@skrr-ai/cli 0.1.109 → 0.1.111

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionRevocation.js

@@ -0,0 +1,472 @@
+/**
+ * Why a session was signed out, and what the person should do next (OSK-16941).
+ *
+ * ## Why this file exists
+ *
+ * The server always knew why it refused a session: `requireJwtAuth` answers
+ * `401 SESSION_REVOKED` with a `reason` for an inactive account, an account-wide
+ * revocation, a password change and a per-session sign-out. Nothing passed it
+ * on. The CLI dropped the field, the web client folded every unrecognised code
+ * into "your saved credentials are no longer valid", and a refresh refused for a
+ * revoked session answered with no code at all. A person signed out with no
+ * explanation reasonably concludes their account was stolen.
+ *
+ * So the vocabulary lives here, once, beside the one function that turns a
+ * reason into words: the API writes these codes, the web login page, the desktop
+ * banner, the desktop main process (OS notification and tray) and the CLI all
+ * render them through `describeSessionRevocation`.
+ *
+ * ## Why auth-core, behind its own subpath
+ *
+ * It was declared in `@skrr-ai/data-provider`, which the Electron main process
+ * does not (and should not) depend on — so main kept printing the server's raw
+ * message in the OS notification and the tray. auth-core is already the
+ * package that LATCHES the reason (`refresh.ts` writes `revocationReason` into
+ * `needs-reauth.json`), and every desktop, daemon and CLI process already
+ * depends on it. This module imports nothing, so the
+ * `@skrr-ai/auth-core/session-revocation` subpath is safe in a browser, React
+ * Native and Node alike, the same way `first-party-harness` is.
+ * `@skrr-ai/data-provider` re-exports it unchanged: there is still exactly one
+ * declaration of the vocabulary and one copy of its words.
+ *
+ * ## Three closed lists
+ *
+ * - `SESSION_REVOCATION_REASONS` — what a refused CLIENT is told. Wire values;
+ *   the 401 body's `reason` field. The account-state members keep the spelling
+ *   `requireJwtAuth` already sent (`banned`, `pending_deletion`, ...), so a
+ *   client that already switched on them keeps working.
+ * - `SESSION_REVOCATION_CAUSES` — what HAPPENED, recorded in Security activity
+ *   when sessions are revoked. Each cause names its trigger and the reason the
+ *   signed-out client is told.
+ * - `SESSION_REVOCATION_TRIGGERS` — who or what did it.
+ *
+ * ## Unknown is a member, and it is never hidden
+ *
+ * Each list carries an explicit `unknown`. A missing, empty or unrecognised
+ * value normalizes to it, and its copy says plainly that we could not tell why.
+ * It is never folded into the nearest reassuring reading: "Everything reads
+ * healthy and the thing is unusable" (root CLAUDE.md) is exactly what an
+ * optimistic default here would produce.
+ *
+ * Copy avoids contractions in code strings so a terminal and a source file read
+ * them the same; the web reads the localized keys instead.
+ */
+/**
+ * The CLI binary the `cli` surface names when the caller passes no `bin`. A
+ * literal because this module imports nothing; `@skrr-ai/data-provider`'s
+ * `sessionRevocation.spec` asserts it equals `BRAND_NAME`, so the two cannot
+ * drift.
+ */
+export const SESSION_REVOCATION_DEFAULT_BIN = 'skrr';
+/* ------------------------------------------------------------------------ */
+/* Reasons — what a refused client is told                                  */
+/* ------------------------------------------------------------------------ */
+export const SESSION_REVOCATION_REASONS = [
+    'password_change',
+    'sessions_revoked',
+    'logged_out',
+    'session_limit',
+    'sign_in_method_removed',
+    'security_check',
+    'machine_removed',
+    'banned',
+    'disabled',
+    'deleted',
+    'pending_deletion',
+    'unknown',
+];
+export const SESSION_REVOCATION_UNKNOWN = 'unknown';
+/**
+ * The login-page query parameter that carries a revocation reason across the
+ * sign-out redirect (`/login?reason=SESSION_REVOKED&revocation=password_change`).
+ * `reason` keeps the refusal CODE it always carried, so a login page that
+ * predates this still says something.
+ */
+export const SESSION_REVOCATION_QUERY_PARAM = 'revocation';
+/**
+ * Other spellings that already reach clients for the SAME reason: the
+ * revocation-bus `cause` strings an older server put on `auth:revoked`, and the
+ * `missing` account state. Kept so a client newer than its server still names
+ * them; a new server sends the canonical member.
+ */
+const SESSION_REVOCATION_REASON_ALIASES = Object.freeze({
+    logout: 'logged_out',
+    explicit_logout: 'logged_out',
+    session_limit_reached: 'session_limit',
+    reuse: 'security_check',
+    reuse_detected: 'security_check',
+    missing: 'deleted',
+});
+export function isSessionRevocationReason(value) {
+    return (typeof value === 'string' && SESSION_REVOCATION_REASONS.includes(value));
+}
+/**
+ * The canonical reason for any value a server or a URL handed us. Anything not
+ * in the vocabulary is `unknown` — never a guess.
+ */
+export function normalizeSessionRevocationReason(value) {
+    if (isSessionRevocationReason(value))
+        return value;
+    if (typeof value === 'string' &&
+        Object.prototype.hasOwnProperty.call(SESSION_REVOCATION_REASON_ALIASES, value)) {
+        return SESSION_REVOCATION_REASON_ALIASES[value];
+    }
+    return SESSION_REVOCATION_UNKNOWN;
+}
+/**
+ * Refusal codes that end a session WITHOUT revoking it, each of which a surface
+ * explains in its own sentence (expired, no longer valid). Every other code a
+ * refusal latch can carry is read as a revocation.
+ */
+export const NON_REVOCATION_REFUSAL_CODES = [
+    'REFRESH_EXPIRED',
+    'TOKEN_EXPIRED',
+    'REFRESH_INVALID',
+    'TOKEN_INVALID',
+];
+export function isNonRevocationRefusalCode(value) {
+    return (typeof value === 'string' && NON_REVOCATION_REFUSAL_CODES.includes(value));
+}
+/**
+ * The revocation reason a refusal names — from a refusal CODE (`SESSION_REVOKED`,
+ * `REFRESH_REUSED`, ...) and the revocation reason that travelled beside it —
+ * or `null` when the code is one of `NON_REVOCATION_REFUSAL_CODES`.
+ *
+ * - A revocation reason, when present, always wins.
+ * - `SESSION_REVOKED` with no reason beside it IS a revocation whose reason we
+ *   do not know, so it is `unknown`.
+ * - `REFRESH_REUSED` is the refresh-family burn, i.e. a security check.
+ * - Any other code, including none at all, is `unknown`: "we could not tell
+ *   why", never a guess.
+ *
+ * Shared by the web banner and the desktop main process so the two read one
+ * latch the same way.
