skillvault 0.7.5 → 0.8.0

package/dist/cli.js

@@ -20,7 +20,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createHmac, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.7.5';
+const VERSION = '0.8.0';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
@@ -640,7 +640,9 @@ async function fetchCEK(skillName, publisherToken, apiUrl) {
     const serverWatermarkId = body.watermark_id || '';
     const ephPub = createPublicKey({ key: Buffer.from(wc.ephemeralPublicKey, 'base64'), format: 'der', type: 'spki' });
     const shared = diffieHellman({ publicKey: ephPub, privateKey: kp.privateKey });
-    const wrapKey = Buffer.from(hkdfSync('sha256', shared, Buffer.alloc(32, 0), Buffer.from('skillvault-cek-wrap-v1'), 32));
+    // Use server-provided salt, or fall back to zero salt for backward compat with old servers
+    const hkdfSalt = wc.salt ? Buffer.from(wc.salt, 'base64') : Buffer.alloc(32, 0);
+    const wrapKey = Buffer.from(hkdfSync('sha256', shared, hkdfSalt, Buffer.from('skillvault-cek-wrap-v1'), 32));
     shared.fill(0);
     const d = createDecipheriv('aes-256-gcm', wrapKey, Buffer.from(wc.iv, 'base64'), { authTagLength: 16 });
     d.setAuthTag(Buffer.from(wc.authTag, 'base64'));
@@ -726,8 +728,8 @@ function watermarkLayer4(content, id, email, publisherName) {
     const lines = content.split('\n');
     // Determine pseudo-random insertion points based on HMAC of licensee ID
     // This ensures the same licensee always gets the same positions (deterministic)
-    const hmac = createHmac('sha256', 'skillvault-visible-v1');
-    hmac.update(id);
+    const hmac = createHmac('sha256', id);
+    hmac.update('watermark-positions');
     const hash = hmac.digest();
     // Insert at: beginning, end, and 2-4 random points in between
     const totalLines = lines.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.7.5",
+  "version": "0.8.0",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {