@idpartners/client-attestation-sdk 1.0.1 → 1.2.0

package/dist/errors.js

@@ -2,7 +2,11 @@
  * The SDK's error types. {@link ClientAttestationError} is the base for every failure of the
  * one-call flow; {@link TransportError} is the subclass for anything that went wrong on the wire.
  */
-/** A step in the flow failed. `status` and `body` are set for HTTP failures. */
+/**
+ * A step in the flow failed. `status` and `body` are set for HTTP failures: `body` is at most the first 512
+ * characters of a non-2xx response, and unset for a 2xx response that could not be used, since that body
+ * may hold a token, attestation or SVID.
+ */
 export class ClientAttestationError extends Error {
     status;
     body;
@@ -16,7 +20,7 @@ export class ClientAttestationError extends Error {
 /**
  * An outbound HTTP call failed: unreachable, timed out, redirected, oversized, non-2xx, or malformed
  * JSON (see {@link kind}). `status` is set when a response was received; `body` holds at most the first
- * 512 characters of it.
+ * 512 characters of a non-2xx one.
  */
 export class TransportError extends ClientAttestationError {
     kind;

package/dist/evidence.d.ts

@@ -19,6 +19,7 @@ export declare class EvidenceNotFound extends Error {
  * Kubernetes and GKE mount a short-lived, auto-rotated service-account token into the pod as a file
  * (a projected `serviceAccountToken` volume). Reading it fresh each time picks up the rotation. The
  * file's audience must already be the attester's evidence audience — set it when you declare the volume.
+ * The path must be a regular file of at most 64 KiB; anything else is an {@link EvidenceNotFound}.
  *
  * Needs a filesystem: `node:fs/promises` is loaded on the first `fetch`, which throws a
  * `ClientAttestationError` on a runtime without it.
@@ -33,7 +34,8 @@ export declare class FileTokenSvidSource implements SvidSource {
  *
  * Works on any Google runtime that exposes the metadata server (GCE, GKE, Cloud Run, Vertex AI Agent
  * Engine). The token's `aud` is the attester's evidence audience; `sub` is the service account. No
- * google-auth dependency — a plain metadata call.
+ * google-auth dependency — a plain metadata call. The answer must be HTTP 200 carrying the
+ * `Metadata-Flavor: Google` response header, as the real metadata server sends.
  */
 export declare class GoogleMetadataSvidSource implements SvidSource {
     private readonly timeoutMs;

package/dist/evidence.js

@@ -10,12 +10,12 @@
  * - the GCP metadata server (GCE, GKE, Cloud Run, Vertex AI Agent Engine).
  *
  * {@link autoDetectEvidence} tries these in order and returns the first that applies, so a developer
- * can write `new ClientAttestation(attesterUrl)` and have it work without naming the source. Override by
+ * can write `new ClientAttestation(attesterUrl, { evidenceAudience })` and have it work without naming the source. Override by
  * passing an explicit {@link SvidSource} to {@link ClientAttestation}.
  */
 import { TransportError } from "./errors.js";
 import { request, snippet } from "./http.js";
-import { envVar, importNodeBuiltin } from "./runtime.js";
+import { envVar, importNodeBuiltin, utf8Decode } from "./runtime.js";
 import { SpireWorkloadApiSvidSource, StaticSvidSource } from "./svid-source.js";
 /** Environment variable holding the evidence token itself (static). */
 export const ENV_SVID = "CLIENT_ATTESTATION_SVID";
@@ -39,6 +39,8 @@ export const GCP_METADATA_BASE = "http://metadata.google.internal";
  * @internal
  */
 export const GCP_METADATA_IDENTITY = GCP_METADATA_BASE + "/computeMetadata/v1/instance/service-accounts/default/identity";
+/** A token file larger than this (64 KiB) is refused: a projected token is a few KiB. */
+const MAX_TOKEN_FILE_BYTES = 64 * 1024;
 /** No platform identity could be detected and none was supplied. */
 export class EvidenceNotFound extends Error {
     constructor(message) {
@@ -52,6 +54,7 @@ export class EvidenceNotFound extends Error {
  * Kubernetes and GKE mount a short-lived, auto-rotated service-account token into the pod as a file
  * (a projected `serviceAccountToken` volume). Reading it fresh each time picks up the rotation. The
  * file's audience must already be the attester's evidence audience — set it when you declare the volume.
+ * The path must be a regular file of at most 64 KiB; anything else is an {@link EvidenceNotFound}.
  *
  * Needs a filesystem: `node:fs/promises` is loaded on the first `fetch`, which throws a
  * `ClientAttestationError` on a runtime without it.
@@ -62,9 +65,29 @@ export class FileTokenSvidSource {
         this.path = path;
     }
     async fetch(_audience) {
-        const { readFile } = await importNodeBuiltin("fs/promises", "FileTokenSvidSource");
-        const contents = await readFile(this.path, "utf8");
-        return contents.trim();
+        const { open, stat } = await importNodeBuiltin("fs/promises", "FileTokenSvidSource");
+        // Checked before opening: opening a FIFO blocks, and a device such as /dev/zero never ends.
+        if (!(await stat(this.path)).isFile()) {
+            throw new EvidenceNotFound(`token file ${this.path} is not a regular file`);
+        }
+        const handle = await open(this.path, "r");
+        try {
+            const buf = new Uint8Array(MAX_TOKEN_FILE_BYTES + 1);
+            let total = 0;
+            for (;;) {
+                const { bytesRead } = await handle.read(buf, total, buf.length - total, null);
+                if (bytesRead === 0)
+                    break;
+                total += bytesRead;
+                if (total > MAX_TOKEN_FILE_BYTES) {
+                    throw new EvidenceNotFound(`token file ${this.path} is larger than ${MAX_TOKEN_FILE_BYTES} bytes`);
+                }
+            }
+            return utf8Decode(buf.subarray(0, total)).trim();
+        }
+        finally {
+            await handle.close();
+        }
     }
 }
 /**
@@ -72,7 +95,8 @@ export class FileTokenSvidSource {
  *
  * Works on any Google runtime that exposes the metadata server (GCE, GKE, Cloud Run, Vertex AI Agent
  * Engine). The token's `aud` is the attester's evidence audience; `sub` is the service account. No
- * google-auth dependency — a plain metadata call.
+ * google-auth dependency — a plain metadata call. The answer must be HTTP 200 carrying the
+ * `Metadata-Flavor: Google` response header, as the real metadata server sends.
  */
 export class GoogleMetadataSvidSource {
     timeoutMs;
@@ -92,12 +116,17 @@ export class GoogleMetadataSvidSource {
             headers: { "Metadata-Flavor": "Google" },
             timeoutMs: this.timeoutMs,
         });
-        if (!res.ok) {
+        if (res.status !== 200) {
             throw new TransportError(`GCP metadata identity endpoint -> ${res.status}`, "status", {
                 status: res.status,
                 body: snippet(res.body),
             });
         }
+        if (!fromGoogleMetadata(res.headers)) {
+            throw new TransportError("GCP metadata identity endpoint answered without Metadata-Flavor: Google", "status", {
+                status: res.status,
+            });
+        }
         return res.body.trim();
     }
 }
@@ -114,6 +143,15 @@ async function pathProbe() {
         return () => false;
     }
 }
+/** Whether a response carries the header the GCP metadata server always sets. */
+function fromGoogleMetadata(headers) {
+    return headers.get("Metadata-Flavor") === "Google";
+}
+/**
+ * Whether the GCP metadata server answers: HTTP 200 with `Metadata-Flavor: Google`.
+ * `metadata.google.internal` is a DNS name, so whatever a search domain, LLMNR or a hostile resolver
+ * points it at could answer; the header is what google-auth checks too.
+ */
 async function gcpMetadataAvailable(base, timeoutMs = 300) {
     try {
         const res = await request(base + "/computeMetadata/v1/", {
@@ -121,7 +159,7 @@ async function gcpMetadataAvailable(base, timeoutMs = 300) {
             headers: { "Metadata-Flavor": "Google" },
             timeoutMs,
         });
-        return res.ok;
+        return res.status === 200 && fromGoogleMetadata(res.headers);
     }
     catch {
         return false;

package/dist/http.js

@@ -9,20 +9,50 @@
  * - redirects are never followed — a 3xx is a {@link TransportError}, and the target is never contacted;
  * - the response body is capped (default 1 MiB), by `content-length` and again while streaming;
  * - {@link request} returns non-2xx responses as data; {@link jsonOk} turns them, and malformed JSON,
- *   into a {@link TransportError}.
+ *   into a {@link TransportError};
+ * - a URL with userinfo (`user:password@`) is refused, and errors name a URL without its userinfo, query or
+ *   fragment.
+ *
+ * Proxies: `fetch` uses no proxy from the environment by default (Node, Deno, Bun without configuration,
+ * edge runtimes). Node started with `NODE_USE_ENV_PROXY=1` or `--use-env-proxy` sends every request,
+ * plain http included, to `HTTP_PROXY` / `HTTPS_PROXY`; the SDK can't pick a dispatcher per request
+ * without depending on undici, so the other ports' rule (a proxy only for https to a remote host) is
+ * then the operator's to keep, with `NO_PROXY`.
  */
-import { TransportError } from "./errors.js";
+import { ClientAttestationError, TransportError } from "./errors.js";
 import { utf8Decode, utf8Encode } from "./runtime.js";
 /** @internal */
 export const DEFAULT_MAX_BYTES = 1024 * 1024;
 /** @internal */
 export const DEFAULT_TIMEOUT_MS = 20_000;
 /**
- * At most this many characters of a response body are carried in an error.
+ * At most this many characters of a non-2xx response body are carried in an error. A 2xx body never is:
+ * that is where access tokens, attestations and SVIDs travel.
  *
  * @internal
  */
 export const ERROR_BODY_CHARS = 512;
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+/**
+ * Refuse a non-https URL unless it is loopback or the caller passed `allowInsecure`. Shared by every SDK
+ * client that sends credentials.
+ *
+ * @internal
+ */
+export function checkSecure(url, what, allowInsecure) {
+    if (allowInsecure)
+        return;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new ClientAttestationError(`${what} is not a valid URL: ${url}`);
+    }
+    if (parsed.protocol === "https:" || LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase()))
+        return;
+    throw new ClientAttestationError(`${what} must use https: ${url} (loopback hosts are exempt; pass allowInsecure: true to override)`);
+}
 /**
  * The first {@link ERROR_BODY_CHARS} characters of a body, for an error message.
  *
@@ -31,6 +61,30 @@ export const ERROR_BODY_CHARS = 512;
 export function snippet(body) {
     return body.length > ERROR_BODY_CHARS ? body.slice(0, ERROR_BODY_CHARS) : body;
 }
+/**
+ * `url` without its userinfo, query or fragment, for error messages: a query can carry a secret, and
+ * userinfo is one.
+ *
+ * @internal
+ */
+export function displayUrl(url) {
+    const beforeQuery = url.split(/[?#]/, 1)[0] ?? "";
+    return beforeQuery.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/\\]*@/, "$1");
+}
+/**
+ * Whether `url` carries userinfo, read as `fetch` would read it; an unparseable URL is checked by hand.
+ *
+ * @internal
+ */
+export function hasUserinfo(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.username !== "" || parsed.password !== "";
+    }
+    catch {
+        return /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#\\]*@/.test(url);
+    }
+}
 function describe(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -49,7 +103,11 @@ export async function request(url, opts = {}) {
     const method = opts.method ?? "GET";
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
-    const where = `${method} ${url}`;
+    const where = `${method} ${displayUrl(url)}`;
+    if (hasUserinfo(url)) {
+        // fetch refuses these too, but its error would come after `where` held the userinfo
+        throw new TransportError(`${where}: URLs with userinfo (user:password@) are not supported`, "network");
+    }
     const timedOut = (cause) => new TransportError(`${where} timed out after ${timeoutMs} ms`, "timeout", { cause });
     let res;
     try {
@@ -147,7 +205,7 @@ async function readCapped(res, maxBytes, tooLarge) {
 export function jsonOk(res, opts = {}) {
     if (!res.ok) {
         const body = snippet(res.body);
-        throw new TransportError(`${res.method} ${res.url} returned HTTP ${res.status}: ${body}`, "status", {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} returned HTTP ${res.status}: ${body}`, "status", {
             status: res.status,
             body,
         });
@@ -155,7 +213,9 @@ export function jsonOk(res, opts = {}) {
     return parseJsonObject(res, opts);
 }
 /**
- * Parse `res.body` as a JSON object regardless of status; a {@link TransportError} if it is not one.
+ * Parse `res.body` as a JSON object regardless of status; a {@link TransportError} if it is not one. The
+ * error carries no body, no cause and not the parser's message, which quotes part of the text: the body
+ * parsed here is a 2xx one, which carries tokens, attestations and SVIDs.
  *
  * @internal
  */
@@ -166,17 +226,12 @@ export function parseJsonObject(res, opts = {}) {
     try {
         parsed = JSON.parse(res.body);
     }
-    catch (err) {
-        throw new TransportError(`${res.method} ${res.url} returned malformed JSON: ${describe(err)}`, "json", {
-            status: res.status,
-            body: snippet(res.body),
-            cause: err,
-        });
+    catch {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} returned malformed JSON`, "json", { status: res.status });
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new TransportError(`${res.method} ${res.url} did not return a JSON object`, "json", {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} did not return a JSON object`, "json", {
             status: res.status,
-            body: snippet(res.body),
         });
     }
     return parsed;

package/dist/index.d.ts

@@ -21,6 +21,6 @@ export type { AttesterMetadata, AttesterProfile, AttesterTransport, MintResult }
 export type { TransportFailure } from "./errors.js";
 export { NOOP_LOGGER } from "./logging.js";
 export type { Logger, LogAttributes, LogLevel } from "./logging.js";
-export declare const VERSION = "1.0.1";
+export declare const VERSION = "1.2.0";
 /** draft-ietf-oauth-attestation-based-client-auth revision this SDK implements. */
 export declare const DRAFT_REVISION = "10";

package/dist/index.js

@@ -15,6 +15,6 @@ export { EvidenceNotFound, FileTokenSvidSource, GoogleMetadataSvidSource, autoDe
 export { ClientAttestation, ClientAttestationError, TransportError, DEFAULT_EXPIRY_SKEW_SECONDS, } from "./token-source.js";
 export { MintRequest, PingFederateProfile } from "./attester.js";
 export { NOOP_LOGGER } from "./logging.js";
-export const VERSION = "1.0.1";
+export const VERSION = "1.2.0";
 /** draft-ietf-oauth-attestation-based-client-auth revision this SDK implements. */
 export const DRAFT_REVISION = "10";

package/dist/issuance.d.ts

@@ -12,20 +12,26 @@ import type { SvidSource } from "./svid-source.js";
 /** The instance-key proof typ the PingFederate profile presents (server InstanceKeyProofValidator.TYP). */
 export { INSTANCE_PROOF_TYP } from "./attester.js";
 /**
- * Thrown when the issuance endpoint rejects the request (non-2xx). Transport failures — unreachable,
- * timeout, redirect, oversized or malformed response — are a {@link TransportError} instead.
+ * Thrown when the issuance endpoint rejects the request (non-2xx); `body` is at most the first 512
+ * characters of the response. Transport failures — unreachable, timeout, redirect, oversized or malformed
+ * response — are a {@link TransportError} instead.
  */
 export declare class IssuanceError extends Error {
     readonly status: number;
     readonly body: string;
     constructor(status: number, body: string);
 }
-/** A minted Client Attestation plus the instance key it is bound to. */
+/**
+ * A minted Client Attestation plus the instance key it is bound to. The attestation is a getter over a
+ * private field, so `JSON.stringify` and `console.log` of this object don't show it.
+ */
 export declare class IssuedAttestation {
-    readonly attestation: string;
+    #private;
     readonly expiresIn: number | undefined;
     readonly instanceKey: SigningKeyPair;
     constructor(attestation: string, expiresIn: number | undefined, instanceKey: SigningKeyPair);
+    /** The Client Attestation (a compact JWT). */
+    get attestation(): string;
     /** A fresh Client Attestation PoP for the token endpoint, signed by the bound instance key. */
     pop(audience: string, clientId?: string, challenge?: string): Promise<string>;
     /**
@@ -39,6 +45,9 @@ export declare class IssuedAttestation {
  *
  * `opts.profile` sets the mint protocol (default {@link PingFederateProfile}; see
  * docs/attester-profiles.md). The endpoint is given directly, so the profile's discovery is not used.
+ *
+ * The SVID is a bearer credential to the attester, so the endpoint, and every URL the profile calls, must be
+ * https unless its host is loopback (`localhost`, `127.0.0.1`, `::1`) or `opts.allowInsecure` is set.
   *
   * @experimental See docs/api.md: it calls a PingFederate demo issuance servlet (/federation/attestation)
   * whose protocol is not standardised.
@@ -50,11 +59,16 @@ export declare class AttestationIssuanceClient {
     private readonly source;
     readonly instanceKey: SigningKeyPair;
     readonly profile: AttesterProfile;
+    private readonly transport;
     private constructor();
-    /** Generate a fresh ES256 instance key and return a ready client. */
+    /**
+     * Generate a fresh ES256 instance key and return a ready client. `opts.allowInsecure` permits plain-http
+     * URLs on hosts that are not loopback (default `false`).
+     */
     static create(endpoint: string, clientId: string, attesterIssuer: string, source: SvidSource, opts?: {
         instanceKey?: SigningKeyPair;
         profile?: AttesterProfile;
+        allowInsecure?: boolean;
     }): Promise<AttestationIssuanceClient>;
     /** Fetch the SVID, prove possession of the instance key, and exchange them for a minted attestation. */
     bootstrap(authorizationDetails?: Array<Record<string, unknown>>, challenge?: string): Promise<IssuedAttestation>;

