@dbx-tools/tunnel 0.6.89 → 0.6.91

package/README.md

@@ -1,7 +1,7 @@
 # @dbx-tools/tunnel
 
-Front an app with a public tunnel and an email one-time-code access gate,
-in-process.
+Front an app with a public tunnel and the passwordless
+[`@dbx-tools/auth`](../auth) gate, in-process.
 
 Built on the [SSE-enabled Portr fork](https://github.com/reggie-db/portr/releases/tag/v1.0.15-sse.2),
 based on [upstream Portr](https://github.com/amalshaji/portr). Use this library
@@ -18,9 +18,9 @@ context: `createApp({ interceptor: tunnelInterceptor() })` applies the computed
 so the app and portr live and die as one (concurrently-style - signals pass
 through, either death tears the pair down). The app is the process; the tunnel
 rides along inside it. Access is granted per email address against an allow-list,
-verified by a code sent over [`@dbx-tools/email`](../../node/email); the gate
-itself is the `authGate` AppKit plugin, which registers the login routes and a
-gating middleware on the app's OWN Express server (no separate proxy process).
+authenticated by Better Auth email OTP or a passkey; the gate itself is the
+`authGate` AppKit plugin, which registers the login routes and a gating
+middleware on the app's OWN Express server (no separate proxy process).
 
 **Key features:**
 
@@ -56,27 +56,19 @@ gating middleware on the app's OWN Express server (no separate proxy process).
   `EMAIL_SYSTEM_FROM`), never a person's address, since a reply to a
   machine-generated code reaches nobody. `EMAIL_FROM` is not required - see
   [`@dbx-tools/email`](../../node/email#sender-addresses).
-- Email one-time-code gate: a 6-digit code stored as a SHA-256 hash with an
-  attempt counter, verified in constant time, in AppKit's `CacheManager` (Lakebase
-  when a database is bound to the deployment, else memory) so TTL expiry and
-  eviction are the cache's job.
-- The gate resolves Lakebase for itself, so its cache is actually persistent. The
-  gate is its own tiny AppKit app with no `lakebase()` plugin (it has no server to
-  mount routes on), and AppKit only chooses Lakebase for the cache when a pool can
-  be built from `LAKEBASE_ENDPOINT` **and** `PGHOST` **and** `PGDATABASE` - while a
-  Databricks App `postgres` binding supplies only the first. The gate fills in the
-  rest at boot, and skips entirely when nothing is bound rather than creating
-  infrastructure on someone else's behalf.
-- HS256 session JWT (via `jose`) carrying only the email, signed with a key that
-  is PERSISTED in AppKit's cache for 30 days - so a signed-in browser stays signed
-  in across the restarts a tunnel sees whenever the app it wraps reloads. An
-  operator-held `TUNNEL_AUTH_JWT_SECRET` still wins. `TUNNEL_AUTH_SESSION_CUTOFF`
-  is the log-everyone-out switch, and takes a relative duration (`-30d`) as
-  readily as a date.
+- Better Auth owns users, hashed OTP verification records, sessions, rate
+  limits, and passkey credentials. `@dbx-tools/tunnel` supplies only its
+  authorization policy, branded email delivery, and transport boundary.
+- Storage is the native AppKit `lakebase()` pool when registered, or SQLite in
+  the operating system's application-data directory. Both adapters run Better
+  Auth's own migrations under a Postgres advisory lock or file lock.
+- Email OTP remains bootstrap and recovery. Returning users can authenticate
+  with discoverable passkeys, enroll multiple devices, and name or remove them
+  through [`@dbx-tools/ui-auth`](../../ui/auth).
 - Allow-list patterns in three shapes, matched in order: a domain shortcut
   (`example.com`, `@example.com`), a shell-style glob (`*@example.com`), or a
   regex literal (`/^ops-.*@example\.com$/`). An empty list allows nobody.
-- Per-email and per-IP fixed-window rate limiting, plus anti-enumeration: a code
+- Better Auth rate limiting plus anti-enumeration: the compatibility code
   request always answers `{ ok: true }`, whether or not the address is allowed.
 - Inbound `x-` headers are stripped by default and re-allowed by pattern, so a
   public caller cannot spoof the headers the app trusts - above all
@@ -373,16 +365,15 @@ the selected release and executable path, then removes the temporary directory.
 
 - `interceptor` - `tunnelInterceptor()`, the `createApp` interceptor that applies
   `DATABRICKS_HOST`, launches portr, and binds it to the app.
-- `plugin` - `authGate()`, its config/env resolution, the `AuthGateApi` handlers,
-  and the `setup()` that mounts the gate on the app's server.
+- `plugin` - `authGate()`, authorization/delivery config, Better Auth
+  composition, and AppKit Lakebase discovery.
 - `gate` - the login routes + gating middleware (`mountGate`, `isTunnelHost`):
   `Host`-based tunnel classification, session enforcement, and identity injection.
 - `send-code` - the default OTP delivery through the shared email transport
   (lazily imported) and the SMTP fail-fast.
 - `code-email` - pure builders for the code email's subject/preheader/bodies.
-- `otp` - the `CacheManager`-backed code store and the session JWT.
-- `signingKey` - the cache-persisted HS256 session key (30-day TTL, get/generate/
-  re-read convergence) and the `TUNNEL_AUTH_SESSION_CUTOFF` force-clear cutoff.
+- `signingKey` - the cache-persisted Better Auth secret and
+  `TUNNEL_AUTH_SESSION_CUTOFF` force-clear cutoff.
 - `allowlist` - email domain / glob / regex matching and `looksLikeEmail`.
 - `headers` - the inbound-header allow-list: `toHeaderPolicy()`,
   `DEFAULT_FORWARD_HEADERS`, and the `PROTECTED_HEADERS` no pattern can forward.
@@ -391,6 +382,6 @@ the selected release and executable path, then removes the temporary directory.
 - `portr` - portr install, config rendering, and child launch.
 - `env` - the environment-variable names, each with its deprecated aliases.
 
-Browser-safe login wire schemas (the request/verify payloads and the session
-cookie name) live in [`@dbx-tools/shared-email`](../../shared/email); the React
-login surface is in [`@dbx-tools/ui-email`](../../ui/email).
+Browser-safe gate contracts live in
+[`@dbx-tools/shared-auth`](../../shared/auth); the passkey-first React login and
+credential manager live in [`@dbx-tools/ui-auth`](../../ui/auth).

package/index.ts

@@ -2,28 +2,24 @@
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
 
+export const PACKAGE_IDENTIFIER = "@dbx-tools/tunnel";
 export * as allowlist from "./src/allowlist.ts";
 export * as codeEmail from "./src/code-email.ts";
 export * as gate from "./src/gate.ts";
 export * as headers from "./src/headers.ts";
 export * as interceptor from "./src/interceptor.ts";
-export * as otp from "./src/otp.ts";
 export * as plugin from "./src/plugin.ts";
 export * as portr from "./src/portr.ts";
-export * as rateLimit from "./src/rate-limit.ts";
 export * as sendCode from "./src/send-code.ts";
 export * as signingKey from "./src/signing-key.ts";
 export type { CodeCopy } from "./src/code-email.ts";
-export { AUTH_PREFIX, UNAUTHORIZED_BODY, LOGOUT_SET_COOKIE } from "./src/gate.ts";
+export { AUTH_PREFIX, UNAUTHORIZED_BODY } from "./src/gate.ts";
 export type { GateOptions, GateAction } from "./src/gate.ts";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
 export type { HeaderPolicy } from "./src/headers.ts";
 export type { TunnelInterceptorOptions } from "./src/interceptor.ts";
-export { CodeStore } from "./src/otp.ts";
-export type { VerifyOutcome } from "./src/otp.ts";
 export { AuthGatePlugin, authGate } from "./src/plugin.ts";
 export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateApi } from "./src/plugin.ts";
 export type { PortrInstallOptions, PortrConfig } from "./src/portr.ts";
-export { RateLimiter } from "./src/rate-limit.ts";
 export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
 export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.d.ts

@@ -1,25 +1,21 @@
+export declare const PACKAGE_IDENTIFIER = "@dbx-tools/tunnel";
 export * as allowlist from "./src/allowlist.ts";
 export * as codeEmail from "./src/code-email.ts";
 export * as gate from "./src/gate.ts";
 export * as headers from "./src/headers.ts";
 export * as interceptor from "./src/interceptor.ts";
-export * as otp from "./src/otp.ts";
 export * as plugin from "./src/plugin.ts";
 export * as portr from "./src/portr.ts";
-export * as rateLimit from "./src/rate-limit.ts";
 export * as sendCode from "./src/send-code.ts";
 export * as signingKey from "./src/signing-key.ts";
 export type { CodeCopy } from "./src/code-email.ts";
-export { AUTH_PREFIX, UNAUTHORIZED_BODY, LOGOUT_SET_COOKIE } from "./src/gate.ts";
+export { AUTH_PREFIX, UNAUTHORIZED_BODY } from "./src/gate.ts";
 export type { GateOptions, GateAction } from "./src/gate.ts";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
 export type { HeaderPolicy } from "./src/headers.ts";
 export type { TunnelInterceptorOptions } from "./src/interceptor.ts";
-export { CodeStore } from "./src/otp.ts";
-export type { VerifyOutcome } from "./src/otp.ts";
 export { AuthGatePlugin, authGate } from "./src/plugin.ts";
 export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateApi } from "./src/plugin.ts";
 export type { PortrInstallOptions, PortrConfig } from "./src/portr.ts";
-export { RateLimiter } from "./src/rate-limit.ts";
 export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
 export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.js

@@ -1,21 +1,18 @@
 // GENERATED by projen watch - DO NOT EDIT.
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
+export const PACKAGE_IDENTIFIER = "@dbx-tools/tunnel";
 export * as allowlist from "./src/allowlist.js";
 export * as codeEmail from "./src/code-email.js";
 export * as gate from "./src/gate.js";
 export * as headers from "./src/headers.js";
 export * as interceptor from "./src/interceptor.js";
-export * as otp from "./src/otp.js";
 export * as plugin from "./src/plugin.js";
 export * as portr from "./src/portr.js";
-export * as rateLimit from "./src/rate-limit.js";
 export * as sendCode from "./src/send-code.js";
 export * as signingKey from "./src/signing-key.js";
-export { AUTH_PREFIX, UNAUTHORIZED_BODY, LOGOUT_SET_COOKIE } from "./src/gate.js";
+export { AUTH_PREFIX, UNAUTHORIZED_BODY } from "./src/gate.js";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.js";
-export { CodeStore } from "./src/otp.js";
 export { AuthGatePlugin, authGate } from "./src/plugin.js";
-export { RateLimiter } from "./src/rate-limit.js";
 export { KEY_TTL_SECONDS } from "./src/signing-key.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxTQUFTLE1BQU0scUJBQXFCLENBQUM7QUFDakQsT0FBTyxLQUFLLElBQUksTUFBTSxlQUFlLENBQUM7QUFDdEMsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEtBQUssV0FBVyxNQUFNLHNCQUFzQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxNQUFNLE1BQU0saUJBQWlCLENBQUM7QUFDMUMsT0FBTyxLQUFLLEtBQUssTUFBTSxnQkFBZ0IsQ0FBQztBQUN4QyxPQUFPLEtBQUssU0FBUyxNQUFNLHFCQUFxQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxRQUFRLE1BQU0sb0JBQW9CLENBQUM7QUFDL0MsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQkFBc0IsQ0FBQztBQUVuRCxPQUFPLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBRWxGLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFekMsT0FBTyxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUczRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbEQsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHNCQUFzQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0ICogYXMgYWxsb3dsaXN0IGZyb20gXCIuL3NyYy9hbGxvd2xpc3QudHNcIjtcbmV4cG9ydCAqIGFzIGNvZGVFbWFpbCBmcm9tIFwiLi9zcmMvY29kZS1lbWFpbC50c1wiO1xuZXhwb3J0ICogYXMgZ2F0ZSBmcm9tIFwiLi9zcmMvZ2F0ZS50c1wiO1xuZXhwb3J0ICogYXMgaGVhZGVycyBmcm9tIFwiLi9zcmMvaGVhZGVycy50c1wiO1xuZXhwb3J0ICogYXMgaW50ZXJjZXB0b3IgZnJvbSBcIi4vc3JjL2ludGVyY2VwdG9yLnRzXCI7XG5leHBvcnQgKiBhcyBvdHAgZnJvbSBcIi4vc3JjL290cC50c1wiO1xuZXhwb3J0ICogYXMgcGx1Z2luIGZyb20gXCIuL3NyYy9wbHVnaW4udHNcIjtcbmV4cG9ydCAqIGFzIHBvcnRyIGZyb20gXCIuL3NyYy9wb3J0ci50c1wiO1xuZXhwb3J0ICogYXMgcmF0ZUxpbWl0IGZyb20gXCIuL3NyYy9yYXRlLWxpbWl0LnRzXCI7XG5leHBvcnQgKiBhcyBzZW5kQ29kZSBmcm9tIFwiLi9zcmMvc2VuZC1jb2RlLnRzXCI7XG5leHBvcnQgKiBhcyBzaWduaW5nS2V5IGZyb20gXCIuL3NyYy9zaWduaW5nLWtleS50c1wiO1xuZXhwb3J0IHR5cGUgeyBDb2RlQ29weSB9IGZyb20gXCIuL3NyYy9jb2RlLWVtYWlsLnRzXCI7XG5leHBvcnQgeyBBVVRIX1BSRUZJWCwgVU5BVVRIT1JJWkVEX0JPRFksIExPR09VVF9TRVRfQ09PS0lFIH0gZnJvbSBcIi4vc3JjL2dhdGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgR2F0ZU9wdGlvbnMsIEdhdGVBY3Rpb24gfSBmcm9tIFwiLi9zcmMvZ2F0ZS50c1wiO1xuZXhwb3J0IHsgUFJPVEVDVEVEX0hFQURFUlMsIERFRkFVTFRfRk9SV0FSRF9IRUFERVJTIH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB0eXBlIHsgSGVhZGVyUG9saWN5IH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB0eXBlIHsgVHVubmVsSW50ZXJjZXB0b3JPcHRpb25zIH0gZnJvbSBcIi4vc3JjL2ludGVyY2VwdG9yLnRzXCI7XG5leHBvcnQgeyBDb2RlU3RvcmUgfSBmcm9tIFwiLi9zcmMvb3RwLnRzXCI7XG5leHBvcnQgdHlwZSB7IFZlcmlmeU91dGNvbWUgfSBmcm9tIFwiLi9zcmMvb3RwLnRzXCI7XG5leHBvcnQgeyBBdXRoR2F0ZVBsdWdpbiwgYXV0aEdhdGUgfSBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgdHlwZSB7IEF1dGhHYXRlQ29uZmlnLCBTZW5kQ29kZU9wdGlvbnMsIFJlc29sdmVkQXV0aEdhdGVDb25maWcsIEF1dGhHYXRlQXBpIH0gZnJvbSBcIi4vc3JjL3BsdWdpbi50c1wiO1xuZXhwb3J0IHR5cGUgeyBQb3J0ckluc3RhbGxPcHRpb25zLCBQb3J0ckNvbmZpZyB9IGZyb20gXCIuL3NyYy9wb3J0ci50c1wiO1xuZXhwb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9zcmMvcmF0ZS1saW1pdC50c1wiO1xuZXhwb3J0IHsgS0VZX1RUTF9TRUNPTkRTIH0gZnJvbSBcIi4vc3JjL3NpZ25pbmcta2V5LnRzXCI7XG5leHBvcnQgdHlwZSB7IFNpZ25pbmdLZXkgfSBmcm9tIFwiLi9zcmMvc2lnbmluZy1rZXkudHNcIjtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxtQkFBbUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxTQUFTLE1BQU0scUJBQXFCLENBQUM7QUFDakQsT0FBTyxLQUFLLElBQUksTUFBTSxlQUFlLENBQUM7QUFDdEMsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEtBQUssV0FBVyxNQUFNLHNCQUFzQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxNQUFNLE1BQU0saUJBQWlCLENBQUM7QUFDMUMsT0FBTyxLQUFLLEtBQUssTUFBTSxnQkFBZ0IsQ0FBQztBQUN4QyxPQUFPLEtBQUssUUFBUSxNQUFNLG9CQUFvQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxVQUFVLE1BQU0sc0JBQXNCLENBQUM7QUFFbkQsT0FBTyxFQUFFLFdBQVcsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUUvRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUc5RSxPQUFPLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRzNELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIEdFTkVSQVRFRCBieSBwcm9qZW4gd2F0Y2ggLSBETyBOT1QgRURJVC5cbi8vIFJlZ2VuZXJhdGVkIGZyb20gdGhlIGV4cG9ydGluZyBtb2R1bGVzIGluIC4vc3JjLlxuLy8gSGFuZCBlZGl0cyBhcmUgb3ZlcndyaXR0ZW4gb24gdGhlIG5leHQgd2F0Y2g7IHRoaXMgZmlsZSBpcyByZWFkLW9ubHkuXG5cbmV4cG9ydCBjb25zdCBQQUNLQUdFX0lERU5USUZJRVIgPSBcIkBkYngtdG9vbHMvdHVubmVsXCI7XG5leHBvcnQgKiBhcyBhbGxvd2xpc3QgZnJvbSBcIi4vc3JjL2FsbG93bGlzdC50c1wiO1xuZXhwb3J0ICogYXMgY29kZUVtYWlsIGZyb20gXCIuL3NyYy9jb2RlLWVtYWlsLnRzXCI7XG5leHBvcnQgKiBhcyBnYXRlIGZyb20gXCIuL3NyYy9nYXRlLnRzXCI7XG5leHBvcnQgKiBhcyBoZWFkZXJzIGZyb20gXCIuL3NyYy9oZWFkZXJzLnRzXCI7XG5leHBvcnQgKiBhcyBpbnRlcmNlcHRvciBmcm9tIFwiLi9zcmMvaW50ZXJjZXB0b3IudHNcIjtcbmV4cG9ydCAqIGFzIHBsdWdpbiBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgKiBhcyBwb3J0ciBmcm9tIFwiLi9zcmMvcG9ydHIudHNcIjtcbmV4cG9ydCAqIGFzIHNlbmRDb2RlIGZyb20gXCIuL3NyYy9zZW5kLWNvZGUudHNcIjtcbmV4cG9ydCAqIGFzIHNpZ25pbmdLZXkgZnJvbSBcIi4vc3JjL3NpZ25pbmcta2V5LnRzXCI7XG5leHBvcnQgdHlwZSB7IENvZGVDb3B5IH0gZnJvbSBcIi4vc3JjL2NvZGUtZW1haWwudHNcIjtcbmV4cG9ydCB7IEFVVEhfUFJFRklYLCBVTkFVVEhPUklaRURfQk9EWSB9IGZyb20gXCIuL3NyYy9nYXRlLnRzXCI7XG5leHBvcnQgdHlwZSB7IEdhdGVPcHRpb25zLCBHYXRlQWN0aW9uIH0gZnJvbSBcIi4vc3JjL2dhdGUudHNcIjtcbmV4cG9ydCB7IFBST1RFQ1RFRF9IRUFERVJTLCBERUZBVUxUX0ZPUldBUkRfSEVBREVSUyB9IGZyb20gXCIuL3NyYy9oZWFkZXJzLnRzXCI7XG5leHBvcnQgdHlwZSB7IEhlYWRlclBvbGljeSB9IGZyb20gXCIuL3NyYy9oZWFkZXJzLnRzXCI7XG5leHBvcnQgdHlwZSB7IFR1bm5lbEludGVyY2VwdG9yT3B0aW9ucyB9IGZyb20gXCIuL3NyYy9pbnRlcmNlcHRvci50c1wiO1xuZXhwb3J0IHsgQXV0aEdhdGVQbHVnaW4sIGF1dGhHYXRlIH0gZnJvbSBcIi4vc3JjL3BsdWdpbi50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoR2F0ZUNvbmZpZywgU2VuZENvZGVPcHRpb25zLCBSZXNvbHZlZEF1dGhHYXRlQ29uZmlnLCBBdXRoR2F0ZUFwaSB9IGZyb20gXCIuL3NyYy9wbHVnaW4udHNcIjtcbmV4cG9ydCB0eXBlIHsgUG9ydHJJbnN0YWxsT3B0aW9ucywgUG9ydHJDb25maWcgfSBmcm9tIFwiLi9zcmMvcG9ydHIudHNcIjtcbmV4cG9ydCB7IEtFWV9UVExfU0VDT05EUyB9IGZyb20gXCIuL3NyYy9zaWduaW5nLWtleS50c1wiO1xuZXhwb3J0IHR5cGUgeyBTaWduaW5nS2V5IH0gZnJvbSBcIi4vc3JjL3NpZ25pbmcta2V5LnRzXCI7XG4iXX0=

package/lib/src/allowlist.d.ts

@@ -1,5 +1,5 @@
 /**
- * Unified access allow-list matching for the email-OTP gate.
+ * Unified identity authorization matching for the passwordless gate.
  *
  * Each pattern in the configured list is one of three shapes:
  *

package/lib/src/allowlist.js

@@ -1,5 +1,5 @@
 /**
- * Unified access allow-list matching for the email-OTP gate.
+ * Unified identity authorization matching for the passwordless gate.
  *
  * Each pattern in the configured list is one of three shapes:
  *
@@ -54,4 +54,4 @@ export function matchesAllowlist(email, patterns) {
 export function looksLikeEmail(value) {
     return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxsb3dsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FsbG93bGlzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBd0JHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRWpELCtEQUErRDtBQUMvRCxTQUFTLGNBQWMsQ0FBQyxLQUFhLEVBQUUsS0FBYTtJQUNsRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0IsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMzQixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFM0MsOEVBQThFO0lBQzlFLDJFQUEyRTtJQUMzRSx3RUFBd0U7SUFDeEUsMkNBQTJDO0lBQzNDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN2RCxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUM7SUFDckQsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQztBQUN4RCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWEsRUFBRSxRQUF1QztJQUNyRixJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLGNBQWMsQ0FBQyxLQUFhO0lBQzFDLE9BQU8sNEJBQTRCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFVuaWZpZWQgYWNjZXNzIGFsbG93LWxpc3QgbWF0Y2hpbmcgZm9yIHRoZSBlbWFpbC1PVFAgZ2F0ZS5cbiAqXG4gKiBFYWNoIHBhdHRlcm4gaW4gdGhlIGNvbmZpZ3VyZWQgbGlzdCBpcyBvbmUgb2YgdGhyZWUgc2hhcGVzOlxuICpcbiAqICAgLSAqKmRvbWFpbiBzaG9ydGN1dCoqIC0gYGV4YW1wbGUuY29tYCBvciBgQGV4YW1wbGUuY29tYDogbWF0Y2hlcyBhbnlcbiAqICAgICBhZGRyZXNzIHdob3NlIGRvbWFpbiBlcXVhbHMgaXQuIFRoaXMgaXMgdGhlIGdhdGUncyBPV04gc2VtYW50aWMgKGEgYmFyZVxuICogICAgIHZhbHVlIG1lYW5zIFwidGhlIGRvbWFpblwiLCBub3QgXCJ0aGUgd2hvbGUgYWRkcmVzc1wiKSwgc28gaXQgaXMgaGFuZGxlZCBoZXJlLlxuICogICAtICoqZ2xvYioqIC0gY29udGFpbnMgYCpgIG9yIGA/YCwgZS5nLiBgKkBleGFtcGxlLmNvbWA6IG1hdGNoZWQgYWdhaW5zdCB0aGVcbiAqICAgICBXSE9MRSBhZGRyZXNzIHdpdGggc2hlbGwtc3R5bGUgd2lsZGNhcmRzLlxuICogICAtICoqcmVnZXgqKiAtIHdyYXBwZWQgaW4gc2xhc2hlcywgYC8uLi4vIFtmbGFnc11gOiB0ZXN0ZWQgYWdhaW5zdCB0aGUgd2hvbGVcbiAqICAgICBhZGRyZXNzLiBBbiBpbnZhbGlkIHJlZ2V4IG5ldmVyIG1hdGNoZXMgKGl0IGlzIHNraXBwZWQgd2l0aCBhIHdhcm5pbmdcbiAqICAgICByYXRoZXIgdGhhbiB0aHJvd2luZykuXG4gKlxuICogT25seSB0aGUgZmlyc3Qgc2hhcGUgaXMgdGhpcyBtb2R1bGUncyBidXNpbmVzczogdGhlIGdsb2IgYW5kIHJlZ2V4IHNoYXBlcyBhcmVcbiAqIGRlbGVnYXRlZCB0byBgQGRieC10b29scy9zaGFyZWQtY29yZWAncyB7QGxpbmsgcGF0dGVybi50b1BhdHRlcm59LCB3aGljaCBpc1xuICogd2hlcmUgdGhhdCBjb21waWxhdGlvbiBsaXZlcyBmb3IgZXZlcnkgYWxsb3ctbGlzdCBpbiB0aGUgcmVwbyAodGhlIHR1bm5lbCdzXG4gKiBpbmJvdW5kLWhlYWRlciBwb2xpY3kgdXNlcyB0aGUgc2FtZSBvbmUpLiBNYXRjaGluZyBpcyBjYXNlLWluc2Vuc2l0aXZlXG4gKiB0aHJvdWdob3V0LlxuICpcbiAqIEFuIEVNUFRZIGxpc3QgbWF0Y2hlcyBub2JvZHkgKGZhaWwgY2xvc2VkKTogYW4gYXBwIHRoYXQgZW5hYmxlcyB0aGUgZ2F0ZSBidXRcbiAqIGNvbmZpZ3VyZXMgbm8gcGF0dGVybnMgbGV0cyBubyBvbmUgaW4sIHdoaWNoIGlzIHRoZSBzYWZlIGRlZmF1bHQuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHBhdHRlcm4gfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuXG4vKiogVHJ1ZSB3aGVuIGBlbWFpbGAgbWF0Y2hlcyBhIHNpbmdsZSBhbGxvdy1saXN0IGBwYXR0ZXJuYC4gKi9cbmZ1bmN0aW9uIG1hdGNoZXNQYXR0ZXJuKGVtYWlsOiBzdHJpbmcsIGVudHJ5OiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgdHJpbW1lZCA9IGVudHJ5LnRyaW0oKTtcbiAgaWYgKCF0cmltbWVkKSByZXR1cm4gZmFsc2U7XG4gIGNvbnN0IGFkZHJlc3MgPSBlbWFpbC50cmltKCkudG9Mb3dlckNhc2UoKTtcblxuICAvLyBBIGJhcmUgdmFsdWUgd2l0aCBubyB3aWxkY2FyZCBhbmQgbm8gcmVnZXggZGVsaW1pdGVycyBpcyBhIERPTUFJTiBzaG9ydGN1dCxcbiAgLy8gdGhlIG9uZSBzaGFwZSBzaGFyZWQtY29yZSBjYW5ub3QgaW5mZXI6IHRoZXJlIGl0IHdvdWxkIG1lYW4gd2hvbGUtc3RyaW5nXG4gIC8vIGVxdWFsaXR5IGFnYWluc3QgdGhlIGFkZHJlc3MsIHdoaWNoIGlzIG5ldmVyIHdoYXQgYW4gb3BlcmF0b3Igd3JpdGluZ1xuICAvLyBgZXhhbXBsZS5jb21gIGluIGFuIGFjY2VzcyBsaXN0IGludGVuZHMuXG4gIGlmICghdHJpbW1lZC5zdGFydHNXaXRoKFwiL1wiKSAmJiAhdHJpbW1lZC5pbmNsdWRlcyhcIipcIikgJiYgIXRyaW1tZWQuaW5jbHVkZXMoXCI/XCIpKSB7XG4gICAgY29uc3QgZG9tYWluID0gdHJpbW1lZC5yZXBsYWNlKC9eQC8sIFwiXCIpLnRvTG93ZXJDYXNlKCk7XG4gICAgY29uc3QgYXQgPSBhZGRyZXNzLmxhc3RJbmRleE9mKFwiQFwiKTtcbiAgICByZXR1cm4gYXQgPj0gMCAmJiBhZGRyZXNzLnNsaWNlKGF0ICsgMSkgPT09IGRvbWFpbjtcbiAgfVxuXG4gIHJldHVybiBwYXR0ZXJuLnRvUGF0dGVybih0cmltbWVkKT8uKGFkZHJlc3MpID8/IGZhbHNlO1xufVxuXG4vKipcbiAqIFRydWUgd2hlbiBgZW1haWxgIGlzIGFsbG93ZWQgYnkgQU5ZIHBhdHRlcm4gaW4gYHBhdHRlcm5zYC4gQW4gZW1wdHkgKG9yXG4gKiBtaXNzaW5nKSBsaXN0IGFsbG93cyBub2JvZHkgLSB0aGUgZ2F0ZSBmYWlscyBjbG9zZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBtYXRjaGVzQWxsb3dsaXN0KGVtYWlsOiBzdHJpbmcsIHBhdHRlcm5zOiByZWFkb25seSBzdHJpbmdbXSB8IHVuZGVmaW5lZCk6IGJvb2xlYW4ge1xuICBpZiAoIWVtYWlsIHx8ICFwYXR0ZXJucyB8fCBwYXR0ZXJucy5sZW5ndGggPT09IDApIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIHBhdHRlcm5zLnNvbWUoKGVudHJ5KSA9PiBtYXRjaGVzUGF0dGVybihlbWFpbCwgZW50cnkpKTtcbn1cblxuLyoqIFJvdWdoIHNoYXBlIGNoZWNrIHNvIGEgY2xlYXJseS1pbnZhbGlkIGFkZHJlc3MgaXMgcmVqZWN0ZWQgYmVmb3JlIGFueSB3b3JrLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxvb2tzTGlrZUVtYWlsKHZhbHVlOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgcmV0dXJuIC9eW15cXHNAXStAW15cXHNAXStcXC5bXlxcc0BdKyQvLnRlc3QodmFsdWUudHJpbSgpKTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxsb3dsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FsbG93bGlzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBd0JHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRWpELCtEQUErRDtBQUMvRCxTQUFTLGNBQWMsQ0FBQyxLQUFhLEVBQUUsS0FBYTtJQUNsRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0IsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMzQixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFM0MsOEVBQThFO0lBQzlFLDJFQUEyRTtJQUMzRSx3RUFBd0U7SUFDeEUsMkNBQTJDO0lBQzNDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN2RCxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUM7SUFDckQsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQztBQUN4RCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWEsRUFBRSxRQUF1QztJQUNyRixJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLGNBQWMsQ0FBQyxLQUFhO0lBQzFDLE9BQU8sNEJBQTRCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFVuaWZpZWQgaWRlbnRpdHkgYXV0aG9yaXphdGlvbiBtYXRjaGluZyBmb3IgdGhlIHBhc3N3b3JkbGVzcyBnYXRlLlxuICpcbiAqIEVhY2ggcGF0dGVybiBpbiB0aGUgY29uZmlndXJlZCBsaXN0IGlzIG9uZSBvZiB0aHJlZSBzaGFwZXM6XG4gKlxuICogICAtICoqZG9tYWluIHNob3J0Y3V0KiogLSBgZXhhbXBsZS5jb21gIG9yIGBAZXhhbXBsZS5jb21gOiBtYXRjaGVzIGFueVxuICogICAgIGFkZHJlc3Mgd2hvc2UgZG9tYWluIGVxdWFscyBpdC4gVGhpcyBpcyB0aGUgZ2F0ZSdzIE9XTiBzZW1hbnRpYyAoYSBiYXJlXG4gKiAgICAgdmFsdWUgbWVhbnMgXCJ0aGUgZG9tYWluXCIsIG5vdCBcInRoZSB3aG9sZSBhZGRyZXNzXCIpLCBzbyBpdCBpcyBoYW5kbGVkIGhlcmUuXG4gKiAgIC0gKipnbG9iKiogLSBjb250YWlucyBgKmAgb3IgYD9gLCBlLmcuIGAqQGV4YW1wbGUuY29tYDogbWF0Y2hlZCBhZ2FpbnN0IHRoZVxuICogICAgIFdIT0xFIGFkZHJlc3Mgd2l0aCBzaGVsbC1zdHlsZSB3aWxkY2FyZHMuXG4gKiAgIC0gKipyZWdleCoqIC0gd3JhcHBlZCBpbiBzbGFzaGVzLCBgLy4uLi8gW2ZsYWdzXWA6IHRlc3RlZCBhZ2FpbnN0IHRoZSB3aG9sZVxuICogICAgIGFkZHJlc3MuIEFuIGludmFsaWQgcmVnZXggbmV2ZXIgbWF0Y2hlcyAoaXQgaXMgc2tpcHBlZCB3aXRoIGEgd2FybmluZ1xuICogICAgIHJhdGhlciB0aGFuIHRocm93aW5nKS5cbiAqXG4gKiBPbmx5IHRoZSBmaXJzdCBzaGFwZSBpcyB0aGlzIG1vZHVsZSdzIGJ1c2luZXNzOiB0aGUgZ2xvYiBhbmQgcmVnZXggc2hhcGVzIGFyZVxuICogZGVsZWdhdGVkIHRvIGBAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlYCdzIHtAbGluayBwYXR0ZXJuLnRvUGF0dGVybn0sIHdoaWNoIGlzXG4gKiB3aGVyZSB0aGF0IGNvbXBpbGF0aW9uIGxpdmVzIGZvciBldmVyeSBhbGxvdy1saXN0IGluIHRoZSByZXBvICh0aGUgdHVubmVsJ3NcbiAqIGluYm91bmQtaGVhZGVyIHBvbGljeSB1c2VzIHRoZSBzYW1lIG9uZSkuIE1hdGNoaW5nIGlzIGNhc2UtaW5zZW5zaXRpdmVcbiAqIHRocm91Z2hvdXQuXG4gKlxuICogQW4gRU1QVFkgbGlzdCBtYXRjaGVzIG5vYm9keSAoZmFpbCBjbG9zZWQpOiBhbiBhcHAgdGhhdCBlbmFibGVzIHRoZSBnYXRlIGJ1dFxuICogY29uZmlndXJlcyBubyBwYXR0ZXJucyBsZXRzIG5vIG9uZSBpbiwgd2hpY2ggaXMgdGhlIHNhZmUgZGVmYXVsdC5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgcGF0dGVybiB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlXCI7XG5cbi8qKiBUcnVlIHdoZW4gYGVtYWlsYCBtYXRjaGVzIGEgc2luZ2xlIGFsbG93LWxpc3QgYHBhdHRlcm5gLiAqL1xuZnVuY3Rpb24gbWF0Y2hlc1BhdHRlcm4oZW1haWw6IHN0cmluZywgZW50cnk6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBjb25zdCB0cmltbWVkID0gZW50cnkudHJpbSgpO1xuICBpZiAoIXRyaW1tZWQpIHJldHVybiBmYWxzZTtcbiAgY29uc3QgYWRkcmVzcyA9IGVtYWlsLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuXG4gIC8vIEEgYmFyZSB2YWx1ZSB3aXRoIG5vIHdpbGRjYXJkIGFuZCBubyByZWdleCBkZWxpbWl0ZXJzIGlzIGEgRE9NQUlOIHNob3J0Y3V0LFxuICAvLyB0aGUgb25lIHNoYXBlIHNoYXJlZC1jb3JlIGNhbm5vdCBpbmZlcjogdGhlcmUgaXQgd291bGQgbWVhbiB3aG9sZS1zdHJpbmdcbiAgLy8gZXF1YWxpdHkgYWdhaW5zdCB0aGUgYWRkcmVzcywgd2hpY2ggaXMgbmV2ZXIgd2hhdCBhbiBvcGVyYXRvciB3cml0aW5nXG4gIC8vIGBleGFtcGxlLmNvbWAgaW4gYW4gYWNjZXNzIGxpc3QgaW50ZW5kcy5cbiAgaWYgKCF0cmltbWVkLnN0YXJ0c1dpdGgoXCIvXCIpICYmICF0cmltbWVkLmluY2x1ZGVzKFwiKlwiKSAmJiAhdHJpbW1lZC5pbmNsdWRlcyhcIj9cIikpIHtcbiAgICBjb25zdCBkb21haW4gPSB0cmltbWVkLnJlcGxhY2UoL15ALywgXCJcIikudG9Mb3dlckNhc2UoKTtcbiAgICBjb25zdCBhdCA9IGFkZHJlc3MubGFzdEluZGV4T2YoXCJAXCIpO1xuICAgIHJldHVybiBhdCA+PSAwICYmIGFkZHJlc3Muc2xpY2UoYXQgKyAxKSA9PT0gZG9tYWluO1xuICB9XG5cbiAgcmV0dXJuIHBhdHRlcm4udG9QYXR0ZXJuKHRyaW1tZWQpPy4oYWRkcmVzcykgPz8gZmFsc2U7XG59XG5cbi8qKlxuICogVHJ1ZSB3aGVuIGBlbWFpbGAgaXMgYWxsb3dlZCBieSBBTlkgcGF0dGVybiBpbiBgcGF0dGVybnNgLiBBbiBlbXB0eSAob3JcbiAqIG1pc3NpbmcpIGxpc3QgYWxsb3dzIG5vYm9keSAtIHRoZSBnYXRlIGZhaWxzIGNsb3NlZC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIG1hdGNoZXNBbGxvd2xpc3QoZW1haWw6IHN0cmluZywgcGF0dGVybnM6IHJlYWRvbmx5IHN0cmluZ1tdIHwgdW5kZWZpbmVkKTogYm9vbGVhbiB7XG4gIGlmICghZW1haWwgfHwgIXBhdHRlcm5zIHx8IHBhdHRlcm5zLmxlbmd0aCA9PT0gMCkgcmV0dXJuIGZhbHNlO1xuICByZXR1cm4gcGF0dGVybnMuc29tZSgoZW50cnkpID0+IG1hdGNoZXNQYXR0ZXJuKGVtYWlsLCBlbnRyeSkpO1xufVxuXG4vKiogUm91Z2ggc2hhcGUgY2hlY2sgc28gYSBjbGVhcmx5LWludmFsaWQgYWRkcmVzcyBpcyByZWplY3RlZCBiZWZvcmUgYW55IHdvcmsuICovXG5leHBvcnQgZnVuY3Rpb24gbG9va3NMaWtlRW1haWwodmFsdWU6IHN0cmluZyk6IGJvb2xlYW4ge1xuICByZXR1cm4gL15bXlxcc0BdK0BbXlxcc0BdK1xcLlteXFxzQF0rJC8udGVzdCh2YWx1ZS50cmltKCkpO1xufVxuIl19

