fdb2 1.0.26 → 1.0.31

package/dist/server/core/guard.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeToken = computeToken;
+exports.verifyToken = verifyToken;
+exports.isTokenUsed = isTokenUsed;
+exports.markTokenUsed = markTokenUsed;
+exports.checkReadonly = checkReadonly;
+exports.confirmThreshold = confirmThreshold;
+exports.checkThreshold = checkThreshold;
+exports.gateWrite = gateWrite;
+exports.audit = audit;
+/**
+ * 写操作护栏
+ *  - 全局只读模式（config.readonly=true 时所有写操作需 --write）
+ *  - 破坏性操作必须带 --yes
+ *  - 有条件写操作（update/delete）必须 先 dry-run 拿 confirmToken，再带 token 执行
+ *  - 影响行数超过阈值需 --force
+ *  - token 与 op+sql+params 绑定，5 分钟有效（进程无关，跨调用可验证）
+ */
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const config_1 = require("./config");
+const errors_1 = require("./errors");
+const data_dir_1 = require("../utils/data-dir");
+const TOKEN_WINDOW_MS = 5 * 60 * 1000;
+function computeToken(op, sql, params) {
+    const secret = (0, config_1.getSecret)();
+    const bucket = Math.floor(Date.now() / TOKEN_WINDOW_MS);
+    const payload = `${op}|${sql}|${JSON.stringify(params)}|${bucket}`;
+    return crypto.createHmac('sha256', secret).update(payload).digest('hex').slice(0, 24);
+}
+function verifyToken(token, op, sql, params) {
+    if (!token)
+        return false;
+    const secret = (0, config_1.getSecret)();
+    const now = Date.now();
+    const bucket = Math.floor(now / TOKEN_WINDOW_MS);
+    for (let back = 0; back < 2; back++) {
+        const b = bucket - back;
+        const payload = `${op}|${sql}|${JSON.stringify(params)}|${b}`;
+        const expect = crypto.createHmac('sha256', secret).update(payload).digest('hex').slice(0, 24);
+        if (expect === token)
+            return true;
+    }
+    return false;
+}
+// ============ 一次性令牌（防重放） ============
+const USED_TOKENS_FILE = 'used-tokens.json';
+function loadUsedTokens() {
+    (0, data_dir_1.ensureDataDir)();
+    const p = (0, data_dir_1.getDataPath)(USED_TOKENS_FILE);
+    try {
+        if (fs.existsSync(p)) {
+            const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+            if (raw && typeof raw === 'object')
+                return raw;
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return {};
+}
+function saveUsedTokens(store) {
+    const p = (0, data_dir_1.getDataPath)(USED_TOKENS_FILE);
+    try {
+        fs.writeFileSync(p, JSON.stringify(store), 'utf8');
+        if (process.platform !== 'win32')
+            fs.chmodSync(p, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+}
+function pruneUsedTokens(store) {
+    const now = Date.now();
+    const next = {};
+    for (const k of Object.keys(store)) {
+        if ((store[k] || 0) > now)
+            next[k] = store[k];
+    }
+    return next;
+}
+/** 令牌是否已使用（一次性，防重放） */
+function isTokenUsed(token) {
+    const store = loadUsedTokens();
+    return !!store[token] && store[token] > Date.now();
+}
+/** 标记令牌已使用，保留到时间窗结束以便过期清理 */
+function markTokenUsed(token) {
+    const store = pruneUsedTokens(loadUsedTokens());
+    store[token] = Date.now() + TOKEN_WINDOW_MS;
+    saveUsedTokens(store);
+}
+/** 检查全局只读模式 */
+function checkReadonly(write) {
+    const cfg = (0, config_1.getConfig)();
+    if (cfg.readonly && !write) {
+        throw new errors_1.AppError('WRITE_BLOCKED', '当前为只读模式，写操作被禁止', {
+            hint: '如需临时允许，请加 --write 或执行 fdb2 config set readonly false'
+        });
+    }
+}
+/** 影响行数阈值 */
+function confirmThreshold() {
+    return (0, config_1.getConfig)().confirmThreshold ?? 100;
+}
+/** 检查行数是否超阈值（超阈值需 --force） */
+function checkThreshold(rows, force) {
+    if (rows > confirmThreshold() && !force) {
+        throw new errors_1.AppError('FORCE_REQUIRED', `操作将影响 ${rows} 行，超过阈值 ${confirmThreshold()}`, {
+            hint: '确认无误后请附加 --force 重新 dry-run/执行'
+        });
+    }
+}
+/**
+ * 写操作统一入口：
+ *  - dryRun=true：估算行数，返回 token（不执行）
+ *  - 有 confirm：校验 token 并放行
+ *  - 破坏性操作（destructive=true）还需 --yes
