@lunora/cloudflare-access 1.0.0-alpha.12 → 1.0.0-alpha.120

package/LICENSE.md

@@ -227,5 +227,219 @@ Repository: git+https://github.com/anolilab/lunora.git
 >
 > <!-- DEPENDENCIES -->
 > <!-- /DEPENDENCIES -->
+>
+>
+>
+> # Licenses of bundled types
+> The published @lunora/server artifact additionally contains code with the following licenses:
+> Apache-2.0
+>
+> # Bundled types:
+> ## @opentelemetry/api
+> License: Apache-2.0
+> By: OpenTelemetry Authors
+> Repository: open-telemetry/opentelemetry-js
+>
+> > Apache License
+> >                            Version 2.0, January 2004
+> >                         http://www.apache.org/licenses/
+> >
+> >    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+> >
+> >    1. Definitions.
+> >
+> >       "License" shall mean the terms and conditions for use, reproduction,
+> >       and distribution as defined by Sections 1 through 9 of this document.
+> >
+> >       "Licensor" shall mean the copyright owner or entity authorized by
+> >       the copyright owner that is granting the License.
+> >
+> >       "Legal Entity" shall mean the union of the acting entity and all
+> >       other entities that control, are controlled by, or are under common
+> >       control with that entity. For the purposes of this definition,
+> >       "control" means (i) the power, direct or indirect, to cause the
+> >       direction or management of such entity, whether by contract or
+> >       otherwise, or (ii) ownership of fifty percent (50%) or more of the
+> >       outstanding shares, or (iii) beneficial ownership of such entity.
+> >
+> >       "You" (or "Your") shall mean an individual or Legal Entity
+> >       exercising permissions granted by this License.
+> >
+> >       "Source" form shall mean the preferred form for making modifications,
+> >       including but not limited to software source code, documentation
+> >       source, and configuration files.
+> >
+> >       "Object" form shall mean any form resulting from mechanical
+> >       transformation or translation of a Source form, including but
+> >       not limited to compiled object code, generated documentation,
+> >       and conversions to other media types.
+> >
+> >       "Work" shall mean the work of authorship, whether in Source or
+> >       Object form, made available under the License, as indicated by a
+> >       copyright notice that is included in or attached to the work
+> >       (an example is provided in the Appendix below).
+> >
+> >       "Derivative Works" shall mean any work, whether in Source or Object
+> >       form, that is based on (or derived from) the Work and for which the
+> >       editorial revisions, annotations, elaborations, or other modifications
+> >       represent, as a whole, an original work of authorship. For the purposes
+> >       of this License, Derivative Works shall not include works that remain
+> >       separable from, or merely link (or bind by name) to the interfaces of,
+> >       the Work and Derivative Works thereof.
+> >
+> >       "Contribution" shall mean any work of authorship, including
+> >       the original version of the Work and any modifications or additions
+> >       to that Work or Derivative Works thereof, that is intentionally
+> >       submitted to Licensor for inclusion in the Work by the copyright owner
+> >       or by an individual or Legal Entity authorized to submit on behalf of
+> >       the copyright owner. For the purposes of this definition, "submitted"
+> >       means any form of electronic, verbal, or written communication sent
+> >       to the Licensor or its representatives, including but not limited to
+> >       communication on electronic mailing lists, source code control systems,
+> >       and issue tracking systems that are managed by, or on behalf of, the
+> >       Licensor for the purpose of discussing and improving the Work, but
+> >       excluding communication that is conspicuously marked or otherwise
+> >       designated in writing by the copyright owner as "Not a Contribution."
+> >
+> >       "Contributor" shall mean Licensor and any individual or Legal Entity
+> >       on behalf of whom a Contribution has been received by Licensor and
+> >       subsequently incorporated within the Work.
+> >
+> >    2. Grant of Copyright License. Subject to the terms and conditions of
+> >       this License, each Contributor hereby grants to You a perpetual,
+> >       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+> >       copyright license to reproduce, prepare Derivative Works of,
+> >       publicly display, publicly perform, sublicense, and distribute the
+> >       Work and such Derivative Works in Source or Object form.
+> >
+> >    3. Grant of Patent License. Subject to the terms and conditions of
+> >       this License, each Contributor hereby grants to You a perpetual,
+> >       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+> >       (except as stated in this section) patent license to make, have made,
+> >       use, offer to sell, sell, import, and otherwise transfer the Work,
+> >       where such license applies only to those patent claims licensable
+> >       by such Contributor that are necessarily infringed by their
+> >       Contribution(s) alone or by combination of their Contribution(s)
+> >       with the Work to which such Contribution(s) was submitted. If You
+> >       institute patent litigation against any entity (including a
+> >       cross-claim or counterclaim in a lawsuit) alleging that the Work
+> >       or a Contribution incorporated within the Work constitutes direct
+> >       or contributory patent infringement, then any patent licenses
+> >       granted to You under this License for that Work shall terminate
+> >       as of the date such litigation is filed.
+> >
+> >    4. Redistribution. You may reproduce and distribute copies of the
+> >       Work or Derivative Works thereof in any medium, with or without
+> >       modifications, and in Source or Object form, provided that You
+> >       meet the following conditions:
+> >
+> >       (a) You must give any other recipients of the Work or
+> >           Derivative Works a copy of this License; and
+> >
+> >       (b) You must cause any modified files to carry prominent notices
+> >           stating that You changed the files; and
+> >
+> >       (c) You must retain, in the Source form of any Derivative Works
+> >           that You distribute, all copyright, patent, trademark, and
+> >           attribution notices from the Source form of the Work,
+> >           excluding those notices that do not pertain to any part of
+> >           the Derivative Works; and
+> >
+> >       (d) If the Work includes a "NOTICE" text file as part of its
+> >           distribution, then any Derivative Works that You distribute must
+> >           include a readable copy of the attribution notices contained
+> >           within such NOTICE file, excluding those notices that do not
+> >           pertain to any part of the Derivative Works, in at least one
+> >           of the following places: within a NOTICE text file distributed
+> >           as part of the Derivative Works; within the Source form or
+> >           documentation, if provided along with the Derivative Works; or,
+> >           within a display generated by the Derivative Works, if and
+> >           wherever such third-party notices normally appear. The contents
+> >           of the NOTICE file are for informational purposes only and
+> >           do not modify the License. You may add Your own attribution
+> >           notices within Derivative Works that You distribute, alongside
+> >           or as an addendum to the NOTICE text from the Work, provided
+> >           that such additional attribution notices cannot be construed
+> >           as modifying the License.
+> >
+> >       You may add Your own copyright statement to Your modifications and
+> >       may provide additional or different license terms and conditions
+> >       for use, reproduction, or distribution of Your modifications, or
+> >       for any such Derivative Works as a whole, provided Your use,
+> >       reproduction, and distribution of the Work otherwise complies with
+> >       the conditions stated in this License.
+> >
+> >    5. Submission of Contributions. Unless You explicitly state otherwise,
+> >       any Contribution intentionally submitted for inclusion in the Work
+> >       by You to the Licensor shall be under the terms and conditions of
+> >       this License, without any additional terms or conditions.
+> >       Notwithstanding the above, nothing herein shall supersede or modify
+> >       the terms of any separate license agreement you may have executed
+> >       with Licensor regarding such Contributions.
+> >
+> >    6. Trademarks. This License does not grant permission to use the trade
+> >       names, trademarks, service marks, or product names of the Licensor,
+> >       except as required for reasonable and customary use in describing the
+> >       origin of the Work and reproducing the content of the NOTICE file.
+> >
+> >    7. Disclaimer of Warranty. Unless required by applicable law or
+> >       agreed to in writing, Licensor provides the Work (and each
+> >       Contributor provides its Contributions) on an "AS IS" BASIS,
+> >       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+> >       implied, including, without limitation, any warranties or conditions
+> >       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+> >       PARTICULAR PURPOSE. You are solely responsible for determining the
+> >       appropriateness of using or redistributing the Work and assume any
+> >       risks associated with Your exercise of permissions under this License.
+> >
+> >    8. Limitation of Liability. In no event and under no legal theory,
+> >       whether in tort (including negligence), contract, or otherwise,
+> >       unless required by applicable law (such as deliberate and grossly
+> >       negligent acts) or agreed to in writing, shall any Contributor be
+> >       liable to You for damages, including any direct, indirect, special,
+> >       incidental, or consequential damages of any character arising as a
+> >       result of this License or out of the use or inability to use the
+> >       Work (including but not limited to damages for loss of goodwill,
+> >       work stoppage, computer failure or malfunction, or any and all
+> >       other commercial damages or losses), even if such Contributor
+> >       has been advised of the possibility of such damages.
+> >
+> >    9. Accepting Warranty or Additional Liability. While redistributing
+> >       the Work or Derivative Works thereof, You may choose to offer,
+> >       and charge a fee for, acceptance of support, warranty, indemnity,
+> >       or other liability obligations and/or rights consistent with this
+> >       License. However, in accepting such obligations, You may act only
+> >       on Your own behalf and on Your sole responsibility, not on behalf
+> >       of any other Contributor, and only if You agree to indemnify,
+> >       defend, and hold each Contributor harmless for any liability
+> >       incurred by, or claims asserted against, such Contributor by reason
+> >       of your accepting any such warranty or additional liability.
+> >
+> >    END OF TERMS AND CONDITIONS
+> >
+> >    APPENDIX: How to apply the Apache License to your work.
+> >
+> >       To apply the Apache License to your work, attach the following
+> >       boilerplate notice, with the fields enclosed by brackets "[]"
+> >       replaced with your own identifying information. (Don't include
+> >       the brackets!)  The text should be enclosed in the appropriate
+> >       comment syntax for the file format. We also recommend that a
+> >       file or class name and description of purpose be included on the
+> >       same "printed page" as the copyright notice for easier
+> >       identification within third-party archives.
+> >
+> >    Copyright [yyyy] [name of copyright owner]
+> >
+> >    Licensed under the Apache License, Version 2.0 (the "License");
+> >    you may not use this file except in compliance with the License.
+> >    You may obtain a copy of the License at
+> >
+> >        http://www.apache.org/licenses/LICENSE-2.0
+> >
+> >    Unless required by applicable law or agreed to in writing, software
+> >    distributed under the License is distributed on an "AS IS" BASIS,
+> >    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+> >    See the License for the specific language governing permissions and
+> >    limitations under the License.
 
