@odla-ai/chapter 0.22.0 → 0.23.0

package/dist/worker/index.js

@@ -111,68 +111,6 @@ function createWorkerContext(options) {
 // src/worker-routes.ts
 import { createCrmRoutes } from "@odla-ai/crm";
 
-// src/clerk.ts
-var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
-function clerkInviteRequest(input) {
-  return {
-    path: "/v1/invitations",
-    body: {
-      email_address: input.email,
-      notify: true,
-      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
-    }
-  };
-}
-async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkInviteRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  return res.ok ? { ok: true, status: res.status } : heal(res.status);
-}
-function clerkUserRequest(input) {
-  return {
-    path: "/v1/users",
-    body: {
-      email_address: [input.email],
-      skip_password_requirement: true,
-      ...input.firstName ? { first_name: input.firstName } : {},
-      ...input.lastName ? { last_name: input.lastName } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
-    }
-  };
-}
-async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
-  const auth = { authorization: `Bearer ${secretKey}` };
-  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
-  if (!found.ok) return false;
-  const users = await found.json().catch(() => null);
-  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
-  if (!id) return false;
-  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
-    method: "PATCH",
-    headers: { ...auth, "content-type": "application/json" },
-    body: JSON.stringify({ public_metadata: publicMetadata })
-  });
-  return patched.ok;
-}
-async function createClerkUser(secretKey, input, fetchImpl = fetch) {
-  const { path, body } = clerkUserRequest(input);
-  const res = await fetchImpl(`https://api.clerk.com${path}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (res.ok) return { ok: true, status: res.status };
-  const healed = heal(res.status);
-  if (!healed.existed || !input.publicMetadata) return healed;
-  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
-  return { ...healed, refreshed };
-}
-
 // src/member.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function isValidEmail(value) {
@@ -188,7 +126,7 @@ function hasDisclaimerAck(fields) {
 var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["email", "firstName", "lastName"]);
 function applicantProfile(chapter, fields) {
   const app = chapter.application;
-  const allowed = (f) => app.profileFields === null || app.profileFields.includes(f);
+  const allowed = (f) => app.profileFields.includes(f);
   const profile = {};
   for (const f of [...app.required, ...app.optional]) {
     if (IDENTITY_FIELDS.has(f) || !allowed(f)) continue;
@@ -506,6 +444,19 @@ function applicationBookingUpdate(currentStatus, startAt, htmlLink) {
   };
 }
 
+// src/pipeline.ts
+function canTransition(from, to, p) {
+  const fi = p.stages.indexOf(from);
+  const ti = p.stages.indexOf(to);
+  return fi >= 0 && ti >= 0 && ti >= fi;
+}
+function canBook(status, p) {
+  return p.bookableFrom.includes(status);
+}
+function canApprove(status, p) {
+  return p.approvableFrom.includes(status);
+}
+
 // src/session.ts
 function applicationSummary(app) {
   return {
@@ -538,6 +489,68 @@ function memberApplication(app, meeting, defaultTimezone) {
   return { ...summary, meetingAt, meetUrl, timezone };
 }
 
