@odla-ai/chapter 0.47.9 → 0.48.0

package/dist/worker/index.d.ts

@@ -84,6 +84,8 @@ interface ChapterSignupControl {
     sourceId: string;
     /** Follower-vault key holding the dedicated edge secret. */
     secretName?: string;
+    /** Optional per-runtime vault keys. When present, unlisted runtimes and legacy untargeted deliveries fail closed. */
+    runtimeSecrets?: Readonly<Record<string, string>>;
     /** Stripe mode this deployed environment accepts. */
     stripeMode: "test" | "live";
 }
@@ -91,6 +93,7 @@ interface ChapterSignupControl {
 interface ResolvedSignupControl {
     sourceId: string;
     secretName: string;
+    runtimeSecrets?: Readonly<Record<string, string>>;
     stripeMode: "test" | "live";
 }
 
@@ -266,6 +269,9 @@ interface ChapterNetworkReader {
  * receive pushed records. It must explicitly declare `readers` before any peer
  * can browse its CRM. */
 interface ChapterNetwork {
+    /** Require the protected super-admin tier for remote mutations and operational
+     * detail. Ordinary admins retain routine name/email directory reads. */
+    requireSuperAdminWrites?: boolean;
     targets?: readonly ChapterNetworkTarget[];
     readers?: readonly ChapterNetworkReader[];
 }
@@ -320,6 +326,7 @@ interface ResolvedNetworkReader {
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
+    requireSuperAdminWrites?: boolean;
     targets: readonly ResolvedNetworkTarget[];
     readers: readonly ResolvedNetworkReader[];
 }
@@ -514,7 +521,9 @@ interface ChapterScheduling {
 }
 /** How a signed-in user's role is determined.
  *
- * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
+ * - `"clerk"` reads backend-only private Clerk roles for each authorization
+ *   check, without trusting public metadata or stale session roles.
+ * - `"claim"` reads a role ladder from a JWT claim (the legacy member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
  *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
@@ -522,23 +531,25 @@ interface ChapterScheduling {
  *
  * Defaults: `"claim"` in `chapter` mode, `"table"` in `hub` mode. */
 interface ChapterAuth {
-    source?: "claim" | "table";
+    /** `clerk` reads backend-only private_metadata.role on each request, ignoring
+     * JWT/public roles. Select explicitly after the coordinated role migration. */
+    source?: "claim" | "table" | "clerk";
     /** JWT claim holding the role, for `source: "claim"`. Default `"role"`. */
     claim?: string;
-    /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
+    /** Role ladder low→high, for claim or private Clerk roles. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
     /** Enable the Studio-managed super-admin tier — the only tier that may
-     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
+     *  create/modify admins. Default: `true` for `"claim"`/`"clerk"`, `false` for `"table"`. */
     superAdmins?: boolean;
     /** Authority behind the super-admin tier. `"table"` preserves the legacy
-     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
-     * for backward compatibility. */
+     * app allowlist; `"odla"` reads protected `$users.role` by exact subject ID.
