@webskill/sdk 0.13.0 → 0.15.0

package/dist/urlSafety-CiSuCJvX.js

@@ -0,0 +1,65 @@
+import { t as WebSkillError } from "./errors-BDZNpC13.js";
+
+//#region ../core/src/net/urlSafety.ts
+const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "localhost."]);
+function ipv4Octets(host) {
+	const parts = host.split(".");
+	if (parts.length !== 4) return void 0;
+	const octets = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : NaN);
+	return octets.every((n) => n >= 0 && n <= 255) ? octets : void 0;
+}
+function isPrivateIpv4(octets) {
+	const [a, b] = octets;
+	return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+}
+function isPrivateIpv6(host) {
+	const h = host.toLowerCase();
+	if (h === "::1" || h === "::") return true;
+	const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+	if (mapped) {
+		const octets = ipv4Octets(mapped[1]);
+		return octets !== void 0 && isPrivateIpv4(octets);
+	}
+	const mappedHex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+	if (mappedHex) {
+		const hi = parseInt(mappedHex[1], 16);
+		const lo = parseInt(mappedHex[2], 16);
+		return isPrivateIpv4([
+			hi >> 8,
+			hi & 255,
+			lo >> 8,
+			lo & 255
+		]);
+	}
+	const first = h.split(":")[0];
+	if (/^[0-9a-f]{1,4}$/.test(first)) {
+		const n = parseInt(first, 16);
+		if ((n & 65472) === 65152) return true;
+		if ((n & 65024) === 64512) return true;
+	}
+	return false;
+}
+function isPrivateHost(hostname) {
+	const host = hostname.toLowerCase();
+	if (LOOPBACK_HOSTNAMES.has(host) || host.endsWith(".localhost")) return true;
+	const v4 = ipv4Octets(host);
+	if (v4) return isPrivateIpv4(v4);
+	if (host.startsWith("[") && host.endsWith("]")) return isPrivateIpv6(host.slice(1, -1));
+	if (host.includes(":")) return isPrivateIpv6(host);
+	return false;
+}
+/**
+* 校验远程 URL 是否允许连接；违规抛 NETWORK_BLOCKED。
+* rawUrl 非合法 URL 时抛 TypeError（由调用方按自身错误码包装）。
+*/
+function assertRemoteUrlAllowed(rawUrl, policy = {}) {
+	const url = new URL(rawUrl);
+	if (url.protocol === "http:") {
+		if (!policy.allowHttp) throw new WebSkillError("NETWORK_BLOCKED", `Insecure URL scheme "http:" is not allowed (opt in via allowHttp): ${url.href}`);
+	} else if (url.protocol !== "https:") throw new WebSkillError("NETWORK_BLOCKED", `URL scheme "${url.protocol}" is not allowed (https only): ${url.href}`);
+	if (!policy.allowPrivateHosts && isPrivateHost(url.hostname)) throw new WebSkillError("NETWORK_BLOCKED", `Refusing to connect to a private/loopback/link-local address: ${url.hostname}`);
+	return url;
+}
+
+//#endregion
+export { assertRemoteUrlAllowed as t };

