@craigruks/x402-server-guard 0.1.0

package/dist/store-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-types.d.ts","sourceRoot":"","sources":["../src/store-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnC,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE/F,wHAAwH;AACxH,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAEzD,2HAA2H;AAC3H,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;CACpF"}

package/dist/store-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store-types.js.map

package/dist/store-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-types.js","sourceRoot":"","sources":["../src/store-types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "@craigruks/x402-server-guard",
+  "version": "0.1.0",
+  "description": "Server-side hardening middleware for x402 payment endpoints. Mitigations for settlement races, replay, cross-resource substitution, and cache leakage. Not a security guarantee.",
+  "keywords": [
+    "x402",
+    "payments",
+    "security",
+    "middleware",
+    "hardening",
+    "replay-protection",
+    "agentic-payments",
+    "web3"
+  ],
+  "license": "MIT",
+  "author": "Craig Ruks",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/craigruks/x402-server-guard.git"
+  },
+  "homepage": "https://github.com/craigruks/x402-server-guard#readme",
+  "bugs": {
+    "url": "https://github.com/craigruks/x402-server-guard/issues"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./cloudflare": {
+      "types": "./dist/cloudflare/durable-object.d.ts",
+      "default": "./dist/cloudflare/durable-object.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "SECURITY.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.cloudflare.json",
+    "version": "node scripts/sync-version.mjs && git add src/index.ts",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.cloudflare.json --noEmit",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "lint:filelength": "tsx scripts/lint-file-length.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "check": "npm run typecheck && npm run lint && npm run lint:filelength && npm run test",
+    "check:pkg": "publint --strict && attw --pack . --profile esm-only",
+    "prepublishOnly": "npm run build && npm run check:pkg",
+    "prepare": "git config core.hooksPath .githooks || true",
+    "test:coverage": "vitest run --coverage",
+    "smoke:dist": "npm run build && node scripts/smoke-dist.mjs",
+    "example": "tsx examples/secure-flow.ts",
+    "example:hono": "tsx examples/hono-server.ts"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
+    "@biomejs/biome": "2.5.3",
+    "@cloudflare/workers-types": "5.20260714.1",
+    "@types/node": "26.1.1",
+    "@vitest/coverage-v8": "4.1.10",
+    "@x402/core": "2.18.0",
+    "esbuild": "0.28.1",
+    "hono": "4.12.29",
+    "miniflare": "4.20260708.1",
+    "publint": "0.3.21",
+    "tsx": "4.23.0",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10"
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "workerd@1.20260708.1": true
+  }
+}

package/src/cache.ts

@@ -0,0 +1,48 @@
+/**
+ * Cache directives for paid responses.
+ *
+ * A shared cache (CDN or reverse proxy) keys on the URL and knows nothing about
+ * payment, so a cacheable paid 200 can be stored and served to the next caller, paid
+ * or not. The reference x402 adapters set no cache directive, leaving that door open.
+ *
+ * The mitigation is a response directive, not a decision about a nonce, so it lives
+ * here as a small pure helper the server or adapter applies to every paid response.
+ * `no-store` is load-bearing (no conforming cache stores it); `private` and `Vary` on
+ * the payment header are defense in depth.
+ */
+
+/** HTTP header directives to attach to a paid response so no cache serves it onward. */
+export interface CacheDirectives {
+  /** `Cache-Control` value. */
+  readonly cacheControl: string;
+  /** `Vary` value: the request headers a stored response must key on. */
+  readonly vary: string;
+}
+
+export interface CacheDirectivesOptions {
+  /**
+   * The request header the payment travels in, added to `Vary` so a cache that
+   * stores despite `no-store` still keys by payer. Defaults to `X-PAYMENT`.
+   */
+  readonly paymentHeader?: string;
+}
+
+/** The cache directives to attach to a paid (200) response. */
+export function paidResponseCacheDirectives(options: CacheDirectivesOptions = {}): CacheDirectives {
+  const paymentHeader = options.paymentHeader ?? "X-PAYMENT";
+  return { cacheControl: "no-store, private", vary: paymentHeader };
+}
+
+/**
+ * Whether a shared (CDN / reverse-proxy) cache may store a response with this
+ * `Cache-Control`. A conforming shared cache refuses to store a `no-store` or
+ * `private` response. Used by the caching model in the tests. A CDN in force-cache
+ * mode ignores `Cache-Control`; this models a cache that honors it.
+ */
+export function isStorableBySharedCache(cacheControl: string | undefined): boolean {
+  if (cacheControl === undefined || cacheControl === "") {
+    return true;
+  }
+  const normalized = cacheControl.toLowerCase();
+  return !normalized.includes("no-store") && !normalized.includes("private");
+}

