@shunt-network/verify 0.0.0-stage → 1.0.1

package/README.md

@@ -1,3 +1,275 @@
-# Temporary Holding Version
+# @shunt-network/verify
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Verify that incoming requests to your API really came through the **Shunt gateway** and were paid for.
+
+Shunt is a payment gateway and marketplace for AI agents on Solana. When an agent calls your tool, the gateway verifies the agent's USDC payment-channel voucher and then forwards the request to your API. Every forwarded request is **signed**. This package checks that signature, so nobody can skip the paywall by hitting your endpoint directly with `curl` or Postman.
+
+- Zero runtime dependencies (only `node:crypto`)
+- Works with Express, Next.js (App Router), Hono, Cloudflare Workers, Deno and Supabase Edge Functions
+- Replay protection, timestamp window, constant-time comparison
+- Supports two active secrets for painless rotation
+
+---
+
+## Install
+
+```bash
+npm install @shunt-network/verify
+```
+
+Deno / Supabase Edge Functions:
+
+```ts
+import { verifyShunt } from "npm:@shunt-network/verify@0.1.0";
+```
+
+---
+
+## How it works
+
+1. You list your API on Shunt. Shunt gives you a **signing secret** (`shunt_whsec_...`), shown once in the dashboard.
+2. For every paid call, the gateway adds these headers to the forwarded request:
+
+| Header | Meaning |
+|---|---|
+| `x-shunt-timestamp` | Unix time (seconds) when the gateway signed the request |
+| `x-shunt-request-id` | Unique ID for this call |
+| `x-shunt-signature` | `v1=<hex HMAC-SHA256>` |
+| `x-shunt-agent` | Agent wallet address. **Informational only, not covered by the signature** |
+
+3. The signature is an HMAC-SHA256, using your secret, over:
+
+```
+v1
+{timestamp}
+{request_id}
+{METHOD}
+{path_and_query}
+{sha256_hex(raw_body)}
+```
+
+(joined with `\n`). Because the method, path, query and body hash are all signed, a request can't be modified or replayed against a different endpoint.
+
+4. This package recomputes the signature and rejects the request if anything is missing, stale, or doesn't match.
+
+---
+
+## Quick start
+
+### Express
+
+```ts
+import express from "express";
+import { shuntExpress, shuntRawBody } from "@shunt-network/verify";
+
+const app = express();
+
+// Keep the raw bytes: the signature covers a hash of the exact body.
+app.use(express.json({ verify: shuntRawBody }));
+
+// Protect every paid route.
+app.use("/api/paid", shuntExpress(process.env.SHUNT_SECRET!));
+
+app.post("/api/paid/scrape", (req, res) => {
+  console.log(req.shunt); // { requestId, agent }
+  res.json({ ok: true });
+});
+```
+
+### Next.js (App Router)
+
+```ts
+// app/api/scrape/route.ts
+import { withShunt } from "@shunt-network/verify";
+
+export const POST = withShunt(process.env.SHUNT_SECRET!, async (req) => {
+  const body = await req.json();
+  return Response.json({ ok: true, body });
+});
+```
+
+### Hono
+
+```ts
+import { Hono } from "hono";
+import { shuntHono } from "@shunt-network/verify";
+
+const app = new Hono();
+app.use("/paid/*", shuntHono(process.env.SHUNT_SECRET!));
+app.post("/paid/scrape", (c) => c.json({ ok: true }));
+```
+
+### Supabase Edge Functions / Deno
+
+Use the core function so you control the path that gets verified:
+
+```ts
+import { verifyShunt } from "npm:@shunt-network/verify@0.1.0";
+
+const SHUNT_SECRET = Deno.env.get("SHUNT_SECRET")!;
+const PATH_PREFIX = "/functions/v1"; // stripped from req.url inside the runtime
+
+Deno.serve(async (req) => {
+  const rawBody = new Uint8Array(await req.arrayBuffer()); // read ONCE
+  const url = new URL(req.url);
+
+  const result = verifyShunt({
+    secret: SHUNT_SECRET,
+    method: req.method,
+    pathAndQuery: PATH_PREFIX + url.pathname + url.search,
+    rawBody,
+    getHeader: (n) => req.headers.get(n),
+  });
+
+  if (!result.ok) {
+    return Response.json({ error: "Unauthorized: requests must come via Shunt" }, { status: 401 });
+  }
+
+  const body = JSON.parse(new TextDecoder().decode(rawBody));
+  return Response.json({ ok: true, body });
+});
+```
+
+Also disable Supabase's own JWT check for the function (`verify_jwt = false` in `config.toml`, or `--no-verify-jwt` on deploy). The gateway doesn't send a Supabase JWT, and your Shunt signature check replaces it.
+
+---
+
+## API
+
+### `verifyShunt(input): VerifyResult`
+
+Framework-agnostic core. Everything else is a thin wrapper around it.
+
+```ts
+interface VerifyInput {
+  secret: string | string[];       // array = accept any (rotation)
+  method: string;                  // "POST"
+  pathAndQuery: string;            // exactly as received, e.g. "/v2/scrape?url=..."
+  rawBody: Buffer | Uint8Array | string;
+  getHeader: (name: string) => string | undefined | null;
+  maxSkewSec?: number;             // default 300 (5 minutes)
+  replayCache?: ReplayCache;       // optional duplicate-ID detection
+}
+
+type VerifyResult =
+  | { ok: true; requestId: string }
+  | { ok: false; reason: "missing_headers" | "stale_timestamp" | "bad_signature" | "replay" };
+```
+
+### `shuntExpress(secret, opts?)`
+
+Express/Connect middleware. Responds `401` on failure and sets `req.shunt = { requestId, agent }` on success.
+
+Options: `maxSkewSec?: number`, `replayProtection?: boolean`.
+
+### `shuntRawBody`
+
+Pass to `express.json({ verify: shuntRawBody })` (or `express.raw`) so `req.rawBody` is available.
+
+### `withShunt(secret, handler)`
+
+Wraps a Fetch-API route handler (Next.js App Router, Cloudflare Workers, etc.). Returns `401` JSON if verification fails, otherwise calls your handler.
+
+### `shuntHono(secret)`
+
+Hono middleware.
+
+### `verifyShuntRequest(req, secret, opts?)`
+
+Verify a standard `Request` object directly. Reads a clone of the body, so your handler can still read it.
+
+### `ReplayCache`
+
+In-memory cache of seen request IDs (10 minute TTL by default). Request IDs are recorded only **after** the signature is valid, so attackers can't fill the cache with junk.
+
+```ts
+import { ReplayCache, verifyShunt } from "@shunt-network/verify";
+const replayCache = new ReplayCache();
+```
+
+It's per-process. On serverless or edge platforms with short-lived isolates it isn't reliable, and the timestamp window already limits replay to a few minutes. Use a shared store (Redis, etc.) if you need strict guarantees.
+
+---
+
+## Secret rotation
+
+Pass both the new and the old secret while you roll over, and drop the old one once traffic has switched:
+
+```ts
+shuntExpress([process.env.SHUNT_SECRET!, process.env.SHUNT_SECRET_PREV!]);
+```
+
+---
+
+## Common problems
+
+**Everything returns 401 through the gateway**
+
+1. **Raw body.** The signature is over the exact bytes. If you hash a re-serialized `JSON.stringify(req.body)`, it won't match. Capture the raw bytes (`shuntRawBody` for Express).
+2. **Path mismatch.** `pathAndQuery` must equal what the gateway sent to your server, including any prefix from the `base_url` you registered. For example, a base URL of `https://api.example.com/v2` and a tool path of `/scrape` is signed as `/v2/scrape`. In Express, `req.originalUrl` is correct. If a reverse proxy or framework rewrites the path before your code sees it, pass the original path.
+3. **Wrong secret.** Each service has its own `shunt_whsec_...`. Check for trailing whitespace in your env var.
+4. **Clock skew.** Requests older than 5 minutes (or too far in the future) are rejected. Keep your server clock synced with NTP, or raise `maxSkewSec`.
+
+**Direct calls still work.** Make sure the middleware runs before your handlers and covers every paid route.
+
+---
+
+## Best practices
+
+- **Verify first.** Put the middleware at the top, before any parsing, database access, or expensive work.
+- **Return real status codes.** The gateway automatically **refunds the agent** when your API returns a 5xx or certain 4xx errors (401, 403, 404, 408, 429). If your API fails but returns `200` with `{ "error": ... }`, the agent is still charged.
+- **Treat `x-shunt-agent` as a hint.** It isn't signed. Don't use it for authorization.
+- **Keep the secret out of source control.** Use an environment variable or secrets manager. If it leaks, regenerate it from the Shunt dashboard.
+- **Selling elsewhere too?** This package verifies Shunt only. If you list your API on other marketplaces or accept other payment methods, mount those on separate routes or middleware.
+
+---
+
+## Testing locally
+
+Simulate the gateway with `curl`:
+
+```bash
+SECRET="shunt_whsec_your_secret"
+URL="http://localhost:3000/api/paid/scrape"
+SIGNED_PATH="/api/paid/scrape"
+BODY='{"url":"https://example.com"}'
+
+TS=$(date +%s)
+RID=$(uuidgen)
+BODY_HASH=$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | awk '{print $NF}')
+PAYLOAD=$(printf 'v1\n%s\n%s\nPOST\n%s\n%s' "$TS" "$RID" "$SIGNED_PATH" "$BODY_HASH")
+SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $NF}')
+
+curl -i -X POST "$URL" \
+  -H "Content-Type: application/json" \
+  -H "x-shunt-timestamp: $TS" \
+  -H "x-shunt-request-id: $RID" \
+  -H "x-shunt-signature: v1=$SIG" \
+  --data-binary "$BODY"
+```
+
+Expected results:
+
+| Request | Result |
+|---|---|
+| Direct call, no headers | `401` |
+| Correctly signed | `200` |
+| Signed, then body changed | `401` |
+
+Use `--data-binary` rather than `-d` so curl sends exactly the bytes that were hashed.
+
+---
+
+## Security notes
+
+- Signatures use HMAC-SHA256 and are compared in constant time.
+- The signed payload binds method, path, query, body hash, timestamp and request ID.
+- The gateway strips any client-supplied `x-shunt-*` headers before signing, so callers can't forge them.
+- The gateway doesn't follow redirects from your API.
+- Secrets are stored encrypted (AES-256-GCM) on the gateway side.
+
+---
+
+## License
+
+MIT

package/dist/core.d.ts

@@ -0,0 +1,25 @@
+export type VerifyResult = {
+    ok: true;
+    requestId: string;
+} | {
+    ok: false;
+    reason: "missing_headers" | "stale_timestamp" | "bad_signature" | "replay";
+};
+export interface VerifyInput {
+    secret: string | string[];
+    method: string;
+    pathAndQuery: string;
+    rawBody: Buffer | Uint8Array | string;
+    getHeader: (name: string) => string | undefined | null;
+    maxSkewSec?: number;
+    replayCache?: ReplayCache;
+}
+export declare class ReplayCache {
+    private ttlMs;
+    private seen;
+    constructor(ttlMs?: number);
+    /** returns true if the id was already seen */
+    check(id: string): boolean;
+}
+export declare function verifyShunt(i: VerifyInput): VerifyResult;
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,GAAG,QAAQ,CAAA;CAAE,CAAC;AAE9F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,WAAW;IAEV,OAAO,CAAC,KAAK;IADzB,OAAO,CAAC,IAAI,CAA6B;IACzC,YAAoB,KAAK,SAAc,EAAI;IAC3C,8CAA8C;IAC9C,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAMzB;CACF;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,YAAY,CA4BxD"}

package/dist/core.js

@@ -0,0 +1,44 @@
+import crypto from "node:crypto";
+export class ReplayCache {
+    ttlMs;
+    seen = new Map();
+    constructor(ttlMs = 10 * 60_000) {
+        this.ttlMs = ttlMs;
+    }
+    /** returns true if the id was already seen */
+    check(id) {
+        const now = Date.now();
+        for (const [k, exp] of this.seen)
+            if (exp < now)
+                this.seen.delete(k);
+        if (this.seen.has(id))
+            return true;
+        this.seen.set(id, now + this.ttlMs);
+        return false;
+    }
+}
+export function verifyShunt(i) {
+    const ts = i.getHeader("x-shunt-timestamp");
+    const rid = i.getHeader("x-shunt-request-id");
+    const sig = (i.getHeader("x-shunt-signature") ?? "").replace(/^v1=/, "");
+    if (!ts || !rid || !sig)
+        return { ok: false, reason: "missing_headers" };
+    const skew = Math.abs(Date.now() / 1000 - Number(ts));
+    if (!Number.isFinite(skew) || skew > (i.maxSkewSec ?? 300))
+        return { ok: false, reason: "stale_timestamp" };
+    const bodyHash = crypto.createHash("sha256").update(i.rawBody).digest("hex");
+    const payload = `v1\n${ts}\n${rid}\n${i.method.toUpperCase()}\n${i.pathAndQuery}\n${bodyHash}`;
+    const secrets = Array.isArray(i.secret) ? i.secret : [i.secret];
+    const sigBuf = Buffer.from(sig, "utf8");
+    const valid = secrets.some((s) => {
+        const expected = Buffer.from(crypto.createHmac("sha256", s).update(payload).digest("hex"), "utf8");
+        return expected.length === sigBuf.length && crypto.timingSafeEqual(expected, sigBuf);
+    });
+    if (!valid)
+        return { ok: false, reason: "bad_signature" };
+    // only record the id AFTER the signature is valid, so attackers can't fill the cache
+    if (i.replayCache?.check(rid))
+        return { ok: false, reason: "replay" };
+    return { ok: true, requestId: rid };
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAgBjC,MAAM,OAAO,WAAW;IAEF,KAAK;IADjB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,YAAoB,KAAK,GAAG,EAAE,GAAG,MAAM;qBAAnB,KAAK;IAAiB,CAAC;IAC3C,8CAA8C;IAC9C,KAAK,CAAC,EAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,CAAc;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;IAE/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5D,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1D,qFAAqF;IACrF,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC"}

package/dist/express.d.ts

@@ -0,0 +1,7 @@
+/** Pass to express.json({ verify: shuntRawBody }) so the raw bytes are kept. */
+export declare const shuntRawBody: (req: any, _res: any, buf: Buffer) => void;
+export declare function shuntExpress(secret: string | string[], opts?: {
+    maxSkewSec?: number;
+    replayProtection?: boolean;
+}): (req: any, res: any, next: any) => any;
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,eAAO,MAAM,YAAY,QAAS,GAAG,QAAQ,GAAG,OAAO,MAAM,SAE5D,CAAC;AAEF,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,SAGjD,GAAG,OAAO,GAAG,QAAQ,GAAG,SAgBtC"}

package/dist/express.js

@@ -0,0 +1,25 @@
+import { verifyShunt, ReplayCache } from "./core.js";
+/** Pass to express.json({ verify: shuntRawBody }) so the raw bytes are kept. */
+export const shuntRawBody = (req, _res, buf) => {
+    req.rawBody = buf;
+};
+export function shuntExpress(secret, opts = {}) {
+    const replayCache = opts.replayProtection ? new ReplayCache() : undefined;
+    return (req, res, next) => {
+        const r = verifyShunt({
+            secret,
+            method: req.method,
+            pathAndQuery: req.originalUrl,
+            rawBody: req.rawBody ?? Buffer.alloc(0),
+            getHeader: (n) => req.get(n),
+            maxSkewSec: opts.maxSkewSec,
+            replayCache,
+        });
+        if (!r.ok) {
+            return res.status(401).json({ error: "Unauthorized: requests must come via Shunt" });
+        }
+        req.shunt = { requestId: r.requestId, agent: req.get("x-shunt-agent") };
+        next();
+    };
+}
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAErD,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAQ,EAAE,IAAS,EAAE,GAAW,EAAE,EAAE;IAC/D,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,MAAyB,EACzB,IAAI,GAAwD,EAAE;IAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,OAAO,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,WAAW,CAAC;YACpB,MAAM;YACN,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,WAAW;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACxE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./core.js";
+export * from "./express.js";
+export * from "./web.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./core.js";
+export * from "./express.js";
+export * from "./web.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/web.d.ts

@@ -0,0 +1,10 @@
+import { ReplayCache } from "./core.js";
+export declare function verifyShuntRequest(req: Request, secret: string | string[], opts?: {
+    maxSkewSec?: number;
+    replayCache?: ReplayCache;
+}): Promise<import("./core.js").VerifyResult>;
+/** Next.js App Router: export const POST = withShunt(secret, async (req) => ...) */
+export declare function withShunt<T extends (req: Request, ...a: any[]) => Promise<Response> | Response>(secret: string | string[], handler: T): T;
+/** Hono: app.use("/paid/*", shuntHono(secret)) */
+export declare const shuntHono: (secret: string | string[]) => (c: any, next: any) => Promise<any>;
+//# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,WAAW,EAAE,MAAM,WAAW,CAAC;AAErD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,WAAW,CAAA;CAAO,6CAY9D;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAC7F,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,EAAE,CAAC,GACT,CAAC,CAQH;AAED,kDAAkD;AAClD,eAAO,MAAM,SAAS,WAAY,MAAM,GAAG,MAAM,EAAE,SAAe,GAAG,QAAQ,GAAG,iBAI/E,CAAC"}

package/dist/web.js

@@ -0,0 +1,31 @@
+import { verifyShunt } from "./core.js";
+export async function verifyShuntRequest(req, secret, opts = {}) {
+    const url = new URL(req.url);
+    const rawBody = new Uint8Array(await req.clone().arrayBuffer());
+    return verifyShunt({
+        secret,
+        method: req.method,
+        pathAndQuery: url.pathname + url.search,
+        rawBody,
+        getHeader: (n) => req.headers.get(n),
+        ...opts,
+    });
+}
+/** Next.js App Router: export const POST = withShunt(secret, async (req) => ...) */
+export function withShunt(secret, handler) {
+    return (async (req, ...args) => {
+        const r = await verifyShuntRequest(req, secret);
+        if (!r.ok) {
+            return Response.json({ error: "Unauthorized: requests must come via Shunt" }, { status: 401 });
+        }
+        return handler(req, ...args);
+    });
+}
+/** Hono: app.use("/paid/*", shuntHono(secret)) */
+export const shuntHono = (secret) => async (c, next) => {
+    const r = await verifyShuntRequest(c.req.raw, secret);
+    if (!r.ok)
+        return c.json({ error: "Unauthorized: requests must come via Shunt" }, 401);
+    await next();
+};
+//# sourceMappingURL=web.js.map

package/dist/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAe,MAAM,WAAW,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,MAAyB,EACzB,IAAI,GAAuD,EAAE;IAE7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QACvC,OAAO;QACP,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,SAAS,CACvB,MAAyB,EACzB,OAAU;IAEV,OAAO,CAAC,KAAK,EAAE,GAAY,EAAE,GAAG,IAAW,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAM,CAAC;AACV,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,KAAK,EAAE,CAAM,EAAE,IAAS,EAAE,EAAE;IAClF,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,21 @@
 {
   "name": "@shunt-network/verify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "",
+  "license": "ISC",
+  "author": "Aditya Patwa",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "typescript": "^7.0.2"
+  }
+}