@musnows/scriverse 0.7.1 → 0.7.3

package/dist/public/styles.css

@@ -65,7 +65,7 @@
   --font-cjk: "PingFang SC", "Microsoft YaHei", "Noto Sans CJK SC", "Heiti SC";
   --ui-font-size: 14px;
   --ui-font-scale: 1;
-  --ai-font-size: 14px;
+  --ai-font-size: 12px;
   --ai-font-scale: 1;
   --editor-font-size: 17px;
   --editor-line-height: 1.55;
@@ -796,6 +796,17 @@ body.is-panel-resizing { cursor: col-resize; user-select: none; }
 }
 .dialog.s3-backup-dialog { width: min(900px, 94vw); }
 .s3-backup-body { display: grid; gap: 18px; max-height: calc(88vh - 86px); overflow-y: auto; padding: 18px 24px 24px; }
+.s3-backup-encryption { display: grid; gap: 12px; min-width: 0; margin: 0; padding: 15px 16px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface-soft); }
+.s3-backup-encryption legend { padding: 0 6px; color: var(--ink); font-size: 13px; font-weight: 600; }
+.s3-backup-encryption-control { display: flex; align-items: flex-start; justify-content: space-between; gap: 16px; }
+.s3-backup-encryption-control > label { display: flex; align-items: flex-start; gap: 9px; min-width: 0; color: var(--ink); cursor: pointer; }
+.s3-backup-encryption-control input { flex: 0 0 auto; width: 17px; height: 17px; margin-top: 1px; }
+.s3-backup-encryption-control label > span { display: grid; gap: 4px; min-width: 0; }
+.s3-backup-encryption-control strong { font-size: 12px; font-weight: 600; }
+.s3-backup-encryption-control small { color: var(--muted); font-size: 10px; line-height: 1.55; }
+.s3-backup-encryption-warning { padding: 10px 12px; border: 1px solid color-mix(in srgb, #bf6a35 48%, var(--line)); border-radius: 5px; background: color-mix(in srgb, #bf6a35 10%, var(--surface)); }
+.s3-backup-encryption-warning strong { color: var(--ink); font-size: 11px; }
+.s3-backup-encryption-warning p { margin: 3px 0 0; color: var(--muted); font-size: 10px; line-height: 1.55; }
 .s3-backup-overview { display: flex; align-items: center; justify-content: space-between; gap: 18px; padding: 15px 16px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface-soft); }
 .s3-backup-overview h3, .s3-backup-history h3 { margin: 0; font-size: 15px; font-weight: 600; }
 .s3-backup-overview p, .s3-backup-history header p { margin: 4px 0 0; color: var(--muted); font-size: 10px; line-height: 1.55; }
@@ -841,6 +852,12 @@ body.is-panel-resizing { cursor: col-resize; user-select: none; }
 .s3-backup-options span { display: grid; gap: 3px; }
 .s3-backup-options strong { font-size: 10px; font-weight: 600; }
 .s3-backup-options small { color: var(--muted); font-size: 9px; line-height: 1.45; }
+.dialog.s3-backup-key-dialog { width: min(620px, 94vw); }
+.s3-backup-key-body { display: grid; gap: 14px; padding: 18px 24px 4px; }
+.s3-backup-key-body > label { display: grid; gap: 6px; color: var(--muted); font-size: 11px; }
+.s3-backup-key-body textarea { width: 100%; min-height: 82px; resize: none; padding: 10px 12px; border: 1px solid var(--line); border-radius: 5px; background: var(--surface); color: var(--ink); font: 12px/1.6 var(--font-latin), monospace; overflow-wrap: anywhere; }
+.s3-backup-key-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.s3-backup-key-actions button { min-height: 34px; }
 .member-permission-form { display: grid; gap: 12px; margin: 0; padding: 14px; border: 1px solid var(--line); border-radius: 7px; background: var(--surface-soft); }
 .member-person-field { display: grid; gap: 6px; color: var(--muted); font-size: 11px; }
 .member-person-field small, .member-permission-help { color: var(--muted); font-size: 10px; line-height: 1.5; }
@@ -1415,6 +1432,10 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .draft-type-filter-field { display: grid; min-width: 0; }
 .draft-type-filter-field > span { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
 .draft-type-filter-field select { width: 100%; min-width: 0; min-height: 38px; padding: 8px 10px; background: var(--surface); color: var(--ink); font-size: 11px; }
+.setting-filter-toolbar { grid-template-columns: minmax(0, 1.2fr) repeat(2, minmax(0, .8fr)) auto; }
+.setting-filter-field { display: grid; min-width: 0; }
+.setting-filter-field > span { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
+.setting-filter-field input, .setting-filter-field select { width: 100%; min-width: 0; min-height: 38px; padding: 8px 10px; background: var(--surface); color: var(--ink); font-size: 11px; }
 .draft-binding-field { min-width: 0; }
 .draft-binding-field > label { display: grid; gap: 7px; }
 .character-card:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
@@ -1615,13 +1636,13 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 }
 .task-status-badge.is-running .task-status-indicator::after { animation: task-status-running-ripple 1.8s ease-out infinite; }
 .task-status-badge.is-review, .task-status-badge.is-completed { --task-status-color: var(--green); }
-.task-status-badge.is-partial { --task-status-color: var(--accent); }
+.task-status-badge.is-partial, .task-status-badge.is-failed { --task-status-color: var(--accent); }
 .task-status-badge.is-expired { --task-status-color: color-mix(in srgb, var(--muted) 72%, var(--accent)); border-style: dashed; }
 .task-status-badge.is-cancelled, .task-status-badge.is-unknown { --task-status-color: var(--muted); }
 .task-status-badge.is-cancelled .task-status-indicator, .task-status-badge.is-unknown .task-status-indicator { background: transparent; border: 1px solid currentColor; box-shadow: none; }
 .task-status-badge.is-state-change { animation: task-status-enter .42s cubic-bezier(.22, .8, .32, 1) both; }
 .task-status-badge.is-running.is-state-change { animation: task-status-enter .42s cubic-bezier(.22, .8, .32, 1) both, task-status-running-breathe 1.8s ease-in-out .42s infinite; }
-.task-status-badge.is-partial.is-state-change { animation: task-status-attention .46s ease-out both; }
+.task-status-badge.is-partial.is-state-change, .task-status-badge.is-failed.is-state-change { animation: task-status-attention .46s ease-out both; }
 .task-progress-cell { width: 128px; }
 .task-progress { display: grid; grid-template-columns: 36px minmax(58px, 1fr); align-items: center; gap: 8px; min-width: 102px; }
 .task-progress-value { color: var(--ink); font-family: var(--font-latin), monospace; font-size: 11px; font-variant-numeric: tabular-nums; font-weight: 600; }
@@ -1629,7 +1650,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .task-progress-fill { position: relative; display: block; width: var(--task-progress); height: 100%; overflow: hidden; border-radius: inherit; background: var(--muted); transition: width .35s ease; }
 .task-progress.is-running .task-progress-fill { background: var(--task-running); }
 .task-progress.is-review .task-progress-fill, .task-progress.is-completed .task-progress-fill { background: var(--green); }
-.task-progress.is-partial .task-progress-fill { background: var(--accent); }
+.task-progress.is-partial .task-progress-fill, .task-progress.is-failed .task-progress-fill { background: var(--accent); }
 .task-progress.is-running .task-progress-fill::after {
   content: "";
   position: absolute;
@@ -1963,7 +1984,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .mind-edge-detail { position: absolute; z-index: 5; left: 16px; right: 16px; bottom: 14px; display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 10px; align-items: start; padding: 10px 12px; border: 1px solid var(--line); border-radius: 5px; background: var(--surface-strong); box-shadow: var(--shadow); font-size: 11px; }
 .mind-edge-detail b { white-space: nowrap; }.mind-edge-detail span { color: var(--muted); line-height: 1.55; }
 .relationship-empty-note { margin-top: -12px; padding: 12px 14px; border: 1px dashed var(--line); color: var(--muted); font-size: 11px; }
-.relationship-map-dialog { position: relative; width: min(1400px, 96vw); max-width: none; height: min(900px, 92vh); max-height: none; padding: 0; border: 1px solid var(--line); border-radius: 7px; background: var(--panel); box-shadow: var(--shadow); }
+.relationship-map-dialog { position: fixed; inset: 0; width: 100vw; max-width: none; height: 100dvh; max-height: none; margin: 0; padding: 0; overflow: hidden; border: 0; border-radius: 0; background: var(--panel); box-shadow: none; }
 .relationship-map-dialog::backdrop { background: rgba(34,30,25,.52); backdrop-filter: blur(3px); }
 .relationship-map-floating-close { position: absolute; z-index: 12; top: 25px; right: 25px; width: 34px; height: 34px; border: 1px solid var(--line); border-radius: 50%; background: var(--surface-strong); color: var(--ink); font-size: 20px; }
 .relationship-map-expanded-host { height: 100%; padding: 18px; }
@@ -2194,7 +2215,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .galaxy-graph { z-index: 2; }.galaxy-node-layer { z-index: 3; pointer-events: none; }
 .galaxy-node { --node-size: 12px; position: absolute; left: 0; top: 0; display: grid; grid-template-rows: var(--node-size) auto; justify-items: center; align-items: start; gap: 5px; padding: 8px; border: 0; background: transparent; color: #edf7ff; cursor: grab; touch-action: none; pointer-events: auto; transform-origin: center; opacity: var(--depth-opacity, 1); }
 .galaxy-node.is-dragging, .galaxy-node.is-selected, .galaxy-node.is-edge-endpoint { will-change: transform, opacity; }
-.galaxy-node i { position: relative; isolation: isolate; width: var(--node-size); height: var(--node-size); border-radius: 50%; background: radial-gradient(circle at 32% 27%, var(--node-core, #fff) 0 7%, color-mix(in srgb, var(--node-color) 62%, #fff) 18%, var(--node-color) 52%, var(--node-rim, #07101f) 100%); box-shadow: inset -3px -4px 7px color-mix(in srgb, var(--node-rim, #07101f) 74%, transparent), 0 0 4px rgba(255,255,255,.82), 0 0 calc(7px + var(--node-glow) * 11px) var(--node-color), 0 0 calc(15px + var(--node-glow) * 25px) var(--node-atmosphere, color-mix(in srgb, var(--node-color) 72%, transparent)); filter: brightness(var(--node-brightness)); transition: filter .18s ease, box-shadow .18s ease; }
+.galaxy-node i { position: relative; isolation: isolate; width: var(--node-size); height: var(--node-size); border-radius: 50%; background: radial-gradient(circle at 32% 27%, var(--node-core, #fff) 0 7%, color-mix(in srgb, var(--node-color) 62%, #fff) 18%, var(--node-color) 52%, var(--node-rim, #07101f) 100%); box-shadow: inset -3px -4px 7px color-mix(in srgb, var(--node-rim, #07101f) 74%, transparent), 0 0 4px rgba(255,255,255,.82), 0 0 calc(7px + var(--node-glow) * 11px) var(--node-color), 0 0 calc(15px + var(--node-glow) * 25px) var(--node-atmosphere, color-mix(in srgb, var(--node-color) 72%, transparent)); filter: brightness(var(--node-brightness)); transform: scale(var(--node-marker-scale, 1)); transform-origin: center; transition: filter .18s ease, box-shadow .18s ease; }
 .galaxy-node i::before, .galaxy-node i::after { content: ""; position: absolute; pointer-events: none; }
 .galaxy-node i::before { z-index: -1; inset: -34%; border-radius: 50%; background: radial-gradient(circle, var(--node-atmosphere) 0, transparent 68%); opacity: .64; }
 .galaxy-node[data-celestial-type="star"] i { background: radial-gradient(circle at 38% 34%, #fff 0 10%, var(--node-core) 22%, var(--node-color) 53%, var(--node-rim) 100%); box-shadow: 0 0 5px #fff, 0 0 calc(10px + var(--node-glow) * 15px) var(--node-color), 0 0 calc(24px + var(--node-glow) * 34px) var(--node-atmosphere); }
@@ -2206,7 +2227,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .galaxy-node[data-celestial-type="volcanic"] i { background: radial-gradient(circle at 66% 61%, #ffd37a 0 3%, #ff7438 5%, transparent 9%), radial-gradient(circle at 37% 72%, #ff9b48 0 3%, transparent 8%), radial-gradient(circle at 30% 25%, var(--node-core) 0 5%, var(--node-color) 38%, var(--node-rim) 100%); }
 .galaxy-node[data-celestial-type="rocky"] i { background: radial-gradient(circle at 67% 31%, color-mix(in srgb, var(--node-rim) 74%, transparent) 0 8%, transparent 10%), radial-gradient(circle at 34% 68%, color-mix(in srgb, var(--node-rim) 58%, transparent) 0 11%, transparent 13%), radial-gradient(circle at 30% 26%, var(--node-core) 0 5%, var(--node-color) 45%, var(--node-rim) 100%); }
 .galaxy-node[data-celestial-type="dwarf"] i { box-shadow: inset -2px -3px 5px var(--node-rim), 0 0 3px rgba(255,255,255,.65), 0 0 calc(5px + var(--node-glow) * 8px) var(--node-atmosphere); }
-.galaxy-node span { opacity: 0; max-width: 150px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; padding: 3px 6px; border-radius: 4px; background: rgba(5,7,13,.68); font-size: 10px; text-align: center; text-shadow: 0 1px 3px #000; transition: opacity .14s ease; }
+.galaxy-node span { opacity: 0; max-width: 150px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; padding: 3px 6px; border-radius: 4px; background: rgba(5,7,13,.68); font-size: 10px; text-align: center; text-shadow: 0 1px 3px #000; transform: translate3d(0, var(--node-label-offset, 0px), 0); transition: opacity .14s ease; }
 .galaxy-node.show-label span, .galaxy-node:hover span, .galaxy-node:focus-visible span, .galaxy-node.is-selected span, .galaxy-node.is-related span, .galaxy-node.is-edge-endpoint span { opacity: 1; }.galaxy-node.is-selected i { background: #fff4bd; box-shadow: 0 0 5px #fff, 0 0 18px #ffc86b, 0 0 42px rgba(255,173,66,.82); }.galaxy-node.is-related i { background: #d8f4ff; box-shadow: 0 0 4px #fff, 0 0 15px #438cff, 0 0 28px rgba(67,140,255,.56); }.galaxy-node.is-edge-endpoint i { background: #fff; box-shadow: 0 0 6px #fff, 0 0 22px #6fcaff, 0 0 48px rgba(67,140,255,.92); }.galaxy-node.is-dimmed { opacity: .16; }.galaxy-node.is-selected, .galaxy-node.is-related, .galaxy-node.is-edge-endpoint { z-index: 2; }
 .galaxy-node.is-dragging { cursor: grabbing; z-index: 6; }
 .galaxy-close { position: fixed; z-index: 8; top: 22px; right: 25px; width: 42px; height: 42px; border: 1px solid rgba(255,255,255,.22); border-radius: 50%; background: rgba(5,7,13,.62); color: #fff; font-size: 25px; }
@@ -2437,7 +2458,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .prompt-composer { position: relative; }
 .ai-mention-menu { position: absolute; z-index: 20; left: 0; right: 0; bottom: calc(100% + 6px); max-height: 230px; overflow-y: auto; padding: 6px; border: 1px solid var(--line); border-radius: 6px; background: var(--panel); box-shadow: 0 12px 34px rgba(49,42,32,.18); }
 .ai-mention-option { display: grid; grid-template-columns: 34px minmax(0, 1fr); gap: 8px; width: 100%; padding: 7px 8px; border: 0; border-radius: 4px; background: transparent; text-align: left; }
-.ai-mention-option:hover, .ai-mention-option:focus-visible { background: var(--paper-deep); }
+.ai-mention-option:hover, .ai-mention-option:focus-visible, .ai-mention-option.is-active { background: var(--paper-deep); }
 .ai-mention-option small { color: var(--accent); font-size: 8px; }
 .ai-mention-option strong { overflow: hidden; font-size: 10px; font-weight: 500; text-overflow: ellipsis; white-space: nowrap; }
 .ai-mention-empty { margin: 0; padding: 10px; color: var(--muted); font-size: 10px; text-align: center; }
@@ -2487,6 +2508,9 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
 .ai-citation-card pre { display: none; grid-column: 1 / -1; max-height: 160px; overflow: auto; margin: 0; padding: 9px; border-top: 1px solid var(--line); background: var(--surface); font: 10px/1.55 var(--font-cjk), sans-serif; white-space: pre-wrap; }
 .ai-citation-card.is-expanded pre { display: block; }
 .message-citations { display: flex; flex-wrap: wrap; gap: 4px; margin-top: 7px; }.message-citations span { padding: 3px 6px; border: 1px solid currentColor; border-radius: 10px; font-size: 8px; opacity: .75; }
+.user-message-mentions { display: flex; align-items: center; flex-wrap: wrap; gap: 4px; min-width: 0; margin-top: 8px; padding-top: 7px; border-top: 1px solid color-mix(in srgb, currentColor 28%, transparent); font-size: 8px; line-height: 1.4; }
+.user-message-mentions-label { flex: 0 0 auto; opacity: .72; letter-spacing: .08em; }
+.user-message-mention { min-width: 0; max-width: 100%; padding: 2px 6px; overflow-wrap: anywhere; border: 1px solid color-mix(in srgb, currentColor 55%, transparent); border-radius: 999px; background: color-mix(in srgb, currentColor 12%, transparent); }
 
 /* Toast 使用 Popover Top Layer；必须覆盖 UA 默认居中/系统边框/Canvas 背景 */
 .toast-region,
@@ -2531,6 +2555,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
   background: var(--toast-error-bg);
   color: var(--toast-error-fg);
 }
+.toast.warning { border-color: color-mix(in srgb, #f0bd78 42%, transparent); background: #65451f; color: #fff7e8; }
 .toast-confirmation {
   display: grid;
   gap: 8px;
@@ -2860,6 +2885,7 @@ select:focus, input:focus, textarea:focus { border-color: #a77768; box-shadow: 0
   .character-filter-toolbar { grid-template-columns: minmax(0, 1fr); }
   .character-filter-toolbar-actions { justify-content: flex-start; }
   .draft-filter-toolbar { grid-template-columns: minmax(0, 1fr); }
+  .setting-filter-toolbar { grid-template-columns: minmax(0, 1fr); }
 }
 .entity-editor-open { overflow: hidden; }
 .preview-record-card { cursor: pointer; }
@@ -3527,7 +3553,7 @@ body { font-size: var(--ui-font-size); }
 .ai-context-distribution-label small, .ai-context-distribution-label strong { font-size: calc(9px * var(--ai-font-scale)); }
 .ai-send-button { font-size: calc(10px * var(--ai-font-scale)); }
 .ai-citation-main strong { font-size: calc(10px * var(--ai-font-scale)); }
-.ai-citation-main small, .ai-citation-main span, .message-citations span { font-size: calc(9px * var(--ai-font-scale)); }
+.ai-citation-main small, .ai-citation-main span, .message-citations span, .user-message-mentions { font-size: calc(9px * var(--ai-font-scale)); }
 .ai-history-item strong { font-size: calc(14px * var(--ai-font-scale)); }
 .ai-history-item small { font-size: calc(10px * var(--ai-font-scale)); }
 .ai-tool-call-info dt, .ai-tool-call-detail h3 { font-size: calc(9px * var(--ai-font-scale)); }
@@ -3541,6 +3567,8 @@ body { font-size: var(--ui-font-size); }
 
 @media (max-width: 640px) {
   .s3-backup-body { gap: 14px; padding: 14px 16px 18px; }
+  .s3-backup-encryption-control { align-items: stretch; flex-direction: column; }
+  .s3-backup-encryption-control > .s3-backup-status { width: fit-content; }
   .s3-backup-overview, .s3-backup-history > header { align-items: stretch; flex-direction: column; }
   .s3-backup-overview-actions { display: grid; grid-template-columns: minmax(0, 1fr); }
   .s3-backup-overview-actions button { width: 100%; }
@@ -3553,4 +3581,6 @@ body { font-size: var(--ui-font-size); }
   .s3-backup-run-card details { grid-column: 1 / -1; }
   .s3-backup-target-fields { grid-template-columns: minmax(0, 1fr) !important; padding-inline: 16px !important; }
   .s3-backup-target-fields > * { grid-column: 1 !important; }
+  .s3-backup-key-body { padding-inline: 16px; }
+  .s3-backup-key-actions { display: grid; grid-template-columns: minmax(0, 1fr); }
 }

package/dist/s3-backup.js

@@ -1,5 +1,10 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { Agent as HttpAgent } from "node:http";
+import { Agent as HttpsAgent } from "node:https";
+import { isIP } from "node:net";
 import { DeleteObjectsCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { encryptObject, generateKek } from "./backup-encryption.js";
 import { PLATFORM_AI_WORK_ID } from "./database.js";
 import { AppError } from "./errors.js";
 import { logger, sanitizeError } from "./logger.js";
@@ -65,6 +70,12 @@ export function s3FailureServerResponse(error, secrets = []) {
 class AwsS3ObjectClient {
     client;
     constructor(connection) {
+        const requestHandler = connection.resolvedAddresses?.length
+            ? new NodeHttpHandler({
+                httpAgent: new HttpAgent({ keepAlive: true, maxSockets: 10, lookup: pinnedS3Lookup(connection) }),
+                httpsAgent: new HttpsAgent({ keepAlive: true, maxSockets: 10, lookup: pinnedS3Lookup(connection) })
+            })
+            : undefined;
         this.client = new S3Client({
             endpoint: connection.endpoint,
             region: connection.region,
@@ -75,7 +86,8 @@ class AwsS3ObjectClient {
             forcePathStyle: connection.forcePathStyle,
             maxAttempts: 3,
             requestChecksumCalculation: "WHEN_REQUIRED",
-            responseChecksumValidation: "WHEN_REQUIRED"
+            responseChecksumValidation: "WHEN_REQUIRED",
+            ...(requestHandler ? { requestHandler } : {})
         });
     }
     async objectExists(bucket, key) {
@@ -138,6 +150,35 @@ class AwsS3ObjectClient {
         this.client.destroy();
     }
 }
+function normalizedHostname(value) {
+    return value.replace(/^\[|\]$/gu, "").replace(/\.$/u, "").toLocaleLowerCase("en-US");
+}
+function pinnedS3Lookup(connection) {
+    const endpointHostname = normalizedHostname(new URL(connection.endpoint).hostname);
+    const addresses = (connection.resolvedAddresses ?? []).filter(({ address, family }) => isIP(address) === family);
+    return (hostname, options, callback) => {
+        const requestedHostname = normalizedHostname(hostname);
+        const expectedHostname = requestedHostname === endpointHostname
+            || (!connection.forcePathStyle && requestedHostname.endsWith(`.${endpointHostname}`));
+        const requestedFamily = options.family === 4 || options.family === 6 ? options.family : 0;
+        const candidates = expectedHostname
+            ? addresses.filter(({ family }) => requestedFamily === 0 || family === requestedFamily)
+            : [];
+        if (candidates.length === 0) {
+            const error = Object.assign(new Error("S3 endpoint hostname or address was not approved by the SSRF validator"), {
+                code: "ENOTFOUND"
+            });
+            callback(error, "", 0);
+            return;
+        }
+        if (options.all) {
+            callback(null, candidates.map(({ address, family }) => ({ address, family })));
+            return;
+        }
+        const selected = candidates[0];
+        callback(null, selected.address, selected.family);
+    };
+}
 function requiredString(row, key) {
     const value = row[key];
     if (typeof value !== "string")
@@ -179,9 +220,11 @@ export class S3BackupManager {
     validateEndpoint;
     now;
     log;
+    encryptionConfirmationTtlMs;
     queuedTargetIds = new Set();
     executionChain = Promise.resolve();
     schedulerTimer = null;
+    pendingBackupEncryption = null;
     disposed = false;
     constructor(database, vault, store, attachmentStorage, options = {}) {
         this.database = database;
@@ -198,6 +241,10 @@ export class S3BackupManager {
         this.validateEndpoint = options.validateEndpoint;
         this.now = options.now ?? (() => new Date());
         this.log = options.logger ?? logger;
+        const encryptionConfirmationTtlMs = Number(options.encryptionConfirmationTtlMs ?? 10 * 60_000);
+        this.encryptionConfirmationTtlMs = Number.isFinite(encryptionConfirmationTtlMs) && encryptionConfirmationTtlMs > 0
+            ? Math.floor(encryptionConfirmationTtlMs)
+            : 10 * 60_000;
     }
     listTargets() {
         return this.database.all("SELECT * FROM s3_backup_targets ORDER BY sort_order, created_at, id").map((row) => this.mapTarget(row));
@@ -205,6 +252,91 @@ export class S3BackupManager {
     getTarget(targetId) {
         return this.mapTarget(this.requireTargetRow(targetId));
     }
+    getEncryptionState() {
+        const row = this.database.get("SELECT * FROM s3_backup_encryption WHERE id = 1");
+        if (!row)
+            return { enabled: false, keyConfiguredAt: null };
+        const keyConfigured = this.hasBackupEncryptionKey(row);
+        if (Number(row.enabled) === 1 && !keyConfigured) {
+            throw new AppError(500, "BACKUP_ENCRYPTION_STATE_INVALID", "S3 备份加密配置缺少密钥");
+        }
+        return {
+            enabled: Number(row.enabled) === 1,
+            keyConfiguredAt: keyConfigured ? requiredString(row, "created_at") : null
+        };
+    }
+    setEncryptionEnabled(enabled) {
+        if (!enabled)
+            this.pendingBackupEncryption = null;
+        return this.database.transaction(() => {
+            const row = this.database.get("SELECT * FROM s3_backup_encryption WHERE id = 1");
+            const currentEnabled = Number(row?.enabled ?? 0) === 1;
+            const keyConfigured = row ? this.hasBackupEncryptionKey(row) : false;
+            if (currentEnabled && !keyConfigured) {
+                throw new AppError(500, "BACKUP_ENCRYPTION_STATE_INVALID", "S3 备份加密配置缺少密钥");
+            }
+            if (currentEnabled === enabled) {
+                return {
+                    enabled,
+                    keyConfiguredAt: keyConfigured && row ? requiredString(row, "created_at") : null
+                };
+            }
+            const timestamp = this.now().toISOString();
+            if (!enabled) {
+                this.database.run("UPDATE s3_backup_encryption SET enabled = 0, updated_at = ? WHERE id = 1", timestamp);
+                this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-encryption.disabled", "s3-backup-encryption", "s3-backup-encryption");
+                return {
+                    enabled: false,
+                    keyConfiguredAt: keyConfigured && row ? requiredString(row, "created_at") : null
+                };
+            }
+            if (row && keyConfigured) {
+                this.database.run("UPDATE s3_backup_encryption SET enabled = 1, updated_at = ? WHERE id = 1", timestamp);
+                this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-encryption.enabled", "s3-backup-encryption", "s3-backup-encryption", { keyGenerated: false });
+                return { enabled: true, keyConfiguredAt: requiredString(row, "created_at") };
+            }
+            const key = generateKek();
+            const confirmationToken = randomBytes(32).toString("base64url");
+            this.pendingBackupEncryption = {
+                key,
+                confirmationTokenHash: createHash("sha256").update(confirmationToken).digest(),
+                expiresAtMs: this.now().getTime() + this.encryptionConfirmationTtlMs
+            };
+            return { enabled: false, keyConfiguredAt: null, key, confirmationToken };
+        });
+    }
+    confirmEncryptionEnabled(confirmationToken) {
+        const pending = this.pendingBackupEncryption;
+        const tokenHash = createHash("sha256").update(confirmationToken).digest();
+        if (!pending || pending.expiresAtMs <= this.now().getTime() || !timingSafeEqual(pending.confirmationTokenHash, tokenHash)) {
+            if (pending && pending.expiresAtMs <= this.now().getTime())
+                this.pendingBackupEncryption = null;
+            throw new AppError(409, "BACKUP_ENCRYPTION_CONFIRMATION_INVALID", "备份加密确认已失效，请重新开启并保存新密钥");
+        }
+        const state = this.database.transaction(() => {
+            const row = this.database.get("SELECT * FROM s3_backup_encryption WHERE id = 1");
+            const currentEnabled = Number(row?.enabled ?? 0) === 1;
+            const keyConfigured = row ? this.hasBackupEncryptionKey(row) : false;
+            if (currentEnabled || keyConfigured) {
+                throw new AppError(409, "BACKUP_ENCRYPTION_CONFIRMATION_INVALID", "备份加密状态已变化，请刷新后重试");
+            }
+            const timestamp = this.now().toISOString();
+            const encrypted = this.vault.encrypt(pending.key);
+            if (row) {
+                this.database.run(`UPDATE s3_backup_encryption SET enabled = 1, kek_encrypted = ?, kek_iv = ?, kek_tag = ?,
+           created_at = ?, updated_at = ? WHERE id = 1`, encrypted.encrypted, encrypted.iv, encrypted.tag, timestamp, timestamp);
+            }
+            else {
+                this.database.run(`INSERT INTO s3_backup_encryption (
+            id, enabled, kek_encrypted, kek_iv, kek_tag, created_at, updated_at
+          ) VALUES (1, 1, ?, ?, ?, ?, ?)`, encrypted.encrypted, encrypted.iv, encrypted.tag, timestamp, timestamp);
+            }
+            this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-encryption.enabled", "s3-backup-encryption", "s3-backup-encryption", { keyGenerated: true });
+            return { enabled: true, keyConfiguredAt: timestamp };
+        });
+        this.pendingBackupEncryption = null;
+        return state;
+    }
     createTarget(input) {
         const targetId = randomUUID();
         const timestamp = this.now().toISOString();
@@ -345,11 +477,31 @@ export class S3BackupManager {
         this.schedulerTimer = setInterval(poll, 30_000);
         this.schedulerTimer.unref();
     }
-    async waitForIdle() {
-        await this.executionChain;
+    async waitForIdle(timeoutMs) {
+        const executionChain = this.executionChain;
+        if (timeoutMs === undefined) {
+            await executionChain;
+            return;
+        }
+        const normalizedTimeoutMs = Math.floor(timeoutMs);
+        if (!Number.isFinite(timeoutMs) || normalizedTimeoutMs < 1) {
+            throw new RangeError("S3 backup idle timeout must be a positive finite number");
+        }
+        let timer = null;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new AppError(504, "BACKUP_IDLE_TIMEOUT", `等待 S3 备份执行链结束超时（${normalizedTimeoutMs} 毫秒）`)), normalizedTimeoutMs);
+        });
+        try {
+            await Promise.race([executionChain, timeout]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
     dispose() {
         this.disposed = true;
+        this.pendingBackupEncryption = null;
         if (this.schedulerTimer)
             clearInterval(this.schedulerTimer);
         this.schedulerTimer = null;
@@ -377,30 +529,35 @@ export class S3BackupManager {
         let imagesUploaded = 0;
         let imagesSkipped = 0;
         let databasesDeleted = 0;
+        let encryptionKey = null;
         try {
-            await this.validateEndpoint?.(target.endpoint);
+            encryptionKey = this.activeBackupEncryptionKey();
+            const resolvedAddresses = await this.validateEndpoint?.(target.endpoint);
             client = this.clientFactory({
                 endpoint: target.endpoint,
                 region: target.region,
                 accessKeyId: target.accessKeyId,
                 secretAccessKey: target.secretAccessKey,
-                forcePathStyle: target.forcePathStyle
+                forcePathStyle: target.forcePathStyle,
+                ...(resolvedAddresses?.length ? { resolvedAddresses } : {})
             });
             const databaseSnapshot = await this.snapshotDatabase();
             databaseKey = `${target.rootPrefix}/db/scriverse-${this.snapshotTimestamp(started)}-${runId.replaceAll("-", "").slice(0, 8)}.db`;
             if (!this.masterKey)
                 throw new AppError(500, "BACKUP_MASTER_KEY_UNAVAILABLE", "S3 备份缺少 CredentialVault 恢复密钥");
+            const masterKeyBody = encryptionKey ? encryptObject(this.masterKey, encryptionKey) : this.masterKey;
             await this.withRequestTimeout(client.putObject({
                 bucket: target.bucket,
                 key: `${target.rootPrefix}/master.key`,
-                body: this.masterKey,
+                body: masterKeyBody,
                 contentType: "application/octet-stream"
             }), "上传 CredentialVault 恢复密钥");
+            const databaseBody = encryptionKey ? encryptObject(databaseSnapshot, encryptionKey) : databaseSnapshot;
             await this.withRequestTimeout(client.putObject({
                 bucket: target.bucket,
                 key: databaseKey,
-                body: databaseSnapshot,
-                contentType: "application/vnd.sqlite3"
+                body: databaseBody,
+                contentType: encryptionKey ? "application/octet-stream" : "application/vnd.sqlite3"
             }), "上传数据库快照");
             if (target.backupImages) {
                 for (const source of this.backupImageSources(target.rootPrefix)) {
@@ -409,11 +566,12 @@ export class S3BackupManager {
                         continue;
                     }
                     const body = await source.read();
+                    const uploadBody = encryptionKey ? encryptObject(body, encryptionKey) : body;
                     await this.withRequestTimeout(client.putObject({
                         bucket: target.bucket,
                         key: source.objectKey,
-                        body,
-                        contentType: source.contentType,
+                        body: uploadBody,
+                        contentType: encryptionKey ? "application/octet-stream" : source.contentType,
                         metadata: { sha256: source.sha256 }
                     }), "上传图片");
                     imagesUploaded += 1;
@@ -445,7 +603,11 @@ export class S3BackupManager {
             });
         }
         catch (error) {
-            const serverResponse = s3FailureServerResponse(error, [target.accessKeyId, target.secretAccessKey]);
+            const serverResponse = s3FailureServerResponse(error, [
+                target.accessKeyId,
+                target.secretAccessKey,
+                ...(encryptionKey ? [encryptionKey] : [])
+            ]);
             const errorMessage = typeof serverResponse.message === "string" ? serverResponse.message : "S3 备份失败";
             const finishedAt = this.now().toISOString();
             this.database.transaction(() => {
@@ -488,6 +650,29 @@ export class S3BackupManager {
             throw new AppError(404, "BACKUP_TARGET_NOT_FOUND", "S3 备份目标不存在");
         return row;
     }
+    hasBackupEncryptionKey(row) {
+        return typeof row.kek_encrypted === "string"
+            && typeof row.kek_iv === "string"
+            && typeof row.kek_tag === "string";
+    }
+    activeBackupEncryptionKey() {
+        const row = this.database.get("SELECT * FROM s3_backup_encryption WHERE id = 1");
+        if (!row || Number(row.enabled) !== 1)
+            return null;
+        if (!this.hasBackupEncryptionKey(row)) {
+            throw new AppError(500, "BACKUP_ENCRYPTION_STATE_INVALID", "S3 备份加密配置缺少密钥");
+        }
+        try {
+            return this.vault.decrypt({
+                encrypted: requiredString(row, "kek_encrypted"),
+                iv: requiredString(row, "kek_iv"),
+                tag: requiredString(row, "kek_tag")
+            });
+        }
+        catch {
+            throw new AppError(500, "BACKUP_ENCRYPTION_KEY_UNAVAILABLE", "S3 备份加密密钥无法读取");
+        }
+    }
     runtimeTarget(row) {
         return {
             ...this.mapTarget(row),