+ */
+export function sessionRevocationForRefusal(code, revocation) {
+    if (revocation)
+        return normalizeSessionRevocationReason(revocation);
+    if (code === 'SESSION_REVOKED')
+        return SESSION_REVOCATION_UNKNOWN;
+    if (code === 'REFRESH_REUSED')
+        return 'security_check';
+    if (isNonRevocationRefusalCode(code))
+        return null;
+    return normalizeSessionRevocationReason(code);
+}
+/* ------------------------------------------------------------------------ */
+/* Next steps                                                               */
+/* ------------------------------------------------------------------------ */
+export const SESSION_REVOCATION_NEXT_STEPS = [
+    'sign_in',
+    'sign_in_and_review',
+    'cancel_deletion',
+    'contact_support',
+    'use_another_account',
+];
+const REASON_COPY = Object.freeze({
+    password_change: {
+        title: 'Your password was changed.',
+        detail: 'Changing the password signs out every session that was opened before the change, including this one.',
+        nextStep: 'sign_in_and_review',
+    },
+    sessions_revoked: {
+        title: 'Every session on your account was signed out.',
+        detail: 'All sessions were ended at once. That happens when someone signed in to the account chooses to sign out everywhere, changes two-factor or email settings, uses a recovery key or reports a sign-in, and when an administrator or an automatic security measure revokes sessions. Security activity records which one it was.',
+        nextStep: 'sign_in_and_review',
+    },
+    logged_out: {
+        title: 'This session was signed out.',
+        detail: 'It was signed out on this device or from another device signed in to your account.',
+        nextStep: 'sign_in',
+    },
+    session_limit: {
+        title: 'This session was signed out to make room for a newer one.',
+        detail: 'Your account reached its limit of signed-in sessions, so the oldest one was ended.',
+        nextStep: 'sign_in',
+    },
+    sign_in_method_removed: {
+        title: 'The way this session signed in was removed from your account.',
+        detail: 'The password, passkey or sign-in provider this session used is no longer on the account.',
+        nextStep: 'sign_in_and_review',
+    },
+    security_check: {
+        title: 'This session was ended by a security check.',
+        detail: 'Its credential was presented in a way that suggested it may have been copied, so it was ended to protect your account.',
+        nextStep: 'sign_in_and_review',
+    },
+    machine_removed: {
+        title: 'The machine this session belonged to was removed.',
+        detail: 'The machine connection that held this sign-in was removed or replaced.',
+        nextStep: 'sign_in',
+    },
+    banned: {
+        title: 'This account has been suspended.',
+        detail: 'An administrator suspended the account, so its sessions no longer work.',
+        nextStep: 'contact_support',
+    },
+    disabled: {
+        title: 'This account is disabled.',
+        detail: 'The account was disabled, so its sessions no longer work.',
+        nextStep: 'contact_support',
+    },
+    deleted: {
+        title: 'This account no longer exists.',
+        detail: 'The account this session belonged to was deleted.',
+        nextStep: 'use_another_account',
+    },
+    pending_deletion: {
+        title: 'This account is scheduled for deletion.',
+        detail: 'Until the deletion is carried out, signing in can only cancel it.',
+        nextStep: 'cancel_deletion',
+    },
+    unknown: {
+        title: 'You were signed out, and we could not tell why.',
+        detail: 'The server ended this session without saying why. That can happen with an older server or an unexpected error.',
+        nextStep: 'sign_in_and_review',
+    },
+});
+function nextStepCopy(step, surface, bin) {
+    const signIn = surface === 'cli' ? `Run \`${bin} login\` to sign in again.` : 'Sign in again to continue.';
+    switch (step) {
+        case 'sign_in':
+            return signIn;
+        case 'sign_in_and_review':
+            return (`${signIn} If this was not you, open Settings > Account > Security activity to see ` +
+                'what happened, and change your password.');
+        case 'cancel_deletion':
+            return surface === 'cli'
+                ? 'Sign in on the web to cancel the deletion if you want to keep the account.'
+                : 'Sign in to cancel the deletion if you want to keep the account.';
+        case 'contact_support':
+            return 'Contact support if you think this is a mistake.';
+        case 'use_another_account':
+            return surface === 'cli'
+                ? `Run \`${bin} login\` to sign in with a different account.`
+                : 'Sign in with a different account, or create a new one.';
+    }
+}
+/**
+ * THE copy for a revoked session. Never throws, whatever it is given: the server
+ * can ship a reason before a client knows it, and that case must still say
+ * something true ("we could not tell why"), not nothing.
