@naulon/enforce 0.1.0

package/dist/nonce.d.ts

@@ -0,0 +1,45 @@
+/** The payment facts a nonce is cryptographically bound to. */
+export interface NonceBinding {
+    amount: string;
+    payTo: string;
+    network: string;
+}
+/** Mint a nonce bound to a payment requirement, valid for NONCE_TTL_SECONDS. */
+export declare function issueNonce(binding: NonceBinding, now: number): string;
+/**
+ * The "has this nonce been spent?" store — the one piece of nonce state that
+ * isn't carried inside the nonce itself. Issuance is stateless (the HMAC is the
+ * proof); only single-use enforcement needs memory. Behind this seam it can be
+ * an in-process Map (default) or a shared table (Supabase) so the guarantee
+ * survives across serverless instances.
+ */
+export interface ConsumedStore {
+    /**
+     * Atomically mark `nonce` as spent. Resolve `true` if this call was the first
+     * to spend it, `false` if it was already spent (a replay). Must be a single
+     * atomic step — a check-then-set with a gap would let two concurrent replays
+     * both win.
+     */
+    consume(nonce: string, expMs: number, now: number): Promise<boolean>;
+}
+/**
+ * Build a single-use store using the configured backend. Each caller gets its
+ * own instance — the memory backend is a private Map, and the Supabase backend
+ * shares the nonces table but callers namespace their keys (e.g. the PoP path
+ * prefixes `pop:`) so distinct uses never collide. Reused by the holder-of-key
+ * proof verifier (pop.ts) so its replay protection inherits the same seam.
+ */
+export declare function makeConsumedStore(): ConsumedStore;
+export type ConsumeResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate a nonce against a payment binding and spend it. Fails closed on a
+ * bad shape, a forged/mismatched HMAC, expiry, or replay. The signature/expiry
+ * checks run before we touch the store, so a forged nonce never hits the DB.
+ */
+export declare function consumeNonce(nonce: string, binding: NonceBinding, now: number): Promise<ConsumeResult>;
+//# sourceMappingURL=nonce.d.ts.map

package/dist/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../src/nonce.ts"],"names":[],"mappings":"AAwCA,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAEjD;AAID,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,CAmBxB"}

package/dist/nonce.js

@@ -0,0 +1,122 @@
+/**
+ * Payment nonces — replay protection for the x402 handshake.
+ *
+ * Without this, a captured `payment-signature` could be replayed forever to read
+ * for free (mock mode has no chain to stop it; even live, defence-in-depth is
+ * cheap). Each 402 carries a fresh nonce the agent must echo in its payment.
+ *
+ * Design: issuance is STATELESS — the nonce is its own proof. It's
+ *   `${expMs}.${rand}.${hmac}`
+ * where the HMAC is taken over the expiry, the random salt, AND the payment
+ * binding (amount + payTo + network). Two consequences:
+ *   - a nonce minted for a $0.001 read can't be reused to satisfy a $0.005
+ *     citation — the binding wouldn't match.
+ *   - the gate needs no memory of what it issued to validate a nonce later.
+ *
+ * The only state is a CONSUMED set so a valid nonce works exactly once. It lives
+ * behind the `ConsumedStore` seam below: an in-process Map by default (single
+ * instance), or a shared Supabase table when NONCE_BACKEND=supabase — which is
+ * what makes the gate safe to run as many serverless instances (Vercel). For
+ * either multi-instance path, also set TOLLGATE_SECRET so every instance signs
+ * and verifies nonces with the same key.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { getConfig, supabaseRest } from "@naulon/shared";
+const cfg = getConfig();
+const secret = cfg.TOLLGATE_SECRET ??
+    (() => {
+        const ephemeral = randomBytes(32).toString("hex");
+        console.warn("[tollgate] TOLLGATE_SECRET not set — using an ephemeral nonce secret. " +
+            "Outstanding 402s are invalidated on restart; set TOLLGATE_SECRET for stability/multi-instance.");
+        return ephemeral;
+    })();
+const ttlMs = cfg.NONCE_TTL_SECONDS * 1000;
+function sign(expMs, rand, b) {
+    return createHmac("sha256", secret)
+        .update(`${expMs}.${rand}.${b.amount}.${b.payTo}.${b.network}`)
+        .digest("hex");
+}
+/** Mint a nonce bound to a payment requirement, valid for NONCE_TTL_SECONDS. */
+export function issueNonce(binding, now) {
+    const expMs = now + ttlMs;
+    const rand = randomBytes(12).toString("hex");
+    return `${expMs}.${rand}.${sign(expMs, rand, binding)}`;
+}
+/** Default store: an in-process Map. Correct for a single instance. */
+function memoryStore() {
+    // nonce -> expiry ms. A present key means "already spent".
+    const consumed = new Map();
+    const sweep = (now) => {
+        for (const [n, exp] of consumed)
+            if (exp <= now)
+                consumed.delete(n);
+    };
+    return {
+        async consume(nonce, expMs, now) {
+            if (consumed.has(nonce))
+                return false;
+            if (consumed.size > 10_000)
+                sweep(now); // amortized cleanup under load
+            consumed.set(nonce, expMs);
+            return true;
+        },
+    };
+}
+/**
+ * Shared store: a Supabase table with `nonce` as the primary key. The DB is the
+ * arbiter of single-use — we INSERT and let the unique constraint decide. With
+ * `resolution=ignore-duplicates` a conflicting insert is silently dropped and,
+ * thanks to `return=representation`, the response is an EMPTY array — so "a row
+ * came back" means we won the insert (fresh), and "[]" means someone already
+ * spent it (replay). One round-trip, atomic, race-safe across instances.
+ */
+function supabaseStore() {
+    const table = getConfig().SUPABASE_NONCES_TABLE;
+    return {
+        async consume(nonce, expMs) {
+            const rows = (await supabaseRest(`/rest/v1/${table}?on_conflict=nonce`, {
+                method: "POST",
+                headers: { Prefer: "resolution=ignore-duplicates,return=representation" },
+                body: JSON.stringify([{ nonce, exp_ms: expMs }]),
+            }));
+            return rows.length > 0;
+        },
+    };
+}
+/**
+ * Build a single-use store using the configured backend. Each caller gets its
+ * own instance — the memory backend is a private Map, and the Supabase backend
+ * shares the nonces table but callers namespace their keys (e.g. the PoP path
+ * prefixes `pop:`) so distinct uses never collide. Reused by the holder-of-key
+ * proof verifier (pop.ts) so its replay protection inherits the same seam.
+ */
+export function makeConsumedStore() {
+    return cfg.NONCE_BACKEND === "supabase" ? supabaseStore() : memoryStore();
+}
+const store = makeConsumedStore();
+/**
+ * Validate a nonce against a payment binding and spend it. Fails closed on a
+ * bad shape, a forged/mismatched HMAC, expiry, or replay. The signature/expiry
+ * checks run before we touch the store, so a forged nonce never hits the DB.
+ */
+export async function consumeNonce(nonce, binding, now) {
+    const parts = nonce.split(".");
+    if (parts.length !== 3)
+        return { ok: false, error: "malformed nonce" };
+    const [expStr, rand, mac] = parts;
+    const expMs = Number(expStr);
+    if (!Number.isFinite(expMs))
+        return { ok: false, error: "malformed nonce" };
+    if (expMs <= now)
+        return { ok: false, error: "nonce expired" };
+    const expected = sign(expMs, rand, binding);
+    // Constant-time compare; lengths match (both hex SHA-256) so this is safe.
+    if (mac.length !== expected.length || !timingSafeEqual(Buffer.from(mac), Buffer.from(expected))) {
+        return { ok: false, error: "invalid nonce signature" };
+    }
+    if (!(await store.consume(nonce, expMs, now))) {
+        return { ok: false, error: "nonce already used (replay)" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=nonce.js.map

package/dist/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../src/nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AAExB,MAAM,MAAM,GACV,GAAG,CAAC,eAAe;IACnB,CAAC,GAAG,EAAE;QACJ,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,wEAAwE;YACtE,gGAAgG,CACnG,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;AAEP,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;AAS3C,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,CAAe;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;SAC9D,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,OAAqB,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC;AAmBD,uEAAuE;AACvE,SAAS,WAAW;IAClB,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,QAAQ;YAAE,IAAI,GAAG,IAAI,GAAG;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG;YAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,MAAM;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B;YACvE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,qBAAqB,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK;YACxB,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,KAAK,oBAAoB,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,oDAAoD,EAAE;gBACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;aACjD,CAAC,CAAc,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,KAAK,GAAkB,iBAAiB,EAAE,CAAC;AAIjD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,OAAqB,EACrB,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACvE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAiC,CAAC;IAE9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC5E,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/pop.d.ts

@@ -0,0 +1,15 @@
+import { type CitationLicenseClaims } from "@naulon/shared";
+export interface PopContext {
+    claims: CitationLicenseClaims;
+    slug: string;
+    /** The gate identity (= license aud); pins the proof to this deployment. */
+    identity: string;
+    /** Epoch ms (the gate clock). */
+    now: number;
+}
+/**
+ * Verify a proof-of-possession header for a holder-of-key license. Returns true
+ * only if the proof is fresh, single-use, and signed by the bound wallet.
+ */
+export declare function verifyPopProof(proofHeader: string, ctx: PopContext): Promise<boolean>;
+//# sourceMappingURL=pop.d.ts.map

package/dist/pop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pop.d.ts","sourceRoot":"","sources":["../src/pop.ts"],"names":[],"mappings":"AAsBA,OAAO,EAA0C,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAepG,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAoC3F"}

