@lunora/cloudflare-access 1.0.0-alpha.24 → 1.0.0-alpha.26

package/dist/admin.d.mts

@@ -1,36 +1,36 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.mjs";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
 interface AccessAdminGateOptions extends RequestVerifyOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+ * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+ * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+ * endpoints) in addition to — or instead of — the static admin bearer, so the
+ * Studio can sit behind Cloudflare Access.
+ *
+ * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * the runtime can evaluate it without threading async through every admin route.
+ *
+ * ```ts
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
 declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.d.ts

@@ -1,36 +1,36 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.js";
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.js";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
 interface AccessAdminGateOptions extends RequestVerifyOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+ * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+ * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+ * endpoints) in addition to — or instead of — the static admin bearer, so the
+ * Studio can sit behind Cloudflare Access.
+ *
+ * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * the runtime can evaluate it without threading async through every admin route.
+ *
+ * ```ts
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
 declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/context.d.mts

@@ -1,14 +1,14 @@
-import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
 import '@lunora/errors';
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -16,11 +16,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -42,39 +42,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.d.ts

@@ -1,14 +1,14 @@
-import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.js";
+import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
 import '@lunora/errors';
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -16,11 +16,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -42,39 +42,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/index.d.mts

@@ -1,82 +1,58 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.mjs";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
+ * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+ * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+ * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+ * verified Access user/service-token becomes `ctx.auth` for every
+ * query/mutation/action (and feeds RLS) with no further wiring.
+ *
+ * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+ * fails verification, resolves to `null` (the request proceeds unauthenticated
+ * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+ * verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
 declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Eagerly validate the static, construction-time verify options so a misconfigured
-* deployment fails fast at factory build time instead of degrading to
-* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
-* call this once when built: `teamDomain` must resolve to a valid Access issuer
-* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
-* then covers only genuine token-verification failures, not config mistakes — a
-* broken deployment throws here at startup rather than resolving every caller to
-* anonymous with zero signal.
-*/
-
-/**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.d.ts

@@ -1,82 +1,58 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.js";
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.js";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
+ * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+ * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+ * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+ * verified Access user/service-token becomes `ctx.auth` for every
+ * query/mutation/action (and feeds RLS) with no further wiring.
+ *
+ * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+ * fails verification, resolves to `null` (the request proceeds unauthenticated
+ * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+ * verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
 declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Eagerly validate the static, construction-time verify options so a misconfigured
-* deployment fails fast at factory build time instead of degrading to
-* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
-* call this once when built: `teamDomain` must resolve to a valid Access issuer
-* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
-* then covers only genuine token-verification failures, not config mistakes — a
-* broken deployment throws here at startup rather than resolving every caller to
-* anonymous with zero signal.
-*/
-
-/**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };