@zxyycom/vibe-check 0.0.1 → 0.0.2

package/dist/esm/package-checks/secret-detection/finding-waiver-identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-waiver-identity.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/finding-waiver-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAG9E,MAAM,mBAAmB,GAAG,wCAAiD,CAAC;AAC9E,MAAM,8BAA8B,GAAG,eAAwB,CAAC;AAEhE,8DAA8D;AAC9D,MAAM,UAAU,qCAAqC,CACnD,KAAc;IAEd,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAChD,SAAS;QACT,MAAM;QACN,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAC;IACH,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxC,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/C,QAAQ,CAAC,MAAM,KAAK,mBAAmB;QACvC,QAAQ,CAAC,eAAe,KAAK,8BAA8B,EAC3D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,mBAAmB;QAC3B,eAAe,EAAE,8BAA8B;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AACnE,MAAM,CAAC,MAAM,0CAA0C,GAAG,8BAA8B,CAAC","sourcesContent":["import { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { isNormalizedProjectRelativePath } from \"../host-environment/path.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\n\nconst PRIVATE_KEY_RULE_ID = \"@secretlint/secretlint-rule-privatekey\" as const;\nconst TEXT_DOCUMENT_STRUCTURAL_CLASS = \"text-document\" as const;\n\n/** 解析只含安全路径、规则、结构标记和 occurrence ordinal 的 waiver identity。 */\nexport function resolveSecretDetectionFindingIdentity(\n  value: unknown\n): SecretDetectionFindingIdentity | undefined {\n  const identity = snapshotExactClosedRecord(value, [\n    \"ordinal\",\n    \"path\",\n    \"ruleId\",\n    \"structuralClass\"\n  ]);\n  if (\n    identity === undefined ||\n    !isPositiveSafeInteger(identity.ordinal) ||\n    !isNormalizedProjectRelativePath(identity.path) ||\n    identity.ruleId !== PRIVATE_KEY_RULE_ID ||\n    identity.structuralClass !== TEXT_DOCUMENT_STRUCTURAL_CLASS\n  ) {\n    return undefined;\n  }\n  return Object.freeze({\n    ordinal: identity.ordinal,\n    path: identity.path,\n    ruleId: PRIVATE_KEY_RULE_ID,\n    structuralClass: TEXT_DOCUMENT_STRUCTURAL_CLASS\n  });\n}\n\nexport const secretDetectionPrivateKeyRuleId = PRIVATE_KEY_RULE_ID;\nexport const secretDetectionTextDocumentStructuralClass = TEXT_DOCUMENT_STRUCTURAL_CLASS;\n"]}

package/dist/esm/package-checks/secret-detection/input-preparation.mjs

@@ -0,0 +1,153 @@
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import { resolve } from "node:path";
+import { classifySecretDetectionBytes } from "./classification.mjs";
+/** Reads and classifies the already-selected paths before the detector can receive text. */
+export function prepareSecretDetectionInputs(context, selectedPaths) {
+    const coverageGaps = [];
+    const inputs = [];
+    let consumedBytes = 0;
+    for (const [index, path] of selectedPaths.entries()) {
+        if (context.signal.aborted)
+            return Object.freeze({ kind: "cancelled" });
+        const selectionLimit = selectionLimitGaps(context.options.maximumFileCount, selectedPaths, index);
+        if (selectionLimit !== undefined) {
+            coverageGaps.push(...selectionLimit);
+            break;
+        }
+        const prepared = prepareSelectedInput(context, path, consumedBytes);
+        if (prepared.kind === "cancelled" || prepared.kind === "unavailable")
+            return prepared;
+        if (prepared.kind === "coverage-gap") {
+            consumedBytes += prepared.consumedBytes;
+            coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));
+            if (prepared.stop) {
+                coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), "total-byte-limit"));
+                break;
+            }
+            continue;
+        }
+        consumedBytes += prepared.byteLength;
+        inputs.push(prepared.input);
+    }
+    return Object.freeze({
+        coverageGaps: Object.freeze(coverageGaps),
+        inputs: Object.freeze(inputs),
+        kind: "complete"
+    });
+}
+function selectionLimitGaps(maximumFileCount, selectedPaths, index) {
+    if (index < maximumFileCount)
+        return undefined;
+    return coverageGapsFor(selectedPaths.slice(index), "file-count-limit");
+}
+function prepareSelectedInput(context, path, consumedBytes) {
+    if (context.signal.aborted)
+        return Object.freeze({ kind: "cancelled" });
+    const read = readBoundedRegularFile({
+        consumedBytes,
+        filePath: resolve(context.project.root, path),
+        options: context.options
+    });
+    if (read.kind === "unavailable")
+        return read;
+    if (read.kind === "coverage-gap") {
+        return Object.freeze({
+            consumedBytes: 0,
+            kind: "coverage-gap",
+            reason: read.reason,
+            stop: read.reason === "total-byte-limit"
+        });
+    }
+    if (context.signal.aborted)
+        return Object.freeze({ kind: "cancelled" });
+    const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);
+    if (classification.kind === "coverage-gap") {
+        return Object.freeze({
+            consumedBytes: read.bytes.byteLength,
+            kind: "coverage-gap",
+            reason: classification.reason,
+            stop: false
+        });
+    }
+    return Object.freeze({
+        byteLength: read.bytes.byteLength,
+        input: Object.freeze({ content: classification.content, path }),
+        kind: "approved"
+    });
+}
+function readBoundedRegularFile(input) {
+    const descriptor = openRegularFileWithoutFollowingSymlink(input.filePath);
+    if (descriptor === undefined)
+        return Object.freeze({ kind: "unavailable" });
+    try {
+        const byteLength = regularFileByteLength(descriptor);
+        if (byteLength === undefined)
+            return Object.freeze({ kind: "unavailable" });
+        const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);
+        if (limit !== undefined)
+            return Object.freeze({ kind: "coverage-gap", reason: limit });
+        const bytes = readExactBoundedBytes(descriptor, byteLength);
+        if (bytes === undefined || regularFileByteLength(descriptor) !== byteLength) {
+            return Object.freeze({ kind: "unavailable" });
+        }
+        return Object.freeze({ bytes, kind: "complete" });
+    }
+    catch {
+        return Object.freeze({ kind: "unavailable" });
+    }
+    finally {
+        closeDescriptor(descriptor);
+    }
+}
+function closeDescriptor(descriptor) {
+    try {
+        closeSync(descriptor);
+    }
+    catch {
+        // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.
+    }
+}
+function openRegularFileWithoutFollowingSymlink(filePath) {
+    if (!supportsNoFollowDescriptorOpen())
+        return undefined;
+    try {
+        return openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch {
+        return undefined;
+    }
+}
+function supportsNoFollowDescriptorOpen() {
+    return process.platform !== "win32" && constants.O_NOFOLLOW !== 0;
+}
+function regularFileByteLength(descriptor) {
+    try {
+        const details = fstatSync(descriptor);
+        return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0
+            ? details.size
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readExactBoundedBytes(descriptor, byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+        const read = readSync(descriptor, bytes, offset, Math.min(65_536, bytes.byteLength - offset), null);
+        if (read <= 0)
+            return undefined;
+        offset += read;
+    }
+    return bytes;
+}
+function resourceLimitReason(options, byteLength, consumedBytes) {
+    if (byteLength > options.maximumFileBytes)
+        return "file-byte-limit";
+    return consumedBytes + byteLength > options.maximumTotalBytes ? "total-byte-limit" : undefined;
+}
+function coverageGapsFor(paths, reason) {
+    return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));
+}
+//# sourceMappingURL=input-preparation.mjs.map

package/dist/esm/package-checks/secret-detection/input-preparation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-preparation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/input-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,4BAA4B,EAE7B,MAAM,qBAAqB,CAAC;AAyB7B,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAC1C,OAA8D,EAC9D,aAAgC;IAEhC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAChC,aAAa,EACb,KAAK,CACN,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACtF,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC1F,MAAM;YACR,CAAC;YACD,SAAS;QACX,CAAC;QACD,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AA0BD,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,aAAgC,EAChC,KAAa;IAEb,IAAI,KAAK,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8D,EAC9D,IAAY,EACZ,aAAqB;IAErB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,kBAAkB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAExE,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClG,IAAI,cAAc,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACpC,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,UAAU,GAAG,sCAAsC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAAC,QAAgB;IAC9D,IAAI,CAAC,8BAA8B,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B;IACrC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;YAChF,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CACnB,UAAU,EACV,KAAK,EACL,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,EAC3C,IAAI,CACL,CAAC;QACF,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAuC,EACvC,UAAkB,EAClB,aAAqB;IAErB,IAAI,UAAU,GAAG,OAAO,CAAC,gBAAgB;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAwB,EACxB,MAAwC;IAExC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import { closeSync, constants, fstatSync, openSync, readSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nimport type { CheckExecutionContext } from \"../../check/check.ts\";\nimport {\n  classifySecretDetectionBytes,\n  type SecretDetectionCoverageGapReason\n} from \"./classification.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Private, already-classified text passed to this Check's private detector adapter. */\nexport interface ApprovedTextInput {\n  readonly content: string;\n  readonly path: string;\n}\n\n/** A safe explanation for an exact selected input that did not receive detector coverage. */\nexport interface SecretCoverageGap {\n  readonly path: string;\n  readonly reason: SecretDetectionCoverageGapReason;\n}\n\nexport type PreparedSecretDetectionInputs = Readonly<\n  | { readonly kind: \"cancelled\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly coverageGaps: readonly SecretCoverageGap[];\n      readonly inputs: readonly ApprovedTextInput[];\n      readonly kind: \"complete\";\n    }\n>;\n\n/** Reads and classifies the already-selected paths before the detector can receive text. */\nexport function prepareSecretDetectionInputs(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  selectedPaths: readonly string[]\n): PreparedSecretDetectionInputs {\n  const coverageGaps: SecretCoverageGap[] = [];\n  const inputs: ApprovedTextInput[] = [];\n  let consumedBytes = 0;\n\n  for (const [index, path] of selectedPaths.entries()) {\n    if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n    const selectionLimit = selectionLimitGaps(\n      context.options.maximumFileCount,\n      selectedPaths,\n      index\n    );\n    if (selectionLimit !== undefined) {\n      coverageGaps.push(...selectionLimit);\n      break;\n    }\n    const prepared = prepareSelectedInput(context, path, consumedBytes);\n    if (prepared.kind === \"cancelled\" || prepared.kind === \"unavailable\") return prepared;\n    if (prepared.kind === \"coverage-gap\") {\n      consumedBytes += prepared.consumedBytes;\n      coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));\n      if (prepared.stop) {\n        coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), \"total-byte-limit\"));\n        break;\n      }\n      continue;\n    }\n    consumedBytes += prepared.byteLength;\n    inputs.push(prepared.input);\n  }\n  return Object.freeze({\n    coverageGaps: Object.freeze(coverageGaps),\n    inputs: Object.freeze(inputs),\n    kind: \"complete\"\n  });\n}\n\ntype PreparedSelectedInput = Readonly<\n  | { readonly kind: \"cancelled\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly consumedBytes: number;\n      readonly kind: \"coverage-gap\";\n      readonly reason: SecretDetectionCoverageGapReason;\n      readonly stop: boolean;\n    }\n  | { readonly byteLength: number; readonly input: ApprovedTextInput; readonly kind: \"approved\" }\n>;\n\ntype BoundedRegularFileRead = Readonly<\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly kind: \"coverage-gap\";\n      readonly reason: Extract<\n        SecretDetectionCoverageGapReason,\n        \"file-byte-limit\" | \"total-byte-limit\"\n      >;\n    }\n  | { readonly bytes: Uint8Array; readonly kind: \"complete\" }\n>;\n\nfunction selectionLimitGaps(\n  maximumFileCount: number,\n  selectedPaths: readonly string[],\n  index: number\n): readonly SecretCoverageGap[] | undefined {\n  if (index < maximumFileCount) return undefined;\n  return coverageGapsFor(selectedPaths.slice(index), \"file-count-limit\");\n}\n\nfunction prepareSelectedInput(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  path: string,\n  consumedBytes: number\n): PreparedSelectedInput {\n  if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n  const read = readBoundedRegularFile({\n    consumedBytes,\n    filePath: resolve(context.project.root, path),\n    options: context.options\n  });\n  if (read.kind === \"unavailable\") return read;\n  if (read.kind === \"coverage-gap\") {\n    return Object.freeze({\n      consumedBytes: 0,\n      kind: \"coverage-gap\",\n      reason: read.reason,\n      stop: read.reason === \"total-byte-limit\"\n    });\n  }\n  if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n\n  const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);\n  if (classification.kind === \"coverage-gap\") {\n    return Object.freeze({\n      consumedBytes: read.bytes.byteLength,\n      kind: \"coverage-gap\",\n      reason: classification.reason,\n      stop: false\n    });\n  }\n  return Object.freeze({\n    byteLength: read.bytes.byteLength,\n    input: Object.freeze({ content: classification.content, path }),\n    kind: \"approved\"\n  });\n}\n\nfunction readBoundedRegularFile(input: {\n  readonly consumedBytes: number;\n  readonly filePath: string;\n  readonly options: ResolvedSecretDetectionOptions;\n}): BoundedRegularFileRead {\n  const descriptor = openRegularFileWithoutFollowingSymlink(input.filePath);\n  if (descriptor === undefined) return Object.freeze({ kind: \"unavailable\" });\n  try {\n    const byteLength = regularFileByteLength(descriptor);\n    if (byteLength === undefined) return Object.freeze({ kind: \"unavailable\" });\n    const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);\n    if (limit !== undefined) return Object.freeze({ kind: \"coverage-gap\", reason: limit });\n\n    const bytes = readExactBoundedBytes(descriptor, byteLength);\n    if (bytes === undefined || regularFileByteLength(descriptor) !== byteLength) {\n      return Object.freeze({ kind: \"unavailable\" });\n    }\n    return Object.freeze({ bytes, kind: \"complete\" });\n  } catch {\n    return Object.freeze({ kind: \"unavailable\" });\n  } finally {\n    closeDescriptor(descriptor);\n  }\n}\n\nfunction closeDescriptor(descriptor: number): void {\n  try {\n    closeSync(descriptor);\n  } catch {\n    // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.\n  }\n}\n\nfunction openRegularFileWithoutFollowingSymlink(filePath: string): number | undefined {\n  if (!supportsNoFollowDescriptorOpen()) return undefined;\n  try {\n    return openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction supportsNoFollowDescriptorOpen(): boolean {\n  return process.platform !== \"win32\" && constants.O_NOFOLLOW !== 0;\n}\n\nfunction regularFileByteLength(descriptor: number): number | undefined {\n  try {\n    const details = fstatSync(descriptor);\n    return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0\n      ? details.size\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readExactBoundedBytes(descriptor: number, byteLength: number): Uint8Array | undefined {\n  const bytes = new Uint8Array(byteLength);\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const read = readSync(\n      descriptor,\n      bytes,\n      offset,\n      Math.min(65_536, bytes.byteLength - offset),\n      null\n    );\n    if (read <= 0) return undefined;\n    offset += read;\n  }\n  return bytes;\n}\n\nfunction resourceLimitReason(\n  options: ResolvedSecretDetectionOptions,\n  byteLength: number,\n  consumedBytes: number\n): Extract<SecretDetectionCoverageGapReason, \"file-byte-limit\" | \"total-byte-limit\"> | undefined {\n  if (byteLength > options.maximumFileBytes) return \"file-byte-limit\";\n  return consumedBytes + byteLength > options.maximumTotalBytes ? \"total-byte-limit\" : undefined;\n}\n\nfunction coverageGapsFor(\n  paths: readonly string[],\n  reason: SecretDetectionCoverageGapReason\n): readonly SecretCoverageGap[] {\n  return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));\n}\n"]}

package/dist/esm/package-checks/secret-detection/options-resolution.mjs

@@ -0,0 +1,40 @@
+import { snapshotClosedPolicyRecord } from "../../data-boundary/closed-values.mjs";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.mjs";
+import { resolveFindingWaiverAuthoring } from "../code-quality-findings/finding-waiver-authoring.mjs";
+import { snapshotProjectFileSelection, validProjectFileSelection } from "../project-files/configuration.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+import { validSecretDetectionOptions } from "./options-validation.mjs";
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES = 1_048_576;
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES = 8_388_608;
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT = 2_048;
+/** 将 required exact file policy 和有限资源策略物化为完整、冻结 options。 */
+export function resolveSecretDetectionOptions(value) {
+    const input = snapshotClosedPolicyRecord(value, {
+        optional: ["findingWaivers", "maximumFileBytes", "maximumFileCount", "maximumTotalBytes"],
+        required: ["files"]
+    });
+    if (input === undefined || !validProjectFileSelection(input.files))
+        return undefined;
+    const limits = resolveSecretDetectionResourceLimits(input);
+    const findingWaivers = resolveFindingWaiverAuthoring(input.findingWaivers, resolveSecretDetectionFindingIdentity);
+    if (limits === undefined || findingWaivers === undefined)
+        return undefined;
+    const options = Object.freeze({
+        files: snapshotProjectFileSelection(input.files),
+        findingWaivers,
+        ...limits
+    });
+    return validSecretDetectionOptions(options) ? options : undefined;
+}
+function resolveSecretDetectionResourceLimits(input) {
+    const maximumFileBytes = input.maximumFileBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES;
+    const maximumFileCount = input.maximumFileCount ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT;
+    const maximumTotalBytes = input.maximumTotalBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES;
+    if (!isPositiveSafeInteger(maximumFileBytes) ||
+        !isPositiveSafeInteger(maximumFileCount) ||
+        !isPositiveSafeInteger(maximumTotalBytes)) {
+        return undefined;
+    }
+    return Object.freeze({ maximumFileBytes, maximumFileCount, maximumTotalBytes });
+}
+//# sourceMappingURL=options-resolution.mjs.map

package/dist/esm/package-checks/secret-detection/options-resolution.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-resolution.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AACrG,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAErF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,2CAA2C,GAAG,SAAS,CAAC;AACrE,MAAM,CAAC,MAAM,4CAA4C,GAAG,SAAS,CAAC;AACtE,MAAM,CAAC,MAAM,2CAA2C,GAAG,KAAK,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE;QAC9C,QAAQ,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;QACzF,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAErF,MAAM,MAAM,GAAG,oCAAoC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,qCAAqC,CACtC,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC;QAChD,cAAc;QACd,GAAG,MAAM;KACV,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,oCAAoC,CAC3C,KAIE;IAQF,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,2CAA2C,CAAC;IAC/F,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,2CAA2C,CAAC;IAC/F,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,4CAA4C,CAAC;IAClG,IACE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;QACxC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;QACxC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { snapshotClosedPolicyRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { resolveFindingWaiverAuthoring } from \"../code-quality-findings/finding-waiver-authoring.ts\";\nimport {\n  snapshotProjectFileSelection,\n  validProjectFileSelection\n} from \"../project-files/configuration.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES = 1_048_576;\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES = 8_388_608;\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT = 2_048;\n\n/** 将 required exact file policy 和有限资源策略物化为完整、冻结 options。 */\nexport function resolveSecretDetectionOptions(\n  value: unknown\n): ResolvedSecretDetectionOptions | undefined {\n  const input = snapshotClosedPolicyRecord(value, {\n    optional: [\"findingWaivers\", \"maximumFileBytes\", \"maximumFileCount\", \"maximumTotalBytes\"],\n    required: [\"files\"]\n  });\n  if (input === undefined || !validProjectFileSelection(input.files)) return undefined;\n\n  const limits = resolveSecretDetectionResourceLimits(input);\n  const findingWaivers = resolveFindingWaiverAuthoring(\n    input.findingWaivers,\n    resolveSecretDetectionFindingIdentity\n  );\n  if (limits === undefined || findingWaivers === undefined) return undefined;\n\n  const options = Object.freeze({\n    files: snapshotProjectFileSelection(input.files),\n    findingWaivers,\n    ...limits\n  });\n  return validSecretDetectionOptions(options) ? options : undefined;\n}\n\nfunction resolveSecretDetectionResourceLimits(\n  input: Readonly<{\n    readonly maximumFileBytes?: unknown;\n    readonly maximumFileCount?: unknown;\n    readonly maximumTotalBytes?: unknown;\n  }>\n):\n  | Readonly<{\n      readonly maximumFileBytes: number;\n      readonly maximumFileCount: number;\n      readonly maximumTotalBytes: number;\n    }>\n  | undefined {\n  const maximumFileBytes = input.maximumFileBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES;\n  const maximumFileCount = input.maximumFileCount ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT;\n  const maximumTotalBytes = input.maximumTotalBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES;\n  if (\n    !isPositiveSafeInteger(maximumFileBytes) ||\n    !isPositiveSafeInteger(maximumFileCount) ||\n    !isPositiveSafeInteger(maximumTotalBytes)\n  ) {\n    return undefined;\n  }\n  return Object.freeze({ maximumFileBytes, maximumFileCount, maximumTotalBytes });\n}\n"]}

package/dist/esm/package-checks/secret-detection/options-validation.mjs

@@ -0,0 +1,22 @@
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.mjs";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.mjs";
+import { validResolvedFindingWaivers } from "../code-quality-findings/finding-waiver-authoring.mjs";
+import { validProjectFileSelection } from "../project-files/configuration.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+/** Guards prepared options before a Run invokes a detector. */
+export function validSecretDetectionOptions(value) {
+    const options = snapshotExactClosedRecord(value, [
+        "files",
+        "findingWaivers",
+        "maximumFileBytes",
+        "maximumFileCount",
+        "maximumTotalBytes"
+    ]);
+    return (options !== undefined &&
+        validProjectFileSelection(options.files) &&
+        validResolvedFindingWaivers(options.findingWaivers, resolveSecretDetectionFindingIdentity) &&
+        isPositiveSafeInteger(options.maximumFileBytes) &&
+        isPositiveSafeInteger(options.maximumFileCount) &&
+        isPositiveSafeInteger(options.maximumTotalBytes));
+}
+//# sourceMappingURL=options-validation.mjs.map

package/dist/esm/package-checks/secret-detection/options-validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-validation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAGrF,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAC/C,OAAO;QACP,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC,CAAC;IACH,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,2BAA2B,CAAC,OAAO,CAAC,cAAc,EAAE,qCAAqC,CAAC;QAC1F,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CACjD,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { validResolvedFindingWaivers } from \"../code-quality-findings/finding-waiver-authoring.ts\";\nimport { validProjectFileSelection } from \"../project-files/configuration.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Guards prepared options before a Run invokes a detector. */\nexport function validSecretDetectionOptions(\n  value: unknown\n): value is ResolvedSecretDetectionOptions {\n  const options = snapshotExactClosedRecord(value, [\n    \"files\",\n    \"findingWaivers\",\n    \"maximumFileBytes\",\n    \"maximumFileCount\",\n    \"maximumTotalBytes\"\n  ]);\n  return (\n    options !== undefined &&\n    validProjectFileSelection(options.files) &&\n    validResolvedFindingWaivers(options.findingWaivers, resolveSecretDetectionFindingIdentity) &&\n    isPositiveSafeInteger(options.maximumFileBytes) &&\n    isPositiveSafeInteger(options.maximumFileCount) &&\n    isPositiveSafeInteger(options.maximumTotalBytes)\n  );\n}\n"]}

package/dist/esm/package-checks/secret-detection/options.mjs

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=options.mjs.map

package/dist/esm/package-checks/secret-detection/options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options.ts"],"names":[],"mappings":"","sourcesContent":["import type { FindingWaiver } from \"../../finding-waivers/reconciliation.ts\";\nimport type { ProjectFileSelection } from \"../project-files/configuration.ts\";\n\n/** `secretDetection(options)` 的明确 authoring policy。 */\nexport interface SecretDetectionOptions {\n  /** 必填的完整 project-file policy；只有它选中的 path 可以被读取或传给 detector。 */\n  readonly files: ProjectFileSelection;\n  /** 单个输入允许的最大 raw byte 数；超过时形成不可豁免的 coverage gap。 */\n  readonly maximumFileBytes?: number;\n  /** 一次 invocation 中允许读取和检测的累计 raw byte 数；超过时形成 coverage gap。 */\n  readonly maximumTotalBytes?: number;\n  /** 一次 invocation 中允许处理的 selected file 数；超过时形成 coverage gap。 */\n  readonly maximumFileCount?: number;\n  /** 对安全 finding identity 的精确、可审计误报豁免。 */\n  readonly findingWaivers?: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n}\n\n/** 不含 raw value、message、hash 或 location 的 secret finding 身份。 */\nexport interface SecretDetectionFindingIdentity {\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n}\n\n/** `secretDetection` execution 消费的完整冻结 options。 */\nexport interface ResolvedSecretDetectionOptions {\n  readonly files: ProjectFileSelection;\n  readonly findingWaivers: readonly FindingWaiver<SecretDetectionFindingIdentity>[];\n  readonly maximumFileBytes: number;\n  readonly maximumFileCount: number;\n  readonly maximumTotalBytes: number;\n}\n\n/** `findingWaivers` 的 public authoring alias。 */\nexport type SecretDetectionFindingWaiver = FindingWaiver<SecretDetectionFindingIdentity>;\n"]}

package/dist/esm/package-checks/secret-detection/records.mjs

@@ -0,0 +1,31 @@
+import { buildFindingWaiverAuditRecordData } from "../code-quality-findings/finding-waiver-evidence.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+export function secretFindingIdentity(issue) {
+    return Object.freeze({
+        ordinal: issue.ordinal,
+        path: issue.path,
+        ruleId: issue.ruleId,
+        structuralClass: issue.structuralClass
+    });
+}
+export function secretFindingRecordId(identity) {
+    return `/secret-finding/${identity.path}/${identity.ordinal}`;
+}
+export function secretCoverageGapRecordId(path) {
+    return `/coverage-gap/${path}`;
+}
+export function secretDetectionWaiverAuditRecord(audit) {
+    const identity = secretDetectionWaiverIdentity(audit.waiver);
+    return Object.freeze({
+        data: buildFindingWaiverAuditRecordData(identity, audit),
+        id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`
+    });
+}
+function secretDetectionWaiverIdentity(waiver) {
+    const identity = resolveSecretDetectionFindingIdentity(waiver.identity);
+    if (identity === undefined) {
+        throw new TypeError("secretDetection waiver identity must be a safe finding identity");
+    }
+    return identity;
+}
+//# sourceMappingURL=records.mjs.map

package/dist/esm/package-checks/secret-detection/records.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/records.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAIxG,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAgCrF,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAwC;IAC5E,OAAO,mBAAmB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAA+B;IAE/B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,iCAAiC,CAAC,QAAQ,EAAE,KAAK,CAAC;QACxD,EAAE,EAAE,yBAAyB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC;IAEjC,MAAM,QAAQ,GAAG,qCAAqC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { MaterializedFindingWaiver } from \"../../finding-waivers/reconciliation.ts\";\nimport type {\n  FindingWaiverRecordAudit,\n  FindingWaiverAuditRecordData\n} from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { buildFindingWaiverAuditRecordData } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport type { SecretDetectionCoverageGapReason } from \"./classification.ts\";\nimport type { SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\n\n/** An actionable or waived high-confidence secret finding. No detector value or message is retained. */\nexport interface SecretDetectionFindingRecordData {\n  readonly blocking: boolean;\n  readonly kind: \"secret-finding\";\n  readonly location: SecretDetectionIssue[\"location\"];\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n  readonly waiver?: Readonly<{ readonly reason: string }>;\n}\n\n/** A deterministic exact-input coverage gap. It is never reconciled through finding waiver policy. */\nexport interface SecretDetectionCoverageGapRecordData {\n  readonly blocking: true;\n  readonly kind: \"coverage-gap\";\n  readonly path: string;\n  readonly reason: SecretDetectionCoverageGapReason;\n}\n\n/** Unused or overmatched safe secret finding waiver evidence. */\nexport type SecretDetectionFindingWaiverAuditRecordData =\n  FindingWaiverAuditRecordData<SecretDetectionFindingIdentity>;\n\n/** `secretDetection` 发布的全部补充 Record data。 */\nexport type SecretDetectionRecordData =\n  | SecretDetectionCoverageGapRecordData\n  | SecretDetectionFindingRecordData\n  | SecretDetectionFindingWaiverAuditRecordData;\n\nexport function secretFindingIdentity(issue: SecretDetectionIssue): SecretDetectionFindingIdentity {\n  return Object.freeze({\n    ordinal: issue.ordinal,\n    path: issue.path,\n    ruleId: issue.ruleId,\n    structuralClass: issue.structuralClass\n  });\n}\n\nexport function secretFindingRecordId(identity: SecretDetectionFindingIdentity): string {\n  return `/secret-finding/${identity.path}/${identity.ordinal}`;\n}\n\nexport function secretCoverageGapRecordId(path: string): string {\n  return `/coverage-gap/${path}`;\n}\n\nexport function secretDetectionWaiverAuditRecord(\n  audit: FindingWaiverRecordAudit\n): Readonly<{ readonly data: SecretDetectionFindingWaiverAuditRecordData; readonly id: string }> {\n  const identity = secretDetectionWaiverIdentity(audit.waiver);\n  return Object.freeze({\n    data: buildFindingWaiverAuditRecordData(identity, audit),\n    id: `/finding-waiver-audit/${identity.path}/${identity.ordinal}`\n  });\n}\n\nfunction secretDetectionWaiverIdentity(\n  waiver: MaterializedFindingWaiver\n): SecretDetectionFindingIdentity {\n  const identity = resolveSecretDetectionFindingIdentity(waiver.identity);\n  if (identity === undefined) {\n    throw new TypeError(\"secretDetection waiver identity must be a safe finding identity\");\n  }\n  return identity;\n}\n"]}

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs

@@ -0,0 +1,85 @@
+import { snapshotClosedRecord } from "../../../data-boundary/closed-values.mjs";
+import { lintSource } from "@secretlint/core";
+import { creator as privateKeyRule } from "@secretlint/secretlint-rule-privatekey";
+import { secretDetectionPrivateKeyRuleId, secretDetectionTextDocumentStructuralClass } from "../finding-waiver-identity.mjs";
+/**
+ * Runs the fixed local Secretlint rule set against already-approved in-memory text.
+ * Third-party result, message text, data, error, and source content never leave this module.
+ */
+export async function detectSecretlintIssues(content, projectRelativePath) {
+    try {
+        const result = await lintSource({
+            source: { content, contentType: "text", filePath: projectRelativePath },
+            options: {
+                config: {
+                    rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: "error" }]
+                },
+                maskSecrets: true,
+                noPhysicFilePath: true
+            }
+        });
+        return adaptSecretlintMessages(result.messages, projectRelativePath);
+    }
+    catch {
+        return Object.freeze({ kind: "unavailable" });
+    }
+}
+/** Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */
+export function adaptSecretlintMessages(messages, projectRelativePath) {
+    if (!Array.isArray(messages))
+        return Object.freeze({ kind: "protocol-failed" });
+    const issues = [];
+    for (const message of messages) {
+        const location = safeLocation(message);
+        if (location === undefined || !isPrivateKeyMessage(message)) {
+            return Object.freeze({ kind: "protocol-failed" });
+        }
+        issues.push(Object.freeze({
+            location,
+            ordinal: issues.length + 1,
+            path: projectRelativePath,
+            ruleId: secretDetectionPrivateKeyRuleId,
+            structuralClass: secretDetectionTextDocumentStructuralClass
+        }));
+    }
+    return Object.freeze({ issues: Object.freeze(issues), kind: "complete" });
+}
+function isPrivateKeyMessage(value) {
+    const message = snapshotClosedRecord(value);
+    return (message !== undefined &&
+        message.type === "message" &&
+        message.ruleId === secretDetectionPrivateKeyRuleId &&
+        message.severity === "error");
+}
+function safeLocation(value) {
+    const message = snapshotClosedRecord(value);
+    if (message === undefined)
+        return undefined;
+    const loc = snapshotClosedRecord(message.loc);
+    if (loc === undefined)
+        return undefined;
+    const start = loc.start;
+    const end = loc.end;
+    if (!isPosition(start) || !isPosition(end))
+        return undefined;
+    if (end.line < start.line || (end.line === start.line && end.column < start.column)) {
+        return undefined;
+    }
+    return Object.freeze({
+        endColumn: end.column + 1,
+        endLine: end.line,
+        startColumn: start.column + 1,
+        startLine: start.line
+    });
+}
+function isPosition(value) {
+    const position = snapshotClosedRecord(value);
+    return (position !== undefined &&
+        typeof position.column === "number" &&
+        Number.isSafeInteger(position.column) &&
+        position.column >= 0 &&
+        typeof position.line === "number" &&
+        Number.isSafeInteger(position.line) &&
+        position.line >= 1);
+}
+//# sourceMappingURL=adapter.mjs.map

package/dist/esm/package-checks/secret-detection/secretlint/adapter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.mjs","sourceRoot":"","sources":["../../../../../src/package-checks/secret-detection/secretlint/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EACL,+BAA+B,EAC/B,0CAA0C,EAC3C,MAAM,+BAA+B,CAAC;AAsBvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,mBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;YACvE,OAAO,EAAE;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;iBAC1F;gBACD,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,mBAA2B;IAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YAC1B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,0CAA0C;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,OAAO,CAAC,MAAM,KAAK,+BAA+B;QAClD,OAAO,CAAC,QAAQ,KAAK,OAAO,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,IAAI;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;QACnC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACjC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,IAAI,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { snapshotClosedRecord } from \"../../../data-boundary/closed-values.ts\";\nimport { lintSource } from \"@secretlint/core\";\nimport { creator as privateKeyRule } from \"@secretlint/secretlint-rule-privatekey\";\n\nimport {\n  secretDetectionPrivateKeyRuleId,\n  secretDetectionTextDocumentStructuralClass\n} from \"../finding-waiver-identity.ts\";\n\n/** The only detector result shape allowed to leave this private adapter. */\nexport interface SecretDetectionIssue {\n  readonly location: Readonly<{\n    readonly endColumn: number;\n    readonly endLine: number;\n    readonly startColumn: number;\n    readonly startLine: number;\n  }>;\n  readonly ordinal: number;\n  readonly path: string;\n  readonly ruleId: \"@secretlint/secretlint-rule-privatekey\";\n  readonly structuralClass: \"text-document\";\n}\n\nexport type SecretlintDetectionResult = Readonly<\n  | { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n  | { readonly kind: \"protocol-failed\" }\n  | { readonly kind: \"unavailable\" }\n>;\n\n/**\n * Runs the fixed local Secretlint rule set against already-approved in-memory text.\n * Third-party result, message text, data, error, and source content never leave this module.\n */\nexport async function detectSecretlintIssues(\n  content: string,\n  projectRelativePath: string\n): Promise<SecretlintDetectionResult> {\n  try {\n    const result = await lintSource({\n      source: { content, contentType: \"text\", filePath: projectRelativePath },\n      options: {\n        config: {\n          rules: [{ id: secretDetectionPrivateKeyRuleId, rule: privateKeyRule, severity: \"error\" }]\n        },\n        maskSecrets: true,\n        noPhysicFilePath: true\n      }\n    });\n    return adaptSecretlintMessages(result.messages, projectRelativePath);\n  } catch {\n    return Object.freeze({ kind: \"unavailable\" });\n  }\n}\n\n/** Converts only allowlisted Secretlint message fields to the safe Check-local issue DTO. */\nexport function adaptSecretlintMessages(\n  messages: unknown,\n  projectRelativePath: string\n): SecretlintDetectionResult {\n  if (!Array.isArray(messages)) return Object.freeze({ kind: \"protocol-failed\" });\n\n  const issues: SecretDetectionIssue[] = [];\n  for (const message of messages) {\n    const location = safeLocation(message);\n    if (location === undefined || !isPrivateKeyMessage(message)) {\n      return Object.freeze({ kind: \"protocol-failed\" });\n    }\n    issues.push(\n      Object.freeze({\n        location,\n        ordinal: issues.length + 1,\n        path: projectRelativePath,\n        ruleId: secretDetectionPrivateKeyRuleId,\n        structuralClass: secretDetectionTextDocumentStructuralClass\n      })\n    );\n  }\n  return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nfunction isPrivateKeyMessage(value: unknown): boolean {\n  const message = snapshotClosedRecord(value);\n  return (\n    message !== undefined &&\n    message.type === \"message\" &&\n    message.ruleId === secretDetectionPrivateKeyRuleId &&\n    message.severity === \"error\"\n  );\n}\n\nfunction safeLocation(value: unknown): SecretDetectionIssue[\"location\"] | undefined {\n  const message = snapshotClosedRecord(value);\n  if (message === undefined) return undefined;\n  const loc = snapshotClosedRecord(message.loc);\n  if (loc === undefined) return undefined;\n  const start = loc.start;\n  const end = loc.end;\n  if (!isPosition(start) || !isPosition(end)) return undefined;\n  if (end.line < start.line || (end.line === start.line && end.column < start.column)) {\n    return undefined;\n  }\n  return Object.freeze({\n    endColumn: end.column + 1,\n    endLine: end.line,\n    startColumn: start.column + 1,\n    startLine: start.line\n  });\n}\n\nfunction isPosition(\n  value: unknown\n): value is Readonly<{ readonly column: number; readonly line: number }> {\n  const position = snapshotClosedRecord(value);\n  return (\n    position !== undefined &&\n    typeof position.column === \"number\" &&\n    Number.isSafeInteger(position.column) &&\n    position.column >= 0 &&\n    typeof position.line === \"number\" &&\n    Number.isSafeInteger(position.line) &&\n    position.line >= 1\n  );\n}\n"]}