Cross-device magic-link confirmation

.where(and(
  eq(magicLinkTokens.tokenHash, tokenHash),
  eq(magicLinkTokens.brandId, brandId),
  isNull(magicLinkTokens.usedAt),
  gt(magicLinkTokens.expiresAt, now),
  eq(customers.brandId, brandId),
  eq(customers.isArchived, false),
));

const browserInitiationMatches =
  candidates[0].browserNonceHash !== null &&
  suppliedBrowserNonceHash === candidates[0].browserNonceHash;
if (!browserInitiationMatches && !confirm) {
  return c.json({
    confirmationRequired: true,
    account: { maskedEmail: maskEmail(candidates[0].customer.email) },
  }, 409);
}

const verified = await db.transaction(async (tx) => {
  const [customer] = await tx
    .select()
    .from(customers)
    .where(and(
      eq(customers.id, candidates[0].customer.id),
      eq(customers.brandId, brandId),
      eq(customers.isArchived, false),
    ))
    .for("update");
  if (!customer) return null;

  const claimed = await tx
    .update(magicLinkTokens)
    .set({ usedAt: now, updatedAt: now })
    .where(and(
      eq(magicLinkTokens.id, candidates[0].tokenId),
      isNull(magicLinkTokens.usedAt),
      gt(magicLinkTokens.expiresAt, now),
    ))
    .returning({ id: magicLinkTokens.id });
  if (claimed.length === 0) return null;
  // Mint the tenant-bound customer session.
});

const mlt = pendingMagicLinkTokenRef.current;
if (!mlt || !magicLinkConfirmation || confirmingMagicLinkRef.current) return;

const authority = magicLinkAuthorityRef.current;
confirmingMagicLinkRef.current = true;
setMagicLinkConfirmation({ ...magicLinkConfirmation, pending: true });
const result = await requestMagicLinkExchange(mlt, null, true);
if (
  !magicLinkMountedRef.current ||
  authority !== magicLinkAuthorityRef.current ||
  pendingMagicLinkTokenRef.current !== mlt
) {
  return;
}
if (result.kind === "signed-in") {
  setSession(result.token, result.customer);
}

ALTER TABLE "magic_link_tokens" ADD COLUMN "browser_nonce_hash" varchar(64);

if ((await run(["bun", "run", "build"])) !== 0) process.exit(1);
if (!existsSync(chromium.executablePath())) {
  if ((await run(["bunx", "playwright", "install", "chromium"])) !== 0) {
    process.exit(1);
  }
}

const preview = Bun.spawn([
  "bunx", "vite", "preview", "--host", host,
  "--port", String(port), "--strictPort",
], { cwd, stdin: "ignore", stdout: "inherit", stderr: "inherit" });

// Wait for account.html, then run the real browser suite.
const exitCode = await run(
  ["bun", "test", "magic-link-confirmation.browser.test.ts"],
  { RUN_BROWSER_TESTS: "1", WIDGETS_TEST_BASE_URL: baseUrl },
);