@naulon/shared 0.0.1

package/dist/config.js

@@ -0,0 +1,400 @@
+/**
+ * Env loading + validation. Fail loud at boot if a required var is missing,
+ * rather than mid-payment. Secrets never get a default.
+ */
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { config as loadDotenv } from "dotenv";
+import { z } from "zod";
+// Find the repo root by walking UP from the cwd until we hit the workspace root
+// (marked by package-lock.json). We anchor on cwd, not import.meta.url, because
+// this package is symlinked into node_modules/@naulon/shared — under
+// `npm run -w` the module URL can resolve to the symlink path, sending an
+// import.meta.url-relative lookup into node_modules/ instead of the repo. Every
+// entrypoint (make, npm -w, tests) runs with cwd inside the repo, so walking up
+// from cwd is reliable and symlink-immune. Falls back to cwd if no marker found.
+function findRepoRoot() {
+    let dir = process.cwd();
+    for (let i = 0; i < 12; i++) {
+        if (existsSync(join(dir, "package-lock.json")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return process.cwd();
+}
+const REPO_ROOT = findRepoRoot();
+// Anchor .env to the repo root, not cwd — npm workspaces run each package script
+// with cwd set to the package dir, so a cwd-relative lookup would miss the root
+// .env and silently fall back to defaults (mock mode, ephemeral keys).
+// Tests are hermetic — they must not pick up a developer's local .env (which may
+// set PAYMENT_MODE=gateway, real creds, etc.). Everything else loads the root .env.
+if (process.env.NODE_ENV !== "test") {
+    loadDotenv({ path: join(REPO_ROOT, ".env") });
+}
+// Anchor the ledger to the repo root, not the current working directory — npm
+// workspaces change cwd per package, so a cwd-relative default would split the
+// ledger across folders. Uses REPO_ROOT (cwd-walked) for the same symlink-immune
+// reason as the .env load above.
+const DEFAULT_EVENTS_PATH = join(REPO_ROOT, "data/events.jsonl");
+const DEFAULT_OBSERVATIONS_PATH = join(REPO_ROOT, "data/observations.jsonl");
+const DEFAULT_PAYOUTS_PATH = join(REPO_ROOT, "data/payouts.jsonl");
+const DEFAULT_LICENSE_STORE = join(REPO_ROOT, "data/wayfarer-licenses.json");
+const DEFAULT_CREDITS_FIXTURES = join(REPO_ROOT, "examples/meridian/credits.json");
+const DEFAULT_SETTLEMENT_OUTBOX = join(REPO_ROOT, "data/settlement-outbox.jsonl");
+// Exported so config validation (e.g. the licensing superRefine) is unit-testable
+// without mutating process.env / the getConfig() singleton.
+export const configSchema = z.object({
+    // Payment rail. "mock" settles offline (no creds); "gateway" uses the real
+    // Circle Gateway batching SDK (needs a funded BUYER_PRIVATE_KEY).
+    PAYMENT_MODE: z.enum(["mock", "gateway"]).default("mock"),
+    // Settlement network — which Circle Gateway chain the gate tolls on. Selects the
+    // whole rail (x402 quote, settlement body, discovery manifest, buyer client, and
+    // the testnet-vs-mainnet facilitator) from one switch. Default arcTestnet so a
+    // misconfigured deploy settles on testnet, never silently on mainnet. See
+    // shared/networks.ts for the per-network constants.
+    SETTLEMENT_NETWORK: z.enum(["arcTestnet", "baseSepolia", "base"]).default("arcTestnet"),
+    // Circle Gateway. GATEWAY_API_URL overrides the facilitator endpoint; the
+    // testnet facilitator needs no key.
+    CIRCLE_API_KEY: z.string().optional(),
+    GATEWAY_API_URL: z.string().url().optional(),
+    // Relayer key for the Arc self-relay (memo) settlement path. Required ONLY when
+    // PAYMENT_MODE=gateway AND the active network ships the Memo predeploy (Arc) —
+    // on Base/Base Sepolia the rail is Circle Gateway and this is unused. The relayer
+    // is an EOA (the Memo precompile is EOA-only) that signs the OUTER tx and pays gas
+    // (native USDC on Arc, an operating cost); it NEVER touches the transferred funds
+    // (buyer→author by the buyer's EIP-3009 authorization). Custody-free holds. A
+    // settle-time guard (not boot) errors clearly if it's missing on a memo network.
+    RELAYER_PRIVATE_KEY: z.string().optional(),
+    // Override the Arc USDC EIP-712 domain `name` if it is ever not the standard
+    // "USD Coin" (PREFLIGHT: confirm against the on-chain name() before real settle).
+    USDC_EIP712_NAME: z.string().optional(),
+    // Validity window (seconds) we advertise in the x402 quote (validBefore = now +
+    // this). Circle's Gateway facilitator rejects `verify` unless the REMAINING
+    // validity at verify time is >= 7 days (604800s). The SDK client clamps short
+    // windows up, but a non-SDK buyer that trusts our advertised value verbatim
+    // fails `authorization_validity_too_short` if it is below the floor. Default 8
+    // days = ~1 day of margin over the floor for signing->verify latency + clock
+    // skew. Keep it >= 604900 (floor + the SDK's 100s buffer) — enforced below so a
+    // future edit can't silently re-arm the 4d footgun this fix removed.
+    X402_MAX_TIMEOUT_SECONDS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(691_200)
+        .refine((v) => v >= 604_900, {
+        message: "must be >= 604900 (Circle Gateway's 7-day validity floor 604800 + the SDK's 100s buffer); below it a non-SDK buyer that signs our advertised window verbatim fails authorization_validity_too_short",
+    }),
+    // Tollgate
+    TOLLGATE_PORT: z.coerce.number().int().positive().default(8402),
+    // The site the gate sits in front of. Any publisher; not tied to one product.
+    ORIGIN_URL: z.string().url().default("http://localhost:3000"),
+    DEFAULT_PRICE_USDC: z.coerce.number().positive().default(0.001),
+    // Citation tolls cost this multiple of a single read (a citation has downstream
+    // reach — it grounds an answer many will see). Both resolve to the same author
+    // payees; only the price differs. 1 = price a citation the same as a read.
+    CITATION_MULTIPLIER: z.coerce.number().positive().default(5),
+    // Which path prefixes count as gateable articles (comma-separated).
+    ARTICLE_PATH_PREFIXES: z.string().default("essays,articles,posts"),
+    // ── Hardening ──
+    // HMAC secret that signs 402 payment nonces. If unset, the gate mints an
+    // ephemeral one at boot (fine for a single instance; set it for multi-instance
+    // or to keep outstanding nonces valid across restarts).
+    TOLLGATE_SECRET: z.string().optional(),
+    // How long an issued 402 nonce stays valid (seconds). Also the replay window.
+    NONCE_TTL_SECONDS: z.coerce.number().int().positive().default(300),
+    // Per-client request ceiling. 0 disables rate limiting. Sustained rate is
+    // RATE_LIMIT_RPM/min; short bursts up to RATE_LIMIT_BURST are absorbed.
+    RATE_LIMIT_RPM: z.coerce.number().int().nonnegative().default(120),
+    RATE_LIMIT_BURST: z.coerce.number().int().positive().default(40),
+    // Trust X-Forwarded-For for the client IP. Only enable behind a proxy you
+    // control — otherwise clients spoof their rate-limit identity. Default: off.
+    TRUST_PROXY: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+    // Web Bot Auth: allow http:// + loopback key directories so a LOCAL signer
+    // fixture can serve its directory from a loopback port. Test walks only —
+    // never enable in production (the directory URL is attacker-supplied).
+    BOT_AUTH_ALLOW_HTTP: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+    // Web Bot Auth SIGNING identity (slice 3 — the toll's own species marker).
+    // A base64url 32-byte Ed25519 seed (generate: scripts/wba-keygen.mjs). When
+    // set, the gate serves + self-signs the key directory at
+    // /.well-known/http-message-signatures-directory, and the wayfarer signs its
+    // outbound requests. Unset ⇒ both surfaces are dark (byte-identical traffic).
+    BOT_AUTH_SIGNING_KEY: z.string().optional(),
+    // The directory host the wayfarer advertises in Signature-Agent — it must
+    // actually serve OUR directory (e.g. "naulon.app"). An http://127.0.0.1:port
+    // form is a local-walk fixture (needs the verifying gate's BOT_AUTH_ALLOW_HTTP).
+    BOT_AUTH_SIGNATURE_AGENT: z.string().optional(),
+    // Credits resolution — how the gate maps an article to its author(s).
+    // If CREDITS_API_URL is set, the gate fetches `${url}/credits/:slug`.
+    // Otherwise it reads a local JSON fixture (CREDITS_FIXTURES).
+    CREDITS_API_URL: z.string().url().optional(),
+    CREDITS_API_TOKEN: z.string().optional(),
+    CREDITS_FIXTURES: z.string().default(DEFAULT_CREDITS_FIXTURES),
+    // Shared HMAC secret for the naulon → publisher settlement emit (POST
+    // ${ORIGIN_URL}/api/credits/settlement). Must match the publisher's value. When
+    // unset the emit is dark — the gate still tolls and serves; it just doesn't
+    // report earnings (keeps the no-creds mock loop working, per hard rule).
+    CREDITS_SETTLEMENT_SECRET: z.string().optional(),
+    // Crash-safe at-least-once delivery for the settlement emit. The hot path
+    // tries once; a background drain re-sends anything not yet acked. The outbox
+    // is an append-only log of acked event ids — durable across restarts, and
+    // only an optimization (a lost outbox just re-POSTs, which IA dedupes).
+    SETTLEMENT_OUTBOX_PATH: z.string().default(DEFAULT_SETTLEMENT_OUTBOX),
+    // Bounded retry budget per event inside the drain (the hot path is always 1).
+    SETTLEMENT_MAX_ATTEMPTS: z.coerce.number().int().positive().default(5),
+    // Per-attempt POST timeout (ms) — a hung IA must never stall the gate.
+    SETTLEMENT_TIMEOUT_MS: z.coerce.number().int().positive().default(4000),
+    // How often the background drain sweeps for unacked events. 0 disables it
+    // (e.g. serverless, where a cron drives the drain instead of a live loop).
+    SETTLEMENT_DRAIN_INTERVAL_MS: z.coerce.number().int().nonnegative().default(60_000),
+    // Wayfarer
+    BUYER_ADDRESS: z.string().optional(),
+    BUYER_PRIVATE_KEY: z.string().optional(),
+    WAYFARER_BUDGET_USDC: z.coerce.number().positive().default(0.1),
+    // BUY-1.4 pay-path hardening. The buyer prices then pays in two separate requests,
+    // so the toll can move between them. The MCP re-quotes at pay time and aborts if the
+    // live total tops the quoted total by more than this tolerance (basis points). 0 =
+    // strict: abort on ANY increase over the quoted total (the budget-safe default; a
+    // price DROP is always fine). Raise it only to absorb known small price drift.
+    WAYFARER_TOLL_TOLERANCE_BPS: z.coerce.number().int().nonnegative().default(0),
+    // Floor (seconds) on the buyer's EIP-3009 validity window, stamped at pay time. If a
+    // gate advertises a too-short maxTimeoutSeconds, the signed authorization could expire
+    // before the relayer submits it (`authorization_validity_too_short`). The window only
+    // widens to this floor, never shrinks. See memory `x402-validity-window-floor`.
+    WAYFARER_MIN_VALIDITY_SECONDS: z.coerce.number().int().positive().default(60),
+    // BUY-3 policy engine (server-config, never LLM-controlled). All optional — unset
+    // ⇒ DEFAULT_POLICY. The MCP folds these into the DecisionPolicy it hands run().
+    //   *_DOMAINS: comma-separated publisher hosts. ALLOW is an allowlist (deny-by-
+    //   default for anything not listed); DENY always wins. CAP: max pays per host.
+    //   APPROVAL_USDC: a toll at/above this becomes an "approve" (human gate), not a
+    //   pay. KILL_SWITCH: halt all new spend (free re-reads of held licenses still ok).
+    // Parse to a non-empty host list, or `undefined` when blank/malformed (e.g. ","):
+    // a garbled value must read as "unset" (no restriction), never as an empty
+    // allowlist that would silently skip every essay.
+    WAYFARER_ALLOW_DOMAINS: z
+        .string()
+        .optional()
+        .transform((v) => {
+        const hosts = v ? v.split(",").map((s) => s.trim()).filter(Boolean) : [];
+        return hosts.length ? hosts : undefined;
+    }),
+    WAYFARER_DENY_DOMAINS: z
+        .string()
+        .optional()
+        .transform((v) => {
+        const hosts = v ? v.split(",").map((s) => s.trim()).filter(Boolean) : [];
+        return hosts.length ? hosts : undefined;
+    }),
+    WAYFARER_PER_DOMAIN_CAP: z.coerce.number().int().positive().optional(),
+    WAYFARER_APPROVAL_USDC: z.coerce.number().positive().optional(),
+    WAYFARER_KILL_SWITCH: z
+        .string()
+        .default("false")
+        .transform((v) => v === "true" || v === "1"),
+    OPENAI_API_KEY: z.string().optional(),
+    // USDC the agent deposits into the Gateway Wallet at the start of a run.
+    DEPOSIT_AMOUNT_USDC: z.string().default("1"),
+    // The tollgate the agent pays. Defaults to the local tollgate.
+    TOLLGATE_URL: z.string().url().optional(),
+    // Where the agent discovers candidate essays (a catalog of {slug,title,summary}).
+    CATALOG_URL: z.string().url().optional(),
+    // RSS/sitemap discovery. If set, the agent discovers from the publisher's live
+    // feed instead of a CATALOG_URL. Precedence: RSS_URL > PUBLISHER_URL > CATALOG_URL
+    // > bundled demo. rssSource reads ${PUBLISHER_URL}/rss.xml unless RSS_URL overrides.
+    PUBLISHER_URL: z.string().url().optional(),
+    RSS_URL: z.string().url().optional(),
+    // Optional — fills slug coverage RSS truncates (latest-N). Unused until sitemap
+    // parsing lands; reserved here so the seam is config-complete.
+    SITEMAP_URL: z.string().url().optional(),
+    // Where the agent caches Citation Licenses it has been issued, so a live one
+    // lets it re-read an essay free instead of paying again (across runs).
