@solvapay/server 1.0.8-preview.8 → 1.0.8

package/dist/index.js

@@ -1,5 +1,3 @@
-import "./chunk-MLKGABMK.js";
-
 // src/index.ts
 import crypto from "crypto";
 import { SolvaPayError as SolvaPayError5 } from "@solvapay/core";
@@ -64,7 +62,27 @@ function createSolvaPayClient(opts) {
         throw new SolvaPayError(`Create customer failed (${res.status}): ${error}`);
       }
       const result = await res.json();
-      return result;
+      return {
+        customerRef: result.reference || result.customerRef
+      };
+    },
+    // PATCH: /v1/sdk/customers/{customerRef}
+    async updateCustomer(customerRef, params) {
+      const url = `${base}/v1/sdk/customers/${encodeURIComponent(customerRef)}`;
+      const res = await fetch(url, {
+        method: "PATCH",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new SolvaPayError(`Update customer failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return {
+        customerRef: result.reference || result.customerRef || customerRef
+      };
     },
     // GET: /v1/sdk/customers/{reference} or /v1/sdk/customers?externalRef={externalRef}|email={email}
     async getCustomer(params) {
@@ -124,6 +142,20 @@ function createSolvaPayClient(opts) {
       }
       return res.json();
     },
+    // GET: /v1/sdk/platform-config
+    async getPlatformConfig() {
+      const url = `${base}/v1/sdk/platform-config`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new SolvaPayError(`Get platform config failed (${res.status}): ${error}`);
+      }
+      return res.json();
+    },
     // GET: /v1/sdk/products/{productRef}
     async getProduct(productRef) {
       const url = `${base}/v1/sdk/products/${encodeURIComponent(productRef)}`;
@@ -550,10 +582,67 @@ function createSolvaPayClient(opts) {
         throw new SolvaPayError(`Activate plan failed (${res.status}): ${error}`);
       }
       return await res.json();
+    },
+    async getPaymentMethod(params) {
+      const url = new URL(`${base}/v1/sdk/payment-method`);
+      url.searchParams.set("customerRef", params.customerRef);
+      const res = await fetch(url.toString(), { method: "GET", headers });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new SolvaPayError(`Get payment method failed (${res.status}): ${error}`);
+      }
+      return await res.json();
     }
   };
 }
 
+// src/paywall-state.ts
+function classifyPaywallState(limits) {
+  if (!limits) return { kind: "upgrade_required" };
+  if (limits.activationRequired === true) {
+    return { kind: "activation_required" };
+  }
+  const activePlan = limits.plans?.find((p) => p.reference === limits.plan);
+  const isUsageBased = activePlan?.type === "usage-based" || limits.balance !== void 0;
+  const creditBalance = limits.balance?.creditBalance ?? limits.creditBalance;
+  if (isUsageBased) {
+    if (creditBalance === 0) return { kind: "topup_required" };
+    if (creditBalance === void 0 && limits.remaining === 0) {
+      return { kind: "topup_required" };
+    }
+  }
+  return { kind: "upgrade_required" };
+}
+function buildGateMessage(state, gate) {
+  const url = gate.checkoutUrl && gate.checkoutUrl.length > 0 ? gate.checkoutUrl : null;
+  const openClause = url ? `, or open ${url} in a browser` : "";
+  switch (state.kind) {
+    case "activation_required":
+      return `Your plan needs activation before you can use this tool. Call the \`activate_plan\` tool to activate it${openClause}.`;
+    case "topup_required":
+      return `You're out of credits. Call the \`topup\` tool to add more${openClause}.`;
+    case "upgrade_required":
+      return `You don't have an active plan for this tool. Call the \`upgrade\` tool to pick a plan${openClause}.`;
+    case "reactivation_required":
+      return `Your previous plan is no longer active. Call the \`manage_account\` tool to reactivate it, or the \`upgrade\` tool to pick a new plan.`;
+  }
+}
+function buildNudgeMessage(state, limits) {
+  const url = limits?.checkoutUrl && limits.checkoutUrl.length > 0 ? limits.checkoutUrl : null;
+  const visitClause = url ? `, or visit ${url}` : "";
+  switch (state.kind) {
+    case "topup_required":
+      return `Heads up \u2014 running low on credits. Call the \`topup\` tool to add more${visitClause}.`;
+    case "upgrade_required":
+      return `Heads up \u2014 approaching your plan's limit this period. Call the \`upgrade\` tool for more headroom${visitClause}.`;
+    case "activation_required":
+      return `Heads up \u2014 this plan still needs activation. Call the \`activate_plan\` tool${visitClause}.`;
+    case "reactivation_required":
+      return `Heads up \u2014 your plan is no longer active. Call the \`manage_account\` tool to reactivate it${visitClause}.`;
+  }
+}
+
 // src/utils.ts
 async function withRetry(fn, options = {}) {
   const {
@@ -720,6 +809,10 @@ function paywallErrorToClientPayload(error) {
     if (sc.balance !== void 0) base.balance = sc.balance;
     if (sc.productDetails !== void 0) base.productDetails = sc.productDetails;
     if (sc.confirmationUrl !== void 0) base.confirmationUrl = sc.confirmationUrl;
+  } else {
+    base.kind = "payment_required";
+    if (sc.balance !== void 0) base.balance = sc.balance;
+    if (sc.productDetails !== void 0) base.productDetails = sc.productDetails;
   }
   return base;
 }
@@ -731,6 +824,7 @@ var sharedCustomerLookupDeduplicator = createRequestDeduplicator({
   cacheErrors: false
   // Don't cache errors - retry on next request
 });
+var EXTRA_FORWARD_KEY = "__solvapayExtra";
 var SolvaPayPaywall = class {
   constructor(apiClient, options = {}) {
     this.apiClient = apiClient;
@@ -756,136 +850,216 @@ var SolvaPayPaywall = class {
     return `solvapay_${timestamp}_${random}`;
   }
   /**
-   * Core protection method - works for both MCP and HTTP
+   * Pure decision routine — performs customer resolution, limits cache
+   * lookup / fresh `checkLimits` fetch, and returns a `PaywallDecision`
+   * describing whether the handler should run.
+   *
+   * Side effects kept in lockstep with the legacy `protect()` path:
+   *  - creates the backend customer on first use (`ensureCustomer`),
+   *  - updates the limits cache (consume-one-unit bookkeeping), and
+   *  - emits a `paywall` usage event on gate outcomes.
+   *
+   * `trackUsage` for the `success` / `fail` outcome is emitted by the
+   * caller (adapter or `protect()`) once it has actually invoked the
+   * handler — `decide()` never counts handler execution as usage.
+   *
+   * @since 1.1.0
    */
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  async protect(handler, metadata = {}, getCustomerRef) {
+  async decide(args, metadata = {}, getCustomerRef) {
     const product = this.resolveProduct(metadata);
     const usageType = metadata.usageType || "requests";
-    return async (args) => {
-      const startTime = Date.now();
-      const requestId = this.generateRequestId();
-      const inputCustomerRef = getCustomerRef ? getCustomerRef(args) : args.auth?.customer_ref || "anonymous";
-      let backendCustomerRef;
-      if (inputCustomerRef.startsWith("cus_")) {
-        backendCustomerRef = inputCustomerRef;
+    const requestId = this.generateRequestId();
+    const startTime = Date.now();
+    const inputCustomerRef = getCustomerRef ? getCustomerRef(args) : args.auth?.customer_ref || "anonymous";
+    let backendCustomerRef;
+    if (inputCustomerRef.startsWith("cus_")) {
+      backendCustomerRef = inputCustomerRef;
+    } else {
+      backendCustomerRef = await this.ensureCustomer(inputCustomerRef, inputCustomerRef);
+    }
+    const limitsCacheKey = `${backendCustomerRef}:${product}:${usageType}`;
+    const cachedLimits = this.limitsCache.get(limitsCacheKey);
+    const now = Date.now();
+    let withinLimits;
+    let remaining;
+    let checkoutUrl;
+    let resolvedMeterName;
+    let lastLimitsCheck;
+    const hasFreshCachedLimits = cachedLimits && now - cachedLimits.timestamp < this.limitsCacheTTL;
+    if (hasFreshCachedLimits) {
+      checkoutUrl = cachedLimits.checkoutUrl;
+      resolvedMeterName = cachedLimits.meterName;
+      lastLimitsCheck = cachedLimits.limits;
+      if (cachedLimits.remaining > 0) {
+        cachedLimits.remaining--;
+        if (cachedLimits.remaining <= 0) {
+          this.limitsCache.delete(limitsCacheKey);
+        }
+        withinLimits = true;
+        remaining = cachedLimits.remaining;
       } else {
-        backendCustomerRef = await this.ensureCustomer(inputCustomerRef, inputCustomerRef);
+        withinLimits = false;
+        remaining = 0;
+        this.limitsCache.delete(limitsCacheKey);
       }
-      let resolvedMeterName;
-      try {
-        const limitsCacheKey = `${backendCustomerRef}:${product}:${usageType}`;
-        const cachedLimits = this.limitsCache.get(limitsCacheKey);
-        const now = Date.now();
-        let withinLimits;
-        let remaining;
-        let checkoutUrl;
-        let lastLimitsCheck;
-        const hasFreshCachedLimits = cachedLimits && now - cachedLimits.timestamp < this.limitsCacheTTL;
-        if (hasFreshCachedLimits) {
-          checkoutUrl = cachedLimits.checkoutUrl;
-          resolvedMeterName = cachedLimits.meterName;
-          if (cachedLimits.remaining > 0) {
-            cachedLimits.remaining--;
-            if (cachedLimits.remaining <= 0) {
-              this.limitsCache.delete(limitsCacheKey);
-            }
-            withinLimits = true;
-            remaining = cachedLimits.remaining;
-          } else {
-            withinLimits = false;
-            remaining = 0;
-            this.limitsCache.delete(limitsCacheKey);
-          }
-        } else {
-          if (cachedLimits) {
-            this.limitsCache.delete(limitsCacheKey);
-          }
-          const limitsCheck = await this.apiClient.checkLimits({
-            customerRef: backendCustomerRef,
-            productRef: product,
-            meterName: usageType
-          });
-          lastLimitsCheck = limitsCheck;
-          withinLimits = limitsCheck.withinLimits;
-          remaining = limitsCheck.remaining;
-          checkoutUrl = limitsCheck.checkoutUrl;
-          resolvedMeterName = limitsCheck.meterName;
-          const consumedAllowance = withinLimits && remaining > 0;
-          if (consumedAllowance) {
-            remaining = Math.max(0, remaining - 1);
-          }
-          if (consumedAllowance) {
-            this.limitsCache.set(limitsCacheKey, {
-              remaining,
-              checkoutUrl,
-              meterName: resolvedMeterName,
-              timestamp: now
-            });
-          }
-        }
-        if (!withinLimits) {
-          const latencyMs2 = Date.now() - startTime;
-          this.trackUsage(
-            backendCustomerRef,
-            product,
-            resolvedMeterName || usageType,
-            "paywall",
-            requestId,
-            latencyMs2
-          );
-          if (lastLimitsCheck?.activationRequired) {
-            const confirmationUrl = lastLimitsCheck.confirmationUrl;
-            const payCheckoutUrl = confirmationUrl || lastLimitsCheck.checkoutUrl || checkoutUrl || "";
-            throw new PaywallError("Activation required", {
-              kind: "activation_required",
-              product,
-              message: "Product activation is required before this tool can be used.",
-              checkoutUrl: payCheckoutUrl,
-              confirmationUrl,
-              plans: lastLimitsCheck.plans,
-              balance: lastLimitsCheck.balance,
-              productDetails: lastLimitsCheck.product
-            });
-          }
-          throw new PaywallError("Payment required", {
-            kind: "payment_required",
-            product,
-            checkoutUrl: checkoutUrl || "",
-            message: `Purchase required. Remaining: ${remaining}`
-          });
-        }
-        const result = await handler(args);
+    } else {
+      if (cachedLimits) {
