@dp-bohrium/widget-sdk 0.5.0 → 0.6.0

package/AGENTS.md

@@ -1,20 +1,25 @@
 # Widget SDK Agent 使用说明
 
-`@dp-bohrium/widget-sdk` 是 iframe 内 Widget 的运行时 SDK。Agent 先读取 `llms.txt`，再
+`@dp-bohrium/widget-sdk` 是 Widget 作者的统一代码、类型与 Schema 入口。Agent 先读取 `llms.txt`，再
 根据任务选择高层 Widget API、低层 Runtime API 或测试入口；不要自行实现 Bridge 握手。
 
 ## 常用动作
 
 ```bash
 pnpm add @dp-bohrium/widget-sdk
+pnpm dlx @dp-bohrium/widget-sdk create my-widget --template panel
 ```
 
-1. 用 `activate(context)` 实现 Widget；让 `bohr-widget` 生成 Host 入口。
+1. 用 SDK 自带的 `bohr-widget` 创建工程，再用 `activate(context)` 实现 Widget；生成工程只直接依赖 SDK。
 2. 在 Manifest 中声明所需 capability，再使用 `context.capabilities`、`context.files`、
    `context.tasks`、`context.ui` 或 `context.network`。
 3. 在测试中使用 `@dp-bohrium/widget-sdk/testing` 的 `MockWidgetHost`；生产 Bundle 使用
    根入口，不把 testing 入口打进产物。
-4. 低层协议集成只从 `@dp-bohrium/widget-sdk/runtime` 导入，并保留 contracts 的精确版本。
+4. 常用作者类型从根入口获取；完整协议用 `/contracts`，编辑器 Schema 用 `/schemas/*.json`。
+   SDK 与开发工具负责核对配套协议版本，作者无需直接安装 contracts；直接依赖的旧用法已废弃，
+   统一入口切换发布 R1 前迁移并移除，不恢复旧版本执行器。
+5. 低层协议客户端从 `@dp-bohrium/widget-sdk/runtime` 导入。根入口的 `WidgetRenderContext`
+   表示渲染回调的 phase/signal，协议同名类型从 `/contracts` 导入。
 
 ## 错误恢复
 
@@ -30,4 +35,5 @@ pnpm add @dp-bohrium/widget-sdk
 
 SDK 不授予权限、不上传或发布 Bundle、不决定 iframe/CSP 策略，也不保证脱离 Host 可以运行。
 `ok=true` 只表示当前调用被 Runtime/Host 接受；真实授权、渲染和生产绑定由 Host 与平台负责。
-发布包使用精确 SemVer；升级 SDK 时同步核对 contracts 版本和生成 Bundle 的 digest。
+发布包使用精确 SemVer；升级 SDK 时让开发工具核对配套协议和生成 Bundle 的 digest。
+SDK 的 Node 命令与浏览器 Runtime 使用独立构建入口；不要从根入口或 `/runtime` 导入 CLI 模块。

package/CHANGELOG.md

@@ -1,6 +1,23 @@
 # `@dp-bohrium/widget-sdk` 变更记录
 
-本文件只记录影响使用者的变更：运行时 API、事件订阅、Manifest 要求。
+## 0.6.0
+
+### Minor Changes
+
+- 7c21acf: SDK 发布包新增 `bohr-widget` 可执行入口并内置固定工具链资产，使新工程只需精确安装 SDK 即可完成
+  创建、构建、校验、开发和打包。现有 widget-cli 暂按现行发布治理复用同一份命令实现与原有分发身份，
+  作为过渡兼容分发；两种入口创建或迁移的新工程都只依赖 SDK，SDK bin 不根据旧工程依赖回选历史执行器。
+  两包同时安装时不保证同名命令保留旧 CLI 身份；旧工程须移除 CLI、重新安装，并由 SDK 重新构建 receipt
+  后再校验与打包，receipt 严格校验不变。
+  复用的命令源码与构建输入纳入 SDK 版本门禁；本次不改变 integration v2、工程锁或发布 Tag 协议。
+  Widget 作者 skill 同步改用 SDK 创建入口，避免 Agent 为新工程重新引入独立 CLI 依赖。
+- 31e930e: 统一 Widget 作者入口：SDK 根入口导出常用作者类型，并新增 `/contracts`、`/schemas/*.json` 和
+  `/conformance/*` 子入口，使作者与 Host 无需直接安装 contracts。直接声明或导入 contracts 的旧用法
+  进入迁移期，统一入口切换发布 R1 前应迁移到 SDK；规范协议类型仍由 contracts 唯一维护。
+
+### Patch Changes
+
+- @dp-bohrium/widget-contracts@0.6.0
 
