@odla-ai/chapter 0.25.6 → 0.26.0

package/dist/worker/index.js

@@ -111,6 +111,48 @@ function createWorkerContext(options) {
 // src/worker-routes.ts
 import { createCrmRoutes } from "@odla-ai/crm";
 
+// src/discussion-reference-security.ts
+async function authorizeCrmDiscussionReference(req, env, fetcher = fetch) {
+  const match = req.headers.get("authorization")?.match(/^Bearer ([^\s]+)$/);
+  const appIncarnation = env.ODLA_APP_INCARNATION;
+  const expectedTenant = env.ODLA_ENV === "prod" ? env.ODLA_APP_ID : `${env.ODLA_APP_ID}--${env.ODLA_ENV}`;
+  if (!match || env.ODLA_TENANT !== expectedTenant || typeof appIncarnation !== "string" || !/^[a-f0-9]{32}$/.test(appIncarnation)) return null;
+  const requestUrl = new URL(req.url);
+  requestUrl.search = "";
+  requestUrl.hash = "";
+  const audience = requestUrl.href;
+  try {
+    const url = new URL(
+      "/registry/discuss/reference-authority/verify",
+      env.ODLA_PLATFORM
+    );
+    const response = await fetcher(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        token: match[1],
+        appId: env.ODLA_APP_ID,
+        appIncarnation,
+        env: env.ODLA_ENV,
+        product: "crm",
+        projectCapability: "crm.read",
+        audience
+      }),
+      redirect: "manual"
+    });
+    if (!response.ok) return null;
+    const value = await response.json();
+    if (value.authority?.appId !== env.ODLA_APP_ID || value.authority.appIncarnation !== appIncarnation || value.authority.appEnv !== env.ODLA_ENV || value.authority.capability !== "product.reference.read" || value.authority.product !== "crm" || value.authority.projectCapability !== "crm.read" || value.authority.audience !== audience || typeof value.actor?.id !== "string" || value.actor.kind !== "human" && value.actor.kind !== "agent" || value.actor.email !== void 0 && typeof value.actor.email !== "string") return null;
+    return {
+      userId: value.actor.id,
+      discussionReferenceScope: "all",
+      ...value.actor.email ? { email: value.actor.email } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+
 // src/application-id.ts
 var APPLICATION_ID_DOMAIN = "odla-ai/chapter/application/v1:";
 async function applicationIdForSubmission(submissionId) {
@@ -194,160 +236,6 @@ function joinConfig(group, paymentsReady) {
   };
 }
 
-// src/network.ts
-import { createRecord, updateRecord } from "@odla-ai/crm";
-var DEFAULT_SHARE_FIELDS = {
-  person: ["name", "email", "firstName", "lastName", "phone", "linkedin"],
-  company: ["name", "domain", "industry", "location", "linkedin", "notes"]
-};
-function sharedPersonInput(person) {
-  const email = person.email.toLowerCase();
-  const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
-  const input = { name: person.name ?? fullName ?? email, email };
-  if (input.name === "") input.name = email;
-  if (person.firstName) input.firstName = person.firstName;
-  if (person.lastName) input.lastName = person.lastName;
-  if (person.phone) input.phone = person.phone;
-  if (person.linkedin) input.linkedin = person.linkedin;
-  return input;
-}
-function shortHash(value) {
-  let a = 2166136261;
-  let b = 2654435769;
-  for (let i = 0; i < value.length; i += 1) {
-    const n = value.charCodeAt(i);
-    a = Math.imul(a ^ n, 16777619);
-    b = Math.imul(b ^ n, 2246822507);
-  }
-  return `${(a >>> 0).toString(36)}${(b >>> 0).toString(36)}`;
-}
-function networkSourceTag(type, hubRecordId) {
-  const typeKey = type.toLowerCase();
-  const readable = /^[a-z0-9_-]+$/.test(hubRecordId);
-  const raw = `network:${typeKey}:${hubRecordId}`;
-  if (readable && raw.length <= 64) return raw;
-  return `network:${typeKey.slice(0, 20)}:${shortHash(`${type}\0${hubRecordId}`)}`;
-}
-function normalizeSharedRecord(record) {
-  if ("input" in record) return { version: 1, type: record.type, hubRecordId: record.hubRecordId, input: record.input };
-  if ("type" in record && record.type === "company") {
-    const input = { name: record.name };
-    for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
-      if (record[key]) input[key] = record[key];
-    }
-    return { version: 1, type: "company", hubRecordId: record.hubRecordId, input };
-  }
-  return { version: 1, type: "person", hubRecordId: record.hubRecordId, input: sharedPersonInput(record) };
-}
-function sharedRecordFromCrm(crm, record, target) {
-  if (target.fields && !target.fields[record.type]) {
