@dp-bohrium/widget-sdk 0.6.0 → 0.7.0

package/dist/cli.mjs

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { constants, existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync, watch } from "node:fs";
 import { chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileWidgetPluginManifest } from "@dp-bohrium/widget-sdk";
 import { spawn, spawnSync } from "node:child_process";
 import { createServer } from "node:http";
+import { isDeepStrictEqual } from "node:util";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -99,7 +98,59 @@ function collectReferencedFileIds(request) {
 	return referenced;
 }
 //#endregion
+//#region ../widget-project/src/manifest-compiler.mjs
+function compiledContribution(contribution) {
+	switch (contribution.type) {
+		case "panel": return {
+			type: "panel",
+			id: contribution.id,
+			...contribution.placement === void 0 ? {} : { placement: contribution.placement }
+		};
+		case "file-preview": return {
+			type: "file-preview",
+			extensions: [...contribution.extensions]
+		};
+	}
+}
+/** 只编译协议数据；SDK 版本由可信调用方绑定，不读取安装或执行环境。 */
+function compileWidgetPluginManifest(manifest, sdkVersion, options = {}) {
+	const samples = options.samples ?? manifest.samples;
+	if (!samples || samples.length === 0) throw new Error("Widget Plugin Manifest must provide at least one sample before packaging");
+	const contribution = manifest.contributes.widget;
+	if (contribution.type === "panel" && contribution.placement?.kind === "region" && (manifest.capabilities?.region?.mode !== contribution.placement.mode || !manifest.capabilities.region.regions.includes(contribution.placement.region))) throw new Error("A region Widget contribution must declare a matching region capability");
+	const activationEvents = manifest.activationEvents ? [...manifest.activationEvents] : void 0;
+	return {
+		name: manifest.name,
+		...manifest.description === void 0 ? {} : { description: manifest.description },
+		widgetConfig: {
+			schemaVersion: 1,
+			hostApiVersion: 1,
+			widgetSdkVersion: sdkVersion,
+			entry: options.hostEntry ?? "dist/widget.js",
+			contribution: compiledContribution(manifest.contributes.widget),
+			...activationEvents === void 0 ? {} : { activationEvents },
+			...manifest.capabilities === void 0 ? {} : { requestedCapabilities: manifest.capabilities },
+			...manifest.runtime === void 0 ? {} : { runtime: manifest.runtime },
+			samples
+		}
+	};
+}
+//#endregion
+//#region package.json
+var name = "@dp-bohrium/widget-sdk";
+var version = "0.7.0";
+//#endregion
+//#region ../widget-project/src/sdk-metadata.mjs
+/** 只读取交付包元数据，不加载 SDK 公开入口的执行代码。 */
+function getSdkVersion() {
+	if (name !== "@dp-bohrium/widget-sdk" || typeof version !== "string" || version.length === 0) throw new Error("Widget SDK package metadata is invalid");
+	return version;
+}
+//#endregion
 //#region ../widget-project/src/manifest.mjs
+function compileWithSdkMetadata(manifest, options) {
+	return compileWidgetPluginManifest(manifest, getSdkVersion(), options);
+}
 /**
 * Convert the author-facing VS Code-style plugin manifest to the Host
 * manifest consumed by Host Runtime Config. This is deliberately a tooling
@@ -110,7 +161,7 @@ function compileAuthorManifest(manifest, options = {}) {
 	if (!isAuthorManifest(manifest)) return manifest;
 	const contribution = manifest.contributes?.widget;
 	if (!contribution || typeof contribution !== "object" || !["panel", "file-preview"].includes(contribution.type) || contribution.type === "file-preview" && !Array.isArray(contribution.extensions)) return manifest;
-	const compiled = (options.compiler ?? compileWidgetPluginManifest)(manifest, {
+	const compiled = (options.compiler ?? compileWithSdkMetadata)(manifest, {
 		hostEntry: options.hostEntry,
