From 7044beac51abf3ddf71040971de365265b24250d Mon Sep 17 00:00:00 2001
From: padams <peter@peteradams.org>
Date: Wed, 21 Oct 2026 17:54:25 +0000
Subject: [PATCH 1/3] Keep tests and dev tooling out of installed packages

Composer installs a release from its GitHub archive, which had everything,
so tests/ (including tests/fixtures/echo-server.php, which echoes requests
back), .github/ and phpstan/phpunit config were installed into every
consumer's vendor/. The WordPress plugin 2.2.0 shipped them to sites.
export-ignore leaves them out of git archive and so of the dist download.
---
 .gitattributes | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.gitattributes b/.gitattributes
index 4aa168f..b0d8dc2 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -93,3 +93,16 @@ Procfile text filter=spabs
 *.md text filter=spabs
 LICENSE text filter=spabs
 AUTHORS text filter=spabs
+
+# Not part of the installed package: Composer's dist downloads and
+# `git archive` leave these out.
+/.github export-ignore
+/tests export-ignore
+/phpstan.neon export-ignore
+/phpunit.xml export-ignore
+/composer.lock export-ignore
+/.gitattributes export-ignore
+/.gitconfig export-ignore
+/.gitignore export-ignore
+/CODE_OF_CONDUCT.md export-ignore
+/CONTRIBUTING.md export-ignore

From d95dc1377fc3d9bc75e883599c4cf401109c8528 Mon Sep 17 00:00:00 2001
From: padams <peter@peteradams.org>
Date: Wed, 21 Oct 2026 17:59:01 +0000
Subject: [PATCH 2/3] Refuse to run the echo-server fixture outside php -S;
 check package contents in CI

A copy installed by 1.1.0, a git clone or --prefer-source still has the
fixture, which would echo a visitor's cookies back under a web server.
CI now fails if git archive holds anything beyond LICENSE, README.md,
composer.json, owa-autoloader.php and src/.
---
 .github/workflows/ci.yml       | 10 ++++++++++
 tests/fixtures/echo-server.php |  7 +++++++
 2 files changed, 17 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 114f487..d878876 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,6 +38,16 @@ jobs:
       - name: Show extensions
         run: php -m | grep -iE '^(curl|json|iconv)$' || true
 
+      - name: Check package contents
+        # what Composer installs is `git archive`; anything else is export-ignore'd
+        run: |
+          extra=$(git archive HEAD | tar -t | grep -vE '^(LICENSE|README\.md|composer\.json|owa-autoloader\.php|src/.*)$' || true)
+          if [ -n "$extra" ]; then
+            echo "Not export-ignore'd in .gitattributes:"
+            echo "$extra"
+            exit 1
+          fi
+
       - name: Install dependencies
         run: composer install --no-interaction --no-progress --prefer-dist
 
diff --git a/tests/fixtures/echo-server.php b/tests/fixtures/echo-server.php
index 0229d58..5d34b8f 100644
--- a/tests/fixtures/echo-server.php
+++ b/tests/fixtures/echo-server.php
@@ -3,6 +3,13 @@
 // Router for `php -S`: echoes the request back as JSON so transports can be
 // tested against a real socket.
 
+// Never answer under a real web server: it would echo visitors' cookies back.
+if ( PHP_SAPI !== 'cli-server' ) {
+
+    http_response_code( 404 );
+    return;
+}
+
 if ( ( $_SERVER['REQUEST_URI'] ?? '' ) === '/status/404' ) {
 
     http_response_code( 404 );

From eaf55cfc7848adcfee87e60b491781dbf21ed8d4 Mon Sep 17 00:00:00 2001
From: padams <peter@peteradams.org>
Date: Wed, 21 Oct 2026 18:00:08 +0000
Subject: [PATCH 3/3] 1.1.1

---
 src/sdk.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sdk.php b/src/sdk.php
index c71a878..7b296a1 100644
--- a/src/sdk.php
+++ b/src/sdk.php
@@ -18,7 +18,7 @@
  */
 class sdk {
 
-    const VERSION = '1.1.0';
+    const VERSION = '1.1.1';
 
     private array $config;