@solvapay/server 1.0.7 → 1.0.8-preview.10

package/dist/index.d.ts

@@ -2488,6 +2488,26 @@ interface ProcessPaymentResult {
     status: 'completed';
 }
 type ActivatePlanResult = components['schemas']['ActivatePlanResponseDto'];
+/**
+ * SDK-facing merchant identity (source: GET /v1/sdk/merchant).
+ *
+ * Hand-typed here until the OpenAPI generator picks up the new endpoint.
+ * Fields match `SdkMerchantResponseDto` on the backend.
+ */
+type SdkMerchantResponse = {
+    displayName: string;
+    legalName: string;
+    supportEmail?: string;
+    supportUrl?: string;
+    termsUrl?: string;
+    privacyUrl?: string;
+    country?: string;
+    defaultCurrency?: string;
+    statementDescriptor?: string;
+    logoUrl?: string;
+};
+/** SDK-facing product projection. Sourced from the existing OpenAPI spec. */
+type SdkProductResponse = components['schemas']['SdkProductResponse'];
 type McpBootstrapPlanInput = NonNullable<components['schemas']['McpBootstrapDto']['plans']>[number];
 type ToolPlanMappingInput = NonNullable<components['schemas']['McpBootstrapDto']['tools']>[number];
 type McpBootstrapRequest = components['schemas']['McpBootstrapDto'];
@@ -2556,6 +2576,13 @@ interface SolvaPayClient {
         externalRef?: string;
         email?: string;
     }): Promise<CustomerResponseMapped>;
+    /**
+     * SDK-facing merchant identity (GET /v1/sdk/merchant).
+     * Returns the subset of provider fields safe for browser consumption —
+     * used by `<MandateText>`, `<CheckoutSummary>`, and trust signals.
+     */
+    getMerchant?(): Promise<SdkMerchantResponse>;
+    getProduct?(productRef: string): Promise<SdkProductResponse>;
     listProducts?(): Promise<Array<{
         reference: string;
         name: string;
@@ -3785,8 +3812,16 @@ declare function handleRouteError(error: unknown, operationName: string, default
  * and name from authenticated requests. Works with any framework that uses
  * the standard Web API Request (Express, Fastify, Next.js, Edge Functions, etc.).
  *
- * Uses dynamic imports to avoid requiring @solvapay/auth at build time,
- * making it suitable for edge runtime environments.
+ * Resolution order:
+ * 1. `x-user-id` header — set by Next.js-style middleware (unchanged).
+ * 2. `Authorization: Bearer <jwt>` — verified via HS256 when a secret is
+ *    configured (`SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET`), or
+ *    unverified-decoded when no secret is configured. The unverified path
+ *    covers platforms that verify JWTs at the gateway (e.g. Supabase Edge
+ *    with `verify_jwt = true`, which is the default) and asymmetric signing
+ *    keys (ES256/RS256) that the SDK does not have keys for.
+ * 3. Set `SOLVAPAY_AUTH_STRICT=true` to require cryptographic verification
+ *    inside the handler (the unverified-decode fallback is then disabled).
  *
  * @param request - Standard Web API Request object
  * @param options - Configuration options
@@ -4116,13 +4151,85 @@ declare function activatePlanCore(request: Request, body: {
 
 type Plan = components['schemas']['Plan'];
 /**
- * List plans - core implementation
+ * List plans - core implementation.
+ *
+ * Pass `options.solvaPay` to route through a pre-configured SolvaPay instance
+ * (e.g. stub-backed in examples). When omitted, the helper reads
+ * `SOLVAPAY_SECRET_KEY` from environment and constructs a real API client.
  */
-declare function listPlansCore(request: Request): Promise<{
+declare function listPlansCore(request: Request, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<{
     plans: Plan[];
     productRef: string;
 } | ErrorResult>;
 
