@toyako/hive 1.0.0

package/dist/security/P0IncidentResponse.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * P0 Incident Response System — v5.5
+ *
+ * When a security breach is detected:
+ * The system must shift from "prevention mode" to "incident containment mode"
+ *
+ * Activation Condition:
+ * - any secret is confirmed exposed
+ * - npm package contains credentials
+ * - git history includes secrets
+ * - logs or traces are publicly distributed
+ *
+ * A system that leaks secrets must not continue operating as if nothing happened.
+ * Security incidents are NOT warnings.
+ * They are architectural validation failures.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.P0IncidentResponseSystem = void 0;
+class P0IncidentResponseSystem {
+    incidents = new Map();
+    publishFrozen = false;
+    /**
+     * 检测到安全事件
+     */
+    detectIncident(exposure) {
+        const incident = {
+            id: `INC-${Date.now()}`,
+            status: "DETECTED",
+            exposure,
+            timeline: [`${new Date().toISOString()}: Incident detected`],
+            timestamp: Date.now()
+        };
+        this.incidents.set(incident.id, incident);
+        // Phase 1: Immediate Containment
+        this.contain(incident);
+        return incident;
+    }
+    /**
+     * Phase 1: Immediate Containment (P0 Lockdown)
+     */
+    contain(incident) {
+        incident.status = "CONTAINED";
+        incident.timeline.push(`${new Date().toISOString()}: Containment initiated`);
+        // Freeze publishing
+        this.publishFrozen = true;
+        incident.timeline.push(`${new Date().toISOString()}: Publishing frozen`);
+        // Mark affected versions
+        for (const version of incident.exposure.versions) {
+            incident.timeline.push(`${new Date().toISOString()}: Version ${version} marked COMPROMISED`);
+        }
+    }
+    /**
+     * Phase 2: Exposure Scope Analysis
+     */
+    analyzeExposure(incidentId) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return null;
+        incident.status = "ANALYZING";
+        incident.timeline.push(`${new Date().toISOString()}: Exposure analysis started`);
+        return incident.exposure;
+    }
+    /**
+     * Phase 3: Secret Rotation Protocol
+     */
+    rotateSecrets(incidentId, secrets) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.timeline.push(`${new Date().toISOString()}: Secret rotation initiated`);
+        for (const secret of secrets) {
+            incident.timeline.push(`${new Date().toISOString()}: Secret ${secret} revoked`);
+        }
+        incident.timeline.push(`${new Date().toISOString()}: New credentials generated`);
+    }
+    /**
+     * Phase 4: Artifact Purge
+     */
+    purgeArtifacts(incidentId, files) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.timeline.push(`${new Date().toISOString()}: Artifact purge initiated`);
+        for (const file of files) {
+            incident.timeline.push(`${new Date().toISOString()}: File ${file} purged`);
+        }
+    }
+    /**
+     * Phase 5: Version Retraction
+     */
+    retractVersion(incidentId, version, strategy) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        if (strategy === "unpublish") {
+            incident.timeline.push(`${new Date().toISOString()}: Version ${version} unpublished`);
+        }
+        else {
+            incident.timeline.push(`${new Date().toISOString()}: Version ${version} deprecated: SECURITY INCIDENT`);
+        }
+    }
+    /**
+     * Phase 6: Forensic Trace Reconstruction
+     */
+    reconstructTrace(incidentId, rootCause) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.rootCause = rootCause;
+        incident.timeline.push(`${new Date().toISOString()}: Root cause identified: ${rootCause}`);
+    }
+    /**
+     * Phase 7: Recovery Release Strategy
+     */
+    planRecovery(incidentId, patchedVersion) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.status = "REMEDIATING";
+        incident.recoveryPlan = patchedVersion;
+        incident.timeline.push(`${new Date().toISOString()}: Recovery plan: release ${patchedVersion}`);
+    }
+    /**
+     * Phase 8: Trust Reset Protocol
+     */
+    resetTrust(incidentId) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.status = "RESOLVED";
+        incident.timeline.push(`${new Date().toISOString()}: Trust level: DEGRADED`);
+        incident.timeline.push(`${new Date().toISOString()}: Re-validation required before next release`);
+    }
+    /**
+     * 获取事件状态
+     */
+    getIncident(id) {
+        return this.incidents.get(id);
+    }
+    /**
+     * 获取所有事件
+     */
+    getAllIncidents() {
+        return Array.from(this.incidents.values());
+    }
+    /**
+     * 检查发布是否冻结
+     */
+    isPublishFrozen() {
+        return this.publishFrozen;
+    }
+    /**
+     * 解除发布冻结
+     */
+    unfreezePublish() {
+        this.publishFrozen = false;
+    }
+}
+exports.P0IncidentResponseSystem = P0IncidentResponseSystem;
+//# sourceMappingURL=P0IncidentResponse.js.map

package/dist/security/P0IncidentResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"P0IncidentResponse.js","sourceRoot":"","sources":["../../src/security/P0IncidentResponse.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAyBH,MAAa,wBAAwB;IAC3B,SAAS,GAAgC,IAAI,GAAG,EAAE,CAAC;IACnD,aAAa,GAAY,KAAK,CAAC;IAEvC;;OAEG;IACH,cAAc,CAAC,QAAwB;QACrC,MAAM,QAAQ,GAAmB;YAC/B,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE;YACvB,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,QAAQ,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,qBAAqB,CAAC;YAC5D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE1C,iCAAiC;QACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,QAAwB;QACtC,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAE7E,oBAAoB;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAEzE,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACjD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,qBAAqB,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,UAAkB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QAEjF,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB,EAAE,OAAiB;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QAEjF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,MAAM,UAAU,CAAC,CAAC;QAClF,CAAC;QAED,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,UAAkB,EAAE,KAAe;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;QAEhF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,IAAI,SAAS,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,UAAkB,EAAE,OAAe,EAAE,QAAmC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,cAAc,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,gCAAgC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,UAAkB,EAAE,SAAiB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,4BAA4B,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,UAAkB,EAAE,cAAsB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC;QAChC,QAAQ,CAAC,YAAY,GAAG,cAAc,CAAC;QACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,4BAA4B,cAAc,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,UAAkB;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC7E,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;IACpG,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;CACF;AAhKD,4DAgKC"}

package/dist/security/SecurityHardening.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Security Hardening & Secret Boundary Layer — v5.5
+ *
+ * Upgrade from Verifiable Execution System to Secure Verifiable Execution System
+ *
+ * Core Principle:
+ * Anything that can be traced must NOT leak secrets.
+ * Anything that contains secrets must NOT be traced.
+ *
+ * Secrets ∩ TraceArtifacts = ∅
+ * Secrets ∩ Logs = ∅
+ * Secrets ∩ ExportPackage = ∅
+ * Secrets ∩ Events = ∅
+ *
+ * Violation = SYSTEM FAILURE.
+ */
+export interface SecretItem {
+    type: "API_KEY" | "TOKEN" | "URL" | "CREDENTIAL" | "ENV_VAR";
+    value: string;
+    location: string;
+    severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+}
+export interface SecretScanResult {
+    hasSecrets: boolean;
+    detected: SecretItem[];
+    severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+}
+export interface SecurityEvent {
+    type: "SECRET_DETECTED" | "LEAK_BLOCKED" | "EXPORT_BLOCKED";
+    location: string;
+    severity: string;
+    actionTaken: string;
+    timestamp: number;
+}
+export declare class SecretDetectionEngine {
+    private patterns;
+    private envPatterns;
+    /**
+     * 扫描文本中的密钥
+     */
+    scan(text: string, location: string): SecretScanResult;
+    /**
+     * 清理文本中的密钥
+     */
+    redact(text: string): string;
+    /**
+     * 分类密钥类型
+     */
+    private classifySecret;
+    /**
+     * 获取最高严重性
+     */
+    private getMaxSeverity;
+}
+export declare class SecretRedactionEngine {
+    private detector;
+    constructor();
+    /**
+     * 清理日志
+     */
+    sanitizeLog(log: string): string;
+    /**
+     * 清理追踪
+     */
+    sanitizeTrace(trace: any): any;
+    /**
+     * 清理导出包
+     */
+    sanitizeExport(data: any): any;
+}
+export declare class RuntimeSecretVault {
+    private secrets;
+    /**
+     * 设置密钥
+     */
+    setSecret(key: string, value: string): void;
+    /**
+     * 获取密钥
+     */
+    getSecret(key: string): string | undefined;
+    /**
+     * 解析密钥引用
+     */
+    resolveSecret(ref: string): string | undefined;
+    /**
+     * 检查是否有密钥
+     */
+    hasSecret(key: string): boolean;
+    /**
+     * 删除密钥
+     */
+    deleteSecret(key: string): boolean;
+    /**
+     * 清空所有密钥
+     */
+    clear(): void;
+}
+export declare class SecurityEventSystem {
+    private events;
+    /**
+     * 记录安全事件
+     */
+    record(event: Omit<SecurityEvent, "timestamp">): void;
+    /**
+     * 获取所有事件
+     */
+    getEvents(): SecurityEvent[];
+    /**
+     * 获取事件统计
+     */
+    stats(): {
+        total: number;
+        byType: Record<string, number>;
+        bySeverity: Record<string, number>;
+    };
+    /**
+     * 清空事件
+     */
+    clear(): void;
+}
+//# sourceMappingURL=SecurityHardening.d.ts.map

package/dist/security/SecurityHardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHardening.d.ts","sourceRoot":"","sources":["../../src/security/SecurityHardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CAClD;AAGD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CAClD;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAQd;IAEF,OAAO,CAAC,WAAW,CAEjB;IAEF;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IAuCtD;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAU5B;;OAEG;IACH,OAAO,CAAC,cAAc;IAWtB;;OAEG;IACH,OAAO,CAAC,cAAc;CAcvB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAwB;;IAMxC;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIhC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG;IAM9B;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG;CAK/B;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAkC;IAEjD;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3C;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1C;;OAEG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK9C;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI/B;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIlC;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAuB;IAErC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,IAAI;IAOrD;;OAEG;IACH,SAAS,IAAI,aAAa,EAAE;IAI5B;;OAEG;IACH,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAgB9F;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/security/SecurityHardening.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Security Hardening & Secret Boundary Layer — v5.5
+ *
+ * Upgrade from Verifiable Execution System to Secure Verifiable Execution System
+ *
+ * Core Principle:
+ * Anything that can be traced must NOT leak secrets.
+ * Anything that contains secrets must NOT be traced.
+ *
+ * Secrets ∩ TraceArtifacts = ∅
+ * Secrets ∩ Logs = ∅
+ * Secrets ∩ ExportPackage = ∅
+ * Secrets ∩ Events = ∅
+ *
+ * Violation = SYSTEM FAILURE.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityEventSystem = exports.RuntimeSecretVault = exports.SecretRedactionEngine = exports.SecretDetectionEngine = void 0;
