@odla-ai/chapter 0.0.1 → 0.0.2

package/README.md

@@ -3,8 +3,7 @@
 A foundation for **membership sites**. One `defineChapter({...})` config
 stands up a full member site — join/apply, Stripe membership, Google booking, a
 member area, an admin console, and a CRM — or an **admin-only hub**, on odla-db +
-Clerk + [@odla-ai/crm](https://odla.ai/docs/packages/crm) + calendar + email, with
-a themeable web-component chrome engine.
+Clerk + [@odla-ai/crm](https://odla.ai/docs/packages/crm) + calendar + email.
 
 ```sh
 npm i @odla-ai/chapter
@@ -13,6 +12,10 @@ npm i @odla-ai/chapter
 > **Agentic experiment.** Built and maintained by AI agents from bounded runbooks
 > with human review. Review the documented guarantees before relying on it.
 
+> **Early access (pre-1.0).** Hub mode — the admin console, CRM, and provisioning
+> — is complete. The public member surface (join/apply, Stripe membership, Google
+> booking, member area) is being ported release by release.
+
 ## The shape
 
 - **One config, two profiles.** `defineChapter()` validates at import and returns
@@ -21,18 +24,22 @@ npm i @odla-ai/chapter
   Same worker shell, auth, CRM, chrome, and provisioning — the mode gates the
   member/join/payment route surface.
 - **The worker is the package.** `chapterWorker({ chapter })` is the whole
-  Cloudflare `ExportedHandler` (auth verify, CRM mount, Stripe, calendar, email,
-  webhooks, admin), wrapped in observability. A site's `src/worker.ts` is ~3
-  lines. Everything brand-specific (prices, policy copy, email templates,
-  scheduling) is read at runtime from a single odla-db `groups` row, never
-  hardcoded.
+  Cloudflare `ExportedHandler` — today: Clerk-JWT verify, the odla-db
+  admins-allowlist gate, the mounted `@odla-ai/crm` routes, and the static-asset
+  fallback (the member/join/Stripe/booking routes are being added). A site's
+  `src/worker.ts` is ~3 lines. Observability is a host concern — wrap it with
+  `withObservability` from `@odla-ai/o11y` in your entry if you run it. Everything
+  brand-specific (prices, policy copy, email templates, scheduling) is read at
+  runtime from a single odla-db `groups` row, never hardcoded.
 - **Provisioning is declarative.** `createChapterIntegration(chapter, opts)` is a
   CLI-consumable descriptor that composes the crm namespaces + the chapter
   namespaces (`applications`, `groups`, `meetings`, `emailLog`, `admins`) + a
   guarded group-row seed. Drop it in `odla.config.mjs` `integrations: [...]`.
-- **Chrome, not content.** `./ui` ships the Preact islands (admin/member/join)
-  and a themeable `<site-header>`/`<site-footer>` engine over `@odla-ai/ui`; each
-  site authors its own marketing page bodies from its brandbook.
+- **The admin UI.** `./ui` ships `<ChapterAdmin>` — the console shell (config
+  fetch, themed Clerk sign-in, the allowlist gate, and a TopBar that renders the
+  sections you pass), authored against React and rendered as Preact via
+  `preact/compat` in the reference sites. The member islands (join, members,
+  slot-picker) and brand-token theming are on the roadmap.
 
 ## Quick start
 

package/dist/worker/index.cjs

@@ -25,7 +25,6 @@ __export(worker_exports, {
 module.exports = __toCommonJS(worker_exports);
 var import_db = require("@odla-ai/db");
 var import_crm = require("@odla-ai/crm");
-var import_o11y = require("@odla-ai/o11y");
 var import_jose = require("jose");
 var json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 function chapterWorker(options) {
@@ -117,6 +116,6 @@ function chapterWorker(options) {
       return env.ASSETS.fetch(req);
     }
   };
-  return (0, import_o11y.withObservability)(handler);
+  return handler;
 }
 //# sourceMappingURL=index.cjs.map

package/dist/worker/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/worker.ts"],"sourcesContent":["// chapterWorker — the Cloudflare Worker for a chapter/hub site. This entry\n// (@odla-ai/chapter/worker) is separate from the core so the CLI can load\n// odla.config.mjs without pulling in worker-runtime deps.\n//\n// The worker is the ONLY thing that talks to odla-db, using the app key\n// (ODLA_API_KEY), which bypasses the deny-all rules. Browsers never receive a\n// db credential. Access is admin-only: a request is authorized when its Clerk\n// session JWT verifies AND the user's lowercased email has a row in the\n// Studio-seeded `admins` allowlist.\n//\n// hub mode routes:  GET /api/config, GET /api/me, /api/crm/*, else ASSETS.\n// chapter mode adds the public member/join/Stripe/booking surface (ported next).\nimport { initAdmin } from \"@odla-ai/db\";\nimport { createCrmRoutes } from \"@odla-ai/crm\";\nimport { withObservability } from \"@odla-ai/o11y\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { Chapter } from \"./types\";\n\ninterface EmailPayload {\n  from: string;\n  to: string[];\n  subject: string;\n  text?: string;\n  html?: string;\n  replyTo?: string;\n  headers?: Record<string, string>;\n}\n\n/** The Worker env a chapter site provides (wrangler vars + the ODLA_API_KEY\n * secret pushed by provision). */\nexport interface ChapterEnv {\n  ASSETS: { fetch(req: Request): Promise<Response> };\n  ODLA_ENDPOINT: string;\n  ODLA_TENANT: string;\n  ODLA_PLATFORM: string;\n  ODLA_APP_ID: string;\n  ODLA_ENV: string;\n  ODLA_API_KEY: string;\n  SEND_EMAIL?: { send(payload: EmailPayload): Promise<{ messageId: string }> };\n  EMAIL_FROM?: string;\n}\n\n/** Options for {@link chapterWorker}. */\nexport interface ChapterWorkerOptions {\n  chapter: Chapter;\n  /** CRM mount point. Default \"/api/crm\". */\n  crmBasePath?: string;\n}\n\ntype PublicConfig = { env?: string; clerkPublishableKey?: string | null; issuer?: string | null };\ntype Db = ReturnType<typeof initAdmin>;\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n\n/**\n * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT\n * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm\n * routes, and the static-asset fallback, wrapped in observability. In hub mode\n * it serves /api/config, /api/me, /api/crm/*; chapter mode adds the public\n * member surface (join/Stripe/booking — ported next).\n */\nexport function chapterWorker(options: ChapterWorkerOptions) {\n  const { chapter } = options;\n  const crmBase = options.crmBasePath ?? \"/api/crm\";\n\n  let publicConfigCache: { value: PublicConfig; at: number } | null = null;\n  const jwksByIssuer = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n  async function getPublicConfig(env: ChapterEnv): Promise<PublicConfig> {\n    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 60_000) return publicConfigCache.value;\n    const res = await fetch(\n      `${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`,\n    );\n    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);\n    const value = (await res.json()) as PublicConfig;\n    publicConfigCache = { value, at: Date.now() };\n    return value;\n  }\n\n  async function verifyUser(req: Request, env: ChapterEnv): Promise<{ userId: string; email?: string } | null> {\n    const header = req.headers.get(\"authorization\") ?? \"\";\n    if (!header.startsWith(\"Bearer \")) return null;\n    const token = header.slice(7);\n    const { issuer } = await getPublicConfig(env);\n    if (!issuer) return null;\n    let jwks = jwksByIssuer.get(issuer);\n    if (!jwks) {\n      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));\n      jwksByIssuer.set(issuer, jwks);\n    }\n    try {\n      const { payload } = await jwtVerify(token, jwks, { issuer });\n      if (!payload.sub) return null;\n      return { userId: payload.sub, email: typeof payload.email === \"string\" ? payload.email : undefined };\n    } catch {\n      return null;\n    }\n  }\n\n  function makeDb(env: ChapterEnv): Db {\n    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });\n  }\n\n  // The allowlist gate: no route ever writes `admins`, so membership can only be\n  // granted by a human in odla Studio.\n  async function isAdminEmail(db: Db, email: string | undefined): Promise<boolean> {\n    if (!email) return false;\n    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });\n    return Array.isArray(admins) && admins.length > 0;\n  }\n\n  function crmSender(env: ChapterEnv) {\n    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return undefined;\n    const binding = env.SEND_EMAIL;\n    return { async send(payload: EmailPayload): Promise<{ messageId: string }> { return binding.send(payload); } };\n  }\n\n  const handler = {\n    async fetch(req: Request, env: ChapterEnv): Promise<Response> {\n      const url = new URL(req.url);\n\n      // Public: the SPA reads the Clerk publishable key to boot sign-in.\n      if (url.pathname === \"/api/config\") {\n        try {\n          const { clerkPublishableKey } = await getPublicConfig(env);\n          return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });\n        } catch {\n          return json({ clerkPublishableKey: null, env: env.ODLA_ENV });\n        }\n      }\n\n      // Auth: is the signed-in user an allowlisted admin?\n      if (url.pathname === \"/api/me\") {\n        const u = await verifyUser(req, env);\n        if (!u) return json({ authorized: false }, 401);\n        const authorized = await isAdminEmail(makeDb(env), u.email);\n        return json({ authorized, email: u.email ?? null });\n      }\n\n      // CRM admin surface.\n      if (url.pathname === crmBase || url.pathname.startsWith(crmBase + \"/\")) {\n        const db = makeDb(env);\n        const routes = createCrmRoutes({\n          crm: chapter.crm,\n          db: db as never,\n          authorize: async (r: Request) => {\n            const u = await verifyUser(r, env);\n            if (!u || !(await isAdminEmail(db, u.email))) return null;\n            return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };\n          },\n          sender: crmSender(env),\n          from: env.EMAIL_FROM,\n          envName: env.ODLA_ENV,\n          baseUrl: url.origin,\n          basePath: crmBase,\n        });\n        const res = await routes(req);\n        if (res) return res;\n        return json({ error: \"not found\" }, 404);\n      }\n\n      // chapter mode adds the public member/join/Stripe/booking routes here.\n\n      // Everything else is the static site.\n      return env.ASSETS.fetch(req);\n    },\n  };\n\n  return withObservability(handler as never);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,gBAA0B;AAC1B,iBAAgC;AAChC,kBAAkC;AAClC,kBAA8C;AAqC9C,IAAM,OAAO,CAAC,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AASzF,SAAS,cAAc,SAA+B;AAC3D,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,UAAU,QAAQ,eAAe;AAEvC,MAAI,oBAAgE;AACpE,QAAM,eAAe,oBAAI,IAAmD;AAE5E,iBAAe,gBAAgB,KAAwC;AACrE,QAAI,qBAAqB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,IAAQ,QAAO,kBAAkB;AAClG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,IAAI,aAAa,kBAAkB,IAAI,WAAW,sBAAsB,IAAI,QAAQ;AAAA,IACzF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,EAAE;AACxE,UAAM,QAAS,MAAM,IAAI,KAAK;AAC9B,wBAAoB,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,KAAc,KAAqE;AAC3G,UAAM,SAAS,IAAI,QAAQ,IAAI,eAAe,KAAK;AACnD,QAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,UAAM,QAAQ,OAAO,MAAM,CAAC;AAC5B,UAAM,EAAE,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,aAAa,IAAI,MAAM;AAClC,QAAI,CAAC,MAAM;AACT,iBAAO,gCAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC;AACpE,mBAAa,IAAI,QAAQ,IAAI;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,MAAM,EAAE,OAAO,CAAC;AAC3D,UAAI,CAAC,QAAQ,IAAK,QAAO;AACzB,aAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,OAAU;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,WAAS,OAAO,KAAqB;AACnC,eAAO,qBAAU,EAAE,OAAO,IAAI,aAAa,YAAY,IAAI,cAAc,UAAU,IAAI,cAAc,CAAC;AAAA,EACxG;AAIA,iBAAe,aAAa,IAAQ,OAA6C;AAC/E,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,EAAE,OAAO,IAAI,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC;AACxG,WAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS;AAAA,EAClD;AAEA,WAAS,UAAU,KAAiB;AAClC,QAAI,CAAC,IAAI,cAAc,CAAC,IAAI,WAAY,QAAO;AAC/C,UAAM,UAAU,IAAI;AACpB,WAAO,EAAE,MAAM,KAAK,SAAuD;AAAE,aAAO,QAAQ,KAAK,OAAO;AAAA,IAAG,EAAE;AAAA,EAC/G;AAEA,QAAM,UAAU;AAAA,IACd,MAAM,MAAM,KAAc,KAAoC;AAC5D,YAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,UAAI,IAAI,aAAa,eAAe;AAClC,YAAI;AACF,gBAAM,EAAE,oBAAoB,IAAI,MAAM,gBAAgB,GAAG;AACzD,iBAAO,KAAK,EAAE,qBAAqB,uBAAuB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QACrF,QAAQ;AACN,iBAAO,KAAK,EAAE,qBAAqB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QAC9D;AAAA,MACF;AAGA,UAAI,IAAI,aAAa,WAAW;AAC9B,cAAM,IAAI,MAAM,WAAW,KAAK,GAAG;AACnC,YAAI,CAAC,EAAG,QAAO,KAAK,EAAE,YAAY,MAAM,GAAG,GAAG;AAC9C,cAAM,aAAa,MAAM,aAAa,OAAO,GAAG,GAAG,EAAE,KAAK;AAC1D,eAAO,KAAK,EAAE,YAAY,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,MACpD;AAGA,UAAI,IAAI,aAAa,WAAW,IAAI,SAAS,WAAW,UAAU,GAAG,GAAG;AACtE,cAAM,KAAK,OAAO,GAAG;AACrB,cAAM,aAAS,4BAAgB;AAAA,UAC7B,KAAK,QAAQ;AAAA,UACb;AAAA,UACA,WAAW,OAAO,MAAe;AAC/B,kBAAM,IAAI,MAAM,WAAW,GAAG,GAAG;AACjC,gBAAI,CAAC,KAAK,CAAE,MAAM,aAAa,IAAI,EAAE,KAAK,EAAI,QAAO;AACrD,mBAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO;AAAA,UAC7E;AAAA,UACA,QAAQ,UAAU,GAAG;AAAA,UACrB,MAAM,IAAI;AAAA,UACV,SAAS,IAAI;AAAA,UACb,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC;AACD,cAAM,MAAM,MAAM,OAAO,GAAG;AAC5B,YAAI,IAAK,QAAO;AAChB,eAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MACzC;AAKA,aAAO,IAAI,OAAO,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF;AAEA,aAAO,+BAAkB,OAAgB;AAC3C;","names":[]}
+{"version":3,"sources":["../../src/worker.ts"],"sourcesContent":["// chapterWorker — the Cloudflare Worker for a chapter/hub site. This entry\n// (@odla-ai/chapter/worker) is separate from the core so the CLI can load\n// odla.config.mjs without pulling in worker-runtime deps.\n//\n// The worker is the ONLY thing that talks to odla-db, using the app key\n// (ODLA_API_KEY), which bypasses the deny-all rules. Browsers never receive a\n// db credential. Access is admin-only: a request is authorized when its Clerk\n// session JWT verifies AND the user's lowercased email has a row in the\n// Studio-seeded `admins` allowlist.\n//\n// hub mode routes:  GET /api/config, GET /api/me, /api/crm/*, else ASSETS.\n// chapter mode adds the public member/join/Stripe/booking surface (ported next).\nimport { initAdmin } from \"@odla-ai/db\";\nimport { createCrmRoutes } from \"@odla-ai/crm\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { Chapter } from \"./types\";\n\ninterface EmailPayload {\n  from: string;\n  to: string[];\n  subject: string;\n  text?: string;\n  html?: string;\n  replyTo?: string;\n  headers?: Record<string, string>;\n}\n\n/** The Worker env a chapter site provides (wrangler vars + the ODLA_API_KEY\n * secret pushed by provision). */\nexport interface ChapterEnv {\n  ASSETS: { fetch(req: Request): Promise<Response> };\n  ODLA_ENDPOINT: string;\n  ODLA_TENANT: string;\n  ODLA_PLATFORM: string;\n  ODLA_APP_ID: string;\n  ODLA_ENV: string;\n  ODLA_API_KEY: string;\n  SEND_EMAIL?: { send(payload: EmailPayload): Promise<{ messageId: string }> };\n  EMAIL_FROM?: string;\n}\n\n/** Options for {@link chapterWorker}. */\nexport interface ChapterWorkerOptions {\n  chapter: Chapter;\n  /** CRM mount point. Default \"/api/crm\". */\n  crmBasePath?: string;\n}\n\ntype PublicConfig = { env?: string; clerkPublishableKey?: string | null; issuer?: string | null };\ntype Db = ReturnType<typeof initAdmin>;\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n\n/**\n * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT\n * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm\n * routes, and the static-asset fallback. In hub mode it serves /api/config,\n * /api/me, /api/crm/*; chapter mode adds the public member surface\n * (join/Stripe/booking — ported next).\n *\n * Observability is a host concern, not a chapter dependency. To trace, wrap the\n * result in your worker entry — `export default withObservability(chapterWorker(\n * { chapter }))` — with `withObservability` from `@odla-ai/o11y`. Sites that\n * don't run o11y bundle `@odla-ai/chapter/worker` without installing it.\n */\nexport function chapterWorker(options: ChapterWorkerOptions) {\n  const { chapter } = options;\n  const crmBase = options.crmBasePath ?? \"/api/crm\";\n\n  let publicConfigCache: { value: PublicConfig; at: number } | null = null;\n  const jwksByIssuer = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n  async function getPublicConfig(env: ChapterEnv): Promise<PublicConfig> {\n    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 60_000) return publicConfigCache.value;\n    const res = await fetch(\n      `${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`,\n    );\n    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);\n    const value = (await res.json()) as PublicConfig;\n    publicConfigCache = { value, at: Date.now() };\n    return value;\n  }\n\n  async function verifyUser(req: Request, env: ChapterEnv): Promise<{ userId: string; email?: string } | null> {\n    const header = req.headers.get(\"authorization\") ?? \"\";\n    if (!header.startsWith(\"Bearer \")) return null;\n    const token = header.slice(7);\n    const { issuer } = await getPublicConfig(env);\n    if (!issuer) return null;\n    let jwks = jwksByIssuer.get(issuer);\n    if (!jwks) {\n      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));\n      jwksByIssuer.set(issuer, jwks);\n    }\n    try {\n      const { payload } = await jwtVerify(token, jwks, { issuer });\n      if (!payload.sub) return null;\n      return { userId: payload.sub, email: typeof payload.email === \"string\" ? payload.email : undefined };\n    } catch {\n      return null;\n    }\n  }\n\n  function makeDb(env: ChapterEnv): Db {\n    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });\n  }\n\n  // The allowlist gate: no route ever writes `admins`, so membership can only be\n  // granted by a human in odla Studio.\n  async function isAdminEmail(db: Db, email: string | undefined): Promise<boolean> {\n    if (!email) return false;\n    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });\n    return Array.isArray(admins) && admins.length > 0;\n  }\n\n  function crmSender(env: ChapterEnv) {\n    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return undefined;\n    const binding = env.SEND_EMAIL;\n    return { async send(payload: EmailPayload): Promise<{ messageId: string }> { return binding.send(payload); } };\n  }\n\n  const handler = {\n    async fetch(req: Request, env: ChapterEnv): Promise<Response> {\n      const url = new URL(req.url);\n\n      // Public: the SPA reads the Clerk publishable key to boot sign-in.\n      if (url.pathname === \"/api/config\") {\n        try {\n          const { clerkPublishableKey } = await getPublicConfig(env);\n          return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });\n        } catch {\n          return json({ clerkPublishableKey: null, env: env.ODLA_ENV });\n        }\n      }\n\n      // Auth: is the signed-in user an allowlisted admin?\n      if (url.pathname === \"/api/me\") {\n        const u = await verifyUser(req, env);\n        if (!u) return json({ authorized: false }, 401);\n        const authorized = await isAdminEmail(makeDb(env), u.email);\n        return json({ authorized, email: u.email ?? null });\n      }\n\n      // CRM admin surface.\n      if (url.pathname === crmBase || url.pathname.startsWith(crmBase + \"/\")) {\n        const db = makeDb(env);\n        const routes = createCrmRoutes({\n          crm: chapter.crm,\n          db: db as never,\n          authorize: async (r: Request) => {\n            const u = await verifyUser(r, env);\n            if (!u || !(await isAdminEmail(db, u.email))) return null;\n            return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };\n          },\n          sender: crmSender(env),\n          from: env.EMAIL_FROM,\n          envName: env.ODLA_ENV,\n          baseUrl: url.origin,\n          basePath: crmBase,\n        });\n        const res = await routes(req);\n        if (res) return res;\n        return json({ error: \"not found\" }, 404);\n      }\n\n      // chapter mode adds the public member/join/Stripe/booking routes here.\n\n      // Everything else is the static site.\n      return env.ASSETS.fetch(req);\n    },\n  };\n\n  return handler;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,gBAA0B;AAC1B,iBAAgC;AAChC,kBAA8C;AAqC9C,IAAM,OAAO,CAAC,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAczF,SAAS,cAAc,SAA+B;AAC3D,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,UAAU,QAAQ,eAAe;AAEvC,MAAI,oBAAgE;AACpE,QAAM,eAAe,oBAAI,IAAmD;AAE5E,iBAAe,gBAAgB,KAAwC;AACrE,QAAI,qBAAqB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,IAAQ,QAAO,kBAAkB;AAClG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,IAAI,aAAa,kBAAkB,IAAI,WAAW,sBAAsB,IAAI,QAAQ;AAAA,IACzF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,EAAE;AACxE,UAAM,QAAS,MAAM,IAAI,KAAK;AAC9B,wBAAoB,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,KAAc,KAAqE;AAC3G,UAAM,SAAS,IAAI,QAAQ,IAAI,eAAe,KAAK;AACnD,QAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,UAAM,QAAQ,OAAO,MAAM,CAAC;AAC5B,UAAM,EAAE,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,aAAa,IAAI,MAAM;AAClC,QAAI,CAAC,MAAM;AACT,iBAAO,gCAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC;AACpE,mBAAa,IAAI,QAAQ,IAAI;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,MAAM,EAAE,OAAO,CAAC;AAC3D,UAAI,CAAC,QAAQ,IAAK,QAAO;AACzB,aAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,OAAU;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,WAAS,OAAO,KAAqB;AACnC,eAAO,qBAAU,EAAE,OAAO,IAAI,aAAa,YAAY,IAAI,cAAc,UAAU,IAAI,cAAc,CAAC;AAAA,EACxG;AAIA,iBAAe,aAAa,IAAQ,OAA6C;AAC/E,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,EAAE,OAAO,IAAI,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC;AACxG,WAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS;AAAA,EAClD;AAEA,WAAS,UAAU,KAAiB;AAClC,QAAI,CAAC,IAAI,cAAc,CAAC,IAAI,WAAY,QAAO;AAC/C,UAAM,UAAU,IAAI;AACpB,WAAO,EAAE,MAAM,KAAK,SAAuD;AAAE,aAAO,QAAQ,KAAK,OAAO;AAAA,IAAG,EAAE;AAAA,EAC/G;AAEA,QAAM,UAAU;AAAA,IACd,MAAM,MAAM,KAAc,KAAoC;AAC5D,YAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,UAAI,IAAI,aAAa,eAAe;AAClC,YAAI;AACF,gBAAM,EAAE,oBAAoB,IAAI,MAAM,gBAAgB,GAAG;AACzD,iBAAO,KAAK,EAAE,qBAAqB,uBAAuB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QACrF,QAAQ;AACN,iBAAO,KAAK,EAAE,qBAAqB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QAC9D;AAAA,MACF;AAGA,UAAI,IAAI,aAAa,WAAW;AAC9B,cAAM,IAAI,MAAM,WAAW,KAAK,GAAG;AACnC,YAAI,CAAC,EAAG,QAAO,KAAK,EAAE,YAAY,MAAM,GAAG,GAAG;AAC9C,cAAM,aAAa,MAAM,aAAa,OAAO,GAAG,GAAG,EAAE,KAAK;AAC1D,eAAO,KAAK,EAAE,YAAY,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,MACpD;AAGA,UAAI,IAAI,aAAa,WAAW,IAAI,SAAS,WAAW,UAAU,GAAG,GAAG;AACtE,cAAM,KAAK,OAAO,GAAG;AACrB,cAAM,aAAS,4BAAgB;AAAA,UAC7B,KAAK,QAAQ;AAAA,UACb;AAAA,UACA,WAAW,OAAO,MAAe;AAC/B,kBAAM,IAAI,MAAM,WAAW,GAAG,GAAG;AACjC,gBAAI,CAAC,KAAK,CAAE,MAAM,aAAa,IAAI,EAAE,KAAK,EAAI,QAAO;AACrD,mBAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO;AAAA,UAC7E;AAAA,UACA,QAAQ,UAAU,GAAG;AAAA,UACrB,MAAM,IAAI;AAAA,UACV,SAAS,IAAI;AAAA,UACb,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC;AACD,cAAM,MAAM,MAAM,OAAO,GAAG;AAC5B,YAAI,IAAK,QAAO;AAChB,eAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MACzC;AAKA,aAAO,IAAI,OAAO,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/worker/index.d.cts

@@ -168,10 +168,17 @@ interface ChapterWorkerOptions {
 /**
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm
- * routes, and the static-asset fallback, wrapped in observability. In hub mode
- * it serves /api/config, /api/me, /api/crm/*; chapter mode adds the public
- * member surface (join/Stripe/booking — ported next).
+ * routes, and the static-asset fallback. In hub mode it serves /api/config,
+ * /api/me, /api/crm/*; chapter mode adds the public member surface
+ * (join/Stripe/booking — ported next).
+ *
+ * Observability is a host concern, not a chapter dependency. To trace, wrap the
+ * result in your worker entry — `export default withObservability(chapterWorker(
+ * { chapter }))` — with `withObservability` from `@odla-ai/o11y`. Sites that
+ * don't run o11y bundle `@odla-ai/chapter/worker` without installing it.
  */
-declare function chapterWorker(options: ChapterWorkerOptions): ExportedHandler<E>;
+declare function chapterWorker(options: ChapterWorkerOptions): {
+    fetch(req: Request, env: ChapterEnv): Promise<Response>;
+};
 
 export { type ChapterEnv, type ChapterWorkerOptions, chapterWorker };

package/dist/worker/index.d.ts

@@ -168,10 +168,17 @@ interface ChapterWorkerOptions {
 /**
  * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT
  * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm
- * routes, and the static-asset fallback, wrapped in observability. In hub mode
- * it serves /api/config, /api/me, /api/crm/*; chapter mode adds the public
- * member surface (join/Stripe/booking — ported next).
+ * routes, and the static-asset fallback. In hub mode it serves /api/config,
+ * /api/me, /api/crm/*; chapter mode adds the public member surface
+ * (join/Stripe/booking — ported next).
+ *
+ * Observability is a host concern, not a chapter dependency. To trace, wrap the
+ * result in your worker entry — `export default withObservability(chapterWorker(
+ * { chapter }))` — with `withObservability` from `@odla-ai/o11y`. Sites that
+ * don't run o11y bundle `@odla-ai/chapter/worker` without installing it.
  */
-declare function chapterWorker(options: ChapterWorkerOptions): ExportedHandler<E>;
+declare function chapterWorker(options: ChapterWorkerOptions): {
+    fetch(req: Request, env: ChapterEnv): Promise<Response>;
+};
 
 export { type ChapterEnv, type ChapterWorkerOptions, chapterWorker };

package/dist/worker/index.js

@@ -1,7 +1,6 @@
 // src/worker.ts
 import { initAdmin } from "@odla-ai/db";
 import { createCrmRoutes } from "@odla-ai/crm";
-import { withObservability } from "@odla-ai/o11y";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 function chapterWorker(options) {
@@ -93,7 +92,7 @@ function chapterWorker(options) {
       return env.ASSETS.fetch(req);
     }
   };
-  return withObservability(handler);
+  return handler;
 }
 export {
   chapterWorker

package/dist/worker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/worker.ts"],"sourcesContent":["// chapterWorker — the Cloudflare Worker for a chapter/hub site. This entry\n// (@odla-ai/chapter/worker) is separate from the core so the CLI can load\n// odla.config.mjs without pulling in worker-runtime deps.\n//\n// The worker is the ONLY thing that talks to odla-db, using the app key\n// (ODLA_API_KEY), which bypasses the deny-all rules. Browsers never receive a\n// db credential. Access is admin-only: a request is authorized when its Clerk\n// session JWT verifies AND the user's lowercased email has a row in the\n// Studio-seeded `admins` allowlist.\n//\n// hub mode routes:  GET /api/config, GET /api/me, /api/crm/*, else ASSETS.\n// chapter mode adds the public member/join/Stripe/booking surface (ported next).\nimport { initAdmin } from \"@odla-ai/db\";\nimport { createCrmRoutes } from \"@odla-ai/crm\";\nimport { withObservability } from \"@odla-ai/o11y\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { Chapter } from \"./types\";\n\ninterface EmailPayload {\n  from: string;\n  to: string[];\n  subject: string;\n  text?: string;\n  html?: string;\n  replyTo?: string;\n  headers?: Record<string, string>;\n}\n\n/** The Worker env a chapter site provides (wrangler vars + the ODLA_API_KEY\n * secret pushed by provision). */\nexport interface ChapterEnv {\n  ASSETS: { fetch(req: Request): Promise<Response> };\n  ODLA_ENDPOINT: string;\n  ODLA_TENANT: string;\n  ODLA_PLATFORM: string;\n  ODLA_APP_ID: string;\n  ODLA_ENV: string;\n  ODLA_API_KEY: string;\n  SEND_EMAIL?: { send(payload: EmailPayload): Promise<{ messageId: string }> };\n  EMAIL_FROM?: string;\n}\n\n/** Options for {@link chapterWorker}. */\nexport interface ChapterWorkerOptions {\n  chapter: Chapter;\n  /** CRM mount point. Default \"/api/crm\". */\n  crmBasePath?: string;\n}\n\ntype PublicConfig = { env?: string; clerkPublishableKey?: string | null; issuer?: string | null };\ntype Db = ReturnType<typeof initAdmin>;\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n\n/**\n * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT\n * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm\n * routes, and the static-asset fallback, wrapped in observability. In hub mode\n * it serves /api/config, /api/me, /api/crm/*; chapter mode adds the public\n * member surface (join/Stripe/booking — ported next).\n */\nexport function chapterWorker(options: ChapterWorkerOptions) {\n  const { chapter } = options;\n  const crmBase = options.crmBasePath ?? \"/api/crm\";\n\n  let publicConfigCache: { value: PublicConfig; at: number } | null = null;\n  const jwksByIssuer = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n  async function getPublicConfig(env: ChapterEnv): Promise<PublicConfig> {\n    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 60_000) return publicConfigCache.value;\n    const res = await fetch(\n      `${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`,\n    );\n    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);\n    const value = (await res.json()) as PublicConfig;\n    publicConfigCache = { value, at: Date.now() };\n    return value;\n  }\n\n  async function verifyUser(req: Request, env: ChapterEnv): Promise<{ userId: string; email?: string } | null> {\n    const header = req.headers.get(\"authorization\") ?? \"\";\n    if (!header.startsWith(\"Bearer \")) return null;\n    const token = header.slice(7);\n    const { issuer } = await getPublicConfig(env);\n    if (!issuer) return null;\n    let jwks = jwksByIssuer.get(issuer);\n    if (!jwks) {\n      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));\n      jwksByIssuer.set(issuer, jwks);\n    }\n    try {\n      const { payload } = await jwtVerify(token, jwks, { issuer });\n      if (!payload.sub) return null;\n      return { userId: payload.sub, email: typeof payload.email === \"string\" ? payload.email : undefined };\n    } catch {\n      return null;\n    }\n  }\n\n  function makeDb(env: ChapterEnv): Db {\n    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });\n  }\n\n  // The allowlist gate: no route ever writes `admins`, so membership can only be\n  // granted by a human in odla Studio.