@solvapay/server 1.0.8-preview.5 → 1.0.8-preview.7

package/dist/src/helpers/subscription.js

@@ -0,0 +1,101 @@
+/**
+ * Subscription Helpers (Core)
+ *
+ * Generic helpers for subscription operations.
+ * Works with standard Web API Request (works everywhere).
+ */
+import { createSolvaPay } from '../factory';
+import { SolvaPayError } from '@solvapay/core';
+import { handleRouteError } from './error';
+/**
+ * Cancel subscription - core implementation
+ *
+ * @param request - Standard Web API Request
+ * @param body - Cancellation parameters
+ * @param options - Configuration options
+ * @returns Cancelled subscription response or error result
+ */
+export async function cancelSubscriptionCore(request, body, options = {}) {
+    try {
+        // Validate required parameters
+        if (!body.subscriptionRef) {
+            return {
+                error: 'Missing required parameter: subscriptionRef is required',
+                status: 400,
+            };
+        }
+        // Use provided SolvaPay instance or create new one
+        const solvaPay = options.solvaPay || createSolvaPay();
+        // Use the SDK client to cancel the subscription
+        if (!solvaPay.apiClient.cancelSubscription) {
+            return {
+                error: 'Cancel subscription method not available on SDK client',
+                status: 500,
+            };
+        }
+        let cancelledSubscription = await solvaPay.apiClient.cancelSubscription({
+            subscriptionRef: body.subscriptionRef,
+            reason: body.reason,
+        });
+        // Validate response (client should already extract subscription from nested response)
+        if (!cancelledSubscription || typeof cancelledSubscription !== 'object') {
+            return {
+                error: 'Invalid response from cancel subscription endpoint',
+                status: 500,
+            };
+        }
+        // Fallback: Extract subscription from nested response if client didn't already do it
+        const responseAny = cancelledSubscription;
+        if (responseAny.subscription && typeof responseAny.subscription === 'object') {
+            cancelledSubscription = responseAny.subscription;
+        }
+        // Validate required fields
+        if (!cancelledSubscription.reference) {
+            return {
+                error: 'Cancel subscription response missing required fields',
+                status: 500,
+            };
+        }
+        // Check if subscription was actually cancelled
+        const isCancelled = cancelledSubscription.status === 'cancelled' || cancelledSubscription.cancelledAt;
+        if (!isCancelled) {
+            return {
+                error: `Subscription cancellation failed: backend returned status '${cancelledSubscription.status}' without cancelledAt timestamp`,
+                status: 500,
+            };
+        }
+        // Add a small delay to allow backend to fully process the cancellation
+        await new Promise(resolve => setTimeout(resolve, 500));
+        return cancelledSubscription;
+    }
+    catch (error) {
+        // Handle SolvaPay errors and map to appropriate HTTP status codes
+        if (error instanceof SolvaPayError) {
+            const errorMessage = error.message;
+            // Map specific error messages to HTTP status codes
+            if (errorMessage.includes('Subscription not found')) {
+                return {
+                    error: 'Subscription not found',
+                    status: 404,
+                    details: errorMessage,
+                };
+            }
+            if (errorMessage.includes('cannot be cancelled') ||
+                errorMessage.includes('does not belong to provider')) {
+                return {
+                    error: 'Subscription cannot be cancelled or does not belong to provider',
+                    status: 400,
+                    details: errorMessage,
+                };
+            }
+            // For other SolvaPay errors, return 500
+            return {
+                error: errorMessage,
+                status: 500,
+                details: errorMessage,
+            };
+        }
+        return handleRouteError(error, 'Cancel subscription', 'Failed to cancel subscription');
+    }
+}
+//# sourceMappingURL=subscription.js.map

