@edge-base/server 0.2.9 → 0.3.1

package/admin-build/_app/immutable/nodes/{9.B2jgJDkH.js → 9.f548N7zh.js}

@@ -1 +1 @@
-import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/DncT8xH5.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{d as Y,s as Z}from"../chunks/CjcrXziO.js";import{P as tt}from"../chunks/BkZCgsc3.js";import{a as et}from"../chunks/Q2nPFxS6.js";import{M as _,T as at}from"../chunks/YGUb3X-Q.js";import{D as rt,T as nt}from"../chunks/DBkor_jM.js";var st=I("<button> </button>"),ot=I('<div class="range-selector"></div>'),lt=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function yt(w,A){j(A,!0);let s=D(!0),o=D(null),p=D("24h");const M=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],T=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(T)()}`);y(o,e,!0)}catch(e){V(Y(e,"Failed to load functions analytics."))}finally{y(s,!1)}}function k(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});tt(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return et},actions:a=>{var c=ot();W(c,21,()=>M,X,(f,d)=>{var l=st();let v;var h=b(l,!0);g(l),J(()=>{v=Z(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>k(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=lt(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());at(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());rt(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());nt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{yt as component};
+import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/BkrC_6Ss.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{d as Y,s as Z}from"../chunks/CjcrXziO.js";import{P as tt}from"../chunks/BkZCgsc3.js";import{a as et}from"../chunks/Q2nPFxS6.js";import{M as _,T as at}from"../chunks/DOOhHO-v.js";import{D as rt,T as nt}from"../chunks/dZsKGnWZ.js";var st=I("<button> </button>"),ot=I('<div class="range-selector"></div>'),lt=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function yt(w,A){j(A,!0);let s=D(!0),o=D(null),p=D("24h");const M=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],T=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(T)()}`);y(o,e,!0)}catch(e){V(Y(e,"Failed to load functions analytics."))}finally{y(s,!1)}}function k(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});tt(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return et},actions:a=>{var c=ot();W(c,21,()=>M,X,(f,d)=>{var l=st();let v;var h=b(l,!0);g(l),J(()=>{v=Z(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>k(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=lt(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());at(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());rt(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());nt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{yt as component};

package/admin-build/_app/version.json

@@ -1 +1 @@
-{"version":"1775689125712"}
+{"version":"1783089130568"}

package/admin-build/index.html

@@ -5,12 +5,12 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         <title>EdgeBase Admin</title>
         <link rel="icon" href="/admin/favicon.svg" type="image/svg+xml" />
-        <link href="/admin/_app/immutable/entry/start.Bcf0SjPV.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/B0zJ5_Wk.js" rel="modulepreload">
+        <link href="/admin/_app/immutable/entry/start.BgMeGq-q.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/DdjFeYwG.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/BdTBlfLy.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bn2NtlTj.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/DZo4s3wn.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/entry/app.BW-Ac3jY.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/D3hdqsfp.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/entry/app.j1WHBlZX.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/B2bEC_Hm.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bb0e0sAP.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/DtZk82gG.js" rel="modulepreload">
@@ -26,7 +26,7 @@
         <div style="display: contents">
 			<script>
 				{
-					__sveltekit_1iz3xys = {
+					__sveltekit_xb7lyo = {
 						base: "/admin",
 						assets: "/admin"
 					};
@@ -34,8 +34,8 @@
 					const element = document.currentScript.parentElement;
 
 					Promise.all([
-						import("/admin/_app/immutable/entry/start.Bcf0SjPV.js"),
-						import("/admin/_app/immutable/entry/app.BW-Ac3jY.js")
+						import("/admin/_app/immutable/entry/start.BgMeGq-q.js"),
+						import("/admin/_app/immutable/entry/app.j1WHBlZX.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});

package/openapi.json

@@ -1846,6 +1846,100 @@
         }
       }
     },
+    "/api/auth/mfa/recovery-codes": {
+      "post": {
+        "operationId": "authMfaRecoveryCodesRegenerate",
+        "tags": [
+          "client"
+        ],
+        "summary": "Regenerate MFA recovery codes",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string"
+                  },
+                  "code": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": {},
+                  "description": "JSON response"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "code": {
+                      "type": "number",
+                      "description": "HTTP status code",
+                      "example": 400
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Human-readable message",
+                      "example": "Invalid request body"
+                    }
+                  },
+                  "required": [
+                    "code",
+                    "message"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required or verification failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "code": {
+                      "type": "number",
+                      "description": "HTTP status code",
+                      "example": 400
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Human-readable message",
+                      "example": "Invalid request body"
+                    }
+                  },
+                  "required": [
+                    "code",
+                    "message"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/auth/mfa/totp": {
       "delete": {
         "operationId": "authMfaTotpDelete",
@@ -8576,6 +8670,26 @@
             "required": true,
             "name": "bucket",
             "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload key echoed from a signed upload URL."
+            },
+            "required": false,
+            "description": "Optional signed upload key echoed from a signed upload URL.",
+            "name": "key",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "requestBody": {
@@ -8654,6 +8768,32 @@
                 }
               }
             }
+          },
+          "413": {
+            "description": "Payload too large",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "code": {
+                      "type": "number",
+                      "description": "HTTP status code",
+                      "example": 400
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Human-readable message",
+                      "example": "Invalid request body"
+                    }
+                  },
+                  "required": [
+                    "code",
+                    "message"
+                  ]
+                }
+              }
+            }
           }
         }
       }
@@ -9026,6 +9166,9 @@
           "200": {
             "description": "File content"
           },
+          "206": {
+            "description": "Partial file content"
+          },
           "403": {
             "description": "Forbidden",
             "content": {
@@ -9077,6 +9220,9 @@
                 }
               }
             }
+          },
+          "416": {
+            "description": "Range not satisfiable"
           }
         }
       },
@@ -9203,6 +9349,16 @@
             "required": true,
             "name": "key",
             "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "responses": {
@@ -9803,6 +9959,26 @@
             "required": true,
             "name": "bucket",
             "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload key echoed from a signed upload URL."
+            },
+            "required": false,
+            "description": "Optional signed upload key echoed from a signed upload URL.",
+            "name": "key",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "requestBody": {
@@ -9915,15 +10091,49 @@
             "required": true,
             "name": "bucket",
             "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "uploadId",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "partNumber",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "key",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "requestBody": {
           "required": true,
           "content": {
-            "application/json": {
+            "application/octet-stream": {
               "schema": {
-                "type": "object",
-                "additionalProperties": {}
+                "type": "string",
+                "format": "binary"
               }
             }
           }
@@ -9992,6 +10202,32 @@
                 }
               }
             }
+          },
+          "413": {
+            "description": "Payload too large",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "code": {
+                      "type": "number",
+                      "description": "HTTP status code",
+                      "example": 400
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Human-readable message",
+                      "example": "Invalid request body"
+                    }
+                  },
+                  "required": [
+                    "code",
+                    "message"
+                  ]
+                }
+              }
+            }
           }
         }
       }
@@ -10011,6 +10247,26 @@
             "required": true,
             "name": "bucket",
             "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload key echoed from a signed upload URL."
+            },
+            "required": false,
+            "description": "Optional signed upload key echoed from a signed upload URL.",
+            "name": "key",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "requestBody": {
@@ -10118,6 +10374,32 @@
                 }
               }
             }
+          },
+          "413": {
+            "description": "Payload too large",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "code": {
+                      "type": "number",
+                      "description": "HTTP status code",
+                      "example": 400
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Human-readable message",
+                      "example": "Invalid request body"
+                    }
+                  },
+                  "required": [
+                    "code",
+                    "message"
+                  ]
+                }
+              }
+            }
           }
         }
       }
@@ -10137,6 +10419,26 @@
             "required": true,
             "name": "bucket",
             "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload key echoed from a signed upload URL."
+            },
+            "required": false,
+            "description": "Optional signed upload key echoed from a signed upload URL.",
+            "name": "key",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Optional signed upload token for write-rule-bypassing upload grants."
+            },
+            "required": false,
+            "description": "Optional signed upload token for write-rule-bypassing upload grants.",
+            "name": "token",
+            "in": "query"
           }
         ],
         "requestBody": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-base/server",
-  "version": "0.2.9",
+  "version": "0.3.1",
   "description": "EdgeBase runtime assets consumed by the EdgeBase CLI",
   "license": "MIT",
   "repository": {
@@ -34,8 +34,8 @@
     "jose": "^6.0.0",
     "pg": "^8.16.3",
     "zod": "^4.3.6",
-    "@edge-base/core": "0.2.9",
-    "@edge-base/shared": "0.2.9"
+    "@edge-base/shared": "0.3.1",
+    "@edge-base/core": "0.3.1"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.8.71",

package/src/__tests__/auth-token.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest';
+import type { AuthDb } from '../lib/auth-db-adapter.js';
+import {
+  createEmailToken,
+  deleteEmailToken,
+  getEmailToken,
+  getEmailTokenByType,
+} from '../lib/auth-d1-service.js';
+import {
+  authSecretLookupKeys,
+  hashAuthSecret,
+  hashOtpSecret,
+  verifyAuthSecret,
+  verifyOtpSecret,
+} from '../lib/auth-token.js';
+
+class MemoryAuthDb implements AuthDb {
+  readonly dialect = 'sqlite' as const;
+  rows: Array<Record<string, unknown>> = [];
+
+  async query<T = Record<string, unknown>>(): Promise<T[]> {
+    return this.rows as T[];
+  }
+
+  async first<T = Record<string, unknown>>(_sql: string, params: unknown[] = []): Promise<T | null> {
+    const type = _sql.includes('AND type = ?') ? params[params.length - 1] : undefined;
+    const tokenKeys = type ? params.slice(0, -1) : params;
+    const row = this.rows.find((candidate) => {
+      return tokenKeys.includes(candidate.token) && (!type || candidate.type === type);
+    });
+    return (row ?? null) as T | null;
+  }
+
+  async run(sql: string, params: unknown[] = []): Promise<void> {
+    if (sql.includes('INSERT INTO _email_tokens')) {
+      const [token, userId, type, expiresAt, createdAt] = params;
+      this.rows.push({ token, userId, type, expiresAt, createdAt });
+      return;
+    }
+    if (sql.includes('DELETE FROM _email_tokens WHERE token IN')) {
+      const keys = new Set(params);
+      this.rows = this.rows.filter((row) => !keys.has(row.token));
+      return;
+    }
+    throw new Error(`Unexpected SQL in MemoryAuthDb: ${sql}`);
+  }
+
+  async batch(): Promise<void> {}
+}
+
+describe('auth-token helpers', () => {
+  it('hashes auth secrets and verifies them without storing the raw value', async () => {
+    const hash = await hashAuthSecret('123456');
+
+    expect(hash).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(hash).not.toBe('123456');
+    await expect(verifyAuthSecret('123456', hash)).resolves.toBe(true);
+    await expect(verifyAuthSecret('000000', hash)).resolves.toBe(false);
+  });
+
+  it('hashes short OTP secrets with a server-keyed HMAC', async () => {
+    const hash = await hashOtpSecret('123456', 'server-secret-a');
+
+    expect(hash).toMatch(/^hmac-sha256:[a-f0-9]{64}$/);
+    expect(hash).not.toBe('123456');
+    expect(hash).not.toBe(await hashAuthSecret('123456'));
+    await expect(verifyOtpSecret('123456', hash, 'server-secret-a')).resolves.toBe(true);
+    await expect(verifyOtpSecret('000000', hash, 'server-secret-a')).resolves.toBe(false);
+    await expect(verifyOtpSecret('123456', hash, 'server-secret-b')).resolves.toBe(false);
+  });
+
+  it('keeps short-lived legacy SHA-256 OTP hashes verifiable', async () => {
+    const legacyHash = await hashAuthSecret('123456');
+
+    await expect(verifyOtpSecret('123456', legacyHash, 'server-secret-a')).resolves.toBe(true);
+    await expect(verifyOtpSecret('000000', legacyHash, 'server-secret-a')).resolves.toBe(false);
+  });
+
+  it('builds hashed and legacy lookup keys for auth secrets', async () => {
+    const keys = await authSecretLookupKeys('raw-magic-link-token');
+
+    expect(keys).toHaveLength(2);
+    expect(keys[0]).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(keys[1]).toBe('raw-magic-link-token');
+    await expect(authSecretLookupKeys(keys[0])).resolves.toEqual([keys[0]]);
+  });
+});
+
+describe('email token storage', () => {
+  it('stores hashed email tokens while allowing raw-token lookup and deletion', async () => {
+    const db = new MemoryAuthDb();
+    const expiresAt = new Date(Date.now() + 60_000).toISOString();
+
+    await createEmailToken(db, {
+      token: 'raw-magic-link-token',
+      userId: 'user-1',
+      type: 'magic-link',
+      expiresAt,
+    });
+
+    expect(db.rows).toHaveLength(1);
+    expect(db.rows[0].token).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(db.rows[0].token).not.toBe('raw-magic-link-token');
+
+    const row = await getEmailToken(db, 'raw-magic-link-token');
+    expect(row?.userId).toBe('user-1');
+
+    await deleteEmailToken(db, 'raw-magic-link-token');
+    expect(db.rows).toHaveLength(0);
+  });
+
+  it('still accepts and deletes legacy raw email tokens', async () => {
+    const db = new MemoryAuthDb();
+    db.rows.push({
+      token: 'legacy-verify-token',
+      userId: 'user-2',
+      type: 'verify',
+      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      createdAt: new Date().toISOString(),
+    });
+
+    const row = await getEmailTokenByType(db, 'legacy-verify-token', 'verify');
+    expect(row?.userId).toBe('user-2');
+
+    await deleteEmailToken(db, 'legacy-verify-token');
+    expect(db.rows).toHaveLength(0);
+  });
+
+  it('cleans up expired hashed tokens on lookup', async () => {
+    const db = new MemoryAuthDb();
+    await createEmailToken(db, {
+      token: 'expired-token',
+      userId: 'user-3',
+      type: 'password-reset',
+      expiresAt: new Date(Date.now() - 60_000).toISOString(),
+    });
+
+    const row = await getEmailToken(db, 'expired-token');
+    expect(row).toBeNull();
+    expect(db.rows).toHaveLength(0);
+  });
+});