package/dist/issuance.js

@@ -8,15 +8,17 @@
  */
 import { MintRequest, PingFederateProfile } from "./attester.js";
 import { DpopProofBuilder, PopBuilder } from "./builders.js";
-import { jsonOk, request } from "./http.js";
+import { ClientAttestationError } from "./errors.js";
+import { checkSecure, jsonOk, request, snippet } from "./http.js";
 import { SigningKeyPair } from "./signing-key-pair.js";
 /** The instance-key proof typ the PingFederate profile presents (server InstanceKeyProofValidator.TYP). */
 export { INSTANCE_PROOF_TYP } from "./attester.js";
 /** Per-call timeout for the issuance endpoint. */
 const ISSUANCE_TIMEOUT_MS = 20_000;
 /**
- * Thrown when the issuance endpoint rejects the request (non-2xx). Transport failures — unreachable,
- * timeout, redirect, oversized or malformed response — are a {@link TransportError} instead.
+ * Thrown when the issuance endpoint rejects the request (non-2xx); `body` is at most the first 512
+ * characters of the response. Transport failures — unreachable, timeout, redirect, oversized or malformed
+ * response — are a {@link TransportError} instead.
  */
 export class IssuanceError extends Error {
     status;
@@ -28,15 +30,22 @@ export class IssuanceError extends Error {
         this.name = "IssuanceError";
     }
 }
-/** A minted Client Attestation plus the instance key it is bound to. */
+/**
+ * A minted Client Attestation plus the instance key it is bound to. The attestation is a getter over a
+ * private field, so `JSON.stringify` and `console.log` of this object don't show it.
+ */
 export class IssuedAttestation {
-    attestation;
     expiresIn;
     instanceKey;
+    #attestation;
     constructor(attestation, expiresIn, instanceKey) {
-        this.attestation = attestation;
         this.expiresIn = expiresIn;
         this.instanceKey = instanceKey;
+        this.#attestation = attestation;
+    }
+    /** The Client Attestation (a compact JWT). */
+    get attestation() {
+        return this.#attestation;
     }
     /** A fresh Client Attestation PoP for the token endpoint, signed by the bound instance key. */
     async pop(audience, clientId, challenge) {
@@ -63,6 +72,9 @@ export class IssuedAttestation {
  *
  * `opts.profile` sets the mint protocol (default {@link PingFederateProfile}; see
  * docs/attester-profiles.md). The endpoint is given directly, so the profile's discovery is not used.
+ *
+ * The SVID is a bearer credential to the attester, so the endpoint, and every URL the profile calls, must be
+ * https unless its host is loopback (`localhost`, `127.0.0.1`, `::1`) or `opts.allowInsecure` is set.
   *
   * @experimental See docs/api.md: it calls a PingFederate demo issuance servlet (/federation/attestation)
   * whose protocol is not standardised.
@@ -74,36 +86,47 @@ export class AttestationIssuanceClient {
     source;
     instanceKey;
     profile;
-    constructor(endpoint, clientId, attesterIssuer, source, instanceKey, profile) {
+    transport;
+    constructor(endpoint, clientId, attesterIssuer, source, instanceKey, profile, transport) {
         this.endpoint = endpoint;
         this.clientId = clientId;
         this.attesterIssuer = attesterIssuer;
         this.source = source;
         this.instanceKey = instanceKey;
         this.profile = profile;
+        this.transport = transport;
     }
-    /** Generate a fresh ES256 instance key and return a ready client. */
+    /**
+     * Generate a fresh ES256 instance key and return a ready client. `opts.allowInsecure` permits plain-http
+     * URLs on hosts that are not loopback (default `false`).
+     */
     static async create(endpoint, clientId, attesterIssuer, source, opts) {
+        const allowInsecure = opts?.allowInsecure ?? false;
+        const trimmed = endpoint.replace(/\/$/, "");
+        checkSecure(trimmed, "endpoint", allowInsecure);
         const key = opts?.instanceKey ?? (await SigningKeyPair.generate("ES256"));
         const profile = opts?.profile ?? new PingFederateProfile();
-        return new AttestationIssuanceClient(endpoint.replace(/\/$/, ""), clientId, attesterIssuer, source, key, profile);
+        return new AttestationIssuanceClient(trimmed, clientId, attesterIssuer, source, key, profile, issuanceTransport(allowInsecure));
     }
     /** Fetch the SVID, prove possession of the instance key, and exchange them for a minted attestation. */
     async bootstrap(authorizationDetails, challenge) {
         const svid = await this.source.fetch(this.attesterIssuer);
-        const minted = await this.profile.mint(issuanceTransport, { evidenceAudience: this.attesterIssuer, attestationEndpoint: this.endpoint }, new MintRequest({
+        const minted = await this.profile.mint(this.transport, { evidenceAudience: this.attesterIssuer, attestationEndpoint: this.endpoint }, new MintRequest({
             instanceKey: this.instanceKey,
             evidence: svid,
             challenge: challenge || undefined,
             clientId: this.clientId,
             authorizationDetails,
         }));
+        if (!minted?.attestation)
+            throw new ClientAttestationError("attester response contained no attestation");
         return new IssuedAttestation(minted.attestation, minted.expiresIn, this.instanceKey);
     }
 }
-/** The issuance endpoint's transport: a non-2xx answer is an {@link IssuanceError}. */
-const issuanceTransport = {
-    async requestJson(_step, method, url, body) {
+/** The issuance endpoint's transport: the https rule, and a non-2xx answer is an {@link IssuanceError}. */
+const issuanceTransport = (allowInsecure) => ({
+    async requestJson(step, method, url, body) {
+        checkSecure(url, `${step} URL`, allowInsecure);
         const res = await request(url, {
             method,
             headers: { "Content-Type": "application/json", Accept: "application/json" },
@@ -111,7 +134,7 @@ const issuanceTransport = {
             timeoutMs: ISSUANCE_TIMEOUT_MS,
         });
         if (!res.ok)
-            throw new IssuanceError(res.status, res.body);
+            throw new IssuanceError(res.status, snippet(res.body));
         return jsonOk(res);
     },
-};
+});

package/dist/logging.js

@@ -4,25 +4,59 @@
  * other ports; see docs/logging.md.
  *
  * Never logged: tokens, attestations, proofs, SVIDs, challenge values, key material, header values, or
- * URLs with their query string. As a backstop, any string attribute containing `eyJ` (how a JWT's
- * base64url-encoded header begins) is replaced with `<redacted:N bytes>` before it reaches the logger.
+ * URLs with their query string. As a backstop, an attribute under a credential key (`token`, `*_token`,
+ * `auth_req_id`, `code`, ...), or a string attribute that carries a credential (contains `eyJ`, how a
+ * JWT's base64url-encoded header begins; a Vault/OpenBao token; an `Authorization` header value), is
+ * replaced with `<redacted:N bytes>` before it reaches the logger.
  */
 import { TransportError } from "./errors.js";
 import { utf8Encode } from "./runtime.js";
 const noop = () => undefined;
 /** The default: drops everything. */
 export const NOOP_LOGGER = { debug: noop, info: noop, warn: noop, error: noop };
-function guard(value) {
+// The backstop (docs/logging.md, the same rule in every port): an attribute is redacted when its key names
+// a credential, or its value carries one this SDK handles. Keys are matched in lower case.
+const SECRET_KEYS = new Set([
+    "svid", "proof", "assertion", "client_assertion", "subject_token", "actor_token", "client_secret",
+    "attestation", "access_token", "refresh_token", "id_token", "authorization", "dpop",
+    "oauth-client-attestation", "oauth-client-attestation-pop", "auth_req_id", "code", "handle", "token",
+    "secret", "password", "private_key", "vault_token", "x-vault-token",
+]);
+const SECRET_KEY_SUFFIXES = ["_token", "-token", "_secret", "-secret", "_password"];
+// Vault/OpenBao tokens: hvs./hvb./hvr. and the older s./b./r. forms, standing alone.
+const VAULT_TOKEN = /(?:^|[^A-Za-z0-9._-])(?:hv[sbr]\.[A-Za-z0-9_-]{20,}|[sbr]\.[A-Za-z0-9_-]{24,}(?:$|[^A-Za-z0-9._-]))/;
+// An Authorization header value anywhere in the string: a scheme this SDK sends, standing alone, then
+// whitespace and the first character of a credential ("Bearer x", " Bearer x", "Authorization: Bearer x").
+// A bare scheme name ("Bearer", "token_type=Bearer", "dpop_combined") is not one.
+const AUTH_SCHEME = /(?:^|[^A-Za-z0-9_-])(?:bearer|dpop|basic)[ \t]+[A-Za-z0-9._~+/-]/i;
+function secretKey(key) {
+    const k = key.toLowerCase();
+    return SECRET_KEYS.has(k) || SECRET_KEY_SUFFIXES.some((suffix) => k.endsWith(suffix));
+}
+function redacted(value) {
+    return `<redacted:${utf8Encode(value).length} bytes>`;
+}
+function guard(key, value) {
+    if (secretKey(key)) {
+        try {
+            return redacted(typeof value === "string" ? value : String(value));
+        }
+        catch {
+            // a value whose toString throws (or an object with no prototype) must not throw out of logging
+            return "<redacted>";
+        }
