@dp-bohrium/widget-sdk 0.4.1 → 0.6.0

package/dist/contracts.d.ts

@@ -0,0 +1,2 @@
+/** 完整协议保持独立子入口，避免与作者接口的同名类型混用。 */
+export * from "@dp-bohrium/widget-contracts";

package/dist/contracts.js

@@ -0,0 +1 @@
+export * from "@dp-bohrium/widget-contracts";

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export type { FileMutationId, FileReadInput, FileReadResult, FileRevision, FileWriteInput, FileWriteResult, WidgetActivationEvent, WidgetActivationEvents, WidgetContribution, WidgetEventName, WidgetFilePreviewContribution, WidgetPanelContribution, WidgetPluginContributions, WidgetPluginManifest, WidgetToolPhase, } from "@dp-bohrium/widget-contracts";
+export type { CapabilityRequest, CapabilityResult, FileDownloadResult, FileMutationId, FilePreviewContent, FilePreviewRenderRequest, FileReadInput, FileReadResult, FileReference, FileRevision, FileWriteInput, FileWriteResult, GrantedCapability, JsonValue, PanelContent, PanelRenderRequest, RenderRequest, RenderState, TaskObservationBatch, TaskObservationEvent, TaskObservationSnapshot, Theme, ThemeMode, WidgetActivationEvent, WidgetActivationEvents, WidgetContribution, WidgetError, WidgetErrorCode, WidgetEventName, WidgetFilePreviewContribution, WidgetLiveEvent, WidgetNetworkFetchInput, WidgetNetworkFetchOutput, WidgetPanelContribution, WidgetPluginContributions, WidgetPluginManifest, WidgetToolPhase, } from "@dp-bohrium/widget-contracts";
 export { isWidgetActivationEvent, isWidgetEventName, WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, } from "@dp-bohrium/widget-contracts";
 export type { CompileWidgetPluginManifestOptions } from "./manifest.js";
 export { compileWidgetPluginManifest } from "./manifest.js";
 export type { HostUserEmail, HostUserEmailResult, HostUserProfile, HostUserProfileResult, WidgetHostUserClient, } from "./runtime/service.js";
-export type { FileDownloadCapabilityResult, FileReadCapabilityResult, FileWriteCapabilityResult, TaskWatchCapabilityResult, UiStateReadCapabilityResult, UiStateWriteCapabilityResult, WidgetActivation, WidgetCapabilityApi, WidgetContext, WidgetDisposable, WidgetEventApi, WidgetFileApi, WidgetHandle, WidgetHostOptions, WidgetModule, WidgetRenderContext, WidgetRenderHandler, WidgetTaskApi, WidgetUiApi, WidgetUiStateApi, } from "./widget.js";
+export type { FileDownloadCapabilityResult, FileReadCapabilityResult, FileWriteCapabilityResult, TaskListCapabilityResult, TaskWatchCapabilityResult, UiStateReadCapabilityResult, UiStateWriteCapabilityResult, WidgetActivation, WidgetCapabilityApi, WidgetContext, WidgetDisposable, WidgetEventApi, WidgetFileApi, WidgetHandle, WidgetHostOptions, WidgetModule, WidgetRenderContext, WidgetRenderHandler, WidgetTaskApi, WidgetUiApi, WidgetUiStateApi, } from "./widget.js";
 export { runWidgetHost } from "./widget.js";

package/dist/index.js

@@ -1,4 +1,4 @@
-import { i as createWidgetClient, l as WIDGET_SDK_VERSION } from "./runtime-RyAEhkyn.js";
+import { i as createWidgetClient, l as WIDGET_SDK_VERSION } from "./runtime-D7KxTtdu.js";
 import { WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, isWidgetActivationEvent, isWidgetEventName } from "@dp-bohrium/widget-contracts";
 //#region src/manifest.ts
 function compiledContribution(contribution) {
@@ -315,10 +315,16 @@ function createContext(client, payload, renderHandlers, lifetime) {
 				input
 			}, options)
 		},
-		tasks: { watch: (input, options) => client.requestCapability({
-			operation: "tasks.watch",
-			input
-		}, options) },
+		tasks: {
+			list: (input = {}, options) => client.requestCapability({
+				operation: "tasks.list",
+				input
+			}, options),
+			watch: (input, options) => client.requestCapability({
+				operation: "tasks.watch",
+				input
+			}, options)
+		},
 		network: client.network,
 		services: client.services,
 		hostUser: client.hostUser,
@@ -373,6 +379,29 @@ function createWidgetRuntime(module, options = {}) {
 	const disposedPromise = new Promise((resolve) => {
 		resolveDisposed = resolve;
 	});
+	function writeLocalDiagnostic(...details) {
+		try {
+			console.error(...details);
+		} catch {}
+	}
+	function reportRenderFailure(error, request, update) {
+		if (lifetime.signal.aborted) return;
+		const failure = {
+			code: update ? "UPDATE_FAILED" : "RENDER_FAILED",
+			phase: update ? "update" : "render",
+			message: "Widget render handler failed",
+			retryable: false,
+			correlationId: request.requestId
+		};
+		writeLocalDiagnostic("[Widget 渲染失败]", failure, error);
+		for (const observer of [options.events?.onError, options.onError]) try {
+			Promise.resolve(observer?.(failure)).catch((observerError) => {
+				writeLocalDiagnostic("[Widget 诊断回调失败]", observerError);
+			});
+		} catch (observerError) {
+			writeLocalDiagnostic("[Widget 诊断回调失败]", observerError);
+		}
+	}
 	function runDeactivation() {
 		if (deactivation) return deactivation;
 		deactivation = Promise.resolve().then(() => module.deactivate?.()).catch((error) => {
@@ -413,9 +442,14 @@ function createWidgetRuntime(module, options = {}) {
 					phase: update ? "update" : "initial",
 					signal: lifetime.signal
 				};
-				for (const handler of [...renderHandlers]) try {
-					Promise.resolve(handler(request, renderContext)).catch(() => {});
-				} catch {}
+				for (const handler of [...renderHandlers]) {
+					if (lifetime.signal.aborted) break;
+					try {
+						Promise.resolve(handler(request, renderContext)).catch((error) => reportRenderFailure(error, request, update));
+					} catch (error) {
+						reportRenderFailure(error, request, update);
+					}
+				}
 			},
 			onDispose: dispose
 		}

package/dist/runtime/index.js

@@ -1,3 +1,3 @@
-import { a as isWidgetHostConnectMessage, c as WidgetClient, i as createWidgetClient, l as WIDGET_SDK_VERSION, n as WIDGET_HOST_CONNECT, o as PRESENTATION_CONFIRMATION_TIMEOUT_MS, r as WidgetRuntimeClient, s as REGION_CONFIRMATION_TIMEOUT_MS, t as WIDGET_BOOTSTRAP_READY } from "../runtime-RyAEhkyn.js";
+import { a as isWidgetHostConnectMessage, c as WidgetClient, i as createWidgetClient, l as WIDGET_SDK_VERSION, n as WIDGET_HOST_CONNECT, o as PRESENTATION_CONFIRMATION_TIMEOUT_MS, r as WidgetRuntimeClient, s as REGION_CONFIRMATION_TIMEOUT_MS, t as WIDGET_BOOTSTRAP_READY } from "../runtime-D7KxTtdu.js";
 import { i as isWidgetProtocolMessage, r as MessagePortTransport } from "../protocol-endpoint-CDz-YDGT.js";
 export { MessagePortTransport, PRESENTATION_CONFIRMATION_TIMEOUT_MS, REGION_CONFIRMATION_TIMEOUT_MS, WIDGET_BOOTSTRAP_READY, WIDGET_HOST_CONNECT, WIDGET_SDK_VERSION, WidgetClient, WidgetRuntimeClient, createWidgetClient, isWidgetHostConnectMessage, isWidgetProtocolMessage };

package/dist/{runtime-RyAEhkyn.js → runtime-D7KxTtdu.js}

@@ -2,7 +2,7 @@ import { r as MessagePortTransport, t as ProtocolEndpoint } from "./protocol-end
 //#endregion
 //#region src/runtime/version.ts
 /** 从当前安装的 SDK package.json 读取版本，插件作者不需要重复填写。 */
-const WIDGET_SDK_VERSION = "0.4.1";
+const WIDGET_SDK_VERSION = "0.6.0";
 //#endregion
 //#region src/runtime/network.ts
 const failureReasons = /* @__PURE__ */ new Set([

package/dist/widget.d.ts

@@ -1,4 +1,4 @@
-import type { CapabilityRequest, CapabilityResult, FileDownloadResult, FileReadInput, FileReference, FileWriteInput, GrantedCapability, RegionCapabilityResult, RenderRequest, TaskObservationBatch, Theme, UiStateResult, UiStateWriteResult, WidgetEventName, WidgetLiveEvent } from "@dp-bohrium/widget-contracts";
+import type { CapabilityRequest, CapabilityResult, FileDownloadResult, FileReadInput, FileReference, FileWriteInput, GrantedCapability, RegionCapabilityResult, RenderRequest, TaskListPage, TaskObservationBatch, Theme, UiStateResult, UiStateWriteResult, WidgetEventName, WidgetLiveEvent } from "@dp-bohrium/widget-contracts";
 import { type FileReadCapabilityResult, type FileWriteCapabilityResult } from "./runtime/files.js";
 import { type CreateWidgetClientOptions, type RegionName, type WidgetClientFactoryOptions, type WidgetClientState, type WidgetLiveEventContext, type WidgetLiveEventHandler } from "./runtime/index.js";
 import type { WidgetNetworkClient } from "./runtime/network.js";
@@ -53,6 +53,17 @@ export type FileDownloadCapabilityResult = {
     readonly ok: false;
 }>;
 export interface WidgetTaskApi {
+    /**
+     * 读取一次受 Host 限制的任务摘要页。返回的 taskId 可继续用于 tasks.watch；
+     * 此 API 只发现任务，不创建、调度或取消任务。
+     */
+    list(input?: {
+        readonly cursor?: string;
+        readonly limit?: number;
+    }, options?: {
+        readonly timeoutMs?: number;
+        readonly signal?: AbortSignal;
+    }): Promise<TaskListCapabilityResult>;
     /**
      * 读取一次受 Host 限制的任务快照和事件页。调用方使用返回的 cursor
      * 继续轮询；此 API 不创建、调度或取消任务。
@@ -66,6 +77,14 @@ export interface WidgetTaskApi {
         readonly signal?: AbortSignal;
     }): Promise<TaskWatchCapabilityResult>;
 }
+/** tasks.list 的类型化能力结果。 */
+export type TaskListCapabilityResult = {
+    readonly ok: true;
+    readonly data: TaskListPage;
+} | Extract<CapabilityResult, {
+    readonly ok: false;
+}>;
+/** tasks.watch 的类型化能力结果。 */
 export type TaskWatchCapabilityResult = {
     readonly ok: true;
     readonly data: TaskObservationBatch;

package/llms.txt

@@ -14,12 +14,22 @@
 - 生产 Widget：`@dp-bohrium/widget-sdk`
 - 单元测试：`@dp-bohrium/widget-sdk/testing`
 - 协议级集成：`@dp-bohrium/widget-sdk/runtime`
-- 配套类型和 Schema：`@dp-bohrium/widget-contracts`
+- 常用作者类型：`@dp-bohrium/widget-sdk`
+- 完整协议类型：`@dp-bohrium/widget-sdk/contracts`
+- Manifest 与协议 Schema：`@dp-bohrium/widget-sdk/schemas/*.json`
+- Host 协议校验语料：`@dp-bohrium/widget-sdk/conformance/*`
+- 工程命令：SDK 包内 `bohr-widget`（首次创建可用 `pnpm dlx @dp-bohrium/widget-sdk create ...`）
+
+消费方直接声明或导入 contracts 的旧用法已废弃；统一入口切换发布 R1 前迁到 SDK 子入口。
+contracts 仍维护内部唯一源，不恢复旧作者执行器来支持历史工程。
+新工程只直接声明精确 SDK 版本；`@dp-bohrium/widget-cli` 只按现行发布治理保留过渡分发、历史审计和废弃诊断，不由 SDK 回选。
 
 ## 使用原则
 
 - 先在 Manifest 声明 capability，再等待 Host grant。
 - 用 `WidgetError` 的 `code/phase/retryable/correlationId` 诊断启动、渲染和能力失败。
+- `context.render` 异常通过 `runWidgetHost` 的既有 `onError` / `events.onError` 和 Guest console
+  本地报告，不自动终止或重试；不要改成向旧 Host 发送致命协议 `error`。
 - `ok=false` 的能力结果是可处理状态，不要直接重试或绕过 Host。
 - 文件读写使用 `context.files.read(input, options)` / `write(input, options)`；Manifest
   分别申请 `files.read` / `files.write`。file-preview 的引用来自当前文件；Panel 只有获得

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dp-bohrium/widget-sdk",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Bohrium Widget 开发者 SDK：在 Widget Bundle 内与 Host 建立 Bridge，并暴露生命周期与能力协议。",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,9 @@
   "author": "Bohrium",
   "homepage": "https://dev.dp.tech/bohrium-widget-sdk/",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "bohr-widget": "./dist/cli.mjs"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -33,10 +36,19 @@
       "types": "./dist/runtime/index.d.ts",
       "import": "./dist/runtime/index.js"
     },
+    "./contracts": {
+      "types": "./dist/contracts.d.ts",
+      "import": "./dist/contracts.js"
+    },
+    "./schemas/*.json": "./schemas/*.json",
+    "./conformance/*": "./conformance/*",
     "./package.json": "./package.json"
   },
   "files": [
     "dist",
+    "assets",
+    "schemas",
+    "conformance",
     "README.md",
     "AGENTS.md",
     "llms.txt",
@@ -48,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@dp-bohrium/widget-contracts": "0.4.1"
+    "@dp-bohrium/widget-contracts": "0.6.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.2.0",
@@ -60,7 +72,9 @@
     "@dp-bohrium/widget-contract-testing": "0.1.0-alpha.0"
   },
   "scripts": {
-    "build": "tsdown && tsc -b tsconfig.build.json --force --pretty false",
+    "build:runtime": "tsdown && tsc -b tsconfig.build.json --force --pretty false && node ../../scripts/schema/build-sdk-assets.mjs",
+    "build:cli": "node ../../scripts/schema/build-sdk-cli-assets.mjs && tsdown --config widget-cli.tsdown.config.ts && node --check dist/cli.mjs",
+    "build": "pnpm build:runtime && pnpm --filter @dp-bohrium/widget-contract-testing build && pnpm build:cli",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage --coverage.thresholds.lines=80 --coverage.thresholds.functions=80 --coverage.thresholds.statements=80 --coverage.thresholds.branches=70",