+class SecretDetectionEngine {
+    patterns = [
+        /sk-[a-zA-Z0-9]{48}/, // OpenAI API key
+        /ghp_[a-zA-Z0-9]{36}/, // GitHub token
+        /xoxb-[a-zA-Z0-9-]+/, // Slack token
+        /AKIA[A-Z0-9]{16}/, // AWS access key
+        /Bearer\s+[a-zA-Z0-9._-]+/, // Bearer token
+        /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+/, // JWT
+        /https?:\/\/[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+/, // URL with credentials
+    ];
+    envPatterns = [
+        /^[A-Z_]+=.+$/ // Environment variables
+    ];
+    /**
+     * 扫描文本中的密钥
+     */
+    scan(text, location) {
+        const detected = [];
+        // 检查 API keys
+        for (const pattern of this.patterns) {
+            const matches = text.match(pattern);
+            if (matches) {
+                for (const match of matches) {
+                    detected.push({
+                        type: this.classifySecret(match),
+                        value: match,
+                        location,
+                        severity: "CRITICAL"
+                    });
+                }
+            }
+        }
+        // 检查环境变量
+        for (const pattern of this.envPatterns) {
+            if (pattern.test(text)) {
+                detected.push({
+                    type: "ENV_VAR",
+                    value: text,
+                    location,
+                    severity: "HIGH"
+                });
+            }
+        }
+        const maxSeverity = this.getMaxSeverity(detected);
+        return {
+            hasSecrets: detected.length > 0,
+            detected,
+            severity: maxSeverity
+        };
+    }
+    /**
+     * 清理文本中的密钥
+     */
+    redact(text) {
+        let redacted = text;
+        for (const pattern of this.patterns) {
+            redacted = redacted.replace(pattern, "[REDACTED_SECRET]");
+        }
+        return redacted;
+    }
+    /**
+     * 分类密钥类型
+     */
+    classifySecret(value) {
+        if (value.startsWith("sk-"))
+            return "API_KEY";
+        if (value.startsWith("ghp_"))
+            return "TOKEN";
+        if (value.startsWith("xoxb-"))
+            return "TOKEN";
+        if (value.startsWith("AKIA"))
+            return "API_KEY";
+        if (value.startsWith("Bearer"))
+            return "TOKEN";
+        if (value.startsWith("eyJ"))
+            return "TOKEN";
+        if (value.includes("@"))
+            return "URL";
+        return "CREDENTIAL";
+    }
+    /**
+     * 获取最高严重性
+     */
+    getMaxSeverity(items) {
+        if (items.length === 0)
+            return "LOW";
+        const severityOrder = { "LOW": 0, "MEDIUM": 1, "HIGH": 2, "CRITICAL": 3 };
+        let max = "LOW";
+        for (const item of items) {
+            if (severityOrder[item.severity] > severityOrder[max]) {
+                max = item.severity;
+            }
+        }
+        return max;
+    }
+}
+exports.SecretDetectionEngine = SecretDetectionEngine;
+class SecretRedactionEngine {
+    detector;
+    constructor() {
+        this.detector = new SecretDetectionEngine();
+    }
+    /**
+     * 清理日志
+     */
+    sanitizeLog(log) {
+        return this.detector.redact(log);
+    }
+    /**
+     * 清理追踪
+     */
+    sanitizeTrace(trace) {
+        const traceStr = JSON.stringify(trace);
+        const redacted = this.detector.redact(traceStr);
+        return JSON.parse(redacted);
+    }
+    /**
+     * 清理导出包
+     */
+    sanitizeExport(data) {
+        const dataStr = JSON.stringify(data);
+        const redacted = this.detector.redact(dataStr);
+        return JSON.parse(redacted);
+    }
+}
+exports.SecretRedactionEngine = SecretRedactionEngine;
+class RuntimeSecretVault {
+    secrets = new Map();
+    /**
+     * 设置密钥
+     */
+    setSecret(key, value) {
+        this.secrets.set(key, value);
+    }
+    /**
+     * 获取密钥
+     */
+    getSecret(key) {
+        return this.secrets.get(key);
+    }
+    /**
+     * 解析密钥引用
+     */
+    resolveSecret(ref) {
+        // 从环境变量或vault中解析
+        return this.secrets.get(ref) || process.env[ref];
+    }
+    /**
+     * 检查是否有密钥
+     */
+    hasSecret(key) {
+        return this.secrets.has(key);
+    }
+    /**
+     * 删除密钥
+     */
+    deleteSecret(key) {
