Module package_index 

HTTP client for the ZLayer package index (packages.zlayer.dev) plus the shared streaming-download-with-integrity primitive.

packages.zlayer.dev is a Cloudflare worker in front of the Komodo ZPackageIndex container. Public reads are verbatim:

• GET /formula/:name → a Homebrew formula JSON (FormulaData) carrying versions.stable, urls.stable.{url,checksum} and per-platform bottle.stable.files.<tag>.{url,sha256}.
• GET /choco/:name → a Chocolatey OData entry (ChocoData).

Writes / hints / /admin/* require an HMAC signature (x-reposync-signature: sha256=<hex> over the request body), keyed by the ZLAYER_REPOSYNC_HMAC_SECRET build-time secret. sign is the single DRY home for that signature — the builder’s harvest / windows-image resolvers (a later commit) reuse it instead of re-deriving HMAC each.

Reads degrade gracefully: the index base URL first, then (on miss/failure) the direct upstream (formulae.brew.sh for brew). On a /formula/:name miss the client fires a best-effort HMAC refresh hint and retries once before falling back.

Structs

PackageIndexClient

A typed client over the ZLayer package index.

Functions

download_verified

Stream url into dest while hashing with SHA-256.

sign

Compute the reposync HMAC signature for a request body: sha256=<hex> = HMAC-SHA256(secret, body).