@webskill/sdk 0.11.0 → 0.13.0

package/dist/{index-DWbs58LF.d.ts → index-iBm9tJL_.d.ts}

@@ -1,5 +1,5 @@
-import { G as RemoteUrlPolicy, S as UiBridge, Tt as WebSkillErrorCode, a as InteractionOrigin, c as InteractionResponse, s as InteractionRequest } from "./types-C26b05fW-CdrRCRDb.js";
-import { F as ExternalToolSource } from "./index-D3mONFHD.js";
+import { G as RemoteUrlPolicy, S as UiBridge, Tt as WebSkillErrorCode, a as InteractionOrigin, c as InteractionResponse, s as InteractionRequest } from "./types-DLctJep_-B5G4uk2u.js";
+import { F as ExternalToolSource, mn as ToolStepReader } from "./index-DkvBhJQy.js";
 //#region ../agent/dist/index.d.ts
 //#region src/todo/types.d.ts
 /** 待办条目状态：未开始 / 进行中 / 已完成（FR-3.1） */
@@ -94,6 +94,16 @@ interface GeneratedSkillDraft {
     path: string;
     content: string;
   }[];
+  /**
+   * 模型声称这个技能会执行的工具调用（分册 30 / FR-30.4）。
+   *
+   * 做成结构化入参而不是从 `content` 正文里扫工具名：正文是自由文本，
+   * 扫描既会漏（模型写「点击提交按钮」而不写工具名）又会误命中（提到但没执行）。
+   */
+  steps?: readonly {
+    tool: string;
+    args?: Record<string, unknown>;
+  }[];
 }
 /**
  * 候选收货端口。实现由宿主注入——`@webskill/agent` 不依赖 `@webskill/governance`
@@ -136,12 +146,34 @@ interface SkillGeneratorOptions {
   now?: () => Date;
   /** 界面文案注入口：生成器与语言无关，字典在宿主手里（UI-UX5 #9） */
   messages?: SkillGenerationMessages;
+  /**
+   * 本会话的运行轨迹（分册 30）。**不注入即不校验、不展示证据**，行为与 0.11.0 一致——
+   * 这既让本册可分步落地，也给 AC-30.14 的反向对照留了现成的造法。
+   */
+  steps?: ToolStepReader;
 }
 /** 生成器面向用户的文案；缺省全部为英文模板 */
 interface SkillGenerationMessages {
   /** 授权确认卡的正文（含技能名与描述插值由实现方完成） */
   confirmSkill?(draft: GeneratedSkillDraft): string;
 }
+/**
+ * 确认卡上的一步（分册 30 / FR-30.5）。
+ * `evidence` 区分「这一步在本会话真的跑过」与「模型自己补写的」。
+ */
+interface SkillTraceEvidenceStep {
+  tool: string;
+  evidence: 'trace' | 'model';
+  /** 轨迹里的原始参数（已脱敏）；无背书时缺省 */
+  traceArgs?: Record<string, unknown>;
+  /** 模型在草稿里写的参数 */
+  draftArgs?: Record<string, unknown>;
+  /** 轨迹里被脱敏掉的字段路径 */
+  redacted?: readonly string[];
+}
+interface SkillTraceEvidence {
+  steps: readonly SkillTraceEvidenceStep[];
+}
 /**
  * 技能自动生成策略。生成动作是策略而不是内核：它不进入 `AgentLoop`，
  * 而是经既有的 `ExternalToolSource` 扩展点接入（设计 02 §0）。
@@ -309,16 +341,19 @@ interface PerceptionScope {
   exclude?: readonly string[];
 }
 /**
- * 一个帧内的可感知范围（FR-24.1）。
+ * 一个帧内的可感知范围（FR-24.1 / 分册 18 FR-18.1）。
  *
- * `frame` 的选择器在**主文档**里求值，不下钻到 iframe 内部再找 iframe：
- * 允许 `a > b > c` 式的跨帧路径会让「授权面到底覆盖了什么」无法在配置里一眼看出来。
- * 要读更深的帧须再写一条——而那条也只能写主文档里的选择器，所以本版实际只支持一层。
+ * 嵌套帧写**自外向内的选择器数组**：第 1 项在主文档里求值，
+ * 第 n+1 项在第 n 项解析出的文档里求值。逐层写出来是有意的——
+ * 授权面覆盖了哪几层，配置里要能一眼看出来，不允许靠自动发现下钻。
  * @experimental
  */
 interface FrameScope {
-  /** 主文档写 `'self'`；iframe 写主文档里定位该 `<iframe>` 的选择器 */
-  frame: 'self' | string;
+  /**
+   * 主文档写 `'self'`；单层 iframe 写主文档里定位该 `<iframe>` 的选择器；
+   * 多层嵌套写逐层选择器数组（空数组等价于 `'self'`）。
+   */
+  frame: 'self' | string | readonly string[];
   include: readonly string[];
   exclude?: readonly string[];
 }
@@ -341,6 +376,7 @@ type PerceptionScopeInput = PerceptionScope | {
 declare function toFrameScopes(scope: PerceptionScopeInput): readonly FrameScope[];
 /** 某个帧未能读取的原因（FR-24.2 / FR-24.3）；不静默跳过 @experimental */
 interface FrameNote {
+  /** 帧路径的展示串（`frameLabel` 的产出，分册 18 FR-18.2） */
   frame: string;
   reason: 'cross-origin' | 'origin-changed' | 'not-found';
   /** 面向模型的英文说明，同时也是说明节点的 name */
@@ -371,13 +407,16 @@ interface PerceivedNode {
   imageNote?: string;
   /**
    * 不透明元素句柄（S10）。**仅当该节点可被操作时出现**：
-   * 它落在宿主声明的操作范围内、且是可交互角色。
-   * 由 reader 生成，只在产生它的那次感知内有效；模型不得构造或推断。
+   * 它落在宿主声明的操作范围内、且是可交互角色。由 reader 生成，模型不得构造或推断。
+   *
+   * **跨感知保留，直到元素离开文档**（分册 18 FR-18.5）。它不是安全边界——
+   * 「页面变了不能点到别的东西」由执行前的实时校验承担，不由句柄寿命承担。
    */
   ref?: string;
   /**
-   * 该节点来自哪个帧（FR-24.4）。**主文档节点不带这个字段**——
-   * 否则旧宿主的断言会凭空变化。跨帧后会出现同名控件，不标帧模型会点错。
+   * 该节点来自哪个帧（FR-24.4），取值是帧路径的展示串（`frameLabel`）。
+   * **主文档节点不带这个字段**——否则旧宿主的断言会凭空变化。
+   * 跨帧后会出现同名控件，不标帧模型会点错。
    */
   frame?: string;
   /**
@@ -415,6 +454,11 @@ interface PerceptionCaptureOptions {
   images: boolean;
   maxImageBytes: number;
   maxImages: number;
+  /**
+   * 小于该面积（平方像素）的元素视作图标，不占取像名额（0.13.0 FR-20.3）。
+   * 可选是为了不破坏既有 reader 实现；缺省与 0 都表示不过滤。
+   */
+  minImageArea?: number;
 }
 /**
  * reader 的完整产物。只实现文本的 reader 可以继续返回节点数组。
@@ -536,6 +580,8 @@ interface ImageCaptureBudget {
   enabled: boolean;
   maxImageBytes: number;
   maxImages: number;
+  /** 小于该面积（平方像素）的元素视作图标；缺省与 0 都表示不过滤（0.13.0 FR-20.3） */
+  minImageArea?: number;
 }
 /**
  * 把只读感知接到既有工具协议上。**本工具源不导出任何写入动作**（FR-10.7）：
@@ -547,6 +593,25 @@ interface ImageCaptureBudget {
  */
 declare function createPagePerceptionToolSource(options: PagePerceptionToolSourceOptions): ExternalToolSource;
 //#endregion
+//#region src/frame.d.ts
+/**
+ * 帧指称的展示形式（分册 18 FR-18.2）。
+ *
+ * 感知与操作两侧各自声明自己的 scope 类型（那是刻意的，见各自 types.ts），
+ * 但「一条帧路径写成给人看的字符串」只能有一份实现——
+ * 两处各写一遍，审计里的帧名和确认卡里的帧名就会慢慢对不上。
+ */
+/**
+ * 帧路径的稳定展示串：`'self'` / `'#a'` / `'#a >>> #b'`。
+ *
+ * `>>>` **只是展示分隔符**：CSS 选择器里可以合法出现任意字符，
+ * 反向解析这个串取回路径是不成立的，实现层一律传原始形状（D-18-1）。
+ * @experimental
+ */
+declare function frameLabel(frame: string | readonly string[]): string;
+/** 把两种形状归一成逐层选择器数组；`'self'` 与空数组都归一成空数组 @experimental */
+declare function frameSteps(frame: string | readonly string[]): readonly string[];
+//#endregion
 //#region src/prompts/perception.d.ts
 /**
  * 页面只读感知的策略提示词（设计 09 §1）。
@@ -672,15 +737,18 @@ interface PageActionScope {
   exclude?: readonly string[];
 }
 /**
- * 一个帧内的可操作范围（FR-24.1）。
+ * 一个帧内的可操作范围（FR-24.1 / 分册 18 FR-18.1）。
  *
  * 与感知侧的 `FrameScope` 同构但**独立声明**，理由同上：合并成一个类型会让
  * 「一份配置同时当感知范围和操作范围用」在类型层面合法。
  * @experimental
  */
 interface ActionFrameScope {
-  /** 主文档写 `'self'`；iframe 写主文档里定位该 `<iframe>` 的选择器 */
-  frame: 'self' | string;
+  /**
+   * 主文档写 `'self'`；单层 iframe 写主文档里定位该 `<iframe>` 的选择器；
+   * 多层嵌套写逐层选择器数组（空数组等价于 `'self'`）。
+   */
+  frame: 'self' | string | readonly string[];
   include: readonly string[];
   exclude?: readonly string[];
 }
@@ -738,9 +806,32 @@ interface PageActionOutcome {
   noop?: boolean;
   /** 本次操作新打开的模态的可访问名；授权面临时扩大要在留痕里看得见（FR-25.6） */
   elevatedModal?: string;
+  /**
+   * 本次操作后目标所在帧的地址变了（帧内跳转 / SPA 路由，分册 18 FR-18.6）。
+   * 没变时**不带**该字段：带个 `false` 会让旧宿主的断言凭空变化。
+   *
+   * 真正的跨文档导航会销毁执行上下文，那种情况拿不到本字段——固有限制，不假装。
+   */
+  navigated?: boolean;
+  /** 变更后的地址；仅 `navigated` 时带 */
+  documentUrl?: string;
   /** 失败原因（英文） */
   reason?: string;
 }
+/**
+ * 执行器对一个句柄的描述。确认卡的措辞、留痕与分册 30 的参数留存共用这一份——
+ * 句柄本身是本次感知产出的不透明串，离开这次运行就没有意义。
+ * @experimental
+ */
+interface PageActionTarget {
+  role: string;
+  name?: string;
+  /** 密码类控件：确认卡打掩码，参数留存整次调用不留明文 */
+  secret?: boolean;
+  frame?: string;
+  /** 目标在本次任务临时打开的对话框里，授权面被扩大过 */
+  elevated?: boolean;
+}
 /**
  * 页面操作执行器。与 `PagePerceptionReader` 对称，同样不含 DOM 概念。
  * 实现方负责校验句柄有效性、元素可交互性，以及目标是否仍在操作范围内。
@@ -749,13 +840,7 @@ interface PageActionOutcome {
 interface PageActionExecutor {
