@rovela-ai/sdk 0.3.34 → 0.4.1

package/dist/auth/server/customer-session.js

@@ -1,115 +0,0 @@
-/**
- * @rovela-ai/sdk/auth/server/customer-session
- *
- * Centralized session check for customer-side API routes and Server
- * Components. Mirror of `requireAdmin()` on the admin side.
- *
- * # Why this exists
- *
- * Before this helper, customer API routes each had their own inline
- * "check session.user.id, optionally check session.user.role" scaffolding.
- * Some of them (e.g. `/api/account/orders`) simply checked `session.user.id`
- * and trusted whatever was there — including an admin session that happened
- * to be in the single shared cookie. Result: admin JWTs silently succeeded
- * on customer endpoints, returning "no orders" for the admin UUID rather
- * than rejecting the request.
- *
- * Post-0.3.20 the admin cookie lives at a different name entirely
- * (`__Secure-rovela.admin.session-token`), so an admin JWT CANNOT reach
- * this helper because `getServerSession(createCustomerAuthOptions())` only
- * reads the customer cookie (`__Secure-rovela.customer.session-token`).
- * The `role` check below is belt-and-braces for legacy tokens still in
- * flight during the fleet-wide cookie-name rollout.
- *
- * # Return contract
- *
- * Discriminated union, same as `requireAdmin`:
- *   - `{ ok: true, customer }`  — caller proceeds
- *   - `{ ok: false, response }` — caller returns `response` directly
- *
- * Never throws — any internal error converts to a safe response.
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   const { customer } = guard
- *   const orders = await findOrders({ customerId: customer.id })
- *   return Response.json({ orders })
- * }
- * ```
- */
-import { NextResponse } from 'next/server';
-import { getServerSession } from 'next-auth';
-import { createCustomerAuthOptions } from '../config';
-import { findCustomerById } from './customer-service';
-// =============================================================================
-// Response helpers
-// =============================================================================
-function unauthorized() {
-    return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHORIZED' }, { status: 401 });
-}
-function forbidden() {
-    return NextResponse.json({ error: 'Forbidden', code: 'FORBIDDEN' }, { status: 403 });
-}
-// =============================================================================
-// Main helper
-// =============================================================================
-/**
- * Authenticate the current request as a customer.
- *
- * Resolves with either `{ ok: true, customer }` (caller may proceed) or
- * `{ ok: false, response }` (caller returns the response to the client).
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   // ...proceed with guard.customer
- * }
- * ```
- */
-export async function requireCustomer() {
-    let rawSession;
-    try {
-        rawSession = await getServerSession(createCustomerAuthOptions());
-    }
-    catch (err) {
-        console.error('[requireCustomer] Failed to read session:', err);
-        return { ok: false, response: unauthorized() };
-    }
-    const sessionUser = rawSession?.user;
-    if (!sessionUser?.id) {
-        return { ok: false, response: unauthorized() };
-    }
-    // Defense in depth: an admin cookie cannot reach this endpoint by
-    // design (separate cookie jar), but if a legacy token with a `role`
-    // field somehow decodes in this context, treat it as forbidden rather
-    // than render customer UI with admin identity.
-    if (sessionUser.role) {
-        return { ok: false, response: forbidden() };
-    }
-    // Re-validate the customer exists in the DB. Catches orphan JWTs where
-    // the customer row was deleted after the token was minted.
-    let customer;
-    try {
-        const row = await findCustomerById(sessionUser.id);
-        if (!row) {
-            return { ok: false, response: unauthorized() };
-        }
-        customer = {
-            id: row.id,
-            email: row.email,
-            name: row.name ?? null,
-            emailVerified: !!row.emailVerified,
-        };
-    }
-    catch (err) {
-        console.error('[requireCustomer] Failed to load customer row:', err);
-        return { ok: false, response: unauthorized() };
-    }
-    return { ok: true, customer };
-}
-//# sourceMappingURL=customer-session.js.map

package/dist/auth/server/customer-session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"customer-session.js","sourceRoot":"","sources":["../../../src/auth/server/customer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAsBrD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,WAAW,GAAI,UAEZ,EAAE,IAAI,CAAA;IAEf,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,QAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;QAChD,CAAC;QACD,QAAQ,GAAG;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa;SACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC"}

package/dist/auth/server/email-sender.d.ts

@@ -1,64 +0,0 @@
-/**
- * @rovela/sdk/auth/server/email-sender
- *
- * Email sending utilities for customer authentication.
- * This file re-exports from the emails module for backward compatibility.
- *
- * NOTE: For new code, prefer importing directly from '@rovela/sdk/emails':
- * ```typescript
- * import { sendVerificationEmail, sendWelcomeEmail } from '@rovela/sdk/emails'
- * ```
- */
-/**
- * Send verification email to new customer.
- *
- * @param email - Customer email address
- * @param token - Verification token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendVerificationEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendVerificationEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendVerificationEmail(email: string, token: string, storeName: string): Promise<void>;
-/**
- * Send password reset email to customer.
- *
- * @param email - Customer email address
- * @param token - Reset token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendPasswordResetEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendPasswordResetEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendPasswordResetEmail(email: string, token: string, storeName: string): Promise<void>;
-/**
- * Send welcome email to new customer after verification.
- *
- * @param email - Customer email address
- * @param name - Customer name
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendWelcomeEmail('customer@example.com', 'John', 'My Store')
- * ```
- *
- * @deprecated Use `sendWelcomeEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendWelcomeEmail(email: string, name: string | null | undefined, storeName: string): Promise<void>;
-/**
- * Get the store name from configuration or environment.
- * Falls back to a generic name if not configured.
- *
- * @deprecated Use `getStoreName` from '@rovela/sdk/emails'
- */
-export declare function getStoreName(): Promise<string>;
-//# sourceMappingURL=email-sender.d.ts.map

package/dist/auth/server/email-sender.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-sender.d.ts","sourceRoot":"","sources":["../../../src/auth/server/email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAcH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAEpD"}

package/dist/auth/server/email-sender.js

@@ -1,106 +0,0 @@
-/**
- * @rovela/sdk/auth/server/email-sender
- *
- * Email sending utilities for customer authentication.
- * This file re-exports from the emails module for backward compatibility.
- *
- * NOTE: For new code, prefer importing directly from '@rovela/sdk/emails':
- * ```typescript
- * import { sendVerificationEmail, sendWelcomeEmail } from '@rovela/sdk/emails'
- * ```
- */
-import { sendVerificationEmail as sendVerification, sendPasswordResetEmail as sendPasswordReset, sendWelcomeEmail as sendWelcome, getStoreName as getStoreNameFromEmails, getStoreUrl, } from '../../emails';
-// =============================================================================
-// Re-exported Functions (Backward Compatible API)
-// =============================================================================
-/**
- * Send verification email to new customer.
- *
- * @param email - Customer email address
- * @param token - Verification token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendVerificationEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendVerificationEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendVerificationEmail(email, token, storeName) {
-    const storeUrl = getStoreUrl();
-    const verificationLink = `${storeUrl}/auth/verify-email?token=${token}`;
-    const result = await sendVerification({
-        to: email,
-        customerName: email.split('@')[0], // Fallback to email prefix
-        verificationLink,
-        expiryTime: '24',
-    });
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send verification email:', result.error);
-        throw new Error('Failed to send verification email');
-    }
-}
-/**
- * Send password reset email to customer.
- *
- * @param email - Customer email address
- * @param token - Reset token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendPasswordResetEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendPasswordResetEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendPasswordResetEmail(email, token, storeName) {
-    const storeUrl = getStoreUrl();
-    const resetLink = `${storeUrl}/auth/reset-password?token=${token}`;
-    const result = await sendPasswordReset({
-        to: email,
-        customerName: email.split('@')[0], // Fallback to email prefix
-        resetLink,
-        expiryTime: '1',
-    });
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send password reset email:', result.error);
-        throw new Error('Failed to send password reset email');
-    }
-}
-/**
- * Send welcome email to new customer after verification.
- *
- * @param email - Customer email address
- * @param name - Customer name
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendWelcomeEmail('customer@example.com', 'John', 'My Store')
- * ```
- *
- * @deprecated Use `sendWelcomeEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendWelcomeEmail(email, name, storeName) {
-    const customerName = name || 'there';
-    const result = await sendWelcome({
-        to: email,
-        customerName,
-    });
-    // Welcome email failure is not critical - just log it
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send welcome email:', result.error);
-    }
-}
-/**
- * Get the store name from configuration or environment.
- * Falls back to a generic name if not configured.
- *
- * @deprecated Use `getStoreName` from '@rovela/sdk/emails'
- */
-export async function getStoreName() {
-    return getStoreNameFromEmails();
-}
-//# sourceMappingURL=email-sender.js.map

package/dist/auth/server/email-sender.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-sender.js","sourceRoot":"","sources":["../../../src/auth/server/email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,IAAI,gBAAgB,EACzC,sBAAsB,IAAI,iBAAiB,EAC3C,gBAAgB,IAAI,WAAW,EAC/B,YAAY,IAAI,sBAAsB,EACtC,WAAW,GACZ,MAAM,cAAc,CAAA;AAErB,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,KAAa,EACb,SAAiB;IAEjB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,gBAAgB,GAAG,GAAG,QAAQ,4BAA4B,KAAK,EAAE,CAAA;IAEvE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B;QAC9D,gBAAgB;QAChB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,KAAa,EACb,SAAiB;IAEjB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,8BAA8B,KAAK,EAAE,CAAA;IAElE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B;QAC9D,SAAS;QACT,UAAU,EAAE,GAAG;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAChF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAA+B,EAC/B,SAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,IAAI,OAAO,CAAA;IAEpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,YAAY;KACb,CAAC,CAAA;IAEF,sDAAsD;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,OAAO,sBAAsB,EAAE,CAAA;AACjC,CAAC"}

package/dist/auth/server/index.d.ts

@@ -1,15 +0,0 @@
-/**
- * @rovela/sdk/auth/server
- *
- * Server-side authentication utilities.
- * Import from '@rovela/sdk/auth/server' in server components and API routes.
- */
-export { hashPassword, verifyPassword, validatePassword, MIN_PASSWORD_LENGTH, } from './password';
-export { sendVerificationEmail, sendPasswordResetEmail, sendWelcomeEmail, getStoreName, } from './email-sender';
-export { createCustomer, authenticateCustomer, findCustomerForSession, findCustomerByEmail, findCustomerById, updateCustomer, updateCustomerPassword, markEmailVerified, emailExists, } from './customer-service';
-export type { CreateCustomerResult, AuthenticateResult, AuthenticateError, } from './customer-service';
-export { requireCustomer } from './customer-session';
-export type { VerifiedCustomer, RequireCustomerResult } from './customer-session';
-export { createVerificationToken, verifyEmail, deleteVerificationTokens, resendVerificationEmail, isEmailVerified, cleanupExpiredTokens, } from './verification-service';
-export { requestPasswordReset, validateResetToken, resetPassword, deletePasswordResetTokens, cleanupExpiredResetTokens, } from './password-reset-service';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,GACZ,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAGjF,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA"}

package/dist/auth/server/index.js

@@ -1,19 +0,0 @@
-/**
- * @rovela/sdk/auth/server
- *
- * Server-side authentication utilities.
- * Import from '@rovela/sdk/auth/server' in server components and API routes.
- */
-// Password utilities
-export { hashPassword, verifyPassword, validatePassword, MIN_PASSWORD_LENGTH, } from './password';
-// Email utilities
-export { sendVerificationEmail, sendPasswordResetEmail, sendWelcomeEmail, getStoreName, } from './email-sender';
-// Customer service
-export { createCustomer, authenticateCustomer, findCustomerForSession, findCustomerByEmail, findCustomerById, updateCustomer, updateCustomerPassword, markEmailVerified, emailExists, } from './customer-service';
-// Customer session guard (mirror of requireAdmin on the admin side)
-export { requireCustomer } from './customer-session';
-// Verification service
-export { createVerificationToken, verifyEmail, deleteVerificationTokens, resendVerificationEmail, isEmailVerified, cleanupExpiredTokens, } from './verification-service';
-// Password reset service
-export { requestPasswordReset, validateResetToken, resetPassword, deletePasswordResetTokens, cleanupExpiredResetTokens, } from './password-reset-service';
-//# sourceMappingURL=index.js.map

package/dist/auth/server/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAqB;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,kBAAkB;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,GACZ,MAAM,oBAAoB,CAAA;AAO3B,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,uBAAuB;AACvB,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,yBAAyB;AACzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA"}

