@solvapay/server 1.0.9-preview.1 → 1.0.9

package/dist/fetch/index.cjs

@@ -0,0 +1,3073 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/fetch/index.ts
+var index_exports = {};
+__export(index_exports, {
+  activatePlan: () => activatePlan,
+  cancelRenewal: () => cancelRenewal,
+  checkPurchase: () => checkPurchase,
+  configureCors: () => configureCors,
+  createCheckoutSession: () => createCheckoutSession,
+  createCustomerSession: () => createCustomerSession,
+  createPaymentIntent: () => createPaymentIntent,
+  createTopupPaymentIntent: () => createTopupPaymentIntent,
+  customerBalance: () => customerBalance,
+  getMerchant: () => getMerchant,
+  getPaymentMethod: () => getPaymentMethod,
+  getProduct: () => getProduct,
+  listPlans: () => listPlans,
+  processPayment: () => processPayment,
+  reactivateRenewal: () => reactivateRenewal,
+  solvapayWebhook: () => solvapayWebhook,
+  syncCustomer: () => syncCustomer,
+  trackUsage: () => trackUsage
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/helpers/error.ts
+var import_core = require("@solvapay/core");
+function isErrorResult(result) {
+  return typeof result === "object" && result !== null && "error" in result && "status" in result;
+}
+function handleRouteError(error, operationName, defaultMessage) {
+  console.error(`[${operationName}] Error:`, error);
+  if (error instanceof import_core.SolvaPayError) {
+    const errorMessage2 = error.message;
+    return {
+      error: errorMessage2,
+      status: 500,
+      details: errorMessage2
+    };
+  }
+  const errorMessage = error instanceof Error ? error.message : "Unknown error";
+  const message = defaultMessage || `${operationName} failed`;
+  return {
+    error: message,
+    status: 500,
+    details: errorMessage
+  };
+}
+
+// src/helpers/auth.ts
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+function getConfiguredSecret() {
+  return readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+}
+async function verifyHs256(token, secret) {
+  try {
+    const { jwtVerify } = await import("jose");
+    const key = new TextEncoder().encode(secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function pickName(payload) {
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function pickEmail(payload) {
+  return typeof payload.email === "string" ? payload.email : null;
+}
+function unauthorized(details) {
+  return { error: "Unauthorized", status: 401, details };
+}
+async function getAuthenticatedUserCore(request, options = {}) {
+  try {
+    const includeEmail = options.includeEmail !== false;
+    const includeName = options.includeName !== false;
+    const headerUserId = request.headers.get("x-user-id");
+    if (headerUserId) {
+      let email = null;
+      let name = null;
+      if (includeEmail || includeName) {
+        const token2 = extractBearerToken(request);
+        if (token2) {
+          const secret2 = getConfiguredSecret();
+          const payload2 = secret2 ? await verifyHs256(token2, secret2) : isStrictMode() ? null : decodeJwtUnverified(token2);
+          if (payload2) {
+            if (includeEmail) email = pickEmail(payload2);
+            if (includeName) name = pickName(payload2);
+          }
+        }
+      }
+      return { userId: headerUserId, email, name };
+    }
+    const token = extractBearerToken(request);
+    if (!token) {
+      return unauthorized("User ID not found. Ensure middleware is configured.");
+    }
+    const secret = getConfiguredSecret();
+    let payload = null;
+    if (secret) {
+      payload = await verifyHs256(token, secret);
+      if (!payload) {
+        return unauthorized("Invalid or expired authentication token");
+      }
+    } else if (isStrictMode()) {
+      return unauthorized(
+        "Strict auth mode is enabled but no JWT secret is configured. Set SOLVAPAY_JWT_SECRET or SUPABASE_JWT_SECRET."
+      );
+    } else {
+      payload = decodeJwtUnverified(token);
+      if (!payload) {
+        return unauthorized("Malformed authentication token");
+      }
+    }
+    const userId = typeof payload.sub === "string" ? payload.sub : null;
+    if (!userId) {
+      return unauthorized("Authentication token missing subject (sub) claim");
+    }
+    return {
+      userId,
+      email: includeEmail ? pickEmail(payload) : null,
+      name: includeName ? pickName(payload) : null
+    };
+  } catch (error) {
+    return handleRouteError(error, "Get authenticated user", "Authentication failed");
+  }
+}
+
+// src/client.ts
+var import_core2 = require("@solvapay/core");
+function createSolvaPayClient(opts) {
+  const base = opts.apiBaseUrl ?? "https://api.solvapay.com";
+  if (!opts.apiKey) throw new import_core2.SolvaPayError("Missing apiKey");
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${opts.apiKey}`
+  };
+  const debug = process.env.SOLVAPAY_DEBUG === "true";
+  const log = (...args) => {
+    if (debug) {
+      console.log(...args);
+    }
+  };
+  return {
+    // POST: /v1/sdk/limits
+    async checkLimits(params) {
+      const url = `${base}/v1/sdk/limits`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Check limits failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // POST: /v1/sdk/usages
+    async trackUsage(params) {
+      const url = `${base}/v1/sdk/usages`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Track usage failed (${res.status}): ${error}`);
+      }
+    },
+    // POST: /v1/sdk/customers
+    async createCustomer(params) {
+      const url = `${base}/v1/sdk/customers`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create customer failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return {
+        customerRef: result.reference || result.customerRef
+      };
+    },
+    // PATCH: /v1/sdk/customers/{customerRef}
+    async updateCustomer(customerRef, params) {
+      const url = `${base}/v1/sdk/customers/${encodeURIComponent(customerRef)}`;
+      const res = await fetch(url, {
+        method: "PATCH",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Update customer failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return {
+        customerRef: result.reference || result.customerRef || customerRef
+      };
+    },
+    // GET: /v1/sdk/customers/{reference} or /v1/sdk/customers?externalRef={externalRef}|email={email}
+    async getCustomer(params) {
+      let url;
+      let isByExternalRef = false;
+      let isByEmail = false;
+      if (params.externalRef) {
+        url = `${base}/v1/sdk/customers?externalRef=${encodeURIComponent(params.externalRef)}`;
+        isByExternalRef = true;
+      } else if (params.email) {
+        url = `${base}/v1/sdk/customers?email=${encodeURIComponent(params.email)}`;
+        isByEmail = true;
+      } else if (params.customerRef) {
+        url = `${base}/v1/sdk/customers/${params.customerRef}`;
+      } else {
+        throw new import_core2.SolvaPayError("One of customerRef, externalRef, or email must be provided");
+      }
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get customer failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      let customer = result;
+      if (isByExternalRef || isByEmail) {
+        const directCustomer = result && typeof result === "object" && (result.reference || result.customerRef || result.externalRef) ? result : void 0;
+        const wrappedCustomer = result && typeof result === "object" && result.customer ? result.customer : void 0;
+        const customers = Array.isArray(result) ? result : result && typeof result === "object" && Array.isArray(result.customers) ? result.customers : [];
+        customer = directCustomer || wrappedCustomer || customers[0];
+        if (!customer) {
+          throw new import_core2.SolvaPayError(`No customer found with externalRef: ${params.externalRef}`);
+        }
+      }
+      return {
+        customerRef: customer.reference || customer.customerRef,
+        email: customer.email,
+        name: customer.name,
+        externalRef: customer.externalRef,
+        purchases: customer.purchases || []
+      };
+    },
+    // GET: /v1/sdk/merchant
+    async getMerchant() {
+      const url = `${base}/v1/sdk/merchant`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get merchant failed (${res.status}): ${error}`);
+      }
+      return res.json();
+    },
+    // GET: /v1/sdk/platform-config
+    async getPlatformConfig() {
+      const url = `${base}/v1/sdk/platform-config`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get platform config failed (${res.status}): ${error}`);
+      }
+      return res.json();
+    },
+    // GET: /v1/sdk/products/{productRef}
+    async getProduct(productRef) {
+      const url = `${base}/v1/sdk/products/${encodeURIComponent(productRef)}`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get product failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      const data = result.data || {};
+      return { ...data, ...result };
+    },
+    // Product management methods (primarily for integration tests)
+    // GET: /v1/sdk/products
+    async listProducts() {
+      const url = `${base}/v1/sdk/products`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`List products failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      const products = Array.isArray(result) ? result : result.products || [];
+      return products.map((product) => ({
+        ...product,
+        ...product.data || {}
+      }));
+    },
+    // POST: /v1/sdk/products
+    async createProduct(params) {
+      const url = `${base}/v1/sdk/products`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create product failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // POST: /v1/sdk/products/mcp/bootstrap
+    async bootstrapMcpProduct(params) {
+      const url = `${base}/v1/sdk/products/mcp/bootstrap`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Bootstrap MCP product failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // PUT: /v1/sdk/products/{productRef}/mcp/plans
+    async configureMcpPlans(productRef, params) {
+      const url = `${base}/v1/sdk/products/${productRef}/mcp/plans`;
+      const res = await fetch(url, {
+        method: "PUT",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Configure MCP plans failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // DELETE: /v1/sdk/products/{productRef}
+    async deleteProduct(productRef) {
+      const url = `${base}/v1/sdk/products/${productRef}`;
+      const res = await fetch(url, {
+        method: "DELETE",
+        headers
+      });
+      if (!res.ok && res.status !== 404) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Delete product failed (${res.status}): ${error}`);
+      }
+    },
+    // POST: /v1/sdk/products/{productRef}/clone
+    async cloneProduct(productRef, overrides) {
+      const url = `${base}/v1/sdk/products/${productRef}/clone`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(overrides || {})
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Clone product failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // GET: /v1/sdk/products/{productRef}/plans
+    async listPlans(productRef) {
+      const url = `${base}/v1/sdk/products/${productRef}/plans`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`List plans failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      const plans = Array.isArray(result) ? result : result.plans || [];
+      return plans.map((plan) => {
+        const data = plan.data || {};
+        const price = plan.price ?? data.price;
+        const unwrapped = {
+          ...data,
+          ...plan,
+          ...price !== void 0 && { price }
+        };
+        delete unwrapped.data;
+        return unwrapped;
+      });
+    },
+    // POST: /v1/sdk/products/{productRef}/plans
+    async createPlan(params) {
+      const url = `${base}/v1/sdk/products/${params.productRef}/plans`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create plan failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // PUT: /v1/sdk/products/{productRef}/plans/{planRef}
+    async updatePlan(productRef, planRef, params) {
+      const url = `${base}/v1/sdk/products/${productRef}/plans/${planRef}`;
+      const res = await fetch(url, {
+        method: "PUT",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Update plan failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // DELETE: /v1/sdk/products/{productRef}/plans/{planRef}
+    async deletePlan(productRef, planRef) {
+      const url = `${base}/v1/sdk/products/${productRef}/plans/${planRef}`;
+      const res = await fetch(url, {
+        method: "DELETE",
+        headers
+      });
+      if (!res.ok && res.status !== 404) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Delete plan failed (${res.status}): ${error}`);
+      }
+    },
+    // POST: /payment-intents
+    async createPaymentIntent(params) {
+      const idempotencyKey = params.idempotencyKey || `payment-${params.planRef}-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+      const url = `${base}/v1/sdk/payment-intents`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          ...headers,
+          "Idempotency-Key": idempotencyKey
+        },
+        body: JSON.stringify({
+          productRef: params.productRef,
+          planRef: params.planRef,
+          customerRef: params.customerRef
+        })
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create payment intent failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // POST: /v1/sdk/payment-intents (purpose: credit_topup)
+    async createTopupPaymentIntent(params) {
+      const idempotencyKey = params.idempotencyKey || `topup-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+      const url = `${base}/v1/sdk/payment-intents`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          ...headers,
+          "Idempotency-Key": idempotencyKey
+        },
+        body: JSON.stringify({
+          customerRef: params.customerRef,
+          purpose: "credit_topup",
+          amount: params.amount,
+          currency: params.currency,
+          description: params.description
+        })
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create topup payment intent failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // POST: /v1/sdk/payment-intents/{paymentIntentId}/process
+    async processPaymentIntent(params) {
+      const url = `${base}/v1/sdk/payment-intents/${params.paymentIntentId}/process`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          ...headers,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          productRef: params.productRef,
+          customerRef: params.customerRef,
+          planRef: params.planRef
+        })
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Process payment failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // POST: /v1/sdk/purchases/{purchaseRef}/cancel
+    async cancelPurchase(params) {
+      const url = `${base}/v1/sdk/purchases/${params.purchaseRef}/cancel`;
+      const requestOptions = {
+        method: "POST",
+        headers
+      };
+      if (params.reason) {
+        requestOptions.body = JSON.stringify({ reason: params.reason });
+      }
+      const res = await fetch(url, requestOptions);
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        if (res.status === 404) {
+          throw new import_core2.SolvaPayError(`Purchase not found: ${error}`);
+        }
+        if (res.status === 400) {
+          throw new import_core2.SolvaPayError(
+            `Purchase cannot be cancelled or does not belong to provider: ${error}`
+          );
+        }
+        throw new import_core2.SolvaPayError(`Cancel purchase failed (${res.status}): ${error}`);
+      }
+      const responseText = await res.text();
+      let responseData;
+      try {
+        responseData = JSON.parse(responseText);
+      } catch (parseError) {
+        log(`\u274C Failed to parse response as JSON: ${parseError}`);
+        throw new import_core2.SolvaPayError(
+          `Invalid JSON response from cancel purchase endpoint: ${responseText.substring(0, 200)}`
+        );
+      }
+      if (!responseData || typeof responseData !== "object") {
+        log(`\u274C Invalid response structure: ${JSON.stringify(responseData)}`);
+        throw new import_core2.SolvaPayError(`Invalid response structure from cancel purchase endpoint`);
+      }
+      let result;
+      if (responseData.purchase && typeof responseData.purchase === "object") {
+        result = responseData.purchase;
+      } else if (responseData.reference) {
+        result = responseData;
+      } else {
+        result = responseData.purchase || responseData;
+      }
+      if (!result || typeof result !== "object") {
+        log(`\u274C Invalid purchase data in response. Full response:`, responseData);
+        throw new import_core2.SolvaPayError(`Invalid purchase data in cancel purchase response`);
+      }
+      return result;
+    },
+    // POST: /v1/sdk/purchases/{purchaseRef}/reactivate
+    async reactivatePurchase(params) {
+      const url = `${base}/v1/sdk/purchases/${params.purchaseRef}/reactivate`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        if (res.status === 404) {
+          throw new import_core2.SolvaPayError(`Purchase not found: ${error}`);
+        }
+        if (res.status === 400) {
+          throw new import_core2.SolvaPayError(
+            `Purchase cannot be reactivated: ${error}`
+          );
+        }
+        throw new import_core2.SolvaPayError(`Reactivate purchase failed (${res.status}): ${error}`);
+      }
+      const responseText = await res.text();
+      let responseData;
+      try {
+        responseData = JSON.parse(responseText);
+      } catch (parseError) {
+        log(`\u274C Failed to parse response as JSON: ${parseError}`);
+        throw new import_core2.SolvaPayError(
+          `Invalid JSON response from reactivate purchase endpoint: ${responseText.substring(0, 200)}`
+        );
+      }
+      if (!responseData || typeof responseData !== "object") {
+        log(`\u274C Invalid response structure: ${JSON.stringify(responseData)}`);
+        throw new import_core2.SolvaPayError(`Invalid response structure from reactivate purchase endpoint`);
+      }
+      let result;
+      if (responseData.purchase && typeof responseData.purchase === "object") {
+        result = responseData.purchase;
+      } else if (responseData.reference) {
+        result = responseData;
+      } else {
+        result = responseData.purchase || responseData;
+      }
+      if (!result || typeof result !== "object") {
+        log(`\u274C Invalid purchase data in response. Full response:`, responseData);
+        throw new import_core2.SolvaPayError(`Invalid purchase data in reactivate purchase response`);
+      }
+      return result;
+    },
+    // POST: /v1/sdk/user-info
+    async getUserInfo(params) {
+      const url = `${base}/v1/sdk/user-info`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get user info failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // GET: /v1/sdk/customers/:customerRef/balance
+    async getCustomerBalance(params) {
+      const url = `${base}/v1/sdk/customers/${params.customerRef}/balance`;
+      const res = await fetch(url, {
+        method: "GET",
+        headers
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get customer balance failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    // POST: /v1/sdk/checkout-sessions
+    async createCheckoutSession(params) {
+      const url = `${base}/v1/sdk/checkout-sessions`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create checkout session failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // POST: /v1/sdk/customers/customer-sessions
+    async createCustomerSession(params) {
+      const url = `${base}/v1/sdk/customers/customer-sessions`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Create customer session failed (${res.status}): ${error}`);
+      }
+      const result = await res.json();
+      return result;
+    },
+    // POST: /v1/sdk/activate
+    async activatePlan(params) {
+      const url = `${base}/v1/sdk/activate`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(params)
+      });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Activate plan failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    },
+    async getPaymentMethod(params) {
+      const url = new URL(`${base}/v1/sdk/payment-method`);
+      url.searchParams.set("customerRef", params.customerRef);
+      const res = await fetch(url.toString(), { method: "GET", headers });
+      if (!res.ok) {
+        const error = await res.text();
+        log(`\u274C API Error: ${res.status} - ${error}`);
+        throw new import_core2.SolvaPayError(`Get payment method failed (${res.status}): ${error}`);
+      }
+      return await res.json();
+    }
+  };
+}
+
+// src/paywall-state.ts
+function classifyPaywallState(limits) {
+  if (!limits) return { kind: "upgrade_required" };
+  if (limits.activationRequired === true) {
+    return { kind: "activation_required" };
+  }
+  const activePlan = limits.plans?.find((p) => p.reference === limits.plan);
+  const isUsageBased = activePlan?.type === "usage-based" || limits.balance !== void 0;
+  const creditBalance = limits.balance?.creditBalance ?? limits.creditBalance;
+  if (isUsageBased) {
+    if (creditBalance === 0) return { kind: "topup_required" };
+    if (creditBalance === void 0 && limits.remaining === 0) {
+      return { kind: "topup_required" };
+    }
+  }
+  return { kind: "upgrade_required" };
+}
+function buildGateMessage(state, gate) {
+  const url = gate.checkoutUrl && gate.checkoutUrl.length > 0 ? gate.checkoutUrl : null;
+  const openClause = url ? `, or open ${url} in a browser` : "";
+  switch (state.kind) {
+    case "activation_required":
+      return `Your plan needs activation before you can use this tool. Call the \`activate_plan\` tool to activate it${openClause}.`;
+    case "topup_required":
+      return `You're out of credits. Call the \`topup\` tool to add more${openClause}.`;
+    case "upgrade_required":
+      return `You don't have an active plan for this tool. Call the \`upgrade\` tool to pick a plan${openClause}.`;
+    case "reactivation_required":
+      return `Your previous plan is no longer active. Call the \`manage_account\` tool to reactivate it, or the \`upgrade\` tool to pick a new plan.`;
+  }
+}
+
+// src/utils.ts
+async function withRetry(fn, options = {}) {
+  const {
+    maxRetries = 2,
+    initialDelay = 500,
+    backoffStrategy = "fixed",
+    shouldRetry,
+    onRetry
+  } = options;
+  let lastError;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      const isLastAttempt = attempt === maxRetries;
+      if (isLastAttempt) {
+        throw lastError;
+      }
+      if (shouldRetry && !shouldRetry(lastError, attempt)) {
+        throw lastError;
+      }
+      const delay = calculateDelay(initialDelay, attempt, backoffStrategy);
+      if (onRetry) {
+        onRetry(lastError, attempt);
+      }
+      await sleep(delay);
+    }
+  }
+  throw lastError;
+}
+function calculateDelay(initialDelay, attempt, strategy) {
+  switch (strategy) {
+    case "fixed":
+      return initialDelay;
+    case "linear":
+      return initialDelay * (attempt + 1);
+    case "exponential":
+      return initialDelay * Math.pow(2, attempt);
+    default:
+      return initialDelay;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createRequestDeduplicator(options = {}) {
+  const { cacheTTL = 2e3, maxCacheSize = 1e3, cacheErrors = true } = options;
+  const inFlightRequests = /* @__PURE__ */ new Map();
+  const resultCache = /* @__PURE__ */ new Map();
+  let _cleanupInterval = null;
+  function ensureCleanupInterval() {
+    if (_cleanupInterval || cacheTTL <= 0) return;
+    _cleanupInterval = setInterval(
+      () => {
+        const now = Date.now();
+        const entriesToDelete = [];
+        for (const [key, cached] of resultCache.entries()) {
+          if (now - cached.timestamp >= cacheTTL) {
+            entriesToDelete.push(key);
+          }
+        }
+        for (const key of entriesToDelete) {
+          resultCache.delete(key);
+        }
+        if (resultCache.size > maxCacheSize) {
+          const sortedEntries = Array.from(resultCache.entries()).sort(
+            (a, b) => a[1].timestamp - b[1].timestamp
+          );
+          const toRemove = sortedEntries.slice(0, resultCache.size - maxCacheSize);
+          for (const [key] of toRemove) {
+            resultCache.delete(key);
+          }
+        }
+      },
+      Math.min(cacheTTL, 1e3)
+    );
+  }
+  const deduplicate = async (key, fn) => {
+    ensureCleanupInterval();
+    if (cacheTTL > 0) {
+      const cached = resultCache.get(key);
+      if (cached && Date.now() - cached.timestamp < cacheTTL) {
+        return cached.data;
+      } else if (cached) {
+        resultCache.delete(key);
+      }
+    }
+    let requestPromise = inFlightRequests.get(key);
+    if (!requestPromise) {
+      requestPromise = (async () => {
+        try {
+          const result = await fn();
+          if (cacheTTL > 0) {
+            resultCache.set(key, {
+              data: result,
+              timestamp: Date.now()
+            });
+          }
+          return result;
+        } catch (error) {
+          if (cacheTTL > 0 && cacheErrors) {
+            resultCache.set(key, {
+              data: error,
+              timestamp: Date.now()
+            });
+          }
+          throw error;
+        } finally {
+          inFlightRequests.delete(key);
+        }
+      })();
+      const existingPromise = inFlightRequests.get(key);
+      if (existingPromise) {
+        requestPromise = existingPromise;
+      } else {
+        inFlightRequests.set(key, requestPromise);
+      }
+    }
+    return requestPromise;
+  };
+  const clearCache = (key) => {
+    resultCache.delete(key);
+  };
+  const clearAllCache = () => {
+    resultCache.clear();
+  };
+  const getStats = () => ({
+    inFlight: inFlightRequests.size,
+    cached: resultCache.size
+  });
+  return {
+    deduplicate,
+    clearCache,
+    clearAllCache,
+    getStats
+  };
+}
+
+// src/paywall.ts
+var PaywallError = class extends Error {
+  /**
+   * Creates a new PaywallError instance.
+   *
+   * @param message - Error message
+   * @param structuredContent - Structured content with checkout URLs and metadata
+   */
+  constructor(message, structuredContent) {
+    super(message);
+    this.structuredContent = structuredContent;
+    this.name = "PaywallError";
+  }
+};
+function paywallErrorToClientPayload(error) {
+  const sc = error.structuredContent;
+  const base = {
+    success: false,
+    error: sc.kind === "activation_required" ? "Activation required" : "Payment required",
+    product: sc.product,
+    checkoutUrl: sc.checkoutUrl,
+    message: sc.message
+  };
+  if (sc.kind === "activation_required") {
+    base.kind = "activation_required";
+    if (sc.plans !== void 0) base.plans = sc.plans;
+    if (sc.balance !== void 0) base.balance = sc.balance;
+    if (sc.productDetails !== void 0) base.productDetails = sc.productDetails;
+    if (sc.confirmationUrl !== void 0) base.confirmationUrl = sc.confirmationUrl;
+  } else {
+    base.kind = "payment_required";
+    if (sc.balance !== void 0) base.balance = sc.balance;
+    if (sc.productDetails !== void 0) base.productDetails = sc.productDetails;
+  }
+  return base;
+}
+var sharedCustomerLookupDeduplicator = createRequestDeduplicator({
+  cacheTTL: 6e4,
+  // Cache results for 60 seconds (reduces API calls significantly)
+  maxCacheSize: 1e3,
+  // Maximum cache entries
+  cacheErrors: false
+  // Don't cache errors - retry on next request
+});
+var EXTRA_FORWARD_KEY = "__solvapayExtra";
+var SolvaPayPaywall = class {
+  constructor(apiClient, options = {}) {
+    this.apiClient = apiClient;
+    this.debug = options.debug ?? process.env.SOLVAPAY_DEBUG === "true";
+    this.limitsCacheTTL = options.limitsCacheTTL ?? 1e4;
+  }
+  customerCreationAttempts = /* @__PURE__ */ new Set();
+  customerRefMapping = /* @__PURE__ */ new Map();
+  debug;
+  limitsCache = /* @__PURE__ */ new Map();
+  limitsCacheTTL;
+  log(...args) {
+    if (this.debug) {
+      console.log(...args);
+    }
+  }
+  resolveProduct(metadata) {
+    return metadata.product || process.env.SOLVAPAY_PRODUCT || "default-product";
+  }
+  generateRequestId() {
+    const timestamp = Date.now();
+    const random = Math.random().toString(36).substring(2, 11);
+    return `solvapay_${timestamp}_${random}`;
+  }
+  /**
+   * Pure decision routine — performs customer resolution, limits cache
+   * lookup / fresh `checkLimits` fetch, and returns a `PaywallDecision`
+   * describing whether the handler should run.
+   *
+   * Side effects kept in lockstep with the legacy `protect()` path:
+   *  - creates the backend customer on first use (`ensureCustomer`),
+   *  - updates the limits cache (consume-one-unit bookkeeping), and
+   *  - emits a `paywall` usage event on gate outcomes.
+   *
+   * `trackUsage` for the `success` / `fail` outcome is emitted by the
+   * caller (adapter or `protect()`) once it has actually invoked the
+   * handler — `decide()` never counts handler execution as usage.
+   *
+   * @since 1.1.0
+   */
+  async decide(args, metadata = {}, getCustomerRef) {
+    const product = this.resolveProduct(metadata);
+    const usageType = metadata.usageType || "requests";
+    const requestId = this.generateRequestId();
+    const startTime = Date.now();
+    const inputCustomerRef = getCustomerRef ? getCustomerRef(args) : args.auth?.customer_ref || "anonymous";
+    let backendCustomerRef;
+    if (inputCustomerRef.startsWith("cus_")) {
+      backendCustomerRef = inputCustomerRef;
+    } else {
+      backendCustomerRef = await this.ensureCustomer(inputCustomerRef, inputCustomerRef);
+    }
+    const limitsCacheKey = `${backendCustomerRef}:${product}:${usageType}`;
+    const cachedLimits = this.limitsCache.get(limitsCacheKey);
+    const now = Date.now();
+    let withinLimits;
+    let remaining;
+    let checkoutUrl;
+    let resolvedMeterName;
+    let lastLimitsCheck;
+    const hasFreshCachedLimits = cachedLimits && now - cachedLimits.timestamp < this.limitsCacheTTL;
+    if (hasFreshCachedLimits) {
+      checkoutUrl = cachedLimits.checkoutUrl;
+      resolvedMeterName = cachedLimits.meterName;
+      lastLimitsCheck = cachedLimits.limits;
+      if (cachedLimits.remaining > 0) {
+        cachedLimits.remaining--;
+        if (cachedLimits.remaining <= 0) {
+          this.limitsCache.delete(limitsCacheKey);
+        }
+        withinLimits = true;
+        remaining = cachedLimits.remaining;
+      } else {
+        withinLimits = false;
+        remaining = 0;
+        this.limitsCache.delete(limitsCacheKey);
+      }
+    } else {
+      if (cachedLimits) {
+        this.limitsCache.delete(limitsCacheKey);
+      }
+      const limitsCheck = await this.apiClient.checkLimits({
+        customerRef: backendCustomerRef,
+        productRef: product,
+        meterName: usageType
+      });
+      lastLimitsCheck = limitsCheck;
+      withinLimits = limitsCheck.withinLimits;
+      remaining = limitsCheck.remaining;
+      checkoutUrl = limitsCheck.checkoutUrl;
+      resolvedMeterName = limitsCheck.meterName;
+      const consumedAllowance = withinLimits && remaining > 0;
+      if (consumedAllowance) {
+        remaining = Math.max(0, remaining - 1);
+      }
+      if (consumedAllowance) {
+        this.limitsCache.set(limitsCacheKey, {
+          remaining,
+          checkoutUrl,
+          meterName: resolvedMeterName,
+          timestamp: now,
+          limits: limitsCheck
+        });
+      }
+    }
+    if (!withinLimits) {
+      const latencyMs = Date.now() - startTime;
+      this.trackUsage(
+        backendCustomerRef,
+        product,
+        resolvedMeterName || usageType,
+        "paywall",
+        requestId,
+        latencyMs
+      );
+      const state = classifyPaywallState(lastLimitsCheck ?? null);
+      const preMessageGate = lastLimitsCheck?.activationRequired ? {
+        kind: "activation_required",
+        product,
+        message: "",
+        checkoutUrl: lastLimitsCheck.confirmationUrl || lastLimitsCheck.checkoutUrl || checkoutUrl || "",
+        ...lastLimitsCheck.confirmationUrl !== void 0 ? { confirmationUrl: lastLimitsCheck.confirmationUrl } : {},
+        ...lastLimitsCheck.plans !== void 0 ? { plans: lastLimitsCheck.plans } : {},
+        ...lastLimitsCheck.balance !== void 0 ? { balance: lastLimitsCheck.balance } : {},
+        ...lastLimitsCheck.product !== void 0 ? { productDetails: lastLimitsCheck.product } : {}
+      } : {
+        kind: "payment_required",
+        product,
+        checkoutUrl: checkoutUrl || "",
+        message: "",
+        ...lastLimitsCheck?.balance !== void 0 ? { balance: lastLimitsCheck.balance } : {},
+        ...lastLimitsCheck?.product !== void 0 ? { productDetails: lastLimitsCheck.product } : {}
+      };
+      const gate = {
+        ...preMessageGate,
+        message: buildGateMessage(state, preMessageGate)
+      };
+      return {
+        outcome: "gate",
+        gate,
+        limits: lastLimitsCheck ?? null,
+        customerRef: backendCustomerRef
+      };
+    }
+    return {
+      outcome: "allow",
+      args,
+      limits: lastLimitsCheck,
+      customerRef: backendCustomerRef
+    };
+  }
+  /**
+   * Execute the handler for an already-obtained `allow` decision and
+   * emit the post-handler `trackUsage('success' | 'fail', ...)` event.
+   *
+   * Exposed for adapter integration — the adapter layer drives the
+   * paywall through `decide()` + `runAllow()` so `formatGate` can own
+   * gate outcomes without routing through `PaywallError`. `protect()`
+   * continues to offer the self-contained throw-based surface for
+   * legacy consumers.
+   *
+   * `runAllow` intentionally does NOT re-throw `PaywallError` — if a
+   * handler calls `ctx.gate(reason)` and throws from deep code, the
+   * adapter catches that at the `formatGate` boundary instead.
+   *
+   * @since 1.1.0
+   */
+  async runAllow(decision, handler, metadata, args) {
+    const product = this.resolveProduct(metadata);
+    const usageType = metadata.usageType || "requests";
+    const requestId = this.generateRequestId();
+    const startTime = Date.now();
+    const forwardedExtra = args[EXTRA_FORWARD_KEY];
+    const handlerContext = {
+      customerRef: decision.customerRef,
+      limits: decision.limits,
+      ...forwardedExtra !== void 0 ? { extra: forwardedExtra } : {}
+    };
+    try {
+      const result = await handler(args, handlerContext);
+      const latencyMs = Date.now() - startTime;
+      this.trackUsage(
+        decision.customerRef,
+        product,
+        decision.limits.meterName || usageType,
+        "success",
+        requestId,
+        latencyMs
+      );
+      return result;
+    } catch (error) {
+      if (error instanceof Error) {
+        const errorType = error instanceof PaywallError ? "PaywallError" : "API Error";
+        this.log(`\u274C Error in paywall [${errorType}]: ${error.message}`);
+      } else {
+        this.log(`\u274C Error in paywall:`, error);
+      }
+      if (!(error instanceof PaywallError)) {
+        const latencyMs = Date.now() - startTime;
+        this.trackUsage(
+          decision.customerRef,
+          product,
+          decision.limits.meterName || usageType,
+          "fail",
+          requestId,
+          latencyMs
+        );
+      }
+      throw error;
+    }
+  }
+  /**
+   * Core protection method - works for both MCP and HTTP
+   *
+   * The `handler` may optionally declare a second positional argument
+   * of type `ProtectHandlerContext` to receive the resolved customer
+   * ref, the pre-check `LimitResponseWithPlan`, and an opaque `extra`
+   * bag threaded through from the adapter layer. One-arg handlers
+   * ignore the second argument and continue to work unchanged.
+   *
+   * Implemented on top of `decide()`: pre-check runs through the same
+   * decision routine, and gate outcomes are raised as a `PaywallError`
+   * to preserve the legacy throw-based signal for consumers that
+   * haven't migrated to adapter-level `formatGate` routing.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async protect(handler, metadata = {}, getCustomerRef) {
+    return async (args) => {
+      const decision = await this.decide(args, metadata, getCustomerRef);
+      if (decision.outcome === "gate") {
+        const message = decision.gate.kind === "activation_required" ? "Activation required" : "Payment required";
+        this.log(`\u274C Error in paywall [PaywallError]: ${message}`);
+        throw new PaywallError(message, decision.gate);
+      }
+      return this.runAllow(decision, handler, metadata, args);
+    };
+  }
+  /**
+   * Ensures a customer exists in the backend, creating them if necessary.
+   * This is a public helper for testing, pre-creating customers, and internal use.
+   * Only attempts creation once per customer (idempotent).
+   * Returns the backend customer reference to use in API calls.
+   *
+   * @param customerRef - The customer reference used as a cache key (e.g., Supabase user ID)
+   * @param externalRef - Optional external reference for backend lookup (e.g., Supabase user ID)
+   *   If provided, will lookup existing customer by externalRef before creating new one.
+   *   The externalRef is stored on the SolvaPay backend for customer lookup.
+   * @param options - Optional customer details (email, name) for customer creation
+   */
+  async ensureCustomer(customerRef, externalRef, options) {
+    if (this.customerRefMapping.has(customerRef)) {
+      return this.customerRefMapping.get(customerRef);
+    }
+    if (customerRef === "anonymous") {
+      return customerRef;
+    }
+    if (customerRef.startsWith("cus_")) {
+      return customerRef;
+    }
+    const cacheKey = externalRef || customerRef;
+    if (this.customerRefMapping.has(customerRef)) {
+      const cached = this.customerRefMapping.get(customerRef);
+      return cached;
+    }
+    const backendRef = await sharedCustomerLookupDeduplicator.deduplicate(cacheKey, async () => {
+      if (externalRef) {
+        try {
+          const existingCustomer = await this.apiClient.getCustomer({ externalRef });
+          if (existingCustomer && existingCustomer.customerRef) {
+            const ref = existingCustomer.customerRef;
+            this.customerRefMapping.set(customerRef, ref);
+            this.customerCreationAttempts.add(customerRef);
+            if (externalRef !== customerRef) {
+              this.customerCreationAttempts.add(externalRef);
+            }
+            return ref;
+          }
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : String(error);
+          if (!errorMessage.includes("404") && !errorMessage.includes("not found")) {
+            this.log(`\u26A0\uFE0F  Error looking up customer by externalRef: ${errorMessage}`);
+          }
+        }
+      }
+      if (this.customerCreationAttempts.has(customerRef) || externalRef && this.customerCreationAttempts.has(externalRef)) {
+        const mappedRef = this.customerRefMapping.get(customerRef);
+        return mappedRef || customerRef;
+      }
+      if (!this.apiClient.createCustomer) {
+        console.warn(
+          `\u26A0\uFE0F  Cannot auto-create customer ${customerRef}: createCustomer method not available on API client`
+        );
+        return customerRef;
+      }
+      this.customerCreationAttempts.add(customerRef);
+      try {
+        const createParams = {
+          email: options?.email || `${customerRef}-${Date.now()}@auto-created.local`,
+          metadata: {}
+        };
+        if (options?.name) {
+          createParams.name = options.name;
+        }
+        if (externalRef) {
+          createParams.externalRef = externalRef;
+        }
+        const result = await this.apiClient.createCustomer(createParams);
+        const resultObj = result;
+        const ref = resultObj.customerRef || resultObj.reference || customerRef;
+        this.customerRefMapping.set(customerRef, ref);
+        return ref;
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (errorMessage.includes("409") || errorMessage.includes("already exists")) {
+          if (externalRef) {
+            try {
+              const searchResult = await this.apiClient.getCustomer({ externalRef });
+              if (searchResult && searchResult.customerRef) {
+                this.customerRefMapping.set(customerRef, searchResult.customerRef);
+                return searchResult.customerRef;
+              }
+            } catch (lookupError) {
+              this.log(
+                `\u26A0\uFE0F Failed to lookup existing customer by externalRef after 409:`,
+                lookupError instanceof Error ? lookupError.message : lookupError
+              );
+            }
+          }
+          const isEmailConflict = errorMessage.includes("email") || errorMessage.includes("identifier email");
+          if (externalRef && isEmailConflict && options?.email) {
+            try {
+              const byEmail = await this.apiClient.getCustomer({ email: options.email });
+              if (byEmail && byEmail.customerRef) {
+                this.customerRefMapping.set(customerRef, byEmail.customerRef);
+                this.log(
+                  `\u26A0\uFE0F Resolved customer ${customerRef} by email after conflict; using existing customer ${byEmail.customerRef}`
+                );
+                if (!byEmail.externalRef && this.apiClient.updateCustomer) {
+                  try {
+                    await this.apiClient.updateCustomer(byEmail.customerRef, { externalRef });
+                  } catch (backfillError) {
+                    this.log(
+                      `\u26A0\uFE0F Failed to backfill externalRef on ${byEmail.customerRef}:`,
+                      backfillError instanceof Error ? backfillError.message : backfillError
+                    );
+                  }
+                }
+                return byEmail.customerRef;
+              }
+            } catch (emailLookupError) {
+              this.log(
+                `\u26A0\uFE0F Email lookup failed after customer conflict for ${customerRef}:`,
+                emailLookupError instanceof Error ? emailLookupError.message : emailLookupError
+              );
+            }
+            try {
+              const retryParams = {
+                email: `${customerRef}-${Date.now()}@auto-created.local`,
+                externalRef,
+                metadata: {}
+              };
+              if (options?.name) {
+                retryParams.name = options.name;
+              }
+              const retryResult = await this.apiClient.createCustomer(retryParams);
+              const retryObj = retryResult;
+              const retryRef = retryObj.customerRef || retryObj.reference || customerRef;
+              this.customerRefMapping.set(customerRef, retryRef);
+              this.log(
+                `\u26A0\uFE0F Retried customer creation for ${customerRef} with generated email after email conflict`
+              );
+              return retryRef;
+            } catch (retryError) {
+              this.log(
+                `\u26A0\uFE0F Retry create customer with generated email failed for ${customerRef}:`,
+                retryError instanceof Error ? retryError.message : retryError
+              );
+            }
+          }
+          const unresolvedMessage = errorMessage || "Customer already exists but could not be resolved";
+          throw new Error(
+            `Failed to resolve existing customer for ${customerRef} after conflict: ${unresolvedMessage}. Ensure the existing customer is linked to this externalRef.`
+          );
+        }
+        this.log(
+          `\u274C Failed to auto-create customer ${customerRef}:`,
+          error instanceof Error ? error.message : error
+        );
+        throw error;
+      }
+    });
+    if (backendRef !== customerRef) {
+      this.customerRefMapping.set(customerRef, backendRef);
+    }
+    return backendRef;
+  }
+  async trackUsage(customerRef, productRef, action, outcome, requestId, actionDuration) {
+    await withRetry(
+      () => this.apiClient.trackUsage({
+        customerRef,
+        actionType: "api_call",
+        units: 1,
+        outcome,
+        productRef,
+        duration: actionDuration,
+        metadata: { action: action || "api_requests", requestId },
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }),
+      {
+        maxRetries: 2,
+        initialDelay: 500,
+        shouldRetry: (error) => error.message.includes("Customer not found"),
+        onRetry: (_error, attempt) => {
+          console.warn(`\u26A0\uFE0F  Customer not found (attempt ${attempt + 1}/3), retrying in 500ms...`);
+        }
+      }
+    ).catch((error) => {
+      console.error("Usage tracking failed:", error);
+    });
+  }
+};
+
+// src/adapters/base.ts
+var EXTRA_FORWARD_KEY2 = "__solvapayExtra";
+var AdapterUtils = class {
+  /**
+   * Ensure customer reference is properly formatted
+   */
+  static ensureCustomerRef(customerRef) {
+    if (!customerRef || customerRef === "anonymous") {
+      return "anonymous";
+    }
+    return customerRef;
+  }
+  /**
+   * Extract customer ref from JWT token
+   */
+  static async extractFromJWT(token, options) {
+    try {
+      const { jwtVerify } = await import("jose");
+      const jwtSecret = new TextEncoder().encode(
+        options?.secret || process.env.OAUTH_JWKS_SECRET || "test-jwt-secret"
+      );
+      const { payload } = await jwtVerify(token, jwtSecret, {
+        issuer: options?.issuer || process.env.OAUTH_ISSUER || "http://localhost:3000",
+        audience: options?.audience || process.env.OAUTH_CLIENT_ID || "test-client-id"
+      });
+      return payload.sub || null;
+    } catch {
+      return null;
+    }
+  }
+};
+async function createAdapterHandler(adapter, paywall, metadata, businessLogic) {
+  const backendRefCache = /* @__PURE__ */ new Map();
+  return async (context, extra) => {
+    let args;
+    let customerRef;
+    try {
+      args = await adapter.extractArgs(context);
+      customerRef = await adapter.getCustomerRef(context, extra);
+      let backendRef = backendRefCache.get(customerRef);
+      if (!backendRef) {
+        backendRef = await paywall.ensureCustomer(customerRef, customerRef);
+        backendRefCache.set(customerRef, backendRef);
+      }
+      args.auth = { customer_ref: backendRef };
+    } catch (error) {
+      return adapter.formatError(error, context);
+    }
+    const decideGetCustomerRef = (args2) => args2.auth?.customer_ref || "anonymous";
+    try {
+      const decision = await paywall.decide(args, metadata, decideGetCustomerRef);
+      if (decision.outcome === "gate") {
+        return adapter.formatGate(decision.gate, context);
+      }
+      if (extra !== void 0) {
+        ;
+        args[EXTRA_FORWARD_KEY2] = extra;
+      }
+      try {
+        const result = await paywall.runAllow(decision, businessLogic, metadata, args);
+        return adapter.formatResponse(result, context);
+      } finally {
+        if (EXTRA_FORWARD_KEY2 in args) {
+          delete args[EXTRA_FORWARD_KEY2];
+        }
+      }
+    } catch (error) {
+      if (error instanceof PaywallError) {
+        return adapter.formatGate(error.structuredContent, context);
+      }
+      return adapter.formatError(error, context);
+    }
+  };
+}
+
+// src/adapters/http.ts
+var HttpAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  extractArgs([req, _reply]) {
+    if (this.options.extractArgs) {
+      return this.options.extractArgs(req);
+    }
+    return {
+      ...req.body || {},
+      ...req.params || {},
+      ...req.query || {}
+    };
+  }
+  async getCustomerRef([req, _reply]) {
+    if (this.options.getCustomerRef) {
+      const ref = await this.options.getCustomerRef(req);
+      return AdapterUtils.ensureCustomerRef(ref);
+    }
+    const headerRef = req.headers?.["x-customer-ref"];
+    if (headerRef) {
+      return AdapterUtils.ensureCustomerRef(headerRef);
+    }
+    const authHeader = req.headers?.["authorization"];
+    if (authHeader && authHeader.startsWith("Bearer ")) {
+      const token = authHeader.substring(7);
+      const jwtSub = await AdapterUtils.extractFromJWT(token);
+      if (jwtSub) {
+        return AdapterUtils.ensureCustomerRef(jwtSub);
+      }
+    }
+    return "anonymous";
+  }
+  formatResponse(result, [_req, reply]) {
+    if (this.options.transformResponse) {
+      return this.options.transformResponse(result, reply);
+    }
+    if (reply && reply.status && typeof reply.json === "function") {
+      reply.json(result);
+      return;
+    }
+    return result;
+  }
+  /**
+   * Emit a 402 Payment Required response with the same JSON body shape
+   * REST consumers have always received (`{success:false, error, product,
+   * checkoutUrl, message, ...}`). The shape is reused via
+   * `paywallErrorToClientPayload` so HTTP / Next / hosted-proxy clients
+   * don't have to branch on an SDK version.
+   */
+  formatGate(gate, [_req, reply]) {
+    const errorResponse2 = paywallErrorToClientPayload(new PaywallError(gate.message, gate));
+    if (reply && reply.status && typeof reply.json === "function") {
+      reply.status(402).json(errorResponse2);
+      return;
+    }
+    if (reply && reply.code) {
+      reply.code(402);
+    }
+    return errorResponse2;
+  }
+  formatError(error, [_req, reply]) {
+    const errorResponse2 = {
+      success: false,
+      error: error instanceof Error ? error.message : "Internal server error"
+    };
+    if (reply && reply.status && typeof reply.json === "function") {
+      reply.status(500).json(errorResponse2);
+      return;
+    }
+    if (reply && reply.code) {
+      reply.code(500);
+    }
+    return errorResponse2;
+  }
+};
+
+// src/adapters/next.ts
+var NextAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async extractArgs([request, context]) {
+    if (this.options.extractArgs) {
+      return await this.options.extractArgs(request, context);
+    }
+    const url = new URL(request.url);
+    const query = Object.fromEntries(url.searchParams.entries());
+    let body = {};
+    try {
+      if (request.method !== "GET" && request.headers.get("content-type")?.includes("application/json")) {
+        body = await request.json();
+      }
+    } catch {
+    }
+    let routeParams = {};
+    if (context?.params) {
+      if (typeof context.params === "object" && "then" in context.params) {
+        routeParams = await context.params;
+      } else {
+        routeParams = context.params;
+      }
+    }
+    return {
+      ...body,
+      ...query,
+      ...routeParams
+    };
+  }
+  async getCustomerRef([request]) {
+    if (this.options.getCustomerRef) {
+      const ref = await this.options.getCustomerRef(request);
+      return AdapterUtils.ensureCustomerRef(ref);
+    }
+    const authHeader = request.headers.get("authorization");
+    if (authHeader && authHeader.startsWith("Bearer ")) {
+      const token = authHeader.substring(7);
+      const jwtSub = await AdapterUtils.extractFromJWT(token);
+      if (jwtSub) {
+        return AdapterUtils.ensureCustomerRef(jwtSub);
+      }
+    }
+    const userId = request.headers.get("x-user-id");
+    if (userId) {
+      return AdapterUtils.ensureCustomerRef(userId);
+    }
+    const headerRef = request.headers.get("x-customer-ref");
+    if (headerRef) {
+      return AdapterUtils.ensureCustomerRef(headerRef);
+    }
+    return "demo_user";
+  }
+  formatResponse(result, _context) {
+    const transformed = this.options.transformResponse ? this.options.transformResponse(result) : result;
+    return new Response(JSON.stringify(transformed), {
+      status: 200,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  /**
+   * Emit a 402 Payment Required `Response` with the same JSON body
+   * REST consumers have always received. Reuses
+   * `paywallErrorToClientPayload` so HTTP / Next / hosted-proxy
+   * clients don't have to branch on an SDK version.
+   */
+  formatGate(gate, _context) {
+    return new Response(
+      JSON.stringify(paywallErrorToClientPayload(new PaywallError(gate.message, gate))),
+      {
+        status: 402,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+  formatError(error, _context) {
+    return new Response(
+      JSON.stringify({
+        success: false,
+        error: error instanceof Error ? error.message : "Internal server error"
+      }),
+      {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+};
+
+// src/adapters/mcp.ts
+var McpAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  extractArgs(args) {
+    return args;
+  }
+  async getCustomerRef(args, extra) {
+    if (this.options.getCustomerRef) {
+      const ref = await this.options.getCustomerRef(args, extra);
+      return AdapterUtils.ensureCustomerRef(ref);
+    }
+    const customerRefFromExtra = typeof extra?.authInfo?.extra?.customer_ref === "string" ? String(extra.authInfo.extra.customer_ref) : void 0;
+    const customerRefFromArgs = typeof args.auth === "object" && args.auth !== null && typeof args.auth.customer_ref === "string" ? String(args.auth.customer_ref) : void 0;
+    const directCustomerRef = typeof args.customer_ref === "string" ? args.customer_ref : void 0;
+    const customerRef = (customerRefFromExtra || customerRefFromArgs || directCustomerRef || "anonymous").trim();
+    return AdapterUtils.ensureCustomerRef(customerRef);
+  }
+  formatResponse(result, _context) {
+    const transformed = this.options.transformResponse ? this.options.transformResponse(result) : result;
+    const response = {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(transformed, null, 2)
+        }
+      ]
+    };
+    if (transformed && typeof transformed === "object" && !Array.isArray(transformed)) {
+      response.structuredContent = transformed;
+    }
+    return response;
+  }
+  /**
+   * Emit a plain-narration paywall response — `content[0].text` carries
+   * the gate's human message (LLM-actionable), `structuredContent`
+   * carries the machine-readable gate payload, and `isError` stays
+   * `false` per the MCP spec's own `isError` definition (paywall is
+   * not a self-correctable tool execution error; it is a user-facing
+   * control transfer to the UI).
+   *
+   * Hosts that read widget metadata from `tools/list` or tool-result
+   * `_meta.ui` open the paywall iframe on top of this response;
+   * `buildPayableHandler` stamps the `_meta.ui.resourceUri` envelope
+   * before returning.
+   */
+  formatGate(gate, _context) {
+    return {
+      content: [{ type: "text", text: gate.message }],
+      isError: false,
+      structuredContent: gate
+    };
+  }
+  formatError(error, _context) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            {
+              success: false,
+              error: error instanceof Error ? error.message : "Unknown error occurred"
+            },
+            null,
+            2
+          )
+        }
+      ],
+      isError: true
+    };
+  }
+};
+
+// src/factory.ts
+var import_core3 = require("@solvapay/core");
+
+// src/virtual-tools.ts
+var TOOL_GET_USER_INFO = {
+  name: "get_user_info",
+  description: "Get information about the current user and their purchase status for this MCP server. Returns user profile (reference, name, email) and active purchase details including product name, type, dates, and usage limit if applicable.",
+  inputSchema: {
+    type: "object",
+    properties: {},
+    required: []
+  }
+};
+var TOOL_UPGRADE = {
+  name: "upgrade",
+  description: "Get available pricing options and checkout URLs for upgrading. Returns a list of available pricing options with their details (price, features) and checkout URLs. Users can click on a checkout URL to purchase. If a specific planRef is provided, returns only the checkout URL for that pricing option.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      planRef: {
+        type: "string",
+        description: 'Optional pricing reference (e.g., "pln_abc123") to get a checkout URL for a specific option. If not provided, returns all available pricing options with their checkout URLs.'
