@sockethub/util 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/crypto/index.d.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-export declare function getPlatformId(platform: string, actor?: string, _crypto?: Crypto): string;
+export declare function getPlatformId(platform: string, actor?: string, scope?: string, _crypto?: Crypto): string;
 export declare class Crypto {
     randomBytes: typeof randomBytes;
     constructor();
@@ -15,6 +15,16 @@ export declare class Crypto {
      * different (platform, actor) pairs to the same instance.
      */
     hashFull(text: string): string;
+    /**
+     * Stable hash of a credential object, used as the verifier that decides
+     * whether a session may reuse an existing platform connection.
+     *
+     * `object-hash` defaults to SHA-1; pinned to SHA-256 instead, since this
+     * backs an authorization decision. Not an exploit fix — the value is never
+     * exposed to clients, and forging a match needs a second preimage of an
+     * unknown credential object, which SHA-1 does not give you — but a new
+     * security-sensitive verifier should not be built on a deprecated digest.
+     */
     objectHash(object: object): string;
     /**
      * Derive a high-entropy secret from multiple input secrets.
@@ -23,6 +33,14 @@ export declare class Crypto {
      */
     deriveSecret(...secrets: string[]): string;
     randToken(len: number): string;
+    /**
+     * Random alphanumeric identifier. Use this instead of randToken() for
+     * values that end up in Redis key names, logger namespaces, HTTP headers,
+     * or shell commands: randToken()'s charset includes `*?[]^@$#!`, which are
+     * Redis glob metacharacters and shell specials. randToken() remains the
+     * generator for secrets, where the wider charset adds entropy.
+     */
+    randId(len: number): string;
     private static ensureSecret;
 }
 export declare const crypto: Crypto;