@lunora/cloudflare-access 0.0.1 → 1.0.0-alpha.2

package/dist/admin.d.mts

@@ -0,0 +1,36 @@
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.mjs";
+import 'jose';
+/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
+interface AccessAdminGateOptions extends RequestVerifyOptions {
+  /**
+  * Decide whether the **verified** claims authorize the Studio/admin plane —
+  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+  * check. Required: there is no implicit grant, so a verified-but-unprivileged
+  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+  */
+  isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
+}
+/**
+* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+* endpoints) in addition to — or instead of — the static admin bearer, so the
+* Studio can sit behind Cloudflare Access.
+*
+* It is **fail-closed**: a missing token, a token that fails verification, or an
+* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+* only other path). Verification needs no `env` binding (static team-domain/aud
+* config + the remote JWKS over `fetch`), so the gate takes only the request and
+* the runtime can evaluate it without threading async through every admin route.
+*
+* ```ts
+* options.adminGate = accessAdminGate({
+*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+*     aud: env.CF_ACCESS_ADMIN_AUD,
+*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+* });
+* ```
+*/
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.d.ts

@@ -0,0 +1,36 @@
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.js";
+import 'jose';
+/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
+interface AccessAdminGateOptions extends RequestVerifyOptions {
+  /**
+  * Decide whether the **verified** claims authorize the Studio/admin plane —
+  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+  * check. Required: there is no implicit grant, so a verified-but-unprivileged
+  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+  */
+  isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
+}
+/**
+* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+* endpoints) in addition to — or instead of — the static admin bearer, so the
+* Studio can sit behind Cloudflare Access.
+*
+* It is **fail-closed**: a missing token, a token that fails verification, or an
+* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+* only other path). Verification needs no `env` binding (static team-domain/aud
+* config + the remote JWKS over `fetch`), so the gate takes only the request and
+* the runtime can evaluate it without threading async through every admin route.
+*
+* ```ts
+* options.adminGate = accessAdminGate({
+*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+*     aud: env.CF_ACCESS_ADMIN_AUD,
+*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+* });
+* ```
+*/
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.mjs

@@ -0,0 +1,8 @@
+import { verifyRequest } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+
+const accessAdminGate = (options) => async (request) => {
+  const claims = await verifyRequest(request, options);
+  return claims === void 0 ? false : options.isAdmin(claims);
+};
+
+export { accessAdminGate };

package/dist/context.d.mts

@@ -0,0 +1,79 @@
+import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import 'jose';
+/**
+* The slice of context {@link accessContext} reads: the `auth` facade every
+* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+* output, which carries the full claim set under `access` plus the promoted
+* `email` / `groups` / `commonName` fields.
+*/
+interface AccessContextInput {
+  auth?: {
+    getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
+    userId?: string | null;
+  };
+}
+/**
+* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+* synchronous, Access-shaped read over the already-resolved identity — so a
+* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+*/
+interface AccessFacade {
+  /** True when a verified Access identity is present on the request. */
+  readonly authenticated: boolean;
+  /** The full verified claim set, or `undefined` when anonymous. */
+  readonly claims: AccessClaims | undefined;
+  /** Service-token name (`common_name`), for machine callers; `undefined` otherwise. */
+  readonly commonName: string | undefined;
+  /** Verified SSO email; `undefined` for service tokens or anonymous requests. */
+  readonly email: string | undefined;
+  /** IdP group memberships — empty when none are emitted or the request is anonymous. */
+  readonly groups: ReadonlyArray<string>;
+  /** True when the verified groups include `group`. Always `false` when anonymous. */
+  hasGroup: (group: string) => boolean;
+  /** The stable caller id (`ctx.auth.userId`), or `undefined` when anonymous. */
+  readonly userId: string | undefined;
+}
+/** The context shape {@link accessContext} produces — the input widened with `access`. */
+interface AccessContextOutput extends AccessContextInput {
+  access: AccessFacade;
+}
+/**
+* Build the `ctx.access` facade from a (possibly absent) resolved identity
+* envelope. Returns the anonymous facade when no identity is present, so callers
+* never null-check. Shared by {@link accessContext} and the codegen-wired global
+* `ctx.access` (which calls this synchronously from the resolved identity locals
+* at ctx-build time, so a global `ctx.access` adds only this object construction
+* per request — no extra I/O or re-verification).
+*/
+declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
+/**
+* Middleware that attaches a typed `ctx.access` facade derived from the verified
+* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+* handler reads the verified identity ergonomically and with full typing instead
+* of casting off the generic `getIdentity()` envelope.
+*
+* When no identity is resolved (anonymous request) it attaches the anonymous
+* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+* so reads stay safe without a null check, and authorization decisions still
+* fail closed.
+*
+* It does not gate the request; pair it with `rls(...)` (or
+* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+* the identity for branching inside a handler.
+*
+* ```ts
+* export const whoAmI = query
+*   .use(accessContext())
+*   .query(async ({ ctx }) => ({
+*       email: ctx.access.email,
+*       isOps: ctx.access.hasGroup("ops"),
+*   }));
+* ```
+*/
+declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
+export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.d.ts

