@webskill/sdk 0.11.0 → 0.12.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { A as jsonRenderer, B as resolveArchiveLimits, C as computeDigest, D as exportSkills, E as escapeXml, F as parseSkillPackManifest, G as unzipWithLimits, H as signSkill, I as readResponseWithLimit, J as verifySkillSignature, K as validateSkills, L as readSkillSignature, M as messageOf, N as normalizePath, O as isAtomicTempPath, P as parseSkillMarkdown, R as renderAvailableSkillsXml, S as checkSkillRules, T as detectSkillArchiveShapeFromFs, U as signaturePayloadBytes, V as resolveInsideRoot, W as stripArchiveRoot, Y as xmlRenderer, _ as assertSafePathSegment, a as MemoryFS, b as buildManifest, c as SKILL_MANIFEST_FILE, d as SKILL_PACK_FILE, f as SKILL_SIGNATURE_FILE, g as assertRemoteUrlAllowed, h as WebSkillError, i as MANIFEST_EXCLUDED_FILES, j as keyIdOf, k as isValidSkillName, l as SKILL_NAME_MAX_LENGTH, m as SkillReader, n as DEFAULT_ARCHIVE_LIMITS, o as SIGNATURE_SCHEMA_VERSION, p as SkillDiscovery, q as verifyManifest, r as FsTrustedKeyStore, s as SKILLS_LOCKFILE, t as ATOMIC_TMP_SUFFIX_PATTERN, u as SKILL_NAME_PATTERN, v as atomicWriteText, w as detectSkillArchiveShape, x as checkDependencyCycles, y as buildCatalog, z as renderCatalogJson } from "./dist-Bev6i6Ip.js";
 import { a as textParts, n as partsToText } from "./memoryArtifactStore-52Zn9npI-LbCQaqyx.js";
-import { $ as createWebSkillApi, A as READ_LINKED_DOCUMENT_TOOL_NAME, At as schemaSourceLabel, B as TraceRecorder, Bt as validateUiSpecNode, C as FsSessionStore, Ct as readBehaviorRecords, D as OpenAiCompatibleClient, Dt as renderUserProfileContext, E as HookRunner, Et as refineUserProfile, F as RUN_TRACE_SCHEMA_VERSION, Ft as summarizeToolCalls, G as USER_PROFILE_PROMPT_HEADER, H as USER_PROFILE_EXPORT_VERSION, I as SESSION_SCHEMA_VERSION, It as toLlmToolSpec, J as appendBehaviorRecords, K as USER_PROFILE_REFINE_PROMPT, L as SUPPORTED_DOCUMENT_MIME, Lt as toRecordDigests, M as READ_SKILL_FILE_TOOL, Mt as scriptToolName, N as READ_SKILL_FILE_TOOL_NAME, Nt as sealToolCallPairs, O as ProgressiveRouter, Ot as resolveToolName, P as RUN_SNAPSHOT_SCHEMA_VERSION, Pt as summarizeRunUsage, Q as createScriptContext, R as SerializingMemoryStore, Rt as toVercelToolSpecs, S as FsRunTraceStore, St as parseUserProfileExport, T as GoogleGenAiClient, Tt as readUserProfile, U as USER_PROFILE_KEY, V as UNSUPPORTED_DOCUMENT_MESSAGE, W as USER_PROFILE_NO_INVENTION_RULE, X as bridgeError, Y as applyUserProfileImport, Z as buildRenderResult, _ as EventBus, _t as networkUrlHost, a as ASK_USER_TOOL, at as extractUiSpecEvents, b as FsMemoryStore, bt as normalizeToolError, c as AnthropicClient, ct as fromVercelResult, d as DEFAULT_LOOP_LIMITS, dt as isNetworkAllowed, et as diffUserProfile, f as DEFAULT_MAX_DATA_SOURCE_BYTES, ft as isUnsupportedRunSnapshot, g as EMPTY_USER_PROFILE, gt as networkPolicyLibSource, h as DEFAULT_USER_PROFILE_LIMITS, ht as mergeProfileEntries, i as ASK_USER_MAX_FIELDS, it as extractTodoTraceEvents, j as READ_SKILL_FILE_INPUT_SCHEMA, jt as schemaToForm, k as READ_LINKED_DOCUMENT_TOOL, kt as sampleBehaviorRecords, l as BEHAVIOR_RECORDS_KEY, lt as fromVercelStreamPart, m as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, mt as mergeCatalogEntries, n as ASK_USER_FIELD_TYPES, nt as extractChartSpec, o as ASK_USER_TOOL_NAME, ot