@webskill/sdk 0.10.0 → 0.12.0

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-CrRcT-LM-DZAp8sWv.js";
-import { Fn as mergeCatalogEntries, O as ExternalSkillProvider, Xt as ToolResult, k as ExternalToolSource } from "./index-DtFdMKBX.js";
+import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-DLctJep_-B5G4uk2u.js";
+import { F as ExternalToolSource, P as ExternalSkillProvider, dn as ToolResult, tr as mergeCatalogEntries } from "./index-C9pzXLKy.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -141,8 +141,26 @@ declare class McpToolResolver {
  */
 declare function endpointToolLlmName(endpoint: string, toolName: string): string;
 declare function parseEndpointToolLlmName(endpoint: string, llmName: string): string | undefined;
-declare function webMcpToolLlmName(toolName: string): string;
-declare function parseWebMcpToolLlmName(llmName: string): string | undefined;
+/**
+ * 来源标识的长度上限（分册 26 §2.2）。
+ *
+ * 前缀计入工具名，而工具名进**每一次**请求 —— 长 sourceId 是持续成本。
+ * 装配期校验并给出可读错误，比运行时被 provider 拒掉好查。
+ */
+declare const WEB_MCP_SOURCE_ID_MAX = 24;
+/**
+ * WebMCP 工具的 LLM 可见名。
+ *
+ * 多来源时带来源前缀（FR-26.2）：三个文档都注册 `get_current_date` 是常态，
+ * 「首个来源优先」是**静默歧义** —— 模型选中的到底是哪个，谁也说不清。
+ * 不传 sourceId 时保持 0.10.0 的旧名，单来源宿主无感。
+ */
+declare function webMcpToolLlmName(toolName: string, sourceId?: string): string;
+/** 解析回 `{ sourceId?, toolName }`；旧名（无来源段）解析出 `sourceId: undefined` */
+declare function parseWebMcpToolLlmName(llmName: string, sourceIds?: readonly string[]): {
+  sourceId?: string;
+  toolName: string;
+} | undefined;
 //#endregion
 //#region src/skills/temporarySkillProvider.d.ts
 /**
@@ -241,8 +259,14 @@ interface WebMcpToolDescriptor {
  */
 declare class ExperimentalWebMcpAdapter {
   #private;
+  /**
+   * 多来源时的消歧标识（分册 26 FR-26.2）。不设即沿用 0.10.0 的旧工具名，
+   * 单来源宿主无感；**两个以上来源必须各自设**，否则同名工具会撞车。
+   */
+  readonly sourceId?: string;
   constructor(api?: BrowserModelContextLike | (() => BrowserModelContextLike | undefined), options?: {
     enabled?: boolean;
+    sourceId?: string;
   });
   /**
    * 宿主能力检测（FR-19.2/19.4）：**只**看 `document.modelContext.executeTool` 是否存在，
@@ -275,7 +299,24 @@ interface McpToolVisibility {
   /** 端点工具级开关；返回 false 时该工具对大模型不可见 */
   isEndpointToolEnabled?(endpoint: string, tool: string): boolean;
   /** WebMCP 工具级开关；返回 false 时该工具对大模型不可见 */
-  isWebMcpToolEnabled?(tool: string): boolean;
+  /**
+   * 两级启停（FR-26.3，与端点/工具同款）：`sourceId` 为空即整个来源那一组。
+   * 宿主按来源关 → 该组全灭；按工具关 → 只灭一个。
+   */
+  isWebMcpToolEnabled?(tool: string, sourceId?: string): boolean;
+}
+/**
+ * 参数留存的宿主侧信任声明（分册 30 / FR-30.6）。
+ *
+ * 声明只吃 endpoint / sourceId 这两个**宿主配置里的标识**，
+ * 不读工具 schema、不读工具描述、不读服务器元数据——服务器自称可信不算数。
+ * 缺省不信任；信任只影响脱敏判定，不影响可见性与审批。
+ */
+interface McpSourceTrust {
+  /** 宿主声明「这台端点的工具 schema 我审查过」 */
+  isEndpointTrusted?(endpoint: string): boolean;
+  /** WebMCP 来源同款；`sourceId` 为空即未命名的那一个 */
+  isWebMcpSourceTrusted?(sourceId: string | undefined): boolean;
 }
 /**
  * runtime 扩展点实现：endpoint 注册表 + WebMCP adapter 一处装配。
@@ -286,15 +327,25 @@ declare class McpRuntimePlugin implements ExternalToolSource {
   readonly kind = "mcp";
   constructor(deps: {
     registry: EndpointRegistry<McpClientLike>;
-    webMcp?: ExperimentalWebMcpAdapter;
+    webMcp?: readonly ExperimentalWebMcpAdapter[];
     resolver?: McpToolResolver;
     /** 工具可见性策略（端点/工具级启停）；缺省全部可见 */
     visibility?: McpToolVisibility;
+    /** 参数留存的信任声明（分册 30）；**缺省不信任** */
+    trust?: McpSourceTrust;
     /** 已知的 endpoint 名（注销后仍按 MCP_ENDPOINT_UNAVAILABLE 响应，而非 TOOL_NOT_FOUND） */
     endpoints?: string[];
     /** endpoint 不可用时的告警出口（默认 console.warn） */
     onWarning?(message: string): void;
   });
+  /**
+   * 参数留存的信任判定（分册 30 / FR-30.6）。
+   * 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+   */
+  argCaptureTrust(llmToolName: string): {
+    tier: 'host-trusted';
+    declaredBy?: string;
+  } | undefined;
   listToolSpecs(): Promise<LlmToolSpec[]>;
   canHandle(llmToolName: string): boolean;
   call(llmToolName: string, args: Record<string, unknown>): Promise<ToolResult>;
@@ -443,4 +494,4 @@ interface RemoteEndpointHandle {
  */
 declare function connectRemoteEndpoint(registry: EndpointRegistry<McpClientLike>, config: RemoteEndpointConfig): Promise<RemoteEndpointHandle>;
 //#endregion
-export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, type McpSourceTrust, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, WEB_MCP_SOURCE_ID_MAX, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { M as messageOf, g as assertRemoteUrlAllowed, h as WebSkillError } from "./dist-Bev6i6Ip.js";
-import { it as mergeCatalogEntries, lt as normalizeToolContent } from "./dist-BViUeszk.js";
+import { St as normalizeToolContent, _t as mergeCatalogEntries } from "./dist-sdKFgERo.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -249,6 +249,11 @@ var McpToolResolver = class {
 			return failure$1("TOOL_EXECUTION_FAILED", text || "MCP tool returned an error");
 		}
 		for (const item of content) if (item.text !== void 0 && item.text.length > MAX_MCP_RESULT_TEXT_BYTES) item.text = `${item.text.slice(0, MAX_MCP_RESULT_TEXT_BYTES)}…[truncated ${item.text.length - MAX_MCP_RESULT_TEXT_BYTES} chars]`;
+		const structured = result?.structuredContent;
+		if (typeof structured === "object" && structured !== null) content.push({
+			type: "json",
+			data: structured
+		});
 		return {
 			ok: true,
 			content
@@ -267,11 +272,35 @@ function parseEndpointToolLlmName(endpoint, llmName) {
 	const prefix = `${endpoint}__`;
 	return llmName.startsWith(prefix) && llmName.length > prefix.length ? llmName.slice(prefix.length) : void 0;
 }
-function webMcpToolLlmName(toolName) {
-	return `mcp__${toolName}`;
+/**
+* 来源标识的长度上限（分册 26 §2.2）。
+*
+* 前缀计入工具名，而工具名进**每一次**请求 —— 长 sourceId 是持续成本。
+* 装配期校验并给出可读错误，比运行时被 provider 拒掉好查。
+*/
+const WEB_MCP_SOURCE_ID_MAX = 24;
+/**
+* WebMCP 工具的 LLM 可见名。
+*
+* 多来源时带来源前缀（FR-26.2）：三个文档都注册 `get_current_date` 是常态，
+* 「首个来源优先」是**静默歧义** —— 模型选中的到底是哪个，谁也说不清。
+* 不传 sourceId 时保持 0.10.0 的旧名，单来源宿主无感。
+*/
+function webMcpToolLlmName(toolName, sourceId) {
+	return sourceId === void 0 ? `mcp__${toolName}` : `mcp__${sourceId}__${toolName}`;
 }
-function parseWebMcpToolLlmName(llmName) {
-	return llmName.startsWith("mcp__") && llmName.length > 5 ? llmName.slice(5) : void 0;
+/** 解析回 `{ sourceId?, toolName }`；旧名（无来源段）解析出 `sourceId: undefined` */
+function parseWebMcpToolLlmName(llmName, sourceIds = []) {
+	if (!llmName.startsWith("mcp__") || llmName.length <= 5) return void 0;
+	const rest = llmName.slice(5);
+	for (const sourceId of sourceIds) {
+		const sourcePrefix = `${sourceId}__`;
+		if (rest.startsWith(sourcePrefix) && rest.length > sourcePrefix.length) return {
+			sourceId,
+			toolName: rest.slice(sourcePrefix.length)
+		};
+	}
+	return { toolName: rest };
 }
 const textOfContent = (content) => {
 	if (typeof content === "string") return content;
@@ -354,6 +383,10 @@ async function loadFromJSONSchema() {
 		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", "The \"zod\" package is required to serve skills as MCP tools; install it first (npm i zod)", e);
 	}
 }
+/** MCP 的 structuredContent 必须是对象（规范用 `z.record`）：数组与标量不适用 */
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /** 注册端：在页面 MCP server 上一行声明动态技能（prompt + resources + tools） */
 async function serveSkillAsMcp(server, skill) {
 	server.registerPrompt(skill.name, { description: skill.description }, async () => ({ messages: [{
@@ -372,13 +405,18 @@ async function serveSkillAsMcp(server, skill) {
 		description: tool.description ?? "",
 		...tool.inputSchema ? { inputSchema: (await loadFromJSONSchema())(tool.inputSchema) } : {}