+        this.limitsCache.delete(limitsCacheKey);
+      }
+      const limitsCheck = await this.apiClient.checkLimits({
+        customerRef: backendCustomerRef,
+        productRef: product,
+        meterName: usageType
+      });
+      lastLimitsCheck = limitsCheck;
+      withinLimits = limitsCheck.withinLimits;
+      remaining = limitsCheck.remaining;
+      checkoutUrl = limitsCheck.checkoutUrl;
+      resolvedMeterName = limitsCheck.meterName;
+      const consumedAllowance = withinLimits && remaining > 0;
+      if (consumedAllowance) {
+        remaining = Math.max(0, remaining - 1);
+      }
+      if (consumedAllowance) {
+        this.limitsCache.set(limitsCacheKey, {
+          remaining,
+          checkoutUrl,
+          meterName: resolvedMeterName,
+          timestamp: now,
+          limits: limitsCheck
+        });
+      }
+    }
+    if (!withinLimits) {
+      const latencyMs = Date.now() - startTime;
+      this.trackUsage(
+        backendCustomerRef,
+        product,
+        resolvedMeterName || usageType,
+        "paywall",
+        requestId,
+        latencyMs
+      );
+      const state = classifyPaywallState(lastLimitsCheck ?? null);
+      const preMessageGate = lastLimitsCheck?.activationRequired ? {
+        kind: "activation_required",
+        product,
+        message: "",
+        checkoutUrl: lastLimitsCheck.confirmationUrl || lastLimitsCheck.checkoutUrl || checkoutUrl || "",
+        ...lastLimitsCheck.confirmationUrl !== void 0 ? { confirmationUrl: lastLimitsCheck.confirmationUrl } : {},
+        ...lastLimitsCheck.plans !== void 0 ? { plans: lastLimitsCheck.plans } : {},
+        ...lastLimitsCheck.balance !== void 0 ? { balance: lastLimitsCheck.balance } : {},
+        ...lastLimitsCheck.product !== void 0 ? { productDetails: lastLimitsCheck.product } : {}
+      } : {
+        kind: "payment_required",
+        product,
+        checkoutUrl: checkoutUrl || "",
+        message: "",
+        ...lastLimitsCheck?.balance !== void 0 ? { balance: lastLimitsCheck.balance } : {},
+        ...lastLimitsCheck?.product !== void 0 ? { productDetails: lastLimitsCheck.product } : {}
+      };
+      const gate = {
+        ...preMessageGate,
+        message: buildGateMessage(state, preMessageGate)
+      };
+      return {
+        outcome: "gate",
+        gate,
+        limits: lastLimitsCheck ?? null,
+        customerRef: backendCustomerRef
+      };
+    }
+    return {
+      outcome: "allow",
+      args,
+      limits: lastLimitsCheck,
+      customerRef: backendCustomerRef
+    };
+  }
+  /**
+   * Execute the handler for an already-obtained `allow` decision and
+   * emit the post-handler `trackUsage('success' | 'fail', ...)` event.
+   *
+   * Exposed for adapter integration — the adapter layer drives the
+   * paywall through `decide()` + `runAllow()` so `formatGate` can own
+   * gate outcomes without routing through `PaywallError`. `protect()`
+   * continues to offer the self-contained throw-based surface for
+   * legacy consumers.
+   *
+   * `runAllow` intentionally does NOT re-throw `PaywallError` — if a
+   * handler calls `ctx.gate(reason)` and throws from deep code, the
+   * adapter catches that at the `formatGate` boundary instead.
+   *
+   * @since 1.1.0
+   */
+  async runAllow(decision, handler, metadata, args) {
+    const product = this.resolveProduct(metadata);
+    const usageType = metadata.usageType || "requests";
+    const requestId = this.generateRequestId();
+    const startTime = Date.now();
+    const forwardedExtra = args[EXTRA_FORWARD_KEY];
+    const handlerContext = {
+      customerRef: decision.customerRef,
+      limits: decision.limits,
+      ...forwardedExtra !== void 0 ? { extra: forwardedExtra } : {}
+    };
+    try {
+      const result = await handler(args, handlerContext);
+      const latencyMs = Date.now() - startTime;
+      this.trackUsage(
+        decision.customerRef,
+        product,
+        decision.limits.meterName || usageType,
+        "success",
+        requestId,
+        latencyMs
+      );
+      return result;
+    } catch (error) {
+      if (error instanceof Error) {
+        const errorType = error instanceof PaywallError ? "PaywallError" : "API Error";
+        this.log(`\u274C Error in paywall [${errorType}]: ${error.message}`);
+      } else {
+        this.log(`\u274C Error in paywall:`, error);
+      }
+      if (!(error instanceof PaywallError)) {
         const latencyMs = Date.now() - startTime;
         this.trackUsage(
-          backendCustomerRef,
+          decision.customerRef,
           product,
-          resolvedMeterName || usageType,
-          "success",
+          decision.limits.meterName || usageType,
+          "fail",
           requestId,
           latencyMs
         );
-        return result;
-      } catch (error) {
-        if (error instanceof Error) {
-          const errorType = error instanceof PaywallError ? "PaywallError" : "API Error";
-          this.log(`\u274C Error in paywall [${errorType}]: ${error.message}`);
-        } else {
-          this.log(`\u274C Error in paywall:`, error);
-        }
-        if (!(error instanceof PaywallError)) {
-          const latencyMs = Date.now() - startTime;
-          this.trackUsage(
-            backendCustomerRef,
-            product,
-            resolvedMeterName || usageType,
-            "fail",
-            requestId,
-            latencyMs
-          );
-        }
-        throw error;
       }
+      throw error;
+    }
+  }
+  /**
+   * Core protection method - works for both MCP and HTTP
+   *
+   * The `handler` may optionally declare a second positional argument
+   * of type `ProtectHandlerContext` to receive the resolved customer
+   * ref, the pre-check `LimitResponseWithPlan`, and an opaque `extra`
+   * bag threaded through from the adapter layer. One-arg handlers
+   * ignore the second argument and continue to work unchanged.
