@odla-ai/chapter 0.26.1 → 0.27.1

package/dist/worker/index.d.cts

@@ -36,7 +36,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -74,11 +74,31 @@ interface ChapterNetworkTarget {
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -113,10 +133,18 @@ interface ResolvedNetworkTarget {
     binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -377,8 +405,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -587,7 +615,7 @@ type Route = (req: Request, url: URL, env: ChapterEnv, ctx: WorkerContext) => Pr
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the source-aware admin gate, the mounted @odla-ai/crm routes, the
  * hub→chapter network projection, and the static-asset fallback. Hub mode serves
- * /api/health, /api/config, /api/me, /api/crm/*, /api/network/shared; chapter mode
+ * /api/health, /api/config, /api/me, /api/crm/*, /api/network/*; chapter mode
  * adds the public member surface (join/apply/pay/book) and the admin surface
  * (/api/admin/*).
  *

package/dist/worker/index.d.ts

@@ -36,7 +36,7 @@ interface ChapterCopy {
     admin: {
         auth: TextFields<"checking" | "notAuthorized" | "accountNotAuthorized" | "thisAccount" | "signOut" | "loading" | "signInNotConfigured" | "missingPublishableKey" | "noWorkspaces" | "signInTagline">;
         shell: TextFields<"adminRole" | "adminConsole" | "adminName" | "navigationLabel">;
-        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
+        workspaces: TextFields<"dashboard" | "overview" | "billing" | "people" | "network" | "portfolio" | "settings" | "calendar" | "email" | "chapters" | "formations" | "dealFlow" | "dashboardViewsLabel" | "settingsViewsLabel" | "collectionsLabel" | "portfolioViewsLabel">;
         dashboard: TextFields<"loading" | "loadFailed" | "upcomingCalls" | "callsNeedAttention" | "noUpcomingCalls" | "drift" | "open" | "meet" | "applications" | "newMembers" | "newMembersUnavailable" | "revenueAdded" | "revenue" | "revenueUnavailable" | "pipeline" | "pipelineLabel" | "thisWeek" | "noChange" | "activeMemberships" | "annualRunRate" | "testMode">;
         billing: TextFields<"loading" | "loadFailed" | "notConfigured" | "active" | "annualized" | "renewingSoon" | "pastDue" | "subscriptions" | "testMode" | "truncated" | "name" | "email" | "application" | "subscription" | "cancelling" | "amount" | "renews">;
         availability: TextFields<"loading" | "loadFailed" | "saved" | "title" | "days" | "startHour" | "endHour" | "slotMinutes" | "minNoticeHours" | "windowDays" | "timezone" | "summaryTemplate" | "save"> & {
@@ -74,11 +74,31 @@ interface ChapterNetworkTarget {
     /** Per-record-type field allowlist. If present, omitted types cannot be sent
      * to this target. Without it, package-safe person/company defaults apply. */
     fields?: Record<string, readonly string[]>;
-}
-/** Leader/follower network configuration. Followers need no code config to
- * receive records; they only vault `network_share_secret`. */
+    /** Record types on which leader admins may deliberately share notes with
+     * this follower. Omitted by default: a target never gains write permission
+     * merely because its records are browsable. */
+    sharedNotes?: readonly string[];
+}
+/** One signed peer allowed to browse a privacy-bounded projection of this
+ * site's CRM. The follower owns this allowlist; a leader target declaration
+ * cannot widen it. */
+interface ChapterNetworkReader {
+    /** Stable app/site slug expected in the signed federation envelope. */
+    id: string;
+    /** Per-record-type field allowlist. Omitted types and fields never leave
+     * this site. Record id, name, stage, and timestamps are bounded metadata. */
+    fields: Record<string, readonly string[]>;
+    /** Record types on which this reader may append an explicitly shared note.
+     * Omitted by default: browse permission never silently grants write access.
+     * Shared notes land in the follower CRM activity feed. */
+    sharedNotes?: readonly string[];
+}
+/** Leader/follower network configuration. A follower needs no code config to
+ * receive pushed records. It must explicitly declare `readers` before any peer
+ * can browse its CRM. */
 interface ChapterNetwork {
     targets?: readonly ChapterNetworkTarget[];
+    readers?: readonly ChapterNetworkReader[];
 }
 /** Public chapter-formation intake backed by one CRM record type. The host owns
  * the branded form; Chapter owns the bounded, idempotent write contract. */
@@ -113,10 +133,18 @@ interface ResolvedNetworkTarget {
     binding?: string;
     secretName: string;
     fields?: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
+}
+/** A validated follower-owned record projection for one signed reader. */
+interface ResolvedNetworkReader {
+    id: string;
+    fields: Record<string, readonly string[]>;
+    sharedNotes: readonly string[];
 }
 /** Fully-resolved leader network configuration. */
 interface ResolvedNetwork {
     targets: readonly ResolvedNetworkTarget[];
+    readers: readonly ResolvedNetworkReader[];
 }
 
