@lunora/codegen 1.0.0-alpha.17 → 1.0.0-alpha.18

package/dist/index.d.mts

@@ -1099,6 +1099,13 @@ declare const emitApi: (functions: ReadonlyArray<FunctionIR>, workflows?: Readon
 declare const emitCollections: (shapes: ReadonlyArray<ShapeIR>, hasDatabase: boolean, useUmbrella?: boolean) => string;
 interface EmitServerOptions {
   containers?: ReadonlyArray<ContainerIR>;
+  /**
+  * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
+  * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
+  * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
+  * method); this one gates the per-request `ctx.access` read surface.
+  */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
   hasAnalytics?: boolean;
@@ -1127,6 +1134,7 @@ interface EmitServerOptions {
 }
 declare const emitServer: ({
   containers,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
@@ -1187,6 +1195,8 @@ interface EmitShardOptions {
     key: string;
     type: "boolean" | "number" | "object" | "string";
   }>;
+  /** A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access facade onto every ctx. */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source reads `ctx.analytics` — wires the Analytics Engine write helper onto every ctx. */
   hasAnalytics?: boolean;
@@ -1224,6 +1234,7 @@ declare const emitShard: ({
   advisories,
   containers,
   flagKeys,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
@@ -1304,6 +1315,8 @@ declare const emitVectors: (vectorIndexes: ReadonlyArray<VectorIndexIR>) => stri
 declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => string[];
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
+  /** App depends on `@lunora/cloudflare-access` → emit `.access()` (wire the Cloudflare Access `resolveIdentity`, composed ahead of `@lunora/auth` when both are present). */
+  hasAccess: boolean;
   /** App uses `@lunora/ai` / `ctx.ai` → emit `.ai()` (override the Workers AI binding backing `ctx.ai`). */
   hasAi: boolean;
   /** App uses `@lunora/bindings/analytics` / `ctx.analytics` → emit `.analytics()` (override the dataset backing `ctx.analytics`). */

package/dist/index.d.ts

@@ -1099,6 +1099,13 @@ declare const emitApi: (functions: ReadonlyArray<FunctionIR>, workflows?: Readon
 declare const emitCollections: (shapes: ReadonlyArray<ShapeIR>, hasDatabase: boolean, useUmbrella?: boolean) => string;
 interface EmitServerOptions {
   containers?: ReadonlyArray<ContainerIR>;
+  /**
+  * A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access
+  * facade (`@lunora/cloudflare-access/context`) onto every ctx. Distinct from
+  * `emitApp`'s `hasAccess` (which gates the worker's `.access()` resolveIdentity
+  * method); this one gates the per-request `ctx.access` read surface.
+  */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/analytics` / `ctx.analytics` — wires the write helper onto every ctx. */
   hasAnalytics?: boolean;
@@ -1127,6 +1134,7 @@ interface EmitServerOptions {
 }
 declare const emitServer: ({
   containers,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
@@ -1187,6 +1195,8 @@ interface EmitShardOptions {
     key: string;
     type: "boolean" | "number" | "object" | "string";
   }>;
+  /** A `lunora/` source reads `ctx.access` — wires the verified Cloudflare Access facade onto every ctx. */
+  hasAccessFacade?: boolean;
   hasAi?: boolean;
   /** A `lunora/` source reads `ctx.analytics` — wires the Analytics Engine write helper onto every ctx. */
   hasAnalytics?: boolean;
@@ -1224,6 +1234,7 @@ declare const emitShard: ({
   advisories,
   containers,
   flagKeys,
+  hasAccessFacade,
   hasAi,
   hasAnalytics,
   hasBrowser,
@@ -1304,6 +1315,8 @@ declare const emitVectors: (vectorIndexes: ReadonlyArray<VectorIndexIR>) => stri
 declare const emitWranglerCronTriggers: (crons: ReadonlyArray<CronJobIR>) => string[];
 /** Which capability methods the generated `defineApp` builder exposes — one flag per package-backed feature the app actually uses. */
 interface EmitAppOptions {
+  /** App depends on `@lunora/cloudflare-access` → emit `.access()` (wire the Cloudflare Access `resolveIdentity`, composed ahead of `@lunora/auth` when both are present). */
+  hasAccess: boolean;
   /** App uses `@lunora/ai` / `ctx.ai` → emit `.ai()` (override the Workers AI binding backing `ctx.ai`). */
   hasAi: boolean;
   /** App uses `@lunora/bindings/analytics` / `ctx.analytics` → emit `.analytics()` (override the dataset backing `ctx.analytics`). */

package/dist/index.mjs

@@ -19,11 +19,11 @@ export { default as discoverSchema } from './packem_shared/discoverSchema-BnWHHJ
 export { SHAPES_FILENAME, discoverShapes } from './packem_shared/SHAPES_FILENAME-ChV7MqgE.mjs';
 export { default as discoverStorageRulesMetadata } from './packem_shared/discoverStorageRulesMetadata-Da8BKXcI.mjs';
 export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/WORKFLOWS_FILENAME-D62dcBGg.mjs';
-export { GENERATED_HEADER, emitApi, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/GENERATED_HEADER-BoVKLcnE.mjs';
-export { emitApp } from './packem_shared/emitApp-Bh0HsQVK.mjs';
-export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-CB2brlbc.mjs';
-export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-BMCOe3B6.mjs';
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-BA9tjjOl.mjs';
+export { GENERATED_HEADER, emitApi, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/GENERATED_HEADER-D-AbhmRh.mjs';
+export { emitApp } from './packem_shared/emitApp-CV81L74c.mjs';
+export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-DoK7_x1g.mjs';
+export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-DDT4mIzD.mjs';
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-ExbveiC6.mjs';
 export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/SCHEMA_SNAPSHOT_VERSION-wWGP2_5E.mjs';
 export { schemaFromIr } from './packem_shared/schemaFromIr-DTYsLBaA.mjs';
 export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-CySpQPD3.mjs';

package/dist/packem_shared/{GENERATED_HEADER-BoVKLcnE.mjs → GENERATED_HEADER-D-AbhmRh.mjs}

@@ -749,6 +749,7 @@ const buildStorageBucketNames = (schema, ruleBuckets = []) => {
 };
 const emitServer = ({
   containers = [],
+  hasAccessFacade = false,
   hasAi = false,
   hasAnalytics = false,
   hasBrowser = false,
@@ -821,6 +822,9 @@ ${envBindingFields}` : ""}
 export type Env = CloudflareBindings;`;
   const kvContextField = hasKv ? `
     readonly kv: import("@lunora/bindings/kv").Kv;` : "";
+  const accessContextField = hasAccessFacade ? `
+    /** Verified Cloudflare Access identity — a synchronous facade over the resolved claims (email / groups / hasGroup / claims). Anonymous when no Access token is present. */
+    readonly access: import("@lunora/cloudflare-access/context").AccessFacade;` : "";
   const flagsContextField = hasFlags ? `
     /** Feature-flag evaluation (OpenFeature). Reads are memoized per request; evaluations never throw — a provider error resolves to the supplied default. */
     readonly flags: import("@lunora/flags").LunoraFlags;` : "";
@@ -938,19 +942,19 @@ type TypedTableGet = <T extends TableName>(id: IdOfTable<T>) => Promise<Doc<T> |
 export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"> {
     readonly db: Omit<DatabaseReader, "query" | "get"> & DatabaseReaderFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmReader;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${kvContextField}${flagsContextField}${analyticsContextField}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}
 }
 
 export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${workflowsOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${kvContextField}${flagsContextField}${analyticsContextField}${workflowsContextField}${queuesContextField}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}${workflowsContextField}${queuesContextField}
 }
 
 export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${workflowsOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: StorageBase<StorageBucketName>;${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${flagsContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}${queuesContextField}
+    readonly storage: StorageBase<StorageBucketName>;${accessContextField}${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${flagsContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}${queuesContextField}
 }
 
 /**
@@ -1361,6 +1365,21 @@ const emitFlagsFragments = (hasFlags) => {
     stub: ""
   };
 };
+const emitAccessFragments = (hasAccessFacade) => {
+  if (!hasAccessFacade) {
+    return EMPTY_HELPER_FRAGMENTS;
+  }
+  return {
+    build: `
+            const access = accessFacade(identity, userId);
+`,
+    configField: "",
+    contextField: `
+                access,`,
+    importLines: [`import { accessFacade } from "@lunora/cloudflare-access/context";`],
+    stub: ""
+  };
+};
 const emitFlagsOverrides = (flagKeys, hasFlags) => {
   if (!hasFlags) {
     return { constant: "", evaluateOverride: "", subscriptionOverride: "" };
@@ -1954,6 +1973,7 @@ const emitShard = ({
   advisories = [],
   containers = [],
   flagKeys = [],
+  hasAccessFacade = false,
   hasAi = false,
   hasAnalytics = false,
   hasBrowser = false,
@@ -1979,6 +1999,7 @@ const emitShard = ({
   const hasMutators = mutators.length > 0;
   const hasShapes = shapes.length > 0;
   const { build: aiBuild, configField: aiConfigField, contextField: aiContextField, stub: aiStub } = emitAiFragments(hasAi);
+  const accessFragments = emitAccessFragments(hasAccessFacade);
   const kvFragments = emitKvFragments(hasKv);
   const flagsFragments = emitFlagsFragments(hasFlags);
   const flagsOverrides = emitFlagsOverrides(flagKeys, hasFlags);
@@ -2126,6 +2147,7 @@ const LUNORA_RLS_READ_REGISTRY = buildRlsReadRegistry(Object.values(LUNORA_FUNCT
     importLines.push(`import type { AiBindingLike, LunoraAi } from "@lunora/ai";`, `import { createAi } from "@lunora/ai";`);
   }
   importLines.push(
+    ...accessFragments.importLines,
     ...kvFragments.importLines,
     ...flagsFragments.importLines,
     ...analyticsFragments.importLines,
@@ -2314,8 +2336,8 @@ ${schema.tables.map(
   const secretsBuild = `
             const secrets = createSecrets(env);
 `;
-  const everyContextBuild = `${kvFragments.build}${flagsFragments.build}${analyticsFragments.build}${secretsBuild}`;
-  const everyContextField = `${kvFragments.contextField}${flagsFragments.contextField}${analyticsFragments.contextField}
+  const everyContextBuild = `${accessFragments.build}${kvFragments.build}${flagsFragments.build}${analyticsFragments.build}${secretsBuild}`;
+  const everyContextField = `${accessFragments.contextField}${kvFragments.contextField}${flagsFragments.contextField}${analyticsFragments.contextField}
                 secrets,`;
   const actionOnlyHasAny = hasImages || hasHyperdrive || hasBrowser || hasR2sql || hasPipelines;
   const actionOnlyBlock = actionOnlyHasAny ? `

package/dist/packem_shared/{OPENRPC_VERSION-BMCOe3B6.mjs → OPENRPC_VERSION-DDT4mIzD.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-BoVKLcnE.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-D-AbhmRh.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { argsObjectSchema, LUNORA_ERROR_CODES } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{SCHEMA_SNAPSHOT_FILENAME-BA9tjjOl.mjs → SCHEMA_SNAPSHOT_FILENAME-ExbveiC6.mjs}

@@ -23,10 +23,10 @@ import { discoverShapes } from './SHAPES_FILENAME-ChV7MqgE.mjs';
 import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-Da8BKXcI.mjs';
 import { e as enclosingExportName$1 } from './discover-ast-CT6BgBr4.mjs';
 import { discoverWorkflows } from './WORKFLOWS_FILENAME-D62dcBGg.mjs';
-import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitCollections, emitContainers, emitWorkflows, emitQueues, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-BoVKLcnE.mjs';
-import { emitApp } from './emitApp-Bh0HsQVK.mjs';
-import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-CB2brlbc.mjs';
-import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-BMCOe3B6.mjs';
+import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitCollections, emitContainers, emitWorkflows, emitQueues, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-D-AbhmRh.mjs';
+import { emitApp } from './emitApp-CV81L74c.mjs';
+import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-DoK7_x1g.mjs';
+import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-DDT4mIzD.mjs';
 import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-wWGP2_5E.mjs';
 
 const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
@@ -243,6 +243,11 @@ const discoverArgumentValidators = (project, lunoraDirectory) => {
 };
 
 const PROBES = {
+  // The middleware (`accessContext()` / `accessRoles()`) imports the `/context`
+  // and `/roles` subpaths, NOT the bare `@lunora/cloudflare-access` specifier —
+  // so the per-procedure middleware never trips the global `ctx.access` wiring.
+  // A handler reading `ctx.access` is the signal that wires it onto every ctx.
+  access: { contextProperty: "access", moduleSpecifier: "@lunora/cloudflare-access" },
   ai: { contextProperty: "ai", moduleSpecifier: "@lunora/ai" },
   analytics: { contextProperty: "analytics", moduleSpecifier: "@lunora/bindings/analytics" },
   browser: { contextProperty: "browser", moduleSpecifier: "@lunora/browser" },
@@ -279,6 +284,7 @@ const readsContextProperty = (sourceFile, property) => {
 };
 const discoverFeatureUsage = (project, lunoraDirectory) => {
   const usage = {
+    access: false,
     ai: false,
     analytics: false,
     browser: false,
@@ -833,6 +839,7 @@ const runCodegen = (options) => {
   const hasAi = featureUsage.ai;
   const hasPayments = featureUsage.payments;
   const hasKv = featureUsage.kv;
+  const hasAccessFacade = featureUsage.access;
   const hasFlags = existsSync(join(lunoraDirectory, "flags.ts"));
   const flagKeys = hasFlags ? discoverFlagKeys(project, lunoraDirectory) : [];
   const hasHyperdrive = featureUsage.hyperdrive;
@@ -857,6 +864,7 @@ const runCodegen = (options) => {
   const apiContent = emitApi(functions, workflows, useUmbrella);
   const serverContent = emitServer({
     containers,
+    hasAccessFacade,
     hasAi,
     hasAnalytics,
     hasBrowser,
@@ -878,6 +886,7 @@ const runCodegen = (options) => {
     advisories,
     containers,
     flagKeys,
+    hasAccessFacade,
     hasAi,
     hasAnalytics,
     hasBrowser,
@@ -911,6 +920,7 @@ const runCodegen = (options) => {
   const wantsOpenApi = apiSpec === "openapi" || apiSpec === "both";
   const wantsOpenRpc = apiSpec === "openrpc" || apiSpec === "both";
   const appContent = emitApp({
+    hasAccess: dependencies.has("@lunora/cloudflare-access"),
     hasAi,
     hasAnalytics,
     hasAuth: dependencies.has("@lunora/auth"),

package/dist/packem_shared/{buildOpenApiDocument-CB2brlbc.mjs → buildOpenApiDocument-DoK7_x1g.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-BoVKLcnE.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-D-AbhmRh.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { LUNORA_ERROR_CODES, objectSchema, argsObjectSchema, validatorIrToJsonSchema } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{emitApp-Bh0HsQVK.mjs → emitApp-CV81L74c.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-BoVKLcnE.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-D-AbhmRh.mjs';
 
 const LONG_TAIL = [
   ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
@@ -22,8 +22,25 @@ const LONG_TAIL = [
   ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
 ];
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
+const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
+  `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
+  `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
+] : [];
 const buildImportLines = (options) => {
-  const { hasAuth, hasFramework, hasGlobal, hasHyperdriveGlobal, hasQueue, hasScheduler, hasStorage, hasWorkflow, useUmbrella, wantsOpenApi, wantsOpenRpc } = options;
+  const {
+    hasAccess,
+    hasAuth,
+    hasFramework,
+    hasGlobal,
+    hasHyperdriveGlobal,
+    hasQueue,
+    hasScheduler,
+    hasStorage,
+    hasWorkflow,
+    useUmbrella,
+    wantsOpenApi,
+    wantsOpenRpc
+  } = options;
   const runtimeModule = useUmbrella ? "lunorash/runtime" : "@lunora/runtime";
   const runtimeTypeImports = ["ExecutionContextLike", "LunoraWorker", "Route", "ScheduledControllerLike", "ShardNamespaceLike", "WorkerOptions"];
   if (hasGlobal) {
@@ -42,6 +59,7 @@ const buildImportLines = (options) => {
       `import type { LunoraAuth, LunoraAuthOptions } from "@lunora/auth";`,
       `import { createAuth, createAuthAdmin, ensureMigrated, handleAuthRequest, lunoraD1Adapter } from "@lunora/auth";`
     ] : [],
+    ...buildAccessImports(hasAccess, hasAuth),
     ...hasGlobal ? [
       `import type { D1CtxDbOptions, D1DatabaseLike, D1Exec } from "@lunora/d1";`,
       `import { createD1CtxDb, facetGlobalColumn, listGlobalTables, readGlobalTablePage } from "@lunora/d1";`
@@ -120,9 +138,10 @@ interface AuthDeclaration<Env> {
   ] : []
 ];
 const buildFieldLines = (options) => [
+  ...options.hasAccess ? [`    private accessSelector?: Selector<Env, CreateAccessResolverOptions>;`] : [],
   `    private adminToken?: Selector<Env, string>;`,
   ...options.hasAuth ? [`    private authDeclaration?: AuthDeclaration<Env>;`] : [],
-  `    private readonly extendFns: ((env: Env) => Partial<WorkerOptions>)[] = [];`,
+  `    private readonly extendFns: ((env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>)[] = [];`,
   ...options.hasGlobal ? [`    private globalDeclaration?: GlobalDeclaration<Env>;`] : [],
   ...options.hasHyperdriveGlobal ? [`    private hyperdriveGlobalDeclaration?: HyperdriveGlobalDeclaration<Env>;`] : [],
   `    private readonly routeMap: Record<string, Route> = {};`,
@@ -140,6 +159,14 @@ const buildLongTailMethods = (options) => LONG_TAIL.filter(([flag]) => options[f
     }`
 );
 const buildMethodBlocks = (options) => [
+  ...options.hasAccess ? [
+    `    /** Wire Cloudflare Access (Zero Trust) — verifies the \`Cf-Access-Jwt-Assertion\` JWT and feeds the identity into \`ctx.auth\` / RLS via \`resolveIdentity\`. When \`.auth(...)\` is also configured, Access is composed ahead of it (Access wins when its JWT is present; everyone else falls through to the app session). */
+    public access(selector: Selector<Env, CreateAccessResolverOptions>): this {
+        this.accessSelector = selector;
+
+        return this;
+    }`
+  ] : [],
   `    /** Bearer token gating the \`/_lunora/admin/*\` endpoints the studio calls. */
     public admin(selector: Selector<Env, string>): this {
         this.adminToken = selector;
@@ -154,8 +181,8 @@ const buildMethodBlocks = (options) => [
         return this;
     }`
   ] : [],
-  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. */
-    public extend(fn: (env: Env) => Partial<WorkerOptions>): this {
+  `    /** Escape hatch — merge raw \`WorkerOptions\` (anything not yet sugared) over the derived options at build time. The second \`derived\` argument is a snapshot of the options assembled so far (after \`.auth(...)\` etc.), so you can compose rather than clobber — e.g. wrap \`derived.resolveIdentity\` instead of replacing it. */
+    public extend(fn: (env: Env, derived: Readonly<WorkerOptions>) => Partial<WorkerOptions>): this {
         this.extendFns.push(fn);
 
         return this;
@@ -344,6 +371,21 @@ const buildWorkerOptionLines = (options) => [
 
             options.authAdmin = authInstance ? createAuthAdmin(authInstance) : undefined;
         }`
+  ] : [],
+  // Cloudflare Access — runs AFTER the auth block so it can compose ahead of
+  // the better-auth resolver rather than clobber it. With `.auth()` present,
+  // a request carrying a verified Access JWT is authenticated by Access and
+  // everyone else falls through to the app session; without it, Access is the
+  // sole resolver.
+  ...options.hasAccess ? [
+    options.hasAuth ? `        if (this.accessSelector) {
+            const accessResolver = createAccessResolver(this.accessSelector(env));
+            const fallback = options.resolveIdentity;
+
+            options.resolveIdentity = fallback ? composeResolvers(accessResolver, fallback) : accessResolver;
+        }` : `        if (this.accessSelector) {
+            options.resolveIdentity = createAccessResolver(this.accessSelector(env));
+        }`
   ] : []
 ];
 const buildBaseWorkerOptions = (options) => [
@@ -599,7 +641,7 @@ ${buildBaseWorkerOptions(options).join("\n")}
         }
 
 ${workerOptionLines.join("\n\n")}${workerOptionLines.length > 0 ? "\n\n" : ""}        for (const fn of this.extendFns) {
-            Object.assign(options, fn(env));
+            Object.assign(options, fn(env, { ...options }));
         }
 
         return options;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.17",
+  "version": "1.0.0-alpha.18",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",