+        return this.secrets.delete(key);
+    }
+    /**
+     * 清空所有密钥
+     */
+    clear() {
+        this.secrets.clear();
+    }
+}
+exports.RuntimeSecretVault = RuntimeSecretVault;
+class SecurityEventSystem {
+    events = [];
+    /**
+     * 记录安全事件
+     */
+    record(event) {
+        this.events.push({
+            ...event,
+            timestamp: Date.now()
+        });
+    }
+    /**
+     * 获取所有事件
+     */
+    getEvents() {
+        return [...this.events];
+    }
+    /**
+     * 获取事件统计
+     */
+    stats() {
+        const byType = {};
+        const bySeverity = {};
+        for (const event of this.events) {
+            byType[event.type] = (byType[event.type] || 0) + 1;
+            bySeverity[event.severity] = (bySeverity[event.severity] || 0) + 1;
+        }
+        return {
+            total: this.events.length,
+            byType,
+            bySeverity
+        };
+    }
+    /**
+     * 清空事件
+     */
+    clear() {
+        this.events = [];
+    }
+}
+exports.SecurityEventSystem = SecurityEventSystem;
+//# sourceMappingURL=SecurityHardening.js.map

package/dist/security/SecurityHardening.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityHardening.js","sourceRoot":"","sources":["../../src/security/SecurityHardening.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA4BH,MAAa,qBAAqB;IACxB,QAAQ,GAAa;QAC3B,oBAAoB,EAAG,iBAAiB;QACxC,qBAAqB,EAAG,eAAe;QACvC,oBAAoB,EAAG,cAAc;QACrC,kBAAkB,EAAG,iBAAiB;QACtC,0BAA0B,EAAG,eAAe;QAC5C,sCAAsC,EAAG,MAAM;QAC/C,4CAA4C,EAAG,uBAAuB;KACvE,CAAC;IAEM,WAAW,GAAa;QAC9B,cAAc,CAAE,wBAAwB;KACzC,CAAC;IAEF;;OAEG;IACH,IAAI,CAAC,IAAY,EAAE,QAAgB;QACjC,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAElC,cAAc;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;wBAChC,KAAK,EAAE,KAAK;wBACZ,QAAQ;wBACR,QAAQ,EAAE,UAAU;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS;QACT,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI;oBACX,QAAQ;oBACR,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC/B,QAAQ;YACR,QAAQ,EAAE,WAAW;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,IAAI,QAAQ,GAAG,IAAI,CAAC;QAEpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC;QAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QAC9C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC;QAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAmB;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAErC,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,GAAG,GAAG,KAAqC,CAAC;QAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AArGD,sDAqGC;AAED,MAAa,qBAAqB;IACxB,QAAQ,CAAwB;IAExC;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAU;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAS;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF;AA/BD,sDA+BC;AAED,MAAa,kBAAkB;IACrB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjD;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,GAAW;QACvB,iBAAiB;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AA7CD,gDA6CC;AAED,MAAa,mBAAmB;IACtB,MAAM,GAAoB,EAAE,CAAC;IAErC;;OAEG;IACH,MAAM,CAAC,KAAuC;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAE9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACzB,MAAM;YACN,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACnB,CAAC;CACF;AA7CD,kDA6CC"}

package/dist/security/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Security System — v5.5
+ *
+ * Secure Verifiable Execution System
+ *
+ * Core Principle:
+ * Anything that can be traced must NOT leak secrets.
+ * Anything that contains secrets must NOT be traced.
+ *
+ * Verifiability without security is unsafe transparency.
+ * Security without verifiability is blind control.
+ */
+export { SecretItem, SecretScanResult, SecurityEvent, SecretDetectionEngine, SecretRedactionEngine, RuntimeSecretVault, SecurityEventSystem } from "./SecurityHardening";
+export { ExposureReport, IncidentStatus, IncidentRecord, P0IncidentResponseSystem } from "./P0IncidentResponse";
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,wBAAwB,EACzB,MAAM,sBAAsB,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Security System — v5.5
+ *
+ * Secure Verifiable Execution System
+ *
+ * Core Principle:
+ * Anything that can be traced must NOT leak secrets.
+ * Anything that contains secrets must NOT be traced.
+ *
+ * Verifiability without security is unsafe transparency.
