@apitap/core 1.4.2 → 1.5.0

package/src/read/peek.ts

@@ -48,6 +48,22 @@ export async function peek(url: string, options: PeekOptions = {}): Promise<Peek
   const contentType = headers['content-type'] || null;
   const server = headers['server'] || null;
 
+  // JSON API responses with HTTP 200 are always accessible, regardless of CDN headers
+  if (status === 200 && contentType && contentType.includes('application/json')) {
+    const framework = detectFramework(headers, signals);
+    return {
+      url,
+      status,
+      accessible: true,
+      contentType,
+      server,
+      framework,
+      botProtection: null,
+      signals,
+      recommendation: 'read',
+    };
+  }
+
   // Detect bot protection
   const botProtection = detectBotProtection(headers, signals);
 

package/src/replay/engine.ts

@@ -628,7 +628,7 @@ export async function replayMultiple(
   const skillCache = new Map<string, SkillFile | null>();
   const uniqueDomains = [...new Set(requests.map(r => r.domain))];
   await Promise.all(uniqueDomains.map(async (domain) => {
-    const skill = await readSkillFile(domain, options.skillsDir, { verifySignature: true, signingKey });
+    const skill = await readSkillFile(domain, options.skillsDir, { verifySignature: true, signingKey, trustUnsigned: true });
     skillCache.set(domain, skill);
   }));
 

package/src/skill/store.ts

@@ -85,7 +85,17 @@ export async function readSkillFile(
         }
       } else {
         const { verifySignature } = await import('./signing.js');
-        if (!verifySignature(skill, signingKey)) {
+        let verified = verifySignature(skill, signingKey);
+        if (!verified) {
+          // Fallback: try pre-v1.4.0 legacy key (before HKDF signing key separation)
+          // Files signed with deriveKey() directly (not deriveSigningKey()) will match here
+          const { deriveKey } = await import('../auth/crypto.js');
+          const { getMachineId } = await import('../auth/manager.js');
+          const machineId = await getMachineId();
+          const legacyKey = deriveKey(machineId);
+          verified = verifySignature(skill, legacyKey);
+        }
+        if (!verified) {
           throw new Error(`Skill file signature verification failed for ${domain} — file may be tampered`);
         }
       }