   execute(request: PageActionRequest): Promise<PageActionOutcome> | PageActionOutcome;
   /** 目标的角色与可访问名称，供确认卡在**执行前**说清将要做什么（FR-23.2） */
-  describe(ref: string): {
-    role: string;
-    name?: string;
-    secret?: boolean;
-    frame?: string;
-    elevated?: boolean;
-  } | undefined;
+  describe(ref: string): PageActionTarget | undefined;
 }
 /** 一次页面操作的留痕（FR-23.3 的五项字段） @experimental */
 interface PageActionRecord {
@@ -816,6 +901,20 @@ declare class PageActionPolicy {
   get scope(): PageActionScopeInput;
   /** 最近的操作记录（只读展示用），新的在前 */
   get records(): readonly PageActionRecord[];
+  /**
+   * 目标是不是密码类控件（分册 30）。与确认卡上把值打成掩码用的是**同一个判定**，
+   * 不另立一套敏感字段清单。
+   *
+   * 读的是 `act()` 当时记下的结论而不是事后重查：提交或重绘后句柄会失效，
+   * 重查就会把一次普通填写误判成敏感、把内容丢掉。没操作过的句柄才现查，
+   * 查不到按敏感：不知道就别留存。
+   */
+  isSecretTarget(ref: string): boolean;
+  /**
+   * `act()` 当时看到的目标身份（分册 30）。句柄只在本次感知内有效，
+   * 只留句柄等于留了一个换次运行就失效的引用；角色与可访问名才是可重放的那部分。
+   */
+  rememberedTarget(ref: string): PageActionTarget | undefined;
   act(request: PageActionRequest): Promise<PageActionOutcome>;
 }
 //#endregion
@@ -842,4 +941,4 @@ declare function createPageActionToolSource(options: PageActionToolSourceOptions
  */
 declare const PAGE_ACTION_SYSTEM_PROMPT: string;
 //#endregion
-export { PerceptionScopeInput as $, PageActionKind as A, PageAuditSink as B, MANAGE_TODO_TOOL as C, createTodoToolSource as Ct, PERCEIVE_PAGE_TOOL as D, PAGE_ACTION_TOOL as E, withDelegationOrigin as Et, PageActionRequest as F, ParentBudget as G, PagePerceptionPolicyOptions as H, PageActionScope as I, PerceptionAuditSink as J, PerceivedImage as K, PageActionScopeInput as L, PageActionPolicy as M, PageActionPolicyOptions as N, PERCEPTION_SYSTEM_PROMPT as O, PageActionRecord as P, PerceptionScope as Q, PageActionToolSourceOptions as R, ImageCaptureBudget as S, createSkillGenerationToolSource as St, PAGE_ACTION_SYSTEM_PROMPT as T, toFrameScopes as Tt, PagePerceptionReader as U, PagePerceptionPolicy as V, PagePerceptionToolSourceOptions as W, PerceptionRecord as X, PerceptionCaptureOptions as Y, PerceptionResult as Z, FrameNote as _, TodoToolSourceOptions as _t, DataSourceDef as a, SkillGenerationToolSourceOptions as at, GeneratedSkillDraft as b, createPageActionToolSource as bt, DataSourcePolicyOptions as c, SubAgentRunInput as ct, DelegationBudget as d, TodoEvent as dt, SKILL_GENERATION_SYSTEM_PROMPT as et, DelegationOrchestrator as f, TodoItem as ft, DelegationToolSourceOptions as g, TodoStore as gt, DelegationResult as h, TodoStatus as ht, DataSourceAuditSink as i, SkillGenerationPolicy as it, PageActionOutcome as j, PageActionExecutor as k, DataSourceRecord as l, SubAgentRunner as lt, DelegationRequest as m, TodoListener as mt, DELEGATE_TASK_TOOL as n, SkillGenerationMessages as nt, DataSourceKind as o, SkillGenerator as ot, DelegationOrchestratorOptions as p, TodoList as pt, PerceivedNode as q, DELEGATION_SYSTEM_PROMPT as r, SkillGenerationOutcome as rt, DataSourcePolicy as s, SkillGeneratorOptions as st, ActionFrameScope as t, SkillCandidateSink as tt, DataSourceTransport as u, TODO_SYSTEM_PROMPT as ut, FrameScope as v, createDelegationToolSource as vt, PAGE_ACTION_KINDS as w, toActionFrameScopes as wt, HttpDataSourceOptions as x, createPagePerceptionToolSource as xt, GENERATE_SKILL_TOOL as y, createHttpDataSourceTransport as yt, PageActionUi as z };
+export { PerceptionScope as $, PageActionKind as A, toFrameScopes as At, PageActionUi as B, MANAGE_TODO_TOOL as C, createPageActionToolSource as Ct, PERCEIVE_PAGE_TOOL as D, frameLabel as Dt, PAGE_ACTION_TOOL as E, createTodoToolSource as Et, PageActionRequest as F, PagePerceptionToolSourceOptions as G, PagePerceptionPolicy as H, PageActionScope as I, PerceivedNode as J, ParentBudget as K, PageActionScopeInput as L, PageActionPolicy as M, PageActionPolicyOptions as N, PERCEPTION_SYSTEM_PROMPT as O, frameSteps as Ot, PageActionRecord as P, PerceptionResult as Q, PageActionTarget as R, ImageCaptureBudget as S, createHttpDataSourceTransport as St, PAGE_ACTION_SYSTEM_PROMPT as T, createSkillGenerationToolSource as Tt, PagePerceptionPolicyOptions as U, PageAuditSink as V, PagePerceptionReader as W, PerceptionCaptureOptions as X, PerceptionAuditSink as Y, PerceptionRecord as Z, FrameNote as _, TodoListener as _t, DataSourceDef as a, SkillGenerationPolicy as at, GeneratedSkillDraft as b, TodoToolSourceOptions as bt, DataSourcePolicyOptions as c, SkillGeneratorOptions as ct, DelegationBudget as d, SubAgentRunInput as dt, PerceptionScopeInput as et, DelegationOrchestrator as f, SubAgentRunner as ft, DelegationToolSourceOptions as g, TodoList as gt, DelegationResult as h, TodoItem as ht, DataSourceAuditSink as i, SkillGenerationOutcome as it, PageActionOutcome as j, withDelegationOrigin as jt, PageActionExecutor as k, toActionFrameScopes as kt, DataSourceRecord as l, SkillTraceEvidence as lt, DelegationRequest as m, TodoEvent as mt, DELEGATE_TASK_TOOL as n, SkillCandidateSink as nt, DataSourceKind as o, SkillGenerationToolSourceOptions as ot, DelegationOrchestratorOptions as p, TODO_SYSTEM_PROMPT as pt, PerceivedImage as q, DELEGATION_SYSTEM_PROMPT as r, SkillGenerationMessages as rt, DataSourcePolicy as s, SkillGenerator as st, ActionFrameScope as t, SKILL_GENERATION_SYSTEM_PROMPT as tt, DataSourceTransport as u, SkillTraceEvidenceStep as ut, FrameScope as v, TodoStatus as vt, PAGE_ACTION_KINDS as w, createPagePerceptionToolSource as wt, HttpDataSourceOptions as x, createDelegationToolSource as xt, GENERATE_SKILL_TOOL as y, TodoStore as yt, PageActionToolSourceOptions as z };

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { $ as SignatureAuditSink, $t as signaturePayloadBytes, A as extractSkillCandidate, At as buildManifest, B as JsonSchema, Bt as jsonRenderer, C as UiSpecActionCapability, Ct as VerifyResult, D as UiSpecSnapshot, Dt as assertSafePathSegment, E as UiSpecPatch, Et as assertRemoteUrlAllowed, F as DEFAULT_ARCHIVE_LIMITS, Ft as detectSkillArchiveShapeFromFs, G as RemoteUrlPolicy, Gt as parseSkillPackManifest, H as MemoryFS, Ht as messageOf, I as DiscoveryResult, It as escapeXml, J as SKILL_MANIFEST_FILE, Jt as renderAvailableSkillsXml, K as SIGNATURE_SCHEMA_VERSION, Kt as readResponseWithLimit, L as FileStat, Lt as exportSkills, M as ArchiveLimits, Mt as checkSkillRules, N as CatalogRenderer, Nt as computeDigest, O as UiSurfaceActionRequest, Ot as atomicWriteText, P as CryptoKeyLike, Pt as detectSkillArchiveShape, Q as SKILL_SIGNATURE_FILE, Qt as signSkill, R as FileSystemProvider, Rt as isAtomicTempPath, S as UiBridge, St as ValidationReport, T as UiSpecEvent, Tt as WebSkillErrorCode, U as Page, Ut as normalizePath, V as MANIFEST_EXCLUDED_FILES, Vt as keyIdOf, W as PageQuery, Wt as parseSkillMarkdown, X as SKILL_NAME_PATTERN, Xt as resolveArchiveLimits, Y as SKILL_NAME_MAX_LENGTH, Yt as renderCatalogJson, Z as SKILL_PACK_FILE, Zt as resolveInsideRoot, _ as LlmToolSpec, _t as SkillsLockfile, a as InteractionOrigin, an as xmlRenderer, at as SkillDiscovery, b as RenderResultRequest, bt as UiSpecNode, c as InteractionResponse, ct as SkillIssue, d as LlmContentPart, dt as SkillManifest, en as stripArchiveRoot, et as SignatureVerdict, f as LlmMessage, ft as SkillMetadata, g as LlmToolCall, gt as SkillSource, h as LlmTokenUsage, ht as SkillSignature, i as FormField, in as verifySkillSignature, it as SkillCatalogEntry, j as ATOMIC_TMP_SUFFIX_PATTERN, jt as checkDependencyCycles, k as UiSurfaceActionResponse, kt as buildCatalog, l as LlmClient, lt as SkillLocation, m as LlmStreamEvent, mt as SkillReader, n as ArtifactStore, nn as validateSkills, nt as SkillArchiveShape, o as InteractionPolicy, ot as SkillDocument, p as LlmResponse, pt as SkillPackManifest, q as SKILLS_LOCKFILE, qt as readSkillSignature, r as ChartSpec, rn as verifyManifest, rt as SkillCatalog, s as InteractionRequest, st as SkillInstallSource, t as Artifact, tn as unzipWithLimits, tt as SkillArchiveDetection, u as LlmCompleteInput, ut as SkillManagerPort, v as MemoryStore, vt as TrustedKey, w as UiSpecDrafts, wt as WebSkillError, x as SkillCandidateMarker, xt as UnsignedPolicy, y as RenderBlock, yt as TrustedKeyStore, z as FsTrustedKeyStore, zt as isValidSkillName } from "./types-C26b05fW-CdrRCRDb.js";
-import { $ as LifecycleHookContext, $n as normalizeToolError, $t as SkillSuccessReport, A as DocxTextExtractor, An as bridgeError, At as RuntimeRun, B as FsRunTraceStore, Bn as formatSkillScriptManifest, Bt as SealResult, C as CapabilityApproval, Cn as UserProfileLimits, Ct as RunTraceFile, D as DEFAULT_MAX_DOCUMENT_BYTES, Dn as WebSkillRuntimeDeps, Dt as RunTraceSummary, E as DEFAULT_MAX_DATA_SOURCE_BYTES, En as WebSkillRuntime, Et as RunTraceStore, F as ExternalToolSource, Fn as exportUserProfile, Ft as SchemaInferer, G as HookRunner, Gn as isUnsupportedRunSnapshot, Gt as SessionStore, H as FullDisclosureRouter, Hn as fromVercelStreamPart, Ht as SessionListPage, I as FS_SESSION_PAGE_SIZE, In as extractChartSpec, It as ScriptExecutionContext, J as IntegrityVerdict, Jn as mergeProfileEntries, Jt as SkillOutcomeReporter, K as HookRunnerOptions, Kn as listSkillScripts, Kt as SkillFailureReport, L as FsArtifactStore, Ln as extractTodoTraceEvents, Lt as ScriptExecutor, M as EventBus, Mn as createScriptContext, Mt as RuntimeSessionHandle, N as ExecuteLifecycleData, Nn as createWebSkillApi, Nt as SESSION_SCHEMA_VERSION, O as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, On as appendBehaviorRecords, Ot as RunUsageSummary, P as ExternalSkillProvider, Pn as diffUserProfile, Pt as SUPPORTED_DOCUMENT_MIME, Q as LifecycleHook, Qn as normalizeToolContent, Qt as SkillStateGuard, R as FsMemoryStore, Rn as extractUiSpecEvents, Rt as SealOptions, S as BridgeResponse, Sn as UserProfileImportDiff, St as RunToolCall, T as DEFAULT_LOOP_LIMITS, Tn as WebSkillApi, Tt as RunTraceMetrics, U as GoogleGenAiClient, Un as interruptedToolResult, Ut as SessionMeta, V as FsSessionStore, Vn as fromVercelResult, Vt as SerializingMemoryStore, W as GoogleGenAiClientConfig, Wn as isNetworkAllowed, Wt as SessionRecord, X as LifecycleEvent, Xn as networkUrlHost, Xt as SkillScriptDescriptor, Y as InteractLifecycleData, Yn as networkPolicyLibSource, Yt as SkillRouter, Z as LifecycleEventInit, Zn as normalizeErrorCode, Zt as SkillScriptSchemaSource, _ as BehaviorRecordKind, _n as USER_PROFILE_REFINE_PROMPT, _r as toLlmToolSpec, _t as RunResult, a as ASK_USER_TOOL, an as ToolDefinition, ar as readUserProfile, at as ProgressiveRouter, b as BridgeCapability, bn as UserProfileEntry, br as validateUiSpecEvent, bt as RunSnapshotStore, c as AgentLoop, cn as TraceClock, cr as resolveToolName, ct as READ_SKILL_FILE_INPUT_SCHEMA, d as AnthropicClient, dn as TraceRecorder, dr as schemaToForm, dt as RUN_SNAPSHOT_SCHEMA_VERSION, en as TEXT_BUDGETED_CONTENT_TYPES, er as parseBridgeRequest, et as LifecycleListener, f as AnthropicClientConfig, fn as UNSUPPORTED_DOCUMENT_MESSAGE, fr as scriptToolName, ft as RUN_TRACE_SCHEMA_VERSION, g as BehaviorRecord, gn as USER_PROFILE_PROMPT_HEADER, gr as textParts, gt as RunLimitErrorDetails, h as BEHAVIOR_RECORDS_KEY, hn as USER_PROFILE_NO_INVENTION_RULE, hr as summarizeToolCalls, ht as RouteResult, i as ASK_USER_MAX_FIELDS, in as ToolContent, ir as readProfileEntries, it as OpenAiCompatibleClientConfig, j as EMPTY_USER_PROFILE, jn as buildRenderResult, jt as RuntimeSession, k as DEFAULT_USER_PROFILE_LIMITS, kn as applyUserProfileImport, kt as RuntimePhase, l as AgentLoopConfig, ln as TraceEvent, lr as sampleBehaviorRecords, lt as READ_SKILL_FILE_TOOL, m as ApprovalScope, mn as USER_PROFILE_KEY, mr as summarizeRunUsage, mt as RouteLifecycleData, n as ASK_USER_FIELD_TYPES, nn as TextualToolContent, nr as partsToText, nt as NetworkPolicy, o as ASK_USER_TOOL_NAME, on as ToolResolution, or as refineUserProfile, ot as READ_LINKED_DOCUMENT_TOOL, p as ApprovalDecision, pn as USER_PROFILE_EXPORT_VERSION, pr as sealToolCallPairs, pt as RefineUserProfileInput, q as InstalledSkillManifest, qn as mergeCatalogEntries, qt as SkillIntegrityGuard, r as ASK_USER_INPUT_SCHEMA, rn as TodoTraceEvent, rr as readBehaviorRecords, rt as OpenAiCompatibleClient, s as ActivateLifecycleData, sn as ToolResult, sr as renderUserProfileContext, st as READ_LINKED_DOCUMENT_TOOL_NAME, t as ALLOWED_TOOLS_EXCLUSION_REASON, tn as TerminalLifecycleData, tr as parseUserProfileExport, tt as LinkedDocumentReader, u as AgentLoopDeps, un as TraceEventType, ur as schemaSourceLabel, ut as READ_SKILL_FILE_TOOL_NAME, v as BehaviorScene, vn as UnsupportedRunSnapshot, vr as toRecordDigests, vt as RunSnapshot, w as CapabilityMode, wn as VercelToolSpec, wt as RunTraceFilter, x as BridgeRequest, xn as UserProfileExport, xr as validateUiSpecNode, xt as RunTerminationReason, y as BridgeCapabilities, yn as UserProfile, yr as toVercelToolSpecs, yt as RunSnapshotListEntry, z as FsRunSnapshotStore, zn as findUnpairedToolCalls, zt as SealRecord } from "./index-D3mONFHD.js";
+import { $ as SignatureAuditSink, $t as signaturePayloadBytes, A as extractSkillCandidate, At as buildManifest, B as JsonSchema, Bt as jsonRenderer, C as UiSpecActionCapability, Ct as VerifyResult, D as UiSpecSnapshot, Dt as assertSafePathSegment, E as UiSpecPatch, Et as assertRemoteUrlAllowed, F as DEFAULT_ARCHIVE_LIMITS, Ft as detectSkillArchiveShapeFromFs, G as RemoteUrlPolicy, Gt as parseSkillPackManifest, H as MemoryFS, Ht as messageOf, I as DiscoveryResult, It as escapeXml, J as SKILL_MANIFEST_FILE, Jt as renderAvailableSkillsXml, K as SIGNATURE_SCHEMA_VERSION, Kt as readResponseWithLimit, L as FileStat, Lt as exportSkills, M as ArchiveLimits, Mt as checkSkillRules, N as CatalogRenderer, Nt as computeDigest, O as UiSurfaceActionRequest, Ot as atomicWriteText, P as CryptoKeyLike, Pt as detectSkillArchiveShape, Q as SKILL_SIGNATURE_FILE, Qt as signSkill, R as FileSystemProvider, Rt as isAtomicTempPath, S as UiBridge, St as ValidationReport, T as UiSpecEvent, Tt as WebSkillErrorCode, U as Page, Ut as normalizePath, V as MANIFEST_EXCLUDED_FILES, Vt as keyIdOf, W as PageQuery, Wt as parseSkillMarkdown, X as SKILL_NAME_PATTERN, Xt as resolveArchiveLimits, Y as SKILL_NAME_MAX_LENGTH, Yt as renderCatalogJson, Z as SKILL_PACK_FILE, Zt as resolveInsideRoot, _ as LlmToolSpec, _t as SkillsLockfile, a as InteractionOrigin, an as xmlRenderer, at as SkillDiscovery, b as RenderResultRequest, bt as UiSpecNode, c as InteractionResponse, ct as SkillIssue, d as LlmContentPart, dt as SkillManifest, en as stripArchiveRoot, et as SignatureVerdict, f as LlmMessage, ft as SkillMetadata, g as LlmToolCall, gt as SkillSource, h as LlmTokenUsage, ht as SkillSignature, i as FormField, in as verifySkillSignature, it as SkillCatalogEntry, j as ATOMIC_TMP_SUFFIX_PATTERN, jt as checkDependencyCycles, k as UiSurfaceActionResponse, kt as buildCatalog, l as LlmClient, lt as SkillLocation, m as LlmStreamEvent, mt as SkillReader, n as ArtifactStore, nn as validateSkills, nt as SkillArchiveShape, o as InteractionPolicy, ot as SkillDocument, p as LlmResponse, pt as SkillPackManifest, q as SKILLS_LOCKFILE, qt as readSkillSignature, r as ChartSpec, rn as verifyManifest, rt as SkillCatalog, s as InteractionRequest, st as SkillInstallSource, t as Artifact, tn as unzipWithLimits, tt as SkillArchiveDetection, u as LlmCompleteInput, ut as SkillManagerPort, v as MemoryStore, vt as TrustedKey, w as UiSpecDrafts, wt as WebSkillError, x as SkillCandidateMarker, xt as UnsignedPolicy, y as RenderBlock, yt as TrustedKeyStore, z as FsTrustedKeyStore, zt as isValidSkillName } from "./types-DLctJep_-B5G4uk2u.js";
+import { $ as LifecycleHook, $n as fromVercelStreamPart, $t as SkillOutcomeReporter, A as DocxTextExtractor, An as UserProfileEntry, Ar as toRecordDigests, At as RunTraceStore, B as FsRunTraceStore, Bn as applyUserProfileImport, Bt as SchemaInferer, C as CapabilityApproval, Cn as USER_PROFILE_EXPORT_VERSION, Cr as schemaToForm, Ct as RunSnapshotListEntry, D as DEFAULT_MAX_DOCUMENT_BYTES, Dn as USER_PROFILE_REFINE_PROMPT, Dr as summarizeToolCalls, Dt as RunTraceFile, E as DEFAULT_MAX_DATA_SOURCE_BYTES, En as USER_PROFILE_PROMPT_HEADER, Er as summarizeRunUsage, Et as RunToolCall, F as ExternalToolSource, Fn as WebSkillApi, Ft as RuntimeSession, G as GoogleGenAiClientConfig, Gn as diffUserProfile, Gt as SealResult, H as FsToolStepStore, Hn as buildRenderResult, Ht as ScriptExecutor, I as FS_SESSION_PAGE_SIZE, In as WebSkillRuntime, It as RuntimeSessionHandle, J as InstalledSkillManifest, Jn as extractTodoTraceEvents, Jt as SessionMeta, K as HookRunner, Kn as exportUserProfile, Kt as SerializingMemoryStore, L as FsArtifactStore, Ln as WebSkillRuntimeDeps, Lt as SENSITIVE_ANNOTATION, M as EventBus, Mn as UserProfileImportDiff, Mr as validateUiSpecEvent, Mt as RunUsageSummary, N as ExecuteLifecycleData, Nn as UserProfileLimits, Nr as validateUiSpecNode, Nt as RuntimePhase, O as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, On as UnsupportedRunSnapshot, Or as textParts, Ot as RunTraceFilter, P as ExternalSkillProvider, Pn as VercelToolSpec, Pt as RuntimeRun, Q as LifecycleEventInit, Qn as fromVercelResult, Qt as SkillIntegrityGuard, R as FsMemoryStore, Rn as XlsxTextExtractor, Rt as SESSION_SCHEMA_VERSION, S as BridgeResponse, Sn as UNSUPPORTED_DOCUMENT_MESSAGE, Sr as schemaSourceLabel, St as RunSnapshot, T as DEFAULT_LOOP_LIMITS, Tn as USER_PROFILE_NO_INVENTION_RULE, Tr as sealToolCallPairs, Tt as RunTerminationReason, U as FullDisclosureRouter, Un as createScriptContext, Ut as SealOptions, V as FsSessionStore, Vn as bridgeError, Vt as ScriptExecutionContext, W as GoogleGenAiClient, Wn as createWebSkillApi, Wt as SealRecord, X as InteractLifecycleData, Xn as findUnpairedToolCalls, Xt as SessionStore, Y as IntegrityVerdict, Yn as extractUiSpecEvents, Yt as SessionRecord, Z as LifecycleEvent, Zn as formatSkillScriptManifest, Zt as SkillFailureReport, _ as BehaviorRecordKind, _n as ToolStepTrust, _r as redactToolStepArgs, _t as RefineUserProfileInput, a as ASK_USER_TOOL, an as TEXT_BUDGETED_CONTENT_TYPES, ar as mergeProfileEntries, at as OpenAiCompatibleClient, b as BridgeCapability, bn as TraceEventType, br as resolveToolName, bt as RunLimitErrorDetails, c as AgentLoop, cn as TodoTraceEvent, cr as normalizeErrorCode, ct as ProgressiveRouter, d as AnthropicClient, dn as ToolDisclosure, dr as parseBridgeRequest, dt as READ_SKILL_FILE_INPUT_SCHEMA, en as SkillRouter, er as interruptedToolResult, et as LifecycleHookContext, f as AnthropicClientConfig, fn as ToolResolution, fr as parseUserProfileExport, ft as READ_SKILL_FILE_TOOL, g as BehaviorRecord, gn as ToolStepStore, gr as readUserProfile, gt as RedactedArgs, h as BEHAVIOR_RECORDS_KEY, hn as ToolStepRecord, hr as readProfileEntries, ht as RUN_TRACE_SCHEMA_VERSION, i as ASK_USER_MAX_FIELDS, in as SkillSuccessReport, ir as mergeCatalogEntries, it as NetworkPolicy, j as EMPTY_USER_PROFILE, jn as UserProfileExport, jr as toVercelToolSpecs, jt as RunTraceSummary, k as DEFAULT_USER_PROFILE_LIMITS, kn as UserProfile, kr as toLlmToolSpec, kt as RunTraceMetrics, l as AgentLoopConfig, ln as ToolContent, lr as normalizeToolContent, lt as READ_LINKED_DOCUMENT_TOOL, m as ApprovalScope, mn as ToolStepReader, mr as readBehaviorRecords, mt as RUN_SNAPSHOT_SCHEMA_VERSION, n as ASK_USER_FIELD_TYPES, nn as SkillScriptSchemaSource, nr as isUnsupportedRunSnapshot, nt as LinkedDocumentReader, o as ASK_USER_TOOL_NAME, on as TerminalLifecycleData, or as networkPolicyLibSource, ot as OpenAiCompatibleClientConfig, p as ApprovalDecision, pn as ToolResult, pr as partsToText, pt as READ_SKILL_FILE_TOOL_NAME, q as HookRunnerOptions, qn as extractChartSpec, qt as SessionListPage, r as ASK_USER_INPUT_SCHEMA, rn as SkillStateGuard, rr as listSkillScripts, rt as MAX_TOOL_STEP_ARG_BYTES, s as ActivateLifecycleData, sn as TextualToolContent, sr as networkUrlHost, st as PdfTextExtractor, t as ALLOWED_TOOLS_EXCLUSION_REASON, tn as SkillScriptDescriptor, tr as isNetworkAllowed, tt as LifecycleListener, u as AgentLoopDeps, un as ToolDefinition, ur as normalizeToolError, ut as READ_LINKED_DOCUMENT_TOOL_NAME, v as BehaviorScene, vn as TraceClock, vr as refineUserProfile, vt as RouteLifecycleData, w as CapabilityMode, wn as USER_PROFILE_KEY, wr as scriptToolName, wt as RunSnapshotStore, x as BridgeRequest, xn as TraceRecorder, xr as sampleBehaviorRecords, xt as RunResult, y as BridgeCapabilities, yn as TraceEvent, yr as renderUserProfileContext, yt as RouteResult, z as FsRunSnapshotStore, zn as appendBehaviorRecords, zt as SUPPORTED_DOCUMENT_MIME } from "./index-DkvBhJQy.js";
 //#region src/version.d.ts
 /** Generated by scripts/syncVersionConstant.mjs from packages/sdk/package.json. Do not edit by hand. */
 /**
  * Version of the published `@webskill/sdk` package, injected at build time.
  * @stable
  */
-declare const SDK_VERSION = "0.11.0";
+declare const SDK_VERSION = "0.13.0";
 //#endregion
-export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, type ActivateLifecycleData, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, BEHAVIOR_RECORDS_KEY, type BehaviorRecord, type BehaviorRecordKind, type BehaviorScene, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type CryptoKeyLike, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, type DiscoveryResult, type DocxTextExtractor, EMPTY_USER_PROFILE, EventBus, type ExecuteLifecycleData, type ExternalSkillProvider, type ExternalToolSource, FS_SESSION_PAGE_SIZE, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type IntegrityVerdict, type InteractLifecycleData, type InteractionOrigin, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleEventInit, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LinkedDocumentReader, type LlmClient, type LlmCompleteInput, type LlmContentPart, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmTokenUsage, type LlmToolCall, type LlmToolSpec, MANIFEST_EXCLUDED_FILES, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, type Page, type PageQuery, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, type RefineUserProfileInput, type RemoteUrlPolicy, type RenderBlock, type RenderResultRequest, type RouteLifecycleData, type RouteResult, type RunLimitErrorDetails, type RunResult, type RunSnapshot, type RunSnapshotListEntry, type RunSnapshotStore, type RunTerminationReason, type RunToolCall, type RunTraceFile, type RunTraceFilter, type RunTraceMetrics, type RunTraceStore, type RunTraceSummary, type RunUsageSummary, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SDK_VERSION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SealOptions, type SealRecord, type SealResult, SerializingMemoryStore, type SessionListPage, type SessionMeta, type SessionRecord, type SessionStore, type SignatureAuditSink, type SignatureVerdict, type SkillArchiveDetection, type SkillArchiveShape, type SkillCandidateMarker, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillFailureReport, type SkillInstallSource, type SkillIntegrityGuard, type SkillIssue, type SkillLocation, type SkillManagerPort, type SkillManifest, type SkillMetadata, type SkillOutcomeReporter, type SkillPackManifest, SkillReader, type SkillRouter, type SkillScriptDescriptor, type SkillScriptSchemaSource, type SkillSignature, type SkillSource, type SkillStateGuard, type SkillSuccessReport, type SkillsLockfile, TEXT_BUDGETED_CONTENT_TYPES, type TerminalLifecycleData, type TextualToolContent, type TodoTraceEvent, type ToolContent, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type TrustedKey, type TrustedKeyStore, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, type UiBridge, type UiSpecActionCapability, type UiSpecDrafts, type UiSpecEvent, type UiSpecNode, type UiSpecPatch, type UiSpecSnapshot, type UiSurfaceActionRequest, type UiSurfaceActionResponse, type UnsignedPolicy, type UnsupportedRunSnapshot, type UserProfile, type UserProfileEntry, type UserProfileExport, type UserProfileImportDiff, type UserProfileLimits, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };
+export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, type ActivateLifecycleData, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, BEHAVIOR_RECORDS_KEY, type BehaviorRecord, type BehaviorRecordKind, type BehaviorScene, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type CryptoKeyLike, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, type DiscoveryResult, type DocxTextExtractor, EMPTY_USER_PROFILE, EventBus, type ExecuteLifecycleData, type ExternalSkillProvider, type ExternalToolSource, FS_SESSION_PAGE_SIZE, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type IntegrityVerdict, type InteractLifecycleData, type InteractionOrigin, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleEventInit, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LinkedDocumentReader, type LlmClient, type LlmCompleteInput, type LlmContentPart, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmTokenUsage, type LlmToolCall, type LlmToolSpec, MANIFEST_EXCLUDED_FILES, MAX_TOOL_STEP_ARG_BYTES, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, type Page, type PageQuery, type PdfTextExtractor, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, type RedactedArgs, type RefineUserProfileInput, type RemoteUrlPolicy, type RenderBlock, type RenderResultRequest, type RouteLifecycleData, type RouteResult, type RunLimitErrorDetails, type RunResult, type RunSnapshot, type RunSnapshotListEntry, type RunSnapshotStore, type RunTerminationReason, type RunToolCall, type RunTraceFile, type RunTraceFilter, type RunTraceMetrics, type RunTraceStore, type RunTraceSummary, type RunUsageSummary, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SDK_VERSION, SENSITIVE_ANNOTATION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SealOptions, type SealRecord, type SealResult, SerializingMemoryStore, type SessionListPage, type SessionMeta, type SessionRecord, type SessionStore, type SignatureAuditSink, type SignatureVerdict, type SkillArchiveDetection, type SkillArchiveShape, type SkillCandidateMarker, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillFailureReport, type SkillInstallSource, type SkillIntegrityGuard, type SkillIssue, type SkillLocation, type SkillManagerPort, type SkillManifest, type SkillMetadata, type SkillOutcomeReporter, type SkillPackManifest, SkillReader, type SkillRouter, type SkillScriptDescriptor, type SkillScriptSchemaSource, type SkillSignature, type SkillSource, type SkillStateGuard, type SkillSuccessReport, type SkillsLockfile, TEXT_BUDGETED_CONTENT_TYPES, type TerminalLifecycleData, type TextualToolContent, type TodoTraceEvent, type ToolContent, type ToolDefinition, type ToolDisclosure, type ToolResolution, type ToolResult, type ToolStepReader, type ToolStepRecord, type ToolStepStore, type ToolStepTrust, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type TrustedKey, type TrustedKeyStore, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, type UiBridge, type UiSpecActionCapability, type UiSpecDrafts, type UiSpecEvent, type UiSpecNode, type UiSpecPatch, type UiSpecSnapshot, type UiSurfaceActionRequest, type UiSurfaceActionResponse, type UnsignedPolicy, type UnsupportedRunSnapshot, type UserProfile, type UserProfileEntry, type UserProfileExport, type UserProfileImportDiff, type UserProfileLimits, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, type XlsxTextExtractor, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, redactToolStepArgs, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { A as jsonRenderer, B as resolveArchiveLimits, C as computeDigest, D as exportSkills, E as escapeXml, F as parseSkillPackManifest, G as unzipWithLimits, H as signSkill, I as readResponseWithLimit, J as verifySkillSignature, K as validateSkills, L as readSkillSignature, M as messageOf, N as normalizePath, O as isAtomicTempPath, P as parseSkillMarkdown, R as renderAvailableSkillsXml, S as checkSkillRules, T as detectSkillArchiveShapeFromFs, U as signaturePayloadBytes, V as resolveInsideRoot, W as stripArchiveRoot, Y as xmlRenderer, _ as assertSafePathSegment, a as MemoryFS, b as buildManifest, c as SKILL_MANIFEST_FILE, d as SKILL_PACK_FILE, f as SKILL_SIGNATURE_FILE, g as assertRemoteUrlAllowed, h as WebSkillError, i as MANIFEST_EXCLUDED_FILES, j as keyIdOf, k as isValidSkillName, l as SKILL_NAME_MAX_LENGTH, m as SkillReader, n as DEFAULT_ARCHIVE_LIMITS, o as SIGNATURE_SCHEMA_VERSION, p as SkillDiscovery, q as verifyManifest, r as FsTrustedKeyStore, s as SKILLS_LOCKFILE, t as ATOMIC_TMP_SUFFIX_PATTERN, u as SKILL_NAME_PATTERN, v as atomicWriteText, w as detectSkillArchiveShape, x as checkDependencyCycles, y as buildCatalog, z as renderCatalogJson } from "./dist-Bev6i6Ip.js";
 import { a as textParts, n as partsToText } from "./memoryArtifactStore-52Zn9npI-LbCQaqyx.js";
-import { $ as createWebSkillApi, A as READ_LINKED_DOCUMENT_TOOL_NAME, At as schemaSourceLabel, B as TraceRecorder, Bt as validateUiSpecNode, C as FsSessionStore, Ct as readBehaviorRecords, D as OpenAiCompatibleClient, Dt as renderUserProfileContext, E as HookRunner, Et as refineUserProfile, F as RUN_TRACE_SCHEMA_VERSION, Ft as summarizeToolCalls, G as USER_PROFILE_PROMPT_HEADER, H as USER_PROFILE_EXPORT_VERSION, I as SESSION_SCHEMA_VERSION, It as toLlmToolSpec, J as appendBehaviorRecords, K as USER_PROFILE_REFINE_PROMPT, L as SUPPORTED_DOCUMENT_MIME, Lt as toRecordDigests, M as READ_SKILL_FILE_TOOL, Mt as scriptToolName, N as READ_SKILL_FILE_TOOL_NAME, Nt as sealToolCallPairs, O as ProgressiveRouter, Ot as resolveToolName, P as RUN_SNAPSHOT_SCHEMA_VERSION, Pt as summarizeRunUsage, Q as createScriptContext, R as SerializingMemoryStore, Rt as toVercelToolSpecs, S as FsRunTraceStore, St as parseUserProfileExport, T as GoogleGenAiClient, Tt as readUserProfile, U as USER_PROFILE_KEY, V as UNSUPPORTED_DOCUMENT_MESSAGE, W as USER_PROFILE_NO_INVENTION_RULE, X as bridgeError, Y as applyUserProfileImport, Z as buildRenderResult, _ as EventBus, _t as networkUrlHost, a as ASK_USER_TOOL, at as extractUiSpecEvents, b as FsMemoryStore, bt as normalizeToolError, c as AnthropicClient, ct as fromVercelResult, d as DEFAULT_LOOP_LIMITS, dt as isNetworkAllowed, et as diffUserProfile, f as DEFAULT_MAX_DATA_SOURCE_BYTES, ft as isUnsupportedRunSnapshot, g as EMPTY_USER_PROFILE, gt as networkPolicyLibSource, h as DEFAULT_USER_PROFILE_LIMITS, ht as mergeProfileEntries, i as ASK_USER_MAX_FIELDS, it as extractTodoTraceEvents, j as READ_SKILL_FILE_INPUT_SCHEMA, jt as schemaToForm, k as READ_LINKED_DOCUMENT_TOOL, kt as sampleBehaviorRecords, l as BEHAVIOR_RECORDS_KEY, lt as fromVercelStreamPart, m as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, mt as mergeCatalogEntries, n as ASK_USER_FIELD_TYPES, nt as extractChartSpec, o as ASK_USER_TOOL_NAME, ot as findUnpairedToolCalls, p as DEFAULT_MAX_DOCUMENT_BYTES, pt as listSkillScripts, q as WebSkillRuntime, r as ASK_USER_INPUT_SCHEMA, rt as extractSkillCandidate, s as AgentLoop, st as formatSkillScriptManifest, t as ALLOWED_TOOLS_EXCLUSION_REASON, tt as exportUserProfile, u as CapabilityApproval, ut as interruptedToolResult, v as FS_SESSION_PAGE_SIZE, vt as normalizeErrorCode, w as FullDisclosureRouter, wt as readProfileEntries, x as FsRunSnapshotStore, xt as parseBridgeRequest, y as FsArtifactStore, yt as normalizeToolContent, z as TEXT_BUDGETED_CONTENT_TYPES, zt as validateUiSpecEvent } from "./dist-B-cOu08W.js";
+import { $ as bridgeError, A as ProgressiveRouter, At as refineUserProfile, B as SUPPORTED_DOCUMENT_MIME, Bt as toLlmToolSpec, C as FsSessionStore, Ct as normalizeToolError, D as HookRunner, Dt as readProfileEntries, E as GoogleGenAiClient, Et as readBehaviorRecords, F as READ_SKILL_FILE_TOOL_NAME, Ft as schemaToForm, G as USER_PROFILE_EXPORT_VERSION, H as TEXT_BUDGETED_CONTENT_TYPES, Ht as toVercelToolSpecs, I as RUN_SNAPSHOT_SCHEMA_VERSION, It as scriptToolName, J as USER_PROFILE_PROMPT_HEADER, K as USER_PROFILE_KEY, L as RUN_TRACE_SCHEMA_VERSION, Lt as sealToolCallPairs, M as READ_LINKED_DOCUMENT_TOOL_NAME, Mt as resolveToolName, N as READ_SKILL_FILE_INPUT_SCHEMA, Nt as sampleBehaviorRecords, O as MAX_TOOL_STEP_ARG_BYTES, Ot as readUserProfile, P as READ_SKILL_FILE_TOOL, Pt as schemaSourceLabel, Q as applyUserProfileImport, R as SENSITIVE_ANNOTATION, Rt as summarizeRunUsage, S as FsRunTraceStore, St as normalizeToolContent, T as FullDisclosureRouter, Tt as parseUserProfileExport, U as TraceRecorder, Ut as validateUiSpecEvent, V as SerializingMemoryStore, Vt as toRecordDigests, W as UNSUPPORTED_DOCUMENT_MESSAGE, Wt as validateUiSpecNode, X as WebSkillRuntime, Y as USER_PROFILE_REFINE_PROMPT, Z as appendBehaviorRecords, _ as EventBus, _t as mergeCatalogEntries, a as ASK_USER_TOOL, at as extractChartSpec, b as FsMemoryStore, bt as networkUrlHost, c as AnthropicClient, ct as extractUiSpecEvents, d as DEFAULT_LOOP_LIMITS, dt as fromVercelResult, et as buildRenderResult, f as DEFAULT_MAX_DATA_SOURCE_BYTES, ft as fromVercelStreamPart, g as EMPTY_USER_PROFILE, gt as listSkillScripts, h as DEFAULT_USER_PROFILE_LIMITS, ht as isUnsupportedRunSnapshot, i as ASK_USER_MAX_FIELDS, it as exportUserProfile, j as READ_LINKED_DOCUMENT_TOOL, jt as renderUserProfileContext, k as OpenAiCompatibleClient, kt as redactToolStepArgs, l as BEHAVIOR_RECORDS_KEY, lt as findUnpairedToolCalls, m as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, mt as isNetworkAllowed, n as ASK_USER_FIELD_TYPES, nt as createWebSkillApi, o as ASK_USER_TOOL_NAME, ot as extractSkillCandidate, p as DEFAULT_MAX_DOCUMENT_BYTES, pt as interruptedToolResult, q as USER_PROFILE_NO_INVENTION_RULE, r as ASK_USER_INPUT_SCHEMA, rt as diffUserProfile, s as AgentLoop, st as extractTodoTraceEvents, t as ALLOWED_TOOLS_EXCLUSION_REASON, tt as createScriptContext, u as CapabilityApproval, ut as formatSkillScriptManifest, v as FS_SESSION_PAGE_SIZE, vt as mergeProfileEntries, w as FsToolStepStore, wt as parseBridgeRequest, x as FsRunSnapshotStore, xt as normalizeErrorCode, y as FsArtifactStore, yt as networkPolicyLibSource, z as SESSION_SCHEMA_VERSION, zt as summarizeToolCalls } from "./dist-ExSQky4C.js";
 
 //#region src/version.ts
 /** Generated by scripts/syncVersionConstant.mjs from packages/sdk/package.json. Do not edit by hand. */
@@ -8,7 +8,7 @@ import { $ as createWebSkillApi, A as READ_LINKED_DOCUMENT_TOOL_NAME, At as sche
 * Version of the published `@webskill/sdk` package, injected at build time.
 * @stable
 */
-const SDK_VERSION = "0.11.0";
+const SDK_VERSION = "0.13.0";
 
 //#endregion
-export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, AgentLoop, AnthropicClient, BEHAVIOR_RECORDS_KEY, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, EMPTY_USER_PROFILE, EventBus, FS_SESSION_PAGE_SIZE, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MANIFEST_EXCLUDED_FILES, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, SDK_VERSION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, SkillReader, TEXT_BUDGETED_CONTENT_TYPES, TraceRecorder, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, WebSkillError, WebSkillRuntime, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };
+export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, AgentLoop, AnthropicClient, BEHAVIOR_RECORDS_KEY, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_USER_PROFILE_LIMITS, EMPTY_USER_PROFILE, EventBus, FS_SESSION_PAGE_SIZE, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MANIFEST_EXCLUDED_FILES, MAX_TOOL_STEP_ARG_BYTES, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, SDK_VERSION, SENSITIVE_ANNOTATION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, SerializingMemoryStore, SkillDiscovery, SkillReader, TEXT_BUDGETED_CONTENT_TYPES, TraceRecorder, UNSUPPORTED_DOCUMENT_MESSAGE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, WebSkillError, WebSkillRuntime, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, redactToolStepArgs, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-C26b05fW-CdrRCRDb.js";
-import { F as ExternalToolSource, P as ExternalSkillProvider, qn as mergeCatalogEntries, sn as ToolResult } from "./index-D3mONFHD.js";
+import { B as JsonSchema, _ as LlmToolSpec, it as SkillCatalogEntry, ot as SkillDocument } from "./types-DLctJep_-B5G4uk2u.js";
+import { F as ExternalToolSource, P as ExternalSkillProvider, dn as ToolDisclosure, ir as mergeCatalogEntries, pn as ToolResult } from "./index-DkvBhJQy.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -288,6 +288,13 @@ declare class ExperimentalWebMcpAdapter {
 }
 //#endregion
 //#region src/plugin/mcpRuntimePlugin.d.ts
+/**
+ * 披露层级（分册 19）。与 runtime 的 `ToolDisclosure` 同义，保留 mcp 侧命名以便宿主按包对齐。
+ *
+ * 它与启停（`McpToolVisibility` 的三个 boolean 回调）作用面不同：
+ * 禁用同时管暴露与调用，`on-demand` **只管暴露**——没被点名的按需工具照样调得动。
+ */
+type McpToolDisclosure = ToolDisclosure;
 /**
  * 工具可见性策略（0.10.0 UI-UX5 #50.3）：端点禁用 ∨ 工具禁用 ⇒ 不进 LLM tool spec，
  * 调用侧同样拦截（模型找不到这些工具）。各判定缺省视为启用。
@@ -304,6 +311,28 @@ interface McpToolVisibility {
    * 宿主按来源关 → 该组全灭；按工具关 → 只灭一个。
    */
   isWebMcpToolEnabled?(tool: string, sourceId?: string): boolean;
+  /**
+   * 端点级披露层级（分册 19 / FR-19.1）；该端点全部工具的默认值。
+   * 返回 `undefined` = 不表态（最终落到 `always`）。
+   */
+  endpointDisclosure?(endpoint: string): McpToolDisclosure | undefined;
+  /** 端点工具级披露层级；返回 `undefined` 才继承端点级（就近覆盖） */
+  endpointToolDisclosure?(endpoint: string, tool: string): McpToolDisclosure | undefined;
+  /** WebMCP 工具级披露层级；`sourceId` 为空即未命名来源 */
+  webMcpToolDisclosure?(tool: string, sourceId?: string): McpToolDisclosure | undefined;
+}
+/**
+ * 参数留存的宿主侧信任声明（分册 30 / FR-30.6）。
+ *
+ * 声明只吃 endpoint / sourceId 这两个**宿主配置里的标识**，
+ * 不读工具 schema、不读工具描述、不读服务器元数据——服务器自称可信不算数。
+ * 缺省不信任；信任只影响脱敏判定，不影响可见性与审批。
+ */
+interface McpSourceTrust {
+  /** 宿主声明「这台端点的工具 schema 我审查过」 */
+  isEndpointTrusted?(endpoint: string): boolean;
+  /** WebMCP 来源同款；`sourceId` 为空即未命名的那一个 */
+  isWebMcpSourceTrusted?(sourceId: string | undefined): boolean;
 }
 /**
  * runtime 扩展点实现：endpoint 注册表 + WebMCP adapter 一处装配。
@@ -318,11 +347,26 @@ declare class McpRuntimePlugin implements ExternalToolSource {
     resolver?: McpToolResolver;
     /** 工具可见性策略（端点/工具级启停）；缺省全部可见 */
     visibility?: McpToolVisibility;
+    /** 参数留存的信任声明（分册 30）；**缺省不信任** */
+    trust?: McpSourceTrust;
     /** 已知的 endpoint 名（注销后仍按 MCP_ENDPOINT_UNAVAILABLE 响应，而非 TOOL_NOT_FOUND） */
     endpoints?: string[];
     /** endpoint 不可用时的告警出口（默认 console.warn） */
     onWarning?(message: string): void;
   });
+  /**
+   * 工具的披露层级（分册 19 / FR-19.2）。本方法只**如实回答层级**，不做过滤——
+   * 「有没有技能点名」是 run 状态，mcp 包看不到，过滤发生在 agentLoop 的暴露点。
+   */
+  disclosure(llmToolName: string): McpToolDisclosure;
+  /**
+   * 参数留存的信任判定（分册 30 / FR-30.6）。
+   * 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+   */
+  argCaptureTrust(llmToolName: string): {
+    tier: 'host-trusted';
+    declaredBy?: string;
+  } | undefined;
   listToolSpecs(): Promise<LlmToolSpec[]>;
   canHandle(llmToolName: string): boolean;
   call(llmToolName: string, args: Record<string, unknown>): Promise<ToolResult>;
@@ -471,4 +515,4 @@ interface RemoteEndpointHandle {
  */
 declare function connectRemoteEndpoint(registry: EndpointRegistry<McpClientLike>, config: RemoteEndpointConfig): Promise<RemoteEndpointHandle>;
 //#endregion
-export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, WEB_MCP_SOURCE_ID_MAX, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+export { type BrowserModelContextLike, EndpointRegistry, ExperimentalWebMcpAdapter, type McpClientLike, type McpOAuthClient, type McpOAuthConfig, type McpOAuthHandshake, type McpOAuthHandshakeStore, type McpOAuthProvider, type McpOAuthStage, type McpOAuthTokenStore, type McpOAuthTokens, McpRuntimePlugin, type McpSourceTrust, type McpToolDisclosure, McpToolResolver, type McpToolVisibility, MessageChannelTransport, type MessageChannelTransportOptions, type MessagePortLike, type RemoteEndpointConfig, type RemoteEndpointHandle, type ServedSkill, TemporarySkillProvider, type TransportState, WEB_MCP_SOURCE_ID_MAX, type WebMcpToolDescriptor, type WebMcpToolLike, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { M as messageOf, g as assertRemoteUrlAllowed, h as WebSkillError } from "./dist-Bev6i6Ip.js";
-import { mt as mergeCatalogEntries, yt as normalizeToolContent } from "./dist-B-cOu08W.js";
+import { St as normalizeToolContent, _t as mergeCatalogEntries } from "./dist-ExSQky4C.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -311,6 +311,15 @@ const textOfContent = (content) => {
 	return "";
 };
 /**
+* 端点不提供 prompts 等于「没有临时技能」，不是加载失败。
+* 两条路径都要认：客户端本地能力断言，以及服务端回的 JSON-RPC -32601。
+*/
+const isPromptsUnsupported = (e) => {
+	if (typeof e !== "object" || e === null) return false;
+	if (e.code === -32601) return true;
+	return /does not support prompts/i.test(messageOf(e));
+};
+/**
 * 消费端：endpoint 的 prompts → 临时技能（source:'mcp'，随 endpoint 生灭）；
 * resources → 可读 references（readFile 的 path 即 resource URI）。
 */
@@ -329,7 +338,10 @@ var TemporarySkillProvider = class {
 		} catch {
 			return [];
 		}
-		const { prompts } = await client.listPrompts();
+		const { prompts } = await client.listPrompts().catch((e) => {
+			if (isPromptsUnsupported(e)) return { prompts: [] };
+			throw e;
+		});
 		const resources = await client.listResources().catch(() => ({ resources: [] }));
 		return prompts.map((p) => ({
 			name: p.name,
@@ -580,6 +592,7 @@ var McpRuntimePlugin = class {
 	*/
 	#webMcp;
 	#visibility;
+	#trust;
 	#configuredEndpoints;
 	#onWarning;
 	constructor(deps) {
@@ -587,6 +600,7 @@ var McpRuntimePlugin = class {
 		this.#resolver = deps.resolver ?? new McpToolResolver(deps.registry);
 		this.#webMcp = deps.webMcp ?? [];
 		this.#visibility = deps.visibility;
+		this.#trust = deps.trust;
 		this.#configuredEndpoints = deps.endpoints ?? [];
 		this.#onWarning = deps.onWarning ?? ((message) => console.warn(message));
 	}
@@ -610,6 +624,69 @@ var McpRuntimePlugin = class {
 			return true;
 		}
 	}
+	/**
+	* 信任回调统一求值。**刻意不复用 `#visible()`**：两者的失败代价不对称。
+	* 可见性判不出来最坏是工具从列表里消失；信任判不出来而放行，落盘的就是明文。
+	* 因此这里缺省 false、异常也按 false，并同样走 onWarning。
+	*/
+	#trusted(probe) {
+		try {
+			return probe() === true;
+		} catch (e) {
+			this.#onWarning(`[webskill] MCP trust callback failed; treating the source as untrusted: ${e instanceof Error ? e.message : String(e)}`);
+			return false;
+		}
+	}
+	/**
+	* 披露层级求值。**刻意不复用 `#visible()`**：那个的返回值同时喂给 `listToolSpecs` 与 `call`，
+	* 合并会让按需工具被 `disabledResult()` 拦住——把「只省 token」变成「限制访问」。
+	*
+	* 返回 `undefined` = 该级不表态，交由上一级决定；异常直接按 `always` 定案（不再回落），
+	* 判不出来时多给一个工具，比整轮工具集塌陷、模型转而幻觉的代价小。
+	*/
+	#disclosureOf(probe) {
+		try {
+			return probe();
+		} catch (e) {
+			this.#onWarning(`[webskill] MCP disclosure callback failed; treating the tool as always disclosed: ${e instanceof Error ? e.message : String(e)}`);
+			return "always";
+		}
+	}
+	/**
+	* 工具的披露层级（分册 19 / FR-19.2）。本方法只**如实回答层级**，不做过滤——
+	* 「有没有技能点名」是 run 状态，mcp 包看不到，过滤发生在 agentLoop 的暴露点。
+	*/
+	disclosure(llmToolName) {
+		const parsed = parseWebMcpToolLlmName(llmToolName, this.#sourceIds());
+		if (parsed !== void 0) return this.#disclosureOf(() => this.#visibility?.webMcpToolDisclosure?.(parsed.toolName, parsed.sourceId)) ?? "always";
+		for (const endpoint of this.#endpoints()) {
+			const toolName = parseEndpointToolLlmName(endpoint, llmToolName);
+			if (toolName === void 0) continue;
+			return this.#disclosureOf(() => this.#visibility?.endpointToolDisclosure?.(endpoint, toolName)) ?? this.#disclosureOf(() => this.#visibility?.endpointDisclosure?.(endpoint)) ?? "always";
+		}
+		return "always";
+	}
+	/**
+	* 参数留存的信任判定（分册 30 / FR-30.6）。
+	* 只按宿主配置里的 endpoint / sourceId 判，服务器传回的内容进不了这条路径。
+	*/
+	argCaptureTrust(llmToolName) {
+		const parsed = parseWebMcpToolLlmName(llmToolName, this.#sourceIds());
+		if (parsed !== void 0) {
+			if (!this.#trusted(() => this.#trust?.isWebMcpSourceTrusted?.(parsed.sourceId))) return void 0;
+			return {
+				tier: "host-trusted",
+				declaredBy: `webmcp:${parsed.sourceId ?? ""}`
+			};
+		}
+		const endpoint = this.#endpoints().find((name) => parseEndpointToolLlmName(name, llmToolName) !== void 0);
+		if (endpoint === void 0) return void 0;
+		if (!this.#trusted(() => this.#trust?.isEndpointTrusted?.(endpoint))) return void 0;
+		return {
+			tier: "host-trusted",
+			declaredBy: endpoint
+		};
+	}
 	async listToolSpecs() {
 		const specs = [];
 		for (const endpoint of this.#endpoints()) {

package/dist/node.d.ts

@@ -1,6 +1,6 @@
-import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-C26b05fW-CdrRCRDb.js";
-import { Dn as WebSkillRuntimeDeps, En as WebSkillRuntime, Ft as SchemaInferer, It as ScriptExecutionContext, L as FsArtifactStore, Lt as ScriptExecutor, Mn as createScriptContext, R as FsMemoryStore, an as ToolDefinition, m as ApprovalScope, nt as NetworkPolicy, sn as ToolResult, y as BridgeCapabilities } from "./index-D3mONFHD.js";
-import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-BcmFLykd.js";
+import { $ as SignatureAuditSink, B as JsonSchema, Ct as VerifyResult, J as SKILL_MANIFEST_FILE, L as FileStat, M as ArchiveLimits, R as FileSystemProvider, S as UiBridge, _t as SkillsLockfile, b as RenderResultRequest, c as InteractionResponse, dt as SkillManifest, q as SKILLS_LOCKFILE, s as InteractionRequest, st as SkillInstallSource, ut as SkillManagerPort, xt as UnsignedPolicy, yt as TrustedKeyStore } from "./types-DLctJep_-B5G4uk2u.js";
+import { Bt as SchemaInferer, Ht as ScriptExecutor, In as WebSkillRuntime, L as FsArtifactStore, Ln as WebSkillRuntimeDeps, R as FsMemoryStore, Un as createScriptContext, Vt as ScriptExecutionContext, it as NetworkPolicy, m as ApprovalScope, pn as ToolResult, un as ToolDefinition, y as BridgeCapabilities } from "./index-DkvBhJQy.js";
+import { a as AuditLog, b as SkillVersionStore, d as CandidateSkill, m as CandidateStore, r as ApprovalPolicy } from "./skillVersionStore-D-qHk9ZE-DheTIwAB.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-AK3cSMEA-Dli6QU5E.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts