@solvapay/server 1.0.8-preview.1 → 1.0.8-preview.11

package/dist/edge.d.ts

@@ -3720,8 +3720,16 @@ declare function handleRouteError(error: unknown, operationName: string, default
  * and name from authenticated requests. Works with any framework that uses
  * the standard Web API Request (Express, Fastify, Next.js, Edge Functions, etc.).
  *
- * Uses dynamic imports to avoid requiring @solvapay/auth at build time,
- * making it suitable for edge runtime environments.
+ * Resolution order:
+ * 1. `x-user-id` header — set by Next.js-style middleware (unchanged).
+ * 2. `Authorization: Bearer <jwt>` — verified via HS256 when a secret is
+ *    configured (`SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET`), or
+ *    unverified-decoded when no secret is configured. The unverified path
+ *    covers platforms that verify JWTs at the gateway (e.g. Supabase Edge
+ *    with `verify_jwt = true`, which is the default) and asymmetric signing
+ *    keys (ES256/RS256) that the SDK does not have keys for.
+ * 3. Set `SOLVAPAY_AUTH_STRICT=true` to require cryptographic verification
+ *    inside the handler (the unverified-decode fallback is then disabled).
  *
  * @param request - Standard Web API Request object
  * @param options - Configuration options
@@ -4064,6 +4072,29 @@ declare function listPlansCore(request: Request, options?: {
     productRef: string;
 } | ErrorResult>;
 
+/**
+ * Merchant Helper (Core)
+ *
+ * Generic helper for GET /api/merchant — returns the SDK-facing merchant
+ * identity used by `<MandateText>`, `<CheckoutSummary>`, and trust signals.
+ * Works with standard Web API Request (Express, Fastify, Next.js, Edge).
+ */
+
+declare function getMerchantCore(_request: Request, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<SdkMerchantResponse | ErrorResult>;
+
+/**
+ * Product Helper (Core)
+ *
+ * Generic helper for GET /api/get-product?productRef=...
+ * Returns a single product by reference, used by the `useProduct` React hook.
+ */
+
+declare function getProductCore(request: Request, options?: {
+    solvaPay?: SolvaPay;
+}): Promise<SdkProductResponse | ErrorResult>;
+
 interface PurchaseCheckResult {
     customerRef: string;
     email?: string;
@@ -4120,4 +4151,4 @@ declare function verifyWebhook({ body, signature, secret, }: {
     secret: string;
 }): Promise<WebhookEvent>;
 
-export { type AuthenticatedUser, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, type NextAdapterOptions, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type PurchaseCheckResult, type RetryOptions, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, cancelPurchaseCore, checkPurchaseCore, createCheckoutSessionCore, createCustomerSessionCore, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, getAuthenticatedUserCore, getCustomerBalanceCore, handleRouteError, isErrorResult, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, syncCustomerCore, trackUsageCore, verifyWebhook, withRetry };
+export { type AuthenticatedUser, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, type NextAdapterOptions, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type PurchaseCheckResult, type RetryOptions, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, cancelPurchaseCore, checkPurchaseCore, createCheckoutSessionCore, createCustomerSessionCore, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, getAuthenticatedUserCore, getCustomerBalanceCore, getMerchantCore, getProductCore, handleRouteError, isErrorResult, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, syncCustomerCore, trackUsageCore, verifyWebhook, withRetry };

package/dist/edge.js

@@ -1758,26 +1758,128 @@ function handleRouteError(error, operationName, defaultMessage) {
 }
 
 // src/helpers/auth.ts
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+}
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify } = await import("./webapi-K5XBCEO6.js");
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
+}
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
+}
 async function getAuthenticatedUserCore(request, options = {}) {
   try {
-    const { requireUserId, getUserEmailFromRequest, getUserNameFromRequest } = await import("@solvapay/auth");
-    const userIdOrError = requireUserId(request);
-    if (userIdOrError instanceof Response) {
-      const clonedResponse = userIdOrError.clone();
-      const body = await clonedResponse.json().catch(() => ({ error: "Unauthorized" }));
-      return {
-        error: body.error || "Unauthorized",
-        status: userIdOrError.status,
-        details: body.error || "Unauthorized"
-      };
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
+      }
+      return { userId: headerUserId, email, name };
+    }
+    const token = extractBearerToken(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
+    }
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
+      }
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
+      }
+    }
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
     }
-    const userId = userIdOrError;
-    const email = options.includeEmail !== false ? await getUserEmailFromRequest(request) : null;
-    const name = options.includeName !== false ? await getUserNameFromRequest(request) : null;
     return {
       userId,
-      email,
-      name
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
     };
   } catch (error) {
     return handleRouteError(error, "Get authenticated user", "Authentication failed");
@@ -2212,6 +2314,76 @@ async function listPlansCore(request, options = {}) {
   }
 }
 
+// src/helpers/merchant.ts
+import { getSolvaPayConfig as getSolvaPayConfig3 } from "@solvapay/core";
+async function getMerchantCore(_request, options = {}) {
+  try {
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = getSolvaPayConfig3();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getMerchant) {
+      return {
+        error: "Get merchant method not available",
+        status: 500
+      };
+    }
+    const merchant = await apiClient.getMerchant();
+    return merchant;
+  } catch (error) {
+    return handleRouteError(error, "Get merchant", "Failed to fetch merchant");
+  }
+}
+
+// src/helpers/product.ts
+import { getSolvaPayConfig as getSolvaPayConfig4 } from "@solvapay/core";
+async function getProductCore(request, options = {}) {
+  try {
+    const url = new URL(request.url);
+    const productRef = url.searchParams.get("productRef");
+    if (!productRef) {
+      return {
+        error: "Missing required parameter: productRef",
+        status: 400
+      };
+    }
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = getSolvaPayConfig4();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getProduct) {
+      return {
+        error: "Get product method not available",
+        status: 500
+      };
+    }
+    const product = await apiClient.getProduct(productRef);
+    return product;
+  } catch (error) {
+    return handleRouteError(error, "Get product", "Failed to fetch product");
+  }
+}
+
 // src/helpers/purchase.ts
 async function checkPurchaseCore(request, options = {}) {
   try {
@@ -2360,6 +2532,8 @@ export {
   createTopupPaymentIntentCore,
   getAuthenticatedUserCore,
   getCustomerBalanceCore,
+  getMerchantCore,
+  getProductCore,
   handleRouteError,
   isErrorResult,
   listPlansCore,

package/dist/index.cjs

@@ -6322,26 +6322,128 @@ function handleRouteError(error, operationName, defaultMessage) {
 }
 
 // src/helpers/auth.ts
+function base64UrlDecode2(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode2(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken2(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+}
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify: jwtVerify2 } = await Promise.resolve().then(() => (init_webapi(), webapi_exports));
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify2(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
+}
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
+}
 async function getAuthenticatedUserCore(request, options = {}) {
   try {
-    const { requireUserId, getUserEmailFromRequest, getUserNameFromRequest } = await import("@solvapay/auth");
-    const userIdOrError = requireUserId(request);
-    if (userIdOrError instanceof Response) {
-      const clonedResponse = userIdOrError.clone();
-      const body = await clonedResponse.json().catch(() => ({ error: "Unauthorized" }));
-      return {
-        error: body.error || "Unauthorized",
-        status: userIdOrError.status,
-        details: body.error || "Unauthorized"
-      };
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken2(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
+      }
+      return { userId: headerUserId, email, name };
+    }
+    const token = extractBearerToken2(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
+    }
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
+      }
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
+      }
+    }
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
     }
-    const userId = userIdOrError;
-    const email = options.includeEmail !== false ? await getUserEmailFromRequest(request) : null;
-    const name = options.includeName !== false ? await getUserNameFromRequest(request) : null;
     return {
       userId,
-      email,
-      name
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
     };
   } catch (error) {
     return handleRouteError(error, "Get authenticated user", "Authentication failed");

package/dist/index.d.cts

@@ -3812,8 +3812,16 @@ declare function handleRouteError(error: unknown, operationName: string, default
  * and name from authenticated requests. Works with any framework that uses
  * the standard Web API Request (Express, Fastify, Next.js, Edge Functions, etc.).
  *
- * Uses dynamic imports to avoid requiring @solvapay/auth at build time,
- * making it suitable for edge runtime environments.
+ * Resolution order:
+ * 1. `x-user-id` header — set by Next.js-style middleware (unchanged).
+ * 2. `Authorization: Bearer <jwt>` — verified via HS256 when a secret is
+ *    configured (`SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET`), or
+ *    unverified-decoded when no secret is configured. The unverified path
+ *    covers platforms that verify JWTs at the gateway (e.g. Supabase Edge
+ *    with `verify_jwt = true`, which is the default) and asymmetric signing
+ *    keys (ES256/RS256) that the SDK does not have keys for.
+ * 3. Set `SOLVAPAY_AUTH_STRICT=true` to require cryptographic verification
+ *    inside the handler (the unverified-decode fallback is then disabled).
  *
  * @param request - Standard Web API Request object
  * @param options - Configuration options