+   *
+   * Implemented on top of `decide()`: pre-check runs through the same
+   * decision routine, and gate outcomes are raised as a `PaywallError`
+   * to preserve the legacy throw-based signal for consumers that
+   * haven't migrated to adapter-level `formatGate` routing.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async protect(handler, metadata = {}, getCustomerRef) {
+    return async (args) => {
+      const decision = await this.decide(args, metadata, getCustomerRef);
+      if (decision.outcome === "gate") {
+        const message = decision.gate.kind === "activation_required" ? "Activation required" : "Payment required";
+        this.log(`\u274C Error in paywall [PaywallError]: ${message}`);
+        throw new PaywallError(message, decision.gate);
+      }
+      return this.runAllow(decision, handler, metadata, args);
     };
   }
   /**
@@ -988,6 +1162,16 @@ var SolvaPayPaywall = class {
                 this.log(
                   `\u26A0\uFE0F Resolved customer ${customerRef} by email after conflict; using existing customer ${byEmail.customerRef}`
                 );
+                if (!byEmail.externalRef && this.apiClient.updateCustomer) {
+                  try {
+                    await this.apiClient.updateCustomer(byEmail.customerRef, { externalRef });
+                  } catch (backfillError) {
+                    this.log(
+                      `\u26A0\uFE0F Failed to backfill externalRef on ${byEmail.customerRef}:`,
+                      backfillError instanceof Error ? backfillError.message : backfillError
+                    );
+                  }
+                }
                 return byEmail.customerRef;
               }
             } catch (emailLookupError) {
@@ -1064,6 +1248,7 @@ var SolvaPayPaywall = class {
 };
 
 // src/adapters/base.ts
+var EXTRA_FORWARD_KEY2 = "__solvapayExtra";
 var AdapterUtils = class {
   /**
    * Ensure customer reference is properly formatted
@@ -1079,7 +1264,7 @@ var AdapterUtils = class {
    */
   static async extractFromJWT(token, options) {
     try {
-      const { jwtVerify } = await import("./webapi-K5XBCEO6.js");
+      const { jwtVerify } = await import("jose");
       const jwtSecret = new TextEncoder().encode(
         options?.secret || process.env.OAUTH_JWKS_SECRET || "test-jwt-secret"
       );
@@ -1095,23 +1280,45 @@ var AdapterUtils = class {
 };
 async function createAdapterHandler(adapter, paywall, metadata, businessLogic) {
   const backendRefCache = /* @__PURE__ */ new Map();
-  const getCustomerRef = (args) => args.auth?.customer_ref || "anonymous";
-  const protectedHandler = await paywall.protect(businessLogic, metadata, getCustomerRef);
   return async (context, extra) => {
+    let args;
+    let customerRef;
     try {
-      const args = await adapter.extractArgs(context);
-      const customerRef = await adapter.getCustomerRef(context, extra);
+      args = await adapter.extractArgs(context);
+      customerRef = await adapter.getCustomerRef(context, extra);
       let backendRef = backendRefCache.get(customerRef);
       if (!backendRef) {
         backendRef = await paywall.ensureCustomer(customerRef, customerRef);
         backendRefCache.set(customerRef, backendRef);
       }
       args.auth = { customer_ref: backendRef };
-      const result = await protectedHandler(args);
-      return adapter.formatResponse(result, context);
     } catch (error) {
       return adapter.formatError(error, context);
     }
+    const decideGetCustomerRef = (args2) => args2.auth?.customer_ref || "anonymous";
+    try {
+      const decision = await paywall.decide(args, metadata, decideGetCustomerRef);
+      if (decision.outcome === "gate") {
+        return adapter.formatGate(decision.gate, context);
+      }
+      if (extra !== void 0) {
+        ;
+        args[EXTRA_FORWARD_KEY2] = extra;
+      }
+      try {
+        const result = await paywall.runAllow(decision, businessLogic, metadata, args);
+        return adapter.formatResponse(result, context);
+      } finally {
+        if (EXTRA_FORWARD_KEY2 in args) {
+          delete args[EXTRA_FORWARD_KEY2];
+        }
+      }
+    } catch (error) {
+      if (error instanceof PaywallError) {
+        return adapter.formatGate(error.structuredContent, context);
+      }
+      return adapter.formatError(error, context);
+    }
   };
 }
 
@@ -1159,24 +1366,25 @@ var HttpAdapter = class {
     }
     return result;
   }
-  formatError(error, [_req, reply]) {
-    if (error instanceof PaywallError) {
-      const errorResponse2 = {
-        success: false,
-        error: "Payment required",
-        product: error.structuredContent.product,
-        checkoutUrl: error.structuredContent.checkoutUrl,
-        message: error.structuredContent.message
-      };
-      if (reply && reply.status && typeof reply.json === "function") {
-        reply.status(402).json(errorResponse2);
-        return;
-      }
-      if (reply && reply.code) {
-        reply.code(402);
-      }
-      return errorResponse2;
+  /**
+   * Emit a 402 Payment Required response with the same JSON body shape
+   * REST consumers have always received (`{success:false, error, product,
+   * checkoutUrl, message, ...}`). The shape is reused via
+   * `paywallErrorToClientPayload` so HTTP / Next / hosted-proxy clients
+   * don't have to branch on an SDK version.
