@lemoncat7/dsh-ssh 1.3.3 → 1.3.9

package/lib/gist-sync.js

@@ -0,0 +1,1043 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scrypt } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { credentialKey } from '@deepseek-ai/dsh-credentials';
+import { normalizeCredentialEntryDraft, normalizeFtpProfileDraft, normalizeProfileDraft, normalizeProxyEntryDraft, normalizeRemoteProjectDraft, } from './domain.js';
+import { GitHubDeviceAuthService } from './github-device-auth.js';
+import { createGitHubHttpTransport } from './github-http.js';
+const MAIN_FILE = 'dsh-ssh.config.json';
+const BACKUP_PREFIX = 'dsh-ssh.backup.';
+const MAX_GIST_BYTES = 1_048_576;
+const AUTO_SYNC_DELAY_MS = 3_000;
+const AUTO_PULL_INTERVAL_MS = 5 * 60_000;
+const GIST_CREDENTIAL_SCOPE = 'dsh-ssh-gist-sync';
+const COLLECTION_NAMES = ['profiles', 'ftpProfiles', 'remoteProjects', 'credentialEntries', 'proxyEntries'];
+export class GistTokenVault {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    async configured() {
+        const record = await this.readRecord();
+        return { token: record.token !== undefined, encryption: record.encryptionPassphrase !== undefined };
+    }
+    async readToken() { return (await this.readRecord()).token; }
+    async readEncryptionPassphrase() { return (await this.readRecord()).encryptionPassphrase; }
+    async readRecord() {
+        const record = await this.provider.readRecord(credentialKey(GIST_CREDENTIAL_SCOPE, 'default'));
+        if (record === undefined)
+            return {};
+        if (record.kind !== 'grant')
+            throw new Error('Gist 同步凭据格式无效');
+        return parseGistCredentialPayload(record.payload);
+    }
+    async write(value) {
+        await this.provider.modifyRecord(credentialKey(GIST_CREDENTIAL_SCOPE, 'default'), async (current) => {
+            if (current !== undefined && current.kind !== 'grant')
+                throw new Error('Gist 同步凭据格式无效');
+            const previous = current === undefined ? {} : parseGistCredentialPayload(current.payload);
+            const payload = {
+                ...previous,
+                ...(value.token === undefined ? {} : { token: normalizeToken(value.token) }),
+                ...(value.encryptionPassphrase === undefined ? {} : { encryptionPassphrase: normalizeEncryptionPassphrase(value.encryptionPassphrase) }),
+            };
+            return { kind: 'grant', payload };
+        });
+    }
+    async delete() {
+        await this.provider.deleteRecord(credentialKey(GIST_CREDENTIAL_SCOPE, 'default'));
+    }
+    async clearToken() {
+        const key = credentialKey(GIST_CREDENTIAL_SCOPE, 'default');
+        const current = await this.provider.readRecord(key);
+        if (current === undefined)
+            return;
+        if (current.kind !== 'grant')
+            throw new Error('Gist 同步凭据格式无效');
+        const previous = parseGistCredentialPayload(current.payload);
+        if (previous.encryptionPassphrase === undefined) {
+            await this.provider.deleteRecord(key);
+            return;
+        }
+        await this.provider.modifyRecord(key, async () => ({
+            kind: 'grant', payload: { encryptionPassphrase: previous.encryptionPassphrase },
+        }));
+    }
+}
+export class GitHubGistClient {
+    token;
+    request;
+    constructor(token, request = fetch) {
+        this.token = token;
+        this.request = request;
+    }
+    async identify() {
+        const value = await this.json('https://api.github.com/user');
+        if (typeof value.login !== 'string')
+            throw new Error('GitHub 未返回有效账号');
+        return { login: value.login };
+    }
+    async get(id) {
+        return parseGist(await this.json(`https://api.github.com/gists/${normalizeGistId(id)}`));
+    }
+    async create(content) {
+        return parseGist(await this.json('https://api.github.com/gists', {
+            method: 'POST',
+            body: JSON.stringify({ description: 'DSH SSH portable configuration', public: false, files: { [MAIN_FILE]: { content } } }),
+        }));
+    }
+    async update(id, files) {
+        return parseGist(await this.json(`https://api.github.com/gists/${normalizeGistId(id)}`, {
+            method: 'PATCH', body: JSON.stringify({ files }),
+        }));
+    }
+    async content(gist, filename = MAIN_FILE) {
+        const file = gist.files[filename];
+        if (file === undefined)
+            return undefined;
+        if (file.truncated !== true && typeof file.content === 'string')
+            return boundedContent(file.content);
+        if (typeof file.raw_url !== 'string' || !file.raw_url.startsWith('https://gist.githubusercontent.com/')) {
+            throw new Error(`Gist 文件 ${filename} 缺少可信下载地址`);
+        }
+        const response = await this.request(file.raw_url, { headers: this.headers(), signal: AbortSignal.timeout(15_000) });
+        if (!response.ok)
+            throw new Error(`读取 Gist 文件失败（HTTP ${response.status}）`);
+        return boundedContent(await response.text());
+    }
+    async json(url, init = {}) {
+        const response = await this.request(url, {
+            ...init,
+            headers: { ...this.headers(), ...(init.body === undefined ? {} : { 'content-type': 'application/json' }), ...init.headers },
+            signal: AbortSignal.timeout(15_000),
+        });
+        const value = await response.json().catch(() => undefined);
+        if (!response.ok) {
+            const detail = typeof value === 'object' && value !== null && typeof value.message === 'string'
+                ? value.message
+                : `HTTP ${response.status}`;
+            throw new Error(`GitHub Gist 请求失败：${detail}`);
+        }
+        return value;
+    }
+    headers() {
+        return {
+            accept: 'application/vnd.github+json',
+            authorization: `Bearer ${this.token}`,
+            'user-agent': 'dsh-ssh-gist-sync',
+            'x-github-api-version': '2022-11-28',
+        };
+    }
+}
+export class GistSyncService {
+    store;
+    credentials;
+    vault;
+    metadataPath;
+    clientFactory;
+    githubHttp;
+    metadata;
+    persistQueue = Promise.resolve();
+    syncQueue = Promise.resolve(undefined);
+    unsubscribe;
+    autoTimer;
+    pullTimer;
+    applying = false;
+    running = false;
+    oauth;
+    constructor(store, credentials, vault, metadataPath, metadata, clientFactory, githubHttp) {
+        this.store = store;
+        this.credentials = credentials;
+        this.vault = vault;
+        this.metadataPath = metadataPath;
+        this.clientFactory = clientFactory;
+        this.githubHttp = githubHttp;
+        this.metadata = metadata;
+        this.oauth = new GitHubDeviceAuthService(() => this.metadata.settings.oauthClientId, async (token) => {
+            const identity = await this.clientFactory(token).identify();
+            await this.vault.write({ token });
+            this.metadata.githubLogin = identity.login;
+            delete this.metadata.lastError;
+            await this.persist();
+            return identity;
+        }, githubHttp.request);
+    }
+    static async open(store, credentials, vault, metadataPath, clientFactory) {
+        const metadata = await readMetadata(metadataPath);
+        const githubHttp = createGitHubHttpTransport(() => store.settings().githubProxy);
+        const factory = clientFactory ?? (token => new GitHubGistClient(token, githubHttp.request));
+        const service = new GistSyncService(store, credentials, vault, metadataPath, metadata, factory, githubHttp);
+        service.unsubscribe = store.subscribe((previous, next) => { service.onStoreChanged(previous, next); });
+        service.configureAutomaticSync();
+        if (metadata.settings.autoSync)
+            service.scheduleAutoSync(1_500);
+        return service;
+    }
+    async close() {
+        this.oauth.close();
+        this.unsubscribe?.();
+        this.unsubscribe = undefined;
+        if (this.autoTimer !== undefined)
+            clearTimeout(this.autoTimer);
+        if (this.pullTimer !== undefined)
+            clearInterval(this.pullTimer);
+        await this.persistQueue;
+        await this.syncQueue.catch(() => { });
+        await this.githubHttp.close();
+    }
+    async testNetwork() {
+        const response = await this.githubHttp.request('https://api.github.com/meta', {
+            headers: { accept: 'application/vnd.github+json', 'user-agent': 'dsh-ssh-github-network-test' },
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            throw new Error(`GitHub 网络测试失败（HTTP ${response.status}）`);
+        await response.body?.cancel();
+        return { route: this.githubHttp.route() };
+    }
+    async view() {
+        const settings = this.metadata.settings;
+        const configured = await this.vault.configured();
+        return {
+            ...settings,
+            tokenConfigured: configured.token,
+            encryptionConfigured: configured.encryption,
+            running: this.running,
+            ...(this.metadata.lastSyncAt === undefined ? {} : { lastSyncAt: this.metadata.lastSyncAt }),
+            ...(this.metadata.lastResult === undefined ? {} : { lastResult: this.metadata.lastResult }),
+            ...(this.metadata.lastError === undefined ? {} : { lastError: this.metadata.lastError }),
+            ...(settings.gistId === undefined ? {} : { gistUrl: `https://gist.github.com/${settings.gistId}` }),
+            ...(this.metadata.githubLogin === undefined ? {} : { githubLogin: this.metadata.githubLogin }),
+            ...(this.metadata.lastCloudVersion === undefined ? {} : { cloudVersion: this.metadata.lastCloudVersion }),
+            oauthAvailable: settings.oauthClientId !== undefined,
+        };
+    }
+    async configure(value) {
+        const input = asRecord(value, 'Gist 同步设置');
+        const previousGistId = this.metadata.settings.gistId;
+        const settings = normalizeSettings(input.settings ?? input);
+        const credentialUpdate = {};
+        if (typeof input.token === 'string' && input.token.trim().length > 0)
+            credentialUpdate.token = input.token;
+        if (typeof input.encryptionPassphrase === 'string' && input.encryptionPassphrase.length > 0)
+            credentialUpdate.encryptionPassphrase = input.encryptionPassphrase;
+        if (Object.keys(credentialUpdate).length > 0) {
+            await this.vault.write(credentialUpdate);
+            if (credentialUpdate.token !== undefined)
+                delete this.metadata.githubLogin;
+        }
+        if (input.clearToken === true) {
+            await this.vault.clearToken();
+            delete this.metadata.githubLogin;
+        }
+        this.metadata.settings = settings;
+        if (previousGistId !== settings.gistId)
+            delete this.metadata.lastSyncedDigest;
+        delete this.metadata.lastError;
+        await this.persist();
+        this.configureAutomaticSync();
+        if (settings.autoSync)
+            this.scheduleAutoSync(500);
+        return this.view();
+    }
+    async testConnection() {
+        const client = await this.client();
+        const identity = await client.identify();
+        const gistId = this.metadata.settings.gistId;
+        if (gistId !== undefined) {
+            const gist = await client.get(gistId);
+            if (gist.version !== undefined)
+                this.metadata.lastCloudVersion = gist.version;
+            const content = await client.content(gist);
+            if (content !== undefined) {
+                const snapshot = parsePortableSnapshot(content);
+                await decryptSecretRecords(snapshot.secrets, await this.encryptionPassphrase());
+            }
+        }
+        this.metadata.githubLogin = identity.login;
+        await this.persist();
+        return { login: identity.login, ...(gistId === undefined ? {} : { gistId }) };
+    }
+    startOAuth() { return this.oauth.start(); }
+    pollOAuth(id) { return this.oauth.poll(id); }
+    async disconnectGitHub() {
+        await this.vault.clearToken();
+        delete this.metadata.githubLogin;
+        delete this.metadata.lastError;
+        await this.persist();
+        return this.view();
+    }
+    sync() {
+        const operation = this.syncQueue.catch(() => undefined).then(() => this.performSync());
+        this.syncQueue = operation;
+        return operation;
+    }
+    async performSync() {
+        this.running = true;
+        delete this.metadata.lastError;
+        try {
+            await this.persistQueue;
+            const client = await this.client();
+            const passphrase = await this.encryptionPassphrase();
+            const local = await createEncryptedPortableSnapshot(this.store.snapshot(), this.metadata.deviceId, this.metadata.tombstones, this.credentials, passphrase);
+            const localDigest = snapshotDigest(local);
+            const gistId = this.metadata.settings.gistId;
+            if (gistId === undefined) {
+                const created = await client.create(serializeSnapshot(local));
+                this.metadata.settings = { ...this.metadata.settings, gistId: created.id };
+                this.complete(local, localDigest, 'uploaded', created.version);
+                await this.persist();
+                return this.view();
+            }
+            let gist = await client.get(gistId);
+            const content = await client.content(gist);
+            if (content === undefined) {
+                gist = await client.update(gistId, { [MAIN_FILE]: { content: serializeSnapshot(local) } });
+                this.complete(local, localDigest, 'uploaded', gist.version);
+                await this.persist();
+                return this.view();
+            }
+            const remote = parsePortableSnapshot(content);
+            const remoteDigest = snapshotDigest(remote);
+            const isFreshEmptyDevice = this.metadata.lastSyncedDigest === undefined
+                && !snapshotHasPortableData(local)
+                && snapshotHasPortableData(remote);
+            const decision = isFreshEmptyDevice
+                ? 'remote'
+                : resolveSyncDecision(localDigest, remoteDigest, this.metadata.lastSyncedDigest, this.metadata.settings.strategy);
+            if (decision === 'unchanged') {
+                this.complete(remote, remoteDigest, 'unchanged', gist.version);
+            }
+            else if (decision === 'remote') {
+                if (localDigest !== remoteDigest)
+                    gist = await this.writeBackup(client, gist, local);
+                await this.apply(remote, passphrase);
+                this.complete(remote, remoteDigest, 'downloaded', gist.version);
+            }
+            else {
+                const result = decision === 'merge' ? mergePortableSnapshots(local, remote, this.metadata.deviceId) : local;
+                const resultDigest = snapshotDigest(result);
+                if (remoteDigest !== resultDigest) {
+                    gist = await this.writeMain(client, gist, result, remote);
+                }
+                if (localDigest !== resultDigest)
+                    await this.apply(result, passphrase);
+                this.complete(result, resultDigest, decision === 'merge' ? 'merged' : 'uploaded', gist.version);
+            }
+            await this.persist();
+            return this.view();
+        }
+        catch (error) {
+            this.metadata.lastError = error instanceof Error ? error.message : String(error);
+            await this.persist().catch(() => { });
+            throw error;
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    async client() {
+        const token = await this.vault.readToken();
+        if (token === undefined)
+            throw new Error('请先在设置中保存 GitHub Token');
+        return this.clientFactory(token);
+    }
+    async encryptionPassphrase() {
+        const passphrase = await this.vault.readEncryptionPassphrase();
+        if (passphrase === undefined)
+            throw new Error('请先在设置中保存同步加密密码');
+        return passphrase;
+    }
+    async writeMain(client, gist, result, previousRemote) {
+        const files = { [MAIN_FILE]: { content: serializeSnapshot(result) } };
+        this.addBackupFiles(files, gist, previousRemote);
+        return client.update(gist.id, files);
+    }
+    async writeBackup(client, gist, snapshot) {
+        const files = {};
+        this.addBackupFiles(files, gist, snapshot);
+        return Object.keys(files).length === 0 ? gist : client.update(gist.id, files);
+    }
+    addBackupFiles(files, gist, snapshot) {
+        const retention = this.metadata.settings.backupRetention;
+        const existing = Object.keys(gist.files).filter(name => name.startsWith(BACKUP_PREFIX)).sort().reverse();
+        if (retention > 0) {
+            const stamp = new Date().toISOString().replace(/[-:.TZ]/g, '');
+            const filename = `${BACKUP_PREFIX}${stamp}.${this.metadata.deviceId.slice(0, 8)}.${randomBytes(3).toString('hex')}.json`;
+            files[filename] = { content: serializeSnapshot(snapshot) };
+            for (const stale of existing.slice(Math.max(0, retention - 1)))
+                files[stale] = null;
+        }
+        else {
+            for (const stale of existing)
+                files[stale] = null;
+        }
+    }
+    async apply(snapshot, passphrase) {
+        const secrets = await decryptSecretRecords(snapshot.secrets, passphrase);
+        const previous = this.store.snapshot();
+        this.applying = true;
+        try {
+            await this.store.update(state => {
+                state.profiles = structuredClone(snapshot.collections.profiles);
+                state.ftpProfiles = structuredClone(snapshot.collections.ftpProfiles);
+                state.remoteProjects = structuredClone(snapshot.collections.remoteProjects);
+                state.credentialEntries = structuredClone(snapshot.collections.credentialEntries);
+                state.proxyEntries = structuredClone(snapshot.collections.proxyEntries);
+            });
+            await this.replaceSecrets(previous, snapshot, secrets);
+        }
+        finally {
+            this.applying = false;
+        }
+    }
+    async replaceSecrets(previous, snapshot, secrets) {
+        for (const id of uniqueIds(previous.profiles, snapshot.collections.profiles)) {
+            const profile = snapshot.collections.profiles.find(item => item.id === id);
+            const value = profile?.credentialId === undefined ? secrets.get(secretKey('ssh-profile', id)) : undefined;
+            if (value === undefined)
+                await this.credentials.delete(id);
+            else
+                await this.credentials.replace(id, value);
+        }
+        for (const id of uniqueIds(previous.ftpProfiles, snapshot.collections.ftpProfiles)) {
+            const profile = snapshot.collections.ftpProfiles.find(item => item.id === id);
+            const value = profile?.credentialId === undefined ? secrets.get(secretKey('ftp-profile', id)) : undefined;
+            if (value === undefined)
+                await this.credentials.deleteFtp(id);
+            else
+                await this.credentials.replaceFtp(id, value);
+        }
+        for (const id of uniqueIds(previous.credentialEntries, snapshot.collections.credentialEntries)) {
+            const value = secrets.get(secretKey('vault-entry', id));
+            if (value === undefined)
+                await this.credentials.deleteEntry(id);
+            else
+                await this.credentials.replaceEntry(id, value);
+        }
+        for (const id of uniqueIds(previous.proxyEntries, snapshot.collections.proxyEntries)) {
+            const value = secrets.get(secretKey('proxy-entry', id));
+            if (value === undefined)
+                await this.credentials.deleteProxyEntry(id);
+            else
+                await this.credentials.replaceProxyEntry(id, value);
+        }
+    }
+    complete(snapshot, digest, result, cloudVersion) {
+        this.metadata.tombstones = structuredClone(snapshot.tombstones);
+        this.metadata.lastSyncedDigest = digest;
+        this.metadata.lastSyncAt = Date.now();
+        this.metadata.lastResult = result;
+        if (cloudVersion !== undefined)
+            this.metadata.lastCloudVersion = cloudVersion;
+        delete this.metadata.lastError;
+    }
+    onStoreChanged(previous, next) {
+        if (this.applying)
+            return;
+        let changed = false;
+        const now = Date.now();
+        for (const name of COLLECTION_NAMES) {
+            const previousIds = new Set(previous[name].map(item => item.id));
+            const nextIds = new Set(next[name].map(item => item.id));
+            for (const id of previousIds)
+                if (!nextIds.has(id)) {
+                    this.metadata.tombstones[name][id] = now;
+                    changed = true;
+                }
+            if (!changed && snapshotCollectionDigest(previous[name]) !== snapshotCollectionDigest(next[name]))
+                changed = true;
+        }
+        if (!changed)
+            return;
+        void this.persist();
+        if (this.metadata.settings.autoSync)
+            this.scheduleAutoSync();
+    }
+    scheduleAutoSync(delay = AUTO_SYNC_DELAY_MS) {
+        if (!this.metadata.settings.autoSync)
+            return;
+        if (this.autoTimer !== undefined)
+            clearTimeout(this.autoTimer);
+        this.autoTimer = setTimeout(() => {
+            this.autoTimer = undefined;
+            void this.sync().catch(() => { });
+        }, delay);
+        this.autoTimer.unref?.();
+    }
+    configureAutomaticSync() {
+        if (this.pullTimer !== undefined)
+            clearInterval(this.pullTimer);
+        this.pullTimer = undefined;
+        if (!this.metadata.settings.autoSync)
+            return;
+        this.pullTimer = setInterval(() => { void this.sync().catch(() => { }); }, AUTO_PULL_INTERVAL_MS);
+        this.pullTimer.unref?.();
+    }
+    persist() {
+        const value = structuredClone(this.metadata);
+        const operation = this.persistQueue.then(() => writeMetadata(this.metadataPath, value));
+        this.persistQueue = operation.catch(() => { });
+        return operation;
+    }
+}
+export function createPortableSnapshot(state, deviceId, tombstones = emptyTombstones(), exportedAt = Date.now()) {
+    return {
+        schemaVersion: 1,
+        exportedAt,
+        sourceDeviceId: deviceId,
+        collections: {
+            profiles: sortItems(state.profiles),
+            ftpProfiles: sortItems(state.ftpProfiles),
+            remoteProjects: sortItems(state.remoteProjects),
+            credentialEntries: sortItems(state.credentialEntries),
+            proxyEntries: sortItems(state.proxyEntries),
+        },
+        tombstones: cloneTombstones(tombstones),
+        secrets: [],
+    };
+}
+export async function createEncryptedPortableSnapshot(state, deviceId, tombstones, credentials, passphrase, exportedAt = Date.now()) {
+    const snapshot = createPortableSnapshot(state, deviceId, tombstones, exportedAt);
+    const records = [];
+    for (const profile of state.profiles)
+        if (profile.credentialId === undefined) {
+            records.push({ scope: 'ssh-profile', id: profile.id, updatedAt: profile.updatedAt, value: await credentials.read(profile.id) });
+        }
+    for (const profile of state.ftpProfiles)
+        if (profile.credentialId === undefined) {
+            records.push({ scope: 'ftp-profile', id: profile.id, updatedAt: profile.updatedAt, value: await credentials.readFtp(profile.id) });
+        }
+    for (const entry of state.credentialEntries)
+        records.push({ scope: 'vault-entry', id: entry.id, updatedAt: entry.updatedAt, value: await credentials.readEntry(entry.id) });
+    for (const entry of state.proxyEntries)
+        records.push({ scope: 'proxy-entry', id: entry.id, updatedAt: entry.updatedAt, value: await credentials.readProxyEntry(entry.id) });
+    const salt = randomBytes(16);
+    const key = await deriveEncryptionKey(passphrase, salt);
+    snapshot.secrets = (await Promise.all(records.filter(item => Object.keys(item.value).length > 0).map(item => encryptSecretRecord(item, salt, key))))
+        .sort((left, right) => secretKey(left.scope, left.id).localeCompare(secretKey(right.scope, right.id)));
+    return snapshot;
+}
+export function parsePortableSnapshot(content) {
+    const value = JSON.parse(boundedContent(content));
+    const input = asRecord(value, 'Gist 配置');
+    if (input.schemaVersion !== 1)
+        throw new Error(`不支持的 Gist 配置版本：${String(input.schemaVersion)}`);
+    const collections = asRecord(input.collections, 'Gist 配置集合');
+    const result = {
+        schemaVersion: 1,
+        exportedAt: timestamp(input.exportedAt, 'exportedAt'),
+        sourceDeviceId: text(input.sourceDeviceId, 'sourceDeviceId', 8, 100),
+        collections: {
+            profiles: array(collections.profiles, 'profiles').map(parseProfile),
+            ftpProfiles: array(collections.ftpProfiles, 'ftpProfiles').map(parseFtpProfile),
+            remoteProjects: array(collections.remoteProjects, 'remoteProjects').map(parseRemoteProject),
+            credentialEntries: array(collections.credentialEntries, 'credentialEntries').map(parseCredentialEntry),
+            proxyEntries: array(collections.proxyEntries, 'proxyEntries').map(parseProxyEntry),
+        },
+        tombstones: parseTombstones(input.tombstones),
+        secrets: input.secrets === undefined ? [] : array(input.secrets, 'secrets').map(parseEncryptedSecretRecord).sort((a, b) => secretKey(a.scope, a.id).localeCompare(secretKey(b.scope, b.id))),
+    };
+    assertUniqueIds(result);
+    assertPortableReferences(result.collections);
+    return result;
+}
+export function mergePortableSnapshots(local, remote, deviceId, now = Date.now()) {
+    const tombstones = emptyTombstones();
+    const collections = {};
+    for (const name of COLLECTION_NAMES) {
+        const localItems = new Map(local.collections[name].map(item => [item.id, item]));
+        const remoteItems = new Map(remote.collections[name].map(item => [item.id, item]));
+        const deleted = { ...local.tombstones[name] };
+        for (const [id, deletedAt] of Object.entries(remote.tombstones[name]))
+            deleted[id] = Math.max(deleted[id] ?? 0, deletedAt);
+        tombstones[name] = deleted;
+        const ids = new Set([...localItems.keys(), ...remoteItems.keys(), ...Object.keys(deleted)]);
+        const merged = [];
+        for (const id of ids) {
+            const left = localItems.get(id);
+            const right = remoteItems.get(id);
+            const selected = selectNewest(left, right);
+            if (selected !== undefined && selected.updatedAt > (deleted[id] ?? 0))
+                merged.push(structuredClone(selected));
+        }
+        ;
+        collections[name] = sortItems(merged);
+    }
+    const result = { schemaVersion: 1, exportedAt: now, sourceDeviceId: deviceId, collections, tombstones, secrets: [] };
+    result.secrets = mergeSecretRecords(local.secrets, remote.secrets, result);
+    repairReferences(result, now);
+    result.secrets = result.secrets.filter(record => secretOwnerExists(record, result.collections));
+    return result;
+}
+export function snapshotDigest(snapshot) {
+    const secrets = snapshot.secrets.map(record => ({ scope: record.scope, id: record.id, updatedAt: record.updatedAt, contentHash: record.contentHash }));
+    return createHash('sha256').update(stableJson({ collections: snapshot.collections, tombstones: snapshot.tombstones, secrets })).digest('hex');
+}
+export function resolveSyncDecision(localDigest, remoteDigest, baseDigest, strategy) {
+    if (localDigest === remoteDigest)
+        return 'unchanged';
+    if (baseDigest !== undefined) {
+        const localChanged = localDigest !== baseDigest;
+        const remoteChanged = remoteDigest !== baseDigest;
+        if (localChanged && !remoteChanged)
+            return 'local';
+        if (!localChanged && remoteChanged)
+            return 'remote';
+    }
+    return strategy === 'local-first' ? 'local' : strategy === 'cloud-first' ? 'remote' : 'merge';
+}
+function normalizeSettings(value) {
+    const input = asRecord(value, 'Gist 同步设置');
+    const strategy = input.strategy;
+    if (strategy !== 'smart' && strategy !== 'local-first' && strategy !== 'cloud-first')
+        throw new Error('同步策略无效');
+    const backupRetention = input.backupRetention;
+    if (!Number.isSafeInteger(backupRetention) || backupRetention < 0 || backupRetention > 50) {
+        throw new Error('备份保留数量必须是 0 到 50');
+    }
+    const gistId = input.gistId === undefined || input.gistId === null || input.gistId === '' ? undefined : normalizeGistId(input.gistId);
+    const oauthClientId = input.oauthClientId === undefined || input.oauthClientId === null || input.oauthClientId === '' ? undefined : normalizeOAuthClientId(input.oauthClientId);
+    return {
+        autoSync: input.autoSync === true, strategy, backupRetention: backupRetention,
+        ...(gistId === undefined ? {} : { gistId }),
+        ...(oauthClientId === undefined ? {} : { oauthClientId }),
+    };
+}
+function defaultSettings() { return { autoSync: false, strategy: 'smart', backupRetention: 5 }; }
+function emptyTombstones() {
+    return { profiles: {}, ftpProfiles: {}, remoteProjects: {}, credentialEntries: {}, proxyEntries: {} };
+}
+function cloneTombstones(value) {
+    return Object.fromEntries(COLLECTION_NAMES.map(name => [name, { ...value[name] }]));
+}
+async function readMetadata(path) {
+    let content;
+    try {
+        content = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return defaultMetadata();
+        throw error;
+    }
+    try {
+        const input = asRecord(JSON.parse(content), 'Gist 同步状态');
+        if (input.schemaVersion !== 1)
+            throw new Error(`不支持的 Gist 同步状态版本：${String(input.schemaVersion)}`);
+        return {
+            schemaVersion: 1,
+            deviceId: text(input.deviceId, 'deviceId', 8, 100),
+            settings: normalizeSettings(input.settings),
+            tombstones: parseTombstones(input.tombstones),
+            ...(typeof input.lastSyncedDigest === 'string' ? { lastSyncedDigest: input.lastSyncedDigest } : {}),
+            ...(typeof input.lastSyncAt === 'number' ? { lastSyncAt: input.lastSyncAt } : {}),
+            ...(input.lastResult === 'uploaded' || input.lastResult === 'downloaded' || input.lastResult === 'merged' || input.lastResult === 'unchanged' ? { lastResult: input.lastResult } : {}),
+            ...(typeof input.lastError === 'string' ? { lastError: input.lastError } : {}),
+            ...(typeof input.githubLogin === 'string' ? { githubLogin: text(input.githubLogin, 'githubLogin', 1, 100) } : {}),
+            ...(typeof input.lastCloudVersion === 'string' ? { lastCloudVersion: revision(input.lastCloudVersion) } : {}),
+        };
+    }
+    catch (error) {
+        const backupPath = `${path}.corrupt.${Date.now()}`;
+        const preserved = await rename(path, backupPath).then(() => true, () => false);
+        const reason = error instanceof Error ? error.message : String(error);
+        return defaultMetadata(`本地 Gist 同步状态损坏，已安全重置${preserved ? '并保留原文件' : ''}：${reason}`);
+    }
+}
+function defaultMetadata(lastError) {
+    return {
+        schemaVersion: 1,
+        deviceId: randomBytes(16).toString('hex'),
+        settings: defaultSettings(),
+        tombstones: emptyTombstones(),
+        ...(lastError === undefined ? {} : { lastError }),
+    };
+}
+async function writeMetadata(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${randomBytes(5).toString('hex')}.tmp`;
+    const handle = await open(temporary, 'w', 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, path);
+    }
+    catch (error) {
+        if (process.platform !== 'win32')
+            throw error;
+        await rm(path, { force: true });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => { });
+    }
+}
+function serializeSnapshot(value) {
+    const content = `${JSON.stringify(value, null, 2)}\n`;
+    return boundedContent(content);
+}
+function boundedContent(content) {
+    if (Buffer.byteLength(content, 'utf8') > MAX_GIST_BYTES)
+        throw new Error('Gist 配置超过 1 MB 限制');
+    return content;
+}
+function parseGist(value) {
+    const input = asRecord(value, 'GitHub Gist');
+    if (typeof input.public !== 'boolean')
+        throw new Error('GitHub 未返回 Gist 可见性');
+    if (input.public)
+        throw new Error('为避免暴露主机配置，SSH 同步只支持私有 Gist');
+    const files = asRecord(input.files, 'GitHub Gist files');
+    const parsedFiles = {};
+    for (const [name, raw] of Object.entries(files)) {
+        const file = asRecord(raw, `Gist file ${name}`);
+        parsedFiles[name] = {
+            filename: typeof file.filename === 'string' ? file.filename : name,
+            ...(typeof file.content === 'string' ? { content: file.content } : {}),
+            ...(typeof file.raw_url === 'string' ? { raw_url: file.raw_url } : {}),
+            ...(file.truncated === true ? { truncated: true } : {}),
+        };
+    }
+    return {
+        id: normalizeGistId(input.id),
+        html_url: typeof input.html_url === 'string' ? input.html_url : `https://gist.github.com/${String(input.id)}`,
+        public: false,
+        ...parseGistVersion(input),
+        files: parsedFiles,
+    };
+}
+function parseProfile(value) {
+    const input = asRecord(value, 'SSH profile');
+    const draft = normalizeProfileDraft(input);
+    return {
+        id: text(input.id, 'profile.id', 1, 100), name: draft.name, ...(draft.group === undefined ? {} : { group: draft.group }), host: draft.host,
+        port: draft.port ?? 22, username: draft.username, authType: draft.authType, ...(draft.credentialId === undefined ? {} : { credentialId: draft.credentialId }),
+        ...(draft.hostFingerprint === undefined ? {} : { hostFingerprint: draft.hostFingerprint }), proxy: draft.proxy ?? { type: 'none' },
+        keepAliveIntervalMs: draft.keepAliveIntervalMs ?? 15_000, connectTimeoutMs: draft.connectTimeoutMs ?? 15_000,
+        terminalType: draft.terminalType ?? 'xterm-256color', tags: draft.tags ?? [], createdAt: timestamp(input.createdAt, 'createdAt'), updatedAt: timestamp(input.updatedAt, 'updatedAt'),
+    };
+}
+function parseFtpProfile(value) {
+    const input = asRecord(value, 'FTP profile');
+    const draft = normalizeFtpProfileDraft(input);
+    return {
+        id: text(input.id, 'ftpProfile.id', 1, 100), name: draft.name, ...(draft.group === undefined ? {} : { group: draft.group }), protocol: draft.protocol,
+        host: draft.host, port: draft.port ?? (draft.protocol === 'ftps-implicit' ? 990 : 21), username: draft.username,
+        ...(draft.credentialId === undefined ? {} : { credentialId: draft.credentialId }), proxy: draft.proxy ?? { type: 'none' }, initialPath: draft.initialPath ?? '/',
+        connectTimeoutMs: draft.connectTimeoutMs ?? 15_000, ...(draft.tlsServerName === undefined ? {} : { tlsServerName: draft.tlsServerName }),
+        createdAt: timestamp(input.createdAt, 'createdAt'), updatedAt: timestamp(input.updatedAt, 'updatedAt'),
+    };
+}
+function parseRemoteProject(value) {
+    const input = asRecord(value, 'remote project');
+    const draft = normalizeRemoteProjectDraft(input);
+    return { id: text(input.id, 'project.id', 1, 100), profileId: text(input.profileId, 'project.profileId', 1, 100), ...draft, createdAt: timestamp(input.createdAt, 'createdAt'), updatedAt: timestamp(input.updatedAt, 'updatedAt') };
+}
+function parseCredentialEntry(value) {
+    const input = asRecord(value, 'credential entry');
+    const draft = normalizeCredentialEntryDraft(input);
+    return { id: text(input.id, 'credential.id', 1, 100), ...draft, createdAt: timestamp(input.createdAt, 'createdAt'), updatedAt: timestamp(input.updatedAt, 'updatedAt') };
+}
+function parseProxyEntry(value) {
+    const input = asRecord(value, 'proxy entry');
+    const draft = normalizeProxyEntryDraft(input);
+    return { id: text(input.id, 'proxy.id', 1, 100), ...draft, createdAt: timestamp(input.createdAt, 'createdAt'), updatedAt: timestamp(input.updatedAt, 'updatedAt') };
+}
+function parseEncryptedSecretRecord(value) {
+    const input = asRecord(value, 'encrypted secret');
+    const scope = input.scope;
+    if (scope !== 'ssh-profile' && scope !== 'ftp-profile' && scope !== 'vault-entry' && scope !== 'proxy-entry')
+        throw new Error('加密凭据作用域无效');
+    const record = {
+        scope,
+        id: text(input.id, 'secret.id', 1, 100),
+        updatedAt: timestamp(input.updatedAt, 'secret.updatedAt'),
+        contentHash: hexDigest(input.contentHash, 'secret.contentHash'),
+        salt: base64(input.salt, 'secret.salt', 16),
+        iv: base64(input.iv, 'secret.iv', 12),
+        authTag: base64(input.authTag, 'secret.authTag', 16),
+        ciphertext: base64(input.ciphertext, 'secret.ciphertext', undefined, 700_000),
+    };
+    return record;
+}
+async function encryptSecretRecord(item, salt, key) {
+    const plaintext = Buffer.from(stableJson(parseSecretPayload(item.value)), 'utf8');
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(Buffer.from(`${item.scope}:${item.id}:${item.updatedAt}`, 'utf8'));
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return {
+        scope: item.scope,
+        id: item.id,
+        updatedAt: item.updatedAt,
+        contentHash: createHash('sha256').update(plaintext).digest('hex'),
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: cipher.getAuthTag().toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+    };
+}
+async function decryptSecretRecords(records, passphrase) {
+    const output = new Map();
+    const keys = new Map();
+    for (const record of records) {
+        const salt = Buffer.from(record.salt, 'base64');
+        const iv = Buffer.from(record.iv, 'base64');
+        let keyPromise = keys.get(record.salt);
+        if (keyPromise === undefined) {
+            keyPromise = deriveEncryptionKey(passphrase, salt);
+            keys.set(record.salt, keyPromise);
+        }
+        const key = await keyPromise;
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAAD(Buffer.from(`${record.scope}:${record.id}:${record.updatedAt}`, 'utf8'));
+        decipher.setAuthTag(Buffer.from(record.authTag, 'base64'));
+        let plaintext;
+        try {
+            plaintext = Buffer.concat([decipher.update(Buffer.from(record.ciphertext, 'base64')), decipher.final()]);
+        }
+        catch {
+            throw new Error('无法解密 Gist 密钥数据，请检查同步加密密码');
+        }
+        if (createHash('sha256').update(plaintext).digest('hex') !== record.contentHash)
+            throw new Error('Gist 密钥数据完整性校验失败');
+        let value;
+        try {
+            value = JSON.parse(plaintext.toString('utf8'));
+        }
+        catch {
+            throw new Error('Gist 密钥数据不是有效 JSON');
+        }
+        output.set(secretKey(record.scope, record.id), parseSecretPayload(value));
+    }
+    return output;
+}
+export async function decryptPortableSecrets(snapshot, passphrase) {
+    return Object.fromEntries(await decryptSecretRecords(snapshot.secrets, passphrase));
+}
+function mergeSecretRecords(left, right, snapshot) {
+    const records = new Map();
+    for (const candidate of [...left, ...right]) {
+        if (!secretOwnerExists(candidate, snapshot.collections))
+            continue;
+        const key = secretKey(candidate.scope, candidate.id);
+        const previous = records.get(key);
+        if (previous === undefined || candidate.updatedAt > previous.updatedAt || candidate.updatedAt === previous.updatedAt && candidate.contentHash > previous.contentHash) {
+            records.set(key, structuredClone(candidate));
+        }
+    }
+    return [...records.values()].sort((a, b) => secretKey(a.scope, a.id).localeCompare(secretKey(b.scope, b.id)));
+}
+function secretOwnerExists(record, collections) {
+    if (record.scope === 'ssh-profile')
+        return collections.profiles.some(item => item.id === record.id && item.credentialId === undefined);
+    if (record.scope === 'ftp-profile')
+        return collections.ftpProfiles.some(item => item.id === record.id && item.credentialId === undefined);
+    if (record.scope === 'vault-entry')
+        return collections.credentialEntries.some(item => item.id === record.id);
+    return collections.proxyEntries.some(item => item.id === record.id);
+}
+function secretKey(scope, id) { return `${scope}:${id}`; }
+function deriveEncryptionKey(passphrase, salt) {
+    const normalized = normalizeEncryptionPassphrase(passphrase);
+    return new Promise((resolve, reject) => {
+        scrypt(normalized, salt, 32, (error, key) => { if (error !== null)
+            reject(error);
+        else
+            resolve(key); });
+    });
+}
+function parseSecretPayload(value) {
+    const input = asRecord(value, 'credential payload');
+    const output = {};
+    for (const field of ['password', 'privateKey', 'passphrase', 'proxyPassword']) {
+        const candidate = input[field];
+        if (candidate === undefined)
+            continue;
+        if (typeof candidate !== 'string' || candidate.length === 0 || candidate.length > (field === 'privateKey' ? 512_000 : 16_384))
+            throw new Error(`凭据字段 ${field} 无效`);
+        output[field] = candidate;
+    }
+    return output;
+}
+function parseTombstones(value) {
+    const input = value === undefined ? {} : asRecord(value, 'tombstones');
+    const result = emptyTombstones();
+    for (const name of COLLECTION_NAMES) {
+        const entries = input[name] === undefined ? {} : asRecord(input[name], `tombstones.${name}`);
+        for (const [id, raw] of Object.entries(entries))
+            result[name][text(id, 'tombstone id', 1, 100)] = timestamp(raw, 'deletedAt');
+    }
+    return result;
+}
+function assertUniqueIds(snapshot) {
+    for (const name of COLLECTION_NAMES) {
+        const ids = snapshot.collections[name].map(item => item.id);
+        if (new Set(ids).size !== ids.length)
+            throw new Error(`Gist 配置包含重复的 ${name} ID`);
+    }
+    const secretIds = snapshot.secrets.map(item => secretKey(item.scope, item.id));
+    if (new Set(secretIds).size !== secretIds.length)
+        throw new Error('Gist 配置包含重复的加密凭据');
+    if (snapshot.secrets.some(item => !secretOwnerExists(item, snapshot.collections)))
+        throw new Error('Gist 配置包含无归属的加密凭据');
+}
+function assertPortableReferences(collections) {
+    const profiles = new Set(collections.profiles.map(item => item.id));
+    const credentials = new Set(collections.credentialEntries.map(item => item.id));
+    const proxies = new Set(collections.proxyEntries.map(item => item.id));
+    for (const profile of collections.profiles) {
+        if (profile.credentialId !== undefined && !credentials.has(profile.credentialId))
+            throw new Error(`主机 ${profile.name} 引用了缺失的凭据条目`);
+        if (profile.proxy.type === 'saved' && !proxies.has(profile.proxy.proxyId))
+            throw new Error(`主机 ${profile.name} 引用了缺失的代理`);
+        if (profile.proxy.type === 'jump' && profile.proxy.profileIds.some(id => !profiles.has(id) || id === profile.id))
+            throw new Error(`主机 ${profile.name} 的跳板链无效`);
+    }
+    for (const profile of collections.ftpProfiles) {
+        if (profile.credentialId !== undefined && !credentials.has(profile.credentialId))
+            throw new Error(`FTP ${profile.name} 引用了缺失的凭据条目`);
+        if (profile.proxy.type === 'saved' && !proxies.has(profile.proxy.proxyId))
+            throw new Error(`FTP ${profile.name} 引用了缺失的代理`);
+    }
+    for (const project of collections.remoteProjects)
+        if (!profiles.has(project.profileId))
+            throw new Error(`远端项目 ${project.name} 引用了缺失的主机`);
+}
+function repairReferences(snapshot, deletedAt) {
+    const profiles = new Set(snapshot.collections.profiles.map(item => item.id));
+    const credentials = new Set(snapshot.collections.credentialEntries.map(item => item.id));
+    const proxies = new Set(snapshot.collections.proxyEntries.map(item => item.id));
+    const invalidProfiles = new Set(snapshot.collections.profiles.filter(profile => profile.credentialId !== undefined && !credentials.has(profile.credentialId)
+        || profile.proxy.type === 'saved' && !proxies.has(profile.proxy.proxyId)
+        || profile.proxy.type === 'jump' && profile.proxy.profileIds.some(id => !profiles.has(id) || id === profile.id)).map(item => item.id));
+    for (const id of invalidProfiles)
+        snapshot.tombstones.profiles[id] = Math.max(snapshot.tombstones.profiles[id] ?? 0, deletedAt);
+    snapshot.collections.profiles = snapshot.collections.profiles.filter(item => !invalidProfiles.has(item.id));
+    const survivingProfiles = new Set(snapshot.collections.profiles.map(item => item.id));
+    const invalidFtp = new Set(snapshot.collections.ftpProfiles.filter(profile => profile.credentialId !== undefined && !credentials.has(profile.credentialId)
+        || profile.proxy.type === 'saved' && !proxies.has(profile.proxy.proxyId)).map(item => item.id));
+    for (const id of invalidFtp)
+        snapshot.tombstones.ftpProfiles[id] = Math.max(snapshot.tombstones.ftpProfiles[id] ?? 0, deletedAt);
+    snapshot.collections.ftpProfiles = snapshot.collections.ftpProfiles.filter(item => !invalidFtp.has(item.id));
+    const invalidProjects = new Set(snapshot.collections.remoteProjects.filter(project => !survivingProfiles.has(project.profileId)).map(item => item.id));
+    for (const id of invalidProjects)
+        snapshot.tombstones.remoteProjects[id] = Math.max(snapshot.tombstones.remoteProjects[id] ?? 0, deletedAt);
+    snapshot.collections.remoteProjects = snapshot.collections.remoteProjects.filter(item => !invalidProjects.has(item.id));
+}
+function selectNewest(left, right) {
+    if (left === undefined)
+        return right;
+    if (right === undefined)
+        return left;
+    if (left.updatedAt !== right.updatedAt)
+        return left.updatedAt > right.updatedAt ? left : right;
+    return stableJson(left) >= stableJson(right) ? left : right;
+}
+function sortItems(items) { return structuredClone(items).sort((a, b) => a.id.localeCompare(b.id)); }
+function uniqueIds(...groups) { return [...new Set(groups.flatMap(group => group.map(item => item.id)))]; }
+function snapshotCollectionDigest(items) { return createHash('sha256').update(stableJson(sortItems(items))).digest('hex'); }
+function snapshotHasPortableData(snapshot) {
+    return COLLECTION_NAMES.some(name => snapshot.collections[name].length > 0 || Object.keys(snapshot.tombstones[name]).length > 0)
+        || snapshot.secrets.length > 0;
+}
+function stableJson(value) { return JSON.stringify(stableValue(value)); }
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stableValue(item)]));
+}
+function normalizeToken(value) {
+    const token = value.trim();
+    if (token.length < 20 || token.length > 512 || /\s/.test(token))
+        throw new Error('GitHub Token 格式无效');
+    return token;
+}
+function normalizeEncryptionPassphrase(value) {
+    if (value.length < 6 || value.length > 512)
+        throw new Error('同步加密密码必须包含 6 到 512 个字符');
+    return value;
+}
+function parseGistCredentialPayload(value) {
+    const payload = asRecord(value, 'Gist 同步凭据');
+    const token = payload.token;
+    const encryptionPassphrase = payload.encryptionPassphrase;
+    if (token !== undefined && (typeof token !== 'string' || token.length < 20 || token.length > 512))
+        throw new Error('Gist Token 格式无效');
+    if (encryptionPassphrase !== undefined && (typeof encryptionPassphrase !== 'string' || encryptionPassphrase.length < 6 || encryptionPassphrase.length > 512))
+        throw new Error('同步加密密码格式无效');
+    return {
+        ...(typeof token === 'string' ? { token } : {}),
+        ...(typeof encryptionPassphrase === 'string' ? { encryptionPassphrase } : {}),
+    };
+}
+function normalizeGistId(value) {
+    if (typeof value !== 'string' || !/^[a-fA-F0-9]{5,64}$/.test(value.trim()))
+        throw new Error('Gist ID 格式无效');
+    return value.trim().toLowerCase();
+}
+function normalizeOAuthClientId(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9._-]{10,128}$/.test(value.trim()))
+        throw new Error('GitHub OAuth Client ID 格式无效');
+    return value.trim();
+}
+function parseGistVersion(input) {
+    if (!Array.isArray(input.history) || input.history.length === 0)
+        return {};
+    const latest = input.history[0];
+    if (typeof latest !== 'object' || latest === null || Array.isArray(latest))
+        return {};
+    const value = latest.version;
+    return typeof value === 'string' ? { version: revision(value) } : {};
+}
+function revision(value) {
+    if (!/^[a-fA-F0-9]{7,64}$/.test(value))
+        throw new Error('Gist 云端版本格式无效');
+    return value.toLowerCase();
+}
+function asRecord(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${label}必须是对象`);
+    return value;
+}
+function array(value, label) {
+    if (!Array.isArray(value) || value.length > 10_000)
+        throw new Error(`${label} 必须是有效数组`);
+    return value;
+}
+function text(value, label, min, max) {
+    if (typeof value !== 'string' || value.length < min || value.length > max)
+        throw new Error(`${label} 格式无效`);
+    return value;
+}
+function timestamp(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${label} 格式无效`);
+    return value;
+}
+function hexDigest(value, label) {
+    if (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value))
+        throw new Error(`${label} 格式无效`);
+    return value;
+}
+function base64(value, label, exactBytes, maxBytes = exactBytes) {
+    if (typeof value !== 'string' || value.length === 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value))
+        throw new Error(`${label} 格式无效`);
+    const decoded = Buffer.from(value, 'base64');
+    if (exactBytes !== undefined && decoded.length !== exactBytes)
+        throw new Error(`${label} 长度无效`);
+    if (maxBytes !== undefined && decoded.length > maxBytes)
+        throw new Error(`${label} 超出大小限制`);
+    if (decoded.toString('base64') !== value)
+        throw new Error(`${label} 编码无效`);
+    return value;
+}
+//# sourceMappingURL=gist-sync.js.map