@kya-os/mcp-i-cloudflare 1.17.0 → 1.18.0

package/dist/utils/oauth-profile.js

@@ -7,7 +7,9 @@ export function oauthProfileString(value) {
 /** GitHub subjects are numeric IDs; preserve them as exact scalar strings. */
 export function normalizeOAuthSubject(value) {
     if (typeof value === "number") {
-        return Number.isSafeInteger(value) && value >= 0 ? String(value) : undefined;
+        return Number.isSafeInteger(value) && value >= 0
+            ? String(value)
+            : undefined;
     }
     return oauthProfileString(value);
 }
@@ -21,4 +23,55 @@ export function oauthProfileSubject(profile) {
         normalizeOAuthSubject(claims.id) ??
         oauthProfileString(claims.login));
 }
+const GITHUB_API_ORIGIN = "https://api.github.com";
+/** The primary address from GitHub's /user/emails, only when GitHub verified it. */
+function githubVerifiedPrimaryEmail(emails) {
+    if (!Array.isArray(emails))
+        return undefined;
+    const primary = emails.find((entry) => !!entry &&
+        typeof entry === "object" &&
+        "primary" in entry &&
+        entry.primary === true);
+    return primary?.verified === true
+        ? oauthProfileString(primary.email)
+        : undefined;
+}
+/**
+ * The email to send for identity linking, and whether the provider verified it.
+ *
+ * GitHub's /user has no verification flag, so for a profile read from the
+ * GitHub API the only verified email is the primary one on /user/emails (needs
+ * the `user:email` scope). A missing scope, an error or an unverified primary
+ * leaves the profile email unverified. The token only goes to the API that
+ * already served the profile. Other providers keep their explicit boolean claim.
+ */
+export async function resolveOAuthEmail(params) {
+    const profileEmail = oauthProfileString(params.profile.email);
+    if (new URL(params.userInfoUrl).origin !== GITHUB_API_ORIGIN) {
+        return {
+            email: profileEmail,
+            emailVerified: params.profile.email_verified === true,
+        };
+    }
+    // Unbound: Workers throws "Illegal invocation" for fetch called as a method.
+    const { fetchImpl } = params;
+    try {
+        const response = await fetchImpl(`${GITHUB_API_ORIGIN}/user/emails`, {
+            headers: {
+                Authorization: `Bearer ${params.accessToken}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": params.userAgent,
+            },
+        });
+        const verified = response.ok
+            ? githubVerifiedPrimaryEmail(await response.json())
+            : undefined;
+        return verified
+            ? { email: verified, emailVerified: true }
+            : { email: profileEmail, emailVerified: false };
+    }
+    catch {
+        return { email: profileEmail, emailVerified: false };
+    }
+}
 //# sourceMappingURL=oauth-profile.js.map

package/dist/utils/oauth-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-profile.js","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-profile.js","sourceRoot":"","sources":["../../src/utils/oauth-profile.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,oFAAoF;AACpF,SAAS,0BAA0B,CAAC,MAAe;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAI,MAAoB,CAAC,IAAI,CACxC,CAAC,KAAK,EAAoC,EAAE,CAC1C,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,SAAS,IAAI,KAAK;QAClB,KAAK,CAAC,OAAO,KAAK,IAAI,CACzB,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,KAAK,IAAI;QAC/B,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAMvC;IACC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI;SACtD,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,iBAAiB,cAAc,EAAE;YACnE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;gBAC7C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,MAAM,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE;YAC1B,CAAC,CAAC,0BAA0B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,QAAQ;YACb,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE;YAC1C,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-cloudflare",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Cloudflare Workers adapter for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,8 +31,8 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/consent": "^0.1.50",
-    "@kya-os/contracts": "^1.13.1",
+    "@kya-os/consent": "^0.2.0",
+    "@kya-os/contracts": "^1.14.0",
     "@kya-os/mcp": "1.16.0",
     "@kya-os/mcp-i-core": "^1.9.4",
     "@kya-os/mcp-i-runtime": "^1.3.1",