@lunora/cloudflare-access 1.0.0-alpha.100 → 1.0.0-alpha.102

package/dist/admin.d.mts

@@ -1,4 +1,4 @@
-import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-D30o96f7.mjs";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-Dp399TMk.mjs";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
 interface AccessAdminGateOptions extends AccessJwtFallbackOptions {

package/dist/admin.d.ts

@@ -1,4 +1,4 @@
-import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-D30o96f7.js";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-Dp399TMk.js";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
 interface AccessAdminGateOptions extends AccessJwtFallbackOptions {

package/dist/context.d.mts

@@ -1,6 +1,25 @@
-import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-Dp399TMk.mjs";
 import 'jose';
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every
  * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
@@ -63,7 +82,7 @@ declare const accessFacade: (identity: Record<string, unknown> | null | undefine
  * fail closed.
  *
  * It does not gate the request; pair it with `rls(...)` (or
- * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * `rls(...)`) when you need enforcement. It only surfaces
  * the identity for branching inside a handler.
  *
  * ```ts

package/dist/context.d.ts

@@ -1,6 +1,25 @@
-import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
-import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
+import { A as AccessClaims } from "./packem_shared/types.d-Dp399TMk.js";
 import 'jose';
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every
  * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
@@ -63,7 +82,7 @@ declare const accessFacade: (identity: Record<string, unknown> | null | undefine
  * fail closed.
  *
  * It does not gate the request; pair it with `rls(...)` (or
- * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * `rls(...)`) when you need enforcement. It only surfaces
  * the identity for branching inside a handler.
  *
  * ```ts

package/dist/context.mjs

@@ -1 +1 @@
-import{i as r,r as m}from"./packem_shared/identity-groups-CpehEdiX.mjs";const e=s=>typeof s=="string"?s:void 0,t={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(s,a)=>{if(!r(s))return t;const o=s.access,c=m(s)??[];return{authenticated:!0,claims:o,commonName:e(s.commonName)??e(o.common_name),email:e(s.email)??e(o.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(s,a)=>s?i(s,a??void 0):t,l=()=>async({ctx:s,next:a})=>{const o=await s.auth?.getIdentity?.(),c=u(o,s.auth?.userId);return a({ctx:{access:c}})};export{l as accessContext,u as accessFacade};
+import{i as r,r as m}from"./packem_shared/identity-groups-BnaBEyE_.mjs";const e=s=>typeof s=="string"?s:void 0,t={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(s,a)=>{if(!r(s))return t;const o=s.access,c=m(s)??[];return{authenticated:!0,claims:o,commonName:e(s.commonName)??e(o.common_name),email:e(s.email)??e(o.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(s,a)=>s?i(s,a??void 0):t,l=()=>async({ctx:s,next:a})=>{const o=await s.auth?.getIdentity?.(),c=u(o,s.auth?.userId);return a({ctx:{access:c}})};export{l as accessContext,u as accessFacade};

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
-export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.mjs";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-Dp399TMk.mjs";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as AccessRoleMap, d as ResolvedAccessIdentity, e as ResolvedIdentityLike } from "./packem_shared/types.d-Dp399TMk.mjs";
 import 'jose';
 /**
  * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
-export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.js";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-Dp399TMk.js";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as AccessRoleMap, d as ResolvedAccessIdentity, e as ResolvedIdentityLike } from "./packem_shared/types.d-Dp399TMk.js";
 import 'jose';
 /**
  * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access

package/dist/index.mjs

@@ -1 +1 @@
-import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-JBsWQvv4.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-DQFDgtOL.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/composeResolvers-DQFDgtOL.mjs

@@ -0,0 +1 @@
+import{a as c,r as v}from"./identity-groups-BnaBEyE_.mjs";import{r as u}from"./platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as f,verifyRequest as y}from"./accessIssuer-CLO6p5MF.mjs";const d=null,i=o=>typeof o=="string"&&o.length>0?o:void 0,I=o=>i(o.sub)??i(o.email)??i(o.common_name),p=(o,e)=>{const r=e?.mapClaims?.(o)??{},n=i(r.userId)??I(o);if(n===void 0)return d;const t=c(v(o),e?.roles);return{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...t===void 0?{}:{roles:t},...r,userId:n}},x=o=>{const e=f(o);return async(r,n,t)=>{const s=await u(t),a=s===void 0?d:p(s,o);if(a!==d)return a;const m=e===void 0?void 0:await y(r,e);return m===void 0?d:p(m,o)}},O=(...o)=>async(e,r,n)=>{for(const t of o){const s=await t(e,r,n);if(s)return s}return d};export{O as composeResolvers,x as createAccessResolver};

package/dist/packem_shared/identity-groups-BnaBEyE_.mjs

@@ -0,0 +1 @@
+const c=r=>{const{access:o}=r;return typeof o=="object"&&o!==null},i=r=>{const{access:o}=r,s=typeof o=="object"&&o!==null?o.groups:void 0,t=r.groups??s;return Array.isArray(t)?t.filter(e=>typeof e=="string"):void 0},n=(r,o)=>{const s=typeof o=="function"?o(r):o[r];return s===void 0?[]:Array.isArray(s)?s:[s]},d=(r,o)=>{if(o===void 0||r===void 0||r.length===0)return;const s=new Set;for(const t of r)for(const e of n(t,o))s.add(e);return s.size===0?void 0:[...s]};export{d as a,c as i,i as r};

package/dist/packem_shared/{types.d-D30o96f7.d.mts → types.d-Dp399TMk.d.mts}

@@ -80,6 +80,8 @@ interface AccessIdentityLike {
 interface AccessContextLike {
   getIdentity: () => AccessIdentityLike | null | undefined | Promise<AccessIdentityLike | null | undefined>;
 }
+/** A group→role(s) lookup table, or a function returning the role(s) for one group. */
+type AccessRoleMap = ((group: string) => string | string[] | undefined) | Record<string, string | string[]>;
 /**
  * The verified claims of a Cloudflare Access caller — from the
  * `Cf-Access-Jwt-Assertion` JWT (hostname-scoped Access applications) or from the
@@ -239,8 +241,30 @@ interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
    * Remap verified claims into the resolved identity. Return an object to
    * shallow-merge over the defaults; return a `userId` to override the derived
    * caller id. Runs only after signature/issuer/audience/expiry are verified.
+   *
+   * It is merged OVER the `roles` claim {@link CreateAccessResolverOptions.roles}
+   * mints, so returning `roles` here replaces the mapped set outright.
    */
   mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
+  /**
+   * Map the verified Access `groups` claim onto RLS role names, minted as the
+   * identity's `roles` claim — the list `rls()` unions permissions over.
+   *
+   * A table (`{ "idp-admins": "admin", "idp-eng": ["editor", "viewer"] }`) or a
+   * function; either may return one role, an array, or `undefined` to drop the
+   * group. Omit the option and no `roles` claim is minted at all — granting
+   * every group name as a role by default would hand existing deployments
+   * permissions their policies never intended. Pass `(group) => group` to opt
+   * into group names as role names verbatim.
+   *
+   * Roles live ON THE IDENTITY rather than being derived per-procedure so that
+   * every consumer sees the same set. A middleware that writes `ctx.auth.roles`
+   * reaches queries and mutations but NOT live shapes — a shape runs no
+   * procedure, so no middleware fires — and a role-gated policy then resolves
+   * differently for a query and the subscription that mirrors it. The identity
+   * is the one place both paths read.
+   */
+  roles?: AccessRoleMap;
 }
 /**
  * A `resolveIdentity`-shaped function: maps an inbound request to a verified
@@ -253,4 +277,4 @@ interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
  * have no context to give, so a resolver must handle its absence.
  */
 type ResolveIdentityFunction = (request: Request, env?: unknown, context?: ExecutionContextLike) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
-export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };
+export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, AccessRoleMap as c, ResolvedAccessIdentity as d, ResolvedIdentityLike as e };

package/dist/packem_shared/{types.d-D30o96f7.d.ts → types.d-Dp399TMk.d.ts}

@@ -80,6 +80,8 @@ interface AccessIdentityLike {
 interface AccessContextLike {
   getIdentity: () => AccessIdentityLike | null | undefined | Promise<AccessIdentityLike | null | undefined>;
 }
+/** A group→role(s) lookup table, or a function returning the role(s) for one group. */
+type AccessRoleMap = ((group: string) => string | string[] | undefined) | Record<string, string | string[]>;
 /**
  * The verified claims of a Cloudflare Access caller — from the
  * `Cf-Access-Jwt-Assertion` JWT (hostname-scoped Access applications) or from the
@@ -239,8 +241,30 @@ interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
    * Remap verified claims into the resolved identity. Return an object to
    * shallow-merge over the defaults; return a `userId` to override the derived
    * caller id. Runs only after signature/issuer/audience/expiry are verified.
+   *
+   * It is merged OVER the `roles` claim {@link CreateAccessResolverOptions.roles}
+   * mints, so returning `roles` here replaces the mapped set outright.
    */
   mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
+  /**
+   * Map the verified Access `groups` claim onto RLS role names, minted as the
+   * identity's `roles` claim — the list `rls()` unions permissions over.
+   *
+   * A table (`{ "idp-admins": "admin", "idp-eng": ["editor", "viewer"] }`) or a
+   * function; either may return one role, an array, or `undefined` to drop the
+   * group. Omit the option and no `roles` claim is minted at all — granting
+   * every group name as a role by default would hand existing deployments
+   * permissions their policies never intended. Pass `(group) => group` to opt
+   * into group names as role names verbatim.
+   *
+   * Roles live ON THE IDENTITY rather than being derived per-procedure so that
+   * every consumer sees the same set. A middleware that writes `ctx.auth.roles`
+   * reaches queries and mutations but NOT live shapes — a shape runs no
+   * procedure, so no middleware fires — and a role-gated policy then resolves
+   * differently for a query and the subscription that mirrors it. The identity
+   * is the one place both paths read.
+   */
+  roles?: AccessRoleMap;
 }
 /**
  * A `resolveIdentity`-shaped function: maps an inbound request to a verified
@@ -253,4 +277,4 @@ interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
  * have no context to give, so a resolver must handle its absence.
  */
 type ResolveIdentityFunction = (request: Request, env?: unknown, context?: ExecutionContextLike) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
-export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };
+export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, AccessRoleMap as c, ResolvedAccessIdentity as d, ResolvedIdentityLike as e };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.100",
+  "version": "1.0.0-alpha.102",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -44,17 +44,13 @@
       "types": "./dist/context.d.ts",
       "import": "./dist/context.mjs"
     },
-    "./roles": {
-      "types": "./dist/roles.d.ts",
-      "import": "./dist/roles.mjs"
-    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.31",
+    "@lunora/errors": "1.0.0-alpha.32",
     "jose": "^6.2.8"
   },
   "peerDependencies": {

package/dist/packem_shared/composeResolvers-JBsWQvv4.mjs

@@ -1 +0,0 @@
-import{r as c}from"./platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as m,verifyRequest as p}from"./accessIssuer-CLO6p5MF.mjs";const d=null,s=o=>typeof o=="string"&&o.length>0?o:void 0,v=o=>s(o.sub)??s(o.email)??s(o.common_name),a=(o,e)=>{const t=e?.(o)??{},n=s(t.userId)??v(o);return n===void 0?d:{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...t,userId:n}},y=o=>{const e=m(o);return async(t,n,i)=>{const r=await c(i)??(e===void 0?void 0:await p(t,e));return r===void 0?d:a(r,o?.mapClaims)}},g=(...o)=>async(e,t,n)=>{for(const i of o){const r=await i(e,t,n);if(r)return r}return d};export{g as composeResolvers,y as createAccessResolver};

package/dist/packem_shared/identity-groups-CpehEdiX.mjs

@@ -1 +0,0 @@
-const c=t=>{const{access:s}=t;return typeof s=="object"&&s!==null},n=t=>{const{access:s}=t,r=typeof s=="object"&&s!==null?s.groups:void 0,o=t.groups??r;return Array.isArray(o)?o.filter(e=>typeof e=="string"):void 0};export{c as i,n as r};