-    throw new Error(`${target.name} does not accept "${record.type}" records`);
-  }
-  const def = crm.type(record.type);
-  const fields = target.fields?.[record.type] ?? DEFAULT_SHARE_FIELDS[record.type];
-  if (!fields) {
-    throw new Error(`${target.name} requires an explicit field allowlist for "${record.type}" records`);
-  }
-  const nameField = def.nameField ?? "name";
-  const input = {};
-  for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
-    const value = record.fields?.[field];
-    if (value !== void 0) input[field] = value;
-  }
-  if (input[nameField] === void 0) input[nameField] = record.name;
-  return { version: 1, type: record.type, hubRecordId: record.id, input };
-}
-async function upsertPerson(deps, opts) {
-  const email = opts.email.toLowerCase();
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const { crm_record } = await deps.db.query({ crm_record: { $: { where: { type: "person", primaryEmail: email }, limit: 1 } } });
-  const existing = crm_record?.[0];
-  if (existing && typeof existing.id === "string") {
-    await updateRecord(crmDeps3, { id: existing.id, input: opts.input });
-    return { recordId: existing.id };
-  }
-  const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
-  return { recordId: created.id };
-}
-async function findSharedRecord(deps, record, tag) {
-  const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
-  const mappedId = mapped.crm_tag?.[0]?.recordId;
-  if (typeof mappedId === "string") {
-    const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
-    if (found.crm_record?.[0]) return found.crm_record[0];
-  }
-  const def = deps.crm.type(record.type);
-  const emailField = def.emailField;
-  if (emailField && typeof record.input[emailField] === "string") {
-    const primaryEmail = record.input[emailField].toLowerCase();
-    const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, primaryEmail }, limit: 1 } }
-    });
-    if (found.crm_record?.[0]) return found.crm_record[0];
-  }
-  const domain = record.input.domain;
-  const domainSlot = def.fields.domain?.slot;
-  if (typeof domain === "string" && domainSlot) {
-    const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, [domainSlot]: domain }, limit: 1 } }
-    });
-    if (found.crm_record?.[0]) return found.crm_record[0];
-  }
-  const nameField = def.nameField ?? "name";
-  const name = record.input[nameField];
-  if (record.type === "company" && typeof name === "string" && name.trim()) {
-    const found = await deps.db.query({
-      crm_record: { $: { where: { type: record.type, name: name.trim() }, limit: 1 } }
-    });
-    if (found.crm_record?.[0]) return found.crm_record[0];
-  }
-  return void 0;
-}
-async function projectSharedRecord(deps, shared) {
-  const record = normalizeSharedRecord(shared);
-  if (!record.type.trim() || !record.hubRecordId.trim()) {
-    throw new Error("type and hubRecordId must be non-empty");
-  }
-  const tag = networkSourceTag(record.type, record.hubRecordId);
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const existing = await findSharedRecord(deps, record, tag);
-  let recordId;
-  if (existing && typeof existing.id === "string") {
-    await updateRecord(crmDeps3, { id: existing.id, input: record.input });
-    recordId = existing.id;
-  } else {
-    recordId = `network_${shortHash(`${record.type}\0${record.hubRecordId}`)}`;
-    await createRecord({ ...crmDeps3, newId: () => recordId }, {
-      type: record.type,
-      input: record.input,
-      mutationId: `share-create:${tag}`
-    });
-  }
-  await deps.db.transact(
-    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps.now() } }],
-    { mutationId: `share-map:${tag}:${recordId}` }
-  );
-  return { recordId };
-}
-async function projectApplicant(deps, applicant) {
-  const base = sharedPersonInput({
-    email: applicant.email,
-    firstName: applicant.firstName,
-    lastName: applicant.lastName,
-    phone: applicant.phone,
-    linkedin: applicant.linkedin,
-    hubRecordId: applicant.applicationId
-  });
-  const mutationId = `apply:${applicant.applicationId}`;
-  const extra = applicant.extra ?? {};
-  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
-  try {
-    return await upsertPerson(deps, { email: applicant.email, input: { ...base, ...extra }, mutationId });
-  } catch {
-    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
-  }
-}
-
 // src/scheduling.ts
 var SCHEDULING_DEFAULTS = {
   slotMinutes: 45,
@@ -576,6 +464,215 @@ async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   return { ...healed, refreshed };
 }
 
+// src/network.ts
+import {
+  createRecord,
+  getRecordByOrigin,
+  updateRecord,
+  upsertRecordOrigin
+} from "@odla-ai/crm";
+
+// src/network-contract.ts
+var DEFAULT_SHARE_FIELDS = {
+  person: ["name", "email", "firstName", "lastName", "phone", "linkedin"],
+  company: ["name", "domain", "industry", "location", "linkedin", "notes"]
+};
+
+// src/network.ts
+function sharedPersonInput(person) {
+  const email = person.email.toLowerCase();
+  const fullName = [person.firstName, person.lastName].filter(Boolean).join(" ").trim();
+  const input = { name: person.name ?? fullName ?? email, email };
+  if (input.name === "") input.name = email;
+  if (person.firstName) input.firstName = person.firstName;
+  if (person.lastName) input.lastName = person.lastName;
+  if (person.phone) input.phone = person.phone;
+  if (person.linkedin) input.linkedin = person.linkedin;
+  return input;
+}
+function shortHash(value) {
+  let a = 2166136261;
+  let b = 2654435769;
+  for (let i = 0; i < value.length; i += 1) {
+    const n = value.charCodeAt(i);
+    a = Math.imul(a ^ n, 16777619);
+    b = Math.imul(b ^ n, 2246822507);
+  }
+  return `${(a >>> 0).toString(36)}${(b >>> 0).toString(36)}`;
+}
+function networkSourceTag(type, hubRecordId, sourceId) {
+  const typeKey = type.toLowerCase();
+  const readable = /^[a-z0-9_-]+$/.test(hubRecordId);
+  const prefix = sourceId ? `network:${sourceId.toLowerCase()}:${typeKey}` : `network:${typeKey}`;
+  const raw = `${prefix}:${hubRecordId}`;
+  if (readable && raw.length <= 64) return raw;
+  return `network:${typeKey.slice(0, 16)}:${shortHash(`${sourceId ?? ""}\0${type}\0${hubRecordId}`)}`;
+}
+function normalizeSharedRecord(record, fallbackSourceId = "legacy-source") {
+  if ("input" in record && record.version === 2) {
+    return {
+      version: 2,
+      sourceId: record.source.siteId,
+      sourceRecordId: record.source.recordId,
+      type: record.type,
+      input: record.input
+    };
+  }
+  if ("input" in record) {
+    return {
+      version: 1,
+      sourceId: fallbackSourceId,
+      sourceRecordId: record.hubRecordId,
+      type: record.type,
+      input: record.input
+    };
+  }
+  if ("type" in record && record.type === "company") {
+    const input = { name: record.name };
+    for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
+      if (record[key]) input[key] = record[key];
+    }
+    return {
+      version: 1,
+      sourceId: fallbackSourceId,
+      sourceRecordId: record.hubRecordId,
+      type: "company",
+      input
+    };
+  }
+  return {
+    version: 1,
+    sourceId: fallbackSourceId,
+    sourceRecordId: record.hubRecordId,
+    type: "person",
+    input: sharedPersonInput(record)
+  };
+}
+function sharedRecordFromCrm(crm, record, target, sourceId) {
+  if (target.fields && !target.fields[record.type]) {
+    throw new Error(`${target.name} does not accept "${record.type}" records`);
+  }
+  const def = crm.type(record.type);
+  const fields = target.fields?.[record.type] ?? DEFAULT_SHARE_FIELDS[record.type];
+  if (!fields) {
+    throw new Error(`${target.name} requires an explicit field allowlist for "${record.type}" records`);
+  }
+  const nameField = def.nameField ?? "name";
+  const input = {};
+  for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
+    const value = record.fields?.[field];
+    if (value !== void 0) input[field] = value;
+  }
+  if (input[nameField] === void 0) input[nameField] = record.name;
+  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record.id }, type: record.type, input } : { version: 1, type: record.type, hubRecordId: record.id, input };
+}
+async function upsertPerson(deps, opts) {
+  const email = opts.email.toLowerCase();
+  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const { crm_record } = await deps.db.query({ crm_record: { $: { where: { type: "person", primaryEmail: email }, limit: 1 } } });
+  const existing = crm_record?.[0];
+  if (existing && typeof existing.id === "string") {
+    await updateRecord(crmDeps3, { id: existing.id, input: opts.input });
+    return { recordId: existing.id };
+  }
+  const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
+  return { recordId: created.id };
+}
