# Add AddonPass paid access to this addon

You are integrating the `@addon-pass/sdk` npm package into this Stremio addon server so only paying subscribers can use it. Follow these instructions exactly. Do not invent SDK APIs; if something here disagrees with the installed package, the package wins.

## Before writing code
1. Detect the server framework from package.json: Node `http`, a Fetch-style runtime (Request in, Response out: Next.js route handlers, Hono, Workers), Express 5, or Fastify 5. The SDK is ESM-only and needs Node 22.14 or newer.
2. Install it: `pnpm add @addon-pass/sdk` (use the project's package manager).
3. Read `node_modules/@addon-pass/sdk/AGENTS.md` if it exists, then the package README and its `.d.ts` types. They describe the installed version.

## Configuration (server-side only)
- `ADDONPASS_API_URL=https://api.addonpass.com`
- `ADDONPASS_INTEGRATION_CREDENTIAL`: this addon's credential from the AddonPass dashboard (`ap_live_…` for Base, `ap_test_…` for Base Sepolia). Use a placeholder; the developer sets the real value. Never commit it, log it, or send it to a browser.
- `ADDONPASS_ALLOWED_PLAN_IDS`: comma-separated plan IDs from the addon page. Empty is fine until a paid plan exists.
- `ADDONPASS_MANAGEMENT_URL=https://addonpass.com/subscriptions`

## Wire it up
- Create one `new AddonPassVerifier({ apiBaseUrl, integrationCredential, allowedPlanIds })` per process. Split the plan IDs on commas, trim them, and drop empty entries.
- `access` is `{ addonId, addonName, managementUrl }`; reuse the manifest's `id` and `name`.
- Choose one adapter:
  - Node `http`: `createNodeStremioHandler({ access, verifier, upstream })` from `@addon-pass/sdk`.
  - Fetch runtimes: `createFetchStremioHandler({ access, verifier, upstream })` from `@addon-pass/sdk`.
  - Express 5: `app.use(createExpressStremioMiddleware({ access, verifier }))` from `@addon-pass/sdk/express`, before every Stremio route. Read the decision with `expressAddonPassAuthorization(res)`.
  - Fastify 5: `createFastifyStremioProtection({ access, verifier })` from `@addon-pass/sdk/fastify`. Register every protected route under `/addonpass/:token/…` with `preHandler: protection.preHandler`.
- Subscribers install `https://YOUR_HOST/addonpass/{token}/manifest.json`. The SDK checks the token, removes the `/addonpass/{token}` prefix, and the existing handlers see the usual `/manifest.json`, `/catalog/…`, `/meta/…`, `/stream/…`, `/player/…` and `/library/…` paths.

## Rules
- Protect manifest.json, catalog, meta and stream, plus the player and library events if the manifest declares them (SDK 0.1.10 or newer). Nothing paid may be reachable without a token: remove or protect any public Stremio `/manifest.json` and any copy of these routes on another path, port or host.
- No redirects on these paths (http to https, trailing slash, www). Serve them over HTTPS on port 443, as `application/json`, without compression on the manifest.
- Don't add your own entitlement cache, and don't log URLs that contain the token.
- Only change what this integration needs.

## AddonPass dashboard values
- Addon server URL: `https://YOUR_HOST/addonpass/`. Use the protected base path, not the site root; a website `/manifest.json` at the root fails the live check.
- Install URL template: `https://YOUR_HOST/addonpass/{token}/manifest.json`

## Verify before finishing
- Run the server and request `/addonpass/manifest.json` and `/addonpass/<random 43-character base64url>/manifest.json`. Both must return 404 (401 or 403 also pass).
- Tell the developer to set the real credential, deploy over public HTTPS, and run the live integration test in the AddonPass dashboard.
- Add this line to the repo's AGENTS.md (create it if missing, and a CLAUDE.md containing `@AGENTS.md` if the project uses Claude Code): "AddonPass protects this addon. Read node_modules/@addon-pass/sdk/AGENTS.md before changing routes, access checks or AddonPass settings."
- Summarize what you changed and which environment variables must be set.