yakuza0 2.23.45 → 2.23.46-beta.1

package/COMPATIBILITY.md

@@ -0,0 +1,15 @@
+# 三仓库统一开发基线（2026-10-28）
+
+三个仓库统一使用 `codex/security-config-compat-20261028`。各仓库在自己的现有代码上增量修复，不互相合并 Git 历史，也不切回旧功能分支。
+
+| 仓库 | 原分支 | 原 HEAD | 本轮基线 |
+| --- | --- | --- | --- |
+| yakuza0 | del_apiv1 | 0ecacb4 | 原 HEAD + 本轮修复 |
+| yakuza1 | del_apiv1 | 6a3a031 | 原 HEAD + 本轮修复 |
+| yakuza4 | safe0 | b26b6df | 43e67e5 保存原有暂存、未暂存和未跟踪开发文件，再叠加本轮修复 |
+
+原分支保留。BFF 的 Yulink/SDK、检查策略、HTTP 调试、加密工具等原有工作完整保存在独立基线提交中；安全补丁另行提交。检查当前版本时同时记录三个仓库的 `git rev-parse HEAD`，不能用不同仓库的同名分支或包版本代替提交号。
+
+开始本轮前的补丁、原始暂存区补丁、未跟踪文件归档及基线信息保存在本机 `/Users/ningfujun/.codex/yakuza-security-20261028-1p8lfbv_`，该目录不进入 Git 或 npm 包。
+
+发布顺序、兼容范围和回归结果见 [配置泄露整改说明](docs/security-config-compat-2026-10-28.md)。本轮只做本地修复和验证，未发布 npm、推送远程或修改生产。

package/config/index.js

@@ -54,10 +54,10 @@ var safeGet = function safeGet(options) {
   return ec(cj);
 };
 
-var lsKey = 'cln_init';
+var lsKey = 'cln_public_v1';
 var lsGet = function lsGet(appName, key) {
   // const lsk = lsKey + '_' + md5(appName).substring(2, 8);
-  var lsk = lsKey;
+  var lsk = lsKey + '_' + appName;
   var lgc = localStorage.getItem(lsk);
 
   if (lgc) {
@@ -71,14 +71,14 @@ var lsGet = function lsGet(appName, key) {
 var lsSet = function lsSet(appName, key, str) {
   // const lsk = lsKey + '_' + md5(appName).substring(2, 8);
 
-  for (var i = 0; i < localStorage.length; i++) {
+  for (var i = localStorage.length - 1; i >= 0; i--) {
     var k = localStorage.key(i);
-    if (_yakuza._.startsWith(k, lsKey) && k.replace(lsKey, '').length > 0) {
+    if (k === 'cln_init' || _yakuza._.startsWith(k, 'cln_init_')) {
       localStorage.removeItem(k);
     }
   }
 
-  var lsk = lsKey;
+  var lsk = lsKey + '_' + appName;
   var content = key + '_' + str;
   localStorage.setItem(lsk, content);
 };
@@ -130,7 +130,7 @@ var ykConfig = function ykConfig() {
   }
 
   _yakuza._.readOnly(_yakuza.global, '__enc_encryptType__', config.security && config.security.encrypt);
-  _yakuza._.readOnly(_yakuza.global, '__yConf_ak__', config.ak);
+  if ((0, _yakuza.checkServer)()) _yakuza._.readOnly(_yakuza.global, '__yConf_ak__', config.ak);
 
   if (config.https && process && process.env) {
     process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';

package/nuxt/modules/http.js

@@ -12,6 +12,10 @@ var _paths = require('../../config/paths');
 
 var _paths2 = _interopRequireDefault(_paths);
 
+var _serverHttpOptions = require('../../utils/serverHttpOptions');
+
+var _publicHttpOptions = require('../../utils/publicHttpOptions');
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 var path = require('path');
@@ -89,13 +93,14 @@ function httpModule(_moduleOptions) {
     options.browserBaseURL = https(options.browserBaseURL);
   }
 
-  options = (0, _stringify2.default)(options);
+  (0, _serverHttpOptions.writeServerHttpOptions)(appName, options);
+  var browserOptions = (0, _stringify2.default)((0, _publicHttpOptions.publicHttpOptions)(options)).replace(/</g, '\\u003c');
 
   // Register plugin
   this.addPlugin({
     src: _paths2.default.ykTemplate + 'http.plugin.js',
     fileName: 'http.js',
-    options: options
+    options: browserOptions
   });
 
   // Proxy integration
@@ -107,7 +112,7 @@ function httpModule(_moduleOptions) {
   // }
   // Add `ky` to build.transpile
   this.options.build = this.options.build || {};
-  this.options.build.transpile = this.options.build.transpile || {};
+  this.options.build.transpile = this.options.build.transpile || [];
   // transpile only for non-modern build
   // istanbul ignore if
   if (semver.gte(semver.coerce(this.nuxt.constructor.version), '2.9.0')) {

package/nuxt/modules/yk.js

@@ -48,7 +48,7 @@ exports.default = function (moduleOptions) {
     src: _paths2.default.ykTemplate + 'yk.plugin.js',
     options: _encrypt.mixin.symmetry.ECB.encrypt((0, _stringify2.default)({
       appName: appName,
-      appConf: appConf
+      appConf: (0, _publicConfig.publicAppConfig)(appConf, _config2.default.name, appName)
     }))
   });
 };
@@ -59,6 +59,12 @@ var _paths2 = _interopRequireDefault(_paths);
 
 var _encrypt = require('yakuza1/lib/encrypt');
 
+var _config = require('../../config');
+
+var _config2 = _interopRequireDefault(_config);
+
+var _publicConfig = require('../../utils/publicConfig');
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 var defaults = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.23.45",
+  "version": "2.23.46-beta.1",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -11,6 +11,8 @@
     "pub": "npm run build && npm version patch && npm publish",
     "test": "jest",
     "test:ssr": "node tests/zunir-ssr.js",
+    "test:config-values": "node tests/config-value.js && node tests/server-identity.js",
+    "test:public-config": "node tests/public-config.js",
     "postinstall": "yk init"
   },
   "author": "nfjbill",
@@ -116,13 +118,13 @@
     "ua-parser-js": "^0.7.40",
     "uglify-js": "^3.17.4",
     "v8-compile-cache": "^2.0.2",
-    "yakuza1": "2.6.26"
+    "yakuza1": "2.6.27-beta.1"
   },
   "peerDependencies": {
     "@evolvere/nuxt": "2.15.9",
     "core-js": "3.10.1",
     "eslint": "7.2.0",
-    "yakuza1": "2.6.26"
+    "yakuza1": "2.6.27-beta.1"
   },
   "__npminstall_done": false
 }

package/pxnpm-lock.yaml

@@ -288,8 +288,8 @@ importers:
         specifier: ^2.0.2
         version: 2.4.0
       yakuza1:
-        specifier: ^2.6.25
-        version: 2.6.25(core-js@3.10.1)
+        specifier: 2.6.26
+        version: 2.6.26(core-js@3.10.1)
     devDependencies:
       babel-cli:
         specifier: ^6.26.0
@@ -8532,8 +8532,8 @@ packages:
   y18n@4.0.3:
     resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
 
-  yakuza1@2.6.25:
-    resolution: {integrity: sha512-z1OSZJBtd61d8s+IzpAi5An8/fhVy/UTxktY9nxRLmVUJ7KEw4V0TIpZ/rvD2q2EqH7l07Sdp3Vk8hvwS+UHPA==}
+  yakuza1@2.6.26:
+    resolution: {integrity: sha512-057phi0dejOtyXplzEqVB07r+qULLXkV2RdT8e/idFEFZlgGTXdoiMwdI5Vv7jqNH8gbt3/IdZZMSF+jn8DNvw==}
     peerDependencies:
       core-js: 3.10.1
 
@@ -19022,7 +19022,7 @@ snapshots:
 
   y18n@4.0.3: {}
 
-  yakuza1@2.6.25(core-js@3.10.1):
+  yakuza1@2.6.26(core-js@3.10.1):
     dependencies:
       '@babel/core': 7.26.9
       '@babel/preset-env': 7.26.9(@babel/core@7.26.9)

package/server/proxy/conf.js

@@ -220,7 +220,7 @@ var ng_conf = exports.ng_conf = function ng_conf(_ref7) {
     resolver = 'resolver ' + _server._.trimEnd(resolver, ';') + ';';
   }
 
-  var headers = '\n    proxy_set_header ' + _def.variable.projectNameHeader + ' \'' + th[_def.variable.projectNameHeader] + '\';\n    proxy_set_header ' + _def.variable.ipHeader + ' \'' + th[_def.variable.ipHeader] + '\';\n    proxy_set_header ' + _def.variable.childKeyHeader + ' \'' + th[_def.variable.childKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.appCodeHeader + ' \'' + th[_def.variable.appCodeHeader] + '\';\n    proxy_set_header ' + _def.variable.appKeyHeader + ' \'' + th[_def.variable.appKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.shareRuleHeader + ' \'' + th[_def.variable.shareRuleHeader] + '\';\n    proxy_set_header ' + _def.variable.baseURLHeader + ' \'' + th[_def.variable.baseURLHeader] + '\';\n  ';
+  var headers = '\n    proxy_set_header ' + _def.variable.projectNameHeader + ' \'' + th[_def.variable.projectNameHeader] + '\';\n    proxy_set_header ' + _def.variable.ipHeader + ' \'' + th[_def.variable.ipHeader] + '\';\n    proxy_set_header ' + _def.variable.childKeyHeader + ' \'' + th[_def.variable.childKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.appCodeHeader + ' \'' + th[_def.variable.appCodeHeader] + '\';\n    proxy_set_header ' + _def.variable.appKeyHeader + ' \'' + th[_def.variable.appKeyHeader] + '\';\n    proxy_set_header ' + _def.variable.appNameHeader + ' \'' + th[_def.variable.appNameHeader] + '\';\n    proxy_set_header ' + _def.variable.shareRuleHeader + ' \'' + th[_def.variable.shareRuleHeader] + '\';\n    proxy_set_header ' + _def.variable.baseURLHeader + ' \'' + th[_def.variable.baseURLHeader] + '\';\n  ';
 
   return '\n    ' + resolver + '\n\n    server {\n      listen       ' + port + ';\n      server_name  cln-tire.lan;\n      include ' + confRoot + '/server.conf;\n\n      location ' + basePath + ' {\n          proxy_pass ' + appUrl + ';\n      }\n\n      location ' + basePath + 'zunir {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/zunir/' + name + '/client/backend;\n      }\n\n      location ' + basePath + 'zunir/feapiv1 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/zunir/' + name + '/client/feapiv1;\n      }\n\n      location ' + basePath + 'apiv2 {\n          ' + headers + '\n          include ' + confRoot + '/proxy.conf;\n          proxy_pass ' + yk4Addr + '/apiv2;\n      }\n\n      location ~ ' + basePath + 'apiv3/cln_.*feapiv1/ {\n        rewrite ^' + basePath + 'apiv3/cln_(.*)feapiv1/(.*)$ ' + basePath + 'apiv3/fe/$2 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n      location ~ ' + basePath + 'apiv3/cln_[a-z]+/ {\n        rewrite ^' + basePath + 'apiv3/cln_[a-z]+/(.*)$ ' + basePath + 'apiv3/backend/$1 last;\n        include ' + confRoot + '/proxy.conf;\n        proxy_pass ' + yk4Addr + ';\n      }\n  }\n  ';
 };