package/dist/pop.js

@@ -0,0 +1,77 @@
+/**
+ * Holder-of-key proof-of-possession (P5). See docs/citation-license.md.
+ *
+ * A holder-of-key license carries a `cnf` claim binding it to the payer wallet.
+ * Re-reading it free is no longer a bearer right: the caller must prove it holds
+ * that wallet's key by signing a fresh challenge (EIP-191 personal_sign). So a
+ * captured `X-Naulon-License` header is worthless without the private key.
+ *
+ * The proof rides in `X-Naulon-Proof: <ts>.<nonce>.<sig>` where the agent signed
+ * `popMessage({ aud, jti, slug, ts, nonce })`. The gate reconstructs that exact
+ * message from the (already signature-verified) license claims plus the proof's
+ * own ts/nonce, recovers the signer with viem, and accepts iff:
+ *   - the recovered address equals the wallet named in `cnf` (constant-compare
+ *     by lowercased hex),
+ *   - `ts` is within ±LICENSE_POP_WINDOW_SECONDS of the gate clock (freshness),
+ *   - the (jti, nonce) pair has not been spent — single-use via the same
+ *     ConsumedStore seam the 402 nonces use, so replay is closed in-window too.
+ *
+ * Fails CLOSED: any defect returns false, which drops the caller to the normal
+ * 402 path (pay again) — never a 500, never a free pass.
+ */
+import { recoverMessageAddress } from "viem";
+import { getConfig, popBoundAddress, popMessage } from "@naulon/shared";
+import { makeConsumedStore } from "./nonce.js";
+const cfg = getConfig();
+const windowSec = cfg.LICENSE_POP_WINDOW_SECONDS;
+// Single-use store for proof nonces. Keys are namespaced `pop:<jti>:<nonce>` so
+// they never collide with the 402 payment nonces in a shared Supabase table.
+const proofStore = makeConsumedStore();
+/** Hard cap on the proof header before any parsing (an EIP-191 sig is ~132 chars). */
+const MAX_PROOF_LEN = 1024;
+const HEX_NONCE = /^[0-9a-f]{8,64}$/;
+const ETH_SIG = /^0x[0-9a-fA-F]{130}$/;
+/**
+ * Verify a proof-of-possession header for a holder-of-key license. Returns true
+ * only if the proof is fresh, single-use, and signed by the bound wallet.
+ */
+export async function verifyPopProof(proofHeader, ctx) {
+    try {
+        if (typeof proofHeader !== "string" || proofHeader.length === 0 || proofHeader.length > MAX_PROOF_LEN) {
+            return false;
+        }
+        const bound = popBoundAddress(ctx.claims);
+        if (!bound)
+            return false; // caller should only invoke this for cnf-bound licenses
+        const parts = proofHeader.split(".");
+        if (parts.length !== 3)
+            return false;
+        const [tsStr, nonce, sig] = parts;
+        if (!HEX_NONCE.test(nonce) || !ETH_SIG.test(sig))
+            return false;
+        const ts = Number(tsStr);
+        if (!Number.isInteger(ts))
+            return false;
+        // Freshness: the proof's self-asserted timestamp must sit within the window
+        // of the gate clock, in BOTH directions (stale replay and future-dating).
+        const nowSec = Math.floor(ctx.now / 1000);
+        if (Math.abs(nowSec - ts) > windowSec)
+            return false;
+        // Reconstruct the exact bytes the holder signed from the trusted claims.
+        const message = popMessage({ aud: ctx.identity, jti: ctx.claims.jti, slug: ctx.slug, ts, nonce });
+        const recovered = await recoverMessageAddress({ message, signature: sig });
+        if (recovered.toLowerCase() !== bound)
+            return false;
+        // Single-use: spend (jti, nonce) once. expMs bounds how long we must remember
+        // it — exactly the freshness window past the proof's timestamp.
+        const key = `pop:${ctx.claims.jti}:${nonce}`;
+        const expMs = (ts + windowSec) * 1000;
+        if (!(await proofStore.consume(key, expMs, ctx.now)))
+            return false; // replay
+        return true;
+    }
+    catch {
+        return false; // fail closed on any recover/parse error
+    }
+}
+//# sourceMappingURL=pop.js.map

package/dist/pop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pop.js","sourceRoot":"","sources":["../src/pop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAA8B,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AACxB,MAAM,SAAS,GAAG,GAAG,CAAC,0BAA0B,CAAC;AAEjD,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;AAEvC,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAWvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,GAAe;IACvE,IAAI,CAAC;QACH,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,wDAAwD;QAElF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAiC,CAAC;QAE9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAExC,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;QAEpD,yEAAyE;QACzE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAoB,EAAE,CAAC,CAAC;QAC5F,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAEpD,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,SAAS;QAE7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,yCAAyC;IACzD,CAAC;AACH,CAAC"}

