@webskill/sdk 0.13.0 → 0.15.0

package/dist/external-_ZRQe-V9.js

@@ -0,0 +1,53 @@
+//#region ../runtime/src/tools/normalizeContent.ts
+const MCP_CONTENT_RE = /^(text|json|image|resource|audio)$/;
+/**
+* 脚本返回值归一到 MCP content 格式：数组沿用（逐项归一），
+* 字符串包装为 text，其他值序列化包装。Node/浏览器执行器共享。
+* 产出只有文本型分片：脚本侧没有下发图像的通道（图像只来自页面取像）。
+*/
+function normalizeToolContent(value) {
+	if (Array.isArray(value)) return value.map((item) => {
+		if (typeof item === "object" && item !== null && typeof item.type === "string" && MCP_CONTENT_RE.test(item.type)) {
+			const { type, ...rest } = item;
+			if (type === "json") return {
+				type: "json",
+				data: rest["data"] ?? rest
+			};
+			return {
+				type: "text",
+				text: typeof rest["text"] === "string" ? rest["text"] : JSON.stringify(rest)
+			};
+		}
+		return {
+			type: "text",
+			text: typeof item === "string" ? item : JSON.stringify(item)
+		};
+	});
+	if (typeof value === "string") return [{
+		type: "text",
+		text: value
+	}];
+	if (value === void 0 || value === null) return [{
+		type: "text",
+		text: ""
+	}];
+	return [{
+		type: "text",
+		text: typeof value === "object" ? JSON.stringify(value) : String(value)
+	}];
+}
+
+//#endregion
+//#region ../runtime/src/engine/external.ts
+/**
+* Catalog 合并：同名本地优先；外部条目的 mcp:// 根 URI 保留，
+* 调用方可凭 URI 强制选择外部技能（绕过本地优先）。
+*/
+function mergeCatalogEntries(localEntries, providerEntries) {
+	const byName = new Map(localEntries.map((e) => [e.name, e]));
+	for (const entry of providerEntries) if (!byName.has(entry.name)) byName.set(entry.name, entry);
+	return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+//#endregion
+export { normalizeToolContent as n, mergeCatalogEntries as t };

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { R as FileSystemProvider, S as UiBridge, U as Page, W as PageQuery, f as LlmMessage, it as SkillCatalogEntry, l as LlmClient, ot as SkillDocument, ut as SkillManagerPort } from "./types-DLctJep_-B5G4uk2u.js";
-import { $t as SkillOutcomeReporter, In as WebSkillRuntime, Pt as RuntimeRun, Qt as SkillIntegrityGuard, Y as IntegrityVerdict, rn as SkillStateGuard } from "./index-DkvBhJQy.js";
-import { _ as SkillState, a as AuditLog, b as SkillVersionStore, c as CandidateFile, d as CandidateSkill, f as CandidateSource, g as SKILL_VERSION_PAGE_SIZE, h as CompositeApprovalPolicy, i as AuditEvent, l as CandidatePage, m as CandidateStore, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStatus, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateRisk, v as SkillVersion, x as candidateToCatalogEntry, y as SkillVersionPage } from "./skillVersionStore-D-qHk9ZE-DheTIwAB.js";
+import { S as UiBridge, U as FileSystemProvider, X as PageQuery, Y as Page, f as LlmMessage, ft as SkillDocument, gt as SkillManagerPort, l as LlmClient, ut as SkillCatalogEntry } from "./types-C3V6lAeO-BIf7UB2e.js";
+import { $ as IntegrityVerdict, Wn as WebSkillRuntime, cn as SkillStateGuard, in as SkillOutcomeReporter, rn as SkillIntegrityGuard, zt as RuntimeRun } from "./index-Oc3H89TJ.js";
+import { _ as SkillState, a as AuditLog, b as SkillVersionStore, c as CandidateFile, d as CandidateSkill, f as CandidateSource, g as SKILL_VERSION_PAGE_SIZE, h as CompositeApprovalPolicy, i as AuditEvent, l as CandidatePage, m as CandidateStore, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStatus, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateRisk, v as SkillVersion, x as candidateToCatalogEntry, y as SkillVersionPage } from "./skillVersionStore-B24Jjjry-C4zomhMZ.js";
 //#region ../governance/dist/index.d.ts
 //#region src/candidate/candidateNormalizer.d.ts
 /** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
@@ -205,12 +205,24 @@ declare const AUDIT_EVENT_TYPES: {
   readonly candidateSubmitted: "candidate.submitted";
   readonly candidateApproved: "candidate.approved";
   readonly candidateRejected: "candidate.rejected";
+  /** 候选记录被从审批队列里删除（仅 draft / pending-review / rejected 可删） */
+  readonly candidateRemoved: "candidate.removed";
   readonly pagePerceived: "page.perceived";
   readonly pageAction: "page.action";
+  /**
+   * 一次页面操作引发了下载，但 `sandbox.downloadedFiles` 关着，模型因此一无所知
+   * （0.15.0 分册 15 · FR-15.7）。载荷只有计数与原因，不含文件名 / 大小 / 类型。
+   */
+  readonly pageDownloadUnreported: "page.download.unreported";
   readonly documentRead: "document.read";
   readonly documentSurfaceOpen: "document.surface.open";
   /** 脚本按宿主声明的数据源取数（分册 16）；被拒也记，否则反复试探看不见 */
   readonly dataFetched: "data.fetch";
+  /**
+   * 技能脚本读用户本轮上传的文件（0.15.0 分册 17 · FR-17.7）。
+   * 载荷记文件名 / 类型 / 字节数与是否被拒，**不含文件内容**。
+   */
+  readonly uploadFileRead: "upload.file.read";
 };
 type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES];
 /** 稳定展示序：筛选下拉与文档表格都从这里取，不各自维护一份顺序 */

package/dist/governance.js

@@ -1,8 +1,10 @@
-import { M as messageOf, _ as assertSafePathSegment, h as WebSkillError, k as isValidSkillName, v as atomicWriteText } from "./dist-Bev6i6Ip.js";
-import { a as textParts, n as partsToText } from "./memoryArtifactStore-52Zn9npI-LbCQaqyx.js";
-import { n as AUDIT_EVENT_TYPE_LIST, t as AUDIT_EVENT_TYPES } from "./eventTypes-FllCrX-Z-DNDeHWoG.js";
+import { n as messageOf, t as WebSkillError } from "./errors-BDZNpC13.js";
+import { y as isValidSkillName } from "./skill-CAJMsLod.js";
+import { a as atomicWriteText, t as assertSafePathSegment } from "./pathSecurity-B1owvJAF.js";
+import { d as partsToText, p as textParts } from "./llm-B7lLH0ZI.js";
+import { n as AUDIT_EVENT_TYPE_LIST, t as AUDIT_EVENT_TYPES } from "./eventTypes-Y07N8IAC.js";
 
-//#region ../governance/dist/index.js
+//#region ../governance/src/candidate/candidateNormalizer.ts
 const invalid = (message, details) => {
 	throw new WebSkillError("CANDIDATE_INVALID", message, details);
 };
@@ -96,11 +98,17 @@ function normalizeCandidate(input) {
 		updatedAt: now
 	};
 }
+
+//#endregion
+//#region ../governance/src/candidate/candidateValidator.ts
 /** 候选校验：缺 SKILL.md / 非法扩展名 → CANDIDATE_INVALID */
 function validateCandidate(candidate) {
 	if (!candidate.files.some((f) => f.kind === "skill-md")) throw new WebSkillError("CANDIDATE_INVALID", `Candidate "${candidate.name}" is missing SKILL.md`);
 	for (const file of candidate.files) if (file.kind === "script" && !/\.(ts|js)$/.test(file.path)) throw new WebSkillError("CANDIDATE_INVALID", `Candidate "${candidate.name}" has an unsupported script file: ${file.path}`);
 }
+
+//#endregion
+//#region ../governance/src/pagination.ts
 /**
 * 治理侧各列表共用的游标切片，形状与会话消息（C1）完全一致：
 * 无游标给**最新**一页，`nextCursor` 指向更早的历史，页内按时间升序。
@@ -125,6 +133,9 @@ function takeTailPage(all, options, defaultLimit, what) {
 		...start > 0 ? { nextCursor: String(start) } : {}
 	};
 }
+
+//#endregion
+//#region ../governance/src/candidate/candidateStore.ts
 const dirOf$1 = (root) => `${root}/.webskill/candidates`;
 /** 候选列表的缺省页长。缺省属于实现，不属于调用方 */
 const CANDIDATE_PAGE_SIZE = 50;
@@ -132,9 +143,11 @@ const CANDIDATE_PAGE_SIZE = 50;
 var CandidateStore = class {
 	#root;
 	#fs;
+	#isSkillInstalled;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
+		this.#isSkillInstalled = deps.isSkillInstalled;
 	}
 	async save(candidate) {
 		validateCandidate(candidate);
@@ -175,6 +188,24 @@ var CandidateStore = class {
 		await this.save(candidate);
 		return candidate;
 	}
+	/**
+	* 把候选记录从队列里删掉。
+	*
+	* `approved` 恒拒删：它是「已批准但还没发布」，删掉等于让批准过的东西凭空消失；
+	* 要清理先 `reject`（留下理由）再删。
+	* `published` 是已安装技能的来源凭证，技能还装着时同样拒删；技能卸载后它只剩堆在队列里，
+	* 此时可删（0.15.0 分册 16 D-16-2）。未注入 `isSkillInstalled` 时判断不了装没装，
+	* 退化为「published 一律拒删」——宁可留着清不掉，也不能把还装着的技能的来源凭证删了。
+	*/
+	async remove(id) {
+		const candidate = await this.get(id);
+		if (candidate.status === "approved") throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" cannot be removed from status "${candidate.status}"`);
+		if (candidate.status === "published" && await this.#skillStillInstalled(candidate.name)) throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" is the provenance record of an installed skill and cannot be removed; uninstall the skill first`);
+		await this.#fs.remove(`${dirOf$1(this.#root)}/${id}.json`);
+	}
+	async #skillStillInstalled(name) {
+		return this.#isSkillInstalled === void 0 ? true : await this.#isSkillInstalled(name);
+	}
 };
 /** 硬门禁：仅 published 可转换为 Catalog 条目，否则 APPROVAL_REQUIRED */
 function candidateToCatalogEntry(candidate) {
@@ -189,6 +220,9 @@ function candidateToCatalogEntry(candidate) {
 		hasAssets: candidate.files.some((f) => f.kind === "asset")
 	};
 }
+
+//#endregion
+//#region ../governance/src/candidate/candidateSink.ts
 /**
 * 把 agent 生成的技能草稿接进既有的候选管线（设计 02 §5）。
 *
@@ -232,6 +266,9 @@ function createCandidateSink(options) {
 		return { id: candidate.id };
 	} };
 }
+
+//#endregion
+//#region ../governance/src/llmText.ts
 /**
 * 文本补全：优先走流式（慢速本地模型下非流式整响应缓冲会触发 fetch 头超时，
 * SSE 首包秒到不受此限）；无 stream 的客户端回退 complete。
@@ -246,6 +283,9 @@ async function completeText(llm, messages) {
 	}
 	return partsToText((await llm.complete({ messages })).content);
 }
+
+//#endregion
+//#region ../governance/src/candidate/llmCandidateGenerator.ts
 const GENERATION_PROMPT = (task, context) => [
 	"You generate a skill candidate as STRICT JSON only (no markdown, no explanation).",
 	"Schema: {\"name\": string, \"description\": string, \"risk\": \"low\"|\"medium\"|\"high\",",
@@ -293,6 +333,9 @@ var LlmCandidateGenerator = class {
 		return candidate;
 	}
 };
+
+//#endregion
+//#region ../governance/src/approval/policies.ts
 /** 默认策略：任何候选都必须人工审批 */
 var AlwaysHumanApprovalPolicy = class {
 	evaluate(candidate) {
@@ -318,6 +361,9 @@ var CompositeApprovalPolicy = class {
 		return this.#fallback.evaluate(candidate);
 	}
 };
+
+//#endregion
+//#region ../governance/src/audit/fsAuditLog.ts
 const fileOf$1 = (root) => `${root}/.webskill/audit.jsonl`;
 /** 审计查询的缺省页长。缺省属于实现，不属于调用方 */
 const AUDIT_PAGE_SIZE = 100;
@@ -572,6 +618,9 @@ var FsAuditLog = class {
 		};
 	}
 };
+
+//#endregion
+//#region ../governance/src/versioning/skillVersionStore.ts
 const dirOf = (root, skillName) => {
 	assertSafePathSegment(skillName, "skill name");
 	return `${root}/.webskill/versions/${skillName}`;
@@ -669,6 +718,9 @@ var SkillVersionStore = class {
