@nyuchi/mzizi-mcp 0.6.0 → 0.8.0

package/README.md

@@ -9,7 +9,9 @@ retiring a tool is a registry edit, not a code change. The server is read-only o
 the anonymous surface — write-kind tools are excluded.
 
 **Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
-0.4.0). A **free WorkOS signup gate** fronts the endpoint — a WorkOS
+0.7.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
+reports, and it moves in lockstep with `package.json` and `server.json`). A
+**free WorkOS signup gate** fronts the endpoint — a WorkOS
 **Connect OAuth application** (public client, PKCE; no client secret) — so sign up
 once and read the whole registry at no cost. The worker advertises
 `/.well-known/oauth-protected-resource` so MCP clients can run the OAuth discovery
@@ -138,21 +140,28 @@ catalog.
 
 Secrets (`wrangler secret put`):
 
-| Secret                     | Required | Notes                                          |
-| -------------------------- | -------- | ---------------------------------------------- |
-| `SUPABASE_URL`             | yes      | Public Supabase project URL                    |
-| `SUPABASE_PUBLISHABLE_KEY` | yes      | Anon (RLS public-read) key                     |
-| `SUPABASE_SECRET_KEY`      | no       | Service-role key; placeholder is used if unset |
-| `COOKIE_ENCRYPTION_KEY`    | yes      | HMAC key for the consent cookie (random bytes) |
+| Secret                     | Required | Notes                                                          |
+| -------------------------- | -------- | -------------------------------------------------------------- |
+| `SUPABASE_URL`             | yes      | Public Supabase project URL                                    |
+| `SUPABASE_PUBLISHABLE_KEY` | yes      | Anon (RLS public-read) key                                     |
+| `SUPABASE_SECRET_KEY`      | no       | Service-role key; placeholder is used if unset                 |
+| `COOKIE_ENCRYPTION_KEY`    | yes      | HMAC key for the consent cookie (random bytes)                 |
+| `WORKOS_AUTHKIT_DOMAIN`    | no       | AuthKit domain for `/oauth2/*` (`https://accounts.mukoko.com`) |
+
+`WORKOS_AUTHKIT_DOMAIN` is a **secret and not a `[vars]` entry**, even though a hostname is not
+confidential: a var wins on every deploy and silently discards a same-named remote value, so a
+value that differs per environment cannot live in committed config. It is "not required" only
+because `src/identity.ts` carries a working default — and it must move in lockstep with
+`fundi-tester`, which binds the same issuer that this Worker's agent-card consumers are pointed
+at. See `AUTH.md`.
 
 Plain vars (`[vars]` in `wrangler.toml`, not secrets):
 
-| Var                     | Notes                                                               |
-| ----------------------- | ------------------------------------------------------------------- |
-| `WORKOS_CLIENT_ID`      | Connect OAuth app client id (public client; PKCE)                   |
-| `WORKOS_AUTHKIT_DOMAIN` | AuthKit domain for `/oauth2/*` (e.g. `https://identity.nyuchi.com`) |
-| `WORKOS_M2M_CLIENT_ID`  | Fundi M2M app client id; required only when `FUNDI_URL` is set      |
-| `FUNDI_URL`             | Base URL of the fundi worker; enables the `fundi_status` tool       |
+| Var                    | Notes                                                          |
+| ---------------------- | -------------------------------------------------------------- |
+| `WORKOS_CLIENT_ID`     | Connect OAuth app client id (public client; PKCE)              |
+| `WORKOS_M2M_CLIENT_ID` | Fundi M2M app client id; required only when `FUNDI_URL` is set |
+| `FUNDI_URL`            | Base URL of the fundi worker; enables the `fundi_status` tool  |
 
 > The Connect OAuth app is a **public client (PKCE)** — there is no `WORKOS_CLIENT_SECRET`
 > or WorkOS API key on the worker.

package/dist/api-client.d.ts

@@ -0,0 +1,86 @@
+/**
+ * HTTP client for the Mzizi API — the MCP's only data source.
+ *
+ * The architecture: the Next.js app at mzizi.dev builds the registry from files at
+ * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
+ * NOT talk to Supabase, and it does not hold a database credential, because component
+ * documents and doctrine are files in `nyuchi/mzizi` — not rows.
+ *
+ * What that buys, beyond matching the architecture:
+ *
+ *   - One source of truth. The API and the MCP answer from the same build, so an agent
+ *     over MCP and a consumer over HTTP cannot get different answers.
+ *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
+ *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
+ *   - The tool surface stops being data. It was built at startup from a table, which
+ *     meant a row edit silently changed what the server exposed with no review. The
+ *     tools are now code (see `tools.ts`), so a change to them is a diff.
+ *
+ * Failure policy: every method returns a discriminated result rather than throwing, so
+ * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
+ * that throws an opaque fetch error teaches the agent nothing.
+ */
+export declare const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
+export type ApiOk<T> = {
+    ok: true;
+    data: T;
+};
+export type ApiErr = {
+    ok: false;
+    /** Machine-readable reason, for a tool to branch on. */
+    reason: "not_found" | "timeout" | "network" | "bad_status" | "bad_body";
+    /** A sentence for the caller. Not a status code. */
+    message: string;
+    status?: number;
+};
+export type ApiResult<T> = ApiOk<T> | ApiErr;
+export type MziziApiOptions = {
+    /** Base URL, no trailing slash. Defaults to the public API. */
+    baseUrl?: string;
+    timeoutMs?: number;
+    /** Injectable for tests and for a Worker's bound fetch. */
+    fetchImpl?: typeof fetch;
+};
+export declare class MziziApiClient {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(opts?: MziziApiOptions);
+    /**
+     * GET a JSON path under the API base.
+     *
+     * `path` is appended verbatim, so every caller must encode its own segments —
+     * a component name arriving from an agent is untrusted input, and an unencoded
+     * `../` would climb out of /api/v1.
+     */
+    get<T>(path: string, query?: Record<string, string | number | undefined>): Promise<ApiResult<T>>;
+    /** Registry index. */
+    listComponents(): Promise<ApiResult<unknown>>;
+    /** One component, shadcn-shaped, with metadata and files. */
+    getComponent(name: string): Promise<ApiResult<unknown>>;
+    /** Per-component docs: use cases, variants, a11y. */
+    getComponentDocs(name: string): Promise<ApiResult<unknown>>;
+    /** Per-component version history. */
+    getComponentVersions(name: string): Promise<ApiResult<unknown>>;
+    /** Cross-resource search — components, docs, changelog. */
+    search(query: string): Promise<ApiResult<unknown>>;
+    /** The DNA double helix: nodes, rungs, strands, live counts. */
+    getArchitecture(): Promise<ApiResult<unknown>>;
+    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
+    getNode(n: number): Promise<ApiResult<unknown>>;
+    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
+    getBrand(): Promise<ApiResult<unknown>>;
+    getUbuntuPillars(): Promise<ApiResult<unknown>>;
+    getUbuntuPrinciples(): Promise<ApiResult<unknown>>;
+    listAiInstructions(): Promise<ApiResult<unknown>>;
+    getAiInstructions(name: string): Promise<ApiResult<unknown>>;
+    listSkills(): Promise<ApiResult<unknown>>;
+    getSkill(name: string): Promise<ApiResult<unknown>>;
+    listChangelog(): Promise<ApiResult<unknown>>;
+    getRelease(version: string): Promise<ApiResult<unknown>>;
+    /** Live counts + usage metrics. Derived upstream, never a stored number. */
+    getStats(): Promise<ApiResult<unknown>>;
+    /** Service health. */
+    getHealth(): Promise<ApiResult<unknown>>;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAA;AAK1D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAA;AAC5C,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,KAAK,CAAA;IACT,wDAAwD;IACxD,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IACvE,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,IAAI,GAAE,eAAoB;IAmBtC;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAyEtG,sBAAsB;IACtB,cAAc;IAId,6DAA6D;IAC7D,YAAY,CAAC,IAAI,EAAE,MAAM;IAIzB,qDAAqD;IACrD,gBAAgB,CAAC,IAAI,EAAE,MAAM;IAI7B,qCAAqC;IACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM;IAIjC,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,gEAAgE;IAChE,eAAe;IAIf,8EAA8E;IAC9E,OAAO,CAAC,CAAC,EAAE,MAAM;IAIjB,wEAAwE;IACxE,QAAQ;IAIR,gBAAgB;IAIhB,mBAAmB;IAInB,kBAAkB;IAIlB,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,UAAU;IAIV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAIrB,aAAa;IAIb,UAAU,CAAC,OAAO,EAAE,MAAM;IAI1B,4EAA4E;IAC5E,QAAQ;IAIR,sBAAsB;IACtB,SAAS;CAGV"}

