@zxyycom/vibe-check 0.0.1 → 0.0.3

package/dist/esm/package-checks/secret-detection/default-check.mjs

@@ -0,0 +1,37 @@
+import { defineCheck } from "../../check/check.mjs";
+import { resolvePackageCheckAuthoringInput } from "../check-authoring.mjs";
+import { executeSecretDetection, SECRET_DETECTION_CHECK_DEFINITION } from "./execution.mjs";
+import { parseSecretDetectionData } from "./final-data.mjs";
+import { resolveSecretDetectionOptions } from "./options-resolution.mjs";
+import { validSecretDetectionOptions } from "./options-validation.mjs";
+export function secretDetection(options) {
+    const input = resolvePackageCheckAuthoringInput(options, ["files", "maximumFileBytes", "maximumTotalBytes", "maximumFileCount", "findingWaivers"], SECRET_DETECTION_CHECK_DEFINITION);
+    if (input === undefined) {
+        throw new TypeError("secretDetection options must declare the documented closed explicit file policy");
+    }
+    const resolvedOptions = resolveSecretDetectionOptions(input.domainOptions);
+    if (resolvedOptions === undefined) {
+        throw new TypeError("secretDetection options must declare the documented closed explicit file policy");
+    }
+    return defineCheck({
+        ...input.definition,
+        execute: executeSecretDetection,
+        parseData: parseSecretDetectionData,
+        prepare: (preparedOptions) => validSecretDetectionOptions(preparedOptions)
+            ? { status: "success", preparedOptions }
+            : {
+                status: "failure",
+                action: "block",
+                reason: { code: "invalid-options" },
+                messages: [
+                    {
+                        code: "invalid-options",
+                        level: "error",
+                        message: "secretDetection options are invalid; recreate the Check with secretDetection({ files }) or restore its complete resolved options."
+                    }
+                ]
+            },
+        options: resolvedOptions
+    });
+}
+//# sourceMappingURL=default-check.mjs.map

package/dist/esm/package-checks/secret-detection/default-check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-check.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/default-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAA8B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,iCAAiC,EAElC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAsBtE,MAAM,UAAU,eAAe,CAC7B,OAA+B;IAE/B,MAAM,KAAK,GAAG,iCAAiC,CAC7C,OAAO,EACP,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EACxF,iCAAiC,CAClC,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CACjB,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,UAAU;QACnB,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,wBAAwB;QACnC,OAAO,EAAE,CAAC,eAAe,EAAE,EAAE,CAC3B,2BAA2B,CAAC,eAAe,CAAC;YAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE;YACxC,CAAC,CAAC;gBACE,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;gBACnC,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,OAAO;wBACd,OAAO,EACL,mIAAmI;qBACtI;iBACF;aACF;QACP,OAAO,EAAE,eAAe;KACzB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineCheck, type TypedCheckWithOptions } from \"../../check/check.ts\";\nimport {\n  resolvePackageCheckAuthoringInput,\n  type PackageCheckIdentityInput\n} from \"../check-authoring.ts\";\nimport { executeSecretDetection, SECRET_DETECTION_CHECK_DEFINITION } from \"./execution.ts\";\nimport { parseSecretDetectionData } from \"./final-data.ts\";\nimport type { ResolvedSecretDetectionOptions, SecretDetectionOptions } from \"./options.ts\";\nimport { resolveSecretDetectionOptions } from \"./options-resolution.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\n/**\n * 构造只检查其必填、显式 `files` policy 所选择输入的 high-confidence secret Check。\n *\n * @param options - 必须声明完整 `files`；limits 和 finding waivers 使用本 Check 的固定安全策略。\n * @returns 固定 `secret-detection` identity、完整冻结 options、final-data parser 与 execution。\n * @throws {TypeError} files 缺失、策略不完整或输入含未知字段时抛出。\n */\nexport function secretDetection(\n  options: SecretDetectionOptions<\"secret-detection\">\n): TypedCheckWithOptions<\n  \"secret-detection\",\n  ResolvedSecretDetectionOptions,\n  typeof parseSecretDetectionData\n>;\nexport function secretDetection<const Id extends string>(\n  options: SecretDetectionOptions<Id> & PackageCheckIdentityInput<Id>\n): TypedCheckWithOptions<Id, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData>;\nexport function secretDetection(\n  options: SecretDetectionOptions\n): TypedCheckWithOptions<string, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData>;\nexport function secretDetection(\n  options: SecretDetectionOptions\n): TypedCheckWithOptions<string, ResolvedSecretDetectionOptions, typeof parseSecretDetectionData> {\n  const input = resolvePackageCheckAuthoringInput(\n    options,\n    [\"files\", \"maximumFileBytes\", \"maximumTotalBytes\", \"maximumFileCount\", \"findingWaivers\"],\n    SECRET_DETECTION_CHECK_DEFINITION\n  );\n  if (input === undefined) {\n    throw new TypeError(\n      \"secretDetection options must declare the documented closed explicit file policy\"\n    );\n  }\n  const resolvedOptions = resolveSecretDetectionOptions(input.domainOptions);\n  if (resolvedOptions === undefined) {\n    throw new TypeError(\n      \"secretDetection options must declare the documented closed explicit file policy\"\n    );\n  }\n  return defineCheck({\n    ...input.definition,\n    execute: executeSecretDetection,\n    parseData: parseSecretDetectionData,\n    prepare: (preparedOptions) =>\n      validSecretDetectionOptions(preparedOptions)\n        ? { status: \"success\", preparedOptions }\n        : {\n            status: \"failure\",\n            action: \"block\",\n            reason: { code: \"invalid-options\" },\n            messages: [\n              {\n                code: \"invalid-options\",\n                level: \"error\",\n                message:\n                  \"secretDetection options are invalid; recreate the Check with secretDetection({ files }) or restore its complete resolved options.\"\n              }\n            ]\n          },\n    options: resolvedOptions\n  });\n}\n"]}