\n  async function isAdminEmail(db: Db, email: string | undefined): Promise<boolean> {\n    if (!email) return false;\n    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });\n    return Array.isArray(admins) && admins.length > 0;\n  }\n\n  function crmSender(env: ChapterEnv) {\n    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return undefined;\n    const binding = env.SEND_EMAIL;\n    return { async send(payload: EmailPayload): Promise<{ messageId: string }> { return binding.send(payload); } };\n  }\n\n  const handler = {\n    async fetch(req: Request, env: ChapterEnv): Promise<Response> {\n      const url = new URL(req.url);\n\n      // Public: the SPA reads the Clerk publishable key to boot sign-in.\n      if (url.pathname === \"/api/config\") {\n        try {\n          const { clerkPublishableKey } = await getPublicConfig(env);\n          return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });\n        } catch {\n          return json({ clerkPublishableKey: null, env: env.ODLA_ENV });\n        }\n      }\n\n      // Auth: is the signed-in user an allowlisted admin?\n      if (url.pathname === \"/api/me\") {\n        const u = await verifyUser(req, env);\n        if (!u) return json({ authorized: false }, 401);\n        const authorized = await isAdminEmail(makeDb(env), u.email);\n        return json({ authorized, email: u.email ?? null });\n      }\n\n      // CRM admin surface.\n      if (url.pathname === crmBase || url.pathname.startsWith(crmBase + \"/\")) {\n        const db = makeDb(env);\n        const routes = createCrmRoutes({\n          crm: chapter.crm,\n          db: db as never,\n          authorize: async (r: Request) => {\n            const u = await verifyUser(r, env);\n            if (!u || !(await isAdminEmail(db, u.email))) return null;\n            return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };\n          },\n          sender: crmSender(env),\n          from: env.EMAIL_FROM,\n          envName: env.ODLA_ENV,\n          baseUrl: url.origin,\n          basePath: crmBase,\n        });\n        const res = await routes(req);\n        if (res) return res;\n        return json({ error: \"not found\" }, 404);\n      }\n\n      // chapter mode adds the public member/join/Stripe/booking routes here.\n\n      // Everything else is the static site.\n      return env.ASSETS.fetch(req);\n    },\n  };\n\n  return withObservability(handler as never);\n}\n"],"mappings":";AAYA,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,oBAAoB,iBAAiB;AAqC9C,IAAM,OAAO,CAAC,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AASzF,SAAS,cAAc,SAA+B;AAC3D,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,UAAU,QAAQ,eAAe;AAEvC,MAAI,oBAAgE;AACpE,QAAM,eAAe,oBAAI,IAAmD;AAE5E,iBAAe,gBAAgB,KAAwC;AACrE,QAAI,qBAAqB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,IAAQ,QAAO,kBAAkB;AAClG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,IAAI,aAAa,kBAAkB,IAAI,WAAW,sBAAsB,IAAI,QAAQ;AAAA,IACzF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,EAAE;AACxE,UAAM,QAAS,MAAM,IAAI,KAAK;AAC9B,wBAAoB,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,KAAc,KAAqE;AAC3G,UAAM,SAAS,IAAI,QAAQ,IAAI,eAAe,KAAK;AACnD,QAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,UAAM,QAAQ,OAAO,MAAM,CAAC;AAC5B,UAAM,EAAE,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,aAAa,IAAI,MAAM;AAClC,QAAI,CAAC,MAAM;AACT,aAAO,mBAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC;AACpE,mBAAa,IAAI,QAAQ,IAAI;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM,EAAE,OAAO,CAAC;AAC3D,UAAI,CAAC,QAAQ,IAAK,QAAO;AACzB,aAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,OAAU;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,WAAS,OAAO,KAAqB;AACnC,WAAO,UAAU,EAAE,OAAO,IAAI,aAAa,YAAY,IAAI,cAAc,UAAU,IAAI,cAAc,CAAC;AAAA,EACxG;AAIA,iBAAe,aAAa,IAAQ,OAA6C;AAC/E,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,EAAE,OAAO,IAAI,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC;AACxG,WAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS;AAAA,EAClD;AAEA,WAAS,UAAU,KAAiB;AAClC,QAAI,CAAC,IAAI,cAAc,CAAC,IAAI,WAAY,QAAO;AAC/C,UAAM,UAAU,IAAI;AACpB,WAAO,EAAE,MAAM,KAAK,SAAuD;AAAE,aAAO,QAAQ,KAAK,OAAO;AAAA,IAAG,EAAE;AAAA,EAC/G;AAEA,QAAM,UAAU;AAAA,IACd,MAAM,MAAM,KAAc,KAAoC;AAC5D,YAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,UAAI,IAAI,aAAa,eAAe;AAClC,YAAI;AACF,gBAAM,EAAE,oBAAoB,IAAI,MAAM,gBAAgB,GAAG;AACzD,iBAAO,KAAK,EAAE,qBAAqB,uBAAuB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QACrF,QAAQ;AACN,iBAAO,KAAK,EAAE,qBAAqB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QAC9D;AAAA,MACF;AAGA,UAAI,IAAI,aAAa,WAAW;AAC9B,cAAM,IAAI,MAAM,WAAW,KAAK,GAAG;AACnC,YAAI,CAAC,EAAG,QAAO,KAAK,EAAE,YAAY,MAAM,GAAG,GAAG;AAC9C,cAAM,aAAa,MAAM,aAAa,OAAO,GAAG,GAAG,EAAE,KAAK;AAC1D,eAAO,KAAK,EAAE,YAAY,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,MACpD;AAGA,UAAI,IAAI,aAAa,WAAW,IAAI,SAAS,WAAW,UAAU,GAAG,GAAG;AACtE,cAAM,KAAK,OAAO,GAAG;AACrB,cAAM,SAAS,gBAAgB;AAAA,UAC7B,KAAK,QAAQ;AAAA,UACb;AAAA,UACA,WAAW,OAAO,MAAe;AAC/B,kBAAM,IAAI,MAAM,WAAW,GAAG,GAAG;AACjC,gBAAI,CAAC,KAAK,CAAE,MAAM,aAAa,IAAI,EAAE,KAAK,EAAI,QAAO;AACrD,mBAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO;AAAA,UAC7E;AAAA,UACA,QAAQ,UAAU,GAAG;AAAA,UACrB,MAAM,IAAI;AAAA,UACV,SAAS,IAAI;AAAA,UACb,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC;AACD,cAAM,MAAM,MAAM,OAAO,GAAG;AAC5B,YAAI,IAAK,QAAO;AAChB,eAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MACzC;AAKA,aAAO,IAAI,OAAO,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO,kBAAkB,OAAgB;AAC3C;","names":[]}
