@odla-ai/chapter 0.23.0 → 0.25.0

package/dist/worker/index.d.cts

@@ -15,7 +15,14 @@ interface ChapterCopy {
     join: {
         form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
         booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
-        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete">;
+        /**
+         * `consent` is the affirmative statement a member agrees to before the card
+         * form appears, rendered beside the checkbox and beneath the policy text.
+         * It is what the member is shown at the moment of consent, so it says they
+         * agree rather than merely restating the policy. Set it to an empty string
+         * to render the checkbox with the policy as its only label.
+         */
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete" | "consent">;
         done: TextFields<"label" | "calendarInvite" | "memberArea">;
     };
     members: {
@@ -292,10 +299,9 @@ interface ChapterApplication {
      *  writing a row with no consent record. Default `true`. Set `false`
      *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
-    /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default `[]`, so application details remain
-     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
-     *  fields the browser may read. */
+    /** Allowlist of application fields mirrored into the Clerk account's
+     *  backend-only `private_metadata.profile`. Default `[]`. Use this for small
+     *  account/admin signals; the application row and CRM remain canonical. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person

package/dist/worker/index.d.ts

@@ -15,7 +15,14 @@ interface ChapterCopy {
     join: {
         form: TextFields<"submit" | "submitting" | "submitFailed" | "unexpectedFailure">;
         booking: TextFields<"unavailable" | "loadFailed" | "slotTaken" | "failed" | "loading" | "book" | "booking">;
-        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete">;
+        /**
+         * `consent` is the affirmative statement a member agrees to before the card
+         * form appears, rendered beside the checkbox and beneath the policy text.
+         * It is what the member is shown at the moment of consent, so it says they
+         * agree rather than merely restating the policy. Set it to an empty string
+         * to render the checkbox with the policy as its only label.
+         */
+        payment: TextFields<"setupFailed" | "preparing" | "pending" | "processing" | "payAndContinue" | "incomplete" | "consent">;
         done: TextFields<"label" | "calendarInvite" | "memberArea">;
     };
     members: {
@@ -292,10 +299,9 @@ interface ChapterApplication {
      *  writing a row with no consent record. Default `true`. Set `false`
      *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
-    /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default `[]`, so application details remain
-     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
-     *  fields the browser may read. */
+    /** Allowlist of application fields mirrored into the Clerk account's
+     *  backend-only `private_metadata.profile`. Default `[]`. Use this for small
+     *  account/admin signals; the application row and CRM remain canonical. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person

package/dist/worker/index.js

@@ -519,23 +519,30 @@ function clerkUserRequest(input) {
       skip_password_requirement: true,
       ...input.firstName ? { first_name: input.firstName } : {},
       ...input.lastName ? { last_name: input.lastName } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
     }
   };
 }
-async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
+async function updateClerkUserMetadata(secretKey, userId, input, fetchImpl = fetch) {
+  const res = await fetchImpl(`https://api.clerk.com/v1/users/${encodeURIComponent(userId)}/metadata`, {
+    method: "PATCH",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
+    })
+  });
+  return res.ok;
+}
+async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl = fetch) {
   const auth = { authorization: `Bearer ${secretKey}` };
   const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
   if (!found.ok) return false;
   const users = await found.json().catch(() => null);
   const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
   if (!id) return false;
-  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
-    method: "PATCH",
-    headers: { ...auth, "content-type": "application/json" },
-    body: JSON.stringify({ public_metadata: publicMetadata })
-  });
-  return patched.ok;
+  return updateClerkUserMetadata(secretKey, id, input, fetchImpl);
 }
 async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   const { path, body } = clerkUserRequest(input);
@@ -546,8 +553,15 @@ async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   });
   if (res.ok) return { ok: true, status: res.status };
   const healed = heal(res.status);
-  if (!healed.existed || !input.publicMetadata) return healed;
-  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
+  const repair = input.repairMetadata ?? {
+    ...input.publicMetadata !== void 0 ? { publicMetadata: input.publicMetadata } : {},
+    ...input.privateMetadata !== void 0 ? { privateMetadata: input.privateMetadata } : {}
+  };
+  if (!healed.existed || repair.publicMetadata === void 0 && repair.privateMetadata === void 0) return healed;
+  const refreshed = await updateClerkUserMetadataByEmail(secretKey, input.email, {
+    ...repair.publicMetadata !== void 0 ? { publicMetadata: repair.publicMetadata } : {},
+    ...repair.privateMetadata !== void 0 ? { privateMetadata: repair.privateMetadata } : {}
+  }, fetchImpl).catch(() => false);
   return { ...healed, refreshed };
 }
 
@@ -655,6 +669,41 @@ function emailGroupFrom(row) {
 }
 
 // src/worker-provisioning.ts
+var applicantPrivateMetadata = (chapter, applicationId, fields, removeMissingProfile = false) => {
+  const profile = applicantProfile(chapter, fields);
+  return {
+    applicationId,
+    ...profile ? { profile } : removeMissingProfile ? { profile: null } : {}
+  };
+};
+var publicProfileRemoval = { applicationId: null, profile: null };
+async function markPrivateMetadataSynced(db, applicationId, clerkUserId) {
+  await db.transact([{
+    t: "update",
+    ns: "applications",
+    id: applicationId,
+    attrs: {
+      clerkPrivateMetadataSyncedAt: Date.now(),
+      ...clerkUserId ? { clerkUserId } : {}
+    }
+  }]);
+}
+async function syncApplicantPrivateMetadata(db, chapter, applicationId, fields, clerkUserId) {
+  if (chapter.account === "none") return false;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return false;
+    const ok = await updateClerkUserMetadata(secret, clerkUserId, {
+      publicMetadata: publicProfileRemoval,
+      privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+    });
+    if (!ok) return false;
+    await markPrivateMetadataSynced(db, applicationId, clerkUserId);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
@@ -682,17 +731,30 @@ async function provisionApplicant(db, chapter, applicationId, fields) {
   try {
     const secret = await getVaultSecret(db, "clerk_secret_key");
     if (!secret) return;
-    const profile = applicantProfile(chapter, fields);
-    const publicMetadata = { applicationId, ...profile ? { profile } : {} };
+    const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
     if (chapter.account === "create") {
-      await createClerkUser(secret, {
+      const result = await createClerkUser(secret, {
         email,
         firstName: stringValue(fields.firstName),
         lastName: stringValue(fields.lastName),
-        publicMetadata
+        privateMetadata,
+        repairMetadata: {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        }
       });
+      if (result.ok && (!result.existed || result.refreshed)) {
+        await markPrivateMetadataSynced(db, applicationId);
+      }
     } else {
-      await createClerkInvitation(secret, { email, publicMetadata });
+      const result = await createClerkInvitation(secret, { email });
+      if (result.existed) {
+        const refreshed = await updateClerkUserMetadataByEmail(secret, email, {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        });
+        if (refreshed) await markPrivateMetadataSynced(db, applicationId);
+      }
     }
   } catch {
   }
@@ -741,7 +803,10 @@ async function memberSessionApplication(db, chapterId, email) {
   const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
   const group = Array.isArray(groups) ? groups[0] : void 0;
   const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  return memberApplication(app, meeting, timezone);
+  return {
+    application: memberApplication(app, meeting, timezone),
+    source: app
+  };
 }
 var handleHealth = async (_req, url) => url.pathname === "/api/health" ? json({ ok: true }) : null;
 var handleConfig = async (_req, url, env, ctx) => {
@@ -762,8 +827,26 @@ var handleMe = async (req, url, env, ctx) => {
   const superAdmin = await ctx.isSuperAdminEmail(db, u.email);
   const base = { authorized: isAdminRole(role, ctx.auth), role, superAdmin, email: u.email ?? null };
   if (ctx.chapter.mode !== "chapter" || !u.email) return json(base);
-  const application = await memberSessionApplication(db, ctx.chapter.id, u.email);
-  return json({ ...base, application });
+  const member = await memberSessionApplication(db, ctx.chapter.id, u.email);
+  let privateMetadataSynced = false;
+  if (member && ctx.chapter.account !== "none" && typeof member.source.clerkPrivateMetadataSyncedAt !== "number") {
+    privateMetadataSynced = await syncApplicantPrivateMetadata(
+      db,
+      ctx.chapter,
+      String(member.source.id),
+      member.source,
+      u.userId
+    );
+  }
+  if (member && !privateMetadataSynced && member.source.clerkUserId !== u.userId) {
+    await db.transact([{
+      t: "update",
+      ns: "applications",
+      id: String(member.source.id),
+      attrs: { clerkUserId: u.userId }
+    }]).catch(() => void 0);
+  }
+  return json({ ...base, application: member?.application ?? null });
 };
 var handleCrm = async (req, url, env, ctx) => {
   const crmBase = ctx.crmBase;
@@ -921,6 +1004,93 @@ var handleMember = async (req, url, env, ctx) => {
   return null;
 };
 
+// src/crm-sync.ts
+import { createRecord as createRecord2, updateRecord as updateRecord2, setStage, linkIdentity } from "@odla-ai/crm";
+var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
+var crmDeps = (db, ctx) => ({
+  crm: ctx.chapter.crm,
+  db,
+  now: () => Date.now(),
+  newId: () => crypto.randomUUID(),
+  chapter: ctx.chapter
+});
+function personInputFromApp(chapter, app) {
+  const input = sharedPersonInput({
+    email: str(app.email),
+    firstName: str(app.firstName) || void 0,
+    lastName: str(app.lastName) || void 0,
+    phone: str(app.phone) || void 0,
+    linkedin: str(app.linkedin) || void 0,
+    hubRecordId: str(app.id)
+  });
+  for (const f of chapter.application.crmFields) {
+    if (app[f] !== void 0) input[f] = app[f];
+  }
+  if (app.id !== void 0) input.applicationId = str(app.id);
+  return input;
+}
+function billingColumns(app) {
+  const status = str(app.status);
+  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
+  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
+  const cols = { billingStatus };
+  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
+  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
+  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
+  return cols;
+}
+async function syncApplicationToCrm(deps, opts) {
+  const emailKey = str(opts.app.email).toLowerCase();
+  if (!emailKey) return null;
+  const recordDeps = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
+  const input = personInputFromApp(deps.chapter, opts.app);
+  const { crm_record } = await deps.db.query({
+    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
+  });
+  const existing = crm_record?.[0] ?? null;
+  const stage = opts.stage || void 0;
+  let recordId;
+  if (existing && typeof existing.id === "string") {
+    recordId = existing.id;
+    await updateRecord2(recordDeps, { id: recordId, input });
+  } else {
+    const created = await createRecord2(recordDeps, { type: "person", input, ...stage ? { stage } : {} });
+    recordId = created.id;
+  }
+  if (existing && stage && existing.stage !== stage) {
+    await setStage(recordDeps, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
+  }
+  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
+  await linkIdentity(recordDeps, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
+  return recordId;
+}
+async function backfillCrm(deps) {
+  const [appsRes, usersRes] = await Promise.all([
+    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
+    deps.db.query({ $users: { $: { limit: 1e3 } } })
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  let synced = 0;
+  const errors = [];
+  const run = async (app, stage) => {
+    const key = str(app.email).toLowerCase();
+    if (!key || seen.has(key)) return;
+    seen.add(key);
+    try {
+      await syncApplicationToCrm(deps, { app, stage });
+      synced += 1;
+    } catch (err) {
+      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
+    }
+  };
+  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
+  for (const u of usersRes.$users ?? []) {
+    if (u.deleted === true) continue;
+    await run({ email: u.email, firstName: str(u.name) });
+  }
+  return { synced, errors };
+}
+
 // src/worker-routes-schedule.ts
 import { computeBookableSlots, initCalendar } from "@odla-ai/calendar";
 function errCode(err) {
@@ -1024,8 +1194,11 @@ async function bookSlot(req, env, ctx) {
     if (code === "calendar_slot_unavailable") return json({ error: "slot no longer available", code }, 409);
     return json({ error: "booking failed", code }, 502);
   }
-  const appOp = { t: "update", ns: "applications", id: applicationId, attrs: applicationBookingUpdate(status, startAt, htmlLink) };
+  const bookingAttrs = applicationBookingUpdate(status, startAt, htmlLink);
+  const appOp = { t: "update", ns: "applications", id: applicationId, attrs: bookingAttrs };
   await db.transact([meetingOp, appOp]);
+  const booked = { ...app, ...bookingAttrs };
+  await syncApplicationToCrm(crmDeps(db, ctx), { app: booked, stage: String(booked.status ?? "") }).catch(() => void 0);
   if (typeof app.email === "string" && app.email) {
     await sendTemplated(
       { db, envName: env.ODLA_ENV, sender: env.SEND_EMAIL, from: env.EMAIL_FROM, now: () => Date.now(), newId: () => crypto.randomUUID() },
@@ -1375,6 +1548,8 @@ async function ingestWebhook(req, env, ctx) {
   const patch = webhookPatch(event, String(app.status ?? ""));
   if (Object.keys(patch).length) {
     await db.transact([{ t: "update", ns: "applications", id: String(app.id), attrs: patch }], { mutationId: webhookMutationId(eventId) });
+    const next = { ...app, ...patch };
+    await syncApplicationToCrm(crmDeps(db, ctx), { app: next, stage: String(next.status ?? "") }).catch(() => void 0);
   }
   if (event.kind === "first_payment") {
     await notifyPaymentConfirmed(db, env, eventId, app);
@@ -1526,9 +1701,21 @@ var PAGE = 100;
 function toRecord(u) {
   if (typeof u.id !== "string") return null;
   const pm = u.public_metadata ?? {};
+  const privateMetadata = u.private_metadata ?? {};
+  const rawProfile = privateMetadata.profile;
+  const profile = rawProfile && typeof rawProfile === "object" && !Array.isArray(rawProfile) ? rawProfile : {};
+  const applicationId = typeof privateMetadata.applicationId === "string" ? privateMetadata.applicationId : void 0;
   const role = typeof pm.role === "string" && pm.role ? pm.role : DEFAULT_ROLE;
