@odla-ai/chapter 0.19.0 → 0.20.0

package/dist/worker/index.d.cts

@@ -47,6 +47,9 @@ interface ChapterBrand {
         body?: string;
         numeral?: string;
     };
+    /** Short glyph used in compact admin chrome. Defaults to the first three
+     * letters of the chapter name. */
+    badge?: string;
     wordmark?: string;
     tagline?: string;
     /** Header/footer nav sections for the web-component chrome: label → entries. */
@@ -56,6 +59,40 @@ interface ChapterBrand {
     }>>;
     logos?: string;
 }
+/** One follower site a leader can push CRM records to. The secret VALUE never
+ * lives in config: `secretName` names the leader tenant's vaulted copy of the
+ * follower's `network_share_secret`. */
+interface ChapterNetworkTarget {
+    /** Stable lowercase slug used by the UI, audit tags, and default secret name. */
+    id: string;
+    /** Human-facing site name. Defaults to `id`. */
+    name?: string;
+    /** Absolute follower origin, e.g. `https://silver.example.com`. */
+    url: string;
+    /** Leader-vault key holding this follower's share secret. Defaults to
+     * `network_share_<id-with-underscores>`. */
+    secretName?: string;
+    /** Per-record-type field allowlist. If present, omitted types cannot be sent
+     * to this target. Without it, package-safe person/company defaults apply. */
+    fields?: Record<string, readonly string[]>;
+}
+/** Leader/follower network configuration. Followers need no code config to
+ * receive records; they only vault `network_share_secret`. */
+interface ChapterNetwork {
+    targets?: readonly ChapterNetworkTarget[];
+}
+/** A validated network target carried on the resolved chapter engine. */
+interface ResolvedNetworkTarget {
+    id: string;
+    name: string;
+    url: string;
+    secretName: string;
+    fields?: Record<string, readonly string[]>;
+}
+/** Fully-resolved leader network configuration. */
+interface ResolvedNetwork {
+    targets: readonly ResolvedNetworkTarget[];
+}
 /** Membership pricing for the group row (chapter mode). */
 interface ChapterPrices {
     standardCents: number;
@@ -211,6 +248,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** Leader → follower delivery targets. Secret values stay in the leader
+     * tenant vault; see {@link ChapterNetworkTarget}. */
+    network?: ChapterNetwork;
     thesis?: unknown;
     /** Required in `chapter` mode. */
     prices?: ChapterPrices;
@@ -297,6 +337,11 @@ interface Chapter {
     name: string;
     url?: string;
     mode: ChapterMode;
+    /** Resolved site identity. `wordmark` always falls back to `name`, so the
+     * admin/member UI never needs a second brand declaration. */
+    brand: ChapterBrand;
+    /** Validated follower targets for leader-driven record pushes. */
+    network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
     crm: Crm;
     /** Resolved auth policy (source, claim, ladder, super-admin tier). */

package/dist/worker/index.d.ts

@@ -47,6 +47,9 @@ interface ChapterBrand {
         body?: string;
         numeral?: string;
     };
+    /** Short glyph used in compact admin chrome. Defaults to the first three
+     * letters of the chapter name. */
+    badge?: string;
     wordmark?: string;
     tagline?: string;
     /** Header/footer nav sections for the web-component chrome: label → entries. */
@@ -56,6 +59,40 @@ interface ChapterBrand {
     }>>;
     logos?: string;
 }
+/** One follower site a leader can push CRM records to. The secret VALUE never
+ * lives in config: `secretName` names the leader tenant's vaulted copy of the
+ * follower's `network_share_secret`. */
+interface ChapterNetworkTarget {
+    /** Stable lowercase slug used by the UI, audit tags, and default secret name. */
+    id: string;
+    /** Human-facing site name. Defaults to `id`. */
+    name?: string;
+    /** Absolute follower origin, e.g. `https://silver.example.com`. */
+    url: string;
+    /** Leader-vault key holding this follower's share secret. Defaults to
+     * `network_share_<id-with-underscores>`. */
+    secretName?: string;
+    /** Per-record-type field allowlist. If present, omitted types cannot be sent
+     * to this target. Without it, package-safe person/company defaults apply. */
+    fields?: Record<string, readonly string[]>;
+}
+/** Leader/follower network configuration. Followers need no code config to
+ * receive records; they only vault `network_share_secret`. */
+interface ChapterNetwork {
+    targets?: readonly ChapterNetworkTarget[];
+}
+/** A validated network target carried on the resolved chapter engine. */
+interface ResolvedNetworkTarget {
+    id: string;
+    name: string;
+    url: string;
+    secretName: string;
+    fields?: Record<string, readonly string[]>;
+}
+/** Fully-resolved leader network configuration. */
+interface ResolvedNetwork {
+    targets: readonly ResolvedNetworkTarget[];
+}
 /** Membership pricing for the group row (chapter mode). */
 interface ChapterPrices {
     standardCents: number;
@@ -211,6 +248,9 @@ interface ChapterConfig {
     /** A `defineCrm()` config or a resolved `Crm`. Omit for the per-mode default. */
     crm?: CrmConfig | Crm;
     brand?: ChapterBrand;
+    /** Leader → follower delivery targets. Secret values stay in the leader
+     * tenant vault; see {@link ChapterNetworkTarget}. */
+    network?: ChapterNetwork;
     thesis?: unknown;
     /** Required in `chapter` mode. */
     prices?: ChapterPrices;
@@ -297,6 +337,11 @@ interface Chapter {
     name: string;
     url?: string;
     mode: ChapterMode;
+    /** Resolved site identity. `wordmark` always falls back to `name`, so the
+     * admin/member UI never needs a second brand declaration. */
+    brand: ChapterBrand;
+    /** Validated follower targets for leader-driven record pushes. */
+    network: ResolvedNetwork;
     /** Resolved CRM engine (from `defineCrm`). */
     crm: Crm;
     /** Resolved auth policy (source, claim, ladder, super-admin tier). */