package/dist/api-client.js

@@ -0,0 +1,192 @@
+/**
+ * HTTP client for the Mzizi API — the MCP's only data source.
+ *
+ * The architecture: the Next.js app at mzizi.dev builds the registry from files at
+ * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
+ * NOT talk to Supabase, and it does not hold a database credential, because component
+ * documents and doctrine are files in `nyuchi/mzizi` — not rows.
+ *
+ * What that buys, beyond matching the architecture:
+ *
+ *   - One source of truth. The API and the MCP answer from the same build, so an agent
+ *     over MCP and a consumer over HTTP cannot get different answers.
+ *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
+ *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
+ *   - The tool surface stops being data. It was built at startup from a table, which
+ *     meant a row edit silently changed what the server exposed with no review. The
+ *     tools are now code (see `tools.ts`), so a change to them is a diff.
+ *
+ * Failure policy: every method returns a discriminated result rather than throwing, so
+ * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
+ * that throws an opaque fetch error teaches the agent nothing.
+ */
+export const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
+/** How long any single upstream call may take before it is abandoned. */
+const DEFAULT_TIMEOUT_MS = 10_000;
+export class MziziApiClient {
+    baseUrl;
+    timeoutMs;
+    fetchImpl;
+    constructor(opts = {}) {
+        this.baseUrl = (opts.baseUrl ?? DEFAULT_API_BASE).replace(/\/+$/, "");
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        // `.bind(globalThis)` is load-bearing, not defensive style.
+        //
+        // Storing the global on an instance and calling it as `this.fetchImpl(...)`
+        // invokes it as a METHOD, so its receiver is the MziziApiClient rather than
+        // the global scope. Workers' `fetch` is a native binding that validates its
+        // receiver and throws:
+        //
+        //   Illegal invocation: function called with incorrect `this` reference
+        //
+        // Node's global fetch tolerates the same call, which is exactly why this
+        // shipped: the offline suite passed on Node while every network-backed tool
+        // on the deployed Worker was dead. An injected `fetchImpl` is a plain
+        // closure and needs no binding, so the tests never touched the broken path.
+        this.fetchImpl = opts.fetchImpl ?? fetch.bind(globalThis);
+    }
+    /**
+     * GET a JSON path under the API base.
+     *
+     * `path` is appended verbatim, so every caller must encode its own segments —
+     * a component name arriving from an agent is untrusted input, and an unencoded
+     * `../` would climb out of /api/v1.
+     */
+    async get(path, query) {
+        let url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+        if (query) {
+            const qs = new URLSearchParams();
+            for (const [k, v] of Object.entries(query)) {
+                if (v !== undefined && v !== "")
+                    qs.set(k, String(v));
+            }
+            const s = qs.toString();
+            if (s)
+                url += `?${s}`;
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await this.fetchImpl(url, {
+                signal: controller.signal,
+                headers: { accept: "application/json" },
+            });
+            if (res.status === 404) {
+                return {
+                    ok: false,
+                    reason: "not_found",
+                    status: 404,
+                    message: `The Mzizi API has no record at ${path}. Check the name — list_components returns the valid set.`,
+                };
+            }
+            if (!res.ok) {
+                // 503 is the API's documented "database not configured" signal. It is worth
+                // distinguishing in words, because it means the deployment is misconfigured
+                // rather than that the caller asked for something wrong.
+                const hint = res.status === 503
+                    ? " The API reports it is not fully configured; this is a deployment problem, not a bad request."
+                    : "";
+                return {
+                    ok: false,
+                    reason: "bad_status",
+                    status: res.status,
+                    message: `The Mzizi API answered ${res.status} for ${path}.${hint}`,
+                };
+            }
+            try {
+                return { ok: true, data: (await res.json()) };
+            }
+            catch {
+                return {
+                    ok: false,
+                    reason: "bad_body",
+                    status: res.status,
+                    message: `The Mzizi API returned a non-JSON body for ${path}. The endpoint may be behind a redirect or an auth gate.`,
+                };
+            }
+        }