 		});
 	}
 };
+
+//#endregion
+//#region ../governance/src/repair/failureAnalyzer.ts
 const ERROR_CAUSES = {
 	TOOL_NOT_FOUND: "The skill script or tool is missing",
 	TOOL_EXECUTION_FAILED: "The script failed at runtime",
@@ -720,6 +772,9 @@ var FailureAnalyzer = class {
 		};
 	}
 };
+
+//#endregion
+//#region ../governance/src/repair/repairPlanner.ts
 /**
 * 修订选项规划：patch（按诊断给具体文件变更）/ rollback（有旧版本时）/ quarantine。
 * 注意：任何 option 的 apply 都必须经 ApprovalWorkflow 审批后执行；rollback 选项（targetVersionId）经 ApprovalWorkflow.applyRollback 真实恢复文件。
@@ -748,6 +803,9 @@ var RepairPlanner = class {
 		return options;
 	}
 };
+
+//#endregion
+//#region ../governance/src/state/skillStatePolicy.ts
 const fileOf = (root) => `${root}/.webskill/states.json`;
 /**
 * 用户策略主动拒绝的错误码（FR-12.4）：这是配置生效的证据，不是技能有问题，不计入隔离阈值。
@@ -1013,6 +1071,9 @@ var SkillStatePolicy = class {
 		});
 	}
 };
+
+//#endregion
+//#region ../governance/src/evaluation/evaluationRunner.ts
 function matchExpected(expected, output, run) {
 	if (expected === void 0) return run.status === "completed";
 	if (typeof expected === "string") return output.includes(expected);
@@ -1067,6 +1128,9 @@ var EvaluationRunner = class {
 		};
 	}
 };
+
+//#endregion
+//#region ../governance/src/evaluation/testSuggestion.ts
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 function suggestFromFailedRun(run) {
 	const errorPatterns = run.trace.filter((e) => e.type === "tool.failed" || e.type === "run.failed").map((e) => String(e.data?.["code"] ?? e.message ?? "")).filter(Boolean);
@@ -1084,6 +1148,9 @@ function suggestFromFailedRun(run) {
 		}
 	};
 }
+
+//#endregion
+//#region ../governance/src/scoring/skillScorer.ts
 const SCORING_WEIGHTS = {
 	success: .5,
 	usage: .2,
@@ -1116,6 +1183,9 @@ var SkillScorer = class {
 		};
 	}
 };
+
+//#endregion
+//#region ../governance/src/scoring/similarity.ts
 const tokenize = (text) => new Set(text.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 1));
 function jaccardSimilarity(a, b) {
 	const sa = tokenize(a);
@@ -1136,6 +1206,9 @@ var SimilarityDetector = class {
 		for (const skill of existing) if (jaccardSimilarity(description, skill.description) >= this.#threshold) return skill.name;
 	}
 };
+
+//#endregion
+//#region ../governance/src/scoring/dependencyGraph.ts
 var DependencyGraph = class DependencyGraph {
 	#edges = /* @__PURE__ */ new Map();
 	addDependency(from, to) {
@@ -1163,6 +1236,9 @@ var DependencyGraph = class DependencyGraph {
 		return out.sort();
 	}
 };
+
+//#endregion
+//#region ../governance/src/documents/documentSource.ts
 /** 环境无关 sha256（WebCrypto；Node ≥17 与浏览器均有 globalThis.crypto.subtle） */
 async function sha256Hex(text) {
 	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
@@ -1177,6 +1253,9 @@ async function readDocument(fs, path) {
 		hash: await sha256Hex(content)
 	};
 }
+
+//#endregion
+//#region ../governance/src/documents/documentSkillExtractor.ts
 const EXTRACT_PROMPT = (doc, nameHint) => [
 	"Extract an executable skill from the following document as STRICT JSON only.",
 	"Schema: {\"name\": string, \"description\": string, \"risk\": \"low\"|\"medium\"|\"high\",",
@@ -1245,6 +1324,9 @@ var DocumentSkillExtractor = class {
 		};
 	}
 };
+
+//#endregion
+//#region ../governance/src/missHook.ts
 /**
 * runtime-miss 现成适配（opt-in）：run 未激活技能时生成 draft 候选入库待审。
 * 返回的 hook 失败会向上抛（由 runtime 降级为 warning）。