+     * Default `"odla"` for private Clerk mode, `"table"` for legacy modes. */
     superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
-    source: "claim" | "table";
+    source: "claim" | "table" | "clerk";
     claim: string;
     ladder: readonly string[];
     /** The highest ladder rung (last entry) — the "admin" gate. */
@@ -775,6 +786,292 @@ interface Chapter {
     groupSeed(): Record<string, unknown> | null;
 }
 
+/** Frozen commercial terms supplied by the issuing membership authority, never the browser. */
+interface SubscriptionBillingTerms {
+    /** Immutable offering version whose base Price is subscribed. */
+    offeringVersionId: string;
+    /** Immutable discount policy, independent of the base SKU and permanent cohort. */
+    discount?: {
+        policyVersionId: string;
+        couponId: string;
+        percentOffBps: number;
+        duration: "once" | "forever";
+    };
+    /** Extended initial paid service end, epoch milliseconds. Renewal starts here. */
+    initialTermEndsAt?: number;
+}
+
+/** Per-tier policy overrides prevent a chapter-wide price claim leaking into another SKU. */
+interface TierPaymentPolicy {
+    refundPolicyText: string;
+    trustCopy?: string;
+}
+
+/** Immutable commercial policy, separate from the recurring base SKU. */
+interface MembershipOfferingVersion {
+    id: string;
+    chapterId: string;
+    baseSkuId: string;
+    version: number;
+    status: "draft" | "published" | "retired";
+    effectiveFrom: number;
+    effectiveUntil?: number;
+    basePriceCents: number;
+    currency: string;
+    interval: "month" | "year";
+    term: {
+        kind: "fixed_end";
+        endsAt: number;
+    } | {
+        kind: "rolling_months";
+        months: number;
+    };
+    autoRenew: true;
+    paymentGraceDays: number;
+    seatPriceCents: number;
+    seatPurchaseWindowCalendarMonths: number;
+    requiredDisclosures: string[];
+}
+/** Cohort qualification survives the expiration of its monetary benefit. */
+interface MembershipDiscountPolicyVersion {
+    id: string;
+    chapterId: string;
+    version: number;
+    status: "draft" | "published" | "retired";
+    cohortLabel: string;
+    cohortEligibleSkuIds: string[];
+    discountEligibleSkuIds: string[];
+    softTarget: number;
+    percentOffBps: number;
+    qualifyingStartsAt: number;
+    qualifyingEndsAt: number;
+    benefitDuration: {
+        kind: "first_term" | "while_active";
+    } | {
+        kind: "fixed_end";
+        endsAt: number;
+    };
+}
+
+/** Money and service promise frozen at offer issuance, not recomputed from later policy edits. */
+interface MembershipCommercialOffer {
+    offering: MembershipOfferingVersion;
+    discountPolicy: MembershipDiscountPolicyVersion | null;
+    issuedAt: number;
+    founding: boolean;
+    dueTodayCents: number;
+    /** Fixed service end only; rolling service starts at the provider-confirmed payment. */
+    initialTermEndsAt?: number;
+    renewalCents: number;
+    billingTerms: SubscriptionBillingTerms;
+}
+
+/** Durable pre-payment promise. The opaque digest is what the member acknowledges. */
+interface IssuedMembershipOffer {
+    id: string;
+    applicationId: string;
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    skuId: string;
+    issuedAt: number;
+    expiresAt: number;
+    digest: string;
+    contract: MembershipCommercialOffer;
+}
+
+/** Server-owned source identity; the browser never supplies an offer or its price. */
+interface MembershipQuoteTarget {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    applicationId: string;
+    skuId: string;
+}
+/** Host transport adapter; may call the signed edge or an in-process network command. */
+type MembershipOfferIssuer = (input: MembershipQuoteTarget & {
+    requestId: string;
+}) => Promise<IssuedMembershipOffer>;
+
+/** A consented offer, bound once to the follower's immutable provider Price and quote. */
+interface MembershipCheckoutBindingInput extends MembershipQuoteTarget {
+    offerId: string;
+    offerDigest: string;
+    quoteDigest: string;
+    priceId: string;
+}
+/** Content-free authority receipt. It does not mean paid, approved, or entitled. */
+interface MembershipCheckoutBinding extends MembershipCheckoutBindingInput {
+    id: string;
+    boundAt: number;
+}
+
+/** References only. Money facts must already exist in the verified network Stripe event log. */
+interface ConfirmMembershipPaymentInput extends MembershipQuoteTarget {
+    eventId: string;
+    providerSubscriptionId: string;
+    providerCustomerId: string;
+}
+/** The network identity remains source-linked until an explicit canonical Person link exists. */
+interface MembershipPaymentReceipt {
+    membershipId: string;
+    status: string;
+    initialTermStartedAt: number;
+    initialTermEndsAt: number;
+    cohort: string;
+    memberNumber?: number;
+}
+
+/** Session identity attested by the signed chapter adapter, never a browser's email_verified flag. */
+interface NamedSeatRecipientInput extends MembershipQuoteTarget {
+    seatId: string;
+    recipientApplicationId: string;
+    recipientUserId: string;
+    verifiedRecipientEmail: string;
+}
+
+/** Verified full initial refund and subscription cancellation, not a browser assertion. */
+interface MembershipRefundReceipt {
+    membershipId: string;
+    status: "refunded";
+    refundedCents: number;
+    subscriptionCanceled: true;
+}
+
+/** Current authoritative billing state; a chapter projection must not derive it from arrival order. */
+interface MembershipRenewalReceipt {
+    membershipId: string;
+    status: string;
+    termEndsAt: number;
+    graceEndsAt: number;
+    autoRenew: boolean;
+}
+
+/** Short-lived decision from current network state; never a durable bearer capability. */
+interface MembershipAccessReceipt {
+    membershipId: string;
+    allowed: boolean;
+    status: string;
+    accessEndsAt: number;
+    revision: number;
+}
+
+/** Named-seat offer for the authenticated purchaser, not a transferable gift or arbitrary quantity. */
+interface NamedSeatOffer {
+    membershipId: string;
+    amountCents: number;
+    currency: string;
+    interval: "year" | "month";
+    termEndsAt: number;
+    purchaseEndsAt: number;
+    autoRenew: boolean;
+    eligible: boolean;
+    digest: string;
+    seat?: {
+        seatId: string;
+        status: string;
+        recipientName: string;
+        recipientEmail: string;
+    };
+}
+
+/** Identity attested by the recipient's chapter after checking Clerk's verified primary email. */
+interface NamedSeatInvitationRequest {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    seatId: string;
+    recipientUserId: string;
+    verifiedRecipientEmail: string;
+}
+/** Recipient-visible invitation; no purchaser contact information or provider credentials. */
+interface NamedSeatInvitation {
+    seatId: string;
+    primaryApplicationId: string;
+    skuId: string;
+    recipientName: string;
+    status: string;
+    acceptanceEndsAt: number;
+    termEndsAt: number;
+}
+
+/** Exact configured chapter/runtime serviced by one scheduled network worker. */
+type MembershipEffectScope = Pick<MembershipQuoteTarget, "appId" | "chapterId" | "environment" | "runtime">;
+/** Downstream requests carry only identifiers; the signed chapter receiver reads current state and deduplicates by effectId. */
+interface MembershipChapterEffect extends MembershipQuoteTarget {
+    effectId: string;
+    seatId: string;
+    kind: "invite_named_recipient" | "grant_named_recipient_access" | "revoke_named_recipient_access";
+}
+/** Recover provider effects and expired invitations from durable state, independently of browser/webhook retries.
+ * The optional chapter adapter must return a durable, idempotent receipt. An absent adapter leaves work visibly pending.
+ * Provider HTTP timeouts, ambiguous receipts and scope conflicts never become success or an unbounded automatic retry loop.
+ */
+declare function drainMembershipEffects(db: ChapterDb, options: {
+    scope: MembershipEffectScope;
+    stripeSecretKey: string;
+    limit?: number;
+    deliverChapterEffect?: (input: MembershipChapterEffect) => Promise<{
+        effectId: string;
+        complete: true;
+    }>;
+}, now: number): Promise<{
+    complete: number;
+    pending: number;
+    expired: number;
+    more: boolean;
+}>;
+
+/** Minimal chapter-owned delivery data, fetched over the authenticated runtime edge, never from a browser payload. */
+interface MembershipChapterEffectData extends MembershipChapterEffect {
+    recipientName: string;
+    recipientEmail: string;
+    recipientUserId: string | null;
+    recipientApplicationId: string | null;
+    acceptanceEndsAt: number;
+    termEndsAt: number;
+    applicable: boolean;
+}
+
+/** Only the named buyer's prepared payment details; no network credentials or canonical PII. */
+interface NamedSeatCheckoutReceipt {
+    seatId: string;
+    paymentIntentId: string;
+    clientSecret: string;
+    amountCents: number;
+    currency: string;
+    termEndsAt: number;
+    status: string;
+}
+/** Result of attesting one verified recipient's acceptance or completed Journey. */
+interface NamedSeatRecipientReceipt {
+    seatId: string;
+    status: string;
+    recipientApplicationId: string;
+}
+/** Full seat-only refund. The purchaser's primary subscription is not canceled. */
+interface NamedSeatRefundReceipt {
+    seatId: string;
+    status: "refunded";
+    refundedCents: number;
+    subscriptionCanceled: false;
+}
+/** Verified purchaser identity and their named recipient, with no caller-selected pricing. */
+type NamedSeatCheckoutRequest = MembershipQuoteTarget & {
+    recipientName: string;
+    recipientEmail: string;
+    purchaserEmail: string;
+    purchaserUserId: string;
+};
+/** Reference to an independent network Stripe fact, never caller-supplied payment amounts. */
+type NamedSeatEvidenceRequest = MembershipQuoteTarget & {
+    seatId: string;
+    eventId: string;
+};
+
 /** The Cloudflare SEND_EMAIL binding payload. */
 interface EmailPayload {
     from: string;
@@ -809,10 +1106,54 @@ interface ChapterEnv {
         }>;
     };
     EMAIL_FROM?: string;
+    /** Optional runtime-local inbox for non-production lifecycle mail. Ignored in prod. */
+    ODLA_DEBUG_EMAIL?: string;
+    /** Optional, allowlisted dev-only named-seat acceptance test transport. */
+    SEND_INVITATION_TEST?: ChapterEnv["SEND_EMAIL"];
+    ODLA_INVITATION_TEST_RECIPIENTS?: string;
+    ODLA_INVITATION_TEST_TO?: string;
+    ODLA_INVITATION_TEST_FROM?: string;
 }
 /** Options for `chapterWorker`. */
 interface ChapterWorkerOptions {
     chapter: Chapter;
+    /** Require the pre-consent quote digest on membership checkout. Enable with the current JoinIsland after upgrading older clients. */
+    requirePaymentQuote?: boolean;
+    /** Opt-in network authority adapter. All operations must use the same network
+     * scope. Never implement these by promoting chapter-local projections to authority. */
+    membershipAuthority?: {
+        issueOffer: (input: Parameters<MembershipOfferIssuer>[0], env: ChapterEnv) => ReturnType<MembershipOfferIssuer>;
+        bindCheckout: (input: MembershipCheckoutBindingInput, env: ChapterEnv) => Promise<MembershipCheckoutBinding>;
+        confirmPayment: (input: ConfirmMembershipPaymentInput, env: ChapterEnv) => Promise<MembershipPaymentReceipt>;
+        approveMembership: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipPaymentReceipt>;
+        refundMembership: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipRefundReceipt>;
+        reconcileRenewal: (input: MembershipQuoteTarget & {
+            eventId: string;
+        }, env: ChapterEnv) => Promise<MembershipRenewalReceipt>;
+        readAccess: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipAccessReceipt>;
+        namedSeats?: {
+            offer: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<NamedSeatOffer>;
+            invitation: (input: NamedSeatInvitationRequest, env: ChapterEnv) => Promise<NamedSeatInvitation>;
+            readAccess: (input: MembershipQuoteTarget & {
+                seatId: string;
+                recipientUserId: string;
+                recipientApplicationId: string;
+            }, env: ChapterEnv) => Promise<MembershipAccessReceipt>;
+            checkout: (input: NamedSeatCheckoutRequest, env: ChapterEnv) => Promise<NamedSeatCheckoutReceipt>;
+            reserve: (input: NamedSeatCheckoutRequest, env: ChapterEnv) => Promise<Pick<NamedSeatCheckoutReceipt, "seatId" | "amountCents" | "currency" | "termEndsAt">>;
+            confirmPayment: (input: NamedSeatEvidenceRequest, env: ChapterEnv) => Promise<{
+                seatId: string;
+                reconciled: true;
+            }>;
+            confirmRefund: (input: NamedSeatEvidenceRequest, env: ChapterEnv) => Promise<{
+                seatId: string;
+                reconciled: true;
+            }>;
+            accept: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRecipientReceipt>;
+            approve: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRecipientReceipt>;
+            decline: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRefundReceipt>;
+        };
+    };
     /** CRM mount point. Default "/api/crm". */
     crmBasePath?: string;
     /** Host routes, tried BEFORE the built-ins — so a wrapping site can add its own
@@ -845,11 +1186,45 @@ declare function createWorkerContext(options: ChapterWorkerOptions): {
     chapter: Chapter;
     auth: ResolvedAuth;
     crmBase: string;
+    requirePaymentQuote: boolean;
+    membershipAuthority: {
+        issueOffer: (input: Parameters<MembershipOfferIssuer>[0], env: ChapterEnv) => ReturnType<MembershipOfferIssuer>;
+        bindCheckout: (input: MembershipCheckoutBindingInput, env: ChapterEnv) => Promise<MembershipCheckoutBinding>;
+        confirmPayment: (input: ConfirmMembershipPaymentInput, env: ChapterEnv) => Promise<MembershipPaymentReceipt>;
+        approveMembership: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipPaymentReceipt>;
+        refundMembership: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipRefundReceipt>;
+        reconcileRenewal: (input: MembershipQuoteTarget & {
+            eventId: string;
+        }, env: ChapterEnv) => Promise<MembershipRenewalReceipt>;
+        readAccess: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<MembershipAccessReceipt>;
+        namedSeats?: {
+            offer: (input: MembershipQuoteTarget, env: ChapterEnv) => Promise<NamedSeatOffer>;
+            invitation: (input: NamedSeatInvitationRequest, env: ChapterEnv) => Promise<NamedSeatInvitation>;
+            readAccess: (input: MembershipQuoteTarget & {
+                seatId: string;
+                recipientUserId: string;
+                recipientApplicationId: string;
+            }, env: ChapterEnv) => Promise<MembershipAccessReceipt>;
+            checkout: (input: NamedSeatCheckoutRequest, env: ChapterEnv) => Promise<NamedSeatCheckoutReceipt>;
+            reserve: (input: NamedSeatCheckoutRequest, env: ChapterEnv) => Promise<Pick<NamedSeatCheckoutReceipt, "seatId" | "amountCents" | "currency" | "termEndsAt">>;
+            confirmPayment: (input: NamedSeatEvidenceRequest, env: ChapterEnv) => Promise<{
+                seatId: string;
+                reconciled: true;
+            }>;
+            confirmRefund: (input: NamedSeatEvidenceRequest, env: ChapterEnv) => Promise<{
+                seatId: string;
+                reconciled: true;
+            }>;
+            accept: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRecipientReceipt>;
+            approve: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRecipientReceipt>;
+            decline: (input: NamedSeatRecipientInput, env: ChapterEnv) => Promise<NamedSeatRefundReceipt>;
+        };
+    } | undefined;
     getPublicConfig: (env: ChapterEnv) => Promise<PublicConfig>;
     verifyUser: (req: Request, env: ChapterEnv) => Promise<Verified | null>;
     makeDb: (env: ChapterEnv) => Db;
     isAdminEmail: (db: Db, email: string | undefined) => Promise<boolean>;
-    isSuperAdminEmail: (db: Db, email: string | undefined) => Promise<boolean>;
+    isSuperAdminEmail: (db: Db, email: string | undefined, userId?: string) => Promise<boolean>;
     roleFor: (db: Db, u: Verified) => Promise<string>;
     isAdmin: (db: Db, u: Verified) => Promise<boolean>;
     crmSender: (env: ChapterEnv) => {
@@ -865,6 +1240,119 @@ type WorkerContext = ReturnType<typeof createWorkerContext>;
  *  {@link WorkerContext} the built-ins receive. */
 type Route = (req: Request, url: URL, env: ChapterEnv, ctx: WorkerContext) => Promise<Response | null>;
 
+/** A dedicated two-sided edge: no chapter receives the network database credential. */
+interface MembershipAuthorityPeer {
+    appId: string;
+    chapterId: string;
+    environment: string;
+    runtime: string;
+    secretName: string;
+    /** Authority-configured, product-separated recurring named-seat Price. Omit to disable seat commands. */
+    seatPriceId?: string;
+}
+/** Business API configuration, independent of the browser UI. May be mounted in
+ * the existing BNF backend using its existing odla database; no extra app required.
+ */
+interface MembershipAuthorityHandlerOptions {
+    peers: readonly MembershipAuthorityPeer[];
+    /** Connect to the network owner's database (BNF), never a chapter projection. */
+    makeDb: () => ChapterDb;
+    now?: () => number;
+    offerLifetimeMs: number;
+    /** Network vault slot; never supplied by a caller. Defaults to stripe_secret_key. */
+    stripeSecretName?: string;
+}
+/** Signed server-to-server route; the runtime is included in the signed request target. */
+declare const MEMBERSHIP_AUTHORITY_PATH = "/api/membership-authority";
+/** Create the narrow signed offer issuer. Authentication maps each dedicated edge
+ * to an exact app/chapter/environment/runtime; callers cannot select another scope,
+ * provide prices, grant roles, or run arbitrary network database operations.
+ * Replayed signed requests are safe because issuance is durably idempotent.
+ */
+declare function createMembershipAuthorityHandler(options: MembershipAuthorityHandlerOptions): (req: Request) => Promise<Response>;
+
+/** Bind reusable authority commands to their isolated collections in BNF's
+ * existing database. Remaps operations AND revision guards in one transaction;
+ * allows policy/provider evidence reads but no writes to those or role tables.
+ * Only named vault slots are exposed. This is defense against accidental command
+ * misuse, NOT isolation from a compromised host holding the underlying app key.
+ */
+declare function createMembershipAuthorityStorage(db: ChapterDb, secretNames: readonly string[]): ChapterDb;
+
+type Row = Record<string, unknown>;
+/** Host routes may reuse this gate after resolving a verified chapter/runtime account. */
+declare function chapterMembershipAccess(db: ChapterDb, env: ChapterEnv, ctx: WorkerContext, app: Row): Promise<boolean>;
+
+/** Retry durable unfinished approval effects in one explicitly configured runtime.
+ * Hosts call this from their scheduled handler; sibling runtime rows are never selected.
+ * The configured origin is used for links, not a stored browser-controlled value.
+ */
+declare function retryChapterApprovalEffects(ctx: WorkerContext, env: ChapterEnv, options: {
+    origin: string;
+    limit?: number;
+}): Promise<{
+    repaired: number;
+    pending: number;
+    more: boolean;
+}>;
+
+/** Deliver one effect identifier. The receiver independently reloads its current authority record. */
+declare function deliverMembershipChapterEffect(options: {
+    secret: string;
+    sender: string;
+    targetUrl: string;
+    effect: MembershipChapterEffect;
+    fetch?: typeof fetch;
+}): Promise<{
+    effectId: string;
+    complete: true;
+}>;
+/** Explicitly configured signed receiver; the host provides the existing authority edge, never its database key.
+ * Stable effect IDs deduplicate email; grant/revoke retries converge on the exact bound recipient.
+ */
+declare function createMembershipChapterEffectRoute(options: {
+    sender: string;
+    secretName: string;
+    origin: string;
+    /** Existing application route on this chapter, not its marketing interest page. */
+    applicationPath?: string;
+    readEffect: (input: MembershipChapterEffect, env: ChapterEnv) => Promise<MembershipChapterEffectData>;
+}): Route;
+
+/** Existing chapter-to-network edge configuration. This never provisions an app, database, credential, or Worker. */
+interface MembershipWorkerAdapterOptions {
+    chapterId: string;
+    secretName: string;
+    makeDb: (env: ChapterEnv) => ChapterDb;
+    targetUrl: (env: ChapterEnv) => string;
+    /** Explicit transport resolver, e.g. a configured service binding. Absence/failure never falls back to a public request. */
+    fetch: (env: ChapterEnv) => typeof globalThis.fetch;
+    namedSeats: boolean;
+}
+/** One complete adapter for every chapter host, plus the reverse receiver's current-state reader. */
+interface MembershipWorkerAdapter {
+    authority: NonNullable<ChapterWorkerOptions["membershipAuthority"]>;
+    readEffect: (input: MembershipChapterEffect, env: ChapterEnv) => Promise<MembershipChapterEffectData>;
+}
+/** Wire all membership commands to one exact configured runtime edge; hosts cannot accidentally omit refunds or use a second scope. */
+declare function createMembershipWorkerAdapter(options: MembershipWorkerAdapterOptions): MembershipWorkerAdapter;
+
+/** The server transport selected for one configured follower edge. */
+interface NetworkTargetTransport {
+    kind: "binding" | "url";
+    binding?: string;
+    fetch(destination: URL, init: RequestInit): Promise<Response>;
+}
+/** A configured binding is authoritative: an invalid binding never falls
+ * through to the public origin and accidentally crosses an account boundary. */
+declare class NetworkTargetTransportError extends Error {
+    readonly code = "binding_unavailable";
+    readonly binding: string;
+    constructor(binding: string);
+}
+/** Resolve the same binding-first transport used by health, reads, and writes. */
+declare function resolveNetworkTargetTransport(env: ChapterEnv, target: Pick<ResolvedNetworkTarget, "binding">): NetworkTargetTransport;
+
 /** The first stable, shared Chapter membership-page renderer contract. */
 declare const MEMBERSHIP_PAGE_RENDERER: "membership-cards-v1";
 /** Fixed visual emphasis choices supported by the versioned card renderer. */
@@ -971,6 +1459,8 @@ interface SignupControlPolicy {
     trustCopy?: string;
     commitmentText?: string;
     normsText?: string;
+    /** Price-specific refund/trust copy, keyed by an explicitly declared tier. */
+    tierPolicies?: Readonly<Record<string, TierPaymentPolicy>>;
 }
 /** Bounded semantic design tokens delegated to the chapter signup surface. */
 interface SignupControlTheme {
@@ -1002,6 +1492,14 @@ interface SignupControlDocument {
 interface SignupControlEnvelope {
     digest: string;
     document: SignupControlDocument;
+    /** Signed transport identity, deliberately excluded from the shared document digest. */
+    deliveryTarget?: SignupControlRuntimeTarget;
+}
+/** Exact deployment receiving a shared data-environment revision. */
+interface SignupControlRuntimeTarget {
+    appId: string;
+    environment: string;
+    runtime: string;
 }
 /** Exact follower acknowledgement for one accepted or replayed revision. */
 interface SignupControlReceipt {
@@ -1009,6 +1507,8 @@ interface SignupControlReceipt {
     target: {
         chapterId: string;
         environment: string;
+        appId?: string;
+        runtime?: string;
     };
     revision: number;
     digest: string;
@@ -1397,4 +1897,4 @@ declare function chapterWorker(options: ChapterWorkerOptions): {
     fetch(req: Request, env: ChapterEnv): Promise<Response>;
 };
 
-export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, AdmissionGrantDeliveryError, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type LeaderAdmissionAssignment, type LeaderAdmissionDelivery, type LeaderAdmissionDeliveryStatus, type MemberContentDeliveryOptions, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterWorker, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverSignupControl, renderActiveSignupControlHtml, retryLeaderAdmissionDeliveries, withActiveSignupControlTheme };
+export { type ActiveSignupControlHtml, type ActiveSignupControlThemeOptions, AdmissionGrantDeliveryError, type AdmissionGrantDeliveryOptions, type BuilderLibraryDeliveryOptions, type ChapterEnv, type ChapterWorkerOptions, type LeaderAdmissionAssignment, type LeaderAdmissionDelivery, type LeaderAdmissionDeliveryStatus, MEMBERSHIP_AUTHORITY_PATH, type MemberContentDeliveryOptions, type MembershipAuthorityHandlerOptions, type MembershipAuthorityPeer, type MembershipChapterEffect, type MembershipEffectScope, type MembershipWorkerAdapter, type MembershipWorkerAdapterOptions, type NetworkTargetTransport, NetworkTargetTransportError, type Route, type SignupControlDeliveryOptions, type WorkerContext, chapterMembershipAccess, chapterWorker, createMembershipAuthorityHandler, createMembershipAuthorityStorage, createMembershipChapterEffectRoute, createMembershipWorkerAdapter, createWorkerContext, deliverAdmissionGrants, deliverBuilderLibrary, deliverMemberContent, deliverMembershipChapterEffect, deliverSignupControl, drainMembershipEffects, renderActiveSignupControlHtml, resolveNetworkTargetTransport, retryChapterApprovalEffects, retryLeaderAdmissionDeliveries, withActiveSignupControlTheme };