@odla-ai/chapter 0.41.1 → 0.42.1

package/dist/worker/index.cjs

@@ -2009,7 +2009,12 @@ var handleMember = async (req, url, env, ctx) => {
     const group = Array.isArray(groups) ? groups[0] : void 0;
     if (!group) return json({ error: "not found" }, 404);
     const state = await continueJoin(db, ctx, env, url.origin, app, group);
-    if (state) return json({ state, applicationId, ...state === "gift" ? { claimId: app.giftClaimId } : {} });
+    if (state) return json({
+      state,
+      applicationId,
+      ...state === "gift" ? { claimId: app.giftClaimId } : {},
+      ...state === "payment" && typeof app.giftOfferId === "string" ? { giftPurchase: true } : {}
+    });
     return json({ error: `application cannot resume from status "${String(app.status ?? "")}"` }, 409);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
@@ -2058,6 +2063,7 @@ var handleMember = async (req, url, env, ctx) => {
       duplicate: result.duplicate,
       status: result.status,
       ...state ? { state } : {},
+      ...state === "payment" && requestedGiftId ? { giftPurchase: true } : {},
       // Echoed so a site can see (and assert in an integration test) whether its
       // join page actually posted the ack. Absent consent is otherwise invisible.
       disclaimerAckAt: result.disclaimerAckAt
@@ -3756,9 +3762,15 @@ async function redeemGiftClaim(db, claim, beneficiary, now) {
   const target = claim.target;
   const ops = [];
   let result;
+  let applicationGuard;
   if (target.type === "tier") {
-    const apps = (await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications;
-    const existing = apps?.filter((row) => row.groupId === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
+    const apps = beneficiary.applicationId ? (await db.query({ applications: { $: { where: { id: beneficiary.applicationId }, limit: 1 } } })).applications : (await db.query({ applications: { $: { where: { emailNormalized }, limit: 20 } } })).applications;
+    const existing = beneficiary.applicationId ? apps?.[0] : apps?.filter((row) => row.groupId === chapterId).sort((a, b) => Number(b.createdAt ?? 0) - Number(a.createdAt ?? 0))[0];
+    if (beneficiary.applicationId && (!existing || String(existing.groupId ?? "") !== chapterId || String(existing.emailNormalized ?? "") !== emailNormalized || String(existing.tierId ?? "") !== target.tierId || String(existing.status ?? "") !== "submitted" || typeof existing.stripeSubscriptionId === "string" || typeof existing.giftClaimId === "string" || typeof existing.clerkUserId === "string" && existing.clerkUserId !== beneficiary.userId)) return null;
+    if (beneficiary.applicationId) applicationGuard = {
+      tierId: target.tierId,
+      ...typeof existing?.clerkUserId === "string" ? { clerkUserId: existing.clerkUserId } : {}
+    };
     const id = existing ? String(existing.id) : `gift-application:${String(claim.id)}`;
     const status = existing && existing.status !== "submitted" ? String(existing.status) : "paid_pending_vetting";
     ops.push({ t: "update", ns: "applications", id, attrs: {
@@ -3775,6 +3787,7 @@ async function redeemGiftClaim(db, claim, beneficiary, now) {
     } });
     result = { kind: "application", id };
   } else {
+    if (beneficiary.applicationId) return null;
     const id = `gift-entitlement:${String(claim.id)}`;
     ops.push({ t: "update", ns: "giftEntitlements", id, attrs: {
       id,
@@ -3798,13 +3811,27 @@ async function redeemGiftClaim(db, claim, beneficiary, now) {
     attemptCount: Number(claim.attemptCount ?? 0) + 1
   } });
   try {
+    const guards = [{ ns: "giftClaims", id: String(claim.id), exists: true, equals: {
+      status: "pending",
+      codeVersion: Number(claim.codeVersion),
+      codeHash: String(claim.codeHash)
+    } }];
+    if (beneficiary.applicationId) guards.push({
+      ns: "applications",
+      id: beneficiary.applicationId,
+      exists: true,
+      equals: {
+        status: "submitted",
+        groupId: chapterId,
+        emailNormalized,
+        tierId: applicationGuard.tierId,
+        ...applicationGuard?.clerkUserId ? { clerkUserId: applicationGuard.clerkUserId } : {}
+      },
+      absent: ["stripeSubscriptionId", "giftClaimId"]
+    });
     await db.transact(ops, {
       mutationId: `gift-redeem:${String(claim.id)}:${beneficiary.userId}`,
-      guards: [{ ns: "giftClaims", id: String(claim.id), exists: true, equals: {
-        status: "pending",
-        codeVersion: Number(claim.codeVersion),
-        codeHash: String(claim.codeHash)
-      } }]
+      guards
     });
     return result;
   } catch {
@@ -4319,15 +4346,35 @@ var handleGifts = async (req, url, env, ctx) => {
       return json({ error: "too many attempts" }, 429);
     }
     let code = "";
+    let applicationId = "";
     try {
-      code = String(JSON.parse(await req.text()).code ?? "").trim();
+      const body = JSON.parse(await req.text());
+      code = String(body.code ?? "").trim();
+      applicationId = typeof body.applicationId === "string" ? body.applicationId : "";
     } catch {
       return invalid();
     }
-    if (!/^gift1_[A-Za-z0-9_-]{43}$/.test(code)) return invalid();
+    if (!/^gift1_[A-Za-z0-9_-]{43}$/.test(code) || !applicationId) return invalid();
+    const app = first3((await db.query({ applications: { $: { where: { id: applicationId }, limit: 1 } } })).applications);
+    const emailNormalized = normalizeChapterEmail(user.email);
+    if (!app || String(app.groupId ?? "") !== ctx.chapter.id || String(app.emailNormalized ?? "") !== emailNormalized || typeof app.clerkUserId === "string" && app.clerkUserId !== user.userId) return invalid();
     const codeHash = await hashGiftCode(ctx.chapter.id, code);
     const claim = first3((await db.query({ giftClaims: { $: { where: { codeHash }, limit: 1 } } })).giftClaims);
     if (!claim || claim.chapterId !== ctx.chapter.id) return invalid();
+    const sameRedemption = (candidate) => candidate.status === "redeemed" && candidate.applicationId === applicationId && candidate.beneficiaryEmailNormalized === emailNormalized && candidate.beneficiaryUserId === user.userId;
+    const success = async () => {
+      const current = first3((await db.query({ applications: { $: { where: { id: applicationId }, limit: 1 } } })).applications);
+      const group2 = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
+      const state = current && group2 ? await continueJoin(db, ctx, env, url.origin, current, group2) : null;
+      return json({
+        ok: true,
+        kind: "application",
+        id: applicationId,
+        applicationId,
+        ...state ? { state } : {}
+      });
+    };
+    if (sameRedemption(claim)) return success();
     if (claim.status !== "pending" || Number(claim.codeExpiresAt) <= now) {
       await db.transact([{ t: "update", ns: "giftClaims", id: String(claim.id), attrs: {
         attemptCount: Number(claim.attemptCount ?? 0) + 1,
@@ -4335,8 +4382,18 @@ var handleGifts = async (req, url, env, ctx) => {
       } }]).catch(() => void 0);
       return invalid();
     }
-    const redeemed = await redeemGiftClaim(db, claim, { email: user.email, userId: user.userId }, now);
-    return redeemed ? json({ ok: true, ...redeemed }) : invalid();
+    const target = claim.target;
+    const group = first3((await db.query({ groups: { $: { where: { id: ctx.chapter.id }, limit: 1 } } })).groups);
+    const tier = group ? findTier(await loadTiers(db, group), typeof app.tierId === "string" ? app.tierId : null) : void 0;
+    if (String(app.status ?? "") !== "submitted" || typeof app.stripeSubscriptionId === "string" || typeof app.giftClaimId === "string" || !tier || tierIsFree(tier) || target?.type !== "tier" || target.tierId !== app.tierId) return invalid();
+    const redeemed = await redeemGiftClaim(db, claim, {
+      email: user.email,
+      userId: user.userId,
+      applicationId
+    }, now);
+    if (redeemed) return success();
+    const raced = await loadClaim(db, String(claim.id));
+    return raced && sameRedemption(raced) ? success() : invalid();
   }
   return null;
 };
@@ -5319,12 +5376,22 @@ var handleAdminNetworkTargets = async (req, url, env, ctx) => {
   const got = await gate5(req, env, ctx);
   if ("response" in got) return got.response;
   return json({
-    targets: ctx.chapter.network.targets.map(({ id, name, url: targetUrl, fields, sharedNotes }) => ({