+{"version":3,"sources":["../../src/worker.ts"],"sourcesContent":["// chapterWorker — the Cloudflare Worker for a chapter/hub site. This entry\n// (@odla-ai/chapter/worker) is separate from the core so the CLI can load\n// odla.config.mjs without pulling in worker-runtime deps.\n//\n// The worker is the ONLY thing that talks to odla-db, using the app key\n// (ODLA_API_KEY), which bypasses the deny-all rules. Browsers never receive a\n// db credential. Access is admin-only: a request is authorized when its Clerk\n// session JWT verifies AND the user's lowercased email has a row in the\n// Studio-seeded `admins` allowlist.\n//\n// hub mode routes:  GET /api/config, GET /api/me, /api/crm/*, else ASSETS.\n// chapter mode adds the public member/join/Stripe/booking surface (ported next).\nimport { initAdmin } from \"@odla-ai/db\";\nimport { createCrmRoutes } from \"@odla-ai/crm\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { Chapter } from \"./types\";\n\ninterface EmailPayload {\n  from: string;\n  to: string[];\n  subject: string;\n  text?: string;\n  html?: string;\n  replyTo?: string;\n  headers?: Record<string, string>;\n}\n\n/** The Worker env a chapter site provides (wrangler vars + the ODLA_API_KEY\n * secret pushed by provision). */\nexport interface ChapterEnv {\n  ASSETS: { fetch(req: Request): Promise<Response> };\n  ODLA_ENDPOINT: string;\n  ODLA_TENANT: string;\n  ODLA_PLATFORM: string;\n  ODLA_APP_ID: string;\n  ODLA_ENV: string;\n  ODLA_API_KEY: string;\n  SEND_EMAIL?: { send(payload: EmailPayload): Promise<{ messageId: string }> };\n  EMAIL_FROM?: string;\n}\n\n/** Options for {@link chapterWorker}. */\nexport interface ChapterWorkerOptions {\n  chapter: Chapter;\n  /** CRM mount point. Default \"/api/crm\". */\n  crmBasePath?: string;\n}\n\ntype PublicConfig = { env?: string; clerkPublishableKey?: string | null; issuer?: string | null };\ntype Db = ReturnType<typeof initAdmin>;\n\nconst json = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), { status, headers: { \"content-type\": \"application/json\" } });\n\n/**\n * Build the Cloudflare `ExportedHandler` for a chapter/hub site: Clerk-JWT\n * verification, the odla-db admins-allowlist gate, the mounted @odla-ai/crm\n * routes, and the static-asset fallback. In hub mode it serves /api/config,\n * /api/me, /api/crm/*; chapter mode adds the public member surface\n * (join/Stripe/booking — ported next).\n *\n * Observability is a host concern, not a chapter dependency. To trace, wrap the\n * result in your worker entry — `export default withObservability(chapterWorker(\n * { chapter }))` — with `withObservability` from `@odla-ai/o11y`. Sites that\n * don't run o11y bundle `@odla-ai/chapter/worker` without installing it.\n */\nexport function chapterWorker(options: ChapterWorkerOptions) {\n  const { chapter } = options;\n  const crmBase = options.crmBasePath ?? \"/api/crm\";\n\n  let publicConfigCache: { value: PublicConfig; at: number } | null = null;\n  const jwksByIssuer = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n  async function getPublicConfig(env: ChapterEnv): Promise<PublicConfig> {\n    if (publicConfigCache && Date.now() - publicConfigCache.at < 5 * 60_000) return publicConfigCache.value;\n    const res = await fetch(\n      `${env.ODLA_PLATFORM}/registry/apps/${env.ODLA_APP_ID}/public-config?env=${env.ODLA_ENV}`,\n    );\n    if (!res.ok) throw new Error(`public-config fetch failed: ${res.status}`);\n    const value = (await res.json()) as PublicConfig;\n    publicConfigCache = { value, at: Date.now() };\n    return value;\n  }\n\n  async function verifyUser(req: Request, env: ChapterEnv): Promise<{ userId: string; email?: string } | null> {\n    const header = req.headers.get(\"authorization\") ?? \"\";\n    if (!header.startsWith(\"Bearer \")) return null;\n    const token = header.slice(7);\n    const { issuer } = await getPublicConfig(env);\n    if (!issuer) return null;\n    let jwks = jwksByIssuer.get(issuer);\n    if (!jwks) {\n      jwks = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`));\n      jwksByIssuer.set(issuer, jwks);\n    }\n    try {\n      const { payload } = await jwtVerify(token, jwks, { issuer });\n      if (!payload.sub) return null;\n      return { userId: payload.sub, email: typeof payload.email === \"string\" ? payload.email : undefined };\n    } catch {\n      return null;\n    }\n  }\n\n  function makeDb(env: ChapterEnv): Db {\n    return initAdmin({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_ENDPOINT });\n  }\n\n  // The allowlist gate: no route ever writes `admins`, so membership can only be\n  // granted by a human in odla Studio.\n  async function isAdminEmail(db: Db, email: string | undefined): Promise<boolean> {\n    if (!email) return false;\n    const { admins } = await db.query({ admins: { $: { where: { email: email.toLowerCase() }, limit: 1 } } });\n    return Array.isArray(admins) && admins.length > 0;\n  }\n\n  function crmSender(env: ChapterEnv) {\n    if (!env.SEND_EMAIL || !env.EMAIL_FROM) return undefined;\n    const binding = env.SEND_EMAIL;\n    return { async send(payload: EmailPayload): Promise<{ messageId: string }> { return binding.send(payload); } };\n  }\n\n  const handler = {\n    async fetch(req: Request, env: ChapterEnv): Promise<Response> {\n      const url = new URL(req.url);\n\n      // Public: the SPA reads the Clerk publishable key to boot sign-in.\n      if (url.pathname === \"/api/config\") {\n        try {\n          const { clerkPublishableKey } = await getPublicConfig(env);\n          return json({ clerkPublishableKey: clerkPublishableKey ?? null, env: env.ODLA_ENV });\n        } catch {\n          return json({ clerkPublishableKey: null, env: env.ODLA_ENV });\n        }\n      }\n\n      // Auth: is the signed-in user an allowlisted admin?\n      if (url.pathname === \"/api/me\") {\n        const u = await verifyUser(req, env);\n        if (!u) return json({ authorized: false }, 401);\n        const authorized = await isAdminEmail(makeDb(env), u.email);\n        return json({ authorized, email: u.email ?? null });\n      }\n\n      // CRM admin surface.