+    WAYFARER_LICENSE_PATH: z.string().default(DEFAULT_LICENSE_STORE),
+    // Dashboard
+    DASHBOARD_PORT: z.coerce.number().int().positive().default(8403),
+    // Interface the dashboard binds. Defaults to localhost: the earnings view has
+    // no built-in auth and exposes author wallets + USD, so it must not face the
+    // public internet directly. Set "0.0.0.0" only behind your own auth (reverse
+    // proxy, access gateway). See README "Dashboard exposure".
+    DASHBOARD_BIND: z.string().default("127.0.0.1"),
+    // ── Storage backend ──
+    // Where attributed events live. "jsonl" = an append-only local file (default,
+    // no creds — great for dev/demo and a single-box deploy). "supabase" = a
+    // Postgres table over Supabase's REST API, for serverless / multi-instance
+    // hosts (e.g. Vercel) that have no shared disk. Same `EventSink` seam either way.
+    EVENTS_BACKEND: z.enum(["jsonl", "supabase"]).default("jsonl"),
+    // Where spent 402 nonces are remembered (replay protection). "memory" =
+    // in-process (default; correct for a single instance). "supabase" = a shared
+    // table, so replay protection holds across many serverless instances.
+    NONCE_BACKEND: z.enum(["memory", "supabase"]).default("memory"),
+    // Where buyer-authorized EXTRA settlement legs await their deferred on-chain settle
+    // (the operator/co-author legs beyond the synchronous author leg). "memory" =
+    // in-process (default; correct for a single instance / mock dev). "supabase" = a
+    // shared table the deferred-settle drain reads, so pending authorizations survive a
+    // restart and settle exactly-once across instances. Same PendingLegSink seam either way.
+    PENDING_LEGS_BACKEND: z.enum(["memory", "supabase"]).default("memory"),
+    // Supabase project — only needed when a *_BACKEND above is "supabase". The
+    // service-role key is a secret; keep it in .env, never in the repo.
+    SUPABASE_URL: z.string().url().optional(),
+    SUPABASE_SERVICE_KEY: z.string().optional(),
+    SUPABASE_EVENTS_TABLE: z.string().default("naulon_events"),
+    SUPABASE_NONCES_TABLE: z.string().default("naulon_nonces"),
+    SUPABASE_PENDING_LEGS_TABLE: z.string().default("naulon_pending_legs"),
+    SUPABASE_REVOCATIONS_TABLE: z.string().default("naulon_revocations"),
+    // Where gated-request OBSERVATIONS go (the audit/observability plane — who was
+    // served free / denied / paid). "off" (default) records nothing, so the open
+    // core keeps its zero-overhead, nothing-stored posture; "jsonl" = a local file
+    // (dev); "supabase" = a shared table a multi-tenant embedder reads for its audit
+    // UI. Separate from EVENTS_BACKEND on purpose: observations are higher-volume,
+    // lower-value, and TTL'd, so a deploy may want them in a different place (or off).
+    OBSERVATIONS_BACKEND: z.enum(["off", "jsonl", "supabase"]).default("off"),
+    SUPABASE_OBSERVATIONS_TABLE: z.string().default("naulon_observations"),
+    // ── Citation License Tokens (CLT) ──
+    // Signed receipts handed to a paying agent (see docs/citation-license.md).
+    // On by default — they're additive (an extra response header) and the offline
+    // path mints with an ephemeral key. A STABLE key is required (below) for real
+    // payments or a supabase/multi-instance deploy.
+    LICENSES_ENABLED: z
+        .enum(["true", "false"])
+        .default("true")
+        .transform((v) => v === "true"),
+    // Ed25519 private key (PKCS8 PEM or base64 DER) that signs licenses. SECRET.
+    // Leave unset only for single-instance mock/dev (ephemeral key + boot warning).
+    LICENSE_SIGNING_KEY: z.string().optional(),
+    // Re-read window for a license, seconds. A CLT is an unrevocable bearer
+    // credential on the offline tier, so the TTL is the kill switch — kept short.
+    LICENSE_TTL_SECONDS: z.coerce.number().int().positive().default(600),
+    // Issuer/audience string; defaults to `naulon:<gate host>` derived at runtime.
+    LICENSE_ISSUER: z.string().optional(),
+    // Embed the full payees graph (transparent, default) or just a hash + primary.
+    LICENSE_PAYEES_MODE: z.enum(["full", "hashed"]).default("full"),
+    // Consult the jti revocation seam on the online verify tier (P2). Off = the
+    // offline JWKS tier only (exp-bounded). Needs shared state when on.
+    LICENSE_ONLINE_CHECK: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+    // Holder-of-key (P5): mint licenses bound to the payer wallet (RFC 7800 cnf),
+    // and require a proof-of-possession (an EIP-191 wallet signature) on re-read.
+    // Off by default — v1 licenses are short-TTL bearer tokens; turn this on to
+    // close leak-replay (a captured token is then useless without the wallet key).
