@lunora/cloudflare-access 1.0.0-alpha.70 → 1.0.0-alpha.72

package/dist/admin.d.mts

@@ -1,36 +1,63 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-D30o96f7.mjs";
 import 'jose';
-/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
-interface AccessAdminGateOptions extends RequestVerifyOptions {
+/** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
+interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
   /**
    * Decide whether the **verified** claims authorize the Studio/admin plane —
    * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
    * check. Required: there is no implicit grant, so a verified-but-unprivileged
-   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   * identity is denied. Runs only after the caller is authenticated.
    */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
  * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
- * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
- * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
- * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
- * endpoints) in addition to — or instead of — the static admin bearer, so the
- * Studio can sit behind Cloudflare Access.
+ * predicate that authenticates the caller through Cloudflare Access and applies
+ * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
+ * `/_lunora/admin/*` plane (the Studio's HTTP + WS endpoints) in addition to — or
+ * instead of — the static admin bearer, so the Studio can sit behind Cloudflare
+ * Access.
  *
- * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * It accepts exactly one proof, and **which one is your choice, not the
+ * platform's**:
+ *
+ * - Configure `teamDomain` + `aud` and the request's `Cf-Access-Jwt-Assertion`
+ * JWT is the only thing accepted. This is the stricter setup, and the point of
+ * the `aud`: it proves the caller came through the *specific* Access application
+ * you put in front of `/_lunora/admin`, not merely through some application in
+ * the same Cloudflare team.
+ * - Configure neither and the Worker's own Access identity (`context.access`) is
+ * accepted, for a deployment whose Access policy is attached to the Worker.
+ *
+ * Note this is the **opposite** precedence to `createAccessResolver`, which
+ * prefers the platform identity. That is deliberate. A policy attached to the
+ * Worker is typically broad — "anyone at the company", covering every route and
+ * preview URL — while a configured admin `aud` is deliberately narrow. Letting
+ * the broad one satisfy a gate you scoped with the narrow one would widen the
+ * admin plane to everyone the Worker policy admits, silently, the moment that
+ * policy was attached.
+ *
+ * It is **fail-closed**: no identity, a token that fails verification, or an
  * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
  * only other path). Verification needs no `env` binding (static team-domain/aud
  * config + the remote JWKS over `fetch`), so the gate takes only the request and
- * the runtime can evaluate it without threading async through every admin route.
+ * its context and the runtime can evaluate it without threading async through
+ * every admin route.
  *
  * ```ts
+ * // A dedicated Access application over /_lunora/admin — the JWT is the only proof.
  * options.adminGate = accessAdminGate({
  *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
  *     aud: env.CF_ACCESS_ADMIN_AUD,
  *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
  * });
+ *
+ * // Access policy attached to the Worker — `isAdmin` is the whole boundary, so
+ * // make it at least as strict as a dedicated admin application would have been.
+ * options.adminGate = accessAdminGate({
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
  * ```
  */
-declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request, context?: ExecutionContextLike) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.d.ts

@@ -1,36 +1,63 @@
-import { A as AccessClaims, R as RequestVerifyOptions } from "./packem_shared/types.d-C8c7Qwx1.js";
+import { A as AccessClaims, a as AccessJwtFallbackOptions, E as ExecutionContextLike } from "./packem_shared/types.d-D30o96f7.js";
 import 'jose';
-/** Options for {@link accessAdminGate}; extends {@link RequestVerifyOptions}. */
-interface AccessAdminGateOptions extends RequestVerifyOptions {
+/** Options for {@link accessAdminGate}; extends {@link AccessJwtFallbackOptions}. */
+interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
   /**
    * Decide whether the **verified** claims authorize the Studio/admin plane —
    * e.g. `(claims) => claims.groups?.includes("ops") ?? false` or an email-domain
    * check. Required: there is no implicit grant, so a verified-but-unprivileged
-   * identity is denied. Runs only after signature/issuer/audience/expiry pass.
+   * identity is denied. Runs only after the caller is authenticated.
    */
   isAdmin: (claims: AccessClaims) => boolean | Promise<boolean>;
 }
 /**
  * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
- * request-only predicate that verifies the request's `Cf-Access-Jwt-Assertion`
- * JWT and applies your `isAdmin(claims)` test. When it resolves `true` the
- * request authorizes the `/_lunora/admin/*` plane (the Studio's HTTP + WS
- * endpoints) in addition to — or instead of — the static admin bearer, so the
- * Studio can sit behind Cloudflare Access.
+ * predicate that authenticates the caller through Cloudflare Access and applies
+ * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
+ * `/_lunora/admin/*` plane (the Studio's HTTP + WS endpoints) in addition to — or
+ * instead of — the static admin bearer, so the Studio can sit behind Cloudflare
+ * Access.
  *
- * It is **fail-closed**: a missing token, a token that fails verification, or an
+ * It accepts exactly one proof, and **which one is your choice, not the
+ * platform's**:
+ *
+ * - Configure `teamDomain` + `aud` and the request's `Cf-Access-Jwt-Assertion`
+ * JWT is the only thing accepted. This is the stricter setup, and the point of
+ * the `aud`: it proves the caller came through the *specific* Access application
+ * you put in front of `/_lunora/admin`, not merely through some application in
+ * the same Cloudflare team.
+ * - Configure neither and the Worker's own Access identity (`context.access`) is
+ * accepted, for a deployment whose Access policy is attached to the Worker.
+ *
+ * Note this is the **opposite** precedence to `createAccessResolver`, which
+ * prefers the platform identity. That is deliberate. A policy attached to the
+ * Worker is typically broad — "anyone at the company", covering every route and
+ * preview URL — while a configured admin `aud` is deliberately narrow. Letting
+ * the broad one satisfy a gate you scoped with the narrow one would widen the
+ * admin plane to everyone the Worker policy admits, silently, the moment that
+ * policy was attached.
+ *
+ * It is **fail-closed**: no identity, a token that fails verification, or an
  * `isAdmin` that returns `false` all resolve to `false` (the bearer remains the
  * only other path). Verification needs no `env` binding (static team-domain/aud
  * config + the remote JWKS over `fetch`), so the gate takes only the request and
- * the runtime can evaluate it without threading async through every admin route.
+ * its context and the runtime can evaluate it without threading async through
+ * every admin route.
  *
  * ```ts
+ * // A dedicated Access application over /_lunora/admin — the JWT is the only proof.
  * options.adminGate = accessAdminGate({
  *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN,
  *     aud: env.CF_ACCESS_ADMIN_AUD,
  *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
  * });
+ *
+ * // Access policy attached to the Worker — `isAdmin` is the whole boundary, so
+ * // make it at least as strict as a dedicated admin application would have been.
+ * options.adminGate = accessAdminGate({
+ *     isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false,
+ * });
  * ```
  */
-declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request) => Promise<boolean>);
+declare const accessAdminGate: (options: AccessAdminGateOptions) => ((request: Request, context?: ExecutionContextLike) => Promise<boolean>);
 export { type AccessAdminGateOptions, accessAdminGate };

package/dist/admin.mjs

@@ -1 +1 @@
-import{assertVerifyOptions as t,verifyRequest as a}from"./packem_shared/accessIssuer-B6vVJPus.mjs";const c=e=>(t(e),async s=>{const r=await a(s,e);return r===void 0?!1:e.isAdmin(r)});export{c as accessAdminGate};
+import{r as e}from"./packem_shared/platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as o,verifyRequest as n}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";const d=t=>{const a=o(t);return async(s,i)=>{const r=a===void 0?await e(i):await n(s,a);return r===void 0?!1:t.isAdmin(r)}};export{d as accessAdminGate};

package/dist/context.d.mts

@@ -1,5 +1,5 @@
 import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
 import 'jose';
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.d.ts

@@ -1,5 +1,5 @@
 import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
-import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
+import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
 import 'jose';
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/index.d.mts

@@ -1,28 +1,46 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.mjs";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.mjs";
 import 'jose';
 /**
- * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
- * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
- * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
- * verified Access user/service-token becomes `ctx.auth` for every
- * query/mutation/action (and feeds RLS) with no further wiring.
+ * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access
+ * user or service token becomes `ctx.auth` for every query/mutation/action (and
+ * feeds RLS) with no further wiring.
  *
- * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
- * fails verification, resolves to `null` (the request proceeds unauthenticated
- * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
- * verification failures.
+ * It authenticates from whichever of the two Access shapes the deployment uses,
+ * **platform identity first**:
+ *
+ * 1. `context.access` — the identity Cloudflare attaches when the Access policy
+ * is attached to the **Worker** (covering its custom domains, routes,
+ * `workers.dev`, and preview URLs at once). Nothing is verified because nothing
+ * can be forged: the platform authenticated the caller before the Worker ran,
+ * and the field is absent unless it did. No JWKS fetch, no `aud` to get wrong.
+ * This is also what `wrangler.jsonc`'s `access.dev` block simulates, so a
+ * locally-simulated identity reaches `ctx.auth` too.
+ * 2. The `Cf-Access-Jwt-Assertion` header (or `CF_Authorization` cookie),
+ * verified against your team JWKS. Needed for **hostname-scoped** Access
+ * applications, which do not populate `context.access`. Configured by passing
+ * `teamDomain` + `aud`; omit both (or pass no options at all) to run
+ * platform-identity-only.
+ *
+ * Behaviour is **fail-closed → anonymous** on both paths: no identity, or a token
+ * that fails verification, resolves to `null` (the request proceeds
+ * unauthenticated and RLS denies). Use {@link CreateAccessResolverOptions.onError}
+ * to observe verification failures.
  *
  * Wire it in your worker entry:
  *
  * ```ts
+ * // Access policy attached to the Worker — nothing to configure.
+ * options.resolveIdentity = createAccessResolver();
+ *
+ * // Hostname-scoped Access application — JWT verification config required.
  * options.resolveIdentity = createAccessResolver({
  *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
  *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
  * });
  * ```
  */
-declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+declare const createAccessResolver: (options?: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
  * Compose several `resolveIdentity` adapters into one: each is tried in order
  * and the first to return a non-null identity wins. The canonical use is

package/dist/index.d.ts

@@ -1,28 +1,46 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-C8c7Qwx1.js";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.js";
 import 'jose';
 /**
- * Create a `resolveIdentity` adapter for Cloudflare Access. The returned
- * function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
- * and maps the claims onto the identity shape `@lunora/runtime` expects — so a
- * verified Access user/service-token becomes `ctx.auth` for every
- * query/mutation/action (and feeds RLS) with no further wiring.
+ * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access
+ * user or service token becomes `ctx.auth` for every query/mutation/action (and
+ * feeds RLS) with no further wiring.
  *
- * Behaviour is **fail-closed → anonymous**: a missing token, or a token that
- * fails verification, resolves to `null` (the request proceeds unauthenticated
- * and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
- * verification failures.
+ * It authenticates from whichever of the two Access shapes the deployment uses,
+ * **platform identity first**:
+ *
+ * 1. `context.access` — the identity Cloudflare attaches when the Access policy
+ * is attached to the **Worker** (covering its custom domains, routes,
+ * `workers.dev`, and preview URLs at once). Nothing is verified because nothing
+ * can be forged: the platform authenticated the caller before the Worker ran,
+ * and the field is absent unless it did. No JWKS fetch, no `aud` to get wrong.
+ * This is also what `wrangler.jsonc`'s `access.dev` block simulates, so a
+ * locally-simulated identity reaches `ctx.auth` too.
+ * 2. The `Cf-Access-Jwt-Assertion` header (or `CF_Authorization` cookie),
+ * verified against your team JWKS. Needed for **hostname-scoped** Access
+ * applications, which do not populate `context.access`. Configured by passing
+ * `teamDomain` + `aud`; omit both (or pass no options at all) to run
+ * platform-identity-only.
+ *
+ * Behaviour is **fail-closed → anonymous** on both paths: no identity, or a token
+ * that fails verification, resolves to `null` (the request proceeds
+ * unauthenticated and RLS denies). Use {@link CreateAccessResolverOptions.onError}
+ * to observe verification failures.
  *
  * Wire it in your worker entry:
  *
  * ```ts
+ * // Access policy attached to the Worker — nothing to configure.
+ * options.resolveIdentity = createAccessResolver();
+ *
+ * // Hostname-scoped Access application — JWT verification config required.
  * options.resolveIdentity = createAccessResolver({
  *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
  *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
  * });
  * ```
  */
-declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+declare const createAccessResolver: (options?: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
  * Compose several `resolveIdentity` adapters into one: each is tried in order
  * and the first to return a non-null identity wins. The canonical use is

package/dist/index.mjs

@@ -1 +1 @@
-import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers--vZvblPO.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-B6vVJPus.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-JBsWQvv4.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/accessIssuer-CLO6p5MF.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as f}from"jose";const h="cf-access-jwt-assertion",w="CF_Authorization",y=(t,e,r)=>{const o=t.headers.get(e);if(o!==null&&o.length>0)return o;const n=t.headers.get("cookie");if(n!==null)for(const c of n.split(";")){const s=c.indexOf("=");if(s!==-1&&c.slice(0,s).trim()===r){const i=c.slice(s+1).trim();return i.length>0?i:void 0}}},A="/cdn-cgi/access/certs",g=/^https?:\/\//i,v=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},d=t=>{const e=v(t.trim().replace(g,""));if(e.length===0)throw new a("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},l=new Map,E=t=>{let e=l.get(t);return e===void 0&&(e=f(new URL(`${t}${A}`)),l.set(t,e)),e},u=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new a("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},k=t=>{d(t.teamDomain),u(t.aud)},S=t=>{if(t===void 0||!("aud"in t)&&!("teamDomain"in t))return;const{aud:e,teamDomain:r}=t;if(e===void 0||r===void 0)throw new a("INTERNAL","@lunora/cloudflare-access: `teamDomain` and `aud` must both be set to verify the Cf-Access-Jwt-Assertion JWT (check that CF_ACCESS_TEAM_DOMAIN / CF_ACCESS_AUD are set in this environment) — to authenticate only off the Worker's Cloudflare Access identity, omit both options entirely");const o={...t,aud:e,teamDomain:r};return k(o),o},C=async(t,e)=>{const r=d(e.teamDomain),o=u(e.aud),n=e.keySet??E(r),{payload:c}=await m(t,n,{algorithms:["RS256"],audience:o,clockTolerance:e.clockToleranceSec,issuer:r});return c},p=async(t,e)=>{const r=(e.headerName??h).toLowerCase(),o=e.cookieName??w,n=y(t,r,o);if(n!==void 0)try{return await C(n,e)}catch(c){try{e.onError?.(c,t)}catch{}return}};export{d as accessIssuer,S as assertJwtFallbackOptions,k as assertVerifyOptions,C as verifyAccessJwt,p as verifyRequest};

package/dist/packem_shared/composeResolvers-JBsWQvv4.mjs

@@ -0,0 +1 @@
+import{r as c}from"./platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as m,verifyRequest as p}from"./accessIssuer-CLO6p5MF.mjs";const d=null,s=o=>typeof o=="string"&&o.length>0?o:void 0,v=o=>s(o.sub)??s(o.email)??s(o.common_name),a=(o,e)=>{const t=e?.(o)??{},n=s(t.userId)??v(o);return n===void 0?d:{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...t,userId:n}},y=o=>{const e=m(o);return async(t,n,i)=>{const r=await c(i)??(e===void 0?void 0:await p(t,e));return r===void 0?d:a(r,o?.mapClaims)}},g=(...o)=>async(e,t,n)=>{for(const i of o){const r=await i(e,t,n);if(r)return r}return d};export{g as composeResolvers,y as createAccessResolver};

package/dist/packem_shared/platform-identity-Dy6G1EoF.mjs

@@ -0,0 +1 @@
+const s=t=>{if(typeof t=="string")return t.length>0?t:void 0;if(typeof t=="object"&&t!==null){const{name:o}=t;return typeof o=="string"&&o.length>0?o:void 0}},a=t=>Array.isArray(t)?t.map(o=>s(o)).filter(o=>o!==void 0):void 0,c=async t=>{const o=t?.access;if(o===void 0)return;let r;try{r=await o.getIdentity()}catch{return}if(r===null||typeof r!="object")return;const{groups:n,...e}=r,i=a(n);return i===void 0?e:{...e,groups:i}};export{c as r};

package/dist/packem_shared/types.d-D30o96f7.d.mts

@@ -0,0 +1,256 @@
+import { JWTPayload, JWTVerifyGetKey, KeyObject } from 'jose';
+/**
+ * The subset of the Cloudflare `ExecutionContext` the Lunora worker entry and
+ * the framework mount seams rely on — `waitUntil` for fire-and-forget work that
+ * must outlive the response, and `passThroughOnException` for the top-level
+ * error posture.
+ *
+ * It is deliberately **not** a package. `@lunora/runtime` is the leaf server
+ * runtime and `@lunora/nuxt` is a framework integration that intentionally does
+ * not depend on `@lunora/runtime`'s worker types, yet both need this exact
+ * shape: the runtime to build/forward the worker `fetch`, Nuxt to forward an
+ * inbound request to the user's composed worker. Each imports this file by
+ * relative path and the bundler (packem/rollup) inlines it: no runtime
+ * dependency edge is created, the helper is duplicated only in emitted output,
+ * never in source. One source of truth, zero deps. See AGENTS.md → "Top-level
+ * `shared/` — bundler-inlined source".
+ *
+ * Both methods are **optional**: a real Cloudflare `ExecutionContext` always
+ * supplies them, but a host that mounts Lunora as a sub-handler (Nitro/H3, a
+ * non-Cloudflare preview, a unit test) may hand over a partial context or none
+ * at all. Callers therefore invoke them defensively (`ctx.waitUntil?.(…)`) or
+ * fall back to {@link NOOP_EXECUTION_CONTEXT}.
+ */
+interface ExecutionContextLike {
+  /**
+   * Present only when Cloudflare Access authenticated the request against a
+   * policy attached to the **Worker** (rather than to a hostname). `undefined`
+   * on every unauthenticated request, so its presence is itself the "Access
+   * authorized this caller" signal — see {@link AccessContextLike}.
+   */
+  access?: AccessContextLike;
+  cache?: {
+    purge: (options: {
+      purgeEverything?: boolean;
+      tags?: string[];
+    }) => Promise<unknown>;
+  };
+  passThroughOnException?: () => void;
+  waitUntil?: (promise: Promise<unknown>) => void;
+}
+/**
+ * The identity Cloudflare Access attaches to a Worker-protected request.
+ *
+ * Shape follows the Access application-token payload: `sub` is the stable per-user
+ * id, `email` the verified address, `common_name` the service-token name (machine
+ * callers, whose `sub` is empty), and `exp` the credential expiry in epoch
+ * **seconds**. Group membership is whatever the Access policy emits — a list of
+ * names, or of `{ id, name }` objects — hence `unknown`; normalize before use.
+ *
+ * Cloudflare may add further fields, so the index signature keeps them rather
+ * than dropping them: this is a view of a payload we do not own.
+ */
+interface AccessIdentityLike {
+  [claim: string]: unknown;
+  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
+  common_name?: string;
+  /** Verified user email. Present for interactive (SSO) callers. */
+  email?: string;
+  /** Credential expiry, epoch **seconds**. */
+  exp?: number;
+  /** IdP group membership — names or `{ id, name }` objects, depending on the policy. */
+  groups?: unknown;
+  /** Display name from the identity provider, when it emits one. */
+  name?: string;
+  /** Stable per-user id, and what consumers key a user on. Empty for service tokens. */
+  sub?: string;
+  /** Cloudflare's per-user UUID. Carried through, but deliberately not used as an id — only this path emits it, so keying on it would not match the JWT path. */
+  user_uuid?: string;
+}
+/**
+ * The `ctx.access` facade Cloudflare exposes on a Worker protected by Access.
+ *
+ * Reading the identity from here is preferable to verifying the
+ * `Cf-Access-Jwt-Assertion` header: the platform has already authenticated the
+ * caller, so there is no JWKS fetch, no audience check to get wrong, and nothing
+ * a request can forge — the field simply does not exist unless Access authorized
+ * the call. The header path remains the fallback for hostname-scoped Access
+ * applications, which do not populate this.
+ */
+interface AccessContextLike {
+  getIdentity: () => AccessIdentityLike | null | undefined | Promise<AccessIdentityLike | null | undefined>;
+}
+/**
+ * The verified claims of a Cloudflare Access caller — from the
+ * `Cf-Access-Jwt-Assertion` JWT (hostname-scoped Access applications) or from the
+ * platform-supplied `ctx.access.getIdentity()` (Access policies attached to the
+ * Worker). Both paths produce this one shape, so nothing downstream branches on
+ * how the caller was authenticated.
+ *
+ * Extends the standard `JWTPayload` (`iss`/`aud`/`sub`/`exp`/`iat`/…) with the
+ * Access-specific fields. Which optional fields are present depends on the
+ * caller and the Access application config. SSO users carry `email` (and
+ * `groups` when the policy emits them), with `sub` as the stable user id.
+ * Service tokens carry `common_name` and an empty `sub`; there is no `email`.
+ *
+ * Cloudflare may add further custom claims — they pass through verbatim via the
+ * index signature so the claims stay a faithful view of the identity.
+ */
+interface AccessClaims extends JWTPayload {
+  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
+  common_name?: string;
+  /** ISO-3166-1 alpha-2 country the request was authorized from, when available. */
+  country?: string;
+  /** Verified user email. Present for interactive (SSO) callers. */
+  email?: string;
+  /** Identity-provider group memberships, when the Access policy is configured to emit them. */
+  groups?: string[];
+  /** Per-session nonce Cloudflare rotates on re-authentication. */
+  identity_nonce?: string;
+  /** Display name from the identity provider. Populated on the platform-supplied identity, not on the JWT. */
+  name?: string;
+  /** Token kind, e.g. `"app"`. */
+  type?: string;
+  /** Cloudflare's per-user UUID. Populated on the platform-supplied identity, not on the JWT — so `userId` is deliberately never derived from it. */
+  user_uuid?: string;
+}
+/**
+ * The minimal `resolveIdentity` return contract shared with `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity` (`ResolvedIdentity`). Declared structurally so
+ * this package takes no runtime dependency on `@lunora/runtime`; the value is
+ * assignable to the runtime hook.
+ *
+ * `userId` becomes `ctx.auth.userId`; every other key is forwarded (server-side,
+ * unforgeable) into `x-lunora-identity` and surfaced via `ctx.auth.getIdentity()`.
+ * `exp` (JWT epoch **seconds**) drives WebSocket credential expiry — omit it and
+ * a live subscription socket never expires.
+ */
+interface ResolvedIdentityLike {
+  /** All other claims pass through into `ctx.auth.getIdentity()`. */
+  [claim: string]: unknown;
+  /** JWT `exp` in epoch **seconds** (NOT milliseconds). Drives WS socket expiry. */
+  exp?: number;
+  /** Absolute expiry in epoch **milliseconds**. Alternative to `exp`; takes precedence in the runtime. */
+  expiresAtMs?: number;
+  /** The stable caller id. Becomes `ctx.auth.userId` and what `serverDefault(({auth}) => auth.userId)` stamps. */
+  userId: string;
+}
+/**
+ * The verified Access identity produced by `createAccessResolver`. A
+ * {@link ResolvedIdentityLike} with the commonly-used Access claims promoted to
+ * named, camelCased fields (so policies read `auth.identity.groups` etc.) plus
+ * the full raw claim set under `access` for fidelity.
+ */
+interface ResolvedAccessIdentity extends ResolvedIdentityLike {
+  /** The full, verified claim set (snake_cased wire names preserved). */
+  access: AccessClaims;
+  /** Service-token name (`common_name`), for machine callers. */
+  commonName?: string;
+  /** Verified email, for SSO callers. */
+  email?: string;
+  /** IdP group memberships, when emitted by the Access policy. */
+  groups?: string[];
+}
+/**
+ * A key source for `verifyAccessJwt`. Either a `jose` remote/local JWKS getter,
+ * or a single public key (handy for tests that mint their own RS256 tokens).
+ * When omitted, a cached remote JWKS is built from `teamDomain`.
+ */
+type AccessKeySet = CryptoKey | JWTVerifyGetKey | KeyObject | Uint8Array;
+/** Options for `verifyAccessJwt`. */
+interface VerifyAccessJwtOptions {
+  /**
+   * The Access application **AUD tag(s)** (the application audience from the
+   * Access app's Overview). Verification rejects a token whose `aud` does not
+   * include one of these — this is what scopes a token to *your* app.
+   */
+  aud: string | string[];
+  /** Clock-skew tolerance in **seconds** applied to `exp`/`nbf`/`iat`. Default `0`. */
+  clockToleranceSec?: number;
+  /**
+   * Override the verification key source. Primarily for tests; in production
+   * leave unset to use the cached remote JWKS derived from `teamDomain`.
+   */
+  keySet?: AccessKeySet;
+  /**
+   * Your Cloudflare Access team domain. Accepts the short team name (`acme`),
+   * the host (`acme.cloudflareaccess.com`), or a full URL
+   * (`https://acme.cloudflareaccess.com`). Determines both the expected issuer
+   * and the JWKS endpoint.
+   */
+  teamDomain: string;
+}
+/**
+ * Common options for the request-driven Access primitives — how to read the JWT
+ * off the request and what to do when verification fails. Shared by
+ * {@link CreateAccessResolverOptions} and `AccessAdminGateOptions`, which add
+ * their distinct mapping / authorization step on top.
+ */
+interface RequestVerifyOptions extends VerifyAccessJwtOptions {
+  /**
+   * Cookie name carrying the Access JWT when the header is absent (browser
+   * navigations). Default `"CF_Authorization"`.
+   */
+  cookieName?: string;
+  /**
+   * Request header carrying the Access JWT. Default `"cf-access-jwt-assertion"`
+   * (matched case-insensitively).
+   */
+  headerName?: string;
+  /**
+   * Invoked when a token is present but fails verification (bad signature,
+   * wrong audience, expired, …). The caller still fails closed (resolver
+   * returns `null`, admin gate returns `false`); this is your hook to
+   * log/observe. It is **not** called when no token is present at all.
+   */
+  onError?: (error: unknown, request: Request) => void;
+}
+/**
+ * {@link RequestVerifyOptions} with the JWT-verification config made optional,
+ * for the primitives that can also authenticate off the platform-supplied
+ * identity (`ctx.access`) and therefore may legitimately be given no JWT config
+ * at all.
+ *
+ * The two fields are **all-or-nothing**: supply both to enable the
+ * `Cf-Access-Jwt-Assertion` fallback (needed for hostname-scoped Access
+ * applications, which do not populate `ctx.access`), or neither to run
+ * platform-identity-only. Supplying exactly one throws at construction — that is
+ * always a misconfiguration (classically an unset `env.CF_ACCESS_AUD`), and
+ * silently degrading it to "no JWT fallback" would turn a broken deployment into
+ * a quietly anonymous one.
+ */
+interface AccessJwtFallbackOptions extends Omit<RequestVerifyOptions, "aud" | "teamDomain"> {
+  /**
+   * The Access application **AUD tag(s)**. Required together with `teamDomain`
+   * to enable JWT verification; omit both to authenticate only off the
+   * platform-supplied identity.
+   */
+  aud?: string | string[];
+  /**
+   * Your Cloudflare Access team domain. Required together with `aud` to enable
+   * JWT verification; omit both to authenticate only off the platform-supplied
+   * identity.
+   */
+  teamDomain?: string;
+}
+/** Options for `createAccessResolver`; extends {@link AccessJwtFallbackOptions}. */
+interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
+  /**
+   * Remap verified claims into the resolved identity. Return an object to
+   * shallow-merge over the defaults; return a `userId` to override the derived
+   * caller id. Runs only after signature/issuer/audience/expiry are verified.
+   */
+  mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
+}
+/**
+ * A `resolveIdentity`-shaped function: maps an inbound request to a verified
+ * identity (or `null` for anonymous). Assignable to `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity`.
+ *
+ * The third argument is the request's `ExecutionContext`, which the runtime
+ * forwards so a resolver can read the identity Cloudflare Access attaches to a
+ * Worker-protected request (`context.access`). It is `undefined` on paths that
+ * have no context to give, so a resolver must handle its absence.
+ */
+type ResolveIdentityFunction = (request: Request, env?: unknown, context?: ExecutionContextLike) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
+export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };

package/dist/packem_shared/types.d-D30o96f7.d.ts

@@ -0,0 +1,256 @@
+import { JWTPayload, JWTVerifyGetKey, KeyObject } from 'jose';
+/**
+ * The subset of the Cloudflare `ExecutionContext` the Lunora worker entry and
+ * the framework mount seams rely on — `waitUntil` for fire-and-forget work that
+ * must outlive the response, and `passThroughOnException` for the top-level
+ * error posture.
+ *
+ * It is deliberately **not** a package. `@lunora/runtime` is the leaf server
+ * runtime and `@lunora/nuxt` is a framework integration that intentionally does
+ * not depend on `@lunora/runtime`'s worker types, yet both need this exact
+ * shape: the runtime to build/forward the worker `fetch`, Nuxt to forward an
+ * inbound request to the user's composed worker. Each imports this file by
+ * relative path and the bundler (packem/rollup) inlines it: no runtime
+ * dependency edge is created, the helper is duplicated only in emitted output,
+ * never in source. One source of truth, zero deps. See AGENTS.md → "Top-level
+ * `shared/` — bundler-inlined source".
+ *
+ * Both methods are **optional**: a real Cloudflare `ExecutionContext` always
+ * supplies them, but a host that mounts Lunora as a sub-handler (Nitro/H3, a
+ * non-Cloudflare preview, a unit test) may hand over a partial context or none
+ * at all. Callers therefore invoke them defensively (`ctx.waitUntil?.(…)`) or
+ * fall back to {@link NOOP_EXECUTION_CONTEXT}.
+ */
+interface ExecutionContextLike {
+  /**
+   * Present only when Cloudflare Access authenticated the request against a
+   * policy attached to the **Worker** (rather than to a hostname). `undefined`
+   * on every unauthenticated request, so its presence is itself the "Access
+   * authorized this caller" signal — see {@link AccessContextLike}.
+   */
+  access?: AccessContextLike;
+  cache?: {
+    purge: (options: {
+      purgeEverything?: boolean;
+      tags?: string[];
+    }) => Promise<unknown>;
+  };
+  passThroughOnException?: () => void;
+  waitUntil?: (promise: Promise<unknown>) => void;
+}
+/**
+ * The identity Cloudflare Access attaches to a Worker-protected request.
+ *
+ * Shape follows the Access application-token payload: `sub` is the stable per-user
+ * id, `email` the verified address, `common_name` the service-token name (machine
+ * callers, whose `sub` is empty), and `exp` the credential expiry in epoch
+ * **seconds**. Group membership is whatever the Access policy emits — a list of
+ * names, or of `{ id, name }` objects — hence `unknown`; normalize before use.
+ *
+ * Cloudflare may add further fields, so the index signature keeps them rather
+ * than dropping them: this is a view of a payload we do not own.
+ */
+interface AccessIdentityLike {
+  [claim: string]: unknown;
+  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
+  common_name?: string;
+  /** Verified user email. Present for interactive (SSO) callers. */
+  email?: string;
+  /** Credential expiry, epoch **seconds**. */
+  exp?: number;
+  /** IdP group membership — names or `{ id, name }` objects, depending on the policy. */
+  groups?: unknown;
+  /** Display name from the identity provider, when it emits one. */
+  name?: string;
+  /** Stable per-user id, and what consumers key a user on. Empty for service tokens. */
+  sub?: string;
+  /** Cloudflare's per-user UUID. Carried through, but deliberately not used as an id — only this path emits it, so keying on it would not match the JWT path. */
+  user_uuid?: string;
+}
+/**
+ * The `ctx.access` facade Cloudflare exposes on a Worker protected by Access.
+ *
+ * Reading the identity from here is preferable to verifying the
+ * `Cf-Access-Jwt-Assertion` header: the platform has already authenticated the
+ * caller, so there is no JWKS fetch, no audience check to get wrong, and nothing
+ * a request can forge — the field simply does not exist unless Access authorized
+ * the call. The header path remains the fallback for hostname-scoped Access
+ * applications, which do not populate this.
+ */
+interface AccessContextLike {
+  getIdentity: () => AccessIdentityLike | null | undefined | Promise<AccessIdentityLike | null | undefined>;
+}
+/**
+ * The verified claims of a Cloudflare Access caller — from the
+ * `Cf-Access-Jwt-Assertion` JWT (hostname-scoped Access applications) or from the
+ * platform-supplied `ctx.access.getIdentity()` (Access policies attached to the
+ * Worker). Both paths produce this one shape, so nothing downstream branches on
+ * how the caller was authenticated.
+ *
+ * Extends the standard `JWTPayload` (`iss`/`aud`/`sub`/`exp`/`iat`/…) with the
+ * Access-specific fields. Which optional fields are present depends on the
+ * caller and the Access application config. SSO users carry `email` (and
+ * `groups` when the policy emits them), with `sub` as the stable user id.
+ * Service tokens carry `common_name` and an empty `sub`; there is no `email`.
+ *
+ * Cloudflare may add further custom claims — they pass through verbatim via the
+ * index signature so the claims stay a faithful view of the identity.
+ */
+interface AccessClaims extends JWTPayload {
+  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
+  common_name?: string;
+  /** ISO-3166-1 alpha-2 country the request was authorized from, when available. */
+  country?: string;
+  /** Verified user email. Present for interactive (SSO) callers. */
+  email?: string;
+  /** Identity-provider group memberships, when the Access policy is configured to emit them. */
+  groups?: string[];
+  /** Per-session nonce Cloudflare rotates on re-authentication. */
+  identity_nonce?: string;
+  /** Display name from the identity provider. Populated on the platform-supplied identity, not on the JWT. */
+  name?: string;
+  /** Token kind, e.g. `"app"`. */
+  type?: string;
+  /** Cloudflare's per-user UUID. Populated on the platform-supplied identity, not on the JWT — so `userId` is deliberately never derived from it. */
+  user_uuid?: string;
+}
+/**
+ * The minimal `resolveIdentity` return contract shared with `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity` (`ResolvedIdentity`). Declared structurally so
+ * this package takes no runtime dependency on `@lunora/runtime`; the value is
+ * assignable to the runtime hook.
+ *
+ * `userId` becomes `ctx.auth.userId`; every other key is forwarded (server-side,
+ * unforgeable) into `x-lunora-identity` and surfaced via `ctx.auth.getIdentity()`.
+ * `exp` (JWT epoch **seconds**) drives WebSocket credential expiry — omit it and
+ * a live subscription socket never expires.
+ */
+interface ResolvedIdentityLike {
+  /** All other claims pass through into `ctx.auth.getIdentity()`. */
+  [claim: string]: unknown;
+  /** JWT `exp` in epoch **seconds** (NOT milliseconds). Drives WS socket expiry. */
+  exp?: number;
+  /** Absolute expiry in epoch **milliseconds**. Alternative to `exp`; takes precedence in the runtime. */
+  expiresAtMs?: number;
+  /** The stable caller id. Becomes `ctx.auth.userId` and what `serverDefault(({auth}) => auth.userId)` stamps. */
+  userId: string;
+}
+/**
+ * The verified Access identity produced by `createAccessResolver`. A
+ * {@link ResolvedIdentityLike} with the commonly-used Access claims promoted to
+ * named, camelCased fields (so policies read `auth.identity.groups` etc.) plus
+ * the full raw claim set under `access` for fidelity.
+ */
+interface ResolvedAccessIdentity extends ResolvedIdentityLike {
+  /** The full, verified claim set (snake_cased wire names preserved). */
+  access: AccessClaims;
+  /** Service-token name (`common_name`), for machine callers. */
+  commonName?: string;
+  /** Verified email, for SSO callers. */
+  email?: string;
+  /** IdP group memberships, when emitted by the Access policy. */
+  groups?: string[];
+}
+/**
+ * A key source for `verifyAccessJwt`. Either a `jose` remote/local JWKS getter,
+ * or a single public key (handy for tests that mint their own RS256 tokens).
+ * When omitted, a cached remote JWKS is built from `teamDomain`.
+ */
+type AccessKeySet = CryptoKey | JWTVerifyGetKey | KeyObject | Uint8Array;
+/** Options for `verifyAccessJwt`. */
+interface VerifyAccessJwtOptions {
+  /**
+   * The Access application **AUD tag(s)** (the application audience from the
+   * Access app's Overview). Verification rejects a token whose `aud` does not
+   * include one of these — this is what scopes a token to *your* app.
+   */
+  aud: string | string[];
+  /** Clock-skew tolerance in **seconds** applied to `exp`/`nbf`/`iat`. Default `0`. */
+  clockToleranceSec?: number;
+  /**
+   * Override the verification key source. Primarily for tests; in production
+   * leave unset to use the cached remote JWKS derived from `teamDomain`.
+   */
+  keySet?: AccessKeySet;
+  /**
+   * Your Cloudflare Access team domain. Accepts the short team name (`acme`),
+   * the host (`acme.cloudflareaccess.com`), or a full URL
+   * (`https://acme.cloudflareaccess.com`). Determines both the expected issuer
+   * and the JWKS endpoint.
+   */
+  teamDomain: string;
+}
+/**
+ * Common options for the request-driven Access primitives — how to read the JWT
+ * off the request and what to do when verification fails. Shared by
+ * {@link CreateAccessResolverOptions} and `AccessAdminGateOptions`, which add
+ * their distinct mapping / authorization step on top.
+ */
+interface RequestVerifyOptions extends VerifyAccessJwtOptions {
+  /**
+   * Cookie name carrying the Access JWT when the header is absent (browser
+   * navigations). Default `"CF_Authorization"`.
+   */
+  cookieName?: string;
+  /**
+   * Request header carrying the Access JWT. Default `"cf-access-jwt-assertion"`
+   * (matched case-insensitively).
+   */
+  headerName?: string;
+  /**
+   * Invoked when a token is present but fails verification (bad signature,
+   * wrong audience, expired, …). The caller still fails closed (resolver
+   * returns `null`, admin gate returns `false`); this is your hook to
+   * log/observe. It is **not** called when no token is present at all.
+   */
+  onError?: (error: unknown, request: Request) => void;
+}
+/**
+ * {@link RequestVerifyOptions} with the JWT-verification config made optional,
+ * for the primitives that can also authenticate off the platform-supplied
+ * identity (`ctx.access`) and therefore may legitimately be given no JWT config
+ * at all.
+ *
+ * The two fields are **all-or-nothing**: supply both to enable the
+ * `Cf-Access-Jwt-Assertion` fallback (needed for hostname-scoped Access
+ * applications, which do not populate `ctx.access`), or neither to run
+ * platform-identity-only. Supplying exactly one throws at construction — that is
+ * always a misconfiguration (classically an unset `env.CF_ACCESS_AUD`), and
+ * silently degrading it to "no JWT fallback" would turn a broken deployment into
+ * a quietly anonymous one.
+ */
+interface AccessJwtFallbackOptions extends Omit<RequestVerifyOptions, "aud" | "teamDomain"> {
+  /**
+   * The Access application **AUD tag(s)**. Required together with `teamDomain`
+   * to enable JWT verification; omit both to authenticate only off the
+   * platform-supplied identity.
+   */
+  aud?: string | string[];
+  /**
+   * Your Cloudflare Access team domain. Required together with `aud` to enable
+   * JWT verification; omit both to authenticate only off the platform-supplied
+   * identity.
+   */
+  teamDomain?: string;
+}
+/** Options for `createAccessResolver`; extends {@link AccessJwtFallbackOptions}. */
+interface CreateAccessResolverOptions extends AccessJwtFallbackOptions {
+  /**
+   * Remap verified claims into the resolved identity. Return an object to
+   * shallow-merge over the defaults; return a `userId` to override the derived
+   * caller id. Runs only after signature/issuer/audience/expiry are verified.
+   */
+  mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
+}
+/**
+ * A `resolveIdentity`-shaped function: maps an inbound request to a verified
+ * identity (or `null` for anonymous). Assignable to `@lunora/runtime`'s
+ * `WorkerOptions.resolveIdentity`.
+ *
+ * The third argument is the request's `ExecutionContext`, which the runtime
+ * forwards so a resolver can read the identity Cloudflare Access attaches to a
+ * Worker-protected request (`context.access`). It is `undefined` on paths that
+ * have no context to give, so a resolver must handle its absence.
+ */
+type ResolveIdentityFunction = (request: Request, env?: unknown, context?: ExecutionContextLike) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
+export { AccessClaims as A, CreateAccessResolverOptions as C, ExecutionContextLike as E, ResolveIdentityFunction as R, VerifyAccessJwtOptions as V, AccessJwtFallbackOptions as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.70",
+  "version": "1.0.0-alpha.72",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.21",
+    "@lunora/errors": "1.0.0-alpha.22",
     "jose": "^6.2.8"
   },
   "peerDependencies": {

package/dist/packem_shared/accessIssuer-B6vVJPus.mjs

@@ -1 +0,0 @@
-import{LunoraError as l}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as h}from"jose";const f="cf-access-jwt-assertion",w="CF_Authorization",g=(t,e,r)=>{const c=t.headers.get(e);if(c!==null&&c.length>0)return c;const o=t.headers.get("cookie");if(o!==null)for(const n of o.split(";")){const s=n.indexOf("=");if(s!==-1&&n.slice(0,s).trim()===r){const a=n.slice(s+1).trim();return a.length>0?a:void 0}}},y="/cdn-cgi/access/certs",k=/^https?:\/\//i,A=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},u=t=>{const e=A(t.trim().replace(k,""));if(e.length===0)throw new l("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},i=new Map,E=t=>{let e=i.get(t);return e===void 0&&(e=h(new URL(`${t}${y}`)),i.set(t,e)),e},d=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new l("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},v=t=>{u(t.teamDomain),d(t.aud)},p=async(t,e)=>{const r=u(e.teamDomain),c=d(e.aud),o=e.keySet??E(r),{payload:n}=await m(t,o,{algorithms:["RS256"],audience:c,clockTolerance:e.clockToleranceSec,issuer:r});return n},L=async(t,e)=>{const r=(e.headerName??f).toLowerCase(),c=e.cookieName??w,o=g(t,r,c);if(o!==void 0)try{return await p(o,e)}catch(n){try{e.onError?.(n,t)}catch{}return}};export{u as accessIssuer,v as assertVerifyOptions,p as verifyAccessJwt,L as verifyRequest};

package/dist/packem_shared/composeResolvers--vZvblPO.mjs

@@ -1 +0,0 @@
-import{assertVerifyOptions as i,verifyRequest as c}from"./accessIssuer-B6vVJPus.mjs";const s=null,t=e=>typeof e=="string"&&e.length>0?e:void 0,u=e=>t(e.sub)??t(e.email)??t(e.common_name),m=(e,r)=>{const o=r?.(e)??{},n=t(o.userId)??u(e);return n===void 0?s:{access:e,...e.common_name===void 0?{}:{commonName:e.common_name},...e.email===void 0?{}:{email:e.email},...e.exp===void 0?{}:{exp:e.exp},...e.groups===void 0?{}:{groups:e.groups},...o,userId:n}},v=e=>(i(e),async r=>{const o=await c(r,e);return o===void 0?s:m(o,e.mapClaims)}),f=(...e)=>async(r,o)=>{for(const n of e){const d=await n(r,o);if(d)return d}return s};export{f as composeResolvers,v as createAccessResolver};

package/dist/packem_shared/types.d-C8c7Qwx1.d.mts

@@ -1,134 +0,0 @@
-import { JWTPayload, JWTVerifyGetKey, KeyObject } from 'jose';
-/**
- * The claims Cloudflare Access mints into the `Cf-Access-Jwt-Assertion` JWT.
- *
- * Extends the standard `JWTPayload` (`iss`/`aud`/`sub`/`exp`/`iat`/…) with the
- * Access-specific fields. Which optional fields are present depends on the
- * caller and the Access application config. SSO users carry `email` (and
- * `groups` when the policy emits them), with `sub` as the stable user id.
- * Service tokens carry `common_name` and an empty `sub`; there is no `email`.
- *
- * Cloudflare may add further custom claims — they pass through verbatim via the
- * index signature so the claims stay a faithful view of the token.
- */
-interface AccessClaims extends JWTPayload {
-  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
-  common_name?: string;
-  /** ISO-3166-1 alpha-2 country the request was authorized from, when available. */
-  country?: string;
-  /** Verified user email. Present for interactive (SSO) callers. */
-  email?: string;
-  /** Identity-provider group memberships, when the Access policy is configured to emit them. */
-  groups?: string[];
-  /** Per-session nonce Cloudflare rotates on re-authentication. */
-  identity_nonce?: string;
-  /** Token kind, e.g. `"app"`. */
-  type?: string;
-}
-/**
- * The minimal `resolveIdentity` return contract shared with `@lunora/runtime`'s
- * `WorkerOptions.resolveIdentity` (`ResolvedIdentity`). Declared structurally so
- * this package takes no runtime dependency on `@lunora/runtime`; the value is
- * assignable to the runtime hook.
- *
- * `userId` becomes `ctx.auth.userId`; every other key is forwarded (server-side,
- * unforgeable) into `x-lunora-identity` and surfaced via `ctx.auth.getIdentity()`.
- * `exp` (JWT epoch **seconds**) drives WebSocket credential expiry — omit it and
- * a live subscription socket never expires.
- */
-interface ResolvedIdentityLike {
-  /** All other claims pass through into `ctx.auth.getIdentity()`. */
-  [claim: string]: unknown;
-  /** JWT `exp` in epoch **seconds** (NOT milliseconds). Drives WS socket expiry. */
-  exp?: number;
-  /** Absolute expiry in epoch **milliseconds**. Alternative to `exp`; takes precedence in the runtime. */
-  expiresAtMs?: number;
-  /** The stable caller id. Becomes `ctx.auth.userId` and what `serverDefault(({auth}) => auth.userId)` stamps. */
-  userId: string;
-}
-/**
- * The verified Access identity produced by `createAccessResolver`. A
- * {@link ResolvedIdentityLike} with the commonly-used Access claims promoted to
- * named, camelCased fields (so policies read `auth.identity.groups` etc.) plus
- * the full raw claim set under `access` for fidelity.
- */
-interface ResolvedAccessIdentity extends ResolvedIdentityLike {
-  /** The full, verified claim set (snake_cased wire names preserved). */
-  access: AccessClaims;
-  /** Service-token name (`common_name`), for machine callers. */
-  commonName?: string;
-  /** Verified email, for SSO callers. */
-  email?: string;
-  /** IdP group memberships, when emitted by the Access policy. */
-  groups?: string[];
-}
-/**
- * A key source for `verifyAccessJwt`. Either a `jose` remote/local JWKS getter,
- * or a single public key (handy for tests that mint their own RS256 tokens).
- * When omitted, a cached remote JWKS is built from `teamDomain`.
- */
-type AccessKeySet = CryptoKey | JWTVerifyGetKey | KeyObject | Uint8Array;
-/** Options for `verifyAccessJwt`. */
-interface VerifyAccessJwtOptions {
-  /**
-   * The Access application **AUD tag(s)** (the application audience from the
-   * Access app's Overview). Verification rejects a token whose `aud` does not
-   * include one of these — this is what scopes a token to *your* app.
-   */
-  aud: string | string[];
-  /** Clock-skew tolerance in **seconds** applied to `exp`/`nbf`/`iat`. Default `0`. */
-  clockToleranceSec?: number;
-  /**
-   * Override the verification key source. Primarily for tests; in production
-   * leave unset to use the cached remote JWKS derived from `teamDomain`.
-   */
-  keySet?: AccessKeySet;
-  /**
-   * Your Cloudflare Access team domain. Accepts the short team name (`acme`),
-   * the host (`acme.cloudflareaccess.com`), or a full URL
-   * (`https://acme.cloudflareaccess.com`). Determines both the expected issuer
-   * and the JWKS endpoint.
-   */
-  teamDomain: string;
-}
-/**
- * Common options for the request-driven Access primitives — how to read the JWT
- * off the request and what to do when verification fails. Shared by
- * {@link CreateAccessResolverOptions} and `AccessAdminGateOptions`, which add
- * their distinct mapping / authorization step on top.
- */
-interface RequestVerifyOptions extends VerifyAccessJwtOptions {
-  /**
-   * Cookie name carrying the Access JWT when the header is absent (browser
-   * navigations). Default `"CF_Authorization"`.
-   */
-  cookieName?: string;
-  /**
-   * Request header carrying the Access JWT. Default `"cf-access-jwt-assertion"`
-   * (matched case-insensitively).
-   */
-  headerName?: string;
-  /**
-   * Invoked when a token is present but fails verification (bad signature,
-   * wrong audience, expired, …). The caller still fails closed (resolver
-   * returns `null`, admin gate returns `false`); this is your hook to
-   * log/observe. It is **not** called when no token is present at all.
-   */
-  onError?: (error: unknown, request: Request) => void;
-}
-/** Options for `createAccessResolver`; extends {@link RequestVerifyOptions}. */
-interface CreateAccessResolverOptions extends RequestVerifyOptions {
-  /**
-   * Remap verified claims into the resolved identity. Return an object to
-   * shallow-merge over the defaults; return a `userId` to override the derived
-   * caller id. Runs only after signature/issuer/audience/expiry are verified.
-   */
-  mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
-}
-/**
- * A `resolveIdentity`-shaped function: maps an inbound request to a verified
- * identity (or `null` for anonymous). Assignable to `@lunora/runtime`'s
- * `WorkerOptions.resolveIdentity`.
- */
-type ResolveIdentityFunction = (request: Request, env?: unknown) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
-export { AccessClaims as A, CreateAccessResolverOptions as C, RequestVerifyOptions as R, VerifyAccessJwtOptions as V, ResolveIdentityFunction as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };

package/dist/packem_shared/types.d-C8c7Qwx1.d.ts

@@ -1,134 +0,0 @@
-import { JWTPayload, JWTVerifyGetKey, KeyObject } from 'jose';
-/**
- * The claims Cloudflare Access mints into the `Cf-Access-Jwt-Assertion` JWT.
- *
- * Extends the standard `JWTPayload` (`iss`/`aud`/`sub`/`exp`/`iat`/…) with the
- * Access-specific fields. Which optional fields are present depends on the
- * caller and the Access application config. SSO users carry `email` (and
- * `groups` when the policy emits them), with `sub` as the stable user id.
- * Service tokens carry `common_name` and an empty `sub`; there is no `email`.
- *
- * Cloudflare may add further custom claims — they pass through verbatim via the
- * index signature so the claims stay a faithful view of the token.
- */
-interface AccessClaims extends JWTPayload {
-  /** Service-token name. Present for non-interactive (machine) callers instead of `email`. */
-  common_name?: string;
-  /** ISO-3166-1 alpha-2 country the request was authorized from, when available. */
-  country?: string;
-  /** Verified user email. Present for interactive (SSO) callers. */
-  email?: string;
-  /** Identity-provider group memberships, when the Access policy is configured to emit them. */
-  groups?: string[];
-  /** Per-session nonce Cloudflare rotates on re-authentication. */
-  identity_nonce?: string;
-  /** Token kind, e.g. `"app"`. */
-  type?: string;
-}
-/**
- * The minimal `resolveIdentity` return contract shared with `@lunora/runtime`'s
- * `WorkerOptions.resolveIdentity` (`ResolvedIdentity`). Declared structurally so
- * this package takes no runtime dependency on `@lunora/runtime`; the value is
- * assignable to the runtime hook.
- *
- * `userId` becomes `ctx.auth.userId`; every other key is forwarded (server-side,
- * unforgeable) into `x-lunora-identity` and surfaced via `ctx.auth.getIdentity()`.
- * `exp` (JWT epoch **seconds**) drives WebSocket credential expiry — omit it and
- * a live subscription socket never expires.
- */
-interface ResolvedIdentityLike {
-  /** All other claims pass through into `ctx.auth.getIdentity()`. */
-  [claim: string]: unknown;
-  /** JWT `exp` in epoch **seconds** (NOT milliseconds). Drives WS socket expiry. */
-  exp?: number;
-  /** Absolute expiry in epoch **milliseconds**. Alternative to `exp`; takes precedence in the runtime. */
-  expiresAtMs?: number;
-  /** The stable caller id. Becomes `ctx.auth.userId` and what `serverDefault(({auth}) => auth.userId)` stamps. */
-  userId: string;
-}
-/**
- * The verified Access identity produced by `createAccessResolver`. A
- * {@link ResolvedIdentityLike} with the commonly-used Access claims promoted to
- * named, camelCased fields (so policies read `auth.identity.groups` etc.) plus
- * the full raw claim set under `access` for fidelity.
- */
-interface ResolvedAccessIdentity extends ResolvedIdentityLike {
-  /** The full, verified claim set (snake_cased wire names preserved). */
-  access: AccessClaims;
-  /** Service-token name (`common_name`), for machine callers. */
-  commonName?: string;
-  /** Verified email, for SSO callers. */
-  email?: string;
-  /** IdP group memberships, when emitted by the Access policy. */
-  groups?: string[];
-}
-/**
- * A key source for `verifyAccessJwt`. Either a `jose` remote/local JWKS getter,
- * or a single public key (handy for tests that mint their own RS256 tokens).
- * When omitted, a cached remote JWKS is built from `teamDomain`.
- */
-type AccessKeySet = CryptoKey | JWTVerifyGetKey | KeyObject | Uint8Array;
-/** Options for `verifyAccessJwt`. */
-interface VerifyAccessJwtOptions {
-  /**
-   * The Access application **AUD tag(s)** (the application audience from the
-   * Access app's Overview). Verification rejects a token whose `aud` does not
-   * include one of these — this is what scopes a token to *your* app.
-   */
-  aud: string | string[];
-  /** Clock-skew tolerance in **seconds** applied to `exp`/`nbf`/`iat`. Default `0`. */
-  clockToleranceSec?: number;
-  /**
-   * Override the verification key source. Primarily for tests; in production
-   * leave unset to use the cached remote JWKS derived from `teamDomain`.
-   */
-  keySet?: AccessKeySet;
-  /**
-   * Your Cloudflare Access team domain. Accepts the short team name (`acme`),
-   * the host (`acme.cloudflareaccess.com`), or a full URL
-   * (`https://acme.cloudflareaccess.com`). Determines both the expected issuer
-   * and the JWKS endpoint.
-   */
-  teamDomain: string;
-}
-/**
- * Common options for the request-driven Access primitives — how to read the JWT
- * off the request and what to do when verification fails. Shared by
- * {@link CreateAccessResolverOptions} and `AccessAdminGateOptions`, which add
- * their distinct mapping / authorization step on top.
- */
-interface RequestVerifyOptions extends VerifyAccessJwtOptions {
-  /**
-   * Cookie name carrying the Access JWT when the header is absent (browser
-   * navigations). Default `"CF_Authorization"`.
-   */
-  cookieName?: string;
-  /**
-   * Request header carrying the Access JWT. Default `"cf-access-jwt-assertion"`
-   * (matched case-insensitively).
-   */
-  headerName?: string;
-  /**
-   * Invoked when a token is present but fails verification (bad signature,
-   * wrong audience, expired, …). The caller still fails closed (resolver
-   * returns `null`, admin gate returns `false`); this is your hook to
-   * log/observe. It is **not** called when no token is present at all.
-   */
-  onError?: (error: unknown, request: Request) => void;
-}
-/** Options for `createAccessResolver`; extends {@link RequestVerifyOptions}. */
-interface CreateAccessResolverOptions extends RequestVerifyOptions {
-  /**
-   * Remap verified claims into the resolved identity. Return an object to
-   * shallow-merge over the defaults; return a `userId` to override the derived
-   * caller id. Runs only after signature/issuer/audience/expiry are verified.
-   */
-  mapClaims?: (claims: AccessClaims) => Record<string, unknown>;
-}
-/**
- * A `resolveIdentity`-shaped function: maps an inbound request to a verified
- * identity (or `null` for anonymous). Assignable to `@lunora/runtime`'s
- * `WorkerOptions.resolveIdentity`.
- */
-type ResolveIdentityFunction = (request: Request, env?: unknown) => (ResolvedIdentityLike | null) | Promise<ResolvedIdentityLike | null>;
-export { AccessClaims as A, CreateAccessResolverOptions as C, RequestVerifyOptions as R, VerifyAccessJwtOptions as V, ResolveIdentityFunction as a, AccessKeySet as b, ResolvedAccessIdentity as c, ResolvedIdentityLike as d };