@solvapay/server 1.0.8-preview.8 → 1.0.8-preview.9

package/dist/index.d.ts

@@ -3675,7 +3675,6 @@ declare function buildAuthInfoFromBearer(authorization?: string | null, options?
 type RequestLike = {
     method?: string;
     path?: string;
-    url?: string;
     headers?: Record<string, string | string[] | undefined>;
     body?: unknown;
     auth?: unknown;
@@ -3684,37 +3683,12 @@ type ResponseLike = {
     status: (code: number) => ResponseLike;
     json: (payload: unknown) => void;
     setHeader: (name: string, value: string) => void;
-    end?: (body?: string) => void;
-    send?: (body?: string | Buffer) => void;
 };
 type NextLike = () => void;
-type Middleware = (req: RequestLike, res: ResponseLike, next: NextLike) => void | Promise<void>;
-interface OAuthBridgePaths {
-    register?: string;
-    authorize?: string;
-    token?: string;
-    revoke?: string;
-}
+type Middleware = (req: RequestLike, res: ResponseLike, next: NextLike) => void;
 interface OAuthAuthorizationServerOptions {
-    publicBaseUrl: string;
-    paths?: OAuthBridgePaths;
-}
-interface OAuthRegisterHandlerOptions {
     apiBaseUrl: string;
     productRef: string;
-    path?: string;
-}
-interface OAuthAuthorizeHandlerOptions {
-    apiBaseUrl: string;
-    path?: string;
-}
-interface OAuthTokenHandlerOptions {
-    apiBaseUrl: string;
-    path?: string;
-}
-interface OAuthRevokeHandlerOptions {
-    apiBaseUrl: string;
-    path?: string;
 }
 interface McpOAuthBridgeOptions {
     publicBaseUrl: string;
@@ -3725,29 +3699,23 @@ interface McpOAuthBridgeOptions {
     authInfo?: BuildAuthInfoFromBearerOptions;
     protectedResourcePath?: string;
     authorizationServerPath?: string;
-    oauthPaths?: OAuthBridgePaths;
 }
 declare function getOAuthProtectedResourceResponse(publicBaseUrl: string): {
     resource: string;
     authorization_servers: string[];
     scopes_supported: string[];
 };
-declare function getOAuthAuthorizationServerResponse({ publicBaseUrl, paths, }: OAuthAuthorizationServerOptions): {
+declare function getOAuthAuthorizationServerResponse({ apiBaseUrl, productRef, }: OAuthAuthorizationServerOptions): {
     issuer: string;
     authorization_endpoint: string;
     token_endpoint: string;
     registration_endpoint: string;
-    revocation_endpoint: string;
     token_endpoint_auth_methods_supported: string[];
     response_types_supported: string[];
     grant_types_supported: string[];
     scopes_supported: string[];
     code_challenge_methods_supported: string[];
 };
-declare function createOAuthRegisterHandler(options: OAuthRegisterHandlerOptions): Middleware;
-declare function createOAuthAuthorizeHandler(options: OAuthAuthorizeHandlerOptions): Middleware;
-declare function createOAuthTokenHandler(options: OAuthTokenHandlerOptions): Middleware;
-declare function createOAuthRevokeHandler(options: OAuthRevokeHandlerOptions): Middleware;
 declare function createMcpOAuthBridge(options: McpOAuthBridgeOptions): Middleware[];
 
 /**
@@ -4309,4 +4277,4 @@ declare function verifyWebhook({ body, signature, secret, }: {
     secret: string;
 }): WebhookEvent;
 
-export { type ActivatePlanResult, type AuthenticatedUser, type ConfigureMcpPlansRequest, type ConfigureMcpPlansResponse, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerResponseMapped, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, McpBearerAuthError, type McpBootstrapPlanInput, type McpBootstrapRequest, type McpBootstrapResponse, type McpServerLike, type McpToolExtra, type McpToolPlanMappingInput, type NextAdapterOptions, type OneTimePurchaseInfo, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type ProcessPaymentResult, type PurchaseCheckResult, type RegisterVirtualToolsMcpOptions, type RetryOptions, type SdkMerchantResponse, type SdkProductResponse, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type ToolPlanMappingInput, VIRTUAL_TOOL_DEFINITIONS, type VirtualToolDefinition, type VirtualToolsOptions, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, buildAuthInfoFromBearer, cancelPurchaseCore, checkPurchaseCore, type components, createCheckoutSessionCore, createCustomerSessionCore, createMcpOAuthBridge, createOAuthAuthorizeHandler, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, createVirtualTools, decodeJwtPayload, extractBearerToken, getAuthenticatedUserCore, getCustomerBalanceCore, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getMerchantCore, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, getProductCore, handleRouteError, isErrorResult, jsonSchemaToZodRawShape, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, registerVirtualToolsMcpImpl, syncCustomerCore, trackUsageCore, verifyWebhook, withRetry };
+export { type ActivatePlanResult, type AuthenticatedUser, type ConfigureMcpPlansRequest, type ConfigureMcpPlansResponse, type CreateSolvaPayConfig, type CustomerBalanceResult, type CustomerResponseMapped, type CustomerWebhookObject, type ErrorResult, type HttpAdapterOptions, type LimitActivationBalance, type LimitActivationProduct, type LimitPlanSummary, type McpAdapterOptions, McpBearerAuthError, type McpBootstrapPlanInput, type McpBootstrapRequest, type McpBootstrapResponse, type McpServerLike, type McpToolExtra, type McpToolPlanMappingInput, type NextAdapterOptions, type OneTimePurchaseInfo, type PayableFunction, type PayableOptions, type PaywallArgs, PaywallError, type PaywallMetadata, type PaywallStructuredContent, type PaywallToolResult, type ProcessPaymentResult, type PurchaseCheckResult, type RegisterVirtualToolsMcpOptions, type RetryOptions, type SdkMerchantResponse, type SdkProductResponse, type ServerClientOptions, type SolvaPay, type SolvaPayClient, type ToolPlanMappingInput, VIRTUAL_TOOL_DEFINITIONS, type VirtualToolDefinition, type VirtualToolsOptions, type WebhookEvent, type WebhookEventForType, type WebhookEventObjectMap, type WebhookEventType, type WebhookProduct, activatePlanCore, buildAuthInfoFromBearer, cancelPurchaseCore, checkPurchaseCore, type components, createCheckoutSessionCore, createCustomerSessionCore, createMcpOAuthBridge, createPaymentIntentCore, createSolvaPay, createSolvaPayClient, createTopupPaymentIntentCore, createVirtualTools, decodeJwtPayload, extractBearerToken, getAuthenticatedUserCore, getCustomerBalanceCore, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getMerchantCore, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, getProductCore, handleRouteError, isErrorResult, jsonSchemaToZodRawShape, listPlansCore, paywallErrorToClientPayload, processPaymentIntentCore, reactivatePurchaseCore, registerVirtualToolsMcpImpl, syncCustomerCore, trackUsageCore, verifyWebhook, withRetry };

package/dist/index.js

@@ -1826,31 +1826,15 @@ function buildAuthInfoFromBearer(authorization, options = {}) {
 }
 
