@lunora/cloudflare-access 1.0.0-alpha.3 → 1.0.0-alpha.30

package/LICENSE.md

@@ -103,3 +103,129 @@ Unless required by applicable law or agreed to in writing, software distributed
 under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 CONDITIONS OF ANY KIND, either express or implied. See the License for the
 specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+
+# Licenses of bundled types
+The published @lunora/cloudflare-access artifact additionally contains code with the following licenses:
+FSL-1.1-Apache-2.0
+
+# Bundled types:
+## @lunora/server
+License: FSL-1.1-Apache-2.0
+By: Daniel Bannert
+Repository: git+https://github.com/anolilab/lunora.git
+
+> # Functional Source License, Version 1.1, Apache 2.0 Future License
+>
+> ## Abbreviation
+>
+> FSL-1.1-Apache-2.0
+>
+> ## Notice
+>
+> Copyright 2026 anolilab and contributors
+>
+> ## Terms and Conditions
+>
+> ### Licensor ("We")
+>
+> The party offering the Software under these Terms and Conditions.
+>
+> ### The Software
+>
+> The "Software" is each version of the software that we make available under
+> these Terms and Conditions, as indicated by our inclusion of these Terms and
+> Conditions with the Software.
+>
+> ### License Grant
+>
+> Subject to your compliance with this License Grant and the Patents,
+> Redistribution and Trademark clauses below, we hereby grant you the right to
+> use, copy, modify, create derivative works, publicly perform, publicly display
+> and redistribute the Software for any Permitted Purpose identified below.
+>
+> ### Permitted Purpose
+>
+> A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+> means making the Software available to others in a commercial product or service
+> that:
+>
+> 1. substitutes for the Software;
+>
+> 2. substitutes for any other product or service we offer using the Software that
+>    exists as of the date we make the Software available; or
+>
+> 3. offers the same or substantially similar functionality as the Software.
+>
+> Permitted Purposes specifically include using the Software:
+>
+> 1. for your internal use and access;
+>
+> 2. for non-commercial education;
+>
+> 3. for non-commercial research; and
+>
+> 4. in connection with professional services that you provide to a licensee using
+>    the Software in accordance with these Terms and Conditions.
+>
+> ### Patents
+>
+> To the extent your use for a Permitted Purpose would necessarily infringe our
+> patents, the license grant above includes a license under our patents. If you
+> make a claim against any party that the Software infringes or contributes to the
+> infringement of any patent, then your patent license to the Software ends
+> immediately.
+>
+> ### Redistribution
+>
+> The Terms and Conditions apply to all copies, modifications and derivatives of
+> the Software.
+>
+> If you redistribute any copies, modifications or derivatives of the Software,
+> you must include a copy of or a link to these Terms and Conditions and not
+> remove any copyright notices provided in or with the Software.
+>
+> ### Disclaimer
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+> PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+>
+> IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+> SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN
+> IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+>
+> ### Trademarks
+>
+> Except for displaying the License Details and identifying us as the origin of
+> the Software, you have no right under these Terms and Conditions to use our
+> trademarks, trade names, service marks or product names.
+>
+> ## Grant of Future License
+>
+> We hereby irrevocably grant you an additional license to use the Software under
+> the Apache License, Version 2.0 that is effective on the second anniversary of
+> the date we make the Software available. On or after that date, you may use the
+> Software under the Apache License, Version 2.0, in which case the following will
+> apply:
+>
+> Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+> this file except in compliance with the License.
+>
+> You may obtain a copy of the License at
+>
+> http://www.apache.org/licenses/LICENSE-2.0
+>
+> Unless required by applicable law or agreed to in writing, software distributed
+> under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+> CONDITIONS OF ANY KIND, either express or implied. See the License for the
+> specific language governing permissions and limitations under the License.
+>
+> <!-- DEPENDENCIES -->
+> <!-- /DEPENDENCIES -->
+
+<!-- /TYPE_DEPENDENCIES -->

package/dist/admin.d.mts

@@ -1,36 +1,36 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.mjs";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
 interface AccessAdminGateOptions extends RequestVerifyOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+ * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+ * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+ * endpoints) in addition to — or instead of — the static admin bearer, so the
+ * Studio can sit behind Cloudflare Access.
+ *
+ * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * the runtime can evaluate it without threading async through every admin route.
+ *
+ * ```ts
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
 declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.d.ts

@@ -1,36 +1,36 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-BO8d74KI.js";
+import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.js";
 import 'jose';
 /** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
 interface AccessAdminGateOptions extends RequestVerifyOptions {
   /**
-  * Decide whether the **verified** claims authorize the Studio/admin plane —
-  * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
-  * check. Required: there is no implicit grant, so a verified-but-unprivileged
-  * identity is denied. Runs only after signature/issuer/audience/expiry pass.
-  */
+   * Decide whether the **verified** claims authorize the Studio/admin plane —
+   * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
+   * check. Required: there is no implicit grant, so a verified-but-unprivileged
+   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
-* Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
-* request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
-* JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
-* request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
-* endpoints) in addition to — or instead of — the static admin bearer, so the
-* Studio can sit behind Cloudflare Access.
-*
-* It is **fail-closed**: a missing token, a token that fails verification, or an
-* `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
-* only other path). Verification needs no `env` binding (static team-domain/aud
-* config + the remote JWKS over `fetch`), so the gate takes only the request and
-* the runtime can evaluate it without threading async through every admin route.
-*
-* ```ts
-* options.adminGate = accessAdminGate({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
-*     aud: env.CF_ACCESS_ADMIN_AUD,
-*     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
-* });
-* ```
-*/
+ * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
+ * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
+ * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
+ * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
+ * endpoints) in addition to — or instead of — the static admin bearer, so the
+ * Studio can sit behind Cloudflare Access.
+ *
+ * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
+ * only other path). Verification needs no `env` binding (static team-domain/aud
+ * config + the remote JWKS over `fetch`), so the gate takes only the request and
+ * the runtime can evaluate it without threading async through every admin route.
+ *
+ * ```ts
+ * options.adminGate = accessAdminGate({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
+ *     aud: env.CF_ACCESS_ADMIN_AUD,
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
+ * ```
+ */
 declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.mjs

@@ -1,8 +1 @@
-import { verifyRequest } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
-
-const accessAdminGate = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? false : options.isAdmin(claims);
-};
-
-export { accessAdminGate };
+import{assertVerifyOptions as i,verifyRequest as e}from"./packem_shared/accessIssuer-BdF2LQuC.mjs";const r=s=>(i(s),async t=>{const a=await e(t,s);return a===void 0?!1:s.isAdmin(a)});export{r as accessAdminGate};

package/dist/context.d.mts

@@ -1,13 +1,14 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+import '@lunora/errors';
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -15,11 +16,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -41,39 +42,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.d.ts

@@ -1,13 +1,14 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.js";
+import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
+import '@lunora/errors';
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -15,11 +16,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -41,39 +42,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.mjs

@@ -1,36 +1 @@
-const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const stringClaim = (value) => typeof value === "string" ? value : void 0;
-const ANONYMOUS_FACADE = {
-  authenticated: false,
-  claims: void 0,
-  commonName: void 0,
-  email: void 0,
-  groups: [],
-  hasGroup: () => false,
-  userId: void 0
-};
-const facadeFor = (identity, userId) => {
-  const raw = identity["access"];
-  if (typeof raw !== "object" || raw === null) {
-    return ANONYMOUS_FACADE;
-  }
-  const claims = raw;
-  const groups = stringList(identity["groups"] ?? claims.groups);
-  return {
-    authenticated: true,
-    claims,
-    commonName: stringClaim(identity["commonName"]) ?? stringClaim(claims.common_name),
-    email: stringClaim(identity["email"]) ?? stringClaim(claims.email),
-    groups,
-    hasGroup: (group) => groups.includes(group),
-    userId
-  };
-};
-const accessFacade = (identity, userId) => identity ? facadeFor(identity, userId ?? void 0) : ANONYMOUS_FACADE;
-const accessContext = () => async ({ ctx, next }) => {
-  const identity = await ctx.auth?.getIdentity?.();
-  const access = accessFacade(identity, ctx.auth?.userId);
-  return next({ ctx: { access } });
-};
-
-export { accessContext, accessFacade };
+import{t as m}from"./packem_shared/identity-groups-lzvxGu3k.mjs";const e=t=>typeof t=="string"?t:void 0,i={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},r=(t,a)=>{const o=t.access;if(typeof o!="object"||o===null)return i;const s=o,c=m(t)??[];return{authenticated:!0,claims:s,commonName:e(t.commonName)??e(s.common_name),email:e(t.email)??e(s.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(t,a)=>t?r(t,a??void 0):i,l=()=>async({ctx:t,next:a})=>{const o=await t.auth?.getIdentity?.(),s=u(o,t.auth?.userId);return a({ctx:{access:s}})};export{l as accessContext,u as accessFacade};