mcp-xdx-schema-ctx 1.1.9

package/dist/crypto-utils.js

@@ -0,0 +1,118 @@
+/**
+ * DPAPI 凭据加密工具
+ *
+ * Windows: 使用 System.Security.Cryptography.ProtectedData（绑定当前用户+机器）
+ * 非 Windows: 降级为 Base64 混淆（仅防无意泄露，不防定向攻击）
+ */
+import { execSync } from "child_process";
+import { platform } from "os";
+const DPAPI_PREFIX = "dpapi:";
+const OBFUSCATED_PREFIX = "obfuscated:";
+/** 需要加密的凭据字段名 */
+export const SENSITIVE_FIELDS = [
+    "DB_SERVER",
+    "DB_PASSWORD",
+    "DB_B_SERVER",
+    "DB_B_PASSWORD",
+];
+/** DPAPI 后缀映射：DB_PASSWORD → DB_PASSWORD_DPAPI */
+export function dpapiField(field) {
+    return `${field}_DPAPI`;
+}
+/** 反向：DB_PASSWORD_DPAPI → DB_PASSWORD */
+export function originalField(dpapiField) {
+    return dpapiField.replace(/_DPAPI$/, "");
+}
+/** 检测当前平台是否支持 DPAPI */
+export function isDpapiAvailable() {
+    return platform() === "win32";
+}
+/** 将 PowerShell 脚本编码为 Base64（UTF-16LE，PowerShell -EncodedCommand 需要） */
+function encodePsCommand(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+/** 执行固定 PowerShell 脚本，通过环境变量传递敏感数据 */
+function runPs(script, env) {
+    return execSync(`powershell -NoProfile -NonInteractive -EncodedCommand ${encodePsCommand(script)}`, {
+        encoding: "utf-8",
+        windowsHide: true,
+        env: env ? { ...process.env, ...env } : undefined,
+    });
+}
+const PS_ENCRYPT = `
+$ProgressPreference = 'SilentlyContinue'
+Add-Type -AssemblyName System.Security
+$bytes = [System.Text.Encoding]::UTF8.GetBytes($env:XDX_ENC_PWD)
+[Convert]::ToBase64String(
+  [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+)
+`;
+const PS_DECRYPT = `
+$ProgressPreference = 'SilentlyContinue'
+Add-Type -AssemblyName System.Security
+[System.Text.Encoding]::UTF8.GetString(
+  [System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String($env:XDX_DEC_PAYLOAD), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+)
+`;
+/**
+ * 加密明文 → 密文（前缀 dpapi:）
+ * Windows 上使用 DPAPI，非 Windows 使用 Base64 混淆
+ */
+export function encrypt(plaintext) {
+    if (!isDpapiAvailable()) {
+        // 非 Windows 平台：使用 Base64 混淆（非加密，仅防无意泄露）
+        return `${OBFUSCATED_PREFIX}${Buffer.from(plaintext, "utf-8").toString("base64")}`;
+    }
+    const result = runPs(PS_ENCRYPT, { XDX_ENC_PWD: plaintext });
+    return `${DPAPI_PREFIX}${result.trim()}`;
+}
+/**
+ * 解密密文 → 原文
+ * 自动识别 dpapi: / obfuscated: 前缀
+ */
+export function decrypt(encrypted) {
+    if (encrypted.startsWith("dpapi:")) {
+        const payload = encrypted.slice(DPAPI_PREFIX.length);
+        const result = runPs(PS_DECRYPT, { XDX_DEC_PAYLOAD: payload });
+        return result.trim();
+    }
+    if (encrypted.startsWith("obfuscated:")) {
+        return Buffer.from(encrypted.slice(OBFUSCATED_PREFIX.length), "base64").toString("utf-8");
+    }
+    // 兼容旧版 base64: 前缀
+    if (encrypted.startsWith("base64:")) {
+        return Buffer.from(encrypted.slice(7), "base64").toString("utf-8");
+    }
+    // 无前缀 → 视为明文（向后兼容）
+    return encrypted;
+}
+/**
+ * 遍历 process.env，解密所有 *_DPAPI 字段并注入为原始字段名
+ * 在 dotenv 加载之后、zod 校验之前调用
+ */
+export function decryptEnv() {
+    const failedFields = [];
+    for (const key of Object.keys(process.env)) {
+        if (!key.endsWith("_DPAPI"))
+            continue;
+        const val = process.env[key];
+        if (!val || val.length === 0)
+            continue;
+        const orig = originalField(key);
+        try {
+            const decrypted = decrypt(val);
+            if (decrypted) {
+                process.env[orig] = decrypted;
+                console.error(`[crypto] ✓ 已解密 ${key} → ${orig}`);
+            }
+        }
+        catch (err) {
+            failedFields.push(orig);
+            console.error(`[crypto] ✗ 解密 ${key} 失败:`, err.message);
+        }
+    }
+    if (failedFields.length > 0) {
+        console.error(`[crypto] ⚠ 以下字段解密失败，请检查 _DPAPI 密文是否正确，或使用明文配置: ${failedFields.join(", ")}`);
+    }
+}
+//# sourceMappingURL=crypto-utils.js.map

