@dbx-tools/tunnel 0.6.89 → 0.6.91

package/lib/src/otp.d.ts

@@ -1,49 +0,0 @@
-/**
- * One-time-code store + session JWT for the email-OTP tunnel gate.
- *
- * The code store is backed by AppKit's `CacheManager` (auto-configured to memory,
- * or Lakebase when the app wires a persistent `CacheStorage`), so TTL EXPIRY and
- * eviction are the cache's job - no hand-rolled Map or timers. A 6-digit code is
- * generated with `crypto.randomInt` and stored as a SHA-256 hash with an attempt
- * counter (never the plaintext, never in the JWT); `verify` is constant-time on
- * the hash, and the entry is deleted on success or once attempts are exhausted.
- *
- * The session JWT is an HS256 token (via `jose`) carrying only the email. Its
- * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
- * set, else a key persisted in the cache for 30 days so cookies survive the
- * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
- * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
- * by the cache key, so the force-clear switch holds even for a still-current key.
- *
- * @module
- */
-/** Result of {@link CodeStore.verify}. */
-export type VerifyOutcome = "ok" | "invalid" | "expired" | "too-many-attempts";
-/**
- * Pending one-time codes, stored in AppKit's cache keyed by lowercased email.
- * Expiry is the cache's TTL (no manual clock); a miss means expired-or-never.
- */
-export declare class CodeStore {
-    private readonly ttlSeconds;
-    private readonly maxAttempts;
-    constructor(ttlSeconds: number, maxAttempts: number);
-    private cache;
-    private key;
-    /**
-     * Generate, store (hashed, with the cache TTL), and RETURN a fresh 6-digit
-     * code. The caller emails the returned plaintext; only the hash is retained.
-     * Replaces any pending code for the address.
-     */
-    issue(email: string): Promise<string>;
-    /**
-     * Check `code` for `email`. A cache miss is `expired` (TTL elapsed or never
-     * issued). Deletes the entry on success or when attempts are exhausted, so a
-     * code is single-use and can't be brute-forced past the cap. An attempt
-     * increments the stored counter (re-persisted with a fresh TTL window).
-     */
-    verify(email: string, code: string): Promise<VerifyOutcome>;
-}
-/** Mint a session JWT for `email`, expiring in `ttlSeconds`. */
-export declare function signSession(email: string, ttlSeconds: number): Promise<string>;
-/** Validate a session JWT, returning the email it was minted for, or `undefined`. */
-export declare function verifySession(token: string | undefined): Promise<string | undefined>;

package/lib/src/otp.js

@@ -1,130 +0,0 @@
-/**
- * One-time-code store + session JWT for the email-OTP tunnel gate.
- *
- * The code store is backed by AppKit's `CacheManager` (auto-configured to memory,
- * or Lakebase when the app wires a persistent `CacheStorage`), so TTL EXPIRY and
- * eviction are the cache's job - no hand-rolled Map or timers. A 6-digit code is
- * generated with `crypto.randomInt` and stored as a SHA-256 hash with an attempt
- * counter (never the plaintext, never in the JWT); `verify` is constant-time on
- * the hash, and the entry is deleted on success or once attempts are exhausted.
- *
- * The session JWT is an HS256 token (via `jose`) carrying only the email. Its
- * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
- * set, else a key persisted in the cache for 30 days so cookies survive the
- * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
- * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
- * by the cache key, so the force-clear switch holds even for a still-current key.
- *
- * @module
- */
-import { createHash, randomInt, timingSafeEqual } from "node:crypto";
-import { CacheManager } from "@databricks/appkit";
-import { processLock } from "@dbx-tools/core";
-import { jwtVerify, SignJWT } from "jose";
-import { signingKey } from "./signing-key.js";
-/** JWT issuer/audience so a token minted for this gate isn't accepted elsewhere. */
-const JWT_AUD = "dbx-tools-tunnel-auth";
-/** Cache-key prefix for pending codes, namespaced away from any other cache use. */
-const CODE_PREFIX = "tunnel:otp:";
-/** SHA-256 hex of a value. */
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-/** Constant-time compare of two equal-length hex digests. */
-function safeEqualHex(a, b) {
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-}
-/**
- * Pending one-time codes, stored in AppKit's cache keyed by lowercased email.
- * Expiry is the cache's TTL (no manual clock); a miss means expired-or-never.
- */
-export class CodeStore {
-    ttlSeconds;
-    maxAttempts;
-    constructor(ttlSeconds, maxAttempts) {
-        this.ttlSeconds = ttlSeconds;
-        this.maxAttempts = maxAttempts;
-    }
-    cache() {
-        return CacheManager.getInstanceSync();
-    }
-    key(email) {
-        return `${CODE_PREFIX}${email.toLowerCase()}`;
-    }
-    /**
-     * Generate, store (hashed, with the cache TTL), and RETURN a fresh 6-digit
-     * code. The caller emails the returned plaintext; only the hash is retained.
-     * Replaces any pending code for the address.
-     */
-    async issue(email) {
-        const key = this.key(email);
-        return processLock.withProcessLock(key, async () => {
-            const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
-            const entry = { hash: sha256(code), attempts: 0 };
-            await this.cache().set(key, entry, { ttl: this.ttlSeconds });
-            return code;
-        });
-    }
-    /**
-     * Check `code` for `email`. A cache miss is `expired` (TTL elapsed or never
-     * issued). Deletes the entry on success or when attempts are exhausted, so a
-     * code is single-use and can't be brute-forced past the cap. An attempt
-     * increments the stored counter (re-persisted with a fresh TTL window).
