@naulon/enforce 0.1.0

package/dist/discoverability.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Toll discoverability — let an agent learn the gate exists, and its terms,
+ * without being told out of band.
+ *
+ *   - `/.well-known/x402` serves a machine-readable manifest for the one
+ *     publisher this gate fronts: the article path prefixes, the price for a read
+ *     and a citation, the Arc/USDC network, and where to verify a license.
+ *   - A `Link: rel="payment"` header on every 402 points an agent at that manifest.
+ *
+ * The manifest is article-agnostic, so it never names author wallets — payTo is
+ * resolved per article from the credits graph at payment time (custody-free,
+ * buyer → author). It's a discovery hint, not concrete x402 PaymentRequirements:
+ * to pay, an agent GETs an article URL and reads the 402's PAYMENT-REQUIRED header.
+ *
+ * Everything here derives from the resolved `PublisherConfig` + the Arc network
+ * constants — no new per-publisher seam.
+ */
+import { type PublisherConfig, type SettlementNetwork } from "@naulon/shared";
+/** Well-known path for the toll manifest. */
+export declare const X402_MANIFEST_PATH = "/.well-known/x402";
+/** `Link` header value pointing an agent at the manifest (RFC 8288). */
+export declare const PAYMENT_LINK_HEADER = "</.well-known/x402>; rel=\"payment\"; type=\"application/json\"";
+interface PriceLeg {
+    /** Atomic USDC (6 decimals) — what the on-chain leg moves. */
+    atomic: string;
+    /** Human USDC, for display. */
+    usdc: number;
+}
+export interface X402Manifest {
+    x402Version: number;
+    /** The product's contract, machine-readable: humans read free, machines pay. */
+    humansReadFree: true;
+    resources: {
+        /** Path prefixes (no leading slash) whose articles are tolled. */
+        pathPrefixes: string[];
+        /** Toll kinds; a citation is priced up from a read. */
+        kinds: ["read", "citation"];
+        /** Header an agent sets to request the citation toll instead of a read. */
+        selectKindHeader: string;
+        note: string;
+    };
+    payment: {
+        scheme: "exact";
+        network: string;
+        chainId: number;
+        asset: string;
+        currency: "USDC";
+        maxTimeoutSeconds: number;
+        price: {
+            read: PriceLeg;
+            citation: PriceLeg & {
+                multiplier: number;
+            };
+        };
+        /** How the single on-chain recipient is chosen (wallets are never listed here). */
+        payTo: string;
+    };
+    license: {
+        jwks: string;
+        verify: string;
+        /** issuer === audience for this publisher's Citation License Tokens. */
+        identity: string;
+    };
+}
+/** Build the discovery manifest for the publisher this gate fronts. */
+export declare function buildX402Manifest(publisher: PublisherConfig, net?: SettlementNetwork): X402Manifest;
+export {};
+//# sourceMappingURL=discoverability.d.ts.map

package/dist/discoverability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoverability.d.ts","sourceRoot":"","sources":["../src/discoverability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAA+B,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE3G,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAMtD,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,oEAAoE,CAAC;AAErG,UAAU,QAAQ;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE;QACT,kEAAkE;QAClE,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,uDAAuD;QACvD,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5B,2EAA2E;QAC3E,gBAAgB,EAAE,MAAM,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,OAAO,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,QAAQ,EAAE,QAAQ,GAAG;gBAAE,UAAU,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;QACvE,mFAAmF;QACnF,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,wEAAwE;QACxE,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,EAC1B,GAAG,GAAE,iBAAmC,GACvC,YAAY,CAgCd"}

