@webskill/sdk 0.1.0 → 0.1.1

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DCklnS0h.js";
-import { K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, c as ApprovalScope, d as BridgeRequest, f as BridgeResponse, g as ExternalSkillProvider, k as NetworkPolicy, l as BridgeCapabilities, ot as bridgeError, q as ScriptExecutor, rt as WebSkillApi } from "./index-S8uza3ld.js";
+import { H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, c as ApprovalScope, d as BridgeRequest, f as BridgeResponse, g as ExternalSkillProvider, k as NetworkPolicy, l as BridgeCapabilities, ot as bridgeError, q as ScriptExecutor, rt as WebSkillApi } from "./index-oG5Nzgb9.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */

package/dist/browser.js

@@ -1,5 +1,5 @@
 import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, c as SkillDiscovery, d as buildCatalog, f as buildManifest, i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as isValidSkillName, x as parseSkillMarkdown } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, O as mergeCatalogEntries, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, f as OpenAiCompatibleClient, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, p as ProgressiveRouter, s as FsArtifactStore } from "./dist-CiYRkm71.js";
+import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, O as mergeCatalogEntries, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, f as OpenAiCompatibleClient, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, p as ProgressiveRouter, s as FsArtifactStore } from "./dist-D5fsiETF.js";
 import { n as MockLlmClient } from "./testing-pn3NhXSV.js";
 import { unzipSync } from "fflate";
 
@@ -499,6 +499,7 @@ var BrowserSkillManager = class {
 			} catch (e) {
 				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf$1(e)}`, e);
 			}
+			if (!isValidSkillName(name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in SKILL.md (path traversal rejected): ${JSON.stringify(name)}`);
 			const finalRoot = `${stagingRoot}/final`;
 			const finalDir = `${finalRoot}/${name}`;
 			await copyDir(fs, skillDir, finalDir);
@@ -540,6 +541,7 @@ var BrowserSkillManager = class {
 		try {
 			const versions = /* @__PURE__ */ new Map();
 			for (const entry of pack.manifest.skills) {
+				if (!isValidSkillName(entry.name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in skill pack manifest (path traversal rejected): ${JSON.stringify(entry.name)}`);
 				const skillDir = `${pack.contentDir}/${entry.name}`;
 				if (!await fs.exists(`${skillDir}/SKILL.md`)) throw new WebSkillError("INSTALL_FAILED", `Skill pack is missing a directory for skill "${entry.name}"`);
 				let name;

package/dist/{dist-DfKKj86A.js → dist-Cc3Mqi3_.js}

@@ -1,5 +1,5 @@
 import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, f as buildManifest, i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as isValidSkillName, x as parseSkillMarkdown } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { A as normalizeToolContent, D as isNetworkAllowed, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, j as parseBridgeRequest, k as networkUrlHost, s as FsArtifactStore } from "./dist-CiYRkm71.js";
+import { A as normalizeToolContent, D as isNetworkAllowed, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, j as parseBridgeRequest, k as networkUrlHost, s as FsArtifactStore } from "./dist-D5fsiETF.js";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
@@ -1178,6 +1178,7 @@ var SkillManager = class {
 			} catch (e) {
 				throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md: ${messageOf(e)}`, e);
 			}
+			if (!isValidSkillName(name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in SKILL.md (path traversal rejected): ${JSON.stringify(name)}`);
 			const finalRoot = `${stagingRoot}/final`;
 			const finalDir = `${finalRoot}/${name}`;
 			await copyDir(fs, staged.skillDir, finalDir);
@@ -1221,6 +1222,7 @@ var SkillManager = class {
 		try {
 			const versions = /* @__PURE__ */ new Map();
 			for (const entry of pack.manifest.skills) {
+				if (!isValidSkillName(entry.name)) throw new WebSkillError("INSTALL_FAILED", `Invalid skill name in skill pack manifest (path traversal rejected): ${JSON.stringify(entry.name)}`);
 				const skillDir = `${pack.contentDir}/${entry.name}`;
 				if (!await fs.exists(`${skillDir}/SKILL.md`)) throw new WebSkillError("INSTALL_FAILED", `Skill pack is missing a directory for skill "${entry.name}"`);
 				let name;

package/dist/{dist-CiYRkm71.js → dist-D5fsiETF.js}

@@ -1758,7 +1758,12 @@ var FsMemoryStore = class {
 	async get(scope, key) {
 		const path = this.#keyPath(scope, key);
 		if (!await this.#fs.exists(path)) return void 0;
-		return JSON.parse(await this.#fs.readText(path));
+		try {
+			return JSON.parse(await this.#fs.readText(path));
+		} catch {
+			await this.#fs.remove(path);
+			return;
+		}
 	}
 	async set(scope, key, value) {
 		await this.#fs.writeText(this.#keyPath(scope, key), JSON.stringify(value, null, 2));
@@ -1775,10 +1780,14 @@ var FsMemoryStore = class {
 			if (entry.type !== "file" || !entry.path.endsWith(".json")) continue;
 			const fileName = entry.path.split("/").pop() ?? "";
 			const key = decodeURIComponent(fileName.replace(/\.json$/, ""));
-			out.push({
-				key,
-				value: JSON.parse(await this.#fs.readText(entry.path))
-			});
+			try {
+				out.push({
+					key,
+					value: JSON.parse(await this.#fs.readText(entry.path))
+				});
+			} catch {
+				await this.#fs.remove(entry.path);
+			}
 		}
 		return out.sort((a, b) => a.key.localeCompare(b.key));
 	}
@@ -1826,7 +1835,12 @@ var FsArtifactStore = class {
 		const indexPath = `${this.#root}/${runId}/${INDEX_FILE}`;
 		if (!await this.#fs.exists(indexPath)) return [];
 		const raw = await this.#fs.readText(indexPath);
-		return JSON.parse(raw).artifacts ?? [];
+		try {
+			return JSON.parse(raw).artifacts ?? [];
+		} catch {
+			await this.#fs.remove(indexPath);
+			return [];
+		}
 	}
 	#artifactPath(runId, artifactPath) {
 		return resolveInsideRoot(`${this.#root}/${runId}`, artifactPath);

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
-import { U as RuntimeRun, it as WebSkillRuntime } from "./index-S8uza3ld.js";
-import { d as SkillManager } from "./index-DuodMfQw.js";
+import { L as SkillManifest, N as SkillDocument, S as FileSystemProvider, c as LlmClient, j as SkillCatalogEntry, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { U as RuntimeRun, it as WebSkillRuntime } from "./index-oG5Nzgb9.js";
+import { d as SkillManager } from "./index-Dc4X2N54.js";
 //#region ../governance/dist/index.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';

package/dist/governance.js

@@ -1,5 +1,5 @@
 import { E as validateSkills, T as resolveInsideRoot, u as WebSkillError, v as isValidSkillName } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { i as NodeFS } from "./dist-DfKKj86A.js";
+import { i as NodeFS } from "./dist-Cc3Mqi3_.js";
 import path from "node:path";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/dist/{index-DuodMfQw.d.ts → index-Dc4X2N54.d.ts}

@@ -1,5 +1,5 @@
-import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DCklnS0h.js";
-import { G as SchemaInferer, K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, c as ApprovalScope, k as NetworkPolicy, l as BridgeCapabilities, q as ScriptExecutor, v as FsArtifactStore, y as FsMemoryStore } from "./index-S8uza3ld.js";
+import { C as JsonSchema, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { G as SchemaInferer, K as ScriptExecutionContext, Y as ToolDefinition, Z as ToolResult, c as ApprovalScope, k as NetworkPolicy, l as BridgeCapabilities, q as ScriptExecutor, v as FsArtifactStore, y as FsMemoryStore } from "./index-oG5Nzgb9.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts

package/dist/{index-S8uza3ld.d.ts → index-oG5Nzgb9.d.ts}

@@ -1,4 +1,4 @@
-import { A as SkillCatalog, C as JsonSchema, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, P as SkillInstallSource, S as FileSystemProvider, U as ValidationReport, _ as RenderResultRequest, a as InteractionPolicy, b as DiscoveryResult, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, j as SkillCatalogEntry, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
+import { A as SkillCatalog, C as JsonSchema, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, P as SkillInstallSource, S as FileSystemProvider, U as ValidationReport, _ as RenderResultRequest, a as InteractionPolicy, b as DiscoveryResult, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, j as SkillCatalogEntry, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as exportSkills, A as SkillCatalog, B as SkillReader, C as JsonSchema, D as SKILL_NAME_MAX_LENGTH, E as SKILL_MANIFEST_FILE, F as SkillIssue, G as WebSkillError, H as SkillsLockfile, I as SkillLocation, J as buildManifest, K as WebSkillErrorCode, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, O as SKILL_NAME_PATTERN, P as SkillInstallSource, Q as escapeXml, R as SkillMetadata, S as FileSystemProvider, T as SKILLS_LOCKFILE, U as ValidationReport, V as SkillSource, W as VerifyResult, X as checkSkillRules, Y as checkDependencyCycles, Z as computeDigest, _ as RenderResultRequest, a as InteractionPolicy, at as renderAvailableSkillsXml, b as DiscoveryResult, c as LlmClient, ct as validateSkills, d as LlmResponse, et as isValidSkillName, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, it as parseSkillPackManifest, j as SkillCatalogEntry, k as SKILL_PACK_FILE, l as LlmCompleteInput, lt as verifyManifest, m as LlmToolSpec, n as ArtifactStore, nt as normalizePath, o as InteractionRequest, ot as renderCatalogJson, p as LlmToolCall, q as buildCatalog, r as ChartSpec, rt as parseSkillMarkdown, s as InteractionResponse, st as resolveInsideRoot, t as Artifact, tt as jsonRenderer, u as LlmMessage, ut as xmlRenderer, v as UiBridge, w as MemoryFS, x as FileStat, y as CatalogRenderer, z as SkillPackManifest } from "./types-CgNC-oQu-DCklnS0h.js";
-import { $ as TraceEvent, A as OpenAiCompatibleClient, B as RunSnapshotStore, C as HookRunnerOptions, D as LifecycleHookContext, E as LifecycleHook, F as READ_SKILL_FILE_TOOL_NAME, G as SchemaInferer, H as RuntimePhase, I as RUN_SNAPSHOT_SCHEMA_VERSION, J as SkillRouter, K as ScriptExecutionContext, L as RouteResult, M as ProgressiveRouter, N as READ_SKILL_FILE_INPUT_SCHEMA, O as LifecycleListener, P as READ_SKILL_FILE_TOOL, Q as TraceClock, R as RunResult, S as HookRunner, T as LifecycleEvent, U as RuntimeRun, V as RunTerminationReason, W as RuntimeSession, X as ToolResolution, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, a as AgentLoopConfig, at as WebSkillRuntimeDeps, b as FsRunSnapshotStore, bt as toLlmToolSpec, c as ApprovalScope, ct as createScriptContext, d as BridgeRequest, dt as fromVercelResult, et as TraceEventType, f as BridgeResponse, ft as fromVercelStreamPart, g as ExternalSkillProvider, gt as normalizeToolContent, h as EventBus, ht as networkUrlHost, i as AgentLoop, it as WebSkillRuntime, j as OpenAiCompatibleClientConfig, k as NetworkPolicy, l as BridgeCapabilities, lt as createWebSkillApi, m as CapabilityMode, mt as mergeCatalogEntries, n as ASK_USER_TOOL, nt as VercelToolSpec, o as AgentLoopDeps, ot as bridgeError, p as CapabilityApproval, pt as isNetworkAllowed, q as ScriptExecutor, r as ASK_USER_TOOL_NAME, rt as WebSkillApi, s as ApprovalDecision, st as buildRenderResult, t as ASK_USER_INPUT_SCHEMA, tt as TraceRecorder, u as BridgeCapability, ut as extractChartSpec, v as FsArtifactStore, vt as resolveToolName, w as InstalledSkillManifest, x as FullDisclosureRouter, xt as toVercelToolSpecs, y as FsMemoryStore, yt as schemaToForm, z as RunSnapshot } from "./index-S8uza3ld.js";
