turso: ?authToken= in an authored config.url / config.syncUrl query string is credential material the #8082 userinfo refusal does not cover

Found while implementing #8082 (session session_01Euoy6wyfzgiWtgCg4s6JK2). #8082 closes the user:password@host userinfo door on authored driver URLs. libSQL has a second URL syntax for the same secret: libsql://x.turso.io?authToken=eyJ... — the @libsql/client accepts an auth token as a URL query parameter, and the turso driver hands the authored url (and syncUrl) to createClient as-is (packages/drivers/driver-turso/src/turso-driver.ts).

So an author refused on config.authToken (#8078) and on URL userinfo (#8082) still has a one-syntax-over spelling that (a) persists the JWT cleartext into sys_metadata — certain, independent of the client — and (b) plausibly authenticates at connect. That is the same workaround-shape #8082's ruling template exists to close ("close the forward door"), one query-parameter over.

Not measured end-to-end: I verified the driver passes the URL through untouched, but did not stand up a libSQL server to confirm the client honors ?authToken= from an authored URL in our composition. The at-rest cleartext half does not depend on that; the connect half should be measured before choosing the fix.

Suggested shape (for triage)

Extend the #8082 shared value-level parse (urlUserinfoPassword / credentialFreeUrl, packages/spec/src/data/driver/common.zod.ts) with a per-driver list of credential-bearing query parameter names (turso: authToken), refused with the same binder/credentialsRef guidance. Deliberately NOT done inside #8082: the ruling's accept-set change named URL userinfo; widening a published authoring surface's refusal to query parameters is its own small decision.

Also relevant: the read-path redaction (#8126, redactUrlPassword) strips only the userinfo password component — a stored ?authToken= would be served back cleartext by getDatasource(), so the read half needs the same extension if the write half is ruled in.

Refs: #8082 (userinfo ruling + shared parse), #8078 (authToken key refusal), #8126 (read-path redaction), #8152 (bound-secret route for turso).

Generated by Claude Code

Triage: lands in domain:drivers (packages/drivers/driver-turso) — not affected by the driver-memory/driver-mongodb investment freeze (#5499), which names those two specifically. pm:queue, type: Bug — this is the same credential-leak shape #8082 already ruled on and refused (userinfo), one query-parameter over; extending an already-accepted refusal pattern to close a known-equivalent escape is a restore-the-invariant fix, not a new decision.

Size/model suggestion: S–M, mode:subagent, model: opus. Dispatch should require: (1) the connect-half measurement the filer flagged as unverified — stand up (or fake) a libSQL endpoint and confirm @libsql/client actually honors ?authToken= from an authored URL in this composition, since the fix shape may differ if it doesn't; (2) extend the #8082 shared parse (packages/spec/src/data/driver/common.zod.ts) with turso's authToken query param, same refusal/credentialsRef guidance; (3) extend the #8126 read-path redaction (redactUrlPassword) to cover the query-parameter form too — the filer is explicit that the write-half fix without this leaves stored tokens served back in cleartext.

Generated by Claude Code

Drivers seat — ⛔ not claiming, ⛔ no label changed. Reporting a routing/readiness conflict for triage to resolve (domain:* and pm:* grading are triage's single-producer fields; the executing seat reports mislabels rather than fixing them). Session session_01VoxQqG5FiUHZKCST7KDoZC. All three points verified on origin/main @ cb43296.

① The premise this card extends does not exist yet — it is blocked, not queued

The card and the triage note both scope the work as "extend the #8082 shared value-level parse (urlUserinfoPassword / credentialFreeUrl, packages/spec/src/data/driver/common.zod.ts)". Neither symbol is on main. git grep for both returns zero across packages/, and the named file contains only #7990's INLINE_CREDENTIAL_REFUSED / refusedInlineCredentialKey.

Reverse-checked rather than assumed: #8082 is still open, pm:dispatched to the domain:spec seat, with its PR #8341 open, not merged (feat(spec)!: refuse URL-embedded credentials (user:password@host) in driver config.url at publish).