 	}, async (args) => {
-		return { content: normalizeToolContent(await tool.handler(args ?? {})).map((item) => item.type === "text" ? {
+		const value = await tool.handler(args ?? {});
+		const content = normalizeToolContent(value).map((item) => item.type === "text" ? {
 			type: "text",
 			text: item.text ?? ""
 		} : {
 			type: "text",
 			text: JSON.stringify(item.data ?? null)
-		}) };
+		});
+		return isPlainObject(value) ? {
+			content,
+			structuredContent: value
+		} : { content };
 	});
 }
 /**
@@ -394,6 +432,14 @@ const failure = (code, message) => ({
 		message
 	}
 });
+/**
+* `executeTool` 按 MCP 规范返回 `{ content: [...] }`，但也有页面直接返回分片数组或裸值。
+* 先解包 `content` 再归一——不解包的话规范形状会被整体序列化成一段 JSON 文本，
+* 模型读到的不是工具答案而是一层信封。与 McpToolResolver 同一口径。
+*/
+function unwrapToolContent(raw) {
+	return normalizeToolContent((typeof raw === "object" && raw !== null ? raw.content : void 0) ?? raw);
+}
 /** getTools() 返回的工具 → 描述符：inputSchema 为 JSON 字符串时解析为对象，并保留原始对象 */
 function toDescriptor(raw) {
 	if (typeof raw !== "object" || raw === null) return void 0;
@@ -437,9 +483,19 @@ function extractToolDescriptors(raw) {
 var ExperimentalWebMcpAdapter = class {
 	#resolveApi;
 	#enabled;
+	/**
+	* 多来源时的消歧标识（分册 26 FR-26.2）。不设即沿用 0.10.0 的旧工具名，
+	* 单来源宿主无感；**两个以上来源必须各自设**，否则同名工具会撞车。
+	*/
+	sourceId;
 	constructor(api, options) {
 		this.#resolveApi = typeof api === "function" ? api : () => api;
 		this.#enabled = options?.enabled ?? false;
+		if (options?.sourceId !== void 0) {
+			if (!/^[a-zA-Z0-9-]+$/.test(options.sourceId)) throw new WebSkillError("VALIDATION_FAILED", `WebMCP sourceId "${options.sourceId}" may only contain letters, digits and hyphens.`);
+			if (options.sourceId.length > 24) throw new WebSkillError("VALIDATION_FAILED", `WebMCP sourceId "${options.sourceId}" is longer than 24 characters; it is prefixed onto every tool name and therefore costs tokens on every request.`);
+			this.sourceId = options.sourceId;
+		}
 	}
 	/**
 	* 宿主能力检测（FR-19.2/19.4）：**只**看 `document.modelContext.executeTool` 是否存在，
@@ -486,7 +542,7 @@ var ExperimentalWebMcpAdapter = class {
 			const tool = match?.raw ?? { name: toolName };
 			return {
 				ok: true,
-				content: normalizeToolContent(await api.executeTool(tool, argsJson))
+				content: unwrapToolContent(await api.executeTool(tool, argsJson))
 			};
 		} catch (e) {
 			return failure("TOOL_EXECUTION_FAILED", `WebMCP tool "${toolName}" failed: ${messageOf(e)}`);
@@ -494,7 +550,7 @@ var ExperimentalWebMcpAdapter = class {
 		try {
 			return {
 				ok: true,
-				content: normalizeToolContent(await api.executeTool(toolName, argsJson))
+				content: unwrapToolContent(await api.executeTool(toolName, argsJson))
 			};
 		} catch (e) {
 			return failure("TOOL_EXECUTION_FAILED", `WebMCP tool "${toolName}" failed: ${messageOf(e)}`);
@@ -517,15 +573,22 @@ var McpRuntimePlugin = class {
 	kind = "mcp";
 	#registry;
 	#resolver;
+	/**
+	* 多来源（分册 26 FR-26.1）：**不做聚合适配器**。
+	* 聚合会让「部分来源可用」无法回答，把 0.9.0 刚理清的
+	* 「不支持 / 未启用」二分重新搅浑。这里逐个问，不合并成一个布尔。
+	*/
 	#webMcp;
 	#visibility;
+	#trust;
 	#configuredEndpoints;
 	#onWarning;
 	constructor(deps) {
 		this.#registry = deps.registry;
 		this.#resolver = deps.resolver ?? new McpToolResolver(deps.registry);
-		this.#webMcp = deps.webMcp;
+		this.#webMcp = deps.webMcp ?? [];
 		this.#visibility = deps.visibility;
+		this.#trust = deps.trust;
 		this.#configuredEndpoints = deps.endpoints ?? [];
 		this.#onWarning = deps.onWarning ?? ((message) => console.warn(message));
 	}
@@ -549,6 +612,40 @@ var McpRuntimePlugin = class {
 			return true;
 		}
 	}
+	/**
+	* 信任回调统一求值。**刻意不复用 `#visible()`**：两者的失败代价不对称。
+	* 可见性判不出来最坏是工具从列表里消失；信任判不出来而放行，落盘的就是明文。
+	* 因此这里缺省 false、异常也按 false，并同样走 onWarning。
+	*/
+	#trusted(probe) {
+		try {
