@rovela-ai/sdk 0.4.0 → 0.4.1

package/dist/auth/server/customer-service.js

@@ -1,266 +0,0 @@
-/**
- * @rovela/sdk/auth/server/customer-service
- *
- * Customer CRUD operations.
- * Each store has its own database (via Neon branches) - no tenant isolation needed.
- */
-import { eq } from 'drizzle-orm';
-import { getDb } from '../../core/db/client';
-import * as schema from '../../core/db/schema';
-import { hashPassword, verifyPassword } from './password';
-// =============================================================================
-// Customer CRUD
-// =============================================================================
-/**
- * Create a new customer account.
- * Password is hashed before storage.
- * Returns customer with null emailVerified (needs verification).
- *
- * @param email - Customer email (will be lowercased)
- * @param password - Plain text password (min 8 chars)
- * @param name - Optional customer name
- * @returns Created customer
- * @throws Error if email already exists
- *
- * @example
- * ```typescript
- * const { customer } = await createCustomer(
- *   'customer@example.com',
- *   'securePassword123',
- *   'John Doe'
- * )
- * ```
- */
-export async function createCustomer(email, password, name) {
-    const db = getDb();
-    // Hash password
-    const passwordHash = await hashPassword(password);
-    try {
-        const [customer] = await db
-            .insert(schema.customers)
-            .values({
-            email: email.toLowerCase().trim(),
-            name: name?.trim() || null,
-            passwordHash,
-            emailVerified: null, // Not verified initially
-        })
-            .returning();
-        // Claim any guest orders with matching email
-        let ordersClaimedCount = 0;
-        try {
-            const { claimGuestOrders } = await import('../../core/db/queries');
-            ordersClaimedCount = await claimGuestOrders(email, customer.id);
-        }
-        catch (claimError) {
-            // Log but don't fail registration - claiming orders is secondary
-            console.warn('[Auth] Failed to claim guest orders:', claimError);
-        }
-        return { customer, ordersClaimedCount };
-    }
-    catch (error) {
-        // Check for unique constraint violation
-        const err = error;
-        if (err.code === '23505' || err.cause?.code === '23505') {
-            throw new Error('An account with this email already exists');
-        }
-        throw error;
-    }
-}
-/**
- * Authenticate a customer by email and password.
- * Checks email verification status.
- *
- * @param email - Customer email
- * @param password - Plain text password
- * @param requireVerification - Whether to require email verification (default: true)
- * @returns Authentication result
- *
- * @example
- * ```typescript
- * const result = await authenticateCustomer('customer@example.com', 'password123')
- * if (result.success) {
- *   console.log('Authenticated:', result.customer.email)
- * } else {
- *   console.log('Failed:', result.error)
- * }
- * ```
- */
-export async function authenticateCustomer(email, password, requireVerification = true) {
-    const db = getDb();
-    // Find customer by email
-    const [customer] = await db
-        .select()
-        .from(schema.customers)
-        .where(eq(schema.customers.email, email.toLowerCase().trim()))
-        .limit(1);
-    if (!customer) {
-        return {
-            success: false,
-            error: 'Invalid email or password',
-            code: 'INVALID_CREDENTIALS',
-        };
-    }
-    // Verify password
-    const isValidPassword = await verifyPassword(password, customer.passwordHash);
-    if (!isValidPassword) {
-        return {
-            success: false,
-            error: 'Invalid email or password',
-            code: 'INVALID_CREDENTIALS',
-        };
-    }
-    // Check email verification
-    if (requireVerification && !customer.emailVerified) {
-        return {
-            success: false,
-            error: 'Please verify your email before signing in',
-            code: 'EMAIL_NOT_VERIFIED',
-        };
-    }
-    return { success: true, customer };
-}
-/**
- * Get customer data for session (excludes sensitive fields).
- *
- * @param customerId - Customer UUID
- * @returns Customer session data or null if not found
- *
- * @example
- * ```typescript
- * const session = await findCustomerForSession(customerId)
- * if (session) {
- *   console.log('Customer:', session.email)
- * }
- * ```
- */
-export async function findCustomerForSession(customerId) {
-    const db = getDb();
-    const [customer] = await db
-        .select({
-        id: schema.customers.id,
-        email: schema.customers.email,
-        name: schema.customers.name,
-        emailVerified: schema.customers.emailVerified,
-    })
-        .from(schema.customers)
-        .where(eq(schema.customers.id, customerId))
-        .limit(1);
-    if (!customer) {
-        return null;
-    }
-    return {
-        id: customer.id,
-        email: customer.email,
-        name: customer.name,
-        emailVerified: !!customer.emailVerified,
-    };
-}
-/**
- * Find a customer by email.
- *
- * @param email - Customer email
- * @returns Customer or null if not found
- */
-export async function findCustomerByEmail(email) {
-    const db = getDb();
-    const [customer] = await db
-        .select()
-        .from(schema.customers)
-        .where(eq(schema.customers.email, email.toLowerCase().trim()))
-        .limit(1);
-    return customer || null;
-}
-/**
- * Find a customer by ID.
- *
- * @param customerId - Customer UUID
- * @returns Customer or null if not found
- */
-export async function findCustomerById(customerId) {
-    const db = getDb();
-    const [customer] = await db
-        .select()
-        .from(schema.customers)
-        .where(eq(schema.customers.id, customerId))
-        .limit(1);
-    return customer || null;
-}
-/**
- * Update customer profile information.
- *
- * @param customerId - Customer UUID
- * @param data - Fields to update
- * @returns Updated customer
- *
- * @example
- * ```typescript
- * const updated = await updateCustomer(customerId, { name: 'Jane Doe' })
- * ```
- */
-export async function updateCustomer(customerId, data) {
-    const db = getDb();
-    const updateData = {};
-    if (data.name !== undefined) {
-        updateData.name = data.name?.trim() || null;
-    }
-    if (data.email !== undefined) {
-        updateData.email = data.email.toLowerCase().trim();
-    }
-    if (Object.keys(updateData).length === 0) {
-        // Nothing to update, return current customer
-        return findCustomerById(customerId);
-    }
-    const [customer] = await db
-        .update(schema.customers)
-        .set(updateData)
-        .where(eq(schema.customers.id, customerId))
-        .returning();
-    return customer || null;
-}
-/**
- * Update customer password.
- *
- * @param customerId - Customer UUID
- * @param newPassword - New plain text password
- *
- * @example
- * ```typescript
- * await updateCustomerPassword(customerId, 'newSecurePassword123')
- * ```
- */
-export async function updateCustomerPassword(customerId, newPassword) {
-    const db = getDb();
-    const passwordHash = await hashPassword(newPassword);
-    await db
-        .update(schema.customers)
-        .set({ passwordHash })
-        .where(eq(schema.customers.id, customerId));
-}
-/**
- * Mark customer email as verified.
- *
- * @param customerId - Customer UUID
- *
- * @example
- * ```typescript
- * await markEmailVerified(customerId)
- * ```
- */
-export async function markEmailVerified(customerId) {
-    const db = getDb();
-    await db
-        .update(schema.customers)
-        .set({ emailVerified: new Date() })
-        .where(eq(schema.customers.id, customerId));
-}
-/**
- * Check if email is already registered.
- *
- * @param email - Email to check
- * @returns True if email exists
- */
-export async function emailExists(email) {
-    const customer = await findCustomerByEmail(email);
-    return !!customer;
-}
-//# sourceMappingURL=customer-service.js.map

package/dist/auth/server/customer-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"customer-service.js","sourceRoot":"","sources":["../../../src/auth/server/customer-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAyBzD,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,QAAgB,EAChB,IAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,gBAAgB;IAChB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACxB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACjC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI;YAC1B,YAAY;YACZ,aAAa,EAAE,IAAI,EAAE,yBAAyB;SAC/C,CAAC;aACD,SAAS,EAAE,CAAA;QAEd,6CAA6C;QAC7C,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;YAClE,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAA;IACzC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wCAAwC;QACxC,MAAM,GAAG,GAAG,KAAqD,CAAA;QACjE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,QAAgB,EAChB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,yBAAyB;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,mBAAmB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4CAA4C;YACnD,IAAI,EAAE,oBAAoB;SAC3B,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK;QAC7B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC3B,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;KAC9C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa;KACxC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,IAAuC;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,UAAU,GAAgC,EAAE,CAAA;IAElD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC7C,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,6CAA6C;QAC7C,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,UAAU,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,SAAS,EAAE,CAAA;IAEd,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAClC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,QAAQ,CAAA;AACnB,CAAC"}

package/dist/auth/server/customer-session.d.ts

@@ -1,79 +0,0 @@
-/**
- * @rovela-ai/sdk/auth/server/customer-session
- *
- * Centralized session check for customer-side API routes and Server
- * Components. Mirror of `requireAdmin()` on the admin side.
- *
- * # Why this exists
- *
- * Before this helper, customer API routes each had their own inline
- * "check session.user.id, optionally check session.user.role" scaffolding.
- * Some of them (e.g. `/api/account/orders`) simply checked `session.user.id`
- * and trusted whatever was there — including an admin session that happened
- * to be in the single shared cookie. Result: admin JWTs silently succeeded
- * on customer endpoints, returning "no orders" for the admin UUID rather
- * than rejecting the request.
- *
- * The admin cookie lives at a different name entirely
- * (`__Secure-rovela.admin.session-token`), so an admin JWT CANNOT reach
- * this helper because `getServerSession(createCustomerAuthOptions())` only
- * reads the customer cookie (`__Secure-rovela.customer.session-token`).
- *
- * # Return contract
- *
- * Discriminated union, same as `requireAdmin`:
- *   - `{ ok: true, customer }`  — caller proceeds
- *   - `{ ok: false, response }` — caller returns `response` directly
- *
- * Never throws — any internal error converts to a safe response.
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   const { customer } = guard
- *   const orders = await findOrders({ customerId: customer.id })
- *   return Response.json({ orders })
- * }
- * ```
- */
-import { NextResponse } from 'next/server';
-/**
- * Shape of the verified customer returned on success. Deliberately a subset
- * of the full customer row so callers don't accidentally leak sensitive
- * fields (passwordHash, emailVerifiedAt timestamp, etc).
- */
-export interface VerifiedCustomer {
-    id: string;
-    email: string;
-    name: string | null;
-    emailVerified: boolean;
-}
-export type RequireCustomerResult = {
-    ok: true;
-    customer: VerifiedCustomer;
-} | {
-    ok: false;
-    response: NextResponse<{
-        error: string;
-        code: string;
-    }>;
-};
-/**
- * Authenticate the current request as a customer.
- *
- * Resolves with either `{ ok: true, customer }` (caller may proceed) or
- * `{ ok: false, response }` (caller returns the response to the client).
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   // ...proceed with guard.customer
- * }
- * ```
- */
-export declare function requireCustomer(): Promise<RequireCustomerResult>;
-//# sourceMappingURL=customer-session.d.ts.map

package/dist/auth/server/customer-session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"customer-session.d.ts","sourceRoot":"","sources":["../../../src/auth/server/customer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAS1C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAA;AAkB1E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAqCtE"}

package/dist/auth/server/customer-session.js

@@ -1,103 +0,0 @@
-/**
- * @rovela-ai/sdk/auth/server/customer-session
- *
- * Centralized session check for customer-side API routes and Server
- * Components. Mirror of `requireAdmin()` on the admin side.
- *
- * # Why this exists
- *
- * Before this helper, customer API routes each had their own inline
- * "check session.user.id, optionally check session.user.role" scaffolding.
- * Some of them (e.g. `/api/account/orders`) simply checked `session.user.id`
- * and trusted whatever was there — including an admin session that happened
- * to be in the single shared cookie. Result: admin JWTs silently succeeded
- * on customer endpoints, returning "no orders" for the admin UUID rather
- * than rejecting the request.
- *
- * The admin cookie lives at a different name entirely
- * (`__Secure-rovela.admin.session-token`), so an admin JWT CANNOT reach
- * this helper because `getServerSession(createCustomerAuthOptions())` only
- * reads the customer cookie (`__Secure-rovela.customer.session-token`).
- *
- * # Return contract
- *
- * Discriminated union, same as `requireAdmin`:
- *   - `{ ok: true, customer }`  — caller proceeds
- *   - `{ ok: false, response }` — caller returns `response` directly
- *
- * Never throws — any internal error converts to a safe response.
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   const { customer } = guard
- *   const orders = await findOrders({ customerId: customer.id })
- *   return Response.json({ orders })
- * }
- * ```
- */
-import { NextResponse } from 'next/server';
-import { getServerSession } from 'next-auth';
-import { createCustomerAuthOptions } from '../config';
-import { findCustomerById } from './customer-service';
-// =============================================================================
-// Response helpers
-// =============================================================================
-function unauthorized() {
-    return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHORIZED' }, { status: 401 });
-}
-// =============================================================================
-// Main helper
-// =============================================================================
-/**
- * Authenticate the current request as a customer.
- *
- * Resolves with either `{ ok: true, customer }` (caller may proceed) or
- * `{ ok: false, response }` (caller returns the response to the client).
- *
- * @example
- * ```ts
- * export async function GET() {
- *   const guard = await requireCustomer()
- *   if (!guard.ok) return guard.response
- *   // ...proceed with guard.customer
- * }
- * ```
- */
-export async function requireCustomer() {
-    let rawSession;
-    try {
-        rawSession = await getServerSession(createCustomerAuthOptions());
-    }
-    catch (err) {
-        console.error('[requireCustomer] Failed to read session:', err);
-        return { ok: false, response: unauthorized() };
-    }
-    const sessionUser = rawSession?.user;
-    if (!sessionUser?.id) {
-        return { ok: false, response: unauthorized() };
-    }
-    // Re-validate the customer exists in the DB. Catches orphan JWTs where
-    // the customer row was deleted after the token was minted.
-    let customer;
-    try {
-        const row = await findCustomerById(sessionUser.id);
-        if (!row) {
-            return { ok: false, response: unauthorized() };
-        }
-        customer = {
-            id: row.id,
-            email: row.email,
-            name: row.name ?? null,
-            emailVerified: !!row.emailVerified,
-        };
-    }
-    catch (err) {
-        console.error('[requireCustomer] Failed to load customer row:', err);
-        return { ok: false, response: unauthorized() };
-    }
-    return { ok: true, customer };
-}
-//# sourceMappingURL=customer-session.js.map

package/dist/auth/server/customer-session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"customer-session.js","sourceRoot":"","sources":["../../../src/auth/server/customer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAsBrD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAGD,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,WAAW,GAAI,UAEZ,EAAE,IAAI,CAAA;IAEf,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,QAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;QAChD,CAAC;QACD,QAAQ,GAAG;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa;SACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC"}

package/dist/auth/server/email-sender.d.ts

@@ -1,64 +0,0 @@
-/**
- * @rovela/sdk/auth/server/email-sender
- *
- * Email sending utilities for customer authentication.
- * This file re-exports from the emails module for backward compatibility.
- *
- * NOTE: For new code, prefer importing directly from '@rovela/sdk/emails':
- * ```typescript
- * import { sendVerificationEmail, sendWelcomeEmail } from '@rovela/sdk/emails'
- * ```
- */
-/**
- * Send verification email to new customer.
- *
- * @param email - Customer email address
- * @param token - Verification token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendVerificationEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendVerificationEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendVerificationEmail(email: string, token: string, storeName: string): Promise<void>;
-/**
- * Send password reset email to customer.
- *
- * @param email - Customer email address
- * @param token - Reset token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendPasswordResetEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendPasswordResetEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendPasswordResetEmail(email: string, token: string, storeName: string): Promise<void>;
-/**
- * Send welcome email to new customer after verification.
- *
- * @param email - Customer email address
- * @param name - Customer name
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendWelcomeEmail('customer@example.com', 'John', 'My Store')
- * ```
- *
- * @deprecated Use `sendWelcomeEmail` from '@rovela/sdk/emails' for more options
- */
-export declare function sendWelcomeEmail(email: string, name: string | null | undefined, storeName: string): Promise<void>;
-/**
- * Get the store name from configuration or environment.
- * Falls back to a generic name if not configured.
- *
- * @deprecated Use `getStoreName` from '@rovela/sdk/emails'
- */
-export declare function getStoreName(): Promise<string>;
-//# sourceMappingURL=email-sender.d.ts.map

package/dist/auth/server/email-sender.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-sender.d.ts","sourceRoot":"","sources":["../../../src/auth/server/email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAcH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAEpD"}

package/dist/auth/server/email-sender.js

@@ -1,106 +0,0 @@
-/**
- * @rovela/sdk/auth/server/email-sender
- *
- * Email sending utilities for customer authentication.
- * This file re-exports from the emails module for backward compatibility.
- *
- * NOTE: For new code, prefer importing directly from '@rovela/sdk/emails':
- * ```typescript
- * import { sendVerificationEmail, sendWelcomeEmail } from '@rovela/sdk/emails'
- * ```
- */
-import { sendVerificationEmail as sendVerification, sendPasswordResetEmail as sendPasswordReset, sendWelcomeEmail as sendWelcome, getStoreName as getStoreNameFromEmails, getStoreUrl, } from '../../emails';
-// =============================================================================
-// Re-exported Functions (Backward Compatible API)
-// =============================================================================
-/**
- * Send verification email to new customer.
- *
- * @param email - Customer email address
- * @param token - Verification token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendVerificationEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendVerificationEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendVerificationEmail(email, token, storeName) {
-    const storeUrl = getStoreUrl();
-    const verificationLink = `${storeUrl}/auth/verify-email?token=${token}`;
-    const result = await sendVerification({
-        to: email,
-        customerName: email.split('@')[0], // Fallback to email prefix
-        verificationLink,
-        expiryTime: '24',
-    });
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send verification email:', result.error);
-        throw new Error('Failed to send verification email');
-    }
-}
-/**
- * Send password reset email to customer.
- *
- * @param email - Customer email address
- * @param token - Reset token
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendPasswordResetEmail('customer@example.com', 'abc123token', 'My Store')
- * ```
- *
- * @deprecated Use `sendPasswordResetEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendPasswordResetEmail(email, token, storeName) {
-    const storeUrl = getStoreUrl();
-    const resetLink = `${storeUrl}/auth/reset-password?token=${token}`;
-    const result = await sendPasswordReset({
-        to: email,
-        customerName: email.split('@')[0], // Fallback to email prefix
-        resetLink,
-        expiryTime: '1',
-    });
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send password reset email:', result.error);
-        throw new Error('Failed to send password reset email');
-    }
-}
-/**
- * Send welcome email to new customer after verification.
- *
- * @param email - Customer email address
- * @param name - Customer name
- * @param storeName - Name of the store
- *
- * @example
- * ```typescript
- * await sendWelcomeEmail('customer@example.com', 'John', 'My Store')
- * ```
- *
- * @deprecated Use `sendWelcomeEmail` from '@rovela/sdk/emails' for more options
- */
-export async function sendWelcomeEmail(email, name, storeName) {
-    const customerName = name || 'there';
-    const result = await sendWelcome({
-        to: email,
-        customerName,
-    });
-    // Welcome email failure is not critical - just log it
-    if (!result.success) {
-        console.error('[Auth Email] Failed to send welcome email:', result.error);
-    }
-}
-/**
- * Get the store name from configuration or environment.
- * Falls back to a generic name if not configured.
- *
- * @deprecated Use `getStoreName` from '@rovela/sdk/emails'
- */
-export async function getStoreName() {
-    return getStoreNameFromEmails();
-}
-//# sourceMappingURL=email-sender.js.map

package/dist/auth/server/email-sender.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-sender.js","sourceRoot":"","sources":["../../../src/auth/server/email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,IAAI,gBAAgB,EACzC,sBAAsB,IAAI,iBAAiB,EAC3C,gBAAgB,IAAI,WAAW,EAC/B,YAAY,IAAI,sBAAsB,EACtC,WAAW,GACZ,MAAM,cAAc,CAAA;AAErB,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,KAAa,EACb,SAAiB;IAEjB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,gBAAgB,GAAG,GAAG,QAAQ,4BAA4B,KAAK,EAAE,CAAA;IAEvE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B;QAC9D,gBAAgB;QAChB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,KAAa,EACb,SAAiB;IAEjB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,8BAA8B,KAAK,EAAE,CAAA;IAElE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B;QAC9D,SAAS;QACT,UAAU,EAAE,GAAG;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAChF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAA+B,EAC/B,SAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,IAAI,OAAO,CAAA;IAEpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,YAAY;KACb,CAAC,CAAA;IAEF,sDAAsD;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,OAAO,sBAAsB,EAAE,CAAA;AACjC,CAAC"}

package/dist/auth/server/index.d.ts

@@ -1,14 +0,0 @@
-/**
- * @rovela/sdk/auth/server
- *
- * Server-side authentication utilities.
- * Import from '@rovela/sdk/auth/server' in server components and API routes.
- */
-export { hashPassword, verifyPassword, validatePassword, MIN_PASSWORD_LENGTH, } from './password';
-export { createCustomer, authenticateCustomer, findCustomerForSession, findCustomerByEmail, findCustomerById, updateCustomer, updateCustomerPassword, markEmailVerified, emailExists, } from './customer-service';
-export type { CreateCustomerResult, AuthenticateResult, AuthenticateError, } from './customer-service';
-export { requireCustomer } from './customer-session';
-export type { VerifiedCustomer, RequireCustomerResult } from './customer-session';
-export { createVerificationToken, verifyEmail, deleteVerificationTokens, resendVerificationEmail, isEmailVerified, cleanupExpiredTokens, } from './verification-service';
-export { requestPasswordReset, validateResetToken, resetPassword, deletePasswordResetTokens, cleanupExpiredResetTokens, } from './password-reset-service';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,GACZ,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAGjF,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA"}