+      }
+    },
+    required: []
+  }
+};
+var TOOL_MANAGE_ACCOUNT = {
+  name: "manage_account",
+  description: "Get a URL to the customer portal where users can view and manage their account. The portal shows current account status, billing history, and allows subscription changes. Returns a secure, time-limited URL that the user can click to access their account management page.",
+  inputSchema: {
+    type: "object",
+    properties: {},
+    required: []
+  }
+};
+function mcpTextResult(text) {
+  return { content: [{ type: "text", text }] };
+}
+function mcpErrorResult(message) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: message }) }], isError: true };
+}
+function createGetUserInfoHandler(apiClient, productRef, getCustomerRef) {
+  return async (args, extra) => {
+    const customerRef = getCustomerRef(args, extra);
+    try {
+      if (!apiClient.getUserInfo) {
+        return mcpErrorResult("getUserInfo is not available on this API client");
+      }
+      const userInfo = await apiClient.getUserInfo({ customerRef, productRef });
+      return mcpTextResult(JSON.stringify(userInfo, null, 2));
+    } catch (error) {
+      return mcpErrorResult(
+        `Failed to retrieve user information: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  };
+}
+function createUpgradeHandler(apiClient, productRef, getCustomerRef) {
+  return async (args, extra) => {
+    const customerRef = getCustomerRef(args, extra);
+    const planRef = typeof args.planRef === "string" ? args.planRef : void 0;
+    try {
+      const result = await apiClient.createCheckoutSession({
+        customerRef,
+        productRef,
+        ...planRef && { planRef }
+      });
+      const checkoutUrl = result.checkoutUrl;
+      if (planRef) {
+        const responseText2 = `## Upgrade
+
+**[Click here to upgrade \u2192](${checkoutUrl})**
+
+After completing the checkout, your purchase will be activated immediately.`;
+        return mcpTextResult(responseText2);
+      }
+      const responseText = `## Upgrade Your Subscription
+
+**[Click here to view pricing options and upgrade \u2192](${checkoutUrl})**
+
+You'll be able to compare options and select the one that's right for you.`;
+      return mcpTextResult(responseText);
+    } catch (error) {
+      return mcpErrorResult(
+        `Failed to create checkout session: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  };
+}
+function createManageAccountHandler(apiClient, productRef, getCustomerRef) {
+  return async (args, extra) => {
+    const customerRef = getCustomerRef(args, extra);
+    try {
+      const session = await apiClient.createCustomerSession({ customerRef, productRef });
+      const portalUrl = session.customerUrl;
+      const responseText = `## Manage Your Account
+
+Access your account management portal to:
+- View your current account status
+- See billing history and invoices
+- Update payment methods
+- Cancel or modify your subscription
+
+**[Open Account Portal \u2192](${portalUrl})**
+
+This link is secure and will expire after a short period.`;
+      return mcpTextResult(responseText);
+    } catch (error) {
+      return mcpErrorResult(
+        `Failed to create customer portal session: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+    }
+  };
+}
+function createVirtualTools(apiClient, options) {
+  const { product, getCustomerRef, exclude = [] } = options;
+  const excludeSet = new Set(exclude);
+  const allTools = [
+    {
+      ...TOOL_GET_USER_INFO,
+      handler: createGetUserInfoHandler(apiClient, product, getCustomerRef)
+    },
+    {
+      ...TOOL_UPGRADE,
+      handler: createUpgradeHandler(apiClient, product, getCustomerRef)
+    },
+    {
+      ...TOOL_MANAGE_ACCOUNT,
+      handler: createManageAccountHandler(apiClient, product, getCustomerRef)
+    }
+  ];
+  return allTools.filter((t) => !excludeSet.has(t.name));
+}
+
+// src/register-virtual-tools-mcp.ts
+var import_node_module = require("module");
+function getNodeRequire() {
+  try {
+    return (0, eval)("require");
+  } catch {
+    return (0, import_node_module.createRequire)(`${process.cwd()}/package.json`);
+  }
+}
+var nodeRequire = getNodeRequire();
+function getZod() {
+  try {
+    const zodModule = nodeRequire("zod");
+    return zodModule.z ?? zodModule;
+  } catch {
+    throw new Error(
+      "zod is required to use registerVirtualToolsMcp(). Install it as a dependency in your MCP server project."
+    );
+  }
+}
+function isJsonSchemaObject(value) {
+  return Boolean(value && typeof value === "object");
+}
+function toZodSchema(property) {
+  const z = getZod();
+  if (Array.isArray(property.enum) && property.enum.length > 0) {
+    if (property.enum.every((value) => typeof value === "string")) {
+      const [first, ...rest] = property.enum;
+      return z.enum([first, ...rest]);
+    }
+    if (property.enum.length === 1) {
+      return z.literal(property.enum[0]);
+    }
+    return z.union(property.enum.map((value) => z.literal(value)));
+  }
+  switch (property.type) {
+    case "string":
+      return z.string();
+    case "number":
+      return z.number();
+    case "integer":
+      return z.number().int();
+    case "boolean":
+      return z.boolean();
+    case "array":
+      return z.array(
+        isJsonSchemaObject(property.items) ? toZodSchema(property.items) : z.any()
+      );
+    case "object":
+      return z.object(jsonSchemaToZodRawShape(property.properties || {}));
+    default:
+      return z.any();
+  }
+}
+function jsonSchemaToZodRawShape(properties, required = []) {
+  const requiredSet = new Set(required);
+  return Object.fromEntries(
+    Object.entries(properties).map(([name, property]) => {
+      const schema = toZodSchema(property);
+      const finalSchema = requiredSet.has(name) ? schema : schema.optional();
+      return [name, finalSchema];
+    })
+  );
+}
+function defaultGetCustomerRef(_args, extra) {
+  const fromExtra = extra?.authInfo?.extra?.customer_ref;
+  return typeof fromExtra === "string" && fromExtra.trim() ? fromExtra.trim() : "anonymous";
+}
+function registerVirtualToolsMcpImpl(server, apiClient, options) {
+  const { filter, mapDefinition, wrapHandler, getCustomerRef, ...virtualToolsOptions } = options;
+  const virtualTools = createVirtualTools(apiClient, {
+    ...virtualToolsOptions,
+    getCustomerRef: getCustomerRef || defaultGetCustomerRef
+  });
+  for (const toolDefinition of virtualTools) {
+    if (filter && !filter(toolDefinition)) continue;
+    const mappedDefinition = mapDefinition ? mapDefinition(toolDefinition) : toolDefinition;
+    const wrappedHandler = wrapHandler ? wrapHandler(mappedDefinition.handler, mappedDefinition) : mappedDefinition.handler;
+    server.registerTool(
+      mappedDefinition.name,
+      {
+        description: mappedDefinition.description,
+        inputSchema: jsonSchemaToZodRawShape(
+          mappedDefinition.inputSchema.properties,
+          mappedDefinition.inputSchema.required || []
+        )
+      },
+      wrappedHandler
+    );
+  }
+}
+
+// src/factory.ts
+function createSolvaPay(config) {
+  let resolvedConfig;
+  if (!config) {
+    const envConfig = (0, import_core3.getSolvaPayConfig)();
+    resolvedConfig = {
+      apiKey: envConfig.apiKey,
+      apiBaseUrl: envConfig.apiBaseUrl
+    };
+  } else {
+    resolvedConfig = config;
+  }
+  const apiClient = resolvedConfig.apiClient || createSolvaPayClient({
+    apiKey: resolvedConfig.apiKey,
+    apiBaseUrl: resolvedConfig.apiBaseUrl
+  });
+  const paywall = new SolvaPayPaywall(apiClient, {
+    debug: process.env.SOLVAPAY_DEBUG !== "false",
+    limitsCacheTTL: resolvedConfig.limitsCacheTTL
+  });
+  return {
+    // Direct access to API client for advanced operations
+    apiClient,
+    // Common API methods exposed directly for convenience
+    ensureCustomer(customerRef, externalRef, options) {
+      return paywall.ensureCustomer(customerRef, externalRef, options);
+    },
+    createPaymentIntent(params) {
+      if (!apiClient.createPaymentIntent) {
+        throw new import_core3.SolvaPayError("createPaymentIntent is not available on this API client");
+      }
+      return apiClient.createPaymentIntent(params);
+    },
+    createTopupPaymentIntent(params) {
+      if (!apiClient.createTopupPaymentIntent) {
+        throw new import_core3.SolvaPayError("createTopupPaymentIntent is not available on this API client");
+      }
+      return apiClient.createTopupPaymentIntent(params);
+    },
+    processPaymentIntent(params) {
+      if (!apiClient.processPaymentIntent) {
+        throw new import_core3.SolvaPayError("processPaymentIntent is not available on this API client");
+      }
+      return apiClient.processPaymentIntent(params);
+    },
+    checkLimits(params) {
+      return apiClient.checkLimits(params);
+    },
+    trackUsage(params) {
+      return apiClient.trackUsage(params);
+    },
+    createCustomer(params) {
+      if (!apiClient.createCustomer) {
+        throw new import_core3.SolvaPayError("createCustomer is not available on this API client");
+      }
+      return apiClient.createCustomer({ ...params, metadata: params.metadata ?? {} });
+    },
+    getCustomer(params) {
+      return apiClient.getCustomer(params);
+    },
+    getCustomerBalance(params) {
+      if (!apiClient.getCustomerBalance) {
+        throw new import_core3.SolvaPayError("getCustomerBalance is not available on this API client");
+      }
+      return apiClient.getCustomerBalance(params);
+    },
+    createCheckoutSession(params) {
+      return apiClient.createCheckoutSession({
+        customerRef: params.customerRef,
+        productRef: params.productRef,
+        planRef: params.planRef
+      });
+    },
+    createCustomerSession(params) {
+      return apiClient.createCustomerSession(params);
+    },
+    activatePlan(params) {
+      if (!apiClient.activatePlan) {
+        throw new import_core3.SolvaPayError("activatePlan is not available on this API client");
+      }
+      return apiClient.activatePlan(params);
+    },
+    bootstrapMcpProduct(params) {
+      if (!apiClient.bootstrapMcpProduct) {
+        throw new import_core3.SolvaPayError("bootstrapMcpProduct is not available on this API client");
+      }
+      return apiClient.bootstrapMcpProduct(params);
+    },
+    configureMcpPlans(productRef, params) {
+      if (!apiClient.configureMcpPlans) {
+        throw new import_core3.SolvaPayError("configureMcpPlans is not available on this API client");
+      }
+      return apiClient.configureMcpPlans(productRef, params);
+    },
+    getVirtualTools(options) {
+      return createVirtualTools(apiClient, options);
+    },
+    async registerVirtualToolsMcp(server, options) {
+      await registerVirtualToolsMcpImpl(server, apiClient, options);
+    },
+    // Payable API for framework-specific handlers
+    payable(options = {}) {
+      const product = options.productRef || options.product || process.env.SOLVAPAY_PRODUCT || "default-product";
+      const usageType = options.usageType || "requests";
+      const metadata = { product, usageType };
+      return {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        http(businessLogic, adapterOptions) {
+          const adapter = new HttpAdapter({
+            ...adapterOptions,
+            getCustomerRef: adapterOptions?.getCustomerRef || options.getCustomerRef
+          });
+          const handlerPromise = createAdapterHandler(adapter, paywall, metadata, businessLogic);
+          return async (req, reply) => {
+            const handler = await handlerPromise;
+            return handler([req, reply]);
+          };
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        next(businessLogic, adapterOptions) {
+          const adapter = new NextAdapter({
+            ...adapterOptions,
+            getCustomerRef: adapterOptions?.getCustomerRef || options.getCustomerRef
+          });
+          const handlerPromise = createAdapterHandler(adapter, paywall, metadata, businessLogic);
+          return async (request, context) => {
+            const handler = await handlerPromise;
+            return handler([request, context]);
