Phone / SMS sign-in

import { entity, field } from "@pylonsync/sdk";

export const User = entity("User", {
  email: field.string().optional(),
  phone: field.string().optional().unique(),  // E.164 normalized
  phoneVerified: field.string().optional(),    // ISO 8601 timestamp on first verify
  displayName: field.string(),
  createdAt: field.string(),
});

curl -X POST https://your-app/api/auth/phone/send-code \
  -H 'Content-Type: application/json' \
  -d '{"phone": "+15551234567"}'

{ "sent": true, "phone": "+15551234567", "codeLength": 6 }

{ "sent": false, "phone": "+15551234567", "codeLength": 6, "dev_code": "123456" }

Acme: your sign-in code is 0427. It expires in 10 minutes.

PYLON_APP_NAME="Acme"
PYLON_SMS_TEMPLATE_SIGN_IN_CODE="{{app_name}}: {{code}} is your sign-in code. It expires in 10 minutes."

curl -X POST https://your-app/api/auth/phone/verify \
  -H 'Content-Type: application/json' \
  -d '{
    "phone": "+15551234567",
    "code": "123456",
    "displayName": "Alice"
  }'

{
  "token": "pylon_...",
  "user_id": "usr_xyz",
  "expires_at": 1737592000
}

PYLON_TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxx
PYLON_TWILIO_AUTH_TOKEN=your_twilio_auth_token
PYLON_TWILIO_FROM=+15551234567       # your Twilio phone number

use pylon_auth::phone::SmsSender;

struct MyProvider;

impl SmsSender for MyProvider {
  fn send_sms(&self, phone: &str, body: &str) -> Result<(), String> {
    // POST to your provider's API, return Ok(()) on success
    Ok(())
  }
}