+			return probe() === true;
+		} catch (e) {
+			this.#onWarning(`[webskill] MCP trust callback failed; treating the source as untrusted: ${e instanceof Error ? e.message : String(e)}`);
+			return false;
+		}
+	}
+	/**
+	* 参数留存的信任判定（分册 30 / FR-30.6）。
+	* 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+	*/
+	argCaptureTrust(llmToolName) {
+		const parsed = parseWebMcpToolLlmName(llmToolName, this.#sourceIds());
+		if (parsed !== void 0) {
+			if (!this.#trusted(() => this.#trust?.isWebMcpSourceTrusted?.(parsed.sourceId))) return void 0;
+			return {
+				tier: "host-trusted",
+				declaredBy: `webmcp:${parsed.sourceId ?? ""}`
+			};
+		}
+		const endpoint = this.#endpoints().find((name) => parseEndpointToolLlmName(name, llmToolName) !== void 0);
+		if (endpoint === void 0) return void 0;
+		if (!this.#trusted(() => this.#trust?.isEndpointTrusted?.(endpoint))) return void 0;
+		return {
+			tier: "host-trusted",
+			declaredBy: endpoint
+		};
+	}
 	async listToolSpecs() {
 		const specs = [];
 		for (const endpoint of this.#endpoints()) {
@@ -570,12 +667,13 @@ var McpRuntimePlugin = class {
 				this.#onWarning(`[webskill] MCP endpoint "${endpoint}" is unavailable; its tools are omitted from this turn: ${e instanceof Error ? e.message : String(e)}`);
 			}
 		}
-		if (this.#webMcp?.isEnabled()) {
-			const tools = await this.#webMcp.listTools();
+		for (const source of this.#webMcp) {
+			if (!source.isEnabled()) continue;
+			const tools = await source.listTools();
 			for (const tool of tools ?? []) {
-				if (!this.#visible(() => this.#visibility?.isWebMcpToolEnabled?.(tool.name))) continue;
+				if (!this.#visible(() => this.#visibility?.isWebMcpToolEnabled?.(tool.name, source.sourceId))) continue;
 				specs.push({
-					name: webMcpToolLlmName(tool.name),
+					name: webMcpToolLlmName(tool.name, source.sourceId),
 					description: tool.description ?? `[webmcp] ${tool.name}`,
 					inputSchema: typeof tool.inputSchema === "object" && tool.inputSchema !== null ? tool.inputSchema : {
 						type: "object",
@@ -586,14 +684,19 @@ var McpRuntimePlugin = class {
 		}
 		return specs;
 	}
+	/** 已知来源标识；解析工具名时用它切分，避免把工具名里的 `__` 当成来源分隔 */
+	#sourceIds() {
+		return this.#webMcp.map((source) => source.sourceId).filter((id) => id !== void 0);
+	}
 	canHandle(llmToolName) {
-		if (parseWebMcpToolLlmName(llmToolName) !== void 0) return true;
+		if (parseWebMcpToolLlmName(llmToolName, this.#sourceIds()) !== void 0) return true;
 		return this.#endpoints().some((endpoint) => parseEndpointToolLlmName(endpoint, llmToolName) !== void 0);
 	}
 	async call(llmToolName, args) {
-		const webMcpTool = parseWebMcpToolLlmName(llmToolName);
-		if (webMcpTool !== void 0) {
-			if (!this.#webMcp) return {
+		const parsed = parseWebMcpToolLlmName(llmToolName, this.#sourceIds());
+		if (parsed !== void 0) {
+			const source = parsed.sourceId === void 0 ? this.#webMcp.find((candidate) => candidate.sourceId === void 0) : this.#webMcp.find((candidate) => candidate.sourceId === parsed.sourceId);
+			if (source === void 0) return {
 				ok: false,
 				content: [],
 				error: {
@@ -601,8 +704,8 @@ var McpRuntimePlugin = class {
 					message: "WebMCP adapter is not configured"
 				}
 			};
-			if (!this.#visible(() => this.#visibility?.isWebMcpToolEnabled?.(webMcpTool))) return disabledResult(llmToolName);
-			return this.#webMcp.call(webMcpTool, args);
+			if (!this.#visible(() => this.#visibility?.isWebMcpToolEnabled?.(parsed.toolName, source.sourceId))) return disabledResult(llmToolName);
+			return source.call(parsed.toolName, args);
 		}
 		for (const endpoint of this.#endpoints()) {
 			const toolName = parseEndpointToolLlmName(endpoint, llmToolName);
@@ -893,4 +996,4 @@ async function connectRemoteEndpoint(registry, config) {
 }
 
