@secondlayer/shared 0.8.1 → 0.9.0

package/dist/src/db/index.d.ts

@@ -160,6 +160,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/queries/accounts.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;
@@ -256,10 +257,16 @@ type Account = Selectable<AccountsTable>;
 declare function upsertAccount(db: Kysely<Database>, email: string): Promise<Account>;
 declare function getAccountById(db: Kysely<Database>, id: string): Promise<Account | null>;
 declare function isEmailAllowed(db: Kysely<Database>, email: string): Promise<boolean>;
-declare function createMagicLink(db: Kysely<Database>, email: string, token: string, expiresInMs?: number): Promise<void>;
+declare function createMagicLink(db: Kysely<Database>, email: string, token: string, code: string, expiresInMs?: number): Promise<void>;
 /**
 * Verify a magic link token. Returns the email if valid, null otherwise.
-* Marks the token as used atomically. Rejects after 5 failed attempts.
+* Marks the token as used atomically. Rejects after 3 failed attempts.
 */
 declare function verifyMagicLink(db: Kysely<Database>, token: string): Promise<string | null>;
-export { verifyMagicLink, upsertAccount, isEmailAllowed, getAccountById, createMagicLink };
+/**
+* Verify by 6-digit code + email. Same atomic pattern as verifyMagicLink.
+* Rejects after 3 failed attempts. Increments failed_attempts on all
+* active codes for this email on failure (prevents parallel brute-force).
+*/
+declare function verifyMagicLinkByCode(db: Kysely<Database>, email: string, code: string): Promise<string | null>;
+export { verifyMagicLinkByCode, verifyMagicLink, upsertAccount, isEmailAllowed, getAccountById, createMagicLink };

package/dist/src/db/queries/accounts.js

@@ -31,21 +31,30 @@ async function isEmailAllowed(db, email) {
   `.execute(db);
   return result.rows.length > 0;
 }
-async function createMagicLink(db, email, token, expiresInMs = 15 * 60 * 1000) {
+async function createMagicLink(db, email, token, code, expiresInMs = 15 * 60 * 1000) {
   await db.insertInto("magic_links").values({
     email,
     token,
+    code,
     expires_at: new Date(Date.now() + expiresInMs)
   }).execute();
 }
 async function verifyMagicLink(db, token) {
-  const result = await db.updateTable("magic_links").set({ used_at: new Date }).where("token", "=", token).where("used_at", "is", null).where("expires_at", ">", new Date).where("failed_attempts", "<", 5).returning("email").executeTakeFirst();
+  const result = await db.updateTable("magic_links").set({ used_at: new Date }).where("token", "=", token).where("used_at", "is", null).where("expires_at", ">", new Date).where("failed_attempts", "<", 3).returning("email").executeTakeFirst();
   if (result?.email)
     return result.email;
   await db.updateTable("magic_links").set({ failed_attempts: sql`failed_attempts + 1` }).where("token", "=", token).where("used_at", "is", null).where("expires_at", ">", new Date).execute();
   return null;
 }
+async function verifyMagicLinkByCode(db, email, code) {
+  const result = await db.updateTable("magic_links").set({ used_at: new Date }).where("email", "=", email).where("code", "=", code).where("used_at", "is", null).where("expires_at", ">", new Date).where("failed_attempts", "<", 3).returning("email").executeTakeFirst();
+  if (result?.email)
+    return result.email;
+  await db.updateTable("magic_links").set({ failed_attempts: sql`failed_attempts + 1` }).where("email", "=", email).where("used_at", "is", null).where("expires_at", ">", new Date).execute();
+  return null;
+}
 export {
+  verifyMagicLinkByCode,
   verifyMagicLink,
   upsertAccount,
   isEmailAllowed,
@@ -53,5 +62,5 @@ export {
   createMagicLink
 };
 