 // src/mcp/oauth-bridge.ts
-var DEFAULT_OAUTH_PATHS = {
-  register: "/oauth/register",
-  authorize: "/oauth/authorize",
-  token: "/oauth/token",
-  revoke: "/oauth/revoke"
-};
-var NATIVE_CLIENT_ORIGIN_SCHEMES = ["cursor:", "vscode:", "vscode-webview:", "claude:"];
 function withoutTrailingSlash(value) {
   return value.replace(/\/$/, "");
 }
-function resolvePaths(paths = {}) {
-  return { ...DEFAULT_OAUTH_PATHS, ...paths };
-}
 function getRequestAuthHeader(req) {
   const header = req.headers?.authorization;
   if (typeof header === "string") return header;
   if (Array.isArray(header)) return header[0] || null;
   return null;
 }
-function getHeader(req, name) {
-  const header = req.headers?.[name.toLowerCase()];
-  if (typeof header === "string") return header;
-  if (Array.isArray(header)) return header[0] || null;
-  return null;
-}
 function getRequestJsonRpcId(body) {
   if (body && typeof body === "object" && "id" in body) {
     const id = body.id;
@@ -1874,100 +1858,6 @@ function setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath) {
     `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`
   );
 }
-function getRequestQuery(req) {
-  const raw = req.url ?? req.path ?? "";
-  const qIndex = raw.indexOf("?");
-  return qIndex === -1 ? "" : raw.slice(qIndex);
-}
-function isNativeClientOrigin(origin) {
-  try {
-    const url = new URL(origin);
-    return NATIVE_CLIENT_ORIGIN_SCHEMES.includes(
-      url.protocol
-    );
-  } catch {
-    return false;
-  }
-}
-function applyCorsHeaders(req, res) {
-  const origin = getHeader(req, "origin");
-  if (!origin) return;
-  if (isNativeClientOrigin(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
-    res.setHeader("Vary", "Origin");
-  }
-}
-function handlePreflight(req, res) {
-  applyCorsHeaders(req, res);
-  const requestedMethod = getHeader(req, "access-control-request-method") ?? "POST";
-  const requestedHeaders = getHeader(req, "access-control-request-headers") ?? "authorization, content-type";
-  res.setHeader("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
-  res.setHeader("Access-Control-Allow-Headers", requestedHeaders);
-  res.setHeader("Access-Control-Max-Age", "600");
-  res.status(204);
-  if (typeof res.end === "function") {
-    res.end();
-  } else {
-    res.json({});
-  }
-}
-async function readJsonFromResponse(upstream) {
-  const text = await upstream.text();
-  if (!text) return { body: {}, text: "" };
-  try {
-    return { body: JSON.parse(text), text };
-  } catch {
-    return { body: text, text };
-  }
-}
-async function relayJsonResponse(upstream, res) {
-  const { body, text } = await readJsonFromResponse(upstream);
-  res.status(upstream.status);
-  const contentType = upstream.headers.get("content-type");
-  if (contentType) res.setHeader("Content-Type", contentType);
-  if (text === "" && upstream.status === 204) {
-    if (typeof res.end === "function") {
-      res.end();
-      return;
-    }
-  }
-  res.json(body);
-}
-function sendUpstreamError(res, _error) {
-  res.status(502);
-  res.setHeader("Content-Type", "application/json");
-  res.json({ error: "upstream_unreachable" });
-}
-function serializeRegisterBody(body) {
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  return JSON.stringify(body ?? {});
-}
-function serializeFormBody(body) {
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  if (body && typeof body === "object") {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(body)) {
-      if (value === void 0 || value === null) continue;
-      if (Array.isArray(value)) {
-        for (const entry of value) params.append(key, String(entry));
-      } else {
-        params.append(key, String(value));
-      }
-    }
-    return params.toString();
-  }
-  return "";
-}
-function serializeRequestBody(contentType, body) {
-  if (contentType && contentType.includes("application/x-www-form-urlencoded")) {
-    return serializeFormBody(body);
-  }
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  return JSON.stringify(body ?? {});
-}
 function getOAuthProtectedResourceResponse(publicBaseUrl) {
   const resource = withoutTrailingSlash(publicBaseUrl);
   return {
@@ -1977,17 +1867,16 @@ function getOAuthProtectedResourceResponse(publicBaseUrl) {
   };
 }
 function getOAuthAuthorizationServerResponse({
-  publicBaseUrl,
-  paths
+  apiBaseUrl,
+  productRef
 }) {
-  const base = withoutTrailingSlash(publicBaseUrl);
-  const p = resolvePaths(paths);
+  const normalizedApiBaseUrl = withoutTrailingSlash(apiBaseUrl);
+  const registrationEndpoint = `${normalizedApiBaseUrl}/v1/customer/auth/register?product_ref=${encodeURIComponent(productRef)}`;
   return {
-    issuer: base,
-    authorization_endpoint: `${base}${p.authorize}`,
-    token_endpoint: `${base}${p.token}`,
-    registration_endpoint: `${base}${p.register}`,
-    revocation_endpoint: `${base}${p.revoke}`,
+    issuer: normalizedApiBaseUrl,
+    authorization_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/authorize`,
+    token_endpoint: `${normalizedApiBaseUrl}/v1/customer/auth/token`,
+    registration_endpoint: registrationEndpoint,
     token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
     response_types_supported: ["code"],
     grant_types_supported: ["authorization_code", "refresh_token"],
@@ -1995,134 +1884,6 @@ function getOAuthAuthorizationServerResponse({
     code_challenge_methods_supported: ["S256"]
   };
 }
-function createOAuthRegisterHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.register;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: serializeRegisterBody(req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
-}
-function createOAuthAuthorizeHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.authorize;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  return (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "GET") {
-      next();
-      return;
-    }
-    const query = getRequestQuery(req);
-    const location = `${api}/v1/customer/auth/authorize${query}`;
-    res.setHeader("Location", location);
-    res.status(302);
-    if (typeof res.end === "function") {
-      res.end();
-      return;
-    }
-    res.json({});
-  };
-}
-function createOAuthTokenHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.token;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/token`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
-    const authorization = getHeader(req, "authorization");
-    const headers = { "content-type": contentType };
-    if (authorization) headers["authorization"] = authorization;
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers,
-        body: serializeRequestBody(contentType, req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
-}
-function createOAuthRevokeHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.revoke;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/revoke`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
-    const authorization = getHeader(req, "authorization");
-    const headers = { "content-type": contentType };
-    if (authorization) headers["authorization"] = authorization;
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers,
-        body: serializeRequestBody(contentType, req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
-}
 function createMcpOAuthBridge(options) {
   const {
     publicBaseUrl,
@@ -2132,23 +1893,8 @@ function createMcpOAuthBridge(options) {
     requireAuth = true,
     authInfo,
     protectedResourcePath = "/.well-known/oauth-protected-resource",
-    authorizationServerPath = "/.well-known/oauth-authorization-server",
-    oauthPaths
+    authorizationServerPath = "/.well-known/oauth-authorization-server"
   } = options;
-  const paths = resolvePaths(oauthPaths);
-  const openidDiscoveryMiddleware = (req, res, next) => {
-    if (req.method !== "GET" || req.path !== "/.well-known/openid-configuration") {
-      next();
-      return;
-    }
-    applyCorsHeaders(req, res);
-    res.status(404);
-    if (typeof res.end === "function") {
-      res.end();
-    } else {
-      res.json({ error: "not_found" });
-    }
-  };
   const protectedResourceMiddleware = (req, res, next) => {
     if (req.method !== "GET" || req.path !== protectedResourcePath) {
       next();
@@ -2167,38 +1913,16 @@ function createMcpOAuthBridge(options) {
     }
     res.json(
       getOAuthAuthorizationServerResponse({
-        publicBaseUrl,
-        paths
+        apiBaseUrl,
+        productRef
       })
     );
   };
-  const registerMiddleware = createOAuthRegisterHandler({
-    apiBaseUrl,
-    productRef,
-    path: paths.register
-  });
-  const authorizeMiddleware = createOAuthAuthorizeHandler({
-    apiBaseUrl,
-    path: paths.authorize
-  });
-  const tokenMiddleware = createOAuthTokenHandler({ apiBaseUrl, path: paths.token });
-  const revokeMiddleware = createOAuthRevokeHandler({ apiBaseUrl, path: paths.revoke });
   const mcpAuthMiddleware = (req, res, next) => {
     if (req.path !== mcpPath) {
       next();
       return;
     }
-    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
-      applyCorsHeaders(req, res);
-      res.setHeader("Allow", "POST, OPTIONS");
-      res.status(405);
-      if (typeof res.end === "function") {
-        res.end();
-      } else {
-        res.json({ error: "method_not_allowed" });
-      }
-      return;
-    }
     const authHeader = getRequestAuthHeader(req);
     const id = getRequestJsonRpcId(req.body);
     if (!authHeader && !requireAuth) {
@@ -2213,8 +1937,6 @@ function createMcpOAuthBridge(options) {
       req.auth = auth;
       next();
     } catch {
-      applyCorsHeaders(req, res);
-      res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
       setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath);
       if (req.method === "POST") {
         res.status(401).json(makeUnauthorizedJsonRpc(id));
@@ -2223,16 +1945,7 @@ function createMcpOAuthBridge(options) {
       res.status(401).json({ error: "Unauthorized" });
     }
   };
-  return [
-    openidDiscoveryMiddleware,
-    protectedResourceMiddleware,
-    authorizationServerMiddleware,
-    registerMiddleware,
-    authorizeMiddleware,
-    tokenMiddleware,
-    revokeMiddleware,
-    mcpAuthMiddleware
-  ];
+  return [protectedResourceMiddleware, authorizationServerMiddleware, mcpAuthMiddleware];
 }
 
 // src/helpers/error.ts
@@ -2915,10 +2628,6 @@ export {
   createCheckoutSessionCore,
   createCustomerSessionCore,
   createMcpOAuthBridge,
-  createOAuthAuthorizeHandler,
-  createOAuthRegisterHandler,
-  createOAuthRevokeHandler,
-  createOAuthTokenHandler,
   createPaymentIntentCore,
   createSolvaPay,
   createSolvaPayClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/server",
-  "version": "1.0.8-preview.8",
+  "version": "1.0.8-preview.9",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -37,12 +37,12 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@solvapay/core": "1.0.8-preview.8"
+    "@solvapay/core": "1.0.8-preview.9"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.28.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@solvapay/auth": "1.0.8-preview.8"
+    "@solvapay/auth": "1.0.8-preview.9"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -60,15 +60,15 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.2",
-    "@solvapay/demo-services": "0.0.0",
+    "@solvapay/auth": "1.0.8-preview.9",
     "@solvapay/test-utils": "^0.0.0",
-    "@solvapay/auth": "1.0.8-preview.8"
+    "@solvapay/demo-services": "0.0.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm,cjs --dts --tsconfig tsconfig.build.json && tsup src/edge.ts --format esm --dts --tsconfig tsconfig.build.json",
     "generate:types": "tsx scripts/generate-types.ts",
-    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts src/mcp/oauth-bridge.spec.ts",
-    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts src/mcp/oauth-bridge.spec.ts",
+    "test": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts",
+    "test:unit": "vitest run __tests__/paywall.unit.test.ts __tests__/mcp-auth.unit.test.ts __tests__/bootstrap-mcp.unit.test.ts __tests__/verify-webhook.unit.test.ts __tests__/edge-exports.unit.test.ts",
     "test:integration": "vitest run __tests__/backend.integration.test.ts",
     "test:integration:payment": "vitest run __tests__/payment-stripe.integration.test.ts",
     "test:all": "vitest run",