+        catch (err) {
+            if (err?.name === "AbortError") {
+                return {
+                    ok: false,
+                    reason: "timeout",
+                    message: `The Mzizi API did not respond within ${this.timeoutMs}ms for ${path}.`,
+                };
+            }
+            return {
+                ok: false,
+                reason: "network",
+                message: `Could not reach the Mzizi API at ${this.baseUrl}: ${err?.message ?? "unknown error"}.`,
+            };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    // ── The endpoints the 10 tools are built from ──────────────────────
+    /** Registry index. */
+    listComponents() {
+        return this.get("/ui");
+    }
+    /** One component, shadcn-shaped, with metadata and files. */
+    getComponent(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}`);
+    }
+    /** Per-component docs: use cases, variants, a11y. */
+    getComponentDocs(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}/docs`);
+    }
+    /** Per-component version history. */
+    getComponentVersions(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}/versions`);
+    }
+    /** Cross-resource search — components, docs, changelog. */
+    search(query) {
+        return this.get("/search", { q: query });
+    }
+    /** The DNA double helix: nodes, rungs, strands, live counts. */
+    getArchitecture() {
+        return this.get("/architecture");
+    }
+    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
+    getNode(n) {
+        return this.get(`/architecture/nodes/${encodeURIComponent(String(n))}`);
+    }
+    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
+    getBrand() {
+        return this.get("/brand");
+    }
+    getUbuntuPillars() {
+        return this.get("/ubuntu/pillars");
+    }
+    getUbuntuPrinciples() {
+        return this.get("/ubuntu/principles");
+    }
+    listAiInstructions() {
+        return this.get("/ai/instructions");
+    }
+    getAiInstructions(name) {
+        return this.get(`/ai/instructions/${encodeURIComponent(name)}`);
+    }
+    listSkills() {
+        return this.get("/skills");
+    }
+    getSkill(name) {
+        return this.get(`/skills/${encodeURIComponent(name)}`);
+    }
+    listChangelog() {
+        return this.get("/changelog");
+    }
+    getRelease(version) {
+        return this.get(`/changelog/${encodeURIComponent(version)}`);
+    }
+    /** Live counts + usage metrics. Derived upstream, never a stored number. */
+    getStats() {
+        return this.get("/stats");
+    }
+    /** Service health. */
+    getHealth() {
+        return this.get("/health");
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAE1D,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAqBjC,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,SAAS,CAAc;IAExC,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,4DAA4D;QAC5D,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,uBAAuB;QACvB,EAAE;QACF,wEAAwE;QACxE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAmD;QAC5E,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;YAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;YACvB,IAAI,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAA;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,kCAAkC,IAAI,2DAA2D;iBAC3G,CAAA;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;oBAChB,CAAC,CAAC,+FAA+F;oBACjG,CAAC,CAAC,EAAE,CAAA;gBACR,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE;iBACpE,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,8CAA8C,IAAI,0DAA0D;iBACtH,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,UAAU,IAAI,GAAG;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,oCAAoC,IAAI,CAAC,OAAO,KAAM,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG;aAC5G,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,sEAAsE;IAEtE,sBAAsB;IACtB,cAAc;QACZ,OAAO,IAAI,CAAC,GAAG,CAAU,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,6DAA6D;IAC7D,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,qDAAqD;IACrD,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClE,CAAC;IAED,qCAAqC;IACrC,oBAAoB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACtE,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,gEAAgE;IAChE,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAU,eAAe,CAAC,CAAA;IAC3C,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,CAAS;QACf,OAAO,IAAI,CAAC,GAAG,CAAU,uBAAuB,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAU,iBAAiB,CAAC,CAAA;IAC7C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,CAAC,CAAA;IAChD,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAU,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,GAAG,CAAU,WAAW,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAU,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAU,cAAc,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,sBAAsB;IACtB,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;CACF"}

package/dist/auth/authkit-handler.d.ts

@@ -5,7 +5,7 @@
  * configured as a PUBLIC client: it has a client id only and NO secret, so the
  * worker holds no WorkOS API key. The flow is standard OAuth 2.0
  * authorization-code with **PKCE** against the AuthKit domain
- * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://identity.nyuchi.com):
+ * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
  *
  *   /authorize  → MCP-client consent, then 302 to <authkit>/oauth2/authorize
  *                 with a PKCE code_challenge

package/dist/auth/authkit-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAcrC,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,GAAG,GAAG;QAAE,cAAc,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,CAAC;AA+RpE,eAAO,MAAM,cAAc,sDAAM,CAAC"}
+{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,GAAG,GAAG;QAAE,cAAc,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,CAAC;AAmSpE,eAAO,MAAM,cAAc,sDAAM,CAAC"}

package/dist/auth/authkit-handler.js

@@ -5,7 +5,7 @@
  * configured as a PUBLIC client: it has a client id only and NO secret, so the
  * worker holds no WorkOS API key. The flow is standard OAuth 2.0
  * authorization-code with **PKCE** against the AuthKit domain
- * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://identity.nyuchi.com):
+ * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
  *
  *   /authorize  → MCP-client consent, then 302 to <authkit>/oauth2/authorize
  *                 with a PKCE code_challenge
@@ -23,6 +23,7 @@
  */
 import { Hono } from "hono";
 import * as jose from "jose";
+import { authkitDomain } from "../identity.js";
 import { addApprovedClient, bindStateToSession, createOAuthState, generateCSRFProtection, isClientApproved, OAuthError, renderApprovalDialog, validateCSRFToken, validateOAuthState, } from "./oauth-utils.js";
 const SERVER_NAME = "Mzizi Design System Registry";
 const SERVER_DESCRIPTION = "Free, public MCP over the Mzizi design-system registry — components, design tokens, brand, and the ecosystem architecture nodes. Sign in or create a free account to connect.";
@@ -51,8 +52,12 @@ async function deriveCodeChallenge(verifier) {
     return base64url(digest);
 }
 function authkitOrigin(c) {
-    // Accept a bare host or a full origin in the var; normalise to an https origin.
-    const raw = c.env.WORKOS_AUTHKIT_DOMAIN.trim().replace(/\/+$/, "");
+    // Accept a bare host or a full origin, and tolerate the secret being unset —
+    // `authkitDomain` falls back to a live issuer rather than throwing on
+    // `undefined.trim()`. The bare-host case is real: at least one Worker on this
+    // account stores the hostname with no scheme, so a find-and-replace that
+    // assumes one produces `https://https://…`.
+    const raw = authkitDomain(c.env);
     return /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
 }
 function callbackUrl(c) {

