@webskill/sdk 0.2.4 → 0.2.6

package/dist/governance.d.ts

@@ -1,7 +1,7 @@
-import { F as SkillDocument, N as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-DZShzhon.js";
-import { d as SkillManager } from "./index-DrHelz72.js";
-//#region ../governance/dist/index.d.ts
+import { B as SkillManifest, I as SkillDocument, P as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-DJOha4b6.js";
+import { d as SkillManager } from "./index-DRlYzdr2.js";
+//#region ../governance/dist/documentSource-9dhqKIVQ.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
 type CandidateSource = 'runtime-miss' | 'document' | 'manual';
@@ -60,32 +60,6 @@ interface SkillVersion {
 }
 type SkillState = 'active' | 'quarantined' | 'deprecated' | 'disabled';
 //#endregion
-//#region src/candidate/candidateNormalizer.d.ts
-/** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
-declare function parseJsonObject(raw: string): Record<string, unknown>;
-/** 小写连字符化、≤64、过 isValidSkillName */
-declare function sanitizeCandidateName(raw: string): string;
-/**
- * 文件归一：补 SKILL.md；路径含 `..` / 以 `/` 开头 / 含 `\` → CANDIDATE_INVALID；
- * scripts/ 下必须是 .ts/.js。
- */
-declare function normalizeCandidateFiles(files: Array<{
-  path: string;
-  content: string;
-}>, name: string, description: string): CandidateFile[];
-/** 含脚本且 LLM 自报 low → 强制 medium 并追加"必须人工审批"原因 */
-declare function normalizeRisk(declared: unknown, files: CandidateFile[], reasons: string[]): {
-  risk: CandidateRisk;
-  reasons: string[];
-};
-/** 不信任归一化管线全链路；状态恒为 draft */
-declare function normalizeCandidate(input: {
-  raw: Record<string, unknown>;
-  source: CandidateSource;
-  now?: () => string;
-  createId?: () => string;
-}): CandidateSkill;
-//#endregion
 //#region src/candidate/candidateValidator.d.ts
 /** 候选校验：缺 SKILL.md / 非法扩展名 → CANDIDATE_INVALID */
 declare function validateCandidate(candidate: CandidateSkill): void;
@@ -123,27 +97,9 @@ declare class LlmCandidateGenerator {
   }): Promise<CandidateSkill>;
 }
 //#endregion
-//#region src/approval/policies.d.ts
-interface ApprovalDecision {
-  needsHuman: boolean;
-  reason: string;
-}
-interface ApprovalPolicy {
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-/** 默认策略：任何候选都必须人工审批 */
-declare class AlwaysHumanApprovalPolicy implements ApprovalPolicy {
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
-declare class CompositeApprovalPolicy implements ApprovalPolicy {
-  #private;
-  constructor(rules: Array<(candidate: CandidateSkill) => ApprovalDecision | undefined>, fallback?: ApprovalPolicy);
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-//#endregion
 //#region src/versioning/skillVersionStore.d.ts
-/** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断） */
+/** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断）。
+ *  保留策略：maxArchivesPerSkill（默认 5）超出时清理最旧版本（json + zip 归档一并删除）。 */
 declare class SkillVersionStore {
   #private;
   constructor(deps: {
@@ -152,6 +108,8 @@ declare class SkillVersionStore {
     now?: () => string;
     createId?: () => string;
     audit?: AuditLog;
+    /** 每技能保留的版本/归档上限（默认 5，超出清理最旧） */
+    maxArchivesPerSkill?: number;
   });
   add(skillName: string, input: {
     reason: string;
@@ -170,38 +128,6 @@ declare class SkillVersionStore {
   }): Promise<SkillVersion>;
 }
 //#endregion
-//#region src/approval/approvalWorkflow.d.ts
-/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
-declare class ApprovalWorkflow {
-  #private;
-  constructor(deps: {
-    policy: ApprovalPolicy;
-    audit: AuditLog;
-    store: CandidateStore;
-    skillManager: SkillManager;
-    versions: SkillVersionStore;
-    fs?: FileSystemProvider;
-  });
-  /** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
-  review(candidateId: string, input: {
-    actor: string;
-    uiBridge?: UiBridge;
-  }): Promise<CandidateSkill>;
-  /** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
-  publish(candidateId: string, input: {
-    actor: string;
-  }): Promise<SkillManifest>;
-  /**
-   * 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
-   * 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
-   * RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
-   */
-  applyRollback(skillName: string, versionId: string, input: {