+   */
+  formatGate(gate, [_req, reply]) {
+    const errorResponse = paywallErrorToClientPayload(new PaywallError(gate.message, gate));
+    if (reply && reply.status && typeof reply.json === "function") {
+      reply.status(402).json(errorResponse);
+      return;
+    }
+    if (reply && reply.code) {
+      reply.code(402);
     }
+    return errorResponse;
+  }
+  formatError(error, [_req, reply]) {
     const errorResponse = {
       success: false,
       error: error instanceof Error ? error.message : "Internal server error"
@@ -1254,22 +1462,22 @@ var NextAdapter = class {
       headers: { "Content-Type": "application/json" }
     });
   }
+  /**
+   * Emit a 402 Payment Required `Response` with the same JSON body
+   * REST consumers have always received. Reuses
+   * `paywallErrorToClientPayload` so HTTP / Next / hosted-proxy
+   * clients don't have to branch on an SDK version.
+   */
+  formatGate(gate, _context) {
+    return new Response(
+      JSON.stringify(paywallErrorToClientPayload(new PaywallError(gate.message, gate))),
+      {
+        status: 402,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
   formatError(error, _context) {
-    if (error instanceof PaywallError) {
-      return new Response(
-        JSON.stringify({
-          success: false,
-          error: "Payment required",
-          product: error.structuredContent.product,
-          checkoutUrl: error.structuredContent.checkoutUrl,
-          message: error.structuredContent.message
-        }),
-        {
-          status: 402,
-          headers: { "Content-Type": "application/json" }
-        }
-      );
-    }
     return new Response(
       JSON.stringify({
         success: false,
@@ -1317,19 +1525,27 @@ var McpAdapter = class {
     }
     return response;
   }
+  /**
+   * Emit a plain-narration paywall response — `content[0].text` carries
+   * the gate's human message (LLM-actionable), `structuredContent`
+   * carries the machine-readable gate payload, and `isError` stays
+   * `false` per the MCP spec's own `isError` definition (paywall is
+   * not a self-correctable tool execution error; it is a user-facing
+   * control transfer to the UI).
+   *
+   * Hosts that read widget metadata from `tools/list` or tool-result
+   * `_meta.ui` open the paywall iframe on top of this response;
+   * `buildPayableHandler` stamps the `_meta.ui.resourceUri` envelope
+   * before returning.
+   */
+  formatGate(gate, _context) {
+    return {
+      content: [{ type: "text", text: gate.message }],
+      isError: false,
+      structuredContent: gate
+    };
+  }
   formatError(error, _context) {
-    if (error instanceof PaywallError) {
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(paywallErrorToClientPayload(error), null, 2)
-          }
-        ],
-        isError: true,
-        structuredContent: error.structuredContent
-      };
-    }
     return {
       content: [
         {
@@ -1735,551 +1951,162 @@ function createSolvaPay(config) {
   };
 }
 
-// src/mcp-auth.ts
-var McpBearerAuthError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "McpBearerAuthError";
-  }
-};
-function base64UrlDecode(input) {
-  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-  const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-  return new TextDecoder().decode(bytes);
-}
-function extractBearerToken(authorization) {
-  if (!authorization) return null;
-  if (!authorization.startsWith("Bearer ")) return null;
-  return authorization.slice(7).trim() || null;
-}
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length < 2) {
-    throw new McpBearerAuthError("Invalid JWT format");
-  }
-  try {
-    const payloadText = base64UrlDecode(parts[1]);
-    const payload = JSON.parse(payloadText);
-    return payload;
-  } catch {
-    throw new McpBearerAuthError("Invalid JWT payload");
-  }
-}
-function getCustomerRefFromJwtPayload(payload, options = {}) {
-  const claimPriority = options.claimPriority || ["customerRef", "customer_ref", "sub"];
-  for (const claim of claimPriority) {
-    const value = payload[claim];
-    if (typeof value === "string" && value.trim()) {
-      return value.trim();
-    }
-  }
-  throw new McpBearerAuthError(
-    `No customer reference claim found (checked: ${claimPriority.join(", ")})`
-  );
-}
-function getCustomerRefFromBearerAuthHeader(authorization, options = {}) {
-  const token = extractBearerToken(authorization);
-  if (!token) {
-    throw new McpBearerAuthError("Missing bearer token");
+// src/types/paywall.ts
+function isPaywallStructuredContent(value) {
+  if (typeof value !== "object" || value === null || !("kind" in value)) {
+    return false;
   }
-  const payload = decodeJwtPayload(token);
-  return getCustomerRefFromJwtPayload(payload, options);
+  const kind = value.kind;
+  return kind === "payment_required" || kind === "activation_required";
 }
 
-// src/mcp/auth-bridge.ts
-function getClientId(payload, explicitClientId) {
-  if (explicitClientId) return explicitClientId;
-  const payloadClientId = typeof payload.client_id === "string" && payload.client_id || typeof payload.azp === "string" && payload.azp || typeof payload.aud === "string" && payload.aud || null;
-  return payloadClientId || "solvapay-mcp-client";
+// src/helpers/error.ts
+import { SolvaPayError as SolvaPayError3 } from "@solvapay/core";
+function isErrorResult(result) {
+  return typeof result === "object" && result !== null && "error" in result && "status" in result;
 }
-function getScopes(payload, defaultScopes) {
-  if (Array.isArray(payload.scp)) {
-    return payload.scp.filter((scope) => typeof scope === "string");
-  }
-  if (typeof payload.scope === "string" && payload.scope.trim()) {
-    return payload.scope.split(/\s+/).map((scope) => scope.trim()).filter(Boolean);
+function handleRouteError(error, operationName, defaultMessage) {
+  console.error(`[${operationName}] Error:`, error);
+  if (error instanceof SolvaPayError3) {
+    const errorMessage2 = error.message;
+    return {
+      error: errorMessage2,
+      status: 500,