package/dist/auth/server/password-reset-service.d.ts

@@ -1,87 +0,0 @@
-/**
- * @rovela/sdk/auth/server/password-reset-service
- *
- * Password reset token management.
- * Handles creating, validating, and using reset tokens.
- * Each store has its own database (via Neon branches) - no tenant isolation needed.
- */
-/**
- * Request a password reset for a customer.
- * Creates a token and sends reset email.
- *
- * Note: Always returns success to prevent email enumeration attacks.
- *
- * @param email - Customer email address
- * @returns Always returns success (security best practice)
- *
- * @example
- * ```typescript
- * const result = await requestPasswordReset('customer@example.com')
- * // Always show "If an account exists, we've sent a reset email"
- * ```
- */
-export declare function requestPasswordReset(email: string): Promise<{
-    success: boolean;
-}>;
-/**
- * Validate a password reset token.
- * Does NOT consume the token - use resetPassword() for that.
- *
- * @param token - Reset token from email link
- * @returns Validation result
- *
- * @example
- * ```typescript
- * const result = await validateResetToken(token)
- * if (result.valid) {
- *   // Show password reset form
- * } else {
- *   // Show error message
- * }
- * ```
- */
-export declare function validateResetToken(token: string): Promise<{
-    valid: boolean;
-    error?: string;
-}>;
-/**
- * Reset password using a token.
- * Validates the token, updates the password, and deletes the token.
- *
- * @param token - Reset token from email link
- * @param newPassword - New password (plain text, will be hashed)
- * @returns Reset result
- *
- * @example
- * ```typescript
- * const result = await resetPassword(token, 'newSecurePassword123')
- * if (result.success) {
- *   // Redirect to login
- * } else {
- *   // Show error
- * }
- * ```
- */
-export declare function resetPassword(token: string, newPassword: string): Promise<{
-    success: boolean;
-    error?: string;
-}>;
-/**
- * Delete all password reset tokens for a customer.
- *
- * @param customerId - Customer UUID
- *
- * @example
- * ```typescript
- * await deletePasswordResetTokens(customerId)
- * ```
- */
-export declare function deletePasswordResetTokens(customerId: string): Promise<void>;
-/**
- * Clean up expired password reset tokens.
- * Should be called periodically (e.g., via cron job).
- *
- * @returns Number of tokens deleted
- */
-export declare function cleanupExpiredResetTokens(): Promise<number>;
-//# sourceMappingURL=password-reset-service.d.ts.map

package/dist/auth/server/password-reset-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"password-reset-service.d.ts","sourceRoot":"","sources":["../../../src/auth/server/password-reset-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAiCD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAC,CA+BD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAC,CAyCD;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CASjE"}

package/dist/auth/server/password-reset-service.js

@@ -1,198 +0,0 @@
-/**
- * @rovela/sdk/auth/server/password-reset-service
- *
- * Password reset token management.
- * Handles creating, validating, and using reset tokens.
- * Each store has its own database (via Neon branches) - no tenant isolation needed.
- */
-import { eq, lt } from 'drizzle-orm';
-import { nanoid } from 'nanoid';
-import { getDb } from '../../core/db/client';
-import * as schema from '../../core/db/schema';
-import { findCustomerByEmail, updateCustomerPassword } from './customer-service';
-import { sendPasswordResetEmail, getStoreName } from './email-sender';
-// =============================================================================
-// Constants
-// =============================================================================
-/**
- * Password reset token expiry time in milliseconds (1 hour).
- * Shorter than verification tokens for security.
- */
-const TOKEN_EXPIRY_MS = 60 * 60 * 1000;
-/**
- * Token length (URL-safe).
- */
-const TOKEN_LENGTH = 32;
-// =============================================================================
-// Token Management
-// =============================================================================
-/**
- * Request a password reset for a customer.
- * Creates a token and sends reset email.
- *
- * Note: Always returns success to prevent email enumeration attacks.
- *
- * @param email - Customer email address
- * @returns Always returns success (security best practice)
- *
- * @example
- * ```typescript
- * const result = await requestPasswordReset('customer@example.com')
- * // Always show "If an account exists, we've sent a reset email"
- * ```
- */
-export async function requestPasswordReset(email) {
-    // Find customer by email
-    const customer = await findCustomerByEmail(email);
-    if (!customer) {
-        // Don't reveal if email exists - return success anyway
-        return { success: true };
-    }
-    // Delete any existing reset tokens for this customer
-    await deletePasswordResetTokens(customer.id);
-    // Generate new token
-    const db = getDb();
-    const token = nanoid(TOKEN_LENGTH);
-    const expires = new Date(Date.now() + TOKEN_EXPIRY_MS);
-    await db.insert(schema.customerPasswordResetTokens).values({
-        customerId: customer.id,
-        token,
-        expires,
-    });
-    // Send reset email
-    const storeName = await getStoreName();
-    try {
-        await sendPasswordResetEmail(email, token, storeName);
-    }
-    catch (error) {
-        console.error('[Auth Reset] Failed to send password reset email:', error);
-        // Don't fail the request if email fails - still return success for security
-    }
-    return { success: true };
-}
-/**
- * Validate a password reset token.
- * Does NOT consume the token - use resetPassword() for that.
- *
- * @param token - Reset token from email link
- * @returns Validation result
- *
- * @example
- * ```typescript
- * const result = await validateResetToken(token)
- * if (result.valid) {
- *   // Show password reset form
- * } else {
- *   // Show error message
- * }
- * ```
- */
-export async function validateResetToken(token) {
-    const db = getDb();
-    // Find the token
-    const [tokenRecord] = await db
-        .select()
-        .from(schema.customerPasswordResetTokens)
-        .where(eq(schema.customerPasswordResetTokens.token, token))
-        .limit(1);
-    if (!tokenRecord) {
-        return {
-            valid: false,
-            error: 'Invalid or expired reset link. Please request a new one.',
-        };
-    }
-    // Check if token has expired
-    if (new Date() > tokenRecord.expires) {
-        // Clean up expired token
-        await db
-            .delete(schema.customerPasswordResetTokens)
-            .where(eq(schema.customerPasswordResetTokens.id, tokenRecord.id));
-        return {
-            valid: false,
-            error: 'Reset link has expired. Please request a new one.',
-        };
-    }
-    return { valid: true };
-}
-/**
- * Reset password using a token.
- * Validates the token, updates the password, and deletes the token.
- *
- * @param token - Reset token from email link
- * @param newPassword - New password (plain text, will be hashed)
- * @returns Reset result
- *
- * @example
- * ```typescript
- * const result = await resetPassword(token, 'newSecurePassword123')
- * if (result.success) {
- *   // Redirect to login
- * } else {
- *   // Show error
- * }
- * ```
- */
-export async function resetPassword(token, newPassword) {
-    const db = getDb();
-    // Find the token
-    const [tokenRecord] = await db
-        .select()
-        .from(schema.customerPasswordResetTokens)
-        .where(eq(schema.customerPasswordResetTokens.token, token))
-        .limit(1);
-    if (!tokenRecord) {
-        return {
-            success: false,
-            error: 'Invalid or expired reset link. Please request a new one.',
-        };
-    }
-    // Check if token has expired
-    if (new Date() > tokenRecord.expires) {
-        // Clean up expired token
-        await db
-            .delete(schema.customerPasswordResetTokens)
-            .where(eq(schema.customerPasswordResetTokens.id, tokenRecord.id));
-        return {
-            success: false,
-            error: 'Reset link has expired. Please request a new one.',
-        };
-    }
-    // Update the customer's password
-    await updateCustomerPassword(tokenRecord.customerId, newPassword);
-    // Delete all reset tokens for this customer
-    await db
-        .delete(schema.customerPasswordResetTokens)
-        .where(eq(schema.customerPasswordResetTokens.customerId, tokenRecord.customerId));
-    return { success: true };
-}
-/**
- * Delete all password reset tokens for a customer.
- *
- * @param customerId - Customer UUID
- *
- * @example
- * ```typescript
- * await deletePasswordResetTokens(customerId)
- * ```
- */
-export async function deletePasswordResetTokens(customerId) {
-    const db = getDb();
-    await db
-        .delete(schema.customerPasswordResetTokens)
-        .where(eq(schema.customerPasswordResetTokens.customerId, customerId));
-}
-/**
- * Clean up expired password reset tokens.
- * Should be called periodically (e.g., via cron job).
- *
- * @returns Number of tokens deleted
- */
-export async function cleanupExpiredResetTokens() {
-    const db = getDb();
-    const result = await db
-        .delete(schema.customerPasswordResetTokens)
-        .where(lt(schema.customerPasswordResetTokens.expires, new Date()))
-        .returning({ id: schema.customerPasswordResetTokens.id });
-    return result.length;
-}
-//# sourceMappingURL=password-reset-service.js.map

package/dist/auth/server/password-reset-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"password-reset-service.js","sourceRoot":"","sources":["../../../src/auth/server/password-reset-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEtC;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa;IAGtD,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,uDAAuD;QACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,qDAAqD;IACrD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAE5C,qBAAqB;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAA;IAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;QACzD,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK;QACL,OAAO;KACR,CAAC,CAAA;IAEF,mBAAmB;IACnB,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAA;QACzE,4EAA4E;IAC9E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IAIpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,iBAAiB;IACjB,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC;SACxC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,0DAA0D;SAClE,CAAA;IACH,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QACrC,yBAAyB;QACzB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;aAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAEnE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mDAAmD;SAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,WAAmB;IAKnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,iBAAiB;IACjB,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC;SACxC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAC1D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0DAA0D;SAClE,CAAA;IACH,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QACrC,yBAAyB;QACzB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;aAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAEnE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC3D,CAAA;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,sBAAsB,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAEjE,4CAA4C;IAC5C,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;SAC1C,KAAK,CACJ,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,CAC1E,CAAA;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;SAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;SAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACjE,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,2BAA2B,CAAC,EAAE,EAAE,CAAC,CAAA;IAE3D,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}