 ## 0.5.0
 

package/README.md

@@ -3,27 +3,27 @@
 Agent 使用入口：先读 [`llms.txt`](./llms.txt) 获取文档索引，再读 [`AGENTS.md`](./AGENTS.md)
 获取安装、运行时调用和错误恢复规则。
 
-Widget 开发者 SDK。普通作者只实现 `activate(context)` 和可选的 `deactivate()`；CLI
-会生成 Widget Host 入口，负责向 Host 宣告 Bundle、接收转移过来的 `MessagePort`，并暴露共享的
+Widget 开发者 SDK，也是创建、构建、校验、开发和打包 Widget 的统一安装入口。普通作者只实现
+`activate(context)` 和可选的 `deactivate()`；SDK 自带的 `bohr-widget` 会生成 Widget Host 入口，
+负责向 Host 宣告 Bundle、接收转移过来的 `MessagePort`，并暴露共享的
 生命周期与能力协议。作者无需直接处理 `window.postMessage`，也无需手动启动插件。
 
 激活事件目录、`context.events` 与低层 `topic` 的边界以本包的 `AGENTS.md`、本 README
-和 `@dp-bohrium/widget-contracts` 中的类型与 Schema 为准。
+和本包公开的类型与 Schema 为准；协议实现保持同一份事实源。
 
 ## 环境要求
 
 | 项 | 要求 |
 | --- | --- |
-| Node.js | ≥ 20（仅构建期；产物运行在浏览器 iframe 内） |
+| Node.js | ≥ 20（执行 `bohr-widget` 与构建时；Widget 产物运行在浏览器 iframe 内） |
 | 源码格式 | 纯 ESM，必须经打包器处理后交付 |
 | 运行环境 | 必须由 Bohrium Host 加载，脱离 Host 无法完成握手 |
 | 产物格式 | Host iframe 为 `sandbox="allow-scripts"` 且无 `allow-same-origin` 时，打成 classic script / IIFE（隔离源下 `type="module"` 需要 CORS） |
 
 ## 安装
 
-写 Widget 装本包。Host 与控制面只消费协议类型，装
-[`@dp-bohrium/widget-contracts`](https://www.npmjs.com/package/@dp-bohrium/widget-contracts)
-即可。
+写 Widget、调用本地工具、消费 Host 协议都安装本包；contracts 作为 SDK 的精确传递依赖维护，
+不再要求使用者单独选择版本。
 
 ```bash
 npm install @dp-bohrium/widget-sdk
@@ -31,9 +31,27 @@ pnpm add @dp-bohrium/widget-sdk
 yarn add @dp-bohrium/widget-sdk
 ```
 
-需要在 TypeScript 中直接声明或在编辑器中解析 Manifest Schema 时，再把
-`@dp-bohrium/widget-contracts` 作为开发依赖安装；它是独立的类型/Schema 包，不需要通过
-`defineManifest()` 工厂获得提示。
+新建工程只需调用 SDK 自带的命令，生成结果也只直接声明精确 SDK 版本：
+
+```bash
+pnpm dlx @dp-bohrium/widget-sdk create my-widget --template panel
+cd my-widget
+pnpm install
+pnpm exec bohr-widget build .
+pnpm exec bohr-widget check .
+```
+
+`@dp-bohrium/widget-cli` 的现有直接安装方式暂按现行发布治理保留，只作为过渡分发、
+历史审计和废弃诊断。作者工程统一只直接安装 SDK；两包提供同名 `bohr-widget`，同时安装时
+不保证保留旧 CLI 身份。旧工程须移除 CLI、重新安装，并由 SDK `build` 重建 receipt 后再打包，
+见[单 SDK 迁移步骤](https://dev.dp.tech/bohrium-widget-sdk/reference/versioning)。SDK 不回选旧执行器，
+receipt 校验保持严格。
+
+常用作者类型从本包根入口导入；完整协议从 `@dp-bohrium/widget-sdk/contracts` 导入，
+编辑器 Schema 使用 `@dp-bohrium/widget-sdk/schemas/*.json`。作者无需直接安装 contracts，
+配套协议版本由 SDK 和开发工具核对。Host/控制面也通过本包 `/contracts`、`/schemas/*.json`、
+`/conformance/*` 消费协议，不加载作者 Runtime。直接依赖 contracts 的旧用法已废弃，
+本轮统一入口切换发布 R1 前移除，见[迁移计划](https://dev.dp.tech/bohrium-widget-sdk/reference/versioning)。
 
