@webskill/chatbot 0.22.0 → 0.23.0

package/dist/config.d.ts

@@ -17,6 +17,24 @@ declare class WebSkillConfigError extends Error {
   constructor(code: WebSkillConfigErrorCode, path: string, message: string);
 }
 //#endregion
+//#region ../ui-kit/src/runtime-config/siteAccess.d.ts
+/**
+ * 站点白名单的匹配规则（`RuntimeConfig.siteAccess.allowedHosts`）。
+ *
+ * 放在配置字段旁边而不是宿主里：规则一旦有第二份手抄，「配了却不生效」
+ * 和「以为拦住了其实没拦」就会同时存在，而后者是安全问题。
+ */
+/**
+ * 地址是否落在白名单内。**空清单一律放行**——它表示「宿主没有设限」，
+ * 而不是「谁都不许」；把空当成全拒会让没配过的宿主整个瘫掉。
+ *
+ * 解析不出主机名的地址（`about:blank`、畸形串）在有清单时**拒绝**：
+ * 认不出来就不该当成自己人。
+ *
+ * @experimental
+ */
+declare function isAllowedSite(url: string | undefined, allowedHosts: readonly string[]): boolean;
+//#endregion
 //#region src/config/merge.d.ts
 /**
  * 三方合并：宿主缺省值 · 用户存储 · 上次应用过的缺省值快照。
@@ -104,4 +122,4 @@ interface ConfigDefaultsStoreOptions {
  */
 declare function createConfigDefaultsStore(store: RuntimeConfigStore, options: ConfigDefaultsStoreOptions): RuntimeConfigStore;
 //#endregion
-export { type AppliedConfigDefaults, type ApplyConfigDefaultsInput, BAKED_KEY_SENTINEL, type BakedSecretLoader, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, type ConfigDefaultsSnapshotStore, type ConfigDefaultsStoreOptions, type ConfigFieldSpec, type ConfigLeafKind, NON_CONFIGURABLE_RUNTIME_PATHS, type ParseWebSkillConfigOptions, type ParsedWebSkillConfig, type WebSkillConfigDefaults, WebSkillConfigError, type WebSkillConfigErrorCode, applyConfigDefaults, createConfigDefaultsStore, parseWebSkillConfig };
+export { type AppliedConfigDefaults, type ApplyConfigDefaultsInput, BAKED_KEY_SENTINEL, type BakedSecretLoader, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, type ConfigDefaultsSnapshotStore, type ConfigDefaultsStoreOptions, type ConfigFieldSpec, type ConfigLeafKind, NON_CONFIGURABLE_RUNTIME_PATHS, type ParseWebSkillConfigOptions, type ParsedWebSkillConfig, type WebSkillConfigDefaults, WebSkillConfigError, type WebSkillConfigErrorCode, applyConfigDefaults, createConfigDefaultsStore, isAllowedSite, parseWebSkillConfig };

package/dist/config.js

@@ -1,6 +1,61 @@
 import { r as mergeRuntimeConfigDefaults } from "./types-DzBMgDa6.js";
 import { a as NON_CONFIGURABLE_RUNTIME_PATHS, i as CONFIG_FIELDS, n as parseWebSkillConfig, o as WebSkillConfigError, r as CONFIGURED_RUNTIME_PATHS, t as CONFIG_TOP_LEVEL_SECTIONS } from "./parse-BaIF8Nm5.js";
 
+//#region ../ui-kit/src/runtime-config/siteAccess.ts
+/**
+* 站点白名单的匹配规则（`RuntimeConfig.siteAccess.allowedHosts`）。
+*
+* 放在配置字段旁边而不是宿主里：规则一旦有第二份手抄，「配了却不生效」
+* 和「以为拦住了其实没拦」就会同时存在，而后者是安全问题。
+*/
+/** 把用户写的模式归一：去空白、小写、去掉前导点与结尾点 */
+function normalizePattern(pattern) {
+	return pattern.trim().toLowerCase().replace(/^\.+/, "").replace(/\.+$/, "");
+}
+/**
+* 单条模式是否命中主机名。
+*
+* - `*` 命中一切。
+* - `*.example.com` 命中 `a.example.com`、`a.b.example.com`，**也命中** `example.com`
+*   本体——与 Chrome 的 match pattern 同口径。用户写通配是为了「这个站」，
+*   让主域漏网只会制造一条谁也想不到的缝。
+* - `example.com` 只命中它自己。
+*
+* 端口与协议一律不参与：用户写的是域名。
+*/
+function matchesPattern(host, pattern) {
+	const p = normalizePattern(pattern);
+	if (p === "") return false;
+	if (p === "*") return true;
+	if (p.startsWith("*.")) {
+		const base = p.slice(2);
+		return base !== "" && (host === base || host.endsWith(`.${base}`));
+	}
+	return host === p;
+}
+/**
+* 地址是否落在白名单内。**空清单一律放行**——它表示「宿主没有设限」，
+* 而不是「谁都不许」；把空当成全拒会让没配过的宿主整个瘫掉。
+*
+* 解析不出主机名的地址（`about:blank`、畸形串）在有清单时**拒绝**：
+* 认不出来就不该当成自己人。
+*
+* @experimental
+*/
+function isAllowedSite(url, allowedHosts) {
+	if (allowedHosts.length === 0) return true;
+	if (url === void 0) return false;
+	let host;
+	try {
+		host = new URL(url).hostname.toLowerCase().replace(/\.+$/, "");
+	} catch {
+		return false;
+	}
+	if (host === "") return false;
+	return allowedHosts.some((pattern) => matchesPattern(host, pattern));
+}
+
+//#endregion
 //#region src/config/merge.ts
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -197,4 +252,4 @@ function createConfigDefaultsStore(store, options) {
 }
 
 //#endregion
-export { BAKED_KEY_SENTINEL, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, NON_CONFIGURABLE_RUNTIME_PATHS, WebSkillConfigError, applyConfigDefaults, createConfigDefaultsStore, parseWebSkillConfig };
+export { BAKED_KEY_SENTINEL, CONFIGURED_RUNTIME_PATHS, CONFIG_FIELDS, CONFIG_TOP_LEVEL_SECTIONS, NON_CONFIGURABLE_RUNTIME_PATHS, WebSkillConfigError, applyConfigDefaults, createConfigDefaultsStore, isAllowedSite, parseWebSkillConfig };

package/dist/index.d.ts

@@ -3240,6 +3240,6 @@ declare function ErrorCard({ code, message, loopLimits, onOpenSettings, onDismis
  * Version of the published `@webskill/chatbot` package, injected at build time.
  * @stable
  */
-declare const CHATBOT_VERSION = "0.22.0";
+declare const CHATBOT_VERSION = "0.23.0";
 //#endregion
 export { A2uiSurfaceHost, type A2uiSurfaceHostProps, A2uiSurfaceSnapshotHost, type A2uiSurfaceSnapshotHostProps, type AppearanceChange, CHATBOT_VERSION, type ChatAttachmentInput, type ChatAttachmentMeta, type ChatContentPart, ChatEngine, type ChatEngineOptions, type ChatEvent, type ChatInteractionRecord, type ChatLayout, type ChatMessage, type ChatRunPhase, type ChatSessionListResult, type ChatSessionMeta, type ChatTheme, type ChatThinking, type ChatTokenUsage, type ChatToolCall, Chatbot, type ChatbotConfig, type ChatbotGovernancePorts, type ChatbotHostAdapter, type ChatbotProps, ChatbotVisionDelegate, type ChatbotVisionDelegateOptions, CompositeUiBridge, type CompositeUiBridgeDeps, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, type DownloadableFile, type DwgHost, ErrorCard, type ErrorCardProps, InteractionCard, type InteractionCardProps, InterruptedBanner, type InterruptedBannerProps, type Locale, type LocalizedText, OpenUiSurfaceHost, type OpenUiSurfaceHostProps, OpenUiSurfaceSnapshotHost, type OpenUiSurfaceSnapshotHostProps, type QuickPrompt, type QuickPromptIconName, type RendererCapability, type RendererKind, type ResolvedChatLayout, ResultBlockList, type ResultBlockListProps, ResultBlocksPro, type ResultBlocksProProps, type RunSnapshot, type RuntimeAppearanceConfig, type RuntimeConfig, type RuntimeConfigStore, type RuntimeQuickPrompt, type RuntimeRendererId, type SandboxExecutorDeps, type SettingsSectionId, SkillBadges, SpecInteraction, type SpecInteractionProps, VercelPayloadPreview, type VercelPayloadPreviewProps, VercelSurfaceHost, type VercelSurfaceHostProps, VercelSurfaceSnapshotHost, type VercelSurfaceSnapshotHostProps, type VisionDelegationConsent, type VisionDelegationEndpoint, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/dist/index.js

@@ -45631,7 +45631,7 @@ function VercelPayloadPreview({ bridge }) {
 * Version of the published `@webskill/chatbot` package, injected at build time.
 * @stable
 */
-const CHATBOT_VERSION = "0.22.0";
+const CHATBOT_VERSION = "0.23.0";
 
 //#endregion
 export { A2uiSurfaceHost, A2uiSurfaceSnapshotHost, CHATBOT_VERSION, ChatEngine, Chatbot, ChatbotVisionDelegate, CompositeUiBridge, DEFAULT_RENDERER_CAPABILITIES, DEFAULT_RUNTIME_CONFIG_STORAGE_KEY, ErrorCard, InteractionCard, InterruptedBanner, OpenUiSurfaceHost, OpenUiSurfaceSnapshotHost, ResultBlockList, ResultBlocksPro, SkillBadges, SpecInteraction, VercelPayloadPreview, VercelSurfaceHost, VercelSurfaceSnapshotHost, WEB_OFFICE_TEMPLATE_PREFIX, chatbotDictionary, configureA2uiMarkdown, createLocalStorageRuntimeConfigStore, createMemoryRuntimeConfigStore, isLlmEntryUsable, pickUsableLlmEntry, probeA2uiAvailability, probeOpenUiAvailability, sandboxExecutorDeps, useT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/chatbot",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "license": "MIT",
   "type": "module",
   "exports": {