as findUnpairedToolCalls, p as DEFAULT_MAX_DOCUMENT_BYTES, pt as listSkillScripts, q as WebSkillRuntime, r as ASK_USER_INPUT_SCHEMA, rt as extractSkillCandidate, s as AgentLoop, st as formatSkillScriptManifest, t as ALLOWED_TOOLS_EXCLUSION_REASON, tt as exportUserProfile, u as CapabilityApproval, ut as interruptedToolResult, v as FS_SESSION_PAGE_SIZE, vt as normalizeErrorCode, w as FullDisclosureRouter, wt as readProfileEntries, x as FsRunSnapshotStore, xt as parseBridgeRequest, y as FsArtifactStore, yt as normalizeToolContent, z as TEXT_BUDGETED_CONTENT_TYPES, zt as validateUiSpecEvent } from "./dist-B-cOu08W.js";
+import { $ as bridgeError, A as ProgressiveRouter, At as refineUserProfile, B as SUPPORTED_DOCUMENT_MIME, Bt as toLlmToolSpec, C as FsSessionStore, Ct as normalizeToolError, D as HookRunner, Dt as readProfileEntries, E as GoogleGenAiClient, Et as readBehaviorRecords, F as READ_SKILL_FILE_TOOL_NAME, Ft as schemaToForm, G as USER_PROFILE_EXPORT_VERSION, H as TEXT_BUDGETED_CONTENT_TYPES, Ht as toVercelToolSpecs, I as RUN_SNAPSHOT_SCHEMA_VERSION, It as scriptToolName, J as USER_PROFILE_PROMPT_HEADER, K as USER_PROFILE_KEY, L as RUN_TRACE_SCHEMA_VERSION, Lt as sealToolCallPairs, M as READ_LINKED_DOCUMENT_TOOL_NAME, Mt as resolveToolName, N as READ_SKILL_FILE_INPUT_SCHEMA, Nt as sampleBehaviorRecords, O as MAX_TOOL_STEP_ARG_BYTES, Ot as readUserProfile, P as READ_SKILL_FILE_TOOL, Pt as schemaSourceLabel, Q as applyUserProfileImport, R as SENSITIVE_ANNOTATION, Rt as summarizeRunUsage, S as FsRunTraceStore, St as normalizeToolContent, T as FullDisclosureRouter, Tt as parseUserProfileExport, U as TraceRecorder, Ut as validateUiSpecEvent, V as SerializingMemoryStore, Vt as toRecordDigests, W as UNSUPPORTED_DOCUMENT_MESSAGE, Wt as validateUiSpecNode, X as WebSkillRuntime, Y as USER_PROFILE_REFINE_PROMPT, Z as appendBehaviorRecords, _ as EventBus, _t as mergeCatalogEntries, a as ASK_USER_TOOL, at as extractChartSpec, b as FsMemoryStore, bt as networkUrlHost, c as AnthropicClient, ct as extractUiSpecEvents, d as DEFAULT_LOOP_LIMITS, dt as fromVercelResult, et as buildRenderResult, f as DEFAULT_MAX_DATA_SOURCE_BYTES, ft as fromVercelStreamPart, g as EMPTY_USER_PROFILE, gt as listSkillScripts, h as DEFAULT_USER_PROFILE_LIMITS, ht as isUnsupportedRunSnapshot, i as ASK_USER_MAX_FIELDS, it as exportUserProfile, j as READ_LINKED_DOCUMENT_TOOL, jt as renderUserProfileContext, k as OpenAiCompatibleClient, kt as redactToolStepArgs, l as BEHAVIOR_RECORDS_KEY, lt as findUnpairedToolCalls, m as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, mt as isNetworkAllowed, n as ASK_USER_FIELD_TYPES, nt as createWebSkillApi, o as ASK_USER_TOOL_NAME, ot as extractSkillCandidate, p as DEFAULT_MAX_DOCUMENT_BYTES, pt as interruptedToolResult, q as USER_PROFILE_NO_INVENTION_RULE, r as ASK_USER_INPUT_SCHEMA, rt as diffUserProfile, s as AgentLoop, st as extractTodoTraceEvents, t as ALLOWED_TOOLS_EXCLUSION_REASON, tt as createScriptContext, u as CapabilityApproval, ut as formatSkillScriptManifest, v as FS_SESSION_PAGE_SIZE, vt as mergeProfileEntries, w as FsToolStepStore, wt as parseBridgeRequest, x as FsRunSnapshotStore, xt as normalizeErrorCode, y as FsArtifactStore, yt as networkPolicyLibSource, z as SESSION_SCHEMA_VERSION, zt as summarizeToolCalls } from "./dist-sdKFgERo.js";
 
 //#region src/version.ts
 /** Generated by scripts/syncVersionConstant.mjs from packages/sdk/package.json. Do not edit by hand. */
@@ -11,4 +11,4 @@ import { $ as createWebSkillApi, A as READ_LINKED_DOCUMENT_TOOL_NAME, At as sche
 const SDK_VERSION = "0.11.0";
 
 //#endregion
-export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, AgentLoop, AnthropicClient, BEHAVIOR_RECORDS_KEY, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, EMPTY_USER_PROFILE, EventBus, FS_SESSION_PAGE_SIZE, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MANIFEST_EXCLUDED_FILES, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, SDK_VERSION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, SkillReader, TEXT_BUDGETED_CONTENT_TYPES, TraceRecorder, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, WebSkillError, WebSkillRuntime, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };
+export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, AgentLoop, AnthropicClient, BEHAVIOR_RECORDS_KEY, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, EMPTY_USER_PROFILE, EventBus, FS_SESSION_PAGE_SIZE, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MANIFEST_EXCLUDED_FILES, MAX_TOOL_STEP_ARG_BYTES, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, SDK_VERSION, SENSITIVE_ANNOTATION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, SkillReader, TEXT_BUDGETED_CONTENT_TYPES, TraceRecorder, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, WebSkillError, WebSkillRuntime, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, redactToolStepArgs, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-C26b05fW-CdrRCRDb.js";
-import { F as ExternalToolSource, P as ExternalSkillProvider, qn as mergeCatalogEntries, sn as ToolResult } from "./index-D3mONFHD.js";
+import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-DLctJep_-B5G4uk2u.js";
+import { F as ExternalToolSource, P as ExternalSkillProvider, dn as ToolResult, tr as mergeCatalogEntries } from "./index-C9pzXLKy.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -305,6 +305,19 @@ interface McpToolVisibility {
    */
   isWebMcpToolEnabled?(tool: string, sourceId?: string): boolean;
 }
+/**
+ * 参数留存的宿主侧信任声明（分册 30 / FR-30.6）。
+ *
+ * 声明只吃 endpoint / sourceId 这两个**宿主配置里的标识**，
+ * 不读工具 schema、不读工具描述、不读服务器元数据——服务器自称可信不算数。
+ * 缺省不信任；信任只影响脱敏判定，不影响可见性与审批。
+ */
+interface McpSourceTrust {
+  /** 宿主声明「这台端点的工具 schema 我审查过」 */
+  isEndpointTrusted?(endpoint: string): boolean;
+  /** WebMCP 来源同款；`sourceId` 为空即未命名的那一个 */
+  isWebMcpSourceTrusted?(sourceId: string | undefined): boolean;
+}
 /**
  * runtime 扩展点实现：endpoint 注册表 + WebMCP adapter 一处装配。
  * LLM 可见名：endpoint__tool / mcp__tool；call 时反向映射。
@@ -318,11 +331,21 @@ declare class McpRuntimePlugin implements ExternalToolSource {
     resolver?: McpToolResolver;
     /** 工具可见性策略（端点/工具级启停）；缺省全部可见 */
     visibility?: McpToolVisibility;
+    /** 参数留存的信任声明（分册 30）；**缺省不信任** */
+    trust?: McpSourceTrust;
     /** 已知的 endpoint 名（注销后仍按 MCP_ENDPOINT_UNAVAILABLE 响应，而非 TOOL_NOT_FOUND） */
     endpoints?: string[];
     /** endpoint 不可用时的告警出口（默认 console.warn） */
     onWarning?(message: string): void;
   });
+  /**
+   * 参数留存的信任判定（分册 30 / FR-30.6）。
+   * 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+   */
+  argCaptureTrust(llmToolName: string): {
+    tier: 'host-trusted';
+    declaredBy?: string;
+  } | undefined;
   listToolSpecs(): Promise<LlmToolSpec[]>;
   canHandle(llmToolName: string): boolean;
   call(llmToolName: string, args: Record<string, unknown>): Promise<ToolResult>;
@@ -471,4 +494,4 @@ interface RemoteEndpointHandle {
  */
 declare function connectRemoteEndpoint(registry: EndpointRegistry<McpClientLike>, config: RemoteEndpointConfig): Promise<RemoteEndpointHandle>;
 //#endregion
-export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, WEB_MCP_SOURCE_ID_MAX, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, type McpSourceTrust, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, WEB_MCP_SOURCE_ID_MAX, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { M as messageOf, g as assertRemoteUrlAllowed, h as WebSkillError } from "./dist-Bev6i6Ip.js";
-import { mt as mergeCatalogEntries, yt as normalizeToolContent } from "./dist-B-cOu08W.js";
+import { St as normalizeToolContent, _t as mergeCatalogEntries } from "./dist-sdKFgERo.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -580,6 +580,7 @@ var McpRuntimePlugin = class {
 	*/
 	#webMcp;
 	#visibility;
+	#trust;
 	#configuredEndpoints;
 	#onWarning;
 	constructor(deps) {
@@ -587,6 +588,7 @@ var McpRuntimePlugin = class {
 		this.#resolver = deps.resolver ?? new McpToolResolver(deps.registry);
 		this.#webMcp = deps.webMcp ?? [];
 		this.#visibility = deps.visibility;
+		this.#trust = deps.trust;
 		this.#configuredEndpoints = deps.endpoints ?? [];
 		this.#onWarning = deps.onWarning ?? ((message) => console.warn(message));
 	}
@@ -610,6 +612,40 @@ var McpRuntimePlugin = class {
 			return true;
 		}
 	}
+	/**
+	* 信任回调统一求值。**刻意不复用 `#visible()`**：两者的失败代价不对称。
+	* 可见性判不出来最坏是工具从列表里消失；信任判不出来而放行，落盘的就是明文。
+	* 因此这里缺省 false、异常也按 false，并同样走 onWarning。
+	*/
+	#trusted(probe) {
+		try {
+			return probe() === true;
+		} catch (e) {
+			this.#onWarning(`[webskill] MCP trust callback failed; treating the source as untrusted: ${e instanceof Error ? e.message : String(e)}`);
+			return false;
+		}
+	}
+	/**
+	* 参数留存的信任判定（分册 30 / FR-30.6）。
+	* 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+	*/
+	argCaptureTrust(llmToolName) {
+		const parsed = parseWebMcpToolLlmName(llmToolName, this.#sourceIds());
+		if (parsed !== void 0) {
+			if (!this.#trusted(() => this.#trust?.isWebMcpSourceTrusted?.(parsed.sourceId))) return void 0;
+			return {
+				tier: "host-trusted",
+				declaredBy: `webmcp:${parsed.sourceId ?? ""}`
+			};
+		}
+		const endpoint = this.#endpoints().find((name) => parseEndpointToolLlmName(name, llmToolName) !== void 0);
+		if (endpoint === void 0) return void 0;
+		if (!this.#trusted(() => this.#trust?.isEndpointTrusted?.(endpoint))) return void 0;
+		return {
+			tier: "host-trusted",
+			declaredBy: endpoint
+		};
+	}
 	async listToolSpecs() {
 		const specs = [];
 		for (const endpoint of this.#endpoints()) {

package/dist/node.d.ts

@@ -1,6 +1,6 @@
-import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-C26b05fW-CdrRCRDb.js";
-import { Dn as WebSkillRuntimeDeps, En as WebSkillRuntime, Ft as SchemaInferer, It as ScriptExecutionContext, L as FsArtifactStore, Lt as ScriptExecutor, Mn as createScriptContext, R as FsMemoryStore, an as ToolDefinition, m as ApprovalScope, nt as NetworkPolicy, sn as ToolResult, y as BridgeCapabilities } from "./index-D3mONFHD.js";
-import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-BcmFLykd.js";
+import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-DLctJep_-B5G4uk2u.js";
+import { Bn as createScriptContext, Bt as ScriptExecutionContext, Fn as WebSkillRuntimeDeps, L as FsArtifactStore, Pn as WebSkillRuntime, R as FsMemoryStore, Vt as ScriptExecutor, dn as ToolResult, it as NetworkPolicy, ln as ToolDefinition, m as ApprovalScope, y as BridgeCapabilities, zt as SchemaInferer } from "./index-C9pzXLKy.js";
+import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-DheTIwAB.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-AK3cSMEA-Dli6QU5E.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts

package/dist/node.js

@@ -1,5 +1,5 @@
 import { B as resolveArchiveLimits, D as exportSkills, F as parseSkillPackManifest, G as unzipWithLimits, I as readResponseWithLimit, J as verifySkillSignature, K as validateSkills, L as readSkillSignature, M as messageOf, O as isAtomicTempPath, P as parseSkillMarkdown, V as resolveInsideRoot, _ as assertSafePathSegment, b as buildManifest, c as SKILL_MANIFEST_FILE, d as SKILL_PACK_FILE, g as assertRemoteUrlAllowed, h as WebSkillError, i as MANIFEST_EXCLUDED_FILES, k as isValidSkillName, q as verifyManifest, s as SKILLS_LOCKFILE, v as atomicWriteText } from "./dist-Bev6i6Ip.js";
-import { Q as createScriptContext, X as bridgeError, b as FsMemoryStore, bt as normalizeToolError, gt as networkPolicyLibSource, q as WebSkillRuntime, u as CapabilityApproval, xt as parseBridgeRequest, y as FsArtifactStore, yt as normalizeToolContent } from "./dist-B-cOu08W.js";
+import { $ as bridgeError, Ct as normalizeToolError, St as normalizeToolContent, X as WebSkillRuntime, b as FsMemoryStore, tt as createScriptContext, u as CapabilityApproval, wt as parseBridgeRequest, y as FsArtifactStore, yt as networkPolicyLibSource } from "./dist-sdKFgERo.js";
 import { i as probeLlmCapabilities } from "./env-8cY40DXB-CGnEVZby.js";
 import { t as AUDIT_EVENT_TYPES } from "./eventTypes-FllCrX-Z-DNDeHWoG.js";
 import { createRequire } from "node:module";
@@ -541,7 +541,10 @@ var SandboxedScriptExecutor = class {
 					});
 					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
-					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					const artifact = await context.writeArtifact(request.path, content, {
+						...request.mimeType ? { mimeType: request.mimeType } : {},
+						...request.metadata === void 0 ? {} : { metadata: request.metadata }
+					});
 					return {
 						id: request.id,
 						ok: true,
@@ -915,7 +918,10 @@ var ProcessSandboxExecutor = class {
 					});
 					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
-					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
+					const artifact = await context.writeArtifact(request.path, content, {
+						...request.mimeType ? { mimeType: request.mimeType } : {},
+						...request.metadata === void 0 ? {} : { metadata: request.metadata }
+					});
 					return {
 						id: request.id,
 						ok: true,

package/dist/{openUiLibrary-D5u8oIvx-BLOAQCho.js → openUiLibrary-BKXW7Iwx-DaymVubt.js}

@@ -1,5 +1,5 @@
-import { St as uiCatalog } from "./dist-DTHZS2k1.js";
-import { t as CatalogNode } from "./catalogComponents-BFoqpT1v-CjUBZ3bc.js";
+import { Dt as uiCatalog } from "./dist-DqcL6jKO.js";
+import { t as CatalogNode } from "./catalogComponents-BgAJN0p8-C3K8klJd.js";
 import { z } from "zod";
 import { Component, Fragment, createContext, useCallback, useContext, useEffect, useInsertionEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
@@ -3761,7 +3761,7 @@ function Renderer({ response, library, isStreaming = false, onAction, onStateUpd
 const FormValidationContext = createContext(null);
 
 //#endregion
-//#region ../ui-react/dist/openUiLibrary-D5u8oIvx.js
+//#region ../ui-react/dist/openUiLibrary-BKXW7Iwx.js
 const propsFor = (props, container) => container ? props.extend({ children: z.array(z.any()).optional() }) : props;
 /**
 * catalog 的 OpenUI 投影：`defineComponent` 复用同一份 zod schema 与描述，

package/dist/processSandboxEntry.js

@@ -174,7 +174,8 @@ async function main(task) {
 			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
 				path,
 				content: typeof content === "string" ? content : Array.from(content ?? []),
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				metadata: options?.metadata
 			}),
 			confirm: (message) => callCapability("confirm", { message })
 		};

package/dist/sandboxWorkerEntry.js

@@ -235,7 +235,8 @@ async function main() {
 			writeArtifact: (path, content, options) => callCapability("writeArtifact", {
 				path,
 				content: typeof content === "string" ? content : Array.from(content ?? []),
-				mimeType: options?.mimeType
+				mimeType: options?.mimeType,
+				metadata: options?.metadata
 			}),
 			confirm: (message) => callCapability("confirm", { message })
 		};

package/dist/{skillVersionStore-D-qHk9ZE-BcmFLykd.d.ts → skillVersionStore-D-qHk9ZE-DheTIwAB.d.ts}

@@ -1,4 +1,4 @@
-import { R as FileSystemProvider, U as Page, W as PageQuery, dt as SkillManifest, it as SkillCatalogEntry } from "./types-C26b05fW-CdrRCRDb.js";
+import { R as FileSystemProvider, U as Page, W as PageQuery, dt as SkillManifest, it as SkillCatalogEntry } from "./types-DLctJep_-B5G4uk2u.js";
 //#region ../governance/dist/skillVersionStore-D-qHk9ZE.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { S as UiBridge, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, v as MemoryStore } from "./types-C26b05fW-CdrRCRDb.js";
+import { S as UiBridge, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, v as MemoryStore } from "./types-DLctJep_-B5G4uk2u.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-AK3cSMEA-Dli6QU5E.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/{types-C26b05fW-CdrRCRDb.d.ts → types-DLctJep_-B5G4uk2u.d.ts}

@@ -637,7 +637,7 @@ declare function escapeXml(text: string): string;
 declare function renderAvailableSkillsXml(catalog: SkillCatalog): string;
 declare const xmlRenderer: CatalogRenderer;
 //#endregion
-//#region ../runtime/dist/types-C26b05fW.d.ts
+//#region ../runtime/dist/types-DLctJep_.d.ts
 //#region src/llm/streamTypes.d.ts
 /** 流式 LLM 事件（OpenAI SSE / Vercel fullStream 统一映射） */
 type LlmStreamEvent = {
@@ -879,7 +879,8 @@ interface InteractionSuggestion {
 }
 /** 图表规格（$chart 约定的校验后形态；渲染单一来源在 ui/chart/miniChart） */
 interface ChartSpec {
-  kind: 'bar' | 'line' | 'pie';
+  /** 取值与 catalog `Chart` 的 props 枚举逐字一致（`ui/catalog/uiCatalog.ts`） */
+  kind: 'bar' | 'line' | 'area' | 'pie' | 'scatter' | 'stacked-bar' | 'dual-axis';
   title?: string;
   labels: string[];
   series: Array<{

package/dist/ui-react.d.ts

@@ -1,5 +1,5 @@
-import { C as UiSpecActionCapability, D as UiSpecSnapshot, O as UiSurfaceActionRequest, S as UiBridge, T as UiSpecEvent, b as RenderResultRequest, bt as UiSpecNode, c as InteractionResponse, k as UiSurfaceActionResponse, s as InteractionRequest, w as UiSpecDrafts } from "./types-C26b05fW-CdrRCRDb.js";
-import { W as SurfaceFormTexts, j as InteractionSpecLabels } from "./index-DACk2_XZ.js";
+import { C as UiSpecActionCapability, D as UiSpecSnapshot, O as UiSurfaceActionRequest, S as UiBridge, T as UiSpecEvent, b as RenderResultRequest, bt as UiSpecNode, c as InteractionResponse, k as UiSurfaceActionResponse, s as InteractionRequest, w as UiSpecDrafts } from "./types-DLctJep_-B5G4uk2u.js";
+import { J as SurfaceHostControlTexts, P as InteractionSpecLabels, q as SurfaceFormTexts, v as ChartFontSizes } from "./index-3fCHc1mQ.js";
 import { z } from "zod";
 import React$1, { ComponentType, ReactNode } from "react";
 import "react/jsx-runtime";
@@ -528,9 +528,18 @@ declare const catalogComponentImpls: Record<string, (input: CatalogNodeProps) =>
 //#endregion
 //#region src/catalog/surfaceFormTexts.d.ts
 declare function useSurfaceFormTexts(): SurfaceFormTexts;
-declare function SurfaceFormTextsProvider({ texts, children }: {
+declare function useSurfaceHostControlTexts(): SurfaceHostControlTexts;
+declare function SurfaceFormTextsProvider({ texts, hostControlTexts, children }: {
   texts?: Partial<SurfaceFormTexts> | undefined;
+  hostControlTexts?: Partial<SurfaceHostControlTexts> | undefined;
   children: ReactNode;
 }): import("react").JSX.Element;
 //#endregion
-export { type CatalogNodeProps, type CustomSurfaceActionEvent, type DroppedSurfaceActionWarning, InteractionForm, type JsonRenderActionDispatch, JsonRenderSpecSurface, type JsonRenderSpecSurfaceProps, NATIVE_SPEC_COMPONENTS, NativeSpecSurface, type NativeSpecSurfaceProps, OpenUiSpecSurface, type OpenUiSpecSurfaceProps, ReactBridgeState, type ReactBridgeStateOptions, type RegisteredSurfaceProps, ResultBlocks, SpecInteractionChannel, type SpecInteractionSession, StreamingText, SurfaceFormTextsProvider, type SurfaceRegistration, SurfaceRegistry, type UiSurfaceActionEvent, UiSurfaceList, type UiSurfaceListProps, UiSurfaceSnapshotList, type UiSurfaceSnapshotListProps, UiSurfaceStore, catalogComponentImpls, createJsonRenderRegistry, probeJsonRenderAvailability, useSurfaceFormTexts };
+//#region src/components/chartFontSizes.d.ts
+declare function useChartFontSizes(): ChartFontSizes;
+declare function ChartFontSizesProvider({ sizes, children }: {
+  sizes?: Partial<ChartFontSizes> | undefined;
+  children: ReactNode;
+}): import("react").JSX.Element;
+//#endregion
+export { type CatalogNodeProps, ChartFontSizesProvider, type CustomSurfaceActionEvent, type DroppedSurfaceActionWarning, InteractionForm, type JsonRenderActionDispatch, JsonRenderSpecSurface, type JsonRenderSpecSurfaceProps, NATIVE_SPEC_COMPONENTS, NativeSpecSurface, type NativeSpecSurfaceProps, OpenUiSpecSurface, type OpenUiSpecSurfaceProps, ReactBridgeState, type ReactBridgeStateOptions, type RegisteredSurfaceProps, ResultBlocks, SpecInteractionChannel, type SpecInteractionSession, StreamingText, SurfaceFormTextsProvider, type SurfaceRegistration, SurfaceRegistry, type UiSurfaceActionEvent, UiSurfaceList, type UiSurfaceListProps, UiSurfaceSnapshotList, type UiSurfaceSnapshotListProps, UiSurfaceStore, catalogComponentImpls, createJsonRenderRegistry, probeJsonRenderAvailability, useChartFontSizes, useSurfaceFormTexts, useSurfaceHostControlTexts };