wayleave 0.5.0 → 0.5.2

package/README.md

@@ -32,7 +32,7 @@ signature headers and get back who signed it and which lane it belongs in.
 Nothing is stored, and your traffic never routes through us.
 
 ```sh
-curl -X POST https://wayleave-api-production.up.railway.app/v1/identify \
+curl -X POST https://api.wayleave.dev/v1/identify \
   -H "Authorization: Bearer $WAYLEAVE_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{"method":"GET","url":"https://api.yourapp.com/v1/data",
@@ -48,8 +48,7 @@ curl -X POST https://wayleave-api-production.up.railway.app/v1/identify \
 
 The same evaluator answers here and in the middleware, and a test asserts they
 agree — if the two front doors disagreed about one request you would have no
-way to know which to believe. (`api.wayleave.dev` is the intended hostname and
-has no DNS record yet; the URL above is the one that answers today.)
+way to know which to believe.
 
 **2. The middleware — in your own process.** Nothing leaves your server that
 you do not send. This is the path if you want to price routes, enforce access
@@ -63,8 +62,10 @@ npm install wayleave
 
 [Create a Meter account](https://meter.wayleave.dev/account.html), issue an API key,
 and set `WAYLEAVE_METER_KEY` in your server environment. Signing in does not
-start billing. The optional hosted Meter trial requires a card and becomes
-$49/month after 3 days unless canceled; see your account for current terms.
+start billing. The optional hosted plans require a card and start after a
+3-day trial unless canceled — current plans and prices are at
+[wayleave.dev/pricing](https://wayleave.dev/pricing/), which is the one place
+they are kept up to date.
 
 In your existing Express app:
 
@@ -122,10 +123,7 @@ rather than quietly denying every payment.
 
 ## Enforce rules you set elsewhere
 
-> Requires 0.5.0. npm currently serves **0.4.1**, which has no `policy` option —
-> installing from npm and pasting this will silently do nothing. Until 0.5.0 is
-> published, install from source:
-> `npm install github:gibrancorbin11-hub/wayleave`
+> Requires 0.5.0 or later, which is what `npm install wayleave` now gives you.
 
 A policy the gate fetches, rather than configuration compiled into your app:
 
@@ -192,7 +190,7 @@ that tooling in the wild does fetch.
 
 ## Status
 
-v0.5.0 — 155 tests, zero dependencies. Published on npm: 0.4.1.
+v0.5.0 — 155 tests, zero dependencies. Published on npm.
 
 **0.5.0** does three things. Rules you set are now *enforced*: `policy: { url, publicKey }` fetches a
 signed policy, verifies it, caches it, and evaluates per request — denials carry the rule id in

package/index.js

@@ -95,6 +95,31 @@ function sigBase(components, ctx, paramsRaw) {
   return Buffer.from(lines.join('\n'));
 }
 
+/**
+ * Does `path` fall under `prefix`?
+ *
+ * Not `startsWith`. A raw prefix test makes "/api" match "/apiv2" and
+ * "/api-internal", which is wrong in both directions and dangerous in one:
+ *
+ *   pricedPaths { "/api": 0.05 }     charges for /apiv2, which the operator
+ *                                    never priced
+ *   rules { bot: [["/public", true]] }  ALLOWS /public-admin, which the
+ *                                    operator never opened
+ *
+ * The second is the one that matters. An over-matching deny is merely
+ * annoying; an over-matching allow is a hole.
+ *
+ * A prefix matches the path itself or anything beneath its boundary, and a
+ * trailing slash on the prefix changes nothing — "/api" and "/api/" mean the
+ * same thing, because operators write both and neither should surprise them.
+ */
+export function pathUnder(path, prefix) {
+  if (typeof path !== 'string' || typeof prefix !== 'string') return false;
+  if (prefix === '' || prefix === '/') return true;
+  const base = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+  return path === base || path.startsWith(base + '/');
+}
+
 export function buildParams(keyid, created, expires, nonce = null) {
   return `("@authority" "signature-agent");created=${created};` +
          `keyid="${keyid}";alg="ed25519";expires=${expires};tag="web-bot-auth"` +
@@ -631,7 +656,7 @@ export class Wayleave {
    */
   _preDecide(req, lane, ident, now, paymentProof, c) {
     for (const [prefix, allow] of this.rules[lane] || []) {
-      if (req.path.startsWith(prefix)) {
+      if (pathUnder(req.path, prefix)) {
         if (!allow) return { status: 403, why: `${lane} denied on ${prefix}` };
         break;
       }
@@ -659,7 +684,7 @@ export class Wayleave {
       : lane === LANES.HUMAN;
     if (!freeOnPriced) {
       for (const [prefix, price] of Object.entries(this.pricedPaths)) {
-        if (req.path.startsWith(prefix)) {
+        if (pathUnder(req.path, prefix)) {
           const challenge = { scheme: 'x402', price_usd: price, resource: prefix };
           if (!paymentProof) {
             const why = this.strictPricedPaths && lane === LANES.HUMAN
@@ -802,6 +827,20 @@ export class Wayleave {
 
   express() {
     return async (req, res, next) => {
+      /* The discovery document is answered first: before classification,
+         before rate limiting, before pricing. A manifest an agent must pay
+         to read cannot be discovered, and one that is classified as bot
+         traffic gets a 402 instead of the price list.
+
+         This lived only on manifestFor() until 0.5.1, so `app.use(gate.express())`
+         -- the integration the Quickstart shows -- served no manifest at all
+         while the README said every install with a priced route does. */
+      const manifest = this.manifestFor({
+        path: req.path || (req.url || '').split('?')[0],
+        headers: req.headers,
+      });
+      if (manifest) return res.status(manifest.status).set(manifest.headers).json(manifest.body);
+
       const r = await this.handleAsync({
         method: req.method, path: req.path || req.url,
         authority: req.headers.host || '',
@@ -816,10 +855,25 @@ export class Wayleave {
       }, undefined, req.headers['x-payment-proof'] || '');
       req.wayleave = r;
       if (r.status === 200) return next();
-      if (r.status === 402)
+      if (r.status === 402) {
+        /* The 402 body and the manifest must come from one source, or an
+           index quotes a price the origin does not honour. `accepts` is
+           built by the same call the manifest is, so they cannot drift.
+
+           Without a payment config there is nothing spec-shaped to say --
+           no payee, no network, no asset -- so the internal challenge is
+           all that is sent, and `accepts` is absent rather than empty.
+           An empty accepts array would read as "priced at nothing". */
+        const body = { error: r.why, challenge: r.challenge };
+        const requirements = this.paymentRequirements({
+          path: req.path || (req.url || '').split('?')[0],
+          headers: req.headers,
+        });
+        if (requirements) { body.x402Version = 1; body.accepts = [requirements]; }
         return res.status(402)
                   .set('x-payment-challenge', JSON.stringify(r.challenge))
-                  .json({ error: r.why, challenge: r.challenge });
+                  .json(body);
+      }
       return res.status(r.status).json({ error: r.why });
     };
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "wayleave",
-  "version": "0.5.0",
-  "description": "Know which AI agents cross your API — verified by signature, not guessed from an IP. Sorts every request into four lanes, prices the non-human ones with HTTP 402, and never charges a human. Zero dependencies.",
+  "version": "0.5.2",
+  "description": "Know which AI agents cross your API \u2014 verified by signature, not guessed from an IP. Sorts every request into four lanes, prices the non-human ones with HTTP 402, and never charges a human. Zero dependencies.",
   "type": "module",
   "main": "index.js",
   "types": "./index.d.ts",

package/policy.js

@@ -114,9 +114,33 @@ export class RemotePolicy {
    * @param {(e:object)=>void} [o.onEvent] observability; never throws into us
    */
   constructor({ apiKey = null, url = null, publicKey = null, endpoint = DEFAULT_ENDPOINT,
-                refreshMs = DEFAULT_REFRESH_MS, graceMs = 0,
+                refreshMs = DEFAULT_REFRESH_MS, graceMs = 0, allowUnsigned = false,
                 cachePath = null, onEvent = null, onChange = null, fetchImpl = null } = {}) {
     if (!apiKey && !url) throw new Error('RemotePolicy requires a policy url (or the meter apiKey)');
+    /* A policy document decides who is allowed through and what they are
+       charged. Applying one nobody signed means whoever can answer that URL
+       — a hijacked CDN, a DNS answer, anyone on the path — writes your access
+       rules. Until 0.5.2 a missing publicKey silently skipped the check.
+
+       The requirement applies to a bare `url` only. With `apiKey` the document
+       comes from the customer's own meter over TLS with their key, which is an
+       authenticated channel; the signature is defence in depth there, not the
+       only defence. A public policy URL has no such channel — being publicly
+       cacheable is the point of it — so the signature IS the authentication.
+
+       Refusing at construction rather than at fetch time is deliberate: the
+       failure belongs at startup, where someone is watching, not on a poll at
+       three in the morning. `allowUnsigned: true` remains for a URL you trust
+       end to end, and it has to be written down. */
+    if (url && !apiKey && !publicKey && !allowUnsigned)
+      throw new Error(
+        'RemotePolicy requires publicKey: an unsigned policy document is an ' +
+        'unauthenticated one, and it decides access and pricing. Pass the ' +
+        'signing key, or allowUnsigned: true if you genuinely trust this URL.');
+    this.allowUnsigned = allowUnsigned;
+    // True only for a bare public URL, where the signature is the only
+    // thing authenticating the document.
+    this._needsSignature = Boolean(url) && !apiKey;
     this.apiKey = apiKey;
     this.publicKey = publicKey;
     this.graceMs = graceMs;
@@ -186,6 +210,11 @@ export class RemotePolicy {
         const v = verifyEnvelope(raw, this.publicKey, { graceMs: this.graceMs });
         if (!v.ok) { this._emit('policy.rejected', { why: v.reason }); return this.document; }
         doc = v.policy;
+      } else if (this._needsSignature && !this.allowUnsigned) {
+        // Unreachable via the constructor, which refuses this combination.
+        // Kept because the field is public and a caller may clear it.
+        this._emit('policy.rejected', { why: 'no signing key configured' });
+        return this.document;
       }
       if (!isUsable(doc)) { this._emit('policy.rejected', { why: 'document not usable' }); return this.document; }