+    // Needs a signing-capable buyer wallet (BUYER_PRIVATE_KEY, or the dev key on
+    // the mock path) — the demo loop is unaffected while this is off.
+    LICENSE_POP: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+    // Freshness window (seconds) for a proof-of-possession: the gate accepts a
+    // proof whose timestamp is within ±this of its clock, and remembers the proof
+    // nonce for this long to stop replay. Shorter = tighter replay window; longer
+    // = more clock-skew tolerance across instances.
+    LICENSE_POP_WINDOW_SECONDS: z.coerce.number().int().positive().default(120),
+    // Shared event ledger (jsonl backend). Tollgate appends here; dashboard +
+    // attribution read it.
+    EVENTS_PATH: z.string().default(DEFAULT_EVENTS_PATH),
+    // Observation ledger (jsonl backend). Tollgate appends; the audit plane reads.
+    OBSERVATIONS_PATH: z.string().default(DEFAULT_OBSERVATIONS_PATH),
+    // Attribution & settlement.
+    PAYOUTS_PATH: z.string().default(DEFAULT_PAYOUTS_PATH),
+    // Don't settle a wallet until its accrued tolls reach this — amortizes the
+    // per-transfer overhead across many sub-cent reads. Below it, carry forward.
+    MIN_PAYOUT_USDC: z.coerce.number().positive().default(0.005),
+    // How the single on-chain recipient is chosen when two co-authors tie for the
+    // top share. "wallet" (default) breaks ties by address, so who gets the on-chain
+    // leg is a pure function of who's credited — a reordered credits graph can't move
+    // it. "input" keeps the credits-graph order. The full split is recorded either way.
+    PRIMARY_PAYEE_TIEBREAK: z.enum(["wallet", "input"]).default("wallet"),
+    // Pay co-authors directly on-chain (split-at-source) for multi-author articles
+    // instead of routing the whole toll to the primary author. OFF by default → the
+    // stock single-recipient toll (the rest of the split is recorded for the publisher
+    // to reconcile off-protocol). ON → the primary's content-gating leg drops to its
+    // own share and each other co-author gets a direct deferred buyer→author leg
+    // (custody-free). Sets `PublisherConfig.coauthorSplit` for the single-tenant gate;
+    // a multi-tenant resolver decides this per publisher instead.
+    COAUTHOR_ONCHAIN_SPLIT: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+}).superRefine((cfg, ctx) => {
+    // A "supabase" backend is useless without the project creds — fail loud at
+    // boot, not mid-payment, naming exactly what's missing.
+    const usesSupabase = cfg.EVENTS_BACKEND === "supabase" ||
+        cfg.NONCE_BACKEND === "supabase" ||
+        cfg.PENDING_LEGS_BACKEND === "supabase" ||
+        cfg.OBSERVATIONS_BACKEND === "supabase";
+    if (usesSupabase) {
+        for (const key of ["SUPABASE_URL", "SUPABASE_SERVICE_KEY"]) {
+            if (!cfg[key]) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [key],
+                    message: `required when EVENTS_BACKEND, NONCE_BACKEND or OBSERVATIONS_BACKEND is "supabase"`,
+                });
+            }
+        }
+    }
+    // A CLT is a reusable, externally-verified token, so an ephemeral signing key
+    // is only safe on a single-instance mock box. Require a stable key once real
+    // money moves or any shared (supabase) backend / multi-instance is in play —
+    // otherwise JWKS and the paid re-read go non-deterministic across instances.
+    const needsStableKey = cfg.LICENSES_ENABLED && (cfg.PAYMENT_MODE !== "mock" || usesSupabase);
+    if (needsStableKey && !cfg.LICENSE_SIGNING_KEY) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["LICENSE_SIGNING_KEY"],
+            message: "required (stable Ed25519 key) when licensing is on with real payments or a supabase backend — " +
+                "ephemeral keys break verification across instances. See docs/citation-license.md.",
+        });
+    }
+    if (cfg.LICENSE_TTL_SECONDS > 3600) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["LICENSE_TTL_SECONDS"],
+            message: "must be <= 3600: a CLT is an unrevocable bearer credential on the offline tier, so a short TTL is the kill switch.",
+        });
+    }
+    if (cfg.LICENSE_POP_WINDOW_SECONDS > 600) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["LICENSE_POP_WINDOW_SECONDS"],
+            message: "must be <= 600: the proof-of-possession window is a replay window — keep it tight (it only needs to cover clock skew + one round trip).",
+        });
+    }
+});
+let cached;
+export function getConfig() {
+    if (cached)
+        return cached;
+    const parsed = configSchema.safeParse(process.env);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((i) => `  ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`Invalid environment:\n${issues}\nSee .env.example.`);
+    }
+    cached = parsed.data;
+    return cached;
+}
+/**
+ * Drop the memoized config so the next `getConfig()` re-reads `process.env`.
+ * A test seam for the env-dependent branches the singleton otherwise freezes
+ * (e.g. the Circle-key settlement guard) — not for production hot-reload.
+ */
+export function resetConfig() {
+    cached = undefined;
+}
+/** Assert a set of keys are present (call at a component's boot once it knows what it needs). */
+export function requireKeys(cfg, keys) {
+    const missing = keys.filter((k) => cfg[k] === undefined || cfg[k] === "");
+    if (missing.length) {
+        throw new Error(`Missing required env: ${missing.join(", ")}. See .env.example.`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,gFAAgF;AAChF,qEAAqE;AACrE,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,SAAS,YAAY;IACnB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AACD,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;AAEjC,iFAAiF;AACjF,gFAAgF;AAChF,uEAAuE;AACvE,iFAAiF;AACjF,oFAAoF;AACpF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,iCAAiC;AACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACjE,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;AAC7E,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AACnE,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;AAC7E,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;AACnF,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;AAElF,kFAAkF;AAClF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,2EAA2E;IAC3E,kEAAkE;IAClE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEzD,iFAAiF;IACjF,iFAAiF;IACjF,+EAA+E;IAC/E,0EAA0E;IAC1E,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAEvF,0EAA0E;IAC1E,oCAAoC;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE5C,gFAAgF;IAChF,+EAA+E;IAC/E,kFAAkF;IAClF,mFAAmF;IACnF,kFAAkF;IAClF,8EAA8E;IAC9E,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,6EAA6E;IAC7E,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,qEAAqE;IACrE,wBAAwB,EAAE,CAAC,CAAC,MAAM;SAC/B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE;QAC3B,OAAO,EACL,qMAAqM;KACxM,CAAC;IAEJ,WAAW;IACX,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/D,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC7D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,gFAAgF;IAChF,+EAA+E;IAC/E,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAElE,kBAAkB;IAClB,yEAAyE;IACzE,+EAA+E;IAC/E,wDAAwD;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAClE,0EAA0E;IAC1E,wEAAwE;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAClE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,0EAA0E;IAC1E,6EAA6E;IAC7E,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;IACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;IACjC,2EAA2E;IAC3E,4EAA4E;IAC5E,yDAAyD;IACzD,6EAA6E;IAC7E,8EAA8E;IAC9E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,0EAA0E;IAC1E,6EAA6E;IAC7E,iFAAiF;IACjF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,sEAAsE;IACtE,sEAAsE;IACtE,8DAA8D;IAC9D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC9D,sEAAsE;IACtE,gFAAgF;IAChF,4EAA4E;IAC5E,yEAAyE;IACzE,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC;IACrE,8EAA8E;IAC9E,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,4BAA4B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnF,WAAW;IACX,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/D,mFAAmF;IACnF,qFAAqF;IACrF,mFAAmF;IACnF,kFAAkF;IAClF,+EAA+E;IAC/E,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,qFAAqF;IACrF,uFAAuF;IACvF,sFAAsF;IACtF,gFAAgF;IAChF,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,kFAAkF;IAClF,2EAA2E;IAC3E,kDAAkD;IAClD,sBAAsB,EAAE,CAAC;SACtB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC,CAAC;IACJ,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC,CAAC;IACJ,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,yEAAyE;IACzE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5C,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,+EAA+E;IAC/E,mFAAmF;IACnF,qFAAqF;IACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,gFAAgF;IAChF,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,6EAA6E;IAC7E,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAEhE,YAAY;IACZ,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAE/C,wBAAwB;IACxB,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/D,oFAAoF;IACpF,8EAA8E;IAC9E,iFAAiF;IACjF,oFAAoF;IACpF,yFAAyF;IACzF,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACtE,2EAA2E;IAC3E,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IAC1D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;IAC1D,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACpE,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,mFAAmF;IACnF,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzE,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAEtE,sCAAsC;IACtC,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,gDAAgD;IAChD,gBAAgB,EAAE,CAAC;SAChB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,MAAM,CAAC;SACf,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;IACjC,6EAA6E;IAC7E,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,wEAAwE;IACxE,8EAA8E;IAC9E,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACpE,+EAA+E;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/D,4EAA4E;IAC5E,oEAAoE;IACpE,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;IACjC,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,kEAAkE;IAClE,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;IACjC,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,gDAAgD;IAChD,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAE3E,0EAA0E;IAC1E,uBAAuB;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpD,+EAA+E;IAC/E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAEhE,4BAA4B;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5D,8EAA8E;IAC9E,iFAAiF;IACjF,kFAAkF;IAClF,oFAAoF;IACpF,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACrE,+EAA+E;IAC/E,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,6EAA6E;IAC7E,mFAAmF;IACnF,8DAA8D;IAC9D,sBAAsB,EAAE,CAAC;SACtB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,OAAO,CAAC,OAAO,CAAC;SAChB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;CAClC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1B,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,YAAY,GAChB,GAAG,CAAC,cAAc,KAAK,UAAU;QACjC,GAAG,CAAC,aAAa,KAAK,UAAU;QAChC,GAAG,CAAC,oBAAoB,KAAK,UAAU;QACvC,GAAG,CAAC,oBAAoB,KAAK,UAAU,CAAC;IAC1C,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAU,EAAE,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACd,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,mFAAmF;iBAC7F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,cAAc,GAClB,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;IACxE,IAAI,cAAc,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EACL,gGAAgG;gBAChG,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,GAAG,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EACL,oHAAoH;SACvH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,0BAA0B,GAAG,GAAG,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,4BAA4B,CAAC;YACpC,OAAO,EACL,yIAAyI;SAC5I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,IAAI,MAA0B,CAAC;AAE/B,MAAM,UAAU,SAAS;IACvB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,qBAAqB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAsB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/credits.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Credits-graph validation now lives in @naulon/sdk — the one place the
+ * money-routing trust boundary's schema is defined. Re-exported here so existing
+ * `@naulon/shared` importers (and `shared/index.ts`'s barrel) are unchanged.
+ */
+export { creditsSchema, parseCredits, buildCredits } from "@naulon/sdk";
+//# sourceMappingURL=credits.d.ts.map

package/dist/credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits.d.ts","sourceRoot":"","sources":["../src/credits.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/credits.js

@@ -0,0 +1,7 @@
+/**
+ * Credits-graph validation now lives in @naulon/sdk — the one place the
+ * money-routing trust boundary's schema is defined. Re-exported here so existing
+ * `@naulon/shared` importers (and `shared/index.ts`'s barrel) are unchanged.
+ */
+export { creditsSchema, parseCredits, buildCredits } from "@naulon/sdk";
+//# sourceMappingURL=credits.js.map

package/dist/credits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits.js","sourceRoot":"","sources":["../src/credits.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/eip3009.d.ts

@@ -0,0 +1,69 @@
+/**
+ * EIP-3009 (`transferWithAuthorization`) protocol descriptor — the SDK-free, pure-data
+ * definition of a USDC EIP-3009 authorization and the EIP-712 domain it is signed
+ * against. Both sides of the memo self-relay rail consume this single source of truth:
+ * the BUYER signs against it (wayfarer), the GATE verifies against it (tollgate). The
+ * viem signing/recovery act stays in each consumer — each already depends on viem; this
+ * file must not, so `shared` stays dependency-light (it is imported by the cloud control
+ * plane too).
+ *
+ * This is the sibling of `networks.ts` `gatewayExtra` (the GatewayWallet EIP-712 domain):
+ * same pattern — the protocol descriptor lives in `shared`, the crypto lives in the
+ * consumer. Keep them adjacent.
+ */
+import type { SettlementNetwork } from "./networks.ts";
+/** The buyer's EIP-3009 authorization — the exact `{from,to,value,validAfter,
+ *  validBefore,nonce}` message they sign, identical in shape to the Gateway payload's
+ *  `authorization` (only the EIP-712 DOMAIN they sign it against differs: the USDC
+ *  token here vs the GatewayWallet contract in batched mode). */
+export interface MemoAuthorization {
+    from: `0x${string}`;
+    to: `0x${string}`;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: `0x${string}`;
+}
+/** EIP-712 typed-data type for the EIP-3009 transfer authorization (what the buyer
+ *  signs against the USDC domain, and what the gate recovers the signer from). */
+export declare const TRANSFER_WITH_AUTHORIZATION_TYPES: {
+    readonly TransferWithAuthorization: readonly [{
+        readonly name: "from";
+        readonly type: "address";
+    }, {
+        readonly name: "to";
+        readonly type: "address";
+    }, {
+        readonly name: "value";
+        readonly type: "uint256";
+    }, {
+        readonly name: "validAfter";
+        readonly type: "uint256";
+    }, {
+        readonly name: "validBefore";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+    }];
+};
+/** The USDC EIP-712 domain name/version — LAST-RESORT fallback only. The real values
+ *  live per-network on `SettlementNetwork.usdcName`/`usdcVersion` (verified on-chain,
+ *  e.g. Arc testnet = "USDC"/"2", NOT this mainnet FiatToken default), and the
+ *  `USDC_EIP712_NAME` env var overrides everything. PREFLIGHT before the first real
+ *  settle on a new network: confirm `name()` on its USDC contract matches the domain —
+ *  a mismatch makes both the off-chain pre-verify AND the on-chain
+ *  `transferWithAuthorization` reject a valid signature, with a confusing "signer != from".