+// src/clerk.ts
+var heal = (status) => status === 422 ? { ok: true, status, existed: true } : { ok: false, status };
+function clerkInviteRequest(input) {
+  return {
+    path: "/v1/invitations",
+    body: {
+      email_address: input.email,
+      notify: true,
+      ...input.redirectUrl ? { redirect_url: input.redirectUrl } : {},
+      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+    }
+  };
+}
+async function createClerkInvitation(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkInviteRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  return res.ok ? { ok: true, status: res.status } : heal(res.status);
+}
+function clerkUserRequest(input) {
+  return {
+    path: "/v1/users",
+    body: {
+      email_address: [input.email],
+      skip_password_requirement: true,
+      ...input.firstName ? { first_name: input.firstName } : {},
+      ...input.lastName ? { last_name: input.lastName } : {},
+      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+    }
+  };
+}
+async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
+  const auth = { authorization: `Bearer ${secretKey}` };
+  const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
+  if (!found.ok) return false;
+  const users = await found.json().catch(() => null);
+  const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
+  if (!id) return false;
+  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
+    method: "PATCH",
+    headers: { ...auth, "content-type": "application/json" },
+    body: JSON.stringify({ public_metadata: publicMetadata })
+  });
+  return patched.ok;
+}
+async function createClerkUser(secretKey, input, fetchImpl = fetch) {
+  const { path, body } = clerkUserRequest(input);
+  const res = await fetchImpl(`https://api.clerk.com${path}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (res.ok) return { ok: true, status: res.status };
+  const healed = heal(res.status);
+  if (!healed.existed || !input.publicMetadata) return healed;
+  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
+  return { ...healed, refreshed };
+}
+
 // src/email.ts
 function render(template, vars) {
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? "");
@@ -641,36 +654,47 @@ function emailGroupFrom(row) {
   };
 }
 
