@phuetz/code-buddy 1.0.0-rc.8 → 1.0.0

package/dist/openclaw/gateway-bridge.js

@@ -2,7 +2,7 @@ import { constants as fsConstants } from 'fs';
 import { access, appendFile, mkdir, readFile, writeFile } from 'fs/promises';
 import * as os from 'os';
 import * as path from 'path';
-import { randomUUID } from 'crypto';
+import { createPublicKey, randomUUID, sign as signPayload } from 'crypto';
 import { execFile as execFileCallback } from 'node:child_process';
 import { promisify } from 'node:util';
 import WebSocket from 'ws';
@@ -80,6 +80,22 @@ async function readOpenClawUnifiedConfig(home) {
         return null;
     }
 }
+async function readOpenClawDeviceIdentity(home) {
+    try {
+        return JSON.parse(await readFile(path.join(home, 'identity', 'device.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+async function readOpenClawDeviceAuthStore(home) {
+    try {
+        return JSON.parse(await readFile(path.join(home, 'identity', 'device-auth.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
 function openClawHostFromGatewayConfig(gateway) {
     if (typeof gateway?.host === 'string' && gateway.host.trim())
         return gateway.host.trim();
@@ -109,6 +125,38 @@ function synthesizeGatewayLockfileFromUnifiedConfig(config) {
         ...(token ? { token } : {}),
     };
 }
+function normalizeOpenClawDeviceAuthScopes(scopes) {
+    const normalized = Array.isArray(scopes)
+        ? scopes.filter((scope) => typeof scope === 'string' && scope.trim().length > 0)
+        : [];
+    return normalized.length > 0 ? [...new Set(normalized)] : ['operator.read', 'operator.write'];
+}
+async function resolveOpenClawConnectAuth(home, gatewayToken) {
+    const [identity, authStore] = await Promise.all([
+        readOpenClawDeviceIdentity(home),
+        readOpenClawDeviceAuthStore(home),
+    ]);
+    const operator = authStore?.tokens?.operator;
+    const deviceToken = typeof operator?.token === 'string' && operator.token.trim()
+        ? operator.token.trim()
+        : undefined;
+    const deviceId = typeof identity?.deviceId === 'string' && identity.deviceId.trim()
+        ? identity.deviceId.trim()
+        : undefined;
+    const publicKeyPem = typeof identity?.publicKeyPem === 'string' && identity.publicKeyPem.trim()
+        ? identity.publicKeyPem
+        : undefined;
+    const privateKeyPem = typeof identity?.privateKeyPem === 'string' && identity.privateKeyPem.trim()
+        ? identity.privateKeyPem
+        : undefined;
+    const hasSignedDeviceAuth = Boolean(deviceToken && deviceId && publicKeyPem && privateKeyPem);
+    return {
+        ...(hasSignedDeviceAuth ? { deviceToken, deviceId, publicKeyPem, privateKeyPem } : {}),
+        ...(!hasSignedDeviceAuth && gatewayToken ? { gatewayToken } : {}),
+        scopes: normalizeOpenClawDeviceAuthScopes(operator?.scopes),
+        tokenPresent: Boolean(gatewayToken || deviceToken),
+    };
+}
 /**
  * Build a node-host lockfile from the real OpenClaw `devices/paired.json` map
  * (keyed by deviceId) plus gateway host/port from the unified config. Prefers a
@@ -369,6 +417,131 @@ function responsePayloadFromFrame(frame) {
         return frame.data;
     return undefined;
 }
+function errorMessageFromFrame(frame) {
+    if (typeof frame.message === 'string')
+        return compactRedactedText(frame.message);
+    if (typeof frame.error === 'string')
+        return compactRedactedText(frame.error);
+    const error = frame.error && typeof frame.error === 'object'
+        ? frame.error
+        : undefined;
+    return typeof error?.message === 'string' ? compactRedactedText(error.message) : undefined;
+}
+function isOpenClawScopeBlocked(error) {
+    return Boolean(error && /\bmissing scope\b|\bscope upgrade pending\b|\bpairing required\b/i.test(error));
+}
+function normalizeOpenClawDeviceMetadataForAuth(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.trim().replace(/[A-Z]/g, (char) => String.fromCharCode(char.charCodeAt(0) + 32));
+}
+function buildOpenClawDeviceAuthPayloadV3(params) {
+    return [
+        'v3',
+        params.deviceId,
+        params.clientId,
+        params.clientMode,
+        params.role,
+        params.scopes.join(','),
+        String(params.signedAtMs),
+        params.token,
+        params.nonce,
+        normalizeOpenClawDeviceMetadataForAuth(params.platform),
+        normalizeOpenClawDeviceMetadataForAuth(params.deviceFamily),
+    ].join('|');
+}
+function publicKeyRawBase64UrlFromPem(publicKeyPem) {
+    const der = createPublicKey(publicKeyPem).export({ format: 'der', type: 'spki' });
+    return Buffer.from(der).subarray(-32).toString('base64url');
+}
+function buildOpenClawDeviceConnectParams(auth, nonce, platform) {
+    if (!auth.deviceToken || !auth.deviceId || !auth.publicKeyPem || !auth.privateKeyPem || !nonce)
+        return undefined;
+    const signedAtMs = Date.now();
+    const payload = buildOpenClawDeviceAuthPayloadV3({
+        deviceId: auth.deviceId,
+        clientId: 'cli',
+        clientMode: 'cli',
+        role: 'operator',
+        scopes: auth.scopes,
+        signedAtMs,
+        token: auth.deviceToken,
+        nonce,
+        platform,
+    });
+    return {
+        id: auth.deviceId,
+        publicKey: publicKeyRawBase64UrlFromPem(auth.publicKeyPem),
+        signature: signPayload(null, Buffer.from(payload), auth.privateKeyPem).toString('base64url'),
+        signedAt: signedAtMs,
+        nonce,
+    };
+}
+function buildOpenClawConnectFrame(requestId, auth, nonce) {
+    const platform = process.platform;
+    const device = buildOpenClawDeviceConnectParams(auth, nonce, platform);
+    const token = auth.deviceToken || auth.gatewayToken;
+    return {
+        type: 'req',
+        id: `${requestId}:connect`,
+        method: 'connect',
+        params: {
+            minProtocol: 4,
+            maxProtocol: 4,
+            client: {
+                id: 'cli',
+                displayName: 'Code Buddy OpenClaw Bridge',
+                version: '1.0.0',
+                platform,
+                mode: 'cli',
+                instanceId: requestId,
+            },
+            caps: [],
+            role: 'operator',
+            scopes: auth.scopes,
+            ...(token ? { auth: { token, ...(auth.deviceToken ? { deviceToken: auth.deviceToken } : {}) } } : {}),
+            ...(device ? { device } : {}),
+        },
+    };
+}
+function isOpenClawHelloFrame(frame) {
+    const type = frameType(frame);
+    if (type === 'hello-ok' || type === 'hello_ok') {
+        return true;
+    }
+    if ((type === 'res' || type === 'response')
+        && typeof frame.id === 'string'
+        && frame.id.endsWith(':connect')
+        && frame.ok === true) {
+        return true;
+    }
+    const payload = responsePayloadFromFrame(frame);
+    if (!payload || typeof payload !== 'object') {
+        return false;
+    }
+    const body = payload;
+    const nestedType = frameType(body);
+    return nestedType === 'hello-ok'
+        || nestedType === 'hello_ok'
+        || body.ok === true
+        || body.connected === true;
+}
+function connectChallengeNonce(frame) {
+    if (frame.type !== 'event' || frame.event !== 'connect.challenge')
+        return undefined;
+    const payload = frame.payload && typeof frame.payload === 'object'
+        ? frame.payload
+        : undefined;
+    return typeof payload?.nonce === 'string' && payload.nonce.trim()
+        ? payload.nonce.trim()
+        : undefined;
+}
+function helloPayloadFrame(frame) {
+    const payload = responsePayloadFromFrame(frame);
+    return payload && typeof payload === 'object'
+        ? payload
+        : frame;
+}
 async function executableExists(filePath) {
     try {
         await access(filePath, fsConstants.X_OK);
@@ -465,9 +638,15 @@ function safeNodePairingSummary(payload) {
         ? body.nodes
         : Array.isArray(body.pending)
             ? body.pending
