@webskill/sdk 0.2.5 → 0.2.7

package/dist/governance.d.ts

@@ -1,7 +1,7 @@
-import { B as SkillManifest, I as SkillDocument, P as SkillCatalogEntry, c as LlmClient, u as LlmMessage, v as UiBridge, w as FileSystemProvider } from "./types-CKm5G_eQ-krKWW8WV.js";
-import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-DfINBEOy.js";
-import { d as SkillManager } from "./index-CsDJvYGV.js";
-//#region ../governance/dist/index.d.ts
+import { G as SkillDocument, N as FileSystemProvider, U as SkillCatalogEntry, Y as SkillManifest, c as LlmClient, u as LlmMessage, v as UiBridge } from "./types-7fnqDVrf-BnRQjVU3.js";
+import { Q as ScriptExecutor, dt as WebSkillRuntime, ft as WebSkillRuntimeDeps, q as RuntimeRun, tt as SkillStateGuard } from "./index-BpIK7tJM.js";
+import { d as SkillManager } from "./index-BHL5FWGw.js";
+//#region ../governance/dist/documentSource-9dhqKIVQ.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
 type CandidateSource = 'runtime-miss' | 'document' | 'manual';
@@ -60,32 +60,6 @@ interface SkillVersion {
 }
 type SkillState = 'active' | 'quarantined' | 'deprecated' | 'disabled';
 //#endregion
-//#region src/candidate/candidateNormalizer.d.ts
-/** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
-declare function parseJsonObject(raw: string): Record<string, unknown>;
-/** 小写连字符化、≤64、过 isValidSkillName */
-declare function sanitizeCandidateName(raw: string): string;
-/**
- * 文件归一：补 SKILL.md；路径含 `..` / 以 `/` 开头 / 含 `\` → CANDIDATE_INVALID；
- * scripts/ 下必须是 .ts/.js。
- */
-declare function normalizeCandidateFiles(files: Array<{
-  path: string;
-  content: string;
-}>, name: string, description: string): CandidateFile[];
-/** 含脚本且 LLM 自报 low → 强制 medium 并追加"必须人工审批"原因 */
-declare function normalizeRisk(declared: unknown, files: CandidateFile[], reasons: string[]): {
-  risk: CandidateRisk;
-  reasons: string[];
-};
-/** 不信任归一化管线全链路；状态恒为 draft */
-declare function normalizeCandidate(input: {
-  raw: Record<string, unknown>;
-  source: CandidateSource;
-  now?: () => string;
-  createId?: () => string;
-}): CandidateSkill;
-//#endregion
 //#region src/candidate/candidateValidator.d.ts
 /** 候选校验：缺 SKILL.md / 非法扩展名 → CANDIDATE_INVALID */
 declare function validateCandidate(candidate: CandidateSkill): void;
@@ -123,25 +97,6 @@ declare class LlmCandidateGenerator {
   }): Promise<CandidateSkill>;
 }
 //#endregion
-//#region src/approval/policies.d.ts
-interface ApprovalDecision {
-  needsHuman: boolean;
-  reason: string;
-}
-interface ApprovalPolicy {
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-/** 默认策略：任何候选都必须人工审批 */
-declare class AlwaysHumanApprovalPolicy implements ApprovalPolicy {
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
-declare class CompositeApprovalPolicy implements ApprovalPolicy {
-  #private;
-  constructor(rules: Array<(candidate: CandidateSkill) => ApprovalDecision | undefined>, fallback?: ApprovalPolicy);
-  evaluate(candidate: CandidateSkill): ApprovalDecision;
-}
-//#endregion
 //#region src/versioning/skillVersionStore.d.ts
 /** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断）。
  *  保留策略：maxArchivesPerSkill（默认 5）超出时清理最旧版本（json + zip 归档一并删除）。 */
@@ -173,38 +128,6 @@ declare class SkillVersionStore {
   }): Promise<SkillVersion>;
 }
 //#endregion
-//#region src/approval/approvalWorkflow.d.ts
-/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
-declare class ApprovalWorkflow {
-  #private;
-  constructor(deps: {
-    policy: ApprovalPolicy;
-    audit: AuditLog;
-    store: CandidateStore;
-    skillManager: SkillManager;
-    versions: SkillVersionStore;
-    fs?: FileSystemProvider;
-  });
-  /** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
-  review(candidateId: string, input: {
-    actor: string;
-    uiBridge?: UiBridge;
-  }): Promise<CandidateSkill>;
-  /** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
-  publish(candidateId: string, input: {
-    actor: string;
-  }): Promise<SkillManifest>;
-  /**
-   * 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
-   * 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
-   * RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
-   */
-  applyRollback(skillName: string, versionId: string, input: {
-    actor: string;
-    reason?: string;
-  }): Promise<SkillManifest>;
-}
-//#endregion
 //#region src/audit/fsAuditLog.d.ts
 interface AuditChainVerification {
   ok: boolean;
@@ -365,18 +288,6 @@ declare class EvaluationRunner {
   run(tasks: EvaluationTask[]): Promise<EvaluationReport>;
 }
 //#endregion
-//#region src/evaluation/evaluationRuntime.d.ts
-/**
- * 治理评估专用 runtime 装配（不可信技能试用路径）：
- * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
- * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
- * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
- * 非安全边界；envWhitelist 同样适用于该执行器）。
- */
-declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
-  executor?: ScriptExecutor;
-}): WebSkillRuntime;
-//#endregion
 //#region src/evaluation/testSuggestion.d.ts
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 declare function suggestFromFailedRun(run: RuntimeRun): EvaluationTask;
@@ -448,6 +359,96 @@ interface SourceDocument {
 /** 读文档 + sha256 hash（变更检测用） */
 declare function readDocument(fs: FileSystemProvider, path: string): Promise<SourceDocument>;
 //#endregion
+//#region ../governance/dist/index.d.ts
+//#region src/candidate/candidateNormalizer.d.ts
+/** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
+declare function parseJsonObject(raw: string): Record<string, unknown>;
+/** 小写连字符化、≤64、过 isValidSkillName */
+declare function sanitizeCandidateName(raw: string): string;
+/**
+ * 文件归一：补 SKILL.md；路径含 `..` / 以 `/` 开头 / 含 `\` → CANDIDATE_INVALID；
+ * scripts/ 下必须是 .ts/.js。
+ */
+declare function normalizeCandidateFiles(files: Array<{
+  path: string;
+  content: string;
+}>, name: string, description: string): CandidateFile[];
+/** 含脚本且 LLM 自报 low → 强制 medium 并追加"必须人工审批"原因 */
+declare function normalizeRisk(declared: unknown, files: CandidateFile[], reasons: string[]): {
+  risk: CandidateRisk;
+  reasons: string[];
+};
+/** 不信任归一化管线全链路；状态恒为 draft */
+declare function normalizeCandidate(input: {
+  raw: Record<string, unknown>;
+  source: CandidateSource;
+  now?: () => string;
+  createId?: () => string;
+}): CandidateSkill;
+//#endregion
+//#region src/approval/policies.d.ts
+interface ApprovalDecision {
+  needsHuman: boolean;
+  reason: string;
+}
+interface ApprovalPolicy {
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+/** 默认策略：任何候选都必须人工审批 */
+declare class AlwaysHumanApprovalPolicy implements ApprovalPolicy {
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
+declare class CompositeApprovalPolicy implements ApprovalPolicy {
+  #private;
+  constructor(rules: Array<(candidate: CandidateSkill) => ApprovalDecision | undefined>, fallback?: ApprovalPolicy);
+  evaluate(candidate: CandidateSkill): ApprovalDecision;
+}
+//#endregion
+//#region src/approval/approvalWorkflow.d.ts
+/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
+declare class ApprovalWorkflow {
+  #private;
+  constructor(deps: {
+    policy: ApprovalPolicy;
+    audit: AuditLog;
+    store: CandidateStore;
+    skillManager: SkillManager;
+    versions: SkillVersionStore;
+    fs?: FileSystemProvider;
+  });
+  /** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
+  review(candidateId: string, input: {
+    actor: string;
+    uiBridge?: UiBridge;
+  }): Promise<CandidateSkill>;
+  /** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
+  publish(candidateId: string, input: {
+    actor: string;
+  }): Promise<SkillManifest>;
+  /**
+   * 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+   * 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+   * RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+   */
+  applyRollback(skillName: string, versionId: string, input: {
+    actor: string;
+    reason?: string;
+  }): Promise<SkillManifest>;
+}
+//#endregion
+//#region src/evaluation/evaluationRuntime.d.ts
+/**
+ * 治理评估专用 runtime 装配（不可信技能试用路径）：
+ * 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+ * env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+ * 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+ * 非安全边界；envWhitelist 同样适用于该执行器）。
+ */
+declare function createEvaluationRuntime(deps: WebSkillRuntimeDeps & {
+  executor?: ScriptExecutor;
+}): WebSkillRuntime;
+//#endregion
 //#region src/documents/documentSkillExtractor.d.ts