   const email = u.email_addresses?.[0]?.email_address;
-  return { id: u.id, email: typeof email === "string" ? email : void 0, role, publicMetadata: pm };
+  return {
+    id: u.id,
+    email: typeof email === "string" ? email : void 0,
+    role,
+    publicMetadata: pm,
+    privateMetadata,
+    profile,
+    ...applicationId ? { applicationId } : {}
+  };
 }
 async function clerkGet(path, secretKey, fetchImpl) {
   const res = await fetchImpl(`${CLERK_API}${path}`, { headers: { authorization: `Bearer ${secretKey}` } });
@@ -1566,86 +1753,6 @@ async function clerkSetRole(secretKey, id, role, fetchImpl = fetch) {
   return res.ok;
 }
 
-// src/crm-sync.ts
-import { createRecord as createRecord2, updateRecord as updateRecord2, setStage, linkIdentity } from "@odla-ai/crm";
-var str = (v) => typeof v === "string" ? v : v == null ? "" : String(v);
-function personInputFromApp(chapter, app) {
-  const input = sharedPersonInput({
-    email: str(app.email),
-    firstName: str(app.firstName) || void 0,
-    lastName: str(app.lastName) || void 0,
-    phone: str(app.phone) || void 0,
-    linkedin: str(app.linkedin) || void 0,
-    hubRecordId: str(app.id)
-  });
-  for (const f of chapter.application.crmFields) {
-    if (app[f] !== void 0) input[f] = app[f];
-  }
-  if (app.id !== void 0) input.applicationId = str(app.id);
-  return input;
-}
-function billingColumns(app) {
-  const status = str(app.status);
-  const paid = Boolean(app.stripeSubscriptionId) && status !== "refunded";
-  const billingStatus = status === "refunded" ? "refunded" : app.canceled === true ? "canceled" : paid ? "active" : "none";
-  const cols = { billingStatus };
-  if (app.stripeCustomerId) cols.stripeCustomerId = str(app.stripeCustomerId);
-  if (app.stripeSubscriptionId) cols.subscriptionId = str(app.stripeSubscriptionId);
-  if (typeof app.renewalAt === "number") cols.renewalAt = app.renewalAt;
-  return cols;
-}
-async function syncApplicationToCrm(deps, opts) {
-  const emailKey = str(opts.app.email).toLowerCase();
-  if (!emailKey) return null;
-  const crmDeps3 = { crm: deps.crm, db: deps.db, now: deps.now, newId: deps.newId };
-  const input = personInputFromApp(deps.chapter, opts.app);
-  const { crm_record } = await deps.db.query({
-    crm_record: { $: { where: { type: "person", primaryEmail: emailKey }, limit: 1 } }
-  });
-  const existing = crm_record?.[0] ?? null;
-  const stage = opts.stage || void 0;
-  let recordId;
-  if (existing && typeof existing.id === "string") {
-    recordId = existing.id;
-    await updateRecord2(crmDeps3, { id: recordId, input });
-  } else {
-    const created = await createRecord2(crmDeps3, { type: "person", input, ...stage ? { stage } : {} });
-    recordId = created.id;
-  }
-  if (existing && stage && existing.stage !== stage) {
-    await setStage(crmDeps3, { id: recordId, to: stage, authorId: "system", mutationId: `crm:stage:${recordId}:${stage}` }).catch(() => void 0);
-  }
-  await deps.db.transact([{ t: "update", ns: "crm_record", id: recordId, attrs: billingColumns(opts.app) }]);
-  await linkIdentity(crmDeps3, { recordId, email: emailKey, mutationId: `crm:link:${recordId}:${emailKey}` }).catch(() => void 0);
-  return recordId;
-}
-async function backfillCrm(deps) {
-  const [appsRes, usersRes] = await Promise.all([
-    deps.db.query({ applications: { $: { order: { createdAt: "desc" }, limit: 1e3 } } }),
-    deps.db.query({ $users: { $: { limit: 1e3 } } })
-  ]);
-  const seen = /* @__PURE__ */ new Set();
-  let synced = 0;
-  const errors = [];
-  const run = async (app, stage) => {
-    const key = str(app.email).toLowerCase();
-    if (!key || seen.has(key)) return;
-    seen.add(key);
-    try {
-      await syncApplicationToCrm(deps, { app, stage });
-      synced += 1;
-    } catch (err) {
-      errors.push({ email: key, error: err instanceof Error ? err.message : String(err) });
-    }
-  };
-  for (const a of appsRes.applications ?? []) await run(a, str(a.status));