+ */
+export function describeSessionRevocation(value, { surface = 'app', bin = SESSION_REVOCATION_DEFAULT_BIN, } = {}) {
+    const reason = normalizeSessionRevocationReason(value);
+    const unrecognized = reason === SESSION_REVOCATION_UNKNOWN &&
+        typeof value === 'string' &&
+        value.trim() !== '' &&
+        value !== SESSION_REVOCATION_UNKNOWN
+        ? value.trim().slice(0, 64)
+        : null;
+    const copy = REASON_COPY[reason];
+    return {
+        reason,
+        unrecognized,
+        title: copy.title,
+        detail: copy.detail,
+        nextStep: copy.nextStep,
+        nextStepText: nextStepCopy(copy.nextStep, surface, bin),
+        reviewSecurityActivity: copy.nextStep === 'sign_in_and_review',
+        keys: {
+            title: `com_auth_revoked_${reason}_title`,
+            detail: `com_auth_revoked_${reason}_detail`,
+            nextStep: `com_auth_revoked_next_${copy.nextStep}`,
+        },
+    };
+}
+/** One line for a terminal or a notification: title, detail and next step. */
+export function formatSessionRevocation(value, options = {}) {
+    const d = describeSessionRevocation(value, options);
+    const code = d.unrecognized ? ` (reason code: ${d.unrecognized})` : '';
+    return `${d.title}${code} ${d.detail} ${d.nextStepText}`;
+}
+/* ------------------------------------------------------------------------ */
+/* Triggers and causes — the Security activity record                       */
+/* ------------------------------------------------------------------------ */
+export const SESSION_REVOCATION_TRIGGERS = [
+    'account_owner',
+    'administrator',
+    'security_system',
+    'external_provider',
+    'account_lifecycle',
+    'unknown',
+];
+export const SESSION_REVOCATION_CAUSES = [
+    'password_change',
+    'password_reset',
+    'sign_out_everywhere',
+    'sign_out_other_sessions',
+    'session_signed_out',
+    'two_factor_change',
+    'email_change',
+    'email_change_reverted',
+    'account_recovery',
+    'reported_not_me',
+    'sign_in_method_removed',
+    'machine_removed',
+    'oauth_app_revoked',
+    'session_limit',
+    'suspicious_reuse',
+    'administrator',
+    'account_suspended',
+    'external_provider',
+    'account_deletion_scheduled',
+    'account_superseded',
+    'unverified_account_cleanup',
+    'unknown',
+];
+export const SESSION_REVOCATION_CAUSE_FACTS = Object.freeze({
+    password_change: {
+        trigger: 'account_owner',
+        reason: 'password_change',
+        copy: 'The password was changed.',
+    },
+    password_reset: {
+        trigger: 'account_owner',
+        reason: 'password_change',
+        copy: 'The password was reset from an emailed link.',
+    },
+    sign_out_everywhere: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'Sign out everywhere was chosen.',
+    },
+    sign_out_other_sessions: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'Every other session was signed out.',
+    },
+    session_signed_out: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'A session was signed out.',
+    },
+    two_factor_change: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'Two-factor authentication settings changed.',
+    },
+    email_change: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'The account email address was changed.',
+    },
+    email_change_reverted: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'An email address change was undone from the link sent to the previous address.',
+    },
+    account_recovery: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'The account was recovered with a recovery key.',
+    },
+    reported_not_me: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'A sign-in was reported as not you.',
+    },
+    sign_in_method_removed: {
+        trigger: 'account_owner',
+        reason: 'sign_in_method_removed',
+        copy: 'A sign-in method was removed, and the sessions that used it were ended.',
+    },
+    machine_removed: {
+        trigger: 'account_owner',
+        reason: 'machine_removed',
+        copy: 'A machine connection was removed, and the sessions it held were ended.',
+    },
+    oauth_app_revoked: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'Access for a connected application was revoked.',
+    },
+    session_limit: {
+        trigger: 'security_system',
+        reason: 'session_limit',
+        copy: 'The limit of signed-in sessions was reached, so the oldest session was ended.',
+    },
+    suspicious_reuse: {
+        trigger: 'security_system',
+        reason: 'security_check',
+        copy: 'A sign-in credential was presented twice, which can mean it was copied, so its sessions were ended.',
