@odla-ai/chapter 0.38.1 → 0.39.1

package/dist/worker/index.js

@@ -516,9 +516,9 @@ function canonicalValue(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalValue).join(",")}]`;
   if (typeof value !== "object") throw new TypeError("signup control contains an unsupported value");
-  const record3 = value;
-  const entries = Object.keys(record3).sort().flatMap((key) => {
-    const item = record3[key];
+  const record4 = value;
+  const entries = Object.keys(record4).sort().flatMap((key) => {
+    const item = record4[key];
     return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue(item)}`];
   });
   return `{${entries.join(",")}}`;
@@ -718,8 +718,8 @@ var APPLICATION_LABELS = {
   state: "State"
 };
 function humanize(id) {
-  const text3 = id.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
-  return text3 ? `${text3[0].toUpperCase()}${text3.slice(1)}` : id;
+  const text4 = id.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  return text4 ? `${text4[0].toUpperCase()}${text4.slice(1)}` : id;
 }
 function applicationDefs(chapter) {
   try {
@@ -910,8 +910,8 @@ async function clerkListUsers(secretKey, fetchImpl = fetch) {
     const data = await clerkGet(`/v1/users?limit=${PAGE}&offset=${offset}`, secretKey, fetchImpl);
     const page = Array.isArray(data) ? data : [];
     for (const u of page) {
-      const record3 = toRecord(u);
-      if (record3) out.push(record3);
+      const record4 = toRecord(u);
+      if (record4) out.push(record4);
     }
     if (page.length < PAGE) break;
   }
@@ -973,34 +973,34 @@ function networkSourceTag(type, hubRecordId, sourceId) {
   if (readable && raw.length <= 64) return raw;
   return `network:${typeKey.slice(0, 16)}:${shortHash(`${sourceId ?? ""}\0${type}\0${hubRecordId}`)}`;
 }
-function normalizeSharedRecord(record3, fallbackSourceId = "legacy-source") {
-  if ("input" in record3 && record3.version === 2) {
+function normalizeSharedRecord(record4, fallbackSourceId = "legacy-source") {
+  if ("input" in record4 && record4.version === 2) {
     return {
       version: 2,
-      sourceId: record3.source.siteId,
-      sourceRecordId: record3.source.recordId,
-      type: record3.type,
-      input: record3.input
+      sourceId: record4.source.siteId,
+      sourceRecordId: record4.source.recordId,
+      type: record4.type,
+      input: record4.input
     };
   }
-  if ("input" in record3) {
+  if ("input" in record4) {
     return {
       version: 1,
       sourceId: fallbackSourceId,
-      sourceRecordId: record3.hubRecordId,
-      type: record3.type,
-      input: record3.input
+      sourceRecordId: record4.hubRecordId,
+      type: record4.type,
+      input: record4.input
     };
   }
-  if ("type" in record3 && record3.type === "company") {
-    const input = { name: record3.name };
+  if ("type" in record4 && record4.type === "company") {
+    const input = { name: record4.name };
     for (const key of ["domain", "industry", "location", "linkedin", "notes"]) {
-      if (record3[key]) input[key] = record3[key];
+      if (record4[key]) input[key] = record4[key];
     }
     return {
       version: 1,
       sourceId: fallbackSourceId,
-      sourceRecordId: record3.hubRecordId,
+      sourceRecordId: record4.hubRecordId,
       type: "company",
       input
     };
@@ -1008,28 +1008,28 @@ function normalizeSharedRecord(record3, fallbackSourceId = "legacy-source") {
   return {
     version: 1,
     sourceId: fallbackSourceId,
-    sourceRecordId: record3.hubRecordId,
+    sourceRecordId: record4.hubRecordId,
     type: "person",
-    input: sharedPersonInput(record3)
+    input: sharedPersonInput(record4)
   };
 }
-function sharedRecordFromCrm(crm, record3, target, sourceId) {
-  if (target.fields && !target.fields[record3.type]) {
-    throw new Error(`${target.name} does not accept "${record3.type}" records`);
+function sharedRecordFromCrm(crm, record4, target, sourceId) {
+  if (target.fields && !target.fields[record4.type]) {
+    throw new Error(`${target.name} does not accept "${record4.type}" records`);
   }
-  const def = crm.type(record3.type);
-  const fields = target.fields?.[record3.type] ?? DEFAULT_SHARE_FIELDS[record3.type];
+  const def = crm.type(record4.type);
+  const fields = target.fields?.[record4.type] ?? DEFAULT_SHARE_FIELDS[record4.type];
   if (!fields) {
-    throw new Error(`${target.name} requires an explicit field allowlist for "${record3.type}" records`);
+    throw new Error(`${target.name} requires an explicit field allowlist for "${record4.type}" records`);
   }
   const nameField = def.nameField ?? "name";
   const input = {};
   for (const field of /* @__PURE__ */ new Set([nameField, ...fields])) {
-    const value = record3.fields?.[field];
+    const value = record4.fields?.[field];
     if (value !== void 0) input[field] = value;
   }
-  if (input[nameField] === void 0) input[nameField] = record3.name;
-  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record3.id }, type: record3.type, input } : { version: 1, type: record3.type, hubRecordId: record3.id, input };
+  if (input[nameField] === void 0) input[nameField] = record4.name;
+  return sourceId ? { version: 2, source: { siteId: sourceId, recordId: record4.id }, type: record4.type, input } : { version: 1, type: record4.type, hubRecordId: record4.id, input };
 }
 async function upsertPerson(deps, opts) {
   const email = opts.email.toLowerCase();
@@ -1043,11 +1043,11 @@ async function upsertPerson(deps, opts) {
   const created = await createRecord(crmDeps3, { type: "person", input: opts.input, mutationId: opts.mutationId });
   return { recordId: created.id };
 }
-async function findSharedRecord(deps, record3, tag) {
+async function findSharedRecord(deps, record4, tag) {
   const structured = await getRecordByOrigin(
     { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId },
-    record3.sourceId,
-    record3.sourceRecordId
+    record4.sourceId,
+    record4.sourceRecordId
   );
   if (structured) return structured;
   const mapped = await deps.db.query({ crm_tag: { $: { where: { tag }, limit: 1 } } });
@@ -1056,53 +1056,53 @@ async function findSharedRecord(deps, record3, tag) {
     const found = await deps.db.query({ crm_record: { $: { where: { id: mappedId }, limit: 1 } } });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const def = deps.crm.type(record3.type);
+  const def = deps.crm.type(record4.type);
   const emailField = def.emailField;
-  if (emailField && typeof record3.input[emailField] === "string") {
-    const primaryEmail = record3.input[emailField].toLowerCase();
+  if (emailField && typeof record4.input[emailField] === "string") {
+    const primaryEmail = record4.input[emailField].toLowerCase();
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record3.type, primaryEmail }, limit: 1 } }
+      crm_record: { $: { where: { type: record4.type, primaryEmail }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
-  const domain = record3.input.domain;
+  const domain = record4.input.domain;
   const domainSlot = def.fields.domain?.slot;
   if (typeof domain === "string" && domainSlot) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record3.type, [domainSlot]: domain }, limit: 1 } }
+      crm_record: { $: { where: { type: record4.type, [domainSlot]: domain }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   const nameField = def.nameField ?? "name";
-  const name = record3.input[nameField];
-  if (record3.type === "company" && typeof name === "string" && name.trim()) {
+  const name = record4.input[nameField];
+  if (record4.type === "company" && typeof name === "string" && name.trim()) {
     const found = await deps.db.query({
-      crm_record: { $: { where: { type: record3.type, name: name.trim() }, limit: 1 } }
+      crm_record: { $: { where: { type: record4.type, name: name.trim() }, limit: 1 } }
     });
     if (found.crm_record?.[0]) return found.crm_record[0];
   }
   return void 0;
 }
 async function projectSharedRecord(deps, shared, options = {}) {
-  const record3 = normalizeSharedRecord(shared, options.sourceId);
-  if (!record3.type.trim() || !record3.sourceId.trim() || !record3.sourceRecordId.trim()) {
+  const record4 = normalizeSharedRecord(shared, options.sourceId);
+  if (!record4.type.trim() || !record4.sourceId.trim() || !record4.sourceRecordId.trim()) {
     throw new Error("type, source site id, and source record id must be non-empty");
   }
-  if (options.sourceId && options.sourceId !== record3.sourceId) {
+  if (options.sourceId && options.sourceId !== record4.sourceId) {
     throw new Error("signed sender does not match payload source");
   }
-  const tag = networkSourceTag(record3.type, record3.sourceRecordId, record3.version === 2 ? record3.sourceId : void 0);
+  const tag = networkSourceTag(record4.type, record4.sourceRecordId, record4.version === 2 ? record4.sourceId : void 0);
   const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const existing = await findSharedRecord(deps, record3, tag);
+  const existing = await findSharedRecord(deps, record4, tag);
   let recordId;
   if (existing && typeof existing.id === "string") {
-    await updateRecord(crmDeps3, { id: existing.id, input: record3.input });
+    await updateRecord(crmDeps3, { id: existing.id, input: record4.input });
     recordId = existing.id;
   } else {
-    recordId = `network_${shortHash(`${record3.sourceId}\0${record3.type}\0${record3.sourceRecordId}`)}`;
+    recordId = `network_${shortHash(`${record4.sourceId}\0${record4.type}\0${record4.sourceRecordId}`)}`;
     await createRecord({ ...crmDeps3, newId: () => recordId }, {
-      type: record3.type,
-      input: record3.input,
+      type: record4.type,
+      input: record4.input,
       mutationId: `share-create:${tag}`
     });
   }
@@ -1112,10 +1112,10 @@ async function projectSharedRecord(deps, shared, options = {}) {
   );
   await upsertRecordOrigin(crmDeps3, {
     recordId,
-    sourceId: record3.sourceId,
-    sourceRecordId: record3.sourceRecordId,
+    sourceId: record4.sourceId,
+    sourceRecordId: record4.sourceRecordId,
     ...options.sourceUrl ? { sourceUrl: options.sourceUrl } : {},
-    payloadVersion: record3.version
+    payloadVersion: record4.version
   });
   return { recordId };
 }
@@ -1254,10 +1254,10 @@ function planDelivery(input) {
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
   const to = redirect ? input.group.debugEmail : input.to;
   const subject = (redirect ? "[dev] " : "") + render(tpl.subject, vars);
-  const text3 = redirect ? `(dev redirect; original recipient: ${input.to})
+  const text4 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + render(tpl.text, vars) : render(tpl.text, vars);
-  return { deliver: true, transport, to, subject, text: text3, redirected: redirect };
+  return { deliver: true, transport, to, subject, text: text4, redirected: redirect };
 }
 
 // src/notify.ts
@@ -2040,8 +2040,8 @@ var handleNetworkShared = async (req, url, env, ctx) => {
       payload,
       sourceId ? { sourceId } : {}
     );
-    const record3 = normalizeSharedRecord(payload, sourceId);
-    return json({ recordId, type: record3.type });
+    const record4 = normalizeSharedRecord(payload, sourceId);
+    return json({ recordId, type: record4.type });
   } catch (error) {
     return json({
       error: error instanceof Error ? error.message : "invalid shared record"
@@ -2095,10 +2095,10 @@ function boundedString(value, path, errors, max, required = false) {
     errors.push(`${path} must be a string`);
     return void 0;
   }
-  const text3 = value.trim();
-  if (required && !text3) errors.push(`${path} is required`);
-  if (text3.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
-  return text3;
+  const text4 = value.trim();
+  if (required && !text4) errors.push(`${path} is required`);
+  if (text4.length > max) errors.push(`${path} must be at most ${max.toLocaleString("en-US")} characters`);
+  return text4;
 }
 function validateMembershipPageDocument(input, options = {}) {
   const errors = [];
@@ -2147,8 +2147,8 @@ function validateMembershipPageDocument(input, options = {}) {
       else {
         if (item.benefits.length > MAX_BENEFITS) errors.push(`${path}.benefits supports at most ${MAX_BENEFITS} entries`);
         benefits = item.benefits.slice(0, MAX_BENEFITS).flatMap((benefit, benefitIndex) => {
-          const text3 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
-          return text3 ? [text3] : [];
+          const text4 = boundedString(benefit, `${path}.benefits[${benefitIndex}]`, errors, 2e3, true);
+          return text4 ? [text4] : [];
         });
       }
     }
@@ -2478,9 +2478,9 @@ function canonicalValue2(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalValue2).join(",")}]`;
   if (typeof value !== "object") throw new TypeError("member content contains an unsupported value");
-  const record3 = value;
-  const entries = Object.keys(record3).sort().flatMap((key) => {
-    const item = record3[key];
+  const record4 = value;
+  const entries = Object.keys(record4).sort().flatMap((key) => {
+    const item = record4[key];
     return item === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue2(item)}`];
   });
   return `{${entries.join(",")}}`;
@@ -2910,9 +2910,9 @@ var handleMemberContentControl = async (req, url, env, ctx) => {
     tiers
   });
   if (!checked.ok) return reject2("invalid_document", 400, checked.errors);
-  const local2 = await loadLocalMemberContent(db, ctx.chapter.id, env.ODLA_ENV);
-  if (local2) {
-    const localCheck = validateMemberContentDocument(local2.document, {
+  const local3 = await loadLocalMemberContent(db, ctx.chapter.id, env.ODLA_ENV);
+  if (local3) {
+    const localCheck = validateMemberContentDocument(local3.document, {
       sourceType: "chapter",
       sourceAppId: ctx.chapter.id,
       tiers,
@@ -3346,9 +3346,21 @@ function webhookMutationId(eventId) {
 function findApplicationRef(obj) {
   const metaOf = (v) => v && typeof v === "object" ? v.metadata ?? {} : {};
   const pick = (m) => typeof m.applicationId === "string" ? m.applicationId : void 0;
-  const applicationId = pick(metaOf(obj)) ?? pick(metaOf(obj.subscription_details)) ?? pick(metaOf(obj.parent?.subscription_details));
+  const candidates = [
+    metaOf(obj),
+    metaOf(obj.subscription_details),
+    metaOf(obj.parent?.subscription_details)
+  ];
+  const applicationId = candidates.map(pick).find(Boolean);
+  const appId = candidates.map((metadata) => typeof metadata.odlaAppId === "string" ? metadata.odlaAppId : void 0).find(Boolean);
+  const environment = candidates.map((metadata) => typeof metadata.odlaEnvironment === "string" ? metadata.odlaEnvironment : void 0).find(Boolean);
   const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
-  return { ...applicationId ? { applicationId } : {}, ...customerId ? { customerId } : {} };
+  return {
+    ...applicationId ? { applicationId } : {},
+    ...customerId ? { customerId } : {},
+    ...appId ? { appId } : {},
+    ...environment ? { environment } : {}
+  };
 }
 function findGiftRef(obj) {
   const metaOf = (value) => value && typeof value === "object" ? value.metadata ?? {} : {};
@@ -3439,7 +3451,13 @@ function createStripeProvider(config) {
   return {
     async createSubscription(input) {
       const sk = requireSecret(secretKey);
-      const meta = { applicationId: input.applicationId, groupId: input.groupId, email: input.email };
+      const meta = {
+        applicationId: input.applicationId,
+        groupId: input.groupId,
+        email: input.email,
+        odlaAppId: input.appId,
+        odlaEnvironment: input.environment
+      };
       let customerId = input.existingCustomerId;
       if (!customerId) {
         const cust = await stripeCall(
@@ -3918,8 +3936,8 @@ async function startSubscription(req, env, ctx) {
   const secretKey = await getVaultSecret(db, "stripe_secret_key");
   if (!group || !secretKey) return json({ error: "payments not configured" }, 503);
   if (typeof app.giftOfferId === "string") {
-    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
-    const offer = findGiftOffer(control2?.document.giftOffers, app.giftOfferId, Date.now());
+    const control3 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control3?.document.giftOffers, app.giftOfferId, Date.now());
     if (!offer || typeof group.stripePublishableKey !== "string" || !group.stripePublishableKey) {
       return json({ error: "gift offer is unavailable" }, 409);
     }
@@ -3959,6 +3977,8 @@ async function startSubscription(req, env, ctx) {
   let result;
   try {
     result = await provider.createSubscription({
+      appId: env.ODLA_APP_ID,
+      environment: env.ODLA_ENV,
       applicationId,
       groupId: String(group.id),
       email: String(app.email ?? ""),
@@ -3988,6 +4008,10 @@ async function ingestWebhook(req, env, ctx) {
   if (!ingest.ok) return json({ error: "invalid signature" }, 400);
   const { eventId, event } = ingest;
   if (event.kind === "ignored") return json({ ok: true, ignored: event.type });
+  const identifiedEnvironment = event.appId !== void 0 || event.environment !== void 0;
+  if (env.ODLA_APP_ID && identifiedEnvironment && (event.appId !== env.ODLA_APP_ID || event.environment !== env.ODLA_ENV)) {
+    return json({ ok: true, matched: false });
+  }
   if (event.kind === "gift_paid" || event.kind === "gift_revoked") {
     const intent = await firstRow2(db, "giftPurchaseIntents", { where: { id: event.giftIntentId }, limit: 1 });
     if (!intent || intent.chapterId !== ctx.chapter.id || intent.environment !== env.ODLA_ENV) {
@@ -4078,14 +4102,14 @@ var handleGifts = async (req, url, env, ctx) => {
   if (req.method === "GET" && url.pathname === "/api/gifts") {
     const user = await userFor(req, env, ctx);
     if (!user) return json({ error: "unauthorized" }, 401);
-    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const control3 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
     const found = await db.query({ giftClaims: { $: { where: {
       purchaserEmailNormalized: normalizeChapterEmail(user.email),
       chapterId: ctx.chapter.id
     }, limit: 200 } } });
     const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
     return json({
-      offers: publicGiftOffers(control2?.document.giftOffers, Date.now()),
+      offers: publicGiftOffers(control3?.document.giftOffers, Date.now()),
       claims: buyerGiftClaims(rows2(found.giftClaims).sort((a, b) => Number(b.createdAt) - Number(a.createdAt)), Date.now()),
       refundPolicyText: typeof group?.refundPolicyText === "string" ? group.refundPolicyText : ""
     });
@@ -4101,8 +4125,8 @@ var handleGifts = async (req, url, env, ctx) => {
     }
     const purchaseId = typeof body.purchaseId === "string" ? body.purchaseId : "";
     if (!/^[A-Za-z0-9_-]{16,128}$/.test(purchaseId)) return json({ error: "purchaseId is invalid" }, 400);
-    const control2 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
-    const offer = findGiftOffer(control2?.document.giftOffers, typeof body.offerId === "string" ? body.offerId : "", Date.now());
+    const control3 = await loadActiveSignupControl(db, ctx.chapter.id, env.ODLA_ENV);
+    const offer = findGiftOffer(control3?.document.giftOffers, typeof body.offerId === "string" ? body.offerId : "", Date.now());
     if (!offer) return json({ error: "gift offer is unavailable" }, 409);
     const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
     const stripeSecret = await getVaultSecret(db, "stripe_secret_key");
@@ -4934,11 +4958,11 @@ var handleAdminGroupEmail = async (req, url, env, ctx) => {
   for (const key of EMAIL_TEMPLATE_NAMES) {
     const t = templates[key];
     const subject = typeof t?.subject === "string" ? t.subject.trim() : "";
-    const text3 = typeof t?.text === "string" ? t.text : "";
-    if (!subject || !text3.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
+    const text4 = typeof t?.text === "string" ? t.text : "";
+    if (!subject || !text4.trim()) return json({ error: `template "${key}" needs a subject and a body` }, 400);
     if (/[\r\n]/.test(subject) || subject.length > 200) return json({ error: `template "${key}" subject must be a single line under 200 characters` }, 400);
-    if (text3.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
-    clean[key] = { subject, text: text3, enabled: t?.enabled !== false };
+    if (text4.length > 1e4) return json({ error: `template "${key}" body is too long` }, 400);
+    clean[key] = { subject, text: text4, enabled: t?.enabled !== false };
   }
   const emailish = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   const notificationEmail = str2(body.notificationEmail).trim();
@@ -5058,7 +5082,7 @@ function fetchNetworkTarget(env, target, destination, init) {
 // src/worker-network-push.ts
 import { recordDeliveryAttempt } from "@odla-ai/crm";
 import { signFederatedRequest } from "@odla-ai/db";
-async function pushNetworkRecord(db, env, ctx, target, record3) {
+async function pushNetworkRecord(db, env, ctx, target, record4) {
   const secret = await getVaultSecret(db, target.secretName);
   const crmDeps3 = {
     crm: ctx.chapter.crm,
@@ -5069,7 +5093,7 @@ async function pushNetworkRecord(db, env, ctx, target, record3) {
   if (!secret) {
     const error = `vault secret "${target.secretName}" is missing`;
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record3.id,
+      recordId: record4.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -5079,7 +5103,7 @@ async function pushNetworkRecord(db, env, ctx, target, record3) {
   }
   let payload;
   try {
-    payload = sharedRecordFromCrm(ctx.chapter.crm, record3, target, ctx.chapter.id);
+    payload = sharedRecordFromCrm(ctx.chapter.crm, record4, target, ctx.chapter.id);
   } catch (err) {
     return {
       id: target.id,
@@ -5108,7 +5132,7 @@ async function pushNetworkRecord(db, env, ctx, target, record3) {
     if (!res.ok) {
       const error = responseBody.error ?? "follower rejected the record";
       await recordDeliveryAttempt(crmDeps3, {
-        recordId: record3.id,
+        recordId: record4.id,
         targetId: target.id,
         status: "failed",
         payloadVersion: 2,
@@ -5123,7 +5147,7 @@ async function pushNetworkRecord(db, env, ctx, target, record3) {
       };
     }
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record3.id,
+      recordId: record4.id,
       targetId: target.id,
       status: "delivered",
       payloadVersion: 2,
@@ -5139,7 +5163,7 @@ async function pushNetworkRecord(db, env, ctx, target, record3) {
   } catch (err) {
     const error = err instanceof Error ? err.message : "delivery failed";
     await recordDeliveryAttempt(crmDeps3, {
-      recordId: record3.id,
+      recordId: record4.id,
       targetId: target.id,
       status: "failed",
       payloadVersion: 2,
@@ -5277,10 +5301,10 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   if (requested.size !== body.targetIds.length) return json({ error: "targetIds must contain unique strings" }, 400);
   const targets = ctx.chapter.network.targets.filter((target) => requested.has(target.id));
   if (targets.length !== requested.size) return json({ error: "one or more targetIds are not configured" }, 400);
-  const record3 = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
-  if (!record3) return json({ error: "record not found" }, 404);
+  const record4 = await getRecord({ crm: ctx.chapter.crm, db: got.db }, body.recordId);
+  if (!record4) return json({ error: "record not found" }, 404);
   const results = await Promise.all(
-    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record3))
+    targets.map((target) => pushNetworkRecord(got.db, env, ctx, target, record4))
   );
   return json({ ok: results.every((result) => result.ok), results });
 };
@@ -5305,18 +5329,18 @@ function integer(value, fallback, min, max) {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
 }
-function projectRecord(record3, allowed2) {
+function projectRecord(record4, allowed2) {
   const fields = Object.fromEntries(
-    allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record3.fields, name) ? [[name, record3.fields[name]]] : [])
+    allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record4.fields, name) ? [[name, record4.fields[name]]] : [])
   );
   return {
-    id: record3.id,
-    type: record3.type,
-    name: record3.name,
-    ...record3.stage ? { stage: record3.stage } : {},
+    id: record4.id,
+    type: record4.type,
+    name: record4.name,
+    ...record4.stage ? { stage: record4.stage } : {},
     fields,
-    createdAt: record3.createdAt,
-    updatedAt: record3.updatedAt
+    createdAt: record4.createdAt,
+    updatedAt: record4.updatedAt
   };
 }
 var handleNetworkRecords = async (req, url, env, ctx) => {
@@ -5354,7 +5378,7 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     version: 1,
     site: { id: ctx.chapter.id, name: ctx.chapter.name },
     type,
-    records: page.records.map((record3) => projectRecord(record3, allowed2)),
+    records: page.records.map((record4) => projectRecord(record4, allowed2)),
     total: page.total,
     limit: page.limit,
     offset: page.offset
@@ -5579,8 +5603,8 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
     return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
   }
-  const record3 = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
-  if (!record3 || record3.type !== recordType) return json({ error: "record not found" }, 404);
+  const record4 = await getRecord2({ crm: ctx.chapter.crm, db }, recordId);
+  if (!record4 || record4.type !== recordType) return json({ error: "record not found" }, 404);
   if (req.method === "GET") {
     return json({
       version: 1,
@@ -5771,6 +5795,467 @@ var handleFormation = async (req, url, env, ctx) => {
   }
 };
 
+// src/worker-routes-builder-library.ts
+import { verifyFederatedRequest as verifyFederatedRequest8 } from "@odla-ai/db";
+
+// src/builder-library-validation.ts
+var ID4 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var APP_ID = /^[a-z0-9][a-z0-9-]{1,62}$/;
+var MAX_RESOURCES = 200;
+var MAX_MARKDOWN3 = 65536;
+var MAX_TEXT2 = 500;
+var MAX_TAGS = 20;
+var KINDS = /* @__PURE__ */ new Set(["document", "note", "link", "inspiration", "image", "file"]);
+var STATUSES = /* @__PURE__ */ new Set(["draft", "published", "archived"]);
+var ROOT_KEYS4 = /* @__PURE__ */ new Set(["schemaVersion", "revision", "generatedAt", "source", "target", "resources"]);
+var SOURCE_KEYS2 = /* @__PURE__ */ new Set(["type", "appId"]);
+var TARGET_KEYS2 = /* @__PURE__ */ new Set(["appId", "environment"]);
+var RESOURCE_KEYS = /* @__PURE__ */ new Set(["id", "kind", "title", "summary", "tags", "scope", "status", "revision", "bodyMarkdown", "url", "brandAsset", "provenance"]);
+var SCOPE_KEYS = /* @__PURE__ */ new Set(["kind", "chapterId"]);
+var ASSET_KEYS = /* @__PURE__ */ new Set(["bookId", "assetId", "filename"]);
+var PROVENANCE_KEYS = /* @__PURE__ */ new Set(["createdBy", "createdAt", "updatedBy", "updatedAt", "promotedFrom"]);
+var PROMOTION_KEYS = /* @__PURE__ */ new Set(["chapterId", "resourceId", "resourceRevision", "documentRevision", "promotedBy", "promotedAt"]);
+var record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function unknownKeys3(value, allowed2, path, errors) {
+  for (const key of Object.keys(value)) if (!allowed2.has(key)) errors.push(`${path}.${key} is not supported`);
+}
+function text3(value, path, errors, max = MAX_TEXT2, required = true) {
+  if (value === void 0 && !required) return void 0;
+  if (typeof value !== "string" || required && !value.trim()) {