package/dist/src/helpers/subscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription.js","sourceRoot":"","sources":["../../../src/helpers/subscription.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,IAGC,EACD,UAEI,EAAE;IAEN,IAAI,CAAC;QACH,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,yDAAyD;gBAChE,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAA;QAErD,gDAAgD;QAChD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK,EAAE,wDAAwD;gBAC/D,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QAED,IAAI,qBAAqB,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC;YACtE,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;QAEF,sFAAsF;QACtF,IAAI,CAAC,qBAAqB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO;gBACL,KAAK,EAAE,oDAAoD;gBAC3D,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QAED,qFAAqF;QACrF,MAAM,WAAW,GAAG,qBAA4B,CAAA;QAChD,IAAI,WAAW,CAAC,YAAY,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC7E,qBAAqB,GAAG,WAAW,CAAC,YAAY,CAAA;QAClD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,sDAAsD;gBAC7D,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GACf,qBAAqB,CAAC,MAAM,KAAK,WAAW,IAAI,qBAAqB,CAAC,WAAW,CAAA;QAEnF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,8DAA8D,qBAAqB,CAAC,MAAM,iCAAiC;gBAClI,MAAM,EAAE,GAAG;aACZ,CAAA;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;QAEtD,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,kEAAkE;QAClE,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAA;YAElC,mDAAmD;YACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE,wBAAwB;oBAC/B,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,YAAY;iBACtB,CAAA;YACH,CAAC;YAED,IACE,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAC5C,YAAY,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EACpD,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,iEAAiE;oBACxE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,YAAY;iBACtB,CAAA;YACH,CAAC;YAED,wCAAwC;YACxC,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,YAAY;aACtB,CAAA;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,EAAE,+BAA+B,CAAC,CAAA;IACxF,CAAC;AACH,CAAC"}

package/dist/src/helpers/types.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Helper Types
+ *
+ * Shared types for route helpers
+ */
+/**
+ * Error result returned by core helpers
+ */
+export interface ErrorResult {
+    error: string;
+    status: number;
+    details?: string;
+}
+/**
+ * Authenticated user information
+ */
+export interface AuthenticatedUser {
+    userId: string;
+    email?: string | null;
+    name?: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/helpers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/helpers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB"}

package/dist/src/helpers/types.js

@@ -0,0 +1,7 @@
+/**
+ * Helper Types
+ *
+ * Shared types for route helpers
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/helpers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/helpers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/index.d.ts

