Gate it to the holders

// The only key whose signatures count. Fetch once and cache.
export async function getCanonicalIssuer() {
  const res = await fetch("https://sabroshi.com/api/verify")
  return res.json() // { issuer: "02ab…", collection: "sabroshi-v1" }
}

import { ProtoWallet, Utils } from "@bsv/sdk"

const ISSUANCE_PROTOCOL: [number, string] = [1, "sabroshi issuance"]
const anyone = new ProtoWallet("anyone") // verifies counterparty-"anyone" sigs, no private key

// Authentic ⇔ valid signature AND issuer === the published canonical issuer.
export async function verifySabroshi(d: SabroshiDescriptor, canonicalIssuerKey: string) {
  if (d.p !== "sabroshi") return { authentic: false, reason: "not a sabroshi" }
  if (d.issuer !== canonicalIssuerKey) return { authentic: false, reason: "not the canonical issuer" }
  const { valid } = await anyone.verifySignature({
    data: Utils.toArray(issuanceMessage(d), "utf8"),
    signature: Utils.toArray(d.sig, "hex"),
    protocolID: ISSUANCE_PROTOCOL,
    keyID: `${d.collection}:${d.n}`,
    counterparty: d.issuer,
  })
  return { authentic: valid, number: d.n }
}

// app/api/premium/route.ts - gate a route behind authentic ownership
import { NextResponse } from "next/server"

export async function GET(req: Request) {
  const K = await requireIdentity(req)                 // 1. identity → verified public key
  if (!K) return NextResponse.json({ error: "sign in" }, { status: 401 })

  const { issuer } = await getCanonicalIssuer()
  const holdings = await getHoldings(K)                // 2. ownership lookup (your indexer)
  const authentic = await filterAuthentic(holdings, issuer) // 3. keep only canonical-issuer sigs

  if (authentic.length === 0) {
    return NextResponse.json({ error: "Holders only" }, { status: 403 })
  }
  return NextResponse.json({ ok: true, sabroshis: authentic.map((a) => a.number) })
}

POST https://sabroshi.com/api/verify
  body: { "descriptor": SabroshiDescriptor }
  → 200 { "authentic": true, "number": 7, "issuer": "02ab…" }
  → 200 { "authentic": false, "reason": "issuer is not the canonical Sabroshi issuer" }