 /** Which feature profile a site runs. `chapter` is the full public member site
@@ -377,8 +405,8 @@ interface ChapterConfig {
     /** User-visible language for packaged Chapter surfaces. Recursively partial;
      * `defineChapter()` resolves every omitted leaf from the package defaults. */
     copy?: ChapterCopyInput;
-    /** Leader → follower delivery targets. Secret values stay in the leader
-     * tenant vault; see {@link ChapterNetworkTarget}. */
+    /** Signed network edges: leader delivery targets and follower-owned,
+     * privacy-bounded record readers. Secret values stay in tenant vaults. */
     network?: ChapterNetwork;
     /** Enable a public, host-rendered formation application workflow. */
     formation?: LeaderFormationConfig;
@@ -587,7 +615,7 @@ type Route = (req: Request, url: URL, env: ChapterEnv, ctx: WorkerContext) => Pr
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the source-aware admin gate, the mounted @odla-ai/crm routes, the
  * hub→chapter network projection, and the static-asset fallback. Hub mode serves
- * /api/health, /api/config, /api/me, /api/crm/*, /api/network/shared; chapter mode
+ * /api/health, /api/config, /api/me, /api/crm/*, /api/network/*; chapter mode
  * adds the public member surface (join/apply/pay/book) and the admin surface
  * (/api/admin/*).
  *

package/dist/worker/index.js

@@ -1901,16 +1901,16 @@ var crmDeps2 = (db, ctx) => ({
 });
 var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const result = await backfillCrm(crmDeps2(gate5.db, ctx));
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const result = await backfillCrm(crmDeps2(gate8.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db } = gate8;
   const sk = await getVaultSecret(db, "clerk_secret_key");
   const [appsRes, usersRes, roleList] = await Promise.all([
     db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 200 } } }),
@@ -1961,9 +1961,9 @@ var handleAdminPeople = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleAccess = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/people/access") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db } = gate8;
   const targetId = url.searchParams.get("userId") ?? "";
   if (!targetId.startsWith("user_")) return json({ error: "invalid userId" }, 400);
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -1974,9 +1974,9 @@ var handleAdminPeopleAccess = async (req, url, env, ctx) => {
 };
 var handleAdminPeopleRole = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/people/role") return null;
-  const gate5 = await adminGate(req, env, ctx);
-  if (gate5 instanceof Response) return gate5;
-  const { db, actor } = gate5;
+  const gate8 = await adminGate(req, env, ctx);
+  if (gate8 instanceof Response) return gate8;
+  const { db, actor } = gate8;
   let body;
   try {
     body = await req.json();
@@ -2739,11 +2739,12 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   const got = await gate4(req, env, ctx);
   if ("response" in got) return got.response;
   return json({
-    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields }) => ({
+    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields, sharedNotes }) => ({
       id,
       name,
       url: targetUrl,
-      types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS)
+      types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS),
+      sharedNotes
     }))
   });
 };
@@ -2861,6 +2862,412 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   return json({ ok: results.every((result) => result.ok), results });
 };
 
+// src/worker-routes-network-records.ts
+import { listRecords } from "@odla-ai/crm";
+import { signFederatedRequest as signFederatedRequest3, verifyFederatedRequest as verifyFederatedRequest3 } from "@odla-ai/db";
+var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
+var MAX_PAGE = 50;
+var MAX_OFFSET = 1e4;
+var MAX_SEARCH = 200;
+async function gate5(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function integer(value, fallback, min, max) {
+  if (value == null || value === "") return fallback;
+  if (!/^\d+$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
+}
+function projectRecord(record, allowed) {
+  const fields = Object.fromEntries(
+    allowed.flatMap((name) => Object.prototype.hasOwnProperty.call(record.fields, name) ? [[name, record.fields[name]]] : [])
+  );
+  return {
+    id: record.id,
+    type: record.type,
+    name: record.name,
+    ...record.stage ? { stage: record.stage } : {},
+    fields,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
+}
+var handleNetworkRecords = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/network/records") return null;
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  const readers = ctx.chapter.network.readers;
+  if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest3(req, {
+    secret,
+    senders: readers.map((reader2) => reader2.id)
+  });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  const reader = readers.find((candidate) => candidate.id === verified.sender);
+  const type = url.searchParams.get("type") ?? "";
+  const allowed = reader?.fields[type];
+  if (!IDENTIFIER.test(type) || !allowed) return json({ error: "record type is not shared with this reader" }, 403);
+  const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
+  const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
+  const search = (url.searchParams.get("search") ?? "").trim();
+  if (limit == null || offset == null || search.length > MAX_SEARCH) {
+    return json({ error: "invalid pagination or search parameters" }, 400);
+  }
+  const page = await listRecords(
+    { crm: ctx.chapter.crm, db },
+    {
+      type,
+      limit,
+      offset,
+      ...search ? { search } : {},
+      sort: { field: "updatedAt", dir: "desc" }
+    }
+  );
+  const response = {
+    version: 1,
+    site: { id: ctx.chapter.id, name: ctx.chapter.name },
+    type,
+    records: page.records.map((record) => projectRecord(record, allowed)),
+    total: page.total,
+    limit: page.limit,
+    offset: page.offset
+  };
+  return json(response);
+};
+function targetFor(ctx, id) {
+  return ctx.chapter.network.targets.find((target) => target.id === id);
+}
+async function readTargetRecords(db, env, ctx, target, query) {
+  const secret = await getVaultSecret(db, target.secretName);
+  if (!secret) return { ok: false, error: "edge secret is missing" };
+  const destination = new URL("/api/network/records", target.url);
+  destination.search = query.toString();
+  try {
+    const headers = await signFederatedRequest3({
+      secret,
+      sender: ctx.chapter.id,
+      method: "GET",
+      url: destination
+    });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      headers,
+      signal: AbortSignal.timeout(1e4)
+    });
+    const body = await response.json().catch(() => null);
+    if (!response.ok || !body || !("version" in body) || body.version !== 1 || !("site" in body) || body.site.id !== target.id || !Array.isArray(body.records)) {
+      const upstream = body && "error" in body && typeof body.error === "string" ? body.error : void 0;
+      return {
+        ok: false,
+        error: upstream ?? (response.ok ? "invalid follower record response" : `follower returned ${response.status}`)
+      };
+    }
+    return { ok: true, page: body };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : "record read failed" };
+  }
+}
+var handleAdminNetworkRecords = async (req, url, env, ctx) => {
+  if (req.method !== "GET" || url.pathname !== "/api/admin/network/records") return null;
+  const got = await gate5(req, env, ctx);
+  if ("response" in got) return got.response;
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const type = url.searchParams.get("type") ?? "";
+  const target = targetFor(ctx, targetId);
+  if (!target || !IDENTIFIER.test(type)) return json({ error: "configured targetId and record type are required" }, 400);
+  const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
+  const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
+  const search = (url.searchParams.get("search") ?? "").trim();
+  if (limit == null || offset == null || search.length > MAX_SEARCH) {
+    return json({ error: "invalid pagination or search parameters" }, 400);
+  }
+  const query = new URLSearchParams({ type, limit: String(limit), offset: String(offset) });
+  if (search) query.set("search", search);
+  const result = await readTargetRecords(
+    got.db,
+    env,
+    ctx,
+    target,
+    query
+  );
+  return result.ok ? json(result.page) : json({ error: result.error }, 502);
+};
+
+// src/worker-routes-network-notes.ts
+var IDENTIFIER2 = /^[a-z][a-zA-Z0-9_]*$/;
+var RECORD_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var MAX_NOTE = 4e3;
+async function gate6(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function noteIdentity(url, ctx) {
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  const configured = ctx.chapter.network.targets.some((target) => target.id === targetId);
+  if (!configured || !IDENTIFIER2.test(recordType) || !RECORD_ID.test(recordId)) return null;
+  return {
+    targetId,
+    recordType,
+    recordId,
+    recordKey: `${targetId}:${recordType}:${recordId}`
+  };
+}
+function asNote(row) {
+  return {
+    id: String(row.id),
+    targetId: String(row.targetId),
+    recordType: String(row.recordType),
+    recordId: String(row.recordId),
+    body: String(row.body),
+    authorId: String(row.authorId),
+    ...typeof row.authorEmail === "string" ? { authorEmail: row.authorEmail } : {},
+    createdAt: Number(row.createdAt)
+  };
+}
+var handleAdminNetworkNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/admin/network/notes" || req.method !== "GET" && req.method !== "POST") return null;
+  const got = await gate6(req, env, ctx);
+  if ("response" in got) return got.response;
+  const identity = noteIdentity(url, ctx);
+  if (!identity) return json({ error: "valid targetId, type, and recordId are required" }, 400);
+  if (req.method === "GET") {
+    const result = await got.db.query({
+      networkNotes: {
+        $: {
+          where: { recordKey: identity.recordKey },
+          order: { createdAt: "desc" },
+          limit: 100
+        }
+      }
+    });
+    return json({ notes: (result.networkNotes ?? []).map((row) => asNote(row)) });
+  }
+  const contentLength = Number(req.headers.get("content-length") ?? 0);
+  if (contentLength > MAX_NOTE * 2) return json({ error: "note is too large" }, 413);
+  let input;
+  try {
+    input = await req.json();
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const body = typeof input.body === "string" ? input.body.trim() : "";
+  if (!body || body.length > MAX_NOTE) return json({ error: `note must be 1\u2013${MAX_NOTE} characters` }, 400);
+  const id = crypto.randomUUID();
+  const note = {
+    id,
+    targetId: identity.targetId,
+    recordType: identity.recordType,
+    recordId: identity.recordId,
+    body,
+    authorId: got.user.userId,
+    ...got.user.email ? { authorEmail: got.user.email } : {},
+    createdAt: Date.now()
+  };
+  await got.db.transact([{
+    t: "update",
+    ns: "networkNotes",
+    id,
+    attrs: { ...note, recordKey: identity.recordKey }
+  }]);
+  return json({ note }, 201);
+};
+
+// src/worker-routes-network-shared-notes.ts
+import {
+  addActivity,
+  CRM_NS,
+  getRecord as getRecord2
+} from "@odla-ai/crm";
+import { signFederatedRequest as signFederatedRequest4, verifyFederatedRequest as verifyFederatedRequest4 } from "@odla-ai/db";
+var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
+var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var MAX_NOTE2 = 4e3;
+var NETWORK_META = "chapterNetwork";
+async function gate7(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
+function sharedNote(activity, sourceId) {
+  const meta = activity.meta?.[NETWORK_META];
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) return null;
+  const value = meta;
+  if (value.version !== 1 || value.sourceId !== sourceId || typeof value.body !== "string") return null;
+  return {
+    id: activity.id,
+    sourceId,
+    recordType: String(value.recordType ?? ""),
+    recordId: activity.recordId,
+    body: value.body,
+    createdAt: activity.createdAt
+  };
+}
+async function listSharedNotes(db, sourceId, recordId) {
+  const result = await db.query({
+    [CRM_NS.activity]: {
+      $: {
+        where: {
+          and: [
+            { recordId },
+            { authorId: `network:${sourceId}` }
+          ]
+        },
+        order: { createdAt: "desc" },
+        limit: 100
+      }
+    }
+  });
+  return (result[CRM_NS.activity] ?? []).flatMap((activity) => {
+    const note = sharedNote(activity, sourceId);
+    return note ? [note] : [];
+  });
+}
+function sourceLabel(sourceId) {
+  return sourceId.split("-").map((word) => word ? `${word[0]?.toUpperCase()}${word.slice(1)}` : word).join(" ");
+}
+var handleNetworkSharedNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
+  if (req.method === "POST" && Number(req.headers.get("content-length") ?? 0) > MAX_NOTE2 * 2) {
+    return json({ error: "note is too large" }, 413);
+  }
+  const db = ctx.makeDb(env);
+  const secret = await getVaultSecret(db, "network_share_secret");
+  const readers = ctx.chapter.network.readers;
+  if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
+  const verified = await verifyFederatedRequest4(req, {
+    secret,
+    senders: readers.map((reader2) => reader2.id)
+  });
+  if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
+  const reader = readers.find((candidate) => candidate.id === verified.sender);
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
+    return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
+  }
+  const record = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
+  if (!record || record.type !== recordType) return json({ error: "record not found" }, 404);
+  if (req.method === "GET") {
+    return json({
+      version: 1,
+      site: { id: ctx.chapter.id, name: ctx.chapter.name },
+      notes: await listSharedNotes(db, verified.sender, recordId)
+    });
+  }
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const body = typeof input.body === "string" ? input.body.trim() : "";
+  const mutationId = typeof input.mutationId === "string" ? input.mutationId : "";
+  if (!body || body.length > MAX_NOTE2 || !MUTATION_ID.test(mutationId)) {
+    return json({ error: `body must be 1\u2013${MAX_NOTE2} characters and mutationId must be valid` }, 400);
+  }
+  const createdAt = Date.now();
+  const id = `network:${verified.sender}:${mutationId}`;
+  const result = await addActivity(
+    {
+      crm: ctx.chapter.crm,
+      db,
+      now: () => createdAt,
+      newId: () => id
+    },
+    {
+      recordId,
+      kind: "note",
+      body: `Shared by ${sourceLabel(verified.sender)}: ${body}`,
+      authorId: `network:${verified.sender}`,
+      meta: {
+        [NETWORK_META]: {
+          version: 1,
+          sourceId: verified.sender,
+          recordType,
+          body
+        }
+      },
+      mutationId: id
+    }
+  );
+  const note = {
+    id,
+    sourceId: verified.sender,
+    recordType,
+    recordId,
+    body,
+    createdAt
+  };
+  return json({ version: 1, site: { id: ctx.chapter.id, name: ctx.chapter.name }, note, duplicate: result.duplicate }, 201);
+};
+function targetFor2(ctx, id) {
+  return ctx.chapter.network.targets.find((target) => target.id === id);
+}
+var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
+  if (url.pathname !== "/api/admin/network/shared-notes" || req.method !== "GET" && req.method !== "POST") return null;
+  const got = await gate7(req, env, ctx);
+  if ("response" in got) return got.response;
+  const targetId = url.searchParams.get("targetId") ?? "";
+  const recordType = url.searchParams.get("type") ?? "";
+  const recordId = url.searchParams.get("recordId") ?? "";
+  const target = targetFor2(ctx, targetId);
+  if (!target || !target.sharedNotes.includes(recordType) || !IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId)) {
+    return json({ error: "configured targetId, type, and recordId are required" }, 400);
+  }
+  let body = "";
+  if (req.method === "POST") {
+    let input;
+    try {
+      input = await req.json();
+    } catch {
+      return json({ error: "invalid JSON body" }, 400);
+    }
+    const note = typeof input.body === "string" ? input.body.trim() : "";
+    if (!note || note.length > MAX_NOTE2) return json({ error: `note must be 1\u2013${MAX_NOTE2} characters` }, 400);
+    body = JSON.stringify({ body: note, mutationId: crypto.randomUUID() });
+  }
+  const secret = await getVaultSecret(got.db, target.secretName);
+  if (!secret) return json({ error: "edge secret is missing" }, 502);
+  const destination = new URL("/api/network/shared-notes", target.url);
+  destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
+  try {
+    const headers = await signFederatedRequest4({
+      secret,
+      sender: ctx.chapter.id,
+      method: req.method,
+      url: destination,
+      ...body ? { body } : {}
+    });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      method: req.method,
+      headers: { ...headers, ...body ? { "content-type": "application/json" } : {} },
+      ...body ? { body } : {},
+      signal: AbortSignal.timeout(1e4)
+    });
+    const payload = await response.json().catch(() => null);
+    const site = payload?.site;
+    if (!response.ok || !payload || site?.id !== target.id) {
+      return json({
+        error: typeof payload?.error === "string" ? payload.error : `follower returned ${response.status}`
+      }, 502);
+    }
+    return json(payload, req.method === "POST" ? 201 : 200);
+  } catch (error) {
+    return json({ error: error instanceof Error ? error.message : "shared note request failed" }, 502);
+  }
+};
+
 // src/worker-routes-formation.ts
 import { createRecord as createRecord3 } from "@odla-ai/crm";
 
@@ -2963,6 +3370,8 @@ var BUILTIN_ROUTES = [
   handleCrm,
   handleNetworkShared,
   handleNetworkSnapshot,
+  handleNetworkRecords,
+  handleNetworkSharedNotes,
   handleFormation,
   handleMember,
   handleSchedule,
@@ -2993,6 +3402,9 @@ var BUILTIN_ROUTES = [
   handleAdminNetworkTargets,
   handleAdminNetworkRollup,
   handleAdminNetworkPush,
+  handleAdminNetworkRecords,
+  handleAdminNetworkNotes,
+  handleAdminNetworkSharedNotes,
   // API requests must never fall through to an SPA asset response. Hosts still
   // get first refusal through options.routes, then this terminates unknown API
   // paths with an explicit machine-readable 404.