@odla-ai/chapter 0.24.0 → 0.25.0

package/dist/worker/index.d.cts

@@ -299,10 +299,9 @@ interface ChapterApplication {
      *  writing a row with no consent record. Default `true`. Set `false`
      *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
-    /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default `[]`, so application details remain
-     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
-     *  fields the browser may read. */
+    /** Allowlist of application fields mirrored into the Clerk account's
+     *  backend-only `private_metadata.profile`. Default `[]`. Use this for small
+     *  account/admin signals; the application row and CRM remain canonical. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person

package/dist/worker/index.d.ts

@@ -299,10 +299,9 @@ interface ChapterApplication {
      *  writing a row with no consent record. Default `true`. Set `false`
      *  deliberately only when the site renders no consent control. */
     requireDisclaimerAck?: boolean;
-    /** Allowlist of fields that reach the Clerk account's client-readable
-     *  `public_metadata.profile`. Default `[]`, so application details remain
-     *  db-only. Set a curated list (e.g. `["phone", "state", "focus"]`) for
-     *  fields the browser may read. */
+    /** Allowlist of application fields mirrored into the Clerk account's
+     *  backend-only `private_metadata.profile`. Default `[]`. Use this for small
+     *  account/admin signals; the application row and CRM remain canonical. */
     profileFields?: readonly string[];
     /** Extra application fields carried into the one-way CRM projection, on top of
      *  the built-in identity/contact set. Each MUST be declared on your crm person

package/dist/worker/index.js

@@ -519,23 +519,30 @@ function clerkUserRequest(input) {
       skip_password_requirement: true,
       ...input.firstName ? { first_name: input.firstName } : {},
       ...input.lastName ? { last_name: input.lastName } : {},
-      ...input.publicMetadata ? { public_metadata: input.publicMetadata } : {}
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
     }
   };
 }
-async function refreshUserMetadata(secretKey, email, publicMetadata, fetchImpl) {
+async function updateClerkUserMetadata(secretKey, userId, input, fetchImpl = fetch) {
+  const res = await fetchImpl(`https://api.clerk.com/v1/users/${encodeURIComponent(userId)}/metadata`, {
+    method: "PATCH",
+    headers: { authorization: `Bearer ${secretKey}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      ...input.publicMetadata !== void 0 ? { public_metadata: input.publicMetadata } : {},
+      ...input.privateMetadata !== void 0 ? { private_metadata: input.privateMetadata } : {}
+    })
+  });
+  return res.ok;
+}
+async function updateClerkUserMetadataByEmail(secretKey, email, input, fetchImpl = fetch) {
   const auth = { authorization: `Bearer ${secretKey}` };
   const found = await fetchImpl(`https://api.clerk.com/v1/users?email_address=${encodeURIComponent(email)}&limit=1`, { headers: auth });
   if (!found.ok) return false;
   const users = await found.json().catch(() => null);
   const id = Array.isArray(users) && typeof users[0]?.id === "string" ? users[0].id : void 0;
   if (!id) return false;
-  const patched = await fetchImpl(`https://api.clerk.com/v1/users/${id}/metadata`, {
-    method: "PATCH",
-    headers: { ...auth, "content-type": "application/json" },
-    body: JSON.stringify({ public_metadata: publicMetadata })
-  });
-  return patched.ok;
+  return updateClerkUserMetadata(secretKey, id, input, fetchImpl);
 }
 async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   const { path, body } = clerkUserRequest(input);
@@ -546,8 +553,15 @@ async function createClerkUser(secretKey, input, fetchImpl = fetch) {
   });
   if (res.ok) return { ok: true, status: res.status };
   const healed = heal(res.status);
-  if (!healed.existed || !input.publicMetadata) return healed;
-  const refreshed = await refreshUserMetadata(secretKey, input.email, input.publicMetadata, fetchImpl).catch(() => false);
+  const repair = input.repairMetadata ?? {
+    ...input.publicMetadata !== void 0 ? { publicMetadata: input.publicMetadata } : {},
+    ...input.privateMetadata !== void 0 ? { privateMetadata: input.privateMetadata } : {}
+  };
+  if (!healed.existed || repair.publicMetadata === void 0 && repair.privateMetadata === void 0) return healed;
+  const refreshed = await updateClerkUserMetadataByEmail(secretKey, input.email, {
+    ...repair.publicMetadata !== void 0 ? { publicMetadata: repair.publicMetadata } : {},
+    ...repair.privateMetadata !== void 0 ? { privateMetadata: repair.privateMetadata } : {}
+  }, fetchImpl).catch(() => false);
   return { ...healed, refreshed };
 }
 
@@ -655,6 +669,41 @@ function emailGroupFrom(row) {
 }
 
 // src/worker-provisioning.ts
+var applicantPrivateMetadata = (chapter, applicationId, fields, removeMissingProfile = false) => {
+  const profile = applicantProfile(chapter, fields);
+  return {
+    applicationId,
+    ...profile ? { profile } : removeMissingProfile ? { profile: null } : {}
+  };
+};
+var publicProfileRemoval = { applicationId: null, profile: null };
+async function markPrivateMetadataSynced(db, applicationId, clerkUserId) {
+  await db.transact([{
+    t: "update",
+    ns: "applications",
+    id: applicationId,
+    attrs: {
+      clerkPrivateMetadataSyncedAt: Date.now(),
+      ...clerkUserId ? { clerkUserId } : {}
+    }
+  }]);
+}
+async function syncApplicantPrivateMetadata(db, chapter, applicationId, fields, clerkUserId) {
+  if (chapter.account === "none") return false;
+  try {
+    const secret = await getVaultSecret(db, "clerk_secret_key");
+    if (!secret) return false;
+    const ok = await updateClerkUserMetadata(secret, clerkUserId, {
+      publicMetadata: publicProfileRemoval,
+      privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+    });
+    if (!ok) return false;
+    await markPrivateMetadataSynced(db, applicationId, clerkUserId);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function provisionApplicant(db, chapter, applicationId, fields) {
   const email = typeof fields.email === "string" ? fields.email : "";
   if (!email) return;
@@ -682,17 +731,30 @@ async function provisionApplicant(db, chapter, applicationId, fields) {
   try {
     const secret = await getVaultSecret(db, "clerk_secret_key");
     if (!secret) return;
-    const profile = applicantProfile(chapter, fields);
-    const publicMetadata = { applicationId, ...profile ? { profile } : {} };
+    const privateMetadata = applicantPrivateMetadata(chapter, applicationId, fields);
     if (chapter.account === "create") {
-      await createClerkUser(secret, {
+      const result = await createClerkUser(secret, {
         email,
         firstName: stringValue(fields.firstName),
         lastName: stringValue(fields.lastName),
-        publicMetadata
+        privateMetadata,
+        repairMetadata: {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        }
       });
+      if (result.ok && (!result.existed || result.refreshed)) {
+        await markPrivateMetadataSynced(db, applicationId);
+      }
     } else {
-      await createClerkInvitation(secret, { email, publicMetadata });
+      const result = await createClerkInvitation(secret, { email });
+      if (result.existed) {
+        const refreshed = await updateClerkUserMetadataByEmail(secret, email, {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(chapter, applicationId, fields, true)
+        });
+        if (refreshed) await markPrivateMetadataSynced(db, applicationId);
+      }
     }
   } catch {
   }
@@ -741,7 +803,10 @@ async function memberSessionApplication(db, chapterId, email) {
   const groups = (await db.query({ groups: { $: { where: { id: chapterId }, limit: 1 } } })).groups;
   const group = Array.isArray(groups) ? groups[0] : void 0;
   const timezone = resolveScheduling(group?.schedulingJson).timezone;
-  return memberApplication(app, meeting, timezone);
+  return {
+    application: memberApplication(app, meeting, timezone),
+    source: app
+  };
 }
 var handleHealth = async (_req, url) => url.pathname === "/api/health" ? json({ ok: true }) : null;
 var handleConfig = async (_req, url, env, ctx) => {
@@ -762,8 +827,26 @@ var handleMe = async (req, url, env, ctx) => {
   const superAdmin = await ctx.isSuperAdminEmail(db, u.email);
   const base = { authorized: isAdminRole(role, ctx.auth), role, superAdmin, email: u.email ?? null };
   if (ctx.chapter.mode !== "chapter" || !u.email) return json(base);
-  const application = await memberSessionApplication(db, ctx.chapter.id, u.email);
-  return json({ ...base, application });
+  const member = await memberSessionApplication(db, ctx.chapter.id, u.email);
+  let privateMetadataSynced = false;
+  if (member && ctx.chapter.account !== "none" && typeof member.source.clerkPrivateMetadataSyncedAt !== "number") {
+    privateMetadataSynced = await syncApplicantPrivateMetadata(
+      db,
+      ctx.chapter,
+      String(member.source.id),
+      member.source,
+      u.userId
+    );
+  }
+  if (member && !privateMetadataSynced && member.source.clerkUserId !== u.userId) {
+    await db.transact([{
+      t: "update",
+      ns: "applications",
+      id: String(member.source.id),
+      attrs: { clerkUserId: u.userId }
+    }]).catch(() => void 0);
+  }
+  return json({ ...base, application: member?.application ?? null });
 };
 var handleCrm = async (req, url, env, ctx) => {
   const crmBase = ctx.crmBase;
@@ -1618,9 +1701,21 @@ var PAGE = 100;
 function toRecord(u) {
   if (typeof u.id !== "string") return null;
   const pm = u.public_metadata ?? {};
+  const privateMetadata = u.private_metadata ?? {};
+  const rawProfile = privateMetadata.profile;
+  const profile = rawProfile && typeof rawProfile === "object" && !Array.isArray(rawProfile) ? rawProfile : {};
+  const applicationId = typeof privateMetadata.applicationId === "string" ? privateMetadata.applicationId : void 0;
   const role = typeof pm.role === "string" && pm.role ? pm.role : DEFAULT_ROLE;
   const email = u.email_addresses?.[0]?.email_address;
-  return { id: u.id, email: typeof email === "string" ? email : void 0, role, publicMetadata: pm };
+  return {
+    id: u.id,
+    email: typeof email === "string" ? email : void 0,
+    role,
+    publicMetadata: pm,
+    privateMetadata,
+    profile,
+    ...applicationId ? { applicationId } : {}
+  };
 }
 async function clerkGet(path, secretKey, fetchImpl) {
   const res = await fetchImpl(`${CLERK_API}${path}`, { headers: { authorization: `Bearer ${secretKey}` } });
@@ -1691,17 +1786,20 @@ var handleAdminPeople = async (req, url, env, ctx) => {
     db.query({ $users: { $: { limit: 200 } } }),
     sk ? clerkListUsers(sk).catch(() => []) : Promise.resolve([])
   ]);
-  const roleByUserId = new Map(roleList.map((u) => [u.id, u.role]));
+  const clerkByUserId = new Map(roleList.map((u) => [u.id, u]));
   const people = /* @__PURE__ */ new Map();
   for (const u of usersRes.$users ?? []) {
     if (u.deleted === true) continue;
     const email = typeof u.email === "string" ? u.email : "";
     if (!email) continue;
+    const clerk = clerkByUserId.get(String(u.id));
     people.set(email.toLowerCase(), {
       email,
       name: typeof u.name === "string" ? u.name : "",
       userId: typeof u.id === "string" ? u.id : null,
-      role: roleByUserId.get(String(u.id)) ?? "provisional",
+      role: clerk?.role ?? "provisional",
+      profile: clerk ? clerk.profile : null,
+      clerkApplicationId: clerk?.applicationId ?? null,
       application: null
     });
   }
@@ -1714,7 +1812,15 @@ var handleAdminPeople = async (req, url, env, ctx) => {
       if (!row.application) row.application = applicationSummary(a);
       if (!row.name) row.name = name;
     } else {
-      people.set(key, { email: String(a.email), name, userId: null, role: null, application: applicationSummary(a) });
+      people.set(key, {
+        email: String(a.email),
+        name,
+        userId: null,
+        role: null,
+        profile: null,
+        clerkApplicationId: null,
+        application: applicationSummary(a)
+      });
     }
   }
   const rows2 = [...people.values()].sort(
@@ -1766,6 +1872,88 @@ var handleAdminPeopleRole = async (req, url, env, ctx) => {
   return json({ ok: true });
 };
 
+// src/worker-routes-admin-clerk.ts
+var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+function positiveInt(raw, fallback, max) {
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? Math.min(parsed, max) : fallback;
+}
+var handleAdminClerkPrivateProfileSync = async (req, url, env, ctx) => {
+  if (req.method !== "POST" || url.pathname !== "/api/admin/clerk/private-profiles/sync") return null;
+  const rawDb = ctx.makeDb(env);
+  const actor = await ctx.verifyUser(req, env);
+  if (!actor) return json({ error: "unauthorized" }, 401);
+  if (!await ctx.isAdmin(rawDb, actor)) return json({ error: "forbidden" }, 403);
+  if (ctx.chapter.mode !== "chapter" || ctx.chapter.account === "none") {
+    return json({ error: "private profile sync requires a side-effecting chapter account model" }, 409);
+  }
+  const db = rawDb;
+  const secret = await getVaultSecret(db, "clerk_secret_key");
+  if (!secret) return json({ error: "clerk_secret_key missing from vault" }, 503);
+  let all;
+  try {
+    all = await clerkListUsers(secret);
+  } catch {
+    return json({ error: "Clerk user listing failed" }, 502);
+  }
+  const offset = positiveInt(url.searchParams.get("offset"), 0, Number.MAX_SAFE_INTEGER);
+  const limit = positiveInt(url.searchParams.get("limit"), 50, 100) || 50;
+  const users = all.slice(offset, offset + limit);
+  const result = { updated: 0, alreadyCurrent: 0, noApplication: 0, failed: 0 };
+  for (const user of users) {
+    if (!user.email) {
+      result.noApplication += 1;
+      continue;
+    }
+    const apps = (await db.query({
+      applications: { $: { where: { email: user.email }, order: { createdAt: "desc" }, limit: 1 } }
+    })).applications;
+    const app = Array.isArray(apps) ? apps[0] : void 0;
+    if (!app || typeof app.id !== "string") {
+      result.noApplication += 1;
+      continue;
+    }
+    const desired = applicantPrivateMetadata(ctx.chapter, app.id, app);
+    const desiredProfile = desired.profile ?? {};
+    const legacyPublic = own(user.publicMetadata, "applicationId") || own(user.publicMetadata, "profile");
+    const current = user.applicationId === app.id && canonical(user.profile) === canonical(desiredProfile);
+    try {
+      let updated = false;
+      if (!current || legacyPublic) {
+        const ok = await updateClerkUserMetadata(secret, user.id, {
+          publicMetadata: publicProfileRemoval,
+          privateMetadata: applicantPrivateMetadata(ctx.chapter, app.id, app, true)
+        });
+        if (!ok) {
+          result.failed += 1;
+          continue;
+        }
+        updated = true;
+      }
+      await markPrivateMetadataSynced(db, app.id, user.id);
+      if (updated) result.updated += 1;
+      else result.alreadyCurrent += 1;
+    } catch {
+      result.failed += 1;
+    }
+  }
+  const nextOffset = offset + users.length < all.length ? offset + users.length : null;
+  return json({
+    totalUsers: all.length,
+    offset,
+    processed: users.length,
+    nextOffset,
+    ...result
+  });
+};
+
 // src/series.ts
 function periodSeries(points, now, count, periodMs) {
   const start = now - count * periodMs;
@@ -2382,6 +2570,7 @@ var BUILTIN_ROUTES = [
   handleAdminPeopleAccess,
   handleAdminPeopleRole,
   handleAdminCrmSync,
+  handleAdminClerkPrivateProfileSync,
   // Aggregation
   handleAdminDashboard,
   handleAdminBilling,