package/dist/esm/package-checks/secret-detection/execution.mjs

@@ -0,0 +1,172 @@
+import { appendCheckMessages } from "../../package-tools/finding-presentation/finding-presentation.mjs";
+import { reconcileFindingWaivers } from "../../package-tools/finding-waivers/reconciliation.mjs";
+import { reportFindingWaiverAudits } from "../code-quality-findings/finding-waiver-evidence.mjs";
+import { collectProjectFiles } from "../project-files/collection.mjs";
+import { prepareSecretDetectionInputs } from "./input-preparation.mjs";
+import { secretCoverageGapRecordId, secretDetectionWaiverAuditRecord, secretFindingIdentity, secretFindingRecordId } from "./records.mjs";
+import { detectSecretlintIssues } from "./secretlint/adapter.mjs";
+import { validSecretDetectionOptions } from "./options-validation.mjs";
+export const SECRET_DETECTION_CHECK_DEFINITION = {
+    checkId: "secret-detection",
+    displayName: "Secret detection"
+};
+/** Executes the fixed in-process detector only for this Check's exact explicit input selection. */
+export async function executeSecretDetection(context) {
+    if (!validSecretDetectionOptions(context.options))
+        return unavailable("invalid-options");
+    if (context.signal.aborted)
+        return unavailable("execution-cancelled");
+    let selectedPaths;
+    try {
+        selectedPaths = collectProjectFiles(context.project.root, context.options.files);
+    }
+    catch {
+        return unavailable("scan-input-unavailable");
+    }
+    if (context.signal.aborted)
+        return unavailable("execution-cancelled");
+    if (selectedPaths.length === 0)
+        return settleSecretDetectionFindings(context, selectedPaths.length, [], []);
+    const prepared = prepareSecretDetectionInputs(context, selectedPaths);
+    if (prepared.kind === "unavailable")
+        return unavailable("source-unavailable");
+    if (prepared.kind === "cancelled")
+        return unavailable("execution-cancelled");
+    const detected = await detectApprovedInputs(context, prepared.inputs);
+    if (detected.kind === "unavailable")
+        return unavailable(detected.code);
+    return settleSecretDetectionFindings(context, selectedPaths.length, detected.issues, prepared.coverageGaps);
+}
+async function detectApprovedInputs(context, inputs) {
+    const issues = [];
+    for (const input of inputs) {
+        if (context.signal.aborted)
+            return Object.freeze({ code: "execution-cancelled", kind: "unavailable" });
+        const detected = await detectSecretlintIssues(input.content, input.path);
+        if (context.signal.aborted)
+            return Object.freeze({ code: "execution-cancelled", kind: "unavailable" });
+        if (detected.kind === "unavailable") {
+            return Object.freeze({ code: "detector-unavailable", kind: "unavailable" });
+        }
+        if (detected.kind === "protocol-failed") {
+            return Object.freeze({ code: "detector-protocol-failed", kind: "unavailable" });
+        }
+        issues.push(...detected.issues);
+    }
+    return Object.freeze({ issues: Object.freeze(issues), kind: "complete" });
+}
+export function settleSecretDetectionFindings(context, selectedFileCount, issues, coverageGaps) {
+    const reconciliation = reconcileFindingWaivers({
+        findings: issues,
+        identify: secretFindingIdentity,
+        waivers: context.options.findingWaivers
+    });
+    const waivedFindingCount = reconciliation.findings.filter((finding) => finding.disposition === "waived").length;
+    for (const finding of reconciliation.findings) {
+        const identity = secretFindingIdentity(finding.finding);
+        const data = Object.freeze({
+            blocking: finding.disposition !== "waived",
+            kind: "secret-finding",
+            location: finding.finding.location,
+            ordinal: identity.ordinal,
+            path: identity.path,
+            ruleId: identity.ruleId,
+            structuralClass: identity.structuralClass,
+            ...(finding.disposition === "waived"
+                ? { waiver: Object.freeze({ reason: finding.waiver.reason }) }
+                : {})
+        });
+        context.records.report({ id: secretFindingRecordId(identity) }, data);
+    }
+    for (const coverageGap of coverageGaps) {
+        const data = Object.freeze({
+            blocking: true,
+            kind: "coverage-gap",
+            path: coverageGap.path,
+            reason: coverageGap.reason
+        });
+        context.records.report({ id: secretCoverageGapRecordId(coverageGap.path) }, data);
+    }
+    reportFindingWaiverAudits(context, reconciliation, secretDetectionWaiverAuditRecord);
+    const data = Object.freeze({
+        coverageGapCount: coverageGaps.length,
+        findingCount: issues.length,
+        scannedFileCount: selectedFileCount - coverageGaps.length,
+        selectedFileCount,
+        waivedFindingCount
+    });
+    if (selectedFileCount === 0) {
+        return appendCheckMessages(Object.freeze({ status: "not-applicable", reason: { code: "no-eligible-input" } }), waiverMessages(reconciliation.waiverAudits));
+    }
+    const actionableFindingCount = issues.length - waivedFindingCount;
+    const result = Object.freeze({
+        data,
+        status: coverageGaps.length > 0 || actionableFindingCount > 0 ? "failed" : "passed"
+    });
+    return appendCheckMessages(appendCheckMessages(result, findingMessages(actionableFindingCount, coverageGaps.length)), waiverMessages(reconciliation.waiverAudits));
+}
+function findingMessages(actionableFindingCount, coverageGapCount) {
+    const messages = [];
+    if (actionableFindingCount > 0) {
+        messages.push(Object.freeze({
+            code: "secret-findings",
+            level: "error",
+            message: `${actionableFindingCount} high-confidence secret finding(s) require attention; inspect this Check's safe Records, remove the material, or author an exact finding waiver.`
+        }));
+    }
+    if (coverageGapCount > 0) {
+        messages.push(Object.freeze({
+            code: "incomplete-coverage",
+            level: "error",
+            message: `${coverageGapCount} selected input(s) could not receive bounded secret detection coverage; narrow files or increase this Check's explicit resource limits.`
+        }));
+    }
+    return Object.freeze(messages);
+}
+function waiverMessages(audits) {
+    const messages = [];
+    for (const audit of audits) {
+        if (audit.status === "applied") {
+            messages.push(Object.freeze({
+                code: "finding-waived",
+                level: "info",
+                message: `A secret finding was waived: ${audit.waiver.reason}`
+            }));
+            continue;
+        }
+        messages.push(Object.freeze({
+            code: audit.status === "unused" ? "unused-finding-waiver" : "overmatched-finding-waiver",
+            level: "warning",
+            message: audit.status === "unused"
+                ? `A configured secret finding waiver matched no finding; remove or update it. Reason: ${audit.waiver.reason}`
+                : `A configured secret finding waiver matched ${audit.matchCount} findings and was not applied; narrow it. Reason: ${audit.waiver.reason}`
+        }));
+    }
+    return Object.freeze(messages);
+}
+function unavailable(code) {
+    return Object.freeze({
+        messages: Object.freeze([
+            Object.freeze({ code, level: "error", message: unavailableMessage(code) })
+        ]),
+        reason: { code },
+        status: "unavailable"
+    });
+}
+function unavailableMessage(code) {
+    switch (code) {
+        case "invalid-options":
+            return "secretDetection options are invalid; recreate the Check with its documented explicit files policy.";
+        case "scan-input-unavailable":
+            return "Secret detection could not collect its configured project files; check the project root, permissions, and selected file source.";
+        case "source-unavailable":
+            return "A selected secret detection input could not be read safely; check that it still exists, is readable, and was not replaced during the Run.";
+        case "detector-unavailable":
+            return "The private secret detector did not complete; retry after restoring the package runtime without treating this Run as clean.";
+        case "detector-protocol-failed":
+            return "The private secret detector returned an unsupported result shape; update the package dependency only with a reviewed adapter change.";
+        case "execution-cancelled":
+            return "Secret detection was cancelled before it could form a complete result; inspect the caller's cancellation reason and retry if appropriate.";
+    }
+}
+//# sourceMappingURL=execution.mjs.map

package/dist/esm/package-checks/secret-detection/execution.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/execution.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,4BAA4B,EAG7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,qBAAqB,EACrB,qBAAqB,EAGtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAA6B,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,kBAAkB;CACvB,CAAC;AAWX,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA8D;IAE9D,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEtE,IAAI,aAAgC,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,6BAA6B,CAClC,OAAO,EACP,aAAa,CAAC,MAAM,EACpB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,YAAY,CACtB,CAAC;AACJ,CAAC;AAOD,KAAK,UAAU,oBAAoB,CACjC,OAA8D,EAC9D,MAAoC;IAEpC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA8D,EAC9D,iBAAyB,EACzB,MAAuC,EACvC,YAA0C;IAE1C,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CACvD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAC9C,CAAC,MAAM,CAAC;IACT,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,GAAqC,MAAM,CAAC,MAAM,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,QAAQ;YAC1C,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAyC,MAAM,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,yBAAyB,CAAC,OAAO,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,gBAAgB,EAAE,YAAY,CAAC,MAAM;QACrC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,gBAAgB,EAAE,iBAAiB,GAAG,YAAY,CAAC,MAAM;QACzD,iBAAiB;QACjB,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CACxB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAClF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC;IAClE,MAAM,MAAM,GAA0C,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI;QACJ,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACpF,CAAC,CAAC;IACH,OAAO,mBAAmB,CACxB,mBAAmB,CAAC,MAAM,EAAE,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,EACzF,cAAc,CAAC,cAAc,CAAC,YAAY,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,sBAA8B,EAC9B,gBAAwB;IAExB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,sBAAsB,kJAAkJ;SACrL,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,GAAG,gBAAgB,yIAAyI;SACtK,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CACrB,MAII;IAEJ,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,gCAAgC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;aAC/D,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B;YACxF,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACvB,CAAC,CAAC,uFAAuF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9G,CAAC,CAAC,8CAA8C,KAAK,CAAC,UAAU,qDAAqD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;SAC/I,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAClB,IAA0C;IAE1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SACpF,CAAC;QACF,MAAM,EAAE,EAAE,IAAI,EAAE;QAChB,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA0C;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,oGAAoG,CAAC;QAC9G,KAAK,wBAAwB;YAC3B,OAAO,iIAAiI,CAAC;QAC3I,KAAK,oBAAoB;YACvB,OAAO,2IAA2I,CAAC;QACrJ,KAAK,sBAAsB;YACzB,OAAO,6HAA6H,CAAC;QACvI,KAAK,0BAA0B;YAC7B,OAAO,sIAAsI,CAAC;QAChJ,KAAK,qBAAqB;YACxB,OAAO,2IAA2I,CAAC;IACvJ,CAAC;AACH,CAAC","sourcesContent":["import type { CheckExecutionContext, CheckMessage, CheckResult } from \"../../check/check.ts\";\nimport { appendCheckMessages } from \"../../package-tools/finding-presentation/finding-presentation.ts\";\nimport { reconcileFindingWaivers } from \"../../package-tools/finding-waivers/reconciliation.ts\";\nimport { reportFindingWaiverAudits } from \"../code-quality-findings/finding-waiver-evidence.ts\";\nimport { collectProjectFiles } from \"../project-files/collection.ts\";\nimport type { SecretDetectionFinalData } from \"./final-data.ts\";\nimport {\n  prepareSecretDetectionInputs,\n  type ApprovedTextInput,\n  type SecretCoverageGap\n} from \"./input-preparation.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\nimport {\n  secretCoverageGapRecordId,\n  secretDetectionWaiverAuditRecord,\n  secretFindingIdentity,\n  secretFindingRecordId,\n  type SecretDetectionCoverageGapRecordData,\n  type SecretDetectionFindingRecordData\n} from \"./records.ts\";\nimport { detectSecretlintIssues, type SecretDetectionIssue } from \"./secretlint/adapter.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\nexport const SECRET_DETECTION_CHECK_DEFINITION = {\n  checkId: \"secret-detection\",\n  displayName: \"Secret detection\"\n} as const;\n\n/** `secretDetection` 的 whole-Check unavailable reason；不携带 detector 或 file-system 原始详情。 */\nexport type SecretDetectionUnavailableReasonCode =\n  | \"detector-protocol-failed\"\n  | \"detector-unavailable\"\n  | \"execution-cancelled\"\n  | \"invalid-options\"\n  | \"scan-input-unavailable\"\n  | \"source-unavailable\";\n\n/** Executes the fixed in-process detector only for this Check's exact explicit input selection. */\nexport async function executeSecretDetection(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>\n): Promise<CheckResult<SecretDetectionFinalData>> {\n  if (!validSecretDetectionOptions(context.options)) return unavailable(\"invalid-options\");\n  if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n\n  let selectedPaths: readonly string[];\n  try {\n    selectedPaths = collectProjectFiles(context.project.root, context.options.files);\n  } catch {\n    return unavailable(\"scan-input-unavailable\");\n  }\n  if (context.signal.aborted) return unavailable(\"execution-cancelled\");\n  if (selectedPaths.length === 0)\n    return settleSecretDetectionFindings(context, selectedPaths.length, [], []);\n\n  const prepared = prepareSecretDetectionInputs(context, selectedPaths);\n  if (prepared.kind === \"unavailable\") return unavailable(\"source-unavailable\");\n  if (prepared.kind === \"cancelled\") return unavailable(\"execution-cancelled\");\n\n  const detected = await detectApprovedInputs(context, prepared.inputs);\n  if (detected.kind === \"unavailable\") return unavailable(detected.code);\n  return settleSecretDetectionFindings(\n    context,\n    selectedPaths.length,\n    detected.issues,\n    prepared.coverageGaps\n  );\n}\n\ntype DetectedIssues = Readonly<\n  | { readonly code: SecretDetectionUnavailableReasonCode; readonly kind: \"unavailable\" }\n  | { readonly issues: readonly SecretDetectionIssue[]; readonly kind: \"complete\" }\n>;\n\nasync function detectApprovedInputs(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  inputs: readonly ApprovedTextInput[]\n): Promise<DetectedIssues> {\n  const issues: SecretDetectionIssue[] = [];\n  for (const input of inputs) {\n    if (context.signal.aborted)\n      return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n    const detected = await detectSecretlintIssues(input.content, input.path);\n    if (context.signal.aborted)\n      return Object.freeze({ code: \"execution-cancelled\", kind: \"unavailable\" });\n    if (detected.kind === \"unavailable\") {\n      return Object.freeze({ code: \"detector-unavailable\", kind: \"unavailable\" });\n    }\n    if (detected.kind === \"protocol-failed\") {\n      return Object.freeze({ code: \"detector-protocol-failed\", kind: \"unavailable\" });\n    }\n    issues.push(...detected.issues);\n  }\n  return Object.freeze({ issues: Object.freeze(issues), kind: \"complete\" });\n}\n\nexport function settleSecretDetectionFindings(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  selectedFileCount: number,\n  issues: readonly SecretDetectionIssue[],\n  coverageGaps: readonly SecretCoverageGap[]\n): CheckResult<SecretDetectionFinalData> {\n  const reconciliation = reconcileFindingWaivers({\n    findings: issues,\n    identify: secretFindingIdentity,\n    waivers: context.options.findingWaivers\n  });\n  const waivedFindingCount = reconciliation.findings.filter(\n    (finding) => finding.disposition === \"waived\"\n  ).length;\n  for (const finding of reconciliation.findings) {\n    const identity = secretFindingIdentity(finding.finding);\n    const data: SecretDetectionFindingRecordData = Object.freeze({\n      blocking: finding.disposition !== \"waived\",\n      kind: \"secret-finding\",\n      location: finding.finding.location,\n      ordinal: identity.ordinal,\n      path: identity.path,\n      ruleId: identity.ruleId,\n      structuralClass: identity.structuralClass,\n      ...(finding.disposition === \"waived\"\n        ? { waiver: Object.freeze({ reason: finding.waiver.reason }) }\n        : {})\n    });\n    context.records.report({ id: secretFindingRecordId(identity) }, data);\n  }\n  for (const coverageGap of coverageGaps) {\n    const data: SecretDetectionCoverageGapRecordData = Object.freeze({\n      blocking: true,\n      kind: \"coverage-gap\",\n      path: coverageGap.path,\n      reason: coverageGap.reason\n    });\n    context.records.report({ id: secretCoverageGapRecordId(coverageGap.path) }, data);\n  }\n  reportFindingWaiverAudits(context, reconciliation, secretDetectionWaiverAuditRecord);\n\n  const data = Object.freeze({\n    coverageGapCount: coverageGaps.length,\n    findingCount: issues.length,\n    scannedFileCount: selectedFileCount - coverageGaps.length,\n    selectedFileCount,\n    waivedFindingCount\n  });\n  if (selectedFileCount === 0) {\n    return appendCheckMessages(\n      Object.freeze({ status: \"not-applicable\", reason: { code: \"no-eligible-input\" } }),\n      waiverMessages(reconciliation.waiverAudits)\n    );\n  }\n  const actionableFindingCount = issues.length - waivedFindingCount;\n  const result: CheckResult<SecretDetectionFinalData> = Object.freeze({\n    data,\n    status: coverageGaps.length > 0 || actionableFindingCount > 0 ? \"failed\" : \"passed\"\n  });\n  return appendCheckMessages(\n    appendCheckMessages(result, findingMessages(actionableFindingCount, coverageGaps.length)),\n    waiverMessages(reconciliation.waiverAudits)\n  );\n}\n\nfunction findingMessages(\n  actionableFindingCount: number,\n  coverageGapCount: number\n): readonly CheckMessage[] {\n  const messages: CheckMessage[] = [];\n  if (actionableFindingCount > 0) {\n    messages.push(\n      Object.freeze({\n        code: \"secret-findings\",\n        level: \"error\",\n        message: `${actionableFindingCount} high-confidence secret finding(s) require attention; inspect this Check's safe Records, remove the material, or author an exact finding waiver.`\n      })\n    );\n  }\n  if (coverageGapCount > 0) {\n    messages.push(\n      Object.freeze({\n        code: \"incomplete-coverage\",\n        level: \"error\",\n        message: `${coverageGapCount} selected input(s) could not receive bounded secret detection coverage; narrow files or increase this Check's explicit resource limits.`\n      })\n    );\n  }\n  return Object.freeze(messages);\n}\n\nfunction waiverMessages(\n  audits: readonly Readonly<{\n    readonly matchCount: number;\n    readonly status: \"applied\" | \"overmatched\" | \"unused\";\n    readonly waiver: Readonly<{ readonly reason: string }>;\n  }>[]\n): readonly CheckMessage[] {\n  const messages: CheckMessage[] = [];\n  for (const audit of audits) {\n    if (audit.status === \"applied\") {\n      messages.push(\n        Object.freeze({\n          code: \"finding-waived\",\n          level: \"info\",\n          message: `A secret finding was waived: ${audit.waiver.reason}`\n        })\n      );\n      continue;\n    }\n    messages.push(\n      Object.freeze({\n        code: audit.status === \"unused\" ? \"unused-finding-waiver\" : \"overmatched-finding-waiver\",\n        level: \"warning\",\n        message:\n          audit.status === \"unused\"\n            ? `A configured secret finding waiver matched no finding; remove or update it. Reason: ${audit.waiver.reason}`\n            : `A configured secret finding waiver matched ${audit.matchCount} findings and was not applied; narrow it. Reason: ${audit.waiver.reason}`\n      })\n    );\n  }\n  return Object.freeze(messages);\n}\n\nfunction unavailable(\n  code: SecretDetectionUnavailableReasonCode\n): CheckResult<SecretDetectionFinalData> {\n  return Object.freeze({\n    messages: Object.freeze([\n      Object.freeze({ code, level: \"error\" as const, message: unavailableMessage(code) })\n    ]),\n    reason: { code },\n    status: \"unavailable\"\n  });\n}\n\nfunction unavailableMessage(code: SecretDetectionUnavailableReasonCode): string {\n  switch (code) {\n    case \"invalid-options\":\n      return \"secretDetection options are invalid; recreate the Check with its documented explicit files policy.\";\n    case \"scan-input-unavailable\":\n      return \"Secret detection could not collect its configured project files; check the project root, permissions, and selected file source.\";\n    case \"source-unavailable\":\n      return \"A selected secret detection input could not be read safely; check that it still exists, is readable, and was not replaced during the Run.\";\n    case \"detector-unavailable\":\n      return \"The private secret detector did not complete; retry after restoring the package runtime without treating this Run as clean.\";\n    case \"detector-protocol-failed\":\n      return \"The private secret detector returned an unsupported result shape; update the package dependency only with a reviewed adapter change.\";\n    case \"execution-cancelled\":\n      return \"Secret detection was cancelled before it could form a complete result; inspect the caller's cancellation reason and retry if appropriate.\";\n  }\n}\n"]}

package/dist/esm/package-checks/secret-detection/final-data.mjs

@@ -0,0 +1,33 @@
+import { exactFinalDataRecord, invalidFinalData, nonNegativeSafeInteger } from "../final-data-parsing.mjs";
+/** 验证并脱离一份 `secretDetection` canonical final-data object。 */
+export function parseSecretDetectionData(data) {
+    const value = exactFinalDataRecord(data, [
+        "coverageGapCount",
+        "findingCount",
+        "scannedFileCount",
+        "selectedFileCount",
+        "waivedFindingCount"
+    ], "secretDetection");
+    const coverageGapCount = nonNegativeSafeInteger(value.coverageGapCount);
+    const findingCount = nonNegativeSafeInteger(value.findingCount);
+    const scannedFileCount = nonNegativeSafeInteger(value.scannedFileCount);
+    const selectedFileCount = nonNegativeSafeInteger(value.selectedFileCount);
+    const waivedFindingCount = nonNegativeSafeInteger(value.waivedFindingCount);
+    if (coverageGapCount === undefined ||
+        findingCount === undefined ||
+        scannedFileCount === undefined ||
+        selectedFileCount === undefined ||
+        waivedFindingCount === undefined ||
+        scannedFileCount + coverageGapCount !== selectedFileCount ||
+        waivedFindingCount > findingCount) {
+        throw invalidFinalData("secretDetection");
+    }
+    return Object.freeze({
+        coverageGapCount,
+        findingCount,
+        scannedFileCount,
+        selectedFileCount,
+        waivedFindingCount
+    });
+}
+//# sourceMappingURL=final-data.mjs.map

package/dist/esm/package-checks/secret-detection/final-data.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"final-data.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/final-data.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAgBlC,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAChC,IAAI,EACJ;QACE,kBAAkB;QAClB,cAAc;QACd,kBAAkB;QAClB,mBAAmB;QACnB,oBAAoB;KACrB,EACD,iBAAiB,CAClB,CAAC;IACF,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5E,IACE,gBAAgB,KAAK,SAAS;QAC9B,YAAY,KAAK,SAAS;QAC1B,gBAAgB,KAAK,SAAS;QAC9B,iBAAiB,KAAK,SAAS;QAC/B,kBAAkB,KAAK,SAAS;QAChC,gBAAgB,GAAG,gBAAgB,KAAK,iBAAiB;QACzD,kBAAkB,GAAG,YAAY,EACjC,CAAC;QACD,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,gBAAgB;QAChB,YAAY;QACZ,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;KACnB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  exactFinalDataRecord,\n  invalidFinalData,\n  nonNegativeSafeInteger\n} from \"../final-data-parsing.ts\";\n\n/** `secretDetection` 正常完成时发布的安全计数。 */\nexport interface SecretDetectionFinalData {\n  /** 已选择但未获得 bounded detector coverage 的文件数。 */\n  readonly coverageGapCount: number;\n  /** 所有安全投影后的 detector finding 数，包括已 waived 的 finding。 */\n  readonly findingCount: number;\n  /** 已获得 bounded text detector coverage 的文件数。 */\n  readonly scannedFileCount: number;\n  /** files policy 的 exact selection 数，恒等于 scannedFileCount 与 coverageGapCount 之和。 */\n  readonly selectedFileCount: number;\n  /** 安全 identity 被唯一 waiver 匹配的 finding 数。 */\n  readonly waivedFindingCount: number;\n}\n\n/** 验证并脱离一份 `secretDetection` canonical final-data object。 */\nexport function parseSecretDetectionData(data: unknown): SecretDetectionFinalData {\n  const value = exactFinalDataRecord(\n    data,\n    [\n      \"coverageGapCount\",\n      \"findingCount\",\n      \"scannedFileCount\",\n      \"selectedFileCount\",\n      \"waivedFindingCount\"\n    ],\n    \"secretDetection\"\n  );\n  const coverageGapCount = nonNegativeSafeInteger(value.coverageGapCount);\n  const findingCount = nonNegativeSafeInteger(value.findingCount);\n  const scannedFileCount = nonNegativeSafeInteger(value.scannedFileCount);\n  const selectedFileCount = nonNegativeSafeInteger(value.selectedFileCount);\n  const waivedFindingCount = nonNegativeSafeInteger(value.waivedFindingCount);\n  if (\n    coverageGapCount === undefined ||\n    findingCount === undefined ||\n    scannedFileCount === undefined ||\n    selectedFileCount === undefined ||\n    waivedFindingCount === undefined ||\n    scannedFileCount + coverageGapCount !== selectedFileCount ||\n    waivedFindingCount > findingCount\n  ) {\n    throw invalidFinalData(\"secretDetection\");\n  }\n  return Object.freeze({\n    coverageGapCount,\n    findingCount,\n    scannedFileCount,\n    selectedFileCount,\n    waivedFindingCount\n  });\n}\n"]}

package/dist/esm/package-checks/secret-detection/finding-waiver-identity.mjs

@@ -0,0 +1,30 @@
+import { snapshotExactClosedRecord } from "../../data-boundary/closed-values.mjs";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.mjs";
+import { isNormalizedProjectRelativePath } from "../host-environment/path.mjs";
+const PRIVATE_KEY_RULE_ID = "@secretlint/secretlint-rule-privatekey";
+const TEXT_DOCUMENT_STRUCTURAL_CLASS = "text-document";
+/** 解析只含安全路径、规则、结构标记和 occurrence ordinal 的 waiver identity。 */
+export function resolveSecretDetectionFindingIdentity(value) {
+    const identity = snapshotExactClosedRecord(value, [
+        "ordinal",
+        "path",
+        "ruleId",
+        "structuralClass"
+    ]);
+    if (identity === undefined ||
+        !isPositiveSafeInteger(identity.ordinal) ||
+        !isNormalizedProjectRelativePath(identity.path) ||
+        identity.ruleId !== PRIVATE_KEY_RULE_ID ||
+        identity.structuralClass !== TEXT_DOCUMENT_STRUCTURAL_CLASS) {
+        return undefined;
+    }
+    return Object.freeze({
+        ordinal: identity.ordinal,
+        path: identity.path,
+        ruleId: PRIVATE_KEY_RULE_ID,
+        structuralClass: TEXT_DOCUMENT_STRUCTURAL_CLASS
+    });
+}
+export const secretDetectionPrivateKeyRuleId = PRIVATE_KEY_RULE_ID;
+export const secretDetectionTextDocumentStructuralClass = TEXT_DOCUMENT_STRUCTURAL_CLASS;
+//# sourceMappingURL=finding-waiver-identity.mjs.map

package/dist/esm/package-checks/secret-detection/finding-waiver-identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-waiver-identity.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/finding-waiver-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAG9E,MAAM,mBAAmB,GAAG,wCAAiD,CAAC;AAC9E,MAAM,8BAA8B,GAAG,eAAwB,CAAC;AAEhE,8DAA8D;AAC9D,MAAM,UAAU,qCAAqC,CACnD,KAAc;IAEd,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,EAAE;QAChD,SAAS;QACT,MAAM;QACN,QAAQ;QACR,iBAAiB;KAClB,CAAC,CAAC;IACH,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxC,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/C,QAAQ,CAAC,MAAM,KAAK,mBAAmB;QACvC,QAAQ,CAAC,eAAe,KAAK,8BAA8B,EAC3D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,mBAAmB;QAC3B,eAAe,EAAE,8BAA8B;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AACnE,MAAM,CAAC,MAAM,0CAA0C,GAAG,8BAA8B,CAAC","sourcesContent":["import { snapshotExactClosedRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { isNormalizedProjectRelativePath } from \"../host-environment/path.ts\";\nimport type { SecretDetectionFindingIdentity } from \"./options.ts\";\n\nconst PRIVATE_KEY_RULE_ID = \"@secretlint/secretlint-rule-privatekey\" as const;\nconst TEXT_DOCUMENT_STRUCTURAL_CLASS = \"text-document\" as const;\n\n/** 解析只含安全路径、规则、结构标记和 occurrence ordinal 的 waiver identity。 */\nexport function resolveSecretDetectionFindingIdentity(\n  value: unknown\n): SecretDetectionFindingIdentity | undefined {\n  const identity = snapshotExactClosedRecord(value, [\n    \"ordinal\",\n    \"path\",\n    \"ruleId\",\n    \"structuralClass\"\n  ]);\n  if (\n    identity === undefined ||\n    !isPositiveSafeInteger(identity.ordinal) ||\n    !isNormalizedProjectRelativePath(identity.path) ||\n    identity.ruleId !== PRIVATE_KEY_RULE_ID ||\n    identity.structuralClass !== TEXT_DOCUMENT_STRUCTURAL_CLASS\n  ) {\n    return undefined;\n  }\n  return Object.freeze({\n    ordinal: identity.ordinal,\n    path: identity.path,\n    ruleId: PRIVATE_KEY_RULE_ID,\n    structuralClass: TEXT_DOCUMENT_STRUCTURAL_CLASS\n  });\n}\n\nexport const secretDetectionPrivateKeyRuleId = PRIVATE_KEY_RULE_ID;\nexport const secretDetectionTextDocumentStructuralClass = TEXT_DOCUMENT_STRUCTURAL_CLASS;\n"]}