-//# debugId=20A55F621EB14D5064756E2164756E21
+//# debugId=8F0ACA05832385B164756E2164756E21
 //# sourceMappingURL=accounts.js.map

package/dist/src/db/queries/accounts.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/db/queries/accounts.ts"],
   "sourcesContent": [
-    "import { type Kysely, sql } from \"kysely\";\nimport type { Account, Database } from \"../types.ts\";\n\nexport async function upsertAccount(\n\tdb: Kysely<Database>,\n\temail: string,\n): Promise<Account> {\n\treturn await db\n\t\t.insertInto(\"accounts\")\n\t\t.values({ email })\n\t\t.onConflict(\n\t\t\t(oc) => oc.column(\"email\").doUpdateSet({ email }), // no-op update to return existing\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getAccountById(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<Account | null> {\n\treturn (\n\t\t(await db\n\t\t\t.selectFrom(\"accounts\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst()) ?? null\n\t);\n}\n\nexport async function isEmailAllowed(\n\tdb: Kysely<Database>,\n\temail: string,\n): Promise<boolean> {\n\tconst result = await sql<{ found: number }>`\n    SELECT 1 AS found FROM accounts WHERE email = ${email}\n    UNION ALL\n    SELECT 1 AS found FROM waitlist WHERE email = ${email} AND status = 'approved'\n    LIMIT 1\n  `.execute(db);\n\n\treturn result.rows.length > 0;\n}\n\nexport async function createMagicLink(\n\tdb: Kysely<Database>,\n\temail: string,\n\ttoken: string,\n\texpiresInMs: number = 15 * 60 * 1000,\n): Promise<void> {\n\tawait db\n\t\t.insertInto(\"magic_links\")\n\t\t.values({\n\t\t\temail,\n\t\t\ttoken,\n\t\t\texpires_at: new Date(Date.now() + expiresInMs),\n\t\t})\n\t\t.execute();\n}\n\n/**\n * Verify a magic link token. Returns the email if valid, null otherwise.\n * Marks the token as used atomically. Rejects after 5 failed attempts.\n */\nexport async function verifyMagicLink(\n\tdb: Kysely<Database>,\n\ttoken: string,\n): Promise<string | null> {\n\tconst result = await db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ used_at: new Date() })\n\t\t.where(\"token\", \"=\", token)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.where(\"failed_attempts\", \"<\", 5)\n\t\t.returning(\"email\")\n\t\t.executeTakeFirst();\n\n\tif (result?.email) return result.email;\n\n\t// Increment failed attempts if token exists but didn't verify\n\tawait db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ failed_attempts: sql`failed_attempts + 1` })\n\t\t.where(\"token\", \"=\", token)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.execute();\n\n\treturn null;\n}\n"
+    "import { type Kysely, sql } from \"kysely\";\nimport type { Account, Database } from \"../types.ts\";\n\nexport async function upsertAccount(\n\tdb: Kysely<Database>,\n\temail: string,\n): Promise<Account> {\n\treturn await db\n\t\t.insertInto(\"accounts\")\n\t\t.values({ email })\n\t\t.onConflict(\n\t\t\t(oc) => oc.column(\"email\").doUpdateSet({ email }), // no-op update to return existing\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getAccountById(\n\tdb: Kysely<Database>,\n\tid: string,\n): Promise<Account | null> {\n\treturn (\n\t\t(await db\n\t\t\t.selectFrom(\"accounts\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst()) ?? null\n\t);\n}\n\nexport async function isEmailAllowed(\n\tdb: Kysely<Database>,\n\temail: string,\n): Promise<boolean> {\n\tconst result = await sql<{ found: number }>`\n    SELECT 1 AS found FROM accounts WHERE email = ${email}\n    UNION ALL\n    SELECT 1 AS found FROM waitlist WHERE email = ${email} AND status = 'approved'\n    LIMIT 1\n  `.execute(db);\n\n\treturn result.rows.length > 0;\n}\n\nexport async function createMagicLink(\n\tdb: Kysely<Database>,\n\temail: string,\n\ttoken: string,\n\tcode: string,\n\texpiresInMs: number = 15 * 60 * 1000,\n): Promise<void> {\n\tawait db\n\t\t.insertInto(\"magic_links\")\n\t\t.values({\n\t\t\temail,\n\t\t\ttoken,\n\t\t\tcode,\n\t\t\texpires_at: new Date(Date.now() + expiresInMs),\n\t\t})\n\t\t.execute();\n}\n\n/**\n * Verify a magic link token. Returns the email if valid, null otherwise.\n * Marks the token as used atomically. Rejects after 3 failed attempts.\n */\nexport async function verifyMagicLink(\n\tdb: Kysely<Database>,\n\ttoken: string,\n): Promise<string | null> {\n\tconst result = await db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ used_at: new Date() })\n\t\t.where(\"token\", \"=\", token)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.where(\"failed_attempts\", \"<\", 3)\n\t\t.returning(\"email\")\n\t\t.executeTakeFirst();\n\n\tif (result?.email) return result.email;\n\n\t// Increment failed attempts if token exists but didn't verify\n\tawait db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ failed_attempts: sql`failed_attempts + 1` })\n\t\t.where(\"token\", \"=\", token)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.execute();\n\n\treturn null;\n}\n\n/**\n * Verify by 6-digit code + email. Same atomic pattern as verifyMagicLink.\n * Rejects after 3 failed attempts. Increments failed_attempts on all\n * active codes for this email on failure (prevents parallel brute-force).\n */\nexport async function verifyMagicLinkByCode(\n\tdb: Kysely<Database>,\n\temail: string,\n\tcode: string,\n): Promise<string | null> {\n\tconst result = await db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ used_at: new Date() })\n\t\t.where(\"email\", \"=\", email)\n\t\t.where(\"code\", \"=\", code)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.where(\"failed_attempts\", \"<\", 3)\n\t\t.returning(\"email\")\n\t\t.executeTakeFirst();\n\n\tif (result?.email) return result.email;\n\n\t// Increment failed attempts on all active codes for this email\n\tawait db\n\t\t.updateTable(\"magic_links\")\n\t\t.set({ failed_attempts: sql`failed_attempts + 1` })\n\t\t.where(\"email\", \"=\", email)\n\t\t.where(\"used_at\", \"is\", null)\n\t\t.where(\"expires_at\", \">\", new Date())\n\t\t.execute();\n\n\treturn null;\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAGA,eAAsB,aAAa,CAClC,IACA,OACmB;AAAA,EACnB,OAAO,MAAM,GACX,WAAW,UAAU,EACrB,OAAO,EAAE,MAAM,CAAC,EAChB,WACA,CAAC,OAAO,GAAG,OAAO,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CACjD,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,cAAc,CACnC,IACA,IAC0B;AAAA,EAC1B,OACE,MAAM,GACL,WAAW,UAAU,EACrB,UAAU,EACV,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB,KAAM;AAAA;AAI3B,eAAsB,cAAc,CACnC,IACA,OACmB;AAAA,EACnB,MAAM,SAAS,MAAM;AAAA,oDAC8B;AAAA;AAAA,oDAEA;AAAA;AAAA,IAEhD,QAAQ,EAAE;AAAA,EAEb,OAAO,OAAO,KAAK,SAAS;AAAA;AAG7B,eAAsB,eAAe,CACpC,IACA,OACA,OACA,cAAsB,KAAK,KAAK,MAChB;AAAA,EAChB,MAAM,GACJ,WAAW,aAAa,EACxB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;AAAA,EAC9C,CAAC,EACA,QAAQ;AAAA;AAOX,eAAsB,eAAe,CACpC,IACA,OACyB;AAAA,EACzB,MAAM,SAAS,MAAM,GACnB,YAAY,aAAa,EACzB,IAAI,EAAE,SAAS,IAAI,KAAO,CAAC,EAC3B,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,MAAM,mBAAmB,KAAK,CAAC,EAC/B,UAAU,OAAO,EACjB,iBAAiB;AAAA,EAEnB,IAAI,QAAQ;AAAA,IAAO,OAAO,OAAO;AAAA,EAGjC,MAAM,GACJ,YAAY,aAAa,EACzB,IAAI,EAAE,iBAAiB,yBAAyB,CAAC,EACjD,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,QAAQ;AAAA,EAEV,OAAO;AAAA;",
-  "debugId": "20A55F621EB14D5064756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAGA,eAAsB,aAAa,CAClC,IACA,OACmB;AAAA,EACnB,OAAO,MAAM,GACX,WAAW,UAAU,EACrB,OAAO,EAAE,MAAM,CAAC,EAChB,WACA,CAAC,OAAO,GAAG,OAAO,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CACjD,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,cAAc,CACnC,IACA,IAC0B;AAAA,EAC1B,OACE,MAAM,GACL,WAAW,UAAU,EACrB,UAAU,EACV,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB,KAAM;AAAA;AAI3B,eAAsB,cAAc,CACnC,IACA,OACmB;AAAA,EACnB,MAAM,SAAS,MAAM;AAAA,oDAC8B;AAAA;AAAA,oDAEA;AAAA;AAAA,IAEhD,QAAQ,EAAE;AAAA,EAEb,OAAO,OAAO,KAAK,SAAS;AAAA;AAG7B,eAAsB,eAAe,CACpC,IACA,OACA,OACA,MACA,cAAsB,KAAK,KAAK,MAChB;AAAA,EAChB,MAAM,GACJ,WAAW,aAAa,EACxB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;AAAA,EAC9C,CAAC,EACA,QAAQ;AAAA;AAOX,eAAsB,eAAe,CACpC,IACA,OACyB;AAAA,EACzB,MAAM,SAAS,MAAM,GACnB,YAAY,aAAa,EACzB,IAAI,EAAE,SAAS,IAAI,KAAO,CAAC,EAC3B,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,MAAM,mBAAmB,KAAK,CAAC,EAC/B,UAAU,OAAO,EACjB,iBAAiB;AAAA,EAEnB,IAAI,QAAQ;AAAA,IAAO,OAAO,OAAO;AAAA,EAGjC,MAAM,GACJ,YAAY,aAAa,EACzB,IAAI,EAAE,iBAAiB,yBAAyB,CAAC,EACjD,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,QAAQ;AAAA,EAEV,OAAO;AAAA;AAQR,eAAsB,qBAAqB,CAC1C,IACA,OACA,MACyB;AAAA,EACzB,MAAM,SAAS,MAAM,GACnB,YAAY,aAAa,EACzB,IAAI,EAAE,SAAS,IAAI,KAAO,CAAC,EAC3B,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,MAAM,mBAAmB,KAAK,CAAC,EAC/B,UAAU,OAAO,EACjB,iBAAiB;AAAA,EAEnB,IAAI,QAAQ;AAAA,IAAO,OAAO,OAAO;AAAA,EAGjC,MAAM,GACJ,YAAY,aAAa,EACzB,IAAI,EAAE,iBAAiB,yBAAyB,CAAC,EACjD,MAAM,SAAS,KAAK,KAAK,EACzB,MAAM,WAAW,MAAM,IAAI,EAC3B,MAAM,cAAc,KAAK,IAAI,IAAM,EACnC,QAAQ;AAAA,EAEV,OAAO;AAAA;",
+  "debugId": "8F0ACA05832385B164756E2164756E21",
   "names": []
 }

package/dist/src/db/queries/integrity.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/queries/metrics.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/queries/subgraphs.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/queries/usage.d.ts

@@ -154,6 +154,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/db/schema.d.ts

@@ -145,6 +145,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/index.d.ts

@@ -145,6 +145,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/dist/src/node/local-client.d.ts

@@ -146,6 +146,7 @@ interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
 	token: string;
+	code: string | null;
 	expires_at: Date;
 	used_at: Date | null;
 	failed_attempts: Generated<number>;

package/migrations/0019_magic_link_code.ts

@@ -0,0 +1,11 @@
+import { type Kysely, sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`ALTER TABLE magic_links ADD COLUMN IF NOT EXISTS code text`.execute(
+		db,
+	);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await sql`ALTER TABLE magic_links DROP COLUMN IF EXISTS code`.execute(db);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "0.8.1",
+	"version": "0.9.0",
 	"type": "module",
 	"main": "./dist/src/index.js",
 	"types": "./dist/src/index.d.ts",