ruvnet/ruflo · error · TokenGeneratorError

INVALID_LENGTH

INVALID_LENGTH

Error message

Token length must be at least 16 bytes

What it means

TokenGenerator constructor guard: the effective defaultLength (config value or the 32-byte default) is below 16 bytes. Tokens shorter than 16 bytes of entropy are brute-forceable, so the generator refuses to construct rather than issue weak tokens.

Source

Thrown at v3/@claude-flow/security/src/token-generator.ts:109

 * const signed = generator.generateSignedToken({ userId: '123' });
 *
 * // Verify signed token
 * const isValid = generator.verifySignedToken(signed.combined);
 * ```
 */
export class TokenGenerator {
  private readonly config: Required<TokenConfig>;

  constructor(config: TokenConfig = {}) {
    this.config = {
      defaultLength: config.defaultLength ?? 32,
      encoding: config.encoding ?? 'base64url',
      hmacSecret: config.hmacSecret ?? '',
      defaultExpiration: config.defaultExpiration ?? 3600,
    };

    if (this.config.defaultLength < 16) {
      throw new TokenGeneratorError(
        'Token length must be at least 16 bytes',
        'INVALID_LENGTH'
      );
    }
  }

  /**
   * Generates a random token.
   *
   * @param length - Token length in bytes
   * @returns Random token string
   */
  generate(length?: number): string {
    const len = length ?? this.config.defaultLength;
    const buffer = randomBytes(len);
    return this.encode(buffer);
  }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Generate the token with at least 16 bytes of entropy (e.g. randomBytes(32)).
2. Fix configuration that supplies a shorter token length.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/token-generator.ts:109 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/17e9bbe6533033b4. Report an issue: GitHub.