- Wrap the Worker with @cloudflare/workers-oauth-provider: /oauth/token,
/oauth/register (dynamic client registration), and /.well-known/* are
implemented by the library; tokens/grants/clients live in OAUTH_KV.
- New consent page at /oauth/authorize reuses the session cookie;
unauthenticated visitors bounce through the SPA login via returnTo.
- Grant props store only userId; oauthPropsAuth re-fetches the user from
D1 on every MCP request, so deleting a user revokes access instantly.
Permissions still flow exclusively through visibleMails().
- OAuth is optional: without the OAUTH_KV binding the provider is skipped
entirely and /mcp keeps working with aik_ API keys only. With it, both
credentials coexist (Bearer aik_ requests pre-route around the provider).
- Docs and wrangler examples updated; KV block commented out by default.
- Replace server-rendered HTML with React 18 + Vite + shadcn/ui dashboard
(mail list, detail panel, Extracted/Raw/Rendered tabs, sonner toasts)
- Add REST API endpoints: GET /api/mails, GET /api/mails/:id
- Fix MIME base64 body extraction (rewrite extractMailBodies with proper
multipart boundary parsing and atob decoding)
- Add isPromotionalEmail() pre-LLM filter (List-Unsubscribe, List-ID,
Precedence: bulk, ESP X-headers) to avoid wasting AI tokens on ads
- Fix codeAndLink() to use regex URL extraction instead of comma-split,
preventing layout break on URLs containing commas
- Add ASSETS binding to wrangler.toml.example for static frontend serving
- Migrate from npm to pnpm; add pnpm-workspace.yaml
- Add CLAUDE.md and update AGENTS.md with current architecture
TooonyChen