+      details: errorMessage2
+    };
   }
-  return defaultScopes;
-}
-function getExpiresAt(payload) {
-  return typeof payload.exp === "number" ? payload.exp : void 0;
-}
-function buildAuthInfoFromBearer(authorization, options = {}) {
-  const token = extractBearerToken(authorization);
-  if (!token) return null;
-  const payload = decodeJwtPayload(token);
-  const customerRef = getCustomerRefFromJwtPayload(payload, options);
-  const clientId = getClientId(payload, options.clientId);
-  const scopes = getScopes(payload, options.defaultScopes || []);
-  const expiresAt = getExpiresAt(payload);
+  const errorMessage = error instanceof Error ? error.message : "Unknown error";
+  const message = defaultMessage || `${operationName} failed`;
   return {
-    token,
-    clientId,
-    scopes,
-    expiresAt,
-    extra: {
-      customer_ref: customerRef,
-      ...options.includePayload ? { payload } : {}
-    }
+    error: message,
+    status: 500,
+    details: errorMessage
   };
 }
 
-// src/mcp/oauth-bridge.ts
-var DEFAULT_OAUTH_PATHS = {
-  register: "/oauth/register",
-  authorize: "/oauth/authorize",
-  token: "/oauth/token",
-  revoke: "/oauth/revoke"
-};
-var NATIVE_CLIENT_ORIGIN_SCHEMES = ["cursor:", "vscode:", "vscode-webview:", "claude:"];
-function withoutTrailingSlash(value) {
-  return value.replace(/\/$/, "");
-}
-function resolvePaths(paths = {}) {
-  return { ...DEFAULT_OAUTH_PATHS, ...paths };
-}
-function getRequestAuthHeader(req) {
-  const header = req.headers?.authorization;
-  if (typeof header === "string") return header;
-  if (Array.isArray(header)) return header[0] || null;
-  return null;
-}
-function getHeader(req, name) {
-  const header = req.headers?.[name.toLowerCase()];
-  if (typeof header === "string") return header;
-  if (Array.isArray(header)) return header[0] || null;
-  return null;
-}
-function getRequestJsonRpcId(body) {
-  if (body && typeof body === "object" && "id" in body) {
-    const id = body.id;
-    return id ?? null;
-  }
-  return null;
-}
-function makeUnauthorizedJsonRpc(id) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    error: {
-      code: -32001,
-      message: "Unauthorized"
+// src/helpers/auth.ts
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
     }
-  };
-}
-function setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath) {
-  res.setHeader(
-    "WWW-Authenticate",
-    `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`
-  );
-}
-function getRequestQuery(req) {
-  const raw = req.url ?? req.path ?? "";
-  const qIndex = raw.indexOf("?");
-  return qIndex === -1 ? "" : raw.slice(qIndex);
-}
-function isNativeClientOrigin(origin) {
-  try {
-    const url = new URL(origin);
-    return NATIVE_CLIENT_ORIGIN_SCHEMES.includes(
-      url.protocol
-    );
-  } catch {
-    return false;
-  }
-}
-function applyCorsHeaders(req, res) {
-  const origin = getHeader(req, "origin");
-  if (!origin) return;
-  if (isNativeClientOrigin(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
-    res.setHeader("Vary", "Origin");
   }
-}
-function handlePreflight(req, res) {
-  applyCorsHeaders(req, res);
-  const requestedMethod = getHeader(req, "access-control-request-method") ?? "POST";
-  const requestedHeaders = getHeader(req, "access-control-request-headers") ?? "authorization, content-type";
-  res.setHeader("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
-  res.setHeader("Access-Control-Allow-Headers", requestedHeaders);
-  res.setHeader("Access-Control-Max-Age", "600");
-  res.status(204);
-  if (typeof res.end === "function") {
-    res.end();
-  } else {
-    res.json({});
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
   }
+  throw new Error("No base64 decoder available in this runtime");
 }
-async function readJsonFromResponse(upstream) {
-  const text = await upstream.text();
-  if (!text) return { body: {}, text: "" };
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
   try {
-    return { body: JSON.parse(text), text };
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
   } catch {
-    return { body: text, text };
+    return null;
   }
 }
-async function relayJsonResponse(upstream, res) {
-  const { body, text } = await readJsonFromResponse(upstream);
-  res.status(upstream.status);
-  const contentType = upstream.headers.get("content-type");
-  if (contentType) res.setHeader("Content-Type", contentType);
-  if (text === "" && upstream.status === 204) {
-    if (typeof res.end === "function") {
-      res.end();
-      return;
-    }
-  }
-  res.json(body);
+function extractBearerToken(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
 }
-function sendUpstreamError(res, _error) {
-  res.status(502);
-  res.setHeader("Content-Type", "application/json");
-  res.json({ error: "upstream_unreachable" });
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
 }
-function serializeRegisterBody(body) {
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  return JSON.stringify(body ?? {});
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
 }
-function serializeFormBody(body) {
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  if (body && typeof body === "object") {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(body)) {
-      if (value === void 0 || value === null) continue;
-      if (Array.isArray(value)) {
-        for (const entry of value) params.append(key, String(entry));
-      } else {
-        params.append(key, String(value));
-      }
-    }
-    return params.toString();
-  }
-  return "";
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
 }
-function serializeRequestBody(contentType, body) {
-  if (contentType && contentType.includes("application/x-www-form-urlencoded")) {
-    return serializeFormBody(body);
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify } = await import("jose");
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
   }
-  if (typeof body === "string") return body;
-  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
-  return JSON.stringify(body ?? {});
-}
-function getOAuthProtectedResourceResponse(publicBaseUrl) {
-  const resource = withoutTrailingSlash(publicBaseUrl);
-  return {
-    resource,
-    authorization_servers: [resource],
-    scopes_supported: ["openid", "profile", "email"]
-  };
-}
-function getOAuthAuthorizationServerResponse({
-  publicBaseUrl,
-  paths
-}) {
-  const base = withoutTrailingSlash(publicBaseUrl);
-  const p = resolvePaths(paths);
-  return {
-    issuer: base,
-    authorization_endpoint: `${base}${p.authorize}`,
-    token_endpoint: `${base}${p.token}`,
-    registration_endpoint: `${base}${p.register}`,
-    revocation_endpoint: `${base}${p.revoke}`,
-    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
-    response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
-    scopes_supported: ["openid", "profile", "email"],
-    code_challenge_methods_supported: ["S256"]
-  };
 }
-function createOAuthRegisterHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.register;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: serializeRegisterBody(req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
 }
-function createOAuthAuthorizeHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.authorize;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  return (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "GET") {
-      next();
-      return;
-    }
-    const query = getRequestQuery(req);
-    const location = `${api}/v1/customer/auth/authorize${query}`;
-    res.setHeader("Location", location);
-    res.status(302);
-    if (typeof res.end === "function") {
-      res.end();
-      return;
-    }
-    res.json({});
-  };
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
 }
-function createOAuthTokenHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.token;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/token`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
-    const authorization = getHeader(req, "authorization");
-    const headers = { "content-type": contentType };
-    if (authorization) headers["authorization"] = authorization;
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers,
-        body: serializeRequestBody(contentType, req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
 }
-function createOAuthRevokeHandler(options) {
-  const path = options.path ?? DEFAULT_OAUTH_PATHS.revoke;
-  const api = withoutTrailingSlash(options.apiBaseUrl);
-  const upstream = `${api}/v1/customer/auth/revoke`;
-  return async (req, res, next) => {
-    if (req.path !== path) {
-      next();
-      return;
-    }
-    if (req.method === "OPTIONS") {
-      handlePreflight(req, res);
-      return;
-    }
-    if (req.method !== "POST") {
-      next();
-      return;
-    }
-    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
-    const authorization = getHeader(req, "authorization");
-    const headers = { "content-type": contentType };
-    if (authorization) headers["authorization"] = authorization;
-    try {
-      const response = await fetch(upstream, {
-        method: "POST",
-        headers,
-        body: serializeRequestBody(contentType, req.body)
-      });
-      applyCorsHeaders(req, res);
-      await relayJsonResponse(response, res);
-    } catch (error) {
-      applyCorsHeaders(req, res);
-      sendUpstreamError(res, error);
-    }
-  };
-}
-function createMcpOAuthBridge(options) {
-  const {
-    publicBaseUrl,
-    apiBaseUrl,
-    productRef,
-    mcpPath = "/mcp",
-    requireAuth = true,
-    authInfo,
-    protectedResourcePath = "/.well-known/oauth-protected-resource",
-    authorizationServerPath = "/.well-known/oauth-authorization-server",
-    oauthPaths
-  } = options;
-  const paths = resolvePaths(oauthPaths);
-  const openidDiscoveryMiddleware = (req, res, next) => {
-    if (req.method !== "GET" || req.path !== "/.well-known/openid-configuration") {
-      next();
-      return;
-    }
-    applyCorsHeaders(req, res);
-    res.status(404);
-    if (typeof res.end === "function") {
-      res.end();
-    } else {
-      res.json({ error: "not_found" });
-    }
-  };
-  const protectedResourceMiddleware = (req, res, next) => {
-    if (req.method !== "GET" || req.path !== protectedResourcePath) {
-      next();
-      return;
-    }
-    res.json(getOAuthProtectedResourceResponse(publicBaseUrl));
-  };
-  const authorizationServerMiddleware = (req, res, next) => {
-    if (req.method !== "GET" || req.path !== authorizationServerPath) {
-      next();
-      return;
-    }
-    if (!productRef) {
-      res.status(500).json({ error: "SOLVAPAY_PRODUCT_REF missing" });
-      return;
-    }
-    res.json(
-      getOAuthAuthorizationServerResponse({
-        publicBaseUrl,
-        paths
-      })
-    );
-  };
-  const registerMiddleware = createOAuthRegisterHandler({
-    apiBaseUrl,
-    productRef,
-    path: paths.register
-  });
-  const authorizeMiddleware = createOAuthAuthorizeHandler({
-    apiBaseUrl,
-    path: paths.authorize
-  });
-  const tokenMiddleware = createOAuthTokenHandler({ apiBaseUrl, path: paths.token });
-  const revokeMiddleware = createOAuthRevokeHandler({ apiBaseUrl, path: paths.revoke });
-  const mcpAuthMiddleware = (req, res, next) => {
-    if (req.path !== mcpPath) {
-      next();
-      return;
-    }
-    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
-      applyCorsHeaders(req, res);
-      res.setHeader("Allow", "POST, OPTIONS");
-      res.status(405);
-      if (typeof res.end === "function") {
-        res.end();
-      } else {
-        res.json({ error: "method_not_allowed" });
+async function getAuthenticatedUserCore(request, options = {}) {
+  try {
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
       }
-      return;
+      return { userId: headerUserId, email, name };
     }
-    const authHeader = getRequestAuthHeader(req);
-    const id = getRequestJsonRpcId(req.body);
-    if (!authHeader && !requireAuth) {
-      next();
-      return;
+    const token = extractBearerToken(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
     }
-    try {
-      const auth = buildAuthInfoFromBearer(authHeader, authInfo);
