@tangle-network/starter-foundry 0.1.0

package/registry/layers/capability/tailwind/files/tailwind-config.json

@@ -0,0 +1,34 @@
+{
+  "version": 4,
+  "notes": [
+    "Tailwind v4 uses @import 'tailwindcss' and @theme block in CSS — no tailwind.config.ts needed.",
+    "Colors are defined as --color-* CSS variables inside @theme.",
+    "PostCSS config uses @tailwindcss/postcss plugin (Next.js) or @tailwindcss/vite plugin (Vite).",
+    "CSS variables in @theme enable light/dark mode switching.",
+    "These color tokens are shadcn/ui compatible — use with capability:shadcn for full component system.",
+    "Add @media (prefers-reduced-motion: reduce) { *, *::before, *::after { animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; } } to globals.css for accessibility."
+  ],
+  "theme": {
+    "colors": {
+      "background": "hsl(0 0% 100%)",
+      "foreground": "hsl(222.2 84% 4.9%)",
+      "card": "hsl(0 0% 100%)",
+      "card-foreground": "hsl(222.2 84% 4.9%)",
+      "popover": "hsl(0 0% 100%)",
+      "popover-foreground": "hsl(222.2 84% 4.9%)",
+      "primary": "hsl(222.2 47.4% 11.2%)",
+      "primary-foreground": "hsl(210 40% 98%)",
+      "secondary": "hsl(210 40% 96.1%)",
+      "secondary-foreground": "hsl(222.2 47.4% 11.2%)",
+      "muted": "hsl(210 40% 96.1%)",
+      "muted-foreground": "hsl(215.4 16.3% 46.9%)",
+      "accent": "hsl(210 40% 96.1%)",
+      "accent-foreground": "hsl(222.2 47.4% 11.2%)",
+      "destructive": "hsl(0 84.2% 60.2%)",
+      "border": "hsl(214.3 31.8% 91.4%)",
+      "input": "hsl(214.3 31.8% 91.4%)",
+      "ring": "hsl(222.2 84% 4.9%)"
+    },
+    "radius": "0.5rem"
+  }
+}

package/registry/layers/capability/tailwind/manifest.json

@@ -0,0 +1,53 @@
+{
+  "id": "tailwind",
+  "description": "Adds Tailwind CSS v4 configuration with PostCSS, dark mode support, and design tokens.",
+  "appliesTo": [
+    "react-vite-ts",
+    "nextjs-ts",
+    "fullstack-ts",
+    "sveltekit-ts",
+    "remix-ts",
+    "vue-ts",
+    "angular-ts",
+    "frontend-static",
+    "browser-extension-ts",
+    "electron-desktop-ts",
+    "tauri-desktop"
+  ],
+  "files": [
+    {
+      "source": "files/tailwind-config.json",
+      "target": "tailwind-config.json"
+    },
+    {
+      "source": "files/design-tokens.json",
+      "target": "design-tokens.json"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "tailwind-config.json",
+      "design-tokens.json",
+      "src/globals.css"
+    ]
+  },
+  "keywords": [
+    "tailwind",
+    "tailwindcss",
+    "utility css",
+    "postcss",
+    "professional",
+    "production-ready",
+    "polished",
+    "styled",
+    "dark mode",
+    "responsive design"
+  ],
+  "buildHints": {
+    "architectureNotes": [
+      "Tailwind v4: define colors in @theme block in globals.css, no tailwind.config.ts needed",
+      "Add CSS variables from design-tokens.json to @theme block in globals.css",
+      "Use class-based dark mode with .dark class toggle"
+    ]
+  }
+}

package/registry/layers/capability/tangle-custody/files/blueprint.json

@@ -0,0 +1,17 @@
+{
+  "name": "{{blueprintName}}",
+  "jobs": [
+    {
+      "id": "{{jobName}}",
+      "description": "Approve a threshold signing request and emit a deterministic ceremony result"
+    }
+  ],
+  "operatorRequirements": {
+    "minimumStake": "25",
+    "ceremony": "threshold-signing"
+  },
+  "slashing": {
+    "enabled": true,
+    "reason": "invalid signature share"
+  }
+}

package/registry/layers/capability/tangle-custody/files/lib.rs

@@ -0,0 +1,53 @@
+use blueprint_sdk::Router;
+use blueprint_sdk::tangle::extract::{Caller, TangleArg, TangleResult};
+use serde::{Deserialize, Serialize};
+
+pub const CUSTODY_JOB_ID: u8 = 0;
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct CustodyRequest {
+    pub action: String,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct CustodyResponse {
+    pub action: String,
+    pub approval: String,
+    pub operator: String,
+}
+
+/// Custody job — processes threshold signing requests.
+pub async fn custody_job(
+    Caller(caller): Caller,
+    TangleArg(request): TangleArg<CustodyRequest>,
+) -> TangleResult<CustodyResponse> {
+    let approval = format!("{{jobName}}:approved:{}", request.action);
+
+    TangleResult(CustodyResponse {
+        action: request.action,
+        approval,
+        operator: caller.to_string(),
+    })
+}
+
+#[must_use]
+pub fn router() -> Router {
+    Router::new().route(CUSTODY_JOB_ID, custody_job)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn custody_job_formats_threshold_output() {
+        let caller = [0u8; 32].into();
+        let request = CustodyRequest {
+            action: "transfer".to_string(),
+        };
+
+        let result = custody_job(Caller(caller), TangleArg(request)).await;
+        assert!(result.0.approval.contains("approved"));
+        assert!(result.0.approval.ends_with("transfer"));
+    }
+}

package/registry/layers/capability/tangle-custody/manifest.json

@@ -0,0 +1,30 @@
+{
+  "id": "tangle-custody",
+  "description": "Specializes a Tangle blueprint for MPC custody and threshold signing flows.",
+  "appliesTo": [
+    "tangle-blueprint"
+  ],
+  "files": [
+    {
+      "source": "files/blueprint.json",
+      "target": "blueprint.json"
+    },
+    {
+      "source": "files/lib.rs",
+      "target": "{{packageName}}-lib/src/lib.rs"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "blueprint.json",
+      "{{packageName}}-lib/src/lib.rs"
+    ]
+  },
+  "keywords": [
+    "custody",
+    "mpc",
+    "threshold signing",
+    "key resharing",
+    "signing ceremony"
+  ]
+}

package/registry/layers/capability/tangle-oracle/files/blueprint.json

@@ -0,0 +1,17 @@
+{
+  "name": "{{blueprintName}}",
+  "jobs": [
+    {
+      "id": "{{jobName}}",
+      "description": "Fetch a deterministic data source and produce an attested price update"
+    }
+  ],
+  "operatorRequirements": {
+    "minimumStake": "10",
+    "rewardModel": "attestation"
+  },
+  "slashing": {
+    "enabled": true,
+    "reason": "invalid oracle report"
+  }
+}

package/registry/layers/capability/tangle-oracle/files/lib.rs

@@ -0,0 +1,53 @@
+use blueprint_sdk::Router;
+use blueprint_sdk::tangle::extract::{Caller, TangleArg, TangleResult};
+use serde::{Deserialize, Serialize};
+
+pub const ORACLE_JOB_ID: u8 = 0;
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct OracleRequest {
+    pub pair: String,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct OracleResponse {
+    pub pair: String,
+    pub attestation: String,
+    pub operator: String,
+}
+
+/// Oracle job — fetches price data and returns an attestation.
+pub async fn oracle_job(
+    Caller(caller): Caller,
+    TangleArg(request): TangleArg<OracleRequest>,
+) -> TangleResult<OracleResponse> {
+    let attestation = format!("{{jobName}}:attested:{}", request.pair);
+
+    TangleResult(OracleResponse {
+        pair: request.pair,
+        attestation,
+        operator: caller.to_string(),
+    })
+}
+
+#[must_use]
+pub fn router() -> Router {
+    Router::new().route(ORACLE_JOB_ID, oracle_job)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn oracle_job_formats_attestation_output() {
+        let caller = [0u8; 32].into();
+        let request = OracleRequest {
+            pair: "btc-usd".to_string(),
+        };
+
+        let result = oracle_job(Caller(caller), TangleArg(request)).await;
+        assert!(result.0.attestation.contains("attested"));
+        assert!(result.0.attestation.ends_with("btc-usd"));
+    }
+}

package/registry/layers/capability/tangle-oracle/manifest.json

@@ -0,0 +1,29 @@
+{
+  "id": "tangle-oracle",
+  "description": "Specializes a Tangle blueprint for oracle and attestation workloads.",
+  "appliesTo": [
+    "tangle-blueprint"
+  ],
+  "files": [
+    {
+      "source": "files/blueprint.json",
+      "target": "blueprint.json"
+    },
+    {
+      "source": "files/lib.rs",
+      "target": "{{packageName}}-lib/src/lib.rs"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "blueprint.json",
+      "{{packageName}}-lib/src/lib.rs"
+    ]
+  },
+  "keywords": [
+    "oracle",
+    "price feed",
+    "attestation",
+    "data source"
+  ]
+}

package/registry/layers/capability/typography/files/typography-config.json

@@ -0,0 +1,24 @@
+{
+  "fonts": {
+    "sans": "Inter, system-ui, -apple-system, sans-serif",
+    "mono": "JetBrains Mono, ui-monospace, SFMono-Regular, monospace",
+    "heading": "Inter, system-ui, -apple-system, sans-serif"
+  },
+  "scale": {
+    "xs": "0.75rem",
+    "sm": "0.875rem",
+    "base": "1rem",
+    "lg": "1.125rem",
+    "xl": "1.25rem",
+    "2xl": "1.5rem",
+    "3xl": "1.875rem",
+    "4xl": "2.25rem"
+  },
+  "prose": true,
+  "notes": [
+    "Use @tailwindcss/typography plugin for prose classes on rich content.",
+    "Load Inter from Google Fonts or use next/font for Next.js projects.",
+    "JetBrains Mono for code blocks and monospace contexts.",
+    "Heading scale follows Tailwind defaults — override in tailwind.config if needed."
+  ]
+}

package/registry/layers/capability/typography/manifest.json

@@ -0,0 +1,35 @@
+{
+  "id": "typography",
+  "description": "Adds typography system with prose classes, font loading, and heading scale.",
+  "appliesTo": [
+    "react-vite-ts",
+    "nextjs-ts",
+    "fullstack-ts",
+    "sveltekit-ts",
+    "remix-ts",
+    "vue-ts",
+    "angular-ts",
+    "frontend-static"
+  ],
+  "files": [
+    {
+      "source": "files/typography-config.json",
+      "target": "typography-config.json"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "typography-config.json"
+    ]
+  },
+  "keywords": [
+    "typography",
+    "prose",
+    "font system",
+    "heading scale",
+    "typographic scale"
+  ],
+  "capabilityRequires": [
+    "tailwind"
+  ]
+}

package/registry/layers/capability/webhook-processor/files/webhook-config.json

@@ -0,0 +1,26 @@
+{
+  "providers": [
+    {
+      "id": "stripe",
+      "signatureHeader": "stripe-signature",
+      "secretEnvVar": "STRIPE_WEBHOOK_SECRET",
+      "events": ["checkout.session.completed", "invoice.paid", "customer.subscription.updated"]
+    },
+    {
+      "id": "github",
+      "signatureHeader": "x-hub-signature-256",
+      "secretEnvVar": "GITHUB_WEBHOOK_SECRET",
+      "events": ["push", "pull_request", "issues"]
+    },
+    {
+      "id": "generic",
+      "signatureHeader": "x-webhook-signature",
+      "secretEnvVar": "WEBHOOK_SECRET",
+      "events": ["*"]
+    }
+  ],
+  "queue": {
+    "maxRetries": 3,
+    "baseDelayMs": 1000
+  }
+}

package/registry/layers/capability/webhook-processor/files/webhook-handler.ts

@@ -0,0 +1,61 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+
+type Provider = 'stripe' | 'github' | 'generic'
+
+function computeHmac(algorithm: string, key: string, data: string): Buffer {
+  return createHmac(algorithm, key).update(data, 'utf8').digest()
+}
+
+function safeCompare(a: Buffer, b: Buffer): boolean {
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}
+
+function verifyStripe(payload: string, signature: string, secret: string): boolean {
+  const parts = signature.split(',')
+  const timestamp = parts.find(p => p.startsWith('t='))?.slice(2)
+  const v1 = parts.find(p => p.startsWith('v1='))?.slice(3)
+  if (!timestamp || !v1) {
+    throw new Error('Stripe: malformed signature header — expected t= and v1= fields')
+  }
+  const signedPayload = `${timestamp}.${payload}`
+  const expected = computeHmac('sha256', secret, signedPayload)
+  const received = Buffer.from(v1, 'hex')
+  return safeCompare(expected, received)
+}
+
+function verifyGitHub(payload: string, signature: string, secret: string): boolean {
+  if (!signature.startsWith('sha256=')) {
+    throw new Error('GitHub: signature must start with sha256= prefix')
+  }
+  const expected = computeHmac('sha256', secret, payload)
+  const received = Buffer.from(signature.slice(7), 'hex')
+  return safeCompare(expected, received)
+}
+
+function verifyGeneric(payload: string, signature: string, secret: string): boolean {
+  const expected = computeHmac('sha256', secret, payload)
+  const received = Buffer.from(signature, 'hex')
+  return safeCompare(expected, received)
+}
+
+const verifiers: Record<Provider, (payload: string, signature: string, secret: string) => boolean> = {
+  stripe: verifyStripe,
+  github: verifyGitHub,
+  generic: verifyGeneric,
+}
+
+export function verifySignature(
+  provider: string,
+  payload: string,
+  signature: string,
+  secret: string,
+): boolean {
+  const verify = verifiers[provider as Provider]
+  if (!verify) {
+    throw new Error(`Unsupported webhook provider: ${provider}`)
+  }
+  return verify(payload, signature, secret)
+}
+
+export type { Provider }

package/registry/layers/capability/webhook-processor/files/webhook-queue.ts

@@ -0,0 +1,77 @@
+type EventState = 'received' | 'processing' | 'completed' | 'failed'
+
+interface QueuedEvent {
+  id: string
+  payload: unknown
+  state: EventState
+  attempts: number
+  lastError?: string
+  createdAt: number
+  updatedAt: number
+}
+
+interface QueueOptions {
+  maxRetries?: number
+  baseDelayMs?: number
+}
+
+export function createWebhookQueue(options: QueueOptions = {}) {
+  const { maxRetries = 3, baseDelayMs = 1000 } = options
+  const events = new Map<string, QueuedEvent>()
+
+  function enqueue(id: string, payload: unknown): QueuedEvent {
+    const existing = events.get(id)
+    if (existing) return existing
+    const entry: QueuedEvent = {
+      id,
+      payload,
+      state: 'received',
+      attempts: 0,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    }
+    events.set(id, entry)
+    return entry
+  }
+
+  async function process(
+    id: string,
+    handler: (payload: unknown) => Promise<void>,
+  ): Promise<QueuedEvent> {
+    const entry = events.get(id)
+    if (!entry) throw new Error(`Event ${id} not found`)
+    if (entry.state === 'completed') return entry
+    if (entry.state === 'processing') return entry
+
+    entry.state = 'processing'
+    entry.attempts += 1
+    entry.updatedAt = Date.now()
+
+    try {
+      await handler(entry.payload)
+      entry.state = 'completed'
+      entry.updatedAt = Date.now()
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      entry.lastError = message
+      if (entry.attempts >= maxRetries) {
+        entry.state = 'failed'
+      } else {
+        entry.state = 'received'
+        const delay = baseDelayMs * Math.pow(2, entry.attempts - 1)
+        entry.updatedAt = Date.now()
+        await new Promise(resolve => setTimeout(resolve, delay))
+      }
+    }
+
+    return entry
+  }
+
+  function getStatus(id: string): QueuedEvent | undefined {
+    return events.get(id)
+  }
+
+  return { enqueue, process, getStatus }
+}
+
+export type { QueuedEvent, EventState, QueueOptions }