+ * Security without verifiability is blind control.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.P0IncidentResponseSystem = exports.SecurityEventSystem = exports.RuntimeSecretVault = exports.SecretRedactionEngine = exports.SecretDetectionEngine = void 0;
+var SecurityHardening_1 = require("./SecurityHardening");
+Object.defineProperty(exports, "SecretDetectionEngine", { enumerable: true, get: function () { return SecurityHardening_1.SecretDetectionEngine; } });
+Object.defineProperty(exports, "SecretRedactionEngine", { enumerable: true, get: function () { return SecurityHardening_1.SecretRedactionEngine; } });
+Object.defineProperty(exports, "RuntimeSecretVault", { enumerable: true, get: function () { return SecurityHardening_1.RuntimeSecretVault; } });
+Object.defineProperty(exports, "SecurityEventSystem", { enumerable: true, get: function () { return SecurityHardening_1.SecurityEventSystem; } });
+var P0IncidentResponse_1 = require("./P0IncidentResponse");
+Object.defineProperty(exports, "P0IncidentResponseSystem", { enumerable: true, get: function () { return P0IncidentResponse_1.P0IncidentResponseSystem; } });
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,yDAQ6B;AAJ3B,0HAAA,qBAAqB,OAAA;AACrB,0HAAA,qBAAqB,OAAA;AACrB,uHAAA,kBAAkB,OAAA;AAClB,wHAAA,mBAAmB,OAAA;AAGrB,2DAK8B;AAD5B,8HAAA,wBAAwB,OAAA"}

package/dist/self-healing/ExecutionTrace.d.ts

@@ -0,0 +1,80 @@
+/**
+ * ExecutionTrace — Self-Healing Runtime Phase 2
+ *
+ * 每个 Node 记录：
+ * - nodeId
+ * - parent
+ * - children
+ * - status
+ * - startTime
+ * - endTime
+ * - duration
+ * - input
+ * - output
+ * - retryCount
+ * - failureType
+ * - error
+ * - provider
+ * - tool
+ *
+ * 支持 Execution Timeline
+ */
+import { FailureType } from "./FailureClassifier";
+export interface TraceNode {
+    nodeId: string;
+    parent?: string;
+    children: string[];
+    status: "pending" | "running" | "completed" | "failed" | "retrying";
+    startTime: number;
+    endTime?: number;
+    duration?: number;
+    input?: any;
+    output?: any;
+    retryCount: number;
+    failureType?: FailureType;
+    error?: string;
+    provider?: string;
+    tool?: string;
+}
+export declare class ExecutionTrace {
+    private nodes;
+    private executionId;
+    constructor(executionId: string);
+    /**
+     * 开始追踪节点
+     */
+    startNode(nodeId: string, input?: any, parent?: string): void;
+    /**
+     * 完成追踪节点
+     */
+    completeNode(nodeId: string, output?: any): void;
+    /**
+     * 失败追踪节点
+     */
+    failNode(nodeId: string, error: string, failureType?: FailureType): void;
+    /**
+     * 重试追踪节点
+     */
+    retryNode(nodeId: string): void;
+    /**
+     * 获取节点
+     */
+    getNode(nodeId: string): TraceNode | undefined;
+    /**
+     * 获取所有节点
+     */
+    getAllNodes(): TraceNode[];
+    /**
+     * 获取执行时间线
+     */
+    getTimeline(): TraceNode[];
+    /**
+     * 获取执行 ID
+     */
+    getExecutionId(): string;
+    /**
+     * 格式化时间线
+     */
+    formatTimeline(): string;
+}
+//# sourceMappingURL=ExecutionTrace.d.ts.map

package/dist/self-healing/ExecutionTrace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionTrace.d.ts","sourceRoot":"","sources":["../../src/self-healing/ExecutionTrace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,EAAE,MAAM;IAI/B;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAsB7D;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,IAAI;IAUhD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI;IAWxE;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ/B;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI9C;;OAEG;IACH,WAAW,IAAI,SAAS,EAAE;IAI1B;;OAEG;IACH,WAAW,IAAI,SAAS,EAAE;IAI1B;;OAEG;IACH,cAAc,IAAI,MAAM;IAIxB;;OAEG;IACH,cAAc,IAAI,MAAM;CAmBzB"}