+    },
+    administrator: {
+        trigger: 'administrator',
+        reason: 'sessions_revoked',
+        copy: 'An administrator revoked the sessions.',
+    },
+    account_suspended: {
+        trigger: 'administrator',
+        reason: 'banned',
+        copy: 'An administrator suspended the account, which ends every session.',
+    },
+    external_provider: {
+        trigger: 'external_provider',
+        reason: 'sessions_revoked',
+        copy: 'Your sign-in provider reported a change to the account it vouches for.',
+    },
+    account_deletion_scheduled: {
+        trigger: 'account_owner',
+        reason: 'pending_deletion',
+        copy: 'Deletion of the account was requested.',
+    },
+    account_superseded: {
+        trigger: 'account_lifecycle',
+        reason: 'password_change',
+        copy: 'A new registration proved this email address and replaced the unverified account.',
+    },
+    unverified_account_cleanup: {
+        trigger: 'account_lifecycle',
+        reason: 'deleted',
+        copy: 'The unverified account was cleaned up.',
+    },
+    unknown: {
+        trigger: 'unknown',
+        reason: 'unknown',
+        copy: 'Sessions were revoked, and the server did not record why.',
+    },
+});
+export const SESSION_REVOCATION_TRIGGER_COPY = Object.freeze({
+    account_owner: 'Someone signed in to this account',
+    administrator: 'An administrator',
+    security_system: 'An automatic security measure',
+    external_provider: 'Your sign-in provider',
+    account_lifecycle: 'Account cleanup',
+    unknown: 'Unknown: the server could not tell who or what',
+});
+export function normalizeSessionRevocationCause(value) {
+    return typeof value === 'string' &&
+        SESSION_REVOCATION_CAUSES.includes(value)
+        ? value
+        : 'unknown';
+}
+export function normalizeSessionRevocationTrigger(value) {
+    return typeof value === 'string' &&
+        SESSION_REVOCATION_TRIGGERS.includes(value)
+        ? value
+        : 'unknown';
+}
+/**
+ * How Security activity explains one recorded revocation. A stored trigger wins
+ * over the cause's usual one (an administrator can change a password too); an
+ * unreadable one is `unknown`, never the cause's default.
+ */
+export function describeSessionRevocationActivity(record) {
+    const cause = normalizeSessionRevocationCause(record?.cause);
+    const trigger = record?.trigger === undefined || record?.trigger === null
+        ? 'unknown'
+        : normalizeSessionRevocationTrigger(record.trigger);
+    const facts = SESSION_REVOCATION_CAUSE_FACTS[cause];
+    return {
+        cause,
+        trigger,
+        reason: facts.reason,
+        causeText: facts.copy,
+        triggerText: SESSION_REVOCATION_TRIGGER_COPY[trigger],
+        keys: {
+            cause: `com_nav_security_activity_revocation_cause_${cause}`,
+            trigger: `com_nav_security_activity_revocation_trigger_${trigger}`,
+        },
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.d.ts

@@ -35,6 +35,13 @@
  * `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` mints credentials with the real minting
  * code and requires every one to come out as the marker, so a change to either side fails there.
  *
+ * HUMAN QR SIGN-IN. Its locator has no token prefix, so redact only the known
+ * `/api/auth/qr/requests/<locator>` path and `/auth/qr?request=<locator>` query
+ * (including percent-encoded nested URLs). Private protocol field names are
+ * redacted in serialized text and structured records, including numeric
+ * comparison codes. Ordinary request ids, operation names and error/metric
+ * categories remain usable. All existing preview-redaction sinks inherit it.
+ *
  * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
  * repository writes one, and a scan that decoded every string first would cost every sink on every record. A
  * credential cut off before its id is whole (`pinv_0123abc`) is an identifier, not yet the secret, and is left as it
@@ -50,6 +57,10 @@
  */
 /** What replaces a token. Fixed, so a trace can say a preview was involved but not which one. */
 export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
+/** QR locators have no identifying prefix, so match only their protocol locations. */
+export declare const QR_SIGN_IN_REDACTION: "[redacted]";
+/** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
+export declare function isQrSignInSecretField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.js

@@ -35,6 +35,13 @@
  * `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` mints credentials with the real minting
  * code and requires every one to come out as the marker, so a change to either side fails there.
