@odla-ai/chapter 0.39.1 → 0.40.0

package/dist/worker/index.d.cts

@@ -117,16 +117,14 @@ interface ResolvedMemberContent {
 interface ChapterBuilderLibrary {
     /** Keep local admin authoring enabled. Defaults to true. */
     localAuthoring?: boolean;
-    /** Signed sources this app accepts. Hub sources are Chapters; Chapter sources are Built Not Found. */
+    /** Existing Chapter-network peers this app accepts. Hub sources must be
+     * configured network targets; a Chapter source must be a configured reader. */
     sources?: readonly {
         sourceId: string;
-        /** Vault key holding the dedicated Builder Library edge secret. */
-        secretName?: string;
     }[];
 }
 interface ResolvedBuilderLibrarySource {
     sourceId: string;
-    secretName: string;
 }
 /** Validated Builder Library settings carried on a resolved Chapter. */
 interface ResolvedBuilderLibrary {
@@ -716,6 +714,9 @@ interface ChapterEnv {
      * reads fail closed when it is absent or stale. */
     ODLA_APP_INCARNATION?: string;
     ODLA_ENV: string;
+    /** Immutable developer-runtime identity. Omitted by legacy deployments whose
+     * runtime and data environment are the same. */
+    ODLA_RUNTIME?: string;
     ODLA_API_KEY: string;
     SEND_EMAIL?: {
         send(payload: EmailPayload): Promise<{
@@ -1123,13 +1124,15 @@ interface BuilderLibraryReceipt {
 
 /** Inputs for one signed Builder Library peer delivery. */
 interface BuilderLibraryDeliveryOptions {
+    /** Existing Chapter-network share secret for this parent/chapter edge. */
     secret: string;
     sender: string;
     targetUrl: string | URL;
     envelope: BuilderLibraryEnvelope;
     fetch?: typeof globalThis.fetch;
 }
-/** Deliver one exact Builder Library revision over its dedicated signed edge. */
+/** Deliver one exact Builder Library revision over the existing signed Chapter
+ * network edge. No Builder-specific credential is created. */
 declare function deliverBuilderLibrary(options: BuilderLibraryDeliveryOptions): Promise<BuilderLibraryReceipt>;
 
 /** Current wire version for parent-authored admission decisions. */

package/dist/worker/index.d.ts

@@ -117,16 +117,14 @@ interface ResolvedMemberContent {
 interface ChapterBuilderLibrary {
     /** Keep local admin authoring enabled. Defaults to true. */
     localAuthoring?: boolean;
-    /** Signed sources this app accepts. Hub sources are Chapters; Chapter sources are Built Not Found. */
+    /** Existing Chapter-network peers this app accepts. Hub sources must be
+     * configured network targets; a Chapter source must be a configured reader. */
     sources?: readonly {
         sourceId: string;
-        /** Vault key holding the dedicated Builder Library edge secret. */
-        secretName?: string;
     }[];
 }
 interface ResolvedBuilderLibrarySource {
     sourceId: string;
-    secretName: string;
 }
 /** Validated Builder Library settings carried on a resolved Chapter. */
 interface ResolvedBuilderLibrary {
@@ -716,6 +714,9 @@ interface ChapterEnv {
      * reads fail closed when it is absent or stale. */
     ODLA_APP_INCARNATION?: string;
     ODLA_ENV: string;
+    /** Immutable developer-runtime identity. Omitted by legacy deployments whose
+     * runtime and data environment are the same. */
+    ODLA_RUNTIME?: string;
     ODLA_API_KEY: string;
     SEND_EMAIL?: {
         send(payload: EmailPayload): Promise<{
@@ -1123,13 +1124,15 @@ interface BuilderLibraryReceipt {
 
 /** Inputs for one signed Builder Library peer delivery. */
 interface BuilderLibraryDeliveryOptions {
+    /** Existing Chapter-network share secret for this parent/chapter edge. */
     secret: string;
     sender: string;
     targetUrl: string | URL;
     envelope: BuilderLibraryEnvelope;
     fetch?: typeof globalThis.fetch;
 }
-/** Deliver one exact Builder Library revision over its dedicated signed edge. */
+/** Deliver one exact Builder Library revision over the existing signed Chapter
+ * network edge. No Builder-specific credential is created. */
 declare function deliverBuilderLibrary(options: BuilderLibraryDeliveryOptions): Promise<BuilderLibraryReceipt>;
 
 /** Current wire version for parent-authored admission decisions. */

package/dist/worker/index.js

@@ -3354,12 +3354,16 @@ function findApplicationRef(obj) {
   const applicationId = candidates.map(pick).find(Boolean);
   const appId = candidates.map((metadata) => typeof metadata.odlaAppId === "string" ? metadata.odlaAppId : void 0).find(Boolean);
   const environment = candidates.map((metadata) => typeof metadata.odlaEnvironment === "string" ? metadata.odlaEnvironment : void 0).find(Boolean);
+  const dataEnvironment = candidates.map((metadata) => typeof metadata.odlaDataEnvironment === "string" ? metadata.odlaDataEnvironment : void 0).find(Boolean);
+  const runtime = candidates.map((metadata) => typeof metadata.odlaRuntime === "string" ? metadata.odlaRuntime : void 0).find(Boolean);
   const customerId = typeof obj.customer === "string" ? obj.customer : void 0;
   return {
     ...applicationId ? { applicationId } : {},
     ...customerId ? { customerId } : {},
     ...appId ? { appId } : {},
-    ...environment ? { environment } : {}
+    ...environment ? { environment } : {},
+    ...dataEnvironment ? { dataEnvironment } : {},
+    ...runtime ? { runtime } : {}
   };
 }
 function findGiftRef(obj) {
@@ -3369,17 +3373,31 @@ function findGiftRef(obj) {
   const subscription = obj.subscription_details ?? parent?.subscription_details;
   const giftIntentId = pick(metaOf(obj)) ?? pick(metaOf(subscription));
   const subscriptionId = typeof obj.subscription === "string" ? obj.subscription : typeof subscription?.subscription === "string" ? String(subscription.subscription) : void 0;
-  return { ...giftIntentId ? { giftIntentId } : {}, providerObjectId: subscriptionId ?? String(obj.id ?? "") };
+  const candidates = [metaOf(obj), metaOf(subscription)];
+  const pickIdentity = (name) => candidates.map((metadata) => typeof metadata[name] === "string" ? String(metadata[name]) : void 0).find(Boolean);
+  const appId = pickIdentity("odlaAppId");
+  const environment = pickIdentity("odlaEnvironment");
+  const dataEnvironment = pickIdentity("odlaDataEnvironment");
+  const runtime = pickIdentity("odlaRuntime");
+  return {
+    ...giftIntentId ? { giftIntentId } : {},
+    providerObjectId: subscriptionId ?? String(obj.id ?? ""),
+    ...appId ? { appId } : {},
+    ...environment ? { environment } : {},
+    ...dataEnvironment ? { dataEnvironment } : {},
+    ...runtime ? { runtime } : {}
+  };
 }
 function normalizeWebhookEvent(event) {
   const obj = event.data?.object ?? {};
   const gift = findGiftRef(obj);
   if (gift.giftIntentId) {
+    const { giftIntentId, providerObjectId, ...identity } = gift;
     if (event.type === "payment_intent.succeeded" || event.type === "invoice.paid" && obj.billing_reason === "subscription_create") {
-      return { kind: "gift_paid", giftIntentId: gift.giftIntentId, providerObjectId: gift.providerObjectId };
+      return { kind: "gift_paid", giftIntentId, providerObjectId, ...identity };
     }
-    if (event.type === "charge.refunded") return { kind: "gift_revoked", giftIntentId: gift.giftIntentId, reason: "refunded" };
-    if (event.type === "customer.subscription.deleted") return { kind: "gift_revoked", giftIntentId: gift.giftIntentId, reason: "canceled" };
+    if (event.type === "charge.refunded") return { kind: "gift_revoked", giftIntentId, ...identity, reason: "refunded" };
+    if (event.type === "customer.subscription.deleted") return { kind: "gift_revoked", giftIntentId, ...identity, reason: "canceled" };
     return { kind: "ignored", type: event.type };
   }
   const ref = findApplicationRef(obj);
@@ -3456,7 +3474,9 @@ function createStripeProvider(config) {
         groupId: input.groupId,
         email: input.email,
         odlaAppId: input.appId,
-        odlaEnvironment: input.environment
+        odlaEnvironment: input.environment,
+        odlaDataEnvironment: input.environment,
+        ...input.runtime ? { odlaRuntime: input.runtime } : {}
       };
       let customerId = input.existingCustomerId;
       if (!customerId) {
@@ -3744,12 +3764,16 @@ var clientSecret = (value) => {
   const nested = confirmation?.client_secret ?? intent?.client_secret;
   return typeof nested === "string" && nested ? nested : null;
 };
-async function startGiftProviderCheckout(secretKey, intent, email, existingCustomerId) {
+async function startGiftProviderCheckout(secretKey, intent, email, existingCustomerId, runtime) {
   const offer = intent.offerSnapshot;
   const metadata = {
     giftIntentId: intent.id,
     chapterId: intent.chapterId,
     environment: intent.environment,
+    odlaAppId: intent.chapterId,
+    odlaEnvironment: intent.environment,
+    odlaDataEnvironment: intent.environment,
+    ...runtime ? { odlaRuntime: runtime } : {},
     offerId: intent.offerId
   };
   let customerId = existingCustomerId;
@@ -3799,6 +3823,7 @@ async function startGiftIntent(db, input) {
       id: input.id,
       chapterId: input.chapterId,
       environment: input.environment,
+      ...input.runtime ? { runtime: input.runtime } : {},
       purchaserType: input.purchaserType,
       purchaserEmailNormalized: input.purchaserEmailNormalized,
       ...input.purchaserApplicationId ? { purchaserApplicationId: input.purchaserApplicationId } : {},
@@ -3818,7 +3843,7 @@ async function startGiftIntent(db, input) {
     stored = write.duplicate ? first2((await db.query({ giftPurchaseIntents: { $: { where: { id: input.id }, limit: 1 } } })).giftPurchaseIntents) : attrs;
     if (!write.duplicate) giftCode = prepared.code;
   }
-  if (!stored || stored.chapterId !== input.chapterId || stored.environment !== input.environment || stored.offerId !== input.offer.id || stored.purchaserEmailNormalized !== input.purchaserEmailNormalized) {
+  if (!stored || stored.chapterId !== input.chapterId || stored.environment !== input.environment || stored.runtime !== input.runtime || stored.offerId !== input.offer.id || stored.purchaserEmailNormalized !== input.purchaserEmailNormalized) {
     throw new Error("gift purchase intent does not match this checkout");
   }
   if (stored.status === "paid") throw new Error("gift purchase is already paid");
@@ -3826,7 +3851,8 @@ async function startGiftIntent(db, input) {
     input.stripeSecret,
     stored,
     input.purchaserEmail,
-    typeof stored.providerCustomerId === "string" ? stored.providerCustomerId : input.existingCustomerId
+    typeof stored.providerCustomerId === "string" ? stored.providerCustomerId : input.existingCustomerId,
+    input.runtime
   );
   await db.transact([{ t: "update", ns: "giftPurchaseIntents", id: input.id, attrs: {
     status: "checkout_ready",
@@ -3845,18 +3871,29 @@ async function startGiftIntent(db, input) {
   };
 }
 
+// src/stripe-runtime.ts
+function stripeWebhookSecretName(runtime) {
+  if (!runtime) return "stripe_webhook_secret";
+  if (!/^[a-z0-9]{2,12}$/.test(runtime) || runtime === "prod" || runtime === "production") {
+    throw new Error("ODLA_RUNTIME is invalid");
+  }
+  return `stripe_webhook_secret__${runtime}`;
+}
+
+// src/payments-route-support.ts
+var paymentErrorCode = (error) => error && typeof error === "object" && typeof error.code === "string" ? error.code : "unknown";
+function paymentLineItems(group) {
+  const standard = Number(group.standardPriceCents ?? 0);
+  const discount = Number(group.foundingDiscountCents ?? 0);
+  return { standardCents: standard, discountCents: discount, dueTodayCents: standard - discount };
+}
+
 // src/worker-routes-payments.ts
-var codeOf = (err) => err && typeof err === "object" && typeof err.code === "string" ? err.code : "unknown";
 async function firstRow2(db, ns, q) {
   const res = await db.query({ [ns]: { $: q } });
   const rows4 = res[ns];
   return Array.isArray(rows4) ? rows4[0] : void 0;
 }
-function lineItems(group) {
-  const standard = Number(group.standardPriceCents ?? 0);
-  const discount = Number(group.foundingDiscountCents ?? 0);
-  return { standardCents: standard, discountCents: discount, dueTodayCents: standard - discount };
-}
 async function findApplication(db, event) {
   if ("applicationId" in event && event.applicationId) {
     return firstRow2(db, "applications", { where: { id: event.applicationId }, limit: 1 });
@@ -3947,6 +3984,7 @@ async function startSubscription(req, env, ctx) {
         chapterId: ctx.chapter.id,
         environment: env.ODLA_ENV,
         offer,
+        ...env.ODLA_RUNTIME ? { runtime: env.ODLA_RUNTIME } : {},
         purchaserType: "application",
         purchaserEmail: String(app.email ?? ""),
         purchaserEmailNormalized: normalizeChapterEmail(String(app.email ?? "")),
@@ -3979,6 +4017,7 @@ async function startSubscription(req, env, ctx) {
     result = await provider.createSubscription({
       appId: env.ODLA_APP_ID,
       environment: env.ODLA_ENV,
+      ...env.ODLA_RUNTIME ? { runtime: env.ODLA_RUNTIME } : {},
       applicationId,
       groupId: String(group.id),
       email: String(app.email ?? ""),
@@ -3987,29 +4026,35 @@ async function startSubscription(req, env, ctx) {
       existingCustomerId: typeof app.stripeCustomerId === "string" ? app.stripeCustomerId : void 0
     });
   } catch (err) {
-    return json({ error: "payment setup failed", code: codeOf(err) }, 502);
+    return json({ error: "payment setup failed", code: paymentErrorCode(err) }, 502);
   }
   await db.transact([
     {
       t: "update",
       ns: "applications",
       id: applicationId,
-      attrs: { stripeCustomerId: result.customerId, stripeSubscriptionId: result.subscriptionId, refundPolicyAckAt: Date.now() }
+      attrs: {
+        stripeCustomerId: result.customerId,
+        stripeSubscriptionId: result.subscriptionId,
+        ...env.ODLA_RUNTIME ? { stripeRuntime: env.ODLA_RUNTIME } : {},
+        refundPolicyAckAt: Date.now()
+      }
     }
   ]);
-  return json({ clientSecret: result.clientSecret, publishableKey: group.stripePublishableKey ?? null, lineItems: lineItems(group) });
+  return json({ clientSecret: result.clientSecret, publishableKey: group.stripePublishableKey ?? null, lineItems: paymentLineItems(group) });
 }
 async function ingestWebhook(req, env, ctx) {
   const db = ctx.makeDb(env);
-  const webhookSecret = await getVaultSecret(db, "stripe_webhook_secret");
+  const webhookSecret = await getVaultSecret(db, stripeWebhookSecretName(env.ODLA_RUNTIME));
   if (!webhookSecret) return json({ error: "webhook not configured" }, 503);
   const rawBody = await req.text();
   const ingest = await createStripeProvider({ webhookSecret }).ingestWebhook(rawBody, req.headers.get("stripe-signature") ?? "");
   if (!ingest.ok) return json({ error: "invalid signature" }, 400);
   const { eventId, event } = ingest;
   if (event.kind === "ignored") return json({ ok: true, ignored: event.type });
-  const identifiedEnvironment = event.appId !== void 0 || event.environment !== void 0;
-  if (env.ODLA_APP_ID && identifiedEnvironment && (event.appId !== env.ODLA_APP_ID || event.environment !== env.ODLA_ENV)) {
+  const identifiedEnvironment = event.appId !== void 0 || event.environment !== void 0 || event.dataEnvironment !== void 0 || event.runtime !== void 0;
+  const eventDataEnvironment = event.dataEnvironment ?? event.environment;
+  if (env.ODLA_APP_ID && identifiedEnvironment && (event.appId !== env.ODLA_APP_ID || eventDataEnvironment !== env.ODLA_ENV || event.runtime !== void 0 && event.runtime !== env.ODLA_RUNTIME)) {
     return json({ ok: true, matched: false });
   }
   if (event.kind === "gift_paid" || event.kind === "gift_revoked") {
@@ -4017,6 +4062,9 @@ async function ingestWebhook(req, env, ctx) {
     if (!intent || intent.chapterId !== ctx.chapter.id || intent.environment !== env.ODLA_ENV) {
       return json({ ok: true, matched: false });
     }
+    if (event.runtime === void 0 && typeof intent.runtime === "string" && intent.runtime !== env.ODLA_RUNTIME) {
+      return json({ ok: true, matched: false });
+    }
     if (event.kind === "gift_paid") {
       if (intent.providerObjectId !== event.providerObjectId) return json({ ok: true, matched: false });
       if (intent.status === "refunded" || intent.status === "canceled") return json({ ok: true, matched: false });
@@ -4040,6 +4088,9 @@ async function ingestWebhook(req, env, ctx) {
   }
   const app = await findApplication(db, event);
   if (!app) return json({ ok: true, matched: false });
+  if (event.runtime === void 0 && typeof app.stripeRuntime === "string" && app.stripeRuntime !== env.ODLA_RUNTIME) {
+    return json({ ok: true, matched: false });
+  }
   const patch = webhookPatch(event, String(app.status ?? ""));
   let next = app;
   if (Object.keys(patch).length) {
@@ -4142,6 +4193,7 @@ var handleGifts = async (req, url, env, ctx) => {
         offer,
         purchaserType: "member",
         purchaserEmail: user.email,
+        ...env.ODLA_RUNTIME ? { runtime: env.ODLA_RUNTIME } : {},
         purchaserEmailNormalized: emailNormalized,
         purchaserUserId: user.userId,
         ...typeof app?.stripeCustomerId === "string" ? { existingCustomerId: app.stripeCustomerId } : {},
@@ -6074,9 +6126,23 @@ async function saveLocalBuilderLibrary(db, document, environment, expectedRevisi
 
 // src/worker-routes-builder-library.ts
 var BODY_CAP2 = 1e6;
-async function verifySource(req, db, sources) {
+async function verifySource(req, db, ctx) {
+  const sources = ctx.chapter.builderLibrary?.sources ?? [];
+  if (ctx.chapter.mode === "chapter") {
+    const secret = await getVaultSecret(db, "network_share_secret");
+    if (!secret) return null;
+    const verified = await verifyFederatedRequest8(req, {
+      secret,
+      senders: sources.map((source2) => source2.sourceId)
+    });
+    if (!verified.ok) return null;
+    const source = sources.find((candidate) => candidate.sourceId === verified.sender);
+    return source ? { source, body: verified.body } : null;
+  }
   for (const source of sources) {
-    const secret = await getVaultSecret(db, source.secretName);
+    const target = ctx.chapter.network.targets.find((candidate) => candidate.id === source.sourceId);
+    if (!target) continue;
+    const secret = await getVaultSecret(db, target.secretName);
     if (!secret) continue;
     const verified = await verifyFederatedRequest8(req.clone(), { secret, senders: [source.sourceId] });
     if (verified.ok) return { source, body: verified.body };
@@ -6088,7 +6154,7 @@ var handleBuilderLibraryControl = async (req, url, env, ctx) => {
   const settings = ctx.chapter.builderLibrary;
   if (!settings) return json({ error: "not found" }, 404);
   const db = ctx.makeDb(env);
-  const verified = await verifySource(req, db, settings.sources);
+  const verified = await verifySource(req, db, ctx);
   if (!verified) return json({ error: "unauthorized" }, 401);
   let input;
   try {