 		samples: options.samples
 	});
@@ -124,7 +175,6 @@ function compileAuthorManifest(manifest, options = {}) {
 function isAuthorManifest(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value) && "contributes" in value && "version" in value);
 }
-createRequire(import.meta.url);
 //#endregion
 //#region ../contract-testing/src/generated-runtime-contracts-schema.ts
 /** GENERATED FILE. Do not edit directly. */
@@ -1050,17 +1100,15 @@ const widgetRuntimeContractsSchema = {
 						"limits": {
 							"type": "object",
 							"additionalProperties": false,
-							"required": [
-								"bytesPerRequest",
-								"bytesPerRun",
-								"callsPerMinute"
-							],
+							"required": ["bytesPerRequest", "callsPerMinute"],
 							"properties": {
 								"bytesPerRequest": {
 									"type": "integer",
 									"minimum": 1
 								},
 								"bytesPerRun": {
+									"description": "历史读取累计额度字段，仅为兼容旧配置保留；当前 files.read 不累计或执行此额度，新宿主不再下发。",
+									"deprecated": true,
 									"type": "integer",
 									"minimum": 1
 								},
@@ -2376,7 +2424,6 @@ const widgetRuntimeContractsSchema = {
 					"additionalProperties": false,
 					"required": [
 						"readBytesPerRequest",
-						"readBytesPerRun",
 						"callsPerMinute",
 						"listPageSize"
 					],
@@ -2386,6 +2433,8 @@ const widgetRuntimeContractsSchema = {
 							"minimum": 1
 						},
 						"readBytesPerRun": {
+							"description": "历史读取累计额度字段，仅为兼容旧配置保留；当前 files.read 不累计或执行此额度，新宿主不再下发。",
+							"deprecated": true,
 							"type": "integer",
 							"minimum": 1
 						},
@@ -11314,7 +11363,7 @@ function storedZip(files) {
 	]);
 }
 //#endregion
-//#region ../widget-project/src/export.mjs
+//#region ../widget-project/src/packaging.mjs
 const EXCLUDED_BUILD_NAMES = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
@@ -11359,6 +11408,22 @@ function collectBuildAssets(root, entry) {
 	visit(rootName);
 	return files;
 }
+function assembleWidgetPackage(project, options) {
+	const files = collectWidgetPackageFiles(project, options);
+	return {
+		files,
+		archive: storedZip(files)
+	};
+}
+/** 已完成作者工程检查后的内部交付组装；不执行构建或改变预览夹具规则。 */
+function prepareWidgetPackage(project, options = {}) {
+	const prepared = assembleWidgetPackage(project, options);
+	return {
+		...prepared,
+		bytes: prepared.archive.byteLength,
+		sha256: `sha256:${createHash("sha256").update(prepared.archive).digest("hex")}`
+	};
+}
 /** 返回将写入 ZIP 的 `[路径, 字节]` 列表；同一路径可能重复出现，由 `storedZip` 去重。 */
 function collectWidgetPackageFiles(project, options = {}) {
 	const root = resolve(project.projectRoot);
@@ -11436,7 +11501,6 @@ const RESOURCE_BUDGET = {
 	},
 	files: {
 		readBytesPerRequest: 4194304,
-		readBytesPerRun: 16777216,
 		callsPerMinute: 120,
 		listPageSize: 100
 	},
@@ -11665,7 +11729,6 @@ function requestedGrants(requested = {}) {
 		name: "files.read",
 		limits: {
 			bytesPerRequest: 4194304,
-			bytesPerRun: 16777216,
 			callsPerMinute: 120
 		}
 	});
@@ -11763,7 +11826,7 @@ function panelDevelopmentDescriptor(generation, profileUrl, statusUrl) {
 		widgetId,
 		widgetVersionId,
 		snapshot: {
-			id,
+			panelType: id,
 			title: generation.manifest.name,
 			state: "complete",
 			data: {}
@@ -12760,7 +12823,7 @@ function commandTopics(context) {
 			notes: [
 				"不传 --project 时只发现 CLI 自带工具链，不检查当前目录是否为 Widget 工程。",
 				"传入工程时要求工具链锁；尚未安装依赖时先核对声明，已安装时同时核对实际版本。",
-				"JSON 使用 interfaceVersion=2、toolchain.formatVersion=2；返回 execution、profile、requirements 和 documentation。",
+				"JSON 使用 interfaceVersion=3、toolchain.formatVersion=3；返回 execution、profile、requirements 和 documentation。",
 				"调用方应使用 execution.executable 与 execution.entry 启动同一份 CLI，避免 PATH 指向另一版本。",
 				"宿主声明由调用方提供；unknown、snapshot、confirmed 不代表上传或发布许可。"
 			],
@@ -12773,7 +12836,7 @@ function commandTopics(context) {
 			options: [HOST_OPTION, JSON_OPTION],
 			examples: ["bohr-widget adopt ./existing-widget --json", "bohr-widget adopt . --host-compat ./host.json --json"],
 			notes: [
-				"先运行 doctor，恢复当前 profile 的精确 SDK/contracts 依赖并安装。",
+				"先运行 doctor，恢复当前 profile 的精确 SDK 依赖并安装。",
 				"核对实际依赖、Manifest 和 samples 后才写锁；不要求已构建入口。",
 				"不会自动升级依赖、迁移源码或修正协议字段；检查不通过时先修复工程。"
 			]
@@ -12790,7 +12853,7 @@ function commandTopics(context) {
 			]
 		},
 		version: {
-			description: "查看当前 CLI 及其固定的 SDK/contracts 版本。",
+			description: "查看当前 SDK 执行器及内置协议摘要。",
 			usage: ["bohr-widget version [--json]", "bohr-widget --version [--json]"],
 			options: [JSON_OPTION],
 			examples: ["bohr-widget version --json", "bohr-widget -v"],
@@ -12861,9 +12924,9 @@ function section(title, lines) {
 	return lines.length ? `\n${title}：\n${lines.map((line) => `  ${line}`).join("\n")}\n` : "";
 }
 function globalHelp(context) {
-	const { cli, sdk, contracts, packageName = "@dp-bohrium/widget-cli", generatedProjectNode, documentation } = context;
+	const { cli, sdk, packageName = "@dp-bohrium/widget-cli", generatedProjectNode, documentation } = context;
 	return `bohr-widget ${cli} — Bohrium Widget 插件工程工具
-SDK ${sdk} / contracts ${contracts}
+SDK ${sdk}（协议与执行工具链均由 SDK 内置）
 创建、校验、构建、开发调试与打包；上传、发布和 Agent 绑定由 Bohr CLI 或平台执行。
 
 用法：
@@ -12883,7 +12946,7 @@ SDK ${sdk} / contracts ${contracts}
   schema                           打印作者 Manifest Schema 的本地路径
   migrate project plan|apply        比较 Agent 准备的候选并安全复制到新目录
   migrate dsh audit|scaffold        审计 DSH 来源或按已审查配方生成工程
-  version                          查看 CLI 与固定的 SDK/contracts 版本
+  version                          查看 SDK 执行器与内置协议版本
   help [命令...]                   查看全局或指定主题帮助
 
 全局选项：
@@ -13433,10 +13496,7 @@ async function scaffoldDshWidget(input, output, options) {
 	const repeated = await auditDshPlugin(sourceRoot);
 	const snapshotFingerprint = `sha256:${createHash("sha256").update(JSON.stringify([...snapshot.files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))).digest("hex")}`;
 	if (repeated.source.fingerprint !== report.source.fingerprint || snapshotFingerprint !== report.source.fingerprint) throw failure$1("SOURCE_CHANGED", "迁移期间源快照发生变化。");
-	const projectFiles = applyDshRecipe(recipe, snapshot.files, {
-		sdkVersion: options?.sdkVersion ?? "0.1.0",
-		contractsVersion: options?.contractsVersion ?? "0.1.0"
-	});
+	const projectFiles = applyDshRecipe(recipe, snapshot.files, { sdkVersion: options?.sdkVersion ?? "0.1.0" });
 	const root = resolve(output);
 	await mkdir(root);
 	for (const [path, content] of Object.entries(projectFiles)) {
@@ -13457,10 +13517,7 @@ async function scaffoldDshWidget(input, output, options) {
 //#region ../widget-cli/src/project-executor.mjs
 const PROJECT_TOOLCHAIN_FILE = "widget-toolchain.json";
 const BUILD_RECEIPT_FILE = ".widget-build-receipt.json";
-const PACKAGES = Object.freeze({
-	sdk: "@dp-bohrium/widget-sdk",
-	contracts: "@dp-bohrium/widget-contracts"
-});
+const PACKAGES = Object.freeze({ sdk: "@dp-bohrium/widget-sdk" });
 const EXACT_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
 function failure(code, message, context, recovery) {
 	return Object.assign(new Error(message), {
@@ -13534,12 +13591,12 @@ async function assertHostCompatibility(hostCompatPath, toolchain, { now = Date.n
 }
 function assertMatchingLock(lock, toolchain, root) {
 	const { profile } = toolchain;
-	if (!record$1(lock) || lock.formatVersion !== 1 || lock.profileId !== profile.id) throw failure("PROJECT_PROFILE_MISMATCH", "工程锁定的 profile 与当前 Widget CLI 不一致", {
+	if (!record$1(lock) || lock.formatVersion !== 2 || lock.profileId !== profile.id) throw failure("PROJECT_PROFILE_MISMATCH", "工程锁定格式或 profile 与当前 SDK 不一致；旧工程需准备当前源码候选后迁移，不能复用历史执行器", {
 		projectRoot: root,
 		expectedProfile: profile.id,
 		actualProfile: lock?.profileId
 	}, ["使用当前受支持的 CLI，并在新目录显式迁移工程与验收；不要回选旧 CLI 绕过 profile 差异。"]);
-	if (lock.sdk !== profile.sdk || lock.contracts !== profile.contracts) throw failure("PROJECT_SDK_MISMATCH", "工程锁定的 SDK/contracts 与当前 profile 不一致", {
+	if (lock.sdk !== profile.sdk || !isDeepStrictEqual(lock.protocol, toolchain.protocol)) throw failure("PROJECT_SDK_MISMATCH", "工程锁定的 SDK 或内置协议与当前 profile 不一致", {
 		projectRoot: root,
 		expected: profile,
 		actual: lock
@@ -13578,39 +13635,58 @@ function assertInstalledPackage(actual, name, expected, root) {
 		installed: actual?.version
 	}, ["按工程锁定信息恢复依赖并重新安装，再重新构建。"]);
 }
-/** 只接受 SDK 自身依赖或其安装目录中的提升依赖，不向工作区祖先借用。 */
-async function sdkContractsMetadata(sdkPath, root) {
+/** 名称和字节同时参与摘要；禁止通过协议资产链接借用其他安装。 */
+async function schemaDigest(directory) {
+	const hash = createHash("sha256");
+	const paths = [];
+	async function visit(path) {
+		const entry = await lstat(path);
+		if (entry.isSymbolicLink()) throw new Error("SDK 协议资产不允许符号链接");
+		if (entry.isDirectory()) for (const name of (await readdir(path)).sort()) await visit(join(path, name));
+		else if (entry.isFile()) paths.push(path);
+		else throw new Error("SDK 协议资产必须是普通文件");
+	}
+	await visit(directory);
+	if (!paths.length) throw new Error("SDK 协议资产为空");
+	for (const path of paths.sort()) {
+		const bytes = await readFile(path);
+		hash.update(relative(directory, path).split(sep).join("/"));
+		hash.update("\0");
+		hash.update(String(bytes.length));
+		hash.update("\0");
+		hash.update(bytes);
+	}
+	return `sha256:${hash.digest("hex")}`;
+}
+async function assertEmbeddedProtocol(sdkPath, toolchain, root) {
 	const sdkRoot = dirname(await realpath(sdkPath));
-	const resolver = createRequire(join(sdkRoot, "package.json"));
-	const lookupRoots = /* @__PURE__ */ new Set([join(sdkRoot, "node_modules")]);
-	for (let current = sdkRoot; dirname(current) !== current; current = dirname(current)) if (basename(current) === "node_modules") {
-		lookupRoots.add(current);
-		break;
-	}
 	try {
-		const resolvedPath = await realpath(resolver.resolve(`${PACKAGES.contracts}/package.json`));
-		for (const lookup of resolver.resolve.paths(PACKAGES.contracts) ?? []) {
-			if (!lookupRoots.has(lookup)) continue;
-			try {
-				if (await realpath(join(lookup, PACKAGES.contracts, "package.json")) === resolvedPath) return await json(resolvedPath, "PROJECT_SDK_MISMATCH", ["重新安装工程 SDK 及其配套 contracts 依赖。"]);
-			} catch (error) {
-				if (error.code !== "ENOENT") throw error;
-			}
-		}
+		const embedded = JSON.parse(await readFile(join(sdkRoot, "assets/toolchain.json"), "utf8"));
+		if (embedded.formatVersion !== 3 || embedded.packageName !== PACKAGES.sdk || embedded.cli !== toolchain.profile.sdk || !isDeepStrictEqual(embedded.profile, toolchain.profile) || !isDeepStrictEqual(embedded.protocol, toolchain.protocol) || !isDeepStrictEqual(embedded.digests, toolchain.digests) || embedded.protocol?.schemaVersion !== 1 || embedded.protocol?.hostApiVersion !== 1 || embedded.protocol?.digest !== embedded.digests?.schemas) throw new Error("SDK 内置协议或执行工具链元数据与当前执行器不一致");
+		for (const directory of ["schemas", "assets/schemas"]) if (await schemaDigest(join(sdkRoot, directory)) !== embedded.protocol.digest) throw new Error("SDK 内置协议资产已漂移");
 	} catch (error) {
-		if (error.cliCode) throw error;
+		throw failure("PROJECT_SDK_MISMATCH", "工程 SDK 缺少有效的自包含协议资产或摘要不一致", {
+			projectRoot: root,
+			package: PACKAGES.sdk,
+			cause: error.message
+		}, ["在当前工程安装正确的 SDK 完整包，再重新构建；不能借用祖先目录或旧 contracts 包。"]);
 	}
-	throw failure("PROJECT_SDK_MISMATCH", "工程 SDK 缺少自身可解析的配套 contracts，不能借用祖先目录或 CLI 的依赖", {
-		projectRoot: root,
-		package: PACKAGES.contracts