+          };
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        mcp(businessLogic, adapterOptions) {
+          const adapter = new McpAdapter({
+            ...adapterOptions,
+            getCustomerRef: adapterOptions?.getCustomerRef || options.getCustomerRef
+          });
+          const handlerPromise = createAdapterHandler(adapter, paywall, metadata, businessLogic);
+          return async (args, extra) => {
+            const handler = await handlerPromise;
+            return handler(args, extra);
+          };
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        async function(businessLogic) {
+          const getCustomerRef = (args) => {
+            const configuredRef = options.getCustomerRef?.(args);
+            if (typeof configuredRef === "string") {
+              return configuredRef;
+            }
+            return args.auth?.customer_ref || "anonymous";
+          };
+          return paywall.protect(businessLogic, metadata, getCustomerRef);
+        }
+      };
+    }
+  };
+}
+
+// src/helpers/customer.ts
+async function syncCustomerCore(request, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request, {
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+      email: email || void 0,
+      name: name || void 0
+    });
+    return customerRef;
+  } catch (error) {
+    return handleRouteError(error, "Sync customer", "Failed to sync customer");
+  }
+}
+async function getCustomerBalanceCore(request, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request);
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+      email: email || void 0,
+      name: name || void 0
+    });
+    const result = await solvaPay.getCustomerBalance({ customerRef });
+    return result;
+  } catch (error) {
+    return handleRouteError(error, "Get customer credits", "Failed to get customer credits");
+  }
+}
+
+// src/helpers/payment.ts
+async function createPaymentIntentCore(request, body, options = {}) {
+  try {
+    if (!body.planRef || !body.productRef) {
+      return {
+        error: "Missing required parameters: planRef and productRef are required",
+        status: 400
+      };
+    }
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const paymentIntent = await solvaPay.createPaymentIntent({
+      productRef: body.productRef,
+      planRef: body.planRef,
+      customerRef
+    });
+    return {
+      processorPaymentId: paymentIntent.processorPaymentId,
+      clientSecret: paymentIntent.clientSecret,
+      publishableKey: paymentIntent.publishableKey,
+      accountId: paymentIntent.accountId,
+      customerRef
+    };
+  } catch (error) {
+    return handleRouteError(error, "Create payment intent", "Payment intent creation failed");
+  }
+}
+async function createTopupPaymentIntentCore(request, body, options = {}) {
+  try {
+    if (!body.amount || body.amount <= 0) {
+      return {
+        error: "Missing or invalid amount: must be a positive number",
+        status: 400
+      };
+    }
+    if (!body.currency) {
+      return {
+        error: "Missing required parameter: currency",
+        status: 400
+      };
+    }
+    if (body.currency !== body.currency.toUpperCase()) {
+      return {
+        error: `Invalid currency "${body.currency}": must be an uppercase ISO 4217 code (e.g. "USD", "EUR")`,
+        status: 400
+      };
+    }
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const paymentIntent = await solvaPay.createTopupPaymentIntent({
+      customerRef,
+      amount: body.amount,
+      currency: body.currency,
+      description: body.description
+    });
+    return {
+      processorPaymentId: paymentIntent.processorPaymentId,
+      clientSecret: paymentIntent.clientSecret,
+      publishableKey: paymentIntent.publishableKey,
+      accountId: paymentIntent.accountId,
+      customerRef
+    };
+  } catch (error) {
+    return handleRouteError(
+      error,
+      "Create topup payment intent",
+      "Topup payment intent creation failed"
+    );
+  }
+}
+async function processPaymentIntentCore(request, body, options = {}) {
+  try {
+    if (!body.paymentIntentId || !body.productRef) {
+      return {
+        error: "paymentIntentId and productRef are required",
+        status: 400
+      };
+    }
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const result = await solvaPay.processPaymentIntent({
+      paymentIntentId: body.paymentIntentId,
+      productRef: body.productRef,
+      customerRef,
+      planRef: body.planRef
+    });
+    return result;
+  } catch (error) {
+    return handleRouteError(error, "Process payment intent", "Payment processing failed");
+  }
+}
+
+// src/helpers/checkout.ts
+async function createCheckoutSessionCore(request, body, options = {}) {
+  try {
+    if (!body.productRef) {
+      return {
+        error: "Missing required parameter: productRef is required",
+        status: 400
+      };
+    }
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    let returnUrl = body.returnUrl || options.returnUrl;
+    if (!returnUrl) {
+      try {
+        const url = new URL(request.url);
+        returnUrl = url.origin;
+      } catch {
+      }
+    }
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const session = await solvaPay.createCheckoutSession({
+      productRef: body.productRef,
+      customerRef,
+      planRef: body.planRef || void 0,
+      returnUrl
+    });
+    return {
+      sessionId: session.sessionId,
+      checkoutUrl: session.checkoutUrl
+    };
+  } catch (error) {
+    return handleRouteError(error, "Create checkout session", "Checkout session creation failed");
+  }
+}
+async function createCustomerSessionCore(request, options = {}) {
+  try {
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const session = await solvaPay.createCustomerSession({
+      customerRef
+    });
+    return session;
+  } catch (error) {
+    return handleRouteError(error, "Create customer session", "Customer session creation failed");
+  }
+}
+
+// src/helpers/renewal.ts
+var import_core4 = require("@solvapay/core");
+async function cancelPurchaseCore(request, body, options = {}) {
+  try {
+    if (!body.purchaseRef) {
+      return {
+        error: "Missing required parameter: purchaseRef is required",
+        status: 400
+      };
+    }
+    const solvaPay = options.solvaPay || createSolvaPay();
+    if (!solvaPay.apiClient.cancelPurchase) {
+      return {
+        error: "Cancel purchase method not available on SDK client",
+        status: 500
+      };
+    }
+    let cancelledPurchase = await solvaPay.apiClient.cancelPurchase({
+      purchaseRef: body.purchaseRef,
+      reason: body.reason
+    });
+    if (!cancelledPurchase || typeof cancelledPurchase !== "object") {
+      return {
+        error: "Invalid response from cancel purchase endpoint",
+        status: 500
+      };
+    }
+    const responseObj = cancelledPurchase;
+    if (responseObj.purchase && typeof responseObj.purchase === "object") {
+      cancelledPurchase = responseObj.purchase;
+    }
+    if (!cancelledPurchase.reference) {
+      return {
+        error: "Cancel purchase response missing required fields",
+        status: 500
+      };
+    }
+    const isCancelled = cancelledPurchase.status === "cancelled" || cancelledPurchase.cancelledAt;
+    if (!isCancelled) {
+      return {
+        error: `Purchase cancellation failed: backend returned status '${cancelledPurchase.status}' without cancelledAt timestamp`,
+        status: 500
+      };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    return cancelledPurchase;
+  } catch (error) {
+    if (error instanceof import_core4.SolvaPayError) {
+      const errorMessage = error.message;
+      if (errorMessage.includes("not found")) {
+        return {
+          error: "Purchase not found",
+          status: 404,
+          details: errorMessage
+        };
+      }
+      if (errorMessage.includes("cannot be cancelled") || errorMessage.includes("does not belong to provider")) {
+        return {
+          error: "Purchase cannot be cancelled or does not belong to provider",
+          status: 400,
+          details: errorMessage
+        };
+      }
+      return {
+        error: errorMessage,
+        status: 500,
+        details: errorMessage
+      };
+    }
+    return handleRouteError(error, "Cancel purchase", "Failed to cancel purchase");
+  }
+}
+async function reactivatePurchaseCore(request, body, options = {}) {
+  try {
+    if (!body.purchaseRef) {
+      return {
+        error: "Missing required parameter: purchaseRef is required",
+        status: 400
+      };
+    }
+    const solvaPay = options.solvaPay || createSolvaPay();
+    if (!solvaPay.apiClient.reactivatePurchase) {
+      return {
+        error: "Reactivate purchase method not available on SDK client",
+        status: 500
+      };
+    }
+    let reactivatedPurchase = await solvaPay.apiClient.reactivatePurchase({
+      purchaseRef: body.purchaseRef
+    });
+    if (!reactivatedPurchase || typeof reactivatedPurchase !== "object") {
+      return {
+        error: "Invalid response from reactivate purchase endpoint",
+        status: 500
+      };
+    }
+    const responseObj = reactivatedPurchase;
+    if (responseObj.purchase && typeof responseObj.purchase === "object") {
+      reactivatedPurchase = responseObj.purchase;
+    }
+    if (!reactivatedPurchase.reference) {
+      return {
+        error: "Reactivate purchase response missing required fields",
+        status: 500
+      };
+    }
+    if (reactivatedPurchase.cancelledAt) {
+      return {
+        error: `Purchase reactivation failed: cancelledAt is still set`,
+        status: 500
+      };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    return reactivatedPurchase;
+  } catch (error) {
+    if (error instanceof import_core4.SolvaPayError) {
+      const errorMessage = error.message;
+      if (errorMessage.includes("not found")) {
+        return {
+          error: "Purchase not found",
+          status: 404,
+          details: errorMessage
+        };
+      }
+      if (errorMessage.includes("cannot be reactivated") || errorMessage.includes("not pending cancellation") || errorMessage.includes("already been fully cancelled") || errorMessage.includes("already ended")) {
+        return {
+          error: "Purchase cannot be reactivated",
+          status: 400,
+          details: errorMessage
+        };
+      }
+      return {
+        error: errorMessage,
+        status: 500,
+        details: errorMessage
+      };
+    }
+    return handleRouteError(error, "Reactivate purchase", "Failed to reactivate purchase");
+  }
+}
+
+// src/helpers/activation.ts
+async function activatePlanCore(request, body, options = {}) {
+  try {
+    if (!body.productRef || !body.planRef) {
+      return {
+        error: "Missing required parameters: productRef and planRef are required",
+        status: 400
+      };
+    }
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    return await solvaPay.activatePlan({
+      customerRef,
+      productRef: body.productRef,
+      planRef: body.planRef
+    });
+  } catch (error) {
+    return handleRouteError(error, "Activate plan", "Plan activation failed");
+  }
+}
+
+// src/helpers/payment-method.ts
+async function getPaymentMethodCore(request, options = {}) {
+  try {
+    const customerResult = await syncCustomerCore(request, {
+      solvaPay: options.solvaPay,
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(customerResult)) {
+      return customerResult;
+    }
+    const customerRef = customerResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    if (!solvaPay.apiClient.getPaymentMethod) {
+      return {
+        error: "getPaymentMethod is not implemented on this API client",
+        status: 500
+      };
+    }
+    return await solvaPay.apiClient.getPaymentMethod({ customerRef });
+  } catch (error) {
+    return handleRouteError(error, "Get payment method", "Failed to load payment method");
+  }
+}
+
+// src/helpers/plans.ts
+var import_core5 = require("@solvapay/core");
+async function listPlansCore(request, options = {}) {
+  try {
+    const url = new URL(request.url);
