@kya-os/mcp-i-cloudflare 1.16.0 → 1.18.0

package/dist/services/resource-audience.js

@@ -0,0 +1,83 @@
+/**
+ * Resource audience: the one `aud` a delegation must name for this request.
+ *
+ * A worker can be routed under several hosts (apex and www,
+ * `<script>.kya-os.ai` plus a custom domain), each its own resource with its
+ * own `did:web:<host>`. `KYA_OS_RESOURCE_DIDS`, a JSON array of did:web DIDs
+ * provisioned by Checkpoint, lists them. A delegation must name exactly
+ * `did:web:<the host this request was routed for>`, and that DID must be
+ * listed: a token for one host is refused at another.
+ *
+ * The routed host must be authentic: the host of the request the edge
+ * delivered (Workers for Platforms dispatch forwards the original request),
+ * never a client-controllable forwarding header. Callers pass it in.
+ *
+ * Unset, empty or malformed configuration, a routed host that is not listed,
+ * or no routed host at all accepts nothing.
+ *
+ * Pure: no I/O. One implementation, shared by every verifier in this package.
+ */
+/** The error each refusal reports; every credential is refused. */
+export const RESOURCE_REFUSALS = Object.freeze({
+    resources_unconfigured: "KYA_OS_RESOURCE_DIDS is unset, empty or malformed: this worker has no resource DID, so no delegation can name it",
+    no_routed_host: "No routed host for this verification: the expected audience is did:web:<request Host>",
+    host_not_a_resource: "The routed host is not one of this worker's resources (KYA_OS_RESOURCE_DIDS)",
+});
+const DID_WEB_PATTERN = /^did:web:[a-z0-9.-]+(?:%3A[0-9]{1,5})?(?::[^\s:#?/]+)*$/;
+/**
+ * `KYA_OS_RESOURCE_DIDS`: a non-empty JSON array of `did:web` DIDs. Anything
+ * else (unset, empty, not JSON, not an array, a non-did:web entry) is null,
+ * so every credential is refused.
+ */
+export function parseResourceDids(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    return Array.isArray(parsed) &&
+        parsed.length > 0 &&
+        parsed.every((did) => typeof did === "string" && DID_WEB_PATTERN.test(did))
+        ? parsed
+        : null;
+}
+/** did:web for a URL host (`host[:port]`), port colon percent-encoded. */
+export function didWebForHost(host) {
+    const value = host.trim().toLowerCase();
+    if (!/^[a-z0-9.-]+(?::[0-9]{1,5})?$/.test(value))
+        return undefined;
+    return "did:web:" + value.replace(":", "%3A");
+}
+/**
+ * The resource DID a delegation must name for a request routed for
+ * `routedHost`, given the `KYA_OS_RESOURCE_DIDS` setting.
+ */
+export function routedResource(resourceDids, routedHost) {
+    const resources = parseResourceDids(resourceDids);
+    if (!resources)
+        return { refusal: "resources_unconfigured" };
+    const routed = routedHost === undefined ? undefined : didWebForHost(routedHost);
+    if (!routed)
+        return { refusal: "no_routed_host" };
+    if (!resources.includes(routed))
+        return { refusal: "host_not_a_resource" };
+    return { resourceDid: routed };
+}
+/**
+ * RFC 7519 §4.1.3: `aud` must be exactly the expected resource DID (a string,
+ * or an array holding only that value). A multi-valued `aud` is refused, so
+ * no token is accepted at more than one host.
+ */
+export function audienceNamesResource(aud, resourceDid) {
+    if (aud === undefined)
+        return "missing";
+    const value = Array.isArray(aud) && aud.length === 1 ? aud[0] : aud;
+    return resourceDid !== undefined && value === resourceDid
+        ? "accepted"
+        : "unmatched";
+}
+//# sourceMappingURL=resource-audience.js.map

package/dist/services/resource-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-audience.js","sourceRoot":"","sources":["../../src/services/resource-audience.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,sBAAsB,EACpB,kHAAkH;IACpH,cAAc,EACZ,uFAAuF;IACzF,mBAAmB,EACjB,8EAA8E;CACjF,CAAC,CAAC;AAOL,MAAM,eAAe,GACnB,yDAAyD,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,CAAC,CAAE,MAAmB;QACtB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAqB,EACrB,UAA8B;IAE9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC7D,MAAM,MAAM,GACV,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAY,EACZ,WAA+B;IAE/B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,OAAO,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW;QACvD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC"}

package/dist/types.d.ts

@@ -62,11 +62,12 @@ export interface CloudflareEnv {
      */
     KYA_OS_TRUSTED_DELEGATION_ISSUERS?: string;
     /**
-     * Comma- or whitespace-separated `aud` values this worker accepts on
-     * delegation VC-JWTs, in addition to its own DID, CHECKPOINT_PROJECT_ID and
-     * the native issuer binding's org DID and project. Read by DelegationService.
+     * This worker's resources: a JSON array of `did:web:<host>`, one per host it
+     * is routed under, provisioned by Checkpoint. A delegation's `aud` must be
+     * `did:web:<the request's Host>` and be in this list. Unset, empty or
+     * malformed, every delegation is refused. Read by DelegationService.
      */
-    KYA_OS_DELEGATION_AUDIENCES?: string;
+    KYA_OS_RESOURCE_DIDS?: string;
     /**
      * "1"/"true" accepts legacy (non VC-JWT) delegation tokens unchecked when no
      * CHECKPOINT_API_KEY is configured. Local development only; never cached.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,WAAW,EAAE,WAAW,CAAC;IACzB,kEAAkE;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,gFAAgF;IAChF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,wFAAwF;IACxF,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,qFAAqF;IACrF,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAC9C,mFAAmF;IACnF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,yEAAyE;IACzE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2LAA2L;IAC3L,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sJAAsJ;IACtJ,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sKAAsK;IACtK,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gPAAgP;IAChP,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,WAAW,EAAE,WAAW,CAAC;IACzB,kEAAkE;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,gFAAgF;IAChF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,wFAAwF;IACxF,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,qFAAqF;IACrF,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAC9C,mFAAmF;IACnF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,yEAAyE;IACzE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2LAA2L;IAC3L,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sJAAsJ;IACtJ,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sKAAsK;IACtK,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gPAAgP;IAChP,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/utils/oauth-profile.d.ts

@@ -4,4 +4,23 @@ export declare function oauthProfileString(value: unknown): string | undefined;
 export declare function normalizeOAuthSubject(value: unknown): string | undefined;
 /** Use provider identifiers; an email alone is not a provider subject. */
 export declare function oauthProfileSubject(profile: unknown): string | undefined;
+/**
+ * The email to send for identity linking, and whether the provider verified it.
+ *
+ * GitHub's /user has no verification flag, so for a profile read from the
+ * GitHub API the only verified email is the primary one on /user/emails (needs
+ * the `user:email` scope). A missing scope, an error or an unverified primary
+ * leaves the profile email unverified. The token only goes to the API that
+ * already served the profile. Other providers keep their explicit boolean claim.
+ */
+export declare function resolveOAuthEmail(params: {
+    profile: Record<string, unknown>;
+    userInfoUrl: string;
+    accessToken: string;
+    fetchImpl: typeof fetch;
+    userAgent: string;
+}): Promise<{
+    email?: string;
+    emailVerified: boolean;
+}>;
 //# sourceMappingURL=oauth-profile.d.ts.map

package/dist/utils/oauth-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-profile.d.ts","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKxE;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUxE"}
+{"version":3,"file":"oauth-profile.d.ts","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOxE;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUxE;AAmBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC,CA2BtD"}

package/dist/utils/oauth-profile.js

@@ -7,7 +7,9 @@ export function oauthProfileString(value) {
 /** GitHub subjects are numeric IDs; preserve them as exact scalar strings. */
 export function normalizeOAuthSubject(value) {
     if (typeof value === "number") {
-        return Number.isSafeInteger(value) && value >= 0 ? String(value) : undefined;
+        return Number.isSafeInteger(value) && value >= 0
+            ? String(value)
+            : undefined;
     }
     return oauthProfileString(value);
 }
@@ -21,4 +23,55 @@ export function oauthProfileSubject(profile) {
         normalizeOAuthSubject(claims.id) ??
         oauthProfileString(claims.login));
 }
+const GITHUB_API_ORIGIN = "https://api.github.com";
+/** The primary address from GitHub's /user/emails, only when GitHub verified it. */
+function githubVerifiedPrimaryEmail(emails) {
+    if (!Array.isArray(emails))
+        return undefined;
+    const primary = emails.find((entry) => !!entry &&
+        typeof entry === "object" &&
+        "primary" in entry &&
+        entry.primary === true);
+    return primary?.verified === true
+        ? oauthProfileString(primary.email)
+        : undefined;
+}
+/**
+ * The email to send for identity linking, and whether the provider verified it.
+ *
+ * GitHub's /user has no verification flag, so for a profile read from the
+ * GitHub API the only verified email is the primary one on /user/emails (needs
+ * the `user:email` scope). A missing scope, an error or an unverified primary
+ * leaves the profile email unverified. The token only goes to the API that
+ * already served the profile. Other providers keep their explicit boolean claim.
+ */
+export async function resolveOAuthEmail(params) {
+    const profileEmail = oauthProfileString(params.profile.email);
+    if (new URL(params.userInfoUrl).origin !== GITHUB_API_ORIGIN) {
+        return {
+            email: profileEmail,
+            emailVerified: params.profile.email_verified === true,
+        };
+    }
+    // Unbound: Workers throws "Illegal invocation" for fetch called as a method.
+    const { fetchImpl } = params;
+    try {
+        const response = await fetchImpl(`${GITHUB_API_ORIGIN}/user/emails`, {
+            headers: {
+                Authorization: `Bearer ${params.accessToken}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": params.userAgent,
+            },
+        });
+        const verified = response.ok
+            ? githubVerifiedPrimaryEmail(await response.json())
+            : undefined;
+        return verified
+            ? { email: verified, emailVerified: true }
+            : { email: profileEmail, emailVerified: false };
+    }
+    catch {
+        return { email: profileEmail, emailVerified: false };
+    }
+}
 //# sourceMappingURL=oauth-profile.js.map

package/dist/utils/oauth-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-profile.js","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-profile.js","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,oFAAoF;AACpF,SAAS,0BAA0B,CAAC,MAAe;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAI,MAAoB,CAAC,IAAI,CACxC,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,SAAS,IAAI,KAAK;QAClB,KAAK,CAAC,OAAO,KAAK,IAAI,CACzB,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,KAAK,IAAI;QAC/B,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAMvC;IACC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI;SACtD,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,iBAAiB,cAAc,EAAE;YACnE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;gBAC7C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,MAAM,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE;YAC1B,CAAC,CAAC,0BAA0B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,QAAQ;YACb,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE;YAC1C,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-cloudflare",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Cloudflare Workers adapter for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,8 +31,8 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/consent": "^0.1.50",
-    "@kya-os/contracts": "^1.13.1",
+    "@kya-os/consent": "^0.2.0",
+    "@kya-os/contracts": "^1.14.0",
     "@kya-os/mcp": "1.16.0",
     "@kya-os/mcp-i-core": "^1.9.4",
     "@kya-os/mcp-i-runtime": "^1.3.1",