-  for (const u of usersRes.$users ?? []) {
-    if (u.deleted === true) continue;
-    await run({ email: u.email, firstName: str(u.name) });
-  }
-  return { synced, errors };
-}
-
 // src/worker-routes-admin-people.ts
 async function adminGate(req, env, ctx) {
   const rawDb = ctx.makeDb(env);
@@ -1654,7 +1761,7 @@ async function adminGate(req, env, ctx) {
   if (!await ctx.isAdmin(rawDb, u)) return json({ error: "forbidden" }, 403);
   return { db: rawDb, actor: { userId: u.userId, email: u.email ?? void 0 } };
 }
-var crmDeps = (db, ctx) => ({
+var crmDeps2 = (db, ctx) => ({
   crm: ctx.chapter.crm,
   db,
   now: () => Date.now(),
@@ -1665,7 +1772,7 @@ var handleAdminCrmSync = async (req, url, env, ctx) => {
   if (req.method !== "POST" || url.pathname !== "/api/admin/crm/sync") return null;
   const gate5 = await adminGate(req, env, ctx);
   if (gate5 instanceof Response) return gate5;
-  const result = await backfillCrm(crmDeps(gate5.db, ctx));
+  const result = await backfillCrm(crmDeps2(gate5.db, ctx));
   return json({ ok: true, ...result });
 };
 var handleAdminPeople = async (req, url, env, ctx) => {
@@ -1679,17 +1786,20 @@ var handleAdminPeople = async (req, url, env, ctx) => {
     db.query({ $users: { $: { limit: 200 } } }),
     sk ? clerkListUsers(sk).catch(() => []) : Promise.resolve([])
   ]);
-  const roleByUserId = new Map(roleList.map((u) => [u.id, u.role]));
+  const clerkByUserId = new Map(roleList.map((u) => [u.id, u]));
   const people = /* @__PURE__ */ new Map();
   for (const u of usersRes.$users ?? []) {
     if (u.deleted === true) continue;
     const email = typeof u.email === "string" ? u.email : "";
     if (!email) continue;
+    const clerk = clerkByUserId.get(String(u.id));
     people.set(email.toLowerCase(), {
       email,
       name: typeof u.name === "string" ? u.name : "",
       userId: typeof u.id === "string" ? u.id : null,
-      role: roleByUserId.get(String(u.id)) ?? "provisional",
+      role: clerk?.role ?? "provisional",
+      profile: clerk ? clerk.profile : null,
+      clerkApplicationId: clerk?.applicationId ?? null,
       application: null
     });
   }
@@ -1702,7 +1812,15 @@ var handleAdminPeople = async (req, url, env, ctx) => {
       if (!row.application) row.application = applicationSummary(a);
       if (!row.name) row.name = name;
     } else {
-      people.set(key, { email: String(a.email), name, userId: null, role: null, application: applicationSummary(a) });
+      people.set(key, {
+        email: String(a.email),
+        name,
+        userId: null,
+        role: null,
+        profile: null,
+        clerkApplicationId: null,
+        application: applicationSummary(a)
+      });
     }
   }
   const rows2 = [...people.values()].sort(
@@ -1754,6 +1872,88 @@ var handleAdminPeopleRole = async (req, url, env, ctx) => {
   return json({ ok: true });
 };
 
+// src/worker-routes-admin-clerk.ts
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+function positiveInt(raw, fallback, max) {
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? Math.min(parsed, max) : fallback;
+}
+var handleAdminClerkPrivateProfileSync = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== "/api/admin/clerk/private-profiles/sync") return null;
+  const rawDb = ctx.makeDb(env);
+  const actor = await ctx.verifyUser(req, env);
+  if (!actor) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, actor)) return json({ error: "forbidden" }, 403);
+  if (ctx.chapter.mode !== "chapter" || ctx.chapter.account === "none") {
+    return json({ error: "private profile sync requires a side-effecting chapter account model" }, 409);
+  }
+  const db = rawDb;
+  const secret = await getVaultSecret(db, "clerk_secret_key");
+  if (!secret) return json({ error: "clerk_secret_key missing from vault" }, 503);
+  let all;
+  try {
+    all = await clerkListUsers(secret);
+  } catch {
+    return json({ error: "Clerk user listing failed" }, 502);
+  }