package/dist/packem_shared/index.d-D7R8k7yf.d.mts

@@ -1,21 +0,0 @@
-/**
- * `next()` advances the middleware chain. Called with no argument it forwards
- * the current context unchanged; called with `{ ctx }` it shallow-merges the
- * extension, and the result type reflects the widened context.
- */
-interface MiddlewareNext<ContextIn> {
-  (): Promise<ContextIn>;
-  <Extension extends Record<string, unknown>>(options: {
-    ctx: Extension;
-  }): Promise<ContextIn & Extension>;
-}
-/**
- * A middleware receives the current context and a `next` continuation. Its
- * return type becomes the builder's new context, so `return next({ ctx })`
- * propagates the extension into every downstream `.use()` and the handler.
- */
-type Middleware<ContextIn, ContextOut> = (options: {
-  ctx: ContextIn;
-  next: MiddlewareNext<ContextIn>;
-}) => ContextOut | Promise<ContextOut>;
-export { Middleware as M };

package/dist/packem_shared/index.d-D7R8k7yf.d.ts

@@ -1,21 +0,0 @@
-/**
- * `next()` advances the middleware chain. Called with no argument it forwards
- * the current context unchanged; called with `{ ctx }` it shallow-merges the
- * extension, and the result type reflects the widened context.
- */
-interface MiddlewareNext<ContextIn> {
-  (): Promise<ContextIn>;
-  <Extension extends Record<string, unknown>>(options: {
-    ctx: Extension;
-  }): Promise<ContextIn & Extension>;
-}
-/**
- * A middleware receives the current context and a `next` continuation. Its
- * return type becomes the builder's new context, so `return next({ ctx })`
- * propagates the extension into every downstream `.use()` and the handler.
- */
-type Middleware<ContextIn, ContextOut> = (options: {
-  ctx: ContextIn;
-  next: MiddlewareNext<ContextIn>;
-}) => ContextOut | Promise<ContextOut>;
-export { Middleware as M };

package/dist/roles.d.mts

@@ -1,57 +0,0 @@
-import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
-/**
- * The slice of context {@link accessRoles} reads and augments: the `auth` facade
- * every Lunora ctx carries. `getIdentity()` returns the verified identity
- * envelope (`createAccessResolver`'s output, including `groups`); `roles` is the
- * per-request role list `rls()` unions permissions over.
- */
-interface AccessRolesContext {
-  auth?: {
-    getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
-    roles?: ReadonlyArray<string>;
-    userId?: string | null;
-  };
-}
-/** A group→role(s) lookup table, or a function returning the role(s) for one group. */
-type AccessRoleMap = ((group: string) => string | string[] | undefined) | Record<string, string | string[]>;
-/** Options for {@link accessRoles}. */
-interface AccessRolesOptions {
-  /**
-   * Map verified Access group names to RLS role names. A table
-   * (`{ "idp-admins": "admin", "idp-eng": ["editor", "viewer"] }`) or a
-   * function; either may return one role, an array, or `undefined` to drop the
-   * group. Omit to use each group name verbatim as a role.
-   */
-  map?: AccessRoleMap;
-  /**
-   * Read the group list off the resolved identity. Defaults to the `groups`
-   * claim (`string[]`). Override when your IdP nests groups elsewhere.
-   */
-  readGroups?: (identity: Record<string, unknown>) => ReadonlyArray<string> | undefined;
-}
-/**
- * Middleware that lifts the verified Cloudflare Access `groups` claim into
- * `ctx.auth.roles` so `rls()` policies can authorize by role. Place it **before**
- * `rls(...)` in the `.use(...)` chain — `rls()` reads `ctx.auth.roles` to union
- * the permissions a request carries.
- *
- * It reads the resolved identity via `ctx.auth.getIdentity()` (the output of
- * `createAccessResolver`), maps each group to role name(s), and unions them with
- * any roles already on `ctx.auth.roles` (so a role set by an earlier middleware
- * is preserved). When there is no identity or no groups it forwards the context
- * unchanged — anonymous requests stay role-less (fail-closed under RLS).
- *
- * Only a **verified Access identity** contributes roles: an envelope without the
- * claim set under `access` (a session resolved by another adapter under
- * `composeResolvers`, e.g. better-auth) is forwarded unchanged, so a `groups`
- * field on a foreign identity can never become an RLS role.
- *
- * ```ts
- * export const listInvoices = query
- *   .use(accessRoles({ map: { "idp-admins": "admin", "idp-billing": ["billing", "viewer"] } }))
- *   .use(rls(policies, { roles }))
- *   .query(async ({ ctx }) => ...);
- * ```
- */
-declare const accessRoles: <Context extends AccessRolesContext>(options?: AccessRolesOptions) => Middleware<Context, Context>;
-export { type AccessRoleMap, type AccessRolesContext, type AccessRolesOptions, accessRoles };

package/dist/roles.d.ts

@@ -1,57 +0,0 @@
-import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
-/**
- * The slice of context {@link accessRoles} reads and augments: the `auth` facade
- * every Lunora ctx carries. `getIdentity()` returns the verified identity
- * envelope (`createAccessResolver`'s output, including `groups`); `roles` is the
- * per-request role list `rls()` unions permissions over.
- */
-interface AccessRolesContext {
-  auth?: {
-    getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
-    roles?: ReadonlyArray<string>;
-    userId?: string | null;
-  };
-}
-/** A group→role(s) lookup table, or a function returning the role(s) for one group. */
-type AccessRoleMap = ((group: string) => string | string[] | undefined) | Record<string, string | string[]>;
-/** Options for {@link accessRoles}. */
-interface AccessRolesOptions {
-  /**
-   * Map verified Access group names to RLS role names. A table
-   * (`{ "idp-admins": "admin", "idp-eng": ["editor", "viewer"] }`) or a
-   * function; either may return one role, an array, or `undefined` to drop the
-   * group. Omit to use each group name verbatim as a role.
-   */
-  map?: AccessRoleMap;
-  /**
-   * Read the group list off the resolved identity. Defaults to the `groups`
-   * claim (`string[]`). Override when your IdP nests groups elsewhere.
-   */
-  readGroups?: (identity: Record<string, unknown>) => ReadonlyArray<string> | undefined;
-}
-/**
- * Middleware that lifts the verified Cloudflare Access `groups` claim into
- * `ctx.auth.roles` so `rls()` policies can authorize by role. Place it **before**
- * `rls(...)` in the `.use(...)` chain — `rls()` reads `ctx.auth.roles` to union
- * the permissions a request carries.
- *
- * It reads the resolved identity via `ctx.auth.getIdentity()` (the output of
- * `createAccessResolver`), maps each group to role name(s), and unions them with
- * any roles already on `ctx.auth.roles` (so a role set by an earlier middleware
- * is preserved). When there is no identity or no groups it forwards the context
- * unchanged — anonymous requests stay role-less (fail-closed under RLS).
- *
- * Only a **verified Access identity** contributes roles: an envelope without the
- * claim set under `access` (a session resolved by another adapter under
- * `composeResolvers`, e.g. better-auth) is forwarded unchanged, so a `groups`
- * field on a foreign identity can never become an RLS role.
- *
- * ```ts
- * export const listInvoices = query
- *   .use(accessRoles({ map: { "idp-admins": "admin", "idp-billing": ["billing", "viewer"] } }))
- *   .use(rls(policies, { roles }))
- *   .query(async ({ ctx }) => ...);
- * ```
- */
-declare const accessRoles: <Context extends AccessRolesContext>(options?: AccessRolesOptions) => Middleware<Context, Context>;
-export { type AccessRoleMap, type AccessRolesContext, type AccessRolesOptions, accessRoles };

package/dist/roles.mjs

@@ -1 +0,0 @@
-import{r as a,i as c}from"./packem_shared/identity-groups-CpehEdiX.mjs";const f=(o,t)=>{if(t===void 0)return[o];const r=typeof t=="function"?t(o):t[o];return r===void 0?[]:Array.isArray(r)?r:[r]},y=(o={})=>{const t=o.readGroups??a;return async({ctx:r,next:n})=>{const e=await r.auth?.getIdentity?.()??void 0,s=e!==void 0&&c(e)?t(e):void 0;if(s===void 0||s.length===0)return n();const i=new Set(r.auth?.roles);for(const d of s)for(const u of f(d,o.map))i.add(u);return n({ctx:{auth:{...r.auth,roles:[...i]}}})}};export{y as accessRoles};