(janitor/dedupe): consolidate Cloudflare Access JWT validation onto worker-utils

[kilo-code-bot]

Summary

wasteland and gastown each carried a byte-identical copy of the Cloudflare Access JWT validation middleware (~230 lines each): the same validateCfAccessRequest entry point, the hand-rolled RS256 verification against the /cdn-cgi/access/certs JWKS endpoint, and the full set of Access* zod schemas.

A fix to issuer/audience/expiry handling, or a Cloudflare Access schema change, would have to be applied to both copies by hand — classic drift risk in security-critical code.

Change

Both services already depend on @kilocode/worker-utils and run in the Cloudflare Workers runtime, so the dependency direction is clean:

• packages/worker-utils/cf-access — new single owner for the validation core (validateCfAccessRequest plus the Access* schemas and helpers).
• wasteland / gastown — delete the duplicated middleware files and import validateCfAccessRequest from @kilocode/worker-utils/cf-access.

The dead withCloudflareAccess Hono adapter in each copy was dropped; the only actual call sites used validateCfAccessRequest directly. The Workers-only cf edge-cache option on the certs fetch is typed locally to avoid pulling @cloudflare/workers-types into worker-utils.

Verification

• pnpm --filter @kilocode/worker-utils run typecheck — pass
• pnpm --filter cloudflare-wasteland run typecheck — pass
• pnpm --filter cloudflare-gastown run typecheck — pass
• pnpm --filter @kilocode/worker-utils run lint — pass
• pnpm --filter cloudflare-wasteland run lint / cloudflare-gastown — pass
• pnpm --filter @kilocode/worker-utils run test — 357 passed
• oxfmt --check — pass

No behavior change: the two copies were byte-identical.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• packages/worker-utils/package.json
• packages/worker-utils/src/cf-access.ts
• services/gastown/src/gastown.worker.ts
• services/wasteland/src/middleware/cf-access.middleware.ts
• services/wasteland/src/wasteland.worker.ts

---

_{Reviewed by grok-4.6 · Input: 82.3K · Output: 8.2K · Cached: 285.1K}

_{Review guidance: REVIEW.md from base branch main}