@webskill/sdk 0.1.4 → 0.2.0

package/dist/browser.d.ts

@@ -1,5 +1,5 @@
-import { H as SkillsLockfile, L as SkillManifest, P as SkillInstallSource, S as FileSystemProvider, W as VerifyResult, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, x as FileStat } from "./types-CgNC-oQu-DYrxhD3z.js";
-import { $ as ToolDefinition, N as NetworkPolicy, X as ScriptExecutionContext, Z as ScriptExecutor, d as BridgeCapabilities, m as BridgeResponse, p as BridgeRequest, st as WebSkillApi, tt as ToolResult, u as ApprovalScope, ut as bridgeError, v as ExternalSkillProvider, xt as parseBridgeRequest, y as ExternalToolSource } from "./index-BSS3EWY-.js";
+import { C as FileStat, I as SkillInstallSource, K as VerifyResult, W as SkillsLockfile, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-8W8FnP4u.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, Z as ScriptExecutionContext, d as BridgeCapabilities, it as ToolResult, m as BridgeResponse, nt as ToolDefinition, p as BridgeRequest, pt as bridgeError, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, wt as parseBridgeRequest, y as ExternalToolSource } from "./index-CySxIvRz.js";
 //#region ../browser/dist/index.d.ts
 //#region src/fs/featureDetection.d.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -24,6 +24,7 @@ declare class OpfsProvider implements FileSystemProvider {
   remove(p: string, options?: {
     recursive?: boolean;
   }): Promise<void>;
+  rename(from: string, to: string): Promise<void>;
 }
 //#endregion
 //#region src/executor/workerBootstrap.d.ts
@@ -83,6 +84,10 @@ declare class BrowserSkillManager {
     fs: FileSystemProvider;
     managedRoot: string;
     fetchImpl?: typeof fetch;
+    /** 归档体积三重上限（缺省 DEFAULT_ARCHIVE_LIMITS） */
+    archiveLimits?: ArchiveLimits;
+    /** install/uninstall 成功后的变更回调（宿主接线缓存失效，如 WebSkillRuntime.invalidate） */
+    onChanged?: () => void;
   });
   install(source: SkillInstallSource, options?: {
     expectedSha256?: string;
@@ -99,10 +104,10 @@ declare class BrowserSkillManager {
 //#endregion
 //#region src/skillManagement/zipExtract.d.ts
 /**
- * zip 解包（fflate，浏览器无依赖）。
+ * zip 解包（fflate 流式，单条目/总解压体积上限，浏览器无依赖）。
  * 每个条目路径过 resolveInsideRoot：拒绝 `..` 段、绝对路径、反斜杠穿越（与 node 规则一致）。
  */
-declare function extractZipWeb(fs: FileSystemProvider, data: Uint8Array, destRoot: string): Promise<void>;
+declare function extractZipWeb(fs: FileSystemProvider, data: Uint8Array, destRoot: string, limits?: ArchiveLimits): Promise<void>;
 //#endregion
 //#region src/skillManagement/checksumWeb.d.ts
 /** WebCrypto sha256（浏览器/Worker 通用；Node 20+ 全局 crypto 同样可用） */

