@naulon/sdk 0.1.0

package/dist/idempotency.js

@@ -0,0 +1,19 @@
+/**
+ * A process-local default so the type is always satisfiable in dev/tests.
+ *
+ * NOT DURABLE. It is lost on restart and useless across instances — any real
+ * deployment MUST back `claim` with its database (a unique constraint on the event
+ * id). Using this in production is a double-payout footgun.
+ */
+export function memoryIdempotencyStore() {
+    const seen = new Set();
+    return {
+        async claim(eventId) {
+            if (seen.has(eventId))
+                return false;
+            seen.add(eventId);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @naulon/sdk — the naulon publisher contract.
+ *
+ * One source of truth for the credits + settlement wire: the types a publisher
+ * produces/consumes, the validators that guard the money-routing boundary, the
+ * HMAC sign/verify pair, and the credits resolvers. Runtime deps: `zod` +
+ * `node:crypto` only — self-contained, so an external publisher installs one
+ * thing. Framework adapters live behind subpath exports (added in a later phase).
+ */
+export * from "./contract/index.ts";
+export * from "./crypto/sign.ts";
+export * from "./crypto/verify.ts";
+export * from "./crypto/fixture.ts";
+export * from "./resolver/types.ts";
+export * from "./resolver/http.ts";
+export * from "./resolver/fixture.ts";
+export * from "./idempotency.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * @naulon/sdk — the naulon publisher contract.
+ *
+ * One source of truth for the credits + settlement wire: the types a publisher
+ * produces/consumes, the validators that guard the money-routing boundary, the
+ * HMAC sign/verify pair, and the credits resolvers. Runtime deps: `zod` +
+ * `node:crypto` only — self-contained, so an external publisher installs one
+ * thing. Framework adapters live behind subpath exports (added in a later phase).
+ */
+export * from "./contract/index.js";
+export * from "./crypto/sign.js";
+export * from "./crypto/verify.js";
+export * from "./crypto/fixture.js";
+export * from "./resolver/types.js";
+export * from "./resolver/http.js";
+export * from "./resolver/fixture.js";
+export * from "./idempotency.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC"}

package/dist/init/plan.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `naulon init` — the pure, testable core.
+ *
+ * A self-hoster's setup cliff today is: copy a 180-line `.env.example`, hand-edit it,
+ * AND hand-author a credits source that satisfies the contract. `init` collapses that
+ * into a short prompt flow. This module is the part with no I/O and no prompts: it turns
+ * validated answers into the exact bytes of the two files the gate boots from — so it can
+ * be unit-tested with fixtures, never touching a TTY or the filesystem (the same split as
+ * `runCheck` vs the `check` CLI shell).
+ *
+ * Every generated `credits.json` entry is run through the real `creditsSchema` before it
+ * is returned, so `init` can never emit a file the gate would reject at boot.
+ */
+import { z } from "zod";
+/** A clearly-fake but structurally-valid address, so a wallet-less starter still boots. */
+export declare const PLACEHOLDER_WALLET = "0x0000000000000000000000000000000000000000";
+/**
+ * The answers the wizard resolves (from flags, prompts, or defaults) before planning.
+ * Mirrors the env surface the gate actually reads (`shared/src/config.ts`) — the real
+ * public contract a self-hoster pins to.
+ */
+export declare const initAnswersSchema: z.ZodObject<{
+    originUrl: z.ZodString;
+    priceUsdc: z.ZodNumber;
+    citationMultiplier: z.ZodNumber;
+    paymentMode: z.ZodEnum<{
+        mock: "mock";
+        gateway: "gateway";
+    }>;
+    settlementNetwork: z.ZodDefault<z.ZodEnum<{
+        arcTestnet: "arcTestnet";
+        baseSepolia: "baseSepolia";
+        base: "base";
+    }>>;
+    tollgatePort: z.ZodNumber;
+    articlePrefixes: z.ZodString;
+    creditsPath: z.ZodString;
+    starterSlug: z.ZodString;
+    starterTitle: z.ZodString;
+    starterAuthorId: z.ZodString;
+    defaultWallet: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InitAnswers = z.infer<typeof initAnswersSchema>;
+/** Schema-level defaults, surfaced to the CLI so prompts can show them in brackets. */
+export declare const INIT_DEFAULTS: {
+    readonly originUrl: "http://localhost:3000";
+    readonly priceUsdc: 0.001;
+    readonly citationMultiplier: 5;
+    readonly paymentMode: "mock";
+    readonly settlementNetwork: "arcTestnet";
+    readonly tollgatePort: 8402;
+    readonly articlePrefixes: "essays,articles,posts";
+    readonly creditsPath: "./credits.json";
+    readonly starterSlug: "welcome";
+    readonly starterTitle: "Welcome";
+    readonly starterAuthorId: "you";
+};
+export interface PlanFile {
+    /** Relative to the target directory. */
+    path: string;
+    contents: string;
+}
+export interface InitPlan {
+    env: PlanFile;
+    credits: PlanFile;
+    /** Non-fatal things the operator must know (mock mode, placeholder wallet, gateway creds). */
+    warnings: string[];
+    /** Printed after the files land — the "what now" a good scaffolder always ends with. */
+    nextSteps: string[];
+}
+/**
+ * Turn validated answers into the two files the gate boots from. Pure: no I/O, no prompts.
+ * Throws only if a generated credits entry fails the contract (a guard, not an expected path).
+ */
+export declare function buildInitPlan(answers: InitAnswers): InitPlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/init/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/init/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,+CAA+C,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;kBAiBnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,uFAAuF;AACvF,eAAO,MAAM,aAAa;;;;;;;;;;;;CAYhB,CAAC;AAEX,MAAM,WAAW,QAAQ;IACvB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wFAAwF;IACxF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA0DD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CA8B5D"}

package/dist/init/plan.js

@@ -0,0 +1,132 @@
+/**
+ * `naulon init` — the pure, testable core.
+ *
+ * A self-hoster's setup cliff today is: copy a 180-line `.env.example`, hand-edit it,
+ * AND hand-author a credits source that satisfies the contract. `init` collapses that
+ * into a short prompt flow. This module is the part with no I/O and no prompts: it turns
+ * validated answers into the exact bytes of the two files the gate boots from — so it can
+ * be unit-tested with fixtures, never touching a TTY or the filesystem (the same split as
+ * `runCheck` vs the `check` CLI shell).
+ *
+ * Every generated `credits.json` entry is run through the real `creditsSchema` before it
+ * is returned, so `init` can never emit a file the gate would reject at boot.
+ */
+import { z } from "zod";
+import { walletSchema, walletAddress } from "../contract/wallet.js";
+import { parseCredits } from "../contract/credits.js";
+/** A clearly-fake but structurally-valid address, so a wallet-less starter still boots. */
+export const PLACEHOLDER_WALLET = "0x0000000000000000000000000000000000000000";
+/**
+ * The answers the wizard resolves (from flags, prompts, or defaults) before planning.
+ * Mirrors the env surface the gate actually reads (`shared/src/config.ts`) — the real
+ * public contract a self-hoster pins to.
+ */
+export const initAnswersSchema = z
+    .object({
+    originUrl: z.string().url(),
+    priceUsdc: z.number().positive(),
+    citationMultiplier: z.number().positive(),
+    paymentMode: z.enum(["mock", "gateway"]),
+    settlementNetwork: z.enum(["arcTestnet", "baseSepolia", "base"]).default("arcTestnet"),
+    tollgatePort: z.number().int().positive(),
+    articlePrefixes: z.string().min(1),
+    /** Where the starter credits map is written; also becomes CREDITS_FIXTURES. */
+    creditsPath: z.string().min(1),
+    /** The starter article + its author. Wallet-less → a placeholder + a loud warning. */
+    starterSlug: z.string().min(1),
+    starterTitle: z.string().min(1),
+    starterAuthorId: z.string().min(1),
+    defaultWallet: walletSchema.optional(),
+})
+    .strict();
+/** Schema-level defaults, surfaced to the CLI so prompts can show them in brackets. */
+export const INIT_DEFAULTS = {
+    originUrl: "http://localhost:3000",
+    priceUsdc: 0.001,
+    citationMultiplier: 5,
+    paymentMode: "mock",
+    settlementNetwork: "arcTestnet",
+    tollgatePort: 8402,
+    articlePrefixes: "essays,articles,posts",
+    creditsPath: "./credits.json",
+    starterSlug: "welcome",
+    starterTitle: "Welcome",
+    starterAuthorId: "you",
+};
+function renderEnv(a) {
+    const gateway = a.paymentMode === "gateway";
+    const lines = [
+        "# naulon gate — generated by `naulon init`. Edit freely; re-run init to regenerate.",
+        "# The full annotated reference is .env.example.",
+        "",
+        "# ── Core toll ──",
+        `PAYMENT_MODE=${a.paymentMode}`,
+        `# The site the gate sits in front of. A machine request to a gateable path gets tolled;`,
+        `# a human request is proxied straight through, free.`,
+        `ORIGIN_URL=${a.originUrl}`,
+        `TOLLGATE_PORT=${a.tollgatePort}`,
+        `# Comma-separated path prefixes that count as gateable articles.`,
+        `ARTICLE_PATH_PREFIXES=${a.articlePrefixes}`,
+        "",
+        "# ── Price ──",
+        `# A single read costs this much USDC. A citation costs CITATION_MULTIPLIER× a read.`,
+        `DEFAULT_PRICE_USDC=${a.priceUsdc}`,
+        `CITATION_MULTIPLIER=${a.citationMultiplier}`,
+        "",
+        "# ── Credits (who gets paid) ──",
+        `# The gate reads this local JSON file to map an article slug → its author wallet(s).`,
+        `# Swap to a live API instead by setting CREDITS_API_URL.`,
+        `CREDITS_FIXTURES=${a.creditsPath}`,
+        "",
+        "# ── Settlement ──",
+    ];
+    if (gateway) {
+        lines.push(`SETTLEMENT_NETWORK=${a.settlementNetwork}`, `# gateway mode settles real USDC. Fill these before it can settle — see .env.example:`, `#   RELAYER_PRIVATE_KEY=   (Arc memo self-relay; pays gas, never touches transferred funds)`, `#   CIRCLE_API_KEY=        (Circle Gateway; testnet facilitator needs no key)`, `# CREDITS_SETTLEMENT_SECRET is optional — unset keeps the earnings emit dark (still tolls).`);
+    }
+    else {
+        lines.push(`# mock mode signs payments offline — the whole loop runs with no wallet or API keys.`, `# Set PAYMENT_MODE=gateway (and re-run init) when you're ready to settle real USDC.`);
+    }
+    return lines.join("\n") + "\n";
+}
+function buildStarterCredits(a) {
+    const usedPlaceholder = a.defaultWallet === undefined;
+    const entry = {
+        slug: a.starterSlug,
+        title: a.starterTitle,
+        contributors: [{ authorId: a.starterAuthorId, wallet: walletAddress(a.defaultWallet ?? PLACEHOLDER_WALLET) }],
+    };
+    // Never emit a file the gate would reject — validate through the real contract.
+    parseCredits(entry, `starter credits for "${a.starterSlug}"`);
+    return { map: { [a.starterSlug]: entry }, usedPlaceholder };
+}
+/**
+ * Turn validated answers into the two files the gate boots from. Pure: no I/O, no prompts.
+ * Throws only if a generated credits entry fails the contract (a guard, not an expected path).
+ */
+export function buildInitPlan(answers) {
+    const a = initAnswersSchema.parse(answers);
+    const { map, usedPlaceholder } = buildStarterCredits(a);
+    const warnings = [];
+    if (a.paymentMode === "mock") {
+        warnings.push("PAYMENT_MODE=mock — payments are signed offline; no real USDC moves. Fine for local dev.");
+    }
+    else {
+        warnings.push(`PAYMENT_MODE=gateway on ${a.settlementNetwork} — set RELAYER_PRIVATE_KEY / CIRCLE_API_KEY in .env before a real settle.`);
+    }
+    if (usedPlaceholder) {
+        warnings.push(`${a.creditsPath} uses a placeholder wallet (0x00…00). Replace it with a real address, or agents pay into the void.`);
+    }
+    return {
+        env: { path: ".env", contents: renderEnv(a) },
+        credits: { path: a.creditsPath, contents: JSON.stringify(map, null, 2) + "\n" },
+        warnings,
+        nextSteps: [
+            "Review .env and " + a.creditsPath + " — add your real article slugs + author wallets.",
+            `Draft entries from your live site:  npx naulon crawl ${a.originUrl} --prefixes ${a.articlePrefixes}`,
+            "Start the gate:  make dev",
+            `Watch the toll:  curl -A python-requests localhost:${a.tollgatePort}/${a.articlePrefixes.split(",")[0]}/${a.starterSlug}`,
+            "Health-check anytime:  npx naulon doctor",
+        ],
+    };
+}
+//# sourceMappingURL=plan.js.map

package/dist/init/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/init/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAuB,MAAM,wBAAwB,CAAC;AAE3E,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,4CAA4C,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,+EAA+E;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,SAAS,EAAE,uBAAuB;IAClC,SAAS,EAAE,KAAK;IAChB,kBAAkB,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM;IACnB,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,uBAAuB;IACxC,WAAW,EAAE,gBAAgB;IAC7B,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,SAAS;IACvB,eAAe,EAAE,KAAK;CACd,CAAC;AAiBX,SAAS,SAAS,CAAC,CAAc;IAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG;QACZ,qFAAqF;QACrF,iDAAiD;QACjD,EAAE;QACF,mBAAmB;QACnB,gBAAgB,CAAC,CAAC,WAAW,EAAE;QAC/B,yFAAyF;QACzF,sDAAsD;QACtD,cAAc,CAAC,CAAC,SAAS,EAAE;QAC3B,iBAAiB,CAAC,CAAC,YAAY,EAAE;QACjC,kEAAkE;QAClE,yBAAyB,CAAC,CAAC,eAAe,EAAE;QAC5C,EAAE;QACF,eAAe;QACf,qFAAqF;QACrF,sBAAsB,CAAC,CAAC,SAAS,EAAE;QACnC,uBAAuB,CAAC,CAAC,kBAAkB,EAAE;QAC7C,EAAE;QACF,iCAAiC;QACjC,sFAAsF;QACtF,0DAA0D;QAC1D,oBAAoB,CAAC,CAAC,WAAW,EAAE;QACnC,EAAE;QACF,oBAAoB;KACrB,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,sBAAsB,CAAC,CAAC,iBAAiB,EAAE,EAC3C,uFAAuF,EACvF,6FAA6F,EAC7F,+EAA+E,EAC/E,6FAA6F,CAC9F,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,sFAAsF,EACtF,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAc;IACzC,MAAM,eAAe,GAAG,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC;IACtD,MAAM,KAAK,GAAmB;QAC5B,IAAI,EAAE,CAAC,CAAC,WAAW;QACnB,KAAK,EAAE,CAAC,CAAC,YAAY;QACrB,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,IAAI,kBAAkB,CAAC,EAAE,CAAC;KAC9G,CAAC;IACF,gFAAgF;IAChF,YAAY,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;IAC9D,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CACX,2BAA2B,CAAC,CAAC,iBAAiB,2EAA2E,CAC1H,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,WAAW,oGAAoG,CACrH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE;QAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAC/E,QAAQ;QACR,SAAS,EAAE;YACT,kBAAkB,GAAG,CAAC,CAAC,WAAW,GAAG,kDAAkD;YACvF,wDAAwD,CAAC,CAAC,SAAS,eAAe,CAAC,CAAC,eAAe,EAAE;YACrG,2BAA2B;YAC3B,sDAAsD,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAC1H,0CAA0C;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/next/credits-route.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The credits-route adapter — deliberately minimal (~20 lines of HTTP framing
+ * around the `CreditsResolver` seam). It earns its place by pinning the one thing
+ * publishers get wrong: `404 = free read` (the deliberate don't-gate signal),
+ * distinct from a `200` with credits. The docs also show the hand-rolled
+ * equivalent for publishers who'd rather not take the dependency.
+ *
+ * Returns a Next App Router GET handler shape — `(req, ctx)` where `ctx.params`
+ * is the async params object Next 15+ passes. Wire it as:
+ *   export const GET = createCreditsRoute(resolver);
+ */
+import type { CreditsResolver } from "../resolver/types.ts";
+export declare function createCreditsRoute(resolver: CreditsResolver, opts?: {
+    token?: string;
+}): (req: Request, ctx: {
+    params: Promise<{
+        slug: string;
+    }>;
+}) => Promise<Response>;
+//# sourceMappingURL=credits-route.d.ts.map

package/dist/next/credits-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits-route.d.ts","sourceRoot":"","sources":["../../src/next/credits-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,EACzB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAgBjF"}

package/dist/next/credits-route.js

@@ -0,0 +1,18 @@
+export function createCreditsRoute(resolver, opts) {
+    return async (req, ctx) => {
+        // Optional bearer gate — set a token when the endpoint is public-internet
+        // reachable (the cloud-tenant case; the fleet sends `Authorization: Bearer`).
+        if (opts?.token) {
+            if (req.headers.get("authorization") !== `Bearer ${opts.token}`) {
+                return Response.json({ error: "unauthorized" }, { status: 401 });
+            }
+        }
+        const { slug } = await ctx.params;
+        const credits = await resolver.resolve(slug);
+        if (credits === undefined) {
+            return Response.json({ error: "not_found" }, { status: 404 }); // 404 = free read
+        }
+        return Response.json(credits);
+    };
+}
+//# sourceMappingURL=credits-route.js.map

package/dist/next/credits-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits-route.js","sourceRoot":"","sources":["../../src/next/credits-route.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,IAAyB;IAEzB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,kBAAkB;QACnF,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC"}

package/dist/next/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @naulon/sdk/next — drop-in Next.js App Router adapters over the contract.
+ *
+ * Both are framework-agnostic web-standard Request→Response handlers (they import
+ * nothing from `next`); the subpath name signals the intended consumer. `next` is
+ * an OPTIONAL peer dependency.
+ */
+export * from "./settlement-receiver.ts";
+export * from "./credits-route.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/next/index.js

@@ -0,0 +1,10 @@
+/**
+ * @naulon/sdk/next — drop-in Next.js App Router adapters over the contract.
+ *
+ * Both are framework-agnostic web-standard Request→Response handlers (they import
+ * nothing from `next`); the subpath name signals the intended consumer. `next` is
+ * an OPTIONAL peer dependency.
+ */
+export * from "./settlement-receiver.js";
+export * from "./credits-route.js";
+//# sourceMappingURL=index.js.map

package/dist/next/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/next/settlement-receiver.d.ts

@@ -0,0 +1,12 @@
+import type { SettlementBody } from "../contract/settlement.ts";
+import type { IdempotencyStore } from "../idempotency.ts";
+export declare function createSettlementReceiver(opts: {
+    /** 1..n shared HMAC secrets; >1 only during a rotation overlap. */
+    secrets: string[];
+    /** Persist the payout here. Runs at most once per eventId (idempotency-gated). */
+    onEvent: (event: SettlementBody) => Promise<void>;
+    /** REQUIRED. memoryIdempotencyStore() satisfies the type for dev, but is NOT
+     *  durable — back this with a DB unique-constraint on eventId in production. */
+    idempotency: IdempotencyStore;
+}): (req: Request) => Promise<Response>;
+//# sourceMappingURL=settlement-receiver.d.ts.map

package/dist/next/settlement-receiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlement-receiver.d.ts","sourceRoot":"","sources":["../../src/next/settlement-receiver.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,mEAAmE;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD;oFACgF;IAChF,WAAW,EAAE,gBAAgB,CAAC;CAC/B,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAyBtC"}

package/dist/next/settlement-receiver.js

@@ -0,0 +1,42 @@
+/**
+ * The settlement receiver adapter — the half a publisher most wants handed to
+ * them, because HMAC verification + replay defense are easy to get subtly wrong.
+ *
+ * It wraps `verifySettlement` (authenticity) with the mandatory exactly-once
+ * persistence (`IdempotencyStore`): the 300s skew window means an authentic POST
+ * is replayable for five minutes, so a money receiver with no dedupe is a
+ * double-payout defect. There is deliberately NO dry-run mode — a money receiver
+ * gets no public "pretend" path; offline conformance uses `makeSignedSettlementFixture`.
+ *
+ * Returns a plain `(req: Request) => Promise<Response>` handler — drop it straight
+ * into a Next.js App Router route (`export const POST = createSettlementReceiver(...)`),
+ * or any framework that speaks web-standard Request/Response.
+ */
+import { verifySettlement } from "../crypto/verify.js";
+export function createSettlementReceiver(opts) {
+    if (opts.secrets.length === 0) {
+        throw new Error("createSettlementReceiver: at least one secret is required");
+    }
+    return async (req) => {
+        // The signature is over the EXACT bytes — read the raw text, never re-serialize.
+        const rawBody = await req.text();
+        const result = verifySettlement({
+            rawBody,
+            timestampHeader: req.headers.get("x-naulon-timestamp"),
+            signatureHeader: req.headers.get("x-naulon-signature"),
+            secrets: opts.secrets,
+        });
+        if (!result.ok) {
+            // 401 = transient (the gate retries); 400 = permanent (it gives up).
+            return Response.json({ error: result.reason }, { status: result.status });
+        }
+        // Exactly-once: a replay inside the skew window is acknowledged but NOT re-paid.
+        const fresh = await opts.idempotency.claim(result.event.eventId);
+        if (!fresh) {
+            return Response.json({ ok: true, deduped: true });
+        }
+        await opts.onEvent(result.event);
+        return Response.json({ ok: true, deduped: false });
+    };
+}
+//# sourceMappingURL=settlement-receiver.js.map

package/dist/next/settlement-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlement-receiver.js","sourceRoot":"","sources":["../../src/next/settlement-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD,MAAM,UAAU,wBAAwB,CAAC,IAQxC;IACC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,iFAAiF;QACjF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,OAAO;YACP,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACtD,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,qEAAqE;YACrE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC"}

package/dist/resolver/fixture.d.ts

@@ -0,0 +1,10 @@
+import { type ArticleCredits } from "../contract/credits.ts";
+import type { CreditsResolver } from "./types.ts";
+export declare function fixtureResolver(fixtures: Record<string, ArticleCredits>): CreditsResolver;
+/**
+ * Load a fixture file lazily; missing file => empty map (gate stays open). Every
+ * entry is validated at load, so a malformed fixture fails fast at boot rather
+ * than mid-payment.
+ */
+export declare function fixtureResolverFromFile(path: string): Promise<CreditsResolver>;
+//# sourceMappingURL=fixture.d.ts.map

package/dist/resolver/fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../src/resolver/fixture.ts"],"names":[],"mappings":"AAMA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,eAAe,CAMzF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAYpF"}

