@dbx-tools/shared-email 0.6.90 → 0.6.92

package/README.md

@@ -1,13 +1,10 @@
 # @dbx-tools/shared-email
 
-Browser-safe email schemas and inferred types, for both things email is used for
-here: SENDING a message, and using an emailed code to LOG IN.
+Browser-safe email sending schemas and inferred types.
 
 Import this package when a UI, Mastra tool schema, server route, or test needs
 to validate the same email payloads that
-[`@dbx-tools/email`](../../node/email) sends, or the same one-time-code login
-payloads that [`@dbx-tools/tunnel`](../../node/tunnel) and
-[`@dbx-tools/cli-tunnel`](../../cli/tunnel) gate traffic with.
+[`@dbx-tools/email`](../../node/email) sends.
 
 Key features:
 
@@ -19,9 +16,6 @@ Key features:
   a browser client.
 - Model/tool-friendly schemas that avoid JSON Schema constraints known to cause
   problems with some serving endpoints.
-- Email one-time-code ACCESS GATE contract: the request/verify/status payloads
-  and the one session cookie name, so the two server paths that implement the
-  gate and the React `AuthGate` that drives it validate against one definition.
 
 ## Validate A Drafted Message
 
@@ -60,37 +54,13 @@ const senders = email.emailSendersSchema.parse(
 The sender schema describes the concrete `From` choices for the current user,
 the default sender, and whether the list is restricted by policy.
 
-## Gate An App Behind An Emailed Code
-
-```ts
-import { auth, SESSION_COOKIE_NAME } from "@dbx-tools/shared-email";
-
-const { email } = auth.authRequestSchema.parse(await request.json());
-const status = auth.authStatusSchema.parse(await (await fetch("/api/email/auth/status")).json());
-```
-
-The flow is `POST /request` (email) → a 6-digit code is emailed → `POST /verify`
-(email + code) → an HttpOnly session cookie named `SESSION_COOKIE_NAME` is set →
-`GET /status` reports whether the caller is authenticated.
-
-`request` ALWAYS reports success. That is deliberate anti-enumeration: the
-response never reveals whether an address is allow-listed or was actually sent a
-code, so a client cannot use the login form to discover who has access. Treat a
-`{ ok: true }` from `request` as "the request was accepted", never as "that
-address exists".
-
-`SESSION_COOKIE_NAME` lives here rather than in either server package because
-both the in-process gate and the CLI reverse proxy SET it, and browser code
-reads it — three places that must agree on one string.
-
 ## Modules
 
 - `email` - `emailAttachmentSchema`, `emailMessageSchema`,
   `emailResultSchema`, `emailSendersSchema`, and flat inferred types:
   `EmailAttachment`, `EmailMessage`, `EmailResult`, and `EmailSenders`.
-- `auth` - the OTP gate wire format: `authRequestSchema`,
-  `authRequestResultSchema`, `authVerifySchema`, `authVerifyResultSchema`,
-  `authStatusSchema`, `SESSION_COOKIE_NAME`, and their inferred types.
+  The schemas intentionally avoid array `.min()` constraints so they can be reused
+  as model/tool JSON schemas for serving endpoints that reject `minItems`.
 
-The schemas intentionally avoid array `.min()` constraints so they can be reused
-as model/tool JSON schemas for serving endpoints that reject `minItems`.
+Passwordless authentication contracts live in
+[`@dbx-tools/shared-auth`](../auth).

package/index.ts

@@ -2,9 +2,7 @@
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
 
-export * as auth from "./src/auth.ts";
+export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-email";
 export * as email from "./src/email.ts";
-export { SESSION_COOKIE_NAME, authRequestSchema, authRequestResultSchema, authVerifySchema, authVerifyResultSchema, authStatusSchema } from "./src/auth.ts";
-export type { AuthRequest, AuthRequestResult, AuthVerify, AuthVerifyResult, AuthStatus } from "./src/auth.ts";
 export { emailAttachmentSchema, emailMessageSchema, emailResultSchema, emailSendersSchema } from "./src/email.ts";
 export type { EmailAttachment, EmailMessage, EmailResult, EmailSenders } from "./src/email.ts";