+    const productRef = url.searchParams.get("productRef");
+    if (!productRef) {
+      return {
+        error: "Missing required parameter: productRef",
+        status: 400
+      };
+    }
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = (0, import_core5.getSolvaPayConfig)();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.listPlans) {
+      return {
+        error: "List plans method not available",
+        status: 500
+      };
+    }
+    const plans = await apiClient.listPlans(productRef);
+    return {
+      plans: plans || [],
+      productRef
+    };
+  } catch (error) {
+    return handleRouteError(error, "List plans", "Failed to fetch plans");
+  }
+}
+
+// src/helpers/merchant.ts
+var import_core6 = require("@solvapay/core");
+async function getMerchantCore(_request, options = {}) {
+  try {
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = (0, import_core6.getSolvaPayConfig)();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getMerchant) {
+      return {
+        error: "Get merchant method not available",
+        status: 500
+      };
+    }
+    const merchant = await apiClient.getMerchant();
+    return merchant;
+  } catch (error) {
+    return handleRouteError(error, "Get merchant", "Failed to fetch merchant");
+  }
+}
+
+// src/helpers/product.ts
+var import_core7 = require("@solvapay/core");
+async function getProductCore(request, options = {}) {
+  try {
+    const url = new URL(request.url);
+    const productRef = url.searchParams.get("productRef");
+    if (!productRef) {
+      return {
+        error: "Missing required parameter: productRef",
+        status: 400
+      };
+    }
+    const apiClient = options.solvaPay?.apiClient ?? (() => {
+      const config = (0, import_core7.getSolvaPayConfig)();
+      if (!config.apiKey) return null;
+      return createSolvaPayClient({
+        apiKey: config.apiKey,
+        apiBaseUrl: config.apiBaseUrl
+      });
+    })();
+    if (!apiClient) {
+      return {
+        error: "Server configuration error: SolvaPay secret key not configured",
+        status: 500
+      };
+    }
+    if (!apiClient.getProduct) {
+      return {
+        error: "Get product method not available",
+        status: 500
+      };
+    }
+    const product = await apiClient.getProduct(productRef);
+    return product;
+  } catch (error) {
+    return handleRouteError(error, "Get product", "Failed to fetch product");
+  }
+}
+
+// src/helpers/purchase.ts
+async function checkPurchaseCore(request, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request, {
+      includeEmail: options.includeEmail,
+      includeName: options.includeName
+    });
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const cachedCustomerRef = request.headers.get("x-solvapay-customer-ref");
+    if (cachedCustomerRef) {
+      try {
+        const customer = await solvaPay.getCustomer({ customerRef: cachedCustomerRef });
+        if (customer && customer.customerRef) {
+          if (customer.externalRef && customer.externalRef === userId) {
+            const filteredPurchases = (customer.purchases || []).filter(
+              (p) => p.status === "active"
+            );
+            return {
+              customerRef: customer.customerRef,
+              email: customer.email,
+              name: customer.name,
+              purchases: filteredPurchases
+            };
+          }
+        }
+      } catch {
+      }
+    }
+    try {
+      const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+        email: email || void 0,
+        name: name || void 0
+      });
+      const customer = await solvaPay.getCustomer({ customerRef });
+      const filteredPurchases = (customer.purchases || []).filter((p) => p.status === "active");
+      return {
+        customerRef: customer.customerRef || userId,
+        email: customer.email,
+        name: customer.name,
+        purchases: filteredPurchases
+      };
+    } catch {
+      return {
+        customerRef: userId,
+        purchases: []
+      };
+    }
+  } catch (error) {
+    return handleRouteError(error, "Check purchase", "Failed to check purchase");
+  }
+}
+
+// src/helpers/usage.ts
+async function trackUsageCore(request, body, options = {}) {
+  try {
+    const userResult = await getAuthenticatedUserCore(request);
+    if (isErrorResult(userResult)) {
+      return userResult;
+    }
+    const { userId, email, name } = userResult;
+    const solvaPay = options.solvaPay || createSolvaPay();
+    const customerRef = await solvaPay.ensureCustomer(userId, userId, {
+      email: email || void 0,
+      name: name || void 0
+    });
+    await solvaPay.trackUsage({
+      customerRef,
+      actionType: body.actionType,
+      units: body.units,
+      productRef: body.productRef,
+      description: body.description,
+      metadata: body.metadata
+    });
+    return { success: true };
+  } catch (error) {
+    return handleRouteError(error, "Track usage", "Track usage failed");
+  }
+}
+
+// src/edge.ts
+var import_core8 = require("@solvapay/core");
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+async function verifyWebhook({
+  body,
+  signature,
+  secret
+}) {
+  const toleranceSec = 300;
+  if (!signature) throw new import_core8.SolvaPayError("Missing webhook signature");
+  const parts = signature.split(",");
+  const tPart = parts.find((p) => p.startsWith("t="));
+  const v1Part = parts.find((p) => p.startsWith("v1="));
+  if (!tPart || !v1Part) {
+    throw new import_core8.SolvaPayError("Malformed webhook signature");
+  }
+  const timestamp = parseInt(tPart.slice(2), 10);
+  const receivedHmac = v1Part.slice(3);
+  if (Number.isNaN(timestamp) || !receivedHmac) {
+    throw new import_core8.SolvaPayError("Malformed webhook signature");
+  }
+  if (toleranceSec > 0) {
+    const age = Math.abs(Math.floor(Date.now() / 1e3) - timestamp);
+    if (age > toleranceSec) {
+      throw new import_core8.SolvaPayError("Webhook signature timestamp too old");
+    }
+  }
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sigBuf = await crypto.subtle.sign("HMAC", key, enc.encode(`${timestamp}.${body}`));
+  const expectedHmac = Array.from(new Uint8Array(sigBuf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (!timingSafeEqual(expectedHmac, receivedHmac)) {
+    throw new import_core8.SolvaPayError("Invalid webhook signature");
+  }
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new import_core8.SolvaPayError("Invalid webhook payload: body is not valid JSON");
+  }
+}
+
+// src/fetch/cors.ts
+var corsConfig = { origins: ["*"] };
+function configureCors(config) {
+  corsConfig = config;
+}
+function getCorsHeaders(req) {
+  const origin = req.headers.get("Origin");
+  const headers = {
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, x-solvapay-customer-ref",
+    "Access-Control-Max-Age": "86400"
+  };
+  if (corsConfig.origins.includes("*")) {
+    headers["Access-Control-Allow-Origin"] = "*";
+  } else if (origin && corsConfig.origins.includes(origin)) {
+    headers["Access-Control-Allow-Origin"] = origin;
+    headers["Vary"] = "Origin";
+  }
+  return headers;
+}
+function handleCors(req) {
+  if (req.method !== "OPTIONS") {
+    return null;
+  }
+  const headers = getCorsHeaders(req);
+  return new Response(null, {
+    status: 204,
+    headers
+  });
+}
+
+// src/fetch/utils.ts
+function errorResponse(result, req) {
+  const corsHeaders = req ? getCorsHeaders(req) : {};
+  return new Response(
+    JSON.stringify({ error: result.error, ...result.details ? { details: result.details } : {} }),
+    {
+      status: result.status,
+      headers: {
+        "Content-Type": "application/json",
+        ...corsHeaders
+      }
+    }
+  );
+}
+function jsonResponseWithCors(data, req, status = 200) {
+  const corsHeaders = getCorsHeaders(req);
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      ...corsHeaders
+    }
+  });
+}
+
+// src/fetch/handlers.ts
+async function parseJsonBody(req) {
+  try {
+    return await req.json();
+  } catch {
+    return {};
+  }
+}
+async function checkPurchase(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await checkPurchaseCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function trackUsage(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await trackUsageCore(req, body, {});
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function createPaymentIntent(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await createPaymentIntentCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function processPayment(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await processPaymentIntentCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function createTopupPaymentIntent(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await createTopupPaymentIntentCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function customerBalance(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await getCustomerBalanceCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function cancelRenewal(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await cancelPurchaseCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function reactivateRenewal(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await reactivatePurchaseCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function activatePlan(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await activatePlanCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function getPaymentMethod(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await getPaymentMethodCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function listPlans(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await listPlansCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function syncCustomer(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await syncCustomerCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors({ customerRef: result }, req);
+}
+async function createCheckoutSession(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const body = await parseJsonBody(req);
+  const result = await createCheckoutSessionCore(req, body);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function createCustomerSession(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await createCustomerSessionCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function getMerchant(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await getMerchantCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+async function getProduct(req) {
+  const corsResponse = handleCors(req);
+  if (corsResponse) return corsResponse;
+  const result = await getProductCore(req);
+  if (isErrorResult(result)) {
+    return errorResponse(result, req);
+  }
+  return jsonResponseWithCors(result, req);
+}
+function solvapayWebhook(options) {
+  return async (req) => {
+    const secret = options.secret || (typeof process !== "undefined" ? process.env.SOLVAPAY_WEBHOOK_SECRET : void 0);
+    if (!secret) {
+      return new Response(JSON.stringify({ error: "Webhook secret not configured" }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const body = await req.text();
+    const signature = req.headers.get("sv-signature") ?? "";
+    let event;
+    try {
+      event = await verifyWebhook({ body, signature, secret });
+    } catch {
+      return new Response(JSON.stringify({ error: "Invalid webhook signature" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    try {
+      await options.onEvent(event);
+    } catch {
+      return new Response(JSON.stringify({ error: "Webhook handler failed" }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(JSON.stringify({ received: true }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" }
+    });
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  activatePlan,
+  cancelRenewal,
+  checkPurchase,
+  configureCors,
+  createCheckoutSession,
+  createCustomerSession,
+  createPaymentIntent,
+  createTopupPaymentIntent,
+  customerBalance,
+  getMerchant,
+  getPaymentMethod,
+  getProduct,
+  listPlans,
+  processPayment,
+  reactivateRenewal,
+  solvapayWebhook,
+  syncCustomer,
+  trackUsage
+});