v0.4.0 — a free allowance that answers with a price

Past a configurable free quota the gateway answers 402 with the offer instead of 429, because the moment a caller runs out of free requests is the best sales pitch a site gets.

• freeQuota: 100 for 100 requests a minute, free, no account.
• benefits: [...] lists what a pass unlocks, on the sales page and in the 402 body.
• A valid pass is now read before anything that can refuse, so a pass holder is never metered.
• The sales page, robots.txt and .well-known stay reachable when the allowance is spent.

On rotating addresses: the default identity is the caller's address and a proxy rotation defeats it. That is documented rather than patched. Residential bandwidth is billed by the gigabyte and passes a dollar on the first day of any crawl worth rotating for, so the throttled page makes that arithmetic instead of pretending to be undefeatable.

v0.3.1

Corrects the onSale JSDoc: the hook has always been awaited before the buyer's receipt is sent, and the comment claimed the opposite. That is worth a release because believing the old comment means writing a fire-and-forget hook, which silently loses the sale on any runtime that stops when the response does. Two tests now hold the behaviour down, including that a throwing hook still sells the pass. No behaviour change.

v0.3.0

Sell as many days as a crawler wants in one payment. ?days=N quotes N terms; the days a proof buys are read off the value it authorizes (a whole multiple of the day price, up to maxDays, default 30); the pass expires that many days out. Receipt carries days/minutes; the 402 pass object carries days, total, maxDays, buyDays; onSale gets days/totalCents.

v0.2.2

The spoof check skips any crawler that declares itself, so Googlebot and Bingbot (evergreen Chrome UAs without Sec-Fetch-Mode) are never charged.

v0.2.1

clientIp reads X-Real-IP or the last X-Forwarded-For hop, so denyCidrs cannot be stepped around by a client-seeded header.

v0.2.0

denyCidrs, chargeSpoofedBrowsers and exempt: controls for crawlers that do not name themselves. See README.

v0.1.0

First release. See README.