-      if (!auth) {
-        throw new McpBearerAuthError("Missing bearer token");
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
       }
-      req.auth = auth;
-      next();
-    } catch {
-      applyCorsHeaders(req, res);
-      res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
-      setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath);
-      if (req.method === "POST") {
-        res.status(401).json(makeUnauthorizedJsonRpc(id));
-        return;
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
       }
-      res.status(401).json({ error: "Unauthorized" });
     }
-  };
-  return [
-    openidDiscoveryMiddleware,
-    protectedResourceMiddleware,
-    authorizationServerMiddleware,
-    registerMiddleware,
-    authorizeMiddleware,
-    tokenMiddleware,
-    revokeMiddleware,
-    mcpAuthMiddleware
-  ];
-}
-
-// src/helpers/error.ts
-import { SolvaPayError as SolvaPayError3 } from "@solvapay/core";
-function isErrorResult(result) {
-  return typeof result === "object" && result !== null && "error" in result && "status" in result;
-}
-function handleRouteError(error, operationName, defaultMessage) {
-  console.error(`[${operationName}] Error:`, error);
-  if (error instanceof SolvaPayError3) {
-    const errorMessage2 = error.message;
-    return {
-      error: errorMessage2,
-      status: 500,
-      details: errorMessage2
-    };
-  }
-  const errorMessage = error instanceof Error ? error.message : "Unknown error";
-  const message = defaultMessage || `${operationName} failed`;
-  return {
-    error: message,
-    status: 500,
-    details: errorMessage
-  };
-}
-
-// src/helpers/auth.ts
-async function getAuthenticatedUserCore(request, options = {}) {
-  try {
-    const { requireUserId, getUserEmailFromRequest, getUserNameFromRequest } = await import("@solvapay/auth");
-    const userIdOrError = requireUserId(request);
-    if (userIdOrError instanceof Response) {
-      const clonedResponse = userIdOrError.clone();
-      const body = await clonedResponse.json().catch(() => ({ error: "Unauthorized" }));
-      return {
-        error: body.error || "Unauthorized",
-        status: userIdOrError.status,
-        details: body.error || "Unauthorized"
-      };
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
     }
-    const userId = userIdOrError;
-    const email = options.includeEmail !== false ? await getUserEmailFromRequest(request) : null;
-    const name = options.includeName !== false ? await getUserNameFromRequest(request) : null;
     return {
       userId,
-      email,
-      name
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
     };
   } catch (error) {
     return handleRouteError(error, "Get authenticated user", "Authentication failed");
@@ -2672,6 +2499,31 @@ async function activatePlanCore(request, body, options = {}) {
   }
 }
 
+// src/helpers/payment-method.ts
+async function getPaymentMethodCore(request, options = {}) {
+  try {
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    if (!solvaPay.apiClient.getPaymentMethod) {
+      return {
+        error: "getPaymentMethod is not implemented on this API client",
+        status: 500
+      };
+    }
+    return await solvaPay.apiClient.getPaymentMethod({ customerRef });
+  } catch (error) {
+    return handleRouteError(error, "Get payment method", "Failed to load payment method");
+  }
+}
+
 // src/helpers/plans.ts
 import { getSolvaPayConfig as getSolvaPayConfig2 } from "@solvapay/core";
 async function listPlansCore(request, options = {}) {
@@ -2841,6 +2693,37 @@ async function checkPurchaseCore(request, options = {}) {
 }
 
 // src/helpers/usage.ts
+async function getUsageCore(request, options = {}) {
+  const purchaseResult = await checkPurchaseCore(request, options);
+  if (isErrorResult(purchaseResult)) return purchaseResult;
+  const activePurchase = (purchaseResult.purchases ?? []).find((p) => p.status === "active");
+  if (!activePurchase) {
+    return {
+      meterRef: null,
+      total: null,
+      used: 0,
+      remaining: null,
+      percentUsed: null
+    };
+  }
+  const snap = activePurchase.planSnapshot;
+  const usage = activePurchase.usage;
+  const meterRef = snap?.meterRef ?? snap?.meterId ?? null;
+  const total = typeof snap?.limit === "number" ? snap.limit : null;
+  const used = typeof usage?.used === "number" ? usage.used : 0;
+  const remaining = total !== null ? Math.max(0, total - used) : null;
+  const percentUsed = total !== null && total > 0 ? Math.min(100, Math.round(used / total * 1e4) / 100) : null;
+  return {
+    meterRef,
+    total,
+    used,
+    remaining,
+    percentUsed,
+    ...usage?.periodStart ? { periodStart: usage.periodStart } : {},
+    ...usage?.periodEnd ? { periodEnd: usage.periodEnd } : {},
+    purchaseRef: activePurchase.reference
+  };
+}
 async function trackUsageCore(request, body, options = {}) {
   try {
     const userResult = await getAuthenticatedUserCore(request);
@@ -2905,37 +2788,30 @@ function verifyWebhook({
   }
 }
 export {
-  McpBearerAuthError,
   PaywallError,
   VIRTUAL_TOOL_DEFINITIONS,
   activatePlanCore,
-  buildAuthInfoFromBearer,
+  buildGateMessage,
+  buildNudgeMessage,
   cancelPurchaseCore,
   checkPurchaseCore,
+  classifyPaywallState,
   createCheckoutSessionCore,
   createCustomerSessionCore,
-  createMcpOAuthBridge,
-  createOAuthAuthorizeHandler,
-  createOAuthRegisterHandler,
-  createOAuthRevokeHandler,
-  createOAuthTokenHandler,
   createPaymentIntentCore,
   createSolvaPay,
   createSolvaPayClient,
   createTopupPaymentIntentCore,
   createVirtualTools,
-  decodeJwtPayload,
-  extractBearerToken,
   getAuthenticatedUserCore,
   getCustomerBalanceCore,
-  getCustomerRefFromBearerAuthHeader,
-  getCustomerRefFromJwtPayload,
   getMerchantCore,
-  getOAuthAuthorizationServerResponse,
-  getOAuthProtectedResourceResponse,
+  getPaymentMethodCore,
   getProductCore,
+  getUsageCore,
   handleRouteError,
   isErrorResult,
+  isPaywallStructuredContent,
   jsonSchemaToZodRawShape,
   listPlansCore,
   paywallErrorToClientPayload,