@homespunapps/core 1.4.3 → 1.5.0

package/dist/client.d.ts

@@ -421,6 +421,34 @@ export declare class HomespunClient {
             url: string;
         };
     }>;
+    /**
+     * PUT /v1/apps/:id/ingest-hooks/:name/signing-secret provisions or rotates a
+     * hook's SIGNING secret (opt-in webhook signature verification, issue #935,
+     * shipped dark: nothing verifies a signature yet). This is a DIFFERENT secret
+     * from the URL secret rotateIngestHook rotates: it is what a provider (GitHub,
+     * Stripe, ...) HMACs the request body with.
+     *
+     * Omit `secret` to have the relay MINT one (`ihk_...`): the response includes
+     * the value ONCE (paste it into the provider). Pass `secret` to store a
+     * provider-generated value verbatim: the value is never echoed back, only the
+     * fingerprint. A rotation keeps the previous secret valid for `graceSeconds`
+     * (default 3600, max 86400) so deliveries verify while you update the provider.
+     */
+    setIngestSigningSecret(appId: string, name: string, opts?: {
+        secret?: string;
+        graceSeconds?: number;
+    }): Promise<{
+        secret?: string;
+        fingerprint: string;
+        setAt: string;
+    }>;
+    /**
+     * DELETE /v1/apps/:id/ingest-hooks/:name/signing-secret clears a hook's
+     * signing secret (current + previous + grace window). Idempotent.
+     */
+    clearIngestSigningSecret(appId: string, name: string): Promise<{
+        ok: boolean;
+    }>;
     /**
      * POST /v1/apps/:id/grants: mint a grant link. `role` must be a declared
      * custom role for the app. `mode` is "once" (one-time, first-browser-claims)
@@ -806,6 +834,20 @@ export interface IngestHookInfo {
     handshake: string | null;
     disabledAt: string | null;
     createdAt: string;
+    /**
+     * Opt-in signature verification state (issue #935), shipped dark. `configured`
+     * is true when a signing secret is set; `fingerprint` identifies WHICH one
+     * (plaintext-derived, matches the value in the provider's settings) without
+     * ever exposing it; `previousUntil` is set during a rotation's grace window.
+     */
+    signingSecret: {
+        configured: boolean;
+        fingerprint: string | null;
+        setAt: string | null;
+        previousUntil: string | null;
+    };
+    /** Placeholder for the D3 manifest `verify` grammar; always null for now. */
+    verify: null;
     deliveries: {
         accepted: number;
         failed: number;

package/dist/client.js

@@ -777,6 +777,40 @@ export class HomespunClient {
             this.fail(r);
         return this.asObject(r);
     }
+    /**
+     * PUT /v1/apps/:id/ingest-hooks/:name/signing-secret provisions or rotates a
+     * hook's SIGNING secret (opt-in webhook signature verification, issue #935,
+     * shipped dark: nothing verifies a signature yet). This is a DIFFERENT secret
+     * from the URL secret rotateIngestHook rotates: it is what a provider (GitHub,
+     * Stripe, ...) HMACs the request body with.
+     *
+     * Omit `secret` to have the relay MINT one (`ihk_...`): the response includes
+     * the value ONCE (paste it into the provider). Pass `secret` to store a
+     * provider-generated value verbatim: the value is never echoed back, only the
+     * fingerprint. A rotation keeps the previous secret valid for `graceSeconds`
+     * (default 3600, max 86400) so deliveries verify while you update the provider.
+     */
+    async setIngestSigningSecret(appId, name, opts = {}) {
+        const body = {};
+        if (opts.secret !== undefined)
+            body.secret = opts.secret;
+        if (opts.graceSeconds !== undefined)
+            body.graceSeconds = opts.graceSeconds;
+        const r = await this.call("PUT", `/v1/apps/${encodeURIComponent(appId)}/ingest-hooks/${encodeURIComponent(name)}/signing-secret`, body);
+        if (!r.ok)
+            this.fail(r);
+        return this.asObject(r);
+    }
+    /**
+     * DELETE /v1/apps/:id/ingest-hooks/:name/signing-secret clears a hook's
+     * signing secret (current + previous + grace window). Idempotent.
+     */
+    async clearIngestSigningSecret(appId, name) {
+        const r = await this.call("DELETE", `/v1/apps/${encodeURIComponent(appId)}/ingest-hooks/${encodeURIComponent(name)}/signing-secret`);
+        if (!r.ok)
+            this.fail(r);
+        return this.asObject(r);
+    }
     // -------------------------------------------------------------------------
     // v2 grant links (M5). An owner/agent mints a capability URL carrying a
     // DECLARED custom role (x-homespun-manifest.roles) plus an optional row/filter

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homespunapps/core",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "description": "Homespun relay client: typed HTTP + WebSocket operations against a Homespun relay. Framework-free.",
   "license": "MIT",
   "type": "module",