@solvapay/server 1.0.8-preview.6 → 1.0.8-preview.7

package/dist/index.js

@@ -1826,15 +1826,31 @@ function buildAuthInfoFromBearer(authorization, options = {}) {
 }
 
 // src/mcp/oauth-bridge.ts
+var DEFAULT_OAUTH_PATHS = {
+  register: "/oauth/register",
+  authorize: "/oauth/authorize",
+  token: "/oauth/token",
+  revoke: "/oauth/revoke"
+};
+var NATIVE_CLIENT_ORIGIN_SCHEMES = ["cursor:", "vscode:", "vscode-webview:", "claude:"];
 function withoutTrailingSlash(value) {
   return value.replace(/\/$/, "");
 }
+function resolvePaths(paths = {}) {
+  return { ...DEFAULT_OAUTH_PATHS, ...paths };
+}
 function getRequestAuthHeader(req) {
   const header = req.headers?.authorization;
   if (typeof header === "string") return header;
   if (Array.isArray(header)) return header[0] || null;
   return null;
 }
+function getHeader(req, name) {
+  const header = req.headers?.[name.toLowerCase()];
+  if (typeof header === "string") return header;
+  if (Array.isArray(header)) return header[0] || null;
+  return null;
+}
 function getRequestJsonRpcId(body) {
   if (body && typeof body === "object" && "id" in body) {
     const id = body.id;
@@ -1858,6 +1874,100 @@ function setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath) {
     `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`
   );
 }
+function getRequestQuery(req) {
+  const raw = req.url ?? req.path ?? "";
+  const qIndex = raw.indexOf("?");
+  return qIndex === -1 ? "" : raw.slice(qIndex);
+}
+function isNativeClientOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    return NATIVE_CLIENT_ORIGIN_SCHEMES.includes(
+      url.protocol
+    );
+  } catch {
+    return false;
+  }
+}
+function applyCorsHeaders(req, res) {
+  const origin = getHeader(req, "origin");
+  if (!origin) return;
+  if (isNativeClientOrigin(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
+}
+function handlePreflight(req, res) {
+  applyCorsHeaders(req, res);
+  const requestedMethod = getHeader(req, "access-control-request-method") ?? "POST";
+  const requestedHeaders = getHeader(req, "access-control-request-headers") ?? "authorization, content-type";
+  res.setHeader("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
+  res.setHeader("Access-Control-Allow-Headers", requestedHeaders);
+  res.setHeader("Access-Control-Max-Age", "600");
+  res.status(204);
+  if (typeof res.end === "function") {
+    res.end();
+  } else {
+    res.json({});
+  }
+}
+async function readJsonFromResponse(upstream) {
+  const text = await upstream.text();
+  if (!text) return { body: {}, text: "" };
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: text, text };
+  }
+}
+async function relayJsonResponse(upstream, res) {
+  const { body, text } = await readJsonFromResponse(upstream);
+  res.status(upstream.status);
+  const contentType = upstream.headers.get("content-type");
+  if (contentType) res.setHeader("Content-Type", contentType);
+  if (text === "" && upstream.status === 204) {
+    if (typeof res.end === "function") {
+      res.end();
+      return;
+    }
+  }
+  res.json(body);
+}
+function sendUpstreamError(res, _error) {
+  res.status(502);
+  res.setHeader("Content-Type", "application/json");
+  res.json({ error: "upstream_unreachable" });
+}
+function serializeRegisterBody(body) {
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  return JSON.stringify(body ?? {});
+}
+function serializeFormBody(body) {
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  if (body && typeof body === "object") {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(body)) {
+      if (value === void 0 || value === null) continue;
+      if (Array.isArray(value)) {
+        for (const entry of value) params.append(key, String(entry));
+      } else {
+        params.append(key, String(value));
+      }
+    }
+    return params.toString();
+  }
+  return "";
+}
+function serializeRequestBody(contentType, body) {
+  if (contentType && contentType.includes("application/x-www-form-urlencoded")) {
+    return serializeFormBody(body);
+  }
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  return JSON.stringify(body ?? {});
+}
 function getOAuthProtectedResourceResponse(publicBaseUrl) {
   const resource = withoutTrailingSlash(publicBaseUrl);
   return {
@@ -1867,16 +1977,17 @@ function getOAuthProtectedResourceResponse(publicBaseUrl) {
   };
 }
 function getOAuthAuthorizationServerResponse({
-  apiBaseUrl,
-  productRef
+  publicBaseUrl,
+  paths
 }) {
-  const normalizedApiBaseUrl = withoutTrailingSlash(apiBaseUrl);
-  const registrationEndpoint = `${normalizedApiBaseUrl}/v1/customer/auth/register?product_ref=${encodeURIComponent(productRef)}`;
+  const base = withoutTrailingSlash(publicBaseUrl);
+  const p = resolvePaths(paths);
   return {
-    issuer: normalizedApiBaseUrl,
-    authorization_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/authorize`,
-    token_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/token`,
-    registration_endpoint: registrationEndpoint,
+    issuer: base,
+    authorization_endpoint: `${base}${p.authorize}`,
+    token_endpoint: `${base}${p.token}`,
+    registration_endpoint: `${base}${p.register}`,
+    revocation_endpoint: `${base}${p.revoke}`,
     token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
     response_types_supported: ["code"],
     grant_types_supported: ["authorization_code", "refresh_token"],
@@ -1884,6 +1995,134 @@ function getOAuthAuthorizationServerResponse({
     code_challenge_methods_supported: ["S256"]
   };
 }
+function createOAuthRegisterHandler(options) {
+  const path = options.path ?? DEFAULT_OAUTH_PATHS.register;
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: serializeRegisterBody(req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
+function createOAuthAuthorizeHandler(options) {
+  const path = options.path ?? DEFAULT_OAUTH_PATHS.authorize;
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  return (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "GET") {
+      next();
+      return;
+    }
+    const query = getRequestQuery(req);
+    const location = `${api}/v1/customer/auth/authorize${query}`;
+    res.setHeader("Location", location);
+    res.status(302);
+    if (typeof res.end === "function") {
+      res.end();
+      return;
+    }
+    res.json({});
+  };
+}
+function createOAuthTokenHandler(options) {
+  const path = options.path ?? DEFAULT_OAUTH_PATHS.token;
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/token`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
+    const authorization = getHeader(req, "authorization");
+    const headers = { "content-type": contentType };
+    if (authorization) headers["authorization"] = authorization;
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers,
+        body: serializeRequestBody(contentType, req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
+function createOAuthRevokeHandler(options) {
+  const path = options.path ?? DEFAULT_OAUTH_PATHS.revoke;
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/revoke`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
+    const authorization = getHeader(req, "authorization");
+    const headers = { "content-type": contentType };
+    if (authorization) headers["authorization"] = authorization;
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers,
+        body: serializeRequestBody(contentType, req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
 function createMcpOAuthBridge(options) {
   const {
     publicBaseUrl,
@@ -1893,8 +2132,10 @@ function createMcpOAuthBridge(options) {
     requireAuth = true,
     authInfo,
     protectedResourcePath = "/.well-known/oauth-protected-resource",
-    authorizationServerPath = "/.well-known/oauth-authorization-server"
+    authorizationServerPath = "/.well-known/oauth-authorization-server",
+    oauthPaths
   } = options;
+  const paths = resolvePaths(oauthPaths);
   const protectedResourceMiddleware = (req, res, next) => {
     if (req.method !== "GET" || req.path !== protectedResourcePath) {
       next();
@@ -1913,16 +2154,38 @@ function createMcpOAuthBridge(options) {
     }
     res.json(
       getOAuthAuthorizationServerResponse({
-        apiBaseUrl,
-        productRef
+        publicBaseUrl,
+        paths
       })
     );
   };
+  const registerMiddleware = createOAuthRegisterHandler({
+    apiBaseUrl,
+    productRef,
+    path: paths.register
+  });
+  const authorizeMiddleware = createOAuthAuthorizeHandler({
+    apiBaseUrl,
+    path: paths.authorize
+  });
+  const tokenMiddleware = createOAuthTokenHandler({ apiBaseUrl, path: paths.token });
+  const revokeMiddleware = createOAuthRevokeHandler({ apiBaseUrl, path: paths.revoke });
   const mcpAuthMiddleware = (req, res, next) => {
     if (req.path !== mcpPath) {
       next();
       return;
     }
+    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
+      applyCorsHeaders(req, res);
+      res.setHeader("Allow", "POST, OPTIONS");
+      res.status(405);
+      if (typeof res.end === "function") {
+        res.end();
+      } else {
+        res.json({ error: "method_not_allowed" });
+      }
+      return;
+    }
     const authHeader = getRequestAuthHeader(req);
     const id = getRequestJsonRpcId(req.body);
     if (!authHeader && !requireAuth) {
@@ -1937,6 +2200,8 @@ function createMcpOAuthBridge(options) {
       req.auth = auth;
       next();
     } catch {
+      applyCorsHeaders(req, res);
+      res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, Mcp-Session-Id");
       setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath);
       if (req.method === "POST") {
         res.status(401).json(makeUnauthorizedJsonRpc(id));
@@ -1945,7 +2210,15 @@ function createMcpOAuthBridge(options) {
       res.status(401).json({ error: "Unauthorized" });
     }
   };
-  return [protectedResourceMiddleware, authorizationServerMiddleware, mcpAuthMiddleware];
+  return [
+    protectedResourceMiddleware,
+    authorizationServerMiddleware,
+    registerMiddleware,
+    authorizeMiddleware,
+    tokenMiddleware,
+    revokeMiddleware,
+    mcpAuthMiddleware
+  ];
 }
 
 // src/helpers/error.ts
@@ -2628,6 +2901,10 @@ export {
   createCheckoutSessionCore,
   createCustomerSessionCore,
   createMcpOAuthBridge,
+  createOAuthAuthorizeHandler,
+  createOAuthRegisterHandler,
+  createOAuthRevokeHandler,
+  createOAuthTokenHandler,
   createPaymentIntentCore,
   createSolvaPay,
   createSolvaPayClient,

package/dist/src/adapters/base.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Base Adapter Interface
+ *
+ * Defines the contract for all framework adapters.
+ * Each adapter handles extraction, transformation, and formatting for its specific context.
+ */
+import type { SolvaPayPaywall } from '../paywall';
+import type { PaywallMetadata } from '../types';
+/**
+ * Base adapter interface that all framework adapters implement
+ */
+export interface Adapter<TContext = any, TResult = any> {
+    /**
+     * Extract plain arguments from the framework-specific context
+     */
+    extractArgs(context: TContext): Promise<Record<string, unknown>> | Record<string, unknown>;
+    /**
+     * Extract customer reference from the context
+     */
+    getCustomerRef(context: TContext, extra?: unknown): Promise<string> | string;
+    /**
+     * Format the business logic result for the framework
+     */
+    formatResponse(result: unknown, context: TContext): TResult;
+    /**
+     * Format errors for the framework
+     */
+    formatError(error: Error, context: TContext): TResult;
+}
+/**
+ * Shared utilities for adapters
+ */
+export declare class AdapterUtils {
+    /**
+     * Ensure customer reference is properly formatted
+     */
+    static ensureCustomerRef(customerRef: string): string;
+    /**
+     * Extract customer ref from JWT token
+     */
+    static extractFromJWT(token: string, options?: {
+        secret?: string;
+        issuer?: string;
+        audience?: string;
+    }): Promise<string | null>;
+}
+/**
+ * Create a protected handler using an adapter.
+ *
+ * The returned closure caches:
+ * - `backendRefCache`: resolved customer ref (input → cus_xxx) so ensureCustomer
+ *   is only called once per distinct customer identity.
+ * - `protectedHandler`: the closure returned by paywall.protect() is created once
+ *   and reused across invocations.
+ */
+export declare function createAdapterHandler<TContext, TResult>(adapter: Adapter<TContext, TResult>, paywall: SolvaPayPaywall, metadata: PaywallMetadata, businessLogic: (args: any) => Promise<any>): Promise<(context: TContext, extra?: unknown) => Promise<TResult>>;
+//# sourceMappingURL=base.d.ts.map

package/dist/src/adapters/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/adapters/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,UAAU,CAAA;AAE5D;;GAEG;AAEH,MAAM,WAAW,OAAO,CAAC,QAAQ,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACpD;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE1F;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IAE5E;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAA;IAE3D;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAA;CACtD;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IASrD;;OAEG;WACU,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAkB1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAC1D,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EACnC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,eAAe,EAEzB,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,GACzC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAwBnE"}

