dsh-config-manager 0.1.0

package/lib/security/encryption.js

@@ -0,0 +1,152 @@
+/**
+ * 凭据加密（规范 §7 / 设计 §7.3 / core `EncryptionProvider` 契约实现，零依赖 node:crypto）。
+ *
+ * 方案：scrypt（KDF）+ AES-256-GCM（AEAD），每次导出 salt/iv 全随机，密码绝不落盘。
+ * secrets.enc 二进制布局（设计 §7.3 细化）：
+ *
+ *   magic "DSC1"(4B) + version(1B) + salt(16B) + iv(12B) + authTag(16B) + ciphertext
+ *
+ * - magic/version 不符 → `UNSUPPORTED_FORMAT`（不是本插件产物 / 版本过新）
+ * - blob 内嵌参数与 manifest 的 EncryptionInfo 不一致 → `TAMPERED`（元数据被篡改）
+ * - GCM 认证失败（密码错误或密文被改） → `BAD_PASSWORD`（提示重输密码或核对备份来源）
+ *
+ * 与 core 契约的关系：
+ * - `createEncryptionProvider(password)` 返回 core `EncryptionProvider`（encrypt 无密码参数，
+ *   闭包持有导出密码；decrypt 用调用方传入的密码 → 支持「换密码解密」）。
+ * - 底层纯函数 encryptCredentials/decryptCredentials 对齐设计 §13.4，供直接调用与测试。
+ * - plaintext 语义：`.credentials.yaml` 文件原文（m5 经 HostContext.fs 文件级读取提供；
+ *   ctx.credentials 永不回读值——研究报告 §3.2 硬约束），本模块只做字节级加解密。
+ */
+import crypto from 'node:crypto';
+import { promisify } from 'node:util';
+const scryptAsync = promisify(crypto.scrypt);
+export const SCHEMA_MAGIC = 'DSC1';
+export const SCHEMA_VERSION = 1;
+export const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1, keyLength: 32 };
+export const SALT_LENGTH = 16;
+export const IV_LENGTH = 12;
+export const TAG_LENGTH = 16;
+/** magic(4) + version(1) + salt(16) + iv(12) + authTag(16) */
+export const HEADER_LENGTH = 4 + 1 + SALT_LENGTH + IV_LENGTH + TAG_LENGTH;
+export class SecurityError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'SecurityError';
+        this.code = code;
+    }
+}
+/** KDF 参数值域校验（防 manifest 被篡改成超大 N 导致 DoS；非法即拒绝） */
+export function validateKdfParams(params) {
+    if (params === null || typeof params !== 'object')
+        return false;
+    const p = params;
+    if (typeof p['N'] !== 'number' || p['N'] < 2 ** 14 || p['N'] > 2 ** 20)
+        return false;
+    if (typeof p['r'] !== 'number' || p['r'] < 1 || p['r'] > 32)
+        return false;
+    if (typeof p['p'] !== 'number' || p['p'] < 1 || p['p'] > 32)
+        return false;
+    return typeof p['keyLength'] === 'number' && p['keyLength'] === 32;
+}
+/** 派生密钥（scrypt，参数可来自 manifest；默认常量） */
+export async function deriveKey(password, salt, params = SCRYPT_PARAMS) {
+    return scryptAsync(password, salt, params.keyLength, { N: params.N, r: params.r, p: params.p });
+}
+/** 加密 .credentials.yaml 原文 → { blob, info }（info 直接进 manifest.security.encryption） */
+export async function encryptCredentials(plaintext, password) {
+    if (password === '')
+        throw new SecurityError('BAD_PASSWORD', '加密密码不能为空');
+    const salt = crypto.randomBytes(SALT_LENGTH);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const key = await deriveKey(password, salt);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const header = Buffer.alloc(HEADER_LENGTH);
+    header.write(SCHEMA_MAGIC, 0, 'ascii');
+    header[4] = SCHEMA_VERSION;
+    salt.copy(header, 5);
+    iv.copy(header, 5 + SALT_LENGTH);
+    authTag.copy(header, 5 + SALT_LENGTH + IV_LENGTH);
+    const info = {
+        algorithm: 'aes-256-gcm',
+        kdf: 'scrypt',
+        kdfParams: { ...SCRYPT_PARAMS },
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        authTag: authTag.toString('base64'),
+        version: SCHEMA_VERSION,
+    };
+    return { blob: Buffer.concat([header, encrypted]), info };
+}
+/** 解密 secrets.enc（authTag 校验失败抛 BAD_PASSWORD；元数据不一致抛 TAMPERED） */
+export async function decryptCredentials(blob, info, password) {
+    if (blob.length < HEADER_LENGTH) {
+        throw new SecurityError('TAMPERED', 'secrets.enc 体积过小（截断或损坏）');
+    }
+    const magic = Buffer.from(blob.subarray(0, 4)).toString('ascii');
+    if (magic !== SCHEMA_MAGIC) {
+        throw new SecurityError('UNSUPPORTED_FORMAT', `未知文件格式 magic "${magic}"，不是本插件产物`);
+    }
+    const version = blob[4];
+    if (version !== SCHEMA_VERSION) {
+        throw new SecurityError('UNSUPPORTED_FORMAT', `不支持的 secrets.enc 版本 ${version}`);
+    }
+    if (info.algorithm !== 'aes-256-gcm' || info.kdf !== 'scrypt' || !validateKdfParams(info.kdfParams)) {
+        throw new SecurityError('UNSUPPORTED_FORMAT', 'manifest 加密参数非法或不受支持');
+    }
+    const blobSalt = blob.subarray(5, 5 + SALT_LENGTH);
+    const blobIv = blob.subarray(5 + SALT_LENGTH, 5 + SALT_LENGTH + IV_LENGTH);
+    const blobTag = blob.subarray(5 + SALT_LENGTH + IV_LENGTH, HEADER_LENGTH);
+    if (info.salt !== Buffer.from(blobSalt).toString('base64') ||
+        info.iv !== Buffer.from(blobIv).toString('base64') ||
+        info.authTag !== Buffer.from(blobTag).toString('base64')) {
+        throw new SecurityError('TAMPERED', 'secrets.enc 与 manifest 加密参数不一致（可能被篡改）');
+    }
+    let key;
+    try {
+        key = await deriveKey(password, blobSalt, info.kdfParams);
+    }
+    catch (err) {
+        throw new SecurityError('BAD_PASSWORD', `密钥派生失败: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, blobIv);
+    decipher.setAuthTag(blobTag);
+    try {
+        const decrypted = Buffer.concat([
+            decipher.update(blob.subarray(HEADER_LENGTH)),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    catch {
+        throw new SecurityError('BAD_PASSWORD', '解密认证失败：密码错误或密文被篡改');
+    }
+}
+/** 密码强度校验（导出 UI 用；≥8 字符，建议 12+ 混合） */
+export function validatePasswordStrength(password) {
+    if (password.length < 8) {
+        return { ok: false, message: '密码至少 8 个字符（建议 12+ 且含大小写与数字）' };
+    }
+    const variety = /[a-z]/.test(password) && /[A-Z]/.test(password) && /[0-9]/.test(password);
+    if (password.length < 12 && !variety) {
+        return { ok: true, message: '密码强度偏弱：建议 12+ 字符且混合大小写与数字' };
+    }
+    return { ok: true, message: '' };
+}
+/**
+ * 创建 core `EncryptionProvider`（对齐 core/types.ts 契约）。
+ * encrypt 使用闭包持有密码；decrypt 使用调用方传入的密码（支持换密码解密）。
+ */
+export function createEncryptionProvider(password) {
+    return {
+        async encrypt(plaintext) {
+            return encryptCredentials(plaintext, password);
+        },
+        async decrypt(blob, info, pw) {
+            return decryptCredentials(blob, info, pw);
+        },
+    };
+}
+//# sourceMappingURL=encryption.js.map

package/lib/security/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAKvB,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAW,CAAC;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAC7B,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAI1E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IACjC,YAAY,IAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;AACrE,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,SAAsC,aAAa;IAEnD,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAElD,MAAM,IAAI,GAAmB;QAC3B,SAAS,EAAE,aAAa;QACxB,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,EAAE,GAAG,aAAa,EAAE;QAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,cAAc;KACxB,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAgB,EAChB,IAAoB,EACpB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,iBAAiB,KAAK,WAAW,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACzB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;IAC1E,IACE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC7C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,OAAO,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,IAAoB,EAAE,EAAU;YAC9D,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/security/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 安全模块公共出口（m4-security）：
+ *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *
+ * 与 core 的注入点对齐：
+ *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
+ *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
+ *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
+ *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
+ *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
+ */
+export * from './secret-scanner.ts';
+export * from './encryption.ts';
+export * from './integrity.ts';
+export * from './zip-security.ts';
+export * from './redaction.ts';

package/lib/security/index.js

@@ -0,0 +1,17 @@
+/**
+ * 安全模块公共出口（m4-security）：
+ *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *
+ * 与 core 的注入点对齐：
+ *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
+ *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
+ *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
+ *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
+ *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
+ */
+export * from "./secret-scanner.js";
+export * from "./encryption.js";
+export * from "./integrity.js";
+export * from "./zip-security.js";
+export * from "./redaction.js";
+//# sourceMappingURL=index.js.map

package/lib/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}

package/lib/security/integrity.d.ts

@@ -0,0 +1,30 @@
+import type { ChecksumVerifyResult } from '../utils/hashing.ts';
+export declare const CHECKSUMS_ALGORITHM: "sha256";
+export declare const SHA256_HEX_RE: RegExp;
+/** 与 core ZIP 条目数上限一致的默认表大小上限 */
+export declare const DEFAULT_MAX_CHECKSUM_ENTRIES = 10000;
+export interface ChecksumsTableOptions {
+    maxEntries?: number;
+}
+/**
+ * 生成 checksums 表（对齐 core 扁平格式；内部复用 core buildChecksums）。
+ * entries.name 必须是 ZIP 内正斜杠相对路径。
+ */
+export declare function buildChecksums(entries: {
+    name: string;
+    data: Uint8Array;
+}[]): Record<string, string>;
+/**
+ * 解析并结构校验 checksums.json 原文。
+ * 非法结构 / 危险键 / 值非 SHA-256 hex / 条目数超限 → 抛错（不可信输入，宁可拒绝）。
+ */
+export declare function parseChecksumsTable(raw: string, opts?: ChecksumsTableOptions): Record<string, string>;
+/**
+ * 校验：表内每个路径必须在 entries 中存在且 SHA-256 一致；entries 多余文件（manifest/自身）不参与。
+ * 返回 { ok, mismatches, missing }（缺失与不符统一列入 mismatches 的展开视图，mismatches 只含不符）。
+ */
+export declare function verifyChecksums(entries: ReadonlyMap<string, Uint8Array>, table: Record<string, string>): ChecksumVerifyResult;
+/** 一步到位：解析 checksums.json 原文并校验（解析失败抛错；不符返回 {ok:false,...}） */
+export declare function verifyChecksumsJson(entries: ReadonlyMap<string, Uint8Array>, raw: string, opts?: ChecksumsTableOptions): ChecksumVerifyResult;
+/** 人类可读的不匹配摘要（给「Backup integrity check failed」错误消息用） */
+export declare function describeMismatches(result: ChecksumVerifyResult): string;

package/lib/security/integrity.js

@@ -0,0 +1,78 @@
+/**
+ * 配置完整性（规范 §18 / 设计 §9.7 / core utils/hashing.ts 的强化层）。
+ *
+ * checksums.json 实际格式由 core exporter 定死（`src/core/exporter.ts`）：
+ * 扁平对象 `{ "<ZIP 内相对路径>": "<sha256 hex>" }`，覆盖除 manifest.json 与自身外的全部条目；
+ * core analyzer 导入时按此解析（`as Record<string, string>`）。本模块**对齐该格式**，不擅自改结构。
+ *
+ * 强化点（在 core hashing 之上）：
+ *  - 解析防线：结构校验（对象、值必须 64 位 hex）、条目数上限、拒绝 `__proto__`/`constructor`/`prototype`
+ *    危险键（防 prototype pollution）；解析失败抛错 → 导入方归为「Backup integrity check failed」。
+ *  - 一步到位 `verifyChecksumsJson`：解析 + 校验合并，供 m5/导入管线直接调用。
+ *  - 校验语义：表内每个路径必须在条目集合中存在且 SHA-256 一致；缺失与不符均计入 mismatches。
+ */
+import { parseJsonSafe } from "../utils/json.js";
+import { buildChecksums as coreBuildChecksums, verifyChecksums as coreVerifyChecksums, } from "../utils/hashing.js";
+export const CHECKSUMS_ALGORITHM = 'sha256';
+export const SHA256_HEX_RE = /^[0-9a-f]{64}$/i;
+/** 与 core ZIP 条目数上限一致的默认表大小上限 */
+export const DEFAULT_MAX_CHECKSUM_ENTRIES = 10_000;
+/** 危险键（原型污染向量）：解析时拒绝 */
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * 生成 checksums 表（对齐 core 扁平格式；内部复用 core buildChecksums）。
+ * entries.name 必须是 ZIP 内正斜杠相对路径。
+ */
+export function buildChecksums(entries) {
+    return coreBuildChecksums(entries);
+}
+/**
+ * 解析并结构校验 checksums.json 原文。
+ * 非法结构 / 危险键 / 值非 SHA-256 hex / 条目数超限 → 抛错（不可信输入，宁可拒绝）。
+ */
+export function parseChecksumsTable(raw, opts = {}) {
+    const maxEntries = opts.maxEntries ?? DEFAULT_MAX_CHECKSUM_ENTRIES;
+    const parsed = parseJsonSafe(raw);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('checksums.json 必须是 JSON 对象');
+    }
+    const entries = Object.entries(parsed);
+    if (entries.length > maxEntries) {
+        throw new Error(`checksums.json 条目数 ${entries.length} 超过上限 ${maxEntries}`);
+    }
+    const table = {};
+    for (const [relPath, hash] of entries) {
+        if (DANGEROUS_KEYS.has(relPath)) {
+            throw new Error(`checksums.json 含危险键 "${relPath}"，已拒绝`);
+        }
+        if (relPath === '' || relPath.includes('\\') || relPath.startsWith('/')) {
+            throw new Error(`checksums.json 含非法相对路径 "${relPath}"`);
+        }
+        if (typeof hash !== 'string' || !SHA256_HEX_RE.test(hash)) {
+            throw new Error(`checksums.json["${relPath}"] 不是合法的 SHA-256 hex`);
+        }
+        table[relPath] = hash;
+    }
+    return table;
+}
+/**
+ * 校验：表内每个路径必须在 entries 中存在且 SHA-256 一致；entries 多余文件（manifest/自身）不参与。
+ * 返回 { ok, mismatches, missing }（缺失与不符统一列入 mismatches 的展开视图，mismatches 只含不符）。
+ */
+export function verifyChecksums(entries, table) {
+    return coreVerifyChecksums(entries, table);
+}
+/** 一步到位：解析 checksums.json 原文并校验（解析失败抛错；不符返回 {ok:false,...}） */
+export function verifyChecksumsJson(entries, raw, opts = {}) {
+    const table = parseChecksumsTable(raw, opts);
+    return verifyChecksums(entries, table);
+}
+/** 人类可读的不匹配摘要（给「Backup integrity check failed」错误消息用） */
+export function describeMismatches(result) {
+    const parts = [
+        ...result.mismatches.map((m) => `"${m}" (hash 不符)`),
+        ...result.missing.map((m) => `"${m}" (缺失)`),
+    ];
+    return parts.join(', ');
+}
+//# sourceMappingURL=integrity.js.map

package/lib/security/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/security/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,cAAc,IAAI,kBAAkB,EACpC,eAAe,IAAI,mBAAmB,GACvC,MAAM,qBAAqB,CAAC;AAG7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,iCAAiC;AACjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,wBAAwB;AACxB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAM1E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA6C;IAC1E,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,SAAS,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,sBAAsB,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAwC,EACxC,KAA6B;IAE7B,OAAO,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CACjC,OAAwC,EACxC,GAAW,EACX,OAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;QACnD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC5C,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/lib/security/redaction.d.ts

