@archlast/server 0.0.1

package/dist/auth/oauth-proxy.js

@@ -0,0 +1,298 @@
+"use strict";
+/**
+ * OAuth Proxy Service
+ *
+ * Acts as an internal HTTP service that handles OAuth flows for external providers
+ * (Google, GitHub) and maps their profiles to the internal auth_users schema.
+ *
+ * Design:
+ * - Providers are configured via environment variables.
+ * - The proxy handles the callback, exchanges the code for tokens, and fetches the profile.
+ * - It creates or links the user in auth_users and auth_accounts.
+ * - Returns a session token via SessionManager.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthProxy = void 0;
+const cuid2_1 = require("@paralleldrive/cuid2");
+const constants_js_1 = require("./system/constants.js");
+const logger_js_1 = require("../logging/logger.js");
+class OAuthProxy {
+    db;
+    sessionManager;
+    config;
+    constructor(db, sessionManager, config) {
+        this.db = db;
+        this.sessionManager = sessionManager;
+        this.config = config ?? {
+            google: this.loadProviderConfig("google"),
+            github: this.loadProviderConfig("github"),
+        };
+    }
+    loadProviderConfig(provider) {
+        const prefix = `ARCHLAST_OAUTH_${provider.toUpperCase()}`;
+        const clientId = process.env[`${prefix}_CLIENT_ID`];
+        const clientSecret = process.env[`${prefix}_CLIENT_SECRET`];
+        const redirectUri = process.env[`${prefix}_REDIRECT_URI`];
+        if (clientId && clientSecret && redirectUri) {
+            return { clientId, clientSecret, redirectUri };
+        }
+        return undefined;
+    }
+    /**
+     * Generate the OAuth authorization URL for a provider.
+     */
+    getAuthorizationUrl(provider, state) {
+        const cfg = this.config[provider];
+        if (!cfg)
+            return null;
+        const params = new URLSearchParams();
+        params.set("client_id", cfg.clientId);
+        params.set("redirect_uri", cfg.redirectUri);
+        params.set("state", state);
+        params.set("response_type", "code");
+        if (provider === "google") {
+            params.set("scope", "openid email profile");
+            return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+        }
+        if (provider === "github") {
+            params.set("scope", "user:email");
+            return `https://github.com/login/oauth/authorize?${params.toString()}`;
+        }
+        return null;
+    }
+    /**
+     * Handle the OAuth callback: exchange code for tokens, fetch profile, create/link user.
+     */
+    async handleCallback(provider, code) {
+        const cfg = this.config[provider];
+        if (!cfg) {
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "error",
+                kind: "system",
+                message: `[OAuthProxy] Provider ${provider} is not configured`,
+            });
+            return null;
+        }
+        try {
+            // Exchange code for tokens
+            const tokens = await this.exchangeCodeForTokens(provider, cfg, code);
+            if (!tokens)
+                return null;
+            // Fetch user profile
+            const profile = await this.fetchProfile(provider, tokens.accessToken);
+            if (!profile)
+                return null;
+            const fullProfile = {
+                provider,
+                ...profile,
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                expiresAt: tokens.expiresAt,
+            };
+            // Create or link user
+            const { userId, isNewUser, tenantId } = await this.createOrLinkUser(fullProfile);
+            // Issue session
+            const session = await this.sessionManager.issueSession({ userId, tenantId });
+            return { token: session.token, userId, isNewUser };
+        }
+        catch (err) {
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "error",
+                kind: "system",
+                message: `[OAuthProxy] Callback error for ${provider}`,
+                context: { err },
+            });
+            return null;
+        }
+    }
+    async exchangeCodeForTokens(provider, cfg, code) {
+        let tokenUrl;
+        const body = new URLSearchParams();
+        body.set("code", code);
+        body.set("client_id", cfg.clientId);
+        body.set("client_secret", cfg.clientSecret);