package/dist/src/adapters/base.js

@@ -0,0 +1,73 @@
+/**
+ * Base Adapter Interface
+ *
+ * Defines the contract for all framework adapters.
+ * Each adapter handles extraction, transformation, and formatting for its specific context.
+ */
+/**
+ * Shared utilities for adapters
+ */
+export class AdapterUtils {
+    /**
+     * Ensure customer reference is properly formatted
+     */
+    static ensureCustomerRef(customerRef) {
+        if (!customerRef || customerRef === 'anonymous') {
+            return 'anonymous';
+        }
+        // Return customer ref as-is (preserve UUIDs with hyphens, etc.)
+        return customerRef;
+    }
+    /**
+     * Extract customer ref from JWT token
+     */
+    static async extractFromJWT(token, options) {
+        try {
+            const { jwtVerify } = await import('jose');
+            const jwtSecret = new TextEncoder().encode(options?.secret || process.env.OAUTH_JWKS_SECRET || 'test-jwt-secret');
+            const { payload } = await jwtVerify(token, jwtSecret, {
+                issuer: options?.issuer || process.env.OAUTH_ISSUER || 'http://localhost:3000',
+                audience: options?.audience || process.env.OAUTH_CLIENT_ID || 'test-client-id',
+            });
+            return payload.sub || null;
+        }
+        catch {
+            // JWT verification failed, return null
+            return null;
+        }
+    }
+}
+/**
+ * Create a protected handler using an adapter.
+ *
+ * The returned closure caches:
+ * - `backendRefCache`: resolved customer ref (input → cus_xxx) so ensureCustomer
+ *   is only called once per distinct customer identity.
+ * - `protectedHandler`: the closure returned by paywall.protect() is created once
+ *   and reused across invocations.
+ */
+export async function createAdapterHandler(adapter, paywall, metadata, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+businessLogic) {
+    const backendRefCache = new Map();
+    const getCustomerRef = (args) => args.auth?.customer_ref || 'anonymous';
+    const protectedHandler = await paywall.protect(businessLogic, metadata, getCustomerRef);
+    return async (context, extra) => {
+        try {
+            const args = await adapter.extractArgs(context);
+            const customerRef = await adapter.getCustomerRef(context, extra);
+            let backendRef = backendRefCache.get(customerRef);
+            if (!backendRef) {
+                backendRef = await paywall.ensureCustomer(customerRef, customerRef);
+                backendRefCache.set(customerRef, backendRef);
+            }
+            args.auth = { customer_ref: backendRef };
+            const result = await protectedHandler(args);
+            return adapter.formatResponse(result, context);
+        }
+        catch (error) {
+            return adapter.formatError(error, context);
+        }
+    };
+}
+//# sourceMappingURL=base.js.map

package/dist/src/adapters/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/adapters/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+BH;;GAEG;AACH,MAAM,OAAO,YAAY;IACvB;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,WAAmB;QAC1C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChD,OAAO,WAAW,CAAA;QACpB,CAAC;QAED,gEAAgE;QAChE,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAAa,EACb,OAIC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACxC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CACtE,CAAA;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;gBACpD,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB;gBAC9E,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB;aAC/E,CAAC,CAAA;YAEF,OAAQ,OAAO,CAAC,GAAc,IAAI,IAAI,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;YACvC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAmC,EACnC,OAAwB,EACxB,QAAyB;AACzB,8DAA8D;AAC9D,aAA0C;IAE1C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAA;IACjD,MAAM,cAAc,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,WAAW,CAAA;IACpF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IAEvF,OAAO,KAAK,EAAE,OAAiB,EAAE,KAAe,EAAoB,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEhE,IAAI,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;gBACnE,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;YAC9C,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,CAAA;YAExC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;YAC3C,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,KAAc,EAAE,OAAO,CAAC,CAAA;QACrD,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/src/adapters/http.d.ts

@@ -0,0 +1,25 @@
+/**
+ * HTTP Adapter for Express and Fastify
+ *
+ * Handles Express and Fastify HTTP frameworks with automatic detection
+ * of request/response patterns.
+ */
+import type { Adapter } from './base';
+import type { HttpAdapterOptions } from '../types';
+/**
+ * HTTP context (Express or Fastify)
+ */
+type HttpContext = [req: any, reply: any];
+/**
+ * HTTP Adapter implementation
+ */
+export declare class HttpAdapter implements Adapter<HttpContext, unknown> {
+    private options;
+    constructor(options?: HttpAdapterOptions);
+    extractArgs([req, _reply]: HttpContext): Record<string, unknown>;
+    getCustomerRef([req, _reply]: HttpContext): Promise<string>;
+    formatResponse(result: unknown, [_req, reply]: HttpContext): unknown;
+    formatError(error: Error, [_req, reply]: HttpContext): unknown;
+}
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/src/adapters/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAGlD;;GAEG;AAEH,KAAK,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;AAEzC;;GAEG;AACH,qBAAa,WAAY,YAAW,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;IACnD,OAAO,CAAC,OAAO;gBAAP,OAAO,GAAE,kBAAuB;IAEpD,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa1D,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BjE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO;IAepE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO;CAyC/D"}