+/**
+ * Merchant Helper (Core)
+ *
+ * Generic helper for GET /api/merchant — returns the SDK-facing merchant
+ * identity used by `<MandateText>`, `<CheckoutSummary>`, and trust signals.
+ * Works with standard Web API Request (Express, Fastify, Next.js, Edge).
+ */
+
+declare function getMerchantCore(_request: Request, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<SdkMerchantResponse | ErrorResult>;
+
+/**
+ * Product Helper (Core)
+ *
+ * Generic helper for GET /api/get-product?productRef=...
+ * Returns a single product by reference, used by the `useProduct` React hook.
+ */
+
+declare function getProductCore(request: Request, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<SdkProductResponse | ErrorResult>;
+
+interface PurchaseCheckResult {
+    customerRef: string;
+    email?: string;
+    name?: string;
+    purchases: Array<{
+        reference: string;
+        productName?: string;
+        productRef?: string;
+        status?: string;
+        startDate?: string;
+        planSnapshot?: {
+            meterId?: string;
+            limit?: number;
+            freeUnits?: number;
+        };
+        usage?: {
+            used?: number;
+            overageUnits?: number;
+            overageCost?: number;
+            periodStart?: string;
+            periodEnd?: string;
+        };
+        [key: string]: unknown;
+    }>;
+}
+declare function checkPurchaseCore(request: Request, options?: {
+    solvaPay?: SolvaPay;
+    includeEmail?: boolean;
+    includeName?: boolean;
+}): Promise<PurchaseCheckResult | ErrorResult>;
+
+declare function trackUsageCore(request: Request, body: {
+    actionType?: 'transaction' | 'api_call' | 'hour' | 'email' | 'storage' | 'custom';
+    units?: number;
+    productRef?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<{
+    success: true;
+} | ErrorResult>;
+
 /**
  * SolvaPay Server SDK
  *
@@ -4178,4 +4285,4 @@ declare function verifyWebhook({ body, signature, secret, }: {
     secret: string;
 }): WebhookEvent;
 
-export { type ActivatePlanResult, type AuthenticatedUser, type ConfigureMcpPlansRequest, type ConfigureMcpPlansResponse, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerResponseMapped, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, McpBearerAuthError, type McpBootstrapPlanInput, type McpBootstrapRequest, type McpBootstrapResponse, type McpServerLike, type McpToolExtra, type McpToolPlanMappingInput, type NextAdapterOptions, type OneTimePurchaseInfo, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type ProcessPaymentResult, type RegisterVirtualToolsMcpOptions, type RetryOptions, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type ToolPlanMappingInput, VIRTUAL_TOOL_DEFINITIONS, type VirtualToolDefinition, type VirtualToolsOptions, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, buildAuthInfoFromBearer, cancelPurchaseCore, type components, createCheckoutSessionCore, createCustomerSessionCore, createMcpOAuthBridge, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, createVirtualTools, decodeJwtPayload, extractBearerToken, getAuthenticatedUserCore, getCustomerBalanceCore, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, handleRouteError, isErrorResult, jsonSchemaToZodRawShape, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, registerVirtualToolsMcpImpl, syncCustomerCore, verifyWebhook, withRetry };
+export { type ActivatePlanResult, type AuthenticatedUser, type ConfigureMcpPlansRequest, type ConfigureMcpPlansResponse, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerResponseMapped, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, McpBearerAuthError, type McpBootstrapPlanInput, type McpBootstrapRequest, type McpBootstrapResponse, type McpServerLike, type McpToolExtra, type McpToolPlanMappingInput, type NextAdapterOptions, type OneTimePurchaseInfo, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type ProcessPaymentResult, type PurchaseCheckResult, type RegisterVirtualToolsMcpOptions, type RetryOptions, type SdkMerchantResponse, type SdkProductResponse, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type ToolPlanMappingInput, VIRTUAL_TOOL_DEFINITIONS, type VirtualToolDefinition, type VirtualToolsOptions, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, buildAuthInfoFromBearer, cancelPurchaseCore, checkPurchaseCore, type components, createCheckoutSessionCore, createCustomerSessionCore, createMcpOAuthBridge, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, createVirtualTools, decodeJwtPayload, extractBearerToken, getAuthenticatedUserCore, getCustomerBalanceCore, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getMerchantCore, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, getProductCore, handleRouteError, isErrorResult, jsonSchemaToZodRawShape, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, registerVirtualToolsMcpImpl, syncCustomerCore, trackUsageCore, verifyWebhook, withRetry };