 /** 文档 → LLM 抽取 → 完整防御管线 → draft 候选（source: document） */
 declare class DocumentSkillExtractor {

package/dist/governance.js

@@ -1,12 +1,11 @@
 import { C as messageOf, M as unzipWithLimits, N as validateSkills, f as assertSafePathSegment, j as resolveInsideRoot, u as WebSkillError, x as isValidSkillName } from "./dist-BQzncxXg.js";
-import { S as WebSkillRuntime } from "./dist-B77plHjw.js";
-import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Chk8iB-E.js";
+import { S as WebSkillRuntime } from "./dist-BdOW8N4V.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-CcMIUXeZ.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
-import { createHash } from "node:crypto";
 
-//#region ../governance/dist/index.js
+//#region ../governance/dist/documentSource-C6gq6pbk.js
 const invalid = (message, details) => {
 	throw new WebSkillError("CANDIDATE_INVALID", message, details);
 };
@@ -217,180 +216,12 @@ var LlmCandidateGenerator = class {
 		return candidate;
 	}
 };
-/** 默认策略：任何候选都必须人工审批 */
-var AlwaysHumanApprovalPolicy = class {
-	evaluate(candidate) {
-		return {
-			needsHuman: true,
-			reason: `Candidate "${candidate.name}" requires human approval (risk: ${candidate.risk})`
-		};
-	}
-};
-/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
-var CompositeApprovalPolicy = class {
-	#rules;
-	#fallback;
-	constructor(rules, fallback) {
-		this.#rules = rules;
-		this.#fallback = fallback ?? new AlwaysHumanApprovalPolicy();
-	}
-	evaluate(candidate) {
-		for (const rule of this.#rules) {
-			const decision = rule(candidate);
-			if (decision) return decision;
-		}
-		return this.#fallback.evaluate(candidate);
-	}
-};
-/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
-var ApprovalWorkflow = class {
-	#policy;
-	#audit;
-	#store;
-	#skillManager;
-	#versions;
-	#fs;
-	constructor(deps) {
-		this.#policy = deps.policy;
-		this.#audit = deps.audit;
-		this.#store = deps.store;
-		this.#skillManager = deps.skillManager;
-		this.#versions = deps.versions;
-		this.#fs = deps.fs ?? new NodeFS();
-	}
-	/** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
-	async review(candidateId, input) {
-		const candidate = await this.#store.get(candidateId);
-		if (candidate.status !== "draft" && candidate.status !== "pending-review") throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidateId}" cannot be reviewed from status "${candidate.status}"`);
-		const decision = this.#policy.evaluate(candidate);
-		let approved;
-		if (decision.needsHuman) {
-			if (!input.uiBridge) {
-				await this.#store.updateStatus(candidateId, "pending-review");
-				throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" requires human approval: ${decision.reason}`);
-			}
-			await this.#store.updateStatus(candidateId, "pending-review");
-			const response = await input.uiBridge.request({
-				type: "confirm",
-				id: `approval-${candidateId}`,
-				message: `Approve candidate "${candidate.name}" (risk: ${candidate.risk})? ${decision.reason}`,
-				defaultValue: false
-			});
-			approved = response.cancelled !== true && response.value === true;
-		} else approved = true;
-		const updated = await this.#store.updateStatus(candidateId, approved ? "approved" : "rejected");
-		await this.#audit.append({
-			type: "candidate.reviewed",
-			target: candidateId,
-			actor: input.actor,
-			data: {
-				approved,
-				reason: decision.reason
-			}
-		});
-		return updated;
-	}
-	/** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
-	async publish(candidateId, input) {
-		const candidate = await this.#store.get(candidateId);
-		if (candidate.status !== "approved") throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" must be approved before publishing (status: ${candidate.status})`);
-		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-candidate-"))).split(path.sep).join("/");
-		try {
-			const skillDir = `${stagingRoot}/${candidate.name}`;
-			for (const file of candidate.files) await this.#fs.writeText(resolveInsideRoot(skillDir, file.path), file.content);
-			const report = await validateSkills(this.#fs, [stagingRoot]);
-			if (!report.ok) {
-				const errors = report.issues.filter((i) => i.severity === "error");
-				throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
-			}
-			const manifest = await this.#skillManager.install({
-				type: "local",
-				path: skillDir
-			});
-			const archiveOut = `${stagingRoot}/version-archive.zip`;
-			await exportArchive(this.#fs, `${this.#skillManager.managedRoot}/${candidate.name}`, {
-				format: "zip",
-				outPath: archiveOut
-			});
-			await this.#versions.add(candidate.name, {
-				reason: `Publish candidate ${candidateId}`,
-				manifest,
-				archive: await this.#fs.readBinary(archiveOut)
-			});
-			await this.#store.updateStatus(candidateId, "published");
-			await this.#audit.append({
-				type: "skill.published",
-				target: candidate.name,
-				actor: input.actor,
-				data: {
-					candidateId,
-					digest: manifest.integrity.digest
-				}
-			});
-			return manifest;
-		} catch (e) {
-			if (e instanceof WebSkillError) throw e;
-			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to publish candidate "${candidateId}": ${messageOf(e)}`, e);
-		} finally {
-			try {
-				await this.#fs.remove(stagingRoot, { recursive: true });
-			} catch {}
-		}
-	}
-	/**
-	* 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
-	* 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
-	* RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
-	*/
-	async applyRollback(skillName, versionId, input) {
-		assertSafePathSegment(skillName, "skill name");
-		assertSafePathSegment(versionId, "version id");
-		const version = await this.#versions.get(skillName, versionId);
-		const archive = await this.#versions.readArchive(skillName, versionId);
-		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-rollback-"))).split(path.sep).join("/");
-		try {
-			const skillDir = `${stagingRoot}/${skillName}`;
-			for (const [rel, content] of await unzipWithLimits(archive)) {
-				if (rel.endsWith("/")) continue;
-				await this.#fs.writeBinary(resolveInsideRoot(skillDir, rel), content);
-			}
-			const report = await validateSkills(this.#fs, [stagingRoot]);
-			if (!report.ok) {
-				const errors = report.issues.filter((i) => i.severity === "error");
-				throw new WebSkillError("GOVERNANCE_FAILED", `Rollback archive of "${skillName}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
-			}
-			const manifest = await this.#skillManager.install({
-				type: "local",
-				path: skillDir
-			});
-			if (manifest.integrity.digest !== version.manifest.integrity.digest) throw new WebSkillError("GOVERNANCE_FAILED", `Rollback of "${skillName}" to version "${versionId}" produced a digest mismatch: expected ${version.manifest.integrity.digest}, got ${manifest.integrity.digest}`);
-			await this.#versions.add(skillName, {
-				reason: input.reason ?? `Rollback to version ${versionId}`,
-				manifest,
-				archive
-			});
-			await this.#audit.append({
-				type: "skill.rolled_back",
-				target: skillName,
-				actor: input.actor,
-				data: {
-					targetVersionId: versionId,
-					reason: input.reason
-				}
-			});
-			return manifest;
-		} catch (e) {
-			if (e instanceof WebSkillError) throw e;
-			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to roll back "${skillName}" to version "${versionId}": ${messageOf(e)}`, e);
-		} finally {
-			try {
-				await this.#fs.remove(stagingRoot, { recursive: true });
-			} catch {}
-		}
-	}
-};
 const fileOf$1 = (root) => `${root}/.webskill/audit.jsonl`;
-const sha256Hex = (text) => createHash("sha256").update(text, "utf8").digest("hex");
+/** 环境无关 sha256（WebCrypto；Node ≥17 与浏览器均有 globalThis.crypto.subtle） */
+const sha256Hex$1 = async (text) => {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+};
 /** 链字段之外的规范化事件载荷（hash 计算输入） */
 function canonical(event) {
 	return JSON.stringify({
@@ -432,7 +263,7 @@ var FsAuditLog = class {
 		if (lines.length === 0) return "GENESIS";
 		try {
 			const last = JSON.parse(lines.at(-1));
-			return last.hash ?? sha256Hex(canonical(last));
+			return last.hash ?? await sha256Hex$1(canonical(last));
 		} catch (e) {
 			throw new WebSkillError("GOVERNANCE_FAILED", `Audit log tail line at ${path} is corrupted; refusing to append (the chain must not silently restart)`, e);
 		}
@@ -448,7 +279,7 @@ var FsAuditLog = class {
 			...event.data !== void 0 ? { data: event.data } : {},
