@webskill/sdk 0.7.0 → 0.9.0

package/dist/{dist-8oQRa8Xz.js → dist-Bev6i6Ip.js}

@@ -76,6 +76,14 @@ function verifyManifest(manifest, actualHashes, actualFiles = [...actualHashes.k
 	};
 }
 /**
+* 原子写的临时文件名后缀模式；列举/打包侧据此排除中断残留（0.9.0 分册 11）。
+* 单一来源：不要在别处手写正则（AC-G10），复制正则必然漂移。
+* @stable
+*/
+const ATOMIC_TMP_SUFFIX_PATTERN = /\.tmp-\d+-[a-z0-9]+$/;
+/** 该路径是否是 atomicWriteText 留下的临时文件 */
+const isAtomicTempPath = (path) => ATOMIC_TMP_SUFFIX_PATTERN.test(path);
+/**
 * 原子写文本：先写临时文件再 rename（进程崩溃不留下半写文件；lockfile 等账本场景）。
 * 原子性强弱取决于 provider 的 rename 实现：NodeFS/MemoryFS 为真 rename；
 * OPFS 无原生 move，rename 是 copy+delete（非原子，崩溃可能残留双份），
@@ -656,7 +664,7 @@ async function listFilesRecursive(fs, root, prefix = "") {
 	for (const entry of await fs.list(root)) {
 		const rel = prefix === "" ? baseName$1(entry.path) : `${prefix}/${baseName$1(entry.path)}`;
 		if (entry.type === "directory") out.push(...await listFilesRecursive(fs, entry.path, rel));
-		else out.push(rel);
+		else if (!isAtomicTempPath(baseName$1(entry.path))) out.push(rel);
 	}
 	return out;
 }
@@ -714,6 +722,87 @@ function parseSkillPackManifest(text) {
 	}
 	return raw;
 }
+const SKILL_FILE = "SKILL.md";
+function normalize(path) {
+	return path.replace(/^\.?\//, "");
+}
+/**
+* 按归档条目表判定包结构。
+*
+* 入参是条目表而不是文件系统：预览侧只有解压后的 entries，没有落盘的目录。
+* 只看路径，不读内容——内容合法性由 checkSkillRules 负责，两者不重叠。
+*/
+function detectSkillArchiveShape(entries) {
+	const paths = [];
+	for (const raw of entries) {
+		const p = normalize(raw);
+		if (p !== "") paths.push(p);
+	}
+	if (paths.length === 0) return {
+		shape: "invalid",
+		reason: "Archive is empty."
+	};
+	if (paths.includes("webskill.skill-pack.json")) return { shape: "pack-set" };
+	if (paths.includes(SKILL_FILE)) return { shape: "flat" };
+	const topLevels = /* @__PURE__ */ new Set();
+	let hasLooseRootFile = false;
+	for (const p of paths) {
+		const slash = p.indexOf("/");
+		if (slash <= 0) hasLooseRootFile = true;
+		else topLevels.add(p.slice(0, slash));
+	}
+	if (!hasLooseRootFile && topLevels.size === 1) {
+		const [dir] = [...topLevels];
+		if (dir !== void 0) {
+			if (paths.includes(`${dir}/webskill.skill-pack.json`)) return {
+				shape: "pack-set",
+				rootDir: dir
+			};
+			if (paths.includes(`${dir}/${SKILL_FILE}`)) return {
+				shape: "nested-single",
+				rootDir: dir
+			};
+		}
+	}
+	return {
+		shape: "invalid",
+		reason: `Archive does not contain a ${SKILL_FILE} at its root or in a single top-level directory.`
+	};
+}
+/** nested-single 时剥掉顶层目录，其余形态原样返回 */
+function stripArchiveRoot(entries, detection) {
+	if (detection.rootDir === void 0) return entries;
+	const prefix = `${detection.rootDir}/`;
+	const out = {};
+	for (const [path, value] of Object.entries(entries)) {
+		const p = normalize(path);
+		if (!p.startsWith(prefix)) continue;
+		const rel = p.slice(prefix.length);
+		if (rel !== "") out[rel] = value;
+	}
+	return out;
+}
+/**
+* 文件系统入口：安装管线拿到的是解压后的目录，不是条目表。
+*
+* 只探测判定所需的少量路径（不递归全量列举），再交给上面的纯函数——
+* 判定规则仍然只有一份，这正是 S7 的目的。
+*/
+async function detectSkillArchiveShapeFromFs(fs, contentDir) {
+	const sample = [];
+	const top = await fs.list(contentDir);
+	for (const entry of top) {
+		const name = entry.path.slice(contentDir.length + 1);
+		if (entry.type !== "directory") {
+			sample.push(name);
+			continue;
+		}
+		if (await fs.exists(`${entry.path}/${SKILL_FILE}`)) sample.push(`${name}/${SKILL_FILE}`);
+		else if (await fs.exists(`${entry.path}/webskill.skill-pack.json`)) sample.push(`${name}/${SKILL_PACK_FILE}`);
+		else sample.push(`${name}/`);
+	}
+	return detectSkillArchiveShape(sample);
+}
 const DEFAULT_ARCHIVE_LIMITS = {
 	maxDownloadBytes: 64 * 1024 * 1024,
 	maxEntryBytes: 64 * 1024 * 1024,
@@ -854,12 +943,15 @@ const baseName = (path) => path.split("/").pop() ?? path;
 var SkillDiscovery = class {
 	#fs;
 	#roots;
+	/** 扫描范围之外已知存在的技能名：只影响 dependencies 存在性判定，不产生目录项 */
+	#extraKnownSkillNames;
 	/** name → skillRoot，与 SkillReader 共享同一 Map 引用 */
 	#index = /* @__PURE__ */ new Map();
 	#reader;
-	constructor(fs, roots) {
+	constructor(fs, roots, options) {
 		this.#fs = fs;
 		this.#roots = roots;
+		this.#extraKnownSkillNames = options?.extraKnownSkillNames ?? [];
 		this.#reader = new SkillReader(fs, this.#index);
 	}
 	async discover() {
@@ -867,7 +959,7 @@ var SkillDiscovery = class {
 		const entries = [];
 		const issues = [];
 		const candidates = [];
-		const knownSkillNames = /* @__PURE__ */ new Set();
+		const knownSkillNames = new Set(this.#extraKnownSkillNames);
 		const adjacency = /* @__PURE__ */ new Map();
 		for (const [rootIndex, root] of this.#roots.entries()) {
 			if (!await this.#fs.exists(root)) {
@@ -940,7 +1032,7 @@ var SkillDiscovery = class {
 			});
 		}
 		issues.push(...cycles.issues);
-		const admitted = new Set(entries.map((e) => e.name));
+		const admitted = /* @__PURE__ */ new Set([...entries.map((e) => e.name), ...this.#extraKnownSkillNames]);
 		let changed = true;
 		while (changed) {
 			changed = false;
@@ -996,9 +1088,12 @@ var SkillDiscovery = class {
 /**
 * 合规校验。内部直接复用 SkillDiscovery 的扫描逻辑，
 * 规则判定同样落在 checkSkillRules 单一来源上。
+*
+* `extraKnownSkillNames`：扫描范围之外已存在的技能名。安装时只扫刚解出来的那一个目录，
+* 不告诉它库里还有谁，任何指向包外的 dependencies 都会被判成不存在。
 */
-async function validateSkills(fs, roots) {
-	const { issues } = await new SkillDiscovery(fs, roots).discover();
+async function validateSkills(fs, roots, options) {
+	const { issues } = await new SkillDiscovery(fs, roots, options).discover();
 	return {
 		ok: !issues.some((i) => i.severity === "error"),
 		issues
@@ -1035,4 +1130,4 @@ const xmlRenderer = {
 };
 
 //#endregion
-export { parseSkillMarkdown as A, unzipWithLimits as B, escapeXml as C, keyIdOf as D, jsonRenderer as E, renderCatalogJson as F, verifyManifest as H, resolveArchiveLimits as I, resolveInsideRoot as L, readResponseWithLimit as M, readSkillSignature as N, messageOf as O, renderAvailableSkillsXml as P, signSkill as R, computeDigest as S, isValidSkillName as T, verifySkillSignature as U, validateSkills as V, xmlRenderer as W, atomicWriteText as _, SIGNATURE_SCHEMA_VERSION as a, checkDependencyCycles as b, SKILL_NAME_MAX_LENGTH as c, SKILL_SIGNATURE_FILE as d, SkillDiscovery as f, assertSafePathSegment as g, assertRemoteUrlAllowed as h, MemoryFS as i, parseSkillPackManifest as j, normalizePath as k, SKILL_NAME_PATTERN as l, WebSkillError as m, FsTrustedKeyStore as n, SKILLS_LOCKFILE as o, SkillReader as p, MANIFEST_EXCLUDED_FILES as r, SKILL_MANIFEST_FILE as s, DEFAULT_ARCHIVE_LIMITS as t, SKILL_PACK_FILE as u, buildCatalog as v, exportSkills as w, checkSkillRules as x, buildManifest as y, signaturePayloadBytes as z };
+export { jsonRenderer as A, resolveArchiveLimits as B, computeDigest as C, exportSkills as D, escapeXml as E, parseSkillPackManifest as F, unzipWithLimits as G, signSkill as H, readResponseWithLimit as I, verifySkillSignature as J, validateSkills as K, readSkillSignature as L, messageOf as M, normalizePath as N, isAtomicTempPath as O, parseSkillMarkdown as P, renderAvailableSkillsXml as R, checkSkillRules as S, detectSkillArchiveShapeFromFs as T, signaturePayloadBytes as U, resolveInsideRoot as V, stripArchiveRoot as W, xmlRenderer as Y, assertSafePathSegment as _, MemoryFS as a, buildManifest as b, SKILL_MANIFEST_FILE as c, SKILL_PACK_FILE as d, SKILL_SIGNATURE_FILE as f, assertRemoteUrlAllowed as g, WebSkillError as h, MANIFEST_EXCLUDED_FILES as i, keyIdOf as j, isValidSkillName as k, SKILL_NAME_MAX_LENGTH as l, SkillReader as m, DEFAULT_ARCHIVE_LIMITS as n, SIGNATURE_SCHEMA_VERSION as o, SkillDiscovery as p, verifyManifest as q, FsTrustedKeyStore as r, SKILLS_LOCKFILE as s, ATOMIC_TMP_SUFFIX_PATTERN as t, SKILL_NAME_PATTERN as u, atomicWriteText as v, detectSkillArchiveShape as w, checkDependencyCycles as x, buildCatalog as y, renderCatalogJson as z };