@webskill/sdk 0.0.1 → 0.0.3

package/README.md

@@ -47,15 +47,18 @@ const runtime = new WebSkillRuntime({
   llm: new OpenAiCompatibleClient({
     baseUrl: 'https://your-llm-endpoint/v1',
     apiKey: process.env.LLM_API_KEY!,
-    model: 'your-model',
+    model: 'your-model'
   }),
   executor: new NodeScriptExecutor(new NodeFS()),
-  artifactStore: new FileArtifactStore({ root: './.webskill/artifacts' }),
+  artifactStore: new FileArtifactStore({ root: './.webskill/artifacts' })
 });
 
 // Discover skills and render the catalog
 const { entries, issues } = await runtime.discover();
-console.log(entries.map((e) => e.name), issues);
+console.log(
+  entries.map((e) => e.name),
+  issues
+);
 
 // Run the agent loop
 const { output, run } = await runtime.run('Use the calculator skill to compute 2+3.');
@@ -64,16 +67,16 @@ console.log(output, run.status, run.trace.length);
 
 ## Subpath exports
 
-| Subpath | Contents |
-| --- | --- |
-| `@webskill/sdk` | Core protocol + runtime engine (discovery, agent loop, LLM clients, routing, interaction, memory, artifacts, trace) |
-| `@webskill/sdk/node` | Node host: NodeFS, script executors (in-process + sandboxed), file stores, skill manager, CLI UI bridge, env helpers |
-| `@webskill/sdk/browser` | Browser host: OPFS provider, Web Worker script sandbox, worker runtime host/client |
-| `@webskill/sdk/mcp` | MCP transports, endpoint registry, tool resolver, temporary skills, WebMCP adapter, runtime plugin |
-| `@webskill/sdk/ui` | Framework-agnostic forms, result rendering, mini markdown, Vercel/OpenUI/A2UI adapters, A2UI Lit runtime |
-| `@webskill/sdk/ui-react` | React bridge state + InteractionForm/ResultBlocks/StreamingText components |
-| `@webskill/sdk/ui-vue` | Vue bridge state + equivalent components |
-| `@webskill/sdk/governance` | Candidates, approval, audit, versioning, state policy, evaluation, scoring, documents |
+| Subpath                    | Contents                                                                                                             |
+| -------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| `@webskill/sdk`            | Core protocol + runtime engine (discovery, agent loop, LLM clients, routing, interaction, memory, artifacts, trace)  |
+| `@webskill/sdk/node`       | Node host: NodeFS, script executors (in-process + sandboxed), file stores, skill manager, CLI UI bridge, env helpers |
+| `@webskill/sdk/browser`    | Browser host: OPFS provider, Web Worker script sandbox, worker runtime host/client                                   |
+| `@webskill/sdk/mcp`        | MCP transports, endpoint registry, tool resolver, temporary skills, WebMCP adapter, runtime plugin                   |
+| `@webskill/sdk/ui`         | Framework-agnostic forms, result rendering, mini markdown, Vercel/OpenUI/A2UI adapters, A2UI Lit runtime             |
+| `@webskill/sdk/ui-react`   | React bridge state + InteractionForm/ResultBlocks/StreamingText components                                           |
+| `@webskill/sdk/ui-vue`     | Vue bridge state + equivalent components                                                                             |
+| `@webskill/sdk/governance` | Candidates, approval, audit, versioning, state policy, evaluation, scoring, documents                                |
 
 ## Requirements
 

package/dist/browser.d.ts

@@ -1,4 +1,4 @@
-import { C as InteractionRequest, M as LlmResponse, Mt as FileSystemProvider, N as LlmStreamEvent, S as InteractionPolicy, X as RenderResultRequest, _t as bridgeError, ct as ToolResult, d as BridgeResponse, it as ScriptExecutor, jt as FileStat, k as LlmClient, l as BridgeCapabilities, m as ExternalToolSource, ot as ToolDefinition, p as ExternalSkillProvider, pt as UiBridge, rt as ScriptExecutionContext, u as BridgeRequest, w as InteractionResponse, wt as parseBridgeRequest } from "./index-88KNOnbr.js";
+import { $t as VerifyResult, C as InteractionRequest, M as LlmResponse, Mt as FileStat, N as LlmStreamEvent, Nt as FileSystemProvider, S as InteractionPolicy, Tt as parseBridgeRequest, Wt as SkillInstallSource, X as RenderResultRequest, Zt as SkillsLockfile, at as ScriptExecutor, d as BridgeResponse, it as ScriptExecutionContext, k as LlmClient, l as BridgeCapabilities, lt as ToolResult, m as ExternalToolSource, mt as UiBridge, p as ExternalSkillProvider, qt as SkillManifest, st as ToolDefinition, u as BridgeRequest, vt as bridgeError, w as InteractionResponse } from "./index-DnI0BTEp.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -42,6 +42,60 @@ declare class OpfsProvider implements FileSystemProvider {
  */
 declare const WORKER_BOOTSTRAP_SOURCE: string;
 //#endregion
+//#region src/executor/tsTranspiler.d.ts
+interface TypeScriptSupportOptions {
+  /** 应用托管的 esbuild-wasm JS（browser build）URL；Node/vitest 可传 'esbuild-wasm'  specifier */
+  esbuildUrl: string;
+  /** 应用托管的 esbuild.wasm URL；Node 下可省略（自动加载） */
+  wasmUrl?: string;
+}
+/**
+ * D4：宿主侧 .ts → JS 纯类型擦除转译（静态无执行，Worker 永远只见 JS）。
+ * OPFS 缓存：键 = 源码 sha256，跨执行/跨 Worker 只转一次。
+ */
+declare class TsTranspiler {
+  #private;
+  constructor(deps: {
+    fs: FileSystemProvider;
+    options: TypeScriptSupportOptions;
+    cacheDir?: string;
+  });
+  /** 返回 JS 源码；转译失败 → TOOL_EXECUTION_FAILED（带 esbuild 诊断） */
+  transpile(scriptPath: string, source: string): Promise<string>;
+}
+//#endregion
+//#region src/skillManagement/browserSkillManager.d.ts
+/**
+ * D5：浏览器技能安装（http(s) zip / ArrayBuffer；tar/git/npm → TOOL_UNSUPPORTED）。
+ * 流程与 Node 对齐：staging → 解析 name → validateSkills（失败零残留）→ managed root →
+ * manifest（WebCrypto sha256）→ skills.lock.json；zip-slip 防护；manifest/lockfile 与 Node 同格式。
+ */
+declare class BrowserSkillManager {
+  #private;
+  constructor(deps: {
+    fs: FileSystemProvider;
+    managedRoot: string;
+    fetchImpl?: typeof fetch;
+  });
+  install(source: SkillInstallSource, options?: {
+    expectedSha256?: string;
+  }): Promise<SkillManifest>;
+  uninstall(name: string): Promise<void>;
+  verifyIntegrity(name: string): Promise<VerifyResult>;