@@ -0,0 +1,73 @@
+/**
+ * SolvaPay Server SDK
+ *
+ * Main entry point for the SolvaPay server-side SDK.
+ * Provides unified payable API with explicit adapters for all frameworks.
+ */
+import type { WebhookEvent } from './types/webhook';
+export { createSolvaPay } from './factory';
+export type { CreateSolvaPayConfig, SolvaPay, PayableFunction } from './factory';
+export { createSolvaPayClient } from './client';
+export type { ServerClientOptions } from './client';
+/**
+ * Verify webhook signature from SolvaPay backend.
+ *
+ * The backend sends an `SV-Signature` header in the format `t={timestamp},v1={hmac}`.
+ * The HMAC is SHA-256 over `"{timestamp}.{rawBody}"` keyed by the full webhook secret
+ * (including the `whsec_` prefix). Signatures older than 5 minutes are rejected to
+ * prevent replay attacks.
+ *
+ * @param params - Webhook verification parameters
+ * @param params.body - Raw request body as string (must be exactly as received)
+ * @param params.signature - Value of the `SV-Signature` header
+ * @param params.secret - Webhook signing secret from SolvaPay dashboard (`whsec_…`)
+ * @returns Parsed and typed {@link WebhookEvent} object
+ * @throws {SolvaPayError} If signature is missing, malformed, expired, or invalid
+ *
+ * @example
+ * ```typescript
+ * import { verifyWebhook } from '@solvapay/server';
+ *
+ * // Express.js — use express.raw() so the body is not parsed
+ * app.post('/webhooks/solvapay', express.raw({ type: 'application/json' }), (req, res) => {
+ *   try {
+ *     const event = verifyWebhook({
+ *       body: req.body.toString(),
+ *       signature: req.headers['sv-signature'] as string,
+ *       secret: process.env.SOLVAPAY_WEBHOOK_SECRET!,
+ *     });
+ *
+ *     if (event.type === 'purchase.created') {
+ *       // …
+ *     }
+ *
+ *     res.json({ received: true });
+ *   } catch (error) {
+ *     res.status(401).json({ error: 'Invalid signature' });
+ *   }
+ * });
+ * ```
+ *
+ * @see [Webhook Guide](../../../docs/guides/webhooks.md) for complete webhook handling examples
+ * @since 1.0.0
+ */
+export declare function verifyWebhook({ body, signature, secret, }: {
+    body: string;
+    signature: string;
+    secret: string;
+}): WebhookEvent;
+export { PaywallError, paywallErrorToClientPayload } from './paywall';
+export { createVirtualTools, VIRTUAL_TOOL_DEFINITIONS } from './virtual-tools';
+export type { VirtualToolsOptions, VirtualToolDefinition } from './virtual-tools';
+export { registerVirtualToolsMcpImpl, jsonSchemaToZodRawShape } from './register-virtual-tools-mcp';
+export type { McpServerLike, RegisterVirtualToolsMcpOptions } from './register-virtual-tools-mcp';
+export { buildAuthInfoFromBearer } from './mcp/auth-bridge';
+export { createMcpOAuthBridge } from './mcp/oauth-bridge';
+export { getOAuthProtectedResourceResponse, getOAuthAuthorizationServerResponse, } from './mcp/oauth-bridge';
+export type { components, LimitActivationBalance, LimitActivationProduct, LimitPlanSummary, SolvaPayClient, PayableOptions, HttpAdapterOptions, NextAdapterOptions, McpAdapterOptions, PaywallArgs, PaywallMetadata, PaywallStructuredContent, PaywallToolResult, RetryOptions, McpToolExtra, WebhookEvent, WebhookEventType, WebhookEventForType, WebhookEventObjectMap, CustomerWebhookObject, WebhookProduct, } from './types';
+export type { OneTimePurchaseInfo, ProcessPaymentResult, CustomerResponseMapped, McpBootstrapRequest, McpBootstrapResponse, McpBootstrapPlanInput, ConfigureMcpPlansRequest, ConfigureMcpPlansResponse, McpToolPlanMappingInput, ToolPlanMappingInput, } from './types/client';
+export { withRetry } from './utils';
+export { McpBearerAuthError, extractBearerToken, decodeJwtPayload, getCustomerRefFromJwtPayload, getCustomerRefFromBearerAuthHeader, } from './mcp-auth';
+export { getAuthenticatedUserCore, syncCustomerCore, createPaymentIntentCore, processPaymentIntentCore, createCheckoutSessionCore, createCustomerSessionCore, cancelPurchaseCore, listPlansCore, isErrorResult, handleRouteError, } from './helpers';
+export type { ErrorResult, AuthenticatedUser } from './helpers';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,YAAY,EAAE,oBAAoB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAGhF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,aAAa,CAAC,EAC5B,IAAI,EACJ,SAAS,EACT,MAAM,GACP,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,YAAY,CAwCf;AAGD,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AAGrE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC9E,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACjF,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACnG,YAAY,EAAE,aAAa,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EACL,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,oBAAoB,CAAA;AAG3B,YAAY,EACV,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,106 @@
+/**
+ * SolvaPay Server SDK
+ *
+ * Main entry point for the SolvaPay server-side SDK.
+ * Provides unified payable API with explicit adapters for all frameworks.
+ */
+import crypto from 'node:crypto';
+import { SolvaPayError } from '@solvapay/core';
+// Main factory for unified API
+export { createSolvaPay } from './factory';
+// Re-export client creation (for advanced use cases)
+export { createSolvaPayClient } from './client';
+/**
+ * Verify webhook signature from SolvaPay backend.
+ *
+ * The backend sends an `SV-Signature` header in the format `t={timestamp},v1={hmac}`.
+ * The HMAC is SHA-256 over `"{timestamp}.{rawBody}"` keyed by the full webhook secret
+ * (including the `whsec_` prefix). Signatures older than 5 minutes are rejected to
+ * prevent replay attacks.
+ *
+ * @param params - Webhook verification parameters
+ * @param params.body - Raw request body as string (must be exactly as received)
+ * @param params.signature - Value of the `SV-Signature` header
+ * @param params.secret - Webhook signing secret from SolvaPay dashboard (`whsec_…`)
+ * @returns Parsed and typed {@link WebhookEvent} object
+ * @throws {SolvaPayError} If signature is missing, malformed, expired, or invalid
+ *
+ * @example
+ * ```typescript
+ * import { verifyWebhook } from '@solvapay/server';
+ *
+ * // Express.js — use express.raw() so the body is not parsed
+ * app.post('/webhooks/solvapay', express.raw({ type: 'application/json' }), (req, res) => {
+ *   try {
+ *     const event = verifyWebhook({
+ *       body: req.body.toString(),
+ *       signature: req.headers['sv-signature'] as string,
+ *       secret: process.env.SOLVAPAY_WEBHOOK_SECRET!,
+ *     });
+ *
+ *     if (event.type === 'purchase.created') {
+ *       // …
+ *     }
+ *
+ *     res.json({ received: true });
+ *   } catch (error) {
+ *     res.status(401).json({ error: 'Invalid signature' });
+ *   }
+ * });
+ * ```
+ *
+ * @see [Webhook Guide](../../../docs/guides/webhooks.md) for complete webhook handling examples
+ * @since 1.0.0
+ */
+export function verifyWebhook({ body, signature, secret, }) {
+    const toleranceSec = 300;
+    if (!signature)
+        throw new SolvaPayError('Missing webhook signature');
+    const parts = signature.split(',');
+    const tPart = parts.find(p => p.startsWith('t='));
+    const v1Part = parts.find(p => p.startsWith('v1='));
+    if (!tPart || !v1Part) {
+        throw new SolvaPayError('Malformed webhook signature');
+    }
+    const timestamp = parseInt(tPart.slice(2), 10);
+    const receivedHmac = v1Part.slice(3);
+    if (Number.isNaN(timestamp) || !receivedHmac) {
+        throw new SolvaPayError('Malformed webhook signature');
+    }
+    if (toleranceSec > 0) {
+        const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
+        if (age > toleranceSec) {
+            throw new SolvaPayError('Webhook signature timestamp too old');
+        }
+    }
+    const expectedHmac = crypto
+        .createHmac('sha256', secret)
+        .update(`${timestamp}.${body}`)
+        .digest('hex');
+    if (receivedHmac.length !== expectedHmac.length) {
+        throw new SolvaPayError('Invalid webhook signature');
+    }
+    const ok = crypto.timingSafeEqual(Buffer.from(expectedHmac), Buffer.from(receivedHmac));
+    if (!ok)
+        throw new SolvaPayError('Invalid webhook signature');
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new SolvaPayError('Invalid webhook payload: body is not valid JSON');
+    }
+}
+// Export PaywallError for error handling
+export { PaywallError, paywallErrorToClientPayload } from './paywall';
+// Export virtual tools for MCP server monetization
+export { createVirtualTools, VIRTUAL_TOOL_DEFINITIONS } from './virtual-tools';
+export { registerVirtualToolsMcpImpl, jsonSchemaToZodRawShape } from './register-virtual-tools-mcp';
+export { buildAuthInfoFromBearer } from './mcp/auth-bridge';
+export { createMcpOAuthBridge } from './mcp/oauth-bridge';
+export { getOAuthProtectedResourceResponse, getOAuthAuthorizationServerResponse, } from './mcp/oauth-bridge';
+// Export utilities for general use
+export { withRetry } from './utils';
+export { McpBearerAuthError, extractBearerToken, decodeJwtPayload, getCustomerRefFromJwtPayload, getCustomerRefFromBearerAuthHeader, } from './mcp-auth';
+// Export route helpers (generic, framework-agnostic)
+export { getAuthenticatedUserCore, syncCustomerCore, createPaymentIntentCore, processPaymentIntentCore, createCheckoutSessionCore, createCustomerSessionCore, cancelPurchaseCore, listPlansCore, isErrorResult, handleRouteError, } from './helpers';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG9C,+BAA+B;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAG1C,qDAAqD;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAG/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,IAAI,EACJ,SAAS,EACT,MAAM,GAKP;IACC,MAAM,YAAY,GAAG,GAAG,CAAA;IACxB,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAA;IACxD,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;QAC/D,IAAI,GAAG,GAAG,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM;SACxB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC,CAAA;IAEhB,IAAI,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IACvF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAA;IAE7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,iDAAiD,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AAErE,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE9E,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EACL,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,oBAAoB,CAAA;AAyC3B,mCAAmC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,YAAY,CAAA;AAEnB,qDAAqD;AACrD,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,WAAW,CAAA"}