@@ -0,0 +1,26 @@
+/**
+ * 日志/文本脱敏（规范 §24 / 设计 §9.8 / core utils/logger.ts 的强化层）。
+ *
+ * 与 core logger.redact 的分工：core 版按固定字段名单做子串替换（不感知字段边界）；
+ * 本模块为强化版，两模式：
+ *  1. **结构化字段形态**：JSON `"field": "value"` / `field=value` / `field: value`，
+ *     字段名命中敏感名单（复用 secret-scanner 的 `isSensitiveFieldName`，单一来源防漂移）→ 值替换。
+ *  2. **值形状模式**：与字段名无关，文本任意位置出现 sk- / JWT / AKIA / GitHub PAT /
+ *     PEM 私钥 / Bearer / URL query 的敏感参数值 → 替换。
+ *
+ * 幂等性：替换产物 `***REDACTED***` 不匹配任何模式，重复 redact 结果不变；
+ * JSON 行的引号结构保留（输出仍是合法 JSON）。
+ */
+import { DEFAULT_SECRET_FIELD_NAMES } from './secret-scanner.ts';
+export declare const REDACTED = "***REDACTED***";
+/**
+ * 文本脱敏（幂等）。blacklist 为**附加**规范化字段名（小写无分隔符，如 'clientsecret'）。
+ * 输出仍保留结构化形态（JSON 行合法）。
+ */
+export declare function redact(text: string, blacklist?: readonly string[]): string;
+/** 对象级掩码：字段名命中敏感名单 → 整值替换（返回新对象，不改原对象；结构与类型保留） */
+export declare function redactValue(value: unknown, blacklist?: readonly string[]): unknown;
+/** 预编译脱敏器（多次调用复用；blacklist 为附加规范化字段名） */
+export declare function createRedactor(blacklist?: readonly string[]): (text: string) => string;
+/** 默认名单（文档用；redact 的默认附加名单为空，内置判定已含 DEFAULT_SECRET_FIELD_NAMES） */
+export { DEFAULT_SECRET_FIELD_NAMES };

package/lib/security/redaction.js

@@ -0,0 +1,95 @@
+/**
+ * 日志/文本脱敏（规范 §24 / 设计 §9.8 / core utils/logger.ts 的强化层）。
+ *
+ * 与 core logger.redact 的分工：core 版按固定字段名单做子串替换（不感知字段边界）；
+ * 本模块为强化版，两模式：
+ *  1. **结构化字段形态**：JSON `"field": "value"` / `field=value` / `field: value`，
+ *     字段名命中敏感名单（复用 secret-scanner 的 `isSensitiveFieldName`，单一来源防漂移）→ 值替换。
+ *  2. **值形状模式**：与字段名无关，文本任意位置出现 sk- / JWT / AKIA / GitHub PAT /
+ *     PEM 私钥 / Bearer / URL query 的敏感参数值 → 替换。
+ *
+ * 幂等性：替换产物 `***REDACTED***` 不匹配任何模式，重复 redact 结果不变；
+ * JSON 行的引号结构保留（输出仍是合法 JSON）。
+ */
+import { DEFAULT_SECRET_FIELD_NAMES, isSensitiveFieldName } from "./secret-scanner.js";
+export const REDACTED = '***REDACTED***';
+/* ---------------- 结构化字段形态 ---------------- */
+const JSON_FIELD_RE = /"([A-Za-z0-9_.\-]+)"\s*:\s*"([^"]*)"/g;
+/** kv 值到空白/逗号/分号/&（& 截断：避免吞掉 URL query 的后续参数） */
+const KV_FIELD_RE = /([A-Za-z0-9_.\-]+)\s*=\s*([^\s,;&]+)/g;
+/** colon 值允许空格（如 `Authorization: Bearer xyz`），到逗号/分号/右大括号截断 */
+const COLON_FIELD_RE = /([A-Za-z0-9_.\-]+)\s*:\s*([^,;}]+)/g;
+/* ---------------- 值形状模式（包含式，字段名无关） ---------------- */
+const VALUE_PATTERNS = [
+    { name: 'openai-key', re: /sk-[A-Za-z0-9_-]{8,}/g },
+    { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g },
+    { name: 'aws-access-key', re: /AKIA[0-9A-Z]{16}/g },
+    { name: 'github-token', re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+    { name: 'github-pat', re: /github_pat_[A-Za-z0-9_]{20,}/g },
+    { name: 'pem-private-key', re: /-----BEGIN [A-Za-z0-9 ]*PRIVATE KEY-----/g },
+    { name: 'bearer-token', re: /Bearer [A-Za-z0-9._~+/=-]{8,}/g },
+];
+/** URL query 中的敏感参数值（保留参数名，只替换值） */
+const URL_QUERY_RE = /([?&](?:token|api[_-]?key|key|secret|access[_-]?token|password|auth)=)([^&\s"']+)/gi;
+/* ---------------- redact ---------------- */
+function replaceSensitiveField(text, re, blacklist) {
+    return text.replace(re, (match, field, value) => {
+        if (!isSensitiveFieldName(field, blacklist))
+            return match;
+        if (value === '')
+            return match;
+        // 只替换值部分，保留原分隔符与引号形态（JSON `"f": "v"` / kv `f=v` / colon `f: v`）
+        const idx = match.lastIndexOf(value);
+        return match.slice(0, idx) + REDACTED + match.slice(idx + value.length);
+    });
+}
+/**
+ * 文本脱敏（幂等）。blacklist 为**附加**规范化字段名（小写无分隔符，如 'clientsecret'）。
+ * 输出仍保留结构化形态（JSON 行合法）。
+ */
+export function redact(text, blacklist = []) {
+    let out = text;
+    // 1. 结构化字段形态（顺序：JSON → kv → colon；JSON 键不会被后续形态二次命中）
+    out = replaceSensitiveField(out, JSON_FIELD_RE, blacklist);
+    out = replaceSensitiveField(out, KV_FIELD_RE, blacklist);
+    out = replaceSensitiveField(out, COLON_FIELD_RE, blacklist);
+    // 2. 值形状模式（字段名无关，包含式）
+    for (const { re } of VALUE_PATTERNS) {
+        re.lastIndex = 0;
+        out = out.replace(re, REDACTED);
+    }
+    out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+    return out;
+}
+/** 对象级掩码：字段名命中敏感名单 → 整值替换（返回新对象，不改原对象；结构与类型保留） */
+export function redactValue(value, blacklist = []) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (value instanceof Uint8Array)
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactValue(v, blacklist));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = isSensitiveFieldName(k, blacklist) ? REDACTED : redactValue(v, blacklist);
+    }
+    return out;
+}
+/** 预编译脱敏器（多次调用复用；blacklist 为附加规范化字段名） */
+export function createRedactor(blacklist = []) {
+    const compiled = { json: JSON_FIELD_RE, kv: KV_FIELD_RE, colon: COLON_FIELD_RE };
+    return (text) => {
+        let out = replaceSensitiveField(text, new RegExp(compiled.json.source, 'g'), blacklist);
+        out = replaceSensitiveField(out, new RegExp(compiled.kv.source, 'g'), blacklist);
+        out = replaceSensitiveField(out, new RegExp(compiled.colon.source, 'g'), blacklist);
+        for (const { re } of VALUE_PATTERNS) {
+            re.lastIndex = 0;
+            out = out.replace(re, REDACTED);
+        }
+        out = out.replace(URL_QUERY_RE, `$1${REDACTED}`);
+        return out;
+    };
+}
+/** 默认名单（文档用；redact 的默认附加名单为空，内置判定已含 DEFAULT_SECRET_FIELD_NAMES） */
+export { DEFAULT_SECRET_FIELD_NAMES };
+//# sourceMappingURL=redaction.js.map

package/lib/security/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/security/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEvF,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAEzC,+CAA+C;AAE/C,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,iDAAiD;AACjD,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAC5D,+DAA+D;AAC/D,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAE7D,wDAAwD;AAExD,MAAM,cAAc,GAAmC;IACrD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,uBAAuB,EAAE;IACnD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gEAAgE,EAAE;IACrF,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,mBAAmB,EAAE;IACnD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,6BAA6B,EAAE;IAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,+BAA+B,EAAE;IAC3D,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,2CAA2C,EAAE;IAC5E,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,gCAAgC,EAAE;CAC/D,CAAC;AAEF,oCAAoC;AACpC,MAAM,YAAY,GAAG,qFAAqF,CAAC;AAE3G,8CAA8C;AAE9C,SAAS,qBAAqB,CAAC,IAAY,EAAE,EAAU,EAAE,SAA4B;IACnF,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;QACtE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,gEAAgE;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,YAA+B,EAAE;IACpE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,qDAAqD;IACrD,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3D,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACzD,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC5D,sBAAsB;IACtB,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,YAA+B,EAAE;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,cAAc,CAAC,YAA+B,EAAE;IAC9D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACjF,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACxF,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACjF,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACpF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;YACpC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,0BAA0B,EAAE,CAAC"}

package/lib/security/secret-scanner.d.ts

@@ -0,0 +1,48 @@
+import type { SecretScanner, SensitiveHit } from '../core/types.ts';
+/** 剥离占位（与 core defaultSecretScanner 语义一致：空串 = 需补录提示） */
+export declare const REDACTED_PLACEHOLDER = "";
+/**
+ * 敏感字段名单（规范化名：小写、无分隔符）。
+ * 覆盖规范 §6 原始清单 + 设计 §7.2 + core logger 名单，并保持克制以防误伤
+ * （不收录 `key`/`session` 等过宽子串——`sessionIds`/`monkey` 不得中招）。
+ */
+export declare const DEFAULT_SECRET_FIELD_NAMES: readonly string[];
+/** 引用字段（值只是「名字」而非秘密）：规范化精确命中即豁免 */
+export declare const DEFAULT_REFERENCE_FIELDS: readonly string[];
+/** 值形状强模式（默认开）：一眼可辨的密钥/凭据形态（包含式：值内任意位置出现即命中） */
+export interface ValuePattern {
+    name: string;
+    re: RegExp;
+}
+export declare const SECRET_VALUE_PATTERNS: readonly ValuePattern[];
+export interface SecretScannerOptions {
+    /** 附加敏感字段名（任意原始形态，内部会规范化） */
+    extraFieldNames?: string[];
+    /** 附加引用字段名（规范化后精确命中即豁免） */
+    extraReferenceFields?: string[];
+    /** 值形状启发式开关（默认 true） */
+    valuePatterns?: boolean;
+    /** 高熵长串启发式（默认 false：误伤风险高，需显式开启） */
+    highEntropy?: boolean;
+    /** 最大递归深度（默认 64，与 JSON 深度上限一致） */
+    maxDepth?: number;
+}
+/** 规范化字段名：小写 + 去 `_-. ` 分隔符（用于名单匹配） */
+export declare function normalizeFieldName(name: string): string;
+/** 是否为「环境变量名」形态（全大写下划线，如 DEEPSEEK_API_KEY）→ 视为引用名 */
+export declare function isEnvVarName(value: string): boolean;
+/** 字段名是否命中敏感名单（规范化后精确 / 敏感后缀 / 敏感前缀） */
+export declare function isSensitiveFieldName(field: string, extra?: readonly string[]): boolean;
+/** 是否为引用字段（值只是名字，不剥离） */
+export declare function isReferenceField(field: string, extra?: readonly string[]): boolean;
+/** 值是否命中强模式 secret 形状（返回命中模式名；未命中返回 null） */
+export declare function matchSecretValuePattern(value: string): string | null;
+/** 递归扫描 + 剥离（纯函数，不改原数据；深度保护；返回清洗后数据与命中清单） */
+export declare function scanAndRedact(data: unknown, opts?: SecretScannerOptions): {
+    sanitized: unknown;
+    hits: SensitiveHit[];
+};
+/** 文本级扫描：逐行找「敏感字段名 = 值」与「值形状」命中（只报告，不修改文本） */
+export declare function scanText(text: string, opts?: SecretScannerOptions): SensitiveHit[];
+/** 强化版 SecretScanner（对齐 core SecretScanner 契约，可注入 Exporter.scanner） */
+export declare function createSecretScanner(opts?: SecretScannerOptions): SecretScanner;