package/lib/src/gate.d.ts

@@ -6,8 +6,8 @@
  * nothing to forward to. It either short-circuits (401, or answers the open login
  * routes) or calls `next()` to let the app's real handlers run. It is the
  * "stands in for AppKit auth" path:
- * a portr caller proves an email via OTP, and on success the gate injects the
- * identity headers AppKit reads, so a gated request runs like a front-door one.
+ * a portr caller authenticates with Better Auth OTP or a passkey, and on
+ * success the gate injects the identity headers AppKit reads.
  *
  * WHICH TRAFFIC IS GATED - the `Host` header, not the socket. portr's client
  * forwards with Go's `httputil.NewSingleHostReverseProxy` and a `Director` that
@@ -22,10 +22,13 @@
  * @module
  */
 import type { IncomingMessage } from "node:http";
-import type { RequestHandler } from "express";
+import type { RequestHandler, Response } from "express";
 import { type HeaderPolicy } from "./headers.ts";
 import type { AuthGateApi } from "./plugin.ts";
-/** Route prefix the login flow lives under (open, answered in-process). */
+type WebRequestInput = IncomingMessage & {
+    body?: unknown;
+    originalUrl?: string;
+};
 export declare const AUTH_PREFIX = "/api/email/auth";
 /** Options for {@link mountGate}. */
 export interface GateOptions {
@@ -57,6 +60,9 @@ export declare function isTunnelHost(req: IncomingMessage, publicDomain: string
  * varying the header. Called before {@link stripHeaders}.
  */
 export declare function clientIp(req: IncomingMessage): string;
+export declare function webHeaders(req: IncomingMessage): Headers;
+export declare function webRequest(req: WebRequestInput): Promise<globalThis.Request>;
+export declare function sendWebResponse(res: Response, response: globalThis.Response): Promise<void>;
 /**
  * What the caller should do with a request, from {@link gateRequest}.
  *
@@ -91,10 +97,6 @@ export declare const UNAUTHORIZED_BODY: {
     readonly error: "authentication required";
     readonly loginPath: "/api/email/auth";
 };
-/** The `Set-Cookie` value that issues a verified session. */
-export declare function sessionSetCookie(sessionToken: string, maxAgeSeconds: number): string;
-/** The `Set-Cookie` value that clears the session. */
-export declare const LOGOUT_SET_COOKIE = "dbx-tools-auth=; Path=/; HttpOnly; Max-Age=0";
 /**
  * Register the login routes and the gating middleware on the app's Express
  * instance. Called from {@link AuthGatePlugin} with the router AppKit hands
@@ -104,4 +106,5 @@ export declare const LOGOUT_SET_COOKIE = "dbx-tools-auth=; Path=/; HttpOnly; Max
  * routes live at an ABSOLUTE path (`/api/email/auth/*`, the client's contract),
  * not under the plugin's `/api/authGate` base.
  */
-export declare function mountGate(opts: GateOptions, addRoute: (method: "get" | "post", path: string, handler: RequestHandler) => void, addMiddleware: (path: string, handler: RequestHandler) => void): void;
+export declare function mountGate(opts: GateOptions, _addRoute: (method: "get" | "post", path: string, handler: RequestHandler) => void, addMiddleware: (path: string, handler: RequestHandler) => void): void;
+export {};