package/dist/worker/index.js

@@ -247,6 +247,10 @@ function joinConfig(group, paymentsReady) {
 
 // src/network.ts
 import { createRecord, updateRecord } from "@odla-ai/crm";
+var DEFAULT_SHARE_FIELDS = {
+  person: ["name", "email", "firstName", "lastName", "phone", "linkedin"],
+  company: ["name", "domain", "industry", "location", "linkedin", "notes"]
+};
 function sharedPersonInput(person) {
   const email = person.email.toLowerCase();
   const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
@@ -258,6 +262,52 @@ function sharedPersonInput(person) {
   if (person.linkedin) input.linkedin = person.linkedin;
   return input;
 }
+function shortHash(value) {
+  let a = 2166136261;
+  let b = 2654435769;
+  for (let i = 0; i < value.length; i += 1) {
+    const n = value.charCodeAt(i);
+    a = Math.imul(a ^ n, 16777619);
+    b = Math.imul(b ^ n, 2246822507);
+  }
+  return `${(a >>> 0).toString(36)}${(b >>> 0).toString(36)}`;
+}
+function networkSourceTag(type, hubRecordId) {
+  const typeKey = type.toLowerCase();
+  const readable = /^[a-z0-9_-]+$/.test(hubRecordId);
+  const raw = `network:${typeKey}:${hubRecordId}`;
+  if (readable && raw.length <= 64) return raw;
+  return `network:${typeKey.slice(0, 20)}:${shortHash(`${type}\0${hubRecordId}`)}`;
+}
+function normalizeSharedRecord(record) {
+  if ("input" in record) return { version: 1, type: record.type, hubRecordId: record.hubRecordId, input: record.input };
+  if ("type" in record && record.type === "company") {
+    const input = { name: record.name };
+    for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
+      if (record[key]) input[key] = record[key];
+    }
+    return { version: 1, type: "company", hubRecordId: record.hubRecordId, input };
+  }
+  return { version: 1, type: "person", hubRecordId: record.hubRecordId, input: sharedPersonInput(record) };
+}
+function sharedRecordFromCrm(crm, record, target) {
+  if (target.fields && !target.fields[record.type]) {
+    throw new Error(`${target.name} does not accept "${record.type}" records`);
+  }
+  const def = crm.type(record.type);
+  const fields = target.fields?.[record.type] ?? DEFAULT_SHARE_FIELDS[record.type];
+  if (!fields) {
+    throw new Error(`${target.name} requires an explicit field allowlist for "${record.type}" records`);
+  }
+  const nameField = def.nameField ?? "name";
+  const input = {};
+  for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
+    const value = record.fields?.[field];
+    if (value !== void 0) input[field] = value;
+  }
+  if (input[nameField] === void 0) input[nameField] = record.name;
+  return { version: 1, type: record.type, hubRecordId: record.id, input };
+}
 async function upsertPerson(deps, opts) {
   const email = opts.email.toLowerCase();
   const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
@@ -270,8 +320,65 @@ async function upsertPerson(deps, opts) {
   const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
   return { recordId: created.id };
 }
-async function projectSharedRecord(deps, person) {
-  return upsertPerson(deps, { email: person.email, input: sharedPersonInput(person), mutationId: `share:${person.hubRecordId}` });
+async function findSharedRecord(deps, record, tag) {
+  const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
+  const mappedId = mapped.crm_tag?.[0]?.recordId;
+  if (typeof mappedId === "string") {
+    const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const def = deps.crm.type(record.type);
+  const emailField = def.emailField;
+  if (emailField && typeof record.input[emailField] === "string") {
+    const primaryEmail = record.input[emailField].toLowerCase();
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, primaryEmail }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const domain = record.input.domain;
+  const domainSlot = def.fields.domain?.slot;
+  if (typeof domain === "string" && domainSlot) {
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, [domainSlot]: domain }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const nameField = def.nameField ?? "name";
+  const name = record.input[nameField];
+  if (record.type === "company" && typeof name === "string" && name.trim()) {
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, name: name.trim() }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  return void 0;
+}
+async function projectSharedRecord(deps, shared) {
+  const record = normalizeSharedRecord(shared);
+  if (!record.type.trim() || !record.hubRecordId.trim()) {
+    throw new Error("type and hubRecordId must be non-empty");
+  }
+  const tag = networkSourceTag(record.type, record.hubRecordId);
+  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const existing = await findSharedRecord(deps, record, tag);
