API Reference

X511 is published as a single package (x511) with multiple subpath entry points. Each subpath exports the symbols documented on its dedicated page.

Module map

Subpath	Page	Exports
x511	x511() factory	x511, defineProvider, self, zkpassport, all core types
x511/hono	Hono adapter	x511, defineProvider, self, zkpassport, Provider, ProviderContext, X511Config, X511Mode
x511/elysia	Elysia adapter	x511, defineProvider, self, zkpassport, Provider, ProviderContext, X511Config, X511Mode
x511/next	Next.js adapter	x511, defineProvider, self, zkpassport, VerifiedHandler, VerifiedIdentity, core types
x511/adonis	AdonisJS adapter	x511, defineProvider, self, zkpassport, Provider, ProviderContext, X511Config, X511Mode
x511/session	Session storage	SessionAdapter, MemorySessionAdapter
x511/countries	Country constants	ALL_COUNTRIES, EU_COUNTRIES, EEA_COUNTRIES, SCHENGEN_COUNTRIES, ASEAN_COUNTRIES, MERCOSUR_COUNTRIES, AMERICAS_COUNTRIES, X511Country, isSelfCountryAllowed
x511/core	x511() factory	Same x511 factory and types as the framework adapters, but framework-agnostic — operates on native Request/Response

Pages

• x511() factory — the main entry point. Configures the gateway, returns verify, verified, and the resolved config.
• Providers — self(), zkpassport(), defineProvider(), and the Provider interface.
• Session storage — SessionAdapter interface and the default MemorySessionAdapter. Includes guidance on building Redis or database adapters.
• Country constants — CountryFilter, X511Country, region groupings, and the Self-specific country normalizer.
• Types — every other interface and type alias the public API exposes.

Conventions

• All adapters are thin shims over a single core implementation that operates on native WinterTC-compatible Request and Response objects. Where an adapter's verify accepts a framework context, it always extracts (or normalizes) the underlying native Request before delegating.
• The cookie name is hardcoded to x511. It is HttpOnly, SameSite=Strict, and Secure (the latter omitted when dev: true).
• The verified middleware sets a per-request identity object (shape { uniqueId?: string }) on the framework's request scope. The exact mechanism varies by framework — see the corresponding Framework page.