package/schemas/host-runtime-config.schema.json

@@ -0,0 +1,305 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "host-runtime-config.schema.json",
+  "description": "Host 为一次 Widget 运行签发并下发给 agent-widget 的运行时配置，不直接发给 Widget。",
+  "title": "Widget Host Runtime Config",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "hostApiVersion",
+    "configId",
+    "runId",
+    "mode",
+    "issuedAt",
+    "expiresAt",
+    "recheckAt",
+    "securityProfile",
+    "resourceBudget",
+    "runtime",
+    "network",
+    "bindings"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "hostApiVersion": { "const": 1 },
+    "configId": { "$ref": "#/$defs/Identifier" },
+    "hostId": { "$ref": "#/$defs/Identifier" },
+    "runId": { "$ref": "#/$defs/Identifier" },
+    "mode": { "$ref": "#/$defs/Mode" },
+    "issuedAt": { "$ref": "#/$defs/Timestamp" },
+    "expiresAt": { "$ref": "#/$defs/Timestamp" },
+    "recheckAt": { "$ref": "#/$defs/Timestamp" },
+    "securityProfile": { "const": "runtime-security-profile-v1" },
+    "resourceBudget": {
+      "$ref": "widget-runtime-contracts.schema.json#/$defs/ResourceBudget"
+    },
+    "runtime": { "$ref": "#/$defs/RuntimeAuthority" },
+    "network": { "$ref": "#/$defs/NetworkAuthority" },
+    "bindings": {
+      "type": "array",
+      "items": {
+        "oneOf": [
+          { "$ref": "#/$defs/LoadableBinding" },
+          { "$ref": "#/$defs/FallbackBinding" }
+        ]
+      }
+    }
+  },
+  "$defs": {
+    "LoadableBinding": {
+      "description": "可加载绑定：状态为 loadable，携带冻结版本、摘要、Manifest、启动地址与能力授权。",
+      "title": "LoadableBinding",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "bindingId",
+        "widgetId",
+        "widgetVersionId",
+        "digest",
+        "manifest",
+        "launch",
+        "grantedCapabilities"
+      ],
+      "properties": {
+        "status": { "const": "loadable" },
+        "bindingId": { "$ref": "#/$defs/Identifier" },
+        "widgetId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "digest": { "$ref": "#/$defs/Digest" },
+        "trustClass": {
+          "description": "控制面确认的信任等级；作者不能自行声明。",
+          "enum": ["external", "first-party"]
+        },
+        "runtimeProfile": {
+          "description": "控制面选择的部署配置；不授予 Cookie 或 Token 读取权限。",
+          "enum": ["public-isolated", "first-party-private"]
+        },
+        "manifest": {
+          "$ref": "widget-manifest.schema.json"
+        },
+        "launch": { "$ref": "#/$defs/Launch" },
+        "grantedCapabilities": { "$ref": "#/$defs/GrantedCapabilities" },
+        "serviceAccess": { "$ref": "#/$defs/WidgetServiceAccess" },
+        "serviceAuthorization": { "$ref": "#/$defs/HostServiceAuthorization" }
+      }
+    },
+    "HostServiceAuthorization": {
+      "title": "HostServiceAuthorization",
+      "description": "Host-only evidence bound to the exact reviewed Widget bundle and current user grant.",
+      "oneOf": [
+        { "$ref": "#/$defs/HostServiceAuthorizationRequired" },
+        { "$ref": "#/$defs/HostServiceAuthorizationGranted" }
+      ]
+    },
+    "HostServiceAuthorizationRequired": {
+      "description": "需用户授权的 Host 服务证据：状态为 authorization-required。",
+      "title": "HostServiceAuthorizationRequired",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "policy",
+        "status",
+        "hostId",
+        "widgetVersionId",
+        "bundleDigest",
+        "reviewRevision",
+        "reviewedPermissions",
+        "grantedPermissions",
+        "expiresAt"
+      ],
+      "properties": {
+        "kind": { "const": "host-service-authorization" },
+        "policy": { "const": "host-user-data-v1" },
+        "status": { "const": "authorization-required" },
+        "hostId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "bundleDigest": { "$ref": "#/$defs/Digest" },
+        "reviewRevision": { "$ref": "#/$defs/Identifier" },
+        "reviewedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "grantedPermissions": {
+          "type": "array",
+          "maxItems": 0
+        },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "HostServiceAuthorizationGranted": {
+      "description": "已授予的 Host 服务证据：状态为 granted。",
+      "title": "HostServiceAuthorizationGranted",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "policy",
+        "status",
+        "hostId",
+        "widgetVersionId",
+        "bundleDigest",
+        "reviewRevision",
+        "grantRevision",
+        "reviewedPermissions",
+        "grantedPermissions",
+        "expiresAt"