-// src/worker-routes.ts
+// src/worker-provisioning.ts
 async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
-  const s = (v) => typeof v === "string" ? v : void 0;
+  const stringValue = (value) => typeof value === "string" ? value : void 0;
   const extra = {};
-  for (const f of chapter.application.crmFields) {
-    if (fields[f] !== void 0) extra[f] = fields[f];
+  for (const field of chapter.application.crmFields) {
+    if (fields[field] !== void 0) extra[field] = fields[field];
   }
   try {
     await projectApplicant(
       { crm: chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID() },
-      { applicationId, email, firstName: s(fields.firstName), lastName: s(fields.lastName), phone: s(fields.phone), linkedin: s(fields.linkedin), extra }
+      {
+        applicationId,
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        phone: stringValue(fields.phone),
+        linkedin: stringValue(fields.linkedin),
+        extra
+      }
     );
   } catch {
   }
-  if (chapter.account !== "none") {
-    try {
-      const secret = await getVaultSecret(db, "clerk_secret_key");
-      if (secret) {
-        const profile = applicantProfile(chapter, fields);
-        const publicMetadata = { applicationId, ...profile ? { profile } : {} };
-        if (chapter.account === "create") {
-          await createClerkUser(secret, { email, firstName: s(fields.firstName), lastName: s(fields.lastName), publicMetadata });
-        } else {
-          await createClerkInvitation(secret, { email, publicMetadata });
-        }
-      }
-    } catch {
+  if (chapter.account === "none") return;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return;
+    const profile = applicantProfile(chapter, fields);
+    const publicMetadata = { applicationId, ...profile ? { profile } : {} };
+    if (chapter.account === "create") {
+      await createClerkUser(secret, {
+        email,
+        firstName: stringValue(fields.firstName),
+        lastName: stringValue(fields.lastName),
+        publicMetadata
+      });
+    } else {
+      await createClerkInvitation(secret, { email, publicMetadata });
     }
+  } catch {
   }
 }
 async function notifyAdminOfApplication(db, env, chapterId, applicationId, fields) {
@@ -678,14 +702,27 @@ async function notifyAdminOfApplication(db, env, chapterId, applicationId, field
     const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
     const group = Array.isArray(groups) ? groups[0] : void 0;
     if (!group || typeof group.notificationEmail !== "string" || !group.notificationEmail) return;
-    const s = (v) => typeof v === "string" ? v : "";
+    const stringValue = (value) => typeof value === "string" ? value : "";
     await sendTemplated(
-      { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
+      {
+        db,
+        envName: env.ODLA_ENV,
+        sender: env.SEND_EMAIL,
+        from: env.EMAIL_FROM,
+        now: () => Date.now(),
+        newId: () => crypto.randomUUID()
+      },
       {
         group: emailGroupFrom(group),
         template: "adminNotification",
         to: group.notificationEmail,
-        vars: { firstName: s(fields.firstName), lastName: s(fields.lastName), email: s(fields.email), phone: s(fields.phone), state: s(fields.state) },
+        vars: {
+          firstName: stringValue(fields.firstName),
+          lastName: stringValue(fields.lastName),
+          email: stringValue(fields.email),
+          phone: stringValue(fields.phone),
+          state: stringValue(fields.state)
+        },
         dedupeKey: `apply:${applicationId}:admin`,
         applicationId
       }
@@ -693,6 +730,8 @@ async function notifyAdminOfApplication(db, env, chapterId, applicationId, field
   } catch {
   }
 }
+
+// src/worker-routes.ts
 async function memberSessionApplication(db, chapterId, email) {
   const apps = (await db.query({ applications: { $: { where: { email }, order: { createdAt: "desc" }, limit: 1 } } })).applications;
   const app = Array.isArray(apps) ? apps[0] : void 0;
@@ -797,7 +836,54 @@ var handleMember = async (req, url, env, ctx) => {
     if (!group) return json({ error: "not found" }, 404);
     const stripeKey = await getVaultSecret(db, "stripe_secret_key");
     const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
-    return json(joinConfig(group, paymentsReady));
+    return json({ ...joinConfig(group, paymentsReady), copy: chapter.copy.join });
+  }
+  if (req.method === "GET" && url.pathname === "/api/join/resume") {
+    const applicationId = url.searchParams.get("application") ?? "";
+    if (!applicationId) return json({ error: "application is required" }, 400);
+    const db = ctx.makeDb(env);
+    const apps = (await db.query({
+      applications: { $: { where: { id: applicationId }, limit: 1 } }
+    })).applications;
+    const app = Array.isArray(apps) ? apps[0] : void 0;
+    if (!app || String(app.groupId ?? "") !== chapter.id) return json({ error: "not found" }, 404);
+    const meetings = (await db.query({
+      meetings: {
+        $: {
+          where: { applicationId, status: "scheduled" },
+          order: { createdAt: "desc" },
+          limit: 1
+        }
+      }
+    })).meetings;
+    const meeting = Array.isArray(meetings) ? meetings[0] : void 0;
+    if (meeting && typeof meeting.startAt === "number") {
+      const groups2 = (await db.query({
+        groups: { $: { where: { id: chapter.id }, limit: 1 } }
+      })).groups;
+      const group2 = Array.isArray(groups2) ? groups2[0] : void 0;
+      const timezone = resolveScheduling(group2?.schedulingJson).timezone;
+      return json({
+        state: "done",
+        applicationId,
+        booked: { startAt: meeting.startAt, timezone }
+      });
+    }
+    const groups = (await db.query({
+      groups: { $: { where: { id: chapter.id }, limit: 1 } }
+    })).groups;
+    const group = Array.isArray(groups) ? groups[0] : void 0;
+    if (!group) return json({ error: "not found" }, 404);
+    const stripeKey = await getVaultSecret(db, "stripe_secret_key");
+    const paymentsReady = Boolean(group.stripePublishableKey && group.stripePriceId && stripeKey);
+    const status = String(app.status ?? "");
+    if (!paymentsReady) return json({ state: "booking", applicationId });
+    if (status === chapter.pipeline.initial && app.stripeSubscriptionId) {
+      return json({ state: "paymentPending", applicationId });
+    }
+    if (status === chapter.pipeline.initial) return json({ state: "payment", applicationId });
+    if (canBook(status, chapter.pipeline)) return json({ state: "booking", applicationId });
+    return json({ error: `application cannot resume from status "${status}"` }, 409);
   }
   if (req.method === "POST" && url.pathname === "/api/applications") {
     const raw = await req.text();
@@ -837,21 +923,6 @@ var handleMember = async (req, url, env, ctx) => {
 