+    targets: ctx.chapter.network.targets.map(({
+      id,
+      name,
+      url: targetUrl,
+      fields,
+      sharedNotes,
+      editableFields,
+      stageTransitions
+    }) => ({
       id,
       name,
       url: targetUrl,
       types: Object.keys(fields ?? DEFAULT_SHARE_FIELDS),
-      sharedNotes
+      sharedNotes,
+      editableFields,
+      stageTransitions
     }))
   });
 };
@@ -5442,19 +5509,20 @@ var handleAdminNetworkPush = async (req, url, env, ctx) => {
   return json({ ok: results.every((result) => result.ok), results });
 };
 
-// src/worker-routes-network-records.ts
+// src/worker-routes-network-records-follower.ts
 var import_crm7 = require("@odla-ai/crm");
 var import_db8 = require("@odla-ai/db");
+
+// src/worker-routes-network-records-common.ts
 var IDENTIFIER = /^[a-z][a-zA-Z0-9_]*$/;
 var MAX_PAGE = 50;
 var MAX_OFFSET = 1e4;
 var MAX_SEARCH = 200;
-async function gate6(req, env, ctx) {
-  const db = ctx.makeDb(env);
-  const user = await ctx.verifyUser(req, env);
-  if (!user) return { response: json({ error: "unauthorized" }, 401) };
-  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
-  return { db, user };
+var MAX_BODY = 32768;
+var RECORD_ID = /^[a-zA-Z0-9][a-zA-Z0-9:_-]{0,191}$/;
+var MUTATION_ID = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{7,127}$/;
+function bodyTooLarge(body) {
+  return new TextEncoder().encode(body).byteLength > MAX_BODY;
 }
 function integer(value, fallback, min, max) {
   if (value == null || value === "") return fallback;
@@ -5462,10 +5530,22 @@ function integer(value, fallback, min, max) {
   const parsed = Number(value);
   return Number.isSafeInteger(parsed) && parsed >= min && parsed <= max ? parsed : null;
 }
-function projectRecord(record4, allowed2) {
+function projectRecord(record4, allowed2, editable, stagesEnabled, crm) {
   const fields = Object.fromEntries(
     allowed2.flatMap((name) => Object.prototype.hasOwnProperty.call(record4.fields, name) ? [[name, record4.fields[name]]] : [])
   );
+  const def = crm.type(record4.type);
+  const editFields = editable.map((id) => {
+    const field = def.fields[id];
+    return {
+      id,
+      label: field.label ?? id,
+      type: field.type,
+      required: field.required ?? false,
+      ...field.options ? { options: field.options } : {}
+    };
+  });
+  const allowedStages = stagesEnabled ? (def.pipeline?.stages ?? []).flatMap((stage) => crm.canTransition(record4.type, record4, stage.id) ? [] : [{ id: stage.id, label: stage.label ?? stage.id }]) : [];
   return {
     id: record4.id,
     type: record4.type,
@@ -5473,11 +5553,66 @@ function projectRecord(record4, allowed2) {
     ...record4.stage ? { stage: record4.stage } : {},
     fields,
     createdAt: record4.createdAt,
-    updatedAt: record4.updatedAt
+    updatedAt: record4.updatedAt,
+    revision: record4.updatedAt,
+    ...editFields.length || stagesEnabled ? { edit: { fields: editFields, allowedStages } } : {}
   };
 }
+function readerRecord(record4, reader, crm) {
+  return projectRecord(
+    record4,
+    reader.fields[record4.type] ?? [],
+    reader.editableFields[record4.type] ?? [],
+    reader.stageTransitions.includes(record4.type),
+    crm
+  );
+}
+function restrictedRecord(record4, target) {
+  if (!record4.edit) return record4;
+  const fields = record4.edit.fields.filter((field) => target.editableFields[record4.type]?.includes(field.id));
+  const allowedStages = target.stageTransitions.includes(record4.type) ? record4.edit.allowedStages : [];
+  const edit = fields.length || target.stageTransitions.includes(record4.type) ? { fields, allowedStages } : void 0;
+  return { ...record4, ...edit ? { edit } : { edit: void 0 } };
+}
+
+// src/worker-routes-network-records-follower.ts
+var NETWORK_MUTATION_META = "chapterNetworkMutation";
+function mutationFingerprint(input) {
+  const fields = input.fields ? Object.fromEntries(Object.entries(input.fields).sort(([a], [b]) => a.localeCompare(b))) : void 0;
+  return JSON.stringify({
+    recordId: input.recordId,
+    type: input.type,
+    expectedRevision: input.expectedRevision,
+    expectedStage: input.expectedStage,
+    mutationId: input.mutationId,
+    fields,
