@odla-ai/chapter 0.26.0 → 0.27.0

package/dist/worker/index.js

@@ -1901,16 +1901,16 @@ var crmDeps2 = (db, ctx) => ({
 });
 var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const result = await backfillCrm(crmDeps2(gate5.db, ctx));
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const result = await backfillCrm(crmDeps2(gate8.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db } = gate8;
   const sk = await getVaultSecret(db, "clerk_secret_key");
   const [appsRes, usersRes, roleList] = await Promise.all([
     db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 200 } } }),
@@ -1961,9 +1961,9 @@ var handleAdminPeople = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db } = gate8;
   const targetId = url.searchParams.get("userId") ?? "";
   if (!targetId.startsWith("user_")) return json({ error: "invalid userId" }, 400);
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -1974,9 +1974,9 @@ var handleAdminPeopleAccess = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleRole = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/people/role") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db, actor } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db, actor } = gate8;
   let body;
   try {
     body = await req.json();
@@ -2615,8 +2615,118 @@ var handleAdminComms = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-network.ts
-import { getRecord, recordDeliveryAttempt, typeSummary } from "@odla-ai/crm";
-import { signFederatedRequest, verifyFederatedRequest as verifyFederatedRequest2 } from "@odla-ai/db";
+import { getRecord, typeSummary } from "@odla-ai/crm";
+import { signFederatedRequest as signFederatedRequest2, verifyFederatedRequest as verifyFederatedRequest2 } from "@odla-ai/db";
+
+// src/worker-network-fetch.ts
+function targetFetcher(env, target) {
+  if (!target.binding) return null;
+  const candidate = env[target.binding];
+  if (typeof candidate !== "object" || candidate === null || !("fetch" in candidate) || typeof candidate.fetch !== "function") {
+    throw new Error(`service binding "${target.binding}" is unavailable`);
+  }
+  return candidate;
+}
+function fetchNetworkTarget(env, target, destination, init) {
+  const binding = targetFetcher(env, target);
+  return binding ? binding.fetch(new Request(destination, init)) : globalThis.fetch(destination, init);
+}
+
+// src/worker-network-push.ts
+import { recordDeliveryAttempt } from "@odla-ai/crm";
+import { signFederatedRequest } from "@odla-ai/db";
+async function pushNetworkRecord(db, env, ctx, target, record) {
+  const secret = await getVaultSecret(db, target.secretName);
+  const crmDeps3 = {
+    crm: ctx.chapter.crm,
+    db,
+    now: () => Date.now(),
+    newId: () => crypto.randomUUID()
+  };
+  if (!secret) {
+    const error = `vault secret "${target.secretName}" is missing`;
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "failed",
+      payloadVersion: 2,
+      error
+    });
+    return { id: target.id, name: target.name, ok: false, error };
+  }
+  let payload;
+  try {
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target, ctx.chapter.id);
+  } catch (err) {
+    return {
+      id: target.id,
+      name: target.name,
+      ok: false,
+      error: err instanceof Error ? err.message : "record is not shareable"
+    };
+  }
+  const payloadBody = JSON.stringify(payload);
+  const destination = new URL("/api/network/shared", target.url);
+  try {
+    const signed = await signFederatedRequest({
+      secret,
+      sender: ctx.chapter.id,
+      method: "POST",
+      url: destination,
+      body: payloadBody
+    });
+    const res = await fetchNetworkTarget(env, target, destination, {
+      method: "POST",
+      headers: { ...signed, "content-type": "application/json" },
+      body: payloadBody,
+      signal: AbortSignal.timeout(1e4)
+    });
+    const responseBody = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const error = responseBody.error ?? "follower rejected the record";
+      await recordDeliveryAttempt(crmDeps3, {
+        recordId: record.id,
+        targetId: target.id,
+        status: "failed",
+        payloadVersion: 2,
+        error
+      });
+      return {
+        id: target.id,
+        name: target.name,
+        ok: false,
+        status: res.status,
+        error
+      };
+    }
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "delivered",
+      payloadVersion: 2,
+      ...responseBody.recordId ? { remoteRecordId: responseBody.recordId } : {}
+    });
+    return {
+      id: target.id,
+      name: target.name,
+      ok: true,
+      status: res.status,
+      recordId: responseBody.recordId
+    };
+  } catch (err) {
+    const error = err instanceof Error ? err.message : "delivery failed";
+    await recordDeliveryAttempt(crmDeps3, {
+      recordId: record.id,
+      targetId: target.id,
+      status: "failed",
+      payloadVersion: 2,
+      error
+    });
+    return { id: target.id, name: target.name, ok: false, error };
+  }
+}
+
+// src/worker-routes-network.ts