package/dist/pricing.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Price a read/citation and resolve who gets paid.
+ *
+ * Pricing is publisher-agnostic: it asks the resolved publisher's `CreditsResolver`
+ * for the article's credits graph, then flattens it to payees via the shared
+ * attribution logic. Everything publisher-specific (the credits source, the base
+ * price) arrives on the `PublisherConfig` — this function reads no global config, so
+ * one gate prices many publishers correctly.
+ */
+import { type AuthorShare, type PayoutLeg, type PublisherConfig, type TollKind, type Usdc } from "@naulon/shared";
+export interface Quote {
+    slug: string;
+    title: string;
+    kind: TollKind;
+    price: Usdc;
+    payees: AuthorShare[];
+    /**
+     * Additional settlement legs beyond the author payment, resolved from the
+     * publisher's `extraLegs` hook. Empty for the single-tenant default and every
+     * publisher that declares no extra legs — in which case the 402 and settle path
+     * are byte-identical to a plain single-author toll. Additive: these never alter
+     * `price`/`payees`; the buyer's total is `price + Σ legs`.
+     */
+    extraLegs: PayoutLeg[];
+    /**
+     * Pay co-authors directly on-chain (split-at-source) — carried from the resolved
+     * `PublisherConfig.coauthorSplit`. When true AND `payees.length > 1`, `build402`
+     * divides the author `price` into the primary's synchronous leg + one deferred leg
+     * per other co-author (custody-free). Off / single-author → the stock single
+     * author-leg toll. Never changes `price` or `payees` (the recorded truth); only the
+     * on-chain leg recipients/amounts.
+     */
+    coauthorSplit: boolean;
+    /**
+     * Optional reconciliation id for the on-chain memo (Arc only). When set AND the
+     * active network ships the Memo predeploy, the synchronous author leg settles via
+     * the self-relay path and emits a `Memo` event keyed by this id (keccak256'd to
+     * `bytes32` if not already 32-byte hex) — tying the settlement to a citation /
+     * license id for offchain reconciliation. Absent, or on a memo-less network (Base),
+     * the settle path is byte-identical to the stock Circle Gateway toll. Supplied by
+     * the control plane; the open-core gate never invents
+     * one, so the default single-tenant gate is unaffected.
+     */
+    memoId?: string;
+}
+/**
+ * Price a toll event for one publisher. Citations cost more than a single read (a
+ * citation has downstream reach), but both resolve to the same author payees.
+ * Returns undefined for an article the publisher's credits source doesn't know —
+ * the gate treats that as "don't gate".
+ */
+export declare function quote(publisher: PublisherConfig, slug: string, kind: TollKind): Promise<Quote | undefined>;
+//# sourceMappingURL=pricing.d.ts.map

package/dist/pricing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CACzB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CA2B5B"}

package/dist/pricing.js

@@ -0,0 +1,44 @@
+/**
+ * Price a read/citation and resolve who gets paid.
+ *
+ * Pricing is publisher-agnostic: it asks the resolved publisher's `CreditsResolver`
+ * for the article's credits graph, then flattens it to payees via the shared
+ * attribution logic. Everything publisher-specific (the credits source, the base
+ * price) arrives on the `PublisherConfig` — this function reads no global config, so
+ * one gate prices many publishers correctly.
+ */
+import { resolvePayees, usdc, } from "@naulon/shared";
+/**
+ * Price a toll event for one publisher. Citations cost more than a single read (a
+ * citation has downstream reach), but both resolve to the same author payees.
+ * Returns undefined for an article the publisher's credits source doesn't know —
+ * the gate treats that as "don't gate".
+ */
+export async function quote(publisher, slug, kind) {
+    const credits = await publisher.credits.resolve(slug);
+    if (!credits)
+        return undefined;
+    const price = usdc(kind === "citation" ? publisher.price * publisher.citationMultiplier : publisher.price);
+    return {
+        slug: credits.slug,
+        title: credits.title,
+        kind,
+        price,
+        payees: resolvePayees(credits),
+        // Additive secondary legs (none for the single-tenant default). The hook owns
+        // all amount math; pricing just carries what it returns through to the quote.
+        extraLegs: publisher.extraLegs?.(price, kind) ?? [],
+        // Carried through to build402, which owns the split-at-source math (it has the
+        // primary-payee tiebreak config). Off unless the resolver opts the publisher in.
+        coauthorSplit: publisher.coauthorSplit ?? false,
+        // The control plane owns the memo id's format; the core just carries what the
+        // hook returns. Spread so an unset hook (or one returning undefined) leaves the
+        // key absent entirely — the settle path then keys the memo off the auth nonce,
+        // byte-identical to the stock single-tenant toll.
+        ...(() => {
+            const memoId = publisher.memoId?.({ slug: credits.slug, kind });
+            return memoId ? { memoId } : {};
+        })(),
+    };
+}
+//# sourceMappingURL=pricing.js.map

package/dist/pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,aAAa,EACb,IAAI,GAML,MAAM,gBAAgB,CAAC;AAsCxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,SAA0B,EAC1B,IAAY,EACZ,IAAc;IAEd,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAE3G,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI;QACJ,KAAK;QACL,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QAC9B,8EAA8E;QAC9E,8EAA8E;QAC9E,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;QACnD,+EAA+E;QAC/E,iFAAiF;QACjF,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,KAAK;QAC/C,8EAA8E;QAC9E,gFAAgF;QAChF,+EAA+E;QAC/E,kDAAkD;QAClD,GAAG,CAAC,GAAG,EAAE;YACP,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,EAAE;KACL,CAAC;AACJ,CAAC"}

package/dist/revocation.d.ts

@@ -0,0 +1,6 @@
+export interface RevocationStore {
+    isRevoked(jti: string): Promise<boolean>;
+    revoke(jti: string): Promise<void>;
+}
+export declare const revocations: RevocationStore;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAkCD,eAAO,MAAM,WAAW,EAAE,eAA0E,CAAC"}

package/dist/revocation.js

@@ -0,0 +1,45 @@
+/**
+ * License revocation seam (the v1 kill switch for a leaked token before its exp).
+ *
+ * A CLT is a bearer entitlement, so the only defence against a captured-but-
+ * unexpired token — beyond the short TTL — is denying its `jti`. This is enforced
+ * ONLY on the trusted tiers: the gate's own re-read path and `GET /licenses/:jti`
+ * (when LICENSE_ONLINE_CHECK is on). The offline JWKS tier can't consult it by
+ * design; that residual window is bounded by the TTL (see docs/citation-license.md).
+ *
+ * Backend mirrors the event/nonce stores: an in-process Set by default, or a
+ * shared Supabase table (`jti` primary key) when a supabase backend is in play so
+ * revocations hold across instances.
+ */
+import { getConfig, supabaseRest } from "@naulon/shared";
+const cfg = getConfig();
+function memoryRevocation() {
+    const revoked = new Set();
+    return {
+        async isRevoked(jti) {
+            return revoked.has(jti);
+        },
+        async revoke(jti) {
+            revoked.add(jti);
+        },
+    };
+}
+function supabaseRevocation() {
+    const table = cfg.SUPABASE_REVOCATIONS_TABLE;
+    return {
+        async isRevoked(jti) {
+            const rows = (await supabaseRest(`/rest/v1/${table}?jti=eq.${encodeURIComponent(jti)}&select=jti&limit=1`));
+            return rows.length > 0;
+        },
+        async revoke(jti) {
+            await supabaseRest(`/rest/v1/${table}?on_conflict=jti`, {
+                method: "POST",
+                headers: { Prefer: "resolution=ignore-duplicates" },
+                body: JSON.stringify([{ jti }]),
+            });
+        },
+    };
+}
+const usesSupabase = cfg.EVENTS_BACKEND === "supabase" || cfg.NONCE_BACKEND === "supabase";
+export const revocations = usesSupabase ? supabaseRevocation() : memoryRevocation();
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;AAOxB,SAAS,gBAAgB;IACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC7C,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAC9B,YAAY,KAAK,WAAW,kBAAkB,CAAC,GAAG,CAAC,qBAAqB,CACzE,CAAc,CAAC;YAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,YAAY,CAAC,YAAY,KAAK,kBAAkB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;gBACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,KAAK,UAAU,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,CAAC;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAoB,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@naulon/enforce",
+  "version": "0.1.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/naulonapp/naulon.git",
+    "directory": "packages/enforce"
+  },
+  "description": "Runtime-agnostic naulon toll-decision kernel + in-app enforcement middleware. The neutral low-level core shared by @naulon/tollgate (the gate) and @naulon/sdk (the publisher SDK) — no dependency cycle.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/enforce/next.d.ts",
+      "import": "./dist/enforce/next.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "test": "node --import tsx --test \"src/**/*.test.ts\""
+  },
+  "dependencies": {
+    "@naulon/shared": "^0.0.1",
+    "viem": "^2.52.2"
+  },
+  "peerDependencies": {
+    "next": ">=15"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}