@openwop/openwop 1.8.0 → 2.0.0

package/src/webhook-header-families.ts

@@ -0,0 +1,78 @@
+/**
+ * Webhook header families and signature-value parsing (webhooks.md §Headers;
+ * RFC 0165 §C.1, RFC 0176 §D.2). Pure — no Node builtin — so both the server
+ * module (`webhook-helpers.ts`) and the browser stub re-export it.
+ * Verification itself stays server-only.
+ */
+
+/** The one accepted signature-value form: `sha256=<hex>`. The SDK-only `v1=` form was removed in v2 (headers.md §Removed). */
+const SIGNATURE_VALUE_PREFIX = 'sha256=';
+
+/** The one signature scheme (`OpenWOP-Signature-Algorithm`): HMAC-SHA256 with the subscription secret. */
+export const WEBHOOK_SIGNATURE_ALGORITHMS = ['v1'] as const;
+export type WebhookSignatureAlgorithm = (typeof WEBHOOK_SIGNATURE_ALGORITHMS)[number];
+
+/** `sha256=<hex>` → `<hex>`; anything else → null. */
+export function parseSignatureValue(value: string): string | null {
+  if (!value.startsWith(SIGNATURE_VALUE_PREFIX)) return null;
+  const hex = value.slice(SIGNATURE_VALUE_PREFIX.length);
+  return /^[0-9a-f]+$/i.test(hex) ? hex : null;
+}
+
+/**
+ * Header-name families a delivery may carry, in the order a receiver SHOULD
+ * prefer them: the v2 `OpenWOP-*` family, then the v1 `X-openwop-*` family a
+ * dual-major host emits beside it through the overlap (webhooks.md §Dual
+ * emission — a v2 receiver MUST accept a delivery carrying only that family).
+ * Lookups are case-insensitive.
+ */
+export const WEBHOOK_HEADER_FAMILIES: ReadonlyArray<{
+  readonly family: 'openwop' | 'x-openwop';
+  readonly signature: string;
+  readonly timestamp: string;
+  readonly algorithm: string;
+}> = [
+  { family: 'openwop', signature: 'OpenWOP-Signature', timestamp: 'OpenWOP-Timestamp', algorithm: 'OpenWOP-Signature-Algorithm' },
+  { family: 'x-openwop', signature: 'X-openwop-Signature', timestamp: 'X-openwop-Timestamp', algorithm: 'X-openwop-Signature-Algorithm' },
+];
+
+export interface WebhookHeaderRead {
+  readonly signatureHeader: string;
+  readonly timestampHeader: string;
+  /** The `*-Signature-Algorithm` value when the delivery carried one. */
+  readonly algorithmHeader?: string;
+  /** Which family was read. */
+  readonly family: 'openwop' | 'x-openwop';
+}
+
+/**
+ * Pick the signature + timestamp (+ algorithm) values out of a delivery's
+ * headers, first present family wins. Returns null when no family is
+ * complete. Pass a plain object (any casing) or a `Headers`-like with a `get`
+ * method.
+ */
+export function readWebhookHeaders(
+  headers: Record<string, string | string[] | undefined> | { get(name: string): string | null },
+): WebhookHeaderRead | null {
+  const get = (name: string): string | undefined => {
+    if (typeof (headers as { get?: unknown }).get === 'function') {
+      const v = (headers as { get(name: string): string | null }).get(name);
+      return v === null ? undefined : v;
+    }
+    const rec = headers as Record<string, string | string[] | undefined>;
+    const key = Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+    const v = key === undefined ? undefined : rec[key];
+    return Array.isArray(v) ? v[0] : v;
+  };
+  for (const f of WEBHOOK_HEADER_FAMILIES) {
+    const sig = get(f.signature);
+    const ts = get(f.timestamp);
+    if (sig !== undefined && ts !== undefined) {
+      const alg = get(f.algorithm);
+      return alg === undefined
+        ? { signatureHeader: sig, timestampHeader: ts, family: f.family }
+        : { signatureHeader: sig, timestampHeader: ts, algorithmHeader: alg, family: f.family };
+    }
+  }
+  return null;
+}

package/src/webhook-helpers.browser.ts

@@ -1,33 +1,18 @@
 /**
- * Browser substitute for `webhook-helpers.ts` (openwop-sdks#30).
- *
- * ## Why this file exists
+ * Browser substitute for `webhook-helpers.ts`.
  *
  * `webhook-helpers.ts` imports `node:crypto` for `createHmac` and
- * `timingSafeEqual`. The package barrel re-exports it, and the `exports` map
- * offers only `"."` — so a browser consumer importing ANYTHING from
- * `@openwop/openwop` pulled the barrel, pulled the webhook helpers, and pulled
- * `node:crypto`. Vite/Rollup then failed the BUILD with
- *
- *     "createHmac" is not exported by "__vite-browser-external"
- *
- * which names a bundler-internal shim rather than the real cause, so the error
- * points nowhere useful. Reported 2026-05-26 and still reproducible against the
- * published 1.7.0 fifteen months later.
+ * `timingSafeEqual`. The `browser` field in package.json maps that module to
+ * this one so a browser bundle builds. Webhook signature verification is a
+ * SERVER concern — a browser has no business holding the subscription
+ * secret — so the honest browser behaviour is to keep the import working and
+ * refuse the call, not to ship a second crypto implementation.
  *
- * The `browser` field in package.json maps the Node module to this one, so the
- * barrel is importable in a browser again. Webhook signature verification is a
- * SERVER concern — a browser has no business holding the subscription secret —
- * so the honest browser behaviour is to keep the import working and refuse the
- * call, not to ship a second crypto implementation.
- *
- * ## Why it throws rather than returning a failure
- *
- * `verifyWebhookSignature` returning `{ ok: false }` in a browser would be a
- * silent security downgrade: a caller that treats "not ok" as "reject the
- * delivery" behaves identically whether the signature was forged or the
- * platform simply could not check it. Those are different facts and only one of
- * them is about the payload. Throwing keeps them distinguishable.
+ * It throws rather than returning a failure: `{ valid: false }` in a browser
+ * would be a silent security downgrade — a caller that treats "not valid" as
+ * "reject the delivery" behaves identically whether the signature was forged
+ * or the platform simply could not check it. Throwing keeps them
+ * distinguishable.
  */
 
 const REASON =
@@ -35,7 +20,7 @@ const REASON =
   + 'Webhook verification is a server-side concern — the subscription secret must never reach a browser. '
   + 'Import them on the server from "@openwop/openwop/webhooks".';
 
-/** @see spec/v1/webhooks.md §"Replay attack protection" */
+/** @see spec/v2/core/webhooks.md §Verification */
 export const DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS = 300;
 
 export function verifyWebhookSignature(): never {
@@ -46,4 +31,15 @@ export function signWebhookDelivery(): never {
   throw new Error(REASON);
 }
 
-export type { VerifyWebhookSignatureOptions, VerifyWebhookOutcome } from './webhook-helpers.js';
+// The header-family readers need no Node builtin, so the browser build
+// carries the real implementations (a browser MAY inspect which family a
+// delivery carries; it still MUST NOT verify — no secret in a browser).
+export {
+  WEBHOOK_HEADER_FAMILIES,
+  WEBHOOK_SIGNATURE_ALGORITHMS,
+  parseSignatureValue,
+  readWebhookHeaders,
+} from './webhook-header-families.js';
+
+export type { VerifyWebhookSignatureOptions, VerifyWebhookOutcome, SignedWebhookDelivery } from './webhook-helpers.js';
+export type { WebhookHeaderRead, WebhookSignatureAlgorithm } from './webhook-header-families.js';

package/src/webhook-helpers.ts

@@ -1,33 +1,40 @@
 /**
- * Webhook delivery-verification helpers per `spec/v1/webhooks.md`
- * §"Signature recipe". Receivers MUST verify both the HMAC AND the
- * timestamp freshness before accepting a delivery — verifying HMAC
- * alone leaves the receiver open to replay attacks.
+ * Webhook delivery-verification helpers per `spec/v2/core/webhooks.md`
+ * §Verification. Receivers MUST verify both the HMAC AND the timestamp
+ * freshness before accepting a delivery — verifying HMAC alone leaves the
+ * receiver open to replay attacks.
  *
- * The canonical signing recipe:
+ * The signing recipe (webhooks.md §Headers):
  *
  *     hmac = HMAC-SHA256(secret, `${timestamp}.${rawBody}`)
- *     header `openwop-Webhook-Signature: v1=<hmac-hex>`
- *     header `openwop-Webhook-Timestamp: <unix-seconds>`
+ *     header `OpenWOP-Signature: sha256=<hmac-hex>`
+ *     header `OpenWOP-Timestamp: <unix-seconds>`
+ *     header `OpenWOP-Signature-Algorithm: v1`
+ *
+ * A host advertising both majors sends the `X-openwop-*` family beside it
+ * with identical values through the overlap; `readWebhookHeaders` accepts
+ * either family. The SDK-only `openwop-Webhook-*` names and the `v1=<hex>`
+ * value form were removed in v2 (headers.md §Removed).
  *
  * Verification:
  *
- *   1. Parse the `v1=<hex>` value from the signature header.
- *   2. Recompute `expected = HMAC-SHA256(secret, `${timestamp}.${rawBody}`)`.
- *   3. Compare using **constant-time** equality (timing-safe).
- *   4. Reject when `|now - timestamp|` exceeds the freshness window
- *      (default 5 minutes per `webhooks.md`'s recommendation).
+ *   1. Parse the `sha256=<hex>` value from the signature header.
+ *   2. Reject an unrecognized `OpenWOP-Signature-Algorithm` value (MUST).
+ *   3. Reject a timestamp more than ±window from the clock (default 5 min).
+ *   4. Recompute `HMAC-SHA256(`${timestamp}.${rawBody}`, secret)` and compare
+ *      in constant time.
  *
- * Implementation note: this helper uses `node:crypto`'s `timingSafeEqual`
- * for the comparison. The browser-side equivalent (Web Crypto's
- * `subtle.verify`) is not wrapped here — the SDK's runtime is Node.
+ * Implementation note: this helper uses `node:crypto`'s `timingSafeEqual`.
+ * The browser build substitutes a stub that throws (see
+ * `webhook-helpers.browser.ts`).
  *
  * @module @openwop/openwop/webhook-helpers
  */
 
 import { createHmac, timingSafeEqual } from 'node:crypto';
+import { parseSignatureValue, WEBHOOK_SIGNATURE_ALGORITHMS } from './webhook-header-families.js';
 
-/** Default freshness window per `spec/v1/webhooks.md` §"Replay attack resistance". */
+/** Default freshness window per webhooks.md §Verification (±5 minutes). */
 export const DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS = 300;
 
 export interface VerifyWebhookSignatureOptions {
@@ -42,24 +49,38 @@ export interface VerifyWebhookSignatureOptions {
    * Default `Math.floor(Date.now() / 1000)`.
    */
   nowSeconds?: number;
+  /**
+   * The `OpenWOP-Signature-Algorithm` value the delivery carried, when the
+   * caller read one (`readWebhookHeaders().algorithmHeader`). An
+   * unrecognized value is rejected as `unsupported_signature_algorithm`.
+   */
+  algorithmHeader?: string;
 }
 
 export type VerifyWebhookOutcome =
   | { valid: true }
-  | { valid: false; reason: 'signature_mismatch' | 'timestamp_expired' | 'timestamp_too_far_in_future' | 'malformed_signature_header' | 'malformed_timestamp_header' };
+  | {
+      valid: false;
+      reason:
+        | 'signature_mismatch'
+        | 'timestamp_expired'
+        | 'timestamp_too_far_in_future'
+        | 'malformed_signature_header'
+        | 'malformed_timestamp_header'
+        | 'unsupported_signature_algorithm';
+    };
 
 /**
- * Verify a webhook delivery per `spec/v1/webhooks.md` §"Signature
- * recipe". Returns `{ valid: true }` on success; otherwise
+ * Verify a webhook delivery. Returns `{ valid: true }` on success; otherwise
  * `{ valid: false, reason }` so callers can log + alert appropriately.
  *
- * Callers MUST pass the **raw** body bytes — JSON-parsed-then-
- * re-serialized bodies will fail verification because the host
- * signs the exact bytes it delivered.
+ * Callers MUST pass the **raw** body bytes — JSON-parsed-then-re-serialized
+ * bodies fail verification because the host signs the exact bytes it
+ * delivered.
  *
- * @param secret The pre-shared secret returned from `webhooks.register`.
- * @param signatureHeader The value of the `openwop-Webhook-Signature` header (e.g., `"v1=abc123…"`).
- * @param timestampHeader The value of the `openwop-Webhook-Timestamp` header (unix seconds as string).
+ * @param secret The subscription secret.
+ * @param signatureHeader `OpenWOP-Signature` / `X-openwop-Signature` (`"sha256=abc123…"`); see `readWebhookHeaders`.
+ * @param timestampHeader The matching timestamp header (unix seconds as string).
  * @param rawBody The exact request body bytes the host POSTed.
  */
 export function verifyWebhookSignature(
@@ -69,32 +90,36 @@ export function verifyWebhookSignature(
   rawBody: string | Buffer,
   options: VerifyWebhookSignatureOptions = {},
 ): VerifyWebhookOutcome {
-  // 1. Parse the signature header.
-  if (!signatureHeader.startsWith('v1=')) {
+  // 1. Parse the signature header — `sha256=<hex>` only.
+  const providedHex = parseSignatureValue(signatureHeader);
+  if (providedHex === null) {
     return { valid: false, reason: 'malformed_signature_header' };
   }
-  const providedHex = signatureHeader.slice(3);
-  if (!/^[0-9a-f]+$/i.test(providedHex)) {
-    return { valid: false, reason: 'malformed_signature_header' };
+
+  // 2. Reject an unrecognized scheme.
+  if (
+    options.algorithmHeader !== undefined &&
+    !(WEBHOOK_SIGNATURE_ALGORITHMS as readonly string[]).includes(options.algorithmHeader)
+  ) {
+    return { valid: false, reason: 'unsupported_signature_algorithm' };
   }
 
-  // 2. Parse the timestamp.
+  // 3. Parse the timestamp.
   const timestamp = Number(timestampHeader);
   if (!Number.isInteger(timestamp) || timestamp <= 0) {
     return { valid: false, reason: 'malformed_timestamp_header' };
   }
 
-  // 3. Freshness check.
+  // 4. Freshness check.
   const window = options.freshnessWindowSeconds ?? DEFAULT_WEBHOOK_FRESHNESS_WINDOW_SECONDS;
   if (window > 0) {
     const now = options.nowSeconds ?? Math.floor(Date.now() / 1000);
     const delta = now - timestamp;
     if (delta > window) return { valid: false, reason: 'timestamp_expired' };
-    // Allow small future skew (within the window) but reject far-future timestamps.
     if (delta < -window) return { valid: false, reason: 'timestamp_too_far_in_future' };
   }
 
-  // 4. Recompute + constant-time compare.
+  // 5. Recompute + constant-time compare.
   const bodyStr = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');
   const signedBytes = `${timestamp}.${bodyStr}`;
   const expectedHex = createHmac('sha256', secret).update(signedBytes, 'utf8').digest('hex');
@@ -111,21 +136,44 @@ export function verifyWebhookSignature(
   return { valid: true };
 }
 
+export interface SignedWebhookDelivery {
+  /** `sha256=<hex>` */
+  readonly signatureHeader: string;
+  readonly timestampHeader: string;
+  /** The five `OpenWOP-*` headers a v2 host MUST send on every delivery, minus the two subscription-specific ones (`OpenWOP-Webhook-Id`, `OpenWOP-Event-Type`), plus the `X-openwop-*` twins a dual-major host emits through the overlap. */
+  readonly headers: Readonly<Record<string, string>>;
+}
+
 /**
  * Compute the canonical webhook signature for a payload — useful when
- * implementing a host (forward direction) OR when generating test
- * fixtures. Receivers verify via `verifyWebhookSignature`; this is the
- * inverse.
+ * implementing a host (forward direction) OR when generating test fixtures.
+ * Receivers verify via `verifyWebhookSignature`; this is the inverse.
  */
 export function signWebhookDelivery(
   secret: string,
   timestamp: number,
   rawBody: string | Buffer,
-): { signatureHeader: string; timestampHeader: string } {
+): SignedWebhookDelivery {
   const bodyStr = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');
   const hex = createHmac('sha256', secret).update(`${timestamp}.${bodyStr}`, 'utf8').digest('hex');
   return {
-    signatureHeader: `v1=${hex}`,
+    signatureHeader: `sha256=${hex}`,
     timestampHeader: String(timestamp),
+    headers: {
+      'OpenWOP-Signature': `sha256=${hex}`,
+      'OpenWOP-Timestamp': String(timestamp),
+      'OpenWOP-Signature-Algorithm': 'v1',
+      'X-openwop-Signature': `sha256=${hex}`,
+      'X-openwop-Timestamp': String(timestamp),
+      'X-openwop-Signature-Algorithm': 'v1',
+    },
   };
 }
+
+export {
+  WEBHOOK_HEADER_FAMILIES,
+  WEBHOOK_SIGNATURE_ALGORITHMS,
+  parseSignatureValue,
+  readWebhookHeaders,
+} from './webhook-header-families.js';
+export type { WebhookHeaderRead, WebhookSignatureAlgorithm } from './webhook-header-families.js';

package/dist/registry-helpers.d.ts

@@ -1,118 +0,0 @@
-/**
- * Public-registry read helpers per
- * `spec/v1/registry-operations.md`.
- *
- * The OpenWOP host SDK targets the host wire surface
- * (`/.well-known/openwop` + `/v1/runs/*` + `/v1/interrupts/*` etc).
- * The **public node-pack registry** at `packs.openwop.dev` is a
- * separate wire surface with its own discovery payload and pack-
- * versioned read endpoints. This module exposes a thin typed client
- * for that surface so adopters fetching pack manifests, indices, or
- * signature material don't roll their own HTTP plumbing.
- *
- * Read-only by design — the public registry uses pull-request-driven
- * publishing per `spec/v1/registry-operations.md` §"Submission flow"
- * + the `registry-publish.yml` GitHub workflow. There is no write API.
- *
- * No auth required for public reads.
- *
- * @module @openwop/openwop/registry-helpers
- */
-/** Public registry discovery payload per `registry-operations.md` §"Discovery". */
-export interface RegistryDiscovery {
-    registryVersion: string;
-    protocolVersion: string;
-    name?: string;
-    operator?: string;
-    url?: string;
-    supportedNamespaces: readonly string[];
-    supportedSigningMethods: readonly string[];
-    supportedTrustModes?: readonly string[];
-    endpoints: {
-        registryIndex: string;
-        packMetadata: string;
-        versionManifest: string;
-        versionTarball: string;
-        versionSignature: string;
-        publicKey: string;
-    };
-    signingKeys?: ReadonlyArray<{
-        keyId: string;
-        algorithm: string;
-        publicKeyUrl?: string;
-        permittedNamespaces?: readonly string[];
-        operator?: string;
-        status?: string;
-    }>;
-    [key: string]: unknown;
-}
-/** Registry-wide index entry per `/v1/index.json` rows. */
-export interface RegistryIndexEntry {
-    name: string;
-    latestVersion: string;
-    description?: string;
-    scope?: string;
-    [key: string]: unknown;
-}
-export interface RegistryIndex {
-    packs: ReadonlyArray<RegistryIndexEntry>;
-    generated?: string;
-    packCount?: number;
-    [key: string]: unknown;
-}
-/** Per-pack metadata document at `/v1/packs/{name}/index.json`. */
-export interface RegistryPackMetadata {
-    name: string;
-    description?: string;
-    versions: ReadonlyArray<string>;
-    latestVersion?: string;
-    [key: string]: unknown;
-}
-/** Version manifest at `/v1/packs/{name}/-/{version}.json`. */
-export interface RegistryVersionManifest {
-    name: string;
-    version: string;
-    description?: string;
-    /** SRI hash: `sha256-<43-char-b64>=`. */
-    integrity?: string;
-    signing?: {
-        method: 'ed25519' | 'manual' | string;
-        keyId: string;
-        publicKeyUrl?: string;
-    };
-    [key: string]: unknown;
-}
-export interface RegistryClientOptions {
-    /** Base URL for the registry. Defaults to `https://packs.openwop.dev`. */
-    baseUrl?: string;
-    /** Custom fetch implementation; defaults to `globalThis.fetch`. */
-    fetch?: typeof fetch;
-}
-/**
- * Typed client for the public OpenWOP node-pack registry. Read-only;
- * no auth required for the canonical public read surface.
- *
- * For host-side install-time verification (SRI + Ed25519 + lockfile),
- * see `examples/hosts/postgres/src/pack-consumer.ts` — the registry
- * client is the fetch surface; the consumer is the security surface.
- */
-export declare class RegistryClient {
-    #private;
-    readonly baseUrl: string;
-    constructor(options?: RegistryClientOptions);
-    /** `GET /.well-known/openwop-registry` — discovery + endpoint catalog. */
-    discovery(): Promise<RegistryDiscovery>;
-    /** `GET /v1/index.json` — registry-wide pack index. */
-    index(): Promise<RegistryIndex>;
-    /** `GET /v1/packs/{name}/index.json` — per-pack metadata. */
-    pack(name: string): Promise<RegistryPackMetadata>;
-    /** `GET /v1/packs/{name}/-/{version}.json` — version manifest. */
-    version(name: string, version: string): Promise<RegistryVersionManifest>;
-    /** Fetch raw tarball bytes. Caller MUST verify SRI + signature before trust. */
-    tarball(name: string, version: string): Promise<Buffer>;
-    /** Fetch raw 64-byte Ed25519 signature bytes. */
-    signature(name: string, version: string): Promise<Buffer>;
-    /** Fetch a publisher's public key as PEM text. */
-    publicKey(keyId: string): Promise<string>;
-}
-//# sourceMappingURL=registry-helpers.d.ts.map

package/dist/registry-helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-helpers.d.ts","sourceRoot":"","sources":["../src/registry-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,SAAS,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE,aAAa,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,+DAA+D;AAC/D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,qBAAa,cAAc;;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAGb,OAAO,GAAE,qBAA0B;IAK/C,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAI7C,uDAAuD;IACjD,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;IAIrC,6DAA6D;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMvD,kEAAkE;IAC5D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAM9E,gFAAgF;IAC1E,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM7D,iDAAiD;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM/D,kDAAkD;IAC5C,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAmBhD"}

