@openwop/openwop 1.7.0 → 1.8.0

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export { ACTIVE_RUN_STATUSES, TERMINAL_RUN_STATUSES, isTerminalRunStatus, HTTP_E
 export type { ActiveRunStatus, TerminalRunStatus, HttpErrorCode, RunErrorCode, RunError, } from './run-helpers.js';
 export { OPENWOP_COST_ATTRIBUTE_NAMES, sanitizeCostAttributes, } from './cost-attribution.js';
 export type { OpenwopCostAttributeName } from './cost-attribution.js';
+/** @deprecated Import from `@openwop/openwop/webhooks` — server-only; removed from the barrel in the next major. */
 export { DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS, verifyWebhookSignature, signWebhookDelivery, } from './webhook-helpers.js';
 export type { VerifyWebhookSignatureOptions, VerifyWebhookOutcome, } from './webhook-helpers.js';
 export { RegistryClient } from './registry-helpers.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,kBAAkB,EAElB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,aAAa,EAEb,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EAEpB,kBAAkB,EAElB,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EAEtB,qBAAqB,EACrB,mBAAmB,EAEnB,wBAAwB,EAExB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EAIpB,mBAAmB,EACnB,sBAAsB,EAGtB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EAGX,cAAc,EAGd,eAAe,EACf,eAAe,EACf,yBAAyB,EAKzB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAIzE,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAMtE,OAAO,EACL,wCAAwC,EACxC,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAI/B,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAEhB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,iCAAiC,GAClC,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAW1E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,kBAAkB,EAElB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,UAAU,EACV,aAAa,EAEb,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EAEpB,kBAAkB,EAElB,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EAEtB,qBAAqB,EACrB,mBAAmB,EAEnB,wBAAwB,EAExB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EAIpB,mBAAmB,EACnB,sBAAsB,EAGtB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EAGX,cAAc,EAGd,eAAe,EACf,eAAe,EACf,yBAAyB,EAKzB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAIzE,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAiBtE,oHAAoH;AACpH,OAAO,EACL,wCAAwC,EACxC,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAI/B,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAEhB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,iCAAiC,GAClC,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAW1E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -28,6 +28,18 @@ export { OPENWOP_COST_ATTRIBUTE_NAMES, sanitizeCostAttributes, } from './cost-at
 // HMAC-SHA256 + timestamp freshness window verification per
 // spec/v1/webhooks.md §"Signature recipe". Receivers MUST verify both
 // the HMAC AND the timestamp to defeat replay attacks.
+//
+// DEPRECATED ON THE BARREL (openwop-sdks#30). These re-exports are why a
+// browser consumer importing anything at all from `@openwop/openwop` dragged
+// in `node:crypto` and failed the build. Import them from
+// `@openwop/openwop/webhooks` instead; the barrel re-export is retained for
+// compatibility and will be removed in the next major.
+//
+// Until then the `browser` field in package.json substitutes a stub that
+// throws with an explanatory message, so a browser build succeeds and only a
+// browser CALL fails — which is the correct outcome either way, since the
+// subscription secret must never reach a browser.
+/** @deprecated Import from `@openwop/openwop/webhooks` — server-only; removed from the barrel in the next major. */
 export { DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS, verifyWebhookSignature, signWebhookDelivery, } from './webhook-helpers.js';
 // Public-registry read helpers (SDK-5 close-out 2026-05-15). Read-only
 // typed client for the public node-pack registry at packs.openwop.dev

