@runlot/access 0.1.0-rc.17 → 0.1.0-rc.171

package/dist/index.d.ts

@@ -1,19 +1,64 @@
 export type AccessMode = "public" | "org" | "password" | "bypass";
 export type OrgRole = "admin" | "member" | "viewer";
 export interface Identity {
-    /** front 가 판정한 모드. `public` 이면 나머지는 비어 있다. */
+    /** The mode the front decided. When it is `public`, the rest is empty. */
     mode: AccessMode;
-    /** 사용자 id. `password` 모드는 `pw:…`, `bypass` 는 `bypass`. */
+    /** The user id. In `password` mode it is `pw:…`, in `bypass` it is
+     *  `bypass`. */
     subject: string | null;
     email: string | null;
     orgRole: OrgRole | null;
 }
 /**
- * 요청의 신원. 헤더가 아예 없으면(front 밖에서 돈다 — 로컬 `wrangler dev` 류)
- * `public` 으로 읽는다: front 가 Mode 를 **항상** 붙이므로, 없는 것은 "판정이
- * 없었다" 이고 그것은 열린 것과 같다.
+ * The identity of the request. When the headers are absent entirely (running
+ * outside the front — local `wrangler dev` and the like) it reads as `public`:
+ * the front **always** attaches Mode, so its absence means "there was no
+ * decision", and that is the same as open.
  */
 export declare function identity(request: Request): Identity;
-/** 로그인이 있는가 — `public` 도 `bypass` 도 아닌 사람. */
+/** Is there a login — somebody who is neither `public` nor `bypass`. */
 export declare function isSignedIn(who: Identity): boolean;
+export interface AccessClaims {
+    iss: string;
+    aud: string[];
+    /** The user id, or `svc:<name>` for a service credential. */
+    sub: string;
+    email?: string;
+    common_name?: string;
+    type: "app";
+    idp?: string;
+    identity_nonce?: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    runlot: {
+        project: string;
+        mode: "allow" | "service_auth";
+        org_role?: OrgRole;
+    };
+}
+export interface VerifyOptions {
+    /** The project id the token must be addressed to. */
+    aud: string;
+    /** The org slug — the `<org>` in `https://<dash>/access/<org>`. */
+    org: string;
+    /** The dashboard origin. Default `https://dash.runlot.io`. */
+    dashboard?: string;
+    /** Clock skew allowance in seconds. Default 60. */
+    leeway?: number;
+    /** Injected for tests or non-global runtimes. */
+    fetch?: (input: string, init?: RequestInit) => Promise<Response>;
+}
+export declare class AccessVerifyError extends Error {
+    constructor(message: string);
+}
+export declare const ACCESS_JWT_HEADER = "Runlot-Access-Jwt";
+/** Test hook: drop every cached key set. */
+export declare function _resetJwksCache(): void;
+/**
+ * Verify the request's `Runlot-Access-Jwt`. Resolves to the claims, or rejects
+ * with `AccessVerifyError` (missing, malformed, wrong signature, issuer,
+ * audience, or time).
+ */
+export declare function verify(request: Request, opts: VerifyOptions): Promise<AccessClaims>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,QAAQ;IACvB,8CAA8C;IAC9C,IAAI,EAAE,UAAU,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAKD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAYnD;AAED,8CAA8C;AAC9C,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAEjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,IAAI,EAAE,UAAU,CAAC;IACjB;oBACgB;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAYnD;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAEjD;AAaD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAUrD,4CAA4C;AAC5C,wBAAgB,eAAe,IAAI,IAAI,CAGtC;AAiDD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCzF"}

package/dist/index.js

@@ -1,19 +1,23 @@
-// `identity(request)` — front 가 붙인 신원을 읽는다 (docs/access.md §4.2).
+// `identity(request)` — reads the identity the front attached
+// (docs/access.md §4.2).
 //
-// `env.auth` 가 아니라 요청에서 읽는 이유는 취향이 아니라 제약이다: `env` 는
-// 워커 수명 동안 고정된 묶음이고 신원은 요청마다 다른 값이다. 요청에서 읽으면
-// 암묵 저장소(AsyncLocalStorage)가 스트리밍·waitUntil 경계에서 끊기는 문제가
-// 아예 없다.
