnapshot;
     invoices: StripeObjectSnapshot;
     refunds: StripeObjectSnapshot;
+    payments?: StripeObjectSnapshot;
 }, sources: readonly NetworkCommercialSource[]): StripeCommercialReconciliation;
 
 /** Reduce a verified Stripe event to a bounded, PII-free fact. */
@@ -1203,7 +1230,9 @@ interface ChapterRunbookHints {
  * Build the one CLI-consumable integration for a chapter/hub: the crm_*
  * namespaces + crm_config seed + route probe, merged with the chapter's own
  * namespaces and a guarded `groups`-row seed. Drop it in odla.config.mjs's
- * `integrations` array.
+ * `integrations` array. Claim/private-Clerk policies also seed the exact role
+ * ladder and metadata source for Studio. Seeds are insert-only: when changing
+ * auth policy, reconcile that stored policy explicitly before enabling editing.
  */
 declare function createChapterIntegration(chapter: Chapter, options?: ChapterIntegrationOptions): ChapterIntegrationDescriptor;
 
@@ -1221,13 +1250,512 @@ declare function createChapterIntegration(chapter: Chapter, options?: ChapterInt
  * `superAdminSource: "odla"` uses reserved `$users` and adds no app namespace. A `"claim"`
  * chapter therefore emits the reference namespace set — `applications`,
  * `groups`, `meetings`, `emailLog`, `stripeEventReceipts`,
- * `subscriptionCheckoutIntents`, `superAdmins` — with
+ * `subscriptionCheckoutIntents`, `chapterAccountPolicy`, `superAdmins` — with
  * no `admins` table. */
 declare function chapterDb(mode: ChapterMode, auth: ResolvedAuth, includeNetworkNotes?: boolean, application?: ResolvedApplication, includeSignupControl?: boolean, includeMemberContent?: boolean, includeBuilderLibrary?: boolean, includeLeaderAdmissions?: boolean, includeNetworkPersonRegistry?: boolean, includeNetworkCommercialReadModel?: boolean): {
     schema: DbSchema;
     rules: DbRules;
 };
 
+/** Immutable commercial policy, separate from the recurring base SKU. */
+interface MembershipOfferingVersion {
+    id: string;
+    chapterId: string;
+    baseSkuId: string;
+    version: number;
+    status: "draft" | "published" | "retired";
+    effectiveFrom: number;
+    effectiveUntil?: number;
+    basePriceCents: number;
+    currency: string;
+    interval: "month" | "year";
+    term: {
+        kind: "fixed_end";
+        endsAt: number;
+    } | {
+        kind: "rolling_months";
+        months: number;
+    };
+    autoRenew: true;
+    paymentGraceDays: number;
+    seatPriceCents: number;
+    seatPurchaseWindowCalendarMonths: number;
+    requiredDisclosures: string[];
+}
+/** Cohort qualification survives the expiration of its monetary benefit. */
+interface MembershipDiscountPolicyVersion {
+    id: string;
+    chapterId: string;
+    version: number;
+    status: "draft" | "published" | "retired";
+    cohortLabel: string;
+    cohortEligibleSkuIds: string[];
+    discountEligibleSkuIds: string[];
+    softTarget: number;
+    percentOffBps: number;
+    qualifyingStartsAt: number;
+    qualifyingEndsAt: number;
+    benefitDuration: {
+        kind: "first_term" | "while_active";
+    } | {
+        kind: "fixed_end";
+        endsAt: number;
+    };
+}
+/** Add UTC calendar months, clamping month-end dates while preserving the time. */
+declare function addMembershipCalendarMonths(input: number | string, months: number): number;
+/** Normalize one version before publishing or issuing it; never retain caller-owned nested objects. */
+declare function membershipOfferingVersion(value: unknown): MembershipOfferingVersion;
+/** Normalize cohort and discount eligibility independently; zero discount can still confer founding status. */
+declare function membershipDiscountPolicyVersion(value: unknown): MembershipDiscountPolicyVersion;
+
+/** Frozen commercial terms supplied by the issuing membership authority, never the browser. */
+interface SubscriptionBillingTerms {
+    /** Immutable offering version whose base Price is subscribed. */
+    offeringVersionId: string;
+    /** Immutable discount policy, independent of the base SKU and permanent cohort. */
+    discount?: {
+        policyVersionId: string;
+        couponId: string;
+        percentOffBps: number;
+        duration: "once" | "forever";
+    };
+    /** Extended initial paid service end, epoch milliseconds. Renewal starts here. */
+    initialTermEndsAt?: number;
+}
+
+/** Money and service promise frozen at offer issuance, not recomputed from later policy edits. */
+interface MembershipCommercialOffer {
+    offering: MembershipOfferingVersion;
+    discountPolicy: MembershipDiscountPolicyVersion | null;
+    issuedAt: number;
+    founding: boolean;
+    dueTodayCents: number;
+    /** Fixed service end only; rolling service starts at the provider-confirmed payment. */
+    initialTermEndsAt?: number;
+    renewalCents: number;
+    billingTerms: SubscriptionBillingTerms;
+}
+/** Calculate a new offer from authority-owned policy and its approved, dues-paying cohort count.
+ * This pure function does not reserve a position or make a shadow ledger authoritative.
+ * Persist the returned promise before accepting consent or performing provider I/O.
+ */
+declare function createMembershipCommercialOffer(input: {
+    offering: unknown;
+    discountPolicy?: unknown;
+    approvedFoundingCount: number;
+    now: number;
+    /** Coupon identity must be partitioned by app, environment, runtime and immutable policy. */
+    couponId?: string;
+}): MembershipCommercialOffer;
+
+/** Verified source identity supplied by the server adapter, never by a browser's price payload. */
+interface MembershipOfferRequest {
+    offerId: string;
+    applicationId: string;
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    skuId: string;
+    now: number;
+    lifetimeMs: number;
+}
+/** Durable pre-payment promise. The opaque digest is what the member acknowledges. */
+interface IssuedMembershipOffer {
+    id: string;
+    applicationId: string;
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    skuId: string;
+    issuedAt: number;
+    expiresAt: number;
+    digest: string;
+    contract: MembershipCommercialOffer;
+}
+/** Stable request identity shared by the issuer and a verifying follower. */
+declare function membershipOfferIdForRequest(input: Pick<MembershipOfferRequest, "appId" | "chapterId" | "environment" | "runtime" | "applicationId"> & {
+    requestId: string;
+}): Promise<string>;
+/** Validate and copy a trusted authority response before saving it as a chapter projection.
+ * This verifies the complete target, normalized money promise and digest; it does not
+ * authenticate its transport or make caller-supplied offers authoritative.
+ */
+declare function verifyIssuedMembershipOffer(value: unknown, expected: MembershipOfferRequest): Promise<IssuedMembershipOffer>;
+/** Issue in the network data scope with a revision fence against policy/cohort changes.
+ * The authority state must be explicitly initialized and every policy/count mutation
+ * must increment its revision in the same transaction. Shadow data never qualifies.
+ * This function neither calls Stripe nor grants access. Its caller authenticates the
+ * source deployment before invoking it and must enforce expiry before checkout starts.
+ */
+declare function issueMembershipCommercialOffer(db: ChapterDb, input: MembershipOfferRequest): Promise<IssuedMembershipOffer>;
+
+/** A dedicated two-sided edge: no chapter receives the network database credential. */
+interface MembershipAuthorityPeer {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    secretName: string;
+    /** Authority-configured, product-separated recurring named-seat Price. Omit to disable seat commands. */
+    seatPriceId?: string;
+}
+/** Business API configuration, independent of the browser UI. May be mounted in
+ * the existing BNF backend using its existing odla database; no extra app required.
+ */
+interface MembershipAuthorityHandlerOptions {
+    peers: readonly MembershipAuthorityPeer[];
+    /** Connect to the network owner's database (BNF), never a chapter projection. */
+    makeDb: () => ChapterDb;
+    now?: () => number;
+    offerLifetimeMs: number;
+    /** Network vault slot; never supplied by a caller. Defaults to stripe_secret_key. */
+    stripeSecretName?: string;
+}
+/** Signed server-to-server route; the runtime is included in the signed request target. */
+declare const MEMBERSHIP_AUTHORITY_PATH = "/api/membership-authority";
+/** Create the narrow signed offer issuer. Authentication maps each dedicated edge
+ * to an exact app/chapter/environment/runtime; callers cannot select another scope,
+ * provide prices, grant roles, or run arbitrary network database operations.
+ * Replayed signed requests are safe because issuance is durably idempotent.
+ */
+declare function createMembershipAuthorityHandler(options: MembershipAuthorityHandlerOptions): (req: Request) => Promise<Response>;
+
+/** Per-tier policy overrides prevent a chapter-wide price claim leaking into another SKU. */
+interface TierPaymentPolicy {
+    refundPolicyText: string;
+    trustCopy?: string;
+}
+
+/** Server-owned source identity; the browser never supplies an offer or its price. */
+interface MembershipQuoteTarget {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    applicationId: string;
+    skuId: string;
+}
+/** Host transport adapter; may call the signed edge or an in-process network command. */
+type MembershipOfferIssuer = (input: MembershipQuoteTarget & {
+    requestId: string;
+}) => Promise<IssuedMembershipOffer>;
+
+/** A consented offer, bound once to the follower's immutable provider Price and quote. */
+interface MembershipCheckoutBindingInput extends MembershipQuoteTarget {
+    offerId: string;
+    offerDigest: string;
+    quoteDigest: string;
+    priceId: string;
+}
+/** Content-free authority receipt. It does not mean paid, approved, or entitled. */
+interface MembershipCheckoutBinding extends MembershipCheckoutBindingInput {
+    id: string;
+    boundAt: number;
+}
+/** Stable per-application binding identity, separate from an individual offer generation. */
+declare function membershipCheckoutBindingId(input: MembershipQuoteTarget): Promise<string>;
+/** Validate an authenticated transport's receipt and discard all undeclared fields. */
+declare function verifyMembershipCheckoutBinding(value: unknown, input: MembershipCheckoutBindingInput): Promise<MembershipCheckoutBinding>;
+/** Bind accepted terms in the network transaction before any provider creation.
+ * Replays preserve an already-bound offer after its issuance window ends.
+ * A different offer/Price/consent for the same application is never a second purchase.
+ */
+declare function bindMembershipCheckout(db: ChapterDb, input: MembershipCheckoutBindingInput, now: number): Promise<MembershipCheckoutBinding>;
+
+/** References only. Money facts must already exist in the verified network Stripe event log. */
+interface ConfirmMembershipPaymentInput extends MembershipQuoteTarget {
+    eventId: string;
+    providerSubscriptionId: string;
+    providerCustomerId: string;
+}
+/** The network identity remains source-linked until an explicit canonical Person link exists. */
+interface MembershipPaymentReceipt {
+    membershipId: string;
+    status: string;
+    initialTermStartedAt: number;
+    initialTermEndsAt: number;
+    cohort: string;
+    memberNumber?: number;
+}
+/** Stable network membership identity for the exact chapter application and runtime. */
+declare function networkMembershipId(input: MembershipQuoteTarget): Promise<string>;
+/** Commit payment and the pending primary entitlement together, before chapter access can advance.
+ * An authenticated Chapter supplies references, never a paid amount or a synthetic Person id.
+ * A missing independently verified Stripe fact is retryable; browser success is not evidence.
+ */
+declare function confirmMembershipPayment(db: ChapterDb, input: ConfirmMembershipPaymentInput, now: number): Promise<MembershipPaymentReceipt>;
+
+/** Session identity attested by the signed chapter adapter, never a browser's email_verified flag. */
+interface NamedSeatRecipientInput extends MembershipQuoteTarget {
+    seatId: string;
+    recipientApplicationId: string;
+    recipientUserId: string;
+    verifiedRecipientEmail: string;
+}
+
+/** Verified full initial refund and subscription cancellation, not a browser assertion. */
+interface MembershipRefundReceipt {
+    membershipId: string;
+    status: "refunded";
+    refundedCents: number;
+    subscriptionCanceled: true;
+}
+/** Refund the frozen initial membership purchase; retain cohort and member order permanently.
+ * The adapter authenticates the operator. Pending state prevents new access while provider effects retry.
+ */
+declare function refundNetworkMembership(db: ChapterDb, input: MembershipQuoteTarget, secretKey: string, now: number): Promise<MembershipRefundReceipt>;
+
+/** Current authoritative billing state; a chapter projection must not derive it from arrival order. */
+interface MembershipRenewalReceipt {
+    membershipId: string;
+    status: string;
+    termEndsAt: number;
+    graceEndsAt: number;
+    autoRenew: boolean;
+}
+/** Apply independently verified renewal success/failure, including co-terminating named seats.
+ * The period and immutable Price set, not webhook delivery order, fence progression.
+ */
+declare function reconcileMembershipRenewal(db: ChapterDb, input: MembershipQuoteTarget & {
+    eventId: string;
+}, now: number): Promise<MembershipRenewalReceipt>;
+
+/** Short-lived decision from current network state; never a durable bearer capability. */
+interface MembershipAccessReceipt {
+    membershipId: string;
+    allowed: boolean;
+    status: string;
+    accessEndsAt: number;
+    revision: number;
+}
+/** Enforce term/grace expiry even when a webhook, cron, or Clerk role update is delayed. */
+declare function readMembershipAccess(db: ChapterDb, input: MembershipQuoteTarget, now: number): Promise<MembershipAccessReceipt>;
+/** Reject an invalid network receipt before a chapter grants private-content access. */
+declare function verifyMembershipAccessReceipt(value: unknown, input: MembershipQuoteTarget, now: number): Promise<MembershipAccessReceipt>;
+
+/** Named-seat offer for the authenticated purchaser, not a transferable gift or arbitrary quantity. */
+interface NamedSeatOffer {
+    membershipId: string;
+    amountCents: number;
+    currency: string;
+    interval: "year" | "month";
+    termEndsAt: number;
+    purchaseEndsAt: number;
+    autoRenew: boolean;
+    eligible: boolean;
+    digest: string;
+    seat?: {
+        seatId: string;
+        status: string;
+        recipientName: string;
+        recipientEmail: string;
+    };
+}
+/** Stable commercial consent fingerprint; eligibility is always checked again at checkout. */
+declare function namedSeatOfferDigest(offer: Omit<NamedSeatOffer, "digest">): Promise<string>;
+/** Read the frozen offering and any existing seat without reserving or charging anything. */
+declare function readNamedSeatOffer(db: ChapterDb, input: MembershipQuoteTarget, now: number): Promise<NamedSeatOffer>;
+
+/** Identity attested by the recipient's chapter after checking Clerk's verified primary email. */
+interface NamedSeatInvitationRequest {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    seatId: string;
+    recipientUserId: string;
+    verifiedRecipientEmail: string;
+}
+/** Recipient-visible invitation; no purchaser contact information or provider credentials. */
+interface NamedSeatInvitation {
+    seatId: string;
+    primaryApplicationId: string;
+    skuId: string;
+    recipientName: string;
+    status: string;
+    acceptanceEndsAt: number;
+    termEndsAt: number;
+}
+/** Resolve the invitation only for its named, verified person (or already bound user ID). */
+declare function readNamedSeatInvitation(db: ChapterDb, input: NamedSeatInvitationRequest, now: number): Promise<NamedSeatInvitation>;
+/** Recipient access requires both current primary membership and this exact bound seat's entitlement. */
+declare function readNamedSeatAccess(db: ChapterDb, input: MembershipQuoteTarget & {
+    seatId: string;
+    recipientUserId: string;
+    recipientApplicationId: string;
+}, now: number): Promise<MembershipAccessReceipt>;
+
+/** Exact configured chapter/runtime serviced by one scheduled network worker. */
+type MembershipEffectScope = Pick<MembershipQuoteTarget, "appId" | "chapterId" | "environment" | "runtime">;
+/** Downstream requests carry only identifiers; the signed chapter receiver reads current state and deduplicates by effectId. */
+interface MembershipChapterEffect extends MembershipQuoteTarget {
+    effectId: string;
+    seatId: string;
+    kind: "invite_named_recipient" | "grant_named_recipient_access" | "revoke_named_recipient_access";
+}
+/** Recover provider effects and expired invitations from durable state, independently of browser/webhook retries.
+ * The optional chapter adapter must return a durable, idempotent receipt. An absent adapter leaves work visibly pending.
+ * Provider HTTP timeouts, ambiguous receipts and scope conflicts never become success or an unbounded automatic retry loop.
+ */
+declare function drainMembershipEffects(db: ChapterDb, options: {
+    scope: MembershipEffectScope;
+    stripeSecretKey: string;
+    limit?: number;
+    deliverChapterEffect?: (input: MembershipChapterEffect) => Promise<{
+        effectId: string;
+        complete: true;
+    }>;
+}, now: number): Promise<{
+    complete: number;
+    pending: number;
+    expired: number;
+    more: boolean;
+}>;
+
+/** Minimal chapter-owned delivery data, fetched over the authenticated runtime edge, never from a browser payload. */
+interface MembershipChapterEffectData extends MembershipChapterEffect {
+    recipientName: string;
+    recipientEmail: string;
+    recipientUserId: string | null;
+    recipientApplicationId: string | null;
+    acceptanceEndsAt: number;
+    termEndsAt: number;
+    applicable: boolean;
+}
+/** Read current effect eligibility and the named recipient from the authoritative seat, not a stale queued message. */
+declare function readMembershipChapterEffect(db: ChapterDb, input: MembershipChapterEffect, now: number): Promise<MembershipChapterEffectData>;
+
+/** Inputs supplied by an authenticated chapter backend; no browser credentials cross this edge. */
+interface RequestMembershipOfferOptions {
+    secret: string;
+    targetUrl: string;
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    applicationId: string;
+    skuId: string;
+    requestId: string;
+    /** A configured service binding may replace public fetch, but must not fall back when absent. */
+    fetch?: typeof globalThis.fetch;
+}
+/** Request and verify one durable network offer before any payment provider call. */
+declare function requestMembershipCommercialOffer(options: RequestMembershipOfferOptions): Promise<IssuedMembershipOffer>;
+/** Bind the exact consent and Price before Stripe is contacted. */
+declare function requestMembershipCheckoutBinding(options: MembershipCheckoutBindingInput & Pick<RequestMembershipOfferOptions, "secret" | "targetUrl" | "fetch">): Promise<MembershipCheckoutBinding>;
+type AuthorityTransport = Pick<RequestMembershipOfferOptions, "secret" | "targetUrl" | "fetch">;
+/** Fetch current delivery state; the caller cannot substitute an email, account, term, or entitlement. */
+declare function requestMembershipChapterEffect(options: MembershipChapterEffect & AuthorityTransport): Promise<MembershipChapterEffectData>;
+/** Only the named buyer's prepared payment details; no network credentials or canonical PII. */
+interface NamedSeatCheckoutReceipt {
+    seatId: string;
+    paymentIntentId: string;
+    clientSecret: string;
+    amountCents: number;
+    currency: string;
+    termEndsAt: number;
+    status: string;
+}
+/** Result of attesting one verified recipient's acceptance or completed Journey. */
+interface NamedSeatRecipientReceipt {
+    seatId: string;
+    status: string;
+    recipientApplicationId: string;
+}
+/** Full seat-only refund. The purchaser's primary subscription is not canceled. */
+interface NamedSeatRefundReceipt {
+    seatId: string;
+    status: "refunded";
+    refundedCents: number;
+    subscriptionCanceled: false;
+}
+/** Refund a declined recipient's exact bound seat; the caller authenticates the chapter operator. */
+declare function requestNamedSeatDecline(options: NamedSeatRecipientInput & AuthorityTransport): Promise<NamedSeatRefundReceipt>;
+/** Verified purchaser identity and their named recipient, with no caller-selected pricing. */
+type NamedSeatCheckoutRequest = MembershipQuoteTarget & {
+    recipientName: string;
+    recipientEmail: string;
+    purchaserEmail: string;
+    purchaserUserId: string;
+};
+/** Reserve the exact recipient before freezing local consent, without contacting a payment provider. */
+declare function requestNamedSeatReservation(options: NamedSeatCheckoutRequest & AuthorityTransport): Promise<Pick<NamedSeatCheckoutReceipt, "seatId" | "amountCents" | "currency" | "termEndsAt">>;
+/** Reference to an independent network Stripe fact, never caller-supplied payment amounts. */
+type NamedSeatEvidenceRequest = MembershipQuoteTarget & {
+    seatId: string;
+    eventId: string;
+};
+/** Read an authenticated purchaser's seat terms and existing named recipient. */
+declare function requestNamedSeatOffer(options: MembershipQuoteTarget & AuthorityTransport): Promise<NamedSeatOffer>;
+/** Look up one invitation only after the chapter verifies the recipient's current primary email. */
+declare function requestNamedSeatInvitation(options: NamedSeatInvitationRequest & AuthorityTransport): Promise<NamedSeatInvitation>;
+/** Check the exact recipient's current entitlement rather than relying on a cached account role. */
+declare function requestNamedSeatAccess(options: MembershipQuoteTarget & {
+    seatId: string;
+    recipientUserId: string;
+    recipientApplicationId: string;
+} & AuthorityTransport): Promise<MembershipAccessReceipt>;
+/** Prepare one named purchase through the configured network Price, never a caller-selected Price. */
+declare function requestNamedSeatCheckout(options: NamedSeatCheckoutRequest & AuthorityTransport): Promise<NamedSeatCheckoutReceipt>;
+/** Forward only the reference to independently verified network payment evidence. */
+declare function requestNamedSeatPayment(options: NamedSeatEvidenceRequest & AuthorityTransport): Promise<{
+    seatId: string;
+    reconciled: true;
+}>;
+/** Forward a complete seat refund without changing the purchaser's membership. */
+declare function requestNamedSeatRefund(options: NamedSeatEvidenceRequest & AuthorityTransport): Promise<{
+    seatId: string;
+    reconciled: true;
+}>;
+/** Claim only the verified named recipient's invitation. */
+declare function requestNamedSeatAcceptance(options: NamedSeatRecipientInput & AuthorityTransport): Promise<NamedSeatRecipientReceipt>;
+/** Attest that recipient's own completed Journey. */
+declare function requestNamedSeatApproval(options: NamedSeatRecipientInput & AuthorityTransport): Promise<NamedSeatRecipientReceipt>;
+/** Reconcile local provider references against independently signed network Stripe facts. */
+declare function requestMembershipPayment(options: ConfirmMembershipPaymentInput & AuthorityTransport): Promise<MembershipPaymentReceipt>;
+/** Attest durable chapter Journey approval; the network alone assigns order and entitlement. */
+declare function requestMembershipApproval(options: MembershipQuoteTarget & AuthorityTransport): Promise<MembershipPaymentReceipt>;
+/** Refund only the network's frozen initial invoice and cancel its subscription. Caller must authenticate the operator first. */
+declare function requestMembershipRefund(options: MembershipQuoteTarget & AuthorityTransport): Promise<MembershipRefundReceipt>;
+/** Advance billing only from independently verified network invoice evidence. */
+declare function requestMembershipRenewal(options: MembershipQuoteTarget & {
+    eventId: string;
+} & AuthorityTransport): Promise<MembershipRenewalReceipt>;
+/** Read current entitlement for one authenticated member; network outages must fail closed. */
+declare function requestMembershipAccess(options: MembershipQuoteTarget & AuthorityTransport): Promise<MembershipAccessReceipt>;
+
+/** The signed chapter adapter attests that its own Journey approval is durable.
+ * Payment, cohort and order come exclusively from network authority records.
+ * An issued paid founding promise is honored even after the soft target is reached.
+ */
+declare function approveNetworkMembership(db: ChapterDb, input: MembershipQuoteTarget, now: number): Promise<MembershipPaymentReceipt>;
+
+/** Validate a trusted transport response before using it to advance a chapter Journey. */
+declare function verifyMembershipPaymentReceipt(value: unknown, target: MembershipQuoteTarget): Promise<MembershipPaymentReceipt>;
+
+/** Reconcile invoices, cancellation settings and provider-initiated full initial refunds from independent evidence.
+ * Current Stripe reads arbitrate out-of-order subscription events. Only paid invoices extend a membership term.
+ */
+declare function reconcileMembershipBilling(db: ChapterDb, input: MembershipQuoteTarget & {
+    eventId: string;
+}, now: number, stripeSecretName?: string): Promise<MembershipRenewalReceipt>;
+
+/** Opt-in network-scope schema. Do not install as independent chapter authorities. */
+declare const membershipOfferEntities: Record<string, Entity>;
+/** Browser callers cannot read, issue or alter commercial promises. */
+declare const membershipOfferRules: DbRules;
+
+/** Authoritative network purchase records, installed once in the network scope.
+ * A canonical Person link is optional until explicit reconciliation; source identity is not.
+ * These records must never be populated by a shadow projection writer.
+ */
+declare const membershipAuthorityEntities: Record<string, Entity>;
+/** Backend-only authority; browser roles, including a network admin, cannot directly change these rows. */
+declare const membershipAuthorityRules: DbRules;
+
 /** Validate one complete parent or chapter authoring layer with actionable paths. */
 declare function validateMemberContentDocument(input: unknown, options?: MemberContentValidationOptions): MemberContentValidationResult;
 /** Validate or fail closed with every actionable document error. */
@@ -1572,7 +2100,7 @@ declare function createBuilderLibraryEnvelope(document: BuilderLibraryDocument):
 
 /** The default shared CRM graph: people (with the application/member pipeline)
  * plus businesses and the `works_at` relation, in both modes. */
-declare function defaultCrm(_mode: ChapterMode): CrmConfig;
+declare function defaultCrm(mode: ChapterMode): CrmConfig;
 
 /** The `groups` row (attrs) for `chapter` mode. Missing config falls back to
  * empty copy / defaults, so a minimal config still provisions cleanly. */
@@ -1664,11 +2192,10 @@ declare function render(template: string, vars: Record<string, string>): string;
  */
 declare function renderTemplateBody(group: EmailGroup, template: string, vars: Record<string, string>): string | null;
 /**
- * E1 (exactly-once): given the prior `emailLog` rows for a `dedupeKey`, has the
+ * E1 (confirmed delivery): given prior `emailLog` rows for a `dedupeKey`, has the
  * mail already been delivered? A prior row with **no error** means yes — the
- * caller short-circuits the resend. Failure rows (which carry an `error` and are
- * written without the dedupe mutationId) do not count, so a retry after a failure
- * can still succeed.
+ * caller short-circuits the resend. Pending/uncertain rows carry an error marker;
+ * the orchestration layer must reconcile those rather than blindly resending.
  */
 declare function isAlreadySent(priorRows: ReadonlyArray<{
     error?: unknown;
@@ -1729,10 +2256,12 @@ interface NotifyDeps {
     envName: string;
     sender?: MailSender;
     from?: string;
+    /** Runtime-local non-production inbox; never changes the shared chapter setting. */
+    debugEmail?: string;
     now: () => number;
     newId: () => string;
 }
-/** One templated send. `dedupeKey` is the exactly-once key. */
+/** One templated send. `dedupeKey` identifies one durable delivery workflow. */
 interface NotifyInput {
     group: EmailGroup;
     template: string;
@@ -1749,15 +2278,30 @@ interface NotifyResult {
     reason?: string;
 }
 /**
- * Send a templated lifecycle email exactly once. Short-circuits on a prior
- * successful send; otherwise plans delivery (dev fail-safe applies), sends via the
- * transport when one is wired and the plan calls for it, and records an emailLog
- * row either way (success keyed for exactly-once, failure unkeyed for retry).
+ * Claim before sending. Confirmed sends short-circuit; uncertain sends never
+ * automatically repeat. Non-production redirect/log-only safeguards still apply.
  */
 declare function sendTemplated(deps: NotifyDeps, input: NotifyInput): Promise<NotifyResult>;
 /** Project a `groups` row into the {@link EmailGroup} the email pipeline reads. */
 declare function emailGroupFrom(row: Record<string, unknown>): EmailGroup;
 
+/** Evidence from an authenticated operator resolving an uncertain provider outcome. */
+interface LifecycleDeliveryResolution {
+    id: string;
+    groupId: string;
+    expectedAttempt: number;
+    expectedState: "sending" | "uncertain";
+    decision: "confirmed_delivered" | "confirmed_not_delivered";
+    actorId: string;
+    reason: string;
+    messageId?: string;
+}
+/** Resolve only the exact reviewed attempt. This never sends mail itself.
+ * A confirmed non-delivery permits the original workflow to retry its frozen payload.
+ * It must not be used merely because a message has not yet appeared in an inbox.
+ */
+declare function reconcileLifecycleDelivery(db: ChapterDb, input: LifecycleDeliveryResolution, now: number): Promise<void>;
+
 /**
  * Apply defaults + validate the pipeline config. With no config, the complete
  * reference pipeline. With `stages` given but the subsets omitted, the subsets
@@ -1780,6 +2324,17 @@ declare function canBook(status: string, p: ResolvedPipeline): boolean;
 /** May an application be approved (→ member) from this status? */
 declare function canApprove(status: string, p: ResolvedPipeline): boolean;
 
+/** Provider evidence retained from a signed initial invoice, not browser success. */
+interface MembershipInvoiceEvidence {
+    invoiceId?: string;
+    subscriptionId?: string;
+    customerId?: string;
+    currency?: string;
+    total?: number;
+    amountPaid?: number;
+    status?: string;
+}
+
 /** A group row's payment configuration, as far as readiness cares. */
 interface PaymentsGroup {
     stripePublishableKey?: string | null;
@@ -1814,16 +2369,30 @@ type WebhookEvent = ({
     kind: "gift_revoked";
     giftIntentId: string;
     reason: "refunded" | "canceled";
+} | {
+    kind: "seat_paid" | "seat_refunded";
+    seatId: string;
+    applicationId?: string;
+    customerId?: string;
 } | {
     kind: "first_payment";
     applicationId?: string;
     customerId?: string;
     renewalAt?: number;
+    invoice?: MembershipInvoiceEvidence;
 } | {
     kind: "renewal";
     applicationId?: string;
     customerId?: string;
     renewalAt?: number;
+} | {
+    kind: "renewal_failed";
+    applicationId?: string;
+    customerId?: string;
+} | {
+    kind: "subscription_changed";
+    applicationId?: string;
+    customerId?: string;
 } | {
     kind: "refunded";
     applicationId?: string;
@@ -1857,7 +2426,9 @@ declare function findApplicationRef(obj: Record<string, unknown>): {
 /** Normalize a verified Stripe event into a {@link WebhookEvent}. `invoice.paid`
  *  splits into first_payment vs renewal by `billing_reason`; refunds and
  *  cancellations map directly; everything else is ignored (acked, not retried). */
-declare function normalizeWebhookEvent(event: StripeEvent): WebhookEvent;
+declare function normalizeWebhookEvent(event: StripeEvent, options?: {
+    requireProviderPayment?: boolean;
+}): WebhookEvent;
 /** First-payment patch: advance submitted→paid_pending_vetting (never any other
  *  transition) and record the renewal date. Empty when nothing changed, so the
  *  caller can skip the write. */
@@ -1869,14 +2440,15 @@ declare function firstPaymentPatch(currentStatus: string, renewalAt?: number): {
 declare function renewalPatch(renewalAt: number): {
     renewalAt: number;
 };
-/** Refund patch — the SOLE writer of status "refunded" (the admin refund route
- *  issues the Stripe refund but never sets this; the webhook does). */
+/** A verified full refund closes the paid lifecycle and its renewal display. */
 declare function refundedPatch(): {
     status: "refunded";
+    renewalAt: 0;
 };
 /** Subscription-cancellation patch. */
 declare function canceledPatch(): {
     canceled: true;
+    renewalAt: 0;
 };
 
 /** Current wire version for parent-authored admission decisions. */
@@ -1997,7 +2569,7 @@ declare function hasDisclaimerAck(fields: Record<string, unknown>): boolean;
  * them. Pure; returns `undefined` when there is nothing to write.
  */
 declare function applicantProfile(chapter: Chapter, fields: Record<string, unknown>): Record<string, unknown> | undefined;
-/** A validated submission, or a 400-worthy validation error the route returns.
+/** A validated submission, or a validation/duplicate-email error the route returns.
  *  `disclaimerAckAt` reports what THIS request recorded — a number when consent
  *  was stamped, `null` when none was supplied. It is always present so a missing
  *  consent record is visible in the response rather than silently absent from a
@@ -2011,6 +2583,8 @@ type SubmitResult = {
 } | {
     ok: false;
     error: string;
+    code?: string;
+    status?: number;
 };
 /**
  * Submit a membership application (B2 + B3). Validates the configured required
@@ -2020,6 +2594,9 @@ type SubmitResult = {
  * create two applications. The application id is derived from that same stable
  * input, so the duplicate response returns the first request's canonical id
  * rather than a fresh, nonexistent one. Idempotency is package-enforced.
+ * A unique normalized signup email key prevents concurrent submissions with
+ * different ids from creating two applications; a conflict returns status 409.
+ * Apply the current Chapter schema before deploying this writer.
  * `now`/`newId` are injected (deterministic in tests).
  */
 declare function submitApplication(db: ChapterDb, chapter: Chapter, fields: Record<string, unknown>, opts: {
@@ -2034,6 +2611,8 @@ declare function submitApplication(db: ChapterDb, chapter: Chapter, fields: Reco
     admissionGrant?: AdmissionGrantRow;
     /** Server-validated gift offer selected from active signed control. */
     giftOfferId?: string;
+    /** Server-selected deployment partition, including free applications. */
+    runtime?: string;
 }): Promise<SubmitResult>;
 /** The `groups`-row fields the join config exposes. */
 interface JoinConfigGroup {
@@ -2275,6 +2854,15 @@ interface NetworkStageTransition {
 interface NetworkRecordEdit {
     fields: NetworkEditableField[];
     allowedStages: NetworkStageTransition[];
+    /** Durable application operation awaiting reconciliation by its original operator. */
+    pendingAction?: {
+        mutationId: string;
+        stage: string;
+        expectedStage: string;
+        expectedRevision: number;
+        actorId: string;
+        actorEmail?: string;
+    };
 }
 /** Signed follower mutation dispatched by a leader admin. Exactly one of
  * `fields` or `stage` is present. */
@@ -2374,34 +2962,12 @@ interface ProjectionDeps {
 /** Safe defaults when a target does not declare an explicit field allowlist. */
 declare const DEFAULT_SHARE_FIELDS: Readonly<Record<string, readonly string[]>>;
 
-/** Map a shared prospect to a crm `person` input (only the fields the default
- *  person type accepts). Name falls back to first+last, then the email. */
-declare function sharedPersonInput(person: SharedPerson): Record<string, unknown>;
-/** Backward-compatible display tag retained while structured origin rows are
- * the durable leader-id → local-record mapping. */
-declare function networkSourceTag(type: string, hubRecordId: string, sourceId?: string): string;
-/** Normalize the backwards-compatible person/business shapes into the versioned
- * generic record envelope the receiver writes. */
-declare function normalizeSharedRecord(record: SharedPerson | SharedBusiness | SharedRecord, fallbackSourceId?: string): NormalizedSharedRecord;
-/** Build the allowlisted payload sent from one leader CRM record to a target.
- * A target with an explicit `fields` map only accepts the types it lists. */
-declare function sharedRecordFromCrm(crm: Crm, record: CrmRecord, target: ResolvedNetworkTarget, sourceId?: string): SharedRecord;
-/**
- * Upsert a leader-shared CRM record into this follower. Accepts the original
- * person wire shape plus the versioned generic shape. Re-shares resolve through
- * a durable provenance tag; people/businesses also converge by natural key.
- */
-declare function projectSharedRecord(deps: ProjectionDeps, shared: SharedPerson | SharedBusiness | SharedRecord, options?: {
-    sourceId?: string;
-    sourceUrl?: string;
-}): Promise<{
-    recordId: string;
-}>;
 /** An arriving applicant, as far as the CRM projection cares. `extra` carries the
  *  site-configured `crmFields` (values from the application), merged on top of the
  *  built-in identity/contact set. */
 interface Applicant {
     applicationId: string;
+    tierId?: string;
     email: string;
     firstName?: string;
     lastName?: string;
@@ -2424,13 +2990,36 @@ declare function projectApplicant(deps: ProjectionDeps, applicant: Applicant): P
     recordId: string;
 }>;
 
+/** Map a shared prospect to a crm `person` input (only the fields the default
+ *  person type accepts). Name falls back to first+last, then the email. */
+declare function sharedPersonInput(person: SharedPerson): Record<string, unknown>;
+/** Backward-compatible display tag retained while structured origin rows are
+ * the durable leader-id → local-record mapping. */
+declare function networkSourceTag(type: string, hubRecordId: string, sourceId?: string): string;
+/** Normalize the backwards-compatible person/business shapes into the versioned
+ * generic record envelope the receiver writes. */
+declare function normalizeSharedRecord(record: SharedPerson | SharedBusiness | SharedRecord, fallbackSourceId?: string): NormalizedSharedRecord;
+/** Build the allowlisted payload sent from one leader CRM record to a target.
+ * A target with an explicit `fields` map only accepts the types it lists. */
+declare function sharedRecordFromCrm(crm: Crm, record: CrmRecord, target: ResolvedNetworkTarget, sourceId?: string): SharedRecord;
+/**
+ * Upsert a leader-shared CRM record into this follower. Accepts the original
+ * person wire shape plus the versioned generic shape. Re-shares resolve through
+ * a durable provenance tag; people/businesses also converge by natural key.
+ */
+declare function projectSharedRecord(deps: ProjectionDeps, shared: SharedPerson | SharedBusiness | SharedRecord, options?: {
+    sourceId?: string;
+    sourceUrl?: string;
+}): Promise<{
+    recordId: string;
+}>;
+
 /** The crm `person` input for one application row: the built-in identity/contact
  *  fields plus each configured `crmFields` value present on the row. */
 declare function personInputFromApp(chapter: Chapter, app: Record<string, unknown>): Record<string, unknown>;
-/** Upsert the person record for one application (or a synthetic `{ email,
- *  firstName }` account row) and mirror its stage, billing snapshot, and Clerk
- *  identity. `stage` is the `applications.status` to mirror — omit for
- *  account-only rows not in the pipeline. Throws on failure (the backfill route
+/** Upsert the person record for one application and mirror its stage, billing
+ *  snapshot, and Clerk identity. Account-only identities must use
+ *  syncAccountToCrm. Throws on failure (the backfill route
  *  counts; the operational call sites wrap in `.catch`). */
 declare function syncApplicationToCrm(deps: ProjectionDeps & {
     chapter: Chapter;
@@ -2439,8 +3028,8 @@ declare function syncApplicationToCrm(deps: ProjectionDeps & {
     stage?: string;
 }): Promise<string | null>;
 /** Backfill / repair: project every application (newest per person) and every
- *  account-only `$users` row into the CRM. Idempotent (safe to re-run). Dev
- *  volumes fit one 1000-row page. Returns `{ synced, errors }`. */
+ *  `$users` row into the CRM without giving accounts an application or stage.
+ *  Pages are bounded; callers receive errors rather than a false success. */
 declare function backfillCrm(deps: ProjectionDeps & {
     chapter: Chapter;
 }): Promise<{
@@ -2490,16 +3079,15 @@ type StripeResult = StripeRequestResult<Record<string, unknown>>;
  *  of each re-deriving the auth + encoding. */
 declare function stripeCall(sk: string, method: "GET" | "POST" | "DELETE", path: string, params?: Record<string, unknown>, idempotencyKey?: string): Promise<StripeResult>;
 
-/** The outcome of a Clerk provisioning call. `existed` marks the heal case: Clerk
- *  rejected it because the account/invitation is already there, which is the end
- *  state we wanted anyway. */
+/** The outcome of provisioning. An existing identifier is a conflict unless
+ * the account proves it belongs to the original application being retried. */
 interface ClerkResult {
     ok: boolean;
     status: number;
     /** Stable Clerk user id returned by a successful fresh account create. */
     userId?: string;
     existed?: boolean;
-    /** Set when an `existed` heal also refreshed the account's metadata. */
+    /** Legacy result field; signup never refreshes an existing account. */
     refreshed?: boolean;
 }
 /** Inputs for a Clerk invitation. */
@@ -2518,9 +3106,8 @@ declare function clerkInviteRequest(input: ClerkInviteInput): {
     path: string;
     body: Record<string, unknown>;
 };
-/** POST the invitation to the Clerk Backend API. A repeat invite for an
- *  already-invited email heals to `{ ok: true, existed: true }` rather than
- *  reporting a failure the caller would have to special-case. */
+/** POST a new invitation. Existing identifiers and all validation failures are
+ * rejected; invitations never authorize changes to an existing account. */
 declare function createClerkInvitation(secretKey: string, input: ClerkInviteInput, fetchImpl?: typeof fetch): Promise<ClerkResult>;
 /** Inputs for a server-side Clerk user create. */
 interface ClerkUserInput {
@@ -2531,9 +3118,8 @@ interface ClerkUserInput {
     publicMetadata?: Record<string, unknown>;
     /** Backend-only account signals and profile data. */
     privateMetadata?: Record<string, unknown>;
-    /** Optional metadata merge used only when create returns 422 for an existing
-     * account. This lets migrations remove legacy keys without putting tombstone
-     * values on a newly-created user. Defaults to the create metadata. */
+    /** @deprecated Ignored. Use an explicitly authorized metadata update for repairs;
+     * signup must never modify an account found by email. */
     repairMetadata?: ClerkMetadataInput;
 }
 /** Build the Clerk Backend API user-create request. The account is created
@@ -2555,19 +3141,21 @@ declare function updateClerkUserMetadata(secretKey: string, userId: string, inpu
 /** Look a Clerk account up by email and merge its metadata.
  *
  * Returns `false` when no matching user can be resolved or Clerk rejects the
- * lookup or update. Chapter uses this for create-healing and invitation
- * adoption so a repeated application repairs the private account snapshot.
+ * lookup or update. This is an explicit administrative repair primitive;
+ * never call it from public signup or use email knowledge as authorization.
  */
 declare function updateClerkUserMetadataByEmail(secretKey: string, email: string, input: ClerkMetadataInput, fetchImpl?: typeof fetch): Promise<boolean>;
-/** Create the applicant's Clerk account server-side. A repeat for an email that
- *  already has an account heals to `{ ok: true, existed: true }` — the account
- *  exists, which is the state apply-time provisioning wanted — and refreshes
- *  supplied public/private metadata on the existing account so a re-application
- *  repairs a previously missed create (`refreshed: true`). */
+/** Create a new passwordless account. A provider collision never patches the
+ * existing account. A retry may return its id only when backend-private metadata
+ * already names the same original application, preserving all current claims. */
 declare function createClerkUser(secretKey: string, input: ClerkUserInput, fetchImpl?: typeof fetch): Promise<ClerkResult>;
 
+/** Backend metadata field selected for all role reads and writes. */
+type ClerkRoleMetadata = "public" | "private";
+/** Resolve one source for authorization, roster, guards and lifecycle writers. */
+declare function clerkRoleMetadata(auth: ResolvedAuth): ClerkRoleMetadata;
 /** A Clerk user as chapter's role layer sees it. `role` defaults to the lowest
- *  rung when `public_metadata` carries none. Raw public/private metadata is
+ *  rung when the selected metadata source carries none. Raw public/private metadata is
  *  returned only from this backend helper; `profile` and `applicationId` are the
  *  normalized Chapter-owned private signals. */
 interface ClerkUserRecord {
@@ -2582,20 +3170,57 @@ interface ClerkUserRecord {
 /** Look a Clerk user up by email. `null` when no such user — or when the lookup
  *  fails (a role gate treats an unresolvable user as absent, matching the site's
  *  own fallback). Role defaults to provisional when unset. */
-declare function clerkGetUserByEmail(secretKey: string, email: string, fetchImpl?: typeof fetch): Promise<ClerkUserRecord | null>;
+declare function clerkGetUserByEmail(secretKey: string, email: string, fetchImpl?: typeof fetch, source?: ClerkRoleMetadata): Promise<ClerkUserRecord | null>;
 /** Fetch a Clerk user by id, for role-change gating. `null` when missing or on a
  *  failed lookup. Role defaults to provisional when unset. */
-declare function clerkGetUser(secretKey: string, id: string, fetchImpl?: typeof fetch): Promise<ClerkUserRecord | null>;
+declare function clerkGetUser(secretKey: string, id: string, fetchImpl?: typeof fetch, source?: ClerkRoleMetadata): Promise<ClerkUserRecord | null>;
 /** List ALL Clerk users with their roles, auto-paginating. A membership community
  *  outgrows one page, and a fixed `limit=100` would silently drop members from the
  *  admin roster with no error — so this pages (offset in steps of {@link PAGE})
  *  until a short page. A page fetch that fails THROWS rather than returning a
  *  partial list, so the caller never mistakes a truncated roster for the whole. */
-declare function clerkListUsers(secretKey: string, fetchImpl?: typeof fetch): Promise<ClerkUserRecord[]>;
-/** Write a user's role: a MERGE-PATCH of only `{ role }` on `public_metadata`.
- *  The backend-only profile lives in `private_metadata`, so the two signals
- *  cannot overwrite each other. Returns whether the role write stuck. */
-declare function clerkSetRole(secretKey: string, id: string, role: string, fetchImpl?: typeof fetch): Promise<boolean>;
+declare function clerkListUsers(secretKey: string, fetchImpl?: typeof fetch, source?: ClerkRoleMetadata): Promise<ClerkUserRecord[]>;
+/** Merge only the selected role key. Private mode removes the legacy public role
+ * atomically while preserving profiles/foreign keys. No private-to-public fallback. */
+declare function clerkSetRole(secretKey: string, id: string, role: string, fetchImpl?: typeof fetch, source?: ClerkRoleMetadata): Promise<boolean>;
+
+/** Operator-supplied evidence for EVERY active runtime sharing this Clerk instance.
+ * Resolve the expected inventory from odla, not from only the current checkout.
+ * Readiness means the private-role build is staged and old role writers paused. */
+interface PrivateRoleRuntimeProof {
+    runtime: string;
+    version: string;
+    privateRoleReady: boolean;
+    roleWritesPaused: boolean;
+}
+/** Fresh operator-reviewed inventory for a dev-only migration dry run.
+ * This evidence is not write authority and the planner performs no provider I/O. */
+interface PrivateRoleMigrationInput {
+    environment: string;
+    expectedRuntimes: readonly string[];
+    runtimes: readonly PrivateRoleRuntimeProof[];
+    /** Existing active protected odla grants, resolved by exact Clerk subject.
+     * Never derive this set from public/private Clerk metadata or legacy tables. */
+    protectedSuperAdminUserIds: readonly string[];
+    users: readonly ClerkUserRecord[];
+    ladder: readonly string[];
+}
+/** Dry-run only: does not change Clerk, odla roles, runtime configuration or keys.
+ * Conflicting sources require review. A successful plan is NOT an atomic lock;
+ * keep all writers paused and re-read the exact role fields before each write.
+ * Resume requires a new plan; never replay a stale snapshot over newer roles. */
+declare function planPrivateRoleMigration(input: PrivateRoleMigrationInput): {
+    ready: boolean;
+    blockers: string[];
+    changes: {
+        userId: string;
+        role: string;
+        publicRole: unknown;
+        privateRole: unknown;
+    }[];
+    alreadyCurrent: number;
+    totalUsers: number;
+};
 
 /** Which auth mode a secret is required for: `"client"` (publishable key only) or
  *  `"full"` (server-side profile/role reads + writes, needing the vault secret). */
@@ -2672,7 +3297,7 @@ interface IntegrationDescriptor {
  * the one public `setting` (the `pk_*` publishable key, served to the SPA), the
  * `secrets` auth mode `"full"` needs in the tenant vault, BOTH sync directions —
  * the inbound `$users` webhook mirror (`provider->odla`) and the outbound
- * public role/private profile write via `clerk_secret_key` (`odla->provider`,
+ * selected private-role (or legacy public-role) / private-profile write via `clerk_secret_key` (`odla->provider`,
  * chapter's `clerk.ts`) — and the `provision` split. Data only; it performs
  * none of it.
  */
@@ -2942,9 +3567,10 @@ type TierGroupRow = TierGroup & {
 };
 /**
  * Every tier a group offers, ordered, including the implicit tier synthesized
- * for a chapter that predates tiers. Never throws on a missing namespace: a
- * deployment whose schema has not been pushed yet reads as "no rows", which
- * resolves to the legacy single tier.
+ * for a chapter with a successfully read empty tier collection. Unavailable,
+ * malformed, or unprovisioned storage fails closed; it must never turn an
+ * outage into an implicit free or legacy-price membership. Retiring all stored
+ * tiers leaves no offers rather than reviving the legacy group price.
  */
 declare function loadTiers(db: ChapterDb, group: TierGroupRow): Promise<ChapterTier[]>;
 /** The tiers a join page may show: active, and joinable as configured. */
@@ -3053,6 +3679,8 @@ interface SignupControlPolicy {
     trustCopy?: string;
     commitmentText?: string;
     normsText?: string;
+    /** Price-specific refund/trust copy, keyed by an explicitly declared tier. */
+    tierPolicies?: Readonly<Record<string, TierPaymentPolicy>>;
 }
 /** Bounded semantic design tokens delegated to the chapter signup surface. */
 interface SignupControlTheme {
@@ -3084,6 +3712,14 @@ interface SignupControlDocument {
 interface SignupControlEnvelope {
     digest: string;
     document: SignupControlDocument;
+    /** Signed transport identity, deliberately excluded from the shared document digest. */
+    deliveryTarget?: SignupControlRuntimeTarget;
+}
+/** Exact deployment receiving a shared data-environment revision. */
+interface SignupControlRuntimeTarget {
+    appId: string;
+    environment: string;
+    runtime: string;
 }
 /** Exact follower acknowledgement for one accepted or replayed revision. */
 interface SignupControlReceipt {
@@ -3091,6 +3727,8 @@ interface SignupControlReceipt {
     target: {
         chapterId: string;
         environment: string;
+        appId?: string;
+        runtime?: string;
     };
     revision: number;
     digest: string;
@@ -3098,7 +3736,7 @@ interface SignupControlReceipt {
     acknowledgedAt: number;
 }
 /** Stable reason codes returned when a follower refuses desired state. */
-type SignupControlRejection = "invalid_document" | "invalid_digest" | "wrong_source" | "wrong_target" | "wrong_environment" | "wrong_stripe_mode" | "stale_revision" | "conflicting_revision" | "materialization_failed";
+type SignupControlRejection = "invalid_document" | "invalid_digest" | "wrong_source" | "wrong_target" | "wrong_environment" | "wrong_runtime" | "wrong_stripe_mode" | "stale_revision" | "conflicting_revision" | "materialization_failed";
 /** Normalized document result returned by the package validator. */
 type SignupControlValidation = {
     ok: true;
@@ -3218,8 +3856,18 @@ interface ChapterPromotionInput {
 /** Export the provider-independent pieces of one exact active signup revision. */
 declare function exportChapterPromotion(input: ChapterPromotionInput): Promise<PromotionAdapterResult>;
 
-/** Storage boundary for a member-system field. */
+/** Logical aggregate boundary, not a requirement for a separate database/app. */
 type MemberSystemScope = "network" | "chapter" | "provider";
+/** Business ownership is independent of the reusable command implementation.
+ * Network records live in BNF's existing odla database. Protected platform roles
+ * are not business records and remain writable only by odla administration.
+ */
+declare const MEMBER_SYSTEM_RECORD_OWNERS: {
+    readonly network: "built-not-found";
+    readonly chapter: "owning-chapter";
+    readonly provider: "originating-provider";
+    readonly protectedRoles: "odla-platform";
+};
 /** Durable authority allowed to write a member-system field. */
 type MemberSystemWriter = "network_person" | "chapter_journey" | "network_membership" | "network_entitlement" | "network_seat" | "network_discount_policy" | "network_referral_ledger" | "network_investment_ledger" | "network_commercial_projection" | "clerk" | "stripe";
 /** Read model that may receive an allowlisted field. */
@@ -3237,7 +3885,9 @@ interface MemberFieldAuthority {
     sensitivity: MemberFieldSensitivity;
     memberAccess: MemberFieldSelfAccess;
 }
-/** Each field has one durable writer. BNF is an operator projection, never a writer. */
+/** Each field has one aggregate command writer. BNF owns network aggregates and
+ * hosts their server commands; bnf_admin names a read projection, not a credential.
+ */
 declare const MEMBER_SYSTEM_AUTHORITY_MATRIX: readonly MemberFieldAuthority[];
 /** Fields a member may change through self-service. */
 declare const MEMBER_SELF_EDITABLE_FIELDS: Set<string>;
@@ -3254,7 +3904,11 @@ interface MemberSystemWriteIntent {
 }
 /** Result of checking a proposed mutation against surface, writer, and revision rules. */
 type MemberSystemWriteDisposition = "apply" | "reject_bnf_surface" | "reject_unknown_field" | "reject_wrong_writer" | "reject_stale_revision";
-/** Reject BNF, wrong-writer, unknown-field, and stale-revision mutations. */
+/** Validate an aggregate command, not a user's authorization. A bare BNF surface
+ * label is still insufficient: its backend must select the field's specific
+ * writer after authenticating and authorizing the caller. This helper cannot
+ * constrain an unrestricted database credential or grant protected platform roles.
+ */
 declare function classifyMemberSystemWrite(intent: MemberSystemWriteIntent): MemberSystemWriteDisposition;
 /** Result of validating an authority matrix. */
 interface MemberAuthorityValidation {
@@ -3279,10 +3933,12 @@ type JourneyEnding = typeof JOURNEY_ENDINGS[number];
 declare const REQUIRED_NOTICE_KINDS: readonly ["payment_receipt", "refund_confirmation", "security_alert", "legal_notice", "membership_status", "renewal_notice", "cancellation_confirmation"];
 /** A typed required notice allowed despite discretionary contact suppression. */
 type RequiredNoticeKind = typeof REQUIRED_NOTICE_KINDS[number];
-/** Availability inputs that distinguish the BNF UI from the odla data plane. */
+/** Availability inputs distinguish BNF's browser UI, authority backend and odla. */
 interface MemberSystemAvailabilityInput {
     odlaReachable: boolean;
     bnfFrontendReachable: boolean;
+    /** Explicit backend health is required; unknown is not evidence of readiness. */
+    bnfBackendReachable: boolean;
 }
 /** Capabilities allowed at the current BNF and odla availability state. */
 interface MemberSystemAvailability {
@@ -3292,9 +3948,9 @@ interface MemberSystemAvailability {
     newApplication: boolean;
     newCheckout: boolean;
     providerRenewalsMayContinue: true;
-    reason?: "odla_unavailable" | "bnf_frontend_unavailable";
+    reason?: "odla_unavailable" | "bnf_backend_unavailable" | "bnf_frontend_unavailable";
 }
-/** BNF is optional for chapter execution; odla is not. */
+/** Only BNF's frontend is optional for dependent chapter execution. */
 declare function memberSystemAvailability(input: MemberSystemAvailabilityInput): MemberSystemAvailability;
 /** Partition metadata supplied by a verified Stripe event. */
 interface MemberStripeIdentity {
@@ -3406,4 +4062,33 @@ declare const SILVER_SALT_P0_FIXTURE: {
     };
 };
 
