(janitor/dedupe): consolidate Kilo user JWT auth middleware onto worker-utils

[kilo-code-bot]

Summary

Consolidate the near-identical Kilo user JWT auth middleware that wasteland and gastown each carried into a single owner in @kilocode/worker-utils.

What changed

• packages/worker-utils/kilo-auth-middleware — new createKiloAuthMiddleware factory owning the shared core: bearer-token extraction, NEXTAUTH_SECRET resolution, verifyKiloToken, Hono context population (kiloUserId, kiloIsAdmin, kiloApiTokenPepper, kiloGastownAccess, kiloOrgMemberships), and 401/500 error handling.
  • resolveSecret stays service-local (injected), avoiding churn across the ~25 existing import sites in each service.
  • Optional onAuthenticated hook preserves each service's structured-logger user tagging.
• services/wasteland / services/gastown — delete the duplicated middleware/kilo-auth.middleware.ts and build the middleware from the shared factory with their own Env + logger.
• The gastown middleware test moves to worker-utils alongside the new owner and now also asserts kiloGastownAccess propagation.

Why

The two copies were byte-equivalent apart from gastown's extra kiloGastownAccess set (an optional claim on KiloTokenPayload) and each service's Env type. A change to JWT claim handling or the error contract would have to be applied to both copies by hand. Both services already depend on @kilocode/worker-utils, so the dependency direction is clean.

Behavior

No behavior change. The shared core is the union of the two copies; wasteland gains an unused kiloGastownAccess context variable (its AuthVariables now includes it).

Verification

• pnpm --filter @kilocode/worker-utils exec tsgo --noEmit — pass
• pnpm --filter cloudflare-wasteland exec tsgo --noEmit — pass
• pnpm --filter cloudflare-gastown exec tsgo --noEmit — pass
• pnpm --filter @kilocode/worker-utils exec vitest run — 360 passed
• oxlint + oxfmt --check on changed files — clean

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Shared createKiloAuthMiddleware preserves the prior wasteland/gastown JWT auth behavior, with types, context variables, and call sites aligned.

Files Reviewed (9 files)

• packages/worker-utils/package.json
• packages/worker-utils/src/index.ts
• packages/worker-utils/src/kilo-auth-middleware.test.ts
• packages/worker-utils/src/kilo-auth-middleware.ts
• services/gastown/src/gastown.worker.ts
• services/gastown/src/middleware/kilo-auth.middleware.ts
• services/wasteland/src/middleware/auth.middleware.ts
• services/wasteland/src/middleware/kilo-auth.middleware.ts
• services/wasteland/src/wasteland.worker.ts

---

_{Reviewed by grok-4.6 · Input: 168.1K · Output: 12.7K · Cached: 291.6K}

_{Review guidance: REVIEW.md from base branch main}