@naulon/shared 0.0.1

package/dist/supabase.js

@@ -0,0 +1,47 @@
+/**
+ * A tiny Supabase client — just `fetch` against PostgREST, no SDK.
+ *
+ * We deliberately avoid `@supabase/supabase-js`: the only Supabase features the
+ * toll needs are "insert a row" and "select rows", both of which PostgREST
+ * exposes directly at `${SUPABASE_URL}/rest/v1/<table>`. Skipping the SDK keeps
+ * the dependency tree flat, leaves the offline (jsonl/memory) path with nothing
+ * extra to install, and runs unchanged on any runtime (Node or edge).
+ *
+ * Auth uses the service-role key in both `apikey` and `Authorization` — this
+ * runs server-side only (tollgate/dashboard/attribution), never in a browser.
+ */
+import { getConfig } from "./config.js";
+function creds() {
+    const cfg = getConfig();
+    if (!cfg.SUPABASE_URL || !cfg.SUPABASE_SERVICE_KEY) {
+        throw new Error("Supabase backend selected but SUPABASE_URL / SUPABASE_SERVICE_KEY are unset. See .env.example.");
+    }
+    return { url: cfg.SUPABASE_URL.replace(/\/$/, ""), key: cfg.SUPABASE_SERVICE_KEY };
+}
+/**
+ * Call the Supabase REST (PostgREST) API and return the parsed JSON body.
+ * Throws on any non-2xx so callers fail loud rather than silently losing a
+ * write. `path` is everything after the project URL, e.g.
+ * `/rest/v1/naulon_events?select=data&order=at.asc`.
+ */
+export async function supabaseRest(path, init = {}) {
+    const { url, key } = creds();
+    const res = await fetch(`${url}${path}`, {
+        ...init,
+        headers: {
+            apikey: key,
+            authorization: `Bearer ${key}`,
+            "content-type": "application/json",
+            ...init.headers,
+        },
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`Supabase ${init.method ?? "GET"} ${path} failed: ${res.status} ${body}`);
+    }
+    if (res.status === 204)
+        return [];
+    const text = await res.text();
+    return text ? JSON.parse(text) : [];
+}
+//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,SAAS,KAAK;IACZ,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAoB,EAAE;IACrE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;QACvC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,cAAc,EAAE,kBAAkB;YAClC,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Core domain types shared across the four naulon components.
+ *
+ * The thesis in one type: an attributed read/citation event resolves to one or
+ * more author wallets, each owed a fraction of the toll. Attribution metadata
+ * *is* the payout rule.
+ */
+import { walletAddress } from "@naulon/sdk";
+import type { WalletAddress, ArticleCredits, Contributor, CreditsResolver } from "@naulon/sdk";
+export { walletAddress };
+export type { WalletAddress, ArticleCredits, Contributor, CreditsResolver };
+/** USDC amount in whole-token units (e.g. 0.001 = one tenth of a cent). */
+export type Usdc = number & {
+    readonly __brand: "Usdc";
+};
+/** Gateway nanopayment floor. Amounts below this can't settle. */
+export declare const USDC_FLOOR: Usdc;
+export declare function usdc(value: number): Usdc;
+/** A reason a request must pay — what kind of machine consumption happened. */
+export type TollKind = "read" | "citation";
+/**
+ * An author and the share of a toll they are owed.
+ * `share` is a fraction in [0, 1]; shares across a split sum to 1.
+ */
+export interface AuthorShare {
+    authorId: string;
+    wallet: WalletAddress;
+    share: number;
+}
+/** A 402 payment requirement the tollgate hands an agent. */
+export interface PaymentRequirement {
+    slug: string;
+    kind: TollKind;
+    price: Usdc;
+    /** Where settlement lands — resolved author wallets + shares. */
+    payees: AuthorShare[];
+    /** Arc network coordinates the agent needs to construct payment. */
+    network: {
+        chainId: number;
+        usdc: WalletAddress;
+        gateway: string;
+    };
+    /** Opaque nonce the agent echoes back in its signed payment. */
+    nonce: string;
+}
+/**
+ * Where attributed events are written and read. JSONL today; swap for
+ * Supabase/Postgres by implementing this interface — callers (tollgate,
+ * attribution, dashboard) don't change. Mirrors the CreditsResolver seam.
+ */
+export interface EventSink {
+    record(event: AttributedEvent): Promise<void>;
+    /**
+     * Read events from the ledger. The optional `publisherId` filters to one
+     * publisher's events — an embedding seam a downstream resolver-based deploy can
+     * use to drain a single publisher in isolation. Omitted (the single-tenant
+     * default, and every OSS caller — dashboard, attribution) returns every event.
+     */
+    readAll(publisherId?: string): Promise<AttributedEvent[]>;
+    /**
+     * Fetch a single event by id (= a license `jti`). Backs `GET /licenses/:jti`
+     * without scanning the whole ledger — Supabase does a primary-key lookup;
+     * jsonl short-circuits on the first match. Returns undefined if not found.
+     */
+    get(id: string): Promise<AttributedEvent | undefined>;
+}
+/** A settled, attributed event — the row the dashboard reads. */
+export interface AttributedEvent {
+    id: string;
+    /**
+     * The publisher this event is attributed to — `PublisherConfig.id` (the default
+     * resolver's is `"default"`). Optional: an embedding seam a downstream
+     * resolver-based deploy uses to attribute earnings; the single-tenant core
+     * neither filters nor drains on it, and every existing ledger row stays valid.
+     */
+    publisherId?: string;
+    slug: string;
+    kind: TollKind;
+    amount: Usdc;
+    payees: AuthorShare[];
+    payerAddress: WalletAddress;
+    /** Gateway settlement / batch reference. */
+    settlementRef: string;
+    /** epoch ms — passed in by the caller (no ambient clock in shared code). */
+    at: number;
+}
+/**
+ * What happened to a gated request, for the observability/audit plane. Unlike
+ * `AttributedEvent` (which exists ONLY when money moved), an observation is
+ * emitted for every gated-route decision — including the ones that earn nothing:
+ * a crawler served free, an agent that got a 402 and walked away. That negative
+ * space ("who is reading/scraping me without paying") is the audit product; the
+ * settlement ledger structurally can't see it.
+ */
+export type ObservationVerdict = 
+/** Read free — a human, or a crawler the publisher allow-listed (e.g. search). */
+"served-free"
+/** An agent re-read on a valid, unexpired license (already paid earlier). */
+ | "agent-reread"
+/** An agent got a 402 and presented no payment — the "scrape attempt, blocked". */
+ | "denied"
+/** An agent the publisher explicitly blocked — refused 403, payment or not. */
+ | "blocked"
+/** An agent presented payment that failed verify/settle — never served. */
+ | "payment-failed"
+/** An agent paid; content served + license minted. Mirrors an `AttributedEvent`. */
+ | "paid";
+/**
+ * One gated-request observation. Telemetry only — it never gates a request or
+ * moves money; emitting it must never change a serving decision. Higher volume
+ * and lower value than `AttributedEvent`, so a sink is expected to TTL/sample it.
+ */
+export interface ObservationEvent {
+    /** uuid. */
+    id: string;
+    /** The publisher this request resolved to (`PublisherConfig.id`); optional like `AttributedEvent`. */
+    publisherId?: string;
+    /** The Host header the request came in on. */
+    host: string;
+    /** The article slug the gate priced (empty string for a non-article gated path). */
+    slug: string;
+    /** read | citation when the request reached the machine path; absent for a plain human read. */
+    kind?: TollKind;
+    verdict: ObservationVerdict;
+    /** The classifier's call — what the gate thought the caller was. */
+    classifiedAs: "human" | "agent";
+    /** Why the classifier ruled that way (e.g. which UA pattern matched). */
+    classifyReason?: string;
+    /** Raw User-Agent — the MVP identity basis (spoofable; Web Bot Auth supersedes it). */
+    agentUa?: string;
+    /** True when the caller's Web Bot Auth signature (RFC 9421/Ed25519) verified. */
+    verified?: boolean;
+    /** The verified operator's directory host (e.g. "chatgpt.com"), when verified. */
+    verifiedAgent?: string;
+    /**
+     * True when a signature was PRESENTED and failed verification — a masquerade
+     * attempt (or a badly broken signer), distinct from plain unsigned traffic.
+     */
+    sigInvalid?: boolean;
+    /** The quoted price (paid → settled; denied/payment-failed → what they'd have paid = "earnings missed"). */
+    price?: Usdc;
+    /** epoch ms — passed in by the caller (no ambient clock in shared code). */
+    at: number;
+}
+/**
+ * Where gated-request observations are written. A deliberate sibling of
+ * `EventSink` — same backend story (jsonl / supabase), same one-way seam — but
+ * write-only from the gate's side; the downstream audit BFF owns reads. Defaults
+ * to a no-op so the open core records nothing unless a deploy opts in.
+ */
+export interface ObservationSink {
+    record(observation: ObservationEvent): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,CAAC;AACzB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,kEAAkE;AAClE,eAAO,MAAM,UAAU,EAAe,IAAI,CAAC;AAE3C,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKxC;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,IAAI,CAAC;IACZ,iEAAiE;IACjE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1D;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,YAAY,EAAE,aAAa,CAAC;IAC5B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB;AAC5B,kFAAkF;AAChF,aAAa;AACf,6EAA6E;GAC3E,cAAc;AAChB,mFAAmF;GACjF,QAAQ;AACV,+EAA+E;GAC7E,SAAS;AACX,2EAA2E;GACzE,gBAAgB;AAClB,oFAAoF;GAClF,MAAM,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,oEAAoE;IACpE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC;IAChC,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4GAA4G;IAC5G,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD"}

package/dist/types.js

@@ -0,0 +1,22 @@
+/**
+ * Core domain types shared across the four naulon components.
+ *
+ * The thesis in one type: an attributed read/citation event resolves to one or
+ * more author wallets, each owed a fraction of the toll. Attribution metadata
+ * *is* the payout rule.
+ */
+// The wallet + credits contract primitives now live in @naulon/sdk (the
+// publisher SDK — one source of truth for the money-routing wire contract).
+// Imported for use in the gate-internal types below AND re-exported so every
+// existing `from "@naulon/shared"` import keeps resolving unchanged.
+import { walletAddress } from "@naulon/sdk";
+export { walletAddress };
+/** Gateway nanopayment floor. Amounts below this can't settle. */
+export const USDC_FLOOR = 0.000001;
+export function usdc(value) {
+    if (!Number.isFinite(value) || value < 0) {
+        throw new Error(`invalid USDC amount: ${value}`);
+    }
+    return value;
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,CAAC;AAMzB,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAgB,CAAC;AAE3C,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAa,CAAC;AACvB,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@naulon/shared",
+  "version": "0.0.1",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/naulonapp/naulon.git",
+    "directory": "packages/shared"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    },
+    "./attribution": {
+      "types": "./dist/attribution.d.ts",
+      "import": "./dist/attribution.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "test": "node --import tsx --test \"src/**/*.test.ts\""
+  },
+  "dependencies": {
+    "@naulon/sdk": "^0.1.0",
+    "dotenv": "^17.4.2",
+    "zod": "^4.4.3"
+  }
+}