@webskill/sdk 0.13.0 → 0.15.0

package/dist/browser.js

@@ -1,13 +1,21 @@
-import { D as exportSkills, F as parseSkillPackManifest, G as unzipWithLimits, I as readResponseWithLimit, J as verifySkillSignature, K as validateSkills, L as readSkillSignature, M as messageOf, O as isAtomicTempPath, P as parseSkillMarkdown, T as detectSkillArchiveShapeFromFs, V as resolveInsideRoot, b as buildManifest, c as SKILL_MANIFEST_FILE, d as SKILL_PACK_FILE, g as assertRemoteUrlAllowed, h as WebSkillError, i as MANIFEST_EXCLUDED_FILES, k as isValidSkillName, p as SkillDiscovery, q as verifyManifest, s as SKILLS_LOCKFILE, v as atomicWriteText, y as buildCatalog } from "./dist-Bev6i6Ip.js";
-import { $ as bridgeError, A as ProgressiveRouter, Ct as normalizeToolError, E as GoogleGenAiClient, St as normalizeToolContent, _t as mergeCatalogEntries, b as FsMemoryStore, c as AnthropicClient, k as OpenAiCompatibleClient, nt as createWebSkillApi, s as AgentLoop, u as CapabilityApproval, wt as parseBridgeRequest, x as FsRunSnapshotStore, y as FsArtifactStore, yt as networkPolicyLibSource } from "./dist-ExSQky4C.js";
-import { D as toFrameScopes, E as toActionFrameScopes, T as frameSteps, w as frameLabel } from "./dist-GK6dtjRv.js";
-import { n as MockLlmClient } from "./testing-WPTyXQYt.js";
+import { n as messageOf, t as WebSkillError } from "./errors-BDZNpC13.js";
+import { A as SKILL_MANIFEST_FILE, D as verifySkillSignature, M as buildManifest, O as MANIFEST_EXCLUDED_FILES, P as verifyManifest, b as parseSkillMarkdown, c as unzipWithLimits, f as SKILL_PACK_FILE, i as buildCatalog, k as SKILLS_LOCKFILE, m as parseSkillPackManifest, n as SkillDiscovery, o as readResponseWithLimit, p as exportSkills, t as validateSkills, u as detectSkillArchiveShapeFromFs, w as readSkillSignature, y as isValidSkillName } from "./skill-CAJMsLod.js";
+import { a as atomicWriteText, o as isAtomicTempPath, r as resolveInsideRoot } from "./pathSecurity-B1owvJAF.js";
+import { t as assertRemoteUrlAllowed } from "./urlSafety-CiSuCJvX.js";
+import { a as networkPolicyLibSource, c as bridgeError, d as FsMemoryStore, g as FsRunSnapshotStore, l as parseBridgeRequest, nt as ProgressiveRouter, p as AgentLoop, r as normalizeToolError, s as UPLOAD_FILES_UNAVAILABLE, t as CapabilityApproval, u as FsArtifactStore } from "./approval-BnLLCOG0.js";
+import { a as GoogleGenAiClient, o as AnthropicClient, s as OpenAiCompatibleClient, t as MockLlmClient } from "./llm-B7lLH0ZI.js";
+import { n as normalizeToolContent, t as mergeCatalogEntries } from "./external-_ZRQe-V9.js";
+import { t as createWebSkillApi } from "./webSkillApi-DOOyz2G5.js";
+import { a as frameSteps, i as frameLabel, n as toActionFrameScopes, r as toFrameScopes } from "./types-TUydnxaj.js";
 
-//#region ../browser/dist/index.js
+//#region ../browser/src/fs/featureDetection.ts
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
 function isOpfsAvailable(globalScope) {
 	return typeof (globalScope ?? globalThis).navigator?.storage?.getDirectory === "function";
 }
+
+//#endregion
+//#region ../browser/src/fs/opfsProvider.ts
 const isDomException = (e, name) => e instanceof DOMException && e.name === name;
 const mapError = (e, path) => {
 	if (isDomException(e, "NotFoundError")) return new WebSkillError("FS_NOT_FOUND", `Path not found: ${path}`);
@@ -174,6 +182,9 @@ var OpfsProvider = class {
 		await this.remove(from);
 	}
 };
+
+//#endregion
+//#region ../browser/src/executor/workerBootstrap.ts
 /**
 * Worker 引导源码（字符串 → Blob URL → new Worker(url, {type:'module'})）。
 * 注意：内容为纯 JS，不能含反引号与 ${ 占位（外层用模板字符串内嵌）；
@@ -183,7 +194,7 @@ var OpfsProvider = class {
 *
 * 协议（宿主 ↔ Worker）：
 * - 宿主 → Worker：{type:'load', id, source, networkPolicy?} 请求加载脚本定义
-* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?} 请求执行
+* - 宿主 → Worker：{type:'execute', id, skillName, runId, source, args, networkPolicy?, documentSurface?} 请求执行
 * - Worker → 宿主：{type:'load-result', id, ok, definition?, error?}
 * - Worker → 宿主：{type:'execute-result', id, ok, value?, stdout, stderr, error?}
 * - Worker → 宿主：{type:'bridge', request} 能力桥 RPC（readReference/writeArtifact/confirm）
@@ -299,7 +310,7 @@ function callCapability(kind, payload) {
 }
 
 function makeContext(msg) {
-  return {
+  var ctx = {
     skillName: msg.skillName,
     runId: msg.runId,
     readReference: function (path) {
@@ -329,6 +340,21 @@ function makeContext(msg) {
       return callCapability('confirm', { message: message });
     },
   };
+  // 能力位而非能力函数：其余能力无条件挂上去（拿不到时桥对面报错），
+  // documentSurface 是个供探测的布尔值，无条件挂上去就变成恒真谎言。
+  if (msg.documentSurface) ctx.documentSurface = true;
+  // 上传文件同理：宿主没接就不能给出「存在但必然失败」的假出口（分册 17 FR-17.1）
+  if (msg.uploadFiles) {
+    ctx.listUploadFiles = function () {
+      return callCapability('listUploadFiles', {});
+    };
+    ctx.readUploadFile = function (fileId) {
+      return callCapability('readUploadFile', { fileId: fileId }).then(function (bytes) {
+        return new Uint8Array(bytes);
+      });
+    };
+  }
+  return ctx;
 }
 
 self.onmessage = async function (event) {
@@ -404,6 +430,9 @@ self.onmessage = async function (event) {
   }
 };
 `;
+
+//#endregion
+//#region ../browser/src/executor/tsTranspiler.ts
 /** 按资源地址缓存，而不是全局单例：不同地址必须各自加载，否则先到的实例会顶替后来的配置 */
 const esbuildCache = /* @__PURE__ */ new Map();
 async function loadEsbuild(options) {
@@ -466,12 +495,18 @@ var TsTranspiler = class {
 		return code;
 	}
 };
+
+//#endregion
+//#region ../browser/src/skillManagement/checksumWeb.ts
 /** WebCrypto sha256（浏览器/Worker 通用；Node 20+ 全局 crypto 同样可用） */
 async function sha256HexWeb(data) {
 	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
 	const digest = await crypto.subtle.digest("SHA-256", bytes);
 	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+
+//#endregion
+//#region ../browser/src/skillManagement/fsUtils.ts
 /** 递归拷贝目录（含子目录与二进制文件；原子写中断残留的 `.tmp-*` 不拷贝） */
 async function copyDir(fs, from, to) {
 	await fs.mkdir(to);
@@ -498,6 +533,9 @@ async function removeDirQuiet(fs, dir) {
 		if (await fs.exists(dir)) await fs.remove(dir, { recursive: true });
 	} catch {}
 }
+
+//#endregion
+//#region ../browser/src/skillManagement/zipExtract.ts
 /**
 * zip 解包（fflate 流式，单条目/总解压体积上限，浏览器无依赖）。
 * 每个条目路径过 resolveInsideRoot：拒绝 `..` 段、绝对路径、反斜杠穿越（与 node 规则一致）。
@@ -509,6 +547,9 @@ async function extractZipWeb(fs, data, destRoot, limits) {
 		else await fs.writeBinary(target, content);
 	}
 }
+
+//#endregion
+//#region ../browser/src/skillManagement/browserSkillManager.ts
 /**
 * 验签失败不能被折叠成 INSTALL_FAILED：四种失败的宿主处置完全不同
 * （引导选策略 / 提示重下 / 引导添加密钥 / 安全事件），与 Node 侧同口径。
@@ -885,6 +926,9 @@ var BrowserSkillManager = class {
 		await atomicWriteText(this.#fs, lockfilePath(this.#managedRoot), JSON.stringify(lockfile, null, 2));
 	}
 };
+
+//#endregion
+//#region ../browser/src/executor/iframeSandbox.ts
 const ENVELOPE = "__webskill_sandbox__";
 let channelSeq = 0;
 /** 每实例 channelId（防同页伪造消息注入；crypto.randomUUID 优先，无则随机回退） */
@@ -905,12 +949,16 @@ var IframeWorkerLike = class {
 	#channelId;
 	#hostWindow;
 	#hostListener;
-	constructor(iframe, hostWindow, channelId) {
+	#readyTimer;
+	constructor(iframe, hostWindow, channelId, readyTimeout) {
 		this.#iframe = iframe;
 		this.#hostWindow = hostWindow;
 		this.#channelId = channelId;
 		this.#hostListener = (event) => this.#onMessage(event);
 		this.#hostWindow.addEventListener("message", this.#hostListener);
+		if (readyTimeout) this.#readyTimer = setTimeout(() => {