+  let recordId;
+  if (existing && typeof existing.id === "string") {
+    await updateRecord(crmDeps3, { id: existing.id, input: record.input });
+    recordId = existing.id;
+  } else {
+    recordId = `network_${shortHash(`${record.type}\0${record.hubRecordId}`)}`;
+    await createRecord({ ...crmDeps3, newId: () => recordId }, {
+      type: record.type,
+      input: record.input,
+      mutationId: `share-create:${tag}`
+    });
+  }
+  await deps.db.transact(
+    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps.now() } }],
+    { mutationId: `share-map:${tag}:${recordId}` }
+  );
+  return { recordId };
 }
 async function projectApplicant(deps, applicant) {
   const base = sharedPersonInput({
@@ -649,20 +756,35 @@ var handleNetworkShared = async (req, url, env, ctx) => {
   if (!secret || provided.length !== secret.length || provided !== secret) {
     return json({ error: "unauthorized" }, 401);
   }
-  let person;
+  let payload;
   try {
-    person = JSON.parse(await req.text());
+    payload = JSON.parse(await req.text());
   } catch {
     return json({ error: "invalid JSON body" }, 400);
   }
-  if (typeof person.email !== "string" || typeof person.hubRecordId !== "string") {
-    return json({ error: "email and hubRecordId are required" }, 400);
+  if (typeof payload.hubRecordId !== "string" || !payload.hubRecordId.trim()) {
+    return json({ error: "hubRecordId is required" }, 400);
+  }
+  if ("input" in payload) {
+    if (payload.version !== 1 || typeof payload.type !== "string" || !payload.type.trim() || !payload.input || typeof payload.input !== "object" || Array.isArray(payload.input)) {
+      return json({ error: "version 1, type, and input are required" }, 400);
+    }
+  } else if (payload.type !== "company" && typeof payload.email !== "string") {
+    return json({ error: "legacy person shares require email" }, 400);
+  } else if (payload.type === "company" && typeof payload.name !== "string") {
+    return json({ error: "business shares require name" }, 400);
+  }
+  try {
+    const record = normalizeSharedRecord(payload);
+    const { recordId } = await projectSharedRecord(
+      { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
+      record
+    );
+    return json({ recordId, type: record.type });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "invalid shared record";
+    return json({ error: message }, 400);
   }
-  const { recordId } = await projectSharedRecord(
-    { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-    person
-  );
-  return json({ recordId });
 };
 var handleMember = async (req, url, env, ctx) => {
   const chapter = ctx.chapter;
@@ -1495,16 +1617,16 @@ var crmDeps = (db, ctx) => ({
 });
 var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
-  const gate4 = await adminGate(req, env, ctx);
-  if (gate4 instanceof Response) return gate4;
-  const result = await backfillCrm(crmDeps(gate4.db, ctx));
+  const gate5 = await adminGate(req, env, ctx);
+  if (gate5 instanceof Response) return gate5;
+  const result = await backfillCrm(crmDeps(gate5.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people") return null;
-  const gate4 = await adminGate(req, env, ctx);
-  if (gate4 instanceof Response) return gate4;
-  const { db } = gate4;
+  const gate5 = await adminGate(req, env, ctx);
+  if (gate5 instanceof Response) return gate5;
+  const { db } = gate5;
   const sk = await getVaultSecret(db, "clerk_secret_key");
   const [appsRes, usersRes, roleList] = await Promise.all([
     db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 200 } } }),
@@ -1544,9 +1666,9 @@ var handleAdminPeople = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
-  const gate4 = await adminGate(req, env, ctx);
-  if (gate4 instanceof Response) return gate4;
-  const { db } = gate4;
+  const gate5 = await adminGate(req, env, ctx);
+  if (gate5 instanceof Response) return gate5;
+  const { db } = gate5;
   const targetId = url.searchParams.get("userId") ?? "";
   if (!targetId.startsWith("user_")) return json({ error: "invalid userId" }, 400);
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -1557,9 +1679,9 @@ var handleAdminPeopleAccess = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleRole = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/people/role") return null;
-  const gate4 = await adminGate(req, env, ctx);
-  if (gate4 instanceof Response) return gate4;
-  const { db, actor } = gate4;
+  const gate5 = await adminGate(req, env, ctx);
+  if (gate5 instanceof Response) return gate5;
+  const { db, actor } = gate5;
   let body;
   try {
     body = await req.json();
@@ -2098,6 +2220,82 @@ var handleAdminComms = async (req, url, env, ctx) => {
   return json({ items });
 };
 