+ */
+function gateWrite(opts) {
+    checkReadonly(opts.write);
+    const { op, sql, params } = opts;
+    const destructive = !!opts.destructive;
+    if (opts.dryRun) {
+        // 预演：校验阈值但不执行
+        if (opts.estimatedRows != null) {
+            checkThreshold(opts.estimatedRows, opts.force);
+        }
+        const token = computeToken(op, sql, params);
+        return { mode: 'dryrun', token };
+    }
+    // 正式执行路径
+    if (opts.confirm) {
+        if (!verifyToken(opts.confirm, op, sql, params)) {
+            throw new errors_1.AppError('CONFIRM_EXPIRED', '确认令牌无效或已过期', {
+                hint: '请重新执行 dry-run 获取新令牌'
+            });
+        }
+        // 一次性令牌：用过即作废，防止同一令牌重复执行写操作
+        if (isTokenUsed(opts.confirm)) {
+            throw new errors_1.AppError('TOKEN_REPLAYED', '确认令牌已被使用', {
+                hint: '令牌一次性有效，请重新执行 dry-run 获取新令牌'
+            });
+        }
+        if (destructive && !opts.yes) {
+            throw new errors_1.AppError('CONFIRM_REQUIRED', '破坏性操作还需 --yes 二次确认', {
+                hint: '请附加 --yes 再次执行'
+            });
+        }
+        if (opts.estimatedRows != null) {
+            checkThreshold(opts.estimatedRows, opts.force);
+        }
+        markTokenUsed(opts.confirm);
+        return { mode: 'execute' };
+    }
+    // 无 dry-run 也无 token
+    if (destructive) {
+        throw new errors_1.AppError('CONFIRM_REQUIRED', '破坏性操作必须先 dry-run 获取确认令牌，再携带 --confirm <token> 与 --yes 执行', {
+            hint: '步骤：1) fdb2 ... --dry-run  2) fdb2 ... --confirm <token> --yes'
+        });
+    }
+    throw new errors_1.AppError('REQUIRE_DRYRUN', '写操作必须先 dry-run 预演', {
+        hint: '步骤：1) fdb2 ... --dry-run  2) fdb2 ... --confirm <token>'
+    });
+}
+/** 审计一个操作 */
+function audit(opts) {
+    // 延迟 require 避免循环依赖
+    const { appendAudit } = require('./config');
+    appendAudit({ ...opts });
+}
+//# sourceMappingURL=guard.js.map

package/dist/server/core/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../server/core/guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,oCAKC;AAED,kCAYC;AAuCD,kCAGC;AAGD,sCAIC;AAGD,sCAOC;AAGD,4CAEC;AAGD,wCAMC;AAQD,8BA8DC;AAGD,sBAeC;AA5MD;;;;;;;GAOG;AACH,+CAAiC;AACjC,uCAAyB;AACzB,qCAAgD;AAChD,qCAAoC;AACpC,gDAA+D;AAU/D,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAgB,YAAY,CAAC,EAAU,EAAE,GAAW,EAAE,MAAa;IACjE,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;IACnE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAgB,WAAW,CAAC,KAAa,EAAE,EAAU,EAAE,GAAW,EAAE,MAAa;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;IACjD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uCAAuC;AACvC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,SAAS,cAAc;IACrB,IAAA,wBAAa,GAAE,CAAC;IAChB,MAAM,CAAC,GAAG,IAAA,sBAAW,EAAC,gBAAgB,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAA6B,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,KAA6B;IACnD,MAAM,CAAC,GAAG,IAAA,sBAAW,EAAC,gBAAgB,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAA6B;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uBAAuB;AACvB,SAAgB,WAAW,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED,6BAA6B;AAC7B,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC5C,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,eAAe;AACf,SAAgB,aAAa,CAAC,KAA0B;IACtD,MAAM,GAAG,GAAG,IAAA,kBAAS,GAAE,CAAC;IACxB,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAQ,CAAC,eAAe,EAAE,gBAAgB,EAAE;YACpD,IAAI,EAAE,sDAAsD;SAC7D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,aAAa;AACb,SAAgB,gBAAgB;IAC9B,OAAO,IAAA,kBAAS,GAAE,CAAC,gBAAgB,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED,8BAA8B;AAC9B,SAAgB,cAAc,CAAC,IAAY,EAAE,KAA0B;IACrE,IAAI,IAAI,GAAG,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAQ,CAAC,gBAAgB,EAAE,SAAS,IAAI,WAAW,gBAAgB,EAAE,EAAE,EAAE;YACjF,IAAI,EAAE,gCAAgC;SACvC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CACvB,IAWC;IAED,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAEvC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,cAAc;QACd,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAC/B,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,SAAS;IACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,iBAAQ,CAAC,iBAAiB,EAAE,YAAY,EAAE;gBAClD,IAAI,EAAE,qBAAqB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,4BAA4B;QAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAQ,CAAC,gBAAgB,EAAE,UAAU,EAAE;gBAC/C,IAAI,EAAE,6BAA6B;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,iBAAQ,CAAC,kBAAkB,EAAE,oBAAoB,EAAE;gBAC3D,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAC/B,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,qBAAqB;IACrB,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAQ,CAAC,kBAAkB,EAAE,0DAA0D,EAAE;YACjG,IAAI,EAAE,+DAA+D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,iBAAQ,CAAC,gBAAgB,EAAE,mBAAmB,EAAE;QACxD,IAAI,EAAE,yDAAyD;KAChE,CAAC,CAAC;AACL,CAAC;AAED,aAAa;AACb,SAAgB,KAAK,CAAC,IAWrB;IACC,oBAAoB;IACpB,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,UAAU,CAA8B,CAAC;IACzE,WAAW,CAAC,EAAE,GAAG,IAAI,EAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/server/core/guard.ts

@@ -0,0 +1,205 @@
+/**
+ * 写操作护栏
+ *  - 全局只读模式（config.readonly=true 时所有写操作需 --write）
+ *  - 破坏性操作必须带 --yes
+ *  - 有条件写操作（update/delete）必须 先 dry-run 拿 confirmToken，再带 token 执行
+ *  - 影响行数超过阈值需 --force
+ *  - token 与 op+sql+params 绑定，5 分钟有效（进程无关，跨调用可验证）
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { getSecret, getConfig } from './config';
+import { AppError } from './errors';
+import { getDataPath, ensureDataDir } from '../utils/data-dir';
+
+export interface WriteOpts {
+  dryRun?: boolean;
+  confirm?: string | null;
+  yes?: boolean;
+  force?: boolean;
+  write?: boolean;
+}
+
+const TOKEN_WINDOW_MS = 5 * 60 * 1000;
+
+export function computeToken(op: string, sql: string, params: any[]): string {
+  const secret = getSecret();
+  const bucket = Math.floor(Date.now() / TOKEN_WINDOW_MS);
+  const payload = `${op}|${sql}|${JSON.stringify(params)}|${bucket}`;
+  return crypto.createHmac('sha256', secret).update(payload).digest('hex').slice(0, 24);
+}
+
+export function verifyToken(token: string, op: string, sql: string, params: any[]): boolean {
+  if (!token) return false;
+  const secret = getSecret();
+  const now = Date.now();
+  const bucket = Math.floor(now / TOKEN_WINDOW_MS);
+  for (let back = 0; back < 2; back++) {
+    const b = bucket - back;
+    const payload = `${op}|${sql}|${JSON.stringify(params)}|${b}`;
+    const expect = crypto.createHmac('sha256', secret).update(payload).digest('hex').slice(0, 24);
+    if (expect === token) return true;
+  }
+  return false;
+}
+
+// ============ 一次性令牌（防重放） ============
+const USED_TOKENS_FILE = 'used-tokens.json';
+
+function loadUsedTokens(): Record<string, number> {
+  ensureDataDir();
+  const p = getDataPath(USED_TOKENS_FILE);
+  try {
+    if (fs.existsSync(p)) {
+      const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+      if (raw && typeof raw === 'object') return raw as Record<string, number>;
+    }
+  } catch {
+    /* ignore */
+  }
+  return {};
+}
+
+function saveUsedTokens(store: Record<string, number>): void {
+  const p = getDataPath(USED_TOKENS_FILE);
+  try {
+    fs.writeFileSync(p, JSON.stringify(store), 'utf8');
+    if (process.platform !== 'win32') fs.chmodSync(p, 0o600);
+  } catch {
+    /* ignore */
+  }
+}
+
+function pruneUsedTokens(store: Record<string, number>): Record<string, number> {
+  const now = Date.now();
+  const next: Record<string, number> = {};
+  for (const k of Object.keys(store)) {
+    if ((store[k] || 0) > now) next[k] = store[k];
+  }
+  return next;
+}
+
+/** 令牌是否已使用（一次性，防重放） */
+export function isTokenUsed(token: string): boolean {
+  const store = loadUsedTokens();
+  return !!store[token] && store[token] > Date.now();
+}
+
+/** 标记令牌已使用，保留到时间窗结束以便过期清理 */
+export function markTokenUsed(token: string): void {