+      ],
+      "properties": {
+        "kind": { "const": "host-service-authorization" },
+        "policy": { "const": "host-user-data-v1" },
+        "status": { "const": "granted" },
+        "hostId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "bundleDigest": { "$ref": "#/$defs/Digest" },
+        "reviewRevision": { "$ref": "#/$defs/Identifier" },
+        "grantRevision": { "$ref": "#/$defs/Identifier" },
+        "reviewedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "grantedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "FallbackBinding": {
+      "description": "降级绑定：状态为 fallback，不含 Bundle 地址、摘要、Manifest 或能力授权。",
+      "title": "FallbackBinding",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "bindingId",
+        "widgetId",
+        "widgetVersionId",
+        "contribution",
+        "reason"
+      ],
+      "properties": {
+        "status": { "const": "fallback" },
+        "bindingId": { "$ref": "#/$defs/Identifier" },
+        "widgetId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "contribution": {
+          "$ref": "widget-manifest.schema.json#/$defs/WidgetContributionConfig"
+        },
+        "reason": { "$ref": "#/$defs/FallbackReason" }
+      }
+    },
+    "RuntimeAuthority": {
+      "description": "运行域授权：origin 与 catalogRevision。",
+      "title": "RuntimeAuthority",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["origin", "catalogRevision"],
+      "properties": {
+        "origin": { "$ref": "#/$defs/RuntimeOrigin" },
+        "catalogRevision": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+        },
+        "profile": {
+          "enum": ["public-isolated", "first-party-private"]
+        }
+      }
+    },
+    "NetworkAuthority": {
+      "description": "网络授权：mode、policyVersion 与限制。",
+      "title": "NetworkAuthority",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode", "policyVersion", "limits"],
+      "properties": {
+        "mode": { "enum": ["runtime-consent", "unavailable"] },
+        "policyVersion": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+        },
+        "limits": {
+          "$ref": "widget-runtime-contracts.schema.json#/$defs/WidgetNetworkLimits"
+        }
+      }
+    },
+    "GrantedCapabilities": {
+      "description": "已授予能力列表。",
+      "title": "GrantedCapabilities",
+      "type": "array",
+      "items": {
+        "$ref": "widget-runtime-contracts.schema.json#/$defs/GrantedCapability"
+      }
+    },
+    "Launch": {
+      "description": "一次性启动地址与有效期。",
+      "title": "Launch",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url", "expiresAt"],
+      "properties": {
+        "url": { "type": "string", "pattern": "^https?://" },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "RuntimeOrigin": {
+      "description": "隔离域运行源地址。",
+      "title": "RuntimeOrigin",
+      "type": "string",
+      "maxLength": 253,
+      "pattern": "^(?:https://[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::[0-9]{1,5})?|http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])(?::[0-9]{1,5})?)$"
+    },
+    "FallbackReason": {
+      "description": "降级原因枚举。",
+      "title": "FallbackReason",
+      "enum": [
+        "not-authorized",
+        "not-approved",
+        "delisted-for-new-use",
+        "revoked",
+        "host-api-unsupported",
+        "preview-not-allowed"
+      ]
+    },
+    "Digest": {
+      "description": "内容摘要；形如 sha256:<hex>。",
+      "title": "Digest",
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "Identifier": {
+      "description": "不透明标识符。",
+      "title": "Identifier",
+      "type": "string",
+      "minLength": 1
+    },
+    "Mode": {
+      "description": "运行模式：preview 或 published。",
+      "title": "Mode",
+      "enum": ["preview", "published"]
+    },
+    "Timestamp": {
+      "description": "UTC 时间戳：YYYY-MM-DD + T + 非空格字符，以 Z 结尾。",
+      "title": "Timestamp",
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T[^ ]+Z$"
+    },
+    "WidgetServiceAccess": {
+      "title": "WidgetServiceAccess",
+      "description": "绑定当前不可变版本与摘要的审核投影；服务端每次调用仍须复核撤销和用户权限。",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["approvalId", "revision", "appId", "policyVersion", "expiresAt"],
+      "properties": {
+        "approvalId": { "$ref": "#/$defs/Identifier" },
+        "revision": { "$ref": "#/$defs/Identifier" },
+        "appId": { "$ref": "#/$defs/Identifier" },
+        "policyVersion": { "$ref": "#/$defs/Identifier" },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    }
+  }
+}