@webskill/sdk 0.1.4 → 0.2.0

package/dist/{dist-DvoBsChX.js → dist-D0saNPi_.js}

@@ -1,5 +1,5 @@
 import { parse } from "yaml";
-import { zipSync } from "fflate";
+import { Unzip, UnzipInflate, zipSync } from "fflate";
 
 //#region ../core/dist/index.js
 /**
@@ -39,16 +39,22 @@ async function buildManifest(input) {
 		files: input.files
 	};
 }
-/** 按 manifest.files 比对实际 hash（调用方负责计算 actualHashes） */
-function verifyManifest(manifest, actualHashes) {
+/** 按 manifest.files 比对实际 hash 与文件集（mismatches/extras/missing 三类全空才 ok） */
+function verifyManifest(manifest, actualHashes, actualFiles = [...actualHashes.keys()]) {
 	const mismatches = [];
+	const missing = [];
+	const listed = new Set(manifest.files.map((f) => f.path));
 	for (const file of manifest.files) {
 		const actual = actualHashes.get(file.path);
-		if (actual === void 0 || actual !== file.sha256) mismatches.push(file.path);
+		if (actual === void 0) missing.push(file.path);
+		else if (actual !== file.sha256) mismatches.push(file.path);
 	}
+	const extras = actualFiles.filter((p) => p !== "webskill.skill-manifest.json" && p !== "skills.lock.json" && !listed.has(p)).sort();
 	return {
-		ok: mismatches.length === 0,
-		mismatches
+		ok: mismatches.length === 0 && missing.length === 0 && extras.length === 0,
+		mismatches,
+		extras,
+		missing
 	};
 }
 const ROOT = "/";
@@ -168,7 +174,26 @@ var MemoryFS = class {
 		for (const k of descendants) this.#entries.delete(k);
 		this.#entries.delete(key);
 	}
+	async rename(from, to) {
+		const src = this.#normalize(from);
+		const dst = this.#normalize(to);
+		const entry = this.#entries.get(src);
+		if (!entry) throw new WebSkillError("FS_NOT_FOUND", `Path not found: ${src}`);
+		const prefix = src + "/";
+		const descendants = [...this.#entries.entries()].filter(([k]) => k.startsWith(prefix));
+		this.#ensureParents(dst);
+		this.#entries.set(dst, entry);
+		for (const [k, v] of descendants) this.#entries.set(dst + k.slice(src.length), v);
+		for (const [k] of descendants) this.#entries.delete(k);
+		this.#entries.delete(src);
+	}
 };
+/** 原子写文本：先写临时文件再 rename（进程崩溃不留下半写文件；lockfile 等账本场景） */
+async function atomicWriteText(fs, path, content) {
+	const tmp = `${path}.tmp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+	await fs.writeText(tmp, content);
+	await fs.rename(tmp, path);
+}
 /** 统一分隔符为 `/`，去除 `.` 段与重复分隔符（不解析 `..`） */
 function normalizePath(path) {
 	return path.replace(/\\/g, "/").split("/").filter((s) => s !== "" && s !== ".").join("/");
@@ -407,6 +432,107 @@ function parseSkillPackManifest(text) {
 	}
 	return raw;
 }
+const DEFAULT_ARCHIVE_LIMITS = {
+	maxDownloadBytes: 64 * 1024 * 1024,
+	maxEntryBytes: 64 * 1024 * 1024,
+	maxTotalBytes: 256 * 1024 * 1024
+};
+function resolveArchiveLimits(limits) {
+	return {
+		...DEFAULT_ARCHIVE_LIMITS,
+		...limits
+	};
+}
+function concat(chunks, size) {
+	const out = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
+/** 流式解 zip（单条目/总双重上限）；返回 [path, content][]（目录条目以 / 结尾、内容为空） */
+async function unzipWithLimits(data, limits) {
+	const { maxEntryBytes, maxTotalBytes } = resolveArchiveLimits(limits);
+	let eocd = false;
+	const scanFrom = Math.max(0, data.length - 65557);
+	for (let i = data.length - 22; i >= scanFrom; i--) if (data[i] === 80 && data[i + 1] === 75 && data[i + 2] === 5 && data[i + 3] === 6) {
+		eocd = true;
+		break;
+	}
+	if (!eocd) throw new WebSkillError("INSTALL_FAILED", "Failed to read zip archive: missing end-of-central-directory record");
+	const entries = [];
+	let total = 0;
+	let failure;
+	const unzip = new Unzip();
+	unzip.register(UnzipInflate);
+	unzip.onfile = (file) => {
+		if (file.name.endsWith("/")) {
+			entries.push([file.name, /* @__PURE__ */ new Uint8Array(0)]);
+			return;
+		}
+		const chunks = [];
+		let size = 0;
+		file.ondata = (err, chunk, final) => {
+			if (err) {
+				failure = err;
+				return;
+			}
+			size += chunk.length;
+			if (size > maxEntryBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive entry exceeds the ${maxEntryBytes}-byte limit: ${file.name}`);
+				return;
+			}
+			total += chunk.length;
+			if (total > maxTotalBytes) {
+				failure = new WebSkillError("INSTALL_FAILED", `Archive contents exceed the ${maxTotalBytes}-byte total limit`);
+				return;
+			}
+			chunks.push(chunk);
+			if (final) entries.push([file.name, concat(chunks, size)]);
+		};
+		file.start();
+	};
+	try {
+		unzip.push(data, true);
+	} catch (e) {
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	await new Promise((resolve) => {
+		setTimeout(resolve, 0);
+	});
+	if (failure) {
+		if (failure instanceof WebSkillError) throw failure;
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${failure instanceof Error ? failure.message : String(failure)}`, failure);
+	}
+	return entries;
+}
+/** 下载响应体：Content-Length 预检 + 流式累计上限 */
+async function readResponseWithLimit(res, limits) {
+	const { maxDownloadBytes } = resolveArchiveLimits(limits);
+	const declared = res.headers.get("content-length");
+	if (declared !== null && Number(declared) > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit (Content-Length: ${declared})`);
+	if (!res.body) {
+		const buf = new Uint8Array(await res.arrayBuffer());
+		if (buf.length > maxDownloadBytes) throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		return buf;
+	}
+	const reader = res.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { value, done } = await reader.read();
+		if (done) break;
+		size += value.length;
+		if (size > maxDownloadBytes) {
+			await reader.cancel().catch(() => void 0);
+			throw new WebSkillError("INSTALL_FAILED", `Download exceeds the ${maxDownloadBytes}-byte limit`);
+		}
+		chunks.push(value);
+	}
+	return concat(chunks, size);
+}
 /** 由条目列表构建 Catalog，保证按名称排序 */
 function buildCatalog(entries) {
 	return { entries: [...entries].sort((a, b) => a.name.localeCompare(b.name)) };
@@ -463,8 +589,7 @@ var SkillDiscovery = class {
 				});
 				continue;
 			}
-			for (const child of await this.#fs.list(root)) {
-				if (child.type !== "directory") continue;
+			await Promise.all((await this.#fs.list(root)).filter((child) => child.type === "directory").map(async (child) => {
 				const dirName = baseName(child.path);
 				const skillRoot = `${root}/${dirName}`;
 				const skillMdPath = `${skillRoot}/SKILL.md`;
@@ -489,7 +614,7 @@ var SkillDiscovery = class {
 					const dependencies = metadata["dependencies"];
 					adjacency.set(metadata.name, Array.isArray(dependencies) ? dependencies.filter((d) => typeof d === "string") : []);
 				}
-			}
+			}));
 		}
 		const cycles = checkDependencyCycles(adjacency);
 		const claimedNames = /* @__PURE__ */ new Set();
@@ -523,6 +648,25 @@ var SkillDiscovery = class {
 			});
 		}
 		issues.push(...cycles.issues);
+		const admitted = new Set(entries.map((e) => e.name));
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const entry of [...entries]) {
+				const missing = (adjacency.get(entry.name) ?? []).filter((d) => !admitted.has(d));
+				if (missing.length === 0) continue;
+				entries.splice(entries.indexOf(entry), 1);
+				admitted.delete(entry.name);
+				this.#index.delete(entry.name);
+				issues.push({
+					code: "SKILL_UNKNOWN_DEPENDENCY",
+					severity: "error",
+					message: `Skill "${entry.name}" was excluded: dependency ${JSON.stringify(missing[0])} is not in the final catalog`,
+					path: entry.root
+				});
+				changed = true;
+			}
+		}
 		entries.sort((a, b) => a.name.localeCompare(b.name));
 		return {
 			entries,
@@ -599,4 +743,4 @@ const xmlRenderer = {
 };
 