-     */
-    async verify(email, code) {
-        const key = this.key(email);
-        return processLock.withProcessLock(key, async () => {
-            const entry = await this.cache().get(key);
-            if (!entry)
-                return "expired";
-            const attempts = entry.attempts + 1;
-            if (safeEqualHex(entry.hash, sha256(code))) {
-                await this.cache().delete(key);
-                return "ok";
-            }
-            if (attempts >= this.maxAttempts) {
-                await this.cache().delete(key);
-                return "too-many-attempts";
-            }
-            await this.cache().set(key, { ...entry, attempts }, { ttl: this.ttlSeconds });
-            return "invalid";
-        });
-    }
-}
-/** Mint a session JWT for `email`, expiring in `ttlSeconds`. */
-export async function signSession(email, ttlSeconds) {
-    const { key } = await signingKey();
-    return new SignJWT({ email })
-        .setProtectedHeader({ alg: "HS256" })
-        .setSubject(email)
-        .setAudience(JWT_AUD)
-        .setIssuedAt()
-        .setExpirationTime(`${ttlSeconds}s`)
-        .sign(key);
-}
-/** Validate a session JWT, returning the email it was minted for, or `undefined`. */
-export async function verifySession(token) {
-    if (!token)
-        return undefined;
-    try {
-        const { key, cutoffMs } = await signingKey();
-        const { payload } = await jwtVerify(token, key, { audience: JWT_AUD });
-        // Belt and braces with the cutoff-scoped cache key: that alone already
-        // orphans older keys, but an operator who moved the cutoff while
-        // TUNNEL_AUTH_JWT_SECRET is set has no key rotation to rely on, and this
-        // check is what makes the switch work in that case too.
-        // Compared in whole SECONDS because `iat` has no finer resolution: against a
-        // millisecond cutoff, a cookie minted in the same second as it would be
-        // refused depending on sub-second rounding.
-        if (cutoffMs > 0 && (payload.iat === undefined || payload.iat < Math.floor(cutoffMs / 1000))) {
-            return undefined;
-        }
-        return typeof payload.email === "string" ? payload.email : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL290cC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBRUgsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQ3JFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDOUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFDMUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRTlDLG9GQUFvRjtBQUNwRixNQUFNLE9BQU8sR0FBRyx1QkFBdUIsQ0FBQztBQUV4QyxvRkFBb0Y7QUFDcEYsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDO0FBRWxDLDhCQUE4QjtBQUM5QixTQUFTLE1BQU0sQ0FBQyxLQUFhO0lBQzNCLE9BQU8sVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDMUQsQ0FBQztBQUVELDZEQUE2RDtBQUM3RCxTQUFTLFlBQVksQ0FBQyxDQUFTLEVBQUUsQ0FBUztJQUN4QyxJQUFJLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN4QyxPQUFPLGVBQWUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ3ZFLENBQUM7QUFVRDs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sU0FBUztJQUVEO0lBQ0E7SUFGbkIsWUFDbUIsVUFBa0IsRUFDbEIsV0FBbUI7UUFEbkIsZUFBVSxHQUFWLFVBQVUsQ0FBUTtRQUNsQixnQkFBVyxHQUFYLFdBQVcsQ0FBUTtJQUNuQyxDQUFDO0lBRUksS0FBSztRQUNYLE9BQU8sWUFBWSxDQUFDLGVBQWUsRUFBRSxDQUFDO0lBQ3hDLENBQUM7SUFFTyxHQUFHLENBQUMsS0FBYTtRQUN2QixPQUFPLEdBQUcsV0FBVyxHQUFHLEtBQUssQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQ2hELENBQUM7SUFFRDs7OztPQUlHO0lBQ0gsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFhO1FBQ3ZCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsT0FBTyxXQUFXLENBQUMsZUFBZSxDQUFDLEdBQUcsRUFBRSxLQUFLLElBQUksRUFBRTtZQUNqRCxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDOUQsTUFBTSxLQUFLLEdBQWMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDLEVBQUUsQ0FBQztZQUM3RCxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztZQUM3RCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFhLEVBQUUsSUFBWTtRQUN0QyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLE9BQU8sV0FBVyxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxJQUFJLEVBQUU7WUFDakQsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFZLEdBQUcsQ0FBQyxDQUFDO1lBQ3JELElBQUksQ0FBQyxLQUFLO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQzdCLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1lBQ3BDLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDM0MsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUMvQixPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxJQUFJLFFBQVEsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ2pDLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDL0IsT0FBTyxtQkFBbUIsQ0FBQztZQUM3QixDQUFDO1lBQ0QsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEdBQUcsS0FBSyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQzlFLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBRUQsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsV0FBVyxDQUFDLEtBQWEsRUFBRSxVQUFrQjtJQUNqRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztJQUNuQyxPQUFPLElBQUksT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUM7U0FDMUIsa0JBQWtCLENBQUMsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUM7U0FDcEMsVUFBVSxDQUFDLEtBQUssQ0FBQztTQUNqQixXQUFXLENBQUMsT0FBTyxDQUFDO1NBQ3BCLFdBQVcsRUFBRTtTQUNiLGlCQUFpQixDQUFDLEdBQUcsVUFBVSxHQUFHLENBQUM7U0FDbkMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2YsQ0FBQztBQUVELHFGQUFxRjtBQUNyRixNQUFNLENBQUMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUF5QjtJQUMzRCxJQUFJLENBQUMsS0FBSztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQzdCLElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztRQUM3QyxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZFLHVFQUF1RTtRQUN2RSxpRUFBaUU7UUFDakUseUVBQXlFO1FBQ3pFLHdEQUF3RDtRQUN4RCw2RUFBNkU7UUFDN0Usd0VBQXdFO1FBQ3hFLDRDQUE0QztRQUM1QyxJQUFJLFFBQVEsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM3RixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBQ0QsT0FBTyxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdkUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBPbmUtdGltZS1jb2RlIHN0b3JlICsgc2Vzc2lvbiBKV1QgZm9yIHRoZSBlbWFpbC1PVFAgdHVubmVsIGdhdGUuXG4gKlxuICogVGhlIGNvZGUgc3RvcmUgaXMgYmFja2VkIGJ5IEFwcEtpdCdzIGBDYWNoZU1hbmFnZXJgIChhdXRvLWNvbmZpZ3VyZWQgdG8gbWVtb3J5LFxuICogb3IgTGFrZWJhc2Ugd2hlbiB0aGUgYXBwIHdpcmVzIGEgcGVyc2lzdGVudCBgQ2FjaGVTdG9yYWdlYCksIHNvIFRUTCBFWFBJUlkgYW5kXG4gKiBldmljdGlvbiBhcmUgdGhlIGNhY2hlJ3Mgam9iIC0gbm8gaGFuZC1yb2xsZWQgTWFwIG9yIHRpbWVycy4gQSA2LWRpZ2l0IGNvZGUgaXNcbiAqIGdlbmVyYXRlZCB3aXRoIGBjcnlwdG8ucmFuZG9tSW50YCBhbmQgc3RvcmVkIGFzIGEgU0hBLTI1NiBoYXNoIHdpdGggYW4gYXR0ZW1wdFxuICogY291bnRlciAobmV2ZXIgdGhlIHBsYWludGV4dCwgbmV2ZXIgaW4gdGhlIEpXVCk7IGB2ZXJpZnlgIGlzIGNvbnN0YW50LXRpbWUgb25cbiAqIHRoZSBoYXNoLCBhbmQgdGhlIGVudHJ5IGlzIGRlbGV0ZWQgb24gc3VjY2VzcyBvciBvbmNlIGF0dGVtcHRzIGFyZSBleGhhdXN0ZWQuXG4gKlxuICogVGhlIHNlc3Npb24gSldUIGlzIGFuIEhTMjU2IHRva2VuICh2aWEgYGpvc2VgKSBjYXJyeWluZyBvbmx5IHRoZSBlbWFpbC4gSXRzXG4gKiBzaWduaW5nIGtleSBpcyByZXNvbHZlZCBieSBgLi9zaWduaW5nLWtleS50c2A6IGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYCB3aGVuXG4gKiBzZXQsIGVsc2UgYSBrZXkgcGVyc2lzdGVkIGluIHRoZSBjYWNoZSBmb3IgMzAgZGF5cyBzbyBjb29raWVzIHN1cnZpdmUgdGhlXG4gKiByZXN0YXJ0cyBhIHR1bm5lbCBzZWVzIHdoZW5ldmVyIHRoZSBhcHAgaXQgd3JhcHMgcmVsb2Fkcy4gQSBjb29raWUgc2lnbmVkXG4gKiBiZWZvcmUgYFRVTk5FTF9BVVRIX1NFU1NJT05fQ1VUT0ZGYCBpcyByZWZ1c2VkIGhlcmUgYXMgd2VsbCBhcyBiZWluZyBvcnBoYW5lZFxuICogYnkgdGhlIGNhY2hlIGtleSwgc28gdGhlIGZvcmNlLWNsZWFyIHN3aXRjaCBob2xkcyBldmVuIGZvciBhIHN0aWxsLWN1cnJlbnQga2V5LlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBjcmVhdGVIYXNoLCByYW5kb21JbnQsIHRpbWluZ1NhZmVFcXVhbCB9IGZyb20gXCJub2RlOmNyeXB0b1wiO1xuaW1wb3J0IHsgQ2FjaGVNYW5hZ2VyIH0gZnJvbSBcIkBkYXRhYnJpY2tzL2FwcGtpdFwiO1xuaW1wb3J0IHsgcHJvY2Vzc0xvY2sgfSBmcm9tIFwiQGRieC10b29scy9jb3JlXCI7XG5pbXBvcnQgeyBqd3RWZXJpZnksIFNpZ25KV1QgfSBmcm9tIFwiam9zZVwiO1xuaW1wb3J0IHsgc2lnbmluZ0tleSB9IGZyb20gXCIuL3NpZ25pbmcta2V5LnRzXCI7XG5cbi8qKiBKV1QgaXNzdWVyL2F1ZGllbmNlIHNvIGEgdG9rZW4gbWludGVkIGZvciB0aGlzIGdhdGUgaXNuJ3QgYWNjZXB0ZWQgZWxzZXdoZXJlLiAqL1xuY29uc3QgSldUX0FVRCA9IFwiZGJ4LXRvb2xzLXR1bm5lbC1hdXRoXCI7XG5cbi8qKiBDYWNoZS1rZXkgcHJlZml4IGZvciBwZW5kaW5nIGNvZGVzLCBuYW1lc3BhY2VkIGF3YXkgZnJvbSBhbnkgb3RoZXIgY2FjaGUgdXNlLiAqL1xuY29uc3QgQ09ERV9QUkVGSVggPSBcInR1bm5lbDpvdHA6XCI7XG5cbi8qKiBTSEEtMjU2IGhleCBvZiBhIHZhbHVlLiAqL1xuZnVuY3Rpb24gc2hhMjU2KHZhbHVlOiBzdHJpbmcpOiBzdHJpbmcge1xuICByZXR1cm4gY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUodmFsdWUpLmRpZ2VzdChcImhleFwiKTtcbn1cblxuLyoqIENvbnN0YW50LXRpbWUgY29tcGFyZSBvZiB0d28gZXF1YWwtbGVuZ3RoIGhleCBkaWdlc3RzLiAqL1xuZnVuY3Rpb24gc2FmZUVxdWFsSGV4KGE6IHN0cmluZywgYjogc3RyaW5nKTogYm9vbGVhbiB7XG4gIGlmIChhLmxlbmd0aCAhPT0gYi5sZW5ndGgpIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIHRpbWluZ1NhZmVFcXVhbChCdWZmZXIuZnJvbShhLCBcImhleFwiKSwgQnVmZmVyLmZyb20oYiwgXCJoZXhcIikpO1xufVxuXG5pbnRlcmZhY2UgQ29kZUVudHJ5IHtcbiAgaGFzaDogc3RyaW5nO1xuICBhdHRlbXB0czogbnVtYmVyO1xufVxuXG4vKiogUmVzdWx0IG9mIHtAbGluayBDb2RlU3RvcmUudmVyaWZ5fS4gKi9cbmV4cG9ydCB0eXBlIFZlcmlmeU91dGNvbWUgPSBcIm9rXCIgfCBcImludmFsaWRcIiB8IFwiZXhwaXJlZFwiIHwgXCJ0b28tbWFueS1hdHRlbXB0c1wiO1xuXG4vKipcbiAqIFBlbmRpbmcgb25lLXRpbWUgY29kZXMsIHN0b3JlZCBpbiBBcHBLaXQncyBjYWNoZSBrZXllZCBieSBsb3dlcmNhc2VkIGVtYWlsLlxuICogRXhwaXJ5IGlzIHRoZSBjYWNoZSdzIFRUTCAobm8gbWFudWFsIGNsb2NrKTsgYSBtaXNzIG1lYW5zIGV4cGlyZWQtb3ItbmV2ZXIuXG4gKi9cbmV4cG9ydCBjbGFzcyBDb2RlU3RvcmUge1xuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IHR0bFNlY29uZHM6IG51bWJlcixcbiAgICBwcml2YXRlIHJlYWRvbmx5IG1heEF0dGVtcHRzOiBudW1iZXIsXG4gICkge31cblxuICBwcml2YXRlIGNhY2hlKCk6IENhY2hlTWFuYWdlciB7XG4gICAgcmV0dXJuIENhY2hlTWFuYWdlci5nZXRJbnN0YW5jZVN5bmMoKTtcbiAgfVxuXG4gIHByaXZhdGUga2V5KGVtYWlsOiBzdHJpbmcpOiBzdHJpbmcge1xuICAgIHJldHVybiBgJHtDT0RFX1BSRUZJWH0ke2VtYWlsLnRvTG93ZXJDYXNlKCl9YDtcbiAgfVxuXG4gIC8qKlxuICAgKiBHZW5lcmF0ZSwgc3RvcmUgKGhhc2hlZCwgd2l0aCB0aGUgY2FjaGUgVFRMKSwgYW5kIFJFVFVSTiBhIGZyZXNoIDYtZGlnaXRcbiAgICogY29kZS4gVGhlIGNhbGxlciBlbWFpbHMgdGhlIHJldHVybmVkIHBsYWludGV4dDsgb25seSB0aGUgaGFzaCBpcyByZXRhaW5lZC5cbiAgICogUmVwbGFjZXMgYW55IHBlbmRpbmcgY29kZSBmb3IgdGhlIGFkZHJlc3MuXG4gICAqL1xuICBhc3luYyBpc3N1ZShlbWFpbDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgICBjb25zdCBrZXkgPSB0aGlzLmtleShlbWFpbCk7XG4gICAgcmV0dXJuIHByb2Nlc3NMb2NrLndpdGhQcm9jZXNzTG9jayhrZXksIGFzeW5jICgpID0+IHtcbiAgICAgIGNvbnN0IGNvZGUgPSBTdHJpbmcocmFuZG9tSW50KDAsIDFfMDAwXzAwMCkpLnBhZFN0YXJ0KDYsIFwiMFwiKTtcbiAgICAgIGNvbnN0IGVudHJ5OiBDb2RlRW50cnkgPSB7IGhhc2g6IHNoYTI1Nihjb2RlKSwgYXR0ZW1wdHM6IDAgfTtcbiAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5zZXQoa2V5LCBlbnRyeSwgeyB0dGw6IHRoaXMudHRsU2Vjb25kcyB9KTtcbiAgICAgIHJldHVybiBjb2RlO1xuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIENoZWNrIGBjb2RlYCBmb3IgYGVtYWlsYC4gQSBjYWNoZSBtaXNzIGlzIGBleHBpcmVkYCAoVFRMIGVsYXBzZWQgb3IgbmV2ZXJcbiAgICogaXNzdWVkKS4gRGVsZXRlcyB0aGUgZW50cnkgb24gc3VjY2VzcyBvciB3aGVuIGF0dGVtcHRzIGFyZSBleGhhdXN0ZWQsIHNvIGFcbiAgICogY29kZSBpcyBzaW5nbGUtdXNlIGFuZCBjYW4ndCBiZSBicnV0ZS1mb3JjZWQgcGFzdCB0aGUgY2FwLiBBbiBhdHRlbXB0XG4gICAqIGluY3JlbWVudHMgdGhlIHN0b3JlZCBjb3VudGVyIChyZS1wZXJzaXN0ZWQgd2l0aCBhIGZyZXNoIFRUTCB3aW5kb3cpLlxuICAgKi9cbiAgYXN5bmMgdmVyaWZ5KGVtYWlsOiBzdHJpbmcsIGNvZGU6IHN0cmluZyk6IFByb21pc2U8VmVyaWZ5T3V0Y29tZT4ge1xuICAgIGNvbnN0IGtleSA9IHRoaXMua2V5KGVtYWlsKTtcbiAgICByZXR1cm4gcHJvY2Vzc0xvY2sud2l0aFByb2Nlc3NMb2NrKGtleSwgYXN5bmMgKCkgPT4ge1xuICAgICAgY29uc3QgZW50cnkgPSBhd2FpdCB0aGlzLmNhY2hlKCkuZ2V0PENvZGVFbnRyeT4oa2V5KTtcbiAgICAgIGlmICghZW50cnkpIHJldHVybiBcImV4cGlyZWRcIjtcbiAgICAgIGNvbnN0IGF0dGVtcHRzID0gZW50cnkuYXR0ZW1wdHMgKyAxO1xuICAgICAgaWYgKHNhZmVFcXVhbEhleChlbnRyeS5oYXNoLCBzaGEyNTYoY29kZSkpKSB7XG4gICAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5kZWxldGUoa2V5KTtcbiAgICAgICAgcmV0dXJuIFwib2tcIjtcbiAgICAgIH1cbiAgICAgIGlmIChhdHRlbXB0cyA+PSB0aGlzLm1heEF0dGVtcHRzKSB7XG4gICAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5kZWxldGUoa2V5KTtcbiAgICAgICAgcmV0dXJuIFwidG9vLW1hbnktYXR0ZW1wdHNcIjtcbiAgICAgIH1cbiAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5zZXQoa2V5LCB7IC4uLmVudHJ5LCBhdHRlbXB0cyB9LCB7IHR0bDogdGhpcy50dGxTZWNvbmRzIH0pO1xuICAgICAgcmV0dXJuIFwiaW52YWxpZFwiO1xuICAgIH0pO1xuICB9XG59XG5cbi8qKiBNaW50IGEgc2Vzc2lvbiBKV1QgZm9yIGBlbWFpbGAsIGV4cGlyaW5nIGluIGB0dGxTZWNvbmRzYC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBzaWduU2Vzc2lvbihlbWFpbDogc3RyaW5nLCB0dGxTZWNvbmRzOiBudW1iZXIpOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCB7IGtleSB9ID0gYXdhaXQgc2lnbmluZ0tleSgpO1xuICByZXR1cm4gbmV3IFNpZ25KV1QoeyBlbWFpbCB9KVxuICAgIC5zZXRQcm90ZWN0ZWRIZWFkZXIoeyBhbGc6IFwiSFMyNTZcIiB9KVxuICAgIC5zZXRTdWJqZWN0KGVtYWlsKVxuICAgIC5zZXRBdWRpZW5jZShKV1RfQVVEKVxuICAgIC5zZXRJc3N1ZWRBdCgpXG4gICAgLnNldEV4cGlyYXRpb25UaW1lKGAke3R0bFNlY29uZHN9c2ApXG4gICAgLnNpZ24oa2V5KTtcbn1cblxuLyoqIFZhbGlkYXRlIGEgc2Vzc2lvbiBKV1QsIHJldHVybmluZyB0aGUgZW1haWwgaXQgd2FzIG1pbnRlZCBmb3IsIG9yIGB1bmRlZmluZWRgLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHZlcmlmeVNlc3Npb24odG9rZW46IHN0cmluZyB8IHVuZGVmaW5lZCk6IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPiB7XG4gIGlmICghdG9rZW4pIHJldHVybiB1bmRlZmluZWQ7XG4gIHRyeSB7XG4gICAgY29uc3QgeyBrZXksIGN1dG9mZk1zIH0gPSBhd2FpdCBzaWduaW5nS2V5KCk7XG4gICAgY29uc3QgeyBwYXlsb2FkIH0gPSBhd2FpdCBqd3RWZXJpZnkodG9rZW4sIGtleSwgeyBhdWRpZW5jZTogSldUX0FVRCB9KTtcbiAgICAvLyBCZWx0IGFuZCBicmFjZXMgd2l0aCB0aGUgY3V0b2ZmLXNjb3BlZCBjYWNoZSBrZXk6IHRoYXQgYWxvbmUgYWxyZWFkeVxuICAgIC8vIG9ycGhhbnMgb2xkZXIga2V5cywgYnV0IGFuIG9wZXJhdG9yIHdobyBtb3ZlZCB0aGUgY3V0b2ZmIHdoaWxlXG4gICAgLy8gVFVOTkVMX0FVVEhfSldUX1NFQ1JFVCBpcyBzZXQgaGFzIG5vIGtleSByb3RhdGlvbiB0byByZWx5IG9uLCBhbmQgdGhpc1xuICAgIC8vIGNoZWNrIGlzIHdoYXQgbWFrZXMgdGhlIHN3aXRjaCB3b3JrIGluIHRoYXQgY2FzZSB0b28uXG4gICAgLy8gQ29tcGFyZWQgaW4gd2hvbGUgU0VDT05EUyBiZWNhdXNlIGBpYXRgIGhhcyBubyBmaW5lciByZXNvbHV0aW9uOiBhZ2FpbnN0IGFcbiAgICAvLyBtaWxsaXNlY29uZCBjdXRvZmYsIGEgY29va2llIG1pbnRlZCBpbiB0aGUgc2FtZSBzZWNvbmQgYXMgaXQgd291bGQgYmVcbiAgICAvLyByZWZ1c2VkIGRlcGVuZGluZyBvbiBzdWItc2Vjb25kIHJvdW5kaW5nLlxuICAgIGlmIChjdXRvZmZNcyA+IDAgJiYgKHBheWxvYWQuaWF0ID09PSB1bmRlZmluZWQgfHwgcGF5bG9hZC5pYXQgPCBNYXRoLmZsb29yKGN1dG9mZk1zIC8gMTAwMCkpKSB7XG4gICAgICByZXR1cm4gdW5kZWZpbmVkO1xuICAgIH1cbiAgICByZXR1cm4gdHlwZW9mIHBheWxvYWQuZW1haWwgPT09IFwic3RyaW5nXCIgPyBwYXlsb2FkLmVtYWlsIDogdW5kZWZpbmVkO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gdW5kZWZpbmVkO1xuICB9XG59XG4iXX0=

package/lib/src/rate-limit.d.ts

@@ -1,35 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export declare class RateLimiter {
-    private readonly max;
-    private readonly windowMs;
-    private readonly windows;
-    constructor(max: number, windowMs: number);
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key: string, now?: number): {
-        allowed: boolean;
-        retryAfter?: number;
-    };
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key: string): void;
-    /** Drop every window (tests). */
-    clear(): void;
-}

package/lib/src/rate-limit.js

@@ -1,53 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export class RateLimiter {
-    max;
-    windowMs;
-    windows = new Map();
-    constructor(max, windowMs) {
-        this.max = max;
-        this.windowMs = windowMs;
-    }
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key, now = Date.now()) {
-        if (this.max <= 0)
-            return { allowed: true };
-        const existing = this.windows.get(key);
-        if (!existing || now >= existing.resetAt) {
-            this.windows.set(key, { count: 1, resetAt: now + this.windowMs });
-            return { allowed: true };
-        }
-        if (existing.count < this.max) {
-            existing.count += 1;
-            return { allowed: true };
-        }
-        return { allowed: false, retryAfter: Math.ceil((existing.resetAt - now) / 1000) };
-    }
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key) {
-        this.windows.delete(key);
-    }
-    /** Drop every window (tests). */
-    clear() {
-        this.windows.clear();
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmF0ZS1saW1pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9yYXRlLWxpbWl0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBT0gsb0RBQW9EO0FBQ3BELE1BQU0sT0FBTyxXQUFXO0lBSUg7SUFDQTtJQUpGLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQUVyRCxZQUNtQixHQUFXLEVBQ1gsUUFBZ0I7UUFEaEIsUUFBRyxHQUFILEdBQUcsQ0FBUTtRQUNYLGFBQVEsR0FBUixRQUFRLENBQVE7SUFDaEMsQ0FBQztJQUVKOzs7O09BSUc7SUFDSCxHQUFHLENBQUMsR0FBVyxFQUFFLE1BQWMsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUN2QyxJQUFJLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQztZQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDNUMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLFFBQVEsSUFBSSxHQUFHLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLEdBQUcsR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztZQUNsRSxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO1FBQzNCLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzlCLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDO1lBQ3BCLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDM0IsQ0FBQztRQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sR0FBRyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3BGLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsS0FBSyxDQUFDLEdBQVc7UUFDZixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMzQixDQUFDO0lBRUQsaUNBQWlDO0lBQ2pDLEtBQUs7UUFDSCxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQSBzbWFsbCBpbi1tZW1vcnkgZml4ZWQtd2luZG93IHJhdGUgbGltaXRlciBmb3IgdGhlIGVtYWlsLU9UUCBnYXRlLlxuICpcbiAqIEtleWVkIGJ5IGFuIGFyYml0cmFyeSBzdHJpbmcgKGFuIGVtYWlsIGFkZHJlc3Mgb3IgYSBjbGllbnQgSVApLiBFYWNoIGtleSBnZXRzXG4gKiBgbWF4YCBoaXRzIHBlciBgd2luZG93TXNgOyB0aGUgd2luZG93IHJlc2V0cyBvbiBmaXJzdCB1c2UgYWZ0ZXIgaXQgZWxhcHNlcy5cbiAqIGBoaXQoKWAgcmV0dXJucyB3aGV0aGVyIHRoZSBjYWxsIGlzIGFsbG93ZWQgYW5kLCB3aGVuIG5vdCwgaG93IG1hbnkgc2Vjb25kc1xuICogdW50aWwgdGhlIHdpbmRvdyByZXNldHMgc28gYSBjYWxsZXIgY2FuIHN1cmZhY2UgYSBjb29sZG93bi5cbiAqXG4gKiBJbi1tZW1vcnkgaXMgaW50ZW50aW9uYWwgYW5kIHN1ZmZpY2llbnQgZm9yIGEgc2luZ2xlLWFwcC1pbnN0YW5jZSBnYXRlOiBhblxuICogYXBwIGJlaGluZCBhIHBvcnRyIHR1bm5lbCBzZXJ2ZXMgZnJvbSBvbmUgcHJvY2Vzcy4gSXQgaXMgTk9UIGEgZGlzdHJpYnV0ZWRcbiAqIGxpbWl0ZXI7IGEgbXVsdGktcmVwbGljYSBkZXBsb3ltZW50IHdvdWxkIG5lZWQgc2hhcmVkIHN0YXRlLiBFbnRyaWVzIGFyZVxuICogcHJ1bmVkIGxhemlseSBvbiBhY2Nlc3MsIHNvIGFuIGlkbGUga2V5IGNvc3RzIG5vdGhpbmcgYWZ0ZXIgaXRzIHdpbmRvdy5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW50ZXJmYWNlIFdpbmRvdyB7XG4gIGNvdW50OiBudW1iZXI7XG4gIHJlc2V0QXQ6IG51bWJlcjtcbn1cblxuLyoqIEEgZml4ZWQtd2luZG93IHJhdGUgbGltaXRlciBvdmVyIHN0cmluZyBrZXlzLiAqL1xuZXhwb3J0IGNsYXNzIFJhdGVMaW1pdGVyIHtcbiAgcHJpdmF0ZSByZWFkb25seSB3aW5kb3dzID0gbmV3IE1hcDxzdHJpbmcsIFdpbmRvdz4oKTtcblxuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IG1heDogbnVtYmVyLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgd2luZG93TXM6IG51bWJlcixcbiAgKSB7fVxuXG4gIC8qKlxuICAgKiBSZWNvcmQgYSBoaXQgZm9yIGBrZXlgLiBSZXR1cm5zIGB7IGFsbG93ZWQgfWAsIHBsdXMgYHJldHJ5QWZ0ZXJgIChzZWNvbmRzKVxuICAgKiB3aGVuIHRoZSBsaW1pdCBpcyBleGNlZWRlZC4gQSBsaW1pdCBvZiBgPD0gMGAgZGlzYWJsZXMgbGltaXRpbmcgKGFsd2F5c1xuICAgKiBhbGxvd2VkKSwgd2hpY2ggbGV0cyBhIGNvbmZpZyB0dXJuIGl0IG9mZiB3aXRob3V0IHNwZWNpYWwtY2FzaW5nIGNhbGxlcnMuXG4gICAqL1xuICBoaXQoa2V5OiBzdHJpbmcsIG5vdzogbnVtYmVyID0gRGF0ZS5ub3coKSk6IHsgYWxsb3dlZDogYm9vbGVhbjsgcmV0cnlBZnRlcj86IG51bWJlciB9IHtcbiAgICBpZiAodGhpcy5tYXggPD0gMCkgcmV0dXJuIHsgYWxsb3dlZDogdHJ1ZSB9O1xuICAgIGNvbnN0IGV4aXN0aW5nID0gdGhpcy53aW5kb3dzLmdldChrZXkpO1xuICAgIGlmICghZXhpc3RpbmcgfHwgbm93ID49IGV4aXN0aW5nLnJlc2V0QXQpIHtcbiAgICAgIHRoaXMud2luZG93cy5zZXQoa2V5LCB7IGNvdW50OiAxLCByZXNldEF0OiBub3cgKyB0aGlzLndpbmRvd01zIH0pO1xuICAgICAgcmV0dXJuIHsgYWxsb3dlZDogdHJ1ZSB9O1xuICAgIH1cbiAgICBpZiAoZXhpc3RpbmcuY291bnQgPCB0aGlzLm1heCkge1xuICAgICAgZXhpc3RpbmcuY291bnQgKz0gMTtcbiAgICAgIHJldHVybiB7IGFsbG93ZWQ6IHRydWUgfTtcbiAgICB9XG4gICAgcmV0dXJuIHsgYWxsb3dlZDogZmFsc2UsIHJldHJ5QWZ0ZXI6IE1hdGguY2VpbCgoZXhpc3RpbmcucmVzZXRBdCAtIG5vdykgLyAxMDAwKSB9O1xuICB9XG5cbiAgLyoqIEZvcmdldCBhIGtleSAoZS5nLiBjbGVhciBhIGNhbGxlcidzIHdpbmRvdyBhZnRlciBhIHN1Y2Nlc3NmdWwgdmVyaWZ5KS4gKi9cbiAgcmVzZXQoa2V5OiBzdHJpbmcpOiB2b2lkIHtcbiAgICB0aGlzLndpbmRvd3MuZGVsZXRlKGtleSk7XG4gIH1cblxuICAvKiogRHJvcCBldmVyeSB3aW5kb3cgKHRlc3RzKS4gKi9cbiAgY2xlYXIoKTogdm9pZCB7XG4gICAgdGhpcy53aW5kb3dzLmNsZWFyKCk7XG4gIH1cbn1cbiJdfQ==

package/src/otp.ts

@@ -1,143 +0,0 @@
-/**
- * One-time-code store + session JWT for the email-OTP tunnel gate.
- *
- * The code store is backed by AppKit's `CacheManager` (auto-configured to memory,
- * or Lakebase when the app wires a persistent `CacheStorage`), so TTL EXPIRY and
- * eviction are the cache's job - no hand-rolled Map or timers. A 6-digit code is
- * generated with `crypto.randomInt` and stored as a SHA-256 hash with an attempt
- * counter (never the plaintext, never in the JWT); `verify` is constant-time on
- * the hash, and the entry is deleted on success or once attempts are exhausted.
- *
- * The session JWT is an HS256 token (via `jose`) carrying only the email. Its
- * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
- * set, else a key persisted in the cache for 30 days so cookies survive the
- * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
- * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
- * by the cache key, so the force-clear switch holds even for a still-current key.
- *
- * @module
- */
-
-import { createHash, randomInt, timingSafeEqual } from "node:crypto";
-import { CacheManager } from "@databricks/appkit";
-import { processLock } from "@dbx-tools/core";
-import { jwtVerify, SignJWT } from "jose";
-import { signingKey } from "./signing-key.ts";
-
-/** JWT issuer/audience so a token minted for this gate isn't accepted elsewhere. */
-const JWT_AUD = "dbx-tools-tunnel-auth";
-
-/** Cache-key prefix for pending codes, namespaced away from any other cache use. */
-const CODE_PREFIX = "tunnel:otp:";
-
-/** SHA-256 hex of a value. */
-function sha256(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-/** Constant-time compare of two equal-length hex digests. */
-function safeEqualHex(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-}
-
-interface CodeEntry {
-  hash: string;
-  attempts: number;
-}
-
-/** Result of {@link CodeStore.verify}. */
-export type VerifyOutcome = "ok" | "invalid" | "expired" | "too-many-attempts";
-
-/**
- * Pending one-time codes, stored in AppKit's cache keyed by lowercased email.
- * Expiry is the cache's TTL (no manual clock); a miss means expired-or-never.
- */
-export class CodeStore {
-  constructor(
-    private readonly ttlSeconds: number,
-    private readonly maxAttempts: number,
-  ) {}
-
-  private cache(): CacheManager {
-    return CacheManager.getInstanceSync();
-  }
-
-  private key(email: string): string {
-    return `${CODE_PREFIX}${email.toLowerCase()}`;
-  }
-
-  /**
-   * Generate, store (hashed, with the cache TTL), and RETURN a fresh 6-digit
-   * code. The caller emails the returned plaintext; only the hash is retained.
-   * Replaces any pending code for the address.
-   */
-  async issue(email: string): Promise<string> {
-    const key = this.key(email);
-    return processLock.withProcessLock(key, async () => {
-      const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
-      const entry: CodeEntry = { hash: sha256(code), attempts: 0 };
-      await this.cache().set(key, entry, { ttl: this.ttlSeconds });
-      return code;
-    });
-  }
-
-  /**
-   * Check `code` for `email`. A cache miss is `expired` (TTL elapsed or never
-   * issued). Deletes the entry on success or when attempts are exhausted, so a
-   * code is single-use and can't be brute-forced past the cap. An attempt
-   * increments the stored counter (re-persisted with a fresh TTL window).
-   */
-  async verify(email: string, code: string): Promise<VerifyOutcome> {
-    const key = this.key(email);
-    return processLock.withProcessLock(key, async () => {
-      const entry = await this.cache().get<CodeEntry>(key);
-      if (!entry) return "expired";
-      const attempts = entry.attempts + 1;
-      if (safeEqualHex(entry.hash, sha256(code))) {
-        await this.cache().delete(key);
-        return "ok";
-      }
-      if (attempts >= this.maxAttempts) {
-        await this.cache().delete(key);
-        return "too-many-attempts";
-      }
-      await this.cache().set(key, { ...entry, attempts }, { ttl: this.ttlSeconds });
-      return "invalid";
-    });
-  }
-}
-
-/** Mint a session JWT for `email`, expiring in `ttlSeconds`. */
-export async function signSession(email: string, ttlSeconds: number): Promise<string> {
-  const { key } = await signingKey();
-  return new SignJWT({ email })
-    .setProtectedHeader({ alg: "HS256" })
-    .setSubject(email)
-    .setAudience(JWT_AUD)
-    .setIssuedAt()
-    .setExpirationTime(`${ttlSeconds}s`)
-    .sign(key);
-}
-
-/** Validate a session JWT, returning the email it was minted for, or `undefined`. */
-export async function verifySession(token: string | undefined): Promise<string | undefined> {
-  if (!token) return undefined;
-  try {
-    const { key, cutoffMs } = await signingKey();
-    const { payload } = await jwtVerify(token, key, { audience: JWT_AUD });
-    // Belt and braces with the cutoff-scoped cache key: that alone already
-    // orphans older keys, but an operator who moved the cutoff while
-    // TUNNEL_AUTH_JWT_SECRET is set has no key rotation to rely on, and this
-    // check is what makes the switch work in that case too.
-    // Compared in whole SECONDS because `iat` has no finer resolution: against a
-    // millisecond cutoff, a cookie minted in the same second as it would be
-    // refused depending on sub-second rounding.
-    if (cutoffMs > 0 && (payload.iat === undefined || payload.iat < Math.floor(cutoffMs / 1000))) {
-      return undefined;
-    }
-    return typeof payload.email === "string" ? payload.email : undefined;
-  } catch {
-    return undefined;
-  }
-}

package/src/rate-limit.ts

@@ -1,59 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-
-interface Window {
-  count: number;
-  resetAt: number;
-}
-
-/** A fixed-window rate limiter over string keys. */
-export class RateLimiter {
-  private readonly windows = new Map<string, Window>();
-
-  constructor(
-    private readonly max: number,
-    private readonly windowMs: number,
-  ) {}
-
-  /**
-   * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-   * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-   * allowed), which lets a config turn it off without special-casing callers.
-   */
-  hit(key: string, now: number = Date.now()): { allowed: boolean; retryAfter?: number } {
-    if (this.max <= 0) return { allowed: true };
-    const existing = this.windows.get(key);
-    if (!existing || now >= existing.resetAt) {
-      this.windows.set(key, { count: 1, resetAt: now + this.windowMs });
-      return { allowed: true };
-    }
-    if (existing.count < this.max) {
-      existing.count += 1;
-      return { allowed: true };
-    }
-    return { allowed: false, retryAfter: Math.ceil((existing.resetAt - now) / 1000) };
-  }
-
-  /** Forget a key (e.g. clear a caller's window after a successful verify). */
-  reset(key: string): void {
-    this.windows.delete(key);
-  }
-
-  /** Drop every window (tests). */
-  clear(): void {
-    this.windows.clear();
-  }
-}