@odla-ai/chapter 0.47.9 → 0.48.0

package/dist/{copy-context-Dorxp-WK.d.ts → copy-context-BveBZglM.d.ts}

@@ -85,6 +85,8 @@ interface ChapterSignupControl {
     sourceId: string;
     /** Follower-vault key holding the dedicated edge secret. */
     secretName?: string;
+    /** Optional per-runtime vault keys. When present, unlisted runtimes and legacy untargeted deliveries fail closed. */
+    runtimeSecrets?: Readonly<Record<string, string>>;
     /** Stripe mode this deployed environment accepts. */
     stripeMode: "test" | "live";
 }
@@ -92,6 +94,7 @@ interface ChapterSignupControl {
 interface ResolvedSignupControl {
     sourceId: string;
     secretName: string;
+    runtimeSecrets?: Readonly<Record<string, string>>;
     stripeMode: "test" | "live";
 }
 
@@ -267,6 +270,9 @@ interface ChapterNetworkReader {
  * receive pushed records. It must explicitly declare `readers` before any peer
  * can browse its CRM. */
 interface ChapterNetwork {
+    /** Require the protected super-admin tier for remote mutations and operational
+     * detail. Ordinary admins retain routine name/email directory reads. */
+    requireSuperAdminWrites?: boolean;
     targets?: readonly ChapterNetworkTarget[];
     readers?: readonly ChapterNetworkReader[];
 }
@@ -321,6 +327,7 @@ interface ResolvedNetworkReader {
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
+    requireSuperAdminWrites?: boolean;
     targets: readonly ResolvedNetworkTarget[];
     readers: readonly ResolvedNetworkReader[];
 }
@@ -458,7 +465,9 @@ interface ChapterScheduling {
 }
 /** How a signed-in user's role is determined.
  *
- * - `"claim"` reads a role ladder from a JWT claim (the member-site model:
+ * - `"clerk"` reads backend-only private Clerk roles for each authorization
+ *   check, without trusting public metadata or stale session roles.
+ * - `"claim"` reads a role ladder from a JWT claim (the legacy member-site model:
  *   `provisional → member → admin`). Admin is the last (highest) rung; the
  *   Studio-managed super-admin tier sits above it.
  * - `"table"` gates on the deny-all `admins` allowlist (the hub model):
@@ -466,23 +475,25 @@ interface ChapterScheduling {
  *
  * Defaults: `"claim"` in `chapter` mode, `"table"` in `hub` mode. */
 interface ChapterAuth {
-    source?: "claim" | "table";
+    /** `clerk` reads backend-only private_metadata.role on each request, ignoring
+     * JWT/public roles. Select explicitly after the coordinated role migration. */
+    source?: "claim" | "table" | "clerk";
     /** JWT claim holding the role, for `source: "claim"`. Default `"role"`. */
     claim?: string;
-    /** Role ladder low→high, for `source: "claim"`. The last entry is admin.
+    /** Role ladder low→high, for claim or private Clerk roles. The last entry is admin.
      *  Default `["provisional", "member", "admin"]`. */
     ladder?: readonly string[];
     /** Enable the Studio-managed super-admin tier — the only tier that may
-     *  create/modify admins. Default: `true` for `"claim"`, `false` for `"table"`. */
+     *  create/modify admins. Default: `true` for `"claim"`/`"clerk"`, `false` for `"table"`. */
     superAdmins?: boolean;
     /** Authority behind the super-admin tier. `"table"` preserves the legacy
-     * app allowlist; `"odla"` reads protected `$users.role`. Default `"table"`
-     * for backward compatibility. */
+     * app allowlist; `"odla"` reads protected `$users.role` by exact subject ID.
+     * Default `"odla"` for private Clerk mode, `"table"` for legacy modes. */
     superAdminSource?: "table" | "odla";
 }
 /** The fully-resolved auth policy (defaults applied) carried on the {@link Chapter}. */
 interface ResolvedAuth {
-    source: "claim" | "table";
+    source: "claim" | "table" | "clerk";
     claim: string;
     ladder: readonly string[];
     /** The highest ladder rung (last entry) — the "admin" gate. */