+async function findSharedRecord(deps, record, tag) {
+  const structured = await getRecordByOrigin(
+    { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
+    record.sourceId,
+    record.sourceRecordId
+  );
+  if (structured) return structured;
+  const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
+  const mappedId = mapped.crm_tag?.[0]?.recordId;
+  if (typeof mappedId === "string") {
+    const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const def = deps.crm.type(record.type);
+  const emailField = def.emailField;
+  if (emailField && typeof record.input[emailField] === "string") {
+    const primaryEmail = record.input[emailField].toLowerCase();
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, primaryEmail }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const domain = record.input.domain;
+  const domainSlot = def.fields.domain?.slot;
+  if (typeof domain === "string" && domainSlot) {
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, [domainSlot]: domain }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  const nameField = def.nameField ?? "name";
+  const name = record.input[nameField];
+  if (record.type === "company" && typeof name === "string" && name.trim()) {
+    const found = await deps.db.query({
+      crm_record: { $: { where: { type: record.type, name: name.trim() }, limit: 1 } }
+    });
+    if (found.crm_record?.[0]) return found.crm_record[0];
+  }
+  return void 0;
+}
+async function projectSharedRecord(deps, shared, options = {}) {
+  const record = normalizeSharedRecord(shared, options.sourceId);
+  if (!record.type.trim() || !record.sourceId.trim() || !record.sourceRecordId.trim()) {
+    throw new Error("type, source site id, and source record id must be non-empty");
+  }
+  if (options.sourceId && options.sourceId !== record.sourceId) {
+    throw new Error("signed sender does not match payload source");
+  }
+  const tag = networkSourceTag(record.type, record.sourceRecordId, record.version === 2 ? record.sourceId : void 0);
+  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const existing = await findSharedRecord(deps, record, tag);
+  let recordId;
+  if (existing && typeof existing.id === "string") {
+    await updateRecord(crmDeps3, { id: existing.id, input: record.input });
+    recordId = existing.id;
+  } else {
+    recordId = `network_${shortHash(`${record.sourceId}\0${record.type}\0${record.sourceRecordId}`)}`;
+    await createRecord({ ...crmDeps3, newId: () => recordId }, {
+      type: record.type,
+      input: record.input,
+      mutationId: `share-create:${tag}`
+    });
+  }
+  await deps.db.transact(
+    [{ t: "update", ns: "crm_tag", id: tag, attrs: { key: `${recordId}:${tag}`, recordId, tag, createdAt: deps.now() } }],
+    { mutationId: `share-map:${tag}:${recordId}` }
+  );
+  await upsertRecordOrigin(crmDeps3, {
+    recordId,
+    sourceId: record.sourceId,
+    sourceRecordId: record.sourceRecordId,
+    ...options.sourceUrl ? { sourceUrl: options.sourceUrl } : {},
+    payloadVersion: record.version
+  });
+  return { recordId };
+}
+async function projectApplicant(deps, applicant) {
+  const base = sharedPersonInput({
+    email: applicant.email,
+    firstName: applicant.firstName,
+    lastName: applicant.lastName,
+    phone: applicant.phone,
+    linkedin: applicant.linkedin,
+    hubRecordId: applicant.applicationId
+  });
+  const mutationId = `apply:${applicant.applicationId}`;
+  const extra = applicant.extra ?? {};
+  if (Object.keys(extra).length === 0) return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  try {
+    return await upsertPerson(deps, { email: applicant.email, input: { ...base, ...extra }, mutationId });
+  } catch {
+    return upsertPerson(deps, { email: applicant.email, input: base, mutationId });
+  }
+}
+
 // src/email.ts
 function render(template, vars) {
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
@@ -871,6 +968,7 @@ var handleCrm = async (req, url, env, ctx) => {
       if (!u || !await ctx.isAdmin(db, u)) return null;
       return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };
     },
+    authorizeDiscussionReferences: (r) => authorizeCrmDiscussionReference(r, env),
     sender: ctx.crmSender(env),
     from: env.EMAIL_FROM,
     envName: env.ODLA_ENV,
@@ -881,44 +979,6 @@ var handleCrm = async (req, url, env, ctx) => {
   if (res) return res;
   return json({ error: "not found" }, 404);
 };
-var handleNetworkShared = async (req, url, env, ctx) => {
-  if (req.method !== "POST" || url.pathname !== "/api/network/shared") return null;
-  const db = ctx.makeDb(env);
-  const secret = await getVaultSecret(db, "network_share_secret");
-  const provided = (req.headers.get("authorization") ?? "").replace(/^Bearer /, "");
-  if (!secret || provided.length !== secret.length || provided !== secret) {
-    return json({ error: "unauthorized" }, 401);
-  }
-  let payload;
-  try {
-    payload = JSON.parse(await req.text());
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  if (typeof payload.hubRecordId !== "string" || !payload.hubRecordId.trim()) {
-    return json({ error: "hubRecordId is required" }, 400);
-  }
-  if ("input" in payload) {
-    if (payload.version !== 1 || typeof payload.type !== "string" || !payload.type.trim() || !payload.input || typeof payload.input !== "object" || Array.isArray(payload.input)) {
-      return json({ error: "version 1, type, and input are required" }, 400);
-    }
-  } else if (payload.type !== "company" && typeof payload.email !== "string") {
-    return json({ error: "legacy person shares require email" }, 400);
-  } else if (payload.type === "company" && typeof payload.name !== "string") {
-    return json({ error: "business shares require name" }, 400);
-  }
-  try {
-    const record = normalizeSharedRecord(payload);
-    const { recordId } = await projectSharedRecord(
-      { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      record
-    );
-    return json({ recordId, type: record.type });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "invalid shared record";
-    return json({ error: message }, 400);
-  }
-};
 var handleMember = async (req, url, env, ctx) => {
   const chapter = ctx.chapter;
   if (chapter.mode !== "chapter") return null;
@@ -1015,6 +1075,62 @@ var handleMember = async (req, url, env, ctx) => {
   return null;
 };
 
+// src/worker-routes-network-receive.ts
+import { FEDERATION_HEADERS, verifyFederatedRequest } from "@odla-ai/db";
+var handleNetworkShared = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== "/api/network/shared") return null;
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  let raw;
+  let sourceId;
+  if (req.headers.has(FEDERATION_HEADERS.version)) {
+    const verified = await verifyFederatedRequest(req, { secret });
+    if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+    raw = verified.body;
+    sourceId = verified.sender;
+  } else {
+    const provided = (req.headers.get("authorization") ?? "").replace(/^Bearer /, "");
+    if (provided.length !== secret.length || provided !== secret) {
+      return json({ error: "unauthorized" }, 401);
+    }
+    raw = await req.text();
+  }
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  if ("input" in payload) {
+    const v1 = payload.version === 1 && typeof payload.hubRecordId === "string" && payload.hubRecordId.trim();
+    const source = payload.source;
+    const v2 = payload.version === 2 && source && typeof source.siteId === "string" && source.siteId.trim() && typeof source.recordId === "string" && source.recordId.trim();
+    if (!v1 && !v2 || typeof payload.type !== "string" || !payload.type.trim() || !payload.input || typeof payload.input !== "object" || Array.isArray(payload.input)) {
+      return json({ error: "a supported version, source record, type, and input are required" }, 400);
+    }
+  } else if (typeof payload.hubRecordId !== "string" || !payload.hubRecordId.trim()) {
+    return json({ error: "hubRecordId is required" }, 400);
+  } else if (payload.type !== "company" && typeof payload.email !== "string") {
+    return json({ error: "legacy person shares require email" }, 400);
+  } else if (payload.type === "company" && typeof payload.name !== "string") {
+    return json({ error: "business shares require name" }, 400);
+  }
+  try {
+    const { recordId } = await projectSharedRecord(
+      { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
+      payload,
+      sourceId ? { sourceId } : {}
+    );
+    const record = normalizeSharedRecord(payload, sourceId);
+    return json({ recordId, type: record.type });
+  } catch (error) {
+    return json({
+      error: error instanceof Error ? error.message : "invalid shared record"
+    }, 400);
+  }
+};
+
 // src/crm-sync.ts
 import { createRecord as createRecord2, updateRecord as updateRecord2, setStage, linkIdentity } from "@odla-ai/crm";
 var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
@@ -1170,7 +1286,11 @@ async function bookSlot(req, env, ctx) {
   let meetingOp;
   try {
     if (decision.reschedule && decision.eventId) {
-      await cal.actions.reschedule(decision.eventId, { startAt, endAt });
+      await cal.actions.reschedule(decision.eventId, {
+        idempotencyKey: `meeting:${String(existing?.id)}:reschedule:${startAt}:${endAt}`,
+        startAt,
+        endAt
+      });
       meetUrl = existing?.meetUrl ?? null;
       htmlLink = existing?.htmlLink ?? null;
       meetingOp = { t: "update", ns: "meetings", id: String(existing?.id), attrs: meetingRescheduleUpdate(startAt, endAt) };
@@ -2200,7 +2320,11 @@ var handleAdminMeetingReschedule = async (req, url, env, ctx) => {
       minNoticeMs: cfg.minNoticeHours * 36e5
     });
     if (!isSlotAvailable(slots, startAt)) return json({ error: "slot no longer available", code: "calendar_slot_unavailable" }, 409);
-    await cal.actions.reschedule(String(meeting.googleEventId), { startAt, endAt });
+    await cal.actions.reschedule(String(meeting.googleEventId), {
+      idempotencyKey: `meeting:${String(meeting.id)}:reschedule:${startAt}:${endAt}`,
+      startAt,
+      endAt
+    });
   } catch {
     return json({ error: "reschedule failed upstream" }, 502);
   }
@@ -2220,7 +2344,9 @@ var handleAdminMeetingCancel = async (req, url, env, ctx) => {
   if (meeting.status !== "scheduled") return json({ error: "already cancelled" }, 409);
   if (meeting.googleEventId) {
     try {
-      await calFor(env).actions.cancel(String(meeting.googleEventId));
+      await calFor(env).actions.cancel(String(meeting.googleEventId), {
+        idempotencyKey: `meeting:${String(meeting.id)}:cancel`
+      });
     } catch {
       return json({ error: "cancel failed upstream" }, 502);
     }
@@ -2489,7 +2615,8 @@ var handleAdminComms = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network.ts
-import { addTag, getRecord } from "@odla-ai/crm";
+import { getRecord, recordDeliveryAttempt, typeSummary } from "@odla-ai/crm";
+import { signFederatedRequest, verifyFederatedRequest as verifyFederatedRequest2 } from "@odla-ai/db";
 async function gate4(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
@@ -2510,33 +2637,158 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
     }))
   });
 };
+var handleNetworkSnapshot = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/network/snapshot") return null;
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  if (!secret) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest2(req, { secret });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  const types = await Promise.all(
+    Object.keys(ctx.chapter.crm.config.types).map((type) => typeSummary({ crm: ctx.chapter.crm, db }, type))
+  );
+  const snapshot = {
+    version: 1,
+    site: { id: ctx.chapter.id, name: ctx.chapter.name, mode: ctx.chapter.mode },
+    generatedAt: Date.now(),
+    types
+  };
+  return json(snapshot);
+};
+async function snapshotOne(db, ctx, target) {
+  const secret = await getVaultSecret(db, target.secretName);
+  if (!secret) return { id: target.id, name: target.name, url: target.url, available: false, error: "edge secret is missing" };
+  const destination = new URL("/api/network/snapshot", target.url);
+  try {
+    const headers = await signFederatedRequest({
+      secret,
+      sender: ctx.chapter.id,
+      method: "GET",
+      url: destination
+    });
+    const response = await fetch(destination, { headers, signal: AbortSignal.timeout(1e4) });
+    const body = await response.json().catch(() => null);
+    if (!response.ok || !body || !("version" in body) || body.version !== 1 || !("site" in body) || body.site.id !== target.id || !Array.isArray(body.types)) {
+      const upstream = body && "error" in body && typeof body.error === "string" ? body.error : void 0;
+      return {
+        id: target.id,
+        name: target.name,
+        url: target.url,
+        available: false,
+        error: upstream ?? (response.ok ? "invalid follower snapshot" : `follower returned ${response.status}`)
+      };
+    }
+    return {
+      id: target.id,
+      name: target.name,
+      url: target.url,
+      available: true,
+      generatedAt: body.generatedAt,
+      types: body.types
+    };
+  } catch (error) {
+    return {
+      id: target.id,
+      name: target.name,
+      url: target.url,
+      available: false,
+      error: error instanceof Error ? error.message : "snapshot failed"
+    };
+  }
+}
+var handleAdminNetworkRollup = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/admin/network/rollup") return null;
+  const got = await gate4(req, env, ctx);
+  if ("response" in got) return got.response;
+  const targets = await Promise.all(
+    ctx.chapter.network.targets.map((target) => snapshotOne(got.db, ctx, target))
+  );
+  const byType = /* @__PURE__ */ new Map();
+  for (const target of targets) {
+    for (const type of target.types ?? []) {
+      const aggregate = byType.get(type.type) ?? { type: type.type, total: 0, stages: {} };
+      aggregate.total += type.total;
+      for (const [stage, count] of Object.entries(type.stages)) {
+        aggregate.stages[stage] = (aggregate.stages[stage] ?? 0) + count;
+      }
+      byType.set(type.type, aggregate);
+    }
+  }
+  const rollup = {
+    configured: targets.length,
+    available: targets.filter((target) => target.available).length,
+    totalRecords: [...byType.values()].reduce((sum, type) => sum + type.total, 0),
+    types: [...byType.values()],
+    targets
+  };
+  return json(rollup);
+};
 async function pushOne(db, ctx, target, record) {
   const secret = await getVaultSecret(db, target.secretName);
-  if (!secret) return { id: target.id, name: target.name, ok: false, error: `vault secret "${target.secretName}" is missing` };
+  const crmDeps3 = { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() };
+  if (!secret) {
+    const error = `vault secret "${target.secretName}" is missing`;
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "failed",
+      payloadVersion: 2,
+      error
+    });
+    return { id: target.id, name: target.name, ok: false, error };
+  }
   let payload;
   try {
-    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target);
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target, ctx.chapter.id);
   } catch (err) {
     return { id: target.id, name: target.name, ok: false, error: err instanceof Error ? err.message : "record is not shareable" };
   }
+  const payloadBody = JSON.stringify(payload);
+  const destination = new URL("/api/network/shared", target.url);
   try {
-    const res = await fetch(new URL("/api/network/shared", target.url), {
+    const signed = await signFederatedRequest({
+      secret,
+      sender: ctx.chapter.id,
+      method: "POST",
+      url: destination,
+      body: payloadBody
+    });
+    const res = await fetch(destination, {
       method: "POST",
-      headers: { authorization: `Bearer ${secret}`, "content-type": "application/json" },
-      body: JSON.stringify(payload),
+      headers: { ...signed, "content-type": "application/json" },
+      body: payloadBody,
       signal: AbortSignal.timeout(1e4)
     });
-    const body = await res.json().catch(() => ({}));
+    const responseBody = await res.json().catch(() => ({}));
     if (!res.ok) {
-      return { id: target.id, name: target.name, ok: false, status: res.status, error: body.error ?? "follower rejected the record" };
+      const error = responseBody.error ?? "follower rejected the record";
+      await recordDeliveryAttempt(crmDeps3, {
+        recordId: record.id,
+        targetId: target.id,
+        status: "failed",
+        payloadVersion: 2,
+        error
+      });
+      return { id: target.id, name: target.name, ok: false, status: res.status, error };
     }
-    await addTag(
-      { crm: ctx.chapter.crm, db },
-      { recordId: record.id, tag: `shared:${target.id}`, mutationId: `network-delivered:${record.id}:${target.id}` }
-    );
-    return { id: target.id, name: target.name, ok: true, status: res.status, recordId: body.recordId };
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "delivered",
+      payloadVersion: 2,
+      ...responseBody.recordId ? { remoteRecordId: responseBody.recordId } : {}
+    });
+    return { id: target.id, name: target.name, ok: true, status: res.status, recordId: responseBody.recordId };
   } catch (err) {
-    return { id: target.id, name: target.name, ok: false, error: err instanceof Error ? err.message : "delivery failed" };
+    const error = err instanceof Error ? err.message : "delivery failed";
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "failed",
