@open-mercato/ai-assistant 0.6.5-develop.5162.1.eba42159b8 → 0.6.5-develop.5166.1.b59e2a71ad

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/modules/ai_assistant/lib/log-redaction.js +1 -1
  2. package/dist/modules/ai_assistant/lib/log-redaction.js.map +2 -2
  3. package/package.json +6 -6
  4. package/src/modules/ai_assistant/lib/log-redaction.ts +2 -1
package/dist/modules/ai_assistant/lib/log-redaction.js CHANGED
@@ -7,7 +7,7 @@ function redactSecretForLog(value) {
7
7
  }
8
8
  const sessionIdHmacKey = randomBytes(32);
9
9
  const SESSION_ID_PBKDF2_ITERATIONS = 21e4;
10
- const SESSION_ID_PBKDF2_KEYLEN = 16;
10
+ const SESSION_ID_PBKDF2_KEYLEN = 8;
11
11
  function deriveApiKeySessionId(apiKeySecret) {
12
12
  const digest = pbkdf2Sync(
13
13
  apiKeySecret,
package/dist/modules/ai_assistant/lib/log-redaction.js.map CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../../../src/modules/ai_assistant/lib/log-redaction.ts"],
4
- "sourcesContent": ["import { pbkdf2Sync, randomBytes } from 'node:crypto'\n\n/**\n * Redact a bearer-style secret (session token, API key) for safe logging.\n * Reveals at most a short leading fingerprint and never more than half of the\n * value, so durable logs never carry a replayable credential.\n */\nexport function redactSecretForLog(value: unknown): string {\n if (typeof value !== 'string' || value.length === 0) return '<redacted>'\n const prefixLength = Math.min(12, Math.floor(value.length / 2))\n if (prefixLength <= 0) return '<redacted>'\n return `${value.slice(0, prefixLength)}...`\n}\n\n// Per-process random key so the API key secret is fingerprinted through a keyed\n// HMAC rather than a fast, unkeyed digest. The session id is only an in-process\n// grouping key for the session-memory cache (a process-local Map), so a key that\n// lives for the process lifetime keeps the same-secret-maps-to-same-id guarantee\n// within an MCP connection while ensuring the digest is not derivable from the\n// secret alone. Mirrors the secret fingerprinter in apiKeyAuthCache.ts.\nconst sessionIdHmacKey = randomBytes(32)\nconst SESSION_ID_PBKDF2_ITERATIONS = 210000\nconst SESSION_ID_PBKDF2_KEYLEN = 16\n\n/**\n * Derive a stable, non-reversible session-memory id from an API key secret.\n * The same secret always maps to the same id within a process (so tool calls on\n * one MCP connection share a memory cache), but no secret material is exposed:\n * the id is derived with PBKDF2 (slow KDF) using a per-process random salt.\n */\nexport function deriveApiKeySessionId(apiKeySecret: string): string {\n const digest = pbkdf2Sync(\n apiKeySecret,\n sessionIdHmacKey,\n SESSION_ID_PBKDF2_ITERATIONS,\n SESSION_ID_PBKDF2_KEYLEN,\n 'sha256'\n ).toString('hex')\n return `apikey_${digest}`\n}\n"],
5
- "mappings": "AAAA,SAAS,YAAY,mBAAmB;AAOjC,SAAS,mBAAmB,OAAwB;AACzD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,QAAM,eAAe,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,SAAS,CAAC,CAAC;AAC9D,MAAI,gBAAgB,EAAG,QAAO;AAC9B,SAAO,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC;AACxC;AAQA,MAAM,mBAAmB,YAAY,EAAE;AACvC,MAAM,+BAA+B;AACrC,MAAM,2BAA2B;AAQ1B,SAAS,sBAAsB,cAA8B;AAClE,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAChB,SAAO,UAAU,MAAM;AACzB;",
4
+ "sourcesContent": ["import { pbkdf2Sync, randomBytes } from 'node:crypto'\n\n/**\n * Redact a bearer-style secret (session token, API key) for safe logging.\n * Reveals at most a short leading fingerprint and never more than half of the\n * value, so durable logs never carry a replayable credential.\n */\nexport function redactSecretForLog(value: unknown): string {\n if (typeof value !== 'string' || value.length === 0) return '<redacted>'\n const prefixLength = Math.min(12, Math.floor(value.length / 2))\n if (prefixLength <= 0) return '<redacted>'\n return `${value.slice(0, prefixLength)}...`\n}\n\n// Per-process random key so the API key secret is fingerprinted through a keyed\n// HMAC rather than a fast, unkeyed digest. The session id is only an in-process\n// grouping key for the session-memory cache (a process-local Map), so a key that\n// lives for the process lifetime keeps the same-secret-maps-to-same-id guarantee\n// within an MCP connection while ensuring the digest is not derivable from the\n// secret alone. Mirrors the secret fingerprinter in apiKeyAuthCache.ts.\nconst sessionIdHmacKey = randomBytes(32)\nconst SESSION_ID_PBKDF2_ITERATIONS = 210000\n// 8 bytes \u2192 16 hex chars: a short in-process grouping key, not a security token.\nconst SESSION_ID_PBKDF2_KEYLEN = 8\n\n/**\n * Derive a stable, non-reversible session-memory id from an API key secret.\n * The same secret always maps to the same id within a process (so tool calls on\n * one MCP connection share a memory cache), but no secret material is exposed:\n * the id is derived with PBKDF2 (slow KDF) using a per-process random salt.\n */\nexport function deriveApiKeySessionId(apiKeySecret: string): string {\n const digest = pbkdf2Sync(\n apiKeySecret,\n sessionIdHmacKey,\n SESSION_ID_PBKDF2_ITERATIONS,\n SESSION_ID_PBKDF2_KEYLEN,\n 'sha256'\n ).toString('hex')\n return `apikey_${digest}`\n}\n"],
5
+ "mappings": "AAAA,SAAS,YAAY,mBAAmB;AAOjC,SAAS,mBAAmB,OAAwB;AACzD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,QAAM,eAAe,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,SAAS,CAAC,CAAC;AAC9D,MAAI,gBAAgB,EAAG,QAAO;AAC9B,SAAO,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC;AACxC;AAQA,MAAM,mBAAmB,YAAY,EAAE;AACvC,MAAM,+BAA+B;AAErC,MAAM,2BAA2B;AAQ1B,SAAS,sBAAsB,cAA8B;AAClE,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK;AAChB,SAAO,UAAU,MAAM;AACzB;",
6
6
  "names": []
7
7
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@open-mercato/ai-assistant",
3
- "version": "0.6.5-develop.5162.1.eba42159b8",
3
+ "version": "0.6.5-develop.5166.1.b59e2a71ad",
4
4
  "type": "module",
5
5
  "engines": {
6
6
  "node": ">=22.0.0"
@@ -98,16 +98,16 @@
98
98
  "zod-to-json-schema": "^3.25.2"
99
99
  },
100
100
  "peerDependencies": {
101
- "@open-mercato/shared": "0.6.5-develop.5162.1.eba42159b8",
102
- "@open-mercato/ui": "0.6.5-develop.5162.1.eba42159b8",
101
+ "@open-mercato/shared": "0.6.5-develop.5166.1.b59e2a71ad",
102
+ "@open-mercato/ui": "0.6.5-develop.5166.1.b59e2a71ad",
103
103
  "react": "^19.0.0",
104
104
  "react-dom": "^19.0.0",
105
105
  "zod": ">=3.23.0"
106
106
  },
107
107
  "devDependencies": {
108
- "@open-mercato/cli": "0.6.5-develop.5162.1.eba42159b8",
109
- "@open-mercato/shared": "0.6.5-develop.5162.1.eba42159b8",
110
- "@open-mercato/ui": "0.6.5-develop.5162.1.eba42159b8",
108
+ "@open-mercato/cli": "0.6.5-develop.5166.1.b59e2a71ad",
109
+ "@open-mercato/shared": "0.6.5-develop.5166.1.b59e2a71ad",
110
+ "@open-mercato/ui": "0.6.5-develop.5166.1.b59e2a71ad",
111
111
  "@types/react": "^19.2.17",
112
112
  "@types/react-dom": "^19.2.3",
113
113
  "react": "19.2.7",
package/src/modules/ai_assistant/lib/log-redaction.ts CHANGED
@@ -20,7 +20,8 @@ export function redactSecretForLog(value: unknown): string {
20
20
  // secret alone. Mirrors the secret fingerprinter in apiKeyAuthCache.ts.
21
21
  const sessionIdHmacKey = randomBytes(32)
22
22
  const SESSION_ID_PBKDF2_ITERATIONS = 210000
23
- const SESSION_ID_PBKDF2_KEYLEN = 16
23
+ // 8 bytes → 16 hex chars: a short in-process grouping key, not a security token.
24
+ const SESSION_ID_PBKDF2_KEYLEN = 8
24
25
 
25
26
  /**
26
27
  * Derive a stable, non-reversible session-memory id from an API key secret.