package/lib/index.d.ts

@@ -1,6 +1,4 @@
-export * as auth from "./src/auth.ts";
+export declare const PACKAGE_IDENTIFIER = "@dbx-tools/shared-email";
 export * as email from "./src/email.ts";
-export { SESSION_COOKIE_NAME, authRequestSchema, authRequestResultSchema, authVerifySchema, authVerifyResultSchema, authStatusSchema } from "./src/auth.ts";
-export type { AuthRequest, AuthRequestResult, AuthVerify, AuthVerifyResult, AuthStatus } from "./src/auth.ts";
 export { emailAttachmentSchema, emailMessageSchema, emailResultSchema, emailSendersSchema } from "./src/email.ts";
 export type { EmailAttachment, EmailMessage, EmailResult, EmailSenders } from "./src/email.ts";

package/lib/index.js

@@ -1,8 +1,7 @@
 // GENERATED by projen watch - DO NOT EDIT.
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
-export * as auth from "./src/auth.js";
+export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-email";
 export * as email from "./src/email.js";
-export { SESSION_COOKIE_NAME, authRequestSchema, authRequestResultSchema, authVerifySchema, authVerifyResultSchema, authStatusSchema } from "./src/auth.js";
 export { emailAttachmentSchema, emailMessageSchema, emailResultSchema, emailSendersSchema } from "./src/email.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxPQUFPLEtBQUssSUFBSSxNQUFNLGVBQWUsQ0FBQztBQUN0QyxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBQ3hDLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxpQkFBaUIsRUFBRSx1QkFBdUIsRUFBRSxnQkFBZ0IsRUFBRSxzQkFBc0IsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUU1SixPQUFPLEVBQUUscUJBQXFCLEVBQUUsa0JBQWtCLEVBQUUsaUJBQWlCLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIEdFTkVSQVRFRCBieSBwcm9qZW4gd2F0Y2ggLSBETyBOT1QgRURJVC5cbi8vIFJlZ2VuZXJhdGVkIGZyb20gdGhlIGV4cG9ydGluZyBtb2R1bGVzIGluIC4vc3JjLlxuLy8gSGFuZCBlZGl0cyBhcmUgb3ZlcndyaXR0ZW4gb24gdGhlIG5leHQgd2F0Y2g7IHRoaXMgZmlsZSBpcyByZWFkLW9ubHkuXG5cbmV4cG9ydCAqIGFzIGF1dGggZnJvbSBcIi4vc3JjL2F1dGgudHNcIjtcbmV4cG9ydCAqIGFzIGVtYWlsIGZyb20gXCIuL3NyYy9lbWFpbC50c1wiO1xuZXhwb3J0IHsgU0VTU0lPTl9DT09LSUVfTkFNRSwgYXV0aFJlcXVlc3RTY2hlbWEsIGF1dGhSZXF1ZXN0UmVzdWx0U2NoZW1hLCBhdXRoVmVyaWZ5U2NoZW1hLCBhdXRoVmVyaWZ5UmVzdWx0U2NoZW1hLCBhdXRoU3RhdHVzU2NoZW1hIH0gZnJvbSBcIi4vc3JjL2F1dGgudHNcIjtcbmV4cG9ydCB0eXBlIHsgQXV0aFJlcXVlc3QsIEF1dGhSZXF1ZXN0UmVzdWx0LCBBdXRoVmVyaWZ5LCBBdXRoVmVyaWZ5UmVzdWx0LCBBdXRoU3RhdHVzIH0gZnJvbSBcIi4vc3JjL2F1dGgudHNcIjtcbmV4cG9ydCB7IGVtYWlsQXR0YWNobWVudFNjaGVtYSwgZW1haWxNZXNzYWdlU2NoZW1hLCBlbWFpbFJlc3VsdFNjaGVtYSwgZW1haWxTZW5kZXJzU2NoZW1hIH0gZnJvbSBcIi4vc3JjL2VtYWlsLnRzXCI7XG5leHBvcnQgdHlwZSB7IEVtYWlsQXR0YWNobWVudCwgRW1haWxNZXNzYWdlLCBFbWFpbFJlc3VsdCwgRW1haWxTZW5kZXJzIH0gZnJvbSBcIi4vc3JjL2VtYWlsLnRzXCI7XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyx5QkFBeUIsQ0FBQztBQUM1RCxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBQ3hDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxrQkFBa0IsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9zaGFyZWQtZW1haWxcIjtcbmV4cG9ydCAqIGFzIGVtYWlsIGZyb20gXCIuL3NyYy9lbWFpbC50c1wiO1xuZXhwb3J0IHsgZW1haWxBdHRhY2htZW50U2NoZW1hLCBlbWFpbE1lc3NhZ2VTY2hlbWEsIGVtYWlsUmVzdWx0U2NoZW1hLCBlbWFpbFNlbmRlcnNTY2hlbWEgfSBmcm9tIFwiLi9zcmMvZW1haWwudHNcIjtcbmV4cG9ydCB0eXBlIHsgRW1haWxBdHRhY2htZW50LCBFbWFpbE1lc3NhZ2UsIEVtYWlsUmVzdWx0LCBFbWFpbFNlbmRlcnMgfSBmcm9tIFwiLi9zcmMvZW1haWwudHNcIjtcbiJdfQ==

