Handles sms:send_verification_code jobs by validating the job payload, normalizing the recipient phone number to E.164, rendering the verification SMS body, and sending it through the configured SMS provider.
Current provider support is intentionally local-only:
SMS_PROVIDER=devsmsDEVSMS_BASE_URL=http://localhost:4000for Docker Compose local development- DevSms endpoint:
POST /api/sms/send/twilio
All SMS configuration is loaded through @constructive-io/graphql-env via getEnvOptions({}, process.cwd(), context.env). The handler must not read SMS_* or DEVSMS_* values directly.
The job worker may retry a job after a timeout or provider error. The SmsSendRequest.metadata includes jobId and databaseId for future idempotency support, but DevSms does not currently expose an idempotency key. A retried job can therefore create duplicate local SMS messages. The handler intentionally does not implement its own retry loop; timeout and transient failures are left to the existing job retry mechanism.
Logs include job metadata, SMS type, provider, provider message ID, status, and a masked phone number only. They must not include the OTP code, full SMS body, full phone number, or provider secrets.