-export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRecordSort, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, backfillCrm, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipPageDocument, membershipTierPresentationFromMarkdown, networkCommercialSourceKey, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, reconcileCommercialParitySnapshot, reconcileMeetings, reconcileStripeSnapshot, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, webhookMutationId };
+/** Separate authoritative collections inside the network owner's EXISTING database.
+ * Legacy networkMembership/networkEntitlement/networkSeat remain shadow/rollback
+ * data. This mapping never migrates, copies, or promotes their contents.
+ */
+declare const MEMBERSHIP_AUTHORITY_COLLECTIONS: {
+    readonly networkMembership: "membershipRecord";
+    readonly networkEntitlement: "membershipEntitlement";
+    readonly networkSeat: "membershipSeat";
+};
+/** Additive, deny-all descriptor. Compose once in BNF alongside its existing
+ * policy and commercial integrations, never in each chapter. No activation seeds:
+ * a reviewed authority-state command must explicitly enable a chapter afterward.
+ */
+declare function createMembershipAuthorityIntegration(): {
+    id: string;
+    title: string;
+    npm: string;
+    schema: {
+        entities: {
+            [k: string]: Entity;
+        };
+        links: {};
+    };
+    rules: {
+        [k: string]: Rule;
+    };
+    seeds: never[];
+};
+
+export { ADMISSION_GRANTS_PATH, ADMISSION_GRANTS_SCHEMA_VERSION, type AccountModel, type AdminNotificationTrigger, type AdmissionDecision, type AdmissionGrantDocument, type AdmissionGrantEnvelope, type AdmissionGrantInput, type AdmissionGrantReceipt, type AdmissionGrantRejection, type AdmissionGrantRevisionRow, type AdmissionGrantRow, type AdmissionGrantValidation, type Applicant, type ApplicationBookingPatch, type ApplicationRecord, type ApplicationSummary, type Attr, type AttrType, BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_CONTROL_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH, BUILDER_LIBRARY_SCHEMA_VERSION, type BuilderLibraryBrandAssetRef, type BuilderLibraryDocument, type BuilderLibraryEnvelope, type BuilderLibraryManifest, type BuilderLibraryPromotionProvenance, type BuilderLibraryReceipt, type BuilderLibraryResource, type BuilderLibraryResourceKind, type BuilderLibraryResourceProvenance, type BuilderLibraryResourceStatus, type BuilderLibraryScope, type BuilderLibrarySource, type BuilderLibrarySourceType, type BuilderLibraryTarget, type BuilderLibraryValidationOptions, type BuilderLibraryValidationResult, type BuilderLibraryViewer, type BuyerGiftClaim, CHAPTER_FLOW_FIELDS_SCHEMA_VERSION, CHAPTER_PROMOTION_ADAPTER, type Chapter, type ChapterApplication, type ChapterAuth, type ChapterBrand, type ChapterBuilderLibrary, type ChapterCommercialParityRecord, type ChapterCommercialParitySnapshot, type ChapterConfig, type ChapterCopy, type ChapterCopyInput, type ChapterDb, type ChapterEmailIdentity, type ChapterEmails, type ChapterFieldFlow, type ChapterFlowField, type ChapterFlowFieldContract, type ChapterIntegrationDescriptor, type ChapterIntegrationOptions, type ChapterMemberContent, type ChapterMode, type ChapterNetwork, type ChapterNetworkReader, type ChapterNetworkTarget, type ChapterOperations, type ChapterPipeline, type ChapterPolicy, type ChapterPrices, type ChapterPromotionInput, type ChapterRunbookHints, type ChapterScheduling, type ChapterSends, type ChapterSignupControl, type ChapterTier, type ChapterTierConfig, type ClerkInviteInput, type ClerkMetadataInput, type ClerkResult, type ClerkRoleMetadata, type ClerkUserInput, type ClerkUserRecord, type CommercialIdentity, type CommercialObjectKind, type CommercialParityException, type CommercialParityExceptionKind, type CommercialParityPartition, type CommercialParityResult, type CompiledChapterBrandTokens, type ConfirmMembershipPaymentInput, DEFAULT_CHAPTER_COPY, DEFAULT_SHARE_FIELDS, type DashboardMetricData, type DashboardMetricSeries, type DbOp, type DbRules, type DbSchema, type DeliveryDecision, type EffectiveMemberContent, type EffectiveMemberContentPage, type EmailGroup, type EmailTemplate, type EmailTemplateRow, type Entity, type ExistingMeeting, GIFT_OFFER_CATALOG_VERSION, type GiftOffer, type GiftOfferCatalog, type GiftOfferTarget, type GiftOfferValidation, type GuardResult, type IntegrationDescriptor, type IntegrationProvision, type IntegrationSecret, type IntegrationSetting, type IntegrationSync, type IssuedMembershipOffer, JOURNEY_ENDINGS, JOURNEY_STAGES, type JoinConfigGroup, type JoinConfigTier, type JoinContinuation, type JourneyEnding, type JourneyStage, type LeaderCrmOptions, type LeaderFormationConfig, type LifecycleDeliveryResolution, type LiveEvent, MAX_GIFT_OFFERS, MEMBERSHIP_AUTHORITY_COLLECTIONS, MEMBERSHIP_AUTHORITY_PATH, MEMBERSHIP_PAGE_RENDERER, MEMBER_CONTENT_CONTROL_PATH, MEMBER_CONTENT_PATH, MEMBER_CONTENT_SCHEMA_VERSION, MEMBER_SELF_EDITABLE_FIELDS, MEMBER_SELF_READABLE_FIELDS, MEMBER_SYSTEM_AUTHORITY_MATRIX, MEMBER_SYSTEM_CONTRACT_VERSION, MEMBER_SYSTEM_RECORD_OWNERS, MEMBER_SYSTEM_RECOVERY_OBJECTIVES, type MailSender, type MeetingForReconcile, type MeetingRecord, type MeetingReschedulePatch, type MemberApplication, type MemberAuthorityValidation, type MemberContentDocument, type MemberContentEnvelope, type MemberContentPage, type MemberContentPageProjection, type MemberContentProjection, type MemberContentReceipt, type MemberContentRejection, type MemberContentSource, type MemberContentSourceType, type MemberContentTarget, type MemberContentTierAuthority, type MemberContentValidationOptions, type MemberContentValidationResult, type MemberContentViewer, type MemberFieldAuthority, type MemberFieldSelfAccess, type MemberFieldSensitivity, type MemberPageAudience, type MemberPageNavigation, type MemberPageUpsell, type MemberPageUpsellOffer, type MemberPageUpsellOverride, type MemberSession, type MemberStripeDisposition, type MemberStripeIdentity, type MemberStripeTarget, type MemberSystemAvailability, type MemberSystemAvailabilityInput, type MemberSystemEventReceiptInput, type MemberSystemEventReplayPlan, type MemberSystemMigrationPlan, type MemberSystemMigrationRow, type MemberSystemProjection, type MemberSystemRecoveryObjectives, type MemberSystemRollbackPlan, type MemberSystemScope, type MemberSystemWriteDisposition, type MemberSystemWriteIntent, type MemberSystemWriter, type MembershipAccessReceipt, type MembershipAuthorityHandlerOptions, type MembershipAuthorityPeer, type MembershipChapterEffect, type MembershipChapterEffectData, type MembershipCheckoutBinding, type MembershipCheckoutBindingInput, type MembershipCommercialOffer, type MembershipDiscountPolicyVersion, type MembershipEffectScope, type MembershipOfferIssuer, type MembershipOfferRequest, type MembershipOfferingVersion, type MembershipPageDocument, type MembershipPageValidationOptions, type MembershipPageValidationResult, type MembershipPaymentReceipt, type MembershipQuoteTarget, type MembershipRefundReceipt, type MembershipRenewalReceipt, type MembershipTierAuthority, type MembershipTierCallout, type MembershipTierCapacity, type MembershipTierMarkdownResult, type MembershipTierPresentation, type MembershipTierVariant, type NamedSeatCheckoutReceipt, type NamedSeatCheckoutRequest, type NamedSeatEvidenceRequest, type NamedSeatInvitation, type NamedSeatInvitationRequest, type NamedSeatOffer, type NamedSeatRecipientReceipt, type NamedSeatRefundReceipt, type NetworkCommercialException, type NetworkCommercialFact, type NetworkCommercialProjectedRow, type NetworkCommercialProjection, type NetworkEditableField, type NetworkRecord, type NetworkRecordEdit, type NetworkRecordMutation, type NetworkRecordMutationResult, type NetworkRecordNote, type NetworkRecordPage, type NetworkRecordSort, type NetworkRollup, type NetworkRollupTarget, type NetworkSharedNote, type NetworkSnapshot, type NetworkStageTransition, type NetworkTargetTransportStatus, type NewMeetingRow, type NotifyDeps, type NotifyInput, type NotifyResult, type PaymentsGroup, type PrivateRoleMigrationInput, type PrivateRoleRuntimeProof, type ProjectionDeps, type PublicGiftOffer, REQUIRED_NOTICE_KINDS, type ReconcileDecision, type RequestMembershipOfferOptions, type RequiredNoticeKind, type ResolvedApplication, type ResolvedAuth, type ResolvedBuilderLibrary, type ResolvedLeaderFormation, type ResolvedMemberContent, type ResolvedMemberPageUpsell, type ResolvedNetwork, type ResolvedNetworkReader, type ResolvedNetworkTarget, type ResolvedOperations, type ResolvedPipeline, type ResolvedScheduling, type ResolvedSends, type ResolvedSignupControl, type RoleChangeContext, type Rule, SCHEDULING_DEFAULTS, SIGNUP_CONTROL_PATH, SIGNUP_CONTROL_SCHEMA_VERSION, SIGNUP_CONTROL_THEME_MARKER, SIGNUP_CONTROL_THEME_STYLE_ID, SILVER_SALT_P0_FIXTURE, type SchedulingErrors, type SecretMode, type SecretStore, type SessionUser, type SharedBusiness, type SharedPerson, type SharedRecord, type SharedRecordV1, type SharedRecordV2, type SignupControlApplication, type SignupControlDocument, type SignupControlEnvelope, type SignupControlPolicy, type SignupControlReceipt, type SignupControlRejection, type SignupControlRuntimeTarget, type SignupControlTheme, type SignupControlThemeHead, type SignupControlThemeMetadata, type SignupControlThemeOptions, type SignupControlThemeRevision, type SignupControlThemeStyleTarget, type SignupControlTier, type SignupControlValidation, type StripeEvent, type StripeResult, type SubmitResult, type TierGroup, type TierGroupRow, type WebhookEvent, addMembershipCalendarMonths, applicantProfile, applicationBookingUpdate, applicationFlowFields, applicationSummary, applyMembershipTierMarkdown, approveNetworkMembership, backfillCrm, bindMembershipCheckout, bookingDecision, brandTokens, bucketSeries, buildBuilderLibraryManifest, buildChapterCommercialParitySnapshot, buildGroupSeed, buildTierSeeds, builderLibraryDigest, canApprove, canBook, canChangeRole, canTransition, canViewBuilderLibraryResource, canceledPatch, canonicalBuilderLibrary, canonicalMemberContent, canonicalSignupControl, chapterBrandFromTokens, chapterDb, chapterFlowFieldContract, clampArray, classifyMemberStripeEvent, classifyMemberSystemWrite, clerkGetUser, clerkGetUserByEmail, clerkIntegration, clerkInviteRequest, clerkListUsers, clerkRoleMetadata, clerkSetRole, clerkUserRequest, commercialParityDigest, composeMemberContent, confirmMembershipPayment, createAdmissionGrantEnvelope, createBuilderLibraryEnvelope, createChapterIntegration, createClerkInvitation, createClerkUser, createMemberContentEnvelope, createMembershipAuthorityHandler, createMembershipAuthorityIntegration, createMembershipCommercialOffer, createSignupControlEnvelope, dashboardMetricData, defaultCrm, defineChapter, drainMembershipEffects, emailGroupFrom, endForSlot, exportChapterPromotion, findAdmissionGrant, findApplicationRef, findGiftOffer, findTier, firstPaymentPatch, formatChapterCopy, formationFields, formationFlowFields, getVaultSecret, giftOfferActive, hasDisclaimerAck, hydrateSignupControlTheme, injectSignupControlThemeHead, introIdempotencyKey, isAdminRole, isAlreadySent, isReconcilable, isSlotAvailable, isValidEmail, issueMembershipCommercialOffer, joinConfig, joinConfigTiers, leaderCrmConfig, listStripeObjects, loadLatestAdmissionRevision, loadOfferableTiers, loadTiers, materializeAdmissionGrants, meetingCreateRow, meetingRescheduleUpdate, memberApplication, memberContentDigest, memberContentDocument, memberSession, memberSystemAvailability, memberSystemRollbackPlan, membershipAuthorityEntities, membershipAuthorityRules, membershipCheckoutBindingId, membershipDiscountPolicyVersion, membershipOfferEntities, membershipOfferIdForRequest, membershipOfferRules, membershipOfferingVersion, membershipPageDocument, membershipTierPresentationFromMarkdown, namedSeatOfferDigest, networkCommercialSourceKey, networkMembershipId, networkSourceTag, normalizeAdmissionEmail, normalizeChapterEmail, normalizeNetworkCommercialStripeEvent, normalizeSharedRecord, normalizeWebhookEvent, offerableTiers, paymentsReady, personInputFromApp, planDelivery, planMemberSystemEventReplay, planMemberSystemMigration, planPrivateRoleMigration, projectApplicant, projectBuilderLibraryDelivery, projectMemberContent, projectMemberSelf, projectNetworkCommercialEvents, projectSharedRecord, promoteBuilderLibraryResource, publicGiftOffers, readMembershipAccess, readMembershipChapterEffect, readNamedSeatAccess, readNamedSeatInvitation, readNamedSeatOffer, reconcileCommercialParitySnapshot, reconcileLifecycleDelivery, reconcileMeetings, reconcileMembershipBilling, reconcileMembershipRenewal, reconcileStripeSnapshot, refundNetworkMembership, refundedPatch, render, renderSignupControlThemeHead, renderSummary, renderTemplateBody, renewalPatch, requestMembershipAccess, requestMembershipApproval, requestMembershipChapterEffect, requestMembershipCheckoutBinding, requestMembershipCommercialOffer, requestMembershipPayment, requestMembershipRefund, requestMembershipRenewal, requestNamedSeatAcceptance, requestNamedSeatAccess, requestNamedSeatApproval, requestNamedSeatCheckout, requestNamedSeatDecline, requestNamedSeatInvitation, requestNamedSeatOffer, requestNamedSeatPayment, requestNamedSeatRefund, requestNamedSeatReservation, resolveApplication, resolveAuth, resolveBuilderLibrary, resolveChapterCopy, resolveJoinContinuation, resolveLeaderFormation, resolveMemberContent, resolveNetworkCommercialReadModel, resolveNetworkPersonRegistry, resolvePipeline, resolveScheduling, resolveSignupControl, resolveTiers, roleFromClaim, sendTemplated, sharedPersonInput, sharedRecordFromCrm, signupControlDigest, slotWindow, stageIndex, stripeCall, subAnnualCents, submitApplication, subscriptionIdempotencyKey, syncApplicationToCrm, tierIsFree, tierPayable, updateClerkUserMetadata, updateClerkUserMetadataByEmail, validateAdmissionGrantDocument, validateBuilderLibraryDocument, validateGiftOfferCatalog, validateMemberContentDocument, validateMemberSystemAuthority, validateMembershipPageDocument, validateScheduling, validateSignupControlDocument, verifyIssuedMembershipOffer, verifyMembershipAccessReceipt, verifyMembershipCheckoutBinding, verifyMembershipPaymentReceipt, webhookMutationId };