+    stage: input.stage,
+    actor: input.actor
+  });
+}
+function mutationError(error) {
+  if (error?.code === "transact_guard_failed") {
+    return json({ error: "record changed since it was reviewed", code: "stale_revision" }, 409);
+  }
+  if (error instanceof import_crm7.CrmInputError) {
+    return json({ error: error.message, code: "invalid_transition_or_fields", ...error.fields ? { fields: error.fields } : {} }, 422);
+  }
+  return json({ error: "follower mutation failed", code: "mutation_failed" }, 500);
+}
+async function priorMutation(db, id) {
+  const result = await db.query({
+    [import_crm7.CRM_NS.activity]: { $: { where: { id }, limit: 1 } }
+  });
+  const row = (result[import_crm7.CRM_NS.activity] ?? [])[0];
+  const meta = row?.meta;
+  const receipt = meta?.[NETWORK_MUTATION_META];
+  return typeof receipt?.fingerprint === "string" ? { fingerprint: receipt.fingerprint } : null;
+}
 var handleNetworkRecords = async (req, url, env, ctx) => {
-  if (req.method !== "GET" || url.pathname !== "/api/network/records") return null;
+  if (url.pathname !== "/api/network/records" || req.method !== "GET" && req.method !== "PATCH") return null;
+  if (req.method === "PATCH" && Number(req.headers.get("content-length") ?? 0) > MAX_BODY) {
+    return json({ error: "mutation body is too large", code: "body_too_large" }, 413);
+  }
   const db = ctx.makeDb(env);
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
@@ -5488,8 +5623,105 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
   });
   if (!verified.ok) return json({ error: "unauthorized", reason: verified.reason }, 401);
   const reader = readers.find((candidate) => candidate.id === verified.sender);
+  if (!reader) return json({ error: "unauthorized" }, 401);
+  if (req.method === "PATCH") {
+    if (bodyTooLarge(verified.body)) {
+      return json({ error: "mutation body is too large", code: "body_too_large" }, 413);
+    }
+    let input;
+    try {
+      input = JSON.parse(verified.body);
+    } catch {
+      return json({ error: "invalid JSON body", code: "invalid_json" }, 422);
+    }
+    const fields = input?.fields;
+    const hasFields = Boolean(fields && typeof fields === "object" && !Array.isArray(fields));
+    const hasStage = typeof input?.stage === "string";
+    const actor = input?.actor;
+    if (!input || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID.test(input.mutationId) || !actor || typeof actor.id !== "string" || !RECORD_ID.test(actor.id) || hasFields === hasStage) {
+      return json({ error: "invalid network mutation", code: "invalid_mutation" }, 422);
+    }
+    const editable = reader.editableFields[input.type];
+    if (hasFields) {
+      const names = Object.keys(fields);
+      if (!editable || names.length === 0 || names.length > 32 || names.some((name) => !editable.includes(name))) {
+        return json({ error: "profile fields are not delegated for this reader", code: "field_forbidden" }, 403);
+      }
+    } else if (!reader.stageTransitions.includes(input.type)) {
+      return json({ error: "stage transitions are not delegated for this reader", code: "stage_forbidden" }, 403);
+    }
+    const activityId = `network-edit:${verified.sender}:${input.mutationId}`;
+    const fingerprint = mutationFingerprint(input);
+    const prior = await priorMutation(db, activityId);
+    if (prior) {
+      if (prior.fingerprint !== fingerprint) {
+        return json({ error: "mutationId was already used for different input", code: "mutation_conflict" }, 409);
+      }
+      const replayed = await (0, import_crm7.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
+      if (!replayed || replayed.type !== input.type) return json({ error: "record not found", code: "not_found" }, 404);
+      const result = {
+        version: 1,
+        site: { id: ctx.chapter.id, name: ctx.chapter.name },
+        record: readerRecord(replayed, reader, ctx.chapter.crm),
+        duplicate: true
+      };
+      return json(result);
+    }
+    const record4 = await (0, import_crm7.getRecord)({ crm: ctx.chapter.crm, db }, input.recordId);
+    if (!record4 || record4.type !== input.type) return json({ error: "record not found", code: "not_found" }, 404);
+    if (record4.updatedAt !== input.expectedRevision) {
+      return json({ error: "record changed since it was reviewed", code: "stale_revision" }, 409);
+    }
+    if (hasStage && (input.expectedStage ?? null) !== (record4.stage ?? null)) {
+      return json({ error: "stage changed since it was reviewed", code: "stale_stage" }, 409);
+    }
+    const actorEmail = typeof actor.email === "string" && actor.email.length <= 320 ? actor.email : void 0;
+    const auditMeta = {
+      [NETWORK_MUTATION_META]: {
+        version: 1,
+        sourceId: verified.sender,
+        actorId: actor.id,
+        ...actorEmail ? { actorEmail } : {},
+        mutationId: input.mutationId,
+        fingerprint
+      }
+    };
+    try {
+      const deps = { crm: ctx.chapter.crm, db };
+      const updated = hasFields ? await (0, import_crm7.updateRecord)(deps, {
+        id: record4.id,
+        input: fields,
+        mutationId: activityId,
+        expectedUpdatedAt: input.expectedRevision,
+        audit: {
+          id: activityId,
+          body: `Profile edited remotely by ${verified.sender}`,
+          authorId: `network:${verified.sender}`,
+          meta: auditMeta
+        }
+      }) : await (0, import_crm7.setStage)(deps, {
+        id: record4.id,
+        to: input.stage,
+        authorId: `network:${verified.sender}`,
+        mutationId: activityId,
+        expectedUpdatedAt: input.expectedRevision,
+        expectedStage: input.expectedStage ?? null,
+        activityId,
+        activityMeta: auditMeta
+      });
+      const result = {
+        version: 1,
+        site: { id: ctx.chapter.id, name: ctx.chapter.name },
+        record: readerRecord(updated.record, reader, ctx.chapter.crm),
+        duplicate: updated.duplicate
+      };
+      return json(result);
+    } catch (error) {
+      return mutationError(error);
+    }
+  }
   const type = url.searchParams.get("type") ?? "";
-  const allowed2 = reader?.fields[type];
+  const allowed2 = reader.fields[type];
   if (!IDENTIFIER.test(type) || !allowed2) return json({ error: "record type is not shared with this reader" }, 403);
   const limit = integer(url.searchParams.get("limit"), 25, 1, MAX_PAGE);
   const offset = integer(url.searchParams.get("offset"), 0, 0, MAX_OFFSET);
@@ -5511,13 +5743,23 @@ var handleNetworkRecords = async (req, url, env, ctx) => {
     version: 1,
     site: { id: ctx.chapter.id, name: ctx.chapter.name },
     type,
-    records: page.records.map((record4) => projectRecord(record4, allowed2)),
+    records: page.records.map((record4) => readerRecord(record4, reader, ctx.chapter.crm)),
     total: page.total,
     limit: page.limit,
     offset: page.offset
   };
   return json(response);
 };
+
+// src/worker-routes-network-records-admin.ts
+var import_db9 = require("@odla-ai/db");
+async function gate6(req, env, ctx) {
+  const db = ctx.makeDb(env);
+  const user = await ctx.verifyUser(req, env);
+  if (!user) return { response: json({ error: "unauthorized" }, 401) };
+  if (!await ctx.isAdmin(db, user)) return { response: json({ error: "forbidden" }, 403) };
+  return { db, user };
+}
 function targetFor(ctx, id) {
   return ctx.chapter.network.targets.find((target) => target.id === id);
 }
@@ -5527,12 +5769,7 @@ async function readTargetRecords(db, env, ctx, target, query) {
   const destination = new URL("/api/network/records", target.url);
   destination.search = query.toString();
   try {
-    const headers = await (0, import_db8.signFederatedRequest)({
-      secret,
-      sender: ctx.chapter.id,
-      method: "GET",
-      url: destination
-    });
+    const headers = await (0, import_db9.signFederatedRequest)({ secret, sender: ctx.chapter.id, method: "GET", url: destination });
     const response = await fetchNetworkTarget(env, target, destination, {
       headers,
       signal: AbortSignal.timeout(1e4)
@@ -5545,15 +5782,90 @@ async function readTargetRecords(db, env, ctx, target, query) {
         error: upstream ?? (response.ok ? "invalid follower record response" : `follower returned ${response.status}`)
       };
     }
-    return { ok: true, page: body };
+    return {
+      ok: true,
+      page: { ...body, records: body.records.map((record4) => restrictedRecord(record4, target)) }
+    };
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : "record read failed" };
   }
 }
+async function mutateTargetRecord(db, env, ctx, target, input) {
+  const fields = input.fields;
+  if (fields) {
+    const allowed2 = target.editableFields[input.type];
+    if (!allowed2 || Object.keys(fields).some((name) => !allowed2.includes(name))) {
+      return json({ error: "profile fields are not enabled for this target", code: "field_forbidden" }, 403);
+    }
+  } else if (!target.stageTransitions.includes(input.type)) {
+    return json({ error: "stage transitions are not enabled for this target", code: "stage_forbidden" }, 403);
+  }
+  const secret = await getVaultSecret(db, target.secretName);
+  if (!secret) return json({ error: "edge secret is missing", code: "edge_unavailable" }, 502);
+  const destination = new URL("/api/network/records", target.url);
+  const body = JSON.stringify(input);
+  try {
+    const headers = await (0, import_db9.signFederatedRequest)({
+      secret,
+      sender: ctx.chapter.id,
+      method: "PATCH",
+      url: destination,
+      body
+    });
+    const response = await fetchNetworkTarget(env, target, destination, {
+      method: "PATCH",
+      headers: { ...headers, "content-type": "application/json" },
+      body,
+      signal: AbortSignal.timeout(1e4)
+    });
+    const payload = await response.json().catch(() => null);
+    const site = payload && "site" in payload ? payload.site : void 0;
+    if (!response.ok || !payload || !("record" in payload) || site && site.id !== target.id) {
+      const status = [401, 403, 404, 409, 422].includes(response.status) ? response.status : 502;
+      return json({
+        error: payload && "error" in payload && typeof payload.error === "string" ? payload.error : `follower returned ${response.status}`,
+        ...payload && "code" in payload && typeof payload.code === "string" ? { code: payload.code } : {}
+      }, status);
+    }
+    return json({ ...payload, record: restrictedRecord(payload.record, target) });
+  } catch {
+    return json({ error: "follower mutation request failed", code: "follower_unavailable" }, 502);
+  }
+}
 var handleAdminNetworkRecords = async (req, url, env, ctx) => {
-  if (req.method !== "GET" || url.pathname !== "/api/admin/network/records") return null;
+  if (url.pathname !== "/api/admin/network/records" || req.method !== "GET" && req.method !== "PATCH") return null;
+  if (req.method === "PATCH" && Number(req.headers.get("content-length") ?? 0) > MAX_BODY) {
+    return json({ error: "mutation body is too large", code: "body_too_large" }, 413);
+  }
   const got = await gate6(req, env, ctx);
   if ("response" in got) return got.response;
+  if (req.method === "PATCH") {
+    let input;
+    try {
+      const body = await req.text();
+      if (bodyTooLarge(body)) {
+        return json({ error: "mutation body is too large", code: "body_too_large" }, 413);
+      }
+      input = JSON.parse(body);
+    } catch {
+      return json({ error: "invalid JSON body", code: "invalid_json" }, 422);
+    }
+    const target2 = targetFor(ctx, input?.targetId);
+    const hasFields = Boolean(input?.fields && typeof input.fields === "object" && !Array.isArray(input.fields));
+    const hasStage = typeof input?.stage === "string";
+    if (!target2 || !IDENTIFIER.test(input.type) || !RECORD_ID.test(input.recordId) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || !MUTATION_ID.test(input.mutationId) || hasFields === hasStage) {
+      return json({ error: "invalid network mutation", code: "invalid_mutation" }, 422);
+    }
+    return mutateTargetRecord(got.db, env, ctx, target2, {
+      type: input.type,
+      recordId: input.recordId,
+      expectedRevision: input.expectedRevision,
+      mutationId: input.mutationId,
+      ...input.expectedStage !== void 0 ? { expectedStage: input.expectedStage } : {},
+      ...hasFields ? { fields: input.fields } : { stage: input.stage },
+      actor: { id: got.user.userId, ...got.user.email ? { email: got.user.email } : {} }
+    });
+  }
   const targetId = url.searchParams.get("targetId") ?? "";