package/dist/registry-helpers.js

@@ -1,82 +0,0 @@
-/**
- * Public-registry read helpers per
- * `spec/v1/registry-operations.md`.
- *
- * The OpenWOP host SDK targets the host wire surface
- * (`/.well-known/openwop` + `/v1/runs/*` + `/v1/interrupts/*` etc).
- * The **public node-pack registry** at `packs.openwop.dev` is a
- * separate wire surface with its own discovery payload and pack-
- * versioned read endpoints. This module exposes a thin typed client
- * for that surface so adopters fetching pack manifests, indices, or
- * signature material don't roll their own HTTP plumbing.
- *
- * Read-only by design — the public registry uses pull-request-driven
- * publishing per `spec/v1/registry-operations.md` §"Submission flow"
- * + the `registry-publish.yml` GitHub workflow. There is no write API.
- *
- * No auth required for public reads.
- *
- * @module @openwop/openwop/registry-helpers
- */
-/**
- * Typed client for the public OpenWOP node-pack registry. Read-only;
- * no auth required for the canonical public read surface.
- *
- * For host-side install-time verification (SRI + Ed25519 + lockfile),
- * see `examples/hosts/postgres/src/pack-consumer.ts` — the registry
- * client is the fetch surface; the consumer is the security surface.
- */
-export class RegistryClient {
-    baseUrl;
-    #fetch;
-    constructor(options = {}) {
-        this.baseUrl = (options.baseUrl ?? 'https://packs.openwop.dev').replace(/\/$/, '');
-        this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
-    }
-    /** `GET /.well-known/openwop-registry` — discovery + endpoint catalog. */
-    async discovery() {
-        return this.#getJson('/.well-known/openwop-registry');
-    }
-    /** `GET /v1/index.json` — registry-wide pack index. */
-    async index() {
-        return this.#getJson('/v1/index.json');
-    }
-    /** `GET /v1/packs/{name}/index.json` — per-pack metadata. */
-    async pack(name) {
-        return this.#getJson(`/v1/packs/${encodeURIComponent(name)}/index.json`);
-    }
-    /** `GET /v1/packs/{name}/-/{version}.json` — version manifest. */
-    async version(name, version) {
-        return this.#getJson(`/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.json`);
-    }
-    /** Fetch raw tarball bytes. Caller MUST verify SRI + signature before trust. */
-    async tarball(name, version) {
-        return this.#getBinary(`/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.tgz`);
-    }
-    /** Fetch raw 64-byte Ed25519 signature bytes. */
-    async signature(name, version) {
-        return this.#getBinary(`/v1/packs/${encodeURIComponent(name)}/-/${encodeURIComponent(version)}.sig`);
-    }
-    /** Fetch a publisher's public key as PEM text. */
-    async publicKey(keyId) {
-        const res = await this.#fetch(`${this.baseUrl}/keys/${encodeURIComponent(keyId)}.pub`);
-        if (!res.ok)
-            throw new Error(`registry: GET /keys/${keyId}.pub returned ${res.status}`);
-        return res.text();
-    }
-    async #getJson(path) {
-        const res = await this.#fetch(`${this.baseUrl}${path}`, {
-            headers: { Accept: 'application/json' },
-        });
-        if (!res.ok)
-            throw new Error(`registry: GET ${path} returned ${res.status}`);
-        return (await res.json());
-    }
-    async #getBinary(path) {
-        const res = await this.#fetch(`${this.baseUrl}${path}`);
-        if (!res.ok)
-            throw new Error(`registry: GET ${path} returned ${res.status}`);
-        return Buffer.from(await res.arrayBuffer());
-    }
-}
-//# sourceMappingURL=registry-helpers.js.map

package/dist/registry-helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-helpers.js","sourceRoot":"","sources":["../src/registry-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA8EH;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,CAAS;IAChB,MAAM,CAAe;IAE9B,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,QAAQ,CAAoB,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,QAAQ,CAAgB,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,QAAQ,CAClB,aAAa,kBAAkB,CAAC,IAAI,CAAC,aAAa,CACnD,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAe;QACzC,OAAO,IAAI,CAAC,QAAQ,CAClB,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAC9E,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAe;QACzC,OAAO,IAAI,CAAC,UAAU,CACpB,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAC7E,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,OAAO,IAAI,CAAC,UAAU,CACpB,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAC7E,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACtD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF"}