-            : Array.isArray(payload)
-                ? payload
-                : [];
+            : Array.isArray(body.pairs)
+                ? body.pairs
+                : Array.isArray(body.devices)
+                    ? body.devices
+                    : Array.isArray(body.requests)
+                        ? body.requests
+                        : Array.isArray(payload)
+                            ? payload
+                            : [];
     const nodes = rawNodes
         .filter((node) => Boolean(node) && typeof node === 'object')
         .map((node) => {
@@ -1064,6 +1243,7 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
     const discovery = await discoverOpenClawGateway({ ...options, cwd, now });
     const lockfile = await readOpenClawLockfile(discovery.lockfilePath);
     const token = tokenFromLockfile(lockfile);
+    const connectAuth = await resolveOpenClawConnectAuth(resolveOpenClawHome(options), token);
     const wsUrl = resolveWebSocketEndpoint(lockfile);
     const dryRun = input.dryRun !== false;
     const liveProbeConfirmed = input.liveProbeConfirmed === true;
@@ -1082,14 +1262,14 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
         ...(input.approvedBy?.trim() ? { approvedBy: input.approvedBy.trim() } : {}),
         liveProbeConfirmed,
         request: {
-            connectFrameType: 'connect',
+            connectFrameType: 'req/connect',
             statusMethod,
             requestId,
         },
     };
     const safetyBase = {
         secretsIncluded: false,
-        tokenPresent: Boolean(token),
+        tokenPresent: connectAuth.tokenPresent,
         tokenSent: false,
         rawPayloadsStored: false,
         networkContacted: false,
@@ -1145,6 +1325,7 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
         let helloFrame = null;
         let resolved = false;
         let statusResponseOk;
+        let connectSent = false;
         const timeout = setTimeout(() => {
             finish(false, 'OpenClaw WebSocket probe timed out');
         }, input.timeoutMs ?? 5_000);
@@ -1178,7 +1359,7 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
                 },
                 safety: {
                     ...safetyBase,
-                    tokenSent: Boolean(token),
+                    tokenSent: connectAuth.tokenPresent,
                     networkContacted: true,
                 },
             };
@@ -1210,18 +1391,12 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
                 });
             });
         };
-        socket.on('open', () => {
-            const connectFrame = {
-                type: 'connect',
-                client: {
-                    name: 'Code Buddy OpenClaw Bridge',
-                    role: 'codebuddy-fleet-bridge',
-                    schemaVersion: OPENCLAW_BRIDGE_SCHEMA_VERSION,
-                },
-                ...(token ? { auth: { token } } : {}),
-            };
-            socket.send(JSON.stringify(connectFrame));
-        });
+        const sendConnect = (nonce) => {
+            if (connectSent)
+                return;
+            connectSent = true;
+            socket.send(JSON.stringify(buildOpenClawConnectFrame(requestId, connectAuth, nonce)));
+        };
         socket.on('message', (data) => {
             let frame;
             try {
@@ -1233,15 +1408,18 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
             }
             const type = frameType(frame);
             frameTypes.push(type);
-            if ((type === 'hello-ok' || type === 'hello_ok') && !helloFrame) {
-                helloFrame = frame;
+            const nonce = connectChallengeNonce(frame);
+            if (nonce) {
+                sendConnect(nonce);
+                return;
+            }
+            if (isOpenClawHelloFrame(frame) && !helloFrame) {
+                helloFrame = helloPayloadFrame(frame);
                 socket.send(JSON.stringify({
                     type: 'req',
                     id: requestId,
                     method: statusMethod,
-                    params: {
-                        source: 'codebuddy-openclaw-bridge',
-                    },
+                    params: {},
                 }));
                 return;
             }
@@ -1250,7 +1428,7 @@ export async function probeOpenClawGatewayWebSocket(input = {}, options = {}) {
                     ? frame.ok
                     : !(frame.error || frame.err);
                 statusResponseOk = ok;
-                finish(ok, ok ? undefined : 'OpenClaw WebSocket status request failed');
+                finish(ok, ok ? undefined : errorMessageFromFrame(frame) || 'OpenClaw WebSocket status request failed');
                 return;
             }
             if (type === 'error') {
@@ -1281,6 +1459,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
     const discovery = await discoverOpenClawGateway({ ...options, cwd, now });
     const lockfile = await readOpenClawLockfile(discovery.lockfilePath);
     const token = tokenFromLockfile(lockfile);
+    const connectAuth = await resolveOpenClawConnectAuth(resolveOpenClawHome(options), token);
     const wsUrl = resolveWebSocketEndpoint(lockfile);
     const dryRun = input.dryRun !== false;
     const liveCallConfirmed = input.liveCallConfirmed === true;
@@ -1308,7 +1487,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
     };
     const safetyBase = {
         secretsIncluded: false,
-        tokenPresent: Boolean(token),
+        tokenPresent: connectAuth.tokenPresent,
         tokenSent: false,
         rawPayloadsStored: false,
         networkContacted: false,
@@ -1365,6 +1544,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
         let resolved = false;
         let rpcOk;
         let safePayloadSummary;
+        let connectSent = false;
         const timeout = setTimeout(() => {
             finish(false, 'OpenClaw WebSocket call timed out');
         }, input.timeoutMs ?? 5_000);
@@ -1394,7 +1574,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
                 },
                 safety: {
                     ...safetyBase,
-                    tokenSent: Boolean(token),
+                    tokenSent: connectAuth.tokenPresent,
                     networkContacted: true,
                 },
             };
@@ -1426,17 +1606,12 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
                 });
             });
         };
-        socket.on('open', () => {
-            socket.send(JSON.stringify({
-                type: 'connect',
-                client: {
-                    name: 'Code Buddy OpenClaw Bridge',
-                    role: 'codebuddy-fleet-bridge',
-                    schemaVersion: OPENCLAW_BRIDGE_SCHEMA_VERSION,
-                },
-                ...(token ? { auth: { token } } : {}),
-            }));
-        });
+        const sendConnect = (nonce) => {
+            if (connectSent)
+                return;
+            connectSent = true;
+            socket.send(JSON.stringify(buildOpenClawConnectFrame(requestId, connectAuth, nonce)));
+        };
         socket.on('message', (data) => {
             let frame;
             try {
@@ -1448,7 +1623,12 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
             }
             const type = frameType(frame);
             frameTypes.push(type);
-            if ((type === 'hello-ok' || type === 'hello_ok') && !helloOk) {
+            const nonce = connectChallengeNonce(frame);
+            if (nonce) {
+                sendConnect(nonce);
+                return;
+            }
+            if (isOpenClawHelloFrame(frame) && !helloOk) {
                 helloOk = true;
                 socket.send(JSON.stringify({
                     type: 'req',
@@ -1464,7 +1644,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
                     : !(frame.error || frame.err);
                 rpcOk = ok;
                 safePayloadSummary = options.summarizePayload?.(responsePayloadFromFrame(frame));
-                finish(ok, ok ? undefined : `OpenClaw WebSocket call failed for ${method}`);
+                finish(ok, ok ? undefined : errorMessageFromFrame(frame) || `OpenClaw WebSocket call failed for ${method}`);
                 return;
             }
             if (type === 'error') {
@@ -1489,7 +1669,7 @@ export async function callOpenClawGatewayWebSocket(input, options = {}) {
 }
 export async function listOpenClawPendingNodes(input = {}, options = {}) {
     return await callOpenClawGatewayWebSocket({
-        method: 'nodes.pending',
+        method: 'node.pair.list',
         params: {},
         approvedBy: input.approvedBy,
         liveCallConfirmed: input.liveCallConfirmed,
@@ -1506,7 +1686,7 @@ export async function approveOpenClawPendingNode(input, options = {}) {
     if (!nodeId && !code)
         throw new Error('nodeId or code is required to approve an OpenClaw node');
     return await callOpenClawGatewayWebSocket({
-        method: 'nodes.approve',
+        method: 'node.pair.approve',
         params: {
             ...(nodeId ? { nodeId } : {}),
             ...(code ? { code } : {}),
@@ -1527,7 +1707,7 @@ export async function rejectOpenClawPendingNode(input, options = {}) {
     if (!nodeId && !code)
         throw new Error('nodeId or code is required to reject an OpenClaw node');
     return await callOpenClawGatewayWebSocket({
-        method: 'nodes.reject',
+        method: 'node.pair.reject',
         params: {
             ...(nodeId ? { nodeId } : {}),
             ...(code ? { code } : {}),
@@ -1643,7 +1823,7 @@ export async function validateOpenClawUpstreamCompatibility(input = {}, options
                     name: 'websocket-probe',
                     ok: true,
                     status: 'preview',
-                    detail: 'Would run connect -> hello-ok -> req(status) -> res',
+                    detail: 'Would run connect.challenge -> signed req(connect) -> res -> req(status) -> res',
                 },
                 {
                     name: 'pending-node-list',
@@ -1651,7 +1831,7 @@ export async function validateOpenClawUpstreamCompatibility(input = {}, options
                     status: input.includePendingNodes === false ? 'skipped' : 'preview',
                     detail: input.includePendingNodes === false
                         ? 'Skipped by includePendingNodes=false'
-                        : 'Would run nodes.pending and store only a safe summary',
+                        : 'Would run node.pair.list and store only a safe summary',
                 },
             ],
             safety: {
@@ -1681,6 +1861,9 @@ export async function validateOpenClawUpstreamCompatibility(input = {}, options
             liveCallConfirmed: true,
             timeoutMs: input.timeoutMs,
         }, options);
+    const pendingNodeScopeBlocked = pendingNodes
+        ? isOpenClawScopeBlocked(pendingNodes.record.response?.error || pendingNodes.error)
+        : false;
     const liveChecks = [
         {
             name: 'openclaw-cli-status',
@@ -1698,14 +1881,18 @@ export async function validateOpenClawUpstreamCompatibility(input = {}, options
         },
         {
             name: 'pending-node-list',
-            ok: pendingNodes ? pendingNodes.ok : true,
-            status: pendingNodes ? (pendingNodes.ok ? 'passed' : 'failed') : 'skipped',
+            ok: pendingNodes ? (pendingNodes.ok || pendingNodeScopeBlocked) : true,
+            status: pendingNodes
+                ? (pendingNodes.ok ? 'passed' : pendingNodeScopeBlocked ? 'blocked' : 'failed')
+                : 'skipped',
             detail: pendingNodes
-                ? pendingNodes.record.response?.error || 'nodes.pending returned a redacted summary'
+                ? pendingNodes.record.response?.error || 'node.pair.list returned a redacted summary'
                 : 'Skipped by includePendingNodes=false',
