fix(workers): point WORKOS_ISSUER at accounts.mukoko.com (identity.nyuchi.com has no DNS)

[bryanfawcett]

The bug

Two deployed worker configs pointed their WorkOS OAuth issuer at a hostname that does not exist:

• site/wrangler.toml → WORKOS_ISSUER = "https://identity.nyuchi.com"
• nyuchi-docs-mcp-worker/wrangler.toml → same

Reproduction:

$ getent hosts identity.nyuchi.com          → (no output, exit 2 — NO DNS RECORD)
$ curl -o /dev/null -w '%{http_code}' https://identity.nyuchi.com/.well-known/openid-configuration
000
$ curl -s https://accounts.mukoko.com/.well-known/openid-configuration
{"issuer":"https://accounts.mukoko.com","authorization_endpoint":"https://accounts.mukoko.com/oauth2/authorize", ...}
$ curl -o /dev/null -w '%{http_code}' https://accounts.mukoko.com/oauth2/jwks
200
$ curl -o /dev/null -w '%{http_code}' https://auth.mukoko.com/.well-known/openid-configuration
404      # the auth API is NOT an issuer

Impact today: site/src/worker/gate.ts builds ${WORKOS_ISSUER}/oauth2/authorize, /oauth2/token and /oauth2/jwks from this var, so every page whose frontmatter says visibility: internal was gated behind a login against a host with no DNS — internal docs pages could not be signed into at all. The docs MCP worker's bearer-token verification (src/auth.ts) was broken the same way.

The AuthKit domain moved to accounts.mukoko.com in the Aug 2026 migration. Verified via the WorkOS admin API that there is exactly one WorkOS project (Mukoko Account), whose Production environment is the one accounts.mukoko.com serves — and site/wrangler.toml's client_01KVTX0V2K1VM3PSC0DJ9VZWTV is a live Connect app in it. Same environment, same app, working issuer.

Changes

File	What
site/wrangler.toml	Value → accounts.mukoko.com, plus a "what this host is / is NOT / do not restore" comment
nyuchi-docs-mcp-worker/wrangler.toml	Same
site/src/content/docs/identity/overview.mdx	Presented the dead host as the identity host — corrected, and now carries the four-host table (AuthKit issuer vs WorkOS auth API vs the two gateways) with a danger callout on the dead-end failure mode
site/src/content/docs/index.mdx	Identity card description
site/src/content/docs/deployment/agentgateway.mdx	WORKOS_ISSUER secret table row
README.md	identity/ section blurb

No variable was renamed — only values and prose.

shamwari-docs-ai/tests/worker.test.ts deliberately untouched. Its three mentions are fixture strings standing in for AI-returned prose, asserted verbatim to prove SSE pass-through. Editing them would be pure grep-satisfaction and would risk breaking a passing test.

Gates

All from the repo root, all passing:

• pnpm install — lockfile up to date
• pnpm build — 58 pages built, complete
• pnpm -r --if-present run test — 5 + 9 + 9 + 12 = 35 tests passed, 0 failed
• pnpm skills:validate — ✓ skills valid
• npx wrangler deploy --dry-run in both touched packages — configs parse, both now show env.WORKOS_ISSUER ("https://accounts.mukoko.com"). Not deployed.

Not touched (flagged for a follow-up)

• site/src/content/docs/deployment/agentgateway.mdx says the Connect app was created in the "Nyuchi Identity" WorkOS project. No such project exists — the admin API reports only Mukoko Account. Stale prose, but renaming a project reference is a separate factual claim; left for owner confirmation.
• site/src/content/docs/api/overview.mdx + api/security.mdx list api.mukoko.com as a "Legacy host" / "Legacy production host" for the gateway. It has no DNS record and per the ecosystem docs is a separate gateway still being built, not a legacy alias of api.nyuchi.com. Out of scope here, but it is wrong in the same family of way.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nyuchi-docs-mcp	d06153c	Commit Preview URL Branch Preview URL	Aug 12 2026, 11:17 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	shamwari-docs-ai	d06153c	Commit Preview URL Branch Preview URL	Aug 12 2026, 11:17 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nyuchi-docs	d06153c	Commit Preview URL Branch Preview URL	Aug 12 2026, 11:18 AM