 async function gate4(req, env, ctx) {
   const db = ctx.makeDb(env);
   const user = await ctx.verifyUser(req, env);
@@ -2629,11 +2739,12 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   const got = await gate4(req, env, ctx);
   if ("response" in got) return got.response;
   return json({
-    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields }) => ({
+    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields, sharedNotes }) => ({
       id,
       name,
       url: targetUrl,
-      types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS)
+      types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS),
+      sharedNotes
     }))
   });
 };
@@ -2655,18 +2766,21 @@ var handleNetworkSnapshot = async (req, url, env, ctx) => {
   };
   return json(snapshot);
 };
-async function snapshotOne(db, ctx, target) {
+async function snapshotOne(db, env, ctx, target) {
   const secret = await getVaultSecret(db, target.secretName);
   if (!secret) return { id: target.id, name: target.name, url: target.url, available: false, error: "edge secret is missing" };
   const destination = new URL("/api/network/snapshot", target.url);
   try {
-    const headers = await signFederatedRequest({
+    const headers = await signFederatedRequest2({
       secret,
       sender: ctx.chapter.id,
       method: "GET",
       url: destination
     });
-    const response = await fetch(destination, { headers, signal: AbortSignal.timeout(1e4) });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      headers,
+      signal: AbortSignal.timeout(1e4)
+    });
     const body = await response.json().catch(() => null);
     if (!response.ok || !body || !("version" in body) || body.version !== 1 || !("site" in body) || body.site.id !== target.id || !Array.isArray(body.types)) {
       const upstream = body && "error" in body && typeof body.error === "string" ? body.error : void 0;
@@ -2701,7 +2815,7 @@ var handleAdminNetworkRollup = async (req, url, env, ctx) => {
   const got = await gate4(req, env, ctx);
   if ("response" in got) return got.response;
   const targets = await Promise.all(
-    ctx.chapter.network.targets.map((target) => snapshotOne(got.db, ctx, target))
+    ctx.chapter.network.targets.map((target) => snapshotOne(got.db, env, ctx, target))
   );
   const byType = /* @__PURE__ */ new Map();
   for (const target of targets) {
@@ -2723,74 +2837,6 @@ var handleAdminNetworkRollup = async (req, url, env, ctx) => {
   };
   return json(rollup);
 };
-async function pushOne(db, ctx, target, record) {
-  const secret = await getVaultSecret(db, target.secretName);
-  const crmDeps3 = { crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() };
-  if (!secret) {
-    const error = `vault secret "${target.secretName}" is missing`;
-    await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
-      targetId: target.id,
-      status: "failed",
-      payloadVersion: 2,
-      error
-    });
-    return { id: target.id, name: target.name, ok: false, error };
-  }
-  let payload;
-  try {
-    payload = sharedRecordFromCrm(ctx.chapter.crm, record, target, ctx.chapter.id);
-  } catch (err) {
-    return { id: target.id, name: target.name, ok: false, error: err instanceof Error ? err.message : "record is not shareable" };
-  }
-  const payloadBody = JSON.stringify(payload);
-  const destination = new URL("/api/network/shared", target.url);
-  try {
-    const signed = await signFederatedRequest({
-      secret,
-      sender: ctx.chapter.id,
-      method: "POST",
-      url: destination,
-      body: payloadBody
-    });
-    const res = await fetch(destination, {
-      method: "POST",
-      headers: { ...signed, "content-type": "application/json" },
-      body: payloadBody,
-      signal: AbortSignal.timeout(1e4)
-    });
-    const responseBody = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const error = responseBody.error ?? "follower rejected the record";
-      await recordDeliveryAttempt(crmDeps3, {
-        recordId: record.id,
-        targetId: target.id,
-        status: "failed",
-        payloadVersion: 2,
-        error
-      });
-      return { id: target.id, name: target.name, ok: false, status: res.status, error };
-    }
-    await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
-      targetId: target.id,
-      status: "delivered",
-      payloadVersion: 2,
-      ...responseBody.recordId ? { remoteRecordId: responseBody.recordId } : {}
-    });
-    return { id: target.id, name: target.name, ok: true, status: res.status, recordId: responseBody.recordId };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : "delivery failed";
-    await recordDeliveryAttempt(crmDeps3, {
-      recordId: record.id,
-      targetId: target.id,
-      status: "failed",
-      payloadVersion: 2,
-      error
-    });
-    return { id: target.id, name: target.name, ok: false, error };
-  }
-}
 var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/network/push") return null;
   const got = await gate4(req, env, ctx);
@@ -2811,11 +2857,417 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   const record = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
   if (!record) return json({ error: "record not found" }, 404);
   const results = await Promise.all(
-    targets.map((target) => pushOne(got.db, ctx, target, record))
+    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record))
   );
   return json({ ok: results.every((result) => result.ok), results });
 };
 
+// src/worker-routes-network-records.ts
+import { listRecords } from "@odla-ai/crm";
+import { signFederatedRequest as signFederatedRequest3, verifyFederatedRequest as verifyFederatedRequest3 } from "@odla-ai/db";
+var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
+var MAX_PAGE = 50;
+var MAX_OFFSET = 1e4;
+var MAX_SEARCH = 200;
+async function gate5(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function integer(value, fallback, min, max) {
+  if (value == null || value === "") return fallback;
+  if (!/^\d+$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
+}
+function projectRecord(record, allowed) {
+  const fields = Object.fromEntries(
+    allowed.flatMap((name) => Object.prototype.hasOwnProperty.call(record.fields, name) ? [[name, record.fields[name]]] : [])
+  );
+  return {
+    id: record.id,
+    type: record.type,
+    name: record.name,
+    ...record.stage ? { stage: record.stage } : {},
+    fields,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
+}
+var handleNetworkRecords = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/network/records") return null;
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  const readers = ctx.chapter.network.readers;
+  if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest3(req, {
+    secret,
+    senders: readers.map((reader2) => reader2.id)
+  });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  const reader = readers.find((candidate) => candidate.id === verified.sender);
+  const type = url.searchParams.get("type") ?? "";
+  const allowed = reader?.fields[type];
+  if (!IDENTIFIER.test(type) || !allowed) return json({ error: "record type is not shared with this reader" }, 403);
+  const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
+  const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
+  const search = (url.searchParams.get("search") ?? "").trim();
+  if (limit == null || offset == null || search.length > MAX_SEARCH) {
+    return json({ error: "invalid pagination or search parameters" }, 400);
+  }
+  const page = await listRecords(
+    { crm: ctx.chapter.crm, db },
+    {
+      type,
+      limit,
+      offset,
+      ...search ? { search } : {},
+      sort: { field: "updatedAt", dir: "desc" }
+    }
+  );
+  const response = {
+    version: 1,
+    site: { id: ctx.chapter.id, name: ctx.chapter.name },
+    type,
+    records: page.records.map((record) => projectRecord(record, allowed)),
+    total: page.total,
+    limit: page.limit,
+    offset: page.offset
+  };
+  return json(response);
+};
+function targetFor(ctx, id) {
+  return ctx.chapter.network.targets.find((target) => target.id === id);
+}
+async function readTargetRecords(db, env, ctx, target, query) {
+  const secret = await getVaultSecret(db, target.secretName);
+  if (!secret) return { ok: false, error: "edge secret is missing" };
+  const destination = new URL("/api/network/records", target.url);
+  destination.search = query.toString();
+  try {
+    const headers = await signFederatedRequest3({
+      secret,
+      sender: ctx.chapter.id,
+      method: "GET",
+      url: destination
+    });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      headers,
+      signal: AbortSignal.timeout(1e4)
+    });
+    const body = await response.json().catch(() => null);
+    if (!response.ok || !body || !("version" in body) || body.version !== 1 || !("site" in body) || body.site.id !== target.id || !Array.isArray(body.records)) {
+      const upstream = body && "error" in body && typeof body.error === "string" ? body.error : void 0;
+      return {
+        ok: false,
+        error: upstream ?? (response.ok ? "invalid follower record response" : `follower returned ${response.status}`)
+      };
+    }
+    return { ok: true, page: body };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : "record read failed" };
+  }
+}
+var handleAdminNetworkRecords = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/admin/network/records") return null;
+  const got = await gate5(req, env, ctx);
+  if ("response" in got) return got.response;
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const type = url.searchParams.get("type") ?? "";
+  const target = targetFor(ctx, targetId);
+  if (!target || !IDENTIFIER.test(type)) return json({ error: "configured targetId and record type are required" }, 400);
+  const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
+  const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
+  const search = (url.searchParams.get("search") ?? "").trim();
+  if (limit == null || offset == null || search.length > MAX_SEARCH) {
+    return json({ error: "invalid pagination or search parameters" }, 400);
+  }
+  const query = new URLSearchParams({ type, limit: String(limit), offset: String(offset) });
+  if (search) query.set("search", search);
+  const result = await readTargetRecords(
+    got.db,
+    env,
+    ctx,
+    target,
+    query
+  );
+  return result.ok ? json(result.page) : json({ error: result.error }, 502);
+};
+
+// src/worker-routes-network-notes.ts
+var IDENTIFIER2 = /^[a-z][a-zA-Z0-9_]*$/;
+var RECORD_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var MAX_NOTE = 4e3;
+async function gate6(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function noteIdentity(url, ctx) {
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  const configured = ctx.chapter.network.targets.some((target) => target.id === targetId);
+  if (!configured || !IDENTIFIER2.test(recordType) || !RECORD_ID.test(recordId)) return null;
+  return {
+    targetId,
+    recordType,
+    recordId,
+    recordKey: `${targetId}:${recordType}:${recordId}`
+  };
+}
+function asNote(row) {
+  return {
+    id: String(row.id),
+    targetId: String(row.targetId),
+    recordType: String(row.recordType),
+    recordId: String(row.recordId),
+    body: String(row.body),
+    authorId: String(row.authorId),
+    ...typeof row.authorEmail === "string" ? { authorEmail: row.authorEmail } : {},
+    createdAt: Number(row.createdAt)
+  };
+}
+var handleAdminNetworkNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/admin/network/notes" || req.method !== "GET" && req.method !== "POST") return null;
+  const got = await gate6(req, env, ctx);
+  if ("response" in got) return got.response;
+  const identity = noteIdentity(url, ctx);
+  if (!identity) return json({ error: "valid targetId, type, and recordId are required" }, 400);
+  if (req.method === "GET") {
+    const result = await got.db.query({
+      networkNotes: {
+        $: {
+          where: { recordKey: identity.recordKey },
+          order: { createdAt: "desc" },
+          limit: 100
+        }
+      }
+    });
+    return json({ notes: (result.networkNotes ?? []).map((row) => asNote(row)) });
+  }
+  const contentLength = Number(req.headers.get("content-length") ?? 0);
+  if (contentLength > MAX_NOTE * 2) return json({ error: "note is too large" }, 413);
+  let input;
+  try {
+    input = await req.json();
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const body = typeof input.body === "string" ? input.body.trim() : "";
+  if (!body || body.length > MAX_NOTE) return json({ error: `note must be 1\u2013${MAX_NOTE} characters` }, 400);
+  const id = crypto.randomUUID();
+  const note = {
+    id,
+    targetId: identity.targetId,
+    recordType: identity.recordType,
+    recordId: identity.recordId,
+    body,
+    authorId: got.user.userId,
+    ...got.user.email ? { authorEmail: got.user.email } : {},
+    createdAt: Date.now()
+  };
+  await got.db.transact([{
+    t: "update",
+    ns: "networkNotes",
+    id,
+    attrs: { ...note, recordKey: identity.recordKey }
+  }]);
+  return json({ note }, 201);
+};
+
+// src/worker-routes-network-shared-notes.ts
+import {
+  addActivity,
+  CRM_NS,
+  getRecord as getRecord2
+} from "@odla-ai/crm";
+import { signFederatedRequest as signFederatedRequest4, verifyFederatedRequest as verifyFederatedRequest4 } from "@odla-ai/db";
+var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
+var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var MAX_NOTE2 = 4e3;
+var NETWORK_META = "chapterNetwork";
+async function gate7(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function sharedNote(activity, sourceId) {
+  const meta = activity.meta?.[NETWORK_META];
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) return null;
+  const value = meta;
+  if (value.version !== 1 || value.sourceId !== sourceId || typeof value.body !== "string") return null;
+  return {
+    id: activity.id,
+    sourceId,
+    recordType: String(value.recordType ?? ""),
+    recordId: activity.recordId,
+    body: value.body,
+    createdAt: activity.createdAt
+  };
+}
+async function listSharedNotes(db, sourceId, recordId) {
+  const result = await db.query({
+    [CRM_NS.activity]: {
+      $: {
+        where: {
+          and: [
+            { recordId },
+            { authorId: `network:${sourceId}` }
+          ]
+        },
+        order: { createdAt: "desc" },
+        limit: 100
+      }
+    }
+  });
+  return (result[CRM_NS.activity] ?? []).flatMap((activity) => {
+    const note = sharedNote(activity, sourceId);
+    return note ? [note] : [];
+  });
+}
+function sourceLabel(sourceId) {
+  return sourceId.split("-").map((word) => word ? `${word[0]?.toUpperCase()}${word.slice(1)}` : word).join(" ");
+}
+var handleNetworkSharedNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
+  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE2 * 2) {
+    return json({ error: "note is too large" }, 413);
+  }
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  const readers = ctx.chapter.network.readers;
+  if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest4(req, {
+    secret,
+    senders: readers.map((reader2) => reader2.id)
+  });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  const reader = readers.find((candidate) => candidate.id === verified.sender);
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
+    return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
+  }
+  const record = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
+  if (!record || record.type !== recordType) return json({ error: "record not found" }, 404);
+  if (req.method === "GET") {
+    return json({
+      version: 1,
+      site: { id: ctx.chapter.id, name: ctx.chapter.name },
+      notes: await listSharedNotes(db, verified.sender, recordId)
+    });
+  }
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const body = typeof input.body === "string" ? input.body.trim() : "";
+  const mutationId = typeof input.mutationId === "string" ? input.mutationId : "";
+  if (!body || body.length > MAX_NOTE2 || !MUTATION_ID.test(mutationId)) {
+    return json({ error: `body must be 1\u2013${MAX_NOTE2} characters and mutationId must be valid` }, 400);
+  }
+  const createdAt = Date.now();
+  const id = `network:${verified.sender}:${mutationId}`;
+  const result = await addActivity(
+    {
+      crm: ctx.chapter.crm,
+      db,
+      now: () => createdAt,
+      newId: () => id
+    },
+    {
+      recordId,
+      kind: "note",
+      body: `Shared by ${sourceLabel(verified.sender)}: ${body}`,
+      authorId: `network:${verified.sender}`,
+      meta: {
+        [NETWORK_META]: {
+          version: 1,
+          sourceId: verified.sender,
+          recordType,
+          body
+        }
+      },
+      mutationId: id
+    }
+  );
+  const note = {
+    id,
+    sourceId: verified.sender,
+    recordType,
+    recordId,
+    body,
+    createdAt
+  };
+  return json({ version: 1, site: { id: ctx.chapter.id, name: ctx.chapter.name }, note, duplicate: result.duplicate }, 201);
+};
+function targetFor2(ctx, id) {
+  return ctx.chapter.network.targets.find((target) => target.id === id);
+}
+var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/admin/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
+  const got = await gate7(req, env, ctx);
+  if ("response" in got) return got.response;
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  const target = targetFor2(ctx, targetId);
+  if (!target || !target.sharedNotes.includes(recordType) || !IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId)) {
+    return json({ error: "configured targetId, type, and recordId are required" }, 400);
+  }
+  let body = "";
+  if (req.method === "POST") {
+    let input;
+    try {
+      input = await req.json();
+    } catch {
+      return json({ error: "invalid JSON body" }, 400);
+    }
+    const note = typeof input.body === "string" ? input.body.trim() : "";
+    if (!note || note.length > MAX_NOTE2) return json({ error: `note must be 1\u2013${MAX_NOTE2} characters` }, 400);
+    body = JSON.stringify({ body: note, mutationId: crypto.randomUUID() });
+  }
+  const secret = await getVaultSecret(got.db, target.secretName);
+  if (!secret) return json({ error: "edge secret is missing" }, 502);
+  const destination = new URL("/api/network/shared-notes", target.url);
+  destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
+  try {
+    const headers = await signFederatedRequest4({
+      secret,
+      sender: ctx.chapter.id,
+      method: req.method,
+      url: destination,
+      ...body ? { body } : {}
+    });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      method: req.method,
+      headers: { ...headers, ...body ? { "content-type": "application/json" } : {} },
+      ...body ? { body } : {},
+      signal: AbortSignal.timeout(1e4)
+    });
+    const payload = await response.json().catch(() => null);
+    const site = payload?.site;
+    if (!response.ok || !payload || site?.id !== target.id) {
+      return json({
+        error: typeof payload?.error === "string" ? payload.error : `follower returned ${response.status}`
+      }, 502);
+    }
+    return json(payload, req.method === "POST" ? 201 : 200);
+  } catch (error) {
+    return json({ error: error instanceof Error ? error.message : "shared note request failed" }, 502);
+  }
+};
+
 // src/worker-routes-formation.ts
 import { createRecord as createRecord3 } from "@odla-ai/crm";
 
@@ -2918,6 +3370,8 @@ var BUILTIN_ROUTES = [
   handleCrm,
   handleNetworkShared,
   handleNetworkSnapshot,
+  handleNetworkRecords,
+  handleNetworkSharedNotes,
   handleFormation,
   handleMember,
   handleSchedule,
@@ -2948,6 +3402,9 @@ var BUILTIN_ROUTES = [
   handleAdminNetworkTargets,
   handleAdminNetworkRollup,
   handleAdminNetworkPush,
+  handleAdminNetworkRecords,
+  handleAdminNetworkNotes,
+  handleAdminNetworkSharedNotes,
   // API requests must never fall through to an SPA asset response. Hosts still
   // get first refusal through options.routes, then this terminates unknown API
   // paths with an explicit machine-readable 404.