+      payloadVersion: 2,
+      error
+    });
+    return { id: target.id, name: target.name, ok: false, error };
   }
 }
 var handleAdminNetworkPush = async (req, url, env, ctx) => {
@@ -2564,6 +2816,100 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   return json({ ok: results.every((result) => result.ok), results });
 };
 
+// src/worker-routes-formation.ts
+import { createRecord as createRecord3 } from "@odla-ai/crm";
+
+// src/formation.ts
+function formationFields(crm, formation) {
+  const def = crm.type(formation.type);
+  return [...formation.required, ...formation.optional].map((id) => {
+    const field = def.fields[id];
+    return {
+      id,
+      label: field.label ?? id,
+      type: field.type,
+      required: formation.required.includes(id),
+      ...field.options ? { options: field.options } : {}
+    };
+  });
+}
+
+// src/worker-routes-formation.ts
+var SUBMISSION = /^[A-Za-z0-9_-]{8,128}$/;
+var handleFormation = async (req, url, env, ctx) => {
+  const formation = ctx.chapter.formation;
+  if (!formation.enabled) return null;
+  if (req.method === "GET" && url.pathname === "/api/formation/config") {
+    return json({
+      type: formation.type,
+      fields: formationFields(ctx.chapter.crm, formation)
+    });
+  }
+  if (req.method !== "POST" || url.pathname !== "/api/formation/applications") return null;
+  const raw = await req.text();
+  if (raw.length > formation.bodyCap) return json({ error: "request body too large" }, 413);
+  let body;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) return json({ error: "JSON body must be an object" }, 400);
+  const submissionId = typeof body.submissionId === "string" ? body.submissionId : void 0;
+  if (submissionId && !SUBMISSION.test(submissionId)) {
+    return json({ error: "submissionId must be an 8\u2013128 character base64url value" }, 400);
+  }
+  const allowed = /* @__PURE__ */ new Set([...formation.required, ...formation.optional]);
+  const unknown = Object.keys(body).filter((field) => field !== "submissionId" && !allowed.has(field));
+  if (unknown.length) return json({ error: `field "${unknown[0]}" is not accepted` }, 400);
+  for (const field of formation.required) {
+    const value = body[field];
+    if (typeof value !== "string" || value.trim() === "") return json({ error: `${field} is required` }, 400);
+  }
+  const input = {};
+  for (const field of allowed) {
+    const value = body[field];
+    if (value === void 0) continue;
+    const cap = formation.maxLen[field] ?? formation.defaultMaxLen;
+    if (typeof value === "string") {
+      if (value.length > cap) return json({ error: `${field} exceeds ${cap} characters` }, 400);
+      input[field] = value.trim();
+    } else if (Array.isArray(value)) {
+      input[field] = value.slice(0, 100);
+    } else {
+      input[field] = value;
+    }
+  }
+  const db = ctx.makeDb(env);
+  const id = submissionId ? await applicationIdForSubmission(`formation:${ctx.chapter.id}:${submissionId}`) : crypto.randomUUID();
+  try {
+    const created = await createRecord3(
+      {
+        crm: ctx.chapter.crm,
+        db,
+        now: () => Date.now(),
+        newId: () => id
+      },
+      {
+        type: formation.type,
+        input,
+        ...submissionId ? { mutationId: `formation:${ctx.chapter.id}:${submissionId}` } : {}
+      }
+    );
+    return json({
+      id,
+      duplicate: created.duplicate,
+      status: created.record.stage ?? null
+    }, created.duplicate ? 200 : 201);
+  } catch (error) {
+    const detail = error && typeof error === "object" && "fields" in error ? error.fields : void 0;
+    return json({
+      error: error instanceof Error ? error.message : "invalid formation application",
+      ...detail ? { fields: detail } : {}
+    }, 400);
+  }
+};
+
 // src/worker.ts
 var BUILTIN_ROUTES = [
   handleHealth,
@@ -2571,6 +2917,8 @@ var BUILTIN_ROUTES = [
   handleMe,
   handleCrm,
   handleNetworkShared,
+  handleNetworkSnapshot,
+  handleFormation,
   handleMember,
   handleSchedule,
   handlePayments,
@@ -2598,6 +2946,7 @@ var BUILTIN_ROUTES = [
   handleAdminComms,
   // Leader → follower record delivery
   handleAdminNetworkTargets,
+  handleAdminNetworkRollup,
   handleAdminNetworkPush,
   // API requests must never fall through to an SPA asset response. Hosts still
   // get first refusal through options.routes, then this terminates unknown API