fix: Harden webhook, vault, session, and base client paths#654

Open

gjtorikian wants to merge 12 commits intomainfrom

Commits on May 7, 2026

fix: percent-encode path segments in base client

gjtorikian
and
claude
committed
fix: add structured failure reasons for session refresh

gjtorikian
and
claude
committed
fix: force public clients to drop the API key

gjtorikian
and
claude
committed
fix: use symmetric tolerance check for webhook timestamps

gjtorikian
and
claude
committed
fix: bound LEB128 decode to 32 bits in vault payload

gjtorikian
and
claude
committed
fix: preserve empty AAD in vault crypto helpers

gjtorikian
and
claude
committed
fix: treat tolerance=0 as a valid window in webhook verifier

gjtorikian
and
claude
committed
style(session): apply ruff format

gjtorikian
and
claude
committed