 			prevHash
 		};
-		full.hash = sha256Hex(canonical(full));
+		full.hash = await sha256Hex$1(canonical(full));
 		await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
 		this.#lastHash = full.hash;
 		return full;
@@ -495,7 +326,7 @@ var FsAuditLog = class {
 				brokenAt: i,
 				reason: "prevHash link mismatch (events may have been removed or reordered)"
 			};
-			const expectedHash = sha256Hex(canonical(event));
+			const expectedHash = await sha256Hex$1(canonical(event));
 			if (event.hash !== expectedHash) return {
 				ok: false,
 				brokenAt: i,
@@ -871,19 +702,6 @@ var EvaluationRunner = class {
 		};
 	}
 };
-/**
-* 治理评估专用 runtime 装配（不可信技能试用路径）：
-* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
-* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
-* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
-* 非安全边界；envWhitelist 同样适用于该执行器）。
-*/
-function createEvaluationRuntime(deps) {
-	return new WebSkillRuntime({
-		...deps,
-		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
-	});
-}
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 function suggestFromFailedRun(run) {
 	const errorPatterns = run.trace.filter((e) => e.type === "tool.failed" || e.type === "run.failed").map((e) => String(e.data?.["code"] ?? e.message ?? "")).filter(Boolean);
@@ -977,15 +795,208 @@ var DependencyGraph = class DependencyGraph {
 		return out.sort();
 	}
 };
+/** 环境无关 sha256（WebCrypto；Node ≥17 与浏览器均有 globalThis.crypto.subtle） */
+async function sha256Hex(text) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 /** 读文档 + sha256 hash（变更检测用） */
 async function readDocument(fs, path) {
 	const content = await fs.readText(path);
 	return {
 		path,
 		content,
-		hash: createHash("sha256").update(content).digest("hex")
+		hash: await sha256Hex(content)
 	};
 }
+
+//#endregion
+//#region ../governance/dist/index.js
+/** 默认策略：任何候选都必须人工审批 */
+var AlwaysHumanApprovalPolicy = class {
+	evaluate(candidate) {
+		return {
+			needsHuman: true,
+			reason: `Candidate "${candidate.name}" requires human approval (risk: ${candidate.risk})`
+		};
+	}
+};
+/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
+var CompositeApprovalPolicy = class {
+	#rules;
+	#fallback;
+	constructor(rules, fallback) {
+		this.#rules = rules;
+		this.#fallback = fallback ?? new AlwaysHumanApprovalPolicy();
+	}
+	evaluate(candidate) {
+		for (const rule of this.#rules) {
+			const decision = rule(candidate);
+			if (decision) return decision;
+		}
+		return this.#fallback.evaluate(candidate);
+	}
+};
+/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
+var ApprovalWorkflow = class {
+	#policy;
+	#audit;
+	#store;
+	#skillManager;
+	#versions;
+	#fs;
+	constructor(deps) {
+		this.#policy = deps.policy;
+		this.#audit = deps.audit;
+		this.#store = deps.store;
+		this.#skillManager = deps.skillManager;
+		this.#versions = deps.versions;
+		this.#fs = deps.fs ?? new NodeFS();
+	}
+	/** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
+	async review(candidateId, input) {
+		const candidate = await this.#store.get(candidateId);
+		if (candidate.status !== "draft" && candidate.status !== "pending-review") throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidateId}" cannot be reviewed from status "${candidate.status}"`);
+		const decision = this.#policy.evaluate(candidate);
+		let approved;
+		if (decision.needsHuman) {
+			if (!input.uiBridge) {
+				await this.#store.updateStatus(candidateId, "pending-review");
+				throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" requires human approval: ${decision.reason}`);
+			}
+			await this.#store.updateStatus(candidateId, "pending-review");
+			const response = await input.uiBridge.request({
+				type: "confirm",
+				id: `approval-${candidateId}`,
+				message: `Approve candidate "${candidate.name}" (risk: ${candidate.risk})? ${decision.reason}`,
+				defaultValue: false
+			});
+			approved = response.cancelled !== true && response.value === true;
+		} else approved = true;
+		const updated = await this.#store.updateStatus(candidateId, approved ? "approved" : "rejected");
+		await this.#audit.append({
+			type: "candidate.reviewed",
+			target: candidateId,
