@lunora/cloudflare-access 1.0.0-alpha.7 → 1.0.0-alpha.71

package/dist/context.d.ts

@@ -1,13 +1,13 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
+import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -15,11 +15,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -41,39 +41,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.mjs

@@ -1,36 +1 @@
-const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const stringClaim = (value) => typeof value === "string" ? value : void 0;
-const ANONYMOUS_FACADE = {
-  authenticated: false,
-  claims: void 0,
-  commonName: void 0,
-  email: void 0,
-  groups: [],
-  hasGroup: () => false,
-  userId: void 0
-};
-const facadeFor = (identity, userId) => {
-  const raw = identity["access"];
-  if (typeof raw !== "object" || raw === null) {
-    return ANONYMOUS_FACADE;
-  }
-  const claims = raw;
-  const groups = stringList(identity["groups"] ?? claims.groups);
-  return {
-    authenticated: true,
-    claims,
-    commonName: stringClaim(identity["commonName"]) ?? stringClaim(claims.common_name),
-    email: stringClaim(identity["email"]) ?? stringClaim(claims.email),
-    groups,
-    hasGroup: (group) => groups.includes(group),
-    userId
-  };
-};
-const accessFacade = (identity, userId) => identity ? facadeFor(identity, userId ?? void 0) : ANONYMOUS_FACADE;
-const accessContext = () => async ({ ctx, next }) => {
-  const identity = await ctx.auth?.getIdentity?.();
-  const access = accessFacade(identity, ctx.auth?.userId);
-  return next({ ctx: { access } });
-};
-
-export { accessContext, accessFacade };
+import{r as m}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=o=>typeof o=="string"?o:void 0,n={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(o,a)=>{const s=o.access;if(typeof s!="object"||s===null)return n;const e=s,t=m(o)??[];return{authenticated:!0,claims:e,commonName:c(o.commonName)??c(e.common_name),email:c(o.email)??c(e.email),groups:t,hasGroup:r=>t.includes(r),userId:a}},u=(o,a)=>o?i(o,a??void 0):n,l=()=>async({ctx:o,next:a})=>{const s=await o.auth?.getIdentity?.(),e=u(s,o.auth?.userId);return a({ctx:{access:e}})};export{l as accessContext,u as accessFacade};

package/dist/index.d.mts

@@ -1,71 +1,58 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.mjs";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
+ * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+ * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+ * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+ * verified Access user/service-token becomes `ctx.auth` for every
+ * query/mutation/action (and feeds RLS) with no further wiring.
+ *
+ * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+ * fails verification, resolves to `null` (the request proceeds unauthenticated
+ * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+ * verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
 declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.d.ts

@@ -1,71 +1,58 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.js";
+import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
+export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.js";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
+ * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
+ * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
+ * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
+ * verified Access user/service-token becomes `ctx.auth` for every
+ * query/mutation/action (and feeds RLS) with no further wiring.
+ *
+ * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
+ * fails verification, resolves to `null` (the request proceeds unauthenticated
+ * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
+ * verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
 declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.mjs

@@ -1,2 +1 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-C_7T5dDj.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers--vZvblPO.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-B6vVJPus.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/accessIssuer-B6vVJPus.mjs

@@ -0,0 +1 @@
+import{LunoraError as l}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as h}from"jose";const f="cf-access-jwt-assertion",w="CF_Authorization",g=(t,e,r)=>{const c=t.headers.get(e);if(c!==null&&c.length>0)return c;const o=t.headers.get("cookie");if(o!==null)for(const n of o.split(";")){const s=n.indexOf("=");if(s!==-1&&n.slice(0,s).trim()===r){const a=n.slice(s+1).trim();return a.length>0?a:void 0}}},y="/cdn-cgi/access/certs",k=/^https?:\/\//i,A=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},u=t=>{const e=A(t.trim().replace(k,""));if(e.length===0)throw new l("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},i=new Map,E=t=>{let e=i.get(t);return e===void 0&&(e=h(new URL(`${t}${y}`)),i.set(t,e)),e},d=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new l("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},v=t=>{u(t.teamDomain),d(t.aud)},p=async(t,e)=>{const r=u(e.teamDomain),c=d(e.aud),o=e.keySet??E(r),{payload:n}=await m(t,o,{algorithms:["RS256"],audience:c,clockTolerance:e.clockToleranceSec,issuer:r});return n},L=async(t,e)=>{const r=(e.headerName??f).toLowerCase(),c=e.cookieName??w,o=g(t,r,c);if(o!==void 0)try{return await p(o,e)}catch(n){try{e.onError?.(n,t)}catch{}return}};export{u as accessIssuer,v as assertVerifyOptions,p as verifyAccessJwt,L as verifyRequest};

package/dist/packem_shared/composeResolvers--vZvblPO.mjs

@@ -0,0 +1 @@
+import{assertVerifyOptions as i,verifyRequest as c}from"./accessIssuer-B6vVJPus.mjs";const s=null,t=e=>typeof e=="string"&&e.length>0?e:void 0,u=e=>t(e.sub)??t(e.email)??t(e.common_name),m=(e,r)=>{const o=r?.(e)??{},n=t(o.userId)??u(e);return n===void 0?s:{access:e,...e.common_name===void 0?{}:{commonName:e.common_name},...e.email===void 0?{}:{email:e.email},...e.exp===void 0?{}:{exp:e.exp},...e.groups===void 0?{}:{groups:e.groups},...o,userId:n}},v=e=>(i(e),async r=>{const o=await c(r,e);return o===void 0?s:m(o,e.mapClaims)}),f=(...e)=>async(r,o)=>{for(const n of e){const d=await n(r,o);if(d)return d}return s};export{f as composeResolvers,v as createAccessResolver};

package/dist/packem_shared/identity-groups-CCucbpzP.mjs

@@ -0,0 +1 @@
+const n=o=>{const{access:r}=o,t=typeof r=="object"&&r!==null?r.groups:void 0,s=o.groups??t;return Array.isArray(s)?s.filter(e=>typeof e=="string"):void 0};export{n as r};

package/dist/packem_shared/index.d-D7R8k7yf.d.mts

@@ -0,0 +1,21 @@
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+export { Middleware as M };

package/dist/packem_shared/index.d-D7R8k7yf.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+export { Middleware as M };

package/dist/packem_shared/types.d-C8c7Qwx1.d.mts

@@ -0,0 +1,134 @@
+import { JWTPayload, JWTVerifyGetKey, KeyObject } from 'jose';
+/**
+ * The claims Cloudflare Access mints into the `Cf-Access-Jwt-Assertion` JWT.
+ *
+ * Extends the standard `JWTPayload` (`iss`/`aud`/`sub`/`exp`/`iat`/…) with the
+ * Access-specific fields. Which optional fields are present depends on the
+ * caller and the Access application config. SSO users carry `email` (and
+ * `groups` when the policy emits them), with `sub` as the stable user id.
+ * Service tokens carry `common_name` and an empty `sub`; there is no `email`.
+ *
+ * Cloudflare may add further custom claims — they pass through verbatim via the
+ * index signature so the claims stay a faithful view of the token.
+ */
+interface AccessClaims extends JWTPayload {
+  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
+  common_name?: string;
+  /** ISO-3166-1 alpha-2 country the request was authorized from, when available. */
+  country?: string;
+  /** Verified user email. Present for interactive (SSO) callers. */
+  email?: string;
+  /** Identity-provider group memberships, when the Access policy is configured to emit them. */
+  groups?: string[];
+  /** Per-session nonce Cloudflare rotates on re-authentication. */
+  identity_nonce?: string;
+  /** Token kind, e.g. `"app"`. */
+  type?: string;
+}
+/**
+ * The minimal `resolveIdentity` return contract shared with `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity` (`ResolvedIdentity`). Declared structurally so
+ * this package takes no runtime dependency on `@lunora/runtime`; the value is
+ * assignable to the runtime hook.
+ *
+ * `userId` becomes `ctx.auth.userId`; every other key is forwarded (server-side,
+ * unforgeable) into `x-lunora-identity` and surfaced via `ctx.auth.getIdentity()`.
+ * `exp` (JWT epoch **seconds**) drives WebSocket credential expiry — omit it and
+ * a live subscription socket never expires.
+ */
+interface ResolvedIdentityLike {
+  /** All other claims pass through into `ctx.auth.getIdentity()`. */
+  [claim: string]: unknown;
+  /** JWT `exp` in epoch **seconds** (NOT milliseconds). Drives WS socket expiry. */
+  exp?: number;
+  /** Absolute expiry in epoch **milliseconds**. Alternative to `exp`; takes precedence in the runtime. */
+  expiresAtMs?: number;
+  /** The stable caller id. Becomes `ctx.auth.userId` and what `serverDefault(({auth}) => auth.userId)` stamps. */
+  userId: string;
+}
+/**
+ * The verified Access identity produced by `createAccessResolver`. A
+ * {@link ResolvedIdentityLike} with the commonly-used Access claims promoted to
+ * named, camelCased fields (so policies read `auth.identity.groups` etc.) plus
+ * the full raw claim set under `access` for fidelity.
+ */
+interface ResolvedAccessIdentity extends ResolvedIdentityLike {
+  /** The full, verified claim set (snake_cased wire names preserved). */
+  access: AccessClaims;
+  /** Service-token name (`common_name`), for machine callers. */
+  commonName?: string;
+  /** Verified email, for SSO callers. */
+  email?: string;
+  /** IdP group memberships, when emitted by the Access policy. */
+  groups?: string[];
+}
+/**
+ * A key source for `verifyAccessJwt`. Either a `jose` remote/local JWKS getter,
+ * or a single public key (handy for tests that mint their own RS256 tokens).
+ * When omitted, a cached remote JWKS is built from `teamDomain`.
+ */
+type AccessKeySet = CryptoKey | JWTVerifyGetKey | KeyObject | Uint8Array;
+/** Options for `verifyAccessJwt`. */
+interface VerifyAccessJwtOptions {
+  /**
+   * The Access application **AUD tag(s)** (the application audience from the
+   * Access app's Overview). Verification rejects a token whose `aud` does not
+   * include one of these — this is what scopes a token to *your* app.
+   */
+  aud: string | string[];
+  /** Clock-skew tolerance in **seconds** applied to `exp`/`nbf`/`iat`. Default `0`. */
+  clockToleranceSec?: number;
+  /**
+   * Override the verification key source. Primarily for tests; in production
+   * leave unset to use the cached remote JWKS derived from `teamDomain`.
+   */
+  keySet?: AccessKeySet;
+  /**
+   * Your Cloudflare Access team domain. Accepts the short team name (`acme`),
+   * the host (`acme.cloudflareaccess.com`), or a full URL
+   * (`https://acme.cloudflareaccess.com`). Determines both the expected issuer
+   * and the JWKS endpoint.
+   */
+  teamDomain: string;
+}
+/**
+ * Common options for the request-driven Access primitives — how to read the JWT
+ * off the request and what to do when verification fails. Shared by
+ * {@link CreateAccessResolverOptions} and `AccessAdminGateOptions`, which add
+ * their distinct mapping / authorization step on top.
+ */
+interface RequestVerifyOptions extends VerifyAccessJwtOptions {
+  /**
+   * Cookie name carrying the Access JWT when the header is absent (browser
+   * navigations). Default `"CF_Authorization"`.
+   */
+  cookieName?: string;
+  /**
+   * Request header carrying the Access JWT. Default `"cf-access-jwt-assertion"`
+   * (matched case-insensitively).
+   */
+  headerName?: string;
+  /**
+   * Invoked when a token is present but fails verification (bad signature,
+   * wrong audience, expired, …). The caller still fails closed (resolver
+   * returns `null`, admin gate returns `false`); this is your hook to
+   * log/observe. It is **not** called when no token is present at all.
+   */
+  onError?: (error: unknown, request: Request) => void;
+}
+/** Options for `createAccessResolver`; extends {@link RequestVerifyOptions}. */
+interface CreateAccessResolverOptions extends RequestVerifyOptions {
+  /**
+   * Remap verified claims into the resolved identity. Return an object to
+   * shallow-merge over the defaults; return a `userId` to override the derived
+   * caller id. Runs only after signature/issuer/audience/expiry are verified.
+   */
+  mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
+}
+/**
+ * A `resolveIdentity`-shaped function: maps an inbound request to a verified
+ * identity (or `null` for anonymous). Assignable to `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity`.
+ */
+type ResolveIdentityFunction = (request: Request, env?: unknown) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
+export { AccessClaims as A, CreateAccessResolverOptions as C, RequestVerifyOptions as R, VerifyAccessJwtOptions as V, ResolveIdentityFunction as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };