@addon-pass/sdk 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Timothy Z.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,147 @@
+# AddonPass middleware SDK
+
+`@addon-pass/sdk` protects private Stremio JSON routes in the same process as the add-on handlers.
+
+The SDK is currently a Base Sepolia `0.x` release. Install the reviewed public
+package directly:
+
+```sh
+pnpm add @addon-pass/sdk@0.1.3
+```
+
+The public SDK repository contains only middleware source. The AddonPass
+application, deployment configuration, credentials, and Sepolia contract source
+remain private.
+
+## Request boundary
+
+For a request such as:
+
+```text
+/addonpass/{token}/stream/movie/addonpass:reference-film.json
+```
+
+the middleware:
+
+1. accepts only a canonical 43-character, unpadded base64url token containing 32 bytes;
+2. hashes the decoded bytes locally with Ethereum `keccak256`;
+3. sends only the hash to `POST /v1/entitlements/verify` with the add-on-scoped integration credential;
+4. checks the returned plan against the configured allowlist;
+5. removes the bearer-token prefix before the add-on handler runs; and
+6. serves the add-on response only for active or grace access.
+
+The raw token is never sent to AddonPass. Do not log request URLs, attach third-party analytics to protected routes, or expose the same handlers on another path, port, or hostname.
+
+## Supported adapters
+
+- Framework-neutral Fetch handler: `createFetchStremioHandler`
+- Native Node HTTP handler: `createNodeStremioHandler`
+- Express 5 middleware: `@addon-pass/sdk/express`
+- Fastify 5 pre-handler: `@addon-pass/sdk/fastify`
+
+The framework packages are optional peers. Import only the adapter used by the add-on.
+
+## Native Node example
+
+```ts
+import { createServer } from "node:http";
+
+import {
+  AddonPassVerifier,
+  createNodeStremioHandler,
+} from "@addon-pass/sdk";
+
+const verifier = new AddonPassVerifier({
+  allowedPlanIds: ["PLAN_ID"],
+  apiBaseUrl: "https://api.addonpass.example",
+  integrationCredential: "ADDON_SCOPED_CREDENTIAL",
+});
+
+The AddonPass integration test subscribes with a hidden test plan that reports no plan id, so it passes regardless of `allowedPlanIds`.
+
+const handle = createNodeStremioHandler({
+  access: {
+    addonId: "com.example.private-addon",
+    addonName: "Private Add-on",
+    managementUrl: "https://addonpass.example/subscriptions",
+  },
+  verifier,
+  upstream: async (request, authorization) => {
+    // request.url now contains /manifest.json or the normal Stremio resource
+    // path. authorization contains the verified decision and parsed route, but
+    // never the raw bearer token.
+    return Response.json({
+      resource: authorization.route.resource,
+      path: new URL(request.url).pathname,
+    });
+  },
+});
+
+createServer((request, response) => {
+  void handle(request, response);
+}).listen(3002, "127.0.0.1");
+```
+
+Use placeholders in source control. Load the API URL, plan IDs, management URL, and integration credential from the add-on process environment.
+
+## Express and Fastify
+
+Mount the Express middleware globally before every add-on handler. The middleware rejects `/manifest.json` without a token and rewrites an entitled request before Express performs downstream routing.
+
+```ts
+import express from "express";
+import {
+  createExpressStremioMiddleware,
+  expressAddonPassAuthorization,
+} from "@addon-pass/sdk/express";
+
+const app = express();
+app.use(createExpressStremioMiddleware({ access, verifier }));
+app.get("/manifest.json", (_request, response) => {
+  const authorization = expressAddonPassAuthorization(response);
+  response.json(buildManifest(authorization));
+});
+```
+
+For Fastify, attach the same protection instance to every protected route and read the request-scoped result from it.
+
+```ts
+import { createFastifyStremioProtection } from "@addon-pass/sdk/fastify";
+
+const protection = createFastifyStremioProtection({ access, verifier });
+app.get(
+  "/addonpass/:token/manifest.json",
+  { preHandler: protection.preHandler },
+  (request) => buildManifest(protection.authorization(request)),
+);
+```
+
+Do not register an unprotected copy of either handler.
+
+## Verification behavior
+
+| State | Result |
+| --- | --- |
+| Active or grace | Invoke the add-on handler and return its Stremio JSON. |
+| Expired, cancelled, or authorization ended | Return valid Stremio JSON with the configured management URL; do not invoke the add-on. |
+| Unknown or malformed token | Return a generic `404` without disclosing entitlement state. |
+| API network error or `5xx` | Use the optional safe-block contract fallback when configured; otherwise return `503`. |
+| Rejected credential, scope mismatch, or invalid API response | Fail closed. These errors never activate contract fallback. |
+
+Successful API decisions use a bounded in-memory LRU cache. Its TTL is at most five seconds and is shortened so it can never extend access beyond paid-through or grace.
+
+## Direct contract fallback
+
+`createViemEntitlementFallback` reads the configured non-upgradeable contract at one safe block and cross-checks the stored subscription, hash, developer, chain, and plan scope. It is opt-in. Configure a bounded RPC transport and never treat a credential rejection as an API outage.
+
+Use the same verifier instance for every protected route and keep its integration
+credential in the add-on server environment.
+
+## Local verification
+
+```sh
+npm install
+npm run check
+```
+
+The suites cover active, grace, terminal, malformed-token, unavailable-provider, cache, fallback, CORS, route-scrubbing, and unprotected-route denial behavior using controlled entitlement decisions. They do not replace the required deployed positive-entitlement integration proof before checkout publication.

package/dist/contract.d.ts

@@ -0,0 +1,9 @@
+import { type Address, type PublicClient } from "viem";
+import type { EntitlementFallback } from "./types.js";
+export declare function createViemEntitlementFallback(input: {
+    readonly chainId: number;
+    readonly client: Pick<PublicClient, "getBlock" | "getChainId" | "readContract">;
+    readonly contractAddress: Address;
+    readonly expectedDeveloperAddress: Address;
+}): EntitlementFallback;
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,MAAM,CAAC;AAOd,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AA6B3E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,IAAI,CACnB,YAAY,EACZ,UAAU,GAAG,YAAY,GAAG,cAAc,CAC3C,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C,GAAG,mBAAmB,CA6FtB"}

package/dist/contract.js

@@ -0,0 +1,111 @@
+import { getAddress, isAddressEqual, parseAbi, zeroAddress, } from "viem";
+import { AddonPassConfigurationError, EntitlementScopeMismatchError, EntitlementVerificationError, } from "./errors.js";
+const ENTITLEMENT_ABI = parseAbi([
+    "function entitlementStatus(bytes32 entitlementHash) view returns (bool entitled, uint64 paidThrough, uint64 graceEnds, uint256 subscriptionId, address developer)",
+    "function subscriptions(uint256 subscriptionId) view returns (uint256 planId, address payer, bytes32 entitlementHash, uint64 paidThrough, uint32 remainingCharges, bool cancelled)",
+]);
+function isoFromSeconds(value) {
+    const milliseconds = value * 1000n;
+    if (milliseconds > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new EntitlementVerificationError();
+    }
+    return new Date(Number(milliseconds)).toISOString();
+}
+function notFound() {
+    return {
+        entitled: false,
+        finality: null,
+        graceEnds: null,
+        paidThrough: null,
+        planId: null,
+        sourceBlock: null,
+        sourceBlockHash: null,
+        status: "not_found",
+        subscriptionId: null,
+    };
+}
+export function createViemEntitlementFallback(input) {
+    if (!Number.isSafeInteger(input.chainId) || input.chainId <= 0) {
+        throw new AddonPassConfigurationError();
+    }
+    let contractAddress;
+    let expectedDeveloperAddress;
+    try {
+        contractAddress = getAddress(input.contractAddress);
+        expectedDeveloperAddress = getAddress(input.expectedDeveloperAddress);
+    }
+    catch {
+        throw new AddonPassConfigurationError();
+    }
+    if (isAddressEqual(expectedDeveloperAddress, zeroAddress)) {
+        throw new AddonPassConfigurationError();
+    }
+    return {
+        async verify(tokenHash) {
+            try {
+                const [actualChainId, block] = await Promise.all([
+                    input.client.getChainId(),
+                    input.client.getBlock({ blockTag: "safe" }),
+                ]);
+                if (actualChainId !== input.chainId) {
+                    throw new EntitlementVerificationError();
+                }
+                const [entitled, paidThrough, graceEnds, subscriptionId, developer] = await input.client.readContract({
+                    abi: ENTITLEMENT_ABI,
+                    address: contractAddress,
+                    args: [tokenHash],
+                    blockNumber: block.number,
+                    functionName: "entitlementStatus",
+                });
+                if (subscriptionId === 0n)
+                    return notFound();
+                if (!isAddressEqual(developer, expectedDeveloperAddress)) {
+                    throw new EntitlementScopeMismatchError();
+                }
+                const [planId, , storedHash, storedPaidThrough, remainingCharges, cancelled,] = await input.client.readContract({
+                    abi: ENTITLEMENT_ABI,
+                    address: contractAddress,
+                    args: [subscriptionId],
+                    blockNumber: block.number,
+                    functionName: "subscriptions",
+                });
+                if (storedHash !== tokenHash || storedPaidThrough !== paidThrough) {
+                    throw new EntitlementVerificationError();
+                }
+                const active = block.timestamp <= paidThrough;
+                if (active !== entitled &&
+                    !(entitled && block.timestamp <= graceEnds)) {
+                    throw new EntitlementVerificationError();
+                }
+                const status = active
+                    ? "active"
+                    : entitled
+                        ? "grace"
+                        : cancelled
+                            ? "cancelled"
+                            : remainingCharges === 0
+                                ? "authorization_ended"
+                                : "expired";
+                return {
+                    entitled,
+                    finality: "safe",
+                    graceEnds: isoFromSeconds(graceEnds),
+                    paidThrough: isoFromSeconds(paidThrough),
+                    planId: planId.toString(10),
+                    sourceBlock: block.number.toString(10),
+                    sourceBlockHash: block.hash,
+                    status,
+                    subscriptionId: subscriptionId.toString(10),
+                };
+            }
+            catch (error) {
+                if (error instanceof EntitlementScopeMismatchError ||
+                    error instanceof EntitlementVerificationError) {
+                    throw error;
+                }
+                throw new EntitlementVerificationError();
+            }
+        },
+    };
+}
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,WAAW,GAGZ,MAAM,MAAM,CAAC;AAEd,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAGrB,MAAM,eAAe,GAAG,QAAQ,CAAC;IAC/B,mKAAmK;IACnK,mLAAmL;CACpL,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,YAAY,GAAG,KAAK,GAAG,KAAM,CAAC;IACpC,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ;IACf,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,WAAW;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAQ7C;IACC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,eAAwB,CAAC;IAC7B,IAAI,wBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,wBAAwB,GAAG,UAAU,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,cAAc,CAAC,wBAAwB,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC/C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;oBACzB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;oBACpC,MAAM,IAAI,4BAA4B,EAAE,CAAC;gBAC3C,CAAC;gBACD,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,GACjE,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;oBAC9B,GAAG,EAAE,eAAe;oBACpB,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,WAAW,EAAE,KAAK,CAAC,MAAM;oBACzB,YAAY,EAAE,mBAAmB;iBAClC,CAAC,CAAC;gBACL,IAAI,cAAc,KAAK,EAAE;oBAAE,OAAO,QAAQ,EAAE,CAAC;gBAC7C,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,6BAA6B,EAAE,CAAC;gBAC5C,CAAC;gBACD,MAAM,CACJ,MAAM,EACN,AADO,EAEP,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACV,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;oBAClC,GAAG,EAAE,eAAe;oBACpB,OAAO,EAAE,eAAe;oBACxB,IAAI,EAAE,CAAC,cAAc,CAAC;oBACtB,WAAW,EAAE,KAAK,CAAC,MAAM;oBACzB,YAAY,EAAE,eAAe;iBAC9B,CAAC,CAAC;gBACH,IAAI,UAAU,KAAK,SAAS,IAAI,iBAAiB,KAAK,WAAW,EAAE,CAAC;oBAClE,MAAM,IAAI,4BAA4B,EAAE,CAAC;gBAC3C,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC;gBAC9C,IACE,MAAM,KAAK,QAAQ;oBACnB,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,EAC3C,CAAC;oBACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;gBAC3C,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM;oBACnB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,SAAS;4BACT,CAAC,CAAC,WAAW;4BACb,CAAC,CAAC,gBAAgB,KAAK,CAAC;gCACtB,CAAC,CAAC,qBAAqB;gCACvB,CAAC,CAAC,SAAS,CAAC;gBACpB,OAAO;oBACL,QAAQ;oBACR,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;oBACpC,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC;oBACxC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,eAAe,EAAE,KAAK,CAAC,IAAI;oBAC3B,MAAM;oBACN,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;iBAC5C,CAAC;YACJ,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,6BAA6B;oBAC9C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,22 @@
+export declare class AddonPassConfigurationError extends Error {
+    constructor();
+}
+export declare class AddonPassUnavailableError extends Error {
+    constructor();
+}
+export declare class EntitlementCredentialRejectedError extends Error {
+    constructor();
+}
+export declare class EntitlementScopeMismatchError extends Error {
+    constructor();
+}
+export declare class EntitlementVerificationError extends Error {
+    constructor();
+}
+export declare class InvalidEntitlementTokenError extends Error {
+    constructor();
+}
+export declare class UnsupportedStremioRouteError extends Error {
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,qBAAa,kCAAmC,SAAQ,KAAK;;CAK5D;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD"}

package/dist/errors.js

@@ -0,0 +1,43 @@
+export class AddonPassConfigurationError extends Error {
+    constructor() {
+        super("AddonPass verifier configuration is invalid");
+        this.name = "AddonPassConfigurationError";
+    }
+}
+export class AddonPassUnavailableError extends Error {
+    constructor() {
+        super("AddonPass entitlement verification is unavailable");
+        this.name = "AddonPassUnavailableError";
+    }
+}
+export class EntitlementCredentialRejectedError extends Error {
+    constructor() {
+        super("AddonPass integration credential was rejected");
+        this.name = "EntitlementCredentialRejectedError";
+    }
+}
+export class EntitlementScopeMismatchError extends Error {
+    constructor() {
+        super("Entitlement does not match the configured add-on scope");
+        this.name = "EntitlementScopeMismatchError";
+    }
+}
+export class EntitlementVerificationError extends Error {
+    constructor() {
+        super("AddonPass entitlement verification failed");
+        this.name = "EntitlementVerificationError";
+    }
+}
+export class InvalidEntitlementTokenError extends Error {
+    constructor() {
+        super("Entitlement token is invalid");
+        this.name = "InvalidEntitlementTokenError";
+    }
+}
+export class UnsupportedStremioRouteError extends Error {
+    constructor() {
+        super("Stremio route is not protected by this handler");
+        this.name = "UnsupportedStremioRouteError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC3D;QACE,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD;QACE,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD;QACE,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}

package/dist/express.d.ts

@@ -0,0 +1,12 @@
+import type { RequestHandler, Response as ExpressResponse } from "express";
+import { type AuthorizedStremioRequest, type StremioAccessConfiguration } from "./stremio.js";
+import type { AddonPassVerifier } from "./verifier.js";
+export declare const EXPRESS_ADDONPASS_LOCAL = "addonPass";
+export interface ExpressStremioMiddlewareOptions {
+    readonly access: StremioAccessConfiguration;
+    readonly mountPath?: string;
+    readonly verifier: Pick<AddonPassVerifier, "verifyToken">;
+}
+export declare function createExpressStremioMiddleware(options: ExpressStremioMiddlewareOptions): RequestHandler;
+export declare function expressAddonPassAuthorization(response: ExpressResponse): AuthorizedStremioRequest;
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,IAAI,eAAe,EAAE,MAAM,SAAS,CAAC;AAU3E,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;CAC3D;AAkBD,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,cAAc,CAyDhB;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,eAAe,GACxB,wBAAwB,CAK1B"}

package/dist/express.js

@@ -0,0 +1,64 @@
+import { AddonPassUnavailableError, EntitlementCredentialRejectedError, EntitlementScopeMismatchError, EntitlementVerificationError, InvalidEntitlementTokenError, UnsupportedStremioRouteError, } from "./errors.js";
+import { authorizeStremioRequest, createStremioAccessResponder, } from "./stremio.js";
+export const EXPRESS_ADDONPASS_LOCAL = "addonPass";
+async function send(target, response, head) {
+    target.status(response.status);
+    response.headers.forEach((value, name) => {
+        target.setHeader(name, value);
+    });
+    if (head || response.body === null) {
+        target.end();
+        return;
+    }
+    target.send(Buffer.from(await response.arrayBuffer()));
+}
+export function createExpressStremioMiddleware(options) {
+    const responder = createStremioAccessResponder(options.access);
+    const mountPath = options.mountPath ?? "/addonpass";
+    return async (request, response, next) => {
+        if (request.method === "OPTIONS") {
+            await send(response, responder.options(), false);
+            return;
+        }
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            await send(response, responder.methodNotAllowed(), false);
+            return;
+        }
+        try {
+            const url = new URL(request.originalUrl, "http://addonpass.local");
+            const authorization = await authorizeStremioRequest(options.verifier, url, mountPath);
+            if (!authorization.decision.entitled) {
+                await send(response, responder.denied(authorization), request.method === "HEAD");
+                return;
+            }
+            const safeUrl = `${authorization.route.upstreamPath}${url.search}`;
+            request.url = safeUrl;
+            request.originalUrl = safeUrl;
+            response.locals[EXPRESS_ADDONPASS_LOCAL] = authorization;
+            response.setHeader("access-control-allow-origin", "*");
+            next();
+        }
+        catch (error) {
+            if (error instanceof UnsupportedStremioRouteError ||
+                error instanceof InvalidEntitlementTokenError) {
+                await send(response, responder.invalid(), request.method === "HEAD");
+                return;
+            }
+            if (error instanceof AddonPassUnavailableError ||
+                error instanceof EntitlementCredentialRejectedError ||
+                error instanceof EntitlementScopeMismatchError ||
+                error instanceof EntitlementVerificationError) {
+                await send(response, responder.unavailable(), request.method === "HEAD");
+                return;
+            }
+            next(error);
+        }
+    };
+}
+export function expressAddonPassAuthorization(response) {
+    const authorization = response.locals[EXPRESS_ADDONPASS_LOCAL];
+    if (authorization === undefined)
+        throw new EntitlementVerificationError();
+    return authorization;
+}
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAG7B,MAAM,cAAc,CAAC;AAGtB,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAQnD,KAAK,UAAU,IAAI,CACjB,MAAuB,EACvB,QAAkB,EAClB,IAAa;IAEb,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAwC;IAExC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,QAAQ,EAChB,GAAG,EACH,SAAS,CACV,CAAC;YACF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,CACR,QAAQ,EACR,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAC/B,OAAO,CAAC,MAAM,KAAK,MAAM,CAC1B,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;YACtB,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,aAAa,CAAC;YACzD,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IACE,KAAK,YAAY,4BAA4B;gBAC7C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,IACE,KAAK,YAAY,yBAAyB;gBAC1C,KAAK,YAAY,kCAAkC;gBACnD,KAAK,YAAY,6BAA6B;gBAC9C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;gBACD,MAAM,IAAI,CACR,QAAQ,EACR,SAAS,CAAC,WAAW,EAAE,EACvB,OAAO,CAAC,MAAM,KAAK,MAAM,CAC1B,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAyB;IAEzB,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CACvB,CAAC;IACvC,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC1E,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/fastify.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyRequest, preHandlerAsyncHookHandler } from "fastify";
+import { type AuthorizedStremioRequest, type StremioAccessConfiguration } from "./stremio.js";
+import type { AddonPassVerifier } from "./verifier.js";
+export interface FastifyStremioProtection {
+    authorization(request: FastifyRequest): AuthorizedStremioRequest;
+    readonly preHandler: preHandlerAsyncHookHandler;
+}
+export interface FastifyStremioProtectionOptions {
+    readonly access: StremioAccessConfiguration;
+    readonly mountPath?: string;
+    readonly verifier: Pick<AddonPassVerifier, "verifyToken">;
+}
+export declare function createFastifyStremioProtection(options: FastifyStremioProtectionOptions): FastifyStremioProtection;
+//# sourceMappingURL=fastify.d.ts.map

package/dist/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,0BAA0B,EAC3B,MAAM,SAAS,CAAC;AAUjB,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,wBAAwB,CAAC;IACjE,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;CAC3D;AAcD,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,wBAAwB,CAyD1B"}

package/dist/fastify.js

@@ -0,0 +1,63 @@
+import { AddonPassUnavailableError, EntitlementCredentialRejectedError, EntitlementScopeMismatchError, EntitlementVerificationError, InvalidEntitlementTokenError, UnsupportedStremioRouteError, } from "./errors.js";
+import { authorizeStremioRequest, createStremioAccessResponder, } from "./stremio.js";
+async function send(reply, response) {
+    reply.code(response.status);
+    response.headers.forEach((value, name) => {
+        void reply.header(name, value);
+    });
+    if (response.body === null || reply.request.method === "HEAD") {
+        await reply.send();
+        return;
+    }
+    await reply.send(Buffer.from(await response.arrayBuffer()));
+}
+export function createFastifyStremioProtection(options) {
+    const authorizations = new WeakMap();
+    const mountPath = options.mountPath ?? "/addonpass";
+    const responder = createStremioAccessResponder(options.access);
+    return {
+        authorization(request) {
+            const authorization = authorizations.get(request);
+            if (authorization === undefined)
+                throw new EntitlementVerificationError();
+            return authorization;
+        },
+        async preHandler(request, reply) {
+            if (request.method === "OPTIONS") {
+                await send(reply, responder.options());
+                return;
+            }
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                await send(reply, responder.methodNotAllowed());
+                return;
+            }
+            try {
+                const url = new URL(request.raw.url ?? "/", "http://addonpass.local");
+                const authorization = await authorizeStremioRequest(options.verifier, url, mountPath);
+                if (!authorization.decision.entitled) {
+                    await send(reply, responder.denied(authorization));
+                    return;
+                }
+                authorizations.set(request, authorization);
+                request.raw.url = `${authorization.route.upstreamPath}${url.search}`;
+                void reply.header("access-control-allow-origin", "*");
+            }
+            catch (error) {
+                if (error instanceof UnsupportedStremioRouteError ||
+                    error instanceof InvalidEntitlementTokenError) {
+                    await send(reply, responder.invalid());
+                    return;
+                }
+                if (error instanceof AddonPassUnavailableError ||
+                    error instanceof EntitlementCredentialRejectedError ||
+                    error instanceof EntitlementScopeMismatchError ||
+                    error instanceof EntitlementVerificationError) {
+                    await send(reply, responder.unavailable());
+                    return;
+                }
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=fastify.js.map

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAG7B,MAAM,cAAc,CAAC;AActB,KAAK,UAAU,IAAI,CAAC,KAAmB,EAAE,QAAkB;IACzD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAwC;IAExC,MAAM,cAAc,GAAG,IAAI,OAAO,EAG/B,CAAC;IACJ,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,aAAa,CAAC,OAAO;YACnB,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,SAAS;gBAAE,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC1E,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK;YAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBACtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,QAAQ,EAChB,GAAG,EACH,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACrC,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrE,KAAK,KAAK,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IACE,KAAK,YAAY,4BAA4B;oBAC7C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;oBACD,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;oBACvC,OAAO;gBACT,CAAC;gBACD,IACE,KAAK,YAAY,yBAAyB;oBAC1C,KAAK,YAAY,kCAAkC;oBACnD,KAAK,YAAY,6BAA6B;oBAC9C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;oBACD,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/fetch.d.ts

@@ -0,0 +1,11 @@
+import { type AuthorizedStremioRequest, type StremioAccessConfiguration } from "./stremio.js";
+import type { AddonPassVerifier } from "./verifier.js";
+export type FetchStremioUpstream = (request: Request, authorization: AuthorizedStremioRequest) => Promise<Response> | Response;
+export interface FetchStremioHandlerOptions {
+    readonly access: StremioAccessConfiguration;
+    readonly mountPath?: string;
+    readonly upstream: FetchStremioUpstream;
+    readonly verifier: Pick<AddonPassVerifier, "verifyToken">;
+}
+export declare function createFetchStremioHandler(options: FetchStremioHandlerOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAEhC,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,wBAAwB,KACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;CAC3D;AAYD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAkDzC"}

package/dist/fetch.js

@@ -0,0 +1,48 @@
+import { AddonPassUnavailableError, EntitlementCredentialRejectedError, EntitlementScopeMismatchError, EntitlementVerificationError, InvalidEntitlementTokenError, UnsupportedStremioRouteError, } from "./errors.js";
+import { authorizeStremioRequest, createStremioAccessResponder, } from "./stremio.js";
+function withCors(response, head) {
+    const headers = new Headers(response.headers);
+    headers.set("access-control-allow-origin", "*");
+    return new Response(head ? null : response.body, {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+}
+export function createFetchStremioHandler(options) {
+    const responder = createStremioAccessResponder(options.access);
+    const mountPath = options.mountPath ?? "/addonpass";
+    return async (request) => {
+        if (request.method === "OPTIONS")
+            return responder.options();
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            return responder.methodNotAllowed();
+        }
+        let route;
+        try {
+            const url = new URL(request.url);
+            const authorization = await authorizeStremioRequest(options.verifier, url, mountPath);
+            route = authorization.route;
+            if (!authorization.decision.entitled) {
+                return withCors(responder.denied(authorization), request.method === "HEAD");
+            }
+            url.pathname = authorization.route.upstreamPath;
+            const upstreamRequest = new Request(url, request);
+            return withCors(await options.upstream(upstreamRequest, authorization), request.method === "HEAD");
+        }
+        catch (error) {
+            if (error instanceof UnsupportedStremioRouteError ||
+                error instanceof InvalidEntitlementTokenError) {
+                return withCors(responder.invalid(), request.method === "HEAD");
+            }
+            if (error instanceof AddonPassUnavailableError ||
+                error instanceof EntitlementCredentialRejectedError ||
+                error instanceof EntitlementScopeMismatchError ||
+                error instanceof EntitlementVerificationError) {
+                return withCors(responder.unavailable(route), request.method === "HEAD");
+            }
+            throw error;
+        }
+    };
+}
+//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAI7B,MAAM,cAAc,CAAC;AAetB,SAAS,QAAQ,CAAC,QAAkB,EAAE,IAAa;IACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC/C,OAAO;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,QAAQ,EAChB,GAAG,EACH,SAAS,CACV,CAAC;YACF,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACrC,OAAO,QAAQ,CACb,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAC/B,OAAO,CAAC,MAAM,KAAK,MAAM,CAC1B,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YAChD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,QAAQ,CACb,MAAM,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,EACtD,OAAO,CAAC,MAAM,KAAK,MAAM,CAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IACE,KAAK,YAAY,4BAA4B;gBAC7C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;gBACD,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YAClE,CAAC;YACD,IACE,KAAK,YAAY,yBAAyB;gBAC1C,KAAK,YAAY,kCAAkC;gBACnD,KAAK,YAAY,6BAA6B;gBAC9C,KAAK,YAAY,4BAA4B,EAC7C,CAAC;gBACD,OAAO,QAAQ,CACb,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAC5B,OAAO,CAAC,MAAM,KAAK,MAAM,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./contract.js";
+export * from "./errors.js";
+export * from "./fetch.js";
+export * from "./node.js";
+export * from "./stremio.js";
+export * from "./token.js";
+export * from "./types.js";
+export * from "./verifier.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}