@@ -0,0 +1,79 @@
+import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import 'jose';
+/**
+* The slice of context {@link accessContext} reads: the `auth` facade every
+* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+* output, which carries the full claim set under `access` plus the promoted
+* `email` / `groups` / `commonName` fields.
+*/
+interface AccessContextInput {
+  auth?: {
+    getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
+    userId?: string | null;
+  };
+}
+/**
+* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+* synchronous, Access-shaped read over the already-resolved identity — so a
+* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+*/
+interface AccessFacade {
+  /** True when a verified Access identity is present on the request. */
+  readonly authenticated: boolean;
+  /** The full verified claim set, or `undefined` when anonymous. */
+  readonly claims: AccessClaims | undefined;
+  /** Service-token name (`common_name`), for machine callers; `undefined` otherwise. */
+  readonly commonName: string | undefined;
+  /** Verified SSO email; `undefined` for service tokens or anonymous requests. */
+  readonly email: string | undefined;
+  /** IdP group memberships — empty when none are emitted or the request is anonymous. */
+  readonly groups: ReadonlyArray<string>;
+  /** True when the verified groups include `group`. Always `false` when anonymous. */
+  hasGroup: (group: string) => boolean;
+  /** The stable caller id (`ctx.auth.userId`), or `undefined` when anonymous. */
+  readonly userId: string | undefined;
+}
+/** The context shape {@link accessContext} produces — the input widened with `access`. */
+interface AccessContextOutput extends AccessContextInput {
+  access: AccessFacade;
+}
+/**
+* Build the `ctx.access` facade from a (possibly absent) resolved identity
+* envelope. Returns the anonymous facade when no identity is present, so callers
+* never null-check. Shared by {@link accessContext} and the codegen-wired global
+* `ctx.access` (which calls this synchronously from the resolved identity locals
+* at ctx-build time, so a global `ctx.access` adds only this object construction
+* per request — no extra I/O or re-verification).
+*/
+declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
+/**
+* Middleware that attaches a typed `ctx.access` facade derived from the verified
+* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+* handler reads the verified identity ergonomically and with full typing instead
+* of casting off the generic `getIdentity()` envelope.
+*
+* When no identity is resolved (anonymous request) it attaches the anonymous
+* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+* so reads stay safe without a null check, and authorization decisions still
+* fail closed.
+*
+* It does not gate the request; pair it with `rls(...)` (or
+* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+* the identity for branching inside a handler.
+*
+* ```ts
+* export const whoAmI = query
+*   .use(accessContext())
+*   .query(async ({ ctx }) => ({
+*       email: ctx.access.email,
+*       isOps: ctx.access.hasGroup("ops"),
+*   }));
+* ```
+*/
+declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
+export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.mjs

@@ -0,0 +1,36 @@
+const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+const stringClaim = (value) => typeof value === "string" ? value : void 0;
+const ANONYMOUS_FACADE = {
+  authenticated: false,
+  claims: void 0,
+  commonName: void 0,
+  email: void 0,
+  groups: [],
+  hasGroup: () => false,
+  userId: void 0
+};
+const facadeFor = (identity, userId) => {
+  const raw = identity["access"];
+  if (typeof raw !== "object" || raw === null) {
+    return ANONYMOUS_FACADE;
+  }
+  const claims = raw;
+  const groups = stringList(identity["groups"] ?? claims.groups);
+  return {
+    authenticated: true,
+    claims,
+    commonName: stringClaim(identity["commonName"]) ?? stringClaim(claims.common_name),
+    email: stringClaim(identity["email"]) ?? stringClaim(claims.email),
+    groups,
+    hasGroup: (group) => groups.includes(group),
+    userId
+  };
+};
+const accessFacade = (identity, userId) => identity ? facadeFor(identity, userId ?? void 0) : ANONYMOUS_FACADE;
+const accessContext = () => async ({ ctx, next }) => {
+  const identity = await ctx.auth?.getIdentity?.();
+  const access = accessFacade(identity, ctx.auth?.userId);
+  return next({ ctx: { access } });
+};
+
+export { accessContext, accessFacade };

package/dist/index.d.mts

@@ -0,0 +1,71 @@
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.mjs";
+import 'jose';
+/**
+* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+* verified Access user/service-token becomes `ctx.auth` for every
+* query/mutation/action (and feeds RLS) with no further wiring.
+*
+* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+* fails verification, resolves to `null` (the request proceeds unauthenticated
+* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+* verification failures.
+*
+* Wire it in your worker entry:
+*
+* ```ts
+* options.resolveIdentity = createAccessResolver({
+*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+* });
+* ```
+*/
+declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+/**
+* Compose several `resolveIdentity` adapters into one: each is tried in order
+* and the first to return a non-null identity wins. The canonical use is
+* pairing Access with `@lunora/auth` —
+* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+* an Access JWT (machine/SSO) is authenticated by Access while everyone else
+* falls through to the app's own session.
+*/
+declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
+/**
+* Normalize a configured team domain to the canonical Access issuer URL.
+*
+* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+* full URL, and always returns an `https://` origin with no trailing slash. A
+* bare name with no dot is expanded to the `cloudflareaccess.com` host.
+*/
+declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Verify a Cloudflare Access JWT and return its claims.
+*
+* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+* the team issuer, `aud` containing one of the configured Access application AUD
+* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+* outright.
+*
+* Throws (a `jose` error) on any failure — callers that want fail-closed
+* anonymous behaviour should catch and treat it as "no identity" (the
+* `createAccessResolver` adapter does exactly this).
+* @param token The raw compact JWT (header value or cookie value).
+*/
+declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
+/**
+* Read the Access JWT off a request and verify it. Returns the verified claims,
+* or `undefined` when no token is present **or** verification fails — the single
+* fail-closed "no Access identity" signal that both `createAccessResolver` and
+* `accessAdminGate` build their distinct mapping / authorization step on top of.
+*
+* This is the package's one place that turns a request into verified claims:
+* header/cookie default resolution, the {@link readToken} read, the
+* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
+* live here so the resolver and the admin gate carry only their genuinely
+* distinct line. `onError` fires for a present-but-invalid token, never for an
+* absent one.
+*/
+export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.d.ts