+        body.set("redirect_uri", cfg.redirectUri);
+        body.set("grant_type", "authorization_code");
+        if (provider === "google") {
+            tokenUrl = "https://oauth2.googleapis.com/token";
+        }
+        else if (provider === "github") {
+            tokenUrl = "https://github.com/login/oauth/access_token";
+        }
+        else {
+            return null;
+        }
+        const headers = {
+            "Content-Type": "application/x-www-form-urlencoded",
+        };
+        if (provider === "github") {
+            headers["Accept"] = "application/json";
+        }
+        const res = await fetch(tokenUrl, {
+            method: "POST",
+            headers,
+            body: body.toString(),
+        });
+        if (!res.ok) {
+            logger_js_1.logger.log({
+                timestamp: Date.now(),
+                level: "error",
+                kind: "system",
+                message: `[OAuthProxy] Token exchange failed for ${provider}`,
+                context: { status: res.status },
+            });
+            return null;
+        }
+        const data = await res.json();
+        const accessToken = data.access_token;
+        const refreshToken = data.refresh_token;
+        const expiresIn = data.expires_in;
+        const expiresAt = expiresIn ? Date.now() + expiresIn * 1000 : undefined;
+        if (!accessToken)
+            return null;
+        return { accessToken, refreshToken, expiresAt };
+    }
+    async fetchProfile(provider, accessToken) {
+        if (provider === "google") {
+            const res = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            return {
+                providerAccountId: data.sub,
+                email: data.email,
+                emailVerified: data.email_verified ?? false,
+                name: data.name,
+                imageUrl: data.picture,
+            };
+        }
+        if (provider === "github") {
+            const res = await fetch("https://api.github.com/user", {
+                headers: { Authorization: `Bearer ${accessToken}`, "User-Agent": "Archlast-OAuth" },
+            });
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            // Fetch primary email
+            const emailRes = await fetch("https://api.github.com/user/emails", {
+                headers: { Authorization: `Bearer ${accessToken}`, "User-Agent": "Archlast-OAuth" },
+            });
+            let email = "";
+            let emailVerified = false;
+            if (emailRes.ok) {
+                const emails = await emailRes.json();
+                const primary = emails.find((e) => e.primary);
+                if (primary) {
+                    email = primary.email;
+                    emailVerified = primary.verified ?? false;
+                }
+            }
+            return {
+                providerAccountId: String(data.id),
+                email,
+                emailVerified,
+                name: data.name || data.login,
+                imageUrl: data.avatar_url,
+            };
+        }
+        return null;
+    }
+    async createOrLinkUser(profile) {
+        // Check if account already exists
+        const existingAccount = await this.db.findFirst(constants_js_1.AUTH_COLLECTIONS.accounts, {
+            where: {
+                and: [
+                    { provider: { eq: profile.provider } },
+                    { providerAccountId: { eq: profile.providerAccountId } },
+                ],
+            },
+        });
+        if (existingAccount) {
+            const userId = existingAccount.userId;
+            // Update tokens
+            await this.db.patch(constants_js_1.AUTH_COLLECTIONS.accounts, existingAccount._id, {
+                accessToken: profile.accessToken,
+                refreshToken: profile.refreshToken,
+                expiresAt: profile.expiresAt,
+                updatedAt: Date.now(),
+            });
+            // Get tenant
+            const membership = await this.db.findFirst(constants_js_1.AUTH_COLLECTIONS.memberships, {
+                where: { userId: { eq: userId } },
+            });
+            return {
+                userId,
+                isNewUser: false,
+                tenantId: membership?.tenantId ?? "",
+            };
+        }
+        // Check if user with same email exists
+        let userId;
