@webskill/chatbot 0.21.0 → 0.23.0

package/dist/config.d.ts

@@ -1,5 +1,5 @@
-import { n as RuntimeConfig, r as RuntimeConfigStore } from "./index-DhXFYp0d.js";
-import { a as parseWebSkillConfig, c as ConfigFieldSpec, i as WebSkillConfigDefaults, l as ConfigLeafKind, n as ParseWebSkillConfigOptions, o as CONFIGURED_RUNTIME_PATHS, r as ParsedWebSkillConfig, s as CONFIG_FIELDS, t as CONFIG_TOP_LEVEL_SECTIONS, u as NON_CONFIGURABLE_RUNTIME_PATHS } from "./parse-Cu0G_3gS.js";
+import { n as RuntimeConfig, r as RuntimeConfigStore } from "./index-6TE6MWZ2.js";
+import { a as parseWebSkillConfig, c as ConfigFieldSpec, i as WebSkillConfigDefaults, l as ConfigLeafKind, n as ParseWebSkillConfigOptions, o as CONFIGURED_RUNTIME_PATHS, r as ParsedWebSkillConfig, s as CONFIG_FIELDS, t as CONFIG_TOP_LEVEL_SECTIONS, u as NON_CONFIGURABLE_RUNTIME_PATHS } from "./parse-60GnE8Co.js";
 //#region src/config/errors.d.ts
 /** 稳定错误码，供宿主可编程处理；`message` 一律英文 @experimental */
 type WebSkillConfigErrorCode = 'CONFIG_UNKNOWN_KEY' | 'CONFIG_TYPE' | 'CONFIG_RANGE' | 'CONFIG_ENUM' | 'CONFIG_SHAPE' | 'CONFIG_REFERENCE';
@@ -17,6 +17,24 @@ declare class WebSkillConfigError extends Error {
   constructor(code: WebSkillConfigErrorCode, path: string, message: string);
 }
 //#endregion
+//#region ../ui-kit/src/runtime-config/siteAccess.d.ts
+/**
+ * 站点白名单的匹配规则（`RuntimeConfig.siteAccess.allowedHosts`）。
+ *
+ * 放在配置字段旁边而不是宿主里：规则一旦有第二份手抄，「配了却不生效」
+ * 和「以为拦住了其实没拦」就会同时存在，而后者是安全问题。
+ */
+/**
+ * 地址是否落在白名单内。**空清单一律放行**——它表示「宿主没有设限」，
+ * 而不是「谁都不许」；把空当成全拒会让没配过的宿主整个瘫掉。
+ *
+ * 解析不出主机名的地址（`about:blank`、畸形串）在有清单时**拒绝**：
+ * 认不出来就不该当成自己人。
+ *
+ * @experimental
+ */
+declare function isAllowedSite(url: string | undefined, allowedHosts: readonly string[]): boolean;
+//#endregion
 //#region src/config/merge.d.ts
 /**
  * 三方合并：宿主缺省值 · 用户存储 · 上次应用过的缺省值快照。
@@ -104,4 +122,4 @@ interface ConfigDefaultsStoreOptions {
  */
 declare function createConfigDefaultsStore(store: RuntimeConfigStore, options: ConfigDefaultsStoreOptions): RuntimeConfigStore;
 //#endregion
-export { type AppliedConfigDefaults, type ApplyConfigDefaultsInput, BAKED_KEY_SENTINEL, type BakedSecretLoader, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, type ConfigDefaultsSnapshotStore, type ConfigDefaultsStoreOptions, type ConfigFieldSpec, type ConfigLeafKind, NON_CONFIGURABLE_RUNTIME_PATHS, type ParseWebSkillConfigOptions, type ParsedWebSkillConfig, type WebSkillConfigDefaults, WebSkillConfigError, type WebSkillConfigErrorCode, applyConfigDefaults, createConfigDefaultsStore, parseWebSkillConfig };
+export { type AppliedConfigDefaults, type ApplyConfigDefaultsInput, BAKED_KEY_SENTINEL, type BakedSecretLoader, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, type ConfigDefaultsSnapshotStore, type ConfigDefaultsStoreOptions, type ConfigFieldSpec, type ConfigLeafKind, NON_CONFIGURABLE_RUNTIME_PATHS, type ParseWebSkillConfigOptions, type ParsedWebSkillConfig, type WebSkillConfigDefaults, WebSkillConfigError, type WebSkillConfigErrorCode, applyConfigDefaults, createConfigDefaultsStore, isAllowedSite, parseWebSkillConfig };