package/lib/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/auth.ts","../src/email.ts","../index.ts"],"version":"5.9.3"}
+{"root":["../src/email.ts","../index.ts"],"version":"5.9.3"}

package/package.json

@@ -23,7 +23,7 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@dbx-tools/shared-core": "0.6.90",
+    "@dbx-tools/shared-core": "0.6.92",
     "zod": "4.3.6"
   },
   "main": "./lib/index.js",
@@ -40,7 +40,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.6.90",
+  "version": "0.6.92",
   "types": "./lib/index.d.ts",
   "type": "module",
   "exports": {

package/lib/src/auth.d.ts

@@ -1,69 +0,0 @@
-/**
- * Wire-format contract for the email one-time-password ACCESS GATE.
- *
- * A companion to the email add-on's send contract ({@link ./email}): where that
- * lets an agent send mail, this lets an AppKit app put an email-OTP gate in front
- * of itself - the login flow for an app exposed publicly (e.g. through a portr
- * tunnel that bypasses the Databricks front door). Pure zod so the server routes,
- * the React `AuthGate`, and any client validate against one definition.
- *
- * Flow: `POST /request` (email) -> a 6-digit code is emailed -> `POST /verify`
- * (email + code) -> an HttpOnly session cookie is set -> `GET /status` reports
- * whether the caller is authenticated. `request` ALWAYS reports success (the
- * server never reveals whether an address is allow-listed or was actually sent a
- * code - anti-enumeration).
- *
- * @module
- */
-import { z } from "zod";
-/**
- * Name of the HttpOnly cookie the tunnel gate stores its session JWT in. Shared
- * so the proxy (which sets it) and any client-side code agree on one name.
- */
-export declare const SESSION_COOKIE_NAME = "dbx-tools-auth";
-/** `POST /api/email/auth/request` body: ask for a code to be emailed. */
-export declare const authRequestSchema: z.ZodObject<{
-    email: z.ZodString;
-}, z.core.$strip>;
-/** {@link authRequestSchema} */
-export type AuthRequest = z.infer<typeof authRequestSchema>;
-/**
- * `POST /api/email/auth/request` response. Always `{ ok: true }` on a
- * well-formed request, regardless of whether the address was allowed or a code
- * was actually sent - the client cannot distinguish an allowed address from a
- * rejected one (anti-enumeration). `retryAfter` is set only when the caller is
- * rate-limited, so a UI can show a cooldown without leaking allow-list state.
- */
-export declare const authRequestResultSchema: z.ZodObject<{
-    ok: z.ZodLiteral<true>;
-    retryAfter: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-/** {@link authRequestResultSchema} */
-export type AuthRequestResult = z.infer<typeof authRequestResultSchema>;
-/** `POST /api/email/auth/verify` body: submit the emailed code. */
-export declare const authVerifySchema: z.ZodObject<{
-    email: z.ZodString;
-    code: z.ZodString;
-}, z.core.$strip>;
-/** {@link authVerifySchema} */
-export type AuthVerify = z.infer<typeof authVerifySchema>;
-/**
- * `POST /api/email/auth/verify` response. `ok` true means the code matched and
- * an HttpOnly session cookie was set; false means it did not (wrong, expired, or
- * too many attempts) - the message is deliberately generic. `retryAfter` is set
- * when the failure was a rate limit.
- */
-export declare const authVerifyResultSchema: z.ZodObject<{
-    ok: z.ZodBoolean;
-    retryAfter: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-/** {@link authVerifyResultSchema} */
-export type AuthVerifyResult = z.infer<typeof authVerifyResultSchema>;
-/** `GET /api/email/auth/status` response: is the caller authenticated, and as whom. */
-export declare const authStatusSchema: z.ZodObject<{
-    authenticated: z.ZodBoolean;
-    email: z.ZodOptional<z.ZodString>;
-    enabled: z.ZodBoolean;
-}, z.core.$strip>;
-/** {@link authStatusSchema} */
-export type AuthStatus = z.infer<typeof authStatusSchema>;