+ *  (`make arc-preflight` does this check.) */
+export declare const USDC_EIP712_NAME = "USD Coin";
+export declare const USDC_EIP712_VERSION = "2";
+/** Resolve the USDC EIP-712 domain: env override → per-network verified value → the
+ *  mainnet-FiatToken fallback. Never trusts the fallback for a network that declares
+ *  its own (Arc), so the default path signs correctly with no env required. */
+export declare function usdcDomain(net: SettlementNetwork, nameOverride?: string): {
+    readonly name: string;
+    readonly version: string;
+    readonly chainId: number;
+    readonly verifyingContract: `0x${string}`;
+};
+//# sourceMappingURL=eip3009.d.ts.map

package/dist/eip3009.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip3009.d.ts","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;iEAGiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;IACpB,EAAE,EAAE,KAAK,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;CACtB;AAED;kFACkF;AAClF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;CASpC,CAAC;AAEX;;;;;;;8CAO8C;AAC9C,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAC3C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;+EAE+E;AAC/E,wBAAgB,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,MAAM;;;;;EAOvE"}

package/dist/eip3009.js

@@ -0,0 +1,34 @@
+/** EIP-712 typed-data type for the EIP-3009 transfer authorization (what the buyer
+ *  signs against the USDC domain, and what the gate recovers the signer from). */
+export const TRANSFER_WITH_AUTHORIZATION_TYPES = {
+    TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" },
+    ],
+};
+/** The USDC EIP-712 domain name/version — LAST-RESORT fallback only. The real values
+ *  live per-network on `SettlementNetwork.usdcName`/`usdcVersion` (verified on-chain,
+ *  e.g. Arc testnet = "USDC"/"2", NOT this mainnet FiatToken default), and the
+ *  `USDC_EIP712_NAME` env var overrides everything. PREFLIGHT before the first real
+ *  settle on a new network: confirm `name()` on its USDC contract matches the domain —
+ *  a mismatch makes both the off-chain pre-verify AND the on-chain
+ *  `transferWithAuthorization` reject a valid signature, with a confusing "signer != from".
+ *  (`make arc-preflight` does this check.) */
+export const USDC_EIP712_NAME = "USD Coin";
+export const USDC_EIP712_VERSION = "2";
+/** Resolve the USDC EIP-712 domain: env override → per-network verified value → the
+ *  mainnet-FiatToken fallback. Never trusts the fallback for a network that declares
+ *  its own (Arc), so the default path signs correctly with no env required. */
+export function usdcDomain(net, nameOverride) {
+    return {
+        name: nameOverride ?? net.usdcName ?? USDC_EIP712_NAME,
+        version: net.usdcVersion ?? USDC_EIP712_VERSION,
+        chainId: net.chainId,
+        verifyingContract: net.usdc,
+    };
+}
+//# sourceMappingURL=eip3009.js.map

package/dist/eip3009.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip3009.js","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AA4BA;kFACkF;AAClF,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACO,CAAC;AAEX;;;;;;;8CAO8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;+EAE+E;AAC/E,MAAM,UAAU,UAAU,CAAC,GAAsB,EAAE,YAAqB;IACtE,OAAO;QACL,IAAI,EAAE,YAAY,IAAI,GAAG,CAAC,QAAQ,IAAI,gBAAgB;QACtD,OAAO,EAAE,GAAG,CAAC,WAAW,IAAI,mBAAmB;QAC/C,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,iBAAiB,EAAE,GAAG,CAAC,IAAI;KACnB,CAAC;AACb,CAAC"}

package/dist/eventsink.d.ts

@@ -0,0 +1,19 @@
+import type { AttributedEvent, EventSink } from "./types.ts";
+export declare function jsonlSink(path?: string): EventSink;
+/**
+ * Supabase-backed sink. Each event is stored as one row: its `id` (primary key,
+ * so a retried write is idempotent), its `at` timestamp (indexed, for ordering),
+ * and the whole `AttributedEvent` as a jsonb `data` column — so `readAll` hands
+ * back the exact shape the writer stored, with no field-by-field mapping to drift.
+ * This is the backend to use on serverless/multi-instance hosts with no shared disk.
+ */
+export declare function supabaseSink(): EventSink;
+/**
+ * Pick the EventSink the config asks for. JSONL file by default (offline, no
+ * creds); Supabase when EVENTS_BACKEND=supabase. Callers use this instead of
+ * naming a sink directly, so switching backends is one env var.
+ */
+export declare function getSink(): EventSink;
+/** In-memory sink, handy for tests. */
+export declare function memorySink(seed?: AttributedEvent[]): EventSink;
+//# sourceMappingURL=eventsink.d.ts.map

package/dist/eventsink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventsink.d.ts","sourceRoot":"","sources":["../src/eventsink.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7D,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAqClD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,SAAS,CA4BxC;AAED;;;;GAIG;AACH,wBAAgB,OAAO,IAAI,SAAS,CAEnC;AAED,uCAAuC;AACvC,wBAAgB,UAAU,CAAC,IAAI,GAAE,eAAe,EAAO,GAAG,SAAS,CAalE"}