onehitter 2.0.8 → 2.0.9

package/README.md

@@ -28,7 +28,7 @@ It generates an OTP, stores a hashed record, emails it to the user, then validat
   - create(...): persist a hashed OTP document
   - send(to, otp): email the OTP via SES (customizable template)
   - validate / validateStatus(...): consume once and return success or a detailed status
-- Storage adapter: MongoDB (default) or SQLite (experimental). Choose with `DB_DRIVER`.
+- Storage adapter: MongoDB (default) or SQLite (experimental). Choose with `OTP_DB_DRIVER` (`mongodb` or `sqlite`).
 - Expiry: checked at validation time; MongoDB users should also create a TTL index on `createdAt` for cleanup.
 - Rate limiting: bring your own limiter or enable a built-in in-memory limiter via env flags.
 
@@ -102,7 +102,12 @@ if (status === 'ok') {
 
 ## Databases
 - Default: MongoDB. Your app owns the `MongoClient` (construct, connect/close, pass to `create`/`validate`).
-- Optional: SQLite (`DB_DRIVER=sqlite`, optional `SQLITE_PATH`); good for tests/small apps.
+- Optional: SQLite (`OTP_DB_DRIVER=sqlite`, optional `SQLITE_PATH`); good for tests/small apps.
+
+### Database driver env
+- `OTP_DB_DRIVER` (optional): selects the storage driver.
+  - `mongodb` (default): uses the MongoDB adapter and only requires the `mongodb` dependency.
+  - `sqlite`: uses the built-in SQLite adapter and requires the host app to install `sqlite3` (for example, `npm install sqlite3`). When `OTP_DB_DRIVER=mongodb`, `sqlite3` is not required and is not loaded.
 
 Details and tradeoffs: docs/DB.md
 

package/dist/cjs/db/sqlite-functions.js

@@ -4,11 +4,29 @@ exports.otpValidateWithStatus = exports.otpCreate = void 0;
 const shared_1 = require("./shared");
 let sqlite3;
 let db = null;
+// Bundler-safe loader for optional sqlite3 dependency.
+// Using eval('require') prevents bundlers from eagerly resolving the sqlite3
+// module when the SQLite driver is not used (e.g. when OTP_DB_DRIVER=mongodb).
+function loadSqlite3() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-implied-eval
+        const req = eval('require');
+        return req('sqlite3');
+    }
+    catch (err) {
+        // Provide a clear error when the SQLite driver is selected but sqlite3
+        // is not installed in the host application.
+        const message = err && err.code === 'MODULE_NOT_FOUND'
+            ? 'The sqlite3 package is not installed. Install it with "npm install sqlite3" to use OTP_DB_DRIVER=sqlite.'
+            : `Failed to load sqlite3 driver: ${String(err)}`;
+        throw new Error(message);
+    }
+}
 function getDb() {
     if (db)
         return db;
     // Lazy-load sqlite3 only when the SQLite driver is actually used
-    const s = sqlite3 ?? (sqlite3 = require('sqlite3'));
+    const s = sqlite3 ?? (sqlite3 = loadSqlite3());
     db = new s.Database(shared_1.SQLITE_PATH);
     db.serialize(() => {
         db.run('CREATE TABLE IF NOT EXISTS otp (\n' +

package/dist/esm/db/sqlite-functions.js

@@ -1,11 +1,29 @@
 import { SQLITE_PATH, computeOtpHash, computeContactId } from './shared';
 let sqlite3;
 let db = null;
+// Bundler-safe loader for optional sqlite3 dependency.
+// Using eval('require') prevents bundlers from eagerly resolving the sqlite3
+// module when the SQLite driver is not used (e.g. when OTP_DB_DRIVER=mongodb).
+function loadSqlite3() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-implied-eval
+        const req = eval('require');
+        return req('sqlite3');
+    }
+    catch (err) {
+        // Provide a clear error when the SQLite driver is selected but sqlite3
+        // is not installed in the host application.
+        const message = err && err.code === 'MODULE_NOT_FOUND'
+            ? 'The sqlite3 package is not installed. Install it with "npm install sqlite3" to use OTP_DB_DRIVER=sqlite.'
+            : `Failed to load sqlite3 driver: ${String(err)}`;
+        throw new Error(message);
+    }
+}
 function getDb() {
     if (db)
         return db;
     // Lazy-load sqlite3 only when the SQLite driver is actually used
-    const s = sqlite3 ?? (sqlite3 = require('sqlite3'));
+    const s = sqlite3 ?? (sqlite3 = loadSqlite3());
     db = new s.Database(SQLITE_PATH);
     db.serialize(() => {
         db.run('CREATE TABLE IF NOT EXISTS otp (\n' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onehitter",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": "One-time password user validation package.",
   "main": "dist/cjs/onehitter.js",
   "module": "dist/esm/onehitter.js",