package/dist/discoverability.js

@@ -0,0 +1,62 @@
+/**
+ * Toll discoverability — let an agent learn the gate exists, and its terms,
+ * without being told out of band.
+ *
+ *   - `/.well-known/x402` serves a machine-readable manifest for the one
+ *     publisher this gate fronts: the article path prefixes, the price for a read
+ *     and a citation, the Arc/USDC network, and where to verify a license.
+ *   - A `Link: rel="payment"` header on every 402 points an agent at that manifest.
+ *
+ * The manifest is article-agnostic, so it never names author wallets — payTo is
+ * resolved per article from the credits graph at payment time (custody-free,
+ * buyer → author). It's a discovery hint, not concrete x402 PaymentRequirements:
+ * to pay, an agent GETs an article URL and reads the 402's PAYMENT-REQUIRED header.
+ *
+ * Everything here derives from the resolved `PublisherConfig` + the Arc network
+ * constants — no new per-publisher seam.
+ */
+import { activeNetwork, toAtomicUsdc } from "@naulon/shared";
+/** Well-known path for the toll manifest. */
+export const X402_MANIFEST_PATH = "/.well-known/x402";
+/** JWKS path (kept in sync with the route registered in app.ts). */
+const JWKS_PATH = "/.well-known/naulon-jwks.json";
+/** Online license verification path template. */
+const LICENSE_VERIFY_PATH = "/licenses/{jti}";
+/** `Link` header value pointing an agent at the manifest (RFC 8288). */
+export const PAYMENT_LINK_HEADER = `<${X402_MANIFEST_PATH}>; rel="payment"; type="application/json"`;
+/** Same validity window the 402 advertises (x402.ts MAX_TIMEOUT_SECONDS). */
+const MAX_TIMEOUT_SECONDS = 345_600;
+/** Build the discovery manifest for the publisher this gate fronts. */
+export function buildX402Manifest(publisher, net = activeNetwork()) {
+    const readUsdc = publisher.price;
+    const citationUsdc = readUsdc * publisher.citationMultiplier;
+    return {
+        x402Version: 2,
+        humansReadFree: true,
+        resources: {
+            pathPrefixes: publisher.articlePrefixes,
+            kinds: ["read", "citation"],
+            selectKindHeader: "X-Naulon-Kind",
+            note: "GET any article URL under a prefix to receive a 402 with concrete PaymentRequirements.",
+        },
+        payment: {
+            scheme: "exact",
+            network: net.network,
+            chainId: net.chainId,
+            asset: net.usdc,
+            currency: "USDC",
+            maxTimeoutSeconds: MAX_TIMEOUT_SECONDS,
+            price: {
+                read: { atomic: toAtomicUsdc(readUsdc), usdc: readUsdc },
+                citation: {
+                    atomic: toAtomicUsdc(citationUsdc),
+                    usdc: citationUsdc,
+                    multiplier: publisher.citationMultiplier,
+                },
+            },
+            payTo: "Resolved per article to the primary author from the publisher's credits graph; the recursive co-author split is recorded on each settled event. Custody-free: settlement is buyer → author.",
+        },
+        license: { jwks: JWKS_PATH, verify: LICENSE_VERIFY_PATH, identity: publisher.licenseIdentity },
+    };
+}
+//# sourceMappingURL=discoverability.js.map

package/dist/discoverability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoverability.js","sourceRoot":"","sources":["../src/discoverability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAgD,MAAM,gBAAgB,CAAC;AAE3G,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACtD,oEAAoE;AACpE,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,iDAAiD;AACjD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,kBAAkB,2CAA2C,CAAC;AAyCrG,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAC/B,SAA0B,EAC1B,MAAyB,aAAa,EAAE;IAExC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAe,CAAC;IAC3C,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC;IAC7D,OAAO;QACL,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE;YACT,YAAY,EAAE,SAAS,CAAC,eAAe;YACvC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC3B,gBAAgB,EAAE,eAAe;YACjC,IAAI,EAAE,wFAAwF;SAC/F;QACD,OAAO,EAAE;YACP,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,IAAI;YACf,QAAQ,EAAE,MAAM;YAChB,iBAAiB,EAAE,mBAAmB;YACtC,KAAK,EAAE;gBACL,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxD,QAAQ,EAAE;oBACR,MAAM,EAAE,YAAY,CAAC,YAAY,CAAC;oBAClC,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,SAAS,CAAC,kBAAkB;iBACzC;aACF;YACD,KAAK,EACH,6LAA6L;SAChM;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,CAAC,eAAe,EAAE;KAC/F,CAAC;AACJ,CAAC"}