 在自己的 `package.json` 里钉死精确 SemVer，不要用 `^` 或裸 `latest`。SDK 运行时会从已安装
 包自身读取版本，插件源码和 Manifest 不需要再次填写 SDK 版本。
@@ -101,7 +119,7 @@ Manifest 是插件的静态声明，SDK 代码是隔离 iframe 内的运行时
 
 ```json
 {
-  "$schema": "@dp-bohrium/widget-contracts/schemas/widget-plugin-manifest.schema.json",
+  "$schema": "@dp-bohrium/widget-sdk/schemas/widget-plugin-manifest.schema.json",
   "name": "research",
   "version": "1.0.0",
   "entry": "src/widget.ts",
@@ -150,8 +168,8 @@ Manifest 的 `contributes.widget` 决定；运行时代码只认识统一的 `co
 `context.render`、`context.capabilities` 和 `context.ui`。首帧和后续快照通过
 `renderContext.phase` 区分，不需要维护两套回调。
 
-Manifest 的编辑器提示来自 `@dp-bohrium/widget-contracts` 发布的 JSON Schema 和
-TypeScript 类型，不依赖某个 `defineManifest` 工厂。构建工具调用
+Manifest 的编辑器提示来自本包 `/schemas` 的 JSON Schema 和公开 TypeScript 类型，
+不依赖某个 `defineManifest` 工厂。构建工具调用
 `compileWidgetPluginManifest`，自动补齐 `schemaVersion`、`hostApiVersion`、SDK 版本和
 宿主加载字段；它会直接读取 Manifest 内的 `samples`，只有构建器从别处生成样例时
 才需要传入第二个参数。`createWidgetClient` 是协议级基础实现，不属于 Widget 作者 API；当前根入口只提供统一 Widget API，协议级代码应从
@@ -159,19 +177,23 @@ TypeScript 类型，不依赖某个 `defineManifest` 工厂。构建工具调用
 
 受信任的内部 Host/协议测试仍可直接构造低层 Tool Result RenderRequest，但该能力不属于外部作者清单或公共示例。
 
-SDK 发布包会生成 `dist/index.d.ts` 与对应的 declaration map，并通过 `package.json` 的
+SDK 发布包会生成 `dist/index.d.ts` 与各子入口声明，并通过 `package.json` 的
 `types`/`exports` 暴露。插件安装 `@dp-bohrium/widget-sdk` 后，编辑器会直接获得
 `WidgetContext`、事件名、能力请求、渲染请求和生命周期返回值的类型提示；Manifest
-编辑器提示由 `@dp-bohrium/widget-contracts` 的 JSON Schema 和声明文件提供。
+编辑器提示由本包的 `/schemas` 和声明文件提供，Schema 在构建时从协议唯一源生成。
 
 ## 包入口
 
 | 入口 | 内容 | 用途 |
 | --- | --- | --- |
-| `.` | `runWidgetHost`、`compileWidgetPluginManifest` 和全部公开类型 | 生成的生产 Bundle |
+| `.` | `runWidgetHost`、`compileWidgetPluginManifest` 和常用作者类型 | 生成的生产 Bundle |
+| `./contracts` | 完整协议类型、事件目录与判定函数 | 高级协议集成；同名协议类型显式从此处获取 |
+| `./conformance/*` | 同源协议校验语料 | Host/控制面验证 |
+| `./schemas/*.json` | 作者清单、宿主清单、运行配置与消息 Schema | 编辑器提示和工具校验 |
 | `./testing` | `MemoryTransport`、`MockWidgetHost` | 单元测试 |
 | `./runtime` | 低层 `WidgetClient`、transport 与 bootstrap 常量 | 协议级集成 |
 | `./package.json` | 已安装包的元数据 | SDK 和构建工具自动读取版本，作者无需复制版本字符串 |
+| `bohr-widget` | Node.js 命令入口 | 创建、构建、校验、开发和打包工程；不进入浏览器 Bundle |
 
 根入口只导出插件运行时和 Manifest 编译所需的少量值，其余均为类型。低层
 `MessagePortTransport` 与 bootstrap 消息不属于普通 Widget API。
@@ -339,7 +361,7 @@ import { MockWidgetHost } from "@dp-bohrium/widget-sdk/testing";
   本地等待，已发出的服务端读取可能完成，但结果被忽略。
 - Host 发来畸形 Bridge 信封或载荷时，transport 报结构化 `MESSAGE_INVALID` 并关闭
   连接，不会让 Widget 悬等。
-- Schema 与类型校验以 `@dp-bohrium/widget-contracts` 为准。
+- contracts 维护 Schema 与类型的内部唯一事实源；使用者从 SDK 的 `/contracts` 与 `/schemas/*` 公开出口读取。
 
 ## 许可证
 

package/assets/licenses/ajv@8.20.0/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2021 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/assets/licenses/fast-deep-equal@3.1.3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/licenses/fast-uri@3.1.6/LICENSE

@@ -0,0 +1,30 @@
+Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
+Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * The names of any contributors may not be used to endorse or promote
+      products derived from this software without specific prior written
+      permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+                                  *   *   *
+
+The complete list of contributors can be found at:
+- https://github.com/garycourt/uri-js/graphs/contributors

package/assets/licenses/json-schema-traverse@1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/licenses/require-from-string@2.0.2/license

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Vsevolod Strukchinsky <floatdrop@gmail.com> (github.com/floatdrop)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/assets/licenses/widget-contracts.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DP Technology
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/licenses/widget-sdk.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DP Technology
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/schemas/host-runtime-config.schema.json

@@ -0,0 +1,305 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "host-runtime-config.schema.json",
+  "description": "Host 为一次 Widget 运行签发并下发给 agent-widget 的运行时配置，不直接发给 Widget。",
+  "title": "Widget Host Runtime Config",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "hostApiVersion",
+    "configId",
+    "runId",
+    "mode",
+    "issuedAt",
+    "expiresAt",