+import { $ as exportSkills, A as SkillCatalog, B as SkillReader, C as JsonSchema, D as SKILL_NAME_MAX_LENGTH, E as SKILL_MANIFEST_FILE, F as SkillIssue, G as WebSkillError, H as SkillsLockfile, I as SkillLocation, J as buildManifest, K as WebSkillErrorCode, L as SkillManifest, M as SkillDiscovery, N as SkillDocument, O as SKILL_NAME_PATTERN, P as SkillInstallSource, Q as escapeXml, R as SkillMetadata, S as FileSystemProvider, T as SKILLS_LOCKFILE, U as ValidationReport, V as SkillSource, W as VerifyResult, X as checkSkillRules, Y as checkDependencyCycles, Z as computeDigest, _ as RenderResultRequest, a as InteractionPolicy, at as renderAvailableSkillsXml, b as DiscoveryResult, c as LlmClient, ct as validateSkills, d as LlmResponse, et as isValidSkillName, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, it as parseSkillPackManifest, j as SkillCatalogEntry, k as SKILL_PACK_FILE, l as LlmCompleteInput, lt as verifyManifest, m as LlmToolSpec, n as ArtifactStore, nt as normalizePath, o as InteractionRequest, ot as renderCatalogJson, p as LlmToolCall, q as buildCatalog, r as ChartSpec, rt as parseSkillMarkdown, s as InteractionResponse, st as resolveInsideRoot, t as Artifact, tt as jsonRenderer, u as LlmMessage, ut as xmlRenderer, v as UiBridge, w as MemoryFS, x as FileStat, y as CatalogRenderer, z as SkillPackManifest } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { $ as TraceEvent, A as OpenAiCompatibleClient, B as RunSnapshotStore, C as HookRunnerOptions, D as LifecycleHookContext, E as LifecycleHook, F as READ_SKILL_FILE_TOOL_NAME, G as SchemaInferer, H as RuntimePhase, I as RUN_SNAPSHOT_SCHEMA_VERSION, J as SkillRouter, K as ScriptExecutionContext, L as RouteResult, M as ProgressiveRouter, N as READ_SKILL_FILE_INPUT_SCHEMA, O as LifecycleListener, P as READ_SKILL_FILE_TOOL, Q as TraceClock, R as RunResult, S as HookRunner, T as LifecycleEvent, U as RuntimeRun, V as RunTerminationReason, W as RuntimeSession, X as ToolResolution, Y as ToolDefinition, Z as ToolResult, _ as ExternalToolSource, _t as parseBridgeRequest, a as AgentLoopConfig, at as WebSkillRuntimeDeps, b as FsRunSnapshotStore, bt as toLlmToolSpec, c as ApprovalScope, ct as createScriptContext, d as BridgeRequest, dt as fromVercelResult, et as TraceEventType, f as BridgeResponse, ft as fromVercelStreamPart, g as ExternalSkillProvider, gt as normalizeToolContent, h as EventBus, ht as networkUrlHost, i as AgentLoop, it as WebSkillRuntime, j as OpenAiCompatibleClientConfig, k as NetworkPolicy, l as BridgeCapabilities, lt as createWebSkillApi, m as CapabilityMode, mt as mergeCatalogEntries, n as ASK_USER_TOOL, nt as VercelToolSpec, o as AgentLoopDeps, ot as bridgeError, p as CapabilityApproval, pt as isNetworkAllowed, q as ScriptExecutor, r as ASK_USER_TOOL_NAME, rt as WebSkillApi, s as ApprovalDecision, st as buildRenderResult, t as ASK_USER_INPUT_SCHEMA, tt as TraceRecorder, u as BridgeCapability, ut as extractChartSpec, v as FsArtifactStore, vt as resolveToolName, w as InstalledSkillManifest, x as FullDisclosureRouter, xt as toVercelToolSpecs, y as FsMemoryStore, yt as schemaToForm, z as RunSnapshot } from "./index-oG5Nzgb9.js";
 export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, type ApprovalDecision, type ApprovalScope, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/index.js