package/dist/webSkillApi-DOOyz2G5.js

@@ -0,0 +1,106 @@
+import { t as WebSkillError } from "./errors-BDZNpC13.js";
+import { b as parseSkillMarkdown, i as buildCatalog, n as SkillDiscovery, t as validateSkills } from "./skill-CAJMsLod.js";
+import { f as WebSkillRuntime } from "./approval-BnLLCOG0.js";
+
+//#region ../runtime/src/facade/webSkillApi.ts
+/**
+* navigator.webskill 门面装配层：零新业务逻辑，全部直转
+* SkillDiscovery / validateSkills / WebSkillRuntime / SkillManager。
+* @stable
+*/
+function createWebSkillApi(deps) {
+	const { fs, roots } = deps;
+	let runtime;
+	const discoveries = /* @__PURE__ */ new Map();
+	const discoveryFor = (paths) => {
+		const key = paths.join("");
+		let discovery = discoveries.get(key);
+		if (!discovery) {
+			discovery = new SkillDiscovery(fs, paths);
+			discoveries.set(key, discovery);
+		}
+		return discovery;
+	};
+	const lazyRuntime = () => {
+		runtime ??= new WebSkillRuntime({
+			fs,
+			roots,
+			llm: deps.llm,
+			...deps.executor ? { executor: deps.executor } : {},
+			...deps.artifactStore ? { artifactStore: deps.artifactStore } : {},
+			...deps.loopConfig ? { config: deps.loopConfig } : {}
+		});
+		return runtime;
+	};
+	const requireManager = () => {
+		if (!deps.skillManager) throw new WebSkillError("TOOL_UNSUPPORTED", "No skill manager is configured; install/uninstall is unavailable");
+		return deps.skillManager;
+	};
+	return {
+		async discover(path) {
+			const { entries } = await discoveryFor([path]).discover();
+			return buildCatalog(entries);
+		},
+		async read(name) {
+			const { entries } = await discoveryFor(roots).discover();
+			const entry = entries.find((e) => e.name === name);
+			if (!entry) throw new WebSkillError("SKILL_NOT_FOUND", `Unknown skill: ${name}`);
+			const skillMdPath = `${entry.root}/SKILL.md`;
+			const { metadata, body } = parseSkillMarkdown(await fs.readText(skillMdPath));
+			return {
+				metadata,
+				body,
+				location: {
+					skillRoot: entry.root,
+					skillMdPath,
+					source: entry.source
+				}
+			};
+		},
+		validate(path) {
+			return validateSkills(fs, [path]);
+		},
+		async run(prompt) {
+			return (await lazyRuntime().run(prompt)).run;
+		},
+		async install(url) {
+			const manifest = await requireManager().install(sourceFromUrl(url));
+			return {
+				name: manifest.name,
+				...manifest.version !== void 0 ? { version: manifest.version } : {},
+				installedAt: manifest.installedAt,
+				integrity: manifest.integrity
+			};
+		},
+		async uninstall(name) {
+			await requireManager().uninstall(name);
+		}
+	};
+}
+/** install URL 分派：http(s) .zip → http；.git → git（无 git 能力的 manager 自行 TOOL_UNSUPPORTED）；
+* 其余 http(s) URL → INSTALL_FAILED（不静默当 local）；非 URL → local */
+function sourceFromUrl(url) {
+	const bare = url.split("?")[0] ?? url;
+	if (/^https?:\/\//.test(url)) {
+		if (bare.endsWith(".zip")) return {
+			type: "http",
+			url
+		};
+		if (bare.endsWith(".git")) return {
+			type: "git",
+			url
+		};
+		throw new WebSkillError("INSTALL_FAILED", `Unsupported install URL "${url}" (supported: http(s) URLs ending in .zip or .git, or local paths)`);
+	}
+	if (bare.endsWith(".git")) return {
+		type: "git",
+		url
+	};
+	return {
+		type: "local",
+		path: url
+	};
+}
+
+//#endregion
+export { createWebSkillApi as t };

package/dist/{webskillLitCatalog-D_zCqeQF-C9lrvvMr.js → webskillLitCatalog-DSqVFQjK.js}

@@ -1,4 +1,6 @@
-import { Dt as uiCatalog, bt as renderMiniMarkdown, et as A2UI_CHILDREN_PROP, ft as WEBSKILL_A2UI_CATALOG_ID, gt as chartSpecFromProps, mt as a2uiComponentShapes, st as DEFAULT_SURFACE_FORM_TEXTS, yt as mountEchart } from "./dist-DqcL6jKO.js";
+import { c as DEFAULT_SURFACE_FORM_TEXTS, i as renderMiniMarkdown } from "./miniChart-owdCdaw-.js";
+import { C as chartSpecFromProps, h as uiCatalog, w as mountEchart } from "./openUiSpecLang-DuOCdw9G.js";
+import { WEBSKILL_A2UI_CATALOG_ID, a2uiComponentShapes, t as A2UI_CHILDREN_PROP } from "./ui.js";
 import { A2uiController, A2uiLitElement } from "@a2ui/lit/v0_9";
 import { Catalog } from "@a2ui/web_core/v0_9";
 import { z } from "zod/v3";
@@ -1419,7 +1421,7 @@ var f = class extends i {
 };
 
 //#endregion
-//#region ../ui/dist/webskillLitCatalog-D_zCqeQF.js
+//#region ../ui/src/a2uiRuntime/echartDirective.ts
 /**
 * Lit 元素上的 echarts 挂载指令。
 * A2UI 档的 catalog `Chart` 渲染在 shadow root 里，实例必须随元素断开而 dispose，
@@ -1458,6 +1460,9 @@ var EchartDirective = class extends f {
 	}
 };
 const echart = e(EchartDirective);
+
+//#endregion
+//#region ../ui/src/a2uiRuntime/webskillLitCatalog.ts
 /** 自定义元素 tag 前缀（同一文档里与 A2UI Basic Catalog 的 `a2ui-basic-*` 互不冲突） */
 const WEBSKILL_A2UI_TAG_PREFIX = "webskill-a2ui";
 /** 与 React 档 `specLayout.tsx` 同一组取值：语义档最小列宽与主次分栏比例 */
@@ -1932,7 +1937,10 @@ const renderers = {
       ${props["description"] ? T`<p class="muted">${str(props, "description")}</p>` : A}
     </div>
   `,
-	Custom: (props) => T` <div role="alert" class="error">Unsupported registered surface: ${str(props, "name")}</div> `
+	Custom: (props) => T`
+    <div role="alert" class="error">Unsupported registered surface: ${str(props, "name")}</div>
+  `,
+	OpenDocument: () => T` <div role="alert" class="error">Document surface is not supported by this renderer</div> `
 };
 /**
 * shape → A2UI 组件 API 的 zod schema。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "WebSkill — browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",