  *
+ * HUMAN QR SIGN-IN. Its locator has no token prefix, so redact only the known
+ * `/api/auth/qr/requests/<locator>` path and `/auth/qr?request=<locator>` query
+ * (including percent-encoded nested URLs). Private protocol field names are
+ * redacted in serialized text and structured records, including numeric
+ * comparison codes. Ordinary request ids, operation names and error/metric
+ * categories remain usable. All existing preview-redaction sinks inherit it.
+ *
  * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
  * repository writes one, and a scan that decoded every string first would cost every sink on every record. A
  * credential cut off before its id is whole (`pinv_0123abc`) is an identifier, not yet the secret, and is left as it
@@ -82,14 +89,45 @@ const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f
  * `TOKEN_CHAR`, whose dot would swallow the full stop at the end of a sentence.
  */
 const LEGACY_OPERATOR_CODE = new RegExp(`(adm)${UNDERSCORE}(?=[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-]))[A-Za-z0-9_-]{43}`, 'g');
-/** Cheap test before any of the expressions: a string with none of these cannot hold a credential. */
+/** QR locators have no identifying prefix, so match only their protocol locations. */
+export const QR_SIGN_IN_REDACTION = '[redacted]';
+const escapedLiteral = (value) => [...value].map((char) => {
+    const literal = char.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return `(?:${literal}|%(?:25)*${char.charCodeAt(0).toString(16)})`;
+}).join('');
+const QR_REQUEST_PATH = new RegExp(`(${escapedLiteral('/api/auth/qr/requests/')})${TOKEN_CHAR}+`, 'gi');
+const QR_LINK_QUERY = new RegExp(`(${escapedLiteral('/auth/qr?')})([^\\s"'<>#]*)`, 'gi');
+const QR_REQUEST_QUERY = new RegExp(`(^|${escapedLiteral('&')})(${escapedLiteral('request')}${escapedLiteral('=')})${TOKEN_CHAR}+`, 'gi');
+const QR_SECRET_FIELDS = new Set([
+    'statustoken', 'claimtoken', 'codeverifier', 'codechallenge', 'comparisoncode',
+]);
+/** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
+export function isQrSignInSecretField(key) {
+    const leaf = key.split('.').pop() || '';
+    return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, '').toLowerCase());
+}
+const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+function redactQrSignInText(value) {
+    // Undici/Sentry may split url.query/query_string from its path. The QR's
+    // direction vocabulary identifies that standalone query without treating an
+    // ordinary application's `request` query key as a secret globally.
+    const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value)
+        ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
+    return standaloneQuery
+        .replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`)
+        .replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`))
+        .replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
+}
+/** Cheap test before the older prefix-based credential expressions. */
 const CREDENTIAL_HINTS = ['pvw', 'wsi', 'pinv', 'usr', 'adm'];
 const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 export function redactPreviewTokens(value) {
-    if (typeof value !== 'string' || !CREDENTIAL_HINTS.some((hint) => value.indexOf(hint) !== -1)) {
+    if (typeof value !== 'string')
         return value;
-    }
-    return value
+    const qrSafe = redactQrSignInText(value);
+    if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
+        return qrSafe;
+    return qrSafe
         .replace(PREVIEW_TOKEN, PREVIEW_TOKEN_REDACTION)
         .replace(SIGNED_CREDENTIAL, credentialMarker)
         .replace(LEGACY_OPERATOR_CODE, credentialMarker);
@@ -115,7 +153,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
         let visited = 0;
         let complete = true;
         const rewrite = (holder, key, current) => {
-            const next = redactPreviewTokens(current);
+            const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
             if (next === current) {
                 return;
             }
@@ -157,7 +195,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
                     complete = false;
                     continue;
                 }
-                if (typeof child === 'string') {
+                if (isQrSignInSecretField(key) || typeof child === 'string') {
                     rewrite(holder, key, child);
                 }
                 else if (child !== null && typeof child === 'object') {