 //#endregion
-export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, TemporarySkillProvider, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, TemporarySkillProvider, WEB_MCP_SOURCE_ID_MAX, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/node.d.ts

@@ -1,6 +1,6 @@
-import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-CrRcT-LM-DZAp8sWv.js";
-import { Dt as ScriptExecutor, Et as ScriptExecutionContext, Jt as ToolDefinition, M as FsMemoryStore, Tt as SchemaInferer, Xt as ToolResult, Y as NetworkPolicy, _ as BridgeCapabilities, bn as createScriptContext, f as ApprovalScope, hn as WebSkillRuntimeDeps, j as FsArtifactStore, mn as WebSkillRuntime } from "./index-DtFdMKBX.js";
-import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-DBsYYCWn.js";
+import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-DLctJep_-B5G4uk2u.js";
+import { Bn as createScriptContext, Bt as ScriptExecutionContext, Fn as WebSkillRuntimeDeps, L as FsArtifactStore, Pn as WebSkillRuntime, R as FsMemoryStore, Vt as ScriptExecutor, dn as ToolResult, it as NetworkPolicy, ln as ToolDefinition, m as ApprovalScope, y as BridgeCapabilities, zt as SchemaInferer } from "./index-C9pzXLKy.js";
+import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-DheTIwAB.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-AK3cSMEA-Dli6QU5E.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts

package/dist/node.js

@@ -1,7 +1,7 @@
 import { B as resolveArchiveLimits, D as exportSkills, F as parseSkillPackManifest, G as unzipWithLimits, I as readResponseWithLimit, J as verifySkillSignature, K as validateSkills, L as readSkillSignature, M as messageOf, O as isAtomicTempPath, P as parseSkillMarkdown, V as resolveInsideRoot, _ as assertSafePathSegment, b as buildManifest, c as SKILL_MANIFEST_FILE, d as SKILL_PACK_FILE, g as assertRemoteUrlAllowed, h as WebSkillError, i as MANIFEST_EXCLUDED_FILES, k as isValidSkillName, q as verifyManifest, s as SKILLS_LOCKFILE, v as atomicWriteText } from "./dist-Bev6i6Ip.js";
-import { B as bridgeError, H as createScriptContext, L as WebSkillRuntime, c as CapabilityApproval, dt as parseBridgeRequest, h as FsMemoryStore, lt as normalizeToolContent, m as FsArtifactStore, ot as networkPolicyLibSource, ut as normalizeToolError } from "./dist-BViUeszk.js";
+import { $ as bridgeError, Ct as normalizeToolError, St as normalizeToolContent, X as WebSkillRuntime, b as FsMemoryStore, tt as createScriptContext, u as CapabilityApproval, wt as parseBridgeRequest, y as FsArtifactStore, yt as networkPolicyLibSource } from "./dist-sdKFgERo.js";
 import { i as probeLlmCapabilities } from "./env-8cY40DXB-CGnEVZby.js";
-import { t as AUDIT_EVENT_TYPES } from "./eventTypes-s2uwAcLG-Go3l_dUe.js";
+import { t as AUDIT_EVENT_TYPES } from "./eventTypes-FllCrX-Z-DNDeHWoG.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -336,6 +336,8 @@ var SandboxedScriptExecutor = class {
 		this.#options = options;
 		this.#capabilities = {
 			readReference: options.capabilities?.readReference ?? true,
+			readAsset: options.capabilities?.readAsset ?? true,
+			fetchData: options.capabilities?.fetchData ?? false,
 			writeArtifact: options.capabilities?.writeArtifact ?? true,
 			confirm: options.capabilities?.confirm ?? true
 		};
@@ -509,6 +511,29 @@ var SandboxedScriptExecutor = class {
 						value: await context.readReference(request.path)
 					};
 				}
+				case "readAsset":
+				case "readAssetBinary": {
+					const read = request.kind === "readAsset" ? context.readAsset : context.readAssetBinary;
+					if (!read) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"readAsset\" is disabled");
+					const denied = await gate("readAsset", `Script "${context.skillName}" wants to read asset "${request.path}"`, { path: request.path });
+					if (denied) return denied;
+					const value = await read(request.path);
+					return {
+						id: request.id,
+						ok: true,
+						value: typeof value === "string" ? value : Array.from(value)
+					};
+				}
+				case "fetchData": {
+					if (!context.fetchData) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"fetchData\" is disabled");
+					const denied = await gate("fetchData", `Script "${context.skillName}" wants to fetch data source "${request.sourceId}"`, { sourceId: request.sourceId });
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.fetchData(request.sourceId, request.params)
+					};
+				}
 				case "writeArtifact": {
 					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
 						path: request.path,
@@ -516,7 +541,10 @@ var SandboxedScriptExecutor = class {
 					});
 					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
-					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					const artifact = await context.writeArtifact(request.path, content, {
+						...request.mimeType ? { mimeType: request.mimeType } : {},
+						...request.metadata === void 0 ? {} : { metadata: request.metadata }
+					});
 					return {
 						id: request.id,
 						ok: true,
@@ -578,6 +606,8 @@ var ProcessSandboxExecutor = class {
 		this.#options = options;
 		this.#capabilities = {
 			readReference: options.capabilities?.readReference ?? true,
+			readAsset: options.capabilities?.readAsset ?? true,
+			fetchData: options.capabilities?.fetchData ?? false,
 			writeArtifact: options.capabilities?.writeArtifact ?? true,
 			confirm: options.capabilities?.confirm ?? true
 		};
@@ -858,6 +888,29 @@ var ProcessSandboxExecutor = class {
 						value: await context.readReference(request.path)
 					};
 				}
+				case "readAsset":
+				case "readAssetBinary": {
+					const read = request.kind === "readAsset" ? context.readAsset : context.readAssetBinary;
+					if (!read) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"readAsset\" is disabled");
+					const denied = await gate("readAsset", `Script "${context.skillName}" wants to read asset "${request.path}"`, { path: request.path });
+					if (denied) return denied;
+					const value = await read(request.path);
+					return {
+						id: request.id,
+						ok: true,
+						value: typeof value === "string" ? value : Array.from(value)
+					};
+				}
+				case "fetchData": {
+					if (!context.fetchData) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"fetchData\" is disabled");
+					const denied = await gate("fetchData", `Script "${context.skillName}" wants to fetch data source "${request.sourceId}"`, { sourceId: request.sourceId });
+					if (denied) return denied;
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.fetchData(request.sourceId, request.params)
+					};
+				}
 				case "writeArtifact": {
 					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
 						path: request.path,
@@ -865,7 +918,10 @@ var ProcessSandboxExecutor = class {
 					});
 					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
-					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					const artifact = await context.writeArtifact(request.path, content, {
+						...request.mimeType ? { mimeType: request.mimeType } : {},
+						...request.metadata === void 0 ? {} : { metadata: request.metadata }
+					});
 					return {
 						id: request.id,
 						ok: true,

package/dist/{openUiLibrary-CIrV--Ad-B8zG_91e.js → openUiLibrary-BKXW7Iwx-DaymVubt.js}

@@ -1,5 +1,5 @@
-import { ft as uiCatalog } from "./dist-1OFC-zax.js";
-import { t as CatalogNode } from "./catalogComponents-DTcYfpLQ-CcoOaz-Z.js";
+import { Dt as uiCatalog } from "./dist-DqcL6jKO.js";
+import { t as CatalogNode } from "./catalogComponents-BgAJN0p8-C3K8klJd.js";
 import { z } from "zod";
 import { Component, Fragment, createContext, useCallback, useContext, useEffect, useInsertionEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
@@ -3761,7 +3761,7 @@ function Renderer({ response, library, isStreaming = false, onAction, onStateUpd
 const FormValidationContext = createContext(null);
 
 //#endregion
-//#region ../ui-react/dist/openUiLibrary-CIrV--Ad.js
+//#region ../ui-react/dist/openUiLibrary-BKXW7Iwx.js
 const propsFor = (props, container) => container ? props.extend({ children: z.array(z.any()).optional() }) : props;
 /**
 * catalog 的 OpenUI 投影：`defineComponent` 复用同一份 zod schema 与描述，

package/dist/processSandboxEntry.js

@@ -165,10 +165,17 @@ async function main(task) {
 			skillName: task.skillName ?? "",
 			runId: task.runId ?? "",
 			readReference: (path) => callCapability("readReference", { path }),
+			readAsset: (path) => callCapability("readAsset", { path }),
+			fetchData: (sourceId, params) => callCapability("fetchData", {
+				sourceId,
+				params
+			}),
+			readAssetBinary: async (path) => new Uint8Array(await callCapability("readAssetBinary", { path })),
 			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
 				path,
 				content: typeof content === "string" ? content : Array.from(content ?? []),
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				metadata: options?.metadata
 			}),
 			confirm: (message) => callCapability("confirm", { message })
 		};

package/dist/sandboxWorkerEntry.js

@@ -226,10 +226,17 @@ async function main() {
 			skillName: task.skillName ?? "",
 			runId: task.runId ?? "",
 			readReference: (path) => callCapability("readReference", { path }),
+			readAsset: (path) => callCapability("readAsset", { path }),
+			fetchData: (sourceId, params) => callCapability("fetchData", {
+				sourceId,
+				params
+			}),
+			readAssetBinary: async (path) => new Uint8Array(await callCapability("readAssetBinary", { path })),
 			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
 				path,
 				content: typeof content === "string" ? content : Array.from(content ?? []),
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				metadata: options?.metadata
 			}),
 			confirm: (message) => callCapability("confirm", { message })
 		};

package/dist/{skillVersionStore-D-qHk9ZE-DBsYYCWn.d.ts → skillVersionStore-D-qHk9ZE-DheTIwAB.d.ts}

@@ -1,4 +1,4 @@
-import { R as FileSystemProvider, U as Page, W as PageQuery, dt as SkillManifest, it as SkillCatalogEntry } from "./types-CrRcT-LM-DZAp8sWv.js";
+import { R as FileSystemProvider, U as Page, W as PageQuery, dt as SkillManifest, it as SkillCatalogEntry } from "./types-DLctJep_-B5G4uk2u.js";
 //#region ../governance/dist/skillVersionStore-D-qHk9ZE.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { S as UiBridge, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, v as MemoryStore } from "./types-CrRcT-LM-DZAp8sWv.js";
+import { S as UiBridge, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, v as MemoryStore } from "./types-DLctJep_-B5G4uk2u.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-AK3cSMEA-Dli6QU5E.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/{types-CrRcT-LM-DZAp8sWv.d.ts → types-DLctJep_-B5G4uk2u.d.ts}

@@ -2,7 +2,15 @@
 //#region src/errors.d.ts
 type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'SKILL_MANIFEST_PROTECTED' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_NOT_ALLOWED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'TOOL_RESOLUTION_EXHAUSTED' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' |
 /** 历史里有未应答的工具调用，但当初为何中断已无从得知（分册 11 读取侧补齐） */
-'RUN_INTERRUPTED' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'SKILL_UNKNOWN_ALLOWED_TOOL' | 'SKILL_UNKNOWN_DEPENDENCY' | 'SKILL_CIRCULAR_DEPENDENCY' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE' | 'RUN_SNAPSHOT_SCHEMA_UNSUPPORTED' | 'RUN_TRACE_INCOMPATIBLE' | 'SESSION_INCOMPATIBLE' | 'SIGNATURE_MISSING' | 'SIGNATURE_MALFORMED' | 'SIGNATURE_UNTRUSTED_KEY' | 'SIGNATURE_MISMATCH' | 'SIGNATURE_UNSUPPORTED' | 'MCP_STDIO_SPAWN_FAILED' | 'MCP_STDIO_EXITED' | 'MCP_STDIO_TIMEOUT' | 'MCP_OAUTH_REQUIRED' | 'MCP_OAUTH_FAILED' | 'MCP_OAUTH_NOT_CONFIGURED' | 'PAGE_ACTION_OUT_OF_SCOPE' | 'PAGE_ACTION_STALE_REF' | 'PAGE_ACTION_DECLINED' | 'TS_RESOURCE_URL_REJECTED' | 'TS_TRANSPILER_UNAVAILABLE' | 'TS_TRANSPILE_FAILED' | 'TODO_LIST_INVALID' | 'TODO_ITEM_NOT_FOUND' | 'SKILL_GENERATION_DISABLED' | 'SKILL_GENERATION_LIMIT_EXCEEDED' | 'SKILL_GENERATION_VALIDATION_FAILED' | 'DELEGATION_UNAVAILABLE' | 'DELEGATION_IN_PROGRESS' | 'DELEGATION_BUDGET_EXCEEDED' | 'PROFILE_IMPORT_INVALID' | 'PROFILE_IMPORT_VERSION_UNSUPPORTED' | 'PROFILE_IMPORT_CREDENTIAL_REJECTED' | 'PROFILE_KEY_UNAVAILABLE' | 'DICTATION_UNAVAILABLE' | 'DICTATION_PERMISSION_DENIED' | 'DICTATION_FAILED' | 'PERCEPTION_NOT_ENABLED' | 'PERCEPTION_FAILED' | 'MODEL_IMAGE_UNSUPPORTED' | 'MODEL_TOOLS_UNSUPPORTED' | 'ATTACHMENT_TOO_LARGE' | 'ATTACHMENT_TYPE_REJECTED';
+'RUN_INTERRUPTED' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'SKILL_UNKNOWN_ALLOWED_TOOL' | 'SKILL_UNKNOWN_DEPENDENCY' | 'SKILL_CIRCULAR_DEPENDENCY' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE' | 'RUN_SNAPSHOT_SCHEMA_UNSUPPORTED' | 'RUN_TRACE_INCOMPATIBLE' | 'SESSION_INCOMPATIBLE' | 'SIGNATURE_MISSING' | 'SIGNATURE_MALFORMED' | 'SIGNATURE_UNTRUSTED_KEY' | 'SIGNATURE_MISMATCH' | 'SIGNATURE_UNSUPPORTED' | 'MCP_STDIO_SPAWN_FAILED' | 'MCP_STDIO_EXITED' | 'MCP_STDIO_TIMEOUT' | 'MCP_OAUTH_REQUIRED' | 'MCP_OAUTH_FAILED' | 'MCP_OAUTH_NOT_CONFIGURED' | 'PAGE_ACTION_OUT_OF_SCOPE' | 'PAGE_ACTION_STALE_REF' | 'PAGE_ACTION_DECLINED' |
+/** 0.11.0 分册 18：用户拒绝把数据交给文档投放面 */
+'DOCUMENT_SURFACE_DECLINED' |
+/** 0.11.0 分册 18：viewer 未在期限内回报就绪（路由挂了 / 外壳脚本没跑起来） */
+'DOCUMENT_SURFACE_UNAVAILABLE' | 'TS_RESOURCE_URL_REJECTED' | 'TS_TRANSPILER_UNAVAILABLE' | 'TS_TRANSPILE_FAILED' | 'TODO_LIST_INVALID' | 'TODO_ITEM_NOT_FOUND' | 'SKILL_GENERATION_DISABLED' | 'SKILL_GENERATION_LIMIT_EXCEEDED' | 'SKILL_GENERATION_VALIDATION_FAILED' | 'DELEGATION_UNAVAILABLE' | 'DELEGATION_IN_PROGRESS' | 'DELEGATION_BUDGET_EXCEEDED' | 'PROFILE_IMPORT_INVALID' | 'PROFILE_IMPORT_VERSION_UNSUPPORTED' | 'PROFILE_IMPORT_CREDENTIAL_REJECTED' | 'PROFILE_KEY_UNAVAILABLE' | 'DICTATION_UNAVAILABLE' | 'DICTATION_PERMISSION_DENIED' | 'DICTATION_FAILED' | 'PERCEPTION_NOT_ENABLED' | 'PERCEPTION_FAILED' | 'MODEL_IMAGE_UNSUPPORTED' | 'MODEL_DOCUMENT_UNSUPPORTED' | 'MODEL_TOOLS_UNSUPPORTED' | 'ATTACHMENT_TOO_LARGE' | 'ATTACHMENT_TYPE_REJECTED' |
+/** 脚本取了宿主未声明的数据源；拒绝发生在发出任何请求之前（0.11.0 分册 16） */
+'DATA_SOURCE_NOT_FOUND' |
+/** 取数结果超预算。与 ATTACHMENT_TOO_LARGE 同口径：拒绝而不截断 */
+'DATA_SOURCE_TOO_LARGE';
 /**
  * 所有公开 API 抛出的结构化错误，code 供上层可编程处理
  * @stable
@@ -629,7 +637,7 @@ declare function escapeXml(text: string): string;
 declare function renderAvailableSkillsXml(catalog: SkillCatalog): string;
 declare const xmlRenderer: CatalogRenderer;
 //#endregion
-//#region ../runtime/dist/types-CrRcT-LM.d.ts
+//#region ../runtime/dist/types-DLctJep_.d.ts
 //#region src/llm/streamTypes.d.ts
 /** 流式 LLM 事件（OpenAI SSE / Vercel fullStream 统一映射） */
 type LlmStreamEvent = {
@@ -696,6 +704,14 @@ interface LlmToolCall {
   arguments: Record<string, unknown>;
   /** 流式拼接后的 arguments 不是合法 JSON 时的错误描述；设置时 arguments 不可信 */
   argumentsParseError?: string;
+  /**
+   * 供应商自己的不透明随车数据，原样回放给**同一家**供应商。
+   *
+   * Gemini 的 thinking 模型会随 `functionCall` 下发 `thoughtSignature`，
+   * 下一轮不带回去就直接 400——丢掉它的后果是多轮工具调用整条链跑不通（UI-UX8 D5）。
+   * 内容对引擎不透明，也不得跨供应商传递。
+   */
+  vendor?: Record<string, unknown>;
 }
 /**
  * 一次模型调用的 token 用量（0.10.0 UI-UX5 #47）。
@@ -842,7 +858,7 @@ type InteractionRequest = {
    */
   type: 'authorize';
   id: string;
-  capability: 'readReference' | 'writeArtifact' | 'confirm' | 'pageAction';
+  capability: 'readReference' | 'readAsset' | 'writeArtifact' | 'confirm' | 'fetchData' | 'pageAction' | 'readLinkedDocument';
   message: string;
   details?: unknown;
 });
@@ -863,7 +879,8 @@ interface InteractionSuggestion {
 }
 /** 图表规格（$chart 约定的校验后形态；渲染单一来源在 ui/chart/miniChart） */
 interface ChartSpec {
-  kind: 'bar' | 'line' | 'pie';
+  /** 取值与 catalog `Chart` 的 props 枚举逐字一致（`ui/catalog/uiCatalog.ts`） */
+  kind: 'bar' | 'line' | 'area' | 'pie' | 'scatter' | 'stacked-bar' | 'dual-axis';
   title?: string;
   labels: string[];
   series: Array<{
@@ -1008,7 +1025,7 @@ interface FormField {
   name: string;
   label: string;
   /** `password` 的值不进 paramHistory、不进行为记录、不落会话（FR-23.7） */
-  type: 'text' | 'number' | 'boolean' | 'select' | 'textarea' | 'file' | 'password';
+  type: 'text' | 'number' | 'boolean' | 'select' | 'textarea' | 'file' | 'password' | 'date';
   required?: boolean;
   description?: string;
   defaultValue?: unknown;