@particle-academy/fancy-connector-core 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to `fancy-connector-core` are documented here, in
 **This package is pre-1.0, so breaking changes land in MINOR releases.** The
 version number is not a promise it can keep yet; the entries below are.
 
+## [0.8.1] - 2026-09-15
+
+### Changed
+
+- **`verifyDelivery` dispatches on a NAMED scheme kind and refuses one it does
+  not know.** `HmacScheme` gains an optional `kind?: "hmac"`; absent still
+  means HMAC, because every scheme written before 0.8.0 is one, and
+  `"shared-token"` still goes to the token check — but any other value is now
+  refused by name (`declares a verification scheme "jwt" this runtime does not
+  know`) rather than verified as HMAC. From Fancy's alignment review of
+  0.8.0: `"kind" in scheme` had made refusal-by-default depend on every future
+  scheme remembering to declare a kind. Connectors compile unchanged.
+
 ## [0.8.0] - 2026-09-15
 
 The declaration half of the subscription vocabulary (Tynn #15), so a

package/dist/index.cjs

@@ -1795,6 +1795,13 @@ async function verifyDelivery(trigger, delivery, secret, now) {
   if (isSharedTokenSpec(spec)) {
     return verifySharedToken({ raw: delivery.raw, headers: delivery.headers, secret, scheme: spec.scheme });
   }
+  const kind = spec.scheme.kind ?? "hmac";
+  if (kind !== "hmac") {
+    return {
+      ok: false,
+      reason: `${trigger.service}.${trigger.operation} declares a verification scheme "${kind}" this runtime does not know \u2014 refusing rather than guessing.`
+    };
+  }
   const rawHeader = header2(delivery.headers, spec.signatureHeader);
   const parsed = spec.parse && rawHeader ? spec.parse(rawHeader) : { signature: rawHeader };
   const timestamp = parsed.timestamp ?? (spec.timestampHeader ? header2(delivery.headers, spec.timestampHeader) : void 0);