diff --git a/src/main/js/firewall/engine/api.js b/src/main/js/firewall/engine/api.js
new file mode 100644
index 0000000..20692c8
--- /dev/null
+++ b/src/main/js/firewall/engine/api.js
@@ -0,0 +1,30 @@
+import {getBoundContext, getPolicy, getPipeline, getDirective} from './common.js'
+import {getPackument, guessDistTags} from './packument.js'
+import {checkTarball} from './tarball.js'
+
+export {
+  getDirective,
+  guessDistTags,
+  getPackument,
+  checkTarball,
+  getPolicy,
+  getPipeline,
+}
+
+export const assertPolicy = async ({org, name, version, rules, registry, authorization}) => {
+  const boundContext = await getBoundContext({org, name, version, rules, registry, authorization})
+}
+
+export const getAssets = async (boundContext) => {
+  const {name, org, version, registry} = boundContext
+  const url = (org ? `${org}/` : '') + `${name}/-/${name}.tgz`
+  const [
+    { packument, packumentBufferZip, headers, etag, deps, directives },
+    tarball
+  ] = await Promise.all([
+    getPackument({ boundContext, rules }),
+    version ? checkTarball({registry, url}) : Promise.resolve(false)
+  ])
+
+  return {packument, packumentBufferZip, headers, etag, deps, directives, tarball}
+}
\ No newline at end of file
diff --git a/src/main/js/firewall/engine.js b/src/main/js/firewall/engine/common.js
similarity index 67%
rename from src/main/js/firewall/engine.js
rename to src/main/js/firewall/engine/common.js
index 395644f..3f771dd 100644
--- a/src/main/js/firewall/engine.js
+++ b/src/main/js/firewall/engine/common.js
@@ -1,5 +1,21 @@
-import {asArray, mapValuesAsync} from '../util.js'
-import {logger} from '../logger.js'
+import {asArray, mapValuesAsync, normalizePath} from '../../util.js'
+import {logger} from '../../logger.js'
+import {getConfig} from '../../config.js'
+
+const getAuth = (token, auth) => token
+  ? token?.startsWith('Bearer')
+    ? token
+    :`Bearer ${token}`
+  : auth
+
+export const getBoundContext = async ({org, name, version, rules, registry, token, req = {headers: {}}}) => {
+  const config = getConfig()
+  const authorization = getAuth(token, req.headers['authorization'])
+  const entrypoint = _entrypoint || normalizePath(`${config.server.entrypoint}${base}`)
+  const pipeline = await getPipeline(rules)
+
+  return { registry, entrypoint, authorization, name, org, version, pipeline, rules }
+}
 
 export const getDirectives = ({packument, rules, boundContext}) =>
   mapValuesAsync(packument.versions, async (entry) =>
@@ -54,4 +70,4 @@ export const normalizePipeline = (rules) =>
     )
 
     return m
-  }, [])
+  }, [])
\ No newline at end of file
diff --git a/src/main/js/firewall/packument.js b/src/main/js/firewall/engine/packument.js
similarity index 92%
rename from src/main/js/firewall/packument.js
rename to src/main/js/firewall/engine/packument.js
index 26498eb..3d4d041 100644
--- a/src/main/js/firewall/packument.js
+++ b/src/main/js/firewall/engine/packument.js
@@ -1,12 +1,12 @@
 import crypto from 'node:crypto'
 
-import {getDirectives, getPolicy} from './engine.js'
-import {request} from '../http/index.js'
-import {logger} from '../logger.js'
-import {asArray, tryQueue, time} from '../util.js'
-import {withCache} from '../cache.js'
-import {semver} from '../semver.js'
-import {gunzip} from '../zip.js'
+import {getDirectives, getPolicy} from './common.js'
+import {request} from '../../http/index.js'
+import {logger} from '../../logger.js'
+import {asArray, tryQueue, time} from '../../util.js'
+import {withCache} from '../../cache.js'
+import {semver} from '../../semver.js'
+import {gunzip} from '../../zip.js'
 
 export const getPackument = async ({boundContext, rules}) => {
   const { registry, authorization, entrypoint, name } = boundContext
diff --git a/src/main/js/firewall/tarball.js b/src/main/js/firewall/engine/tarball.js
similarity index 79%
rename from src/main/js/firewall/tarball.js
rename to src/main/js/firewall/engine/tarball.js
index c574374..4067103 100644
--- a/src/main/js/firewall/tarball.js
+++ b/src/main/js/firewall/engine/tarball.js
@@ -1,5 +1,5 @@
-import {asArray, tryQueue} from '../util.js'
-import {request} from '../http/index.js'
+import {asArray, tryQueue} from '../../util.js'
+import {request} from '../../http/index.js'
 
 export const checkTarball = async ({registry, url}) => {
   const registries = asArray(registry)
diff --git a/src/main/js/firewall/index.js b/src/main/js/firewall/index.js
index c0e12ec..3c24ce8 100644
--- a/src/main/js/firewall/index.js
+++ b/src/main/js/firewall/index.js
@@ -1,3 +1,2 @@
 export * from './middleware.js'
-export * from './engine.js'
-export * from './packument.js'
+export * from './engine/api.js'
diff --git a/src/main/js/firewall/middleware.js b/src/main/js/firewall/middleware.js
index 10752b5..9885047 100644
--- a/src/main/js/firewall/middleware.js
+++ b/src/main/js/firewall/middleware.js
@@ -1,10 +1,8 @@
 import {httpError, NOT_FOUND, ACCESS_DENIED, METHOD_NOT_ALLOWED, NOT_MODIFIED, OK, FOUND} from '../http/index.js'
-import {getPolicy, getPipeline} from './engine.js'
-import {getPackument} from './packument.js'
+import {getPolicy, getPipeline, checkTarball, getPackument} from './engine/api.js'
 import {normalizePath, dropNullEntries, time, jsonBuffer} from '../util.js'
 import {gzip} from '../zip.js'
 import {hasHit, hasKey, isNoCache} from '../cache.js'
-import {checkTarball} from './tarball.js'
 import {logger} from '../logger.js'
 import {getConfig} from '../config.js'
 
diff --git a/src/test/js/firewall.js b/src/test/js/firewall.js
index 761d886..c18f50c 100644
--- a/src/test/js/firewall.js
+++ b/src/test/js/firewall.js
@@ -1,5 +1,5 @@
 import { testFactory, assert } from '../test-utils.js'
-import { getDirective } from '../../main/js/firewall/index.js'
+import { getDirective, assertPolicy } from '../../main/js/firewall/index.js'
 
 const test = testFactory('firewall', import.meta)