package/dist/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../src/crypto-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAE9B,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAExC,iBAAiB;AACjB,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW;IACX,aAAa;IACb,aAAa;IACb,eAAe;CACP,CAAC;AAEX,iDAAiD;AACjD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,GAAG,KAAK,QAAQ,CAAC;AAC1B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,gBAAgB;IAC9B,OAAO,QAAQ,EAAE,KAAK,OAAO,CAAC;AAChC,CAAC;AAED,wEAAwE;AACxE,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,sCAAsC;AACtC,SAAS,KAAK,CAAC,MAAc,EAAE,GAA4B;IACzD,OAAO,QAAQ,CACb,yDAAyD,eAAe,CAAC,MAAM,CAAC,EAAE,EAClF;QACE,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;KAClD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG;;;;;;;CAOlB,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;CAMlB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,wCAAwC;QACxC,OAAO,GAAG,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,mBAAmB;IACnB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEvC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;gBAC9B,OAAO,CAAC,KAAK,CAAC,kBAAkB,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,MAAM,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,kDAAkD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/db.d.ts

@@ -0,0 +1,10 @@
+import sql from "mssql";
+import { table, schemaSource, targetDatabases, envDb, envTable, userDb } from "./config.js";
+export declare function assertReadOnly(queryString: string): void;
+export declare function query<T = Record<string, unknown>>(queryString: string, poolName?: string): Promise<T[]>;
+/**
+ * 参数化只读查询 — 值通过 request.input() 绑定，杜绝字符串拼接注入。
+ * 用于 query_table_data 等需要把用户输入作为值传入的场景。
+ */
+export declare function queryWithParams<T = Record<string, unknown>>(queryString: string, params: Record<string, string | number | boolean | null>, poolName?: string): Promise<T[]>;
+export { sql, table, schemaSource, targetDatabases, envDb, envTable, userDb };

