feat(ql3): harden cluster secret projection checks

packages/ql3-runtime-core/package.json

@@ -89,6 +89,9 @@
       "plugin-package-secret-binding-plan": [
         "dist/plugin-package/secret-binding/plan.d.ts"
       ],
+      "secret-projection": [
+        "dist/secret/secretProjection.d.ts"
+      ],
       "plugin-package-task-reconciliation": [
         "dist/plugin-package/pluginPackageTaskReconciliation.d.ts"
       ],
@@ -387,6 +390,11 @@
       "require": "./dist/plugin-package/secret-binding/plan.js",
       "default": "./dist/plugin-package/secret-binding/plan.js"
     },
+    "./secret-projection": {
+      "types": "./dist/secret/secretProjection.d.ts",
+      "require": "./dist/secret/secretProjection.js",
+      "default": "./dist/secret/secretProjection.js"
+    },
     "./plugin-package-task-reconciliation": {
       "types": "./dist/plugin-package/pluginPackageTaskReconciliation.d.ts",
       "require": "./dist/plugin-package/pluginPackageTaskReconciliation.js",

packages/ql3-runtime-core/src/secret/secretProjection.ts

@@ -0,0 +1,18 @@
+import { createHash } from 'node:crypto';
+
+import { parseSecretRef } from './secretReference';
+
+export const SECRET_PROJECTION_FILE_NAME_PATTERN = /^[0-9a-f]{64}$/;
+
+/**
+ * Maps one canonical SecretRef to a path-free, non-reversible projection key.
+ * The function does not inspect or resolve Secret material.
+ */
+export function secretProjectionFileName(secretRef: string): string {
+  parseSecretRef(secretRef);
+  const result = createHash('sha256').update(secretRef, 'utf8').digest('hex');
+  if (!SECRET_PROJECTION_FILE_NAME_PATTERN.test(result)) {
+    throw new TypeError('Secret projection file name is invalid');
+  }
+  return result;
+}

packages/ql3-runtime-core/test/secretReference.test.cjs

@@ -9,6 +9,9 @@ const {
   createLocalSecretRef,
   parseLocalSecretRef,
 } = require('../dist/secret/localSecret');
+const {
+  secretProjectionFileName,
+} = require('@qinglong/runtime-core/secret-projection');
 
 test('keeps qlsecret:v1 profile-neutral and byte-compatible with local aliases', () => {
   const reference = { projectId: 'default', name: 'TOKEN', version: 2 };
@@ -20,12 +23,40 @@ test('keeps qlsecret:v1 profile-neutral and byte-compatible with local aliases',
   assert.equal(Object.isFrozen(parseSecretRef(value)), true);
 });
 
+test('maps only canonical SecretRefs to stable path-free projection names', () => {
+  const first = createSecretRef({
+    projectId: 'default',
+    name: 'TOKEN',
+    version: 2,
+  });
+  const second = createSecretRef({
+    projectId: 'default',
+    name: 'TOKEN',
+    version: 3,
+  });
+  assert.match(secretProjectionFileName(first), /^[0-9a-f]{64}$/);
+  assert.equal(
+    secretProjectionFileName(first),
+    secretProjectionFileName(first),
+  );
+  assert.notEqual(
+    secretProjectionFileName(first),
+    secretProjectionFileName(second),
+  );
+  assert.throws(
+    () => secretProjectionFileName('not-a-secret-ref'),
+    InvalidSecretReferenceError,
+  );
+});
+
 test('rejects non-canonical, cross-shape and unbounded Secret references', () => {
   for (const value of [
     'qlsecret:v1:',
     'qlsecret:v1:***',
     'local-secret:default:TOKEN',
-    `qlsecret:v1:${Buffer.from('{"name":"TOKEN","projectId":"default"}').toString('base64url')}`,
+    `qlsecret:v1:${Buffer.from(
+      '{"name":"TOKEN","projectId":"default"}',
+    ).toString('base64url')}`,
   ]) {
     assert.throws(() => parseSecretRef(value), InvalidSecretReferenceError);
   }