wayleave 0.5.0 → 0.5.1

package/README.md

@@ -32,7 +32,7 @@ signature headers and get back who signed it and which lane it belongs in.
 Nothing is stored, and your traffic never routes through us.
 
 ```sh
-curl -X POST https://wayleave-api-production.up.railway.app/v1/identify \
+curl -X POST https://api.wayleave.dev/v1/identify \
   -H "Authorization: Bearer $WAYLEAVE_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"method":"GET","url":"https://api.yourapp.com/v1/data",
@@ -48,8 +48,7 @@ curl -X POST https://wayleave-api-production.up.railway.app/v1/identify \
 
 The same evaluator answers here and in the middleware, and a test asserts they
 agree — if the two front doors disagreed about one request you would have no
-way to know which to believe. (`api.wayleave.dev` is the intended hostname and
-has no DNS record yet; the URL above is the one that answers today.)
+way to know which to believe.
 
 **2. The middleware — in your own process.** Nothing leaves your server that
 you do not send. This is the path if you want to price routes, enforce access
@@ -122,10 +121,7 @@ rather than quietly denying every payment.
 
 ## Enforce rules you set elsewhere
 
-> Requires 0.5.0. npm currently serves **0.4.1**, which has no `policy` option —
-> installing from npm and pasting this will silently do nothing. Until 0.5.0 is
-> published, install from source:
-> `npm install github:gibrancorbin11-hub/wayleave`
+> Requires 0.5.0 or later, which is what `npm install wayleave` now gives you.
 
 A policy the gate fetches, rather than configuration compiled into your app:
 
@@ -192,7 +188,7 @@ that tooling in the wild does fetch.
 
 ## Status
 
-v0.5.0 — 155 tests, zero dependencies. Published on npm: 0.4.1.
+v0.5.0 — 155 tests, zero dependencies. Published on npm.
 
 **0.5.0** does three things. Rules you set are now *enforced*: `policy: { url, publicKey }` fetches a
 signed policy, verifies it, caches it, and evaluates per request — denials carry the rule id in

package/index.js

@@ -802,6 +802,20 @@ export class Wayleave {
 
   express() {
     return async (req, res, next) => {
+      /* The discovery document is answered first: before classification,
+         before rate limiting, before pricing. A manifest an agent must pay
+         to read cannot be discovered, and one that is classified as bot
+         traffic gets a 402 instead of the price list.
+
+         This lived only on manifestFor() until 0.5.1, so `app.use(gate.express())`
+         -- the integration the Quickstart shows -- served no manifest at all
+         while the README said every install with a priced route does. */
+      const manifest = this.manifestFor({
+        path: req.path || (req.url || '').split('?')[0],
+        headers: req.headers,
+      });
+      if (manifest) return res.status(manifest.status).set(manifest.headers).json(manifest.body);
+
       const r = await this.handleAsync({
         method: req.method, path: req.path || req.url,
         authority: req.headers.host || '',
@@ -816,10 +830,25 @@ export class Wayleave {
       }, undefined, req.headers['x-payment-proof'] || '');
       req.wayleave = r;
       if (r.status === 200) return next();
-      if (r.status === 402)
+      if (r.status === 402) {
+        /* The 402 body and the manifest must come from one source, or an
+           index quotes a price the origin does not honour. `accepts` is
+           built by the same call the manifest is, so they cannot drift.
+
+           Without a payment config there is nothing spec-shaped to say --
+           no payee, no network, no asset -- so the internal challenge is
+           all that is sent, and `accepts` is absent rather than empty.
+           An empty accepts array would read as "priced at nothing". */
+        const body = { error: r.why, challenge: r.challenge };
+        const requirements = this.paymentRequirements({
+          path: req.path || (req.url || '').split('?')[0],
+          headers: req.headers,
+        });
+        if (requirements) { body.x402Version = 1; body.accepts = [requirements]; }
         return res.status(402)
                   .set('x-payment-challenge', JSON.stringify(r.challenge))
-                  .json({ error: r.why, challenge: r.challenge });
+                  .json(body);
+      }
       return res.status(r.status).json({ error: r.why });
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wayleave",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Know which AI agents cross your API — verified by signature, not guessed from an IP. Sorts every request into four lanes, prices the non-human ones with HTTP 402, and never charges a human. Zero dependencies.",
   "type": "module",
   "main": "index.js",