package/dist/src/adapters/http.js

@@ -0,0 +1,99 @@
+/**
+ * HTTP Adapter for Express and Fastify
+ *
+ * Handles Express and Fastify HTTP frameworks with automatic detection
+ * of request/response patterns.
+ */
+import { AdapterUtils } from './base';
+import { PaywallError } from '../paywall';
+/**
+ * HTTP Adapter implementation
+ */
+export class HttpAdapter {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    extractArgs([req, _reply]) {
+        if (this.options.extractArgs) {
+            return this.options.extractArgs(req);
+        }
+        // Default extraction from req.body, req.params, req.query
+        return {
+            ...(req.body || {}),
+            ...(req.params || {}),
+            ...(req.query || {}),
+        };
+    }
+    async getCustomerRef([req, _reply]) {
+        if (this.options.getCustomerRef) {
+            const ref = await this.options.getCustomerRef(req);
+            return AdapterUtils.ensureCustomerRef(ref);
+        }
+        // Try x-customer-ref header first
+        const headerRef = req.headers?.['x-customer-ref'];
+        if (headerRef) {
+            return AdapterUtils.ensureCustomerRef(headerRef);
+        }
+        // Try JWT token if available
+        const authHeader = req.headers?.['authorization'];
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            const jwtSub = await AdapterUtils.extractFromJWT(token);
+            if (jwtSub) {
+                return AdapterUtils.ensureCustomerRef(jwtSub);
+            }
+        }
+        // Fallback to anonymous
+        return 'anonymous';
+    }
+    formatResponse(result, [_req, reply]) {
+        if (this.options.transformResponse) {
+            return this.options.transformResponse(result, reply);
+        }
+        // Express: has reply.status method
+        if (reply && reply.status && typeof reply.json === 'function') {
+            reply.json(result);
+            return;
+        }
+        // Fastify: return value for auto-serialization
+        return result;
+    }
+    formatError(error, [_req, reply]) {
+        if (error instanceof PaywallError) {
+            const errorResponse = {
+                success: false,
+                error: 'Payment required',
+                product: error.structuredContent.product,
+                checkoutUrl: error.structuredContent.checkoutUrl,
+                message: error.structuredContent.message,
+            };
+            // Express: has reply.status method
+            if (reply && reply.status && typeof reply.json === 'function') {
+                reply.status(402).json(errorResponse);
+                return;
+            }
+            // Fastify: use reply.code
+            if (reply && reply.code) {
+                reply.code(402);
+            }
+            return errorResponse;
+        }
+        // Generic error
+        const errorResponse = {
+            success: false,
+            error: error instanceof Error ? error.message : 'Internal server error',
+        };
+        // Express: has reply.status method
+        if (reply && reply.status && typeof reply.json === 'function') {
+            reply.status(500).json(errorResponse);
+            return;
+        }
+        // Fastify: use reply.code
+        if (reply && reply.code) {
+            reply.code(500);
+        }
+        return errorResponse;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/src/adapters/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAQzC;;GAEG;AACH,MAAM,OAAO,WAAW;IACF;IAApB,YAAoB,UAA8B,EAAE;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAExD,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,CAAc;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACtC,CAAC;QAED,0DAA0D;QAC1D,OAAO;YACL,GAAG,CAAE,GAAG,CAAC,IAAe,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAE,GAAG,CAAC,MAAiB,IAAI,EAAE,CAAC;YACjC,GAAG,CAAE,GAAG,CAAC,KAAgB,IAAI,EAAE,CAAC;SACjC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,CAAc;QAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAA;QACjD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClD,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAA;QACjD,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YACvD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,cAAc,CAAC,MAAe,EAAE,CAAC,IAAI,EAAE,KAAK,CAAc;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACtD,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QAED,+CAA+C;QAC/C,OAAO,MAAM,CAAA;IACf,CAAC;IAED,WAAW,CAAC,KAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAc;QAClD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG;gBACpB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;gBACxC,WAAW,EAAE,KAAK,CAAC,iBAAiB,CAAC,WAAW;gBAChD,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;aACzC,CAAA;YAED,mCAAmC;YACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;gBACrC,OAAM;YACR,CAAC;YAED,0BAA0B;YAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC;QAED,gBAAgB;QAChB,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;SACxE,CAAA;QAED,mCAAmC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACrC,OAAM;QACR,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;CACF"}

package/dist/src/adapters/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Adapters Export
+ *
+ * Exports all framework adapters and utilities
+ */
+export type { Adapter } from './base';
+export { AdapterUtils, createAdapterHandler } from './base';
+export { HttpAdapter } from './http';
+export { NextAdapter } from './next';
+export { McpAdapter } from './mcp';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA"}