+// src/worker-routes-network.ts
+import { addTag, getRecord } from "@odla-ai/crm";
+async function gate4(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+var handleAdminNetworkTargets = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/admin/network/targets") return null;
+  const got = await gate4(req, env, ctx);
+  if ("response" in got) return got.response;
+  return json({
+    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields }) => ({
+      id,
+      name,
+      url: targetUrl,
+      types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS)
+    }))
+  });
+};
+async function pushOne(db, ctx, target, record) {
+  const secret = await getVaultSecret(db, target.secretName);
+  if (!secret) return { id: target.id, name: target.name, ok: false, error: `vault secret "${target.secretName}" is missing` };
+  let payload;
+  try {
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target);
+  } catch (err) {
+    return { id: target.id, name: target.name, ok: false, error: err instanceof Error ? err.message : "record is not shareable" };
+  }
+  try {
+    const res = await fetch(new URL("/api/network/shared", target.url), {
+      method: "POST",
+      headers: { authorization: `Bearer ${secret}`, "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(1e4)
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return { id: target.id, name: target.name, ok: false, status: res.status, error: body.error ?? "follower rejected the record" };
+    }
+    await addTag(
+      { crm: ctx.chapter.crm, db },
+      { recordId: record.id, tag: `shared:${target.id}`, mutationId: `network-delivered:${record.id}:${target.id}` }
+    );
+    return { id: target.id, name: target.name, ok: true, status: res.status, recordId: body.recordId };
+  } catch (err) {
+    return { id: target.id, name: target.name, ok: false, error: err instanceof Error ? err.message : "delivery failed" };
+  }
+}
+var handleAdminNetworkPush = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== "/api/admin/network/push") return null;
+  const got = await gate4(req, env, ctx);
+  if ("response" in got) return got.response;
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  if (typeof body.recordId !== "string" || !Array.isArray(body.targetIds) || body.targetIds.length === 0) {
+    return json({ error: "recordId and a non-empty targetIds array are required" }, 400);
+  }
+  const requested = new Set(body.targetIds.filter((id) => typeof id === "string"));
+  if (requested.size !== body.targetIds.length) return json({ error: "targetIds must contain unique strings" }, 400);
+  const targets = ctx.chapter.network.targets.filter((target) => requested.has(target.id));
+  if (targets.length !== requested.size) return json({ error: "one or more targetIds are not configured" }, 400);
+  const record = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
+  if (!record) return json({ error: "record not found" }, 404);
+  const results = await Promise.all(
+    targets.map((target) => pushOne(got.db, ctx, target, record))
+  );
+  return json({ ok: results.every((result) => result.ok), results });
+};
+
 // src/worker.ts
 var BUILTIN_ROUTES = [
   handleHealth,
@@ -2128,7 +2326,10 @@ var BUILTIN_ROUTES = [
   handleAdminGroupEmail,
   handleAdminEmailLog,
   handleAdminEmailTest,
-  handleAdminComms
+  handleAdminComms,
+  // Leader → follower record delivery
+  handleAdminNetworkTargets,
+  handleAdminNetworkPush
 ];
 function chapterWorker(options) {
   const ctx = createWorkerContext(options);