         },
     ];
-    const ok = (cliStatus ? cliStatus.exitCode === 0 : true) && probe.ok && (pendingNodes ? pendingNodes.ok : true);
+    const ok = (cliStatus ? cliStatus.exitCode === 0 : true)
+        && probe.ok
+        && (pendingNodes ? pendingNodes.ok || pendingNodeScopeBlocked : true);
     return {
         kind: 'openclaw_upstream_validation_result',
         ok,

package/dist/server/websocket/fleet-bridge.d.ts

@@ -76,6 +76,12 @@ export declare function broadcastFleetEvent(type: FleetEventType, payload: Recor
 export declare function broadcastFleetHeartbeat(payload?: {
     idleSince?: number;
     busyWith?: string;
+    /** Live in-flight fleet work count (see src/fleet/fleet-load.ts). */
+    activeRequests?: number;
+    /** Configured capacity (CODEBUDDY_FLEET_MAX_CONCURRENCY). */
+    maxConcurrency?: number;
+    /** activeRequests / maxConcurrency — omitted when capacity is unknown. */
+    utilization?: number;
 }): void;
 /**
  * Phase (d).10 — emit a "compaction started" notice. Called by the

package/dist/skills/hub-signing.d.ts

@@ -73,6 +73,9 @@ export interface SignatureMathResult {
     checksumMatch: boolean;
     mathValid: boolean;
 }
+export interface RegistryIndexSignatureVerification extends SkillSignatureVerification {
+    payloadChecksum: string;
+}
 export declare function isSkillKeyTrust(value: unknown): value is SkillKeyTrust;
 /** True when `trust` is at least as trusted as `min` on the trust ladder. */
 export declare function meetsTrust(trust: SkillKeyTrust, min: SkillKeyTrust): boolean;
@@ -95,6 +98,14 @@ export declare function generateSkillSigningKeyPair(keyId?: string): SkillSignin
  * detached {@link SkillSignature} that binds the content checksum.
  */
 export declare function signSkillContent(content: string, privateKeyB64: string, options?: SignSkillOptions): SkillSignature;
+/**
+ * Canonical JSON used for registry-index signing. The index signs the complete
+ * JSON document after removing its own detached-signature field, with object
+ * keys sorted recursively. This lets publishers format index.json freely while
+ * consumers verify the same semantic payload.
+ */
+export declare function canonicalizeRegistryIndexPayload(index: unknown): string;
+export declare function signRegistryIndexPayload(index: unknown, privateKeyB64: string, options?: SignSkillOptions): SkillSignature;
 /**
  * Low-level check: does the content still hash to the signed checksum, and does
  * the Ed25519 signature verify against the signature's own public key? This does
@@ -114,3 +125,4 @@ export declare function verifySkillSignatureMath(content: string, signature: Ski
  *  5. valid signature, key id + public key match a trusted key -> `verified`
  */
 export declare function resolveSignatureVerification(content: string, signature: SkillSignature | undefined, trustedKeys?: TrustedSkillKey[]): SkillSignatureVerification;
+export declare function resolveRegistryIndexSignatureVerification(index: unknown, signature: SkillSignature | undefined, trustedKeys?: TrustedSkillKey[]): RegistryIndexSignatureVerification;

package/dist/skills/hub-signing.js

@@ -20,6 +20,7 @@ const TRUST_RANK = {
     builtin: 3,
 };
 const SIGNATURE_TRUST_VALUES = ['builtin', 'official', 'trusted', 'community'];
+const REGISTRY_INDEX_SIGNATURE_KEYS = new Set(['signature', 'indexSignature']);
 export function isSkillKeyTrust(value) {
     return typeof value === 'string' && SIGNATURE_TRUST_VALUES.includes(value);
 }
@@ -108,6 +109,18 @@ export function signSkillContent(content, privateKeyB64, options = {}) {
         signedAt: options.signedAt ?? new Date().toISOString(),
     };
 }
+/**
+ * Canonical JSON used for registry-index signing. The index signs the complete
+ * JSON document after removing its own detached-signature field, with object
+ * keys sorted recursively. This lets publishers format index.json freely while
+ * consumers verify the same semantic payload.
