@push.rocks/smartsecret 1.2.0 → 1.2.1

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartsecret',
-    version: '1.2.0',
+    version: '1.2.1',
     description: 'OS-backed secret storage plus strict Linux kernel-keyring and envelope APIs for Node.js.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDBGQUEwRjtDQUN4RyxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartsecret",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "private": false,
   "description": "OS-backed secret storage plus strict Linux kernel-keyring and envelope APIs for Node.js.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -197,7 +197,9 @@ Service and account strings must contain valid Unicode scalar values and encode
 
 `setEntry()` copies its input before dispatch, and `getEntry()` returns a fresh byte array. The caller still owns its input and returned copies and should wipe them when no longer needed. JavaScript and operating-system buffers can retain additional copies, so this remains best-effort zeroization rather than guaranteed memory erasure.
 
-The store uses one persistent-user-owned service ring and stages unpublished objects in the process keyring. An inherited session link is preserved and revalidated, but it cannot override or conflict with the persistent root. Publication is verified before staging ownership is removed. Every operation also acquires a service-wide `NamedMutex`, which coordinates cooperating processes running as the same OS identity on the same machine.
+The store uses one persistent-user-owned service ring and stages unpublished objects in the process keyring. An inherited session link is preserved and revalidated, but it cannot override or conflict with the persistent root. A revoked inherited session keyring, which can remain after PAM logout, is treated as absent because it is optional and unusable; any failure to establish or validate the required process and persistent roots still fails closed. Publication is verified before staging ownership is removed. Every operation also acquires a service-wide `NamedMutex`, which coordinates cooperating processes running as the same OS identity on the same machine.
+
+Generic and legacy searches classify missing, revoked, or expired matches as absent only after the authoritative root revalidates. An unusable root remains a fail-closed kernel error rather than an absent entry.
 
 Kernel keyring permissions are an isolation boundary between OS identities, not between processes running under the same UID. Same-UID processes with access to the relevant keyrings may be able to read entries. Persistent keyrings can expire under kernel policy and are cleared by reboot. Applications must treat `null` as absence, not as evidence that a secret existed previously.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartsecret',
-  version: '1.2.0',
+  version: '1.2.1',
   description: 'OS-backed secret storage plus strict Linux kernel-keyring and envelope APIs for Node.js.'
 }