package/dist/enforce/fetch-handler.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `withNaulon` — wrap any web fetch handler (Cloudflare Workers, Netlify/Deno
+ * Edge, a Hono/`itty` route, a bare `export default { fetch }`) with the toll.
+ *
+ * Unlike the Next adapter (a pre-filter that returns `next()`), a fetch handler
+ * IS the thing that produces the page — so on a pass we CALL the wrapped handler
+ * and stamp the paid-receipt headers onto its response. On a refusal (402/403) we
+ * short-circuit and never invoke the handler.
+ */
+import { type NaulonMiddlewareOptions } from "./middleware.ts";
+export declare function withNaulon(handler: (req: Request) => Promise<Response> | Response, opts: NaulonMiddlewareOptions): (req: Request) => Promise<Response>;
+//# sourceMappingURL=fetch-handler.d.ts.map

package/dist/enforce/fetch-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-handler.d.ts","sourceRoot":"","sources":["../../src/enforce/fetch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAoB,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEjF,wBAAgB,UAAU,CACxB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EACvD,IAAI,EAAE,uBAAuB,GAC5B,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAWrC"}

package/dist/enforce/fetch-handler.js

@@ -0,0 +1,25 @@
+/**
+ * `withNaulon` — wrap any web fetch handler (Cloudflare Workers, Netlify/Deno
+ * Edge, a Hono/`itty` route, a bare `export default { fetch }`) with the toll.
+ *
+ * Unlike the Next adapter (a pre-filter that returns `next()`), a fetch handler
+ * IS the thing that produces the page — so on a pass we CALL the wrapped handler
+ * and stamp the paid-receipt headers onto its response. On a refusal (402/403) we
+ * short-circuit and never invoke the handler.
+ */
+import { naulonMiddleware } from "./middleware.js";
+export function withNaulon(handler, opts) {
+    const core = naulonMiddleware(opts);
+    return async (req) => {
+        const { response, setHeaders } = await core(req);
+        if (response)
+            return response; // 402 / 403 — never reach the handler
+        const res = await handler(req);
+        if (setHeaders) {
+            for (const [k, v] of Object.entries(setHeaders))
+                res.headers.set(k, v);
+        }
+        return res;
+    };
+}
+//# sourceMappingURL=fetch-handler.js.map

package/dist/enforce/fetch-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-handler.js","sourceRoot":"","sources":["../../src/enforce/fetch-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAgC,MAAM,iBAAiB,CAAC;AAEjF,MAAM,UAAU,UAAU,CACxB,OAAuD,EACvD,IAA6B;IAE7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,CAAC,sCAAsC;QACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/enforce/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@naulon/sdk/enforce` — in-app toll enforcement.
+ *
+ * The framework-agnostic core (`naulonMiddleware`) + the pluggable `QuoteSource`.
+ * Framework adapters live alongside: the generic fetch-handler wrapper here, the
+ * Next.js adapter under `@naulon/sdk/next/middleware`.
+ */
+export * from "./quote-source.ts";
+export * from "./middleware.ts";
+export * from "./fetch-handler.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/enforce/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enforce/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/enforce/index.js

@@ -0,0 +1,11 @@
+/**
+ * `@naulon/sdk/enforce` — in-app toll enforcement.
+ *
+ * The framework-agnostic core (`naulonMiddleware`) + the pluggable `QuoteSource`.
+ * Framework adapters live alongside: the generic fetch-handler wrapper here, the
+ * Next.js adapter under `@naulon/sdk/next/middleware`.
+ */
+export * from "./quote-source.js";
+export * from "./middleware.js";
+export * from "./fetch-handler.js";
+//# sourceMappingURL=index.js.map

package/dist/enforce/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enforce/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/enforce/middleware.d.ts

@@ -0,0 +1,27 @@
+import type { QuoteSource } from "./quote-source.ts";
+export interface NaulonMiddlewareOptions {
+    /**
+     * The site's toll config in `PublisherConfig` shape — `decide()` reads
+     * `id`, `articlePrefixes` (or `gateScope`), `licenseIdentity`, `seoAllowlist`,
+     * and `crawlerPolicy` from it.
+     */
+    publisher: unknown;
+    /** Price + payees source: `localQuoteSource` (own data) or `httpQuoteSource` (cloud). */
+    quote: QuoteSource;
+    /** The hosted `POST /verify` URL (settles the presented payment, custody-free). */
+    verifyUrl: string;
+    /** The publisher's `nln_live_` key — bearer-auth to `/verify` (and the cloud quote). */
+    apiKey: string;
+    /** Injectable fetch (tests); defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock (tests); defaults to `Date.now`. */
+    now?: () => number;
+}
+export interface MiddlewareResult {
+    /** A Response to send (short-circuit), or `null` to pass to the app. */
+    response: Response | null;
+    /** Headers to attach to the app's outgoing response on a pass (paid-OK receipt). */
+    setHeaders?: Record<string, string>;
+}
+export declare function naulonMiddleware(opts: NaulonMiddlewareOptions): (req: Request) => Promise<MiddlewareResult>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/enforce/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/enforce/middleware.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,KAAK,EAAE,WAAW,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAYD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,uBAAuB,GAC5B,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAsE7C"}

package/dist/enforce/middleware.js

@@ -0,0 +1,88 @@
+/**
+ * `naulonMiddleware` — the framework-agnostic core of in-app toll enforcement.
+ *
+ * A tolled site on a per-IP rate-limiting edge (Vercel Free's 429) can't route
+ * through the fleet's single egress IP without tripping the limit. This runs the
+ * SAME `decide()` the gate runs, IN the publisher's own runtime, so the agent's
+ * own IP reaches the origin — no fleet hop, no shared-IP 429. The control plane
+ * still owns the money (hosted `/verify`) and the catalog (hosted `/quote`).
+ *
+ * The core takes a web `Request` and returns `{ response, setHeaders }`:
+ *   - `response: Response` → SEND it, short-circuit the app (402 / 403).
+ *   - `response: null` → PASS: let the app render locally. `setHeaders` (if any)
+ *     must be applied to the app's OUTGOING response — a paid-OK request renders
+ *     normally but still carries its `PAYMENT-RESPONSE` + license headers.
+ *
+ * Custody-free: the payment leg POSTs the buyer's signature to the hosted
+ * `/verify`, which settles buyer→author directly. This middleware never holds USDC.
+ */
+import { decide, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PAYMENT_LINK_HEADER, LICENSE_HEADER, } from "../decide.js";
+export function naulonMiddleware(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    const clock = opts.now ?? Date.now;
+    return async (req) => {
+        const url = new URL(req.url);
+        const d = await decide({
+            raw: req,
+            host: url.host,
+            path: url.pathname + url.search,
+            publisher: opts.publisher,
+            now: clock(),
+            quote: (publisher, slug, kind) => opts.quote.quote(publisher, slug, kind, { resource: req.url }),
+        });
+        switch (d.kind) {
+            // Human, free re-read, unknown/non-article: let the app render locally.
+            case "passthrough":
+            case "free":
+            case "reread":
+                return { response: null };
+            case "blocked":
+                return { response: new Response("This crawler is refused by the publisher.", { status: 403 }) };
+            case "payment-required":
+                return {
+                    response: new Response(null, {
+                        status: 402,
+                        headers: { [PAYMENT_REQUIRED_HEADER]: d.header, Link: PAYMENT_LINK_HEADER },
+                    }),
+                };
+            case "payment-presented": {
+                // Custody-free settlement: the buyer's signature goes to the hosted
+                // /verify, which settles buyer→author and mints the receipt.
+                let body;
+                let status;
+                try {
+                    const res = await doFetch(opts.verifyUrl, {
+                        method: "POST",
+                        headers: {
+                            authorization: `Bearer ${opts.apiKey}`,
+                            "content-type": "application/json",
+                        },
+                        body: JSON.stringify({ payment: d.payment, legs: d.legs, quote: d.quote, resource: req.url }),
+                    });
+                    status = res.status;
+                    body = (await res.json().catch(() => ({})));
+                }
+                catch {
+                    // /verify unreachable → refuse this paid attempt (fail-closed on the
+                    // payment leg: we can't confirm settlement, so we can't serve paid).
+                    return { response: new Response(JSON.stringify({ error: "verify unreachable" }), { status: 402, headers: { "content-type": "application/json" } }) };
+                }
+                if (status === 200 && body.ok) {
+                    const setHeaders = {};
+                    if (body.responseHeader)
+                        setHeaders[PAYMENT_RESPONSE_HEADER] = body.responseHeader;
+                    if (body.licenseJws)
+                        setHeaders[LICENSE_HEADER] = body.licenseJws;
+                    return { response: null, setHeaders };
+                }
+                return {
+                    response: new Response(JSON.stringify({ error: body.error ?? "payment rejected" }), {
+                        status: 402,
+                        headers: { "content-type": "application/json" },
+                    }),
+                };
+            }
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/enforce/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/enforce/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EACL,MAAM,EACN,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAuCtB,MAAM,UAAU,gBAAgB,CAC9B,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEnC,OAAO,KAAK,EAAE,GAAY,EAA6B,EAAE;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;YACrB,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAkB;YAClC,GAAG,EAAE,KAAK,EAAE;YACZ,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SACjG,CAAC,CAAC;QAEH,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,wEAAwE;YACxE,KAAK,aAAa,CAAC;YACnB,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ;gBACX,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAE5B,KAAK,SAAS;gBACZ,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAElG,KAAK,kBAAkB;gBACrB,OAAO;oBACL,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE;wBAC3B,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;qBAC5E,CAAC;iBACH,CAAC;YAEJ,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,oEAAoE;gBACpE,6DAA6D;gBAC7D,IAAI,IAAoB,CAAC;gBACzB,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;wBACxC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;4BACtC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;qBAC9F,CAAC,CAAC;oBACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;oBACpB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAmB,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;oBACrE,qEAAqE;oBACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC;gBACvJ,CAAC;gBAED,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAA2B,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,cAAc;wBAAE,UAAU,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;oBACnF,IAAI,IAAI,CAAC,UAAU;wBAAE,UAAU,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;oBAClE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC,EAAE;wBAClF,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/enforce/next.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@naulon/enforce/next` (re-exported as `@naulon/sdk/enforce/next`) — the
+ * Next.js App Router middleware adapter.
+ *
+ * Next middleware is a pre-filter: return a `Response` to short-circuit (402/403),
+ * or `NextResponse.next()` to let the route render. The one thing that needs the
+ * `next` package is `NextResponse.next()` — so we INJECT `NextResponse` rather
+ * than importing `next/server`, keeping the gate free of a hard `next` dependency
+ * (the publisher's app already has it). Everything else is the framework-agnostic
+ * core.
+ *
+ *   // middleware.ts (in the publisher's Next app)
+ *   import { NextResponse } from "next/server";
+ *   import { createNaulonMiddleware } from "@naulon/sdk/enforce/next";
+ *   export const middleware = createNaulonMiddleware({ …opts }, NextResponse);
+ *   export const config = { matcher: ["/essays/:path*"] };
+ */
+import { type NaulonMiddlewareOptions } from "./middleware.ts";
+/** The slice of `NextResponse` this adapter uses (the real class satisfies it). */
+export interface NextResponseLike {
+    next(): Response;
+}
+export declare function createNaulonMiddleware(opts: NaulonMiddlewareOptions, NextResponse: NextResponseLike): (req: Request) => Promise<Response>;
+//# sourceMappingURL=next.d.ts.map

package/dist/enforce/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/enforce/next.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAoB,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEjF,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,QAAQ,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,uBAAuB,EAC7B,YAAY,EAAE,gBAAgB,GAC7B,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAUrC"}