@@ -0,0 +1,71 @@
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.js";
+import 'jose';
+/**
+* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+* verified Access user/service-token becomes `ctx.auth` for every
+* query/mutation/action (and feeds RLS) with no further wiring.
+*
+* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+* fails verification, resolves to `null` (the request proceeds unauthenticated
+* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+* verification failures.
+*
+* Wire it in your worker entry:
+*
+* ```ts
+* options.resolveIdentity = createAccessResolver({
+*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+* });
+* ```
+*/
+declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+/**
+* Compose several `resolveIdentity` adapters into one: each is tried in order
+* and the first to return a non-null identity wins. The canonical use is
+* pairing Access with `@lunora/auth` —
+* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+* an Access JWT (machine/SSO) is authenticated by Access while everyone else
+* falls through to the app's own session.
+*/
+declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
+/**
+* Normalize a configured team domain to the canonical Access issuer URL.
+*
+* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+* full URL, and always returns an `https://` origin with no trailing slash. A
+* bare name with no dot is expanded to the `cloudflareaccess.com` host.
+*/
+declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Verify a Cloudflare Access JWT and return its claims.
+*
+* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+* the team issuer, `aud` containing one of the configured Access application AUD
+* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+* outright.
+*
+* Throws (a `jose` error) on any failure — callers that want fail-closed
+* anonymous behaviour should catch and treat it as "no identity" (the
+* `createAccessResolver` adapter does exactly this).
+* @param token The raw compact JWT (header value or cookie value).
+*/
+declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
+/**
+* Read the Access JWT off a request and verify it. Returns the verified claims,
+* or `undefined` when no token is present **or** verification fails — the single
+* fail-closed "no Access identity" signal that both `createAccessResolver` and
+* `accessAdminGate` build their distinct mapping / authorization step on top of.
+*
+* This is the package's one place that turns a request into verified claims:
+* header/cookie default resolution, the {@link readToken} read, the
+* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
+* live here so the resolver and the admin gate carry only their genuinely
+* distinct line. `onError` fires for a present-but-invalid token, never for an
+* absent one.
+*/
+export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-C_7T5dDj.mjs';
+export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-DhKaNoyU.mjs';

package/dist/packem_shared/accessIssuer-DhKaNoyU.mjs

@@ -0,0 +1,91 @@
+import { jwtVerify, createRemoteJWKSet } from 'jose';
+
+const DEFAULT_HEADER = "cf-access-jwt-assertion";
+const DEFAULT_COOKIE = "CF_Authorization";
+const readToken = (request, headerName, cookieName) => {
+  const headerValue = request.headers.get(headerName);
+  if (headerValue !== null && headerValue.length > 0) {
+    return headerValue;
+  }
+  const cookieHeader = request.headers.get("cookie");
+  if (cookieHeader === null) {
+    return void 0;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) {
+      continue;
+    }
+    if (part.slice(0, eq).trim() === cookieName) {
+      const value = part.slice(eq + 1).trim();
+      return value.length > 0 ? value : void 0;
+    }
+  }
+  return void 0;
+};
+
+const CERTS_PATH = "/cdn-cgi/access/certs";
+const SCHEME_PREFIX = /^https?:\/\//i;
+const stripTrailingSlashes = (value) => {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+};
+const accessIssuer = (teamDomain) => {
+  const trimmed = stripTrailingSlashes(teamDomain.trim().replace(SCHEME_PREFIX, ""));
+  if (trimmed.length === 0) {
+    throw new Error('@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
+  }
+  const candidate = trimmed.includes(".") ? `https://${trimmed}` : `https://${trimmed}.cloudflareaccess.com`;
+  const host = new URL(candidate).host.toLowerCase();
+  return `https://${host}`;
+};
+const jwksByIssuer = /* @__PURE__ */ new Map();
+const remoteJwks = (issuer) => {
+  let getter = jwksByIssuer.get(issuer);
+  if (getter === void 0) {
+    getter = createRemoteJWKSet(new URL(`${issuer}${CERTS_PATH}`));
+    jwksByIssuer.set(issuer, getter);
+  }
+  return getter;
+};
+const verifyAccessJwt = async (token, options) => {
+  const issuer = accessIssuer(options.teamDomain);
+  const audiences = (Array.isArray(options.aud) ? options.aud : [options.aud]).filter(
+    (entry) => typeof entry === "string" && entry.length > 0
+  );
+  if (audiences.length === 0) {
+    throw new Error(
+      "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
+    );
+  }
+  const keySet = options.keySet ?? remoteJwks(issuer);
+  const { payload } = await jwtVerify(token, keySet, {
+    algorithms: ["RS256"],
+    audience: audiences,
+    clockTolerance: options.clockToleranceSec,
+    issuer
+  });
+  return payload;
+};
+const verifyRequest = async (request, options) => {
+  const headerName = (options.headerName ?? DEFAULT_HEADER).toLowerCase();
+  const cookieName = options.cookieName ?? DEFAULT_COOKIE;
+  const token = readToken(request, headerName, cookieName);
+  if (token === void 0) {
+    return void 0;
+  }
+  try {
+    return await verifyAccessJwt(token, options);
+  } catch (error) {
+    try {
+      options.onError?.(error, request);
+    } catch {
+    }
+    return void 0;
+  }
+};
+
+export { accessIssuer, verifyAccessJwt, verifyRequest };

package/dist/packem_shared/composeResolvers-C_7T5dDj.mjs

@@ -0,0 +1,38 @@
+import { verifyRequest } from './accessIssuer-DhKaNoyU.mjs';
+
+const ANONYMOUS = null;
+const deriveUserId = (claims) => {
+  const sub = typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : void 0;
+  return sub ?? claims.email ?? claims.common_name;
+};
+const toIdentity = (claims, mapClaims) => {
+  const overrides = mapClaims?.(claims) ?? {};
+  const userId = typeof overrides.userId === "string" ? overrides.userId : deriveUserId(claims);
+  if (userId === void 0) {
+    return ANONYMOUS;
+  }
+  return {
+    access: claims,
+    ...claims.common_name === void 0 ? {} : { commonName: claims.common_name },
+    ...claims.email === void 0 ? {} : { email: claims.email },
+    ...claims.exp === void 0 ? {} : { exp: claims.exp },
+    ...claims.groups === void 0 ? {} : { groups: claims.groups },
+    ...overrides,
+    userId
+  };
+};
+const createAccessResolver = (options) => async (request) => {
+  const claims = await verifyRequest(request, options);
+  return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
+};
+const composeResolvers = (...resolvers) => async (request, env) => {
+  for (const resolve of resolvers) {
+    const identity = await resolve(request, env);
+    if (identity) {
+      return identity;
+    }
+  }
+  return ANONYMOUS;
+};
+
+export { composeResolvers, createAccessResolver };

package/dist/packem_shared/index.d-C7lOF4ZA.d.mts

@@ -0,0 +1,22 @@
+/**
+* `next()` advances the middleware chain. Called with no argument it forwards
+* the current context unchanged; called with `{ ctx }` it shallow-merges the
+* extension, and the result type reflects the widened context.
+*/
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+* A middleware receives the current context and a `next` continuation. Its
+* return type becomes the builder's new context, so `return next({ ctx })`
+* propagates the extension into every downstream `.use()` and the handler.
+*/
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+/** Options accepted by `initLunora.dataModel&lt;DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
+export { Middleware as M };

package/dist/packem_shared/index.d-C7lOF4ZA.d.ts

@@ -0,0 +1,22 @@
+/**
+* `next()` advances the middleware chain. Called with no argument it forwards
+* the current context unchanged; called with `{ ctx }` it shallow-merges the
+* extension, and the result type reflects the widened context.
+*/
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+* A middleware receives the current context and a `next` continuation. Its
+* return type becomes the builder's new context, so `return next({ ctx })`
+* propagates the extension into every downstream `.use()` and the handler.
+*/
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+/** Options accepted by `initLunora.dataModel&lt;DM>().create(...)`. Reserved for transformer/error-formatter wiring. */
+export { Middleware as M };