 <!-- /TYPE_DEPENDENCIES -->

package/dist/admin.d.mts

@@ -1,36 +1,70 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-Dp399TMk.mjs";
 import 'jose';
-/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
-interface AccessAdminGateOptions extends RequestVerifyOptions {
+/** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
+interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after the caller is authenticated.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
-declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * predicate that authenticates the caller through Cloudflare Access and applies
+ * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
+ * admin **HTTP** plane (`/_lunora/admin/*` plus `/_lunora/migrate`) in addition
+ * to — or instead of — the static admin bearer, so the Studio's pages can sit
+ * behind Cloudflare Access.
+ *
+ * It does NOT cover `/_lunora/ws`, which is not an admin path: the runtime never
+ * evaluates the gate there. The Studio's live views authenticate their socket
+ * with a sub-token minted at `/_lunora/admin/ws-token`, signed with the static
+ * admin token — so with no `LUNORA_ADMIN_TOKEN` configured, minting refuses
+ * (`ADMIN_TOKEN_NOT_CONFIGURED`) and every live panel fails while the HTTP pages
+ * work. Configure both.
+ *
+ * It accepts exactly one proof, and **which one is your choice, not the
+ * platform's**:
+ *
+ * - Configure `teamDomain` + `aud` and the request's `Cf-Access-Jwt-Assertion`
+ * JWT is the only thing accepted. This is the stricter setup, and the point of
+ * the `aud`: it proves the caller came through the *specific* Access application
+ * you put in front of `/_lunora/admin`, not merely through some application in
+ * the same Cloudflare team.
+ * - Configure neither and the Worker's own Access identity (`context.access`) is
+ * accepted, for a deployment whose Access policy is attached to the Worker.
+ *
+ * Note this is the **opposite** precedence to `createAccessResolver`, which
+ * prefers the platform identity. That is deliberate. A policy attached to the
+ * Worker is typically broad — "anyone at the company", covering every route and
+ * preview URL — while a configured admin `aud` is deliberately narrow. Letting
+ * the broad one satisfy a gate you scoped with the narrow one would widen the
+ * admin plane to everyone the Worker policy admits, silently, the moment that
+ * policy was attached.
+ *
+ * It is **fail-closed**: no identity, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * its context and the runtime can evaluate it without threading async through
+ * every admin route.
+ *
+ * ```ts
+ * // A dedicated Access application over /_lunora/admin — the JWT is the only proof.
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ *
+ * // Access policy attached to the Worker — `isAdmin` is the whole boundary, so
+ * // make it at least as strict as a dedicated admin application would have been.
+ * options.adminGate = accessAdminGate({
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request, context?: ExecutionContextLike) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.d.ts