@@ -1,4 +1,4 @@
 import { C as renderAvailableSkillsXml, D as verifyManifest, E as validateSkills, O as xmlRenderer, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, a as SKILL_NAME_MAX_LENGTH, b as normalizePath, c as SkillDiscovery, d as buildCatalog, f as buildManifest, g as escapeXml, h as computeDigest, i as SKILL_MANIFEST_FILE, l as SkillReader, m as checkSkillRules, n as MemoryFS, o as SKILL_NAME_PATTERN, p as checkDependencyCycles, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, v as isValidSkillName, w as renderCatalogJson, x as parseSkillMarkdown, y as jsonRenderer } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, E as fromVercelStreamPart, F as toVercelToolSpecs, M as resolveToolName, N as schemaToForm, O as mergeCatalogEntries, P as toLlmToolSpec, S as createScriptContext, T as fromVercelResult, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, d as HookRunner, f as OpenAiCompatibleClient, g as READ_SKILL_FILE_TOOL_NAME, h as READ_SKILL_FILE_TOOL, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, m as READ_SKILL_FILE_INPUT_SCHEMA, n as ASK_USER_TOOL, o as EventBus, p as ProgressiveRouter, r as ASK_USER_TOOL_NAME, s as FsArtifactStore, t as ASK_USER_INPUT_SCHEMA, u as FullDisclosureRouter, v as TraceRecorder, w as extractChartSpec, x as buildRenderResult, y as WebSkillRuntime } from "./dist-CiYRkm71.js";
+import { A as normalizeToolContent, C as createWebSkillApi, D as isNetworkAllowed, E as fromVercelStreamPart, F as toVercelToolSpecs, M as resolveToolName, N as schemaToForm, O as mergeCatalogEntries, P as toLlmToolSpec, S as createScriptContext, T as fromVercelResult, _ as RUN_SNAPSHOT_SCHEMA_VERSION, a as CapabilityApproval, b as bridgeError, c as FsMemoryStore, d as HookRunner, f as OpenAiCompatibleClient, g as READ_SKILL_FILE_TOOL_NAME, h as READ_SKILL_FILE_TOOL, i as AgentLoop, j as parseBridgeRequest, k as networkUrlHost, l as FsRunSnapshotStore, m as READ_SKILL_FILE_INPUT_SCHEMA, n as ASK_USER_TOOL, o as EventBus, p as ProgressiveRouter, r as ASK_USER_TOOL_NAME, s as FsArtifactStore, t as ASK_USER_INPUT_SCHEMA, u as FullDisclosureRouter, v as TraceRecorder, w as extractChartSpec, x as buildRenderResult, y as WebSkillRuntime } from "./dist-D5fsiETF.js";
 
 export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, CapabilityApproval, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizePath, normalizeToolContent, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, renderAvailableSkillsXml, renderCatalogJson, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { C as JsonSchema, N as SkillDocument, j as SkillCatalogEntry, m as LlmToolSpec } from "./types-CgNC-oQu-DCklnS0h.js";
-import { Z as ToolResult, _ as ExternalToolSource, g as ExternalSkillProvider, mt as mergeCatalogEntries } from "./index-S8uza3ld.js";
+import { C as JsonSchema, N as SkillDocument, j as SkillCatalogEntry, m as LlmToolSpec } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { Z as ToolResult, _ as ExternalToolSource, g as ExternalSkillProvider, mt as mergeCatalogEntries } from "./index-oG5Nzgb9.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { u as WebSkillError } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { A as normalizeToolContent, O as mergeCatalogEntries } from "./dist-CiYRkm71.js";
+import { A as normalizeToolContent, O as mergeCatalogEntries } from "./dist-D5fsiETF.js";
 import { fromJSONSchema } from "zod";
 
 //#region ../mcp/dist/index.js

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { E as SKILL_MANIFEST_FILE, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, T as SKILLS_LOCKFILE, W as VerifyResult } from "./types-CgNC-oQu-DCklnS0h.js";
-import { ct as createScriptContext } from "./index-S8uza3ld.js";
-import { a as LlmEnvConfig, c as OxcSchemaInferer, d as SkillManager, f as loadLlmConfigFromEnv, i as LlmCapabilities, l as SandboxOptions, m as readArchiveManifest, n as FileArtifactStore, o as NodeFS, p as probeLlmCapabilities, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-DuodMfQw.js";
+import { E as SKILL_MANIFEST_FILE, H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, T as SKILLS_LOCKFILE, W as VerifyResult } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { ct as createScriptContext } from "./index-oG5Nzgb9.js";
+import { a as LlmEnvConfig, c as OxcSchemaInferer, d as SkillManager, f as loadLlmConfigFromEnv, i as LlmCapabilities, l as SandboxOptions, m as readArchiveManifest, n as FileArtifactStore, o as NodeFS, p as probeLlmCapabilities, r as FileMemoryStore, s as NodeScriptExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-Dc4X2N54.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,5 +1,5 @@
 import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./memoryArtifactStore-C9lFVqPF-U8nXvqL9.js";
-import { S as createScriptContext } from "./dist-CiYRkm71.js";
-import { a as NodeScriptExecutor, c as SkillManager, d as readArchiveManifest, i as NodeFS, l as loadLlmConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as probeLlmCapabilities } from "./dist-DfKKj86A.js";
+import { S as createScriptContext } from "./dist-D5fsiETF.js";
+import { a as NodeScriptExecutor, c as SkillManager, d as readArchiveManifest, i as NodeFS, l as loadLlmConfigFromEnv, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as SandboxedScriptExecutor, t as CliUiBridge, u as probeLlmCapabilities } from "./dist-Cc3Mqi3_.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, loadLlmConfigFromEnv, probeLlmCapabilities, readArchiveManifest };

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts
 type MockLlmHandler = (input: LlmCompleteInput) => LlmResponse | Promise<LlmResponse>;

package/dist/{types-CgNC-oQu-DCklnS0h.d.ts → types-CgNC-oQu-Dq_A1yA-.d.ts}

@@ -1,6 +1,6 @@
 //#region ../core/dist/index.d.ts
 //#region src/errors.d.ts
-type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE';
+type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'SKILL_UNKNOWN_ALLOWED_TOOL' | 'SKILL_UNKNOWN_DEPENDENCY' | 'SKILL_CIRCULAR_DEPENDENCY' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE';
 /**
  * 所有公开 API 抛出的结构化错误，code 供上层可编程处理
  * @stable
@@ -210,7 +210,7 @@ declare function isValidSkillName(name: string): boolean;
 //#region src/skill/rules.d.ts
 interface SkillIssue {
   /** 与 WebSkillErrorCode 对齐 */
-  code: string;
+  code: WebSkillErrorCode;
   severity: 'info' | 'warning' | 'error';
   message: string;
   path?: string;

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts

package/dist/ui.d.ts

@@ -1,5 +1,5 @@
-import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-DCklnS0h.js";
-import { st as buildRenderResult } from "./index-S8uza3ld.js";
+import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CgNC-oQu-Dq_A1yA-.js";
+import { st as buildRenderResult } from "./index-oG5Nzgb9.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { x as buildRenderResult } from "./dist-CiYRkm71.js";
+import { x as buildRenderResult } from "./dist-D5fsiETF.js";
 import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-Dv4a1Jkm.js";
 
 export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "WebSkill — browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",