-    actor: string;
-    reason?: string;
-  }): Promise<SkillManifest>;
-}
-//#endregion
 //#region src/audit/fsAuditLog.d.ts
 interface AuditChainVerification {
   ok: boolean;
@@ -362,18 +288,6 @@ declare class EvaluationRunner {
   run(tasks: EvaluationTask[]): Promise<EvaluationReport>;
 }
 //#endregion
-//#region src/evaluation/evaluationRuntime.d.ts
-/**
- * 治理评估专用 runtime 装配（不可信技能试用路径）：
- * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
- * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
- * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
- * 非安全边界；envWhitelist 同样适用于该执行器）。
- */
-declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
-  executor?: ScriptExecutor;
-}): WebSkillRuntime;
-//#endregion
 //#region src/evaluation/testSuggestion.d.ts
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 declare function suggestFromFailedRun(run: RuntimeRun): EvaluationTask;
@@ -445,6 +359,96 @@ interface SourceDocument {
 /** 读文档 + sha256 hash（变更检测用） */
 declare function readDocument(fs: FileSystemProvider, path: string): Promise<SourceDocument>;
 //#endregion
+//#region ../governance/dist/index.d.ts
+//#region src/candidate/candidateNormalizer.d.ts
+/** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
+declare function parseJsonObject(raw: string): Record<string, unknown>;
+/** 小写连字符化、≤64、过 isValidSkillName */
+declare function sanitizeCandidateName(raw: string): string;
+/**
+ * 文件归一：补 SKILL.md；路径含 `..` / 以 `/` 开头 / 含 `\` → CANDIDATE_INVALID；
+ * scripts/ 下必须是 .ts/.js。
+ */
+declare function normalizeCandidateFiles(files: Array<{
+  path: string;
+  content: string;
+}>, name: string, description: string): CandidateFile[];
+/** 含脚本且 LLM 自报 low → 强制 medium 并追加"必须人工审批"原因 */
+declare function normalizeRisk(declared: unknown, files: CandidateFile[], reasons: string[]): {
+  risk: CandidateRisk;
+  reasons: string[];
+};
+/** 不信任归一化管线全链路；状态恒为 draft */
+declare function normalizeCandidate(input: {
+  raw: Record<string, unknown>;
+  source: CandidateSource;
+  now?: () => string;
+  createId?: () => string;
+}): CandidateSkill;
+//#endregion
+//#region src/approval/policies.d.ts
+interface ApprovalDecision {
+  needsHuman: boolean;
+  reason: string;
+}
+interface ApprovalPolicy {
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+/** 默认策略：任何候选都必须人工审批 */
+declare class AlwaysHumanApprovalPolicy implements ApprovalPolicy {
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
+declare class CompositeApprovalPolicy implements ApprovalPolicy {
+  #private;
+  constructor(rules: Array<(candidate: CandidateSkill) => ApprovalDecision | undefined>, fallback?: ApprovalPolicy);
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+//#endregion
+//#region src/approval/approvalWorkflow.d.ts
+/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
+declare class ApprovalWorkflow {
+  #private;
+  constructor(deps: {
+    policy: ApprovalPolicy;
+    audit: AuditLog;
+    store: CandidateStore;
+    skillManager: SkillManager;
+    versions: SkillVersionStore;
+    fs?: FileSystemProvider;
+  });
+  /** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
+  review(candidateId: string, input: {
+    actor: string;
+    uiBridge?: UiBridge;
+  }): Promise<CandidateSkill>;
+  /** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
+  publish(candidateId: string, input: {
+    actor: string;
+  }): Promise<SkillManifest>;
+  /**
+   * 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+   * 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+   * RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+   */
+  applyRollback(skillName: string, versionId: string, input: {
+    actor: string;
+    reason?: string;
+  }): Promise<SkillManifest>;
+}
+//#endregion
+//#region src/evaluation/evaluationRuntime.d.ts
+/**
+ * 治理评估专用 runtime 装配（不可信技能试用路径）：
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+ * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+ * 非安全边界；envWhitelist 同样适用于该执行器）。
+ */
+declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
+  executor?: ScriptExecutor;
+}): WebSkillRuntime;
+//#endregion
 //#region src/documents/documentSkillExtractor.d.ts
 /** 文档 → LLM 抽取 → 完整防御管线 → draft 候选（source: document） */
 declare class DocumentSkillExtractor {