 //#endregion
-export { renderAvailableSkillsXml as C, verifyManifest as D, validateSkills as E, xmlRenderer as O, parseSkillPackManifest as S, resolveInsideRoot as T, exportSkills as _, SKILL_NAME_PATTERN as a, normalizePath as b, SkillReader as c, buildCatalog as d, buildManifest as f, escapeXml as g, computeDigest as h, SKILL_NAME_MAX_LENGTH as i, WebSkillError as l, checkSkillRules as m, SKILLS_LOCKFILE as n, SKILL_PACK_FILE as o, checkDependencyCycles as p, SKILL_MANIFEST_FILE as r, SkillDiscovery as s, MemoryFS as t, assertSafePathSegment as u, isValidSkillName as v, renderCatalogJson as w, parseSkillMarkdown as x, jsonRenderer as y };
+export { unzipWithLimits as A, parseSkillMarkdown as C, renderCatalogJson as D, renderAvailableSkillsXml as E, verifyManifest as M, xmlRenderer as N, resolveArchiveLimits as O, normalizePath as S, readResponseWithLimit as T, computeDigest as _, SKILL_NAME_MAX_LENGTH as a, isValidSkillName as b, SkillDiscovery as c, assertSafePathSegment as d, atomicWriteText as f, checkSkillRules as g, checkDependencyCycles as h, SKILL_MANIFEST_FILE as i, validateSkills as j, resolveInsideRoot as k, SkillReader as l, buildManifest as m, MemoryFS as n, SKILL_NAME_PATTERN as o, buildCatalog as p, SKILLS_LOCKFILE as r, SKILL_PACK_FILE as s, DEFAULT_ARCHIVE_LIMITS as t, WebSkillError as u, escapeXml as v, parseSkillPackManifest as w, jsonRenderer as x, exportSkills as y };