package/dist/index.d.ts

@@ -3812,8 +3812,16 @@ declare function handleRouteError(error: unknown, operationName: string, default
  * and name from authenticated requests. Works with any framework that uses
  * the standard Web API Request (Express, Fastify, Next.js, Edge Functions, etc.).
  *
- * Uses dynamic imports to avoid requiring @solvapay/auth at build time,
- * making it suitable for edge runtime environments.
+ * Resolution order:
+ * 1. `x-user-id` header — set by Next.js-style middleware (unchanged).
+ * 2. `Authorization: Bearer <jwt>` — verified via HS256 when a secret is
+ *    configured (`SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET`), or
+ *    unverified-decoded when no secret is configured. The unverified path
+ *    covers platforms that verify JWTs at the gateway (e.g. Supabase Edge
+ *    with `verify_jwt = true`, which is the default) and asymmetric signing
+ *    keys (ES256/RS256) that the SDK does not have keys for.
+ * 3. Set `SOLVAPAY_AUTH_STRICT=true` to require cryptographic verification
+ *    inside the handler (the unverified-decode fallback is then disabled).
  *
  * @param request - Standard Web API Request object
  * @param options - Configuration options

package/dist/index.js

@@ -1973,26 +1973,128 @@ function handleRouteError(error, operationName, defaultMessage) {
 }
 
 // src/helpers/auth.ts
+function base64UrlDecode2(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode2(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken2(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+}
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify } = await import("./webapi-K5XBCEO6.js");
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
+}
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
+}
 async function getAuthenticatedUserCore(request, options = {}) {
   try {
-    const { requireUserId, getUserEmailFromRequest, getUserNameFromRequest } = await import("@solvapay/auth");
-    const userIdOrError = requireUserId(request);
-    if (userIdOrError instanceof Response) {
-      const clonedResponse = userIdOrError.clone();
-      const body = await clonedResponse.json().catch(() => ({ error: "Unauthorized" }));
-      return {
-        error: body.error || "Unauthorized",
-        status: userIdOrError.status,
-        details: body.error || "Unauthorized"
-      };
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken2(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
+      }
+      return { userId: headerUserId, email, name };
+    }
+    const token = extractBearerToken2(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
+    }
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
+      }
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
+      }
+    }
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
     }
-    const userId = userIdOrError;
-    const email = options.includeEmail !== false ? await getUserEmailFromRequest(request) : null;
-    const name = options.includeName !== false ? await getUserNameFromRequest(request) : null;
     return {
       userId,
-      email,
-      name
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
     };
   } catch (error) {
     return handleRouteError(error, "Get authenticated user", "Authentication failed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/server",
-  "version": "1.0.8-preview.1",
+  "version": "1.0.8-preview.11",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -37,12 +37,12 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@solvapay/core": "1.0.8-preview.1"
+    "@solvapay/core": "1.0.8-preview.11"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@solvapay/auth": "1.0.8-preview.1"
+    "@solvapay/auth": "1.0.8-preview.11"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -60,15 +60,15 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.2",
-    "@solvapay/auth": "1.0.8-preview.1",
     "@solvapay/demo-services": "0.0.0",
-    "@solvapay/test-utils": "^0.0.0"
+    "@solvapay/test-utils": "^0.0.0",
+    "@solvapay/auth": "1.0.8-preview.11"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm,cjs --dts --tsconfig tsconfig.build.json && tsup src/edge.ts --format esm --dts --tsconfig tsconfig.build.json",
     "generate:types": "tsx scripts/generate-types.ts",
-    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts",
-    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts",
+    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts __tests__/auth-core.unit.test.ts",
+    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts __tests__/auth-core.unit.test.ts",
     "test:integration": "vitest run __tests__/backend.integration.test.ts",
     "test:integration:payment": "vitest run __tests__/payment-stripe.integration.test.ts",
     "test:all": "vitest run",