package/dist/config.js

@@ -1,6 +1,61 @@
-import { r as mergeRuntimeConfigDefaults } from "./types-D6kVxBO9.js";
-import { a as NON_CONFIGURABLE_RUNTIME_PATHS, i as CONFIG_FIELDS, n as parseWebSkillConfig, o as WebSkillConfigError, r as CONFIGURED_RUNTIME_PATHS, t as CONFIG_TOP_LEVEL_SECTIONS } from "./parse-BtdRevDk.js";
+import { r as mergeRuntimeConfigDefaults } from "./types-DzBMgDa6.js";
+import { a as NON_CONFIGURABLE_RUNTIME_PATHS, i as CONFIG_FIELDS, n as parseWebSkillConfig, o as WebSkillConfigError, r as CONFIGURED_RUNTIME_PATHS, t as CONFIG_TOP_LEVEL_SECTIONS } from "./parse-BaIF8Nm5.js";
 
+//#region ../ui-kit/src/runtime-config/siteAccess.ts
+/**
+* 站点白名单的匹配规则（`RuntimeConfig.siteAccess.allowedHosts`）。
+*
+* 放在配置字段旁边而不是宿主里：规则一旦有第二份手抄，「配了却不生效」
+* 和「以为拦住了其实没拦」就会同时存在，而后者是安全问题。
+*/
+/** 把用户写的模式归一：去空白、小写、去掉前导点与结尾点 */
+function normalizePattern(pattern) {
+	return pattern.trim().toLowerCase().replace(/^\.+/, "").replace(/\.+$/, "");
+}
+/**
+* 单条模式是否命中主机名。
+*
+* - `*` 命中一切。
+* - `*.example.com` 命中 `a.example.com`、`a.b.example.com`，**也命中** `example.com`
+*   本体——与 Chrome 的 match pattern 同口径。用户写通配是为了「这个站」，
+*   让主域漏网只会制造一条谁也想不到的缝。
+* - `example.com` 只命中它自己。
+*
+* 端口与协议一律不参与：用户写的是域名。
+*/
+function matchesPattern(host, pattern) {
+	const p = normalizePattern(pattern);
+	if (p === "") return false;
+	if (p === "*") return true;
+	if (p.startsWith("*.")) {
+		const base = p.slice(2);
+		return base !== "" && (host === base || host.endsWith(`.${base}`));
+	}
+	return host === p;
+}
+/**
+* 地址是否落在白名单内。**空清单一律放行**——它表示「宿主没有设限」，
+* 而不是「谁都不许」；把空当成全拒会让没配过的宿主整个瘫掉。
+*
+* 解析不出主机名的地址（`about:blank`、畸形串）在有清单时**拒绝**：
+* 认不出来就不该当成自己人。
+*
+* @experimental
+*/
+function isAllowedSite(url, allowedHosts) {
+	if (allowedHosts.length === 0) return true;
+	if (url === void 0) return false;
+	let host;
+	try {
+		host = new URL(url).hostname.toLowerCase().replace(/\.+$/, "");
+	} catch {
+		return false;
+	}
+	if (host === "") return false;
+	return allowedHosts.some((pattern) => matchesPattern(host, pattern));
+}
+
+//#endregion
 //#region src/config/merge.ts
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -197,4 +252,4 @@ function createConfigDefaultsStore(store, options) {
 }
 
 //#endregion
-export { BAKED_KEY_SENTINEL, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, NON_CONFIGURABLE_RUNTIME_PATHS, WebSkillConfigError, applyConfigDefaults, createConfigDefaultsStore, parseWebSkillConfig };
+export { BAKED_KEY_SENTINEL, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, NON_CONFIGURABLE_RUNTIME_PATHS, WebSkillConfigError, applyConfigDefaults, createConfigDefaultsStore, isAllowedSite, parseWebSkillConfig };

package/dist/{index-DhXFYp0d.d.ts → index-6TE6MWZ2.d.ts}

@@ -1360,6 +1360,50 @@ interface RuntimeSkillStateConfig {
    */
   quarantineThreshold: number;
 }
+/**
+ * 站点白名单：宿主只在这些站点上提供页面感知与页面操作。
+ *
+ * 与 `sandbox.remoteUrl` 不同：那一条管的是技能往外发请求，这一条管的是助手往内读页面。
+ * @experimental
+ */
+interface RuntimeSiteAccessConfig {
+  /**
+   * 允许服务的域名模式，支持 `*.example.com` 与 `*`。
+   * **空数组即不设限**，匹配规则见 {@link isAllowedSite}。
+   */
+  allowedHosts: readonly string[];
+}
+/**
+ * 概览页「消费金额」那一格（console 专用）。
+ *
+ * 单价与汇率必须可配：它们原先是写死在 `core/llmUsage.ts` 里的两个常量，
+ * 而每个宿主的模型合同价、记账汇率都不一样——写死等于给用户看一个**算错的金额**，
+ * 比不显示更糟，因为它看起来是权威的。`enabled` 关掉时那一格整个不渲染，
+ * 也不做换算：宿主拿不到真实单价时，不报数就是唯一诚实的做法。
+ * @experimental
+ */
+interface RuntimeUsageCostConfig {
+  /** 关掉即概览页不出现「消费金额」，只剩请求次数与 token 用量 */
+  enabled: boolean;
+  /** 每百万 token 折合多少人民币。0 是合法值（自建模型不计费），负数回退默认 */
+  cnyPerMillionTokens: number;
+  /** 1 美元折合多少人民币；英文界面按它把人民币折成美元展示。必须为正 */
+  cnyPerUsd: number;
+}
+/**
+ * console 导航树（console 专用）。
+ *
+ * **只管显示，不是访问控制**：藏起来的页面仍可由宿主经 `initialPage` 直达，
+ * 它挡的是「菜单树上有没有这一项」。真要禁用某项能力，闸门在那项能力自己的配置里。
+ * @experimental
+ */
+interface RuntimeConsoleNavConfig {
+  /**
+   * 不在侧栏与命令面板里出现的页面 id（如 `'connections.models'`）。
+   * 取 id 列表而不是逐页布尔：页面清单归 console 所有，ui-kit 不该跟着它一起改。
+   */
+  hiddenPages: readonly string[];
+}
 /** @experimental */
 interface RuntimeConfig {
   loop: RuntimeLoopConfig;
@@ -1379,6 +1423,12 @@ interface RuntimeConfig {
   documentSurface: RuntimeDocumentSurfaceConfig;
   userProfile: RuntimeUserProfileConfig;
   skillState: RuntimeSkillStateConfig;
+  /** 概览页「消费金额」的开关与换算参数 @experimental */
+  usageCost: RuntimeUsageCostConfig;
+  /** 允许助手工作的站点 @experimental */
+  siteAccess: RuntimeSiteAccessConfig;
+  /** console 导航树的显示裁剪 @experimental */
+  consoleNav: RuntimeConsoleNavConfig;
   /**
    * 快捷指令的**唯一权威**（0.13.0 分册 21 FR-21.5）。
    * `ChatbotConfig.quickPrompts` 降级为一次性种子源，不再参与渲染判断。

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { a as RuntimeRendererId, c as RuntimeQuickPrompt, d as TranslateFn, i as RuntimeLlmEntry, l as Locale, n as RuntimeConfig, o as QuickPrompt, r as RuntimeConfigStore, s as QuickPromptIconName, t as RuntimeAppearanceConfig, u as LocalizedText } from "./index-DhXFYp0d.js";
+import { a as RuntimeRendererId, c as RuntimeQuickPrompt, d as TranslateFn, i as RuntimeLlmEntry, l as Locale, n as RuntimeConfig, o as QuickPrompt, r as RuntimeConfigStore, s as QuickPromptIconName, t as RuntimeAppearanceConfig, u as LocalizedText } from "./index-6TE6MWZ2.js";
 import "react";
 import { AgentLoopConfig, ApprovalScope, BridgeCapabilities, DataSourceInfo, DocumentSurfaceHost, DocxTextExtractor, ExternalSkillProvider, ExternalToolSource, FileSystemProvider, HookRunner, InteractionRequest, InteractionResponse, LifecycleEventInit, LinkedDocumentReader, LlmClient, NetworkPolicy, Page, PageQuery, PdfTextExtractor, PptxTextExtractor, RenderBlock, RenderResultRequest, RunSnapshot, RunSnapshotListEntry, RuntimePhase, RuntimeRun, ScriptExecutor, SessionStore, SkillCandidateMarker, SkillCatalogEntry, SkillIntegrityGuard, SkillOutcomeReporter, SkillStateGuard, UiBridge, UiSpecDrafts, UiSpecEvent, UiSpecSnapshot, UiSurfaceActionRequest, UiSurfaceActionResponse, UserProfile, UserProfileExport, VisionDelegate, VisionDelegateRequest, VisionDelegateResult, WebSkillErrorCode, XlsxTextExtractor, diffUserProfile } from "@webskill/sdk";
 import { PageImageHost, RemoteImageHost, SandboxMode, TypeScriptSupportOptions, WebOfficeConsent, WebOfficeHost } from "@webskill/sdk/browser";
@@ -1373,6 +1373,7 @@ declare const chatbotDictionary: {
     'interaction.webOffice.captureTitle': string;
     'interaction.webOffice.captureBody': string;
     'interaction.webOffice.claimedTypeNote': string;
+    'interaction.webOffice.claimedSourceNote': string;
     'interaction.webOffice.rememberFallback': string;
     'interaction.visionDelegation.title': string;
     'interaction.visionDelegation.reason': string;
@@ -1809,6 +1810,7 @@ declare const chatbotDictionary: {
     'interaction.webOffice.captureTitle': string;
     'interaction.webOffice.captureBody': string;
     'interaction.webOffice.claimedTypeNote': string;
+    'interaction.webOffice.claimedSourceNote': string;
     'interaction.webOffice.rememberFallback': string;
     'interaction.visionDelegation.title': string;
     'interaction.visionDelegation.reason': string;
@@ -2248,6 +2250,7 @@ declare const useT: () => TranslateFn<{
     'interaction.webOffice.captureTitle': string;
     'interaction.webOffice.captureBody': string;
     'interaction.webOffice.claimedTypeNote': string;
+    'interaction.webOffice.claimedSourceNote': string;
     'interaction.webOffice.rememberFallback': string;
     'interaction.visionDelegation.title': string;
     'interaction.visionDelegation.reason': string;
@@ -2684,6 +2687,7 @@ declare const useT: () => TranslateFn<{
     'interaction.webOffice.captureTitle': string;
     'interaction.webOffice.captureBody': string;
     'interaction.webOffice.claimedTypeNote': string;
+    'interaction.webOffice.claimedSourceNote': string;
     'interaction.webOffice.rememberFallback': string;
     'interaction.visionDelegation.title': string;
     'interaction.visionDelegation.reason': string;
@@ -3236,6 +3240,6 @@ declare function ErrorCard({ code, message, loopLimits, onOpenSettings, onDismis
  * Version of the published `@webskill/chatbot` package, injected at build time.
  * @stable
  */
-declare const CHATBOT_VERSION = "0.21.0";
+declare const CHATBOT_VERSION = "0.23.0";
 //#endregion
 export { A2uiSurfaceHost, type A2uiSurfaceHostProps, A2uiSurfaceSnapshotHost, type A2uiSurfaceSnapshotHostProps, type AppearanceChange, CHATBOT_VERSION, type ChatAttachmentInput, type ChatAttachmentMeta, type ChatContentPart, ChatEngine, type ChatEngineOptions, type ChatEvent, type ChatInteractionRecord, type ChatLayout, type ChatMessage, type ChatRunPhase, type ChatSessionListResult, type ChatSessionMeta, type ChatTheme, type ChatThinking, type ChatTokenUsage, type ChatToolCall, Chatbot, type ChatbotConfig, type ChatbotGovernancePorts, type ChatbotHostAdapter, type ChatbotProps, ChatbotVisionDelegate, type ChatbotVisionDelegateOptions, CompositeUiBridge, type CompositeUiBridgeDeps, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, type DownloadableFile, type DwgHost, ErrorCard, type ErrorCardProps, InteractionCard, type InteractionCardProps, InterruptedBanner, type InterruptedBannerProps, type Locale, type LocalizedText, OpenUiSurfaceHost, type OpenUiSurfaceHostProps, OpenUiSurfaceSnapshotHost, type OpenUiSurfaceSnapshotHostProps, type QuickPrompt, type QuickPromptIconName, type RendererCapability, type RendererKind, type ResolvedChatLayout, ResultBlockList, type ResultBlockListProps, ResultBlocksPro, type ResultBlocksProProps, type RunSnapshot, type RuntimeAppearanceConfig, type RuntimeConfig, type RuntimeConfigStore, type RuntimeQuickPrompt, type RuntimeRendererId, type SandboxExecutorDeps, type SettingsSectionId, SkillBadges, SpecInteraction, type SpecInteractionProps, VercelPayloadPreview, type VercelPayloadPreviewProps, VercelSurfaceHost, type VercelSurfaceHostProps, VercelSurfaceSnapshotHost, type VercelSurfaceSnapshotHostProps, type VisionDelegationConsent, type VisionDelegationEndpoint, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { i as __toESM, r as __require, t as __commonJSMin } from "./rolldown-runtime-DZ8SGSJo.js";
-import { i as withRuntimeConfigDefaults, n as defaultRuntimeConfig, o as mergeQuickPrompts, r as mergeRuntimeConfigDefaults, s as normalizeLocalizedText } from "./types-D6kVxBO9.js";
+import { i as withRuntimeConfigDefaults, n as defaultRuntimeConfig, o as mergeQuickPrompts, r as mergeRuntimeConfigDefaults, s as normalizeLocalizedText } from "./types-DzBMgDa6.js";
 import { a as svg, i as html$1, n as refractor, o as find, r as stringify$1, s as stringify } from "./core-D3Tq37jA.js";
 import { t as require_core } from "./core-DBetA176.js";
 import { t as markup } from "./markup-D2NSmoAx.js";
@@ -26499,13 +26499,14 @@ const chatbotDictionary = defineDictionary({
 		"interaction.downloadedFile.read": "Allow the assistant to read this file from your downloads?",
 		"interaction.downloadedFile.file": "{name} · {size}",
 		"interaction.downloadedFile.remember": "Don’t ask again for this kind of access",
-		"interaction.webOffice.listTitle": "WPS documents on this page",
-		"interaction.webOffice.listBody": "Allow the assistant to see which WPS documents are open on {origin}?",
-		"interaction.webOffice.readTitle": "Read this WPS document",
-		"interaction.webOffice.readBody": "Allow the assistant to read the contents of this WPS document on {origin}?",
-		"interaction.webOffice.captureTitle": "Screenshot this WPS document",
-		"interaction.webOffice.captureBody": "Allow the assistant to take screenshots of this WPS document on {origin}? It captures whatever is visible in the tab, including anything shown next to the document, and the screenshots stay in this conversation until you delete it.",
+		"interaction.webOffice.listTitle": "Office documents on this page",
+		"interaction.webOffice.listBody": "Allow the assistant to see which documents are open on {origin}?",
+		"interaction.webOffice.readTitle": "Read this document",
+		"interaction.webOffice.readBody": "Allow the assistant to read the contents of this document on {origin}?",
+		"interaction.webOffice.captureTitle": "Screenshot this document",
+		"interaction.webOffice.captureBody": "Allow the assistant to take screenshots of this document on {origin}? It captures whatever is visible in the tab, including anything shown next to the document, and the screenshots stay in this conversation until you delete it.",
 		"interaction.webOffice.claimedTypeNote": "The page says this document is of type “{type}”.",
+		"interaction.webOffice.claimedSourceNote": "The page says it is rendered by {source}.",
 		"interaction.webOffice.rememberFallback": "Don’t ask again for this kind of access",
 		"interaction.visionDelegation.title": "Send images to another model?",
 		"interaction.visionDelegation.reason": "The model you selected cannot read images, so the {images} image(s) produced by “{source}” cannot be used in this turn unless another model describes them first.",
@@ -26935,13 +26936,14 @@ const chatbotDictionary = defineDictionary({
 		"interaction.downloadedFile.read": "允许助手读取你下载目录里的这份文件吗？",
 		"interaction.downloadedFile.file": "{name} · {size}",
 		"interaction.downloadedFile.remember": "以后不再询问此类访问",
-		"interaction.webOffice.listTitle": "本页的 WPS 文档",
-		"interaction.webOffice.listBody": "允许助手查看 {origin} 上打开了哪些 WPS 文档吗？",
-		"interaction.webOffice.readTitle": "读取这份 WPS 文档",
-		"interaction.webOffice.readBody": "允许助手读取 {origin} 上这份 WPS 文档的内容吗？",
-		"interaction.webOffice.captureTitle": "截取这份 WPS 文档",
-		"interaction.webOffice.captureBody": "允许助手截取 {origin} 上这份 WPS 文档吗？将截取当前页面的画面，包括文档旁边显示的其它内容；截图会留在本次会话里，直到你删除这次会话。",
+		"interaction.webOffice.listTitle": "本页的办公文档",
+		"interaction.webOffice.listBody": "允许助手查看 {origin} 上打开了哪些文档吗？",
+		"interaction.webOffice.readTitle": "读取这份文档",
+		"interaction.webOffice.readBody": "允许助手读取 {origin} 上这份文档的内容吗？",
+		"interaction.webOffice.captureTitle": "截取这份文档",
+		"interaction.webOffice.captureBody": "允许助手截取 {origin} 上这份文档吗？将截取当前页面的画面，包括文档旁边显示的其它内容；截图会留在本次会话里，直到你删除这次会话。",
 		"interaction.webOffice.claimedTypeNote": "页面自称这份文档的类型是「{type}」。",
+		"interaction.webOffice.claimedSourceNote": "页面自称它由 {source} 渲染。",
 		"interaction.webOffice.rememberFallback": "以后不再询问此类访问",
 		"interaction.visionDelegation.title": "把图片发给另一个模型？",
 		"interaction.visionDelegation.reason": "你选中的模型看不了图片。「{source}」产出的 {images} 张图，除非先由另一个模型描述一遍，否则这一轮用不上。",
@@ -29289,7 +29291,7 @@ var ChatEngine = class {
 		* 还多一道闸：一个带资源的技能都没装时不提（AC-23.8）。探测只在真有模板工具时做。
 		*/
 		const hasTemplateEngine = Boolean(this.#adapter.xlsxTemplateEngine || this.#adapter.docxTemplateEngine);
-		const templateIdHints = [...this.#adapter.webOfficeTemplateSource ? [`For a document open in an online WPS/WebOffice viewer, use "${WEB_OFFICE_TEMPLATE_PREFIX}<handle>" with the handle from list_weboffice_documents.`] : [], ...hasTemplateEngine && await this.#hasSkillResources(fs) ? [`For a file that ships inside an installed skill, use "${SKILL_FILE_PREFIX}<skill name>/<path inside the skill>", for example "${SKILL_FILE_PREFIX}quotation/assets/template.xlsx".`] : []];
+		const templateIdHints = [...this.#adapter.webOfficeTemplateSource ? [`For a document open in an online office viewer on the page, use "${WEB_OFFICE_TEMPLATE_PREFIX}<handle>" with the handle from list_weboffice_documents.`] : [], ...hasTemplateEngine && await this.#hasSkillResources(fs) ? [`For a file that ships inside an installed skill, use "${SKILL_FILE_PREFIX}<skill name>/<path inside the skill>", for example "${SKILL_FILE_PREFIX}quotation/assets/template.xlsx".`] : []];
 		const baseTools = [
 			...pageSkillSource ? [pageSkillSource] : [],
 			createSpreadsheetToolSource({
@@ -30858,12 +30860,14 @@ function webOfficeDetails(details) {
 	if (typeof origin !== "string" || origin === "") return void 0;
 	if (channel !== "jssdk" && channel !== "vision") return void 0;
 	const claimedOfficeType = record["claimedOfficeType"];
+	const claimedSource = record["claimedSource"];
 	const rememberLabel = record["rememberLabel"];
 	return {
 		action,
 		origin,
 		channel,
 		...typeof claimedOfficeType === "string" ? { claimedOfficeType } : {},
+		...typeof claimedSource === "string" ? { claimedSource } : {},
 		...record["rememberable"] === true ? { rememberable: true } : {},
 		...typeof rememberLabel === "string" ? { rememberLabel } : {}
 	};
@@ -31031,8 +31035,8 @@ function localizedAuthorizeMessage(request, t) {
 		const details = webOfficeDetails(request.details);
 		if (details === void 0) return void 0;
 		const head = t(`interaction.webOffice.${details.action}Body`, { origin: details.origin });
-		if (details.claimedOfficeType === void 0) return head;
-		return `${head} ${t("interaction.webOffice.claimedTypeNote", { type: details.claimedOfficeType })}`;
+		const claims = [...details.claimedSource === void 0 ? [] : [t("interaction.webOffice.claimedSourceNote", { source: details.claimedSource })], ...details.claimedOfficeType === void 0 ? [] : [t("interaction.webOffice.claimedTypeNote", { type: details.claimedOfficeType })]];
+		return claims.length === 0 ? head : `${head} ${claims.join(" ")}`;
 	}
 	if (request.capability === "delegateVision") {
 		const details = visionDelegationDetails(request.details);
@@ -44158,6 +44162,11 @@ function ActiveInteractionCard({ request, bridge }) {
 							className: "text-sm text-ink",
 							children: t(`interaction.webOffice.${webOffice.action}Body`, { origin: webOffice.origin })
 						}),
+						webOffice.claimedSource !== void 0 ? /* @__PURE__ */ jsx("p", {
+							"data-testid": "interaction-weboffice-claimed-source",
+							className: "text-sm text-muted",
+							children: t("interaction.webOffice.claimedSourceNote", { source: webOffice.claimedSource })
+						}) : null,
 						webOffice.claimedOfficeType !== void 0 ? /* @__PURE__ */ jsx("p", {
 							"data-testid": "interaction-weboffice-claimed",
 							className: "text-sm text-muted",
@@ -45622,7 +45631,7 @@ function VercelPayloadPreview({ bridge }) {
 * Version of the published `@webskill/chatbot` package, injected at build time.
 * @stable
 */
-const CHATBOT_VERSION = "0.21.0";
+const CHATBOT_VERSION = "0.23.0";
 
 //#endregion
 export { A2uiSurfaceHost, A2uiSurfaceSnapshotHost, CHATBOT_VERSION, ChatEngine, Chatbot, ChatbotVisionDelegate, CompositeUiBridge, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, ErrorCard, InteractionCard, InterruptedBanner, OpenUiSurfaceHost, OpenUiSurfaceSnapshotHost, ResultBlockList, ResultBlocksPro, SkillBadges, SpecInteraction, VercelPayloadPreview, VercelSurfaceHost, VercelSurfaceSnapshotHost, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/dist/{parse-Cu0G_3gS.d.ts → parse-60GnE8Co.d.ts}

@@ -1,4 +1,4 @@
-import { a as RuntimeRendererId, n as RuntimeConfig } from "./index-DhXFYp0d.js";
+import { a as RuntimeRendererId, n as RuntimeConfig } from "./index-6TE6MWZ2.js";
 //#region src/config/schema.d.ts
 /**
  * 配置文件的字段表——**唯一**手写的部分。
@@ -211,6 +211,23 @@ declare const CONFIG_FIELDS: {
   readonly 'privacy.recordLimit': {
     readonly target: readonly ["userProfile", "recordLimit"];
   };
+  readonly 'siteAccess.allowedHosts': {
+    readonly target: readonly ["siteAccess", "allowedHosts"];
+  };
+  readonly 'console.usageCost.enabled': {
+    readonly target: readonly ["usageCost", "enabled"];
+  };
+  readonly 'console.usageCost.cnyPerMillionTokens': {
+    readonly target: readonly ["usageCost", "cnyPerMillionTokens"];
+    readonly kind: "number";
+  };
+  readonly 'console.usageCost.cnyPerUsd': {
+    readonly target: readonly ["usageCost", "cnyPerUsd"];
+    readonly kind: "number";
+  };
+  readonly 'console.hiddenPages': {
+    readonly target: readonly ["consoleNav", "hiddenPages"];
+  };
   readonly 'appearance.theme': {
     readonly target: readonly ["appearance", "theme"];
     readonly values: readonly ["light", "dark"];

package/dist/{parse-BtdRevDk.js → parse-BaIF8Nm5.js}

@@ -1,4 +1,4 @@
-import { a as QUICK_PROMPT_ICON_NAMES, n as defaultRuntimeConfig, t as RUNTIME_RENDERER_IDS } from "./types-D6kVxBO9.js";
+import { a as QUICK_PROMPT_ICON_NAMES, n as defaultRuntimeConfig, t as RUNTIME_RENDERER_IDS } from "./types-DzBMgDa6.js";
 
 //#region ../ui-kit/src/runtime-config/enums.ts
 const RUNTIME_LLM_PROVIDERS = [
@@ -299,6 +299,17 @@ const CONFIG_FIELDS = {
 	"privacy.encryptProfile": { target: ["userProfile", "encrypted"] },
 	"privacy.injectMaxBytes": { target: ["userProfile", "injectMaxBytes"] },
 	"privacy.recordLimit": { target: ["userProfile", "recordLimit"] },
+	"siteAccess.allowedHosts": { target: ["siteAccess", "allowedHosts"] },
+	"console.usageCost.enabled": { target: ["usageCost", "enabled"] },
+	"console.usageCost.cnyPerMillionTokens": {
+		target: ["usageCost", "cnyPerMillionTokens"],
+		kind: "number"
+	},
+	"console.usageCost.cnyPerUsd": {
+		target: ["usageCost", "cnyPerUsd"],
+		kind: "number"
+	},
+	"console.hiddenPages": { target: ["consoleNav", "hiddenPages"] },
 	"appearance.theme": {
 		target: ["appearance", "theme"],
 		values: RUNTIME_THEMES

package/dist/{types-D6kVxBO9.js → types-DzBMgDa6.js}

@@ -298,6 +298,13 @@ function defaultRuntimeConfig() {
 			encrypted: true
 		},
 		skillState: { quarantineThreshold: 5 },
+		usageCost: {
+			enabled: true,
+			cnyPerMillionTokens: 9,
+			cnyPerUsd: 6.8
+		},
+		siteAccess: { allowedHosts: [] },
+		consoleNav: { hiddenPages: [] },
 		quickPrompts: [],
 		quickPromptsSeeded: false,
 		quickPromptLimit: 8,
@@ -386,6 +393,9 @@ function mergeRuntimeConfigDefaults(partial) {
 		documentSurface: mergeDocumentSurface(p["documentSurface"], d.documentSurface),
 		userProfile: mergeUserProfile(p["userProfile"], d.userProfile),
 		skillState: mergeSkillState(p["skillState"], d.skillState),
+		usageCost: mergeUsageCost(p["usageCost"], d.usageCost),
+		siteAccess: { allowedHosts: readStringList(p["siteAccess"]?.["allowedHosts"], d.siteAccess.allowedHosts) },
+		consoleNav: { hiddenPages: readStringList(p["consoleNav"]?.["hiddenPages"], d.consoleNav.hiddenPages) },
 		quickPrompts: readQuickPrompts(p["quickPrompts"]),
 		quickPromptsSeeded: p["quickPromptsSeeded"] === true,
 		quickPromptLimit: clampQuickPromptLimit(p["quickPromptLimit"]),
@@ -499,6 +509,20 @@ function mergeUserProfile(raw, d) {
 	};
 }
 /** 与 multimodal 同一套判据：阈值非正整数会让隔离永不触发或立即触发，回退默认值 */
+/**
+* 消费金额段。单价允许 0（自建模型不计费，金额恒为 0 是真实的），
+* 汇率必须为正：0 会把英文界面的金额除成 Infinity，负数直接变负值。
+*/
+function mergeUsageCost(raw, d) {
+	const p = typeof raw === "object" && raw !== null ? raw : {};
+	const rate = p["cnyPerMillionTokens"];
+	const usd = p["cnyPerUsd"];
+	return {
+		enabled: typeof p["enabled"] === "boolean" ? p["enabled"] : d.enabled,
+		cnyPerMillionTokens: typeof rate === "number" && Number.isFinite(rate) && rate >= 0 ? rate : d.cnyPerMillionTokens,
+		cnyPerUsd: typeof usd === "number" && Number.isFinite(usd) && usd > 0 ? usd : d.cnyPerUsd
+	};
+}
 function mergeSkillState(raw, d) {
 	const value = (typeof raw === "object" && raw !== null ? raw : {})["quarantineThreshold"];
 	return { quarantineThreshold: typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : d.quarantineThreshold };

package/dist/vite.d.ts

@@ -1,4 +1,4 @@
-import { n as ParseWebSkillConfigOptions, r as ParsedWebSkillConfig } from "./parse-Cu0G_3gS.js";
+import { n as ParseWebSkillConfigOptions, r as ParsedWebSkillConfig } from "./parse-60GnE8Co.js";
 import { Plugin } from "vite";
 //#region src/vite.d.ts
 /**

package/dist/vite.js

@@ -1,4 +1,4 @@
-import { n as parseWebSkillConfig } from "./parse-BtdRevDk.js";
+import { n as parseWebSkillConfig } from "./parse-BaIF8Nm5.js";
 import { readFileSync } from "node:fs";
 import { webcrypto } from "node:crypto";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/chatbot",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -38,7 +38,7 @@
     "@a2ui/web_core": "^0.10.5",
     "@lit/context": "^1.1.0",
     "@openuidev/react-lang": "0.2.8",
-    "@webskill/sdk": "^0.24.0",
+    "@webskill/sdk": "^0.25.0",
     "mermaid": "^12.0.0",
     "react": ">=19.0.0",
     "react-dom": ">=19.0.0",