package/dist/esm/package-checks/secret-detection/input-preparation.mjs

@@ -0,0 +1,192 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { resolve } from "node:path";
+import { classifySecretDetectionBytes } from "./classification.mjs";
+/** Reads and classifies the already-selected paths before the detector can receive text. */
+export function prepareSecretDetectionInputs(context, selectedPaths) {
+    const coverageGaps = [];
+    const inputs = [];
+    let consumedBytes = 0;
+    for (const [index, path] of selectedPaths.entries()) {
+        if (context.signal.aborted)
+            return Object.freeze({ kind: "cancelled" });
+        const selectionLimit = selectionLimitGaps(context.options.maximumFileCount, selectedPaths, index);
+        if (selectionLimit !== undefined) {
+            coverageGaps.push(...selectionLimit);
+            break;
+        }
+        const prepared = prepareSelectedInput(context, path, consumedBytes);
+        if (prepared.kind === "cancelled" || prepared.kind === "unavailable")
+            return prepared;
+        if (prepared.kind === "coverage-gap") {
+            consumedBytes += prepared.consumedBytes;
+            coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));
+            if (prepared.stop) {
+                coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), "total-byte-limit"));
+                break;
+            }
+            continue;
+        }
+        consumedBytes += prepared.byteLength;
+        inputs.push(prepared.input);
+    }
+    return Object.freeze({
+        coverageGaps: Object.freeze(coverageGaps),
+        inputs: Object.freeze(inputs),
+        kind: "complete"
+    });
+}
+function selectionLimitGaps(maximumFileCount, selectedPaths, index) {
+    if (index < maximumFileCount)
+        return undefined;
+    return coverageGapsFor(selectedPaths.slice(index), "file-count-limit");
+}
+function prepareSelectedInput(context, path, consumedBytes) {
+    if (context.signal.aborted)
+        return Object.freeze({ kind: "cancelled" });
+    const read = readBoundedRegularFile({
+        consumedBytes,
+        filePath: resolve(context.project.root, path),
+        options: context.options
+    });
+    if (read.kind === "unavailable")
+        return read;
+    if (read.kind === "coverage-gap") {
+        return Object.freeze({
+            consumedBytes: 0,
+            kind: "coverage-gap",
+            reason: read.reason,
+            stop: read.reason === "total-byte-limit"
+        });
+    }
+    if (context.signal.aborted)
+        return Object.freeze({ kind: "cancelled" });
+    const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);
+    if (classification.kind === "coverage-gap") {
+        return Object.freeze({
+            consumedBytes: read.bytes.byteLength,
+            kind: "coverage-gap",
+            reason: classification.reason,
+            stop: false
+        });
+    }
+    return Object.freeze({
+        byteLength: read.bytes.byteLength,
+        input: Object.freeze({ content: classification.content, path }),
+        kind: "approved"
+    });
+}
+function readBoundedRegularFile(input) {
+    const descriptor = openIdentityCheckedRegularFile(input.filePath);
+    if (descriptor === undefined)
+        return Object.freeze({ kind: "unavailable" });
+    try {
+        const byteLength = regularFileByteLength(descriptor);
+        if (byteLength === undefined)
+            return Object.freeze({ kind: "unavailable" });
+        const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);
+        if (limit !== undefined)
+            return Object.freeze({ kind: "coverage-gap", reason: limit });
+        const bytes = readExactBoundedBytes(descriptor, byteLength);
+        if (bytes === undefined || regularFileByteLength(descriptor) !== byteLength) {
+            return Object.freeze({ kind: "unavailable" });
+        }
+        return Object.freeze({ bytes, kind: "complete" });
+    }
+    catch {
+        return Object.freeze({ kind: "unavailable" });
+    }
+    finally {
+        closeDescriptor(descriptor);
+    }
+}
+function closeDescriptor(descriptor) {
+    try {
+        closeSync(descriptor);
+    }
+    catch {
+        // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.
+    }
+}
+function openIdentityCheckedRegularFile(filePath) {
+    const expectedIdentity = regularFileIdentityAtPath(filePath);
+    if (expectedIdentity === undefined)
+        return undefined;
+    const openFlags = finalLeafOpenFlags();
+    if (openFlags === undefined)
+        return undefined;
+    let descriptor;
+    try {
+        descriptor = openSync(filePath, openFlags);
+    }
+    catch {
+        return undefined;
+    }
+    const openedIdentity = regularFileIdentityOnDescriptor(descriptor);
+    if (openedIdentity !== undefined && sameRegularFileIdentity(expectedIdentity, openedIdentity)) {
+        return descriptor;
+    }
+    closeDescriptor(descriptor);
+    return undefined;
+}
+function finalLeafOpenFlags() {
+    if (process.platform === "win32")
+        return constants.O_RDONLY;
+    return typeof constants.O_NOFOLLOW === "number" && constants.O_NOFOLLOW !== 0
+        ? constants.O_RDONLY | constants.O_NOFOLLOW
+        : undefined;
+}
+function regularFileIdentityAtPath(filePath) {
+    try {
+        return regularFileIdentity(lstatSync(filePath, { bigint: true }));
+    }
+    catch {
+        return undefined;
+    }
+}
+function regularFileIdentityOnDescriptor(descriptor) {
+    try {
+        return regularFileIdentity(fstatSync(descriptor, { bigint: true }));
+    }
+    catch {
+        return undefined;
+    }
+}
+function regularFileIdentity(details) {
+    return details.isFile() && details.dev > 0n && details.ino > 0n
+        ? Object.freeze({ device: details.dev, inode: details.ino })
+        : undefined;
+}
+function sameRegularFileIdentity(expected, opened) {
+    return expected.device === opened.device && expected.inode === opened.inode;
+}
+function regularFileByteLength(descriptor) {
+    try {
+        const details = fstatSync(descriptor);
+        return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0
+            ? details.size
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readExactBoundedBytes(descriptor, byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+        const read = readSync(descriptor, bytes, offset, Math.min(65_536, bytes.byteLength - offset), null);
+        if (read <= 0)
+            return undefined;
+        offset += read;
+    }
+    return bytes;
+}
+function resourceLimitReason(options, byteLength, consumedBytes) {
+    if (byteLength > options.maximumFileBytes)
+        return "file-byte-limit";
+    return consumedBytes + byteLength > options.maximumTotalBytes ? "total-byte-limit" : undefined;
+}
+function coverageGapsFor(paths, reason) {
+    return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));
+}
+//# sourceMappingURL=input-preparation.mjs.map

package/dist/esm/package-checks/secret-detection/input-preparation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-preparation.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/input-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EAET,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,4BAA4B,EAE7B,MAAM,qBAAqB,CAAC;AAyB7B,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAC1C,OAA8D,EAC9D,aAAgC;IAEhC,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAChC,aAAa,EACb,KAAK,CACN,CAAC;QACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACtF,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC1F,MAAM;YACR,CAAC;YACD,SAAS;QACX,CAAC;QACD,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AA0BD,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,aAAgC,EAChC,KAAa;IAEb,IAAI,KAAK,GAAG,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8D,EAC9D,IAAY,EACZ,aAAqB;IAErB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,kBAAkB;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAExE,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClG,IAAI,cAAc,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACpC,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;AACH,CAAC;AAOD,SAAS,8BAA8B,CAAC,QAAgB;IACtD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,cAAc,KAAK,SAAS,IAAI,uBAAuB,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5D,OAAO,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC;QAC3E,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,UAAkB;IACzD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,EAAE;QAC7D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA6B,EAC7B,MAA2B;IAE3B,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;YAChF,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,UAAkB;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CACnB,UAAU,EACV,KAAK,EACL,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,EAC3C,IAAI,CACL,CAAC;QACF,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAuC,EACvC,UAAkB,EAClB,aAAqB;IAErB,IAAI,UAAU,GAAG,OAAO,CAAC,gBAAgB;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,KAAwB,EACxB,MAAwC;IAExC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["import {\n  closeSync,\n  constants,\n  fstatSync,\n  lstatSync,\n  openSync,\n  readSync,\n  type BigIntStats\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nimport type { CheckExecutionContext } from \"../../check/check.ts\";\nimport {\n  classifySecretDetectionBytes,\n  type SecretDetectionCoverageGapReason\n} from \"./classification.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\n\n/** Private, already-classified text passed to this Check's private detector adapter. */\nexport interface ApprovedTextInput {\n  readonly content: string;\n  readonly path: string;\n}\n\n/** A safe explanation for an exact selected input that did not receive detector coverage. */\nexport interface SecretCoverageGap {\n  readonly path: string;\n  readonly reason: SecretDetectionCoverageGapReason;\n}\n\nexport type PreparedSecretDetectionInputs = Readonly<\n  | { readonly kind: \"cancelled\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly coverageGaps: readonly SecretCoverageGap[];\n      readonly inputs: readonly ApprovedTextInput[];\n      readonly kind: \"complete\";\n    }\n>;\n\n/** Reads and classifies the already-selected paths before the detector can receive text. */\nexport function prepareSecretDetectionInputs(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  selectedPaths: readonly string[]\n): PreparedSecretDetectionInputs {\n  const coverageGaps: SecretCoverageGap[] = [];\n  const inputs: ApprovedTextInput[] = [];\n  let consumedBytes = 0;\n\n  for (const [index, path] of selectedPaths.entries()) {\n    if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n    const selectionLimit = selectionLimitGaps(\n      context.options.maximumFileCount,\n      selectedPaths,\n      index\n    );\n    if (selectionLimit !== undefined) {\n      coverageGaps.push(...selectionLimit);\n      break;\n    }\n    const prepared = prepareSelectedInput(context, path, consumedBytes);\n    if (prepared.kind === \"cancelled\" || prepared.kind === \"unavailable\") return prepared;\n    if (prepared.kind === \"coverage-gap\") {\n      consumedBytes += prepared.consumedBytes;\n      coverageGaps.push(Object.freeze({ path, reason: prepared.reason }));\n      if (prepared.stop) {\n        coverageGaps.push(...coverageGapsFor(selectedPaths.slice(index + 1), \"total-byte-limit\"));\n        break;\n      }\n      continue;\n    }\n    consumedBytes += prepared.byteLength;\n    inputs.push(prepared.input);\n  }\n  return Object.freeze({\n    coverageGaps: Object.freeze(coverageGaps),\n    inputs: Object.freeze(inputs),\n    kind: \"complete\"\n  });\n}\n\ntype PreparedSelectedInput = Readonly<\n  | { readonly kind: \"cancelled\" }\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly consumedBytes: number;\n      readonly kind: \"coverage-gap\";\n      readonly reason: SecretDetectionCoverageGapReason;\n      readonly stop: boolean;\n    }\n  | { readonly byteLength: number; readonly input: ApprovedTextInput; readonly kind: \"approved\" }\n>;\n\ntype BoundedRegularFileRead = Readonly<\n  | { readonly kind: \"unavailable\" }\n  | {\n      readonly kind: \"coverage-gap\";\n      readonly reason: Extract<\n        SecretDetectionCoverageGapReason,\n        \"file-byte-limit\" | \"total-byte-limit\"\n      >;\n    }\n  | { readonly bytes: Uint8Array; readonly kind: \"complete\" }\n>;\n\nfunction selectionLimitGaps(\n  maximumFileCount: number,\n  selectedPaths: readonly string[],\n  index: number\n): readonly SecretCoverageGap[] | undefined {\n  if (index < maximumFileCount) return undefined;\n  return coverageGapsFor(selectedPaths.slice(index), \"file-count-limit\");\n}\n\nfunction prepareSelectedInput(\n  context: CheckExecutionContext<ResolvedSecretDetectionOptions>,\n  path: string,\n  consumedBytes: number\n): PreparedSelectedInput {\n  if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n  const read = readBoundedRegularFile({\n    consumedBytes,\n    filePath: resolve(context.project.root, path),\n    options: context.options\n  });\n  if (read.kind === \"unavailable\") return read;\n  if (read.kind === \"coverage-gap\") {\n    return Object.freeze({\n      consumedBytes: 0,\n      kind: \"coverage-gap\",\n      reason: read.reason,\n      stop: read.reason === \"total-byte-limit\"\n    });\n  }\n  if (context.signal.aborted) return Object.freeze({ kind: \"cancelled\" });\n\n  const classification = classifySecretDetectionBytes(read.bytes, context.options.maximumFileBytes);\n  if (classification.kind === \"coverage-gap\") {\n    return Object.freeze({\n      consumedBytes: read.bytes.byteLength,\n      kind: \"coverage-gap\",\n      reason: classification.reason,\n      stop: false\n    });\n  }\n  return Object.freeze({\n    byteLength: read.bytes.byteLength,\n    input: Object.freeze({ content: classification.content, path }),\n    kind: \"approved\"\n  });\n}\n\nfunction readBoundedRegularFile(input: {\n  readonly consumedBytes: number;\n  readonly filePath: string;\n  readonly options: ResolvedSecretDetectionOptions;\n}): BoundedRegularFileRead {\n  const descriptor = openIdentityCheckedRegularFile(input.filePath);\n  if (descriptor === undefined) return Object.freeze({ kind: \"unavailable\" });\n  try {\n    const byteLength = regularFileByteLength(descriptor);\n    if (byteLength === undefined) return Object.freeze({ kind: \"unavailable\" });\n    const limit = resourceLimitReason(input.options, byteLength, input.consumedBytes);\n    if (limit !== undefined) return Object.freeze({ kind: \"coverage-gap\", reason: limit });\n\n    const bytes = readExactBoundedBytes(descriptor, byteLength);\n    if (bytes === undefined || regularFileByteLength(descriptor) !== byteLength) {\n      return Object.freeze({ kind: \"unavailable\" });\n    }\n    return Object.freeze({ bytes, kind: \"complete\" });\n  } catch {\n    return Object.freeze({ kind: \"unavailable\" });\n  } finally {\n    closeDescriptor(descriptor);\n  }\n}\n\nfunction closeDescriptor(descriptor: number): void {\n  try {\n    closeSync(descriptor);\n  } catch {\n    // The descriptor cannot carry source bytes into a public result; preserve the completed read fact.\n  }\n}\n\ninterface RegularFileIdentity {\n  readonly device: bigint;\n  readonly inode: bigint;\n}\n\nfunction openIdentityCheckedRegularFile(filePath: string): number | undefined {\n  const expectedIdentity = regularFileIdentityAtPath(filePath);\n  if (expectedIdentity === undefined) return undefined;\n  const openFlags = finalLeafOpenFlags();\n  if (openFlags === undefined) return undefined;\n\n  let descriptor: number;\n  try {\n    descriptor = openSync(filePath, openFlags);\n  } catch {\n    return undefined;\n  }\n\n  const openedIdentity = regularFileIdentityOnDescriptor(descriptor);\n  if (openedIdentity !== undefined && sameRegularFileIdentity(expectedIdentity, openedIdentity)) {\n    return descriptor;\n  }\n  closeDescriptor(descriptor);\n  return undefined;\n}\n\nfunction finalLeafOpenFlags(): number | undefined {\n  if (process.platform === \"win32\") return constants.O_RDONLY;\n  return typeof constants.O_NOFOLLOW === \"number\" && constants.O_NOFOLLOW !== 0\n    ? constants.O_RDONLY | constants.O_NOFOLLOW\n    : undefined;\n}\n\nfunction regularFileIdentityAtPath(filePath: string): RegularFileIdentity | undefined {\n  try {\n    return regularFileIdentity(lstatSync(filePath, { bigint: true }));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction regularFileIdentityOnDescriptor(descriptor: number): RegularFileIdentity | undefined {\n  try {\n    return regularFileIdentity(fstatSync(descriptor, { bigint: true }));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction regularFileIdentity(details: BigIntStats): RegularFileIdentity | undefined {\n  return details.isFile() && details.dev > 0n && details.ino > 0n\n    ? Object.freeze({ device: details.dev, inode: details.ino })\n    : undefined;\n}\n\nfunction sameRegularFileIdentity(\n  expected: RegularFileIdentity,\n  opened: RegularFileIdentity\n): boolean {\n  return expected.device === opened.device && expected.inode === opened.inode;\n}\n\nfunction regularFileByteLength(descriptor: number): number | undefined {\n  try {\n    const details = fstatSync(descriptor);\n    return details.isFile() && Number.isSafeInteger(details.size) && details.size >= 0\n      ? details.size\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readExactBoundedBytes(descriptor: number, byteLength: number): Uint8Array | undefined {\n  const bytes = new Uint8Array(byteLength);\n  let offset = 0;\n  while (offset < bytes.byteLength) {\n    const read = readSync(\n      descriptor,\n      bytes,\n      offset,\n      Math.min(65_536, bytes.byteLength - offset),\n      null\n    );\n    if (read <= 0) return undefined;\n    offset += read;\n  }\n  return bytes;\n}\n\nfunction resourceLimitReason(\n  options: ResolvedSecretDetectionOptions,\n  byteLength: number,\n  consumedBytes: number\n): Extract<SecretDetectionCoverageGapReason, \"file-byte-limit\" | \"total-byte-limit\"> | undefined {\n  if (byteLength > options.maximumFileBytes) return \"file-byte-limit\";\n  return consumedBytes + byteLength > options.maximumTotalBytes ? \"total-byte-limit\" : undefined;\n}\n\nfunction coverageGapsFor(\n  paths: readonly string[],\n  reason: SecretDetectionCoverageGapReason\n): readonly SecretCoverageGap[] {\n  return Object.freeze(paths.map((path) => Object.freeze({ path, reason })));\n}\n"]}