package/dist/index.js

@@ -110,6 +110,36 @@ function createSolvaPayClient(opts) {
         purchases: customer.purchases || []
       };
     },
+    // GET: /v1/sdk/merchant
+    async getMerchant() {
+      const url = `${base}/v1/sdk/merchant`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new SolvaPayError(`Get merchant failed (${res.status}): ${error}`);
+      }
+      return res.json();
+    },
+    // GET: /v1/sdk/products/{productRef}
+    async getProduct(productRef) {
+      const url = `${base}/v1/sdk/products/${encodeURIComponent(productRef)}`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new SolvaPayError(`Get product failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      const data = result.data || {};
+      return { ...data, ...result };
+    },
     // Product management methods (primarily for integration tests)
     // GET: /v1/sdk/products
     async listProducts() {
@@ -1715,7 +1745,8 @@ var McpBearerAuthError = class extends Error {
 function base64UrlDecode(input) {
   const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
   const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  return Buffer.from(padded, "base64").toString("utf8");
+  const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
 }
 function extractBearerToken(authorization) {
   if (!authorization) return null;
@@ -1942,26 +1973,128 @@ function handleRouteError(error, operationName, defaultMessage) {
 }
 
 // src/helpers/auth.ts
+function base64UrlDecode2(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode2(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken2(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+}
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify } = await import("./webapi-K5XBCEO6.js");
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
+}
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
+}
 async function getAuthenticatedUserCore(request, options = {}) {
   try {
-    const { requireUserId, getUserEmailFromRequest, getUserNameFromRequest } = await import("@solvapay/auth");
-    const userIdOrError = requireUserId(request);
-    if (userIdOrError instanceof Response) {
-      const clonedResponse = userIdOrError.clone();
-      const body = await clonedResponse.json().catch(() => ({ error: "Unauthorized" }));
-      return {
-        error: body.error || "Unauthorized",
-        status: userIdOrError.status,
-        details: body.error || "Unauthorized"
-      };
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken2(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
+      }
+      return { userId: headerUserId, email, name };
+    }
+    const token = extractBearerToken2(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
+    }
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
+      }
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
+      }
+    }
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
     }
-    const userId = userIdOrError;
-    const email = options.includeEmail !== false ? await getUserEmailFromRequest(request) : null;
-    const name = options.includeName !== false ? await getUserNameFromRequest(request) : null;
     return {
       userId,
-      email,
-      name
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
     };
   } catch (error) {
     return handleRouteError(error, "Get authenticated user", "Authentication failed");
@@ -2356,7 +2489,7 @@ async function activatePlanCore(request, body, options = {}) {
 
 // src/helpers/plans.ts
 import { getSolvaPayConfig as getSolvaPayConfig2 } from "@solvapay/core";
-async function listPlansCore(request) {
+async function listPlansCore(request, options = {}) {
   try {
     const url = new URL(request.url);
     const productRef = url.searchParams.get("productRef");
@@ -2366,19 +2499,20 @@ async function listPlansCore(request) {
         status: 400
       };
     }
-    const config = getSolvaPayConfig2();
-    const solvapaySecretKey = config.apiKey;
-    const solvapayApiBaseUrl = config.apiBaseUrl;
-    if (!solvapaySecretKey) {
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = getSolvaPayConfig2();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
       return {
         error: "Server configuration error: SolvaPay secret key not configured",
         status: 500
       };
     }
-    const apiClient = createSolvaPayClient({
-      apiKey: solvapaySecretKey,
-      apiBaseUrl: solvapayApiBaseUrl
-    });
     if (!apiClient.listPlans) {
       return {
         error: "List plans method not available",
@@ -2395,6 +2529,159 @@ async function listPlansCore(request) {
   }
 }
 
+// src/helpers/merchant.ts
+import { getSolvaPayConfig as getSolvaPayConfig3 } from "@solvapay/core";
+async function getMerchantCore(_request, options = {}) {
+  try {
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = getSolvaPayConfig3();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getMerchant) {
+      return {
+        error: "Get merchant method not available",
+        status: 500
+      };
+    }
+    const merchant = await apiClient.getMerchant();
+    return merchant;
+  } catch (error) {
+    return handleRouteError(error, "Get merchant", "Failed to fetch merchant");
+  }
+}
+
+// src/helpers/product.ts
+import { getSolvaPayConfig as getSolvaPayConfig4 } from "@solvapay/core";
+async function getProductCore(request, options = {}) {
+  try {
+    const url = new URL(request.url);
+    const productRef = url.searchParams.get("productRef");
+    if (!productRef) {
+      return {
+        error: "Missing required parameter: productRef",
+        status: 400
+      };
+    }
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = getSolvaPayConfig4();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getProduct) {
+      return {
+        error: "Get product method not available",
+        status: 500
+      };
+    }
+    const product = await apiClient.getProduct(productRef);
+    return product;
+  } catch (error) {
+    return handleRouteError(error, "Get product", "Failed to fetch product");
+  }
+}
+
+// src/helpers/purchase.ts
+async function checkPurchaseCore(request, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request, {
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const cachedCustomerRef = request.headers.get("x-solvapay-customer-ref");
+    if (cachedCustomerRef) {
+      try {
+        const customer = await solvaPay.getCustomer({ customerRef: cachedCustomerRef });
+        if (customer && customer.customerRef) {
+          if (customer.externalRef && customer.externalRef === userId) {
+            const filteredPurchases = (customer.purchases || []).filter(
+              (p) => p.status === "active"
+            );
+            return {
+              customerRef: customer.customerRef,
+              email: customer.email,
+              name: customer.name,
+              purchases: filteredPurchases
+            };
+          }
+        }
+      } catch {
+      }
+    }
+    try {
+      const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+        email: email || void 0,
+        name: name || void 0
+      });
+      const customer = await solvaPay.getCustomer({ customerRef });
+      const filteredPurchases = (customer.purchases || []).filter((p) => p.status === "active");
+      return {
+        customerRef: customer.customerRef || userId,
+        email: customer.email,
+        name: customer.name,
+        purchases: filteredPurchases
+      };
+    } catch {
+      return {
+        customerRef: userId,
+        purchases: []
+      };
+    }
+  } catch (error) {
+    return handleRouteError(error, "Check purchase", "Failed to check purchase");
+  }
+}
+
+// src/helpers/usage.ts
+async function trackUsageCore(request, body, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request);
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+      email: email || void 0,
+      name: name || void 0
+    });
+    await solvaPay.trackUsage({
+      customerRef,
+      actionType: body.actionType,
+      units: body.units,
+      productRef: body.productRef,
+      description: body.description,
+      metadata: body.metadata
+    });
+    return { success: true };
+  } catch (error) {
+    return handleRouteError(error, "Track usage", "Track usage failed");
+  }
+}
+
 // src/index.ts
 function verifyWebhook({
   body,
@@ -2439,6 +2726,7 @@ export {
   activatePlanCore,
   buildAuthInfoFromBearer,
   cancelPurchaseCore,
+  checkPurchaseCore,
   createCheckoutSessionCore,
   createCustomerSessionCore,
   createMcpOAuthBridge,
@@ -2453,8 +2741,10 @@ export {
   getCustomerBalanceCore,
   getCustomerRefFromBearerAuthHeader,
   getCustomerRefFromJwtPayload,
+  getMerchantCore,
   getOAuthAuthorizationServerResponse,
   getOAuthProtectedResourceResponse,
+  getProductCore,
   handleRouteError,
   isErrorResult,
   jsonSchemaToZodRawShape,
@@ -2464,6 +2754,7 @@ export {
   reactivatePurchaseCore,
   registerVirtualToolsMcpImpl,
   syncCustomerCore,
+  trackUsageCore,
   verifyWebhook,
   withRetry
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/server",
-  "version": "1.0.7",
+  "version": "1.0.8-preview.10",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -37,12 +37,12 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@solvapay/core": "1.0.7"
+    "@solvapay/core": "1.0.8-preview.10"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@solvapay/auth": "1.0.7"
+    "@solvapay/auth": "1.0.8-preview.10"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -60,15 +60,15 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.2",
-    "@solvapay/auth": "1.0.7",
+    "@solvapay/auth": "1.0.8-preview.10",
     "@solvapay/demo-services": "0.0.0",
     "@solvapay/test-utils": "^0.0.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm,cjs --dts --tsconfig tsconfig.build.json && tsup src/edge.ts --format esm --dts --tsconfig tsconfig.build.json",
     "generate:types": "tsx scripts/generate-types.ts",
-    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts",
-    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts",
+    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts __tests__/auth-core.unit.test.ts",
+    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts __tests__/auth-core.unit.test.ts",
     "test:integration": "vitest run __tests__/backend.integration.test.ts",
     "test:integration:payment": "vitest run __tests__/payment-stripe.integration.test.ts",
     "test:all": "vitest run",