@rovela-ai/sdk 0.4.1 → 0.4.2

package/dist/auth/server/customer-service.js

@@ -0,0 +1,266 @@
+/**
+ * @rovela/sdk/auth/server/customer-service
+ *
+ * Customer CRUD operations.
+ * Each store has its own database (via Neon branches) - no tenant isolation needed.
+ */
+import { eq } from 'drizzle-orm';
+import { getDb } from '../../core/db/client';
+import * as schema from '../../core/db/schema';
+import { hashPassword, verifyPassword } from './password';
+// =============================================================================
+// Customer CRUD
+// =============================================================================
+/**
+ * Create a new customer account.
+ * Password is hashed before storage.
+ * Returns customer with null emailVerified (needs verification).
+ *
+ * @param email - Customer email (will be lowercased)
+ * @param password - Plain text password (min 8 chars)
+ * @param name - Optional customer name
+ * @returns Created customer
+ * @throws Error if email already exists
+ *
+ * @example
+ * ```typescript
+ * const { customer } = await createCustomer(
+ *   'customer@example.com',
+ *   'securePassword123',
+ *   'John Doe'
+ * )
+ * ```
+ */
+export async function createCustomer(email, password, name) {
+    const db = getDb();
+    // Hash password
+    const passwordHash = await hashPassword(password);
+    try {
+        const [customer] = await db
+            .insert(schema.customers)
+            .values({
+            email: email.toLowerCase().trim(),
+            name: name?.trim() || null,
+            passwordHash,
+            emailVerified: null, // Not verified initially
+        })
+            .returning();
+        // Claim any guest orders with matching email
+        let ordersClaimedCount = 0;
+        try {
+            const { claimGuestOrders } = await import('../../core/db/queries');
+            ordersClaimedCount = await claimGuestOrders(email, customer.id);
+        }
+        catch (claimError) {
+            // Log but don't fail registration - claiming orders is secondary
+            console.warn('[Auth] Failed to claim guest orders:', claimError);
+        }
+        return { customer, ordersClaimedCount };
+    }
+    catch (error) {
+        // Check for unique constraint violation
+        const err = error;
+        if (err.code === '23505' || err.cause?.code === '23505') {
+            throw new Error('An account with this email already exists');
+        }
+        throw error;
+    }
+}
+/**
+ * Authenticate a customer by email and password.
+ * Checks email verification status.
+ *
+ * @param email - Customer email
+ * @param password - Plain text password
+ * @param requireVerification - Whether to require email verification (default: true)
+ * @returns Authentication result
+ *
+ * @example
+ * ```typescript
+ * const result = await authenticateCustomer('customer@example.com', 'password123')
+ * if (result.success) {
+ *   console.log('Authenticated:', result.customer.email)
+ * } else {
+ *   console.log('Failed:', result.error)
+ * }
+ * ```
+ */
+export async function authenticateCustomer(email, password, requireVerification = true) {
+    const db = getDb();
+    // Find customer by email
+    const [customer] = await db
+        .select()
+        .from(schema.customers)
+        .where(eq(schema.customers.email, email.toLowerCase().trim()))
+        .limit(1);
+    if (!customer) {
+        return {
+            success: false,
+            error: 'Invalid email or password',
+            code: 'INVALID_CREDENTIALS',
+        };
+    }
+    // Verify password
+    const isValidPassword = await verifyPassword(password, customer.passwordHash);
+    if (!isValidPassword) {
+        return {
+            success: false,
+            error: 'Invalid email or password',
+            code: 'INVALID_CREDENTIALS',
+        };
+    }
+    // Check email verification
+    if (requireVerification && !customer.emailVerified) {
+        return {
+            success: false,
+            error: 'Please verify your email before signing in',
+            code: 'EMAIL_NOT_VERIFIED',
+        };
+    }
+    return { success: true, customer };
+}
+/**
+ * Get customer data for session (excludes sensitive fields).
+ *
+ * @param customerId - Customer UUID
+ * @returns Customer session data or null if not found
+ *
+ * @example
+ * ```typescript
+ * const session = await findCustomerForSession(customerId)
+ * if (session) {
+ *   console.log('Customer:', session.email)
+ * }
+ * ```
+ */
+export async function findCustomerForSession(customerId) {
+    const db = getDb();
+    const [customer] = await db
+        .select({
+        id: schema.customers.id,
+        email: schema.customers.email,
+        name: schema.customers.name,
+        emailVerified: schema.customers.emailVerified,
+    })
+        .from(schema.customers)
+        .where(eq(schema.customers.id, customerId))
+        .limit(1);
+    if (!customer) {
+        return null;
+    }
+    return {
+        id: customer.id,
+        email: customer.email,
+        name: customer.name,
+        emailVerified: !!customer.emailVerified,
+    };
+}
+/**
+ * Find a customer by email.
+ *
+ * @param email - Customer email
+ * @returns Customer or null if not found
+ */
+export async function findCustomerByEmail(email) {
+    const db = getDb();
+    const [customer] = await db
+        .select()
+        .from(schema.customers)
+        .where(eq(schema.customers.email, email.toLowerCase().trim()))
+        .limit(1);
+    return customer || null;
+}
+/**
+ * Find a customer by ID.
+ *
+ * @param customerId - Customer UUID
+ * @returns Customer or null if not found
+ */
+export async function findCustomerById(customerId) {
+    const db = getDb();
+    const [customer] = await db
+        .select()
+        .from(schema.customers)
+        .where(eq(schema.customers.id, customerId))
+        .limit(1);
+    return customer || null;
+}
+/**
+ * Update customer profile information.
+ *
+ * @param customerId - Customer UUID
+ * @param data - Fields to update
+ * @returns Updated customer
+ *
+ * @example
+ * ```typescript
+ * const updated = await updateCustomer(customerId, { name: 'Jane Doe' })
+ * ```
+ */
+export async function updateCustomer(customerId, data) {
+    const db = getDb();
+    const updateData = {};
+    if (data.name !== undefined) {
+        updateData.name = data.name?.trim() || null;
+    }
+    if (data.email !== undefined) {
+        updateData.email = data.email.toLowerCase().trim();
+    }
+    if (Object.keys(updateData).length === 0) {
+        // Nothing to update, return current customer
+        return findCustomerById(customerId);
+    }
+    const [customer] = await db
+        .update(schema.customers)
+        .set(updateData)
+        .where(eq(schema.customers.id, customerId))
+        .returning();
+    return customer || null;
+}
+/**
+ * Update customer password.
+ *
+ * @param customerId - Customer UUID
+ * @param newPassword - New plain text password
+ *
+ * @example
+ * ```typescript
+ * await updateCustomerPassword(customerId, 'newSecurePassword123')
+ * ```
+ */
+export async function updateCustomerPassword(customerId, newPassword) {
+    const db = getDb();
+    const passwordHash = await hashPassword(newPassword);
+    await db
+        .update(schema.customers)
+        .set({ passwordHash })
+        .where(eq(schema.customers.id, customerId));
+}
+/**
+ * Mark customer email as verified.
+ *
+ * @param customerId - Customer UUID
+ *
+ * @example
+ * ```typescript
+ * await markEmailVerified(customerId)
+ * ```
+ */
+export async function markEmailVerified(customerId) {
+    const db = getDb();
+    await db
+        .update(schema.customers)
+        .set({ emailVerified: new Date() })
+        .where(eq(schema.customers.id, customerId));
+}
+/**
+ * Check if email is already registered.
+ *
+ * @param email - Email to check
+ * @returns True if email exists
+ */
+export async function emailExists(email) {
+    const customer = await findCustomerByEmail(email);
+    return !!customer;
+}
+//# sourceMappingURL=customer-service.js.map

package/dist/auth/server/customer-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-service.js","sourceRoot":"","sources":["../../../src/auth/server/customer-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAyBzD,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,QAAgB,EAChB,IAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,gBAAgB;IAChB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACxB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACjC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI;YAC1B,YAAY;YACZ,aAAa,EAAE,IAAI,EAAE,yBAAyB;SAC/C,CAAC;aACD,SAAS,EAAE,CAAA;QAEd,6CAA6C;QAC7C,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;YAClE,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAA;IACzC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wCAAwC;QACxC,MAAM,GAAG,GAAG,KAAqD,CAAA;QACjE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,QAAgB,EAChB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,yBAAyB;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,mBAAmB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4CAA4C;YACnD,IAAI,EAAE,oBAAoB;SAC3B,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK;QAC7B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC3B,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;KAC9C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa;KACxC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,IAAuC;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,UAAU,GAAgC,EAAE,CAAA;IAElD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC7C,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,6CAA6C;QAC7C,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,UAAU,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;SAC1C,SAAS,EAAE,CAAA;IAEd,OAAO,QAAQ,IAAI,IAAI,CAAA;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACxB,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAClC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,QAAQ,CAAA;AACnB,CAAC"}

package/dist/auth/server/customer-session.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @rovela-ai/sdk/auth/server/customer-session
+ *
+ * Centralized session check for customer-side API routes and Server
+ * Components. Mirror of `requireAdmin()` on the admin side.
+ *
+ * # Why this exists
+ *
+ * Before this helper, customer API routes each had their own inline
+ * "check session.user.id, optionally check session.user.role" scaffolding.
+ * Some of them (e.g. `/api/account/orders`) simply checked `session.user.id`
+ * and trusted whatever was there — including an admin session that happened
+ * to be in the single shared cookie. Result: admin JWTs silently succeeded
+ * on customer endpoints, returning "no orders" for the admin UUID rather
+ * than rejecting the request.
+ *
+ * The admin cookie lives at a different name entirely
+ * (`__Secure-rovela.admin.session-token`), so an admin JWT CANNOT reach
+ * this helper because `getServerSession(createCustomerAuthOptions())` only
+ * reads the customer cookie (`__Secure-rovela.customer.session-token`).
+ *
+ * # Return contract
+ *
+ * Discriminated union, same as `requireAdmin`:
+ *   - `{ ok: true, customer }`  — caller proceeds
+ *   - `{ ok: false, response }` — caller returns `response` directly
+ *
+ * Never throws — any internal error converts to a safe response.
+ *
+ * @example
+ * ```ts
+ * export async function GET() {
+ *   const guard = await requireCustomer()
+ *   if (!guard.ok) return guard.response
+ *   const { customer } = guard
+ *   const orders = await findOrders({ customerId: customer.id })
+ *   return Response.json({ orders })
+ * }
+ * ```
+ */
+import { NextResponse } from 'next/server';
+/**
+ * Shape of the verified customer returned on success. Deliberately a subset
+ * of the full customer row so callers don't accidentally leak sensitive
+ * fields (passwordHash, emailVerifiedAt timestamp, etc).
+ */
+export interface VerifiedCustomer {
+    id: string;
+    email: string;
+    name: string | null;
+    emailVerified: boolean;
+}
+export type RequireCustomerResult = {
+    ok: true;
+    customer: VerifiedCustomer;
+} | {
+    ok: false;
+    response: NextResponse<{
+        error: string;
+        code: string;
+    }>;
+};
+/**
+ * Authenticate the current request as a customer.
+ *
+ * Resolves with either `{ ok: true, customer }` (caller may proceed) or
+ * `{ ok: false, response }` (caller returns the response to the client).
+ *
+ * @example
+ * ```ts
+ * export async function GET() {
+ *   const guard = await requireCustomer()
+ *   if (!guard.ok) return guard.response
+ *   // ...proceed with guard.customer
+ * }
+ * ```
+ */
+export declare function requireCustomer(): Promise<RequireCustomerResult>;
+//# sourceMappingURL=customer-session.d.ts.map

package/dist/auth/server/customer-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-session.d.ts","sourceRoot":"","sources":["../../../src/auth/server/customer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAS1C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAA;AAkB1E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAqCtE"}

package/dist/auth/server/customer-session.js

@@ -0,0 +1,103 @@
+/**
+ * @rovela-ai/sdk/auth/server/customer-session
+ *
+ * Centralized session check for customer-side API routes and Server
+ * Components. Mirror of `requireAdmin()` on the admin side.
+ *
+ * # Why this exists
+ *
+ * Before this helper, customer API routes each had their own inline
+ * "check session.user.id, optionally check session.user.role" scaffolding.
+ * Some of them (e.g. `/api/account/orders`) simply checked `session.user.id`
+ * and trusted whatever was there — including an admin session that happened
+ * to be in the single shared cookie. Result: admin JWTs silently succeeded
+ * on customer endpoints, returning "no orders" for the admin UUID rather
+ * than rejecting the request.
+ *
+ * The admin cookie lives at a different name entirely
+ * (`__Secure-rovela.admin.session-token`), so an admin JWT CANNOT reach
+ * this helper because `getServerSession(createCustomerAuthOptions())` only
+ * reads the customer cookie (`__Secure-rovela.customer.session-token`).
+ *
+ * # Return contract
+ *
+ * Discriminated union, same as `requireAdmin`:
+ *   - `{ ok: true, customer }`  — caller proceeds
+ *   - `{ ok: false, response }` — caller returns `response` directly
+ *
+ * Never throws — any internal error converts to a safe response.
+ *
+ * @example
+ * ```ts
+ * export async function GET() {
+ *   const guard = await requireCustomer()
+ *   if (!guard.ok) return guard.response
+ *   const { customer } = guard
+ *   const orders = await findOrders({ customerId: customer.id })
+ *   return Response.json({ orders })
+ * }
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { createCustomerAuthOptions } from '../config';
+import { findCustomerById } from './customer-service';
+// =============================================================================
+// Response helpers
+// =============================================================================
+function unauthorized() {
+    return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHORIZED' }, { status: 401 });
+}
+// =============================================================================
+// Main helper
+// =============================================================================
+/**
+ * Authenticate the current request as a customer.
+ *
+ * Resolves with either `{ ok: true, customer }` (caller may proceed) or
+ * `{ ok: false, response }` (caller returns the response to the client).
+ *
+ * @example
+ * ```ts
+ * export async function GET() {
+ *   const guard = await requireCustomer()
+ *   if (!guard.ok) return guard.response
+ *   // ...proceed with guard.customer
+ * }
+ * ```
+ */
+export async function requireCustomer() {
+    let rawSession;
+    try {
+        rawSession = await getServerSession(createCustomerAuthOptions());
+    }
+    catch (err) {
+        console.error('[requireCustomer] Failed to read session:', err);
+        return { ok: false, response: unauthorized() };
+    }
+    const sessionUser = rawSession?.user;
+    if (!sessionUser?.id) {
+        return { ok: false, response: unauthorized() };
+    }
+    // Re-validate the customer exists in the DB. Catches orphan JWTs where
+    // the customer row was deleted after the token was minted.
+    let customer;
+    try {
+        const row = await findCustomerById(sessionUser.id);
+        if (!row) {
+            return { ok: false, response: unauthorized() };
+        }
+        customer = {
+            id: row.id,
+            email: row.email,
+            name: row.name ?? null,
+            emailVerified: !!row.emailVerified,
+        };
+    }
+    catch (err) {
+        console.error('[requireCustomer] Failed to load customer row:', err);
+        return { ok: false, response: unauthorized() };
+    }
+    return { ok: true, customer };
+}
+//# sourceMappingURL=customer-session.js.map

package/dist/auth/server/customer-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-session.js","sourceRoot":"","sources":["../../../src/auth/server/customer-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAsBrD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAGD,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,WAAW,GAAI,UAEZ,EAAE,IAAI,CAAA;IAEf,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,QAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;QAChD,CAAC;QACD,QAAQ,GAAG;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa;SACnC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC"}

package/dist/auth/server/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @rovela/sdk/auth/server
+ *
+ * Server-side authentication utilities.
+ * Import from '@rovela/sdk/auth/server' in server components and API routes.
+ */
+export { hashPassword, verifyPassword, validatePassword, MIN_PASSWORD_LENGTH, } from './password';
+export { createCustomer, authenticateCustomer, findCustomerForSession, findCustomerByEmail, findCustomerById, updateCustomer, updateCustomerPassword, markEmailVerified, emailExists, } from './customer-service';
+export type { CreateCustomerResult, AuthenticateResult, AuthenticateError, } from './customer-service';
+export { requireCustomer } from './customer-session';
+export type { VerifiedCustomer, RequireCustomerResult } from './customer-session';
+export { createVerificationToken, verifyEmail, deleteVerificationTokens, resendVerificationEmail, isEmailVerified, cleanupExpiredTokens, } from './verification-service';
+export { requestPasswordReset, validateResetToken, resetPassword, deletePasswordResetTokens, cleanupExpiredResetTokens, } from './password-reset-service';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,GACZ,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAGjF,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA"}

package/dist/auth/server/index.js

@@ -0,0 +1,17 @@
+/**
+ * @rovela/sdk/auth/server
+ *
+ * Server-side authentication utilities.
+ * Import from '@rovela/sdk/auth/server' in server components and API routes.
+ */
+// Password utilities
+export { hashPassword, verifyPassword, validatePassword, MIN_PASSWORD_LENGTH, } from './password';
+// Customer service
+export { createCustomer, authenticateCustomer, findCustomerForSession, findCustomerByEmail, findCustomerById, updateCustomer, updateCustomerPassword, markEmailVerified, emailExists, } from './customer-service';
+// Customer session guard (mirror of requireAdmin on the admin side)
+export { requireCustomer } from './customer-session';
+// Verification service
+export { createVerificationToken, verifyEmail, deleteVerificationTokens, resendVerificationEmail, isEmailVerified, cleanupExpiredTokens, } from './verification-service';
+// Password reset service
+export { requestPasswordReset, validateResetToken, resetPassword, deletePasswordResetTokens, cleanupExpiredResetTokens, } from './password-reset-service';
+//# sourceMappingURL=index.js.map

package/dist/auth/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAqB;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,WAAW,GACZ,MAAM,oBAAoB,CAAA;AAO3B,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,uBAAuB;AACvB,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,yBAAyB;AACzB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAA"}

package/dist/auth/server/password-reset-service.d.ts

@@ -0,0 +1,87 @@
+/**
+ * @rovela/sdk/auth/server/password-reset-service
+ *
+ * Password reset token management.
+ * Handles creating, validating, and using reset tokens.
+ * Each store has its own database (via Neon branches) - no tenant isolation needed.
+ */
+/**
+ * Request a password reset for a customer.
+ * Creates a token and sends reset email.
+ *
+ * Note: Always returns success to prevent email enumeration attacks.
+ *
+ * @param email - Customer email address
+ * @returns Always returns success (security best practice)
+ *
+ * @example
+ * ```typescript
+ * const result = await requestPasswordReset('customer@example.com')
+ * // Always show "If an account exists, we've sent a reset email"
+ * ```
+ */
+export declare function requestPasswordReset(email: string): Promise<{
+    success: boolean;
+}>;
+/**
+ * Validate a password reset token.
+ * Does NOT consume the token - use resetPassword() for that.
+ *
+ * @param token - Reset token from email link
+ * @returns Validation result
+ *
+ * @example
+ * ```typescript
+ * const result = await validateResetToken(token)
+ * if (result.valid) {
+ *   // Show password reset form
+ * } else {
+ *   // Show error message
+ * }
+ * ```
+ */
+export declare function validateResetToken(token: string): Promise<{
+    valid: boolean;
+    error?: string;
+}>;
+/**
+ * Reset password using a token.
+ * Validates the token, updates the password, and deletes the token.
+ *
+ * @param token - Reset token from email link
+ * @param newPassword - New password (plain text, will be hashed)
+ * @returns Reset result
+ *
+ * @example
+ * ```typescript
+ * const result = await resetPassword(token, 'newSecurePassword123')
+ * if (result.success) {
+ *   // Redirect to login
+ * } else {
+ *   // Show error
+ * }
+ * ```
+ */
+export declare function resetPassword(token: string, newPassword: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+/**
+ * Delete all password reset tokens for a customer.
+ *
+ * @param customerId - Customer UUID
+ *
+ * @example
+ * ```typescript
+ * await deletePasswordResetTokens(customerId)
+ * ```
+ */
+export declare function deletePasswordResetTokens(customerId: string): Promise<void>;
+/**
+ * Clean up expired password reset tokens.
+ * Should be called periodically (e.g., via cron job).
+ *
+ * @returns Number of tokens deleted
+ */
+export declare function cleanupExpiredResetTokens(): Promise<number>;
+//# sourceMappingURL=password-reset-service.d.ts.map

package/dist/auth/server/password-reset-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-service.d.ts","sourceRoot":"","sources":["../../../src/auth/server/password-reset-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAsCD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAC,CA+BD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAC,CAyCD;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CASjE"}