@lunora/cloudflare-access 1.0.0-alpha.2 → 1.0.0-alpha.20

package/LICENSE.md

@@ -103,3 +103,129 @@ Unless required by applicable law or agreed to in writing, software distributed
 under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 CONDITIONS OF ANY KIND, either express or implied. See the License for the
 specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+
+# Licenses of bundled types
+The published @lunora/cloudflare-access artifact additionally contains code with the following licenses:
+FSL-1.1-Apache-2.0
+
+# Bundled types:
+## @lunora/server
+License: FSL-1.1-Apache-2.0
+By: Daniel Bannert
+Repository: git+https://github.com/anolilab/lunora.git
+
+> # Functional Source License, Version 1.1, Apache 2.0 Future License
+>
+> ## Abbreviation
+>
+> FSL-1.1-Apache-2.0
+>
+> ## Notice
+>
+> Copyright 2026 anolilab and contributors
+>
+> ## Terms and Conditions
+>
+> ### Licensor ("We")
+>
+> The party offering the Software under these Terms and Conditions.
+>
+> ### The Software
+>
+> The "Software" is each version of the software that we make available under
+> these Terms and Conditions, as indicated by our inclusion of these Terms and
+> Conditions with the Software.
+>
+> ### License Grant
+>
+> Subject to your compliance with this License Grant and the Patents,
+> Redistribution and Trademark clauses below, we hereby grant you the right to
+> use, copy, modify, create derivative works, publicly perform, publicly display
+> and redistribute the Software for any Permitted Purpose identified below.
+>
+> ### Permitted Purpose
+>
+> A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+> means making the Software available to others in a commercial product or service
+> that:
+>
+> 1. substitutes for the Software;
+>
+> 2. substitutes for any other product or service we offer using the Software that
+>    exists as of the date we make the Software available; or
+>
+> 3. offers the same or substantially similar functionality as the Software.
+>
+> Permitted Purposes specifically include using the Software:
+>
+> 1. for your internal use and access;
+>
+> 2. for non-commercial education;
+>
+> 3. for non-commercial research; and
+>
+> 4. in connection with professional services that you provide to a licensee using
+>    the Software in accordance with these Terms and Conditions.
+>
+> ### Patents
+>
+> To the extent your use for a Permitted Purpose would necessarily infringe our
+> patents, the license grant above includes a license under our patents. If you
+> make a claim against any party that the Software infringes or contributes to the
+> infringement of any patent, then your patent license to the Software ends
+> immediately.
+>
+> ### Redistribution
+>
+> The Terms and Conditions apply to all copies, modifications and derivatives of
+> the Software.
+>
+> If you redistribute any copies, modifications or derivatives of the Software,
+> you must include a copy of or a link to these Terms and Conditions and not
+> remove any copyright notices provided in or with the Software.
+>
+> ### Disclaimer
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+> PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+>
+> IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+> SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN
+> IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+>
+> ### Trademarks
+>
+> Except for displaying the License Details and identifying us as the origin of
+> the Software, you have no right under these Terms and Conditions to use our
+> trademarks, trade names, service marks or product names.
+>
+> ## Grant of Future License
+>
+> We hereby irrevocably grant you an additional license to use the Software under
+> the Apache License, Version 2.0 that is effective on the second anniversary of
+> the date we make the Software available. On or after that date, you may use the
+> Software under the Apache License, Version 2.0, in which case the following will
+> apply:
+>
+> Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+> this file except in compliance with the License.
+>
+> You may obtain a copy of the License at
+>
+> http://www.apache.org/licenses/LICENSE-2.0
+>
+> Unless required by applicable law or agreed to in writing, software distributed
+> under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+> CONDITIONS OF ANY KIND, either express or implied. See the License for the
+> specific language governing permissions and limitations under the License.
+>
+> <!-- DEPENDENCIES -->
+> <!-- /DEPENDENCIES -->
+
+<!-- /TYPE_DEPENDENCIES -->

package/dist/admin.mjs

@@ -1,4 +1,4 @@
-import { verifyRequest } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+import { verifyRequest } from './packem_shared/accessIssuer-83KYwaCp.mjs';
 
 const accessAdminGate = (options) => async (request) => {
   const claims = await verifyRequest(request, options);

package/dist/context.d.mts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.d.ts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-C_7T5dDj.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BI3envaN.mjs';
+export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-83KYwaCp.mjs';

package/dist/packem_shared/{accessIssuer-DhKaNoyU.mjs → accessIssuer-83KYwaCp.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 const DEFAULT_HEADER = "cf-access-jwt-assertion";
@@ -36,7 +37,7 @@ const stripTrailingSlashes = (value) => {
 const accessIssuer = (teamDomain) => {
   const trimmed = stripTrailingSlashes(teamDomain.trim().replace(SCHEME_PREFIX, ""));
   if (trimmed.length === 0) {
-    throw new Error('@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
+    throw new LunoraError("INTERNAL", '@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
   }
   const candidate = trimmed.includes(".") ? `https://${trimmed}` : `https://${trimmed}.cloudflareaccess.com`;
   const host = new URL(candidate).host.toLowerCase();
@@ -57,7 +58,8 @@ const verifyAccessJwt = async (token, options) => {
     (entry) => typeof entry === "string" && entry.length > 0
   );
   if (audiences.length === 0) {
-    throw new Error(
+    throw new LunoraError(
+      "INTERNAL",
       "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
     );
   }

package/dist/packem_shared/{composeResolvers-C_7T5dDj.mjs → composeResolvers-BI3envaN.mjs}

@@ -1,4 +1,4 @@
-import { verifyRequest } from './accessIssuer-DhKaNoyU.mjs';
+import { verifyRequest } from './accessIssuer-83KYwaCp.mjs';
 
 const ANONYMOUS = null;
 const deriveUserId = (claims) => {

package/dist/packem_shared/{index.d-C7lOF4ZA.d.mts → index.d-ByAnpUzP.d.mts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/packem_shared/{index.d-C7lOF4ZA.d.ts → index.d-ByAnpUzP.d.ts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/roles.d.mts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.d.ts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.20",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -54,10 +54,11 @@
     "access": "public"
   },
   "dependencies": {
-    "jose": "^6.1.0"
+    "@lunora/errors": "1.0.0-alpha.3",
+    "jose": "^6.2.3"
   },
   "peerDependencies": {
-    "@lunora/server": "1.0.0-alpha.8"
+    "@lunora/server": "1.0.0-alpha.22"
   },
   "peerDependenciesMeta": {
     "@lunora/server": {