+    errors.push(`${path} must be a non-empty string`);
+    return void 0;
+  }
+  const result = value.trim();
+  if (result.length > max) errors.push(`${path} must be at most ${max} characters`);
+  return result;
+}
+function integer2(value, path, errors, minimum = 1) {
+  if (!Number.isSafeInteger(value) || Number(value) < minimum) errors.push(`${path} must be an integer >= ${minimum}`);
+  return Number(value);
+}
+function scopeValue(value, path, errors) {
+  const raw = record3(value);
+  if (!raw) {
+    errors.push(`${path} must be an object`);
+    return null;
+  }
+  unknownKeys3(raw, SCOPE_KEYS, path, errors);
+  if (raw.kind === "global" || raw.kind === "built_not_found") {
+    if (raw.chapterId !== void 0) errors.push(`${path}.chapterId is allowed only for chapter scope`);
+    return { kind: raw.kind };
+  }
+  if (raw.kind === "chapter") {
+    const chapterId = text3(raw.chapterId, `${path}.chapterId`, errors, 63) ?? "";
+    if (chapterId && !APP_ID.test(chapterId)) errors.push(`${path}.chapterId must be a lowercase app slug`);
+    return { kind: "chapter", chapterId };
+  }
+  errors.push(`${path}.kind must be chapter, built_not_found, or global`);
+  return null;
+}
+function resourceValue(value, path, errors) {
+  const raw = record3(value);
+  if (!raw) {
+    errors.push(`${path} must be an object`);
+    return null;
+  }
+  unknownKeys3(raw, RESOURCE_KEYS, path, errors);
+  const id = text3(raw.id, `${path}.id`, errors, 80) ?? "";
+  if (id && !ID4.test(id)) errors.push(`${path}.id must be lowercase kebab-case`);
+  const kind = text3(raw.kind, `${path}.kind`, errors) ?? "";
+  if (!KINDS.has(kind)) errors.push(`${path}.kind is unsupported`);
+  const title = text3(raw.title, `${path}.title`, errors, 240) ?? "";
+  const summary = text3(raw.summary, `${path}.summary`, errors, 1e3, false);
+  const status = text3(raw.status, `${path}.status`, errors) ?? "";
+  if (!STATUSES.has(status)) errors.push(`${path}.status must be draft, published, or archived`);
+  const revision = integer2(raw.revision, `${path}.revision`, errors);
+  const scope = scopeValue(raw.scope, `${path}.scope`, errors) ?? { kind: "global" };
+  const tags = Array.isArray(raw.tags) ? raw.tags.map((tag, index) => text3(tag, `${path}.tags[${index}]`, errors, 80) ?? "") : [];
+  if (!Array.isArray(raw.tags)) errors.push(`${path}.tags must be an array`);
+  if (tags.length > MAX_TAGS) errors.push(`${path}.tags may contain at most ${MAX_TAGS} items`);
+  if (new Set(tags).size !== tags.length) errors.push(`${path}.tags must be unique`);
+  const bodyMarkdown = text3(raw.bodyMarkdown, `${path}.bodyMarkdown`, errors, MAX_MARKDOWN3, false);
+  const url = text3(raw.url, `${path}.url`, errors, 2048, false);
+  if (url) {
+    try {
+      if (new URL(url).protocol !== "https:") errors.push(`${path}.url must use https`);
+    } catch {
+      errors.push(`${path}.url must be a valid https URL`);
+    }
+  }
+  const asset = raw.brandAsset === void 0 ? null : record3(raw.brandAsset);
+  if (raw.brandAsset !== void 0 && !asset) errors.push(`${path}.brandAsset must be an object`);
+  if (asset) unknownKeys3(asset, ASSET_KEYS, `${path}.brandAsset`, errors);
+  const brandAsset = asset ? {
+    bookId: text3(asset.bookId, `${path}.brandAsset.bookId`, errors, 160) ?? "",
+    assetId: text3(asset.assetId, `${path}.brandAsset.assetId`, errors, 160) ?? "",
+    ...asset.filename === void 0 ? {} : { filename: text3(asset.filename, `${path}.brandAsset.filename`, errors, 240) ?? "" }
+  } : void 0;
+  if ((kind === "document" || kind === "note") && !bodyMarkdown) errors.push(`${path}.bodyMarkdown is required for ${kind}`);
+  if ((kind === "link" || kind === "inspiration") && !url) errors.push(`${path}.url is required for ${kind}`);
+  if ((kind === "image" || kind === "file") && !brandAsset) errors.push(`${path}.brandAsset is required for ${kind}`);
+  if (!["document", "note"].includes(kind) && bodyMarkdown) errors.push(`${path}.bodyMarkdown is not allowed for ${kind}`);
+  if (!["link", "inspiration"].includes(kind) && url) errors.push(`${path}.url is not allowed for ${kind}`);
+  if (!["image", "file"].includes(kind) && brandAsset) errors.push(`${path}.brandAsset is not allowed for ${kind}`);
+  const provenanceRaw = record3(raw.provenance);
+  if (!provenanceRaw) errors.push(`${path}.provenance must be an object`);
+  if (provenanceRaw) unknownKeys3(provenanceRaw, PROVENANCE_KEYS, `${path}.provenance`, errors);
+  const promotedRaw = provenanceRaw?.promotedFrom === void 0 ? null : record3(provenanceRaw.promotedFrom);
+  if (provenanceRaw?.promotedFrom !== void 0 && !promotedRaw) errors.push(`${path}.provenance.promotedFrom must be an object`);
+  if (promotedRaw) unknownKeys3(promotedRaw, PROMOTION_KEYS, `${path}.provenance.promotedFrom`, errors);
+  const promotedFrom = promotedRaw ? {
+    chapterId: text3(promotedRaw.chapterId, `${path}.provenance.promotedFrom.chapterId`, errors, 63) ?? "",
+    resourceId: text3(promotedRaw.resourceId, `${path}.provenance.promotedFrom.resourceId`, errors, 80) ?? "",
+    resourceRevision: integer2(promotedRaw.resourceRevision, `${path}.provenance.promotedFrom.resourceRevision`, errors),
+    documentRevision: integer2(promotedRaw.documentRevision, `${path}.provenance.promotedFrom.documentRevision`, errors),
+    promotedBy: text3(promotedRaw.promotedBy, `${path}.provenance.promotedFrom.promotedBy`, errors, 320) ?? "",
+    promotedAt: integer2(promotedRaw.promotedAt, `${path}.provenance.promotedFrom.promotedAt`, errors, 0)
+  } : void 0;
+  const provenance = {
+    createdBy: text3(provenanceRaw?.createdBy, `${path}.provenance.createdBy`, errors, 320) ?? "",
+    createdAt: integer2(provenanceRaw?.createdAt, `${path}.provenance.createdAt`, errors, 0),
+    updatedBy: text3(provenanceRaw?.updatedBy, `${path}.provenance.updatedBy`, errors, 320) ?? "",
+    updatedAt: integer2(provenanceRaw?.updatedAt, `${path}.provenance.updatedAt`, errors, 0),
+    ...promotedFrom ? { promotedFrom } : {}
+  };
+  return { id, kind, title, ...summary ? { summary } : {}, tags, scope, status, revision, ...bodyMarkdown ? { bodyMarkdown } : {}, ...url ? { url } : {}, ...brandAsset ? { brandAsset } : {}, provenance };
+}
+function validateBuilderLibraryDocument(value, options = {}) {
+  const errors = [];
+  const raw = record3(value);
+  if (!raw) return { ok: false, errors: ["document must be an object"] };
+  unknownKeys3(raw, ROOT_KEYS4, "document", errors);
+  if (raw.schemaVersion !== BUILDER_LIBRARY_SCHEMA_VERSION) errors.push("document.schemaVersion must be 1");
+  const revision = integer2(raw.revision, "document.revision", errors);
+  const generatedAt = integer2(raw.generatedAt, "document.generatedAt", errors, 0);
+  const sourceRaw = record3(raw.source);
+  if (!sourceRaw) errors.push("document.source must be an object");
+  if (sourceRaw) unknownKeys3(sourceRaw, SOURCE_KEYS2, "document.source", errors);
+  const sourceType = sourceRaw?.type;
+  if (sourceType !== "chapter" && sourceType !== "built_not_found") errors.push("document.source.type must be chapter or built_not_found");
+  const sourceAppId = text3(sourceRaw?.appId, "document.source.appId", errors, 63) ?? "";
+  if (sourceAppId && !APP_ID.test(sourceAppId)) errors.push("document.source.appId must be a lowercase app slug");
+  if (options.sourceType && sourceType !== options.sourceType) errors.push(`document.source.type must be ${options.sourceType}`);
+  if (options.sourceAppId && sourceAppId !== options.sourceAppId) errors.push(`document.source.appId must be ${options.sourceAppId}`);
+  const targetRaw = raw.target === void 0 ? null : record3(raw.target);
+  if (raw.target !== void 0 && !targetRaw) errors.push("document.target must be an object");
+  if (targetRaw) unknownKeys3(targetRaw, TARGET_KEYS2, "document.target", errors);
+  const target = targetRaw ? {
+    appId: text3(targetRaw.appId, "document.target.appId", errors, 63) ?? "",
+    environment: text3(targetRaw.environment, "document.target.environment", errors, 80) ?? ""
+  } : void 0;
+  if (options.targetAppId && target?.appId !== options.targetAppId) errors.push(`document.target.appId must be ${options.targetAppId}`);
+  if (!Array.isArray(raw.resources)) errors.push("document.resources must be an array");
+  const inputs = Array.isArray(raw.resources) ? raw.resources : [];
+  if (inputs.length > MAX_RESOURCES) errors.push(`document.resources may contain at most ${MAX_RESOURCES} items`);
+  const resources = inputs.map((item, index) => resourceValue(item, `document.resources[${index}]`, errors)).filter(Boolean);
+  const ids = resources.map(({ id }) => id);
+  if (new Set(ids).size !== ids.length) errors.push("document.resources ids must be unique");
+  for (const resource of resources) {
+    if (sourceType === "chapter" && (resource.scope.kind !== "chapter" || resource.scope.chapterId !== sourceAppId)) {
+      errors.push(`document.resources.${resource.id}: Chapter sources may author only their own chapter scope`);
+    }
+    if (sourceType === "built_not_found" && resource.scope.kind === "chapter") {
+      errors.push(`document.resources.${resource.id}: Built Not Found sources may author only built_not_found or global scope`);
+    }
+  }
+  if (errors.length) return { ok: false, errors };
+  return { ok: true, value: { schemaVersion: 1, revision, generatedAt, source: { type: sourceType, appId: sourceAppId }, ...target ? { target } : {}, resources } };
+}
+
+// src/builder-library.ts
+var BUILDER_LIBRARY_SCHEMA_VERSION = 1;
+var BUILDER_LIBRARY_ADMIN_PATH = "/api/admin/builder-library";
+var BUILDER_LIBRARY_MANIFEST_PATH = "/api/admin/builder-library/manifest";
+var BUILDER_LIBRARY_PROMOTE_PATH = "/api/admin/builder-library/promote";
+var BUILDER_LIBRARY_CONTROL_PATH = "/api/builder-library-control";
+function canViewBuilderLibraryResource(resource, viewer) {
+  if (viewer.kind === "built_not_found") return true;
+  return resource.scope.kind === "global" || resource.scope.kind === "chapter" && resource.scope.chapterId === viewer.chapterId;
+}
+function buildBuilderLibraryManifest(documents, viewer, generatedAt = Date.now(), limit = 100) {
+  const ordered = documents.flatMap((document) => document.resources.map((resource) => ({ document, resource }))).filter(({ resource }) => resource.status === "published" && canViewBuilderLibraryResource(resource, viewer)).sort((a, b) => a.resource.title.localeCompare(b.resource.title) || a.document.source.appId.localeCompare(b.document.source.appId) || a.resource.id.localeCompare(b.resource.id));
+  return {
+    schemaVersion: BUILDER_LIBRARY_SCHEMA_VERSION,
+    generatedAt,
+    viewer,
+    revisions: documents.map(({ source, revision }) => ({ source, revision })),
+    resources: ordered.slice(0, limit).map(({ resource }) => resource),
+    truncated: ordered.length > limit
+  };
+}
+function promoteBuilderLibraryResource(input) {
+  if (input.resource.scope.kind !== "chapter") throw new TypeError("only a Chapter-scoped resource can be promoted");
+  const chapterId = input.resource.scope.chapterId;
+  return {
+    ...input.resource,
+    id: input.globalId ?? `${chapterId}-${input.resource.id}`,
+    scope: { kind: "global" },
+    revision: 1,
+    provenance: {
+      createdBy: input.actor,
+      createdAt: input.promotedAt,
+      updatedBy: input.actor,
+      updatedAt: input.promotedAt,
+      promotedFrom: {
+        chapterId,
+        resourceId: input.resource.id,
+        resourceRevision: input.resource.revision,
+        documentRevision: input.chapterDocumentRevision,
+        promotedBy: input.actor,
+        promotedAt: input.promotedAt
+      }
+    }
+  };
+}
+
+// src/builder-library-canonical.ts
+var encoder3 = new TextEncoder();
+function canonicalValue3(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalValue3).join(",")}]`;
+  if (typeof value !== "object") throw new TypeError("Builder Library contains an unsupported value");
+  const record4 = value;
+  return `{${Object.keys(record4).sort().flatMap((key) => record4[key] === void 0 ? [] : [`${JSON.stringify(key)}:${canonicalValue3(record4[key])}`]).join(",")}}`;
+}
+function canonicalBuilderLibrary(value) {
+  return canonicalValue3(value);
+}
+async function builderLibraryDigest(document) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder3.encode(canonicalBuilderLibrary(document)));
+  return `sha256:${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// src/builder-library-store.ts
+var control2 = (row) => row?.document && typeof row.document === "object" ? row : null;
+var local2 = (row) => row?.document && typeof row.document === "object" ? row : null;
+async function loadActiveBuilderLibraryControls(db, targetId, environment) {
+  const rows4 = (await db.query({ builderLibraryControls: { $: { where: { targetId, environment, active: true }, limit: 500 } } })).builderLibraryControls;
+  return Array.isArray(rows4) ? rows4.map(control2).filter(Boolean) : [];
+}
+async function loadLatestBuilderLibraryControl(db, sourceId, targetId, environment) {
+  const rows4 = (await db.query({ builderLibraryControls: { $: { where: { sourceId, targetId, environment }, order: { revision: "desc" }, limit: 20 } } })).builderLibraryControls;
+  return control2(Array.isArray(rows4) ? [...rows4].sort((a, b) => Number(b.revision) - Number(a.revision))[0] : void 0);
+}
+async function loadLocalBuilderLibrary(db, appId, environment) {
+  const id = `builder-library-local:${environment}`;
+  const rows4 = (await db.query({ builderLibraryLocal: { $: { where: { id }, limit: 1 } } })).builderLibraryLocal;
+  return local2(Array.isArray(rows4) ? rows4[0] : void 0);
+}
+async function materializeBuilderLibraryControl(db, envelope, previous, receivedAt) {
+  const { document, digest } = envelope;
+  const target = document.target;
+  const id = `builder-library-control:${document.source.appId}:${target.environment}:${document.revision}`;
+  const ops = [];
+  if (previous?.active) ops.push({ t: "update", ns: "builderLibraryControls", id: previous.id, attrs: { active: false } });
+  ops.push({ t: "update", ns: "builderLibraryControls", id, attrs: {
+    id,
+    sourceId: document.source.appId,
+    targetId: target.appId,
+    environment: target.environment,
+    revision: document.revision,
+    digest,
+    document,
+    active: true,
+    receivedAt
+  } });
+  await db.transact(ops, { mutationId: `builder-library-control:${document.source.appId}:${target.environment}:${document.revision}:${digest}` });
+}
+async function saveLocalBuilderLibrary(db, document, environment, expectedRevision, updatedAt, updatedBy) {
+  const id = `builder-library-local:${environment}`;
+  const current = await loadLocalBuilderLibrary(db, document.source.appId, environment);
+  if ((current?.revision ?? 0) !== expectedRevision) throw new Error("builder_library_revision_conflict");
+  const row = { id, appId: document.source.appId, environment, revision: document.revision, document, updatedAt, ...updatedBy ? { updatedBy } : {} };
+  await db.transact([{ t: "update", ns: "builderLibraryLocal", id, attrs: row }], {
+    mutationId: `builder-library-local:${environment}:${document.revision}`,
+    guards: current ? [{ ns: "builderLibraryLocal", id, exists: true, equals: { revision: expectedRevision } }] : [{ ns: "builderLibraryLocal", id, exists: false }]
+  });
+  return row;
+}
+
+// src/worker-routes-builder-library.ts
+var BODY_CAP2 = 1e6;
+async function verifySource(req, db, sources) {
+  for (const source of sources) {
+    const secret = await getVaultSecret(db, source.secretName);
+    if (!secret) continue;
+    const verified = await verifyFederatedRequest8(req.clone(), { secret, senders: [source.sourceId] });
+    if (verified.ok) return { source, body: verified.body };
+  }
+  return null;
+}
+var handleBuilderLibraryControl = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== BUILDER_LIBRARY_CONTROL_PATH) return null;
+  const settings = ctx.chapter.builderLibrary;
+  if (!settings) return json({ error: "not found" }, 404);
+  const db = ctx.makeDb(env);
+  const verified = await verifySource(req, db, settings.sources);
+  if (!verified) return json({ error: "unauthorized" }, 401);
+  let input;
+  try {
+    input = JSON.parse(verified.body);
+  } catch {
+    return json({ ok: false, reason: "invalid_document", errors: ["request body must be JSON"] }, 400);
+  }
+  const digest = typeof input.digest === "string" ? input.digest : "";
+  const sourceType = ctx.chapter.mode === "hub" ? "chapter" : "built_not_found";
+  const checked = validateBuilderLibraryDocument(input.document, {
+    sourceType,
+    sourceAppId: verified.source.sourceId,
+    targetAppId: ctx.chapter.id
+  });
+  if (!checked.ok) return json({ ok: false, reason: "invalid_document", errors: checked.errors }, 400);
+  const document = checked.value;
+  if (ctx.chapter.mode === "chapter" && document.resources.some((resource) => resource.scope.kind !== "global")) {
+    return json({ ok: false, reason: "invalid_document", errors: ["Built Not Found may deliver only global resources to a Chapter"] }, 400);
+  }
+  if (!document.target || document.target.environment !== env.ODLA_ENV) return json({ ok: false, reason: "wrong_environment" }, 409);
+  if (!digest || await builderLibraryDigest(document) !== digest) return json({ ok: false, reason: "invalid_digest" }, 400);
+  const latest = await loadLatestBuilderLibraryControl(db, document.source.appId, ctx.chapter.id, env.ODLA_ENV);
+  if (latest && document.revision < latest.revision) return json({ ok: false, reason: "stale_revision" }, 409);
+  if (latest && document.revision === latest.revision) {
+    if (latest.digest !== digest) return json({ ok: false, reason: "conflicting_revision" }, 409);
+    return json({ ok: true, target: document.target, revision: latest.revision, digest: latest.digest, status: "replayed", acknowledgedAt: latest.receivedAt });
+  }
+  const receivedAt = Date.now();
+  try {
+    await materializeBuilderLibraryControl(db, { document, digest }, latest, receivedAt);
+  } catch {
+    return json({ ok: false, reason: "materialization_failed" }, 503);
+  }
+  return json({ ok: true, target: document.target, revision: document.revision, digest, status: "accepted", acknowledgedAt: receivedAt });
+};
+function actorFor(user) {
+  return user.email ?? user.userId;
+}
+function withLocalAuthority2(value, mode, appId, revision, now, actor, current) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const raw = value;
+  const currentById = new Map((current?.resources ?? []).map((item) => [item.id, item]));
+  const resources = Array.isArray(raw.resources) ? raw.resources.map((input) => {
+    if (!input || typeof input !== "object" || Array.isArray(input)) return input;
+    const item = input;
+    const existing = typeof item.id === "string" ? currentById.get(item.id) : void 0;
+    return {
+      ...item,
+      revision: (existing?.revision ?? 0) + 1,
+      provenance: {
+        createdBy: existing?.provenance.createdBy ?? actor,
+        createdAt: existing?.provenance.createdAt ?? now,
+        updatedBy: actor,
+        updatedAt: now,
+        ...existing?.provenance.promotedFrom ? { promotedFrom: existing.provenance.promotedFrom } : {}
+      }
+    };
+  }) : raw.resources;
+  return {
+    ...raw,
+    schemaVersion: 1,
+    revision,
+    generatedAt: now,
+    source: { type: mode === "hub" ? "built_not_found" : "chapter", appId },
+    resources
+  };
+}
+var handleAdminBuilderLibrary = async (req, url, env, ctx) => {
+  const paths = /* @__PURE__ */ new Set([BUILDER_LIBRARY_ADMIN_PATH, BUILDER_LIBRARY_MANIFEST_PATH, BUILDER_LIBRARY_PROMOTE_PATH]);
+  if (!paths.has(url.pathname)) return null;
+  if (!ctx.chapter.builderLibrary) return json({ error: "not found" }, 404);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return json({ error: "unauthorized" }, 401);
+  const db = ctx.makeDb(env);
+  if (!await ctx.isAdmin(db, user)) return json({ error: "forbidden" }, 403);
+  const [local3, controls] = await Promise.all([
+    loadLocalBuilderLibrary(db, ctx.chapter.id, env.ODLA_ENV),
+    loadActiveBuilderLibraryControls(db, ctx.chapter.id, env.ODLA_ENV)
+  ]);
+  if (url.pathname === BUILDER_LIBRARY_MANIFEST_PATH) {
+    if (req.method !== "GET") return json({ error: "method not allowed" }, 405);
+    const chapterId = url.searchParams.get("chapterId")?.trim();
+    if (ctx.chapter.mode === "hub" && (!chapterId || !ctx.chapter.builderLibrary.sources.some((source) => source.sourceId === chapterId))) {
+      return json({ error: "chapterId must name a configured Chapter source" }, 400);
+    }
+    const viewer = ctx.chapter.mode === "hub" ? { kind: "chapter", chapterId } : { kind: "chapter", chapterId: ctx.chapter.id };
+    const documents = [
+      ...local3 ? [local3.document] : [],
+      ...controls.filter((row) => ctx.chapter.mode === "chapter" || row.sourceId === chapterId).map((row) => row.document)
+    ];
+    return json(buildBuilderLibraryManifest(documents, viewer));
+  }
+  if (url.pathname === BUILDER_LIBRARY_PROMOTE_PATH) {
+    if (req.method !== "POST") return json({ error: "method not allowed" }, 405);
+    if (ctx.chapter.mode !== "hub") return json({ error: "only Built Not Found can promote Chapter material" }, 403);
+    let input2;
+    try {
+      input2 = await req.json();
+    } catch {
+      return json({ error: "invalid JSON body" }, 400);
+    }
+    const chapterId = typeof input2.chapterId === "string" ? input2.chapterId : "";
+    const resourceId = typeof input2.resourceId === "string" ? input2.resourceId : "";
+    const expectedRevision2 = Number(input2.expectedRevision);
+    const source = controls.find((row) => row.sourceId === chapterId);
+    const resource = source?.document.resources.find((item) => item.id === resourceId);
+    if (!source || !resource) return json({ error: "Chapter resource not found" }, 404);
+    if (!Number.isInteger(expectedRevision2) || expectedRevision2 !== (local3?.revision ?? 0)) return json({ error: "Builder Library changed; reload before promoting" }, 409);
+    const now2 = Date.now();
+    let promoted;
+    try {
+      promoted = promoteBuilderLibraryResource({ resource, chapterDocumentRevision: source.revision, actor: actorFor(user), promotedAt: now2, ...typeof input2.globalId === "string" ? { globalId: input2.globalId } : {} });
+    } catch {
+      return json({ error: "resource cannot be promoted" }, 400);
+    }
+    if (local3?.document.resources.some((item) => item.id === promoted.id)) return json({ error: `global resource id "${promoted.id}" already exists` }, 409);
+    const document = {
+      schemaVersion: 1,
+      revision: expectedRevision2 + 1,
+      generatedAt: now2,
+      source: { type: "built_not_found", appId: ctx.chapter.id },
+      resources: [...local3?.document.resources ?? [], promoted]
+    };
+    const checked2 = validateBuilderLibraryDocument(document, { sourceType: "built_not_found", sourceAppId: ctx.chapter.id });
+    if (!checked2.ok) return json({ error: "promoted resource is invalid", errors: checked2.errors }, 400);
+    try {
+      const saved = await saveLocalBuilderLibrary(db, checked2.value, env.ODLA_ENV, expectedRevision2, now2, actorFor(user));
+      return json({ ok: true, revision: saved.revision, resource: promoted });
+    } catch {
+      return json({ error: "Builder Library changed; reload before promoting" }, 409);
+    }
+  }
+  if (req.method === "GET") {
+    return json({
+      mode: ctx.chapter.mode,
+      local: local3 ? { revision: local3.revision, document: local3.document } : null,
+      sources: controls.map(({ sourceId, revision, digest, document, receivedAt }) => ({ sourceId, revision, digest, document, receivedAt })),
+      localAuthoring: ctx.chapter.builderLibrary.localAuthoring,
+      visibility: { builtNotFoundSeesChapterSources: ctx.chapter.mode === "hub", chaptersSeeSiblingSources: false }
+    });
+  }
+  if (req.method !== "PUT") return json({ error: "method not allowed" }, 405);
+  if (!ctx.chapter.builderLibrary.localAuthoring) return json({ error: "local authoring is disabled" }, 403);
+  const raw = await req.text();
+  if (raw.length > BODY_CAP2) return json({ error: "request body too large" }, 413);
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const expectedRevision = Number(input.expectedRevision);
+  if (!Number.isInteger(expectedRevision) || expectedRevision < 0) return json({ error: "expectedRevision must be a non-negative integer" }, 400);
+  const now = Date.now();
+  const actor = actorFor(user);
+  const authoritative = withLocalAuthority2(input.document, ctx.chapter.mode, ctx.chapter.id, expectedRevision + 1, now, actor, local3?.document);
+  const checked = validateBuilderLibraryDocument(authoritative, { sourceType: ctx.chapter.mode === "hub" ? "built_not_found" : "chapter", sourceAppId: ctx.chapter.id });
+  if (!checked.ok) return json({ error: "invalid Builder Library", errors: checked.errors }, 400);
+  try {
+    const saved = await saveLocalBuilderLibrary(db, checked.value, env.ODLA_ENV, expectedRevision, now, actor);
+    return json({ ok: true, revision: saved.revision, document: saved.document });
+  } catch (error) {
+    if (error instanceof Error && error.message === "builder_library_revision_conflict") return json({ error: "Builder Library changed; reload before saving" }, 409);
+    return json({ error: "Builder Library could not be saved" }, 503);
+  }
+};
+
 // src/signup-control-delivery.ts
 import { signFederatedRequest as signFederatedRequest5 } from "@odla-ai/db";
 async function deliverSignupControl(options) {
@@ -5821,12 +6306,27 @@ async function deliverMemberContent(options) {
   return result;
 }
 
-// src/admission-grants-delivery.ts
+// src/builder-library-delivery.ts
 import { signFederatedRequest as signFederatedRequest7 } from "@odla-ai/db";
+async function deliverBuilderLibrary(options) {
+  const destination = new URL(BUILDER_LIBRARY_CONTROL_PATH, options.targetUrl);
+  const body = JSON.stringify(options.envelope);
+  const signed = await signFederatedRequest7({ secret: options.secret, sender: options.sender, method: "POST", url: destination, body });
+  const response = await (options.fetch ?? globalThis.fetch)(destination, { method: "POST", headers: { ...signed, "content-type": "application/json" }, body });
+  const result = await response.json();
+  if (!response.ok || !("ok" in result) || result.ok !== true) {
+    const failure = result;
+    throw new Error(`Builder Library rejected (${response.status}): ${failure.reason ?? failure.error ?? "unknown"}`);
+  }
+  return result;
+}
+
+// src/admission-grants-delivery.ts
+import { signFederatedRequest as signFederatedRequest8 } from "@odla-ai/db";
 async function deliverAdmissionGrants(options) {
   const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await signFederatedRequest7({
+  const signed = await signFederatedRequest8({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -5986,6 +6486,7 @@ var BUILTIN_ROUTES = [
   handleNetworkShared,
   handleSignupControl,
   handleMemberContentControl,
+  handleBuilderLibraryControl,
   handleAdmissionGrants,
   handleNetworkSnapshot,
   handleNetworkRecords,
@@ -6009,6 +6510,7 @@ var BUILTIN_ROUTES = [
   handleAdminDashboard,
   handleAdminBilling,
   handleAdminMemberContent,
+  handleAdminBuilderLibrary,
   // Lifecycle actions
   handleAdminMeetingReschedule,
   handleAdminMeetingCancel,
@@ -6050,6 +6552,7 @@ export {
   chapterWorker,
   createWorkerContext,
   deliverAdmissionGrants,
+  deliverBuilderLibrary,
   deliverMemberContent,
   deliverSignupControl,
   renderActiveSignupControlHtml,