package/lib/src/auth.js

@@ -1,65 +0,0 @@
-/**
- * Wire-format contract for the email one-time-password ACCESS GATE.
- *
- * A companion to the email add-on's send contract ({@link ./email}): where that
- * lets an agent send mail, this lets an AppKit app put an email-OTP gate in front
- * of itself - the login flow for an app exposed publicly (e.g. through a portr
- * tunnel that bypasses the Databricks front door). Pure zod so the server routes,
- * the React `AuthGate`, and any client validate against one definition.
- *
- * Flow: `POST /request` (email) -> a 6-digit code is emailed -> `POST /verify`
- * (email + code) -> an HttpOnly session cookie is set -> `GET /status` reports
- * whether the caller is authenticated. `request` ALWAYS reports success (the
- * server never reveals whether an address is allow-listed or was actually sent a
- * code - anti-enumeration).
- *
- * @module
- */
-import { z } from "zod";
-/**
- * Name of the HttpOnly cookie the tunnel gate stores its session JWT in. Shared
- * so the proxy (which sets it) and any client-side code agree on one name.
- */
-export const SESSION_COOKIE_NAME = "dbx-tools-auth";
-/** `POST /api/email/auth/request` body: ask for a code to be emailed. */
-export const authRequestSchema = z.object({
-    email: z.string().describe("Address to email a one-time code to, if it is allowed."),
-});
-/**
- * `POST /api/email/auth/request` response. Always `{ ok: true }` on a
- * well-formed request, regardless of whether the address was allowed or a code
- * was actually sent - the client cannot distinguish an allowed address from a
- * rejected one (anti-enumeration). `retryAfter` is set only when the caller is
- * rate-limited, so a UI can show a cooldown without leaking allow-list state.
- */
-export const authRequestResultSchema = z.object({
-    ok: z.literal(true).describe("Always true for a well-formed request (anti-enumeration)."),
-    retryAfter: z
-        .number()
-        .optional()
-        .describe("Seconds to wait before requesting again, when rate-limited."),
-});
-/** `POST /api/email/auth/verify` body: submit the emailed code. */
-export const authVerifySchema = z.object({
-    email: z.string().describe("The address the code was requested for."),
-    code: z.string().describe("The one-time code from the email."),
-});
-/**
- * `POST /api/email/auth/verify` response. `ok` true means the code matched and
- * an HttpOnly session cookie was set; false means it did not (wrong, expired, or
- * too many attempts) - the message is deliberately generic. `retryAfter` is set
- * when the failure was a rate limit.
- */
-export const authVerifyResultSchema = z.object({
-    ok: z.boolean().describe("True when the code matched and a session was established."),
-    retryAfter: z.number().optional().describe("Seconds to wait before retrying, when rate-limited."),
-});
-/** `GET /api/email/auth/status` response: is the caller authenticated, and as whom. */
-export const authStatusSchema = z.object({
-    authenticated: z.boolean().describe("True when the request carries a valid session."),
-    email: z.string().optional().describe("The authenticated address, when authenticated."),
-    enabled: z
-        .boolean()
-        .describe("True when the gate is active; false means the app is open (no login needed)."),
-});
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBRUgsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4Qjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxnQkFBZ0IsQ0FBQztBQUVwRCx5RUFBeUU7QUFDekUsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN4QyxLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyx3REFBd0QsQ0FBQztDQUNyRixDQUFDLENBQUM7QUFLSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQzlDLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQywyREFBMkQsQ0FBQztJQUN6RixVQUFVLEVBQUUsQ0FBQztTQUNWLE1BQU0sRUFBRTtTQUNSLFFBQVEsRUFBRTtTQUNWLFFBQVEsQ0FBQyw2REFBNkQsQ0FBQztDQUMzRSxDQUFDLENBQUM7QUFLSCxtRUFBbUU7QUFDbkUsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN2QyxLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyx5Q0FBeUMsQ0FBQztJQUNyRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxtQ0FBbUMsQ0FBQztDQUMvRCxDQUFDLENBQUM7QUFLSDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDN0MsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxRQUFRLENBQUMsMkRBQTJELENBQUM7SUFDckYsVUFBVSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMscURBQXFELENBQUM7Q0FDbEcsQ0FBQyxDQUFDO0FBS0gsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDdkMsYUFBYSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxRQUFRLENBQUMsZ0RBQWdELENBQUM7SUFDckYsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMsZ0RBQWdELENBQUM7SUFDdkYsT0FBTyxFQUFFLENBQUM7U0FDUCxPQUFPLEVBQUU7U0FDVCxRQUFRLENBQUMsOEVBQThFLENBQUM7Q0FDNUYsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBXaXJlLWZvcm1hdCBjb250cmFjdCBmb3IgdGhlIGVtYWlsIG9uZS10aW1lLXBhc3N3b3JkIEFDQ0VTUyBHQVRFLlxuICpcbiAqIEEgY29tcGFuaW9uIHRvIHRoZSBlbWFpbCBhZGQtb24ncyBzZW5kIGNvbnRyYWN0ICh7QGxpbmsgLi9lbWFpbH0pOiB3aGVyZSB0aGF0XG4gKiBsZXRzIGFuIGFnZW50IHNlbmQgbWFpbCwgdGhpcyBsZXRzIGFuIEFwcEtpdCBhcHAgcHV0IGFuIGVtYWlsLU9UUCBnYXRlIGluIGZyb250XG4gKiBvZiBpdHNlbGYgLSB0aGUgbG9naW4gZmxvdyBmb3IgYW4gYXBwIGV4cG9zZWQgcHVibGljbHkgKGUuZy4gdGhyb3VnaCBhIHBvcnRyXG4gKiB0dW5uZWwgdGhhdCBieXBhc3NlcyB0aGUgRGF0YWJyaWNrcyBmcm9udCBkb29yKS4gUHVyZSB6b2Qgc28gdGhlIHNlcnZlciByb3V0ZXMsXG4gKiB0aGUgUmVhY3QgYEF1dGhHYXRlYCwgYW5kIGFueSBjbGllbnQgdmFsaWRhdGUgYWdhaW5zdCBvbmUgZGVmaW5pdGlvbi5cbiAqXG4gKiBGbG93OiBgUE9TVCAvcmVxdWVzdGAgKGVtYWlsKSAtPiBhIDYtZGlnaXQgY29kZSBpcyBlbWFpbGVkIC0+IGBQT1NUIC92ZXJpZnlgXG4gKiAoZW1haWwgKyBjb2RlKSAtPiBhbiBIdHRwT25seSBzZXNzaW9uIGNvb2tpZSBpcyBzZXQgLT4gYEdFVCAvc3RhdHVzYCByZXBvcnRzXG4gKiB3aGV0aGVyIHRoZSBjYWxsZXIgaXMgYXV0aGVudGljYXRlZC4gYHJlcXVlc3RgIEFMV0FZUyByZXBvcnRzIHN1Y2Nlc3MgKHRoZVxuICogc2VydmVyIG5ldmVyIHJldmVhbHMgd2hldGhlciBhbiBhZGRyZXNzIGlzIGFsbG93LWxpc3RlZCBvciB3YXMgYWN0dWFsbHkgc2VudCBhXG4gKiBjb2RlIC0gYW50aS1lbnVtZXJhdGlvbikuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHogfSBmcm9tIFwiem9kXCI7XG5cbi8qKlxuICogTmFtZSBvZiB0aGUgSHR0cE9ubHkgY29va2llIHRoZSB0dW5uZWwgZ2F0ZSBzdG9yZXMgaXRzIHNlc3Npb24gSldUIGluLiBTaGFyZWRcbiAqIHNvIHRoZSBwcm94eSAod2hpY2ggc2V0cyBpdCkgYW5kIGFueSBjbGllbnQtc2lkZSBjb2RlIGFncmVlIG9uIG9uZSBuYW1lLlxuICovXG5leHBvcnQgY29uc3QgU0VTU0lPTl9DT09LSUVfTkFNRSA9IFwiZGJ4LXRvb2xzLWF1dGhcIjtcblxuLyoqIGBQT1NUIC9hcGkvZW1haWwvYXV0aC9yZXF1ZXN0YCBib2R5OiBhc2sgZm9yIGEgY29kZSB0byBiZSBlbWFpbGVkLiAqL1xuZXhwb3J0IGNvbnN0IGF1dGhSZXF1ZXN0U2NoZW1hID0gei5vYmplY3Qoe1xuICBlbWFpbDogei5zdHJpbmcoKS5kZXNjcmliZShcIkFkZHJlc3MgdG8gZW1haWwgYSBvbmUtdGltZSBjb2RlIHRvLCBpZiBpdCBpcyBhbGxvd2VkLlwiKSxcbn0pO1xuXG4vKioge0BsaW5rIGF1dGhSZXF1ZXN0U2NoZW1hfSAqL1xuZXhwb3J0IHR5cGUgQXV0aFJlcXVlc3QgPSB6LmluZmVyPHR5cGVvZiBhdXRoUmVxdWVzdFNjaGVtYT47XG5cbi8qKlxuICogYFBPU1QgL2FwaS9lbWFpbC9hdXRoL3JlcXVlc3RgIHJlc3BvbnNlLiBBbHdheXMgYHsgb2s6IHRydWUgfWAgb24gYVxuICogd2VsbC1mb3JtZWQgcmVxdWVzdCwgcmVnYXJkbGVzcyBvZiB3aGV0aGVyIHRoZSBhZGRyZXNzIHdhcyBhbGxvd2VkIG9yIGEgY29kZVxuICogd2FzIGFjdHVhbGx5IHNlbnQgLSB0aGUgY2xpZW50IGNhbm5vdCBkaXN0aW5ndWlzaCBhbiBhbGxvd2VkIGFkZHJlc3MgZnJvbSBhXG4gKiByZWplY3RlZCBvbmUgKGFudGktZW51bWVyYXRpb24pLiBgcmV0cnlBZnRlcmAgaXMgc2V0IG9ubHkgd2hlbiB0aGUgY2FsbGVyIGlzXG4gKiByYXRlLWxpbWl0ZWQsIHNvIGEgVUkgY2FuIHNob3cgYSBjb29sZG93biB3aXRob3V0IGxlYWtpbmcgYWxsb3ctbGlzdCBzdGF0ZS5cbiAqL1xuZXhwb3J0IGNvbnN0IGF1dGhSZXF1ZXN0UmVzdWx0U2NoZW1hID0gei5vYmplY3Qoe1xuICBvazogei5saXRlcmFsKHRydWUpLmRlc2NyaWJlKFwiQWx3YXlzIHRydWUgZm9yIGEgd2VsbC1mb3JtZWQgcmVxdWVzdCAoYW50aS1lbnVtZXJhdGlvbikuXCIpLFxuICByZXRyeUFmdGVyOiB6XG4gICAgLm51bWJlcigpXG4gICAgLm9wdGlvbmFsKClcbiAgICAuZGVzY3JpYmUoXCJTZWNvbmRzIHRvIHdhaXQgYmVmb3JlIHJlcXVlc3RpbmcgYWdhaW4sIHdoZW4gcmF0ZS1saW1pdGVkLlwiKSxcbn0pO1xuXG4vKioge0BsaW5rIGF1dGhSZXF1ZXN0UmVzdWx0U2NoZW1hfSAqL1xuZXhwb3J0IHR5cGUgQXV0aFJlcXVlc3RSZXN1bHQgPSB6LmluZmVyPHR5cGVvZiBhdXRoUmVxdWVzdFJlc3VsdFNjaGVtYT47XG5cbi8qKiBgUE9TVCAvYXBpL2VtYWlsL2F1dGgvdmVyaWZ5YCBib2R5OiBzdWJtaXQgdGhlIGVtYWlsZWQgY29kZS4gKi9cbmV4cG9ydCBjb25zdCBhdXRoVmVyaWZ5U2NoZW1hID0gei5vYmplY3Qoe1xuICBlbWFpbDogei5zdHJpbmcoKS5kZXNjcmliZShcIlRoZSBhZGRyZXNzIHRoZSBjb2RlIHdhcyByZXF1ZXN0ZWQgZm9yLlwiKSxcbiAgY29kZTogei5zdHJpbmcoKS5kZXNjcmliZShcIlRoZSBvbmUtdGltZSBjb2RlIGZyb20gdGhlIGVtYWlsLlwiKSxcbn0pO1xuXG4vKioge0BsaW5rIGF1dGhWZXJpZnlTY2hlbWF9ICovXG5leHBvcnQgdHlwZSBBdXRoVmVyaWZ5ID0gei5pbmZlcjx0eXBlb2YgYXV0aFZlcmlmeVNjaGVtYT47XG5cbi8qKlxuICogYFBPU1QgL2FwaS9lbWFpbC9hdXRoL3ZlcmlmeWAgcmVzcG9uc2UuIGBva2AgdHJ1ZSBtZWFucyB0aGUgY29kZSBtYXRjaGVkIGFuZFxuICogYW4gSHR0cE9ubHkgc2Vzc2lvbiBjb29raWUgd2FzIHNldDsgZmFsc2UgbWVhbnMgaXQgZGlkIG5vdCAod3JvbmcsIGV4cGlyZWQsIG9yXG4gKiB0b28gbWFueSBhdHRlbXB0cykgLSB0aGUgbWVzc2FnZSBpcyBkZWxpYmVyYXRlbHkgZ2VuZXJpYy4gYHJldHJ5QWZ0ZXJgIGlzIHNldFxuICogd2hlbiB0aGUgZmFpbHVyZSB3YXMgYSByYXRlIGxpbWl0LlxuICovXG5leHBvcnQgY29uc3QgYXV0aFZlcmlmeVJlc3VsdFNjaGVtYSA9IHoub2JqZWN0KHtcbiAgb2s6IHouYm9vbGVhbigpLmRlc2NyaWJlKFwiVHJ1ZSB3aGVuIHRoZSBjb2RlIG1hdGNoZWQgYW5kIGEgc2Vzc2lvbiB3YXMgZXN0YWJsaXNoZWQuXCIpLFxuICByZXRyeUFmdGVyOiB6Lm51bWJlcigpLm9wdGlvbmFsKCkuZGVzY3JpYmUoXCJTZWNvbmRzIHRvIHdhaXQgYmVmb3JlIHJldHJ5aW5nLCB3aGVuIHJhdGUtbGltaXRlZC5cIiksXG59KTtcblxuLyoqIHtAbGluayBhdXRoVmVyaWZ5UmVzdWx0U2NoZW1hfSAqL1xuZXhwb3J0IHR5cGUgQXV0aFZlcmlmeVJlc3VsdCA9IHouaW5mZXI8dHlwZW9mIGF1dGhWZXJpZnlSZXN1bHRTY2hlbWE+O1xuXG4vKiogYEdFVCAvYXBpL2VtYWlsL2F1dGgvc3RhdHVzYCByZXNwb25zZTogaXMgdGhlIGNhbGxlciBhdXRoZW50aWNhdGVkLCBhbmQgYXMgd2hvbS4gKi9cbmV4cG9ydCBjb25zdCBhdXRoU3RhdHVzU2NoZW1hID0gei5vYmplY3Qoe1xuICBhdXRoZW50aWNhdGVkOiB6LmJvb2xlYW4oKS5kZXNjcmliZShcIlRydWUgd2hlbiB0aGUgcmVxdWVzdCBjYXJyaWVzIGEgdmFsaWQgc2Vzc2lvbi5cIiksXG4gIGVtYWlsOiB6LnN0cmluZygpLm9wdGlvbmFsKCkuZGVzY3JpYmUoXCJUaGUgYXV0aGVudGljYXRlZCBhZGRyZXNzLCB3aGVuIGF1dGhlbnRpY2F0ZWQuXCIpLFxuICBlbmFibGVkOiB6XG4gICAgLmJvb2xlYW4oKVxuICAgIC5kZXNjcmliZShcIlRydWUgd2hlbiB0aGUgZ2F0ZSBpcyBhY3RpdmU7IGZhbHNlIG1lYW5zIHRoZSBhcHAgaXMgb3BlbiAobm8gbG9naW4gbmVlZGVkKS5cIiksXG59KTtcblxuLyoqIHtAbGluayBhdXRoU3RhdHVzU2NoZW1hfSAqL1xuZXhwb3J0IHR5cGUgQXV0aFN0YXR1cyA9IHouaW5mZXI8dHlwZW9mIGF1dGhTdGF0dXNTY2hlbWE+O1xuIl19