 // src/worker-routes-schedule.ts
 import { computeBookableSlots, initCalendar } from "@odla-ai/calendar";
-
-// src/pipeline.ts
-function canTransition(from, to, p) {
-  const fi = p.stages.indexOf(from);
-  const ti = p.stages.indexOf(to);
-  return fi >= 0 && ti >= 0 && ti >= fi;
-}
-function canBook(status, p) {
-  return p.bookableFrom.includes(status);
-}
-function canApprove(status, p) {
-  return p.approvableFrom.includes(status);
-}
-
-// src/worker-routes-schedule.ts
 function errCode(err) {
   if (err && typeof err === "object") {
     const code = err.code;
@@ -1311,37 +1382,10 @@ async function ingestWebhook(req, env, ctx) {
   }
   return json({ ok: true });
 }
-async function refundApplication(req, url, env, ctx) {
-  const rawDb = ctx.makeDb(env);
-  const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
-  const id = url.pathname.split("/")[4] ?? "";
-  const db = rawDb;
-  const app = await firstRow2(db, "applications", { where: { id }, limit: 1 });
-  if (!app) return json({ error: "not found" }, 404);
-  if (app.status === "refunded") return json({ error: "already refunded" }, 409);
-  if (app.status === "approved") return json({ error: "approved memberships are non-refundable" }, 409);
-  if (!app.stripeSubscriptionId) return json({ error: "no subscription on file" }, 409);
-  if (!app.stripeCustomerId) return json({ error: "no customer on file" }, 409);
-  const secretKey = await getVaultSecret(db, "stripe_secret_key");
-  if (!secretKey) return json({ error: "payments not configured" }, 503);
-  try {
-    const result = await createStripeProvider({ secretKey }).refund({
-      customerId: String(app.stripeCustomerId),
-      subscriptionId: String(app.stripeSubscriptionId)
-    });
-    return json({ ok: true, refundedCents: result.refundedCents, subscriptionCanceled: result.subscriptionCanceled });
-  } catch (err) {
-    const code = codeOf(err);
-    return json({ error: "refund failed", code }, code === "no_charge" ? 409 : 502);
-  }
-}
-var REFUND_PATH = /^\/api\/admin\/applications\/[^/]+\/refund$/;
 var handlePayments = async (req, url, env, ctx) => {
   if (ctx.chapter.mode !== "chapter") return null;
   if (req.method === "POST" && url.pathname === "/api/payments/subscription") return startSubscription(req, env, ctx);
   if (req.method === "POST" && url.pathname === "/api/webhooks/stripe") return ingestWebhook(req, env, ctx);
-  if (req.method === "POST" && REFUND_PATH.test(url.pathname)) return refundApplication(req, url, env, ctx);
   return null;
 };
 
@@ -1384,7 +1428,8 @@ function reconcileMeetings(meetings, events, now) {
 async function adminGroup(req, env, ctx, url) {
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
+  if (!u) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   const db = rawDb;
   const groupId = url.searchParams.get("group") ?? ctx.chapter.id;
   const group = (await db.query({ groups: { $: { where: { id: groupId }, limit: 1 } } })).groups?.[0];
@@ -1429,7 +1474,8 @@ var handleAdminMeetings = async (req, url, env, ctx) => {
   if (req.method !== "GET" || url.pathname !== "/api/admin/meetings") return null;
   const rawDb = ctx.makeDb(env);
   const u = await ctx.verifyUser(req, env);
-  if (!u || !await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
+  if (!u) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   const db = rawDb;
   const all = url.searchParams.get("all") === "1";
   const from = Number(url.searchParams.get("from"));
@@ -2341,7 +2387,11 @@ var BUILTIN_ROUTES = [
   handleAdminComms,
   // Leader → follower record delivery
   handleAdminNetworkTargets,
-  handleAdminNetworkPush
+  handleAdminNetworkPush,
+  // API requests must never fall through to an SPA asset response. Hosts still
+  // get first refusal through options.routes, then this terminates unknown API
+  // paths with an explicit machine-readable 404.
+  async (_req, url) => url.pathname.startsWith("/api/") ? json({ error: "not found" }, 404) : null
 ];
 function chapterWorker(options) {
   const ctx = createWorkerContext(options);