+  const offset = positiveInt(url.searchParams.get("offset"), 0, Number.MAX_SAFE_INTEGER);
+  const limit = positiveInt(url.searchParams.get("limit"), 50, 100) || 50;
+  const users = all.slice(offset, offset + limit);
+  const result = { updated: 0, alreadyCurrent: 0, noApplication: 0, failed: 0 };
+  for (const user of users) {
+    if (!user.email) {
+      result.noApplication += 1;
+      continue;
+    }
+    const apps = (await db.query({
+      applications: { $: { where: { email: user.email }, order: { createdAt: "desc" }, limit: 1 } }
+    })).applications;
+    const app = Array.isArray(apps) ? apps[0] : void 0;
+    if (!app || typeof app.id !== "string") {
+      result.noApplication += 1;
+      continue;
+    }
+    const desired = applicantPrivateMetadata(ctx.chapter, app.id, app);
+    const desiredProfile = desired.profile ?? {};
+    const legacyPublic = own(user.publicMetadata, "applicationId") || own(user.publicMetadata, "profile");
+    const current = user.applicationId === app.id && canonical(user.profile) === canonical(desiredProfile);
+    try {
+      let updated = false;
+      if (!current || legacyPublic) {
+        const ok = await updateClerkUserMetadata(secret, user.id, {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(ctx.chapter, app.id, app, true)
+        });
+        if (!ok) {
+          result.failed += 1;
+          continue;
+        }
+        updated = true;
+      }
+      await markPrivateMetadataSynced(db, app.id, user.id);
+      if (updated) result.updated += 1;
+      else result.alreadyCurrent += 1;
+    } catch {
+      result.failed += 1;
+    }
+  }
+  const nextOffset = offset + users.length < all.length ? offset + users.length : null;
+  return json({
+    totalUsers: all.length,
+    offset,
+    processed: users.length,
+    nextOffset,
+    ...result
+  });
+};
+
 // src/series.ts
 function periodSeries(points, now, count, periodMs) {
   const start = now - count * periodMs;
@@ -1945,7 +2145,6 @@ async function gate2(req, env, ctx) {
   return rawDb;
 }
 var calFor = (env) => initCalendar3({ appId: env.ODLA_APP_ID, env: env.ODLA_ENV, adminToken: env.ODLA_API_KEY, endpoint: env.ODLA_PLATFORM });
-var crmDeps2 = (db, ctx) => ({ crm: ctx.chapter.crm, db, now: () => Date.now(), newId: () => crypto.randomUUID(), chapter: ctx.chapter });
 var readJson = async (req) => {
   try {
     return await req.json();
@@ -2031,7 +2230,7 @@ var handleAdminApprove = async (req, url, env, ctx) => {
   if (!canApprove(String(app.status), ctx.chapter.pipeline)) return json({ error: `cannot approve from status "${String(app.status)}"` }, 409);
   const target = "approved";
   await db.transact([{ t: "update", ns: "applications", id, attrs: { status: target } }]);
-  await syncApplicationToCrm(crmDeps2(db, ctx), { app: { ...app, status: target }, stage: target }).catch(() => void 0);
+  await syncApplicationToCrm(crmDeps(db, ctx), { app: { ...app, status: target }, stage: target }).catch(() => void 0);
   const { promoteTo, send } = ctx.chapter.operations.onApprove;
   let rolePromoted = false;
   const sk = await getVaultSecret(db, "clerk_secret_key");
@@ -2112,7 +2311,7 @@ var handleAdminApplicationPatch = async (req, url, env, ctx) => {
   if (Object.keys(attrs).length === 0) return json({ error: "nothing to update" }, 400);
   await db.transact([{ t: "update", ns: "applications", id, attrs }]);
   if (attrs.status !== void 0) {
-    await syncApplicationToCrm(crmDeps2(db, ctx), { app: { ...app, ...attrs }, stage: String(attrs.status) }).catch(() => void 0);
+    await syncApplicationToCrm(crmDeps(db, ctx), { app: { ...app, ...attrs }, stage: String(attrs.status) }).catch(() => void 0);
   }
   return json({ ok: true });
 };
@@ -2371,6 +2570,7 @@ var BUILTIN_ROUTES = [
   handleAdminPeopleAccess,
   handleAdminPeopleRole,
   handleAdminCrmSync,
+  handleAdminClerkPrivateProfileSync,
   // Aggregation
   handleAdminDashboard,
   handleAdminBilling,