+  const store = pruneUsedTokens(loadUsedTokens());
+  store[token] = Date.now() + TOKEN_WINDOW_MS;
+  saveUsedTokens(store);
+}
+
+/** 检查全局只读模式 */
+export function checkReadonly(write: boolean | undefined): void {
+  const cfg = getConfig();
+  if (cfg.readonly && !write) {
+    throw new AppError('WRITE_BLOCKED', '当前为只读模式，写操作被禁止', {
+      hint: '如需临时允许，请加 --write 或执行 fdb2 config set readonly false'
+    });
+  }
+}
+
+/** 影响行数阈值 */
+export function confirmThreshold(): number {
+  return getConfig().confirmThreshold ?? 100;
+}
+
+/** 检查行数是否超阈值（超阈值需 --force） */
+export function checkThreshold(rows: number, force: boolean | undefined): void {
+  if (rows > confirmThreshold() && !force) {
+    throw new AppError('FORCE_REQUIRED', `操作将影响 ${rows} 行，超过阈值 ${confirmThreshold()}`, {
+      hint: '确认无误后请附加 --force 重新 dry-run/执行'
+    });
+  }
+}
+
+/**
+ * 写操作统一入口：
+ *  - dryRun=true：估算行数，返回 token（不执行）
+ *  - 有 confirm：校验 token 并放行
+ *  - 破坏性操作（destructive=true）还需 --yes
+ */
+export function gateWrite(
+  opts: {
+    op: string;
+    sql: string;
+    params: any[];
+    estimatedRows?: number | null;
+    destructive?: boolean;
+    write?: boolean;
+    dryRun?: boolean;
+    confirm?: string | null;
+    yes?: boolean;
+    force?: boolean;
+  }
+): { mode: 'execute' | 'dryrun'; token?: string } {
+  checkReadonly(opts.write);
+
+  const { op, sql, params } = opts;
+  const destructive = !!opts.destructive;
+
+  if (opts.dryRun) {
+    // 预演：校验阈值但不执行
+    if (opts.estimatedRows != null) {
+      checkThreshold(opts.estimatedRows, opts.force);
+    }
+    const token = computeToken(op, sql, params);
+    return { mode: 'dryrun', token };
+  }
+
+  // 正式执行路径
+  if (opts.confirm) {
+    if (!verifyToken(opts.confirm, op, sql, params)) {
+      throw new AppError('CONFIRM_EXPIRED', '确认令牌无效或已过期', {
+        hint: '请重新执行 dry-run 获取新令牌'
+      });
+    }
+    // 一次性令牌：用过即作废，防止同一令牌重复执行写操作
+    if (isTokenUsed(opts.confirm)) {
+      throw new AppError('TOKEN_REPLAYED', '确认令牌已被使用', {
+        hint: '令牌一次性有效，请重新执行 dry-run 获取新令牌'
+      });
+    }
+    if (destructive && !opts.yes) {
+      throw new AppError('CONFIRM_REQUIRED', '破坏性操作还需 --yes 二次确认', {
+        hint: '请附加 --yes 再次执行'
+      });
+    }
+    if (opts.estimatedRows != null) {
+      checkThreshold(opts.estimatedRows, opts.force);
+    }
+    markTokenUsed(opts.confirm);
+    return { mode: 'execute' };
+  }
+
+  // 无 dry-run 也无 token
+  if (destructive) {
+    throw new AppError('CONFIRM_REQUIRED', '破坏性操作必须先 dry-run 获取确认令牌，再携带 --confirm <token> 与 --yes 执行', {
+      hint: '步骤：1) fdb2 ... --dry-run  2) fdb2 ... --confirm <token> --yes'
+    });
+  }
+  throw new AppError('REQUIRE_DRYRUN', '写操作必须先 dry-run 预演', {
+    hint: '步骤：1) fdb2 ... --dry-run  2) fdb2 ... --confirm <token>'
+  });
+}
+
+/** 审计一个操作 */
+export function audit(opts: {
+  action: string;
+  conn?: string | null;
+  database?: string | null;
+  table?: string | null;
+  kind?: string | null;
+  sql?: string | null;
+  params?: any;
+  rows?: number | null;
+  ok: boolean;
+  error?: string | null;
+}): void {
+  // 延迟 require 避免循环依赖
+  const { appendAudit } = require('./config') as typeof import('./config');
+  appendAudit({ ...opts } as any);
+}

package/dist/server/core/query-builder.d.ts

@@ -0,0 +1,72 @@
+import { FilterNode } from './filter-dsl';
+export interface ColumnMeta {
+    name: string;
+    type?: string;
+    isAutoIncrement?: boolean;
+    isPrimary?: boolean;
+    nullable?: boolean;
+}
+export interface CompiledQuery {
+    sql: string;
+    params: any[];
+}
+/** 内联模式下的字面量（oracle/mssql/sap 使用） */
+export declare function renderLiteral(dbType: string, value: any): string;
+export declare class SqlBuilder {
+    private dbType;
+    private quote;
+    private cols;
+    constructor(dbType: string, columns: ColumnMeta[]);
+    get hasColumns(): boolean;
+    /** 白名单校验 + 候选列名提示 */
+    checkField(field: string): void;
+    /** 编译过滤树 */
+    where(node: FilterNode | null): CompiledQuery;
+    private node;
+    private leaf;
+    /** 按列类型归一化值：int/decimal 列收到数字字符串时转 number，boolean 列归一 */
+    normValue(field: string, v: any): any;
+    /** '%P%' → 实际占位符（? 或 $n），并收集参数 */
+    private collapse;
+    private pick;
+    /** 将收集到的 param 数组按出现顺序填充占位符 */
+    static finalize(dbType: string, sql: string, params: any[]): CompiledQuery;
+}
+/** 由多条语句片段合成最终 SQL */
+export declare function compose(dbType: string, statement: {
+    sql: string;
+    params: any[];
+}): CompiledQuery;
+export declare function buildSelect(dbType: string, table: string, columns: ColumnMeta[], opts: {
+    select?: string[];
+    where?: FilterNode | null;
+    sorts?: Array<{
+        field: string;
+        dir: 'asc' | 'desc';
+    }>;
+    limit?: number | null;
+    offset?: number;
+    countOnly?: boolean;
+}): CompiledQuery;
+export declare function buildCount(dbType: string, table: string, columns: ColumnMeta[], where?: FilterNode | null): CompiledQuery;
+export declare function buildInsert(dbType: string, table: string, columns: ColumnMeta[], data: Record<string, any>, opts?: {
+    skipAutoIncrement?: boolean;
+}): CompiledQuery;
+export declare function buildUpdate(dbType: string, table: string, columns: ColumnMeta[], setData: Record<string, any>, where?: FilterNode | null): CompiledQuery;
+export declare function buildDelete(dbType: string, table: string, columns: ColumnMeta[], where?: FilterNode | null): CompiledQuery;
+/** 排序参数解析：field:asc|desc（可重复） */
+export declare function parseSorts(list: string[]): Array<{
+    field: string;
+    dir: 'asc' | 'desc';
+}>;
+/** Levenshtein 最短距离 */
+export declare function levenshtein(a: string, b: string): number;
+export declare function suggestField(input: string, candidates: string[]): string | null;
+/** SQL 语句类型分类（逃生舱防护） */
+export declare function classifySql(sql: string): {
+    kind: 'select' | 'write' | 'ddl' | 'multi' | 'other';
+    statements: string[];
+    hasWrite: boolean;
+    destructive: boolean;
+};
+//# sourceMappingURL=query-builder.d.ts.map

package/dist/server/core/query-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-builder.d.ts","sourceRoot":"","sources":["../../../server/core/query-builder.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,GAAG,EAAE,CAAC;CACf;AAUD,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,CAahE;AAoBD,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,IAAI,CAA0B;gBAE1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;IAOjD,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,qBAAqB;IACrB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAW/B,YAAY;IACZ,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,aAAa;IAM7C,OAAO,CAAC,IAAI;IAsBZ,OAAO,CAAC,IAAI;IAqEZ,yDAAyD;IACzD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,GAAG,GAAG;IAuBrC,kCAAkC;IAClC,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,IAAI;IAMZ,+BAA+B;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa;CAgB3E;AAED,sBAAsB;AACtB,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,GAAG,aAAa,CAEhG;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EAAE,EACrB,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,aAAa,CAuDf;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,aAAa,CAEzH;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EAAE,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,aAAa,CA4Bf;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GACxB,aAAa,CAiCf;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GACxB,aAAa,CASf;AAED,iCAAiC;AACjC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAA;CAAE,CAAC,CAUxF;AAED,uBAAuB;AACvB,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAexD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAa/E;AAED,wBAAwB;AACxB,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IACxC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IACrD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,CAeA"}