package/dist/esm/package-checks/secret-detection/options-resolution.mjs

@@ -0,0 +1,40 @@
+import { snapshotClosedPolicyRecord } from "../../data-boundary/closed-values.mjs";
+import { isPositiveSafeInteger } from "../../data-boundary/value-shapes.mjs";
+import { resolveFindingWaiverAuthoring } from "../code-quality-findings/finding-waiver-authoring.mjs";
+import { snapshotProjectFileSelection, validProjectFileSelection } from "../project-files/configuration.mjs";
+import { resolveSecretDetectionFindingIdentity } from "./finding-waiver-identity.mjs";
+import { validSecretDetectionOptions } from "./options-validation.mjs";
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES = 1_048_576;
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES = 8_388_608;
+export const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT = 2_048;
+/** 将 required exact file policy 和有限资源策略物化为完整、冻结 options。 */
+export function resolveSecretDetectionOptions(value) {
+    const input = snapshotClosedPolicyRecord(value, {
+        optional: ["findingWaivers", "maximumFileBytes", "maximumFileCount", "maximumTotalBytes"],
+        required: ["files"]
+    });
+    if (input === undefined || !validProjectFileSelection(input.files))
+        return undefined;
+    const limits = resolveSecretDetectionResourceLimits(input);
+    const findingWaivers = resolveFindingWaiverAuthoring(input.findingWaivers, resolveSecretDetectionFindingIdentity);
+    if (limits === undefined || findingWaivers === undefined)
+        return undefined;
+    const options = Object.freeze({
+        files: snapshotProjectFileSelection(input.files),
+        findingWaivers,
+        ...limits
+    });
+    return validSecretDetectionOptions(options) ? options : undefined;
+}
+function resolveSecretDetectionResourceLimits(input) {
+    const maximumFileBytes = input.maximumFileBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES;
+    const maximumFileCount = input.maximumFileCount ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT;
+    const maximumTotalBytes = input.maximumTotalBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES;
+    if (!isPositiveSafeInteger(maximumFileBytes) ||
+        !isPositiveSafeInteger(maximumFileCount) ||
+        !isPositiveSafeInteger(maximumTotalBytes)) {
+        return undefined;
+    }
+    return Object.freeze({ maximumFileBytes, maximumFileCount, maximumTotalBytes });
+}
+//# sourceMappingURL=options-resolution.mjs.map

package/dist/esm/package-checks/secret-detection/options-resolution.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-resolution.mjs","sourceRoot":"","sources":["../../../../src/package-checks/secret-detection/options-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sDAAsD,CAAC;AACrG,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AAErF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,2CAA2C,GAAG,SAAS,CAAC;AACrE,MAAM,CAAC,MAAM,4CAA4C,GAAG,SAAS,CAAC;AACtE,MAAM,CAAC,MAAM,2CAA2C,GAAG,KAAK,CAAC;AAEjE,4DAA4D;AAC5D,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE;QAC9C,QAAQ,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;QACzF,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAErF,MAAM,MAAM,GAAG,oCAAoC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,6BAA6B,CAClD,KAAK,CAAC,cAAc,EACpB,qCAAqC,CACtC,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC;QAChD,cAAc;QACd,GAAG,MAAM;KACV,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,oCAAoC,CAC3C,KAIE;IAQF,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,2CAA2C,CAAC;IAC/F,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,2CAA2C,CAAC;IAC/F,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,4CAA4C,CAAC;IAClG,IACE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;QACxC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;QACxC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { snapshotClosedPolicyRecord } from \"../../data-boundary/closed-values.ts\";\nimport { isPositiveSafeInteger } from \"../../data-boundary/value-shapes.ts\";\nimport { resolveFindingWaiverAuthoring } from \"../code-quality-findings/finding-waiver-authoring.ts\";\nimport {\n  snapshotProjectFileSelection,\n  validProjectFileSelection\n} from \"../project-files/configuration.ts\";\nimport { resolveSecretDetectionFindingIdentity } from \"./finding-waiver-identity.ts\";\nimport type { ResolvedSecretDetectionOptions } from \"./options.ts\";\nimport { validSecretDetectionOptions } from \"./options-validation.ts\";\n\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES = 1_048_576;\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES = 8_388_608;\nexport const DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT = 2_048;\n\n/** 将 required exact file policy 和有限资源策略物化为完整、冻结 options。 */\nexport function resolveSecretDetectionOptions(\n  value: unknown\n): ResolvedSecretDetectionOptions | undefined {\n  const input = snapshotClosedPolicyRecord(value, {\n    optional: [\"findingWaivers\", \"maximumFileBytes\", \"maximumFileCount\", \"maximumTotalBytes\"],\n    required: [\"files\"]\n  });\n  if (input === undefined || !validProjectFileSelection(input.files)) return undefined;\n\n  const limits = resolveSecretDetectionResourceLimits(input);\n  const findingWaivers = resolveFindingWaiverAuthoring(\n    input.findingWaivers,\n    resolveSecretDetectionFindingIdentity\n  );\n  if (limits === undefined || findingWaivers === undefined) return undefined;\n\n  const options = Object.freeze({\n    files: snapshotProjectFileSelection(input.files),\n    findingWaivers,\n    ...limits\n  });\n  return validSecretDetectionOptions(options) ? options : undefined;\n}\n\nfunction resolveSecretDetectionResourceLimits(\n  input: Readonly<{\n    readonly maximumFileBytes?: unknown;\n    readonly maximumFileCount?: unknown;\n    readonly maximumTotalBytes?: unknown;\n  }>\n):\n  | Readonly<{\n      readonly maximumFileBytes: number;\n      readonly maximumFileCount: number;\n      readonly maximumTotalBytes: number;\n    }>\n  | undefined {\n  const maximumFileBytes = input.maximumFileBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_BYTES;\n  const maximumFileCount = input.maximumFileCount ?? DEFAULT_SECRET_DETECTION_MAXIMUM_FILE_COUNT;\n  const maximumTotalBytes = input.maximumTotalBytes ?? DEFAULT_SECRET_DETECTION_MAXIMUM_TOTAL_BYTES;\n  if (\n    !isPositiveSafeInteger(maximumFileBytes) ||\n    !isPositiveSafeInteger(maximumFileCount) ||\n    !isPositiveSafeInteger(maximumTotalBytes)\n  ) {\n    return undefined;\n  }\n  return Object.freeze({ maximumFileBytes, maximumFileCount, maximumTotalBytes });\n}\n"]}