@lunora/cloudflare-access 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/admin.mjs

@@ -1,4 +1,4 @@
-import { verifyRequest } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+import { verifyRequest } from './packem_shared/accessIssuer-83KYwaCp.mjs';
 
 const accessAdminGate = (options) => async (request) => {
   const claims = await verifyRequest(request, options);

package/dist/context.d.mts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.d.ts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-C_7T5dDj.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BI3envaN.mjs';
+export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-83KYwaCp.mjs';

package/dist/packem_shared/{accessIssuer-DhKaNoyU.mjs → accessIssuer-83KYwaCp.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 const DEFAULT_HEADER = "cf-access-jwt-assertion";
@@ -36,7 +37,7 @@ const stripTrailingSlashes = (value) => {
 const accessIssuer = (teamDomain) => {
   const trimmed = stripTrailingSlashes(teamDomain.trim().replace(SCHEME_PREFIX, ""));
   if (trimmed.length === 0) {
-    throw new Error('@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
+    throw new LunoraError("INTERNAL", '@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
   }
   const candidate = trimmed.includes(".") ? `https://${trimmed}` : `https://${trimmed}.cloudflareaccess.com`;
   const host = new URL(candidate).host.toLowerCase();
@@ -57,7 +58,8 @@ const verifyAccessJwt = async (token, options) => {
     (entry) => typeof entry === "string" && entry.length > 0
   );
   if (audiences.length === 0) {
-    throw new Error(
+    throw new LunoraError(
+      "INTERNAL",
       "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
     );
   }

package/dist/packem_shared/{composeResolvers-C_7T5dDj.mjs → composeResolvers-BI3envaN.mjs}

@@ -1,4 +1,4 @@
-import { verifyRequest } from './accessIssuer-DhKaNoyU.mjs';
+import { verifyRequest } from './accessIssuer-83KYwaCp.mjs';
 
 const ANONYMOUS = null;
 const deriveUserId = (claims) => {

package/dist/packem_shared/{index.d-C7lOF4ZA.d.mts → index.d-ByAnpUzP.d.mts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/packem_shared/{index.d-C7lOF4ZA.d.ts → index.d-ByAnpUzP.d.ts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/roles.d.mts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.d.ts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.10",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -54,10 +54,11 @@
     "access": "public"
   },
   "dependencies": {
+    "@lunora/errors": "1.0.0-alpha.1",
     "jose": "^6.1.0"
   },
   "peerDependencies": {
-    "@lunora/server": "1.0.0-alpha.7"
+    "@lunora/server": "1.0.0-alpha.16"
   },
   "peerDependenciesMeta": {
     "@lunora/server": {