   const type = url.searchParams.get("type") ?? "";
   const target = targetFor(ctx, targetId);
@@ -5566,19 +5878,13 @@ var handleAdminNetworkRecords = async (req, url, env, ctx) => {
   }
   const query = new URLSearchParams({ type, limit: String(limit), offset: String(offset) });
   if (search) query.set("search", search);
-  const result = await readTargetRecords(
-    got.db,
-    env,
-    ctx,
-    target,
-    query
-  );
+  const result = await readTargetRecords(got.db, env, ctx, target, query);
   return result.ok ? json(result.page) : json({ error: result.error }, 502);
 };
 
 // src/worker-routes-network-notes.ts
 var IDENTIFIER2 = /^[a-z][a-zA-Z0-9_]*$/;
-var RECORD_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 var MAX_NOTE2 = 4e3;
 async function gate7(req, env, ctx) {
   const db = ctx.makeDb(env);
@@ -5592,7 +5898,7 @@ function noteIdentity(url, ctx) {
   const recordType = url.searchParams.get("type") ?? "";
   const recordId = url.searchParams.get("recordId") ?? "";
   const configured = ctx.chapter.network.targets.some((target) => target.id === targetId);
-  if (!configured || !IDENTIFIER2.test(recordType) || !RECORD_ID.test(recordId)) return null;
+  if (!configured || !IDENTIFIER2.test(recordType) || !RECORD_ID2.test(recordId)) return null;
   return {
     targetId,
     recordType,
@@ -5662,10 +5968,10 @@ var handleAdminNetworkNotes = async (req, url, env, ctx) => {
 
 // src/worker-routes-network-shared-notes.ts
 var import_crm8 = require("@odla-ai/crm");
-var import_db9 = require("@odla-ai/db");
+var import_db10 = require("@odla-ai/db");
 var IDENTIFIER3 = /^[a-z][a-zA-Z0-9_]*$/;
-var RECORD_ID2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
-var MUTATION_ID = /^[A-Za-z0-9_-]{16,128}$/;
+var RECORD_ID3 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
+var MUTATION_ID2 = /^[A-Za-z0-9_-]{16,128}$/;
 var MAX_NOTE3 = 4e3;
 var NETWORK_META = "chapterNetwork";
 async function gate8(req, env, ctx) {
@@ -5721,7 +6027,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   const secret = await getVaultSecret(db, "network_share_secret");
   const readers = ctx.chapter.network.readers;
   if (!secret || readers.length === 0) return json({ error: "unauthorized" }, 401);
-  const verified = await (0, import_db9.verifyFederatedRequest)(req, {
+  const verified = await (0, import_db10.verifyFederatedRequest)(req, {
     secret,
     senders: readers.map((reader2) => reader2.id)
   });
@@ -5729,7 +6035,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   const reader = readers.find((candidate) => candidate.id === verified.sender);
   const recordType = url.searchParams.get("type") ?? "";
   const recordId = url.searchParams.get("recordId") ?? "";
-  if (!IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
+  if (!IDENTIFIER3.test(recordType) || !RECORD_ID3.test(recordId) || !reader?.sharedNotes.includes(recordType)) {
     return json({ error: "shared notes are not enabled for this reader and record type" }, 403);
   }
   const record4 = await (0, import_crm8.getRecord)({ crm: ctx.chapter.crm, db }, recordId);
@@ -5749,7 +6055,7 @@ var handleNetworkSharedNotes = async (req, url, env, ctx) => {
   }
   const body = typeof input.body === "string" ? input.body.trim() : "";
   const mutationId = typeof input.mutationId === "string" ? input.mutationId : "";
-  if (!body || body.length > MAX_NOTE3 || !MUTATION_ID.test(mutationId)) {
+  if (!body || body.length > MAX_NOTE3 || !MUTATION_ID2.test(mutationId)) {
     return json({ error: `body must be 1\u2013${MAX_NOTE3} characters and mutationId must be valid` }, 400);
   }
   const createdAt = Date.now();
@@ -5798,7 +6104,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   const recordType = url.searchParams.get("type") ?? "";
   const recordId = url.searchParams.get("recordId") ?? "";
   const target = targetFor2(ctx, targetId);
-  if (!target || !target.sharedNotes.includes(recordType) || !IDENTIFIER3.test(recordType) || !RECORD_ID2.test(recordId)) {
+  if (!target || !target.sharedNotes.includes(recordType) || !IDENTIFIER3.test(recordType) || !RECORD_ID3.test(recordId)) {
     return json({ error: "configured targetId, type, and recordId are required" }, 400);
