@solvapay/auth 1.0.0-preview.10

package/README.md

@@ -0,0 +1,247 @@
+# @solvapay/auth
+
+Authentication adapters for extracting user IDs from requests. Provides adapters for Supabase and mock/testing scenarios.
+
+## Installation
+
+```bash
+pnpm add @solvapay/auth
+```
+
+If using SupabaseAuthAdapter, also install `jose`:
+
+```bash
+pnpm add jose
+```
+
+## Usage
+
+### SupabaseAuthAdapter
+
+Extract user ID from Supabase JWT tokens:
+
+```ts
+import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
+
+const auth = new SupabaseAuthAdapter({
+  jwtSecret: process.env.SUPABASE_JWT_SECRET!
+});
+
+// In your API route
+export async function POST(request: Request) {
+  const userId = await auth.getUserIdFromRequest(request);
+  
+  if (!userId) {
+    return new Response('Unauthorized', { status: 401 });
+  }
+  
+  // Use userId as cache key and externalRef
+  // The ensureCustomer method returns the SolvaPay backend customer reference
+  const solvaPay = createSolvaPay({ apiKey: process.env.SOLVAPAY_SECRET_KEY! });
+  const ensuredCustomerRef = await solvaPay.ensureCustomer(userId, userId);
+  const customer = await solvaPay.getCustomer({ customerRef: ensuredCustomerRef });
+  
+  return Response.json({ userId, customer });
+}
+```
+
+### MockAuthAdapter
+
+For testing and examples:
+
+```ts
+import { MockAuthAdapter } from '@solvapay/auth/mock';
+
+const auth = new MockAuthAdapter();
+
+// Set header: x-mock-user-id: user_123
+// Or set env: MOCK_USER_ID=user_123
+
+const userId = await auth.getUserIdFromRequest(request);
+```
+
+### Integration with SolvaPay Server SDK
+
+Use auth adapters with the `getCustomerRef` option:
+
+```ts
+import { createSolvaPay } from '@solvapay/server';
+import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
+
+const auth = new SupabaseAuthAdapter({
+  jwtSecret: process.env.SUPABASE_JWT_SECRET!
+});
+
+const solvaPay = createSolvaPay({ apiKey: process.env.SOLVAPAY_SECRET_KEY! });
+
+// Use with Next.js adapter
+export const POST = solvaPay.payable({ agent: 'my-api' }).next(
+  async (args) => {
+    return { result: 'success' };
+  },
+  {
+    getCustomerRef: async (req) => {
+      const userId = await auth.getUserIdFromRequest(req);
+      return userId ?? 'anonymous';
+    }
+  }
+);
+```
+
+## Next.js Route Utilities
+
+The package also provides helper functions for extracting user information in Next.js API routes:
+
+### getUserIdFromRequest
+
+Extract user ID from request headers (commonly set by middleware):
+
+```ts
+import { getUserIdFromRequest } from '@solvapay/auth';
+
+export async function GET(request: Request) {
+  const userId = getUserIdFromRequest(request);
+  
+  if (!userId) {
+    return new Response('Unauthorized', { status: 401 });
+  }
+  
+  // Use userId...
+}
+```
+
+### requireUserId
+
+Require user ID or return error response:
+
+```ts
+import { requireUserId } from '@solvapay/auth';
+
+export async function GET(request: Request) {
+  const userIdOrError = requireUserId(request);
+  
+  if (userIdOrError instanceof Response) {
+    return userIdOrError; // Returns 401 error
+  }
+  
+  // userIdOrError is now a string
+  const userId = userIdOrError;
+}
+```
+
+### getUserEmailFromRequest
+
+Extract email from Supabase JWT token in Authorization header:
+
+```ts
+import { getUserEmailFromRequest } from '@solvapay/auth';
+
+export async function GET(request: Request) {
+  const email = await getUserEmailFromRequest(request);
+  // Returns email string or null
+}
+```
+
+### getUserNameFromRequest
+
+Extract name from Supabase JWT token in Authorization header:
+
+```ts
+import { getUserNameFromRequest } from '@solvapay/auth';
+
+export async function GET(request: Request) {
+  const name = await getUserNameFromRequest(request);
+  // Returns name string or null
+}
+```
+
+**Note:** `getUserEmailFromRequest` and `getUserNameFromRequest` require the `SUPABASE_JWT_SECRET` environment variable to be set, or you can pass it as an option:
+
+```ts
+const email = await getUserEmailFromRequest(request, {
+  jwtSecret: process.env.SUPABASE_JWT_SECRET!
+});
+```
+
+## API Reference
+
+### AuthAdapter Interface
+
+```ts
+interface AuthAdapter {
+  getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+```
+
+### SupabaseAuthAdapter
+
+```ts
+class SupabaseAuthAdapter implements AuthAdapter {
+  constructor(config: { jwtSecret: string });
+  getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+```
+
+**Configuration:**
+- `jwtSecret`: Supabase JWT secret from dashboard (Settings → API → JWT Secret)
+
+**Returns:** User ID from `sub` claim or `null` if missing/invalid
+
+### MockAuthAdapter
+
+```ts
+class MockAuthAdapter implements AuthAdapter {
+  getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+```
+
+**Behavior:**
+1. Checks `x-mock-user-id` header
+2. Falls back to `MOCK_USER_ID` environment variable
+3. Returns `null` if neither is found
+
+## Requirements
+
+- **Node.js**: >=18.17
+- **jose**: >=5.0.0 (peer dependency, required only for SupabaseAuthAdapter)
+
+## Edge Runtime Support
+
+Both adapters and Next.js utilities work in Edge runtimes (Vercel Edge Functions, Cloudflare Workers, etc.). SupabaseAuthAdapter and JWT utilities use dynamic imports for `jose` to ensure Edge compatibility.
+
+## Next.js Integration
+
+These utilities work seamlessly with Next.js middleware. Typically, you'll set the `x-user-id` header in your middleware after authentication:
+
+```ts
+// middleware.ts
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+  // Extract user ID from your auth system (Supabase, Auth0, etc.)
+  const userId = await getUserIdFromAuth(request);
+  
+  // Clone the request and add user ID header
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set('x-user-id', userId);
+  
+  return NextResponse.next({
+    request: {
+      headers: requestHeaders,
+    },
+  });
+}
+```
+
+Then in your API routes, use the utilities:
+
+```ts
+import { requireUserId } from '@solvapay/auth';
+
+export async function GET(request: Request) {
+  const userId = requireUserId(request);
+  // userId is guaranteed to exist or an error response is returned
+}
+```
+

package/dist/adapter-4HTpALyc.d.cts

@@ -0,0 +1,32 @@
+/**
+ * Auth Adapter Interface
+ *
+ * Defines the contract for authentication adapters that extract user IDs from requests.
+ * Implementations should never throw - return null if authentication fails or is missing.
+ */
+/**
+ * Request-like object that has headers
+ */
+interface RequestLike {
+    headers: Headers | {
+        get(name: string): string | null;
+    };
+}
+/**
+ * Auth adapter interface for extracting user IDs from requests
+ */
+interface AuthAdapter {
+    /**
+     * Extract the authenticated user ID from a request
+     *
+     * @param req - Request object or object with headers
+     * @returns The user ID string if authenticated, null otherwise
+     *
+     * @remarks
+     * This method should never throw. If authentication fails or is missing,
+     * return null and let the caller decide how to handle unauthenticated requests.
+     */
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export type { AuthAdapter as A, RequestLike as R };

package/dist/adapter-4HTpALyc.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Auth Adapter Interface
+ *
+ * Defines the contract for authentication adapters that extract user IDs from requests.
+ * Implementations should never throw - return null if authentication fails or is missing.
+ */
+/**
+ * Request-like object that has headers
+ */
+interface RequestLike {
+    headers: Headers | {
+        get(name: string): string | null;
+    };
+}
+/**
+ * Auth adapter interface for extracting user IDs from requests
+ */
+interface AuthAdapter {
+    /**
+     * Extract the authenticated user ID from a request
+     *
+     * @param req - Request object or object with headers
+     * @returns The user ID string if authenticated, null otherwise
+     *
+     * @remarks
+     * This method should never throw. If authentication fails or is missing,
+     * return null and let the caller decide how to handle unauthenticated requests.
+     */
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export type { AuthAdapter as A, RequestLike as R };

package/dist/chunk-2P77RLPB.js

@@ -0,0 +1,77 @@
+// src/next-utils.ts
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    return payload.email ? String(payload.email) : null;
+  } catch {
+    return null;
+  }
+}
+async function getUserNameFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    const name = payload.user_metadata?.full_name || payload.user_metadata?.name || payload.name || null;
+    return name ? String(name) : null;
+  } catch {
+    return null;
+  }
+}
+function requireUserId(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  const errorMessage = options?.errorMessage || "Unauthorized";
+  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
+  const userId = request.headers.get(headerName);
+  if (!userId) {
+    return new Response(
+      JSON.stringify({ error: errorMessage, details: errorDetails }),
+      {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+  return userId;
+}
+
+export {
+  getUserIdFromRequest,
+  getUserEmailFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+};

package/dist/chunk-OETEFHW6.js

@@ -0,0 +1,18 @@
+// src/mock.ts
+var MockAuthAdapter = class {
+  async getUserIdFromRequest(req) {
+    const headers = "headers" in req ? req.headers : req;
+    const headerUserId = headers.get("x-mock-user-id");
+    if (headerUserId) {
+      return headerUserId;
+    }
+    if (typeof process !== "undefined" && process.env.MOCK_USER_ID) {
+      return process.env.MOCK_USER_ID;
+    }
+    return null;
+  }
+};
+
+export {
+  MockAuthAdapter
+};

package/dist/index.cjs

@@ -0,0 +1,133 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  MockAuthAdapter: () => MockAuthAdapter,
+  getUserEmailFromRequest: () => getUserEmailFromRequest,
+  getUserIdFromRequest: () => getUserIdFromRequest,
+  getUserNameFromRequest: () => getUserNameFromRequest,
+  requireUserId: () => requireUserId
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/mock.ts
+var MockAuthAdapter = class {
+  async getUserIdFromRequest(req) {
+    const headers = "headers" in req ? req.headers : req;
+    const headerUserId = headers.get("x-mock-user-id");
+    if (headerUserId) {
+      return headerUserId;
+    }
+    if (typeof process !== "undefined" && process.env.MOCK_USER_ID) {
+      return process.env.MOCK_USER_ID;
+    }
+    return null;
+  }
+};
+
+// src/next-utils.ts
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    return payload.email ? String(payload.email) : null;
+  } catch {
+    return null;
+  }
+}
+async function getUserNameFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    const name = payload.user_metadata?.full_name || payload.user_metadata?.name || payload.name || null;
+    return name ? String(name) : null;
+  } catch {
+    return null;
+  }
+}
+function requireUserId(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  const errorMessage = options?.errorMessage || "Unauthorized";
+  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
+  const userId = request.headers.get(headerName);
+  if (!userId) {
+    return new Response(
+      JSON.stringify({ error: errorMessage, details: errorDetails }),
+      {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+  return userId;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MockAuthAdapter,
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+});

package/dist/index.d.cts

@@ -0,0 +1,3 @@
+export { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.cjs';
+export { MockAuthAdapter, MockAuthAdapter as MockAuthAdapterType } from './mock.cjs';
+export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId } from './next-utils.cjs';

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.js';
+export { MockAuthAdapter, MockAuthAdapter as MockAuthAdapterType } from './mock.js';
+export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId } from './next-utils.js';

package/dist/index.js

@@ -0,0 +1,16 @@
+import {
+  MockAuthAdapter
+} from "./chunk-OETEFHW6.js";
+import {
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+} from "./chunk-2P77RLPB.js";
+export {
+  MockAuthAdapter,
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+};

package/dist/mock.cjs

@@ -0,0 +1,42 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/mock.ts
+var mock_exports = {};
+__export(mock_exports, {
+  MockAuthAdapter: () => MockAuthAdapter
+});
+module.exports = __toCommonJS(mock_exports);
+var MockAuthAdapter = class {
+  async getUserIdFromRequest(req) {
+    const headers = "headers" in req ? req.headers : req;
+    const headerUserId = headers.get("x-mock-user-id");
+    if (headerUserId) {
+      return headerUserId;
+    }
+    if (typeof process !== "undefined" && process.env.MOCK_USER_ID) {
+      return process.env.MOCK_USER_ID;
+    }
+    return null;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MockAuthAdapter
+});

package/dist/mock.d.cts

@@ -0,0 +1,33 @@
+import { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.cjs';
+
+/**
+ * Mock Auth Adapter
+ *
+ * Simple adapter for testing and examples that extracts user ID from headers
+ * or environment variables. No dependencies required.
+ */
+
+/**
+ * Mock authentication adapter
+ *
+ * Extracts user ID from `x-mock-user-id` header or `MOCK_USER_ID` environment variable.
+ * Useful for testing, examples, and development where real authentication isn't needed.
+ *
+ * @example
+ * ```ts
+ * import { MockAuthAdapter } from '@solvapay/auth/mock';
+ *
+ * const auth = new MockAuthAdapter();
+ *
+ * // In tests or examples:
+ * // Set header: x-mock-user-id: user_123
+ * // Or set env: MOCK_USER_ID=user_123
+ *
+ * const userId = await auth.getUserIdFromRequest(request);
+ * ```
+ */
+declare class MockAuthAdapter implements AuthAdapter {
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export { MockAuthAdapter };

package/dist/mock.d.ts

@@ -0,0 +1,33 @@
+import { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.js';
+
+/**
+ * Mock Auth Adapter
+ *
+ * Simple adapter for testing and examples that extracts user ID from headers
+ * or environment variables. No dependencies required.
+ */
+
+/**
+ * Mock authentication adapter
+ *
+ * Extracts user ID from `x-mock-user-id` header or `MOCK_USER_ID` environment variable.
+ * Useful for testing, examples, and development where real authentication isn't needed.
+ *
+ * @example
+ * ```ts
+ * import { MockAuthAdapter } from '@solvapay/auth/mock';
+ *
+ * const auth = new MockAuthAdapter();
+ *
+ * // In tests or examples:
+ * // Set header: x-mock-user-id: user_123
+ * // Or set env: MOCK_USER_ID=user_123
+ *
+ * const userId = await auth.getUserIdFromRequest(request);
+ * ```
+ */
+declare class MockAuthAdapter implements AuthAdapter {
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export { MockAuthAdapter };

package/dist/mock.js

@@ -0,0 +1,6 @@
+import {
+  MockAuthAdapter
+} from "./chunk-OETEFHW6.js";
+export {
+  MockAuthAdapter
+};

package/dist/next-utils.cjs

@@ -0,0 +1,114 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/next-utils.ts
+var next_utils_exports = {};
+__export(next_utils_exports, {
+  getUserEmailFromRequest: () => getUserEmailFromRequest,
+  getUserIdFromRequest: () => getUserIdFromRequest,
+  getUserNameFromRequest: () => getUserNameFromRequest,
+  requireUserId: () => requireUserId
+});
+module.exports = __toCommonJS(next_utils_exports);
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    return payload.email ? String(payload.email) : null;
+  } catch {
+    return null;
+  }
+}
+async function getUserNameFromRequest(request, options) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice(7);
+  if (!token) {
+    return null;
+  }
+  try {
+    const { jwtVerify } = await import("jose");
+    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+    if (!jwtSecret) {
+      return null;
+    }
+    const secret = new TextEncoder().encode(jwtSecret);
+    const { payload } = await jwtVerify(token, secret, {
+      algorithms: ["HS256"]
+    });
+    const name = payload.user_metadata?.full_name || payload.user_metadata?.name || payload.name || null;
+    return name ? String(name) : null;
+  } catch {
+    return null;
+  }
+}
+function requireUserId(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  const errorMessage = options?.errorMessage || "Unauthorized";
+  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
+  const userId = request.headers.get(headerName);
+  if (!userId) {
+    return new Response(
+      JSON.stringify({ error: errorMessage, details: errorDetails }),
+      {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+  return userId;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+});

package/dist/next-utils.d.cts

@@ -0,0 +1,85 @@
+/**
+ * Next.js Route Utilities
+ *
+ * Helper functions for common patterns in Next.js API routes.
+ * These utilities work with authenticated requests where user IDs
+ * have been extracted and set in headers (e.g., by middleware).
+ *
+ * Note: These functions work with the standard web Request API
+ * and can be used with Next.js NextRequest (which extends Request)
+ */
+/**
+ * Extract user ID from request headers.
+ * Checks for 'x-user-id' header (commonly set by middleware after authentication).
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User ID string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserIdFromRequest } from '@solvapay/auth';
+ *
+ * const userId = getUserIdFromRequest(request);
+ * if (!userId) {
+ *   return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+ * }
+ * ```
+ */
+declare function getUserIdFromRequest(request: Request, options?: {
+    headerName?: string;
+}): string | null;
+/**
+ * Extract user email from Supabase JWT token in Authorization header.
+ * Returns null if token is missing or invalid.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User email string or null if not found
+ */
+declare function getUserEmailFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Extract user name from Supabase JWT token in Authorization header.
+ * Returns null if token is missing or invalid.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User name string or null if not found
+ */
+declare function getUserNameFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Require user ID from request headers.
+ * Returns an error response if user ID is not found.
+ *
+ * This function returns a standard Response object that works with Next.js.
+ * In Next.js, NextResponse extends Response, so this is compatible.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns Either the user ID string or a Response error object
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { requireUserId } from '@solvapay/auth';
+ *
+ * const userIdOrError = requireUserId(request);
+ * if (userIdOrError instanceof Response) {
+ *   return userIdOrError; // Returns 401 error
+ * }
+ * // userIdOrError is now a string
+ * const userId = userIdOrError;
+ * ```
+ */
+declare function requireUserId(request: Request, options?: {
+    headerName?: string;
+    errorMessage?: string;
+    errorDetails?: string;
+}): string | Response;
+
+export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId };

package/dist/next-utils.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Next.js Route Utilities
+ *
+ * Helper functions for common patterns in Next.js API routes.
+ * These utilities work with authenticated requests where user IDs
+ * have been extracted and set in headers (e.g., by middleware).
+ *
+ * Note: These functions work with the standard web Request API
+ * and can be used with Next.js NextRequest (which extends Request)
+ */
+/**
+ * Extract user ID from request headers.
+ * Checks for 'x-user-id' header (commonly set by middleware after authentication).
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User ID string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserIdFromRequest } from '@solvapay/auth';
+ *
+ * const userId = getUserIdFromRequest(request);
+ * if (!userId) {
+ *   return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+ * }
+ * ```
+ */
+declare function getUserIdFromRequest(request: Request, options?: {
+    headerName?: string;
+}): string | null;
+/**
+ * Extract user email from Supabase JWT token in Authorization header.
+ * Returns null if token is missing or invalid.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User email string or null if not found
+ */
+declare function getUserEmailFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Extract user name from Supabase JWT token in Authorization header.
+ * Returns null if token is missing or invalid.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns User name string or null if not found
+ */
+declare function getUserNameFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Require user ID from request headers.
+ * Returns an error response if user ID is not found.
+ *
+ * This function returns a standard Response object that works with Next.js.
+ * In Next.js, NextResponse extends Response, so this is compatible.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @returns Either the user ID string or a Response error object
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { requireUserId } from '@solvapay/auth';
+ *
+ * const userIdOrError = requireUserId(request);
+ * if (userIdOrError instanceof Response) {
+ *   return userIdOrError; // Returns 401 error
+ * }
+ * // userIdOrError is now a string
+ * const userId = userIdOrError;
+ * ```
+ */
+declare function requireUserId(request: Request, options?: {
+    headerName?: string;
+    errorMessage?: string;
+    errorDetails?: string;
+}): string | Response;
+
+export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId };

package/dist/next-utils.js

@@ -0,0 +1,12 @@
+import {
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+} from "./chunk-2P77RLPB.js";
+export {
+  getUserEmailFromRequest,
+  getUserIdFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+};

package/dist/supabase.cjs

@@ -0,0 +1,69 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/supabase.ts
+var supabase_exports = {};
+__export(supabase_exports, {
+  SupabaseAuthAdapter: () => SupabaseAuthAdapter
+});
+module.exports = __toCommonJS(supabase_exports);
+var SupabaseAuthAdapter = class {
+  jwtSecret;
+  constructor(config) {
+    if (!config.jwtSecret) {
+      throw new Error("SupabaseAuthAdapter requires jwtSecret in config");
+    }
+    this.jwtSecret = new TextEncoder().encode(config.jwtSecret);
+  }
+  async getUserIdFromRequest(req) {
+    try {
+      const headers = "headers" in req ? req.headers : req;
+      const authHeader = headers.get("authorization");
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return null;
+      }
+      const token = authHeader.slice(7);
+      if (!token) {
+        return null;
+      }
+      const { jwtVerify } = await import("jose");
+      const { payload } = await jwtVerify(token, this.jwtSecret, {
+        algorithms: ["HS256"]
+      });
+      const userId = payload.sub ? String(payload.sub) : null;
+      return userId;
+    } catch {
+      return null;
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SupabaseAuthAdapter
+});

package/dist/supabase.d.cts

@@ -0,0 +1,42 @@
+import { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.cjs';
+
+/**
+ * Supabase Auth Adapter
+ *
+ * Extracts user ID from Supabase JWT tokens using HS256 verification.
+ * Works in both Node.js and Edge runtimes (uses dynamic import for jose).
+ */
+
+interface SupabaseAuthAdapterConfig {
+    /**
+     * Supabase JWT secret (from Supabase dashboard: Settings → API → JWT Secret)
+     */
+    jwtSecret: string;
+}
+/**
+ * Supabase authentication adapter
+ *
+ * Verifies Supabase JWT tokens and extracts the user ID from the `sub` claim.
+ * Uses dynamic import for jose to keep the package lean and Edge-compatible.
+ *
+ * @example
+ * ```ts
+ * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
+ *
+ * const auth = new SupabaseAuthAdapter({
+ *   jwtSecret: process.env.SUPABASE_JWT_SECRET!
+ * });
+ *
+ * const userId = await auth.getUserIdFromRequest(request);
+ * if (!userId) {
+ *   return new Response('Unauthorized', { status: 401 });
+ * }
+ * ```
+ */
+declare class SupabaseAuthAdapter implements AuthAdapter {
+    private jwtSecret;
+    constructor(config: SupabaseAuthAdapterConfig);
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export { SupabaseAuthAdapter, type SupabaseAuthAdapterConfig };

package/dist/supabase.d.ts

@@ -0,0 +1,42 @@
+import { A as AuthAdapter, R as RequestLike } from './adapter-4HTpALyc.js';
+
+/**
+ * Supabase Auth Adapter
+ *
+ * Extracts user ID from Supabase JWT tokens using HS256 verification.
+ * Works in both Node.js and Edge runtimes (uses dynamic import for jose).
+ */
+
+interface SupabaseAuthAdapterConfig {
+    /**
+     * Supabase JWT secret (from Supabase dashboard: Settings → API → JWT Secret)
+     */
+    jwtSecret: string;
+}
+/**
+ * Supabase authentication adapter
+ *
+ * Verifies Supabase JWT tokens and extracts the user ID from the `sub` claim.
+ * Uses dynamic import for jose to keep the package lean and Edge-compatible.
+ *
+ * @example
+ * ```ts
+ * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
+ *
+ * const auth = new SupabaseAuthAdapter({
+ *   jwtSecret: process.env.SUPABASE_JWT_SECRET!
+ * });
+ *
+ * const userId = await auth.getUserIdFromRequest(request);
+ * if (!userId) {
+ *   return new Response('Unauthorized', { status: 401 });
+ * }
+ * ```
+ */
+declare class SupabaseAuthAdapter implements AuthAdapter {
+    private jwtSecret;
+    constructor(config: SupabaseAuthAdapterConfig);
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+
+export { SupabaseAuthAdapter, type SupabaseAuthAdapterConfig };

package/dist/supabase.js

@@ -0,0 +1,34 @@
+// src/supabase.ts
+var SupabaseAuthAdapter = class {
+  jwtSecret;
+  constructor(config) {
+    if (!config.jwtSecret) {
+      throw new Error("SupabaseAuthAdapter requires jwtSecret in config");
+    }
+    this.jwtSecret = new TextEncoder().encode(config.jwtSecret);
+  }
+  async getUserIdFromRequest(req) {
+    try {
+      const headers = "headers" in req ? req.headers : req;
+      const authHeader = headers.get("authorization");
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return null;
+      }
+      const token = authHeader.slice(7);
+      if (!token) {
+        return null;
+      }
+      const { jwtVerify } = await import("jose");
+      const { payload } = await jwtVerify(token, this.jwtSecret, {
+        algorithms: ["HS256"]
+      });
+      const userId = payload.sub ? String(payload.sub) : null;
+      return userId;
+    } catch {
+      return null;
+    }
+  }
+};
+export {
+  SupabaseAuthAdapter
+};

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@solvapay/auth",
+  "version": "1.0.0-preview.10",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./supabase": {
+      "types": "./dist/supabase.d.ts",
+      "import": "./dist/supabase.js",
+      "require": "./dist/supabase.cjs"
+    },
+    "./mock": {
+      "types": "./dist/mock.d.ts",
+      "import": "./dist/mock.js",
+      "require": "./dist/mock.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/solvapay/solvapay-sdk.git",
+    "directory": "packages/auth"
+  },
+  "engines": {
+    "node": ">=18.17"
+  },
+  "sideEffects": false,
+  "peerDependencies": {
+    "jose": "^5.0.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.1",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/supabase.ts src/mock.ts src/next-utils.ts --format esm,cjs --dts --tsconfig tsconfig.build.json",
+    "test": "vitest run || exit 0",
+    "test:watch": "vitest",
+    "lint": "echo 'no lint yet'"
+  }
+}