package/dist/auth/authkit-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,kBAAkB,GACtB,+KAA+K,CAAC;AAClL,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;AAEhC,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB;IACxC,gFAAgF;IAChF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB;IACtC,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CACJ,2IAA2I,WAAW,0UAA0U,WAAW,WAAW,kBAAkB,sTAAsT,EAC9zB,GAAG,EACH,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CACF,CAAC;AACF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EACxE,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAEjE,OAAO,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9D,SAAS;QACT,KAAK,EAAE,EAAE,YAAY,EAAE;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAClD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CAAC,QAAQ,EAC3B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAC3C,KAAK,CAAC,YAAY,EAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAEnD,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,EAAE,YAAY,EAAE;QACjE,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAUD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,YAAyB,CAAC;IAC9B,IAAI,kBAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACnC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,WAAW;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAC1C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACjC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CACF,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,aAAa,CAAC,MAAM,EACpB,MAAM,aAAa,CAAC,IAAI,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAMH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAClC,IAAI,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;QACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAU;QACnB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW;KACZ,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACtE,OAAO,EAAE,YAAY;QACrB,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,WAAW;QAClB,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,IAAI,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}
+{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,kBAAkB,GACtB,+KAA+K,CAAC;AAClL,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;AAEhC,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB;IACxC,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB;IACtC,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CACJ,2IAA2I,WAAW,0UAA0U,WAAW,WAAW,kBAAkB,sTAAsT,EAC9zB,GAAG,EACH,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CACF,CAAC;AACF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EACxE,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAEjE,OAAO,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9D,SAAS;QACT,KAAK,EAAE,EAAE,YAAY,EAAE;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAClD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CAAC,QAAQ,EAC3B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAC3C,KAAK,CAAC,YAAY,EAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAEnD,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,EAAE,YAAY,EAAE;QACjE,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAUD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,YAAyB,CAAC;IAC9B,IAAI,kBAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACnC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,WAAW;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAC1C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACjC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CACF,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,aAAa,CAAC,MAAM,EACpB,MAAM,aAAa,CAAC,IAAI,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAMH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAClC,IAAI,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;QACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAU;QACnB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW;KACZ,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACtE,OAAO,EAAE,YAAY;QACrB,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,WAAW;QAClB,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,IAAI,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}

package/dist/env.d.ts

@@ -15,7 +15,7 @@ export interface Env {
     SUPABASE_PUBLISHABLE_KEY: string;
     SUPABASE_SECRET_KEY?: string;
     WORKOS_CLIENT_ID: string;
-    WORKOS_AUTHKIT_DOMAIN: string;
+    WORKOS_AUTHKIT_DOMAIN?: string;
     WORKOS_M2M_CLIENT_ID?: string;
     WORKOS_M2M_CLIENT_SECRET?: string;
     FUNDI_URL?: string;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAM5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAO7B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAK5B,gBAAgB,EAAE,MAAM,CAAA;IAWxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}

package/dist/fundi-client.d.ts

@@ -18,7 +18,19 @@ export interface FundiToolContext {
     /** The signed-in user's WorkOS access token (from ctx.props). */
     userAccessToken: string;
 }
-/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
+/**
+ * True when either path to fundi is wired: the Service Binding or HTTP + M2M.
+ *
+ * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
+ * secret with a live default, so it always resolves — and gating on it would
+ * reintroduce the exact failure this Worker already shipped once: a capability
+ * conditioned on a credential that turned out not to be set does not error, it
+ * DISAPPEARS. All four fundi tools were absent from the deployed public surface
+ * for weeks because `fundiConfigured` answered false and nothing said so.
+ *
+ * The values that remain are the ones with no usable default: without the M2M
+ * client id, secret and fundi URL there is genuinely no HTTP path to fundi.
+ */
 export declare function fundiConfigured(env: Env): boolean;
 /**
  * Build the transport to fundi.

package/dist/fundi-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AA+BnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AASD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAuBvD"}
+{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAgCnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAuBvD"}

package/dist/fundi-client.js

@@ -9,12 +9,13 @@
  * CLI never holds the secret — it reaches fundi *through* this Worker.
  */
 import { decodeJwt } from "jose";
+import { authkitDomain } from "./identity.js";
 let cached = null;
 async function mintM2MToken(env) {
     const now = Math.floor(Date.now() / 1000);
     if (cached && cached.exp > now + 60)
         return cached.jwt;
-    const res = await fetch(new URL("/oauth2/token", env.WORKOS_AUTHKIT_DOMAIN), {
+    const res = await fetch(new URL("/oauth2/token", authkitDomain(env)), {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
@@ -45,14 +46,23 @@ async function mintM2MToken(env) {
  * resolved, because the binding routes by service, not by DNS.
  */
 const BINDING_ORIGIN = "https://fundi.internal";
-/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
+/**
+ * True when either path to fundi is wired: the Service Binding or HTTP + M2M.
+ *
+ * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
+ * secret with a live default, so it always resolves — and gating on it would
+ * reintroduce the exact failure this Worker already shipped once: a capability
+ * conditioned on a credential that turned out not to be set does not error, it
+ * DISAPPEARS. All four fundi tools were absent from the deployed public surface
+ * for weeks because `fundiConfigured` answered false and nothing said so.
+ *
+ * The values that remain are the ones with no usable default: without the M2M
+ * client id, secret and fundi URL there is genuinely no HTTP path to fundi.
+ */
 export function fundiConfigured(env) {
     if (env.FUNDI_SERVICE)
         return true;
-    return Boolean(env.WORKOS_M2M_CLIENT_ID &&
-        env.WORKOS_M2M_CLIENT_SECRET &&
-        env.FUNDI_URL &&
-        env.WORKOS_AUTHKIT_DOMAIN);
+    return Boolean(env.WORKOS_M2M_CLIENT_ID && env.WORKOS_M2M_CLIENT_SECRET && env.FUNDI_URL);
 }
 /**
  * Build the transport to fundi.

package/dist/fundi-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAE/C,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,OAAO,CACZ,GAAG,CAAC,oBAAoB;QACtB,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,qBAAqB,CAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAA;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;gBAClD,kEAAkE;gBAClE,uEAAuE;gBACvE,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAA;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;gBAClD,kEAAkE;gBAClE,uEAAuE;gBACvE,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/http.js

@@ -63,7 +63,7 @@ export function createMziziHttpHandler(options = {}) {
             sessionIdGenerator: undefined,
             enableJsonResponse: true,
         });
-        const server = await createMziziMcpServer(ctx.supabase, { fundi: options.fundi });
+        const server = await createMziziMcpServer({ fundi: options.fundi });
         await server.connect(transport);
         const response = await transport.handleRequest(request);
         return withCors(response);

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AACxH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,4DAA4D;CAC7F,CAAA;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAuB,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAE1F,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzE,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,QAAQ,CACb,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,mCAAmC,EAAE,EAChE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CACjC,CACF,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACjF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AACxH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,4DAA4D;CAC7F,CAAA;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAuB,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAE1F,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzE,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,QAAQ,CACb,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,mCAAmC,EAAE,EAChE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CACjC,CACF,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,29 @@
+import type { Env } from "./env.js";
+/**
+ * The tenant used when `WORKOS_AUTHKIT_DOMAIN` is unset.
+ *
+ * `accounts.mukoko.com`, NOT the `identity.nyuchi.com` that was configured until
+ * 10 Aug 2026. That host no longer resolves at all — attaching a new WorkOS
+ * custom domain detaches the old one with no overlap window, so it began
+ * returning Cloudflare 1014 the moment the new one landed.
+ *
+ * A default is what a Worker gets when configuration is missing, so it has to
+ * name something that works. Defaulting to the retired host would mean a Worker
+ * deployed before its secret is set fails every login while looking correctly
+ * configured.
+ *
+ * `accounts` is PLURAL. `account.mukoko.com` is the Mukoko Account app;
+ * `accounts.mukoko.com` is the issuer that mints its tokens.
+ */
+export declare const DEFAULT_AUTHKIT_DOMAIN = "https://accounts.mukoko.com";
+/**
+ * Resolve the identity tenant for this Worker.
+ *
+ * The trailing slash is trimmed: callers compose paths onto this, and while
+ * `new URL()` tolerates a slash, an `iss` claim comparison is an exact string
+ * match — `https://x/` never equals the `https://x` WorkOS issues. That would
+ * present as "every token is invalid", which is a long way from "someone left a
+ * trailing slash".
+ */
+export declare function authkitDomain(env: Pick<Env, "WORKOS_AUTHKIT_DOMAIN">): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAA;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,GAAG,MAAM,CAI7E"}