+			actor: input.actor,
+			data: {
+				approved,
+				reason: decision.reason
+			}
+		});
+		return updated;
+	}
+	/** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
+	async publish(candidateId, input) {
+		const candidate = await this.#store.get(candidateId);
+		if (candidate.status !== "approved") throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" must be approved before publishing (status: ${candidate.status})`);
+		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-candidate-"))).split(path.sep).join("/");
+		try {
+			const skillDir = `${stagingRoot}/${candidate.name}`;
+			for (const file of candidate.files) await this.#fs.writeText(resolveInsideRoot(skillDir, file.path), file.content);
+			const report = await validateSkills(this.#fs, [stagingRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifest = await this.#skillManager.install({
+				type: "local",
+				path: skillDir
+			});
+			const archiveOut = `${stagingRoot}/version-archive.zip`;
+			await exportArchive(this.#fs, `${this.#skillManager.managedRoot}/${candidate.name}`, {
+				format: "zip",
+				outPath: archiveOut
+			});
+			await this.#versions.add(candidate.name, {
+				reason: `Publish candidate ${candidateId}`,
+				manifest,
+				archive: await this.#fs.readBinary(archiveOut)
+			});
+			await this.#store.updateStatus(candidateId, "published");
+			await this.#audit.append({
+				type: "skill.published",
+				target: candidate.name,
+				actor: input.actor,
+				data: {
+					candidateId,
+					digest: manifest.integrity.digest
+				}
+			});
+			return manifest;
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to publish candidate "${candidateId}": ${messageOf(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
+		}
+	}
+	/**
+	* 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+	* 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+	* RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+	*/
+	async applyRollback(skillName, versionId, input) {
+		assertSafePathSegment(skillName, "skill name");
+		assertSafePathSegment(versionId, "version id");
+		const version = await this.#versions.get(skillName, versionId);
+		const archive = await this.#versions.readArchive(skillName, versionId);
+		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-rollback-"))).split(path.sep).join("/");
+		try {
+			const skillDir = `${stagingRoot}/${skillName}`;
+			for (const [rel, content] of await unzipWithLimits(archive)) {
+				if (rel.endsWith("/")) continue;
+				await this.#fs.writeBinary(resolveInsideRoot(skillDir, rel), content);
+			}
+			const report = await validateSkills(this.#fs, [stagingRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("GOVERNANCE_FAILED", `Rollback archive of "${skillName}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifest = await this.#skillManager.install({
+				type: "local",
+				path: skillDir
+			});
+			if (manifest.integrity.digest !== version.manifest.integrity.digest) throw new WebSkillError("GOVERNANCE_FAILED", `Rollback of "${skillName}" to version "${versionId}" produced a digest mismatch: expected ${version.manifest.integrity.digest}, got ${manifest.integrity.digest}`);
+			await this.#versions.add(skillName, {
+				reason: input.reason ?? `Rollback to version ${versionId}`,
+				manifest,
+				archive
+			});
+			await this.#audit.append({
+				type: "skill.rolled_back",
+				target: skillName,
+				actor: input.actor,
+				data: {
+					targetVersionId: versionId,
+					reason: input.reason
+				}
+			});
+			return manifest;
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to roll back "${skillName}" to version "${versionId}": ${messageOf(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
+		}
+	}
+};
+/**
+* 治理评估专用 runtime 装配（不可信技能试用路径）：
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+* 非安全边界；envWhitelist 同样适用于该执行器）。
+*/
+function createEvaluationRuntime(deps) {
+	return new WebSkillRuntime({
+		...deps,
+		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
+	});
+}
 const EXTRACT_PROMPT = (doc, nameHint) => [
 	"Extract an executable skill from the following document as STRICT JSON only.",
 	"Schema: {\"name\": string, \"description\": string, \"risk\": \"low\"|\"medium\"|\"high\",",