+  listInstalled(): Promise<SkillsLockfile>;
+}
+//#endregion
+//#region src/skillManagement/zipExtract.d.ts
+/**
+ * zip 解包（fflate，浏览器无依赖）。
+ * 每个条目路径过 resolveInsideRoot：拒绝 `..` 段、绝对路径、反斜杠穿越（与 node 规则一致）。
+ */
+declare function extractZipWeb(fs: FileSystemProvider, data: Uint8Array, destRoot: string): Promise<void>;
+//#endregion
+//#region src/skillManagement/checksumWeb.d.ts
+/** WebCrypto sha256（浏览器/Worker 通用；Node 20+ 全局 crypto 同样可用） */
+declare function sha256HexWeb(data: Uint8Array | string): Promise<string>;
+//#endregion
 //#region src/executor/workerScriptExecutor.d.ts
 /** 主线程持有的 Worker 最小接口（vitest 可用 loopback 替身） */
 interface WorkerLike {
@@ -62,6 +116,8 @@ declare class BrowserWorkerScriptExecutor implements ScriptExecutor {
     fs: FileSystemProvider;
     workerFactory?: WorkerFactory;
     capabilities?: BridgeCapabilities;
+    /** D4 opt-in：配置 esbuild-wasm 资产 URL 后 .ts 经宿主侧转译执行（未配置 .ts → TOOL_UNSUPPORTED） */
+    typescript?: TypeScriptSupportOptions;
   });
   loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
   execute(input: {
@@ -94,6 +150,11 @@ type WorkerRequest = {
     roots?: string[];
     /** OPFS 根目录名（默认 'webskill'）；测试隔离用 */
     opfsRootName?: string;
+    /** D4 opt-in：esbuild-wasm 资产 URL（启用 .ts 脚本宿主侧转译） */
+    typescript?: {
+      esbuildUrl: string;
+      wasmUrl?: string;
+    };
   };
 } | {
   type: 'run';
@@ -191,6 +252,10 @@ declare class WorkerRuntimeClient {
     interaction?: InteractionPolicy;
     roots?: string[];
     opfsRootName?: string;
+    typescript?: {
+      esbuildUrl: string;
+      wasmUrl?: string;
+    };
   }): Promise<WorkerEvent>;
   run(prompt: string, runId?: string): Promise<WorkerEvent>;
   status(runId: string): Promise<WorkerEvent>;
@@ -216,4 +281,4 @@ declare class WorkerUiBridge implements UiBridge {
   onTextDelta(runId: string, delta: string): Promise<void>;
 }
 //#endregion
-export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserWorkerScriptExecutor, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SerializedError, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, startWorkerRuntimeHost };
+export { type BridgeCapabilities, type BridgeRequest, type BridgeResponse, BrowserSkillManager, BrowserWorkerScriptExecutor, type LlmClientConfig, type MainToWorkerMessage, OpfsProvider, type SerializedError, TsTranspiler, type TypeScriptSupportOptions, WORKER_BOOTSTRAP_SOURCE, type WorkerEvent, type WorkerFactory, type WorkerLike, type WorkerRequest, WorkerRuntimeClient, type WorkerRuntimeClientDeps, type WorkerRuntimeHostOverrides, type WorkerScopeLike, WorkerUiBridge, bridgeError, extractZipWeb, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };

package/dist/browser.js

@@ -1,4 +1,5 @@
-import { D as normalizeToolContent, E as mergeCatalogEntries, I as SkillDiscovery, O as parseBridgeRequest, R as WebSkillError, f as MockLlmClient, h as ProgressiveRouter, i as AgentLoop, m as OpenAiCompatibleClient, o as FsArtifactStore, s as FsMemoryStore, x as bridgeError, z as buildCatalog } from "./dist-B_ldNWwT.js";
+import { $ as validateSkills, B as WebSkillError, D as normalizeToolContent, E as mergeCatalogEntries, F as SKILL_MANIFEST_FILE, H as buildManifest, K as isValidSkillName, O as parseBridgeRequest, P as SKILLS_LOCKFILE, Q as resolveInsideRoot, R as SkillDiscovery, V as buildCatalog, Y as parseSkillMarkdown, et as verifyManifest, f as MockLlmClient, h as ProgressiveRouter, i as AgentLoop, m as OpenAiCompatibleClient, o as FsArtifactStore, s as FsMemoryStore, x as bridgeError } from "./dist-hMMxARXK.js";
+import { unzipSync } from "fflate";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -267,6 +268,264 @@ self.onmessage = async function (event) {
   }
 };
 `;
+let esbuildPromise;
+async function loadEsbuild(options) {
+	esbuildPromise ??= (async () => {
+		const mod = await import(
+			/* @vite-ignore */
+			options.esbuildUrl
+);
+		await mod.initialize(options.wasmUrl ? { wasmURL: options.wasmUrl } : {});
+		return mod;
+	})();
+	return esbuildPromise;
+}
+async function sha256Hex(data) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* D4：宿主侧 .ts → JS 纯类型擦除转译（静态无执行，Worker 永远只见 JS）。
+* OPFS 缓存：键 = 源码 sha256，跨执行/跨 Worker 只转一次。
+*/
+var TsTranspiler = class {
+	#fs;
+	#options;
+	#cacheDir;
+	constructor(deps) {
+		this.#fs = deps.fs;
+		this.#options = deps.options;
+		this.#cacheDir = deps.cacheDir ?? ".webskill/ts-cache";
+	}
+	/** 返回 JS 源码；转译失败 → TOOL_EXECUTION_FAILED（带 esbuild 诊断） */
+	async transpile(scriptPath, source) {
+		const cacheKey = `${this.#cacheDir}/${await sha256Hex(`${scriptPath}\n${source}`)}.js`;
+		if (await this.#fs.exists(cacheKey)) return this.#fs.readText(cacheKey);
+		let code;
+		try {
+			code = (await (await loadEsbuild(this.#options)).transform(source, {
+				loader: "ts",
+				target: "es2022",
+				format: "esm"
+			})).code;
+		} catch (e) {
+			throw new WebSkillError("TOOL_EXECUTION_FAILED", `Failed to transpile ${scriptPath}: ${e instanceof Error ? e.message : String(e)}`, e);
+		}
+		await this.#fs.writeText(cacheKey, code);
+		return code;
+	}
+};
+/** WebCrypto sha256（浏览器/Worker 通用；Node 20+ 全局 crypto 同样可用） */
+async function sha256HexWeb(data) {
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** 递归拷贝目录（含子目录与二进制文件） */
+async function copyDir(fs, from, to) {
+	await fs.mkdir(to);
+	for (const entry of await fs.list(from)) {
+		const name = entry.path.split("/").pop() ?? "";
+		if (entry.type === "directory") await copyDir(fs, entry.path, `${to}/${name}`);
+		else await fs.writeBinary(`${to}/${name}`, await fs.readBinary(entry.path));
+	}
+}
+/** 递归列出目录内全部文件（相对路径，posix 分隔） */
+async function listFiles(fs, root, prefix = "") {
+	const out = [];
+	for (const entry of await fs.list(root)) {
+		const name = entry.path.split("/").pop() ?? "";
+		const rel = prefix === "" ? name : `${prefix}/${name}`;
+		if (entry.type === "directory") out.push(...await listFiles(fs, entry.path, rel));
+		else out.push(rel);
+	}
+	return out;
+}
+/** 删除目录（不存在时静默） */
+async function removeDirQuiet(fs, dir) {
+	try {
+		if (await fs.exists(dir)) await fs.remove(dir, { recursive: true });
+	} catch {}
+}
+/**
+* zip 解包（fflate，浏览器无依赖）。
+* 每个条目路径过 resolveInsideRoot：拒绝 `..` 段、绝对路径、反斜杠穿越（与 node 规则一致）。
+*/
+async function extractZipWeb(fs, data, destRoot) {
+	let entries;
+	try {
+		entries = unzipSync(data);
+	} catch (e) {
+		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	for (const [entryPath, content] of Object.entries(entries)) {
+		const target = resolveInsideRoot(destRoot, entryPath);
+		if (entryPath.endsWith("/")) await fs.mkdir(target);
+		else await fs.writeBinary(target, content);
+	}
+}
+const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
+const asInstallFailed = (e) => e instanceof WebSkillError && (e.code === "INSTALL_FAILED" || e.code === "TOOL_UNSUPPORTED") ? e : new WebSkillError("INSTALL_FAILED", `Install failed: ${messageOf$1(e)}`, e);
+const lockfilePath = (root) => `${root}/${SKILLS_LOCKFILE}`;
+/**
+* D5：浏览器技能安装（http(s) zip / ArrayBuffer；tar/git/npm → TOOL_UNSUPPORTED）。
+* 流程与 Node 对齐：staging → 解析 name → validateSkills（失败零残留）→ managed root →
+* manifest（WebCrypto sha256）→ skills.lock.json；zip-slip 防护；manifest/lockfile 与 Node 同格式。
+*/
+var BrowserSkillManager = class {
+	#fs;
+	#managedRoot;
+	#fetchImpl;
+	constructor(deps) {
+		this.#fs = deps.fs;
+		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
+		this.#fetchImpl = deps.fetchImpl;
+	}
+	async install(source, options) {
+		const fs = this.#fs;
+		const stagingRoot = `${this.#managedRoot}/.staging-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+		let targetDir;
+		try {
+			if (source.type !== "http" && source.type !== "archive") throw new WebSkillError("TOOL_UNSUPPORTED", `Install source "${source.type}" is not supported in the browser (http zip / archive only)`);
+			let data;
+			if (source.type === "http") {
+				let res;
+				try {
+					res = await (this.#fetchImpl ?? fetch)(source.url);
+				} catch (e) {
+					throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
+				}
+				if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
+				data = new Uint8Array(await res.arrayBuffer());
+			} else data = new Uint8Array(source.data);
+			if (options?.expectedSha256 !== void 0) {
+				const actual = await sha256HexWeb(data);
+				if (actual !== options.expectedSha256) throw new WebSkillError("INSTALL_FAILED", `Archive checksum mismatch: expected ${options.expectedSha256}, got ${actual}`);
+			}
+			const contentDir = `${stagingRoot}/content`;
+			await fs.mkdir(contentDir);
+			await extractZipWeb(fs, data, contentDir);
+			let skillDir = contentDir;
+			if (!await fs.exists(`${contentDir}/SKILL.md`)) {
+				const dirs = (await fs.list(contentDir)).filter((e) => e.type === "directory");
+				if (dirs.length === 1 && await fs.exists(`${dirs[0]?.path}/SKILL.md`)) skillDir = dirs[0].path;
+				else throw new WebSkillError("INSTALL_FAILED", "Archive does not contain a SKILL.md at its root or in a single top-level directory");
+			}
+			let name;
+			let version;
+			try {
+				const { metadata } = parseSkillMarkdown(await fs.readText(`${skillDir}/SKILL.md`));
+				name = metadata.name;
+				version = typeof metadata["version"] === "string" ? metadata["version"] : void 0;
+			} catch (e) {
+				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf$1(e)}`, e);
+			}
+			const finalRoot = `${stagingRoot}/final`;
+			const finalDir = `${finalRoot}/${name}`;
+			await copyDir(fs, skillDir, finalDir);
+			const report = await validateSkills(fs, [finalRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("INSTALL_FAILED", `Skill "${name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			targetDir = `${this.#managedRoot}/${name}`;
+			if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
+			await copyDir(fs, finalDir, targetDir);
+			const manifest = await this.#createManifest(targetDir, {
+				name,
+				...version ? { version } : {},
+				source
+			});
+			await this.#upsertLockEntry(name, {
+				digest: manifest.integrity.digest,
+				installedAt: manifest.installedAt,
+				source
+			});
+			targetDir = void 0;
+			return manifest;
+		} catch (e) {
+			if (targetDir) await removeDirQuiet(fs, targetDir);
+			throw asInstallFailed(e);
+		} finally {
+			await removeDirQuiet(fs, stagingRoot);
+		}
+	}
+	async uninstall(name) {
+		if (!isValidSkillName(name)) throw new WebSkillError("UNINSTALL_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
+		const targetDir = `${this.#managedRoot}/${name}`;
+		if (!await this.#fs.exists(targetDir)) throw new WebSkillError("UNINSTALL_FAILED", `Skill "${name}" is not installed`);
+		try {
+			await this.#fs.remove(targetDir, { recursive: true });
+			await this.#removeLockEntry(name);
+		} catch (e) {
+			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf$1(e)}`, e);
+		}
+	}
+	async verifyIntegrity(name) {
+		if (!isValidSkillName(name)) throw new WebSkillError("INTEGRITY_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
+		const manifest = await this.#readManifest(`${this.#managedRoot}/${name}`);
+		const actualHashes = /* @__PURE__ */ new Map();
+		for (const file of manifest.files) {
+			const path = `${this.#managedRoot}/${name}/${file.path}`;
+			if (await this.#fs.exists(path)) actualHashes.set(file.path, await sha256HexWeb(await this.#fs.readBinary(path)));
+		}
+		return verifyManifest(manifest, actualHashes);
+	}
+	async listInstalled() {
+		const path = lockfilePath(this.#managedRoot);
+		if (!await this.#fs.exists(path)) return {
+			schemaVersion: 1,
+			skills: {}
+		};
+		try {
+			return JSON.parse(await this.#fs.readText(path));
+		} catch (e) {
+			throw new WebSkillError("INTEGRITY_FAILED", `Skills lockfile at ${path} is corrupted: ${messageOf$1(e)}`, e);
+		}
+	}
+	async #createManifest(skillRoot, input) {
+		const excluded = /* @__PURE__ */ new Set([SKILL_MANIFEST_FILE, SKILLS_LOCKFILE]);
+		const files = [];
+		for (const rel of (await listFiles(this.#fs, skillRoot)).sort()) {
+			if (excluded.has(rel.split("/").pop() ?? "")) continue;
+			const content = await this.#fs.readBinary(`${skillRoot}/${rel}`);
+			files.push({
+				path: rel,
+				size: content.length,
+				sha256: await sha256HexWeb(content)
+			});
+		}
+		const manifest = await buildManifest({
+			name: input.name,
+			...input.version !== void 0 ? { version: input.version } : {},
+			source: input.source,
+			installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			files,
+			sha256: sha256HexWeb
+		});
+		await this.#fs.writeText(`${skillRoot}/${SKILL_MANIFEST_FILE}`, JSON.stringify(manifest, null, 2));
+		return manifest;
+	}
+	async #readManifest(skillRoot) {
+		const path = `${skillRoot}/${SKILL_MANIFEST_FILE}`;
+		if (!await this.#fs.exists(path)) throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest not found at ${path} (was the skill installed via BrowserSkillManager?)`);
+		try {
+			return JSON.parse(await this.#fs.readText(path));
+		} catch (e) {
+			throw new WebSkillError("INTEGRITY_FAILED", `Skill manifest at ${path} is corrupted: ${messageOf$1(e)}`, e);
+		}
+	}
+	async #upsertLockEntry(name, entry) {
+		const lockfile = await this.listInstalled();
+		lockfile.skills[name] = entry;
+		await this.#fs.writeText(lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
+	}
+	async #removeLockEntry(name) {
+		const lockfile = await this.listInstalled();
+		delete lockfile.skills[name];
+		await this.#fs.writeText(lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
+	}
+};
 const defaultWorkerFactory = () => {
 	const blob = new Blob([WORKER_BOOTSTRAP_SOURCE], { type: "text/javascript" });
 	const url = URL.createObjectURL(blob);
@@ -284,9 +543,14 @@ var BrowserWorkerScriptExecutor = class {
 	#fs;
 	#workerFactory;
 	#capabilities;
+	#transpiler;
 	constructor(deps) {
 		this.#fs = deps.fs;
 		this.#workerFactory = deps.workerFactory ?? defaultWorkerFactory;
+		this.#transpiler = deps.typescript ? new TsTranspiler({
+			fs: deps.fs,
+			options: deps.typescript
+		}) : void 0;
 		this.#capabilities = {
 			readReference: deps.capabilities?.readReference ?? true,
 			writeArtifact: deps.capabilities?.writeArtifact ?? true,
@@ -299,7 +563,13 @@ var BrowserWorkerScriptExecutor = class {
 		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
 		const [hasJs, hasTs] = await Promise.all([this.#fs.exists(jsPath), this.#fs.exists(tsPath)]);
 		if (hasJs && hasTs) throw new WebSkillError("TOOL_EXECUTION_FAILED", `Script "${scriptName}" is ambiguous: both .ts and .js exist under ${skillRoot}/scripts`);
-		if (hasTs) throw new WebSkillError("TOOL_UNSUPPORTED", `Browser sandbox executes .js only; "${scriptName}.ts" needs transpilation (deferred: D4)`);
+		if (hasTs) {
+			if (!this.#transpiler) throw new WebSkillError("TOOL_UNSUPPORTED", `Browser sandbox executes .js only unless TypeScript support is configured ("${scriptName}.ts")`);
+			return {
+				path: tsPath,
+				source: await this.#transpiler.transpile(tsPath, await this.#fs.readText(tsPath))
+			};
+		}
 		if (!hasJs) throw new WebSkillError("TOOL_NOT_FOUND", `Script "${scriptName}" not found under ${skillRoot}/scripts`);
 		return {
 			path: jsPath,
@@ -616,7 +886,8 @@ function startWorkerRuntimeHost(scope, overrides = {}) {
 			llm: (overrides.createLlm ?? defaultCreateLlm)(config.llm),
 			executor: new BrowserWorkerScriptExecutor({
 				fs,
-				...overrides.workerFactory ? { workerFactory: overrides.workerFactory } : {}
+				...overrides.workerFactory ? { workerFactory: overrides.workerFactory } : {},
+				...config.typescript ? { typescript: config.typescript } : {}
 			}),
 			...config.interaction ? { interaction: config.interaction } : {},
 			roots: config.roots ?? ["/skills"]
@@ -853,4 +1124,4 @@ var WorkerRuntimeClient = class {
 };
 
 //#endregion
-export { BrowserWorkerScriptExecutor, OpfsProvider, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, startWorkerRuntimeHost };
+export { BrowserSkillManager, BrowserWorkerScriptExecutor, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, extractZipWeb, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, sha256HexWeb, startWorkerRuntimeHost };