+    }
     if (typeof value !== "string")
         return value;
     // A JWT's header and claims (any base64url-encoded JSON object) begin with "eyJ".
-    if (value.includes("eyJ")) {
-        return `<redacted:${utf8Encode(value).length} bytes>`;
+    if (value.includes("eyJ") || VAULT_TOKEN.test(value) || AUTH_SCHEME.test(value)) {
+        return redacted(value);
     }
     return value;
 }
 /**
- * Emit one event: undefined attributes dropped, JWT-looking values redacted. Never throws.
+ * Emit one event: undefined attributes dropped, credential keys and credential-looking values redacted.
+ * Never throws.
  *
  * @internal
  */
@@ -32,7 +66,7 @@ export function emit(logger, level, event, attrs = {}) {
     const clean = {};
     for (const [key, value] of Object.entries(attrs)) {
         if (value !== undefined && value !== null)
-            clean[key] = guard(value);
+            clean[key] = guard(key, value);
     }
     try {
         logger[level](event, clean);

package/dist/runtime.js

@@ -35,6 +35,15 @@ export function base64Encode(bytes) {
     }
     return btoa(binary);
 }
+/**
+ * Milliseconds on a monotonic clock (`performance.now()`, which Node, Deno, Bun and workerd provide), for
+ * measuring how long something has been cached: unlike `Date.now()`, a wall-clock step does not move it.
+ *
+ * @internal
+ */
+export function monotonicMs() {
+    return performance.now();
+}
 /**
  * An environment variable, or `undefined` on a runtime with no `process.env` (most edge runtimes).
  *

package/dist/signer.d.ts

@@ -19,6 +19,11 @@ export interface JwsSigner {
  * fixed-width `r||s`) and the private key never leaves it. `create` reads the key metadata to pin the
  * latest version, derive the public JWK and compute its RFC 7638 `kid`. Fail-closed (vault errors throw).
  *
+ * `baoAddr` must be https unless its host is loopback (`localhost`, `127.0.0.1`, `::1`) or
+ * `allowInsecure: true` is passed: the vault token rides on every call, and the public key read from the
+ * vault becomes the attester's published JWK. `keyName` may contain only letters, digits, `_`, `.` and `-`
+ * (and is not `.` or `..`).
+ *
  * @experimental See docs/api.md: a client for a third-party API that authenticates with a static token only; its constructor will change when other auth methods are added.
  */
 export declare class OpenBaoTransitSigner implements JwsSigner {
@@ -26,7 +31,9 @@ export declare class OpenBaoTransitSigner implements JwsSigner {
     readonly algorithm: string;
     readonly keyId: string;
     private constructor();
-    static create(baoAddr: string, token: string, keyName: string): Promise<OpenBaoTransitSigner>;
+    static create(baoAddr: string, token: string, keyName: string, opts?: {
+        allowInsecure?: boolean;
+    }): Promise<OpenBaoTransitSigner>;
     publicJwk(): JWK;
     sign(signingInput: Uint8Array): Promise<Uint8Array>;
 }