package/src/canonical.ts

@@ -0,0 +1,40 @@
+/**
+ * Canonical keys for the nonce and the resource.
+ *
+ * The guard uses the nonce and resource strings directly as map keys. If one nonce (or
+ * resource) reaches the guard in two encodings, the two forms become two keys for one
+ * payment: the string-encoding cousin of signature malleability. `createGuard` folds
+ * these encodings by default; a caller with a case- or prefix-sensitive scope can
+ * override or opt out (see GuardOptions).
+ */
+
+import { tryCatch } from "./result.js";
+
+/**
+ * Canonicalize a payment nonce: lowercase it and drop a leading `0x`, so `0xABCD`,
+ * `0xabcd`, and `abcd` are one key. Hex case and the `0x` prefix are not part of the
+ * value (the same bytes either way), so folding them cannot merge two distinct nonces.
+ * A caller whose nonce scope is case- or prefix-sensitive should pass their own function.
+ */
+export function canonicalNonce(nonce: string): string {
+  const lower = nonce.toLowerCase();
+  return lower.startsWith("0x") ? lower.slice(2) : lower;
+}
+
+/**
+ * Canonicalize a resource key. When it is an absolute URL, return the WHATWG-URL
+ * canonical form: scheme and host case-folded, the default port dropped, and
+ * dot-segments resolved. It does NOT decode percent-encoded octets (`%41` stays
+ * `%41`, not `A`), so this is not full RFC 3986 equivalence; two RFC-equivalent paths
+ * that differ only in percent-encoding get different keys. Path, query, and fragment
+ * CASE is preserved, so `/Foo` and `/foo` stay distinct and merging cannot open a
+ * substitution hole; normalize trailing slashes and query order yourself if a resource
+ * needs it. A non-URL key (a bare path or an opaque string) is returned unchanged.
+ * Note: the URL parser's IDN/punycode output can vary with the runtime's ICU, so a
+ * persistent distributed store should pin a stable resource form rather than rely on
+ * this across engine upgrades.
+ */
+export function canonicalResource(resource: string): string {
+  const parsed = tryCatch(() => new URL(resource));
+  return parsed.ok ? parsed.value.href : resource;
+}

package/src/cloudflare/durable-object.ts

@@ -0,0 +1,128 @@
+/**
+ * Cloudflare Durable Object nonce store: atomic compare-and-set across isolates.
+ *
+ * The default in-memory store protects one process; on Workers each isolate has its
+ * own Map, so N isolates would each grant one nonce N times. This routes every nonce
+ * to its own Durable Object (`idFromName(nonce)`). A Durable Object serves one request
+ * at a time and holds delivery of other events while a storage op to the same object
+ * is in flight (input gating), so the reserve check-and-set runs atomically with no
+ * lock. That is the compare-and-set the store contract requires. See the Cloudflare
+ * store docs for the wrangler binding and deployment shape.
+ */
+import { DurableObject } from "cloudflare:workers";
+import { guardError } from "../error.js";
+import { err, ok, type Result, tryCatchAsync } from "../result.js";
+import type {
+  NonceStore,
+  ReleaseOutcome,
+  ReserveError,
+  ReserveOutcome,
+  ReserveParams,
+  StoreError,
+} from "../store-types.js";
+
+interface StoredEntry {
+  readonly resource: string;
+  readonly expiresAt: number;
+  readonly token: string;
+}
+
+const ENTRY_KEY = "entry";
+
+/**
+ * The Durable Object the guard reserves against. Bind it in wrangler and export it
+ * from your Worker entry; the adapter routes each nonce to its own instance, so the
+ * single stored entry per object is the reservation for that one nonce.
+ */
+export class NonceReservationDO extends DurableObject {
+  /** Atomic reserve: input gating serializes concurrent calls to this same object. */
+  async reserve(resource: string, expiresAt: number): Promise<ReserveOutcome> {
+    const now = nowSeconds();
+    // Refuse an already-closed window before touching storage (matches the memory store).
+    if (expiresAt <= now) {
+      return { status: "expired" };
+    }
+    const existing = await this.ctx.storage.get<StoredEntry>(ENTRY_KEY);
+    // No `await` on anything but storage between the get and the put, so input gating
+    // keeps this read-modify-write atomic against a concurrent reserve of the same nonce.
+    if (existing !== undefined && existing.expiresAt > now) {
+      return { status: "already-reserved", boundResource: existing.resource };
+    }
+    const token = crypto.randomUUID();
+    await this.ctx.storage.put<StoredEntry>(ENTRY_KEY, { resource, expiresAt, token });
+    // Evict once the window closes: past `validBefore` the nonce is unreplayable on-chain.
+    await this.ctx.storage.setAlarm(expiresAt * 1000);
+    return { status: "reserved", token };
+  }
+
+  /** Fenced release: free the nonce only for the holder of the matching token. */
+  async release(token: string): Promise<ReleaseOutcome> {
+    const entry = await this.ctx.storage.get<StoredEntry>(ENTRY_KEY);
+    if (entry === undefined || entry.token !== token) {
+      return { status: "not-held" };
+    }
+    await this.ctx.storage.deleteAll();
+    return { status: "released" };
+  }
+
+  /** Cleanup: drop the entry once its window has closed. */
+  override async alarm(): Promise<void> {
+    const entry = await this.ctx.storage.get<StoredEntry>(ENTRY_KEY);
+    if (entry !== undefined && entry.expiresAt <= nowSeconds()) {
+      await this.ctx.storage.deleteAll();
+    }
+  }
+}
+
+function nowSeconds(): number {
+  return Math.floor(Date.now() / 1000);
+}
+
+/** An opaque Durable Object id. A real `DurableObjectId` satisfies this. */
+interface NonceReservationId {
+  toString(): string;
+}
+
+/** The RPC surface the adapter calls on a {@link NonceReservationDO} stub. */
+interface NonceReservationStub {
+  reserve(resource: string, expiresAt: number): Promise<ReserveOutcome>;
+  release(token: string): Promise<ReleaseOutcome>;
+}
+
+/**
+ * The Durable Object namespace binding the adapter needs. A real
+ * `DurableObjectNamespace<NonceReservationDO>` satisfies this structurally; type your
+ * binding with that generic so the stub carries the reserve/release RPC methods.
+ */
+export interface NonceReservationNamespace {
+  idFromName(name: string): NonceReservationId;
+  get(id: NonceReservationId): NonceReservationStub;
+}
+
+/**
+ * Build a {@link NonceStore} backed by the Durable Object namespace. Pass it to
+ * `createGuard({ store })` on any multi-isolate deploy. A transport failure (the object
+ * is unreachable) becomes a `store-unavailable` value, so the guard fails closed.
+ */
+export function createDurableObjectNonceStore(namespace: NonceReservationNamespace): NonceStore {
+  const stubFor = (nonce: string): NonceReservationStub =>
+    namespace.get(namespace.idFromName(nonce));
+  return {
+    async reserve({
+      nonce,
+      resource,
+      expiresAt,
+    }: ReserveParams): Promise<Result<ReserveOutcome, ReserveError>> {
+      const outcome = await tryCatchAsync(() => stubFor(nonce).reserve(resource, expiresAt));
+      return outcome.ok
+        ? ok(outcome.value)
+        : err(guardError("store-unavailable", "durable object reserve failed", outcome.error));
+    },
+    async release(nonce: string, token: string): Promise<Result<ReleaseOutcome, StoreError>> {
+      const outcome = await tryCatchAsync(() => stubFor(nonce).release(token));
+      return outcome.ok
+        ? ok(outcome.value)
+        : err(guardError("store-unavailable", "durable object release failed", outcome.error));
+    },
+  };
+}

package/src/error.ts

@@ -0,0 +1,31 @@
+/**
+ * Typed errors: viem's error taste, adapted to errors-as-values.
+ *
+ * viem gives every failure a structured error you branch on by identity rather than by
+ * string-matching a message. We want that discipline, but viem THROWS and we carry
+ * errors as values (result.ts), so a `GuardError` is a plain typed object, not a class:
+ * it serializes, needs no `instanceof`, and drops into a discriminated union or a
+ * `Result`'s error slot. The load-bearing field is `code`, a stable branchable
+ * discriminant; `cause` preserves the original throw so wrapping never loses the chain.
+ */
+
+/** A typed error carried as a value. Branch on `code`, not on `message`. */
+export interface GuardError<Code extends string = string> {
+  /** Stable, branchable discriminant. */
+  readonly code: Code;
+  /** Human-readable detail, for logs and messages, not for control flow. */
+  readonly message: string;
+  /** The originating error, when this wraps a throw. Preserves the chain. */
+  // biome-ignore lint/plugin: a wrapped cause can be any thrown value
+  readonly cause?: unknown;
+}
+
+/** Construct a typed `GuardError`, omitting `cause` when there is none. */
+export function guardError<const Code extends string>(
+  code: Code,
+  message: string,
+  // biome-ignore lint/plugin: a wrapped cause can be any thrown value
+  cause?: unknown,
+): GuardError<Code> {
+  return cause === undefined ? { code, message } : { code, message, cause };
+}

package/src/guard.ts

@@ -0,0 +1,153 @@
+/**
+ * The guard: server-side x402 hardening as decisions, not exceptions.
+ *
+ * A merchant reserves a payment's nonce before granting the resource, so a replay, a
+ * concurrent race, or a cross-resource substitution is denied. The decision is a value
+ * (`Reservation`), never a throw, so a stray `try/catch` cannot turn a deny into an
+ * accidental grant; a store failure fails closed (denies, never grants). The attack
+ * narratives are in the docs site; this is the framework-agnostic core.
+ */
+import { canonicalNonce, canonicalResource } from "./canonical.js";
+import { type GuardError, guardError } from "./error.js";
+import {
+  createMemoryNonceStore,
+  type NonceStore,
+  type ReleaseOutcome,
+  type ReserveParams,
+  type StoreError,
+} from "./nonce-store.js";
+import { err, type Result, tryCatchAsync } from "./result.js";
+
+/** The deny reasons a reservation can carry. */
+export type GuardErrorCode =
+  | "nonce-already-reserved"
+  | "nonce-resource-mismatch"
+  | "nonce-expired"
+  | "store-unavailable"
+  | "store-at-capacity";
+
+export interface GuardOptions {
+  /** Where reserved nonces are tracked. Defaults to an in-memory store. */
+  store?: NonceStore;
+  /**
+   * Fold a nonce to a canonical key before it is reserved, so two encodings of one
+   * nonce cannot become two grants. Defaults to {@link canonicalNonce}. Pass the
+   * identity `(n) => n` to opt out and key on the exact bytes.
+   */
+  canonicalizeNonce?: (nonce: string) => string;
+  /**
+   * Fold the resource to a canonical key before it is bound. Defaults to
+   * {@link canonicalResource}. Pass the identity `(r) => r` to opt out.
+   */
+  canonicalizeResource?: (resource: string) => string;
+}
+
+/**
+ * A guard decision: reserved (grant may proceed) or denied with a typed reason.
+ *
+ * The reserved handle carries `release`, to free the nonce if the payment does not go
+ * through so the payer can retry the same authorization. The fencing token that
+ * authorizes the release is held inside the handle, never exposed. Not calling
+ * `release` is safe: the reservation expires with the authorization.
+ */
+export type Reservation =
+  | { readonly reserved: true; release(): Promise<Result<ReleaseOutcome, StoreError>> }
+  | { readonly reserved: false; readonly reason: GuardError<GuardErrorCode> };
+
+export interface Guard {
+  /**
+   * Reserve a payment's nonce before granting. The first caller for a nonce is
+   * reserved; any later caller (replay or concurrent race) is denied. A store
+   * failure denies (fail closed).
+   */
+  reserve(params: ReserveParams): Promise<Reservation>;
+}
+
+/** Create a guard backed by an in-memory nonce store (or a supplied one). */
+export function createGuard(options: GuardOptions = {}): Guard {
+  const store = options.store ?? createMemoryNonceStore();
+  const canonicalizeNonce = options.canonicalizeNonce ?? canonicalNonce;
+  const canonicalizeResource = options.canonicalizeResource ?? canonicalResource;
+  return {
+    async reserve(params: ReserveParams): Promise<Reservation> {
+      // Fold both keys to canonical form up front; everything below keys on the
+      // canonical values (see canonical.ts for why two encodings must not split).
+      const nonce = canonicalizeNonce(params.nonce);
+      const resource = canonicalizeResource(params.resource);
+      const result = await callStore(() =>
+        store.reserve({ nonce, resource, expiresAt: params.expiresAt }),
+      );
+      if (!result.ok) {
+        // callStore already mapped throws to store-unavailable; surface a known store
+        // code as-is, but collapse an unrecognized one (a misbehaving adapter) to
+        // store-unavailable so it still fails closed.
+        const error = result.error;
+        const reason =
+          error.code === "store-at-capacity" || error.code === "store-unavailable"
+            ? error
+            : guardError("store-unavailable", "nonce store unavailable", error);
+        return { reserved: false, reason };
+      }
+      switch (result.value.status) {
+        case "reserved": {
+          const { token } = result.value;
+          return { reserved: true, release: () => releaseReservation(store, nonce, token) };
+        }
+        case "already-reserved":
+          // Nonce taken. If first bound to a DIFFERENT resource this is a
+          // cross-resource substitution, not a replay: report it distinctly. Both
+          // sides are canonical keys (boundResource was stored canonical).
+          if (result.value.boundResource !== resource) {
+            return {
+              reserved: false,
+              reason: guardError(
+                "nonce-resource-mismatch",
+                "payment nonce is bound to a different resource",
+              ),
+            };
+          }
+          return {
+            reserved: false,
+            reason: guardError("nonce-already-reserved", "payment nonce is already reserved"),
+          };
+        case "expired":
+          return {
+            reserved: false,
+            reason: guardError("nonce-expired", "payment authorization has expired"),
+          };
+        default:
+          // Defensive: an off-contract status fails closed here rather than falling
+          // through to an undefined return (a throw).
+          return {
+            reserved: false,
+            reason: guardError("store-unavailable", "nonce store returned an unknown status"),
+          };
+      }
+    },
+  };
+}
+
+/**
+ * Run a store op with the fail-closed guarantee in one place: a store that THROWS or
+ * REJECTS becomes a `store-unavailable` value rather than an uncaught rejection, so
+ * fail-closed does not depend on each adapter author. A returned error value is passed
+ * through for the caller to map.
+ */
+async function callStore<T, E extends GuardError>(
+  op: () => Promise<Result<T, E>>,
+): Promise<Result<T, E | StoreError>> {
+  const outcome = await tryCatchAsync(op);
+  if (!outcome.ok) {
+    return err(guardError("store-unavailable", "nonce store unavailable", outcome.error));
+  }
+  return outcome.value;
+}
+
+/** Release a reservation through the store, mapping a store throw to a fail-closed error. */
+function releaseReservation(
+  store: NonceStore,
+  nonce: string,
+  token: string,
+): Promise<Result<ReleaseOutcome, StoreError>> {
+  return callStore(() => store.release(nonce, token));
+}

package/src/index.ts

@@ -0,0 +1,49 @@
+/**
+ * @craigruks/x402-server-guard
+ *
+ * Server-side hardening middleware for x402 payment endpoints.
+ *
+ * SECURITY DISCLAIMER: This software is provided "AS IS", without warranty of
+ * any kind. It is NOT audited and is NOT a security guarantee. It mitigates
+ * specific, enumerated attack classes only. It cannot make an insecure payment
+ * endpoint safe on its own. See SECURITY.md for scope and reporting.
+ *
+ * Status: v0.1, in progress. The nonce reservation that stops the settlement
+ * race and payment replay is the first mitigation to land.
+ */
+
+/** Current package version (semver). */
+export const VERSION: string = "0.1.0";
+
+export {
+  type CacheDirectives,
+  type CacheDirectivesOptions,
+  isStorableBySharedCache,
+  paidResponseCacheDirectives,
+} from "./cache.js";
+export { canonicalNonce, canonicalResource } from "./canonical.js";
+export { type GuardError, guardError } from "./error.js";
+export {
+  createGuard,
+  type Guard,
+  type GuardErrorCode,
+  type GuardOptions,
+  type Reservation,
+} from "./guard.js";
+export {
+  createMemoryNonceStore,
+  type MemoryNonceStoreOptions,
+  type NonceStore,
+  type ReleaseOutcome,
+  type ReserveError,
+  type ReserveOutcome,
+  type ReserveParams,
+  type StoreError,
+} from "./nonce-store.js";
+export {
+  type ProtectDecision,
+  type ProtectDenyReason,
+  type ProtectHandlers,
+  protect,
+} from "./protect.js";
+export { err, ok, type Result, tryCatch, tryCatchAsync } from "./result.js";