package/dist/db.js

@@ -0,0 +1,149 @@
+import sql from "mssql";
+import { env, table, schemaSource, targetDatabases, envDb, envTable, userDb, getSystemConfig, } from "./config.js";
+// ============================================================
+// 服务器地址解析 — 支持 host,port / host\instance / host/instance
+// ============================================================
+function parseServerAddress(serverStr) {
+    // 命名实例：host\instance 或 host/instance（贪婪匹配最后一个分隔符，
+    // 兼容 Windows 路径习惯误写的双反斜杠，如 localhost\\MSSQLSERVER2019）
+    const named = /^(.*)[\\/](.*)$/.exec(serverStr);
+    if (named) {
+        const server = named[1].trim().replace(/[\\/]+$/, "");
+        const rest = named[2].trim();
+        // 兼容 host\instance,port 形式
+        const comma = rest.lastIndexOf(",");
+        if (comma !== -1) {
+            const port = Number.parseInt(rest.slice(comma + 1).trim(), 10);
+            return {
+                server,
+                port: Number.isInteger(port) ? port : undefined,
+                instanceName: rest.slice(0, comma).trim() || undefined,
+            };
+        }
+        return { server, instanceName: rest || undefined };
+    }
+    // host,port 形式
+    const commaIdx = serverStr.lastIndexOf(",");
+    if (commaIdx !== -1) {
+        const port = Number.parseInt(serverStr.slice(commaIdx + 1).trim(), 10);
+        return {
+            server: serverStr.slice(0, commaIdx).trim(),
+            port: Number.isInteger(port) ? port : undefined,
+        };
+    }
+    return { server: serverStr.trim() };
+}
+// ============================================================
+// 连接配置工厂 — 根据池名构建不同系统的连接参数
+// ============================================================
+function buildDbConfig(poolName) {
+    const sysCfg = poolName === "b" ? getSystemConfig("b") : getSystemConfig("default");
+    const { server, port, instanceName } = parseServerAddress(sysCfg.server);
+    return {
+        server,
+        ...(port !== undefined && Number.isInteger(port) ? { port } : {}),
+        user: sysCfg.user,
+        password: sysCfg.password,
+        database: sysCfg.database,
+        options: {
+            ...(instanceName ? { instanceName } : {}),
+            trustServerCertificate: env.DB_TRUST_SERVER_CERT === "true",
+            encrypt: env.DB_ENCRYPT === "true",
+            appName: "mcp-xdx-schema-ctx-readonly",
+        },
+        pool: {
+            max: parseInt(env.DB_POOL_MAX, 10),
+            min: parseInt(env.DB_POOL_MIN, 10),
+            idleTimeoutMillis: parseInt(env.DB_POOL_IDLE_TIMEOUT, 10),
+        },
+        // 单条语句超时（防止 query_table_data 等大表查询长时间占用）
+        requestTimeout: statementTimeout(),
+    };
+}
+// ============================================================
+// 连接池管理
+// ============================================================
+const pools = new Map();
+async function getPool(poolName = "default") {
+    const existing = pools.get(poolName);
+    if (existing?.connected)
+        return existing;
+    const config = buildDbConfig(poolName);
+    const newPool = await sql.connect(config);
+    pools.set(poolName, newPool);
+    return newPool;
+}
+// ============================================================
+// 只读查询守卫
+// ============================================================
+/** 禁止的写操作关键字 */
+const FORBIDDEN = [
+    "INSERT",
+    "UPDATE",
+    "DELETE",
+    "DROP",
+    "CREATE",
+    "ALTER",
+    "TRUNCATE",
+    "MERGE",
+    "EXEC",
+    "EXECUTE",
+    "GRANT",
+    "REVOKE",
+];
+/** 检测 SELECT INTO（建表语法，即使以 SELECT 开头也应禁止） */
+function hasSelectInto(stmt) {
+    // 正则：SELECT ... INTO ...（非 INTO 作为普通列名的情况）
+    return /\bSELECT\b.+\bINTO\b/i.test(stmt);
+}
+// 只读查询 — 逐语句扫描，覆盖 SELECT 前缀绕过 + 多语句注入
+export function assertReadOnly(queryString) {
+    const statements = queryString.split(";");
+    for (const raw of statements) {
+        const stmt = raw.trim().toUpperCase();
+        if (!stmt)
+            continue;
+        const head = stmt.split(/\s+/)[0] ?? "";
+        if (FORBIDDEN.includes(head)) {
+            throw new Error(`写操作被禁止: ${head}`);
+        }
+        for (const kw of FORBIDDEN) {
+            if (new RegExp(`\\b${kw}\\b`).test(stmt)) {
+                throw new Error(`写操作被禁止(语句内): ${kw}`);
+            }
+        }
+        // 单独检测 SELECT INTO
+        if (hasSelectInto(raw)) {
+            throw new Error("写操作被禁止: SELECT INTO");
+        }
+    }
+}
+/** 统一的语句超时（毫秒） */
+function statementTimeout() {
+    const t = Number.parseInt(env.DB_QUERY_TIMEOUT, 10);
+    return Number.isFinite(t) && t > 0 ? t : 30_000;
+}
+export async function query(queryString, poolName = "default") {
+    assertReadOnly(queryString);
+    const p = await getPool(poolName);
+    const request = p.request();
+    const result = await request.query(queryString);
+    return result.recordset;
+}
+/**
+ * 参数化只读查询 — 值通过 request.input() 绑定，杜绝字符串拼接注入。
+ * 用于 query_table_data 等需要把用户输入作为值传入的场景。
+ */
+export async function queryWithParams(queryString, params, poolName = "default") {
+    assertReadOnly(queryString);
+    const p = await getPool(poolName);
+    const request = p.request();
+    for (const [key, value] of Object.entries(params)) {
+        request.input(key, value);
+    }
+    const result = await request.query(queryString);
+    return result.recordset;
+}
+// Re-export
+export { sql, table, schemaSource, targetDatabases, envDb, envTable, userDb };
+//# sourceMappingURL=db.js.map

package/dist/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,EACL,GAAG,EACH,KAAK,EACL,YAAY,EACZ,eAAe,EACf,KAAK,EACL,QAAQ,EACR,MAAM,EACN,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,+DAA+D;AAC/D,yDAAyD;AACzD,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,SAAiB;IAK3C,kDAAkD;IAClD,uDAAuD;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,2BAA2B;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC/C,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;IACrD,CAAC;IAED,eAAe;IACf,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE;YAC3C,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,+DAA+D;AAC/D,2BAA2B;AAC3B,+DAA+D;AAC/D,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,MAAM,GACV,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzE,OAAO;QACL,MAAM;QACN,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE;YACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,sBAAsB,EAAE,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAC3D,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;YAClC,OAAO,EAAE,6BAA6B;SACvC;QACD,IAAI,EAAE;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC;SAC1D;QACD,yCAAyC;QACzC,cAAc,EAAE,gBAAgB,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,QAAQ;AACR,+DAA+D;AAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEpD,KAAK,UAAU,OAAO,CAAC,QAAQ,GAAG,SAAS;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,SAAS;AACT,+DAA+D;AAE/D,gBAAgB;AAChB,MAAM,SAAS,GAAG;IAChB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,6CAA6C;AAC7C,SAAS,aAAa,CAAC,IAAY;IACjC,2CAA2C;IAC3C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED,kBAAkB;AAClB,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,WAAmB,EACnB,QAAQ,GAAG,SAAS;IAEpB,cAAc,CAAC,WAAW,CAAC,CAAC;IAE5B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAgB,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,MAAwD,EACxD,QAAQ,GAAG,SAAS;IAEpB,cAAc,CAAC,WAAW,CAAC,CAAC;IAE5B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAgB,CAAC;AACjC,CAAC;AAED,YAAY;AACZ,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC"}

package/dist/diff-utils.d.ts

@@ -0,0 +1,42 @@
+import type { TableKey } from "./config.js";
+import type { Pagination } from "./shared.js";
+export type DiffStatus = "identical" | "added" | "removed" | "modified";
+export interface DiffDetail {
+    entityType: string;
+    businessKey: string;
+    status: DiffStatus;
+    diffFields?: {
+        field: string;
+        valueA: unknown;
+        valueB: unknown;
+    }[];
+    sourceRow?: Record<string, unknown>;
+    targetRow?: Record<string, unknown>;
+}
+export interface DiffResult {
+    summary: {
+        totalCompared: number;
+        identical: number;
+        addedInB: number;
+        removedInB: number;
+        modified: number;
+    };
+    details: DiffDetail[];
+    page: DiffDetail[];
+    pagination: Pagination;
+}
+/** 生成业务键字符串 */
+export declare function bizKey(row: Record<string, unknown>, fields: string[]): string;
+/**
+ * 通用表比对：分别查询两个系统，在 JS 内存中做 FULL OUTER JOIN，
+ * 按业务键字段匹配，比较指定字段的差异。
+ *
+ * @param tableKey   表名键（如 "tableDef"）
+ * @param bkFields   业务键字段（如 ["TableName"]）
+ * @param cmpFields  需要比较的字段（如 ["Description", "ModuleID"]）
+ * @param selectA    系统A 的 SELECT 语句（可覆盖默认的 SELECT * FROM T(...)）
+ * @param selectB    系统B 的 SELECT 语句
+ * @param page       页码，默认 1
+ * @param pageSize   每页数量，默认 50
+ */
+export declare function diffTable(tableKey: TableKey, bkFields: string[], cmpFields: string[], selectA?: string, selectB?: string, page?: number, pageSize?: number): Promise<DiffResult>;

package/dist/diff-utils.js

@@ -0,0 +1,130 @@
+import { query } from "./db.js";
+import { T, T2, paginate } from "./shared.js";
+// ============================================================
+// 工具函数
+// ============================================================
+/** 生成业务键字符串 */
+export function bizKey(row, fields) {
+    return fields.map((f) => String(row[f] ?? "")).join("|");
+}
+/** 比对新旧两个值是否相等 */
+function valuesEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a === null || b === null)
+        return a === b;
+    if (a === undefined || b === undefined)
+        return a === b;
+    return String(a) === String(b);
+}
+// ============================================================
+// 通用比对引擎
+// ============================================================
+/**
+ * 通用表比对：分别查询两个系统，在 JS 内存中做 FULL OUTER JOIN，
+ * 按业务键字段匹配，比较指定字段的差异。
+ *
+ * @param tableKey   表名键（如 "tableDef"）
+ * @param bkFields   业务键字段（如 ["TableName"]）
+ * @param cmpFields  需要比较的字段（如 ["Description", "ModuleID"]）
+ * @param selectA    系统A 的 SELECT 语句（可覆盖默认的 SELECT * FROM T(...)）
+ * @param selectB    系统B 的 SELECT 语句
+ * @param page       页码，默认 1
+ * @param pageSize   每页数量，默认 50
+ */
+export async function diffTable(tableKey, bkFields, cmpFields, selectA, selectB, page, pageSize) {
+    const sqlA = selectA ?? `SELECT * FROM ${T(tableKey)}`;
+    const sqlB = selectB ?? `SELECT * FROM ${T2(tableKey)}`;
+    const rowsA = await query(sqlA, "default");
+    const rowsB = await query(sqlB, "b");
+    // 构建业务键索引 — 检测重复键并警告
+    const mapB = new Map();
+    for (const row of rowsB) {
+        const key = bizKey(row, bkFields);
+        if (mapB.has(key)) {
+            console.error(`[diff] 警告: 系统B中存在重复业务键 "${key}"，仅保留最后一条`);
+        }
+        mapB.set(key, row);
+    }
+    const details = [];
+    const seenInB = new Set();
+    for (const rowA of rowsA) {
+        const key = bizKey(rowA, bkFields);
+        const rowB = mapB.get(key);
+        if (!rowB) {
+            // A 有，B 无 → 系统B缺失
+            details.push({
+                entityType: tableKey,
+                businessKey: key,
+                status: "removed",
+                sourceRow: rowA,
+            });
+        }
+        else {
+            seenInB.add(key);
+            // 两边都有 → 比较字段
+            const diffFields = [];
+            for (const f of cmpFields) {
+                if (!valuesEqual(rowA[f], rowB[f])) {
+                    diffFields.push({ field: f, valueA: rowA[f], valueB: rowB[f] });
+                }
+            }
+            if (diffFields.length > 0) {
+                details.push({
+                    entityType: tableKey,
+                    businessKey: key,
+                    status: "modified",
+                    diffFields,
+                    sourceRow: rowA,
+                    targetRow: rowB,
+                });
+            }
+            // identical 的不入 details（避免数据量过大），仅统计
+        }
+    }
+    // B 有，A 无 → 系统B新增
+    for (const [key, rowB] of mapB) {
+        if (!seenInB.has(key)) {
+            details.push({
+                entityType: tableKey,
+                businessKey: key,
+                status: "added",
+                targetRow: rowB,
+            });
+        }
+    }
+    const { identical, added, removed, modified } = countStatus(details, rowsA.length);
+    const p = page ?? 1;
+    const ps = pageSize ?? 50;
+    const { page: pagedDetails, pagination } = paginate(details, p, ps);
+    return {
+        summary: {
+            totalCompared: removed + added + modified + identical,
+            identical,
+            addedInB: added,
+            removedInB: removed,
+            modified,
+        },
+        details,
+        page: pagedDetails,
+        pagination,
+    };
+}
+/** 根据 details 和系统A行数推算 identical 数量 */
+function countStatus(details, totalA) {
+    let added = 0;
+    let removed = 0;
+    let modified = 0;
+    for (const d of details) {
+        if (d.status === "added")
+            added++;
+        else if (d.status === "removed")
+            removed++;
+        else if (d.status === "modified")
+            modified++;
+    }
+    // identical = 系统A中未出现在 details 的行数（即 A 中有且相同）
+    const identical = totalA - removed - modified;
+    return { identical, added, removed, modified };
+}
+//# sourceMappingURL=diff-utils.js.map

package/dist/diff-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-utils.js","sourceRoot":"","sources":["../src/diff-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAEhC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA+B9C,+DAA+D;AAC/D,OAAO;AACP,+DAA+D;AAE/D,eAAe;AACf,MAAM,UAAU,MAAM,CACpB,GAA4B,EAC5B,MAAgB;IAEhB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,kBAAkB;AAClB,SAAS,WAAW,CAAC,CAAU,EAAE,CAAU;IACzC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,+DAA+D;AAC/D,SAAS;AACT,+DAA+D;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAkB,EAClB,QAAkB,EAClB,SAAmB,EACnB,OAAgB,EAChB,OAAgB,EAChB,IAAa,EACb,QAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,IAAI,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,MAAM,KAAK,CAA0B,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,KAAK,CAA0B,IAAI,EAAE,GAAG,CAAC,CAAC;IAE9D,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,WAAW,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,kBAAkB;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,QAAQ;gBACpB,WAAW,EAAE,GAAG;gBAChB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,cAAc;YACd,MAAM,UAAU,GACd,EAAE,CAAC;YACL,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC;oBACX,UAAU,EAAE,QAAQ;oBACpB,WAAW,EAAE,GAAG;oBAChB,MAAM,EAAE,UAAU;oBAClB,UAAU;oBACV,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,qCAAqC;QACvC,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,QAAQ;gBACpB,WAAW,EAAE,GAAG;gBAChB,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,CACzD,OAAO,EACP,KAAK,CAAC,MAAM,CACb,CAAC;IAEF,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC1B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpE,OAAO;QACL,OAAO,EAAE;YACP,aAAa,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS;YACrD,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,OAAO;YACnB,QAAQ;SACT;QACD,OAAO;QACP,IAAI,EAAE,YAAY;QAClB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,SAAS,WAAW,CAClB,OAAqB,EACrB,MAAc;IAOd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;aACtC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IACD,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/encrypt-secrets.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * 交互式凭据加密 CLI（B + C 混合模式）
+ *
+ * 使用: npx xdx-encrypt-secrets
+ *
+ * - 自动检测当前 .env 中已有的字段
+ * - 默认勾选密码类字段（*_PASSWORD）
+ * - 用户可输入编号切换选择
+ * - 一次性确认，输出 MCP 配置格式的密文
+ */
+export {};