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA8GtC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,2EAA2E;AAC3E,6DAA6D;AAC7D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAM5B,yEAAyE;AACzE,yEAAyE;AACzE,oBAAoB;AACpB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAS1B,iDAAiD;AACjD,sEAAsE;AACtE,mEAAmE;AACnE,uDAAuD;AACvD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,sEAAsE;AACtE,4DAA4D;AAC5D,sEAAsE;AACtE,uDAAuD;AACvD,OAAO,EACL,wCAAwC,EACxC,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,sEAAsE;AACtE,sCAAsC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA0CvD,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,uDAAuD;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,mEAAmE;AACnE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,oDAAoD;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA8GtC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,2EAA2E;AAC3E,6DAA6D;AAC7D,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAM5B,yEAAyE;AACzE,yEAAyE;AACzE,oBAAoB;AACpB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAS1B,iDAAiD;AACjD,sEAAsE;AACtE,mEAAmE;AACnE,uDAAuD;AACvD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,sEAAsE;AACtE,4DAA4D;AAC5D,sEAAsE;AACtE,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,0DAA0D;AAC1D,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,0EAA0E;AAC1E,kDAAkD;AAClD,oHAAoH;AACpH,OAAO,EACL,wCAAwC,EACxC,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,sEAAsE;AACtE,sCAAsC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA0CvD,oEAAoE;AACpE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,uDAAuD;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,mEAAmE;AACnE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,oDAAoD;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/webhook-helpers.browser.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Browser substitute for `webhook-helpers.ts` (openwop-sdks#30).
+ *
+ * ## Why this file exists
+ *
+ * `webhook-helpers.ts` imports `node:crypto` for `createHmac` and
+ * `timingSafeEqual`. The package barrel re-exports it, and the `exports` map
+ * offers only `"."` — so a browser consumer importing ANYTHING from
+ * `@openwop/openwop` pulled the barrel, pulled the webhook helpers, and pulled
+ * `node:crypto`. Vite/Rollup then failed the BUILD with
+ *
+ *     "createHmac" is not exported by "__vite-browser-external"
+ *
+ * which names a bundler-internal shim rather than the real cause, so the error
+ * points nowhere useful. Reported 2026-05-26 and still reproducible against the
+ * published 1.7.0 fifteen months later.
+ *
+ * The `browser` field in package.json maps the Node module to this one, so the
+ * barrel is importable in a browser again. Webhook signature verification is a
+ * SERVER concern — a browser has no business holding the subscription secret —
+ * so the honest browser behaviour is to keep the import working and refuse the
+ * call, not to ship a second crypto implementation.
+ *
+ * ## Why it throws rather than returning a failure
+ *
+ * `verifyWebhookSignature` returning `{ ok: false }` in a browser would be a
+ * silent security downgrade: a caller that treats "not ok" as "reject the
+ * delivery" behaves identically whether the signature was forged or the
+ * platform simply could not check it. Those are different facts and only one of
+ * them is about the payload. Throwing keeps them distinguishable.
+ */
+/** @see spec/v1/webhooks.md §"Replay attack protection" */
+export declare const DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS = 300;
+export declare function verifyWebhookSignature(): never;
+export declare function signWebhookDelivery(): never;
+export type { VerifyWebhookSignatureOptions, VerifyWebhookOutcome } from './webhook-helpers.js';
+//# sourceMappingURL=webhook-helpers.browser.d.ts.map

package/dist/webhook-helpers.browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-helpers.browser.d.ts","sourceRoot":"","sources":["../src/webhook-helpers.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,2DAA2D;AAC3D,eAAO,MAAM,wCAAwC,MAAM,CAAC;AAE5D,wBAAgB,sBAAsB,IAAI,KAAK,CAE9C;AAED,wBAAgB,mBAAmB,IAAI,KAAK,CAE3C;AAED,YAAY,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/webhook-helpers.browser.js

@@ -0,0 +1,43 @@
+/**
+ * Browser substitute for `webhook-helpers.ts` (openwop-sdks#30).
+ *
+ * ## Why this file exists
+ *
+ * `webhook-helpers.ts` imports `node:crypto` for `createHmac` and
+ * `timingSafeEqual`. The package barrel re-exports it, and the `exports` map
+ * offers only `"."` — so a browser consumer importing ANYTHING from
+ * `@openwop/openwop` pulled the barrel, pulled the webhook helpers, and pulled
+ * `node:crypto`. Vite/Rollup then failed the BUILD with
+ *
+ *     "createHmac" is not exported by "__vite-browser-external"
+ *
+ * which names a bundler-internal shim rather than the real cause, so the error
+ * points nowhere useful. Reported 2026-05-26 and still reproducible against the
+ * published 1.7.0 fifteen months later.
+ *
+ * The `browser` field in package.json maps the Node module to this one, so the
+ * barrel is importable in a browser again. Webhook signature verification is a
+ * SERVER concern — a browser has no business holding the subscription secret —
+ * so the honest browser behaviour is to keep the import working and refuse the
+ * call, not to ship a second crypto implementation.
+ *
+ * ## Why it throws rather than returning a failure
+ *
+ * `verifyWebhookSignature` returning `{ ok: false }` in a browser would be a
+ * silent security downgrade: a caller that treats "not ok" as "reject the
+ * delivery" behaves identically whether the signature was forged or the
+ * platform simply could not check it. Those are different facts and only one of
+ * them is about the payload. Throwing keeps them distinguishable.
+ */
+const REASON = 'openwop: webhook signature helpers require Node\'s crypto (HMAC-SHA256 + timingSafeEqual) and are not available in a browser build. '
+    + 'Webhook verification is a server-side concern — the subscription secret must never reach a browser. '
+    + 'Import them on the server from "@openwop/openwop/webhooks".';
+/** @see spec/v1/webhooks.md §"Replay attack protection" */
+export const DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS = 300;
+export function verifyWebhookSignature() {
+    throw new Error(REASON);
+}
+export function signWebhookDelivery() {
+    throw new Error(REASON);
+}
+//# sourceMappingURL=webhook-helpers.browser.js.map