+ */
+export function canonicalizeRegistryIndexPayload(index) {
+    return JSON.stringify(stripRegistryIndexSignature(index));
+}
+export function signRegistryIndexPayload(index, privateKeyB64, options = {}) {
+    return signSkillContent(canonicalizeRegistryIndexPayload(index), privateKeyB64, options);
+}
 /**
  * Low-level check: does the content still hash to the signed checksum, and does
  * the Ed25519 signature verify against the signature's own public key? This does
@@ -186,4 +199,28 @@ export function resolveSignatureVerification(content, signature, trustedKeys = [
     }
     return { status: 'verified', keyId: signature.keyId, trust: trusted.trust };
 }
+export function resolveRegistryIndexSignatureVerification(index, signature, trustedKeys = []) {
+    const payload = canonicalizeRegistryIndexPayload(index);
+    return {
+        ...resolveSignatureVerification(payload, signature, trustedKeys),
+        payloadChecksum: sha256Hex(payload),
+    };
+}
+function stripRegistryIndexSignature(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => stripRegistryIndexSignature(item));
+    }
+    if (!value || typeof value !== 'object') {
+        return value;
+    }
+    const record = value;
+    const out = {};
+    for (const key of Object.keys(record).sort()) {
+        if (REGISTRY_INDEX_SIGNATURE_KEYS.has(key)) {
+            continue;
+        }
+        out[key] = stripRegistryIndexSignature(record[key]);
+    }
+    return out;
+}
 //# sourceMappingURL=hub-signing.js.map

package/dist/skills/hub.d.ts

@@ -8,9 +8,9 @@
  * semver version comparison, and event-driven lifecycle hooks.
  */
 import { EventEmitter } from 'events';
-import type { SkillSignature, SkillKeyTrust, SkillSignatureStatus, SkillSignatureVerification, TrustedSkillKey, SkillSigningKeyPair } from './hub-signing.js';
-export { generateSkillSigningKeyPair, signSkillContent, resolveSignatureVerification, verifySkillSignatureMath, computeKeyId, meetsTrust, } from './hub-signing.js';
-export type { SkillSignature, SkillSignatureAlgorithm, SkillKeyTrust, SkillSignatureStatus, SkillSignatureVerification, TrustedSkillKey, SkillSigningKeyPair, } from './hub-signing.js';
+import type { SkillSignature, SkillKeyTrust, SkillSignatureStatus, SkillSignatureVerification, RegistryIndexSignatureVerification, TrustedSkillKey, SkillSigningKeyPair } from './hub-signing.js';
+export { generateSkillSigningKeyPair, signSkillContent, signRegistryIndexPayload, canonicalizeRegistryIndexPayload, resolveSignatureVerification, verifySkillSignatureMath, computeKeyId, meetsTrust, } from './hub-signing.js';
+export type { SkillSignature, SkillSignatureAlgorithm, SkillKeyTrust, SkillSignatureStatus, SkillSignatureVerification, RegistryIndexSignatureVerification, TrustedSkillKey, SkillSigningKeyPair, } from './hub-signing.js';
 export interface HubSkill {
     /** Unique skill name */
     name: string;
@@ -294,6 +294,7 @@ export interface SkillTapDiscoveryResult {
 export interface WellKnownSkillDiscoveryResult {
     errors: string[];
     indexUrl: string;
+    indexSignature: RegistryIndexSignatureVerification;
     refreshedAt: string;
     skillCount: number;
     skills: DiscoveredHubSkill[];
@@ -431,6 +432,8 @@ export declare class SkillsHub extends EventEmitter {
     private replaceTapCacheForTaps;
     private resolveWellKnownIndexUrl;
     private extractWellKnownEntries;
+    private verifyRegistryIndexSignature;
+    private extractRegistryIndexSignature;
     private discoveredSkillFromWellKnownEntry;
     private readStringField;
     private readStringArrayField;
@@ -482,6 +485,8 @@ export declare class SkillsHub extends EventEmitter {
     private enforceSignaturePolicy;
     private readTrustedKeysFile;
     private writeTrustedKeysFile;
+    private withOfficialTrustedKeys;
+    private isOfficialSkillPublisherKey;
     private normalizeTrustedKeyRecord;
     /**
      * Search for skills by query string matching name, tags, and description.