package/dist/browser.js

@@ -1,7 +1,6 @@
-import { D as verifyManifest, E as validateSkills, S as parseSkillPackManifest, T as resolveInsideRoot, _ as exportSkills, d as buildCatalog, f as buildManifest, l as WebSkillError, n as SKILLS_LOCKFILE, o as SKILL_PACK_FILE, r as SKILL_MANIFEST_FILE, s as SkillDiscovery, v as isValidSkillName, x as parseSkillMarkdown } from "./dist-DvoBsChX.js";
-import { A as mergeCatalogEntries, M as normalizeToolContent, N as parseBridgeRequest, S as bridgeError, T as createWebSkillApi, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as networkUrlHost, k as isNetworkAllowed, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-DAn07zHu.js";
-import { n as MockLlmClient } from "./testing-S8SN9Lc6.js";
-import { unzipSync } from "fflate";
+import { A as unzipWithLimits, C as parseSkillMarkdown, M as verifyManifest, T as readResponseWithLimit, b as isValidSkillName, c as SkillDiscovery, f as atomicWriteText, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, m as buildManifest, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, u as WebSkillError, w as parseSkillPackManifest, y as exportSkills } from "./dist-D0saNPi_.js";
+import { A as isNetworkAllowed, C as bridgeError, E as createWebSkillApi, M as networkUrlHost, N as normalizeToolContent, P as parseBridgeRequest, c as FsArtifactStore, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, l as FsMemoryStore, m as OpenAiCompatibleClient, o as CapabilityApproval, u as FsRunSnapshotStore, y as RUN_SNAPSHOT_SCHEMA_VERSION } from "./dist-BS5OpedX.js";
+import { n as MockLlmClient } from "./testing-B4pq6JYa.js";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -133,6 +132,11 @@ var OpfsProvider = class {
 			await (await this.#walkDir(`/${segments.join("/")}`, false)).removeEntry(name, { recursive: options?.recursive ?? false });
 		});
 	}
+	async rename(from, to) {
+		if ((await this.stat(from)).type === "directory") throw new WebSkillError("FS_PERMISSION_DENIED", `rename of directories is not supported on OPFS: ${from}`);
+		await this.writeBinary(to, await this.readBinary(from));
+		await this.remove(from);
+	}
 };
 /**
 * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
@@ -421,17 +425,11 @@ async function removeDirQuiet(fs, dir) {
 	} catch {}
 }
 /**
-* zip 解包（fflate，浏览器无依赖）。
+* zip 解包（fflate 流式，单条目/总解压体积上限，浏览器无依赖）。
 * 每个条目路径过 resolveInsideRoot：拒绝 `..` 段、绝对路径、反斜杠穿越（与 node 规则一致）。
 */
-async function extractZipWeb(fs, data, destRoot) {
-	let entries;
-	try {
-		entries = unzipSync(data);
-	} catch (e) {
-		throw new WebSkillError("INSTALL_FAILED", `Failed to read zip archive: ${e instanceof Error ? e.message : String(e)}`, e);
-	}
-	for (const [entryPath, content] of Object.entries(entries)) {
+async function extractZipWeb(fs, data, destRoot, limits) {
+	for (const [entryPath, content] of await unzipWithLimits(data, limits)) {
 		const target = resolveInsideRoot(destRoot, entryPath);
 		if (entryPath.endsWith("/")) await fs.mkdir(target);
 		else await fs.writeBinary(target, content);
@@ -450,10 +448,14 @@ var BrowserSkillManager = class {
 	#fs;
 	#managedRoot;
 	#fetchImpl;
+	#archiveLimits;
+	#onChanged;
 	constructor(deps) {
 		this.#fs = deps.fs;
 		this.#managedRoot = deps.managedRoot.replace(/\/+$/, "");
 		this.#fetchImpl = deps.fetchImpl;
+		this.#archiveLimits = deps.archiveLimits;
+		this.#onChanged = deps.onChanged;
 	}
 	async install(source, options) {
 		const fs = this.#fs;
@@ -470,7 +472,7 @@ var BrowserSkillManager = class {
 					throw new WebSkillError("INSTALL_FAILED", `Download failed: ${messageOf$1(e)}`, e);
 				}
 				if (!res.ok) throw new WebSkillError("INSTALL_FAILED", `Download failed with HTTP ${res.status}`);
-				data = new Uint8Array(await res.arrayBuffer());
+				data = await readResponseWithLimit(res, this.#archiveLimits);
 			} else data = new Uint8Array(source.data);
 			if (options?.expectedSha256 !== void 0) {
 				const actual = await sha256HexWeb(data);
@@ -478,7 +480,7 @@ var BrowserSkillManager = class {
 			}
 			const contentDir = `${stagingRoot}/content`;
 			await fs.mkdir(contentDir);
-			await extractZipWeb(fs, data, contentDir);
+			await extractZipWeb(fs, data, contentDir, this.#archiveLimits);
 			const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
 			if (await fs.exists(packFilePath)) return (await this.#installPack({
 				contentDir,
@@ -534,6 +536,7 @@ var BrowserSkillManager = class {
 				throw e;
 			}
 			targetDir = void 0;
+			this.#onChanged?.();
 			return manifest;
 		} catch (e) {
 			if (targetDir) await removeDirQuiet(fs, targetDir);
@@ -611,6 +614,7 @@ var BrowserSkillManager = class {
 				installed.length = 0;
 				throw e;
 			}
+			this.#onChanged?.();
 			return manifests;
 		} catch (e) {
 			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
@@ -641,6 +645,7 @@ var BrowserSkillManager = class {
 		try {
 			await this.#fs.remove(targetDir, { recursive: true });
 			await this.#removeLockEntry(name);
+			this.#onChanged?.();
 		} catch (e) {
 			throw new WebSkillError("UNINSTALL_FAILED", `Failed to uninstall "${name}": ${messageOf$1(e)}`, e);
 		}
@@ -649,11 +654,9 @@ var BrowserSkillManager = class {
 		if (!isValidSkillName(name)) throw new WebSkillError("INTEGRITY_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
 		const manifest = await this.#readManifest(`${this.#managedRoot}/${name}`);
 		const actualHashes = /* @__PURE__ */ new Map();
-		for (const file of manifest.files) {
-			const path = `${this.#managedRoot}/${name}/${file.path}`;
-			if (await this.#fs.exists(path)) actualHashes.set(file.path, await sha256HexWeb(await this.#fs.readBinary(path)));
-		}
-		return verifyManifest(manifest, actualHashes);
+		const actualFiles = await listFiles(this.#fs, `${this.#managedRoot}/${name}`);
+		for (const rel of actualFiles) actualHashes.set(rel, await sha256HexWeb(await this.#fs.readBinary(`${this.#managedRoot}/${name}/${rel}`)));
+		return verifyManifest(manifest, actualHashes, actualFiles);
 	}
 	async listInstalled() {
 		const path = lockfilePath(this.#managedRoot);
@@ -702,12 +705,12 @@ var BrowserSkillManager = class {
 	async #upsertLockEntry(name, entry) {
 		const lockfile = await this.listInstalled();
 		lockfile.skills[name] = entry;
-		await this.#fs.writeText(lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
+		await atomicWriteText(this.#fs, lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
 	}
 	async #removeLockEntry(name) {
 		const lockfile = await this.listInstalled();
 		delete lockfile.skills[name];
-		await this.#fs.writeText(lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
+		await atomicWriteText(this.#fs, lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
 	}
 };
 const defaultWorkerFactory = () => {

package/dist/{dist-MTc2KB03.js → dist-BJobG0i-.js}

@@ -1,4 +1,4 @@
-import { l as WebSkillError } from "./dist-DvoBsChX.js";
+import { u as WebSkillError } from "./dist-D0saNPi_.js";
 
 //#region ../ui/dist/index.js
 /** 提交值按请求类型归形（WebFormBridge 与框架组件库共享单一来源） */
@@ -524,6 +524,8 @@ var WebFormBridge = class {
 	#doc;
 	#styles;
 	#progressEl;
+	/** 等待中的 request 取消句柄（id → 触发 cancelled 并卸载 DOM） */
+	#pending = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.#mount = options.mount;
 		this.#doc = options.document ?? options.mount.ownerDocument;
@@ -535,13 +537,27 @@ var WebFormBridge = class {
 		const model = interactionToFormModel(input);
 		const { form, cleanup } = this.#renderForm(model);
 		return new Promise((resolve) => {
+			const cancel = () => {
+				cleanup();
+				this.#pending.delete(input.id);
+				resolve({
+					id: input.id,
+					cancelled: true
+				});
+			};
+			this.#pending.set(input.id, cancel);
 			form.addEventListener("submit", (event) => {
 				event.preventDefault();
 				const { values, missingRequired } = collectValues(model.controls, form);
 				if (missingRequired.length > 0) {
-					for (const name of missingRequired) form.querySelector(`[${CONTROL_TAG}="${name}"]`)?.closest(".webskill-form__control")?.classList.add("webskill-form__control--invalid");
+					for (const name of missingRequired) {
+						const wrapper = form.querySelector(`[${CONTROL_TAG}="${name}"]`)?.closest(".webskill-form__control");
+						wrapper?.classList.add("webskill-form__control--invalid");
+						wrapper?.querySelector(".webskill-form__input")?.setAttribute("aria-invalid", "true");
+					}
 					return;
 				}
+				this.#pending.delete(input.id);
 				cleanup();
 				resolve({
 					id: input.id,
@@ -550,15 +566,15 @@ var WebFormBridge = class {
 			});
 			form.querySelector("[data-webskill-cancel]")?.addEventListener("click", (event) => {
 				event.preventDefault();
-				cleanup();
-				resolve({
-					id: input.id,
-					cancelled: true
-				});
+				cancel();
 			});
 			this.#mount.appendChild(form);
 		});
 	}
+	/** 尽力取消等待中的 request（超时后清理遗留表单） */
+	cancel(id) {
+		this.#pending.get(id)?.();
+	}
 	async renderResult(input) {
 		if (this.#styles) ensureStyles(this.#doc);
 		this.#clearProgress();
@@ -622,9 +638,12 @@ var WebFormBridge = class {
 		const doc = this.#doc;
 		const wrapper = doc.createElement("div");
 		wrapper.className = "webskill-form__control";
+		const controlId = `webskill-field-${control.name}`;
+		const errorId = `webskill-error-${control.name}`;
 		const label = doc.createElement("label");
 		label.className = control.required ? "webskill-form__label webskill-form__label-required" : "webskill-form__label";
 		label.textContent = control.label;
+		label.htmlFor = controlId;
 		wrapper.appendChild(label);
 		if (control.description) {
 			const desc = doc.createElement("div");
@@ -663,9 +682,13 @@ var WebFormBridge = class {
 			input = textInput;
 		}
 		input.setAttribute(CONTROL_TAG, control.name);
+		input.id = controlId;
+		input.setAttribute("aria-describedby", errorId);
 		wrapper.appendChild(input);
 		const error = doc.createElement("div");
 		error.className = "webskill-form__error";
+		error.id = errorId;
+		error.setAttribute("role", "alert");
 		error.textContent = "This field is required";
 		wrapper.appendChild(error);
 		return wrapper;