+// Reading it from the request rather than from `env.auth` is a constraint, not
+// a taste: `env` is a bundle fixed for the lifetime of the worker, and the
+// identity is a different value on every request. Reading it from the request
+// means the problem of an implicit store (AsyncLocalStorage) being cut at a
+// streaming or waitUntil boundary does not exist at all.
 //
-// 헤더는 front 가 인바운드 `Runlot-*` 를 전부 지운 뒤 붙이므로 위조가 안 된다
-// (proto/front-headers.md). 이 함수는 그것을 **믿는다** — 워커가 front 를 지나지
-// 않고 직접 열리는 배치는 없다.
+// The headers cannot be forged, because the front attaches them after erasing
+// every inbound `Runlot-*` (proto/front-headers.md). This function **trusts**
+// that — there is no deployment where a worker is opened directly without
+// passing through the front.
 const MODES = new Set(["public", "org", "password", "bypass"]);
 const ROLES = new Set(["admin", "member", "viewer"]);
 /**
- * 요청의 신원. 헤더가 아예 없으면(front 밖에서 돈다 — 로컬 `wrangler dev` 류)
- * `public` 으로 읽는다: front 가 Mode 를 **항상** 붙이므로, 없는 것은 "판정이
- * 없었다" 이고 그것은 열린 것과 같다.
+ * The identity of the request. When the headers are absent entirely (running
+ * outside the front — local `wrangler dev` and the like) it reads as `public`:
+ * the front **always** attaches Mode, so its absence means "there was no
+ * decision", and that is the same as open.
  */
 export function identity(request) {
     const h = request.headers;
@@ -29,8 +33,122 @@ export function identity(request) {
         orgRole: rawRole !== null && ROLES.has(rawRole) ? rawRole : null,
     };
 }
-/** 로그인이 있는가 — `public` 도 `bypass` 도 아닌 사람. */
+/** Is there a login — somebody who is neither `public` nor `bypass`. */
 export function isSignedIn(who) {
     return who.mode === "org";
 }
+export class AccessVerifyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AccessVerifyError";
+    }
+}
+export const ACCESS_JWT_HEADER = "Runlot-Access-Jwt";
+const JWKS_TTL_MS = 5 * 60 * 1000;
+const REFETCH_MIN_MS = 30 * 1000;
+const jwksCache = new Map();
+/** Test hook: drop every cached key set. */
+export function _resetJwksCache() {
+    jwksCache.clear();
+    missRefetchAt.clear();
+}
+function b64urlDecode(s) {
+    const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - (s.length % 4));
+    const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+async function loadJwks(url, f) {
+    const res = await f(url, { headers: { accept: "application/json" } });
+    if (!res.ok)
+        throw new AccessVerifyError(`JWKS fetch failed: ${res.status}`);
+    const body = (await res.json());
+    const keys = new Map();
+    for (const k of body.keys ?? []) {
+        if (k.kty !== "EC" || k.crv !== "P-256" || !k.kid || !k.x || !k.y)
+            continue;
+        const jwk = { kty: "EC", crv: "P-256", x: k.x, y: k.y, ext: true };
+        const key = await crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+        keys.set(k.kid, key);
+    }
+    return { keys, fetchedAt: Date.now() };
+}
+async function keyFor(url, kid, f) {
+    const now = Date.now();
+    const cached = jwksCache.get(url);
+    const entry = cached ? await cached.catch(() => undefined) : undefined;
+    if (entry && now - entry.fetchedAt < JWKS_TTL_MS) {
+        if (entry.keys.has(kid))
+            return entry.keys.get(kid);
+        // An unknown kid is either a rotation (refetch now) or garbage (do not let
+        // it turn every request into a JWKS fetch): at most one refetch per window.
+        if (now - (missRefetchAt.get(url) ?? 0) < REFETCH_MIN_MS)
+            return undefined;
+        missRefetchAt.set(url, now);
+    }
+    const p = loadJwks(url, f);
+    jwksCache.set(url, p);
+    try {
+        return (await p).keys.get(kid);
+    }
+    catch (e) {
+        jwksCache.delete(url);
+        throw e instanceof AccessVerifyError ? e : new AccessVerifyError(`JWKS fetch failed: ${String(e)}`);
+    }
+}
+const missRefetchAt = new Map();
+/**
+ * Verify the request's `Runlot-Access-Jwt`. Resolves to the claims, or rejects
+ * with `AccessVerifyError` (missing, malformed, wrong signature, issuer,
+ * audience, or time).
+ */
+export async function verify(request, opts) {
+    const tok = request.headers.get(ACCESS_JWT_HEADER);
+    if (!tok)
+        throw new AccessVerifyError("no Runlot-Access-Jwt header");
+    const parts = tok.split(".");
+    if (parts.length !== 3)
+        throw new AccessVerifyError("malformed token");
+    const [h64, p64, s64] = parts;
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(new TextDecoder().decode(b64urlDecode(h64)));
+        claims = JSON.parse(new TextDecoder().decode(b64urlDecode(p64)));
+    }
+    catch {
+        throw new AccessVerifyError("malformed token");
+    }
+    if (header.alg !== "ES256" || !header.kid)
+        throw new AccessVerifyError("unsupported token header");
+    const iss = `${(opts.dashboard ?? "https://dash.runlot.io").replace(/\/+$/, "")}/access/${opts.org}`;
+    const f = opts.fetch ?? ((input, init) => fetch(input, init));
+    const key = await keyFor(`${iss}/certs`, header.kid, f);
+    if (!key)
+        throw new AccessVerifyError("unknown signing key");
+    let sig;
+    try {
+        sig = b64urlDecode(s64);
+    }
+    catch {
+        throw new AccessVerifyError("malformed signature");
+    }
+    const ok = sig.length === 64 && await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, sig, new TextEncoder().encode(`${h64}.${p64}`));
+    if (!ok)
+        throw new AccessVerifyError("bad signature");
+    if (claims.iss !== iss)
+        throw new AccessVerifyError("wrong issuer");
+    const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (!aud.includes(opts.aud))
+        throw new AccessVerifyError("wrong audience");
+    const now = Math.floor(Date.now() / 1000);
+    const leeway = opts.leeway ?? 60;
+    if (typeof claims.exp !== "number" || now >= claims.exp + leeway)
+        throw new AccessVerifyError("expired");
+    if (typeof claims.nbf === "number" && now < claims.nbf - leeway)
+        throw new AccessVerifyError("not yet valid");
+    return claims;
+}
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,qDAAqD;AACrD,8CAA8C;AAC9C,yDAAyD;AACzD,SAAS;AACT,EAAE;AACF,sDAAsD;AACtD,gEAAgE;AAChE,oBAAoB;AAcpB,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpF,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAe,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnC,OAAO,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAmB,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,yBAAyB;AACzB,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,6BAA6B;AAe7B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpF,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAe,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnC,OAAO,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAmB,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;AAC5B,CAAC;AA0CD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAMjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;AAExD,4CAA4C;AAC5C,MAAM,UAAU,eAAe;IAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,CAAsC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5E,MAAM,GAAG,GAAe,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,GAAG,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC1D,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,GAAW,EAAE,CAAsC;IACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc;YAAE,OAAO,SAAS,CAAC;QAC3E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,YAAY,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,sBAAsB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,IAAmB;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAiC,CAAC;IAC1D,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IAEnG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,GAAG,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAmB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CACxG,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC9G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@runlot/access",
-  "version": "0.1.0-rc.17",
-  "description": "front 가 붙인 접근 신원(Runlot-Access-*)을 읽는다 (docs/access.md §4.2)",
+  "version": "0.1.0-rc.171",
+  "description": "Reads the access identity (Runlot-Access-* headers) that Runlot attaches to a request",
   "publishConfig": {
     "access": "public"
   },
@@ -26,7 +26,7 @@
     "@types/node": "^22.10.2",
     "esbuild": "^0.24.2",
     "typescript": "^5.7.2",
-    "@runlot/config": "0.1.0-rc.17"
+    "@runlot/config": "0.1.0-rc.171"
   },
   "scripts": {
     "test": "node build.mjs",