package/dist/webhook-helpers.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-helpers.browser.js","sourceRoot":"","sources":["../src/webhook-helpers.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,MAAM,GACV,sIAAsI;MACpI,sGAAsG;MACtG,6DAA6D,CAAC;AAElE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAE5D,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Production-ready TypeScript reference SDK for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",
@@ -14,8 +14,14 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
+      "browser": "./dist/index.js",
       "import": "./dist/index.js"
-    }
+    },
+    "./webhooks": {
+      "types": "./dist/webhook-helpers.d.ts",
+      "import": "./dist/webhook-helpers.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
@@ -40,5 +46,8 @@
   },
   "overrides": {
     "esbuild": "^0.25.0"
+  },
+  "browser": {
+    "./dist/webhook-helpers.js": "./dist/webhook-helpers.browser.js"
   }
 }

package/src/index.ts

@@ -188,6 +188,18 @@ export type { OpenwopCostAttributeName } from './cost-attribution.js';
 // HMAC-SHA256 + timestamp freshness window verification per
 // spec/v1/webhooks.md §"Signature recipe". Receivers MUST verify both
 // the HMAC AND the timestamp to defeat replay attacks.
+//
+// DEPRECATED ON THE BARREL (openwop-sdks#30). These re-exports are why a
+// browser consumer importing anything at all from `@openwop/openwop` dragged
+// in `node:crypto` and failed the build. Import them from
+// `@openwop/openwop/webhooks` instead; the barrel re-export is retained for
+// compatibility and will be removed in the next major.
+//
+// Until then the `browser` field in package.json substitutes a stub that
+// throws with an explanatory message, so a browser build succeeds and only a
+// browser CALL fails — which is the correct outcome either way, since the
+// subscription secret must never reach a browser.
+/** @deprecated Import from `@openwop/openwop/webhooks` — server-only; removed from the barrel in the next major. */
 export {
   DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS,
   verifyWebhookSignature,

package/src/webhook-helpers.browser.ts

@@ -0,0 +1,49 @@
+/**
+ * Browser substitute for `webhook-helpers.ts` (openwop-sdks#30).
+ *
+ * ## Why this file exists
+ *
+ * `webhook-helpers.ts` imports `node:crypto` for `createHmac` and
+ * `timingSafeEqual`. The package barrel re-exports it, and the `exports` map
+ * offers only `"."` — so a browser consumer importing ANYTHING from
+ * `@openwop/openwop` pulled the barrel, pulled the webhook helpers, and pulled
+ * `node:crypto`. Vite/Rollup then failed the BUILD with
+ *
+ *     "createHmac" is not exported by "__vite-browser-external"
+ *
+ * which names a bundler-internal shim rather than the real cause, so the error
+ * points nowhere useful. Reported 2026-05-26 and still reproducible against the
+ * published 1.7.0 fifteen months later.
+ *
+ * The `browser` field in package.json maps the Node module to this one, so the
+ * barrel is importable in a browser again. Webhook signature verification is a
+ * SERVER concern — a browser has no business holding the subscription secret —
+ * so the honest browser behaviour is to keep the import working and refuse the
+ * call, not to ship a second crypto implementation.
+ *
+ * ## Why it throws rather than returning a failure
+ *
+ * `verifyWebhookSignature` returning `{ ok: false }` in a browser would be a
+ * silent security downgrade: a caller that treats "not ok" as "reject the
+ * delivery" behaves identically whether the signature was forged or the
+ * platform simply could not check it. Those are different facts and only one of
+ * them is about the payload. Throwing keeps them distinguishable.
+ */
+
+const REASON =
+  'openwop: webhook signature helpers require Node\'s crypto (HMAC-SHA256 + timingSafeEqual) and are not available in a browser build. '
+  + 'Webhook verification is a server-side concern — the subscription secret must never reach a browser. '
+  + 'Import them on the server from "@openwop/openwop/webhooks".';
+
+/** @see spec/v1/webhooks.md §"Replay attack protection" */
+export const DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS = 300;
+
+export function verifyWebhookSignature(): never {
+  throw new Error(REASON);
+}
+
+export function signWebhookDelivery(): never {
+  throw new Error(REASON);
+}
+
+export type { VerifyWebhookSignatureOptions, VerifyWebhookOutcome } from './webhook-helpers.js';