-	}, ["在该 Widget 工程目录重新安装依赖，并保留 SDK 自身的传递依赖。"]);
 }
-/** SDK 必须由工程直接安装，contracts 从该 SDK 的真实依赖核对。 */
+/** SDK 必须由工程直接安装；协议只能来自该 SDK 自己的冻结资产。 */
 async function validateProjectToolchain(projectRoot, toolchain, { requireInstalled = true, requireLock = true } = {}) {
 	const root = resolve(projectRoot);
 	const lock = await readLock(root, toolchain, requireLock);
 	const pkg = await json(join(root, "package.json"), "PROJECT_SDK_MISMATCH", ["恢复工程 package.json 中的精确 SDK 依赖。"]);
 	if (!record$1(pkg)) throw failure("PROJECT_SDK_MISMATCH", "工程 package.json 必须是对象", { projectRoot: root }, ["恢复工程 package.json 中的精确 SDK 依赖。"]);
+	for (const section of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+		"peerDependencies"
+	]) for (const name of ["@dp-bohrium/widget-contracts", "@dp-bohrium/widget-cli"]) if (pkg[section]?.[name] !== void 0) throw failure("PROJECT_SDK_MISMATCH", "作者工程仍直接声明 contracts 或 CLI，需统一使用 SDK 入口", {
+		projectRoot: root,
+		package: name
+	}, ["作者工程统一依赖 SDK；独立 CLI 请在工具目录或通过 npx 使用，Contracts 独立包供 Host 等消费者使用。保留作者源码，在独立候选中移除重复依赖、重新安装和构建。"]);
 	const declared = {};
 	const installed = {};
 	for (const [key, name] of Object.entries(PACKAGES)) {
@@ -13633,53 +13709,22 @@ async function validateProjectToolchain(projectRoot, toolchain, { requireInstall
 		const actual = await json(path, "PROJECT_SDK_MISMATCH", ["在该 Widget 工程目录安装依赖，再重试；父目录或 CLI 的安装不能替代工程安装。"]);
 		assertInstalledPackage(actual, name, expected, root);
 		installed[key] = actual.version;
-		if (key === "sdk") {
-			const dependency = actual.dependencies?.[PACKAGES.contracts];
-			if (dependency !== toolchain.profile.contracts && dependency !== "workspace:*" && dependency !== `workspace:${toolchain.profile.contracts}`) throw failure("PROJECT_SDK_MISMATCH", "工程 SDK 的 contracts 依赖与固定 profile 不一致", {
-				projectRoot: root,
-				package: name,
-				expected: toolchain.profile.contracts,
-				declared: dependency
-			}, ["安装固定 profile 对应的 SDK；发布包的 contracts 依赖必须为精确版本。"]);
-			const contracts = await sdkContractsMetadata(path, root);
-			assertInstalledPackage(contracts, PACKAGES.contracts, toolchain.profile.contracts, root);
-			installed.contracts = contracts.version;
-		}
+		for (const name of ["@dp-bohrium/widget-contracts", "@dp-bohrium/widget-cli"]) if ([
+			"dependencies",
+			"optionalDependencies",
+			"peerDependencies"
+		].some((section) => actual[section]?.[name] !== void 0)) throw failure("PROJECT_SDK_MISMATCH", "工程 SDK 仍包含独立协议或 CLI 运行依赖，不符合当前自包含发布契约", {
+			projectRoot: root,
+			package: name
+		}, ["安装当前自包含 SDK 包，再重新构建。"]);
+		await assertEmbeddedProtocol(path, toolchain, root);
 	}
 	return {
 		projectRoot: root,
 		profile: { ...toolchain.profile },
 		declared,
 		installed,
-		deprecations: declared.contracts ? [{
-			code: "WIDGET_CLI_DIRECT_CONTRACTS_DEPRECATED",
-			message: "独立消费者直接声明 contracts 的旧入口已废弃，将在统一入口切换发布 R1 前移除；协议类型与资产改从 SDK 导入。",
-			replacement: {
-				package: PACKAGES.sdk,
-				entryPoints: [
-					".",
-					"./contracts",
-					"./schemas/*.json",
-					"./conformance/*"
-				]
-			},
-			removal: {
-				release: "R1",
-				phase: "before-publish",
-				policyDocument: "docs/plans/2026-10-29-widget-sdk-forge-unified-entry.md",
-				prerequisites: [
-					"unified-sdk-entries-deliverable",
-					"agent-guided-project-migration-ready",
-					"bohr-and-hosts-upgraded"
-				]
-			},
-			migration: {
-				status: "agent-guided",
-				project: "migrate project plan/apply",
-				candidateRequired: true
-			},
-			recovery: ["先核实目标 SDK 的统一出口已公开，再迁移类型和 Schema 导入、删除工程直接 contracts 依赖，并重新安装、构建、校验和打包。", "由 Agent 或开发者依据当前 SDK 准备候选，再用 migrate project plan --candidate 只读审阅差异，确认 canApply 后在新目录 apply；不自动改写源码或依赖，adopt 只补锁。"]
-		}] : [],
+		deprecations: [],
 		dependenciesVerified: requireInstalled,
 		lock
 	};
@@ -13689,10 +13734,10 @@ async function writeProjectToolchain(projectRoot, toolchain) {
 	const existing = await readLock(root, toolchain, false);
 	if (existing) return existing;
 	const value = {
-		formatVersion: 1,
+		formatVersion: 2,
 		profileId: toolchain.profile.id,
 		sdk: toolchain.profile.sdk,
-		contracts: toolchain.profile.contracts,
+		protocol: toolchain.protocol,
 		createdWithCli: toolchain.cli
 	};
 	await mkdir(root, { recursive: true });
@@ -13733,6 +13778,7 @@ function receiptToolchain(toolchain) {
 	return {
 		cli: toolchain.cli,
 		profile: toolchain.profile,
+		protocol: toolchain.protocol,
 		digests: toolchain.digests
 	};
 }
@@ -13777,7 +13823,7 @@ async function writeBuildReceipt(projectRoot, toolchain, { inputsBefore } = {})
 	const outputs = await fingerprint(result.projectRoot, { outputs: true });
 	if (outputs.files.length === 0) throw failure("BUILD_RECEIPT_MISMATCH", "构建目录 dist 没有可记录的产物", { projectRoot: result.projectRoot }, ["执行标准 build，确认 dist 产物存在后再打包。"]);
 	const receipt = {
-		formatVersion: 1,
+		formatVersion: 2,
 		toolchain: receiptToolchain(toolchain),
 		dependencies: result.installed,
 		inputs,
@@ -13796,7 +13842,7 @@ async function assertBuildReceipt(projectRoot, toolchain) {
 	};
 	const receipt = await json(join(root, BUILD_RECEIPT_FILE), "BUILD_RECEIPT_MISMATCH", ["先执行 bohr-widget build，或去掉 pack 的 --no-build。"]);
 	const project = await validateProjectToolchain(root, toolchain);
-	if (!record$1(receipt) || receipt.formatVersion !== 1 || JSON.stringify(receipt.toolchain) !== JSON.stringify(receiptToolchain(toolchain)) || JSON.stringify(receipt.dependencies) !== JSON.stringify(project.installed)) mismatch("receipt 工具链或实际依赖与本次执行不一致");
+	if (!record$1(receipt) || receipt.formatVersion !== 2 || JSON.stringify(receipt.toolchain) !== JSON.stringify(receiptToolchain(toolchain)) || JSON.stringify(receipt.dependencies) !== JSON.stringify(project.installed)) mismatch("receipt 工具链或实际依赖与本次执行不一致");
 	let inputs;
 	let outputs;
 	try {
@@ -14447,7 +14493,6 @@ export { activate };
 						name: "files.read",
 						limits: {
 							bytesPerRequest: 65536,
-							bytesPerRun: 262144,
 							callsPerMinute: 60
 						}
 					}
@@ -14570,12 +14615,11 @@ function getSchemaPath(name = "widget-manifest.schema.json") {
 const toolchain = getToolchain();
 const packageJson = { version: toolchain.cli };
 const sdkPackage = { version: toolchain.profile.sdk };
-const contractsPackage = { version: toolchain.profile.contracts };
 function usage(path = []) {
 	return renderHelp(path, {
 		cli: packageJson.version,
 		sdk: sdkPackage.version,
-		contracts: contractsPackage.version,
+		protocol: toolchain.protocol,
 		packageName: toolchain.packageName,
 		documentation: getDocumentation(),
 		generatedProjectNode: GENERATED_PROJECT_NODE
@@ -14726,7 +14770,7 @@ async function commandIntegration(options) {
 	const result = {
 		ok: true,
 		command: "integration",
-		interfaceVersion: 2,
+		interfaceVersion: 3,
 		requirements: {
 			node: ">=20",
 			generatedProjectNode: GENERATED_PROJECT_NODE
@@ -15294,9 +15338,9 @@ async function commandPack(directory, options) {
 	const warnings = [];
 	if (options.includePreviewFixtures && !hasFixtures) warnings.push("使用了 --include-preview-fixtures，但 preview/fixtures.json 不存在，ZIP 未包含任何 fixtures。");
 	else if (hasFixtures && !options.includePreviewFixtures) warnings.push("工程包含 preview/fixtures.json，未使用 --include-preview-fixtures，ZIP 未包含 fixtures。");
-	const files = collectWidgetPackageFiles(result, { includePreviewFixtures: fixturesIncluded });
-	warnings.push(...oversizedAssetWarnings(files));
-	const bundle = storedZip(files);
+	const prepared = prepareWidgetPackage(result, { includePreviewFixtures: fixturesIncluded });