package/dist/resolver/fixture.js

@@ -0,0 +1,33 @@
+/**
+ * Static credits resolvers — a JSON map (great for local dev + demos) or a file.
+ * Every entry is validated at load, so a malformed fixture fails fast rather than
+ * mid-payment.
+ */
+import { readFile } from "node:fs/promises";
+import { parseCredits } from "../contract/credits.js";
+export function fixtureResolver(fixtures) {
+    return {
+        async resolve(slug) {
+            return fixtures[slug];
+        },
+    };
+}
+/**
+ * Load a fixture file lazily; missing file => empty map (gate stays open). Every
+ * entry is validated at load, so a malformed fixture fails fast at boot rather
+ * than mid-payment.
+ */
+export async function fixtureResolverFromFile(path) {
+    let fixtures = {};
+    try {
+        const raw = JSON.parse(await readFile(path, "utf8"));
+        fixtures = Object.fromEntries(Object.entries(raw).map(([slug, credits]) => [slug, parseCredits(credits, `fixture "${slug}"`)]));
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        console.warn(`[sdk] no credits fixtures at ${path} — articles will pass through ungated.`);
+    }
+    return fixtureResolver(fixtures);
+}
+//# sourceMappingURL=fixture.js.map

package/dist/resolver/fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.js","sourceRoot":"","sources":["../../src/resolver/fixture.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAuB,MAAM,wBAAwB,CAAC;AAG3E,MAAM,UAAU,eAAe,CAAC,QAAwC;IACtE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QAChF,QAAQ,GAAG,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,CAAC,CAAC,CACjG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,gCAAgC,IAAI,wCAAwC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC"}

package/dist/resolver/http.d.ts

@@ -0,0 +1,3 @@
+import type { CreditsResolver } from "./types.ts";
+export declare function httpResolver(apiUrl: string, token?: string): CreditsResolver;
+//# sourceMappingURL=http.d.ts.map

package/dist/resolver/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/resolver/http.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CAa5E"}

package/dist/resolver/http.js

@@ -0,0 +1,23 @@
+/**
+ * The HTTP credits resolver — fetch `${apiUrl}/credits/:slug` from your CMS/API.
+ * This is the canonical implementation the multi-tenant control plane previously
+ * duplicated verbatim; it now lives here once.
+ */
+import { parseCredits } from "../contract/credits.js";
+export function httpResolver(apiUrl, token) {
+    const base = apiUrl.replace(/\/$/, "");
+    return {
+        async resolve(slug) {
+            const res = await fetch(`${base}/credits/${encodeURIComponent(slug)}`, {
+                headers: token ? { authorization: `Bearer ${token}` } : {},
+            });
+            if (res.status === 404)
+                return undefined;
+            if (!res.ok)
+                throw new Error(`credits lookup failed: ${res.status} ${res.statusText}`);
+            // Validate the upstream response before any wallet here becomes a payTo.
+            return parseCredits(await res.json(), `credits for "${slug}" from ${base}`);
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/resolver/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/resolver/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACrE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;aAC3D,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,yEAAyE;YACzE,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,gBAAgB,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/resolver/types.d.ts

@@ -0,0 +1,11 @@
+import type { ArticleCredits } from "../contract/credits.ts";
+/**
+ * Resolves an article slug to its credits graph. This is the seam that makes the
+ * toll publisher-agnostic: any site implements one of these (HTTP API, static
+ * file, database) and the gate works unchanged. `undefined` = no credits for this
+ * slug, which the gate reads as the deliberate "free read" signal.
+ */
+export interface CreditsResolver {
+    resolve(slug: string): Promise<ArticleCredits | undefined>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/resolver/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/resolver/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC5D"}

package/dist/resolver/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/resolver/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/resolver/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@naulon/sdk",
+  "version": "0.1.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/naulonapp/naulon.git",
+    "directory": "packages/sdk"
+  },
+  "description": "The naulon publisher contract: credits + settlement wire types, validators, HMAC sign/verify, and credits resolvers. One source of truth for the money-routing trust boundary.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "import": "./dist/next/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "import": "./dist/express/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/check.d.ts",
+      "import": "./dist/cli/check.js"
+    }
+  },
+  "bin": {
+    "naulon": "./dist/cli/naulon.js",
+    "naulon-kit": "./dist/cli/naulon.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "test": "node --import tsx --test \"src/**/*.test.ts\""
+  },
+  "dependencies": {
+    "fast-xml-parser": "^4.5.6",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "express": ">=4",
+    "next": ">=15"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "express": "^5.2.1"
+  }
+}