@makolabs/ripple 3.8.0 → 3.8.1

package/dist/funcs/clerk-requests.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Pure builders for Clerk user-API requests, extracted from
+ * `user-management.remote.ts` so the request shape is unit-testable — a
+ * `*.remote.ts` module cannot be imported in vitest (SvelteKit's plugin rejects
+ * any non-remote export).
+ *
+ * They also document the rule that caused minted API keys to silently never
+ * persist: Clerk deprecated sending `private_metadata` in the body of
+ * `PATCH /users/{id}` (it now returns 422 `form_param_deprecated`). User
+ * metadata must be written through the dedicated `PATCH /users/{id}/metadata`
+ * endpoint, which merges into the existing metadata.
+ */
+export interface ClerkRequest {
+    endpoint: string;
+    init: {
+        method: string;
+        body: string;
+    };
+}
+/**
+ * Build a request that persists `privateMetadata` on a Clerk user via the
+ * dedicated metadata endpoint. Clerk merges the provided keys into the user's
+ * existing private metadata.
+ */
+export declare function clerkMetadataPatch(userId: string, privateMetadata: Record<string, unknown>): ClerkRequest;
+/**
+ * Build the body for a profile update (`PATCH /users/{id}`). Metadata is
+ * intentionally excluded — it must go through {@link clerkMetadataPatch}.
+ */
+export declare function clerkProfilePatchBody(userData: {
+    first_name?: string;
+    last_name?: string;
+    username?: string;
+}): Record<string, string>;

package/dist/funcs/clerk-requests.js

@@ -0,0 +1,38 @@
+/**
+ * Pure builders for Clerk user-API requests, extracted from
+ * `user-management.remote.ts` so the request shape is unit-testable — a
+ * `*.remote.ts` module cannot be imported in vitest (SvelteKit's plugin rejects
+ * any non-remote export).
+ *
+ * They also document the rule that caused minted API keys to silently never
+ * persist: Clerk deprecated sending `private_metadata` in the body of
+ * `PATCH /users/{id}` (it now returns 422 `form_param_deprecated`). User
+ * metadata must be written through the dedicated `PATCH /users/{id}/metadata`
+ * endpoint, which merges into the existing metadata.
+ */
+/**
+ * Build a request that persists `privateMetadata` on a Clerk user via the
+ * dedicated metadata endpoint. Clerk merges the provided keys into the user's
+ * existing private metadata.
+ */
+export function clerkMetadataPatch(userId, privateMetadata) {
+    return {
+        endpoint: `/users/${userId}/metadata`,
+        init: { method: 'PATCH', body: JSON.stringify({ private_metadata: privateMetadata }) }
+    };
+}
+/**
+ * Build the body for a profile update (`PATCH /users/{id}`). Metadata is
+ * intentionally excluded — it must go through {@link clerkMetadataPatch}.
+ */
+export function clerkProfilePatchBody(userData) {
+    const body = {};
+    if (userData.first_name !== undefined)
+        body.first_name = userData.first_name;
+    if (userData.last_name !== undefined)
+        body.last_name = userData.last_name;
+    if (userData.username !== undefined && userData.username !== '') {
+        body.username = userData.username;
+    }
+    return body;
+}

package/dist/funcs/user-management.remote.js

@@ -2,6 +2,7 @@ import { command } from '$app/server';
 import { getRequestEvent } from '$app/server';
 import { env } from '$env/dynamic/private';
 import { building } from '$app/environment';
+import { clerkMetadataPatch, clerkProfilePatchBody } from './clerk-requests.js';
 const CLIENT_ID = env.CLIENT_ID;
 const ORGANIZATION_ID = env.ALLOWED_ORG_ID;
 if (!CLIENT_ID && !building) {
@@ -248,6 +249,16 @@ async function createUserPermissions(email, permissions, clientId = CLIENT_ID) {
     log.trace('createUserPermissions', 'Result:', result);
     return result;
 }
+/**
+ * Persist private metadata on a Clerk user via the dedicated metadata endpoint.
+ * Clerk deprecated `private_metadata` in the body of `PATCH /users/{id}` (it
+ * now returns 422 form_param_deprecated), which silently dropped minted API
+ * keys. Routes through `PATCH /users/{id}/metadata` (which merges) instead.
+ */
+async function writeClerkMetadata(userId, privateMetadata) {
+    const { endpoint, init } = clerkMetadataPatch(userId, privateMetadata);
+    return makeClerkRequest(endpoint, init);
+}
 export const getUsers = command('unchecked', async (options) => {
     log.trace('getUsers', 'Called with options:', options);
     try {
@@ -347,14 +358,9 @@ export const createUser = command('unchecked', async (userData) => {
                 const apiKey = adminKeyResult?.data?.key;
                 log.trace('createUser', 'Admin key created, has key:', !!apiKey);
                 if (adminKeyResult && apiKey) {
-                    const updatedUser = await makeClerkRequest(`/users/${result.id}`, {
-                        method: 'PATCH',
-                        body: JSON.stringify({
-                            private_metadata: {
-                                ...result.private_metadata,
-                                mako_api_key: apiKey
-                            }
-                        })
+                    const updatedUser = await writeClerkMetadata(result.id, {
+                        ...result.private_metadata,
+                        mako_api_key: apiKey
                     });
                     // Ensure updatedUser is serializable
                     result = JSON.parse(JSON.stringify(updatedUser));
@@ -385,22 +391,19 @@ export const updateUser = command('unchecked', async (options) => {
     const { userId, userData } = options;
     log.trace('updateUser', 'Called for userId:', userId, 'fields:', Object.keys(userData));
     try {
-        const updateData = {};
-        if (userData.first_name !== undefined)
-            updateData.first_name = userData.first_name;
-        if (userData.last_name !== undefined)
-            updateData.last_name = userData.last_name;
-        if (userData.username !== undefined && userData.username !== '') {
-            updateData.username = userData.username;
-        }
+        // Profile fields and metadata live behind different Clerk endpoints —
+        // `private_metadata` is no longer accepted on PATCH /users/{id}.
+        const profileBody = clerkProfilePatchBody(userData);
+        log.trace('updateUser', 'Profile payload:', profileBody);
+        let result = Object.keys(profileBody).length > 0
+            ? await makeClerkRequest(`/users/${userId}`, {
+                method: 'PATCH',
+                body: JSON.stringify(profileBody)
+            })
+            : await makeClerkRequest(`/users/${userId}`);
         if (userData.private_metadata !== undefined) {
-            updateData.private_metadata = userData.private_metadata;
+            result = await writeClerkMetadata(userId, userData.private_metadata);
         }
-        log.trace('updateUser', 'Update payload:', updateData);
-        let result = await makeClerkRequest(`/users/${userId}`, {
-            method: 'PATCH',
-            body: JSON.stringify(updateData)
-        });
         // Ensure result is serializable
         result = JSON.parse(JSON.stringify(result));
         if (userData.permissions !== undefined) {
@@ -572,14 +575,9 @@ export const updateUserPermissions = command('unchecked', async (options) => {
             const newKeyResult = await createUserPermissions(email, permissions);
             const newApiKey = newKeyResult?.data?.key;
             if (newApiKey) {
-                await makeClerkRequest(`/users/${userId}`, {
-                    method: 'PATCH',
-                    body: JSON.stringify({
-                        private_metadata: {
-                            ...(user.private_metadata || {}),
-                            mako_api_key: newApiKey
-                        }
-                    })
+                await writeClerkMetadata(userId, {
+                    ...(user.private_metadata || {}),
+                    mako_api_key: newApiKey
                 });
                 log.trace('updateUserPermissions', 'New key stored in Clerk metadata');
             }
@@ -742,14 +740,9 @@ export const generateApiKey = command('unchecked', async (options) => {
                 currentUser = await makeClerkRequest(`/users/${options.userId}`);
             }
             if (currentUser) {
-                await makeClerkRequest(`/users/${options.userId}`, {
-                    method: 'PATCH',
-                    body: JSON.stringify({
-                        private_metadata: {
-                            ...(currentUser.private_metadata || {}),
-                            mako_api_key: newApiKey
-                        }
-                    })
+                await writeClerkMetadata(options.userId, {
+                    ...(currentUser.private_metadata || {}),
+                    mako_api_key: newApiKey
                 });
                 log.trace('generateApiKey', 'Clerk metadata updated with new key');
             }
@@ -874,11 +867,9 @@ export const approveUser = command('unchecked', async (input) => {
         if (!apiKey) {
             throw new Error('Failed to mint API key during approval');
         }
-        await makeClerkRequest(`/users/${input.userId}`, {
-            method: 'PATCH',
-            body: JSON.stringify({
-                private_metadata: { ...(user.private_metadata || {}), mako_api_key: apiKey }
-            })
+        await writeClerkMetadata(input.userId, {
+            ...(user.private_metadata || {}),
+            mako_api_key: apiKey
         });
         log.trace('approveUser', 'Approved and key issued');
         return JSON.parse(JSON.stringify({ apiKey }));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makolabs/ripple",
-	"version": "3.8.0",
+	"version": "3.8.1",
 	"description": "Simple Svelte 5 powered component library ✨",
 	"license": "SEE LICENSE IN LICENSE",
 	"repository": {