@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/hub/capability.d.ts

@@ -16,6 +16,11 @@ export interface PublishReceipt {
     assetIds?: string[];
     /** 终态标记: true=不可重试(reject/quarantine/402), SyncEngine 不得 incrementRetry(money-safety risk). */
     terminal?: boolean;
+    /** Adapter-owned structured rejection metadata; callers must not infer policy from free-form `reason`. */
+    rejection?: {
+        code: 'invalid_request' | 'credit_shortage' | 'node_unauthorized' | 'not_found' | 'duplicate' | 'invalid_payload' | 'cooldown' | 'hub_rejected';
+        retryAfterMs?: number;
+    };
     /** M8-1: 公版经济侧只读回执(core 不解释经济语义, 仅透传供观测/UI). private hub 多为空. */
     economic?: {
         creditShortage?: boolean;
@@ -25,6 +30,10 @@ export interface PublishReceipt {
         gdiScore?: number;
     };
 }
+export interface PublishOptions {
+    /** Stable, non-blank per logical publish so adapters can make transport retries idempotent. */
+    idempotencyKey?: string;
+}
 /** 资产查询. 复用 assetstore SearchQuery, 不发明第二套查询 DSL. */
 export type HubQuery = SearchQuery;
 /** task 子系统事件(订阅流元素). 公版含经济上下文(bounty/credit), 私有仅 workflow. */
@@ -111,6 +120,75 @@ export interface ReuseResultReceipt {
     reason?: string;
     id?: string;
 }
+export type LearningAssetType = 'memory' | 'skill' | 'playbook' | 'eval';
+export type LearningAssetStatus = 'pending_review' | 'active' | 'disabled' | 'stale' | 'archived';
+export type LearningAssetEffectiveStatus = LearningAssetStatus | 'expired';
+export type LearningAssetUsageOutcome = ReuseResultOutcome;
+export interface LearningAssetOwner {
+    node_id?: string | null;
+    user_id?: string | null;
+    org_id?: string | null;
+    workspace_id?: string | null;
+}
+/** Hub-owned learning asset record. Core keeps it opaque; adapters own wire shape and auth. */
+export interface LearningAssetRecord {
+    asset_id: string;
+    type: LearningAssetType;
+    source_packet_id?: string;
+    scope?: string[];
+    owner?: LearningAssetOwner;
+    title?: string;
+    summary?: string;
+    confidence?: number;
+    last_used_at?: string | null;
+    usage_count?: number;
+    success_count?: number;
+    success_rate?: number;
+    expires_at?: string | null;
+    conflicts_with?: string[];
+    status?: LearningAssetStatus;
+    effective_status?: LearningAssetEffectiveStatus;
+    status_reason?: string;
+    provenance?: Record<string, unknown>;
+    payload?: Record<string, unknown>;
+    created_at?: string | null;
+    updated_at?: string | null;
+    [k: string]: unknown;
+}
+export interface LearningAssetListOptions {
+    type?: LearningAssetType;
+    scope?: readonly string[];
+    status?: LearningAssetStatus | readonly LearningAssetStatus[];
+    includeExpired?: boolean;
+    includePayload?: boolean;
+    limit?: number;
+}
+export interface LearningAssetListResult {
+    assets: LearningAssetRecord[];
+    limit: number;
+    reason?: string;
+}
+export interface LearningAssetUsageReport {
+    assetId?: string;
+    usedAssetIds?: readonly string[];
+    outcome: LearningAssetUsageOutcome;
+    score?: number;
+    sourceEventId: string;
+    reason?: string;
+}
+export interface LearningAssetUsageResultRow {
+    asset_id: string;
+    recorded: boolean;
+    duplicated?: boolean;
+    error?: string;
+    [k: string]: unknown;
+}
+/** Learning-asset usage reporting is best-effort; failures must not break runtime solve paths. */
+export interface LearningAssetUsageReceipt {
+    recorded: boolean;
+    reason?: string;
+    results: LearningAssetUsageResultRow[];
+}
 /**
  * Pre-publish dry-run result. The hub runs the same hub-side quality + content-safety
  * gate as publish but stores nothing and charges no credits, so an agent can check a
@@ -141,6 +219,10 @@ export interface RecipeCreateRequest {
     pricePerExecution?: number;
     currency?: string;
     maxConcurrent?: number;
+    idempotencyKey?: string;
+}
+export interface RecipePublishOptions {
+    idempotencyKey?: string;
 }
 export interface RecipeReceipt {
     recipeId?: string;
@@ -156,14 +238,29 @@ export interface RecipeExpressRequest {
 export interface RecipeExpressionReceipt extends RecipeReceipt {
     organismId?: string;
 }
+/** Search/list published recipes. Empty `q` is valid; adapters may fall through to list. */
+export interface RecipeSearchRequest {
+    q?: string;
+    limit?: number;
+    cursor?: string;
+    sort?: string;
+}
+export interface RecipeSearchReceipt {
+    recipes: unknown[];
+    nextCursor?: string;
+    hasMore?: boolean;
+    raw: unknown;
+}
 /** Optional Hub recipe/DNA capability. Core stays wire-agnostic; adapters own REST shape. */
 export interface RecipeCapability {
     create(request: RecipeCreateRequest): Promise<RecipeReceipt>;
-    publish(recipeId: string): Promise<RecipeReceipt>;
+    publish(recipeId: string, options?: RecipePublishOptions): Promise<RecipeReceipt>;
     get(recipeId: string): Promise<RecipeFetchReceipt>;
     express(recipeId: string, request?: RecipeExpressRequest): Promise<RecipeExpressionReceipt>;
+    search(request?: RecipeSearchRequest): Promise<RecipeSearchReceipt>;
+    list(request?: RecipeSearchRequest): Promise<RecipeSearchReceipt>;
 }
-export type HubCapabilityName = 'publish' | 'fetch' | 'search' | 'task' | 'mailbox' | 'auth' | 'audit' | 'air_gap' | 'tenant_isolation' | 'marketplace' | 'economy' | 'questions' | 'recipes' | 'agent_directory';
+export type HubCapabilityName = 'publish' | 'fetch' | 'search' | 'task' | 'mailbox' | 'auth' | 'audit' | 'air_gap' | 'tenant_isolation' | 'marketplace' | 'economy' | 'questions' | 'recipes' | 'agent_directory' | 'learning_assets';
 /** hub 能力清单(可选). core 据此动态适配 UI/行为, "按需耦合". */
 export interface HubManifest {
     capabilities: HubCapabilityName[] | string[];
@@ -201,6 +298,7 @@ export interface HttpRequestLike {
     method: string;
     path: string;
     body?: string;
+    signal?: AbortSignal;
 }
 /**
  * Pluggable auth. Example implementations: public OAuth device token / Ed25519 keypair / enterprise SSO (OIDC/LDAP).
@@ -217,20 +315,48 @@ export interface AuthProvider {
     /** 撤销凭证(机器丢失/泄露). */
     revoke(credentialId: string): Promise<void>;
 }
+/**
+ * By-id fetch is content-addressed by default. Integrity-sensitive callers may
+ * explicitly opt in to receiving a schema-valid delivery whose declared
+ * asset_id matches the request while its current content hash does not.
+ */
+export interface FetchAssetByIdOptions {
+    allowUnverifiedExactIdentity?: boolean;
+}
+/** Why a by-id fetch produced no asset. `absent` is the ONLY one that means the hub does not have it. */
+export type AssetDeliveryRejection = 'identity_mismatch' | 'revoked' | 'ambiguous' | 'unverified_not_allowed';
+/**
+ * The outcome of a by-id fetch. `verified:false` means the delivery is bound to the requested id but its body
+ * hashes to something else — usable only under quarantine, never as canonical content.
+ */
+export type AssetDeliveryOutcome = {
+    status: 'delivered';
+    asset: AssetRecord;
+    verified: boolean;
+} | {
+    status: 'absent';
+} | {
+    status: 'rejected';
+    reason: AssetDeliveryRejection;
+};
 export interface HubCapability {
     /**
      * 异步发布. 公版 /a2a/publish 收 **bundle**[Gene,Capsule,(EvolutionEvent)](一个 cycle 的产物一起发, +GDI);
      * 传单资产=[asset]。core 已 normalizeForPut(算/校验 asset_id), hub 做经济/治理/质量 gate。
      */
-    publish(bundle: AssetRecord[]): Promise<PublishReceipt>;
+    publish(bundle: AssetRecord[], options?: PublishOptions): Promise<PublishReceipt>;
     /** 拉取资产. hub 侧排序/scope(公版 GDI, 私有 RBAC); core 不重排. */
     fetch(query: HubQuery): Promise<AssetRecord[]>;
     /** 搜索资产. 与 fetch 同 shape, 差异在 hub 侧召回策略. */
     search(query: HubQuery): Promise<AssetRecord[]>;
     /** 可选: 按 content-addressed asset_id 拉单个 full asset. private adapter/proxy 用它保证只 fetch 一个 winner. */
-    fetchAssetById?(assetId: string): Promise<AssetRecord | null>;
+    fetchAssetById?(assetId: string, options?: FetchAssetByIdOptions): Promise<AssetRecord | null>;
     /** 可选: 报告某个资产被复用后的结果. PHub/enterprise adapter 实现; 不支持时 runtime 应明确降级. */
     recordReuseResult?(report: ReuseResultReport): Promise<ReuseResultReceipt>;
+    /** 可选: 列出 hub 端 runtime learning assets. Missing means the adapter does not support this MVP surface. */
+    listLearningAssets?(options?: LearningAssetListOptions): Promise<LearningAssetListResult>;
+    /** 可选: 上报 learning asset 使用结果. Best-effort; failures must never break solve paths. */
+    recordLearningAssetUsage?(report: LearningAssetUsageReport): Promise<LearningAssetUsageReceipt>;
     /**
      * 可选: 发布前 dry-run 校验(公版 POST /a2a/validate). 跑与 publish 相同的 hub 端质量门禁 + 内容安全扫描,
      * 但不落库、不计费; 经由 Proxy 暴露时调用方需先执行与 publish 相同的客户端脱敏/泄漏拦截.

package/dist/hub/conversationDistiller.d.ts

@@ -43,6 +43,7 @@ interface NormalizedExecution {
         files: number;
         lines: number;
     };
+    untrustedStatusClaim: boolean;
 }
 interface NormalizedConversation {
     text: string;
@@ -65,6 +66,22 @@ export interface QualityGate {
 export interface ConversationDistillOptions {
     persist?: boolean;
     store?: AssetStoreProvider;
+    /**
+     * 仅由受信任的宿主验证器注入。HTTP/MCP 请求体中的 execution 不能替代此证据。
+     */
+    verifiedExecution?: ConversationDistillVerifiedExecution;
+}
+export interface ConversationDistillVerifiedExecution {
+    trace: ReadonlyArray<{
+        command: string;
+        exit: number;
+        summary?: string;
+    }>;
+    validation?: readonly string[];
+    blast_radius?: {
+        files?: number;
+        lines?: number;
+    };
 }
 export type ConversationDistillResult = {
     ok: false;
@@ -80,6 +97,8 @@ export type ConversationDistillResult = {
     signals: string[];
     gene: AssetRecord;
     capsule: AssetRecord;
+    /** 仅当质量闸门通过且草稿可以进入发布流程时为 true。 */
+    publishable: boolean;
 };
 export declare function inferSignals(text: string, providedSignals?: unknown): string[];
 export declare function evaluateGate(input: ConversationDistillInput, normalized: NormalizedConversation): QualityGate;

package/dist/hub/conversationDistiller.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
-import { redactString } from './sanitize.js';
-import { SCHEMA_VERSION, computeAssetId } from '../wire/index.js';
+import { intakeGene } from '../algo/geneIntake.js';
+import { redactDeep, redactString } from './sanitize.js';
+import { SCHEMA_VERSION, computeAssetId, stripGeneHints, validateWireDeep } from '../wire/index.js';
 const DEFAULT_SIGNALS = [
     'conversation_distillation',
     'reusable_capability',
@@ -16,6 +17,7 @@ const SIGNAL_RULES = [
     { signal: 'plugin_integration', re: /\b(plugin|codex|claude|cursor|antigravity|workbuddy|hook|notify)\b|插件|钩子/i },
     { signal: 'test_verified', re: /\b(test|build|verify|passed|green)\b|测试|验证|通过/i },
 ];
+const BUNDLE_PERSISTENCE_UNSUPPORTED = 'bundle_persistence_unsupported';
 function asRecord(v) {
     return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
 }
@@ -74,37 +76,63 @@ function normalizePublishBlastRadius(value, artifactCount) {
     };
 }
 function capsuleContent(normalized) {
-    return redactString(JSON.stringify({
+    return redactDeep({
         platform: normalized.platform,
         source_thread: normalized.source_thread || null,
         artifacts: normalized.artifacts,
         excerpt: normalized.text.slice(0, 1200),
-    }));
+    });
 }
 function normalizeExecution(input) {
     const execution = asRecord(input.execution);
     const validation = normalizeList(input.validation ?? input.verification ?? execution['validation'], 8, 180);
+    const untrustedStatusClaim = execution['status'] !== undefined || execution['ok'] !== undefined;
+    let malformedTrace = false;
     const trace = asArray(execution['trace']).map((item) => {
-        if (typeof item === 'string')
-            return { command: trimText(item, 180), exit: 0 };
+        if (typeof item === 'string') {
+            malformedTrace = true;
+            return null;
+        }
         const row = asRecord(item);
-        if (Object.keys(row).length === 0)
+        if (Object.keys(row).length === 0) {
+            malformedTrace = true;
+            return null;
+        }
+        const command = trimText(row['command'] ?? row['cmd'] ?? row['name'] ?? '', 180);
+        if (!command) {
+            malformedTrace = true;
             return null;
+        }
+        const rawExit = row['exit'];
+        const exit = Number.isInteger(rawExit)
+            ? Number(rawExit)
+            : (typeof row['ok'] === 'boolean' ? (row['ok'] ? 0 : 1) : undefined);
+        if (exit === undefined) {
+            malformedTrace = true;
+            return null;
+        }
         return {
-            command: trimText(row['command'] ?? row['cmd'] ?? row['name'] ?? 'validation', 180),
-            exit: Number.isInteger(row['exit']) ? Number(row['exit']) : (row['ok'] === false ? 1 : 0),
+            command,
+            exit,
             summary: trimText(row['summary'] ?? row['output'] ?? '', 240),
         };
     }).filter((row) => row !== null);
-    for (const cmd of validation)
-        if (!trace.some((t) => t.command === cmd))
-            trace.push({ command: cmd, exit: 0 });
-    const ok = execution['status'] === 'success' || execution['ok'] === true || validation.length > 0 || trace.some((t) => t.exit === 0);
+    // 声明的验证命令只是计划，并不能证明命令已经执行。
+    // 保留它作为质量信号，但不能为未执行的声明伪造 exit-0 轨迹或成功结果。
+    // 只有显式结构化的退出码才可作为证据。调用方声明的 status/ok 字段只是元数据，
+    // 不能据此把资产晋级到发布流程。
+    const normalizedValidation = new Set(validation);
+    const covered = [...normalizedValidation].every((command) => trace.some((row) => row.command === command));
+    const ok = trace.length > 0
+        && !malformedTrace
+        && trace.every((t) => t.exit === 0)
+        && covered;
     return {
         status: ok ? 'success' : 'failed',
         trace,
         validation,
         blast_radius: normalizeBlastRadius(execution['blast_radius'] ?? input.blast_radius),
+        untrustedStatusClaim,
     };
 }
 function buildStrategy(input) {
@@ -145,7 +173,9 @@ export function evaluateGate(input, normalized) {
         reasons.push('explicit_distill_signal');
     }
     const rawThreshold = Number(input.min_score ?? input.minScore ?? 5);
-    const threshold = Number.isFinite(rawThreshold) ? rawThreshold : 5;
+    // 调用方可以要求更严格的阈值，但不能把准入策略降为零，
+    // 也不能把未经确认的草稿变成可发布资产。
+    const threshold = Number.isFinite(rawThreshold) ? Math.max(5, rawThreshold) : 5;
     if (score < threshold)
         return { ok: false, score, threshold, reasons, reason: 'insufficient_reusable_signal' };
     return { ok: true, score, threshold, reasons };
@@ -178,12 +208,17 @@ export function normalizeConversationInput(input) {
 export async function distillConversation(input, opts = {}) {
     if (!input || typeof input !== 'object' || Array.isArray(input))
         return { ok: false, status: 'skipped', reason: 'input_object_required' };
-    const normalized = normalizeConversationInput(input);
+    const effectiveInput = opts.verifiedExecution
+        ? {
+            ...input,
+            execution: opts.verifiedExecution,
+            ...(opts.verifiedExecution.validation ? { validation: opts.verifiedExecution.validation } : {}),
+        }
+        : input;
+    const normalized = normalizeConversationInput(effectiveInput);
     if (!normalized.summary || normalized.summary.length < 20)
         return { ok: false, status: 'skipped', reason: 'summary_required' };
     const gate = evaluateGate(input, normalized);
-    if (!gate.ok)
-        return { ok: false, status: 'skipped', reason: gate.reason ?? 'insufficient_reusable_signal', quality: gate, signals: normalized.signals };
     const slug = slugify(input.name ?? input.title ?? normalized.summary);
     const fingerprint = hashInput({
         summary: normalized.summary,
@@ -192,9 +227,13 @@ export async function distillConversation(input, opts = {}) {
         artifacts: normalized.artifacts,
     });
     const category = inferCategory(normalized.signals, normalized.text);
-    const gene = {
-        type: 'Gene',
-        schema_version: SCHEMA_VERSION,
+    // 只有质量门禁与受信任宿主证据同时通过时，Capsule 才允许广播。
+    const publishable = gate.ok && normalized.execution.status === 'success' && opts.verifiedExecution !== undefined;
+    const declaredValidation = normalized.execution.validation;
+    // GEP Gene schema 要求非空 validation。调用方没有计划时保留旧版 Node 身份检查，
+    // 但它只用于形成可审阅草稿，绝不能产生 verifier 坐标或发布资格。
+    const validation = declaredValidation.length > 0 ? declaredValidation : ['node --version'];
+    const intake = intakeGene({
         id: `gene_conversation_${slug}_${fingerprint}`,
         summary: normalized.summary,
         category,
@@ -204,18 +243,28 @@ export async function distillConversation(input, opts = {}) {
             'The conversation includes enough evidence to reconstruct when and how to use it.',
         ],
         strategy: normalized.strategy,
-        validation: normalized.execution.validation.length > 0 ? normalized.execution.validation : ['node --version'],
+        validation,
         constraints: { max_files: 20, forbidden_paths: ['.git', 'node_modules', '.env'] },
-        _source: {
-            kind: 'conversation_distillation',
-            platform: normalized.platform,
-            source_thread: normalized.source_thread || null,
+        generation_meta: { source: 'distilled' },
+        model_name: normalized.model,
+    });
+    if (!intake.ok || !intake.gene) {
+        return {
+            ok: false,
+            status: 'skipped',
+            reason: 'gene_intake_failed',
             quality: gate,
-            distilled_at: new Date().toISOString(),
-        },
-        asset_id: '',
-    };
-    gene.asset_id = computeAssetId(gene) ?? '';
+            signals: normalized.signals,
+        };
+    }
+    const gene = { ...intake.gene };
+    // intakeGene 会从任何非空 validation 计划推导 verifier_profile。旧版身份检查并非
+    // 行为验证证据，因此必须移除该坐标并重新绑定内容寻址 ID，保持严格 K_auto fail-closed。
+    if (declaredValidation.length === 0) {
+        delete gene.verifier_profile;
+        gene.asset_id = '';
+        gene.asset_id = computeAssetId(gene) ?? '';
+    }
     const capsule = {
         type: 'Capsule',
         schema_version: SCHEMA_VERSION,
@@ -226,13 +275,13 @@ export async function distillConversation(input, opts = {}) {
         confidence: Math.min(0.95, 0.5 + gate.score / 20),
         blast_radius: normalizePublishBlastRadius(normalized.execution.blast_radius, normalized.artifacts.length),
         outcome: { status: normalized.execution.status, score: normalized.execution.status === 'success' ? 0.82 : 0.35 },
-        source_type: 'conversation_distillation',
+        source_type: 'generated',
         strategy: normalized.strategy,
         execution_trace: normalized.execution.trace,
-        a2a: { eligible_to_broadcast: true },
+        a2a: { eligible_to_broadcast: publishable },
         content: capsuleContent(normalized),
-        diff: '',
-        reused_asset_id: '',
+        diff: null,
+        reused_asset_id: null,
         env_fingerprint: {
             platform: normalized.platform,
             source_thread: normalized.source_thread || null,
@@ -247,14 +296,43 @@ export async function distillConversation(input, opts = {}) {
         asset_id: '',
     };
     capsule.asset_id = computeAssetId(capsule) ?? '';
-    const persist = (opts.persist ?? input.persist) === true;
+    // 质量准入可以保持宽松，但草稿仍必须是有效的 wire 记录。
+    // 在持久化或排队前捕获生产者与 schema 的漂移。
+    if (!validateWireDeep(stripGeneHints(gene)).ok || !validateWireDeep(capsule).ok) {
+        return {
+            ok: false,
+            status: 'skipped',
+            reason: 'wire_schema_invalid',
+            quality: gate,
+            signals: normalized.signals,
+        };
+    }
+    // 只有受信任宿主验证器提供的成功 execution 才能解锁发布。
+    // 本地调用方显式要求 persist 时，可以保留没有成功证据的失败草稿供人工复核，
+    // 但请求体伪造的 exit-0 轨迹不能借此写入看似成功的资产。
+    const persistRequested = (opts.persist ?? input.persist) === true;
+    const failedDraftPersistence = !opts.verifiedExecution
+        && normalized.execution.status === 'failed'
+        && !normalized.execution.untrustedStatusClaim;
+    const persist = persistRequested && (publishable || (gate.ok && failedDraftPersistence));
     if (persist && opts.store) {
-        await opts.store.put(gene);
-        await opts.store.put(capsule);
+        // Gene/Capsule 是一个可发布单元。只提供单条写入的 provider 无法恢复
+        // 两次写入之间的崩溃窗口；不要用兼容回退制造孤儿 Gene。
+        if (typeof opts.store.putBundle !== 'function') {
+            return {
+                ok: false,
+                status: 'skipped',
+                reason: BUNDLE_PERSISTENCE_UNSUPPORTED,
+                quality: gate,
+                signals: normalized.signals,
+            };
+        }
+        await opts.store.putBundle([gene, capsule]);
     }
     return {
         ok: true,
         status: persist && opts.store ? 'stored' : 'draft',
+        publishable,
         distill_id: fingerprint,
         quality: gate,
         signals: normalized.signals,

package/dist/hub/fake.d.ts

@@ -1,4 +1,4 @@
-import type { HubCapability, PublishReceipt, AgentEvent, TaskEvent, AuthProvider, HubQuery, AssetRecord, TaskCompleteContext } from './capability.js';
+import type { HubCapability, PublishReceipt, AgentEvent, TaskEvent, AuthProvider, HubQuery, AssetRecord, TaskCompleteContext, PublishOptions } from './capability.js';
 export interface FakeHubOptions {
     /** 脚本化 publish gate: 返回 reject/quarantine 以测 PublishReceipt 终态路径. */
     publishGate?: (asset: AssetRecord) => Pick<PublishReceipt, 'status' | 'reason' | 'terminal'>;
@@ -24,11 +24,12 @@ export declare class FakeHubCapability implements HubCapability {
     }>;
     readonly auth: AuthProvider;
     agentDirectory?: import('./agentDirectory.js').AgentDirectoryCapability;
+    recipes?: import('./capability.js').RecipeCapability;
     nextPollAfterMs: number | undefined;
     constructor(opts?: FakeHubOptions);
     /** 测试注入: 排一条 inbound 事件供 poll 拉. */
     seedInbound(e: AgentEvent): void;
-    publish(bundle: AssetRecord[]): Promise<PublishReceipt>;
+    publish(bundle: AssetRecord[], _options?: PublishOptions): Promise<PublishReceipt>;
     fetch(query: HubQuery): Promise<AssetRecord[]>;
     search(query: HubQuery): Promise<AssetRecord[]>;
     task: {

package/dist/hub/fake.js

@@ -20,13 +20,14 @@ export class FakeHubCapability {
     completed = [];
     auth = fakeAuth;
     agentDirectory;
+    recipes;
     nextPollAfterMs;
     constructor(opts = {}) {
         this.opts = opts;
     }
     /** 测试注入: 排一条 inbound 事件供 poll 拉. */
     seedInbound(e) { this.inbox.push(e); }
-    async publish(bundle) {
+    async publish(bundle, _options) {
         const assetIds = bundle.map((a) => computeAssetId(a));
         const gate = this.opts.publishGate?.(bundle[0] ?? {}) ?? { status: 'accepted' };
         if (gate.status === 'accepted')

package/dist/hub/index.d.ts

@@ -8,4 +8,5 @@ export * from './assetCallLog.js';
 export * from './hubReview.js';
 export * from './reuseDecision.js';
 export * from './conversationDistiller.js';
+export * from './recipeCompose.js';
 export * from './questionGenerator.js';

package/dist/hub/index.js

@@ -8,4 +8,5 @@ export * from './assetCallLog.js';
 export * from './hubReview.js';
 export * from './reuseDecision.js';
 export * from './conversationDistiller.js';
+export * from './recipeCompose.js';
 export * from './questionGenerator.js';

package/dist/hub/questionGenerator.d.ts

@@ -54,6 +54,10 @@ export interface QuestionGenerationResult {
     state: QuestionGeneratorState;
     changed: boolean;
 }
-export declare function extractTopicKeywords(transcript: string | undefined, memory: string | undefined, max?: number): string[];
+export interface TopicKeywordOptions {
+    minOccurrences?: number;
+    preserveSourceOrder?: boolean;
+}
+export declare function extractTopicKeywords(transcript: string | undefined, memory: string | undefined, max?: number, opts?: TopicKeywordOptions): string[];
 export declare function generateQuestions(input?: GenerateQuestionsInput): QuestionGenerationResult;
 export declare function generateUrgentQuestions(input?: GenerateUrgentQuestionsInput): QuestionGenerationResult;

package/dist/hub/questionGenerator.js

@@ -21,7 +21,7 @@ const EXPLORE_STOPWORDS = new Set([
     'agent', 'about', 'into', 'then', 'than', 'they', 'them', 'their', 'there',
     'here', 'will', 'would', 'could', 'should', 'been', 'were', 'using', 'used',
     'cycle', 'evolution', 'error', 'errors', 'failed', 'failure', 'null', 'undefined',
-    'true', 'false', 'console', 'return', 'function', 'const', 'value', 'result',
+    'true', 'false', 'console', 'return', 'function', 'const', 'value', 'result', 'redacted',
 ]);
 const SENSITIVE_TOPIC_RE = /secret|token|api[_-]?key|password|passwd|credential|bearer|authorization|cookie|session[_-]?id|private[_-]?key|oauth|refresh[_-]?token/i;
 const LONG_OPAQUE_RE = /^[a-z0-9_-]{32,}$/i;
@@ -106,8 +106,8 @@ function safeTopicToken(token) {
         return false;
     return true;
 }
-export function extractTopicKeywords(transcript, memory, max = 5) {
-    const text = `${String(transcript ?? '')} ${String(memory ?? '')}`.toLowerCase();
+export function extractTopicKeywords(transcript, memory, max = 5, opts = {}) {
+    const text = redactString(`${String(transcript ?? '')} ${String(memory ?? '')}`).toLowerCase();
     const words = text.match(/[a-z][a-z0-9_-]{4,}/g) ?? [];
     const freq = new Map();
     for (const word of words) {
@@ -115,9 +115,11 @@ export function extractTopicKeywords(transcript, memory, max = 5) {
             continue;
         freq.set(word, (freq.get(word) ?? 0) + 1);
     }
-    return [...freq.entries()]
-        .filter(([, count]) => count >= 2)
-        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    const entries = [...freq.entries()]
+        .filter(([, count]) => count >= Math.max(1, Math.trunc(opts.minOccurrences ?? 2)));
+    if (!opts.preserveSourceOrder)
+        entries.sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+    return entries
         .map(([word]) => word)
         .slice(0, max);
 }

package/dist/hub/recipeCompose.d.ts

@@ -0,0 +1,27 @@
+import type { AssetRecord, HubCapability } from './capability.js';
+export declare const RECIPE_COMPOSE_FLAG = "compose_recipe";
+export interface RecipeComposeInput {
+    title?: string;
+    description?: string;
+    assets?: readonly unknown[];
+    source?: unknown;
+    [k: string]: unknown;
+}
+export interface RecipeComposeResult {
+    attempted: boolean;
+    ok: boolean;
+    reason?: string;
+    recipeId?: string;
+    status?: string;
+}
+export declare function recipeComposeRequested(payload: RecipeComposeInput): boolean;
+export declare function recipeAssetsFromPayload(payload: RecipeComposeInput): {
+    gene?: AssetRecord;
+    capsule?: AssetRecord;
+};
+/**
+ * After a Gene/Capsule bundle is accepted by Hub, compose a Recipe as the
+ * preferred public artifact. Skill Store publish is not the default outbound.
+ * Missing recipe capability or missing Gene is a no-op, never a publish failure.
+ */
+export declare function composeRecipeAfterAssetPublish(hub: Pick<HubCapability, 'recipes'>, payload: RecipeComposeInput): Promise<RecipeComposeResult>;