+    "recheckAt",
+    "securityProfile",
+    "resourceBudget",
+    "runtime",
+    "network",
+    "bindings"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "hostApiVersion": { "const": 1 },
+    "configId": { "$ref": "#/$defs/Identifier" },
+    "hostId": { "$ref": "#/$defs/Identifier" },
+    "runId": { "$ref": "#/$defs/Identifier" },
+    "mode": { "$ref": "#/$defs/Mode" },
+    "issuedAt": { "$ref": "#/$defs/Timestamp" },
+    "expiresAt": { "$ref": "#/$defs/Timestamp" },
+    "recheckAt": { "$ref": "#/$defs/Timestamp" },
+    "securityProfile": { "const": "runtime-security-profile-v1" },
+    "resourceBudget": {
+      "$ref": "widget-runtime-contracts.schema.json#/$defs/ResourceBudget"
+    },
+    "runtime": { "$ref": "#/$defs/RuntimeAuthority" },
+    "network": { "$ref": "#/$defs/NetworkAuthority" },
+    "bindings": {
+      "type": "array",
+      "items": {
+        "oneOf": [
+          { "$ref": "#/$defs/LoadableBinding" },
+          { "$ref": "#/$defs/FallbackBinding" }
+        ]
+      }
+    }
+  },
+  "$defs": {
+    "LoadableBinding": {
+      "description": "可加载绑定：状态为 loadable，携带冻结版本、摘要、Manifest、启动地址与能力授权。",
+      "title": "LoadableBinding",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "bindingId",
+        "widgetId",
+        "widgetVersionId",
+        "digest",
+        "manifest",
+        "launch",
+        "grantedCapabilities"
+      ],
+      "properties": {
+        "status": { "const": "loadable" },
+        "bindingId": { "$ref": "#/$defs/Identifier" },
+        "widgetId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "digest": { "$ref": "#/$defs/Digest" },
+        "trustClass": {
+          "description": "控制面确认的信任等级；作者不能自行声明。",
+          "enum": ["external", "first-party"]
+        },
+        "runtimeProfile": {
+          "description": "控制面选择的部署配置；不授予 Cookie 或 Token 读取权限。",
+          "enum": ["public-isolated", "first-party-private"]
+        },
+        "manifest": {
+          "$ref": "widget-manifest.schema.json"
+        },
+        "launch": { "$ref": "#/$defs/Launch" },
+        "grantedCapabilities": { "$ref": "#/$defs/GrantedCapabilities" },
+        "serviceAccess": { "$ref": "#/$defs/WidgetServiceAccess" },
+        "serviceAuthorization": { "$ref": "#/$defs/HostServiceAuthorization" }
+      }
+    },
+    "HostServiceAuthorization": {
+      "title": "HostServiceAuthorization",
+      "description": "Host-only evidence bound to the exact reviewed Widget bundle and current user grant.",
+      "oneOf": [
+        { "$ref": "#/$defs/HostServiceAuthorizationRequired" },
+        { "$ref": "#/$defs/HostServiceAuthorizationGranted" }
+      ]
+    },
+    "HostServiceAuthorizationRequired": {
+      "description": "需用户授权的 Host 服务证据：状态为 authorization-required。",
+      "title": "HostServiceAuthorizationRequired",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "policy",
+        "status",
+        "hostId",
+        "widgetVersionId",
+        "bundleDigest",
+        "reviewRevision",
+        "reviewedPermissions",
+        "grantedPermissions",
+        "expiresAt"
+      ],
+      "properties": {
+        "kind": { "const": "host-service-authorization" },
+        "policy": { "const": "host-user-data-v1" },
+        "status": { "const": "authorization-required" },
+        "hostId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "bundleDigest": { "$ref": "#/$defs/Digest" },
+        "reviewRevision": { "$ref": "#/$defs/Identifier" },
+        "reviewedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "grantedPermissions": {
+          "type": "array",
+          "maxItems": 0
+        },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "HostServiceAuthorizationGranted": {
+      "description": "已授予的 Host 服务证据：状态为 granted。",
+      "title": "HostServiceAuthorizationGranted",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "policy",
+        "status",
+        "hostId",
+        "widgetVersionId",
+        "bundleDigest",
+        "reviewRevision",
+        "grantRevision",
+        "reviewedPermissions",
+        "grantedPermissions",
+        "expiresAt"
+      ],
+      "properties": {
+        "kind": { "const": "host-service-authorization" },
+        "policy": { "const": "host-user-data-v1" },
+        "status": { "const": "granted" },
+        "hostId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "bundleDigest": { "$ref": "#/$defs/Digest" },
+        "reviewRevision": { "$ref": "#/$defs/Identifier" },
+        "grantRevision": { "$ref": "#/$defs/Identifier" },
+        "reviewedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "grantedPermissions": {
+          "$ref": "widget-manifest.schema.json#/$defs/HostUserPermissions"
+        },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "FallbackBinding": {
+      "description": "降级绑定：状态为 fallback，不含 Bundle 地址、摘要、Manifest 或能力授权。",
+      "title": "FallbackBinding",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "bindingId",
+        "widgetId",
+        "widgetVersionId",
+        "contribution",
+        "reason"
+      ],
+      "properties": {
+        "status": { "const": "fallback" },
+        "bindingId": { "$ref": "#/$defs/Identifier" },
+        "widgetId": { "$ref": "#/$defs/Identifier" },
+        "widgetVersionId": { "$ref": "#/$defs/Identifier" },
+        "contribution": {
+          "$ref": "widget-manifest.schema.json#/$defs/WidgetContributionConfig"
+        },
+        "reason": { "$ref": "#/$defs/FallbackReason" }
+      }
+    },
+    "RuntimeAuthority": {
+      "description": "运行域授权：origin 与 catalogRevision。",
+      "title": "RuntimeAuthority",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["origin", "catalogRevision"],
+      "properties": {
+        "origin": { "$ref": "#/$defs/RuntimeOrigin" },
+        "catalogRevision": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+        },
+        "profile": {
+          "enum": ["public-isolated", "first-party-private"]
+        }
+      }
+    },
+    "NetworkAuthority": {
+      "description": "网络授权：mode、policyVersion 与限制。",
+      "title": "NetworkAuthority",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode", "policyVersion", "limits"],
+      "properties": {
+        "mode": { "enum": ["runtime-consent", "unavailable"] },
+        "policyVersion": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+        },
+        "limits": {
+          "$ref": "widget-runtime-contracts.schema.json#/$defs/WidgetNetworkLimits"
+        }
+      }
+    },
+    "GrantedCapabilities": {
+      "description": "已授予能力列表。",
+      "title": "GrantedCapabilities",
+      "type": "array",
+      "items": {
+        "$ref": "widget-runtime-contracts.schema.json#/$defs/GrantedCapability"
+      }
+    },
+    "Launch": {
+      "description": "一次性启动地址与有效期。",
+      "title": "Launch",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url", "expiresAt"],
+      "properties": {
+        "url": { "type": "string", "pattern": "^https?://" },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    },
+    "RuntimeOrigin": {
+      "description": "隔离域运行源地址。",
+      "title": "RuntimeOrigin",
+      "type": "string",
+      "maxLength": 253,
+      "pattern": "^(?:https://[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::[0-9]{1,5})?|http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])(?::[0-9]{1,5})?)$"
+    },
+    "FallbackReason": {
+      "description": "降级原因枚举。",
+      "title": "FallbackReason",
+      "enum": [
+        "not-authorized",
+        "not-approved",
+        "delisted-for-new-use",
+        "revoked",
+        "host-api-unsupported",
+        "preview-not-allowed"
+      ]
+    },
+    "Digest": {
+      "description": "内容摘要；形如 sha256:<hex>。",
+      "title": "Digest",
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "Identifier": {
+      "description": "不透明标识符。",
+      "title": "Identifier",
+      "type": "string",
+      "minLength": 1
+    },
+    "Mode": {
+      "description": "运行模式：preview 或 published。",
+      "title": "Mode",
+      "enum": ["preview", "published"]
+    },
+    "Timestamp": {
+      "description": "UTC 时间戳：YYYY-MM-DD + T + 非空格字符，以 Z 结尾。",
+      "title": "Timestamp",
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T[^ ]+Z$"
+    },
+    "WidgetServiceAccess": {
+      "title": "WidgetServiceAccess",
+      "description": "绑定当前不可变版本与摘要的审核投影；服务端每次调用仍须复核撤销和用户权限。",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["approvalId", "revision", "appId", "policyVersion", "expiresAt"],
+      "properties": {
+        "approvalId": { "$ref": "#/$defs/Identifier" },
+        "revision": { "$ref": "#/$defs/Identifier" },
+        "appId": { "$ref": "#/$defs/Identifier" },
+        "policyVersion": { "$ref": "#/$defs/Identifier" },
+        "expiresAt": { "$ref": "#/$defs/Timestamp" }
+      }
+    }
+  }
+}