Fix production auth cutover and retire cached Clerk frontend

[Makisuo]

Production cutover exposed three issues: Google requested only openid, Maple dashboard widgets used camelCase instead of the v2 wire format, and existing browsers retained the React/Clerk Workbox service worker.

Request openid, email, and profile explicitly, use snake_case dashboard fields, and serve a retirement worker at /sw.js. On activation it removes Workbox caches, unregisters itself, and reloads controlled Hazel windows onto Foldkit. Application storage and session cookies are preserved.

Validation: auth and Alchemy typechecks passed; the initial fixes were deployed and API health, sessions, JWKS, provider initiation, and frontend artifacts checked. Retirement-worker syntax passed and was deployed to production. Verified in the user's Arc browser that the previously stuck loader now reaches the workspace list, including Hazel and Maple.

[maple-review-bot]

Maple review

🟢 Confidence 8/10 · likely safe to merge
Google sign-in config and the Maple wire-format keys are the only risky bits; the scope change is the sole sign-in path and no test simulates Google.
_{quality 100/100 · no findings · tests partial · risk medium}

Requests openid/email/profile from Google explicitly and switches the Maple dashboard widget/query draft fields to the v2 snake_case wire format. Contained and safe to merge; no defect found in either hunk.

Before merge

• Manual · Confirm the Google OAuth client allows the new scopes on prd
• Manual · Verify the prd deploy upserts the dashboard and 6 alert rules (MAPLE_ALERTS_WEBHOOK_URL set)

What was checked

• No leftover camelCase key in the widget, display, layout or draft: read all 172 lines of maple-monitoring.ts
• makeHazelAuthHttp is the only Google provider construction; apps/backend/src/services/hazel-auth.ts:70 passes config only
• Alert rules share the renamed tracesQuery helper, so alert and dashboard drafts stay consistent

_{11b3c64 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: da2dae5e-3312-48dc-919c-c121bd54764a

📥 Commits

Reviewing files that changed from the base of the PR and between dc919af and 11b3c64.

📒 Files selected for processing: 2

• packages/auth/src/yielded/server.ts
• packages/infra/src/cloudflare/maple-monitoring.ts

 __________________________________________
< Duck and cover! I'm reviewing your code. >
 ------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	52.68%	4916 / 9331
🔵	Statements	52.11%	5121 / 9826
🔵	Functions	41.17%	1202 / 2919
🔵	Branches	37.99%	1619 / 4261

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/auth/src/yielded/server.ts	83.05%	70.58%	66.66%	85.96%	67, 94, 106-110, 112, 158, 172-176, 188-196

Generated in workflow #1822 for commit f025076 by the Vitest Coverage Report Action

[maple-review-bot]

Warning

The review of f025076 could not finish. It stopped before it finished, so its partial findings are not posted here. Comment @maple-review-bot review to try again.

[maple-review-bot]

Merged with 2 steps from "Before merge" still open. If they are done, tick them on the review comment; if not, now is the time.

• Manual · Confirm the Google OAuth client allows the new scopes on prd
• Manual · Verify the prd deploy upserts the dashboard and 6 alert rules (MAPLE_ALERTS_WEBHOOK_URL set)