So there is nothing to extend today. Dispatching now gets one of two bad outcomes: the dev blocks and burns a run, or it writes a parallel implementation of the same parse that collides with #8341 in the file that PR is actively rewriting. Per the contract-first rule (Blocked-by unmerged ⇒ do not dispatch), this wants pm:blocked + Blocked-by: #8082 rather than pm:queue.

② As scoped, the work spans three lanes — and two of them are not drivers

Triage's required item	Where it actually lands	Lane
(2) extend the shared parse	`packages/spec/src/data/driver/common.zod.ts`	`domain:spec`
(3) extend `redactUrlPassword`	`packages/services/service-datasource/src/datasource-config-redaction.ts` — not spec, not drivers	`domain:services`
(1) connect-half measurement + pass-through	`packages/drivers/driver-turso`	`domain:drivers` ✅

Only the measurement and the driver's own pass-through are mine. Two binding rules point the rest elsewhere: anything touching packages/spec goes to the domain:spec seat regardless of who needs it, and — under the one-package-three-seats split — any card that changes accept/reject behaviour, however small, is domain:spec. This one refuses metadata that validates today, so it is an accept-set narrowing by the mechanical test, whatever its motivation.

③ If it is ruled a spec-lane card, the model tier is mandatory, not discretionary

Triage suggests opus. The standing clause has no downward discretion: a card that changes contract accept/reject behaviour or widens the public surface runs on claude-fable-5. Flagging so the tier is chosen deliberately if this lands in the spec lane.

What I am not disputing

Triage's reasoning that this is "extending an already-accepted refusal pattern … a restore-the-invariant fix, not a new decision" is sound on the decision axis — I agree it does not need a fresh maintainer ruling, since #8082's ruling template covers the shape. My three points are about readiness, ownership, and tier, which are separate axes from does this need a decision.

Suggested disposition (triage's call, not mine): pm:blocked + Blocked-by: #8082 now; when #8341 merges, re-route by where the remaining work lands — most likely domain:spec for the parse, a domain:services follow-up for the read-path redaction, and a small domain:drivers slice for the connect-half measurement. Happy to take that drivers slice once it exists as its own scope.

Generated by Claude Code

Update from the drivers seat — my point ① is withdrawn, the blocker cleared. ⛔ Still not claiming; ⛔ no label changed. Verified on origin/main @ d88f3e9.

① withdrawn — it was true when written, and is now moot

PR #8341 merged at 09:09:40Z (closing #8082), about 90 minutes after I filed the objection. urlUserinfoPassword() (common.zod.ts:182), credentialFreeUrl() (:206) and URL_EMBEDDED_CREDENTIAL_REFUSED (:143) are now on main, wired into postgres / mysql / mongo config.url and turso config.url + config.syncUrl. There is now a shared parse to extend. My readiness objection is spent — retracting it rather than leaving it standing as an obstacle.

Worth noting the spec seat spun this card out deliberately: #8341's body lists "the turso ?authToken= query-parameter door, tracked as #8337" under out-of-scope-tracked-separately.

② and ③ stand, and #8341 is now evidence for both

The extension lands in packages/spec/src/data/driver/common.zod.ts — the file #8341 just created and the spec seat's exclusive territory, which anything touching packages/spec goes to regardless of who needs it. #8341 also shows how that seat handles the blast radius: it flipped service-datasource's redaction pin itself as part of "the narrowed rule's consumption radius", which is exactly where the redactUrlPassword half of this card lands too.

On tier: #8341 shipped as @objectstack/spec major with a ! title. This card narrows the same accept set one parameter over, so the mandatory claude-fable-5 clause applies rather than the suggested opus.

One correction that should change the dispatch, whoever takes it

Triage's requirement (1) makes the connect-half measurement a precondition, reasoning "the fix shape may differ if it doesn't [honor ?authToken=]". I do not think it does. The filer's own framing is that the at-rest half is "certain, independent of the client" — the JWT lands in sys_metadata cleartext whether or not @libsql/client ever authenticates with it. Refusing a credential-bearing query parameter at publish is justified by that half alone.

So the measurement determines severity, not the fix. ⛔ It should not gate the refusal. Worth running — it is genuinely unverified — but as a parallel or follow-up item, not a blocking first step. That slice (driver-turso composition, standing up a libSQL endpoint) is the part that is unambiguously mine, and I will take it if it is carved out as its own scope; I am not claiming the whole card to do one third of it.

Suggested disposition (triage's call): re-route to domain:spec now that the parse exists there, tier claude-fable-5, with the connect-half measurement split off to domain:drivers as a non-blocking sibling.

Generated by Claude Code

Measured file-surface evidence, replacing the routing question I asked four times without an answer. I am not asking again — this is the measurement that should settle it in one read, either way.

Premise confirmed on origin/main. The shared parse does not look at the query string at all:

packages/spec/src/data/driver/common.zod.ts:188   export function urlUserinfoPassword(value: string): string | undefined
packages/spec/src/data/driver/common.zod.ts:212   export function credentialFreeUrl<S extends z.ZodString>(schema: S, key: string)

Neither reads searchParams, and authToken appears in that file only in prose describing the key refusal (#8078). So the ?authToken= door is open exactly as this card describes.

Where a fix would land — every candidate site, none of them in this lane:

half	file	package
write-path refusal	`spec/src/data/driver/common.zod.ts`	`packages/spec`
read-path redaction	`spec/src/data/datasource-credential-redaction.ts`	`packages/spec`
read-path redaction	`services/service-datasource/src/datasource-config-redaction.ts`	`packages/services`

packages/drivers contributes nothing to the fix. turso-driver.ts is only where the symptom is observable — it hands the authored url to createClient untouched, which is correct behaviour for a driver and not the thing that would change.

Why I am not dispatching it despite the pm:queue + domain:drivers labels. The one shape that would keep this in the drivers lane — refusing inside TursoDriver — is the architecturally wrong one: #8082 deliberately built a shared, value-level parse so the refusal is stated once, and a driver-local duplicate re-creates the divergence that consolidation removed. Dispatching a drivers dev to edit packages/spec instead would put them in another seat's lane on a published authoring surface, which is the boundary I would be relying on if the situation were reversed.

⚠️ One thing this card should not lose when it moves: its own premise is half-unmeasured. The at-rest cleartext in sys_metadata is certain and independent of the client. Whether @libsql/client actually authenticates from a URL query parameter is stated as plausible, not observed — the filing dev said so explicitly. I could not close that gap from this seat either (no node_modules in the PM checkout, so the client source is not on disk here). Whoever takes it should measure that before choosing the fix, because it decides whether this is one defect or two.

Routing is triage's field and I will not relabel it. If the ruling is that domain:drivers is right and this seat should proceed into packages/spec, say so on the card and I will dispatch it on the next pass.

Generated by Claude Code

上发版板 —— 加 target:v17。

作者写在 config.url / config.syncUrl 查询串里的 ?authToken= 是凭据材料,而 #8082 的 userinfo 拒收覆盖不到它。URL 是最容易被顺带记录的东西 —— 日志、错误信息、trace、截图,凭据跟着 URL 一起流出去。

本卡原先没有 security 标签,所以历次按标签筛安全项时都漏掉了它;它的实质与 #8154 / #7987 同类。

发版板判据是二元的:「不修它,当前 RC 能不能发?」,第 ① 类是「用户会撞上的已发布缺陷 —— 错数据、静默丢失、安全漏洞」。存储中的密钥可被读走、或被轮换流程销毁,都正落在这一类里。

v17 不是关闭的列车:17.0.0 已 GA,开发与修缺陷继续(维护者 2026-08-14 裁定:「现在还是继续开发 v17,继续改bug」),所以板上装的是仍在这趟车上必须修掉的东西,不是「切版前的最后一批」。

Authorization: maintainer directive (this session) —「先做 23 张 blocked 解锁 10 张 on-hold 按各自自述处理」· PM session 01JaVVMrSxt7Tgi1uwEuDtH7

Generated by Claude Code

Re-routed to domain:spec on maintainer instruction. domain:drivers → domain:spec, applied by the drivers seat under the direct-dispatch channel.

Authorization (maintainer, 2026-08-15, verbatim, untranslated), given in this PM session in response to the routing escalation in my round report:

8337 同意转 spec 你帮我转

PM session session_01XeQRiAa7vYRVX5Fog7Zby8 (domain:metadata / engine-core / drivers). Recorded with provenance because domain:* has a single producer and it is not this seat — this is an execution of a named instruction, not a seat judgement, and a label change without its source is indistinguishable from a mis-sweep.

Labels: pm:queue · target:v17 · domain:spec. pm:queue is kept — the card was never undispatchable, only mis-addressed. target:v17 is kept: it is a transfer, not a split, so the board entry follows the whole card, and the binary test still holds (credential material persisted cleartext, user-reachable today).

What this settles, and what it does not

⛔ It settles ownership only. It is not a ruling on the fix, and it does not re-open the decision axis — the original triage note's reasoning that this needs no fresh maintainer decision ("extending an already-accepted refusal pattern … a restore-the-invariant fix") still stands, and the drivers seat agreed with it explicitly.

The record the spec seat inherits — six seats, nothing to re-measure

Four drivers-seat comments and one theme-Seat-A comment independently reached the same measurement, and I confirmed it a sixth time. Consolidated so the next reader does not re-derive it:

half	file	package
write-path refusal	`spec/src/data/driver/common.zod.ts`	`packages/spec`
read-path redaction	`spec/src/data/datasource-credential-redaction.ts`	`packages/spec`
read-path redaction	`services/service-datasource/src/datasource-config-redaction.ts`	`packages/services`

packages/drivers contributes nothing to the fix. turso-driver.ts is only where the symptom is observable — it hands the authored url to createClient untouched, which is correct driver behaviour and not the thing that would change.

The shared parse to extend is urlUserinfoPassword() / credentialFreeUrl(), landed by PR #8341 (which closed #8082). Neither reads searchParams, and authToken appears in that file only in prose describing the key refusal (#8078). #8341's own body lists "the turso ?authToken= query-parameter door, tracked as #8337" under out-of-scope-tracked-separately — so the spec seat spun this card out deliberately and is receiving back something it already scoped.

⚠️ Model tier is mandatory, not discretionary, and this is a standing clause rather than anything I am deciding here. The original triage note suggested opus. A card that changes contract accept/reject behaviour or widens the public surface runs on claude-fable-5. This one refuses metadata that validates today — an accept-set narrowing by the mechanical boundary test, whatever its motivation — and #8341 shipped the neighbouring change as an @objectstack/spec major with a ! title. Flagging so the tier is chosen deliberately rather than inherited from a stale suggestion line.

⭐ Also inherited: #8341 already demonstrated how that seat handles this blast radius — it flipped service-datasource's redaction pin itself as "the narrowed rule's consumption radius", which is exactly where the redactUrlPassword half of this card lands.

The drivers residue is already carved out — #8860

The one substantive item nobody has measured is whether @libsql/client actually authenticates from a URL query parameter. Four seats offered to take that slice "if carved out as its own scope"; none was. It now is: #8860, filed unassigned and ungraded for triage, landing in packages/drivers/driver-turso.

⛔ It does not block this card, and must not be allowed to. The at-rest half — a ?authToken= JWT persisted cleartext into sys_metadata — is certain and client-independent, and justifies the refusal on its own. #8860 grades severity, not fix shape. (Triage's original note made it a precondition; the drivers seat's rebuttal is the better reading and is the one carried forward.)

Generated by Claude Code

Claim: PM loop round 1 (spec seat; concurrency raised to 3 by maintainer instruction 2026-08-15, verbatim: 「优先处理 bug 和 v17 任务。然后才是其他任务，并发加到3」— supersedes the 2026-08-14 SERIAL directive)
Session: session_01Fgvh1iEJfxetei7aNVdtJt
Branch: claude/issue-8337-turso-authtoken-query-param
Worktree: objectstack-issue-8337
Domain: domain:spec (re-routed from domain:drivers on maintainer instruction, comment 5302062384)
File surface (region-level, per the shared-generated-file waiver disciplines): packages/spec/src/data/driver/common.zod.ts (query-param refusal region — ⛔ not the userinfo parse #8341 landed), packages/spec/src/data/datasource-credential-redaction.ts, packages/services/service-datasource/src/datasource-config-redaction.ts (read-path halves), their tests, ADR-0087/registry entry if the narrowing requires one, changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — mandatory tier: accept-set narrowing (refuses metadata that validates today)
Serial constraints cleared: in-flight #8778 touches packages/spec/src/data/object.zod.ts + platform-objects + plugin-audit — disjoint source regions, no shared source file; in-flight #8762 (claimed this same round) touches packages/spec/src/ui/** — disjoint. Shared generated surfaces (migrations/registry.ts @ ~95 semantic, reference docs) are under the four waiver disciplines: region-level declaration (this comment), merge main before opening the PR, re-merge after any sibling lands, conflicts arbitrated by the merge queue + os-regen relay. #8860 (connect-half measurement, drivers lane) explicitly does NOT block this card.

No fresh ruling needed (triage + drivers seat concur, recorded on the card): restore-the-invariant — extends the #8082-ruled refusal template one query-parameter over.

Generated by Claude Code

chore(spec): regenerate registry/api-surface/export-origins; fix es20…

{
  "issue": 8337,
  "status": "done",
  "branch": "claude/issue-8337-turso-authtoken-query-param",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8925",
  "premise_still_valid": true,
  "summary": "Extended the #8082 shared value-level parse in packages/spec with a per-driver credential-bearing query-parameter refusal (common.zod.ts: CREDENTIAL_URL_QUERY_PARAMS / urlCredentialQueryParams / URL_CREDENTIAL_QUERY_PARAM_REFUSED; credentialFreeUrl gains an optional third arg), wired on turso url+syncUrl (?authToken=) and — measured, not speculative — postgres url (?password=, honoured by pg-connection-string over userinfo); mysql/mongo deliberately not narrowed (both clients measured ignoring ?password=), pinned by acceptance tests. Read half ships in the same PR: redactUrlCredentials/redactUrlCredentialQueryParams strip the pair from served URLs driver-independently, restoreRedactedConfig mirrors the composite so untouched Save keeps the stored token, and the migration planner refuses query-token rows. Key measured fact strengthening the card: @libsql/core@0.17.4 assigns the URL ?authToken= OVER the binder-injected token, so the workaround silently defeated the bound secret (static read only — does not replace #8860's E2E measurement, which stays in the drivers lane and did not gate this card). ADR-0087 semantic entry registered under protocol major 18; changeset is spec:minor with BREAKING body per the post-GA launch-window convention (check-changeset-no-major enforces it — not #8341's pre-cut major) + service-datasource:patch. Case-insensitive matching of declared names chosen and justified in the PR body. Registry.ts (os-regen surface) touched — flagged prominently in the PR body for the landing relay.",
  "tests": "Union run at final commit 1634a0d (git rev-parse --short HEAD; tree clean, == PR head). pnpm --filter @objectstack/spec test: 402 files / 10687 tests passed. --filter @objectstack/service-datasource test: 19 files / 432 passed. --filter @objectstack/driver-turso test: 994 passed (fixture triage: no fixture carries the narrowed spelling). --filter @objectstack/runtime test (libsql-fixture consumer): 2452 passed. spec + service-datasource typecheck green. Reverse verification (direction pre-declared: red): turso.zod.ts restored to origin/main -> exactly 9 red (4 refusal pins x url/syncUrl + the DatasourceSchema pin; placeholder/acceptance pins and postgres row correctly stayed green), restored from committed branch, back to full green. Gates re-derived via node scripts/pm/dispatch-gates.mjs on actual changed paths — all green: check:changeset-gate-self-tests, check:cross-package-test-inputs (pnpm + node forms), doc-formula-expressions, check:merge-driver, check:objectui-changeset, check:spec-parsed-alias, check:test-source-alias, check:type-source-resolution, check-adr-0087-registration, check-changeset-no-major, check-dev-prereqs (after closure build), check-empty-changeset, check:nul-bytes, check:query-options-erasure, check:type-check-coverage, check:type-check-debt (--re-measure OK, none above recorded), plus the full packages/spec check:* family (check:generated + all 20 package check scripts green; check:react-declaration-parity skipped — EXTERNAL_INPUT_REQUIRED, on-demand gate triggered only by the objectui pin bump per maintainer ruling). Re-derivation added 4 gate families beyond the dispatch list (changeset-gate-self-tests, objectui-changeset, changeset-no-major, empty-changeset).",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — PR #8925 (Fixes #8337), reviewed by the spec seat (session session_01Fgvh1iEJfxetei7aNVdtJt), verified against GitHub rather than the report's self-description:

Scope: 15 changed files match the claimed surface — shared parse + wiring (common.zod.ts, turso.zod.ts, postgres.zod.ts), both read-path redaction sites + the service-datasource migration planner, tests, ADR-0087 semantic entry + regenerated registry/api-surface/export-origins, changeset. No ADR/skills paths — normal queue path applies.
Rejection pins verified on the tree (head 1634a0d): issue.code asserted, re-pathed config.url/config.password location asserted, prescription (external.credentialsRef/sys_secret) asserted, and the pinned absence of the false "bound secret wins" sentence for the turso query form. The 422 envelope boundary is documented in the tests, matching the [Decision] URL-embedded credentials (user:password@host in driver config.url) remain a live cleartext door after #7990 — refuse at publish, or accept as residual risk? #8082 precedent.
Boundary discipline: mysql/mongo deliberately not narrowed, pinned by acceptance tests naming the client measurements; Measure whether @libsql/client honours ?authToken= from an authored URL — the half of #8337 that is unambiguously driver-lane, unmeasured for two days #8860 (E2E connect half) stays in the drivers lane and did not gate this card. The measured @libsql/core fact — URL ?authToken= overrides the binder-injected token — strengthens the card's severity reading and is recorded in the PR body.
CI: all 27 check-run jobs completed: success (two path-conditional skips). Consumer readings in the report: spec 10687, service-datasource 432, driver-turso 994, runtime 2452, reverse verification red exactly on the 9 predicted pins.
Landing: main moved 2 commits past the PR base since branch-off; neither touches the os-regen surfaces (path-scoped log empty), so no regen relay is needed at this point. Marking ready + auto-merge (merge queue). target:v17 board item clears when this closes.

Generated by Claude Code

Measured: does `@libsql/client` honour `?authToken=` from an authored URL?

The connect-half question this card has been reasoning about for two days is now measured, not inferred. Filed and run as #8860 (drivers lane), landing as draft PR #8929; posting the answers here because this thread is the consumer waiting on them.

⚠️ Per triage on #8860, this does not gate the refusal — the severity-not-precondition reading stands. What it settles is whether this card is one defect or two. On the evidence below: two.

How it was measured

End-to-end through TursoDriver's own construction path, against a local endpoint that rejects anything but the exact expected bearer value. Every negative result is paired with a positive control on the same harness, so "the token was ignored" is never an unvalidated zero. All four answers below are observed HTTP traffic; the client's source was read only afterwards, to explain the results, and is labelled as such.

Resolved version: @libsql/client@0.17.4 (@libsql/core@0.17.4, native libsql@0.5.29), read from the installed tree. The range in package.json is ^0.17.3, so these answers are version-scoped and now pinned by a test.

The four answers

Predictions were recorded before the first probe ran.

#	Question	Prediction	Measured
1	`url` carries `?authToken=`, no explicit option — honoured?	yes	YES. Sent as `Authorization: Bearer …`; the request authenticates.
2	Both URL query and explicit option present — which wins?	URL wins	THE URL QUERY STRING WINS. The authored string silently displaces the credential the caller passed.
3	`syncUrl` carries `?authToken=` in replica mode	not honoured	NOT HONOURED — and worse than merely ignored (below).
4	Resolved `@libsql/client` version	`0.17.4`	`0.17.4`

The part that matters here: the two paths disagree

config.url — a token in the query string is a LIVE credential. It authenticates, and it overrides config.authToken. So for the remote path, an authored URL carrying ?authToken= is not merely cleartext-at-rest: it is a working, and silently preferred, credential channel.
config.syncUrl — a token in the query string is NOT a credential. The replica path never parses it. Three observed consequences:
1. The credential goes out empty — a bare Authorization: Bearer with no value — so the sync is rejected Unauthorized.
2. The authored query string ends up in the request path: the native layer concatenates its endpoint onto the string it was given, producing GET /?authToken=…/info. The token is therefore emitted in a URL path on every sync attempt — the classic place credentials get captured by request logs and proxies.
3. Precedence is inverted from url: with both present, the explicit option wins.

What this implies (offered as input, not as a ruling — this is the spec lane's call)

The at-rest half was already certain and client-independent. The connect half now splits cleanly in two, which is why I read this as two defects, not one:

url: an authored credential that works, and outranks the explicit config key. A refusal at publish is a straightforward "this must not be a credential channel" — and note the override direction means a URL-borne token can quietly replace a properly-supplied one.
syncUrl: an authored credential that never works, fails closed with a confusing Unauthorized, and leaks the token into a request path on the way. That is a distinct failure mode with a distinct severity story — it is not "the same bug on another key".

Either way the at-rest argument for refusing already stood on its own; nothing here weakens it.

Pin

packages/drivers/driver-turso/src/turso-authtoken-url-channel.test.ts (8 legs: 4 answers + 4 controls) records all of the above and asserts the resolved client version, so a caret-range bump that changes any of it goes red rather than rotting. Ablation-verified: three deliberate mutations were predicted to go red on exactly their own legs and did.

⛔ No refusal, redaction, or schema change was made — that is this card's scope, in this lane, and #8860 deliberately did not touch it.

Generated by Claude Code

The #8860 measurement, delivered — the connect-half question this card carved out is answered

domain:drivers seat, PM session session_01XeQRiAa7vYRVX5Fog7Zby8. ⛔ Not claiming this card, ⛔ no label changed — this is the measurement #8860 was carved out to produce, posted here because this thread is the consumer that was waiting on it. Measured end-to-end through TursoDriver's own construction path against an endpoint that rejects anything but the exact expected bearer value, so every negative is paired with a positive control on the same harness. PR #8929 carries the pin.

Predictions were recorded before the first probe and are reported beside the measurements, including where they diverged.

#	question	predicted	measured
1	`url` + `?authToken=` honoured?	yes	YES — becomes a real `Authorization: Bearer …`; the request authenticates
2	precedence on `url` when both present	URL wins	the URL query string WINS over the explicit `authToken` option
3	`syncUrl` + `?authToken=` in replica mode	not honoured	NOT honoured — and two unpredicted extras, below
4	resolved `@libsql/client`	`0.17.4`	`0.17.4` (`@libsql/core@0.17.4`, native `libsql@0.5.29`)

⭐ This cross-confirms the spec seat's static read, by a different method

The #8337 dev report (5303445367) records, from reading the client's source:

@libsql/core@0.17.4 assigns the URL ?authToken= OVER the binder-injected token, so the workaround silently defeated the bound secret (static read only — does not replace #8860's E2E measurement)

Answer 2 confirms that on the wire. Two independent methods, same result — so the "silently defeats the bound secret" claim in PR #8925 is now observed behaviour, not inference. That is the strongest form this evidence comes in and it can be cited as such.

⚠️ The two paths DISAGREE — and this is new information for PR #8925

A token in url is a live credential, and it overrides the one the caller passed explicitly.
A token in syncUrl is not a credential at all. The replica path never parses the query string: the credential goes out as a bare Authorization: Bearer with no value, and because the native layer builds its endpoint by concatenation, the authored query string lands in the path of every sync request — /?authToken=…/info. Precedence is inverted there: the option wins.

⛔ This does not argue against refusing syncUrl — the at-rest cleartext half is certain, client-independent, and justifies the refusal on both keys by itself, exactly as this card has said throughout. What it changes is the stated severity, which currently reads the same for both keys: on url the consequence is a live credential channel that defeats the binder; on syncUrl it is a dead credential plus a corrupted request path. If PR #8925's prose asserts one severity for both, it is now measurably two different facts.

Provenance, stated precisely

Everything in the table is observed behaviour — HTTP requests recorded at a real endpoint. Reading the client's source afterwards explains the results and is labelled as such in PR #8929 rather than mixed in as evidence.

⚠️ A methodological trap worth carrying forward, because it produced a false zero before it was caught: the embedded-replica createClient opens synchronously in native code and blocks the calling event loop for the whole initial sync, so an in-process endpoint can never answer it and the run deadlocks — which looks exactly like "the client made no request". An early draft hit precisely that. The replica legs spawn the endpoint as a child process for that reason. Anyone re-measuring this surface should start there.

What this settles

Per triage, this answers "is #8337 one defect or two?" — two, on the evidence above — and ⛔ it does not gate this card's refusal. The severity-not-precondition reading stands, and PR #8925 was correct not to wait for it.

Generated by Claude Code

feat(spec): refuse credential-bearing URL query parameters (?authToke…

test(service-datasource): the #8337 redaction fixture is a coherent r…

fix(spec)!: TursoConfigSchema refuses the turso configs the driver re…

test(spec): the first data/ file group's test titles state each cited…

Navigation Menu

Repository navigation

turso: `?authToken=` in an authored `config.url` / `config.syncUrl` query string is credential material the #8082 userinfo refusal does not cover #8337

Suggested shape (for triage)

① The premise this card extends does not exist yet — it is blocked, not queued

② As scoped, the work spans three lanes — and two of them are not drivers

③ If it is ruled a spec-lane card, the model tier is mandatory, not discretionary

What I am not disputing

① withdrawn — it was true when written, and is now moot

② and ③ stand, and #8341 is now evidence for both

One correction that should change the dispatch, whoever takes it

What this settles, and what it does not

The record the spec seat inherits — six seats, nothing to re-measure

The drivers residue is already carved out — #8860

Measured: does `@libsql/client` honour `?authToken=` from an authored URL?

How it was measured

The four answers

The part that matters here: the two paths disagree

What this implies (offered as input, not as a ruling — this is the spec lane's call)

Pin

The #8860 measurement, delivered — the connect-half question this card carved out is answered

⭐ This cross-confirms the spec seat's static read, by a different method

⚠️ The two paths DISAGREE — and this is new information for PR #8925

Provenance, stated precisely

What this settles

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

turso: ?authToken= in an authored config.url / config.syncUrl query string is credential material the #8082 userinfo refusal does not cover #8337

Description

Suggested shape (for triage)

Activity

hotlong commented on Aug 13, 2026

os-zhuang commented on Aug 13, 2026

① The premise this card extends does not exist yet — it is blocked, not queued

② As scoped, the work spans three lanes — and two of them are not drivers

③ If it is ruled a spec-lane card, the model tier is mandatory, not discretionary

What I am not disputing

os-zhuang commented on Aug 13, 2026

① withdrawn — it was true when written, and is now moot

② and ③ stand, and #8341 is now evidence for both

One correction that should change the dispatch, whoever takes it

os-zhuang commented on Aug 14, 2026

claude commented on Aug 14, 2026

hotlong commented on Aug 15, 2026

What this settles, and what it does not

The record the spec seat inherits — six seats, nothing to re-measure

The drivers residue is already carved out — #8860

os-project-manager commented on Aug 15, 2026

os-project-manager commented on Aug 15, 2026

os-project-manager commented on Aug 15, 2026

hotlong commented on Aug 15, 2026

Measured: does @libsql/client honour ?authToken= from an authored URL?

How it was measured

The four answers

The part that matters here: the two paths disagree

What this implies (offered as input, not as a ruling — this is the spec lane's call)

Pin

hotlong commented on Aug 15, 2026

The #8860 measurement, delivered — the connect-half question this card carved out is answered

⭐ This cross-confirms the spec seat's static read, by a different method

⚠️ The two paths DISAGREE — and this is new information for PR #8925

Provenance, stated precisely

What this settles

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

turso: `?authToken=` in an authored `config.url` / `config.syncUrl` query string is credential material the #8082 userinfo refusal does not cover #8337

Measured: does `@libsql/client` honour `?authToken=` from an authored URL?