+			this.#failQueue(`Sandbox document did not become ready within ${readyTimeout.ms}ms: ${readyTimeout.documentUrl}. Ensure it is listed in both manifest sandbox.pages and web_accessible_resources.`);
+		}, readyTimeout.ms);
 	}
 	get ready() {
 		return this.#ready;
@@ -919,10 +967,38 @@ var IframeWorkerLike = class {
 		return this.#channelId;
 	}
 	markReady() {
+		this.#clearReadyTimer();
 		this.#ready = true;
 		for (const payload of this.#queue) this.#post(payload);
 		this.#queue = [];
 	}
+	#clearReadyTimer() {
+		if (this.#readyTimer !== void 0) {
+			clearTimeout(this.#readyTimer);
+			this.#readyTimer = void 0;
+		}
+	}
+	/**
+	* 就绪超时（FR-12.4）：`createIframeWorker` 同步返回，超时无处可抛，只能走回包通道。
+	* 而 `#request` 按 `data.id` 匹配回包，id 对不上的消息被静默丢弃——
+	* 所以必须**逐条**回复队列里每一条消息的 id，否则调用方一直挂着。
+	*/
+	#failQueue(message) {
+		const queued = this.#queue;
+		this.#queue = [];
+		for (const payload of queued) {
+			const id = payload.id;
+			if (typeof id === "string") this.emit({
+				id,
+				ok: false,
+				error: {
+					code: "TOOL_EXECUTION_FAILED",
+					message
+				}
+			});
+		}
+		this.terminate();
+	}
 	#post(payload) {
 		this.#iframe.contentWindow?.postMessage({
 			[ENVELOPE]: true,
@@ -953,11 +1029,18 @@ var IframeWorkerLike = class {
 		for (const listener of this.#listeners) listener({ data });
 	}
 	terminate() {
+		this.#clearReadyTimer();
 		this.#hostWindow.removeEventListener("message", this.#hostListener);
 		this.#iframe.remove();
 	}
 };
-/** srcdoc 文档：内嵌 Worker 引导源码 + 双向中继（BOOTSTRAP 经 JSON 字符串注入，防 <\/script> 截断） */
+/**
+* srcdoc 文档：内嵌 Worker 引导源码 + 双向中继（BOOTSTRAP 经 JSON 字符串注入，防 <\/script> 截断）。
+*
+* **这段文本被 FR-12.5 / AC-12.1 冻结在 0.13.0 基线上**：既有网页宿主不给 `documentUrl`，
+* 必须逐字节拿到与升级前相同的沙箱文档。因此它不与 `SANDBOX_PAGE_SCRIPT_SOURCE` 共用模板——
+* 抽模板必然改动生成文本。两份中继的一致性改由行为对拍守卫（见 `sandboxRelayParity` 用例）。
+*/
 function sandboxDocument(bootstrapSource, channelId) {
 	const bootstrapJson = JSON.stringify(bootstrapSource).replace(/<\//g, "<\\/");
 	return `<!doctype html>
@@ -984,19 +1067,103 @@ parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload: { type: '
 <\/script></body></html>`;
 }
 /**
-* 创建 opaque iframe 沙箱 Worker：sandbox="allow-scripts" srcdoc iframe 承载 classic Worker。
+* 静态沙箱页的中继脚本源码（分册 12 / FR-12.3）。
+*
+* 宿主把它落成一个独立文件并用 `<script src>` 引入——**不得内联**：
+* sandbox 页虽允许 `unsafe-inline`，但外链能让「沙箱页脚本 = SDK 原样产物」在审计时可核对。
+*
+* 与 srcdoc 形态的两点区别，都源于「静态页在加载完时还不知道要跑什么」：
+* - **引导源码**随宿主的 `sandbox-init` 消息到达，而不是内嵌在文档里；
+* - **channelId** 由第一条来自 `parent` 的消息 latch。SDK 导出的是一份与宿主无关的源码，
+*   不可能预知宿主这次生成的 id。latch 前先认 `event.source === parent`：少了这句，
+*   任何把本页嵌进去的第三方 frame 都能抢先 latch 一个自己的 id，
+*   让真正的宿主消息全部被丢弃——一个纯粹的拒绝服务面。
+*
+* 本源码不含任何扩展 API：sandbox 页拿不到它们（实证）。
+* `ENVELOPE` 与宿主侧同源（同一个模块常量），两边各写一份字面量会在改名时静默失配。
+* @experimental
+*/
+const SANDBOX_PAGE_SCRIPT_SOURCE = `const ENVELOPE = ${JSON.stringify(ENVELOPE)};
+let CHANNEL_ID = null;
+let worker = null;
+function post(payload) {
+  parent.postMessage({ [ENVELOPE]: true, channelId: CHANNEL_ID, payload }, '*');
+}
+function startWorker(bootstrapSource) {
+  if (worker || typeof bootstrapSource !== 'string') return;
+  const blob = new Blob([bootstrapSource], { type: 'text/javascript' });
+  const url = URL.createObjectURL(blob);
+  // 注意：opaque origin 下 module Worker 无法加载（实证），classic Worker + data: URL 动态导入可用
+  worker = new Worker(url);
+  URL.revokeObjectURL(url);
+  worker.addEventListener('message', (event) => post(event.data));
+  worker.addEventListener('error', (event) => post({ type: 'sandbox-worker-error', message: event.message }));
+  post({ type: 'sandbox-ready' });
+}
+window.addEventListener('message', (event) => {
+  const data = event.data;
+  if (!data || data[ENVELOPE] !== true) return;
+  if (event.source !== parent) return;
+  if (CHANNEL_ID === null) {
+    if (typeof data.channelId !== 'string') return;
+    CHANNEL_ID = data.channelId;
+  } else if (data.channelId !== CHANNEL_ID) return;
+  const payload = data.payload;
+  if (payload && payload.type === 'sandbox-init') {
+    startWorker(payload.bootstrapSource);
+    return;
+  }
+  if (worker) worker.postMessage(payload);
+});
+`;
+/**
+* `Document` 判别式。不用 `'documentUrl' in v`：`Document` 上没有该属性，
+* 但一个只给了 `doc` 的选项对象上也没有，两者会被判到同一侧。
+*/
+function isDocument(value) {
+	return value.nodeType === 9;
+}
+/**
+* 创建 opaque iframe 沙箱 Worker：srcdoc（默认）或宿主指定的静态沙箱页承载 classic Worker。
 * 返回 IframeWorkerLike（协议与 blob Worker 完全一致：load/execute/bridge/network-blocked）。
 */
-function createIframeWorker(bootstrapSource, doc = document) {
+function createIframeWorker(bootstrapSource, options = {}) {
+	const resolved = isDocument(options) ? { doc: options } : options;
+	const doc = resolved.doc ?? document;
 	const channelId = nextChannelId();
 	const iframe = doc.createElement("iframe");
-	iframe.setAttribute("sandbox", "allow-scripts");
 	iframe.style.display = "none";
-	iframe.srcdoc = sandboxDocument(bootstrapSource, channelId);
-	const worker = new IframeWorkerLike(iframe, doc.defaultView ?? window, channelId);
+	const hostWindow = doc.defaultView ?? window;
+	const { documentUrl } = resolved;
+	if (documentUrl === void 0) {
+		iframe.setAttribute("sandbox", "allow-scripts");
+		iframe.srcdoc = sandboxDocument(bootstrapSource, channelId);
+		const worker = new IframeWorkerLike(iframe, hostWindow, channelId);
+		doc.body.appendChild(iframe);
+		return worker;
+	}
+	const readyTimeoutMs = resolved.readyTimeoutMs ?? 1e4;
+	const worker = new IframeWorkerLike(iframe, hostWindow, channelId, {
+		ms: readyTimeoutMs,
+		documentUrl
+	});
+	iframe.addEventListener("load", () => {
+		iframe.contentWindow?.postMessage({
+			[ENVELOPE]: true,
+			channelId,
+			payload: {
+				type: "sandbox-init",
+				bootstrapSource
+			}
+		}, "*");
+	});
+	iframe.src = documentUrl;
 	doc.body.appendChild(iframe);
 	return worker;
 }
+
+//#endregion
+//#region ../browser/src/executor/workerScriptExecutor.ts
 const blobWorkerFactory = () => {
 	const blob = new Blob([WORKER_BOOTSTRAP_SOURCE], { type: "text/javascript" });
 	const url = URL.createObjectURL(blob);
@@ -1109,7 +1276,9 @@ var BrowserWorkerScriptExecutor = class {
 				runId: context.runId,
 				source: script.source,
 				args,
-				networkPolicy: this.#networkPolicy
+				networkPolicy: this.#networkPolicy,
+				...context.documentSurface ? { documentSurface: true } : {},
+				...context.readUploadFile ? { uploadFiles: true } : {}
 			}, timeoutMs, (bridgeRequest) => this.#handleBridge(bridgeRequest, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!response.ok) {
 				const stderrSummary = response.stderr?.length ? ` | stderr: ${response.stderr.join(" | ").slice(0, 500)}` : "";
@@ -1195,7 +1364,7 @@ var BrowserWorkerScriptExecutor = class {
 				...details !== void 0 ? { details } : {}
 			});
 			if (decision === "allowed") return void 0;
-			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled by the sandbox capability settings` : `Capability "${capability}" was denied by the user`);
 		};
 		try {
 			switch (request.kind) {
@@ -1222,7 +1391,7 @@ var BrowserWorkerScriptExecutor = class {
 					};
 				}
 				case "fetchData": {
-					if (!context.fetchData) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"fetchData\" is disabled");
+					if (!context.fetchData) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"fetchData\" is unavailable: this host wired no data source access at all. This is not the capability switch being off — a data source has to be declared in the host settings first.");
 					const denied = await gate("fetchData", `Script "${context.skillName}" wants to fetch data source "${request.sourceId}"`, { sourceId: request.sourceId });
 					if (denied) return denied;
 					return {
@@ -1258,12 +1427,29 @@ var BrowserWorkerScriptExecutor = class {
 						value: await context.confirm(request.message)
 					};
 				}
+				case "listUploadFiles":
+					if (!context.listUploadFiles) return bridgeError(request.id, "TOOL_UNSUPPORTED", UPLOAD_FILES_UNAVAILABLE);
+					return {
+						id: request.id,
+						ok: true,
+						value: await context.listUploadFiles()
+					};
+				case "readUploadFile":
+					if (!context.readUploadFile) return bridgeError(request.id, "TOOL_UNSUPPORTED", UPLOAD_FILES_UNAVAILABLE);
+					return {
+						id: request.id,
+						ok: true,
+						value: Array.from(await context.readUploadFile(request.fileId))
+					};
 			}
 		} catch (e) {
 			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf(e));
 		}
 	}
 };
+
+//#endregion
+//#region ../browser/src/navigator.ts
 /**
 * navigator.webskill 显式装配：OPFS 默认存储 + BrowserWorkerScriptExecutor +
 * BrowserSkillManager → createWebSkillApi；target 提供时挂 target.navigator
@@ -1293,6 +1479,9 @@ function installWebSkillNavigator(config) {
 	nav["webskill"] = api;
 	return api;
 }
+
+//#endregion
+//#region ../browser/src/llm/chromeBuiltinClient.ts
 function languageModel() {
 	const candidate = globalThis.LanguageModel;
 	return typeof candidate?.availability === "function" && typeof candidate.create === "function" ? candidate : void 0;
@@ -1428,6 +1617,9 @@ var ChromeBuiltinLlmClient = class {
 		return (await probeChromeBuiltinAvailability()).available;
 	}
 };
+
+//#endregion
+//#region ../browser/src/llm/createLlmClient.ts
 /**
 * 配置 → `LlmClient`。收在 SDK 里是为了让下游只跟 `RuntimeConfigStore` 打交道，
 * 不必自己维护「provider → client 类」的映射（设计 04 §5）。
@@ -1459,6 +1651,9 @@ function createLlmClient(config) {
 		model: config.model
 	});
 }
+
+//#endregion
+//#region ../browser/src/media/dictation.ts
 function recognitionCtor() {
 	const scope = globalThis;
 	return scope.SpeechRecognition ?? scope.webkitSpeechRecognition;
@@ -1534,6 +1729,9 @@ function startDictation(options) {
 		recognition.stop();
 	} };
 }
+
+//#endregion
+//#region ../browser/src/media/compressImage.ts
 /** 动图无法在不丢帧的前提下走单帧编码管线，超限直接拒绝（裁决 D-2） */
 const UNCOMPRESSABLE_MIME_TYPES = /* @__PURE__ */ new Set(["image/gif"]);
 const QUALITY_STEPS = [
@@ -1601,6 +1799,9 @@ async function encode(bitmap, width, height, quality) {
 function formatBytes(bytes) {
 	return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 }
+
+//#endregion
+//#region ../browser/src/dom/imageCapture.ts
 /** @experimental */
 function isCaptureFailure(result) {
 	return "reason" in result;
@@ -1633,10 +1834,12 @@ function splitDataUrl(dataUrl) {
 /** 压到预算内；压不下去时把失败原因原样上抛给调用方转成 `CaptureFailure` */
 async function toBudget(id, level, blob, maxBytes) {
 	const compressed = await compressImageToBudget(blob, maxBytes);
+	const mimeType = compressed.blob.type.split(";")[0]?.trim().toLowerCase() ?? "";
+	if (!DELIVERABLE_IMAGE_MIME_TYPES.has(mimeType)) throw new Error(`the bytes normalized to "${mimeType === "" ? "no content type" : mimeType}", which is not one of ${[...DELIVERABLE_IMAGE_MIME_TYPES].join(", ")}`);
 	const buffer = await compressed.blob.arrayBuffer();
 	return {
 		id,
-		mimeType: compressed.blob.type === "" ? "application/octet-stream" : compressed.blob.type,
+		mimeType,
 		data: base64Of(new Uint8Array(buffer)),
 		level,
 		originalBytes: compressed.originalBytes,
@@ -1647,15 +1850,16 @@ async function toBudget(id, level, blob, maxBytes) {
 async function captureImg(element, id, maxBytes) {
 	const src = element.currentSrc !== "" ? element.currentSrc : element.src;
 	if (src === "") throw new Error("the <img> element has no resolved source");
+	const oversized = Math.max(element.naturalWidth, element.naturalHeight) > MAX_RASTER_EDGE;
 	const inline = splitDataUrl(src);
 	if (inline) {
 		const bytes = Uint8Array.from(atob(inline.data), (char) => char.charCodeAt(0));
-		return toBudget(id, "src", await toDeliverableBlob(new Blob([bytes], { type: inline.mimeType })), maxBytes);
+		return toBudget(id, "src", await toDeliverableBlob(new Blob([bytes], { type: inline.mimeType }), oversized), maxBytes);
 	}
 	const response = await fetch(src, { mode: "cors" });
 	if (response.type === "opaque") throw new Error("the response is opaque, so its bytes cannot be read");
 	if (!response.ok) throw new Error(`fetching the source returned HTTP ${response.status}`);
-	return toBudget(id, "src", await toDeliverableBlob(await response.blob()), maxBytes);
+	return toBudget(id, "src", await toDeliverableBlob(await response.blob(), oversized), maxBytes);
 }
 /** L2：`<canvas>` 读回。画布被跨域内容污染时 `toDataURL` 抛 SecurityError，不再兜底（裁决 D-3） */
 async function captureCanvas(element, id, maxBytes) {
@@ -1797,6 +2001,18 @@ const DELIVERABLE_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
 /** 用于认出 SVG 正文的前缀嗅探长度：`<?xml`、注释、DOCTYPE 都可能排在 `<svg` 之前 */
 const SVG_SNIFF_BYTES = 1024;
 /**
+* WebP 动图：扩展头 `VP8X` 的 flags 字节第 1 位。位置固定在文件前 24 字节内，
+* 不必解码整图就能判出来。
+*/
+function isAnimatedWebp(bytes) {
+	return [
+		86,
+		80,
+		56,
+		88
+	].every((byte, index) => bytes[12 + index] === byte) && ((bytes[20] ?? 0) & 2) !== 0;
+}
+/**
 * 按魔数认图片类型（服务端声明只作兜底）。
 *
 * 图片接口常年是「无扩展名 + `application/octet-stream`」这种组合（查询串带 file id 的尤其多），
@@ -1844,16 +2060,29 @@ async function rasterizeToPng(blob) {
 * 两类真实站点上很常见的图会在最后一步被模型侧丢掉：服务端把图报成 `application/octet-stream`，
 * 以及矢量图（三家提供方的图片通道都不收 `image/svg+xml`，分册 20 §0.1）。
 * 前者只是声明错了，按魔数改回来即可；后者必须就地栅格化，否则等于没取到图。
+*
+* **声明一律不采信**：大站 CDN 会按 `Accept` 头改发 AVIF 却仍旧报 `image/webp`，
+* 照抄声明会让端点解码失败并连累整次请求（一张图 400，37 张全废）。
+*
+* 魔数对得上也不等于发得出去，还有两类会被端点整次拒收，必须重编码成单帧位图：
+* - **动图**（GIF 天然多帧，WebP 看 `VP8X` 的动画位）：图片通道普遍只收静态图；
+* - **超长边**：横幅类素材常见 7680×120 这种尺寸，字节数却很小，
+*   纯按字节压缩的预算根本不会触发，原样发出去就撞上端点的边长上限。
+*
+* @param oversized 调用方已知原图长边超限（`<img>` 能直接读到 `naturalWidth`，不必为此解码）
 */
-async function toDeliverableBlob(blob) {
+async function toDeliverableBlob(blob, oversized = false) {
 	const declared = blob.type.split(";")[0]?.trim().toLowerCase() ?? "";
-	if (DELIVERABLE_IMAGE_MIME_TYPES.has(declared)) return blob;
-	const bytes = new Uint8Array(await blob.arrayBuffer());
-	const sniffed = sniffImageMime(bytes);
-	if (sniffed !== void 0 && DELIVERABLE_IMAGE_MIME_TYPES.has(sniffed)) return new Blob([bytes], { type: sniffed });
+	const head = new Uint8Array(await blob.slice(0, SVG_SNIFF_BYTES).arrayBuffer());
+	const sniffed = sniffImageMime(head);
+	if (sniffed !== void 0 && DELIVERABLE_IMAGE_MIME_TYPES.has(sniffed)) {
+		const typed = sniffed === declared ? blob : new Blob([blob], { type: sniffed });
+		const animated = sniffed === "image/gif" || sniffed === "image/webp" && isAnimatedWebp(head);
+		return oversized || animated ? await rasterizeToPng(typed) : typed;
+	}
 	const mimeType = sniffed ?? (declared.startsWith("image/") ? declared : void 0);
 	if (mimeType === void 0) throw new Error(`the response is not a recognizable image (the server described it as "${blob.type === "" ? "no content type" : blob.type}")`);
-	return await rasterizeToPng(new Blob([bytes], { type: mimeType }));
+	return await rasterizeToPng(new Blob([blob], { type: mimeType }));
 }
 /**
 * 取一个元素的图像（0.6.0 FR-12.1）。
@@ -1902,6 +2131,154 @@ function describeError(e) {
 	if (e instanceof TypeError) return "the request was blocked, most likely by CORS";
 	return e instanceof Error ? e.message : String(e);
 }
+
+//#endregion
+//#region ../browser/src/dom/promotion.ts
+/**
+* 非标可交互元素的识别与角色提升（0.14.0 分册 15）。
+*
+* 现代前端用 `div` / `span` 做按钮是常态，它们在无障碍树里全落到 `generic`，
+* 于是拿不到句柄——模型读得到那几个字，却点不动。本模块补的就是这一段判定。
+*
+* 整套逻辑默认关闭，由 `createDomPerceptionReader` 的 `promoteRoles` 开启（D-15-1）。
+*/
+/**
+* class / id 里的交互语义词根（FR-15.2）。
+*
+* 带词边界匹配：`table` 含 `tab`、`container` 含 `nav`，子串匹配会把它们全误伤（D-15-8）。
+* 图标类单列一支：`icon-view` / `el-icon-download` / `anticon-*` 这类命名带着具体动作语义。
+*/
+const INTERACTIVE_TOKEN = /(?:^|[^a-z])(btn|button|actions?|click(?:able)?|link|menu|nav|tabs?|trigger|operate|operations?|handle|entry|toolbar|[a-z]*icons?(?:[-_][a-z0-9]+)?)(?:[^a-z]|$)/i;
+/** 从图标类名反推语义：`el-icon-view` → `view`、`icon-download` → `download`（FR-15.4 第 2 级） */
+const ICON_CLASS = /[a-z]*icons?[-_]([a-z0-9][a-z0-9-_]*)$/i;
+/** 框架路由属性：值非空即视为确凿的导航线索（FR-15.3 第 2 条） */
+const ROUTE_ATTRIBUTES = [
+	"to",
+	"routerlink",
+	"data-href",
+	"data-url"
+];
+/** 只有这三种角色会被提升：其余角色要么本就能发句柄，要么带着不该被覆盖的语义（D-15-3） */
+const PROMOTABLE_ROLES = /* @__PURE__ */ new Set([
+	"generic",
+	"img",
+	"cell"
+]);
+/** 合成名的前缀，必须让模型看得出「这不是页面上的字，别拿它去搜」（FR-15.4 第 3 级） */
+const SYNTHETIC_NAME_PREFIX = "unlabeled control";
+/** 往上找具名祖先的层数上限：再往上就是整页容器，拿它当限定语反而更含糊 */
+const SYNTHETIC_NAME_LOOKUP_DEPTH = 5;
+const classAndId = (element) => `${element.getAttribute("class") ?? ""} ${element.getAttribute("id") ?? ""}`;
+/** `cursor: pointer` —— 页面自己声明了可点。`getComputedStyle` 最贵，殿后 */
+function looksClickable(element, view) {
+	if (view === null) return false;
+	try {
+		return view.getComputedStyle(element).cursor === "pointer";
+	} catch {
+		return false;
+	}
+}
+/**
+* 五级信号，命中任一即为真（FR-15.1）。
+*
+* 求值顺序按**成本**排而不是按强度排：前面的廉价信号命中就短路，
+* 把 `getComputedStyle` 这条唯一会触发样式重算的路径留到最后。
+*/
+function looksInteractive(element, context) {
+	if (context.interactiveHint?.(element) === true) return true;
+	const tabindex = element.getAttribute("tabindex");
+	if (tabindex !== null && tabindex.trim() !== "" && tabindex.trim() !== "-1") return true;
+	const title = element.getAttribute("title");
+	if (title !== null && title.trim() !== "") return true;
+	if (INTERACTIVE_TOKEN.test(classAndId(element))) return true;
+	return looksClickable(element, context.view);
+}
+/** 图标类名反推出的语义词；没有图标类则 undefined */
+function iconHintOf(element) {
+	for (const cls of (element.getAttribute("class") ?? "").split(/\s+/)) {
+		const match = ICON_CLASS.exec(cls);
+		if (match === null) continue;
+		const semantic = match[1]?.split("__")[0];
+		if (semantic !== void 0 && semantic !== "") return semantic;
+	}
+}
+/** 宿主逃生舱的角色；命中即无条件提升成声明的角色（FR-15.6） */
+function hintedRoleOf(element, hints) {
+	if (hints === void 0) return void 0;
+	for (const hint of hints) for (const selector of hint.selectors) try {
+		if (element.matches(selector)) return hint.role;
+	} catch {}
+}
+/**
+* 确凿的导航线索（FR-15.3）：拿得到就判 `link`，拿不到一律 `button`。
+*
+* **不看** `cursor` / class 词根 / `onclick` 这类间接迹象——猜错会让模型以为「点了会跳走」
+* 而放弃先把页内信息读完，代价比多标一个 `button` 大。
+*/
+function navigationTargetOf(element, doc) {
+	const own = resolvedHref(element, doc);
+	if (own !== void 0) return own;
+	for (const attribute of ROUTE_ATTRIBUTES) {
+		const value = element.getAttribute(attribute);
+		if (value !== null && value.trim() !== "") return value.trim();
+	}
+	const anchor = element.closest("a[href]");
+	if (anchor !== null && anchor.getAttribute("role") === null) return resolvedHref(anchor, doc);
+}
+/** `href` 解析成绝对地址；不导航的形态（`#`、`javascript:`、空值）一律不算线索 */
+function resolvedHref(element, doc) {
+	const raw = element.getAttribute("href") ?? element.getAttribute("xlink:href");
+	if (raw === null) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed === "" || trimmed === "#" || /^javascript:/i.test(trimmed)) return void 0;
+	try {
+		const url = new URL(trimmed, doc.baseURI);
+		return url.protocol === "http:" || url.protocol === "https:" ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* 算不出名字时合成一个可指称的称呼（FR-15.4 第 3 级）。
+*
+* 用「最近具名祖先 + 同级序位」而不是坐标：坐标随滚动和窗口尺寸变，
+* 用户在屏幕上对不上号，模型跨两次感知也认不出是同一个东西。
+*/
+function synthesizeName(element, nameOf) {
+	const siblings = element.parentElement?.children;
+	let position = 0;
+	if (siblings !== void 0) {
+		for (const [index, sibling] of [...siblings].entries()) if (sibling === element) {
+			position = index + 1;
+			break;
+		}
+	}
+	const ordinal = position > 0 ? `${SYNTHETIC_NAME_PREFIX} #${position}` : SYNTHETIC_NAME_PREFIX;
+	let ancestor = element.parentElement;
+	for (let depth = 0; depth < SYNTHETIC_NAME_LOOKUP_DEPTH && ancestor !== null; depth += 1) {
+		const label = nameOf(ancestor);
+		if (label !== void 0 && label !== "") return `${ordinal} in "${label}"`;
+		ancestor = ancestor.parentElement;
+	}
+	return ordinal;
+}
+/** 提升后的角色与导航目标；未提升时返回 undefined */
+function promoteRole(input) {
+	const { element, role, doc, hasActionableDescendant, context } = input;
+	const hinted = hintedRoleOf(element, context.roleHints);
+	if (hinted !== void 0) return { role: hinted };
+	if (!PROMOTABLE_ROLES.has(role)) return void 0;
+	if (hasActionableDescendant && role !== "img") return void 0;
+	if (!looksInteractive(element, context)) return void 0;
+	const href = navigationTargetOf(element, doc);
+	return href !== void 0 ? {
+		role: "link",
+		href
+	} : { role: "button" };
+}
+
+//#endregion
+//#region ../browser/src/dom/perception.ts
 /** 值可能是凭据的输入类型：即便宿主忘了写进 exclude 也不读值。操作侧复用同一份，不另写 */
 const SECRET_INPUT_TYPES = /* @__PURE__ */ new Set(["password", "hidden"]);
 /** 可被操作的角色：只给这些节点发句柄，其余节点模型连提都提不出来 */
@@ -1979,6 +2356,33 @@ function ownText(element) {
 	for (const node of element.childNodes) if (node.nodeType === 3) text += node.nodeValue ?? "";
 	return clip(text);
 }
+/** 名字全在元素外面的那几种控件 */
+const FORM_CONTROL_TAGS = /* @__PURE__ */ new Set([
+	"INPUT",
+	"TEXTAREA",
+	"SELECT"
+]);
+/**
+* 表单控件的名字来源：`<label>`（关联式与包裹式）、`placeholder`、`title`。
+*
+* 缺了这几级，一个填着「基小建」的输入框在模型眼里就是无名的 textbox——
+* 旁边的 `<label>` 文字它读得到，却接不到这个框上，于是「值明明在结果里，
+* 模型却说不出这是谁」。操作侧的 `accessibleName` 一直取这几级，两边不一致
+* 还会让「感知时叫不出名字、点下去审计里却有名字」。
+*/
+function externalNameOf(element) {
+	const labels = element.labels;
+	if (labels && labels.length > 0) {
+		const joined = [...labels].map((node) => node.textContent ?? "").filter((part) => part.trim() !== "").join(" ");
+		if (joined.trim() !== "") return clip(joined);
+	}
+	const wrapping = element.closest("label")?.textContent ?? "";
+	if (wrapping.trim() !== "") return clip(wrapping);
+	for (const attribute of ["placeholder", "title"]) {
+		const value = element.getAttribute(attribute);
+		if (value !== null && value.trim() !== "") return clip(value);
+	}
+}
 function nameOf(element, doc) {
 	const label = element.getAttribute("aria-label");
 	if (label !== null && label.trim() !== "") return clip(label);
@@ -1991,6 +2395,7 @@ function nameOf(element, doc) {
 		const alt = element.getAttribute("alt");
 		if (alt !== null && alt.trim() !== "") return clip(alt);
 	}
+	if (FORM_CONTROL_TAGS.has(element.tagName)) return externalNameOf(element);
 	const own = ownText(element);
 	return own === "" ? void 0 : own;
 }
@@ -2046,20 +2451,38 @@ function isBelowMinArea(element, minImageArea) {
 	if (size === void 0) return false;
 	return size.width * size.height < minImageArea;
 }
-function describe(element, excluded, doc, view, capture, handles, frame, provenance) {
+function describe(element, excluded, doc, view, capture, handles, frame, provenance, promotion) {
 	if (excluded.has(element)) return void 0;
 	if (SKIPPED_TAGS.has(element.tagName)) return void 0;
 	if (hidden$1(element, view)) return void 0;
 	const children = [];
 	for (const child of element.children) {
-		const node = describe(child, excluded, doc, view, capture, handles, frame, provenance);
+		const node = describe(child, excluded, doc, view, capture, handles, frame, provenance, promotion);
 		if (node !== void 0) children.push(node);
 	}
-	const name = nameOf(element, doc);
+	let name = nameOf(element, doc);
 	const value = valueOf(element);
-	const role = roleOf$1(element);
-	const href = role === "link" ? hrefOf(element) : void 0;
+	let role = roleOf$1(element);
+	let promotedHref;
+	if (promotion !== void 0) {
+		const promoted = promoteRole({
+			element,
+			role,
+			doc,
+			hasActionableDescendant: children.some((child) => child.ref !== void 0),
+			context: promotion
+		});
+		if (promoted !== void 0) {
+			role = promoted.role;
+			promotedHref = promoted.href;
+			if (name === void 0) name = clip(iconHintOf(element) ?? synthesizeName(element, (a) => nameOf(a, doc)));
+		}
+	}
+	const href = promotedHref ?? (role === "link" ? hrefOf(element) : void 0);
 	if (role === "generic" && name === void 0 && value === void 0 && children.length === 0) return void 0;
+	if (promotion !== void 0 && role === "generic" && name === void 0 && value === void 0) {
+		if (children.length === 1) return children[0];
+	}
 	const node = {
 		role,
 		...name !== void 0 ? { name } : {},
@@ -2110,6 +2533,46 @@ function frameHint(iframe) {
 	return "unnamed";
 }
 /**
+* 可路由的绝对地址（分册 16 FR-16.1）。
+*
+* 只认 http(s)：`about:blank` / `srcdoc` / `data:` 这些外壳寻不到址，
+* 交出去只会让它拿一个匹配不上任何 frameId 的字符串去猜。
+*/
+function httpUrlOf(value, base) {
+	try {
+		const url = new URL(value, base);
+		return url.protocol === "http:" || url.protocol === "https:" ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+function routableUrlOf(iframe, doc) {
+	try {
+		const live = iframe.contentWindow?.location?.href;
+		if (live !== void 0 && live !== "about:blank") {
+			const routable = httpUrlOf(live, doc.baseURI);
+			if (routable !== void 0) return routable;
+		}
+	} catch {}
+	const src = iframe.getAttribute("src");
+	if (src === null || src.trim() === "") return void 0;
+	return httpUrlOf(src, doc.baseURI);
+}
+/**
+* 同源嵌套帧的文档；跨源与尚未就绪时返回 `undefined`。
+*
+* 跨源时 `contentDocument` 返回 `null` 而**不抛异常**，某些引擎在别的属性上才抛——
+* 两种形态都要接住，只写 try/catch 会漏掉前一种。
+*/
+function sameOriginDocumentOf(iframe) {
+	try {
+		const inner = iframe.contentDocument;
+		return inner === null || inner.body === null ? void 0 : inner;
+	} catch {
+		return;
+	}
+}
+/**
 * 句柄发放与解析。表在 reader 实例内、**跨感知保留**（分册 18 FR-18.5）：
 * 每次 read() 作废全部旧句柄会让多步任务陷入「读—点—失效—再读」的空转，
 * 而安全性本就不由句柄寿命承担——执行前的 `modalStateOf` / `inActionScope` /
@@ -2180,6 +2643,12 @@ function createDomPerceptionReader(options = {}) {
 	*/
 	const elevatedModals = /* @__PURE__ */ new Set();
 	const rootDocument = () => options.document ?? globalThis.document;
+	/** 提升未开启时返回 undefined，遍历侧据此整段跳过（AC-G10） */
+	const promotionOf = (view) => options.promoteRoles === true ? {
+		view,
+		...options.interactiveHint !== void 0 ? { interactiveHint: options.interactiveHint } : {},
+		...options.roleHints !== void 0 ? { roleHints: options.roleHints } : {}
+	} : void 0;
 	/**
 	* 把一条帧授权解析成 Document，逐层下钻（分册 18 FR-18.3）。
 	*
@@ -2256,13 +2725,15 @@ function createDomPerceptionReader(options = {}) {
 		const root = rootDocument();
 		if (root === void 0) return {
 			nodes: [],
-			frameNotes: []
+			frameNotes: [],
+			nestedFrames: []
 		};
 		handles ??= new HandleIssuer(/* @__PURE__ */ new Set(), /* @__PURE__ */ new Set());
 		handles.prune();
 		const issuer = handles;
 		const nodes = [];
 		const frameNotes = [];
+		const nestedFrames = [];
 		/** 同一个未授权 iframe 至多报一次（它可能同时落在多个 include 根的子树里） */
 		const reportedUnauthorized = /* @__PURE__ */ new Set();
 		const resolvedScopes = [];
@@ -2287,6 +2758,66 @@ function createDomPerceptionReader(options = {}) {
 				doc: resolved.doc
 			});
 		}
+		/**
+		* 范围内未授权嵌套帧的处置（分册 16 FR-16.1）。
+		*
+		* 递归而不是循环固定层数：0.13.0 D-18-8 用「路径是宿主写死的数组」论证深度上限，
+		* 自动发现一进来这个前提就没了。兜底改由**帧数与节点总预算**承担，
+		* 层数是错的度量（见分册 16 §0.2）。
+		*/
+		function descendFrames(roots, doc, excluded, frameScope, label, tag, actionable, actionExcluded) {
+			for (const element of roots) for (const iframe of nestedFramesIn(element, excluded)) {
+				if (authorizedFrames.has(iframe)) continue;
+				if (reportedUnauthorized.has(iframe)) continue;
+				reportedUnauthorized.add(iframe);
+				const hint = frameHint(iframe);
+				if (options.discoverNestedFrames === true) {
+					const url = routableUrlOf(iframe, doc);
+					if (url !== void 0) {
+						nestedFrames.push({
+							url,
+							hint,
+							...tag !== void 0 ? { frame: tag } : {}
+						});
+						continue;
+					}
+					const inner = sameOriginDocumentOf(iframe);
+					if (inner !== void 0 && inlineFrame(inner, iframe, frameScope, label, tag, actionable, actionExcluded)) continue;
+				}
+				nodes.push({
+					role: "note",
+					name: `A nested frame "${hint}" inside "${label}" is not part of the authorized scope and was not read. Ask the user to authorize it if its content is needed.`,
+					...tag !== void 0 ? { frame: tag } : {}
+				});
+			}
+		}
+		/**
+		* 无地址同源帧的就地内联；成功返回 `true`。
+		*
+		* `srcdoc` / `about:blank` 没有可路由地址，外壳寻不到址，只能由父帧代读。
+		*
+		* 可操作性**继承自那个 `<iframe>` 元素本身**：它由父页面写入内容，视觉上就是父页面的一部分，
+		* 父帧的 action scope 把它圈进来了就等于圈进了它的内容；没圈进来则帧内一个句柄都不发。
+		* exclude 在子文档里重新求值——敏感控件在每一层都要剪掉，不因为它在帧里就放宽（§0.1 边界 3）。
+		*/
+		function inlineFrame(inner, iframe, frameScope, label, tag, actionable, actionExcluded) {
+			const innerExcluded = /* @__PURE__ */ new Set();
+			for (const selector of frameScope.exclude ?? []) for (const target of inner.querySelectorAll(selector)) innerExcluded.add(target);
+			const innerActionable = /* @__PURE__ */ new Set();
+			const innerActionExcluded = /* @__PURE__ */ new Set();
+			if (actionable.has(iframe)) {
+				innerActionable.add(inner.body);
+				for (const descendant of inner.body.querySelectorAll("*")) innerActionable.add(descendant);
+				for (const selector of actionScopeFor(label)?.exclude ?? []) for (const target of inner.querySelectorAll(selector)) innerActionExcluded.add(target);
+			}
+			issuer.useSets(innerActionable, innerActionExcluded);
+			const innerView = inner.defaultView;
+			const node = describe(inner.body, innerExcluded, inner, innerView, capture, issuer, tag, "inline-frame", promotionOf(innerView));
+			if (node !== void 0) nodes.push(node);
+			descendFrames([inner.body], inner, innerExcluded, frameScope, label, tag, innerActionable, innerActionExcluded);
+			issuer.useSets(actionable, actionExcluded);
+			return node !== void 0;
+		}
 		for (const { scope: frameScope, label, doc } of resolvedScopes) {
 			const view = doc.defaultView;
 			const tag = label === "self" ? void 0 : label;
@@ -2297,27 +2828,17 @@ function createDomPerceptionReader(options = {}) {
 			const roots = [];
 			for (const selector of frameScope.include) for (const element of doc.querySelectorAll(selector)) if (!roots.includes(element)) roots.push(element);
 			for (const element of roots) {
-				const node = describe(element, excluded, doc, view, capture, issuer, tag, void 0);
+				const node = describe(element, excluded, doc, view, capture, issuer, tag, void 0, promotionOf(view));
 				if (node !== void 0) nodes.push(node);
 			}
-			for (const element of roots) for (const iframe of nestedFramesIn(element, excluded)) {
-				if (authorizedFrames.has(iframe)) continue;
-				if (reportedUnauthorized.has(iframe)) continue;
-				reportedUnauthorized.add(iframe);
-				const hint = frameHint(iframe);
-				nodes.push({
-					role: "note",
-					name: `A nested frame "${hint}" inside "${label}" is not part of the authorized scope and was not read. Ask the user to authorize it if its content is needed.`,
-					...tag !== void 0 ? { frame: tag } : {}
-				});
-			}
+			descendFrames(roots, doc, excluded, frameScope, label, tag, sets.actionable, sets.excluded);
 		}
 		pruneElevated();
 		const view = root.defaultView;
 		const sets = actionSets(root, actionScopeFor("self"));
 		for (const modal of elevatedModals) {
 			issuer.useSets(/* @__PURE__ */ new Set([modal, ...modal.querySelectorAll("*")]), sets.excluded);
-			const node = describe(modal, /* @__PURE__ */ new Set(), root, view, capture, issuer, void 0, "modal-elevated");
+			const node = describe(modal, /* @__PURE__ */ new Set(), root, view, capture, issuer, void 0, "modal-elevated", promotionOf(view));
 			if (node !== void 0) nodes.push(node);
 		}
 		for (const modal of root.querySelectorAll(MODAL_SELECTOR)) {
@@ -2330,12 +2851,13 @@ function createDomPerceptionReader(options = {}) {
 		}
 		return {
 			nodes,
-			frameNotes
+			frameNotes,
+			nestedFrames
 		};
 	}
 	async function readWithImages(scope, capture) {
 		const targets = [];
-		const { nodes, frameNotes } = collect(scope, {
+		const { nodes, frameNotes, nestedFrames } = collect(scope, {
 			targets,
 			minImageArea: capture.minImageArea ?? 0
 		});
@@ -2366,16 +2888,18 @@ function createDomPerceptionReader(options = {}) {
 			images,
 			imagesOmitted: targets.length - selected.length,
 			imageFailures,
-			...frameNotes.length > 0 ? { frameNotes } : {}
+			...frameNotes.length > 0 ? { frameNotes } : {},
+			...nestedFrames.length > 0 ? { nestedFrames } : {}
 		};
 	}
 	function read(scope, capture) {
 		if (capture === void 0) return collect(scope, void 0).nodes;
 		if (!capture.images || capture.maxImages <= 0) {
-			const { nodes, frameNotes } = collect(scope, void 0);
+			const { nodes, frameNotes, nestedFrames } = collect(scope, void 0);
 			return Promise.resolve({
 				nodes,
-				...frameNotes.length > 0 ? { frameNotes } : {}
+				...frameNotes.length > 0 ? { frameNotes } : {},
+				...nestedFrames.length > 0 ? { nestedFrames } : {}
 			});
 		}
 		return readWithImages(scope, capture);
@@ -2435,6 +2959,9 @@ function createDomPerceptionReader(options = {}) {
 		}
 	}
 }
+
+//#endregion
+//#region ../browser/src/dom/pageAction.ts
 const FILLABLE_TAGS = /* @__PURE__ */ new Set(["INPUT", "TEXTAREA"]);
 /** 只看显式声明，不看尺寸：jsdom 有 getComputedStyle 但没有布局 */
 function hidden(element) {
@@ -2732,6 +3259,396 @@ function createDomPageActionExecutor(options) {
 		describe
 	};
 }
+
+//#endregion
+//#region ../browser/src/remote/registry.ts
+/** @experimental */
+function createRemoteTargetRegistry() {
+	let table = /* @__PURE__ */ new Map();
+	return {
+		/**
+		* 整表替换而非合并（FR-13.2）：合并会让上一次感知的 ref 在本次感知后仍然可执行——
+		* 那正是 `PAGE_ACTION_STALE_REF` 要拦的东西。本地形态里旧 ref 天然失效
+		* （DOM 重新遍历、句柄表 prune 掉离开文档的条目），远端必须手动复现这个失效语义，
+		* 否则远端比本地更松。
+		*/
+		replace(entries) {
+			const next = /* @__PURE__ */ new Map();
+			for (const entry of entries) {
+				const { ref, role, name, secret, frame, elevated } = entry;
+				next.set(ref, {
+					role,
+					...name !== void 0 ? { name } : {},
+					...secret === true ? { secret: true } : {},
+					...frame !== void 0 ? { frame } : {},
+					...elevated === true ? { elevated: true } : {}
+				});
+			}
+			table = next;
+		},
+		get(ref) {
+			return table.get(ref);
+		},
+		get size() {
+			return table.size;
+		}
+	};
+}
+
+//#endregion
+//#region ../browser/src/remote/transport.ts
+/** 缺省单次往返上限（FR-13.2 / FR-13.3） */
+const DEFAULT_PAGE_AGENT_TIMEOUT_MS = 1e4;
+/**
+* 一次带超时的往返，并把三类失败统一成 `WebSkillError`（FR-13.6）。
+*
+* 三类都必须显式失败，**绝不降级成空结果**：
+* 空节点数组的含义是「页面上什么都没有」，模型收到它会据此作答，
+* 比报错危险得多——报错至少不会产出一个自信的错误回答。
+*
+* @param expect 期望的应答类型；对不上通常意味着装错了 agent 版本，
+*   静默容忍会把问题推到很远的地方才暴露。
+*/
+async function roundTrip(transport, request, expect, code, timeoutMs) {
+	let timer;
+	let reply;
+	try {
+		reply = await Promise.race([transport.send(request), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(new WebSkillError(code, `Page agent request "${request.type}" timed out after ${timeoutMs}ms with no reply from the page.`)), timeoutMs);
+		})]);
+	} catch (e) {
+		if (e instanceof WebSkillError) throw e;
+		const message = e instanceof Error ? e.message : String(e);
+		throw new WebSkillError(code, `Page agent request "${request.type}" failed: ${message}`);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+	if (reply.type === "error") throw new WebSkillError(reply.code, reply.message);
+	if (reply.type !== expect) throw new WebSkillError(code, `Page agent replied with "${reply.type}" to a "${request.type}" request; expected "${expect}".`);
+	return reply;
+}
+
+//#endregion
+//#region ../browser/src/remote/reader.ts
+/**
+* 跨上下文的页面感知（分册 13 / FR-13.2）。
+*
+* 把句柄描述表写进 registry，**只把 `result` 返回给调用方**——
+* 返回值就是标准 `PerceptionResult`，不夹带任何新字段（AC-13.2）。
+* @experimental
+*/
+function createRemotePerceptionReader(options) {
+	const { transport, targets, timeoutMs = DEFAULT_PAGE_AGENT_TIMEOUT_MS } = options;
+	return { async read(scope, capture) {
+		const reply = await roundTrip(transport, {
+			type: "perceive",
+			scope,
+			...capture !== void 0 ? { capture } : {}
+		}, "perceive-result", "PERCEPTION_FAILED", timeoutMs);
+		targets.replace(reply.targets);
+		return reply.result;
+	} };
+}
+
+//#endregion
+//#region ../browser/src/remote/executor.ts
+/**
+* 跨上下文的页面操作执行器（分册 13 / FR-13.3）。
+* @experimental
+*/
+function createRemotePageActionExecutor(options) {
+	const { transport, targets, timeoutMs = DEFAULT_PAGE_AGENT_TIMEOUT_MS } = options;
+	return {
+		/**
+		* **同步**查表。`PageActionPolicy.act()` 在弹确认卡之前调它，
+		* 拿到的 target 决定卡上写什么、是否 `secret`、是否 `elevated`——
+		* 改成异步就是改 `@webskill/agent` 的公开契约。
+		*
+		* 表里没有即 `undefined`，于是 `act()` 抛 `PAGE_ACTION_STALE_REF`：
+		* 没感知过就执行 = 拒绝，宁可让模型多感知一次（fail-closed）。
+		*/
+		describe(ref) {
+			return targets.get(ref);
+		},
+		/**
+		* 原样返回远端**执行那一刻**回填的 outcome（FR-13.5）：
+		* 不用 registry 里的快照拼装，也不补默认值——
+		* 补出来的 `false` 与「远端没报」在审计上不是一回事。
+		*/
+		async execute(request) {
+			return (await roundTrip(transport, {
+				type: "execute",
+				request
+			}, "execute-result", "TOOL_EXECUTION_FAILED", timeoutMs)).outcome;
+		}
+	};
+}
+
+//#endregion
+//#region ../browser/src/remote/handler.ts
+/** 深度收集句柄；顺序即遍历序，便于与本地形态逐条比对 */
+function collectRefs(nodes, out = []) {
+	for (const node of nodes) {
+		if (node.ref !== void 0) out.push(node.ref);
+		if (node.children !== void 0) collectRefs(node.children, out);
+	}
+	return out;
+}
+/**
+* 页面侧处理器（分册 13 / FR-13.7）。
+*
+* 必须是工厂而不是裸函数：`DomPerceptionReader` **是有状态的**——
+* `resolve(ref)` 依赖上一次感知发出的句柄表，模态提升状态也跨调用累积。
+* 每次请求新建 reader，`execute` 就永远 resolve 不到 `perceive` 发出的 ref。
+*
+* 它**不自己收发消息**：只做「请求进、应答出」。监听消息通道、判断消息是不是给自己的、
+* 回不回 `true`——那些全是宿主的事，本包不得出现任何扩展 API。
+* @experimental
+*/
+function createPageAgentHandler(options = {}) {
+	const reader = createDomPerceptionReader({
+		...options.document !== void 0 ? { document: options.document } : {},
+		...options.actionScope !== void 0 ? { actionScope: options.actionScope } : {},
+		...options.promoteRoles !== void 0 ? { promoteRoles: options.promoteRoles } : {},
+		...options.interactiveHint !== void 0 ? { interactiveHint: options.interactiveHint } : {},
+		...options.roleHints !== void 0 ? { roleHints: options.roleHints } : {},
+		...options.discoverNestedFrames !== void 0 ? { discoverNestedFrames: options.discoverNestedFrames } : {}
+	});
+	const executor = createDomPageActionExecutor({
+		reader,
+		...options.pickFiles !== void 0 ? { pickFiles: options.pickFiles } : {}
+	});
+	return { async handle(request) {
+		try {
+			if (request.type === "perceive") {
+				const raw = request.capture === void 0 ? reader.read(request.scope) : await reader.read(request.scope, request.capture);
+				const result = Array.isArray(raw) ? { nodes: raw } : raw;
+				const targets = [];
+				for (const ref of collectRefs(result.nodes)) {
+					const target = executor.describe(ref);
+					if (target !== void 0) targets.push({
+						ref,
+						...target
+					});
+				}
+				return {
+					type: "perceive-result",
+					result,
+					targets
+				};
+			}
+			return {
+				type: "execute-result",
+				outcome: await executor.execute(request.request)
+			};
+		} catch (e) {
+			return {
+				type: "error",
+				code: e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED",
+				message: e instanceof Error ? e.message : String(e)
+			};
+		}
+	} };
+}
+
+//#endregion
+//#region ../browser/src/remote/frameRouter.ts
+/** @experimental */
+const DEFAULT_FRAME_BUDGET = {
+	maxFrames: 12,
+	maxNodes: 1500
+};
+function countNodes(nodes) {
+	let total = 0;
+	for (const node of nodes) total += 1 + countNodes(node.children ?? []);
+	return total;
+}
+function note(name) {
+	return {
+		role: "note",
+		name
+	};
+}
+/**
+* 地址归一化：只比较 origin + path。
+*
+* 父页面写的 `src` 常带 `?t=123` 之类的缓存参数，甚至被框架改写过 hash。
+* 带上 query/hash 比对会把明明是同一帧的判成换了页，
+* 于是本该读到的内容变成一句「导航走了」——宁可粗一点也不能漏。
+*/
+function frameKey(url) {
+	try {
+		const parsed = new URL(url);
+		return `${parsed.origin}${parsed.pathname}`;
+	} catch {
+		return;
+	}
+}
+/**
+* 确认卡与模型上下文里指称一帧的说法（分册 16 FR-16.6）。
+*
+* 带上 host 而不只用父页面写的 `hint`：用户要能一眼分清「页面主体里的那个按钮」
+* 和「某个第三方 iframe 里的按钮」，而 `hint` 来自被嵌一方决定不了、
+* 嵌入方随便写的属性——`title="账户设置"` 的 iframe 完全可以指向别人的域。
+*/
+function frameLabelOf(nested) {
+	try {
+		return `${nested.hint} (${new URL(nested.url).host})`;
+	} catch {
+		return nested.hint;
+	}
+}
+/** 与 SDK 单帧取像超限时的文案同源；两边改要一起改 */
+const IMAGE_LIMIT_NOTE = "Not captured: the per-message image limit was reached";
+/**
+* 深度重写节点：打帧标签，并把 `imageId` 换成汇总后的全局 id。
+*
+* 每帧的取像 id 都是自己从 `img-1` 数起的，直接合并会让不同帧的图撞成同一个 id。
+* 落选（超整页预算）的图必须**同时**抹掉节点上的 `imageId`，否则节点指向一张
+* 根本没下发的图，模型会以为自己看过了。
+*/
+function relabel(nodes, frame, imageIds) {
+	return nodes.map((node) => {
+		const next = { ...node };
+		if (frame !== void 0) next.frame = node.frame ?? frame;
+		if (node.imageId !== void 0) {
+			const mapped = imageIds.get(node.imageId);
+			if (mapped === void 0) {
+				delete next.imageId;
+				next.imageNote = node.imageNote ?? IMAGE_LIMIT_NOTE;
+			} else next.imageId = mapped;
+		}
+		if (node.children !== void 0) next.children = relabel(node.children, frame, imageIds);
+		return next;
+	});
+}
+/**
+* 逐帧下钻并汇总（分册 16 FR-16.2 / FR-16.3 / FR-16.4，分册 11 FR-11.2）。
+*
+* 编排本身与浏览器 API 无关：它只认 `PageAgentRequest` / `PageAgentReply`，
+* 寻址全压在宿主实现的 `FrameDispatcher` 里。因此这个模块可以在 Service Worker
+* 里实例化，也可以服务不按帧号寻址的宿主。
+* @experimental
+*/
+function createFrameRouter(options) {
+	const budget = {
+		...DEFAULT_FRAME_BUDGET,
+		...options.budget
+	};
+	/** ref → 发放它的那一帧。`execute` 必须投回原帧，投给别的帧要么查无此 ref 要么误点同名控件 */
+	const refFrames = /* @__PURE__ */ new Map();
+	async function perceive(request) {
+		const mainAddress = await options.dispatcher.mainFrame();
+		const nodes = [];
+		const targets = [];
+		const frameNotes = [];
+		const main = await options.dispatcher.send(mainAddress, request);
+		if (main.reply.type !== "perceive-result") return main.reply;
+		const images = [];
+		let imagesOmitted = 0;
+		let imageFailures = 0;
+		const imageBudget = request.capture?.images === true ? request.capture.maxImages : 0;
+		const queue = [];
+		const visited = [mainAddress];
+		let nodeCount = 0;
+		let framesRead = 0;
+		let descended = 0;
+		const skipped = [];
+		const absorb = (reply, address, frame, imagePrefix) => {
+			framesRead += 1;
+			nodeCount += countNodes(reply.result.nodes);
+			const imageIds = /* @__PURE__ */ new Map();
+			for (const image of reply.result.images ?? []) {
+				if (images.length >= imageBudget) {
+					imagesOmitted += 1;
+					continue;
+				}
+				const id = `${imagePrefix}${image.id}`;
+				imageIds.set(image.id, id);
+				images.push({
+					...image,
+					id
+				});
+			}
+			imagesOmitted += reply.result.imagesOmitted ?? 0;
+			imageFailures += reply.result.imageFailures ?? 0;
+			nodes.push(...relabel(reply.result.nodes, frame, imageIds));
+			for (const target of reply.targets) {
+				targets.push(frame === void 0 ? target : {
+					...target,
+					frame: target.frame ?? frame
+				});
+				refFrames.set(target.ref, address);
+			}
+			if (reply.result.frameNotes !== void 0) frameNotes.push(...reply.result.frameNotes);
+			for (const nested of reply.result.nestedFrames ?? []) queue.push({
+				...nested,
+				parent: address
+			});
+		};
+		absorb(main.reply, mainAddress, options.mainFrameLabel, "");
+		while (queue.length > 0) {
+			const next = queue.shift();
+			if (framesRead >= budget.maxFrames || nodeCount >= budget.maxNodes) {
+				skipped.push(next.hint);
+				continue;
+			}
+			const address = await options.dispatcher.resolveNestedFrame(next, {
+				parent: next.parent,
+				visited
+			});
+			if (address === void 0) {
+				nodes.push(note(`A nested frame "${next.hint}" (${next.url}) could not be addressed and was not read. It may have been removed, replaced, or it is out of reach for this host.`));
+				continue;
+			}
+			visited.push(address);
+			const answer = await options.dispatcher.send(address, request).catch((e) => {
+				return {
+					reply: {
+						type: "error",
+						code: "TOOL_EXECUTION_FAILED",
+						message: e instanceof Error ? e.message : String(e)
+					},
+					documentUrl: ""
+				};
+			});
+			if (answer.reply.type !== "perceive-result") {
+				const reason = answer.reply.type === "error" ? answer.reply.message : "it returned an unexpected reply";
+				nodes.push(note(`A nested frame "${next.hint}" (${next.url}) was not read: ${reason}`));
+				continue;
+			}
+			if (frameKey(answer.documentUrl) !== frameKey(next.url)) {
+				nodes.push(note(`A nested frame "${next.hint}" (${next.url}) navigated away while it was being read (it answered from ${answer.documentUrl}); its content was discarded.`));
+				continue;
+			}
+			descended += 1;
+			absorb(answer.reply, address, frameLabelOf(next), `f${descended}-`);
+		}
+		if (skipped.length > 0) nodes.push(note(`${skipped.length} nested frame(s) were not read because this page exceeds the per-perception budget (${budget.maxFrames} frames / ${budget.maxNodes} nodes): ${skipped.join(", ")}. The content above is complete for the frames that were read.`));
+		return {
+			type: "perceive-result",
+			result: {
+				nodes,
+				...images.length > 0 ? { images } : {},
+				...imagesOmitted > 0 ? { imagesOmitted } : {},
+				...imageFailures > 0 ? { imageFailures } : {},
+				...frameNotes.length > 0 ? { frameNotes } : {}
+			},
+			targets
+		};
+	}
+	async function execute(request) {
+		const address = refFrames.get(request.request.ref) ?? await options.dispatcher.mainFrame();
+		return (await options.dispatcher.send(address, request)).reply;
+	}
+	return {
+		perceive,
+		execute
+	};
+}
+
+//#endregion
+//#region ../browser/src/host/protocol.ts
 const isRecord = (v) => typeof v === "object" && v !== null;
 const isNonEmptyString = (v) => typeof v === "string" && v !== "";
 /** Worker 侧入站校验：非法消息返回 undefined（忽略） */
@@ -2819,6 +3736,9 @@ function parseWorkerEvent(data) {
 		default: return;
 	}
 }
+
+//#endregion
+//#region ../browser/src/ui/workerUiBridge.ts
 /**
 * Worker 内 UiBridge：request → 'interaction' 消息到主线程，
 * 挂起等待 'interaction-response' → resolve（行内 await 跨线程成立）。
@@ -2873,6 +3793,9 @@ var WorkerUiBridge = class {
 		});
 	}
 };
+
+//#endregion
+//#region ../browser/src/host/workerRuntimeHost.ts
 const serializeError = (e) => ({
 	code: e instanceof WebSkillError ? e.code : "RUN_FAILED",
 	message: e instanceof Error ? e.message : String(e)
@@ -3100,6 +4023,9 @@ function startWorkerRuntimeHost(scope, overrides = {}) {
 		}
 	});
 }
+
+//#endregion
+//#region ../browser/src/host/workerClient.ts
 /** 主线程客户端：init/run/cancel/status/dispose 的 Promise API + 交互转发 */
 var WorkerRuntimeClient = class {
 	#worker;
@@ -3245,6 +4171,9 @@ var WorkerRuntimeClient = class {
 		}
 	}
 };
+
+//#endregion
+//#region ../browser/src/memory/encryptedMemoryStore.ts
 /**
 * 静态加密的 MemoryStore 包装（FR-19.5）。落盘形态：
 * `{ v: 1, iv: base64, ct: base64 }`；每次写入生成新的 12 字节随机 IV
@@ -3412,6 +4341,9 @@ async function deleteMemoryEncryptionKey(name = "user-profile") {
 		db.close();
 	}
 }
+
+//#endregion
+//#region ../browser/src/host/portMatrix.ts
 /**
 * 端口 × 宿主类型的**唯一定义**（AC-17.4）。
 * About 页与装配工厂都读这一份；护栏 `port-matrix-single-source` 盯着不许再抄。
@@ -3561,6 +4493,9 @@ function inspectHostWiring(input) {
 function missingPorts(reports) {
 	return reports.filter((report) => report.status === "missing");
 }
+
+//#endregion
+//#region ../browser/src/host/createBrowserChatbotHost.ts
 function createBrowserChatbotHost(options) {
 	const { fs, managedRoot, skillRoots, navigation, overrides } = options;
 	const chatbotAdapter = {
@@ -3585,6 +4520,9 @@ function createBrowserChatbotHost(options) {
 		connectFacade: overrides?.connectFacade ?? connectFacade
 	};
 }
+
+//#endregion
+//#region ../browser/src/net/fetchLinkedDocument.ts
 const DEFAULT_TIMEOUT_MS = 3e4;
 /**
 * 默认的链接文档读取实现（分册 22 §2.2）。
@@ -3615,6 +4553,9 @@ function createFetchLinkedDocumentReader(options = {}) {
 		}
 	};
 }
+
+//#endregion
+//#region ../browser/src/document/docx.ts
 /**
 * docx 正文抽取（分册 22 §2.4 / FR-23.7）。
 *
@@ -3692,6 +4633,9 @@ async function extractDocxText(bytes) {
 	}
 	return blocks.join("\n").replace(/\n{3,}/g, "\n\n").trim();
 }
+
+//#endregion
+//#region ../browser/src/document/xlsx.ts
 /**
 * xlsx 文本抽取（0.13.0 分册 12）。
 *
@@ -3941,6 +4885,9 @@ async function extractXlsxText(bytes) {
 	}
 	return sections.join("\n\n");
 }
+
+//#endregion
+//#region ../browser/src/viewer/viewerCsp.ts
 /**
 * 文档投放面的 CSP 单一来源（0.11.0 分册 18 FR-18.3 / AC-G21）。
 *
@@ -3991,6 +4938,9 @@ function viewerCspHeader(options) {
 }
 /** 本版固定的 sandbox token（供判据与装配文档引用，避免第二份清单） */
 const VIEWER_SANDBOX_TOKENS = SANDBOX_TOKENS;
+
+//#endregion
+//#region ../browser/src/viewer/documentSurface.ts
 const DEFAULT_MAX_VIEWER_PAYLOAD_BYTES = 2e6;
 const DEFAULT_HANDSHAKE_TIMEOUT_MS = 1e4;
 /** hello 的重发间隔：viewer 脚本加载完之前投出去的消息全部丢失 */
@@ -4062,6 +5012,16 @@ async function openDocumentSurface(input, options) {
 function defaultOpen(url, target) {
 	return globalThis.open?.(url, target) ?? null;
 }
+/**
+* 把 `openDocumentSurface` 柯里化成 `DocumentSurfaceHost`（0.15.0 分册 13 FR-13.3）。
+*
+* **只绑定选项，不新增任何逻辑**：体积上限、握手超时、`DOCUMENT_SURFACE_DECLINED`
+* 与审计事件全部沿用上面那一份实现（FR-13.5「逐条不变」的实现基础）。
+* @experimental
+*/
+function createDocumentSurfaceHost(options) {
+	return { open: async (input) => void await openDocumentSurface(input, options) };
+}
 /** viewer 是 opaque origin，`postMessage` 的 targetOrigin 只能是 `*` —— 用 channelId 做配对校验 */
 function viewerOrigin(_options) {
 	return "*";
@@ -4120,6 +5080,9 @@ async function audit(options, input, data) {
 		}
 	}).catch(() => void 0);
 }
+
+//#endregion
+//#region ../browser/src/viewer/shell.ts
 /**
 * 启动外壳：等主应用的 hello → 回报 ready → 收文档 → 写进 DOM。
 *
@@ -4152,6 +5115,9 @@ function startViewerShell(host, mount, onData) {
 		host.removeEventListener("message", onMessage);
 	} };
 }
+
+//#endregion
+//#region ../browser/src/viewer/blockedResources.ts
 /**
 * 监听 CSP 违规并把被拦资源汇总成一句话。
 *
@@ -4185,4 +5151,4 @@ function originOf(blockedURI) {
 }
 
 //#endregion
-export { BrowserSkillManager, BrowserWorkerScriptExecutor, ChromeBuiltinLlmClient, DEFAULT_MAX_VIEWER_PAYLOAD_BYTES, DOCUMENT_SURFACE_AUDIT_EVENT, DOCX_UNEXTRACTED, HOST_PORT_MATRIX, IframeWorkerLike, OpfsProvider, TsTranspiler, VIEWER_SANDBOX_TOKENS, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, XLSX_UNEXTRACTED, blockedMessage, bridgeError, captureElementImage, checkDictationAvailability, compressImageToBudget, createBrowserChatbotHost, createDomPageActionExecutor, createDomPerceptionReader, createEncryptedMemoryStore, createFetchLinkedDocumentReader, createIframeWorker, createLlmClient, deleteMemoryEncryptionKey, extractDocxText, extractXlsxText, extractZipWeb, generateMemoryEncryptionKey, inspectHostWiring, installWebSkillNavigator, isCapturableElement, isCaptureFailure, isEncryptedMemoryValue, isOpfsAvailable, missingPorts, openDocumentSurface, openMemoryEncryptionKey, parseBridgeRequest, parseMainMessage, parseWorkerEvent, probeChromeBuiltinAvailability, sha256HexWeb, startDictation, startViewerShell, startWorkerRuntimeHost, viewerCspHeader, watchBlockedResources };
+export { BrowserSkillManager, BrowserWorkerScriptExecutor, ChromeBuiltinLlmClient, DEFAULT_FRAME_BUDGET, DEFAULT_MAX_VIEWER_PAYLOAD_BYTES, DOCUMENT_SURFACE_AUDIT_EVENT, DOCX_UNEXTRACTED, HOST_PORT_MATRIX, IframeWorkerLike, OpfsProvider, SANDBOX_PAGE_SCRIPT_SOURCE, TsTranspiler, VIEWER_SANDBOX_TOKENS, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, XLSX_UNEXTRACTED, blockedMessage, bridgeError, captureElementImage, checkDictationAvailability, compressImageToBudget, createBrowserChatbotHost, createDocumentSurfaceHost, createDomPageActionExecutor, createDomPerceptionReader, createEncryptedMemoryStore, createFetchLinkedDocumentReader, createFrameRouter, createIframeWorker, createLlmClient, createPageAgentHandler, createRemotePageActionExecutor, createRemotePerceptionReader, createRemoteTargetRegistry, deleteMemoryEncryptionKey, extractDocxText, extractXlsxText, extractZipWeb, generateMemoryEncryptionKey, inspectHostWiring, installWebSkillNavigator, isCapturableElement, isCaptureFailure, isEncryptedMemoryValue, isOpfsAvailable, missingPorts, openDocumentSurface, openMemoryEncryptionKey, parseBridgeRequest, parseMainMessage, parseWorkerEvent, probeChromeBuiltinAvailability, sha256HexWeb, startDictation, startViewerShell, startWorkerRuntimeHost, viewerCspHeader, watchBlockedResources };