@skrr-ai/auth-core 0.1.6 → 0.1.7

package/dist/cjs/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -289,6 +289,7 @@ Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: func
 Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */

package/dist/cjs/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/cjs/spawnEnv.js

@@ -40,7 +40,7 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
@@ -110,6 +110,16 @@ exports.SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -145,6 +155,12 @@ function sanitizeSpawnEnv(env) {
         if (!stripped && exports.SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (exports.SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/esm/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/esm/index.js

@@ -135,7 +135,7 @@ export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConf
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/esm/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/esm/spawnEnv.js

@@ -106,6 +106,16 @@ export const SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -141,6 +151,12 @@ export function sanitizeSpawnEnv(env) {
         if (!stripped && SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Shared auth substrate (token store, refresh, scheduler, fd handoff) for the OverSky daemon and CLI.",
   "type": "module",
   "main": "dist/cjs/index.js",