package/dist/enforce/next.js

@@ -0,0 +1,32 @@
+/**
+ * `@naulon/enforce/next` (re-exported as `@naulon/sdk/enforce/next`) — the
+ * Next.js App Router middleware adapter.
+ *
+ * Next middleware is a pre-filter: return a `Response` to short-circuit (402/403),
+ * or `NextResponse.next()` to let the route render. The one thing that needs the
+ * `next` package is `NextResponse.next()` — so we INJECT `NextResponse` rather
+ * than importing `next/server`, keeping the gate free of a hard `next` dependency
+ * (the publisher's app already has it). Everything else is the framework-agnostic
+ * core.
+ *
+ *   // middleware.ts (in the publisher's Next app)
+ *   import { NextResponse } from "next/server";
+ *   import { createNaulonMiddleware } from "@naulon/sdk/enforce/next";
+ *   export const middleware = createNaulonMiddleware({ …opts }, NextResponse);
+ *   export const config = { matcher: ["/essays/:path*"] };
+ */
+import { naulonMiddleware } from "./middleware.js";
+export function createNaulonMiddleware(opts, NextResponse) {
+    const core = naulonMiddleware(opts);
+    return async (req) => {
+        const { response, setHeaders } = await core(req);
+        if (response)
+            return response; // short-circuit (402 / 403)
+        // Pass to the route, carrying the paid receipt headers onto the continuation.
+        const res = NextResponse.next();
+        for (const [k, v] of Object.entries(setHeaders ?? {}))
+            res.headers.set(k, v);
+        return res;
+    };
+}
+//# sourceMappingURL=next.js.map

package/dist/enforce/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../../src/enforce/next.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,gBAAgB,EAAgC,MAAM,iBAAiB,CAAC;AAOjF,MAAM,UAAU,sBAAsB,CACpC,IAA6B,EAC7B,YAA8B;IAE9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,CAAC,4BAA4B;QAC3D,8EAA8E;QAC9E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/enforce/quote-source.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A pluggable price+payees source for the in-app middleware. `decide()` asks it
+ * for a `Quote` per gated slug; returning `null` means "no toll — serve free"
+ * (the same don't-gate signal the gate's own pricing uses).
+ *
+ * Two implementations ship:
+ *   - `localQuoteSource` — the publisher's OWN data (Phase 1a). A site that
+ *     already knows its authors/prices (e.g. a credits API) wraps that lookup.
+ *   - `httpQuoteSource` — the hosted cloud `/quote` (Phase 1b). A site with no
+ *     local catalog defers to the scraper catalog the control plane maintains.
+ *
+ * Custody-free either way: a quote carries `payTo` addresses, never a key.
+ */
+import type { Quote, TollKind } from "../decide.ts";
+/** Extra request context a source may need (the hosted source keys off the URL). */
+export interface QuoteContext {
+    /** The full resource URL being decided (what the hosted `/quote` looks up). */
+    resource: string;
+}
+export interface QuoteSource {
+    quote(publisher: unknown, slug: string, kind: TollKind, ctx: QuoteContext): Promise<Quote | null>;
+}
+/** Wrap a publisher's own price+payees lookup. `undefined`/`null` → free read. */
+export declare function localQuoteSource(fn: (publisher: unknown, slug: string, kind: TollKind) => Promise<Quote | null | undefined>): QuoteSource;
+/**
+ * Defer pricing to the hosted `GET /quote?resource=…` (nln_live_ authed). A 204
+ * means "no toll" → `null` (free). A 200 returns the `Quote`. Never a wallet key.
+ * `fetchImpl` is injectable for tests; defaults to the global `fetch`.
+ */
+export declare function httpQuoteSource(quoteUrl: string, apiKey: string, fetchImpl?: typeof fetch): QuoteSource;
+//# sourceMappingURL=quote-source.d.ts.map

package/dist/enforce/quote-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote-source.d.ts","sourceRoot":"","sources":["../../src/enforce/quote-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEpD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;CACnG;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC,GAC1F,WAAW,CAMb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC9B,WAAW,CAYb"}

package/dist/enforce/quote-source.js

@@ -0,0 +1,29 @@
+/** Wrap a publisher's own price+payees lookup. `undefined`/`null` → free read. */
+export function localQuoteSource(fn) {
+    return {
+        async quote(publisher, slug, kind) {
+            return (await fn(publisher, slug, kind)) ?? null;
+        },
+    };
+}
+/**
+ * Defer pricing to the hosted `GET /quote?resource=…` (nln_live_ authed). A 204
+ * means "no toll" → `null` (free). A 200 returns the `Quote`. Never a wallet key.
+ * `fetchImpl` is injectable for tests; defaults to the global `fetch`.
+ */
+export function httpQuoteSource(quoteUrl, apiKey, fetchImpl = fetch) {
+    return {
+        async quote(_publisher, slug, kind, ctx) {
+            // slug+kind let the cloud price directly (decide() already derived the slug);
+            // resource is carried for catalog lookups keyed on the full URL.
+            const q = new URLSearchParams({ resource: ctx.resource, slug, kind });
+            const res = await fetchImpl(`${quoteUrl}?${q}`, { headers: { authorization: `Bearer ${apiKey}` } });
+            if (res.status === 204)
+                return null; // no toll → free read
+            if (!res.ok)
+                return null; // fail-open: a quote lookup miss must never gate a reader
+            return (await res.json());
+        },
+    };
+}
+//# sourceMappingURL=quote-source.js.map

package/dist/enforce/quote-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote-source.js","sourceRoot":"","sources":["../../src/enforce/quote-source.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC9B,EAA2F;IAE3F,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI;YAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAc,EACd,YAA0B,KAAK;IAE/B,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG;YACrC,8EAA8E;YAC9E,iEAAiE;YACjE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACpG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;YAC3D,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,0DAA0D;YACpF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAU,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `@naulon/enforce` — the runtime-agnostic toll-decision kernel + the in-app
+ * enforcement middleware. The neutral low-level core that both `@naulon/tollgate`
+ * (the gate shell) and `@naulon/sdk` (the publisher SDK) sit ABOVE, with no
+ * dependency cycle. Depends only on `@naulon/shared` (+ `viem` for PoP).
+ *
+ * The Next.js middleware adapter is the separate `@naulon/enforce/next` subpath
+ * (it imports `next/server`, so it must not be pulled into the core barrel).
+ */
+export * from "./decide.ts";
+export * from "./agentDetect.ts";
+export * from "./botAuth.ts";
+export * from "./nonce.ts";
+export * from "./pop.ts";
+export { build402, buildRequirements, bindingOf, MAX_TIMEOUT_SECONDS } from "./build402.ts";
+export { quote } from "./pricing.ts";
+export { licensing, type Licensing } from "./license.ts";
+export { revocations, type RevocationStore } from "./revocation.ts";
+export { X402_MANIFEST_PATH, buildX402Manifest, type X402Manifest } from "./discoverability.ts";
+export * from "./enforce/quote-source.ts";
+export * from "./enforce/middleware.ts";
+export * from "./enforce/fetch-handler.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,cAAc,aAAa,CAAC;AAG5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AAIzB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG5F,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAGrC,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGhG,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}

package/dist/index.js

@@ -0,0 +1,31 @@
+/**
+ * `@naulon/enforce` — the runtime-agnostic toll-decision kernel + the in-app
+ * enforcement middleware. The neutral low-level core that both `@naulon/tollgate`
+ * (the gate shell) and `@naulon/sdk` (the publisher SDK) sit ABOVE, with no
+ * dependency cycle. Depends only on `@naulon/shared` (+ `viem` for PoP).
+ *
+ * The Next.js middleware adapter is the separate `@naulon/enforce/next` subpath
+ * (it imports `next/server`, so it must not be pulled into the core barrel).
+ */
+// The decision surface + its wire re-exports (PAYMENT_* headers, PaymentRequirements,
+// SettlementLegReq, PAYMENT_LINK_HEADER, Quote, TollKind).
+export * from "./decide.js";
+// Classification, Web Bot Auth, nonce replay guard, holder-of-key proof.
+export * from "./agentDetect.js";
+export * from "./botAuth.js";
+export * from "./nonce.js";
+export * from "./pop.js";
+// x402 BUILD side — the symbols `decide.ts` does NOT already re-export (avoids the
+// wildcard-merge ambiguity that would otherwise drop the shared PAYMENT_*/type names).
+export { build402, buildRequirements, bindingOf, MAX_TIMEOUT_SECONDS } from "./build402.js";
+// Pricing (the `quote` value; the `Quote` type comes through `./decide.ts`).
+export { quote } from "./pricing.js";
+// Licensing, revocation, discoverability manifest.
+export { licensing } from "./license.js";
+export { revocations } from "./revocation.js";
+export { X402_MANIFEST_PATH, buildX402Manifest } from "./discoverability.js";
+// In-app enforcement middleware (framework-agnostic). The Next adapter is `./next`.
+export * from "./enforce/quote-source.js";
+export * from "./enforce/middleware.js";
+export * from "./enforce/fetch-handler.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sFAAsF;AACtF,2DAA2D;AAC3D,cAAc,aAAa,CAAC;AAE5B,yEAAyE;AACzE,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AAEzB,mFAAmF;AACnF,uFAAuF;AACvF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE5F,6EAA6E;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,mDAAmD;AACnD,OAAO,EAAE,SAAS,EAAkB,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,WAAW,EAAwB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAqB,MAAM,sBAAsB,CAAC;AAEhG,oFAAoF;AACpF,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}

package/dist/license.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Tollgate licensing boot. Resolves the Citation License signing key once at
+ * startup (a stable key from config, or — only on the single-instance mock path —
+ * an ephemeral one with a warning) and exposes the JWK Set the gate publishes at
+ * /.well-known/naulon-jwks.json. `null` when LICENSES_ENABLED=false.
+ *
+ * Minting + the re-read entitlement (which use `licensing.key`) land in P2; P1
+ * publishes the public key so verifiers can be wired up first.
+ */
+import { type JwkSet, type SigningKey } from "@naulon/shared";
+export interface Licensing {
+    key: SigningKey;
+    jwks: JwkSet;
+}
+export declare const licensing: Licensing | null;
+//# sourceMappingURL=license.d.ts.map

package/dist/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAqC,KAAK,MAAM,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjG,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,SAAS,EAAE,SAAS,GAAG,IAK5B,CAAC"}

package/dist/license.js

@@ -0,0 +1,18 @@
+/**
+ * Tollgate licensing boot. Resolves the Citation License signing key once at
+ * startup (a stable key from config, or — only on the single-instance mock path —
+ * an ephemeral one with a warning) and exposes the JWK Set the gate publishes at
+ * /.well-known/naulon-jwks.json. `null` when LICENSES_ENABLED=false.
+ *
+ * Minting + the re-read entitlement (which use `licensing.key`) land in P2; P1
+ * publishes the public key so verifiers can be wired up first.
+ */
+import { getConfig, jwksOf, loadSigningKey } from "@naulon/shared";
+const cfg = getConfig();
+export const licensing = cfg.LICENSES_ENABLED
+    ? (() => {
+        const key = loadSigningKey(cfg.LICENSE_SIGNING_KEY);
+        return { key, jwks: jwksOf([key]) };
+    })()
+    : null;
+//# sourceMappingURL=license.js.map

package/dist/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAgC,MAAM,gBAAgB,CAAC;AAEjG,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AAOxB,MAAM,CAAC,MAAM,SAAS,GAAqB,GAAG,CAAC,gBAAgB;IAC7D,CAAC,CAAC,CAAC,GAAG,EAAE;QACJ,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,EAAE;IACN,CAAC,CAAC,IAAI,CAAC"}