\n      if (url.pathname === crmBase || url.pathname.startsWith(crmBase + \"/\")) {\n        const db = makeDb(env);\n        const routes = createCrmRoutes({\n          crm: chapter.crm,\n          db: db as never,\n          authorize: async (r: Request) => {\n            const u = await verifyUser(r, env);\n            if (!u || !(await isAdminEmail(db, u.email))) return null;\n            return u.email ? { userId: u.userId, email: u.email } : { userId: u.userId };\n          },\n          sender: crmSender(env),\n          from: env.EMAIL_FROM,\n          envName: env.ODLA_ENV,\n          baseUrl: url.origin,\n          basePath: crmBase,\n        });\n        const res = await routes(req);\n        if (res) return res;\n        return json({ error: \"not found\" }, 404);\n      }\n\n      // chapter mode adds the public member/join/Stripe/booking routes here.\n\n      // Everything else is the static site.\n      return env.ASSETS.fetch(req);\n    },\n  };\n\n  return handler;\n}\n"],"mappings":";AAYA,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,iBAAiB;AAqC9C,IAAM,OAAO,CAAC,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAczF,SAAS,cAAc,SAA+B;AAC3D,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,UAAU,QAAQ,eAAe;AAEvC,MAAI,oBAAgE;AACpE,QAAM,eAAe,oBAAI,IAAmD;AAE5E,iBAAe,gBAAgB,KAAwC;AACrE,QAAI,qBAAqB,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,IAAQ,QAAO,kBAAkB;AAClG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,IAAI,aAAa,kBAAkB,IAAI,WAAW,sBAAsB,IAAI,QAAQ;AAAA,IACzF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,+BAA+B,IAAI,MAAM,EAAE;AACxE,UAAM,QAAS,MAAM,IAAI,KAAK;AAC9B,wBAAoB,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAC5C,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,KAAc,KAAqE;AAC3G,UAAM,SAAS,IAAI,QAAQ,IAAI,eAAe,KAAK;AACnD,QAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,UAAM,QAAQ,OAAO,MAAM,CAAC;AAC5B,UAAM,EAAE,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,aAAa,IAAI,MAAM;AAClC,QAAI,CAAC,MAAM;AACT,aAAO,mBAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,CAAC;AACpE,mBAAa,IAAI,QAAQ,IAAI;AAAA,IAC/B;AACA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM,EAAE,OAAO,CAAC;AAC3D,UAAI,CAAC,QAAQ,IAAK,QAAO;AACzB,aAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,OAAU;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,WAAS,OAAO,KAAqB;AACnC,WAAO,UAAU,EAAE,OAAO,IAAI,aAAa,YAAY,IAAI,cAAc,UAAU,IAAI,cAAc,CAAC;AAAA,EACxG;AAIA,iBAAe,aAAa,IAAQ,OAA6C;AAC/E,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,EAAE,OAAO,IAAI,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC;AACxG,WAAO,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS;AAAA,EAClD;AAEA,WAAS,UAAU,KAAiB;AAClC,QAAI,CAAC,IAAI,cAAc,CAAC,IAAI,WAAY,QAAO;AAC/C,UAAM,UAAU,IAAI;AACpB,WAAO,EAAE,MAAM,KAAK,SAAuD;AAAE,aAAO,QAAQ,KAAK,OAAO;AAAA,IAAG,EAAE;AAAA,EAC/G;AAEA,QAAM,UAAU;AAAA,IACd,MAAM,MAAM,KAAc,KAAoC;AAC5D,YAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,UAAI,IAAI,aAAa,eAAe;AAClC,YAAI;AACF,gBAAM,EAAE,oBAAoB,IAAI,MAAM,gBAAgB,GAAG;AACzD,iBAAO,KAAK,EAAE,qBAAqB,uBAAuB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QACrF,QAAQ;AACN,iBAAO,KAAK,EAAE,qBAAqB,MAAM,KAAK,IAAI,SAAS,CAAC;AAAA,QAC9D;AAAA,MACF;AAGA,UAAI,IAAI,aAAa,WAAW;AAC9B,cAAM,IAAI,MAAM,WAAW,KAAK,GAAG;AACnC,YAAI,CAAC,EAAG,QAAO,KAAK,EAAE,YAAY,MAAM,GAAG,GAAG;AAC9C,cAAM,aAAa,MAAM,aAAa,OAAO,GAAG,GAAG,EAAE,KAAK;AAC1D,eAAO,KAAK,EAAE,YAAY,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,MACpD;AAGA,UAAI,IAAI,aAAa,WAAW,IAAI,SAAS,WAAW,UAAU,GAAG,GAAG;AACtE,cAAM,KAAK,OAAO,GAAG;AACrB,cAAM,SAAS,gBAAgB;AAAA,UAC7B,KAAK,QAAQ;AAAA,UACb;AAAA,UACA,WAAW,OAAO,MAAe;AAC/B,kBAAM,IAAI,MAAM,WAAW,GAAG,GAAG;AACjC,gBAAI,CAAC,KAAK,CAAE,MAAM,aAAa,IAAI,EAAE,KAAK,EAAI,QAAO;AACrD,mBAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO;AAAA,UAC7E;AAAA,UACA,QAAQ,UAAU,GAAG;AAAA,UACrB,MAAM,IAAI;AAAA,UACV,SAAS,IAAI;AAAA,UACb,SAAS,IAAI;AAAA,UACb,UAAU;AAAA,QACZ,CAAC;AACD,cAAM,MAAM,MAAM,OAAO,GAAG;AAC5B,YAAI,IAAK,QAAO;AAChB,eAAO,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MACzC;AAKA,aAAO,IAAI,OAAO,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@odla-ai/chapter",
-  "version": "0.0.1",
-  "description": "A foundation for membership sites — one config (defineChapter) stands up a full member site (join, Stripe membership, Google booking, member area, admin, CRM) or an admin-only hub, on odla-db + Clerk + @odla-ai/crm + calendar + email, with a themeable web-component chrome engine.",
+  "version": "0.0.2",
+  "description": "A foundation for membership sites — one config (defineChapter) stands up a full member site (join, Stripe membership, Google booking, member area, admin, CRM) or an admin-only hub, on odla-db + Clerk + @odla-ai/crm + calendar + email.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/chapter",
   "repository": {
@@ -65,12 +65,9 @@
     "jose": "^6.2.3"
   },
   "peerDependencies": {
-    "@odla-ai/auth-clerk": ">=0.2.0 <0.3.0",
-    "@odla-ai/calendar": ">=0.2.0 <0.3.0",
-    "@odla-ai/db": ">=0.6.0 <0.7.0",
-    "@odla-ai/email": ">=0.3.0 <0.4.0",
-    "@odla-ai/o11y": ">=2.0.0 <3.0.0",
-    "@odla-ai/ui": ">=0.7.0 <0.9.0",
+    "@odla-ai/auth-clerk": ">=0.2.0 <1.0.0",
+    "@odla-ai/db": ">=0.6.0 <1.0.0",
+    "@odla-ai/ui": ">=0.7.0 <1.0.0",
     "react": ">=18"
   },
   "peerDependenciesMeta": {
@@ -80,15 +77,6 @@
     "@odla-ai/db": {
       "optional": true
     },
-    "@odla-ai/calendar": {
-      "optional": true
-    },
-    "@odla-ai/email": {
-      "optional": true
-    },
-    "@odla-ai/o11y": {
-      "optional": true
-    },
     "@odla-ai/ui": {
       "optional": true
     },
@@ -98,10 +86,7 @@
   },
   "devDependencies": {
     "@odla-ai/auth-clerk": "*",
-    "@odla-ai/calendar": "*",
     "@odla-ai/db": "*",
-    "@odla-ai/email": "*",
-    "@odla-ai/o11y": "*",
     "@odla-ai/ui": "*",
     "@types/node": "^26.1.0",
     "@types/react": "^19.2.7",