+        let tenantId;
+        let isNewUser = true;
+        const existingUser = await this.db.findFirst(constants_js_1.AUTH_COLLECTIONS.users, {
+            where: { email: { eq: profile.email } },
+        });
+        if (existingUser) {
+            userId = existingUser._id;
+            isNewUser = false;
+            const membership = await this.db.findFirst(constants_js_1.AUTH_COLLECTIONS.memberships, {
+                where: { userId: { eq: userId } },
+            });
+            tenantId = membership?.tenantId ?? "";
+        }
+        else {
+            // Create new user
+            const now = Date.now();
+            userId = (0, cuid2_1.createId)();
+            await this.db.insert(constants_js_1.AUTH_COLLECTIONS.users, {
+                _id: userId,
+                email: profile.email,
+                emailVerified: profile.emailVerified,
+                name: profile.name,
+                imageUrl: profile.imageUrl,
+                createdAt: now,
+                updatedAt: now,
+            });
+            // Create default tenant
+            tenantId = (0, cuid2_1.createId)();
+            await this.db.insert(constants_js_1.AUTH_COLLECTIONS.tenants, {
+                _id: tenantId,
+                name: `${profile.name || profile.email}'s Workspace`,
+                ownerId: userId,
+                createdAt: now,
+                updatedAt: now,
+            });
+            // Create membership
+            await this.db.insert(constants_js_1.AUTH_COLLECTIONS.memberships, {
+                _id: (0, cuid2_1.createId)(),
+                tenantId,
+                userId,
+                role: constants_js_1.TENANT_ROLES.owner,
+                permissions: [],
+                createdAt: now,
+                updatedAt: now,
+            });
+        }
+        // Create account record
+        const now = Date.now();
+        await this.db.insert(constants_js_1.AUTH_COLLECTIONS.accounts, {
+            _id: (0, cuid2_1.createId)(),
+            userId,
+            provider: profile.provider,
+            providerAccountId: profile.providerAccountId,
+            accessToken: profile.accessToken,
+            refreshToken: profile.refreshToken,
+            expiresAt: profile.expiresAt,
+            createdAt: now,
+            updatedAt: now,
+        });
+        return { userId, isNewUser, tenantId };
+    }
+}
+exports.OAuthProxy = OAuthProxy;
+//# sourceMappingURL=oauth-proxy.js.map

package/dist/auth/oauth-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-proxy.js","sourceRoot":"","sources":["../../src/auth/oauth-proxy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,gDAAgD;AAEhD,wDAAuE;AAGvE,oDAA8C;AA2B9C,MAAa,UAAU;IACF,EAAE,CAAkB;IACpB,cAAc,CAAiB;IAC/B,MAAM,CAAmB;IAE1C,YAAY,EAAmB,EAAE,cAA8B,EAAE,MAAyB;QACtF,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI;YACpB,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACzC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC;SAC5C,CAAC;IACN,CAAC;IAEO,kBAAkB,CAAC,QAAuB;QAC9C,MAAM,MAAM,GAAG,kBAAkB,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC;QAE1D,IAAI,QAAQ,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;YAC1C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAuB,EAAE,KAAa;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC5C,OAAO,gDAAgD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC/E,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAClC,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAChB,QAAuB,EACvB,IAAY;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,kBAAM,CAAC,GAAG,CAAC;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,yBAAyB,QAAQ,oBAAoB;aACjE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACD,2BAA2B;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,qBAAqB;YACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,WAAW,GAAyB;gBACtC,QAAQ;gBACR,GAAG,OAAO;gBACV,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC9B,CAAC;YAEF,sBAAsB;YACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEjF,gBAAgB;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,kBAAM,CAAC,GAAG,CAAC;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,mCAAmC,QAAQ,EAAE;gBACtD,OAAO,EAAE,EAAE,GAAG,EAAE;aACnB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAC/B,QAAuB,EACvB,GAAgB,EAChB,IAAY;QAEZ,IAAI,QAAgB,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE7C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,qCAAqC,CAAC;QACrD,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,6CAA6C,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QACF,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,kBAAM,CAAC,GAAG,CAAC;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,0CAA0C,QAAQ,EAAE;gBAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACtB,QAAuB,EACvB,WAAmB;QAQnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+CAA+C,EAAE;gBACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO;gBACH,iBAAiB,EAAE,IAAI,CAAC,GAAG;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;gBAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,OAAO;aACzB,CAAC;QACN,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;gBACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE;aACtF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAE9B,sBAAsB;YACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE;aACtF,CAAC,CAAC;YACH,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,OAAO,EAAE,CAAC;oBACV,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;oBACtB,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;gBAC9C,CAAC;YACL,CAAC;YAED,OAAO;gBACH,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,KAAK;gBACL,aAAa;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;gBAC7B,QAAQ,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC1B,OAA6B;QAE7B,kCAAkC;QAClC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,+BAAgB,CAAC,QAAQ,EAAE;YACvE,KAAK,EAAE;gBACH,GAAG,EAAE;oBACD,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE;oBACtC,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE;iBAC3D;aACJ;SACJ,CAAC,CAAC;QAEH,IAAI,eAAe,EAAE,CAAC;YAClB,MAAM,MAAM,GAAI,eAAuB,CAAC,MAAM,CAAC;YAC/C,gBAAgB;YAChB,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,+BAAgB,CAAC,QAAQ,EAAG,eAAuB,CAAC,GAAG,EAAE;gBACzE,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,aAAa;YACb,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,+BAAgB,CAAC,WAAW,EAAE;gBACrE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;aACpC,CAAC,CAAC;YAEH,OAAO;gBACH,MAAM;gBACN,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAG,UAAkB,EAAE,QAAQ,IAAI,EAAE;aAChD,CAAC;QACN,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAc,CAAC;QACnB,IAAI,QAAgB,CAAC;QACrB,IAAI,SAAS,GAAG,IAAI,CAAC;QAErB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,+BAAgB,CAAC,KAAK,EAAE;YACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE;SAC1C,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACf,MAAM,GAAI,YAAoB,CAAC,GAAG,CAAC;YACnC,SAAS,GAAG,KAAK,CAAC;YAElB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,+BAAgB,CAAC,WAAW,EAAE;gBACrE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;aACpC,CAAC,CAAC;YACH,QAAQ,GAAI,UAAkB,EAAE,QAAQ,IAAI,EAAE,CAAC;QACnD,CAAC;aAAM,CAAC;YACJ,kBAAkB;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,IAAA,gBAAQ,GAAE,CAAC;YAEpB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,+BAAgB,CAAC,KAAK,EAAE;gBACzC,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACjB,CAAC,CAAC;YAEH,wBAAwB;YACxB,QAAQ,GAAG,IAAA,gBAAQ,GAAE,CAAC;YACtB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,+BAAgB,CAAC,OAAO,EAAE;gBAC3C,GAAG,EAAE,QAAQ;gBACb,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,cAAc;gBACpD,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACjB,CAAC,CAAC;YAEH,oBAAoB;YACpB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,+BAAgB,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,IAAA,gBAAQ,GAAE;gBACf,QAAQ;gBACR,MAAM;gBACN,IAAI,EAAE,2BAAY,CAAC,KAAK;gBACxB,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACjB,CAAC,CAAC;QACP,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,+BAAgB,CAAC,QAAQ,EAAE;YAC5C,GAAG,EAAE,IAAA,gBAAQ,GAAE;YACf,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;CACJ;AAtUD,gCAsUC"}

package/dist/auth/otp/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * OTP Module Exports
+ */
+export { otpSchema, OTP_COLLECTIONS, OTP_TYPES, type OtpType } from "./schema.js";
+export { createOtpService, type OtpService } from "./service.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/otp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/otp/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/auth/otp/index.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * OTP Module Exports
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOtpService = exports.OTP_TYPES = exports.OTP_COLLECTIONS = exports.otpSchema = void 0;
+var schema_js_1 = require("./schema.js");
+Object.defineProperty(exports, "otpSchema", { enumerable: true, get: function () { return schema_js_1.otpSchema; } });
+Object.defineProperty(exports, "OTP_COLLECTIONS", { enumerable: true, get: function () { return schema_js_1.OTP_COLLECTIONS; } });
+Object.defineProperty(exports, "OTP_TYPES", { enumerable: true, get: function () { return schema_js_1.OTP_TYPES; } });
+var service_js_1 = require("./service.js");
+Object.defineProperty(exports, "createOtpService", { enumerable: true, get: function () { return service_js_1.createOtpService; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/otp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/otp/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,yCAAkF;AAAzE,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,sGAAA,SAAS,OAAA;AAC9C,2CAAiE;AAAxD,8GAAA,gBAAgB,OAAA"}

package/dist/auth/otp/schema.d.ts

@@ -0,0 +1,32 @@
+/**
+ * OTP (One-Time Password) Schema
+ * Supports magic links and email verification codes
+ */
+export declare const OTP_COLLECTIONS: {
+    readonly codes: "_auth_otp_codes";
+};
+export declare const otpSchema: {
+    tables: {
+        /**
+         * _auth_otp_codes
+         * Stores OTP/magic link tokens
+         */
+        _auth_otp_codes: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            code: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            type: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            usedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+        }>;
+    };
+};
+export declare const OTP_TYPES: {
+    readonly MAGIC_LINK: "magic_link";
+    readonly EMAIL_VERIFICATION: "email_verification";
+    readonly PASSWORD_RESET: "password_reset";
+};
+export type OtpType = (typeof OTP_TYPES)[keyof typeof OTP_TYPES];
+//# sourceMappingURL=schema.d.ts.map

package/dist/auth/otp/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/auth/otp/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,eAAO,MAAM,eAAe;;CAElB,CAAC;AAEX,eAAO,MAAM,SAAS;;QAClB;;;WAGG;;;;;;;;;;;;CAmBL,CAAC;AAEH,eAAO,MAAM,SAAS;;;;CAIZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC"}

package/dist/auth/otp/schema.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * OTP (One-Time Password) Schema
+ * Supports magic links and email verification codes
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OTP_TYPES = exports.otpSchema = exports.OTP_COLLECTIONS = void 0;
+const definition_js_1 = require("../../schema/definition.js");
+exports.OTP_COLLECTIONS = {
+    codes: "_auth_otp_codes",
+};
+exports.otpSchema = (0, definition_js_1.defineSchema)({
+    /**
+     * _auth_otp_codes
+     * Stores OTP/magic link tokens
+     */
+    [exports.OTP_COLLECTIONS.codes]: (0, definition_js_1.defineTable)({
+        _id: definition_js_1.v.id().primaryKey(),
+        userId: definition_js_1.v.string().optional(), // null for signups
+        email: definition_js_1.v.string(),
+        code: definition_js_1.v.string(), // hashed
+        type: definition_js_1.v.string(), // "magic_link" | "email_verification" | "password_reset"
+        expiresAt: definition_js_1.v.number(),
+        usedAt: definition_js_1.v.number().optional(),
+        createdAt: definition_js_1.v.number(),
+    }, {
+        indexes: [
+            { fields: ["email", "type"], name: "idx_otp_email_type" },
+            { fields: ["code"], name: "idx_otp_code" },
+        ],
+    }),
+});
+exports.OTP_TYPES = {
+    MAGIC_LINK: "magic_link",
+    EMAIL_VERIFICATION: "email_verification",
+    PASSWORD_RESET: "password_reset",
+};
+//# sourceMappingURL=schema.js.map

package/dist/auth/otp/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/auth/otp/schema.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,8DAA0E;AAE7D,QAAA,eAAe,GAAG;IAC3B,KAAK,EAAE,iBAAiB;CAClB,CAAC;AAEE,QAAA,SAAS,GAAG,IAAA,4BAAY,EAAC;IAClC;;;OAGG;IACH,CAAC,uBAAe,CAAC,KAAK,CAAC,EAAE,IAAA,2BAAW,EAChC;QACI,GAAG,EAAE,iBAAC,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE;QACxB,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,mBAAmB;QAClD,KAAK,EAAE,iBAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,iBAAC,CAAC,MAAM,EAAE,EAAE,SAAS;QAC3B,IAAI,EAAE,iBAAC,CAAC,MAAM,EAAE,EAAE,yDAAyD;QAC3E,SAAS,EAAE,iBAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,SAAS,EAAE,iBAAC,CAAC,MAAM,EAAE;KACxB,EACD;QACI,OAAO,EAAE;YACL,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE;YACzD,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;SAC7C;KACJ,CACJ;CACJ,CAAC,CAAC;AAEU,QAAA,SAAS,GAAG;IACrB,UAAU,EAAE,YAAY;IACxB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;CAC1B,CAAC"}

package/dist/auth/otp/service.d.ts

@@ -0,0 +1,59 @@
+/**
+ * OTP Service
+ * Generates and validates one-time passwords and magic links
+ */
+import type { IDatabaseClient } from "../../db/interfaces.js";
+import { type OtpType } from "./schema.js";
+export interface OtpService {
+    /**
+     * Create an OTP code for email verification
+     */
+    createOtp(options: {
+        email: string;
+        userId?: string;
+        type: OtpType;
+        expiryMinutes?: number;
+    }): Promise<{
+        code: string;
+        expiresAt: number;
+    }>;
+    /**
+     * Create a magic link token
+     */
+    createMagicLink(options: {
+        email: string;
+        userId?: string;
+        expiryMinutes?: number;
+    }): Promise<{
+        token: string;
+        expiresAt: number;
+    }>;
+    /**
+     * Verify an OTP code
+     */
+    verifyOtp(options: {
+        email: string;
+        code: string;
+        type: OtpType;
+    }): Promise<{
+        valid: boolean;
+        userId?: string;
+    }>;
+    /**
+     * Verify a magic link token
+     */
+    verifyMagicLink(token: string): Promise<{
+        valid: boolean;
+        email?: string;
+        userId?: string;
+    }>;
+    /**
+     * Cleanup expired OTPs
+     */
+    cleanupExpired(): Promise<number>;
+}
+/**
+ * Create OTP Service instance
+ */
+export declare function createOtpService(db: IDatabaseClient): OtpService;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/otp/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/otp/service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAA8B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AA8BvE,MAAM,WAAW,UAAU;IACvB;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,OAAO,CAAC;QACd,aAAa,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEjD;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAElD;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEjD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE7F;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,UAAU,CA2LhE"}

package/dist/auth/otp/service.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * OTP Service
+ * Generates and validates one-time passwords and magic links
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOtpService = createOtpService;
+const cuid2_1 = require("@paralleldrive/cuid2");
+const crypto_1 = require("crypto");
+const schema_js_1 = require("./schema.js");
+const OTP_CODE_LENGTH = 6;
+const MAGIC_LINK_LENGTH = 32;
+const DEFAULT_EXPIRY_MINUTES = 10;
+/**
+ * Hash a code for secure storage
+ */
+function hashCode(code) {
+    return (0, crypto_1.createHash)("sha256").update(code).digest("hex");
+}
+/**
+ * Generate a numeric OTP code
+ */
+function generateOtpCode() {
+    const bytes = (0, crypto_1.randomBytes)(4);
+    const num = bytes.readUInt32BE(0);
+    const code = String(num % 1000000).padStart(OTP_CODE_LENGTH, "0");
+    return code;
+}
+/**
+ * Generate a magic link token
+ */
+function generateMagicToken() {
+    return (0, crypto_1.randomBytes)(MAGIC_LINK_LENGTH).toString("base64url");
+}
+/**
+ * Create OTP Service instance
+ */
+function createOtpService(db) {
+    async function createOtp(options) {
+        const code = generateOtpCode();
+        const expiryMinutes = options.expiryMinutes ?? DEFAULT_EXPIRY_MINUTES;
+        const now = Date.now();
+        const expiresAt = now + expiryMinutes * 60 * 1000;
+        // Invalidate any existing codes for this email/type
+        const existing = await db.findMany(schema_js_1.OTP_COLLECTIONS.codes, {
+            where: {
+                and: [
+                    { email: { eq: options.email } },
+                    { type: { eq: options.type } },
+                    { usedAt: { eq: null } },
+                ],
+            },
+        });
+        for (const record of existing) {
+            await db.patch(schema_js_1.OTP_COLLECTIONS.codes, record._id, {
+                usedAt: now, // Mark as used/invalidated
+            });
+        }
+        // Create new OTP
+        await db.insert(schema_js_1.OTP_COLLECTIONS.codes, {
+            _id: (0, cuid2_1.createId)(),
+            userId: options.userId || null,
+            email: options.email,
+            code: hashCode(code),
+            type: options.type,
+            expiresAt,
+            usedAt: null,
+            createdAt: now,
+        });
+        return { code, expiresAt };
+    }
+    async function createMagicLink(options) {
+        const token = generateMagicToken();
+        const expiryMinutes = options.expiryMinutes ?? 15;
+        const now = Date.now();
+        const expiresAt = now + expiryMinutes * 60 * 1000;
+        // Invalidate existing magic links
+        const existing = await db.findMany(schema_js_1.OTP_COLLECTIONS.codes, {
+            where: {
+                and: [
+                    { email: { eq: options.email } },
+                    { type: { eq: schema_js_1.OTP_TYPES.MAGIC_LINK } },
+                    { usedAt: { eq: null } },
+                ],
+            },
+        });
+        for (const record of existing) {
+            await db.patch(schema_js_1.OTP_COLLECTIONS.codes, record._id, {
+                usedAt: now,
+            });
+        }
+        // Create new magic link
+        await db.insert(schema_js_1.OTP_COLLECTIONS.codes, {
+            _id: (0, cuid2_1.createId)(),
+            userId: options.userId || null,
+            email: options.email,
+            code: hashCode(token),
+            type: schema_js_1.OTP_TYPES.MAGIC_LINK,
+            expiresAt,
+            usedAt: null,
+            createdAt: now,
+        });
+        return { token, expiresAt };
+    }
+    async function verifyOtp(options) {
+        const hashedCode = hashCode(options.code);
+        const now = Date.now();
+        const records = await db.findMany(schema_js_1.OTP_COLLECTIONS.codes, {
+            where: {
+                and: [
+                    { email: { eq: options.email } },
+                    { type: { eq: options.type } },
+                    { code: { eq: hashedCode } },
+                    { usedAt: { eq: null } },
+                ],
+            },
+            take: 1,
+        });
+        const record = records[0];
+        if (!record) {
+            return { valid: false };
+        }
+        if (record.expiresAt < now) {
+            return { valid: false };
+        }
+        // Mark as used
+        await db.patch(schema_js_1.OTP_COLLECTIONS.codes, record._id, {
+            usedAt: now,
+        });
+        return { valid: true, userId: record.userId || undefined };
+    }
+    async function verifyMagicLink(token) {
+        const hashedToken = hashCode(token);
+        const now = Date.now();
+        const records = await db.findMany(schema_js_1.OTP_COLLECTIONS.codes, {
+            where: {
+                and: [
+                    { type: { eq: schema_js_1.OTP_TYPES.MAGIC_LINK } },
+                    { code: { eq: hashedToken } },
+                    { usedAt: { eq: null } },
+                ],
+            },
+            take: 1,
+        });
+        const record = records[0];
+        if (!record) {
+            return { valid: false };
+        }
+        if (record.expiresAt < now) {
+            return { valid: false };
+        }
+        // Mark as used
+        await db.patch(schema_js_1.OTP_COLLECTIONS.codes, record._id, {
+            usedAt: now,
+        });
+        return {
+            valid: true,
+            email: record.email,
+            userId: record.userId || undefined,
+        };
+    }
+    async function cleanupExpired() {
+        const now = Date.now();
+        const cutoff = now - 24 * 60 * 60 * 1000; // Delete codes older than 24h
+        const expired = await db.findMany(schema_js_1.OTP_COLLECTIONS.codes, {
+            where: {
+                or: [{ expiresAt: { lt: now } }, { createdAt: { lt: cutoff } }],
+            },
+        });
+        for (const record of expired) {
+            await db.delete(schema_js_1.OTP_COLLECTIONS.codes, record._id);
+        }
+        return expired.length;
+    }
+    return {
+        createOtp,
+        createMagicLink,
+        verifyOtp,
+        verifyMagicLink,
+        cleanupExpired,
+    };
+}
+//# sourceMappingURL=service.js.map