+	warnings.push(...oversizedAssetWarnings(prepared.files));
+	const bundle = prepared.archive;
 	await mkdir(dirname(destination), { recursive: true });
 	await writeFile(destination, bundle);
 	const artifact = {
@@ -15304,12 +15348,12 @@ async function commandPack(directory, options) {
 		command: "pack",
 		projectRoot: result.projectRoot,
 		path: destination,
-		bytes: bundle.byteLength,
-		sha256: `sha256:${createHash("sha256").update(bundle).digest("hex")}`,
+		bytes: prepared.bytes,
+		sha256: prepared.sha256,
 		toolchain: {
 			cli: packageJson.version,
 			sdk: sdkPackage.version,
-			contracts: contractsPackage.version
+			protocol: toolchain.protocol
 		},
 		...compatibility,
 		hostCompatibility: await assertHostCompatibility(options.hostCompat, toolchain),
@@ -15365,10 +15409,7 @@ async function commandMigrate(positional, options) {
 	if (action === "scaffold") {
 		if (!options.output) throw new Error("migrate dsh scaffold 需要 --out <widget-dir>");
 		const hostCompatibility = await assertHostCompatibility(options.hostCompat, toolchain);
-		const result = await scaffoldDshWidget(input, options.output, {
-			sdkVersion: sdkPackage.version,
-			contractsVersion: contractsPackage.version
-		});
+		const result = await scaffoldDshWidget(input, options.output, { sdkVersion: sdkPackage.version });
 		await writeProjectToolchain(result.projectRoot, toolchain);
 		result.profile = toolchain.profile;
 		result.hostCompatibility = hostCompatibility;
@@ -15387,7 +15428,7 @@ async function commandDoctor(directory, options) {
 		cli: packageJson.version,
 		node: process.versions.node,
 		sdk: sdkPackage.version,
-		contracts: contractsPackage.version,
+		protocol: toolchain.protocol,
 		project: root,
 		packageJson: existsSync(packagePath),
 		manifest: existsSync(manifestPath),
@@ -15462,7 +15503,7 @@ function commandVersion(options) {
 		command: "version",
 		cli: packageJson.version,
 		sdk: sdkPackage.version,
-		contracts: contractsPackage.version
+		protocol: toolchain.protocol
 	};
 	if (options.json) console.log(JSON.stringify(result, null, 2));
 	else console.log(`${result.cli} (SDK ${result.sdk})`);

package/dist/contracts.d.ts

@@ -1,2 +1,2 @@
 /** 完整协议保持独立子入口，避免与作者接口的同名类型混用。 */
-export * from "@dp-bohrium/widget-contracts";
+export * from "./protocol/index.js";

package/dist/contracts.js

@@ -1 +1,2 @@
-export * from "@dp-bohrium/widget-contracts";
+import { i as isWidgetActivationEvent, n as isWidgetEventName, r as WIDGET_ACTIVATION_EVENTS, t as WIDGET_EVENT_NAMES } from "./widget-events-BT0QxR-H.js";
+export { WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, isWidgetActivationEvent, isWidgetEventName };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { CapabilityRequest, CapabilityResult, FileDownloadResult, FileMutationId, FilePreviewContent, FilePreviewRenderRequest, FileReadInput, FileReadResult, FileReference, FileRevision, FileWriteInput, FileWriteResult, GrantedCapability, JsonValue, PanelContent, PanelRenderRequest, RenderRequest, RenderState, TaskObservationBatch, TaskObservationEvent, TaskObservationSnapshot, Theme, ThemeMode, WidgetActivationEvent, WidgetActivationEvents, WidgetContribution, WidgetError, WidgetErrorCode, WidgetEventName, WidgetFilePreviewContribution, WidgetLiveEvent, WidgetNetworkFetchInput, WidgetNetworkFetchOutput, WidgetPanelContribution, WidgetPluginContributions, WidgetPluginManifest, WidgetToolPhase, } from "@dp-bohrium/widget-contracts";
-export { isWidgetActivationEvent, isWidgetEventName, WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, } from "@dp-bohrium/widget-contracts";
+export type { CapabilityRequest, CapabilityResult, FileDownloadResult, FileMutationId, FilePreviewContent, FilePreviewRenderRequest, FileReadInput, FileReadResult, FileReference, FileRevision, FileWriteInput, FileWriteResult, GrantedCapability, JsonValue, PanelContent, PanelRenderRequest, RenderRequest, RenderState, TaskObservationBatch, TaskObservationEvent, TaskObservationSnapshot, Theme, ThemeMode, WidgetActivationEvent, WidgetActivationEvents, WidgetContribution, WidgetError, WidgetErrorCode, WidgetEventName, WidgetFilePreviewContribution, WidgetLiveEvent, WidgetNetworkFetchInput, WidgetNetworkFetchOutput, WidgetPanelContribution, WidgetPluginContributions, WidgetPluginManifest, WidgetToolPhase, } from "./protocol/index.js";
+export { isWidgetActivationEvent, isWidgetEventName, WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, } from "./protocol/index.js";
 export type { CompileWidgetPluginManifestOptions } from "./manifest.js";
 export { compileWidgetPluginManifest } from "./manifest.js";
 export type { HostUserEmail, HostUserEmailResult, HostUserProfile, HostUserProfileResult, WidgetHostUserClient, } from "./runtime/service.js";

package/dist/index.js

@@ -1,6 +1,6 @@
-import { i as createWidgetClient, l as WIDGET_SDK_VERSION } from "./runtime-D7KxTtdu.js";
-import { WIDGET_ACTIVATION_EVENTS, WIDGET_EVENT_NAMES, isWidgetActivationEvent, isWidgetEventName } from "@dp-bohrium/widget-contracts";
-//#region src/manifest.ts
+import { i as isWidgetActivationEvent, n as isWidgetEventName, r as WIDGET_ACTIVATION_EVENTS, t as WIDGET_EVENT_NAMES } from "./widget-events-BT0QxR-H.js";
+import { i as createWidgetClient, l as WIDGET_SDK_VERSION } from "./runtime-DZA7Gqzl.js";
+//#region ../widget-project/src/manifest-compiler.mjs
 function compiledContribution(contribution) {
 	switch (contribution.type) {
 		case "panel": return {
@@ -14,13 +14,8 @@ function compiledContribution(contribution) {
 		};
 	}
 }
-/**
-* 将开发者维护的插件清单编译为宿主可加载的宿主清单。
-*
-* 这是构建工具的边界函数，不是类型提示入口：作者直接编辑带 `$schema` 的 JSON，
-* SDK 版本从当前安装包读取，宿主入口默认落到 dist/widget.js，内部 contribution 标识只在这里生成。
-*/
-function compileWidgetPluginManifest(manifest, options = {}) {
+/** 只编译协议数据；SDK 版本由可信调用方绑定，不读取安装或执行环境。 */
+function compileWidgetPluginManifest$1(manifest, sdkVersion, options = {}) {
 	const samples = options.samples ?? manifest.samples;
 	if (!samples || samples.length === 0) throw new Error("Widget Plugin Manifest must provide at least one sample before packaging");
 	const contribution = manifest.contributes.widget;
@@ -32,7 +27,7 @@ function compileWidgetPluginManifest(manifest, options = {}) {
 		widgetConfig: {
 			schemaVersion: 1,
 			hostApiVersion: 1,
-			widgetSdkVersion: WIDGET_SDK_VERSION,
+			widgetSdkVersion: sdkVersion,
 			entry: options.hostEntry ?? "dist/widget.js",
 			contribution: compiledContribution(manifest.contributes.widget),
 			...activationEvents === void 0 ? {} : { activationEvents },
@@ -43,6 +38,17 @@ function compileWidgetPluginManifest(manifest, options = {}) {
 	};
 }
 //#endregion
+//#region src/manifest.ts
+/**
+* 将开发者维护的插件清单编译为宿主可加载的宿主清单。
+*
+* 这是构建工具的边界函数，不是类型提示入口：作者直接编辑带 `$schema` 的 JSON，
+* SDK 版本从当前安装包读取，宿主入口默认落到 dist/widget.js，内部 contribution 标识只在这里生成。
+*/
+function compileWidgetPluginManifest(manifest, options = {}) {
+	return compileWidgetPluginManifest$1(manifest, WIDGET_SDK_VERSION, options);
+}
+//#endregion
 //#region src/lifetime.ts
 function createWidgetLifetime(onError) {
 	const controller = new AbortController();

package/dist/manifest.d.ts

@@ -1,4 +1,4 @@
-import type { WidgetManifest, WidgetPluginManifest } from "@dp-bohrium/widget-contracts";
+import type { WidgetManifest, WidgetPluginManifest } from "./protocol/index.js";
 export interface CompileWidgetPluginManifestOptions {
     readonly samples?: NonNullable<WidgetPluginManifest["samples"]>;
     /** Host bundle entry. CLI supplies this after the project is built. */