package/dist/chunk-R5U7XKVJ.js

@@ -1,16 +0,0 @@
-var __defProp = Object.defineProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-export {
-  __require,
-  __export
-};

package/dist/dist-EPVKJAIP.js

@@ -1,94 +0,0 @@
-import "./chunk-R5U7XKVJ.js";
-
-// ../auth/dist/chunk-OETEFHW6.js
-var MockAuthAdapter = class {
-  async getUserIdFromRequest(req) {
-    const headers = "headers" in req ? req.headers : req;
-    const headerUserId = headers.get("x-mock-user-id");
-    if (headerUserId) {
-      return headerUserId;
-    }
-    if (typeof process !== "undefined" && process.env.MOCK_USER_ID) {
-      return process.env.MOCK_USER_ID;
-    }
-    return null;
-  }
-};
-
-// ../auth/dist/chunk-2P77RLPB.js
-function getUserIdFromRequest(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  return request.headers.get(headerName);
-}
-async function getUserEmailFromRequest(request, options) {
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
-  }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
-  }
-  try {
-    const { jwtVerify } = await import("./esm-5GYCIXIY.js");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
-      return null;
-    }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    return payload.email ? String(payload.email) : null;
-  } catch {
-    return null;
-  }
-}
-async function getUserNameFromRequest(request, options) {
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
-  }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
-  }
-  try {
-    const { jwtVerify } = await import("./esm-5GYCIXIY.js");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
-      return null;
-    }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    const name = payload.user_metadata?.full_name || payload.user_metadata?.name || payload.name || null;
-    return name ? String(name) : null;
-  } catch {
-    return null;
-  }
-}
-function requireUserId(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  const errorMessage = options?.errorMessage || "Unauthorized";
-  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
-  const userId = request.headers.get(headerName);
-  if (!userId) {
-    return new Response(
-      JSON.stringify({ error: errorMessage, details: errorDetails }),
-      {
-        status: 401,
-        headers: { "Content-Type": "application/json" }
-      }
-    );
-  }
-  return userId;
-}
-export {
-  MockAuthAdapter,
-  getUserEmailFromRequest,
-  getUserIdFromRequest,
-  getUserNameFromRequest,
-  requireUserId
-};