   }
   let body = "";
@@ -5818,7 +6124,7 @@ var handleAdminNetworkSharedNotes = async (req, url, env, ctx) => {
   const destination = new URL("/api/network/shared-notes", target.url);
   destination.search = new URLSearchParams({ type: recordType, recordId }).toString();
   try {
-    const headers = await (0, import_db9.signFederatedRequest)({
+    const headers = await (0, import_db10.signFederatedRequest)({
       secret,
       sender: ctx.chapter.id,
       method: req.method,
@@ -5925,7 +6231,7 @@ var handleFormation = async (req, url, env, ctx) => {
 };
 
 // src/worker-routes-builder-library.ts
-var import_db10 = require("@odla-ai/db");
+var import_db11 = require("@odla-ai/db");
 
 // src/builder-library-validation.ts
 var ID4 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -6208,7 +6514,7 @@ async function verifySource(req, db, ctx) {
   if (ctx.chapter.mode === "chapter") {
     const secret = await getVaultSecret(db, "network_share_secret");
     if (!secret) return null;
-    const verified = await (0, import_db10.verifyFederatedRequest)(req, {
+    const verified = await (0, import_db11.verifyFederatedRequest)(req, {
       secret,
       senders: sources.map((source2) => source2.sourceId)
     });
@@ -6221,7 +6527,7 @@ async function verifySource(req, db, ctx) {
     if (!target) continue;
     const secret = await getVaultSecret(db, target.secretName);
     if (!secret) continue;
-    const verified = await (0, import_db10.verifyFederatedRequest)(req.clone(), { secret, senders: [source.sourceId] });
+    const verified = await (0, import_db11.verifyFederatedRequest)(req.clone(), { secret, senders: [source.sourceId] });
     if (verified.ok) return { source, body: verified.body };
   }
   return null;
@@ -6410,11 +6716,11 @@ var handleAdminBuilderLibrary = async (req, url, env, ctx) => {
 };
 
 // src/signup-control-delivery.ts
-var import_db11 = require("@odla-ai/db");
+var import_db12 = require("@odla-ai/db");
 async function deliverSignupControl(options) {
   const destination = new URL(SIGNUP_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db11.signFederatedRequest)({
+  const signed = await (0, import_db12.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -6435,11 +6741,11 @@ async function deliverSignupControl(options) {
 }
 
 // src/member-content-delivery.ts
-var import_db12 = require("@odla-ai/db");
+var import_db13 = require("@odla-ai/db");
 async function deliverMemberContent(options) {
   const destination = new URL(MEMBER_CONTENT_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db12.signFederatedRequest)({
+  const signed = await (0, import_db13.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",
@@ -6460,11 +6766,11 @@ async function deliverMemberContent(options) {
 }
 
 // src/builder-library-delivery.ts
-var import_db13 = require("@odla-ai/db");
+var import_db14 = require("@odla-ai/db");
 async function deliverBuilderLibrary(options) {
   const destination = new URL(BUILDER_LIBRARY_CONTROL_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db13.signFederatedRequest)({ secret: options.secret, sender: options.sender, method: "POST", url: destination, body });
+  const signed = await (0, import_db14.signFederatedRequest)({ secret: options.secret, sender: options.sender, method: "POST", url: destination, body });
   const response = await (options.fetch ?? globalThis.fetch)(destination, { method: "POST", headers: { ...signed, "content-type": "application/json" }, body });
   const result = await response.json();
   if (!response.ok || !("ok" in result) || result.ok !== true) {
@@ -6475,11 +6781,11 @@ async function deliverBuilderLibrary(options) {
 }
 
 // src/admission-grants-delivery.ts
-var import_db14 = require("@odla-ai/db");
+var import_db15 = require("@odla-ai/db");
 async function deliverAdmissionGrants(options) {
   const destination = new URL(ADMISSION_GRANTS_PATH, options.targetUrl);
   const body = JSON.stringify(options.envelope);
-  const signed = await (0, import_db14.signFederatedRequest)({
+  const signed = await (0, import_db15.signFederatedRequest)({
     secret: options.secret,
     sender: options.sender,
     method: "POST",