package/registry/layers/capability/webhook-processor/files/webhook-router.ts

@@ -0,0 +1,77 @@
+import { verifySignature } from './webhook-handler'
+
+interface WebhookEvent {
+  id: string
+  provider: string
+  type: string
+  payload: unknown
+  receivedAt: string
+}
+
+interface ProviderConfig {
+  secret: string
+  handler: (event: WebhookEvent) => Promise<void>
+}
+
+interface WebhookRequest {
+  headers: Record<string, string | undefined>
+  body: string
+}
+
+interface WebhookResponse {
+  status: number
+  body: Record<string, unknown>
+}
+
+const SIGNATURE_HEADERS: Record<string, string> = {
+  stripe: 'stripe-signature',
+  github: 'x-hub-signature-256',
+}
+
+const EVENT_TYPE_HEADERS: Record<string, string> = {
+  stripe: 'x-stripe-event',
+  github: 'x-github-event',
+}
+
+function extractEventType(provider: string, headers: Record<string, string | undefined>, parsed: any): string {
+  const header = EVENT_TYPE_HEADERS[provider]
+  if (header && headers[header]) return headers[header]!
+  return parsed?.type ?? parsed?.action ?? 'unknown'
+}
+
+export function createWebhookRouter(config: {
+  providers: Record<string, ProviderConfig>
+}) {
+  return async (req: WebhookRequest): Promise<WebhookResponse> => {
+    for (const [provider, providerConfig] of Object.entries(config.providers)) {
+      const sigHeader = SIGNATURE_HEADERS[provider] ?? `x-${provider}-signature`
+      const signature = req.headers[sigHeader]
+      if (!signature) continue
+
+      const valid = verifySignature(provider, req.body, signature, providerConfig.secret)
+      if (!valid) {
+        return { status: 400, body: { error: `Invalid ${provider} signature` } }
+      }
+
+      const parsed = JSON.parse(req.body)
+      const event: WebhookEvent = {
+        id: parsed.id ?? crypto.randomUUID(),
+        provider,
+        type: extractEventType(provider, req.headers, parsed),
+        payload: parsed,
+        receivedAt: new Date().toISOString(),
+      }
+
+      try {
+        await providerConfig.handler(event)
+        return { status: 200, body: { received: true, id: event.id } }
+      } catch (err) {
+        return { status: 500, body: { error: 'Handler failed', id: event.id } }
+      }
+    }
+
+    return { status: 400, body: { error: 'No matching provider for request' } }
+  }
+}
+
+export type { WebhookEvent, ProviderConfig, WebhookRequest, WebhookResponse }

package/registry/layers/capability/webhook-processor/manifest.json

@@ -0,0 +1,67 @@
+{
+  "id": "webhook-processor",
+  "description": "Webhook ingestion with HMAC signature verification, provider routing, and idempotent retry queue.",
+  "appliesTo": [
+    "api-service",
+    "agent-service-ts",
+    "agent-service-py"
+  ],
+  "files": [
+    {
+      "source": "files/webhook-config.json",
+      "target": "webhook-config.json"
+    },
+    {
+      "source": "files/webhook-handler.ts",
+      "target": "lib/webhook-handler.ts"
+    },
+    {
+      "source": "files/webhook-router.ts",
+      "target": "lib/webhook-router.ts"
+    },
+    {
+      "source": "files/webhook-queue.ts",
+      "target": "lib/webhook-queue.ts"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "webhook-config.json",
+      "lib/webhook-router.ts"
+    ]
+  },
+  "keywords": [
+    "webhook handler",
+    "webhook processor",
+    "inbound webhook",
+    "webhook ingestion",
+    "webhook endpoint",
+    "signature verification",
+    "hmac"
+  ],
+  "buildHints": {
+    "apiRoutes": [
+      "/api/webhooks",
+      "/api/webhooks/[provider]"
+    ],
+    "architecture": [
+      "webhook-handler.ts → verifySignature(provider, payload, signature, secret) with timing-safe HMAC comparison",
+      "webhook-router.ts → createWebhookRouter({ providers }) returns async (req) => response, matches provider by signature header presence",
+      "webhook-queue.ts → createWebhookQueue() for idempotent dedup + retry with exponential backoff"
+    ],
+    "supportedProviders": [
+      "Stripe (t=/v1= timestamp+signature format)",
+      "GitHub (sha256= prefixed HMAC)",
+      "Generic (raw hex HMAC-SHA256)"
+    ],
+    "dataModels": [
+      "WebhookEvent { id, provider, type, payload, receivedAt }",
+      "QueuedEvent { id, payload, state, attempts, lastError }"
+    ],
+    "productionNotes": [
+      "webhook-queue uses in-memory Map — replace with Redis/BullMQ for durable processing",
+      "Add persistent event log (Postgres/DynamoDB) for audit trail",
+      "webhook-config.json secrets should come from environment variables, not the config file"
+    ]
+  }
+}