package/src/auth.ts

@@ -1,86 +0,0 @@
-/**
- * Wire-format contract for the email one-time-password ACCESS GATE.
- *
- * A companion to the email add-on's send contract ({@link ./email}): where that
- * lets an agent send mail, this lets an AppKit app put an email-OTP gate in front
- * of itself - the login flow for an app exposed publicly (e.g. through a portr
- * tunnel that bypasses the Databricks front door). Pure zod so the server routes,
- * the React `AuthGate`, and any client validate against one definition.
- *
- * Flow: `POST /request` (email) -> a 6-digit code is emailed -> `POST /verify`
- * (email + code) -> an HttpOnly session cookie is set -> `GET /status` reports
- * whether the caller is authenticated. `request` ALWAYS reports success (the
- * server never reveals whether an address is allow-listed or was actually sent a
- * code - anti-enumeration).
- *
- * @module
- */
-
-import { z } from "zod";
-
-/**
- * Name of the HttpOnly cookie the tunnel gate stores its session JWT in. Shared
- * so the proxy (which sets it) and any client-side code agree on one name.
- */
-export const SESSION_COOKIE_NAME = "dbx-tools-auth";
-
-/** `POST /api/email/auth/request` body: ask for a code to be emailed. */
-export const authRequestSchema = z.object({
-  email: z.string().describe("Address to email a one-time code to, if it is allowed."),
-});
-
-/** {@link authRequestSchema} */
-export type AuthRequest = z.infer<typeof authRequestSchema>;
-
-/**
- * `POST /api/email/auth/request` response. Always `{ ok: true }` on a
- * well-formed request, regardless of whether the address was allowed or a code
- * was actually sent - the client cannot distinguish an allowed address from a
- * rejected one (anti-enumeration). `retryAfter` is set only when the caller is
- * rate-limited, so a UI can show a cooldown without leaking allow-list state.
- */
-export const authRequestResultSchema = z.object({
-  ok: z.literal(true).describe("Always true for a well-formed request (anti-enumeration)."),
-  retryAfter: z
-    .number()
-    .optional()
-    .describe("Seconds to wait before requesting again, when rate-limited."),
-});
-
-/** {@link authRequestResultSchema} */
-export type AuthRequestResult = z.infer<typeof authRequestResultSchema>;
-
-/** `POST /api/email/auth/verify` body: submit the emailed code. */
-export const authVerifySchema = z.object({
-  email: z.string().describe("The address the code was requested for."),
-  code: z.string().describe("The one-time code from the email."),
-});
-
-/** {@link authVerifySchema} */
-export type AuthVerify = z.infer<typeof authVerifySchema>;
-
-/**
- * `POST /api/email/auth/verify` response. `ok` true means the code matched and
- * an HttpOnly session cookie was set; false means it did not (wrong, expired, or
- * too many attempts) - the message is deliberately generic. `retryAfter` is set
- * when the failure was a rate limit.
- */
-export const authVerifyResultSchema = z.object({
-  ok: z.boolean().describe("True when the code matched and a session was established."),
-  retryAfter: z.number().optional().describe("Seconds to wait before retrying, when rate-limited."),
-});
-
-/** {@link authVerifyResultSchema} */
-export type AuthVerifyResult = z.infer<typeof authVerifyResultSchema>;
-
-/** `GET /api/email/auth/status` response: is the caller authenticated, and as whom. */
-export const authStatusSchema = z.object({
-  authenticated: z.boolean().describe("True when the request carries a valid session."),
-  email: z.string().optional().describe("The authenticated address, when authenticated."),
-  enabled: z
-    .boolean()
-    .describe("True when the gate is active; false means the app is open (no login needed)."),
-});
-
-/** {@link authStatusSchema} */
-export type AuthStatus = z.infer<typeof authStatusSchema>;