package/dist/src/mcp/auth-bridge.d.ts

@@ -0,0 +1,9 @@
+import { type McpBearerCustomerRefOptions } from '../mcp-auth';
+import type { McpToolExtra } from '../types';
+export interface BuildAuthInfoFromBearerOptions extends McpBearerCustomerRefOptions {
+    clientId?: string;
+    defaultScopes?: string[];
+    includePayload?: boolean;
+}
+export declare function buildAuthInfoFromBearer(authorization?: string | null, options?: BuildAuthInfoFromBearerOptions): McpToolExtra['authInfo'] | null;
+//# sourceMappingURL=auth-bridge.d.ts.map

package/dist/src/mcp/auth-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAI5C,MAAM,WAAW,8BAA+B,SAAQ,2BAA2B;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAiCD,wBAAgB,uBAAuB,CACrC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,GAAE,8BAAmC,GAC3C,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAoBjC"}

package/dist/src/mcp/auth-bridge.js

@@ -0,0 +1,46 @@
+import { decodeJwtPayload, extractBearerToken, getCustomerRefFromJwtPayload, } from '../mcp-auth';
+function getClientId(payload, explicitClientId) {
+    if (explicitClientId)
+        return explicitClientId;
+    const payloadClientId = (typeof payload.client_id === 'string' && payload.client_id) ||
+        (typeof payload.azp === 'string' && payload.azp) ||
+        (typeof payload.aud === 'string' && payload.aud) ||
+        null;
+    return payloadClientId || 'solvapay-mcp-client';
+}
+function getScopes(payload, defaultScopes) {
+    if (Array.isArray(payload.scp)) {
+        return payload.scp.filter(scope => typeof scope === 'string');
+    }
+    if (typeof payload.scope === 'string' && payload.scope.trim()) {
+        return payload.scope
+            .split(/\s+/)
+            .map(scope => scope.trim())
+            .filter(Boolean);
+    }
+    return defaultScopes;
+}
+function getExpiresAt(payload) {
+    return typeof payload.exp === 'number' ? payload.exp : undefined;
+}
+export function buildAuthInfoFromBearer(authorization, options = {}) {
+    const token = extractBearerToken(authorization);
+    if (!token)
+        return null;
+    const payload = decodeJwtPayload(token);
+    const customerRef = getCustomerRefFromJwtPayload(payload, options);
+    const clientId = getClientId(payload, options.clientId);
+    const scopes = getScopes(payload, options.defaultScopes || []);
+    const expiresAt = getExpiresAt(payload);
+    return {
+        token,
+        clientId,
+        scopes,
+        expiresAt,
+        extra: {
+            customer_ref: customerRef,
+            ...(options.includePayload ? { payload } : {}),
+        },
+    };
+}
+//# sourceMappingURL=auth-bridge.js.map

package/dist/src/mcp/auth-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.js","sourceRoot":"","sources":["../../../src/mcp/auth-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,GAE7B,MAAM,aAAa,CAAA;AAWpB,SAAS,WAAW,CAAC,OAAmB,EAAE,gBAAyB;IACjE,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAA;IAE7C,MAAM,eAAe,GACnB,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC;QAC5D,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAChD,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAChD,IAAI,CAAA;IAEN,OAAO,eAAe,IAAI,qBAAqB,CAAA;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,aAAuB;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAa,CAAA;IAC3E,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,KAAK;aACjB,KAAK,CAAC,KAAK,CAAC;aACZ,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,OAAmB;IACvC,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,aAA6B,EAC7B,UAA0C,EAAE;IAE5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,4BAA4B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAEvC,OAAO;QACL,KAAK;QACL,QAAQ;QACR,MAAM;QACN,SAAS;QACT,KAAK,EAAE;YACL,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;KACF,CAAA;AACH,CAAC"}

package/dist/src/mcp/oauth-bridge.d.ts

@@ -0,0 +1,48 @@
+import { type BuildAuthInfoFromBearerOptions } from './auth-bridge';
+type RequestLike = {
+    method?: string;
+    path?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    auth?: unknown;
+};
+type ResponseLike = {
+    status: (code: number) => ResponseLike;
+    json: (payload: unknown) => void;
+    setHeader: (name: string, value: string) => void;
+};
+type NextLike = () => void;
+type Middleware = (req: RequestLike, res: ResponseLike, next: NextLike) => void;
+export interface OAuthAuthorizationServerOptions {
+    apiBaseUrl: string;
+    productRef: string;
+}
+export interface McpOAuthBridgeOptions {
+    publicBaseUrl: string;
+    apiBaseUrl: string;
+    productRef: string;
+    mcpPath?: string;
+    requireAuth?: boolean;
+    authInfo?: BuildAuthInfoFromBearerOptions;
+    protectedResourcePath?: string;
+    authorizationServerPath?: string;
+}
+export declare function getOAuthProtectedResourceResponse(publicBaseUrl: string): {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+};
+export declare function getOAuthAuthorizationServerResponse({ apiBaseUrl, productRef, }: OAuthAuthorizationServerOptions): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    token_endpoint_auth_methods_supported: string[];
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    scopes_supported: string[];
+    code_challenge_methods_supported: string[];
+};
+export declare function createMcpOAuthBridge(options: McpOAuthBridgeOptions): Middleware[];
+export {};
+//# sourceMappingURL=oauth-bridge.d.ts.map

package/dist/src/mcp/oauth-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-bridge.d.ts","sourceRoot":"","sources":["../../../src/mcp/oauth-bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,8BAA8B,EAAE,MAAM,eAAe,CAAA;AAI5F,KAAK,WAAW,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACvD,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;CACf,CAAA;AAED,KAAK,YAAY,GAAG;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAA;IACtC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;IAChC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACjD,CAAA;AAED,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAA;AAC1B,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAA;AAE/E,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,8BAA8B,CAAA;IACzC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AAuCD,wBAAgB,iCAAiC,CAAC,aAAa,EAAE,MAAM;;;;EAOtE;AAED,wBAAgB,mCAAmC,CAAC,EAClD,UAAU,EACV,UAAU,GACX,EAAE,+BAA+B;;;;;;;;;;EAejC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,EAAE,CA2EjF"}

package/dist/src/mcp/oauth-bridge.js

@@ -0,0 +1,110 @@
+import { McpBearerAuthError } from '../mcp-auth';
+import { buildAuthInfoFromBearer } from './auth-bridge';
+function withoutTrailingSlash(value) {
+    return value.replace(/\/$/, '');
+}
+function getRequestAuthHeader(req) {
+    const header = req.headers?.authorization;
+    if (typeof header === 'string')
+        return header;
+    if (Array.isArray(header))
+        return header[0] || null;
+    return null;
+}
+function getRequestJsonRpcId(body) {
+    if (body && typeof body === 'object' && 'id' in body) {
+        const id = body.id;
+        return id ?? null;
+    }
+    return null;
+}
+function makeUnauthorizedJsonRpc(id) {
+    return {
+        jsonrpc: '2.0',
+        id,
+        error: {
+            code: -32001,
+            message: 'Unauthorized',
+        },
+    };
+}
+function setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath) {
+    res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`);
+}
+export function getOAuthProtectedResourceResponse(publicBaseUrl) {
+    const resource = withoutTrailingSlash(publicBaseUrl);
+    return {
+        resource,
+        authorization_servers: [resource],
+        scopes_supported: ['openid', 'profile', 'email'],
+    };
+}
+export function getOAuthAuthorizationServerResponse({ apiBaseUrl, productRef, }) {
+    const normalizedApiBaseUrl = withoutTrailingSlash(apiBaseUrl);
+    const registrationEndpoint = `${normalizedApiBaseUrl}/v1/customer/auth/register?product_ref=${encodeURIComponent(productRef)}`;
+    return {
+        issuer: normalizedApiBaseUrl,
+        authorization_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/authorize`,
+        token_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/token`,
+        registration_endpoint: registrationEndpoint,
+        token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        scopes_supported: ['openid', 'profile', 'email'],
+        code_challenge_methods_supported: ['S256'],
+    };
+}
+export function createMcpOAuthBridge(options) {
+    const { publicBaseUrl, apiBaseUrl, productRef, mcpPath = '/mcp', requireAuth = true, authInfo, protectedResourcePath = '/.well-known/oauth-protected-resource', authorizationServerPath = '/.well-known/oauth-authorization-server', } = options;
+    const protectedResourceMiddleware = (req, res, next) => {
+        if (req.method !== 'GET' || req.path !== protectedResourcePath) {
+            next();
+            return;
+        }
+        res.json(getOAuthProtectedResourceResponse(publicBaseUrl));
+    };
+    const authorizationServerMiddleware = (req, res, next) => {
+        if (req.method !== 'GET' || req.path !== authorizationServerPath) {
+            next();
+            return;
+        }
+        if (!productRef) {
+            res.status(500).json({ error: 'SOLVAPAY_PRODUCT_REF missing' });
+            return;
+        }
+        res.json(getOAuthAuthorizationServerResponse({
+            apiBaseUrl,
+            productRef,
+        }));
+    };
+    const mcpAuthMiddleware = (req, res, next) => {
+        if (req.path !== mcpPath) {
+            next();
+            return;
+        }
+        const authHeader = getRequestAuthHeader(req);
+        const id = getRequestJsonRpcId(req.body);
+        if (!authHeader && !requireAuth) {
+            next();
+            return;
+        }
+        try {
+            const auth = buildAuthInfoFromBearer(authHeader, authInfo);
+            if (!auth) {
+                throw new McpBearerAuthError('Missing bearer token');
+            }
+            req.auth = auth;
+            next();
+        }
+        catch {
+            setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath);
+            if (req.method === 'POST') {
+                res.status(401).json(makeUnauthorizedJsonRpc(id));
+                return;
+            }
+            res.status(401).json({ error: 'Unauthorized' });
+        }
+    };
+    return [protectedResourceMiddleware, authorizationServerMiddleware, mcpAuthMiddleware];
+}
+//# sourceMappingURL=oauth-bridge.js.map

package/dist/src/mcp/oauth-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-bridge.js","sourceRoot":"","sources":["../../../src/mcp/oauth-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAuC,MAAM,eAAe,CAAA;AAqC5F,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAgB;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAA;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,EAAE,GAAI,IAA2B,CAAC,EAAE,CAAA;QAC1C,OAAO,EAAE,IAAI,IAAI,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAa;IAC5C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE;QACF,KAAK,EAAE;YACL,IAAI,EAAE,CAAC,KAAK;YACZ,OAAO,EAAE,cAAc;SACxB;KACF,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAiB,EAAE,aAAqB,EAAE,qBAA6B;IACpG,GAAG,CAAC,SAAS,CACX,kBAAkB,EAClB,6BAA6B,oBAAoB,CAAC,aAAa,CAAC,GAAG,qBAAqB,GAAG,CAC5F,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,aAAqB;IACrE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAA;IACpD,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,CAAC,QAAQ,CAAC;QACjC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACjD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,EAClD,UAAU,EACV,UAAU,GACsB;IAChC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;IAC7D,MAAM,oBAAoB,GAAG,GAAG,oBAAoB,0CAA0C,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAA;IAE9H,OAAO;QACL,MAAM,EAAE,oBAAoB;QAC5B,sBAAsB,EAAE,GAAG,oBAAoB,6BAA6B;QAC5E,cAAc,EAAE,GAAG,oBAAoB,yBAAyB;QAChE,qBAAqB,EAAE,oBAAoB;QAC3C,qCAAqC,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;QACpF,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,gCAAgC,EAAE,CAAC,MAAM,CAAC;KAC3C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,EACJ,aAAa,EACb,UAAU,EACV,UAAU,EACV,OAAO,GAAG,MAAM,EAChB,WAAW,GAAG,IAAI,EAClB,QAAQ,EACR,qBAAqB,GAAG,uCAAuC,EAC/D,uBAAuB,GAAG,yCAAyC,GACpE,GAAG,OAAO,CAAA;IAEX,MAAM,2BAA2B,GAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC/D,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,aAAa,CAAC,CAAC,CAAA;IAC5D,CAAC,CAAA;IAED,MAAM,6BAA6B,GAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACjE,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QAED,GAAG,CAAC,IAAI,CACN,mCAAmC,CAAC;YAClC,UAAU;YACV,UAAU;SACX,CAAC,CACH,CAAA;IACH,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAExC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;YACtD,CAAC;YAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;YACf,IAAI,EAAE,CAAA;QACR,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB,CAAC,GAAG,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAA;YAEhE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjD,OAAM;YACR,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC,CAAA;IAED,OAAO,CAAC,2BAA2B,EAAE,6BAA6B,EAAE,iBAAiB,CAAC,CAAA;AACxF,CAAC"}

package/dist/src/mcp-auth.d.ts

@@ -0,0 +1,17 @@
+/**
+ * MCP OAuth helper utilities.
+ *
+ * These helpers are intentionally lightweight and do not verify JWT signatures.
+ * Use them after token validation (for example via /v1/customer/auth/userinfo).
+ */
+export declare class McpBearerAuthError extends Error {
+    constructor(message: string);
+}
+export type McpBearerCustomerRefOptions = {
+    claimPriority?: string[];
+};
+export declare function extractBearerToken(authorization?: string | null): string | null;
+export declare function decodeJwtPayload(token: string): Record<string, unknown>;
+export declare function getCustomerRefFromJwtPayload(payload: Record<string, unknown>, options?: McpBearerCustomerRefOptions): string;
+export declare function getCustomerRefFromBearerAuthHeader(authorization?: string | null, options?: McpBearerCustomerRefOptions): string;
+//# sourceMappingURL=mcp-auth.d.ts.map

package/dist/src/mcp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../../src/mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAQD,wBAAgB,kBAAkB,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAavE;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,2BAAgC,GACxC,MAAM,CAaR;AAED,wBAAgB,kCAAkC,CAChD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,GAAE,2BAAgC,GACxC,MAAM,CAOR"}