@lunora/cloudflare-access 1.0.0-alpha.8 → 1.0.0-alpha.80

package/dist/context.d.mts

@@ -1,14 +1,13 @@
-import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
-import '@lunora/errors';
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
+import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -16,11 +15,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -42,39 +41,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.d.ts

@@ -1,14 +1,13 @@
-import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
-import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
-import '@lunora/errors';
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
+import { A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
 import 'jose';
 /**
-* The slice of context {@link accessContext} reads: the `auth` facade every
-* Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
-* `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
-* output, which carries the full claim set under `access` plus the promoted
-* `email` / `groups` / `commonName` fields.
-*/
+ * The slice of context {@link accessContext} reads: the `auth` facade every
+ * Lunora ctx carries. `getIdentity()` returns the verified identity envelope —
+ * `createAccessResolver`'s {@link import("./types").ResolvedAccessIdentity}
+ * output, which carries the full claim set under `access` plus the promoted
+ * `email` / `groups` / `commonName` fields.
+ */
 interface AccessContextInput {
   auth?: {
     getIdentity?: () => (Record<string, unknown> | null) | Promise<Record<string, unknown> | null>;
@@ -16,11 +15,11 @@ interface AccessContextInput {
   };
 }
 /**
-* The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
-* synchronous, Access-shaped read over the already-resolved identity — so a
-* handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
-* `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
-*/
+ * The typed, per-request `ctx.access` facade {@link accessContext} attaches. A
+ * synchronous, Access-shaped read over the already-resolved identity — so a
+ * handler reads `ctx.access.email` / `ctx.access.hasGroup("ops")` without an
+ * `await` or a cast off the generic `ctx.auth.getIdentity()` envelope.
+ */
 interface AccessFacade {
   /** True when a verified Access identity is present on the request. */
   readonly authenticated: boolean;
@@ -42,39 +41,39 @@ interface AccessContextOutput extends AccessContextInput {
   access: AccessFacade;
 }
 /**
-* Build the `ctx.access` facade from a (possibly absent) resolved identity
-* envelope. Returns the anonymous facade when no identity is present, so callers
-* never null-check. Shared by {@link accessContext} and the codegen-wired global
-* `ctx.access` (which calls this synchronously from the resolved identity locals
-* at ctx-build time, so a global `ctx.access` adds only this object construction
-* per request — no extra I/O or re-verification).
-*/
+ * Build the `ctx.access` facade from a (possibly absent) resolved identity
+ * envelope. Returns the anonymous facade when no identity is present, so callers
+ * never null-check. Shared by {@link accessContext} and the codegen-wired global
+ * `ctx.access` (which calls this synchronously from the resolved identity locals
+ * at ctx-build time, so a global `ctx.access` adds only this object construction
+ * per request — no extra I/O or re-verification).
+ */
 declare const accessFacade: (identity: Record<string, unknown> | null | undefined, userId: string | null | undefined) => AccessFacade;
 /**
-* Middleware that attaches a typed `ctx.access` facade derived from the verified
-* Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
-* exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
-* `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
-* handler reads the verified identity ergonomically and with full typing instead
-* of casting off the generic `getIdentity()` envelope.
-*
-* When no identity is resolved (anonymous request) it attaches the anonymous
-* facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
-* so reads stay safe without a null check, and authorization decisions still
-* fail closed.
-*
-* It does not gate the request; pair it with `rls(...)` (or
-* `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
-* the identity for branching inside a handler.
-*
-* ```ts
-* export const whoAmI = query
-*   .use(accessContext())
-*   .query(async ({ ctx }) => ({
-*       email: ctx.access.email,
-*       isOps: ctx.access.hasGroup("ops"),
-*   }));
-* ```
-*/
+ * Middleware that attaches a typed `ctx.access` facade derived from the verified
+ * Cloudflare Access identity. It resolves `ctx.auth.getIdentity()` once and
+ * exposes a **synchronous**, Access-shaped read — `ctx.access.email`,
+ * `ctx.access.groups`, `ctx.access.hasGroup("ops")`, `ctx.access.claims` — so a
+ * handler reads the verified identity ergonomically and with full typing instead
+ * of casting off the generic `getIdentity()` envelope.
+ *
+ * When no identity is resolved (anonymous request) it attaches the anonymous
+ * facade — `authenticated: false`, empty `groups`, `hasGroup` always `false` —
+ * so reads stay safe without a null check, and authorization decisions still
+ * fail closed.
+ *
+ * It does not gate the request; pair it with `rls(...)` (or
+ * `accessRoles(...)` → `rls(...)`) when you need enforcement. It only surfaces
+ * the identity for branching inside a handler.
+ *
+ * ```ts
+ * export const whoAmI = query
+ *   .use(accessContext())
+ *   .query(async ({ ctx }) => ({
+ *       email: ctx.access.email,
+ *       isOps: ctx.access.hasGroup("ops"),
+ *   }));
+ * ```
+ */
 declare const accessContext: <Context extends AccessContextInput>() => Middleware<Context, AccessContextOutput & Context>;
 export { type AccessContextInput, type AccessContextOutput, type AccessFacade, accessContext, accessFacade };

package/dist/context.mjs

@@ -1,36 +1 @@
-const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const stringClaim = (value) => typeof value === "string" ? value : void 0;
-const ANONYMOUS_FACADE = {
-  authenticated: false,
-  claims: void 0,
-  commonName: void 0,
-  email: void 0,
-  groups: [],
-  hasGroup: () => false,
-  userId: void 0
-};
-const facadeFor = (identity, userId) => {
-  const raw = identity["access"];
-  if (typeof raw !== "object" || raw === null) {
-    return ANONYMOUS_FACADE;
-  }
-  const claims = raw;
-  const groups = stringList(identity["groups"] ?? claims.groups);
-  return {
-    authenticated: true,
-    claims,
-    commonName: stringClaim(identity["commonName"]) ?? stringClaim(claims.common_name),
-    email: stringClaim(identity["email"]) ?? stringClaim(claims.email),
-    groups,
-    hasGroup: (group) => groups.includes(group),
-    userId
-  };
-};
-const accessFacade = (identity, userId) => identity ? facadeFor(identity, userId ?? void 0) : ANONYMOUS_FACADE;
-const accessContext = () => async ({ ctx, next }) => {
-  const identity = await ctx.auth?.getIdentity?.();
-  const access = accessFacade(identity, ctx.auth?.userId);
-  return next({ ctx: { access } });
-};
-
-export { accessContext, accessFacade };
+import{r as m}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=o=>typeof o=="string"?o:void 0,n={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(o,a)=>{const s=o.access;if(typeof s!="object"||s===null)return n;const e=s,t=m(o)??[];return{authenticated:!0,claims:e,commonName:c(o.commonName)??c(e.common_name),email:c(o.email)??c(e.email),groups:t,hasGroup:r=>t.includes(r),userId:a}},u=(o,a)=>o?i(o,a??void 0):n,l=()=>async({ctx:o,next:a})=>{const s=await o.auth?.getIdentity?.(),e=u(s,o.auth?.userId);return a({ctx:{access:e}})};export{l as accessContext,u as accessFacade};

package/dist/index.d.mts

@@ -1,71 +1,76 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.mjs";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.mjs";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.mjs";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
-declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+ * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access
+ * user or service token becomes `ctx.auth` for every query/mutation/action (and
+ * feeds RLS) with no further wiring.
+ *
+ * It authenticates from whichever of the two Access shapes the deployment uses,
+ * **platform identity first**:
+ *
+ * 1. `context.access` — the identity Cloudflare attaches when the Access policy
+ * is attached to the **Worker** (covering its custom domains, routes,
+ * `workers.dev`, and preview URLs at once). Nothing is verified because nothing
+ * can be forged: the platform authenticated the caller before the Worker ran,
+ * and the field is absent unless it did. No JWKS fetch, no `aud` to get wrong.
+ * This is also what `wrangler.jsonc`'s `access.dev` block simulates, so a
+ * locally-simulated identity reaches `ctx.auth` too.
+ * 2. The `Cf-Access-Jwt-Assertion` header (or `CF_Authorization` cookie),
+ * verified against your team JWKS. Needed for **hostname-scoped** Access
+ * applications, which do not populate `context.access`. Configured by passing
+ * `teamDomain` + `aud`; omit both (or pass no options at all) to run
+ * platform-identity-only.
+ *
+ * Behaviour is **fail-closed → anonymous** on both paths: no identity, or a token
+ * that fails verification, resolves to `null` (the request proceeds
+ * unauthenticated and RLS denies). Use {@link CreateAccessResolverOptions.onError}
+ * to observe verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * // Access policy attached to the Worker — nothing to configure.
+ * options.resolveIdentity = createAccessResolver();
+ *
+ * // Hostname-scoped Access application — JWT verification config required.
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
+declare const createAccessResolver: (options?: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.d.ts

@@ -1,71 +1,76 @@
-import { a as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
-export type { b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-BO8d74KI.js";
+import { R as ResolveIdentityFunction, C as CreateAccessResolverOptions, V as VerifyAccessJwtOptions, A as AccessClaims } from "./packem_shared/types.d-D30o96f7.js";
+export type { a as AccessJwtFallbackOptions, b as AccessKeySet, c as ResolvedAccessIdentity, d as ResolvedIdentityLike } from "./packem_shared/types.d-D30o96f7.js";
 import 'jose';
 /**
-* Create a `resolveIdentity` adapter for Cloudflare Access. The returned
-* function reads the Access JWT off the request, verifies it (`verifyAccessJwt`),
-* and maps the claims onto the identity shape `@lunora/runtime` expects — so a
-* verified Access user/service-token becomes `ctx.auth` for every
-* query/mutation/action (and feeds RLS) with no further wiring.
-*
-* Behaviour is **fail-closed → anonymous**: a missing token, or a token that
-* fails verification, resolves to `null` (the request proceeds unauthenticated
-* and RLS denies). Use {@link CreateAccessResolverOptions.onError} to observe
-* verification failures.
-*
-* Wire it in your worker entry:
-*
-* ```ts
-* options.resolveIdentity = createAccessResolver({
-*     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
-*     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
-* });
-* ```
-*/
-declare const createAccessResolver: (options: CreateAccessResolverOptions) => ResolveIdentityFunction;
+ * Create a `resolveIdentity` adapter for Cloudflare Access, so a verified Access
+ * user or service token becomes `ctx.auth` for every query/mutation/action (and
+ * feeds RLS) with no further wiring.
+ *
+ * It authenticates from whichever of the two Access shapes the deployment uses,
+ * **platform identity first**:
+ *
+ * 1. `context.access` — the identity Cloudflare attaches when the Access policy
+ * is attached to the **Worker** (covering its custom domains, routes,
+ * `workers.dev`, and preview URLs at once). Nothing is verified because nothing
+ * can be forged: the platform authenticated the caller before the Worker ran,
+ * and the field is absent unless it did. No JWKS fetch, no `aud` to get wrong.
+ * This is also what `wrangler.jsonc`'s `access.dev` block simulates, so a
+ * locally-simulated identity reaches `ctx.auth` too.
+ * 2. The `Cf-Access-Jwt-Assertion` header (or `CF_Authorization` cookie),
+ * verified against your team JWKS. Needed for **hostname-scoped** Access
+ * applications, which do not populate `context.access`. Configured by passing
+ * `teamDomain` + `aud`; omit both (or pass no options at all) to run
+ * platform-identity-only.
+ *
+ * Behaviour is **fail-closed → anonymous** on both paths: no identity, or a token
+ * that fails verification, resolves to `null` (the request proceeds
+ * unauthenticated and RLS denies). Use {@link CreateAccessResolverOptions.onError}
+ * to observe verification failures.
+ *
+ * Wire it in your worker entry:
+ *
+ * ```ts
+ * // Access policy attached to the Worker — nothing to configure.
+ * options.resolveIdentity = createAccessResolver();
+ *
+ * // Hostname-scoped Access application — JWT verification config required.
+ * options.resolveIdentity = createAccessResolver({
+ *     teamDomain: env.CF_ACCESS_TEAM_DOMAIN, // "acme" | "acme.cloudflareaccess.com"
+ *     aud: env.CF_ACCESS_AUD,                // the Access app's AUD tag
+ * });
+ * ```
+ */
+declare const createAccessResolver: (options?: CreateAccessResolverOptions) => ResolveIdentityFunction;
 /**
-* Compose several `resolveIdentity` adapters into one: each is tried in order
-* and the first to return a non-null identity wins. The canonical use is
-* pairing Access with `@lunora/auth` —
-* `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
-* an Access JWT (machine/SSO) is authenticated by Access while everyone else
-* falls through to the app's own session.
-*/
+ * Compose several `resolveIdentity` adapters into one: each is tried in order
+ * and the first to return a non-null identity wins. The canonical use is
+ * pairing Access with `@lunora/auth` —
+ * `composeResolvers(accessResolver, betterAuthResolver)` — so a request carrying
+ * an Access JWT (machine/SSO) is authenticated by Access while everyone else
+ * falls through to the app's own session.
+ */
 declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => ResolveIdentityFunction;
 /**
-* Normalize a configured team domain to the canonical Access issuer URL.
-*
-* Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
-* full URL, and always returns an `https://` origin with no trailing slash. A
-* bare name with no dot is expanded to the `cloudflareaccess.com` host.
-*/
+ * Normalize a configured team domain to the canonical Access issuer URL.
+ *
+ * Accepts a short team name (`acme`), a host (`acme.cloudflareaccess.com`), or a
+ * full URL, and always returns an `https://` origin with no trailing slash. A
+ * bare name with no dot is expanded to the `cloudflareaccess.com` host.
+ */
 declare const accessIssuer: (teamDomain: string) => string;
 /**
-* Verify a Cloudflare Access JWT and return its claims.
-*
-* Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
-* the team issuer, `aud` containing one of the configured Access application AUD
-* tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
-* is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
-* outright.
-*
-* Throws (a `jose` error) on any failure — callers that want fail-closed
-* anonymous behaviour should catch and treat it as "no identity" (the
-* `createAccessResolver` adapter does exactly this).
-* @param token The raw compact JWT (header value or cookie value).
-*/
+ * Verify a Cloudflare Access JWT and return its claims.
+ *
+ * Enforces, in one shot: RS256 signature against the team JWKS, `iss` equal to
+ * the team issuer, `aud` containing one of the configured Access application AUD
+ * tags, and a non-expired `exp` (with optional clock tolerance). The algorithm
+ * is pinned to `RS256` so an `alg:none` or HS-signed forgery is rejected
+ * outright.
+ *
+ * Throws (a `jose` error) on any failure — callers that want fail-closed
+ * anonymous behaviour should catch and treat it as "no identity" (the
+ * `createAccessResolver` adapter does exactly this).
+ * @param token The raw compact JWT (header value or cookie value).
+ */
 declare const verifyAccessJwt: (token: string, options: VerifyAccessJwtOptions) => Promise<AccessClaims>;
-/**
-* Read the Access JWT off a request and verify it. Returns the verified claims,
-* or `undefined` when no token is present **or** verification fails — the single
-* fail-closed "no Access identity" signal that both `createAccessResolver` and
-* `accessAdminGate` build their distinct mapping / authorization step on top of.
-*
-* This is the package's one place that turns a request into verified claims:
-* header/cookie default resolution, the {@link readToken} read, the
-* {@link verifyAccessJwt} call, and the `onError`-observed fail-closed catch all
-* live here so the resolver and the admin gate carry only their genuinely
-* distinct line. `onError` fires for a present-but-invalid token, never for an
-* absent one.
-*/
 export { type AccessClaims, type CreateAccessResolverOptions, type ResolveIdentityFunction, type VerifyAccessJwtOptions, accessIssuer, composeResolvers, createAccessResolver, verifyAccessJwt };

package/dist/index.mjs

@@ -1,2 +1 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BI3envaN.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-83KYwaCp.mjs';
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-JBsWQvv4.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/accessIssuer-CLO6p5MF.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as f}from"jose";const h="cf-access-jwt-assertion",w="CF_Authorization",y=(t,e,r)=>{const o=t.headers.get(e);if(o!==null&&o.length>0)return o;const n=t.headers.get("cookie");if(n!==null)for(const c of n.split(";")){const s=c.indexOf("=");if(s!==-1&&c.slice(0,s).trim()===r){const i=c.slice(s+1).trim();return i.length>0?i:void 0}}},A="/cdn-cgi/access/certs",g=/^https?:\/\//i,v=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},d=t=>{const e=v(t.trim().replace(g,""));if(e.length===0)throw new a("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},l=new Map,E=t=>{let e=l.get(t);return e===void 0&&(e=f(new URL(`${t}${A}`)),l.set(t,e)),e},u=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new a("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},k=t=>{d(t.teamDomain),u(t.aud)},S=t=>{if(t===void 0||!("aud"in t)&&!("teamDomain"in t))return;const{aud:e,teamDomain:r}=t;if(e===void 0||r===void 0)throw new a("INTERNAL","@lunora/cloudflare-access: `teamDomain` and `aud` must both be set to verify the Cf-Access-Jwt-Assertion JWT (check that CF_ACCESS_TEAM_DOMAIN / CF_ACCESS_AUD are set in this environment) — to authenticate only off the Worker's Cloudflare Access identity, omit both options entirely");const o={...t,aud:e,teamDomain:r};return k(o),o},C=async(t,e)=>{const r=d(e.teamDomain),o=u(e.aud),n=e.keySet??E(r),{payload:c}=await m(t,n,{algorithms:["RS256"],audience:o,clockTolerance:e.clockToleranceSec,issuer:r});return c},p=async(t,e)=>{const r=(e.headerName??h).toLowerCase(),o=e.cookieName??w,n=y(t,r,o);if(n!==void 0)try{return await C(n,e)}catch(c){try{e.onError?.(c,t)}catch{}return}};export{d as accessIssuer,S as assertJwtFallbackOptions,k as assertVerifyOptions,C as verifyAccessJwt,p as verifyRequest};

package/dist/packem_shared/composeResolvers-JBsWQvv4.mjs

@@ -0,0 +1 @@
+import{r as c}from"./platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as m,verifyRequest as p}from"./accessIssuer-CLO6p5MF.mjs";const d=null,s=o=>typeof o=="string"&&o.length>0?o:void 0,v=o=>s(o.sub)??s(o.email)??s(o.common_name),a=(o,e)=>{const t=e?.(o)??{},n=s(t.userId)??v(o);return n===void 0?d:{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...t,userId:n}},y=o=>{const e=m(o);return async(t,n,i)=>{const r=await c(i)??(e===void 0?void 0:await p(t,e));return r===void 0?d:a(r,o?.mapClaims)}},g=(...o)=>async(e,t,n)=>{for(const i of o){const r=await i(e,t,n);if(r)return r}return d};export{g as composeResolvers,y as createAccessResolver};

package/dist/packem_shared/identity-groups-CCucbpzP.mjs

@@ -0,0 +1 @@
+const n=o=>{const{access:r}=o,t=typeof r=="object"&&r!==null?r.groups:void 0,s=o.groups??t;return Array.isArray(s)?s.filter(e=>typeof e=="string"):void 0};export{n as r};

package/dist/packem_shared/index.d-D7R8k7yf.d.mts

@@ -0,0 +1,21 @@
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+export { Middleware as M };

package/dist/packem_shared/index.d-D7R8k7yf.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `next()` advances the middleware chain. Called with no argument it forwards
+ * the current context unchanged; called with `{ ctx }` it shallow-merges the
+ * extension, and the result type reflects the widened context.
+ */
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+ * A middleware receives the current context and a `next` continuation. Its
+ * return type becomes the builder's new context, so `return next({ ctx })`
+ * propagates the extension into every downstream `.use()` and the handler.
+ */
+type Middleware<ContextIn, ContextOut> = (options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => ContextOut | Promise<ContextOut>;
+export { Middleware as M };

package/dist/packem_shared/platform-identity-Dy6G1EoF.mjs

@@ -0,0 +1 @@
+const s=t=>{if(typeof t=="string")return t.length>0?t:void 0;if(typeof t=="object"&&t!==null){const{name:o}=t;return typeof o=="string"&&o.length>0?o:void 0}},a=t=>Array.isArray(t)?t.map(o=>s(o)).filter(o=>o!==void 0):void 0,c=async t=>{const o=t?.access;if(o===void 0)return;let r;try{r=await o.getIdentity()}catch{return}if(r===null||typeof r!="object")return;const{groups:n,...e}=r,i=a(n);return i===void 0?e:{...e,groups:i}};export{c as r};