@@ -1,36 +1,70 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.js";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-Dp399TMk.js";
 import 'jose';
-/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
-interface AccessAdminGateOptions extends RequestVerifyOptions {
+/** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
+interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after the caller is authenticated.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
-declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * predicate that authenticates the caller through Cloudflare Access and applies
+ * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
+ * admin **HTTP** plane (`/_lunora/admin/*` plus `/_lunora/migrate`) in addition
+ * to — or instead of — the static admin bearer, so the Studio's pages can sit
+ * behind Cloudflare Access.
+ *
+ * It does NOT cover `/_lunora/ws`, which is not an admin path: the runtime never
+ * evaluates the gate there. The Studio's live views authenticate their socket
+ * with a sub-token minted at `/_lunora/admin/ws-token`, signed with the static
+ * admin token — so with no `LUNORA_ADMIN_TOKEN` configured, minting refuses
+ * (`ADMIN_TOKEN_NOT_CONFIGURED`) and every live panel fails while the HTTP pages
+ * work. Configure both.
+ *
+ * It accepts exactly one proof, and **which one is your choice, not the
+ * platform's**:
+ *
+ * - Configure `teamDomain` + `aud` and the request's `Cf-Access-Jwt-Assertion`
+ * JWT is the only thing accepted. This is the stricter setup, and the point of
+ * the `aud`: it proves the caller came through the *specific* Access application
+ * you put in front of `/_lunora/admin`, not merely through some application in
+ * the same Cloudflare team.
+ * - Configure neither and the Worker's own Access identity (`context.access`) is
+ * accepted, for a deployment whose Access policy is attached to the Worker.
+ *
+ * Note this is the **opposite** precedence to `createAccessResolver`, which
+ * prefers the platform identity. That is deliberate. A policy attached to the
+ * Worker is typically broad — "anyone at the company", covering every route and
+ * preview URL — while a configured admin `aud` is deliberately narrow. Letting
+ * the broad one satisfy a gate you scoped with the narrow one would widen the
+ * admin plane to everyone the Worker policy admits, silently, the moment that
+ * policy was attached.
+ *
+ * It is **fail-closed**: no identity, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * its context and the runtime can evaluate it without threading async through
+ * every admin route.
+ *
+ * ```ts
+ * // A dedicated Access application over /_lunora/admin — the JWT is the only proof.
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ *
+ * // Access policy attached to the Worker — `isAdmin` is the whole boundary, so
+ * // make it at least as strict as a dedicated admin application would have been.
+ * options.adminGate = accessAdminGate({
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request, context?: ExecutionContextLike) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.mjs

@@ -1,8 +1 @@
-import { verifyRequest } from './packem_shared/accessIssuer-83KYwaCp.mjs';
-
-const accessAdminGate = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? false : options.isAdmin(claims);
-};
-
-export { accessAdminGate };
+import{LunoraError as e}from"@lunora/errors";import{r as n}from"./packem_shared/platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as o,verifyRequest as m}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";const l=i=>{if(typeof i.isAdmin!="function")throw new e("INTERNAL",'accessAdminGate: `isAdmin` is required and must be a function — it is the entire admin boundary, so there is no implicit grant. Pass e.g. `isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false`.');const t=o(i);return async(s,a)=>{const r=t===void 0?await n(a):await m(s,t);return r===void 0?!1:await i.isAdmin(r)===!0}};export{l as accessAdminGate};

package/dist/context.d.mts

@@ -1,14 +1,32 @@
-import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
-import '@lunora/errors';
+import { A as AccessClaims } from "./packem_shared/types.d-Dp399TMk.mjs";
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+/**
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -16,11 +34,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -42,39 +60,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };