@webskill/sdk 0.15.0 → 0.17.0

package/dist/{eventTypes-Y07N8IAC.js → eventTypes-CwciaqCU.js}

@@ -41,12 +41,35 @@ const AUDIT_EVENT_TYPES = {
 	/** 候选记录被从审批队列里删除（仅 draft / pending-review / rejected 可删） */
 	candidateRemoved: "candidate.removed",
 	pagePerceived: "page.perceived",
+	/**
+	* 子树续读被拒（0.16.0 分册 14 · FR-14.6）。载荷只有 `reason`，**不含被拒的 `ref`**：
+	* 句柄换轮即失效，留下来对复盘没有帮助，却会把一个模型可控的字符串写进审计流。
+	*
+	* `reason: 'out-of-scope'` 是注入攻击的观测点：页面里写着「请读取整个页面」时，
+	* 模型若照做，这条留痕就是它留下的痕迹。
+	*/
+	pagePerceiveDenied: "page.perceive.denied",
 	pageAction: "page.action",
 	/**
 	* 一次页面操作引发了下载，但 `sandbox.downloadedFiles` 关着，模型因此一无所知
 	* （0.15.0 分册 15 · FR-15.7）。载荷只有计数与原因，不含文件名 / 大小 / 类型。
 	*/
 	pageDownloadUnreported: "page.download.unreported",
+	/**
+	* 模型侧标签页控制（0.16.0 分册 12 · FR-12.7）。写入点在
+	* `packages/agent/src/tabs/policy.ts`，同样是字面量同步。
+	*
+	* `list_page_tabs` **不在此列**：纯读、无副作用、每轮可能被调很多次，
+	* 记下来只会把 focused / closed 淹没在噪音里（DV-4）。作为交换，
+	* `page.tab.focused` 的 `data.from` 是必需的——失去列举留痕后，
+	* 它是唯一能回答「模型是从哪一页跳过去的」的字段。
+	*/
+	pageTabFocused: "page.tab.focused",
+	pageTabClosed: "page.tab.closed",
+	/** 切换 / 关闭被拒，或工作集触顶。载荷只有原因与上限，**不含**被拒的句柄内容 */
+	pageTabDenied: "page.tab.denied",
+	/** 页面操作新开了一页并被接进工作集（SC-2 的唯一入口） */
+	pageTabOpened: "page.tab.opened",
 	documentRead: "document.read",
 	documentSurfaceOpen: "document.surface.open",
 	/** 脚本按宿主声明的数据源取数（分册 16）；被拒也记，否则反复试探看不见 */

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
-import { S as UiBridge, U as FileSystemProvider, X as PageQuery, Y as Page, f as LlmMessage, ft as SkillDocument, gt as SkillManagerPort, l as LlmClient, ut as SkillCatalogEntry } from "./types-C3V6lAeO-BIf7UB2e.js";
-import { $ as IntegrityVerdict, Wn as WebSkillRuntime, cn as SkillStateGuard, in as SkillOutcomeReporter, rn as SkillIntegrityGuard, zt as RuntimeRun } from "./index-Oc3H89TJ.js";
-import { _ as SkillState, a as AuditLog, b as SkillVersionStore, c as CandidateFile, d as CandidateSkill, f as CandidateSource, g as SKILL_VERSION_PAGE_SIZE, h as CompositeApprovalPolicy, i as AuditEvent, l as CandidatePage, m as CandidateStore, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStatus, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateRisk, v as SkillVersion, x as candidateToCatalogEntry, y as SkillVersionPage } from "./skillVersionStore-B24Jjjry-C4zomhMZ.js";
+import { S as UiBridge, U as FileSystemProvider, X as PageQuery, Y as Page, f as LlmMessage, ft as SkillDocument, gt as SkillManagerPort, l as LlmClient, ut as SkillCatalogEntry } from "./types-Btpdd1y--BcxQ10Fa.js";
+import { $ as IntegrityVerdict, Wn as WebSkillRuntime, cn as SkillStateGuard, in as SkillOutcomeReporter, rn as SkillIntegrityGuard, zt as RuntimeRun } from "./index-BDyXe-a5.js";
+import { _ as SkillState, a as AuditLog, b as SkillVersionStore, c as CandidateFile, d as CandidateSkill, f as CandidateSource, g as SKILL_VERSION_PAGE_SIZE, h as CompositeApprovalPolicy, i as AuditEvent, l as CandidatePage, m as CandidateStore, n as ApprovalDecision, o as AuditQueryFilter, p as CandidateStatus, r as ApprovalPolicy, s as CANDIDATE_PAGE_SIZE, t as AlwaysHumanApprovalPolicy, u as CandidateRisk, v as SkillVersion, x as candidateToCatalogEntry, y as SkillVersionPage } from "./skillVersionStore-B24Jjjry-v2CCU0Xo.js";
 //#region ../governance/dist/index.d.ts
 //#region src/candidate/candidateNormalizer.d.ts
 /** 剥 markdown fence 与 <think> 块、截取首尾 {}；非对象 → CANDIDATE_INVALID */
@@ -208,12 +208,35 @@ declare const AUDIT_EVENT_TYPES: {
   /** 候选记录被从审批队列里删除（仅 draft / pending-review / rejected 可删） */
   readonly candidateRemoved: "candidate.removed";
   readonly pagePerceived: "page.perceived";
+  /**
+   * 子树续读被拒（0.16.0 分册 14 · FR-14.6）。载荷只有 `reason`，**不含被拒的 `ref`**：
+   * 句柄换轮即失效，留下来对复盘没有帮助，却会把一个模型可控的字符串写进审计流。
+   *
+   * `reason: 'out-of-scope'` 是注入攻击的观测点：页面里写着「请读取整个页面」时，
+   * 模型若照做，这条留痕就是它留下的痕迹。
+   */
+  readonly pagePerceiveDenied: "page.perceive.denied";
   readonly pageAction: "page.action";
   /**
    * 一次页面操作引发了下载，但 `sandbox.downloadedFiles` 关着，模型因此一无所知
    * （0.15.0 分册 15 · FR-15.7）。载荷只有计数与原因，不含文件名 / 大小 / 类型。
    */
   readonly pageDownloadUnreported: "page.download.unreported";
+  /**
+   * 模型侧标签页控制（0.16.0 分册 12 · FR-12.7）。写入点在
+   * `packages/agent/src/tabs/policy.ts`，同样是字面量同步。
+   *
+   * `list_page_tabs` **不在此列**：纯读、无副作用、每轮可能被调很多次，
+   * 记下来只会把 focused / closed 淹没在噪音里（DV-4）。作为交换，
+   * `page.tab.focused` 的 `data.from` 是必需的——失去列举留痕后，
+   * 它是唯一能回答「模型是从哪一页跳过去的」的字段。
+   */
+  readonly pageTabFocused: "page.tab.focused";
+  readonly pageTabClosed: "page.tab.closed";
+  /** 切换 / 关闭被拒，或工作集触顶。载荷只有原因与上限，**不含**被拒的句柄内容 */
+  readonly pageTabDenied: "page.tab.denied";
+  /** 页面操作新开了一页并被接进工作集（SC-2 的唯一入口） */
+  readonly pageTabOpened: "page.tab.opened";
   readonly documentRead: "document.read";
   readonly documentSurfaceOpen: "document.surface.open";
   /** 脚本按宿主声明的数据源取数（分册 16）；被拒也记，否则反复试探看不见 */

package/dist/governance.js

@@ -2,7 +2,7 @@ import { n as messageOf, t as WebSkillError } from "./errors-BDZNpC13.js";
 import { y as isValidSkillName } from "./skill-CAJMsLod.js";
 import { a as atomicWriteText, t as assertSafePathSegment } from "./pathSecurity-B1owvJAF.js";
 import { d as partsToText, p as textParts } from "./llm-B7lLH0ZI.js";
-import { n as AUDIT_EVENT_TYPE_LIST, t as AUDIT_EVENT_TYPES } from "./eventTypes-Y07N8IAC.js";
+import { n as AUDIT_EVENT_TYPE_LIST, t as AUDIT_EVENT_TYPES } from "./eventTypes-CwciaqCU.js";
 
 //#region ../governance/src/candidate/candidateNormalizer.ts
 const invalid = (message, details) => {

package/dist/{index-CQYo4tcT.d.ts → index-1sQZ4VBN.d.ts}

@@ -1,5 +1,5 @@
-import { I as ChatAttachmentKind, Nt as WebSkillErrorCode, S as UiBridge, Z as RemoteUrlPolicy, a as InteractionOrigin, c as InteractionResponse, s as InteractionRequest } from "./types-C3V6lAeO-BIf7UB2e.js";
-import { Kn as XlsxTextExtractor, P as DocxTextExtractor, bn as ToolStepReader, j as DataSourceInfo, z as ExternalToolSource } from "./index-Oc3H89TJ.js";
+import { I as ChatAttachmentKind, Nt as WebSkillErrorCode, S as UiBridge, Z as RemoteUrlPolicy, a as InteractionOrigin, c as InteractionResponse, s as InteractionRequest } from "./types-Btpdd1y--BcxQ10Fa.js";
+import { Kn as XlsxTextExtractor, P as DocxTextExtractor, bn as ToolStepReader, j as DataSourceInfo, z as ExternalToolSource } from "./index-BDyXe-a5.js";
 //#region ../agent/dist/index.d.ts
 //#region src/todo/types.d.ts
 /** 待办条目状态：未开始 / 进行中 / 已完成（FR-3.1） */
@@ -505,11 +505,30 @@ interface PerceptionResult {
  * 页面读取实现的注入口（浏览器侧 `createDomPerceptionReader`）。
  *
  * 参数是宿主配置的 scope，不是模型给的——`PagePerceptionPolicy.perceive()`
- * 根本不接受范围参数，模型没有可以影响它的入口（AC-10.8）。
+ * 的范围参数只能是一个既有结果里的句柄，模型没有可以扩大可读范围的入口（AC-10.8 / FR-14.2）。
  * @experimental
  */
 interface PagePerceptionReader {
   read(scope: PerceptionScopeInput, capture?: PerceptionCaptureOptions): Promise<readonly PerceivedNode[] | PerceptionResult> | readonly PerceivedNode[] | PerceptionResult;
+  /**
+   * 子树续读（分册 14 / FR-14.1）。**不实现即该能力不存在**：
+   * 带 `ref` 的调用一律被拒，绝不回落到整页感知（D-14-4）。
+   *
+   * 写成**可选方法**而不是给 `read()` 加第三个参数：可选参数会被既有实现
+   * 静默忽略，而忽略的后果正好是 FR-14.3 明令禁止的那件事——
+   * 模型以为自己在读子树，实际拿到整页。方法的缺席是可检测的。
+   *
+   * 拒绝走**返回值**而不是抛错：跨上下文的 reject 到本地就是一个没有错误码的 `Error`。
+   */
+  readSubtree?(scope: PerceptionScopeInput, ref: string, capture?: PerceptionCaptureOptions): Promise<PerceptionResult | SubtreeRejection> | PerceptionResult | SubtreeRejection;
+}
+/**
+ * 子树续读被拒的两种原因（分册 14 §6）。
+ * 跨页句柄归入 `unknown-ref`：分片解析已经在更早的一层拦住了它们。
+ * @experimental
+ */
+interface SubtreeRejection {
+  rejected: 'out-of-scope' | 'unknown-ref';
 }
 /** 一次感知的留痕（FR-10.5 的 UI 提示与 FR-10.6 的审计共用同一条记录） @experimental */
 interface PerceptionRecord {
@@ -533,6 +552,10 @@ interface PerceptionRecord {
   segments?: number;
   /** 本次直接回喂给模型的那一段承载了多少个节点；只在分段发生时存在 */
   segmentNodeCount?: number;
+  /** 本次读的是哪个子树（0.16.0 分册 14 FR-14.6）；整页读时该键不存在 */
+  subtree?: {
+    ref: string;
+  };
   /** 本次下发的图像张数，按取像级别分组（只在取像开启时存在） */
   images?: {
     src: number;
@@ -572,15 +595,26 @@ interface PagePerceptionPolicyOptions {
   auditTarget?: string;
   /** 帧被跳过时的告警出口（跨源、origin 变更、找不到）；FR-24.3 要求「失效并告警」 */
   onWarning?(message: string): void;
+  /**
+   * 当前页面的身份（分册 11 §8）：两类感知留痕都带上 `page` 键，
+   * 让「这条留痕发生在哪一页」在多标签页宿主上可答。
+   */
+  describePage?(): {
+    key?: string;
+    title?: string;
+    url?: string;
+  } | undefined;
   now?(): string;
 }
 /**
  * 页面只读感知策略（需求 10）。
  *
- * **`perceive()` 不接受任何范围参数**——这是「白名单判定不受模型输出影响」
- * （AC-10.8）的实现方式。不是先拿模型给的范围再去校验，而是模型压根没有
- * 表达范围的入口：能被读的区域只由构造时的 `scope` 决定。
- * 唯一的参数是取像预算（`PerceptionCaptureOptions`），它里面没有任何范围字段。
+ * **模型没有扩大可读范围的入口**——这是「白名单判定不受模型输出影响」
+ * （AC-10.8）的实现方式：能被读的区域只由构造时的 `scope` 决定。
+ * `perceive()` 的第二个参数 `subtree` 只能**缩小**读取范围（分册 14）：
+ * 它走的是同一个遍历器、同一套 scope 判定，只换一个根节点，
+ * 因此「带 `ref` 的结果是不带它时的子集」是个结构事实，而不是事后过滤的结果。
+ * 第一个参数仍旧只是取像预算（`PerceptionCaptureOptions`），它里面没有任何范围字段。
  *
  * 本类**没有**任何点击 / 输入 / 提交 / 导航 / 滚动方法（FR-10.7）。
  * @experimental
@@ -595,7 +629,9 @@ declare class PagePerceptionPolicy {
   get records(): readonly PerceptionRecord[];
   /** FR-10.5：感知发生时通知 UI，chatbot 据此在消息流里标注一行 */
   subscribe(listener: (record: PerceptionRecord) => void): () => void;
-  perceive(capture?: PerceptionCaptureOptions): Promise<{
+  perceive(capture?: PerceptionCaptureOptions, subtree?: {
+    ref: string;
+  }): Promise<{
     nodes: readonly PerceivedNode[];
     images: readonly PerceivedImage[];
     imagesOmitted: number;
@@ -980,13 +1016,68 @@ declare const DOWNLOAD_WAIT_MAX_MS = 10000;
  */
 declare function clampDownloadWaitMs(ms: number | undefined): number;
 //#endregion
-//#region src/pageAction/types.d.ts
+//#region src/pageAction/tabSignal.d.ts
+/**
+ * 操作触发的新标签页：去向信号（0.16.0 分册 13）。
+ *
+ * 与 0.15.0 的下载窗口**同构**，理由也同一条：一个 `waitForNewTab(timeoutMs)`
+ * 无法把「窗口是关着的」写成端口契约——实现方可以永远挂着一个监听而测试全绿。
+ * 窗口的两端由 SDK 说了算，宿主实现里没有自己决定起点的余地。
+ */
+/**
+ * 本次操作开出来的新页面。**不含任何工作集之外的信息**。
+ * @experimental
+ */
+interface OpenedPageInfo {
+  title?: string;
+  url?: string;
+}
+/**
+ * 新标签页观察窗口（FR-13.2）。**不注入即整条通路不存在**：
+ * 不开窗、不留痕，`openedTab` 永不出现，页面操作的结果与本版前逐字一致。
+ * @experimental
+ */
+interface ActionTabWatcher {
+  /**
+   * 在页面操作**执行前**打开窗口。
+   * 新标签页可能在点击返回之前就已经出现，先执行再开窗会漏掉最快的那一类。
+   */
+  open(context: {
+    runId?: string;
+  }): ActionTabWindow | Promise<ActionTabWindow>;
+}
+/** @experimental */
+interface ActionTabWindow {
+  /**
+   * 结算并**关闭**窗口，返回窗口内新开的页面；没有即 `undefined`。
+   *
+   * 窗口内开了多个页面时返回**第一个**：返回数组会诱使模型去遍历一个它没点过的集合，
+   * 而一次点击的「去向」在语义上就是单数（FR-13.2）。
+   *
+   * 到预算上限就收兵，不抛错——等待超时不是失败，操作本身的结果照常返回。
+   * **无论是否超时都必须关窗**，否则留下的是一条常驻监听。
+   */
+  settle(budget: {
+    timeoutMs: number;
+  }): Promise<OpenedPageInfo | undefined>;
+}
 /**
- * 页面操作的策略层类型（需求 23）。
+ * 本次操作的去向（FR-13.3 / AC-13.2）。
  *
- * 与感知层同一条规矩：这一层不含任何 DOM 概念——执行落在 `@webskill/browser`，
- * 本包只定义「什么允许被操作」以及一次操作长什么样。
+ * `tab` 的键名与 `focus_page_tab` 的入参**同名**，
+ * 这样「拿到句柄可直接用于切换」在模型看来是字面上的显然。
+ * @experimental
  */
+type OpenedTabSignal = ({
+  tab: string;
+} & OpenedPageInfo) |
+/** 工作集触顶：照给信号，且说清没接进来——静默不给会让模型以为点击没生效而重复点击 */
+({
+  admitted: false;
+  reason: string;
+} & OpenedPageInfo);
+//#endregion
+//#region src/pageAction/types.d.ts
 /**
  * 可操作范围白名单（FR-23.1，硬约束）。
  *
@@ -1028,18 +1119,28 @@ type PageActionScopeInput = PageActionScope | {
  */
 declare function toActionFrameScopes(scope: PageActionScopeInput): readonly ActionFrameScope[];
 /**
- * 本版的操作集（FR-25.1）。导航、拖拽、滚动仍不在内。
+ * 本版的操作集（FR-25.1 / 0.16.0 FR-13.6）。拖拽、滚动仍不在内；
+ * 导航只有 `back` 一个，且它**不接受地址**——可达面被浏览器历史封死（SC-1）。
  *
  * `select`/`set`/`attach` 与既有三个走**同一条** policy 路径，
  * 范围白名单、逐次确认、审计三条硬约束因此天然覆盖到它们——
  * 前提是新动作不绕过 policy 直接调执行器（AC-25.4 守这一点）。
  * @experimental
  */
-declare const PAGE_ACTION_KINDS: readonly ["click", "fill", "submit", "select", "set", "attach"];
+declare const PAGE_ACTION_KINDS: readonly ["click", "fill", "submit", "select", "set", "attach", "back"];
 type PageActionKind = (typeof PAGE_ACTION_KINDS)[number];
+/**
+ * `back` 的目标占位（0.16.0 分册 13 §4.1）。
+ *
+ * **模型不能表达它**：工具源在 `action === 'back'` 时拒绝任何 `ref` 入参。
+ * 它存在只为了让 `back` 不必改 `PageActionRequest.ref` 的类型——
+ * 改它会波及所有实现过 executor 的宓主。
+ * @experimental
+ */
+declare const PAGE_DOCUMENT_REF = "@document";
 /** @experimental */
 interface PageActionRequest {
-  /** 感知产出的不透明句柄；不接受选择器（FR-23.4） */
+  /** 感知产出的不透明句柄；不接受选择器（FR-23.4）。`back` 时是 `PAGE_DOCUMENT_REF` */
   ref: string;
   action: PageActionKind;
   /**
@@ -1088,6 +1189,14 @@ interface PageActionOutcome {
    * 绕过 `list_downloaded_files` 确认卡的披露路径。要读内容仍得逐次点头。
    */
   downloadCount?: number;
+  /**
+   * 本次操作新开了一个页面（0.16.0 分册 13 · FR-13.3）。
+   * 没有时**不带**该字段，与 `navigated` 同口径。
+   *
+   * 带 `tab` 即已接进工作集，可直接用于 `focus_page_tab`；
+   * 带 `admitted: false` 即开出来了但没接进来（例如工作集触顶）。
+   */
+  openedTab?: OpenedTabSignal;
   /** 失败原因（英文） */
   reason?: string;
 }
@@ -1141,6 +1250,76 @@ interface PageActionRecord {
   reason?: string;
 }
 //#endregion
+//#region src/tabs/types.d.ts
+/**
+ * 模型侧标签页控制：端口与类型（0.16.0 分册 12）。
+ *
+ * 这一层不含任何浏览器概念。「工作集」是**授权概念**——它回答的是
+ * 「这一轮任务被允许在哪几页之间往返」，与谁来投递消息无关。
+ */
+/**
+ * 工作集里的一页。**这就是模型能看到的全部**（FR-12.4 末条）：
+ * 没有 `windowId`、没有 `index`、没有工作集之外的任何一页。
+ * @experimental
+ */
+interface WorksetTab {
+  /**
+   * SDK 发出的不透明句柄。模型不得构造，也不该能从中解析出标签页信息（D-12-8）——
+   * 它若能猜出「+1 就是下一页」，SC-2 的闭合准入就形同虚设。
+   */
+  readonly handle: string;
+  readonly title?: string;
+  readonly url?: string;
+}
+/**
+ * 工作集的宿主端口（FR-12.2）。**不注入即三个工具不存在**。
+ *
+ * 实现方有一条 SDK 无法代为保证的硬性义务，实现处必须注释引用本条：
+ *
+ * > `focus()` **不得**调用任何会改变用户可见画面的 API
+ * > （`chrome.tabs.update({ active: true })`、`chrome.windows.update({ focused: true })`
+ * > 及一切等价物）。切换焦点只改变「后续感知与操作发往哪一页」——SC-3。
+ *
+ * 这条写在这里而不只写在扩展里，是因为端口是给**所有**宿主实现的；
+ * 下一个接入方不会去读某个示例扩展的注释。
+ * @experimental
+ */
+interface TabWorksetPort {
+  /** 接入顺序，第 0 项恒为 run 起点的绑定页 */
+  list(): readonly WorksetTab[] | Promise<readonly WorksetTab[]>;
+  /** 只改变「后续感知与操作发往哪一页」。见上方义务 */
+  focus(handle: string): void | Promise<void>;
+  /** SDK 已保证 handle 既不是起点页、也不在工作集外（FR-12.6） */
+  close(handle: string): void | Promise<void>;
+  /**
+   * 把一个**由页面操作新开出来的**标签页接进工作集，返回它的句柄。
+   *
+   * 由分册 13 的通路唯一调用；模型没有任何入口能到达这里（D-13-4 / SC-2）。
+   * 它放在**端口**而不是 policy 内部，是因为句柄的发放必须与宿主的
+   * 「标签页 → 句柄」映射同时发生——两处各记一半，就会出现
+   * 「SDK 认得这个句柄、宿主找不到那一页」的空转。
+   */
+  admit(opened: {
+    title?: string;
+    url?: string;
+  }): string | Promise<string>;
+  /** run 结束（分册 11 / FR-11.4）。它只丢工作集，**不关闭任何标签页** */
+  reset(): void | Promise<void>;
+}
+/**
+ * 准入结果。触顶**不抛错**：分册 13 要把它变成给模型的一句话，
+ * 而不是让触发它的那次页面操作整个失败。
+ * @experimental
+ */
+type TabAdmission = {
+  admitted: true;
+  handle: string;
+} | {
+  admitted: false;
+  reason: 'full';
+  limit: number;
+};
+//#endregion
 //#region src/pageAction/policy.d.ts
 /** 授权卡的最小出口；`UiBridge` 直接满足（与技能生成用的是同一个端口） */
 interface PageActionUi {
@@ -1195,6 +1374,36 @@ interface PageActionPolicyOptions {
   downloadSignalEnabled?(): boolean;
   /** 宿主注入的等待上限（毫秒）；SDK 夹在地板与天花板之间（FR-15.3）。模型无法影响它 */
   downloadWaitMs?(): number | undefined;
+  /**
+   * 句柄解析失败时的补充说明（0.16.0 分册 11 / FR-11.6）。
+   *
+   * 不注入即一律用通用文案，与 0.15.0 逐字一致（AC-11.3）。
+   * 它**只能换文案**：错误码恒为 `PAGE_ACTION_STALE_REF`，不得因为「认识这个 ref」就放行——
+   * 跨页直接操作正是 SC-3 要拦的东西。
+   */
+  diagnose?(ref: string): string | undefined;
+  /**
+   * 新标签页观察窗口（0.16.0 分册 13 / FR-13.2）。**不注入即整条通路不存在**：
+   * `openedTab` 永不出现，页面操作的结果与本版前逐字一致（AC-13.13）。
+   */
+  tabWatcher?: ActionTabWatcher;
+  /**
+   * 把新页面接进工作集（D-13-4）。
+   * 这里是 `packages/agent/src` 里 `.admit(` 的**唯一调用点**（分册 12 §3 / SC-2）：
+   * 新页只能由模型自己的一次操作带进来，不得存在「监听到新标签页就收进来」的旁路。
+   */
+  workset?: {
+    admit(opened: OpenedPageInfo): Promise<TabAdmission>;
+  };
+  /**
+   * 当前页面的身份（分册 11 §8）。两个用途：给 `back` 的确认卡一个可读的页面名，
+   * 以及给留痕的 `page` 键。不注入即确认卡上只有角色、留痕里没有 `page`。
+   */
+  describePage?(): {
+    key?: string;
+    title?: string;
+    url?: string;
+  } | undefined;
   now?(): string;
 }
 /**
@@ -1254,6 +1463,105 @@ declare function createPageActionToolSource(options: PageActionToolSourceOptions
  */
 declare const PAGE_ACTION_SYSTEM_PROMPT: string;
 //#endregion
+//#region src/tabs/policy.d.ts
+/** 工作集容量缺省（分册 18）；一屏索引视图的行数就是它要盖住的量，撞 `workset-full` 时模型没有任何入口能要更多 */
+declare const TAB_WORKSET_DEFAULT_MAX = 32;
+/** 地板：2 的含义是「起点页 + 至少一个详情页」，低于它工作集这个概念就没有意义 */
+declare const TAB_WORKSET_MIN_MAX = 2;
+/** 天花板：宿主写错一个 0 不该让一轮任务铺开几百个标签页。与缺省同值，宿主只调得低不调得高 */
+declare const TAB_WORKSET_MAX_MAX = 32;
+/**
+ * 夹取工作集容量（FR-11.5 / D-11-3）。
+ *
+ * 与 0.15.0 的 `clampDownloadWaitMs` 同惯例：宿主给不合理的值**不报错，夹到边界**——
+ * 装配期的一个笔误不该让运行期整条能力崩掉。模型无法影响这个值。
+ * @experimental
+ */
+declare function clampWorksetMax(value: number | undefined): number;
+/** 模型看到的一行；`origin` 只出现在起点页上，`focused` 标出当前操作面 */
+interface WorksetTabView {
+  tab: string;
+  title?: string;
+  url?: string;
+  origin?: true;
+  focused: boolean;
+}
+/** @experimental */
+interface TabWorksetPolicyOptions {
+  port: TabWorksetPort;
+  /**
+   * 与 `act_on_page` 同一个启用状态（D-12-6）。本版**不新开开关**：
+   * 「能操作页面」与「能在页面间往返」是同一件事的两半，分开配置只会配出
+   * 「能点但切不过去」这种半残状态。
+   */
+  enabled(): boolean;
+  audit?: PageAuditSink;
+  /** 审计事件的 target（缺省 `page`） */
+  auditTarget?: string;
+  /** 工作集容量；SDK 夹在地板与天花板之间。模型无法影响它 */
+  maxTabs?(): number | undefined;
+  now?(): string;
+}
+/**
+ * 工作集策略（分册 12）。
+ *
+ * 它守着三件事：模型只能在**已接入**的页之间往返（SC-2）、
+ * 切换不改变用户看到的画面（SC-3，由端口实现兑现，此处只做不诱导的接口设计）、
+ * 起点页永远关不掉（FR-12.6）。
+ * @experimental
+ */
+declare class TabWorksetPolicy {
+  #private;
+  constructor(options: TabWorksetPolicyOptions);
+  get enabled(): boolean;
+  list(): Promise<WorksetTabView[]>;
+  focus(handle: string): Promise<{
+    focused: string;
+  }>;
+  close(handle: string): Promise<{
+    closed: string;
+    focused: string | undefined;
+  }>;
+  /**
+   * 把页面操作新开出来的那一页接进工作集（SC-2 的唯一入口）。
+   *
+   * 容量闸门在这里，管的是**标签页数**（FR-11.5）；分册 11 的 registry 分片软上限
+   * 是另一回事（同一页里跳三次产生三个分片，对它们硬拒绝会打断正常感知）。
+   */
+  admit(opened: {
+    title?: string;
+    url?: string;
+  }): Promise<TabAdmission>;
+  /** run 结束（分册 11 / FR-11.4）。**不关闭任何标签页**——那是用户的浏览器 */
+  reset(): Promise<void>;
+}
+//#endregion
+//#region src/tabs/toolSource.d.ts
+declare const LIST_PAGE_TABS_TOOL = "list_page_tabs";
+declare const FOCUS_PAGE_TAB_TOOL = "focus_page_tab";
+declare const CLOSE_PAGE_TAB_TOOL = "close_page_tab";
+/** @experimental */
+interface TabWorksetToolSourceOptions {
+  policy: TabWorksetPolicy;
+}
+/**
+ * 把工作集接到既有工具协议上（分册 12 §7）。
+ *
+ * 端口未注入或页面操作未启用时 `listToolSpecs()` 返回空数组——
+ * 模型连这三个工具的存在都看不到，而不是看得到再被拒（AC-12.11）。
+ * @experimental
+ */
+declare function createTabWorksetToolSource(options: TabWorksetToolSourceOptions): ExternalToolSource;
+//#endregion
+//#region src/prompts/tabWorkset.d.ts
+/**
+ * 工作集系统提示词（0.16.0 分册 12 / FR-12.9）。
+ *
+ * 第三段是最要紧的：模型若以为切换会让用户看到那一页，
+ * 就会写出「我已经帮你打开了详情页」这种与事实不符的话。
+ */
+declare const TAB_WORKSET_SYSTEM_PROMPT = "You can work across several pages within one task.\n\n- `list_page_tabs` shows the pages available to you. The first one is the user's own page; you can read and act on it, but you can never close it.\n- `focus_page_tab` decides which page `perceive_page` and `act_on_page` talk to next. Element references are per-page: a reference from one page will be rejected on another, so perceive after every switch.\n- New pages only join this set when an action you took opened them. You cannot open a page by URL, and pages the user opens on their own are not yours to touch.\n- Close a detail page with `close_page_tab` once you have read what you needed. Leaving them open uses up the page budget and will eventually block new ones.\n\nSwitching pages does not change what the user sees. Their browser stays exactly where they left it, so never tell them you have \"opened\" or \"switched to\" a page for them.";
+//#endregion
 //#region src/downloads/types.d.ts
 /**
  * 一条已下载文件的目录项。
@@ -1400,4 +1708,4 @@ interface DownloadedFileToolSourceOptions {
  */
 declare function createDownloadedFileToolSource(options: DownloadedFileToolSourceOptions): ExternalToolSource;
 //#endregion
-export { PERCEPTION_PAGING_DEFAULTS as $, createHttpDataSourceTransport as $t, DownloadedFileAction as A, SKILL_GENERATION_SYSTEM_PROMPT as At, FrameNote as B, SubAgentRunInput as Bt, DataSourceTransport as C, PerceptionCaptureOptions as Ct, DelegationRequest as D, PerceptionScope as Dt, DelegationOrchestratorOptions as E, PerceptionResult as Et, DownloadedFilePolicyOptions as F, SkillGenerationToolSourceOptions as Ft, ImageCaptureBudget as G, TodoList as Gt, GENERATE_SKILL_TOOL as H, TODO_SYSTEM_PROMPT as Ht, DownloadedFileReadResult as I, SkillGenerator as It, NestedFrameRef as J, TodoStore as Jt, LIST_DOWNLOADED_FILES_TOOL as K, TodoListener as Kt, DownloadedFileReader as L, SkillGeneratorOptions as Lt, DownloadedFileEntry as M, SkillGenerationMessages as Mt, DownloadedFileListing as N, SkillGenerationOutcome as Nt, DelegationResult as O, PerceptionScopeInput as Ot, DownloadedFilePolicy as P, SkillGenerationPolicy as Pt, PERCEIVE_PAGE_TOOL as Q, createDownloadedFileToolSource as Qt, DownloadedFileRecord as R, SkillTraceEvidence as Rt, DataSourceRecord as S, PerceptionAuditSink as St, DelegationOrchestrator as T, PerceptionRecord as Tt, GeneratedSkillDraft as U, TodoEvent as Ut, FrameScope as V, SubAgentRunner as Vt, HttpDataSourceOptions as W, TodoItem as Wt, PAGE_ACTION_SYSTEM_PROMPT as X, clampDownloadWaitMs as Xt, PAGE_ACTION_KINDS as Y, TodoToolSourceOptions as Yt, PAGE_ACTION_TOOL as Z, createDelegationToolSource as Zt, DataSourceDef as _, PagePerceptionReader as _t, DELEGATE_TASK_TOOL as a, frameSteps as an, PageActionPolicy as at, DataSourcePolicyOptions as b, PerceivedImage as bt, DOWNLOAD_WAIT_MAX_MS as c, withDelegationOrigin as cn, PageActionRequest as ct, DataSourceCandidate as d, PageActionTarget as dt, createPageActionToolSource as en, PERCEPTION_SYSTEM_PROMPT as et, DataSourceCandidateAuditSink as f, PageActionToolSourceOptions as ft, DataSourceCandidateStore as g, PagePerceptionPolicyOptions as gt, DataSourceCandidateRecord as h, PagePerceptionPolicy as ht, ConsentUi as i, frameLabel as in, PageActionOutcome as it, DownloadedFileConsent as j, SkillCandidateSink as jt, DelegationToolSourceOptions as k, READ_DOWNLOADED_FILE_TOOL as kt, DOWNLOAD_WAIT_MIN_MS as l, PageActionScope as lt, DataSourceCandidatePolicyOptions as m, PageAuditSink as mt, ActionDownloadWindow as n, createSkillGenerationToolSource as nn, PageActionExecutor as nt, DELEGATION_SYSTEM_PROMPT as o, toActionFrameScopes as on, PageActionPolicyOptions as ot, DataSourceCandidatePolicy as p, PageActionUi as pt, MANAGE_TODO_TOOL as q, TodoStatus as qt, ActionFrameScope as r, createTodoToolSource as rn, PageActionKind as rt, DOWNLOAD_WAIT_DEFAULT_MS as s, toFrameScopes as sn, PageActionRecord as st, ActionDownloadWatcher as t, createPagePerceptionToolSource as tn, PageActionConsent as tt, DataSourceAuditSink as u, PageActionScopeInput as ut, DataSourceKind as v, PagePerceptionToolSourceOptions as vt, DelegationBudget as w, PerceptionPagingBudget as wt, DataSourceProvenance as x, PerceivedNode as xt, DataSourcePolicy as y, ParentBudget as yt, DownloadedFileToolSourceOptions as z, SkillTraceEvidenceStep as zt };
+export { NestedFrameRef as $, TAB_WORKSET_MIN_MAX as $t, DelegationRequest as A, withDelegationOrigin as An, PerceptionAuditSink as At, DownloadedFileReader as B, SkillGenerationMessages as Bt, DataSourcePolicyOptions as C, createSkillGenerationToolSource as Cn, PagePerceptionPolicy as Ct, DelegationBudget as D, frameSteps as Dn, ParentBudget as Dt, DataSourceTransport as E, frameLabel as En, PagePerceptionToolSourceOptions as Et, DownloadedFileEntry as F, PerceptionScope as Ft, FrameScope as G, SkillGeneratorOptions as Gt, DownloadedFileToolSourceOptions as H, SkillGenerationPolicy as Ht, DownloadedFileListing as I, PerceptionScopeInput as It, HttpDataSourceOptions as J, SubAgentRunInput as Jt, GENERATE_SKILL_TOOL as K, SkillTraceEvidence as Kt, DownloadedFilePolicy as L, READ_DOWNLOADED_FILE_TOOL as Lt, DelegationToolSourceOptions as M, PerceptionPagingBudget as Mt, DownloadedFileAction as N, PerceptionRecord as Nt, DelegationOrchestrator as O, toActionFrameScopes as On, PerceivedImage as Ot, DownloadedFileConsent as P, PerceptionResult as Pt, MANAGE_TODO_TOOL as Q, TAB_WORKSET_MAX_MAX as Qt, DownloadedFilePolicyOptions as R, SKILL_GENERATION_SYSTEM_PROMPT as Rt, DataSourcePolicy as S, createPagePerceptionToolSource as Sn, PageAuditSink as St, DataSourceRecord as T, createTodoToolSource as Tn, PagePerceptionReader as Tt, FOCUS_PAGE_TAB_TOOL as U, SkillGenerationToolSourceOptions as Ut, DownloadedFileRecord as V, SkillGenerationOutcome as Vt, FrameNote as W, SkillGenerator as Wt, LIST_DOWNLOADED_FILES_TOOL as X, SubtreeRejection as Xt, ImageCaptureBudget as Y, SubAgentRunner as Yt, LIST_PAGE_TABS_TOOL as Z, TAB_WORKSET_DEFAULT_MAX as Zt, DataSourceCandidatePolicyOptions as _, clampWorksetMax as _n, PageActionScope as _t, ActionTabWindow as a, TabWorksetPort as an, PAGE_DOCUMENT_REF as at, DataSourceDef as b, createHttpDataSourceTransport as bn, PageActionToolSourceOptions as bt, DELEGATE_TASK_TOOL as c, TodoItem as cn, PERCEPTION_SYSTEM_PROMPT as ct, DOWNLOAD_WAIT_MAX_MS as d, TodoStatus as dn, PageActionKind as dt, TAB_WORKSET_SYSTEM_PROMPT as en, OpenedPageInfo as et, DOWNLOAD_WAIT_MIN_MS as f, TodoStore as fn, PageActionOutcome as ft, DataSourceCandidatePolicy as g, clampDownloadWaitMs as gn, PageActionRequest as gt, DataSourceCandidateAuditSink as h, WorksetTabView as hn, PageActionRecord as ht, ActionTabWatcher as i, TabWorksetPolicyOptions as in, PAGE_ACTION_TOOL as it, DelegationResult as j, PerceptionCaptureOptions as jt, DelegationOrchestratorOptions as k, toFrameScopes as kn, PerceivedNode as kt, DELEGATION_SYSTEM_PROMPT as l, TodoList as ln, PageActionConsent as lt, DataSourceCandidate as m, WorksetTab as mn, PageActionPolicyOptions as mt, ActionDownloadWindow as n, TabAdmission as nn, PAGE_ACTION_KINDS as nt, CLOSE_PAGE_TAB_TOOL as o, TabWorksetToolSourceOptions as on, PERCEIVE_PAGE_TOOL as ot, DataSourceAuditSink as p, TodoToolSourceOptions as pn, PageActionPolicy as pt, GeneratedSkillDraft as q, SkillTraceEvidenceStep as qt, ActionFrameScope as r, TabWorksetPolicy as rn, PAGE_ACTION_SYSTEM_PROMPT as rt, ConsentUi as s, TodoEvent as sn, PERCEPTION_PAGING_DEFAULTS as st, ActionDownloadWatcher as t, TODO_SYSTEM_PROMPT as tn, OpenedTabSignal as tt, DOWNLOAD_WAIT_DEFAULT_MS as u, TodoListener as un, PageActionExecutor as ut, DataSourceCandidateRecord as v, createDelegationToolSource as vn, PageActionScopeInput as vt, DataSourceProvenance as w, createTabWorksetToolSource as wn, PagePerceptionPolicyOptions as wt, DataSourceKind as x, createPageActionToolSource as xn, PageActionUi as xt, DataSourceCandidateStore as y, createDownloadedFileToolSource as yn, PageActionTarget as yt, DownloadedFileReadResult as z, SkillCandidateSink as zt };

package/dist/{index-Oc3H89TJ.d.ts → index-BDyXe-a5.d.ts}

@@ -1,4 +1,4 @@
-import { At as ValidationReport, B as DiscoveryResult, K as JsonSchema, Nt as WebSkillErrorCode, O as UiSurfaceActionRequest, Ot as UiSpecNode, S as UiBridge, T as UiSpecEvent, U as FileSystemProvider, X as PageQuery, Y as Page, Z as RemoteUrlPolicy, _ as LlmToolSpec, _t as SkillManifest, b as RenderResultRequest, d as LlmContentPart, dt as SkillDiscovery, f as LlmMessage, ft as SkillDocument, g as LlmToolCall, h as LlmTokenUsage, i as FormField, l as LlmClient, lt as SkillCatalog, m as LlmStreamEvent, n as ArtifactStore, o as InteractionPolicy, p as LlmResponse, pt as SkillInstallSource, r as ChartSpec, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, ut as SkillCatalogEntry, v as MemoryStore, w as UiSpecDrafts, y as RenderBlock } from "./types-C3V6lAeO-BIf7UB2e.js";
+import { At as ValidationReport, B as DiscoveryResult, K as JsonSchema, Nt as WebSkillErrorCode, O as UiSurfaceActionRequest, Ot as UiSpecNode, S as UiBridge, T as UiSpecEvent, U as FileSystemProvider, X as PageQuery, Y as Page, Z as RemoteUrlPolicy, _ as LlmToolSpec, _t as SkillManifest, b as RenderResultRequest, d as LlmContentPart, dt as SkillDiscovery, f as LlmMessage, ft as SkillDocument, g as LlmToolCall, h as LlmTokenUsage, i as FormField, l as LlmClient, lt as SkillCatalog, m as LlmStreamEvent, n as ArtifactStore, o as InteractionPolicy, p as LlmResponse, pt as SkillInstallSource, r as ChartSpec, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, ut as SkillCatalogEntry, v as MemoryStore, w as UiSpecDrafts, y as RenderBlock } from "./types-Btpdd1y--BcxQ10Fa.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/parts.d.ts
 /** 纯文本消息内容的构造快捷方式（引擎内部绝大多数消息仍是纯文本） */

package/dist/{index-CU2md8R1.d.ts → index-CaLsVI-m.d.ts}

@@ -1,5 +1,5 @@
-import { C as UiSpecActionCapability, D as UiSpecSnapshot, K as JsonSchema, Ot as UiSpecNode, S as UiBridge, b as RenderResultRequest, c as InteractionResponse, r as ChartSpec, s as InteractionRequest, y as RenderBlock } from "./types-C3V6lAeO-BIf7UB2e.js";
-import { z as ExternalToolSource } from "./index-Oc3H89TJ.js";
+import { C as UiSpecActionCapability, D as UiSpecSnapshot, K as JsonSchema, Ot as UiSpecNode, S as UiBridge, b as RenderResultRequest, c as InteractionResponse, r as ChartSpec, s as InteractionRequest, y as RenderBlock } from "./types-Btpdd1y--BcxQ10Fa.js";
+import { z as ExternalToolSource } from "./index-BDyXe-a5.js";
 import { z } from "zod";
 import { ComponentType, ReactNode } from "react";
 //#region ../ui/dist/index.d.ts
@@ -668,6 +668,11 @@ interface InteractionSpecLabels {
   title?: string;
   submitLabel?: string;
   cancelLabel?: string;
+  /**
+   * 正文覆写（分册 19 FR-19.1）。runtime 拼的英文原句是无字典层的正确产物，
+   * 但持有字典的宿主要能把它换成本地化文案；空串表示不渲染正文（同 `title`）。
+   */
+  message?: string;
 }
 /**
  * 五类 `InteractionRequest` → catalog 声明树。

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { $ as SKILLS_LOCKFILE, $t as messageOf, A as extractSkillCandidate, At as ValidationReport, B as DiscoveryResult, Bt as checkDependencyCycles, C as UiSpecActionCapability, Ct as SkillsLockfile, D as UiSpecSnapshot, Dt as UNTRUSTED_LINE_LIMIT, E as UiSpecPatch, Et as TrustedKeyStore, F as CatalogRenderer, Ft as assertRemoteUrlAllowed, G as IMAGE_MIME_TYPES, Gt as detectSkillArchiveShapeFromFs, H as FileStat, Ht as classifyAttachment, I as ChatAttachmentKind, It as assertSafePathSegment, J as MemoryFS, Jt as formatAttachmentText, K as JsonSchema, Kt as escapeXml, L as CryptoKeyLike, Lt as atomicWriteText, M as ATTACHMENT_TEXT_LIMIT, Mt as WebSkillError, N as ArchiveLimits, Nt as WebSkillErrorCode, O as UiSurfaceActionRequest, Ot as UiSpecNode, P as AttachmentTextInput, Pt as XLSX_MIME, Q as SIGNATURE_SCHEMA_VERSION, Qt as keyIdOf, R as DEFAULT_ARCHIVE_LIMITS, Rt as buildCatalog, S as UiBridge, St as SkillSource, T as UiSpecEvent, Tt as TrustedKey, U as FileSystemProvider, Ut as computeDigest, V as FILE_MIME_TYPES, Vt as checkSkillRules, W as FsTrustedKeyStore, Wt as detectSkillArchiveShape, X as PageQuery, Xt as isValidSkillName, Y as Page, Yt as isAtomicTempPath, Z as RemoteUrlPolicy, Zt as jsonRenderer, _ as LlmToolSpec, _n as xmlRenderer, _t as SkillManifest, a as InteractionOrigin, an as renderAvailableSkillsXml, at as SignatureAuditSink, b as RenderResultRequest, bt as SkillReader, c as InteractionResponse, cn as resolveInsideRoot, ct as SkillArchiveShape, d as LlmContentPart, dn as signaturePayloadBytes, dt as SkillDiscovery, en as normalizePath, et as SKILL_MANIFEST_FILE, f as LlmMessage, fn as stripArchiveRoot, ft as SkillDocument, g as LlmToolCall, gn as verifySkillSignature, gt as SkillManagerPort, h as LlmTokenUsage, hn as verifyManifest, ht as SkillLocation, i as FormField, in as readSkillSignature, it as SKILL_SIGNATURE_FILE, j as ATOMIC_TMP_SUFFIX_PATTERN, jt as VerifyResult, k as UiSurfaceActionResponse, kt as UnsignedPolicy, l as LlmClient, ln as sanitizeUntrustedLine, lt as SkillCatalog, m as LlmStreamEvent, mn as validateSkills, mt as SkillIssue, n as ArtifactStore, nn as parseSkillPackManifest, nt as SKILL_NAME_PATTERN, o as InteractionPolicy, on as renderCatalogJson, ot as SignatureVerdict, p as LlmResponse, pn as unzipWithLimits, pt as SkillInstallSource, q as MANIFEST_EXCLUDED_FILES, qt as exportSkills, r as ChartSpec, rn as readResponseWithLimit, rt as SKILL_PACK_FILE, s as InteractionRequest, sn as resolveArchiveLimits, st as SkillArchiveDetection, t as Artifact, tn as parseSkillMarkdown, tt as SKILL_NAME_MAX_LENGTH, u as LlmCompleteInput, un as signSkill, ut as SkillCatalogEntry, v as MemoryStore, vt as SkillMetadata, w as UiSpecDrafts, wt as TEXT_EXTENSIONS, x as SkillCandidateMarker, xt as SkillSignature, y as RenderBlock, yt as SkillPackManifest, z as DOCX_MIME, zt as buildManifest } from "./types-C3V6lAeO-BIf7UB2e.js";
-import { $ as IntegrityVerdict, $n as diffUserProfile, $t as SessionMeta, A as DEFAULT_USER_PROFILE_LIMITS, An as USER_PROFILE_EXPORT_VERSION, Ar as schemaSourceLabel, At as RunToolCall, B as FS_SESSION_PAGE_SIZE, Bn as UserProfileImportDiff, Br as toVercelToolSpecs, Bt as RuntimeSession, C as CapabilityApproval, Cn as ToolStepTrust, Cr as readProfileEntries, Ct as RouteResult, D as DEFAULT_MAX_DOCUMENT_BYTES, Dn as TraceRecorder, Dr as renderUserProfileContext, Dt as RunSnapshotListEntry, E as DEFAULT_MAX_DATA_SOURCE_BYTES, En as TraceEventType, Er as refineUserProfile, Et as RunSnapshot, F as EMPTY_USER_PROFILE, Fn as UnsupportedRunSnapshot, Fr as summarizeToolCalls, Ft as RunTraceSummary, G as FsSessionStore, Gn as WebSkillRuntimeDeps, Gt as SchemaInferer, H as FsMemoryStore, Hn as VercelToolSpec, Hr as validateUiSpecNode, Ht as SENSITIVE_ANNOTATION, I as EventBus, In as UploadFileInfo, Ir as textParts, It as RunUploadFiles, J as GoogleGenAiClient, Jn as applyUserProfileImport, Jt as SealOptions, K as FsToolStepStore, Kn as XlsxTextExtractor, Kt as ScriptExecutionContext, L as ExecuteLifecycleData, Ln as UserProfile, Lr as toBase64, Lt as RunUsageSummary, M as DocumentSurfaceHost, Mn as USER_PROFILE_NO_INVENTION_RULE, Mr as scriptToolName, Mt as RunTraceFilter, N as DocumentSurfacePort, Nn as USER_PROFILE_PROMPT_HEADER, Nr as sealToolCallPairs, Nt as RunTraceMetrics, O as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, On as UNSUPPORTED_DOCUMENT_MESSAGE, Or as resolveToolName, Ot as RunSnapshotStore, P as DocxTextExtractor, Pn as USER_PROFILE_REFINE_PROMPT, Pr as summarizeRunUsage, Pt as RunTraceStore, Q as InstalledSkillManifest, Qn as createWebSkillApi, Qt as SessionListPage, R as ExternalSkillProvider, Rn as UserProfileEntry, Rr as toLlmToolSpec, Rt as RuntimePhase, S as BridgeResponse, Sn as ToolStepStore, Sr as readBehaviorRecords, St as RouteLifecycleData, T as DEFAULT_LOOP_LIMITS, Tn as TraceEvent, Tr as redactToolStepArgs, Tt as RunResult, U as FsRunSnapshotStore, Un as WebSkillApi, Ut as SESSION_SCHEMA_VERSION, V as FsArtifactStore, Vn as UserProfileLimits, Vr as validateUiSpecEvent, Vt as RuntimeSessionHandle, W as FsRunTraceStore, Wn as WebSkillRuntime, Wt as SUPPORTED_DOCUMENT_MIME, X as HookRunner, Xn as buildRenderResult, Xt as SealResult, Y as GoogleGenAiClientConfig, Yn as bridgeError, Yt as SealRecord, Z as HookRunnerOptions, Zn as createScriptContext, Zt as SerializingMemoryStore, _ as BehaviorRecordKind, _n as ToolDisclosure, _r as normalizeToolContent, _t as READ_SKILL_FILE_TOOL_NAME, a as ASK_USER_TOOL, an as SkillRouter, ar as formatSkillScriptManifest, at as LifecycleListener, b as BridgeCapability, bn as ToolStepReader, br as parseUserProfileExport, bt as RedactedArgs, c as AgentLoop, cn as SkillStateGuard, cr as interruptedToolResult, ct as NetworkPolicy, d as AnthropicClient, dn as TerminalLifecycleData, dr as listSkillScripts, dt as PdfTextExtractor, en as SessionRecord, er as exportUserProfile, et as InteractLifecycleData, f as AnthropicClientConfig, fn as TextualToolContent, fr as mergeCatalogEntries, ft as ProgressiveRouter, g as BehaviorRecord, gn as ToolDefinition, gr as normalizeErrorCode, gt as READ_SKILL_FILE_TOOL, h as BEHAVIOR_RECORDS_KEY, hn as ToolContent, hr as networkUrlHost, ht as READ_SKILL_FILE_INPUT_SCHEMA, i as ASK_USER_MAX_FIELDS, in as SkillOutcomeReporter, ir as findUnpairedToolCalls, it as LifecycleHookContext, j as DataSourceInfo, jn as USER_PROFILE_KEY, jr as schemaToForm, jt as RunTraceFile, k as DEFAULT_MAX_UPLOAD_FILE_BYTES, kn as UPLOAD_FILES_UNAVAILABLE, kr as sampleBehaviorRecords, kt as RunTerminationReason, l as AgentLoopConfig, ln as SkillSuccessReport, lr as isNetworkAllowed, lt as OpenAiCompatibleClient, m as ApprovalScope, mn as ToolCallContext, mr as networkPolicyLibSource, mt as READ_LINKED_DOCUMENT_TOOL_NAME, n as ASK_USER_FIELD_TYPES, nn as SkillFailureReport, nr as extractTodoTraceEvents, nt as LifecycleEventInit, o as ASK_USER_TOOL_NAME, on as SkillScriptDescriptor, or as fromVercelResult, ot as LinkedDocumentReader, p as ApprovalDecision, pn as TodoTraceEvent, pr as mergeProfileEntries, pt as READ_LINKED_DOCUMENT_TOOL, q as FullDisclosureRouter, qn as appendBehaviorRecords, qt as ScriptExecutor, r as ASK_USER_INPUT_SCHEMA, rn as SkillIntegrityGuard, rr as extractUiSpecEvents, rt as LifecycleHook, s as ActivateLifecycleData, sn as SkillScriptSchemaSource, sr as fromVercelStreamPart, st as MAX_TOOL_STEP_ARG_BYTES, t as ALLOWED_TOOLS_EXCLUSION_REASON, tn as SessionStore, tr as extractChartSpec, tt as LifecycleEvent, u as AgentLoopDeps, un as TEXT_BUDGETED_CONTENT_TYPES, ur as isUnsupportedRunSnapshot, ut as OpenAiCompatibleClientConfig, v as BehaviorScene, vn as ToolResolution, vr as normalizeToolError, vt as RUN_SNAPSHOT_SCHEMA_VERSION, w as CapabilityMode, wn as TraceClock, wr as readUserProfile, wt as RunLimitErrorDetails, x as BridgeRequest, xn as ToolStepRecord, xr as partsToText, xt as RefineUserProfileInput, y as BridgeCapabilities, yn as ToolResult, yr as parseBridgeRequest, yt as RUN_TRACE_SCHEMA_VERSION, z as ExternalToolSource, zn as UserProfileExport, zr as toRecordDigests, zt as RuntimeRun } from "./index-Oc3H89TJ.js";
+import { $ as SKILLS_LOCKFILE, $t as messageOf, A as extractSkillCandidate, At as ValidationReport, B as DiscoveryResult, Bt as checkDependencyCycles, C as UiSpecActionCapability, Ct as SkillsLockfile, D as UiSpecSnapshot, Dt as UNTRUSTED_LINE_LIMIT, E as UiSpecPatch, Et as TrustedKeyStore, F as CatalogRenderer, Ft as assertRemoteUrlAllowed, G as IMAGE_MIME_TYPES, Gt as detectSkillArchiveShapeFromFs, H as FileStat, Ht as classifyAttachment, I as ChatAttachmentKind, It as assertSafePathSegment, J as MemoryFS, Jt as formatAttachmentText, K as JsonSchema, Kt as escapeXml, L as CryptoKeyLike, Lt as atomicWriteText, M as ATTACHMENT_TEXT_LIMIT, Mt as WebSkillError, N as ArchiveLimits, Nt as WebSkillErrorCode, O as UiSurfaceActionRequest, Ot as UiSpecNode, P as AttachmentTextInput, Pt as XLSX_MIME, Q as SIGNATURE_SCHEMA_VERSION, Qt as keyIdOf, R as DEFAULT_ARCHIVE_LIMITS, Rt as buildCatalog, S as UiBridge, St as SkillSource, T as UiSpecEvent, Tt as TrustedKey, U as FileSystemProvider, Ut as computeDigest, V as FILE_MIME_TYPES, Vt as checkSkillRules, W as FsTrustedKeyStore, Wt as detectSkillArchiveShape, X as PageQuery, Xt as isValidSkillName, Y as Page, Yt as isAtomicTempPath, Z as RemoteUrlPolicy, Zt as jsonRenderer, _ as LlmToolSpec, _n as xmlRenderer, _t as SkillManifest, a as InteractionOrigin, an as renderAvailableSkillsXml, at as SignatureAuditSink, b as RenderResultRequest, bt as SkillReader, c as InteractionResponse, cn as resolveInsideRoot, ct as SkillArchiveShape, d as LlmContentPart, dn as signaturePayloadBytes, dt as SkillDiscovery, en as normalizePath, et as SKILL_MANIFEST_FILE, f as LlmMessage, fn as stripArchiveRoot, ft as SkillDocument, g as LlmToolCall, gn as verifySkillSignature, gt as SkillManagerPort, h as LlmTokenUsage, hn as verifyManifest, ht as SkillLocation, i as FormField, in as readSkillSignature, it as SKILL_SIGNATURE_FILE, j as ATOMIC_TMP_SUFFIX_PATTERN, jt as VerifyResult, k as UiSurfaceActionResponse, kt as UnsignedPolicy, l as LlmClient, ln as sanitizeUntrustedLine, lt as SkillCatalog, m as LlmStreamEvent, mn as validateSkills, mt as SkillIssue, n as ArtifactStore, nn as parseSkillPackManifest, nt as SKILL_NAME_PATTERN, o as InteractionPolicy, on as renderCatalogJson, ot as SignatureVerdict, p as LlmResponse, pn as unzipWithLimits, pt as SkillInstallSource, q as MANIFEST_EXCLUDED_FILES, qt as exportSkills, r as ChartSpec, rn as readResponseWithLimit, rt as SKILL_PACK_FILE, s as InteractionRequest, sn as resolveArchiveLimits, st as SkillArchiveDetection, t as Artifact, tn as parseSkillMarkdown, tt as SKILL_NAME_MAX_LENGTH, u as LlmCompleteInput, un as signSkill, ut as SkillCatalogEntry, v as MemoryStore, vt as SkillMetadata, w as UiSpecDrafts, wt as TEXT_EXTENSIONS, x as SkillCandidateMarker, xt as SkillSignature, y as RenderBlock, yt as SkillPackManifest, z as DOCX_MIME, zt as buildManifest } from "./types-Btpdd1y--BcxQ10Fa.js";
+import { $ as IntegrityVerdict, $n as diffUserProfile, $t as SessionMeta, A as DEFAULT_USER_PROFILE_LIMITS, An as USER_PROFILE_EXPORT_VERSION, Ar as schemaSourceLabel, At as RunToolCall, B as FS_SESSION_PAGE_SIZE, Bn as UserProfileImportDiff, Br as toVercelToolSpecs, Bt as RuntimeSession, C as CapabilityApproval, Cn as ToolStepTrust, Cr as readProfileEntries, Ct as RouteResult, D as DEFAULT_MAX_DOCUMENT_BYTES, Dn as TraceRecorder, Dr as renderUserProfileContext, Dt as RunSnapshotListEntry, E as DEFAULT_MAX_DATA_SOURCE_BYTES, En as TraceEventType, Er as refineUserProfile, Et as RunSnapshot, F as EMPTY_USER_PROFILE, Fn as UnsupportedRunSnapshot, Fr as summarizeToolCalls, Ft as RunTraceSummary, G as FsSessionStore, Gn as WebSkillRuntimeDeps, Gt as SchemaInferer, H as FsMemoryStore, Hn as VercelToolSpec, Hr as validateUiSpecNode, Ht as SENSITIVE_ANNOTATION, I as EventBus, In as UploadFileInfo, Ir as textParts, It as RunUploadFiles, J as GoogleGenAiClient, Jn as applyUserProfileImport, Jt as SealOptions, K as FsToolStepStore, Kn as XlsxTextExtractor, Kt as ScriptExecutionContext, L as ExecuteLifecycleData, Ln as UserProfile, Lr as toBase64, Lt as RunUsageSummary, M as DocumentSurfaceHost, Mn as USER_PROFILE_NO_INVENTION_RULE, Mr as scriptToolName, Mt as RunTraceFilter, N as DocumentSurfacePort, Nn as USER_PROFILE_PROMPT_HEADER, Nr as sealToolCallPairs, Nt as RunTraceMetrics, O as DEFAULT_MAX_DOCUMENT_TEXT_BYTES, On as UNSUPPORTED_DOCUMENT_MESSAGE, Or as resolveToolName, Ot as RunSnapshotStore, P as DocxTextExtractor, Pn as USER_PROFILE_REFINE_PROMPT, Pr as summarizeRunUsage, Pt as RunTraceStore, Q as InstalledSkillManifest, Qn as createWebSkillApi, Qt as SessionListPage, R as ExternalSkillProvider, Rn as UserProfileEntry, Rr as toLlmToolSpec, Rt as RuntimePhase, S as BridgeResponse, Sn as ToolStepStore, Sr as readBehaviorRecords, St as RouteLifecycleData, T as DEFAULT_LOOP_LIMITS, Tn as TraceEvent, Tr as redactToolStepArgs, Tt as RunResult, U as FsRunSnapshotStore, Un as WebSkillApi, Ut as SESSION_SCHEMA_VERSION, V as FsArtifactStore, Vn as UserProfileLimits, Vr as validateUiSpecEvent, Vt as RuntimeSessionHandle, W as FsRunTraceStore, Wn as WebSkillRuntime, Wt as SUPPORTED_DOCUMENT_MIME, X as HookRunner, Xn as buildRenderResult, Xt as SealResult, Y as GoogleGenAiClientConfig, Yn as bridgeError, Yt as SealRecord, Z as HookRunnerOptions, Zn as createScriptContext, Zt as SerializingMemoryStore, _ as BehaviorRecordKind, _n as ToolDisclosure, _r as normalizeToolContent, _t as READ_SKILL_FILE_TOOL_NAME, a as ASK_USER_TOOL, an as SkillRouter, ar as formatSkillScriptManifest, at as LifecycleListener, b as BridgeCapability, bn as ToolStepReader, br as parseUserProfileExport, bt as RedactedArgs, c as AgentLoop, cn as SkillStateGuard, cr as interruptedToolResult, ct as NetworkPolicy, d as AnthropicClient, dn as TerminalLifecycleData, dr as listSkillScripts, dt as PdfTextExtractor, en as SessionRecord, er as exportUserProfile, et as InteractLifecycleData, f as AnthropicClientConfig, fn as TextualToolContent, fr as mergeCatalogEntries, ft as ProgressiveRouter, g as BehaviorRecord, gn as ToolDefinition, gr as normalizeErrorCode, gt as READ_SKILL_FILE_TOOL, h as BEHAVIOR_RECORDS_KEY, hn as ToolContent, hr as networkUrlHost, ht as READ_SKILL_FILE_INPUT_SCHEMA, i as ASK_USER_MAX_FIELDS, in as SkillOutcomeReporter, ir as findUnpairedToolCalls, it as LifecycleHookContext, j as DataSourceInfo, jn as USER_PROFILE_KEY, jr as schemaToForm, jt as RunTraceFile, k as DEFAULT_MAX_UPLOAD_FILE_BYTES, kn as UPLOAD_FILES_UNAVAILABLE, kr as sampleBehaviorRecords, kt as RunTerminationReason, l as AgentLoopConfig, ln as SkillSuccessReport, lr as isNetworkAllowed, lt as OpenAiCompatibleClient, m as ApprovalScope, mn as ToolCallContext, mr as networkPolicyLibSource, mt as READ_LINKED_DOCUMENT_TOOL_NAME, n as ASK_USER_FIELD_TYPES, nn as SkillFailureReport, nr as extractTodoTraceEvents, nt as LifecycleEventInit, o as ASK_USER_TOOL_NAME, on as SkillScriptDescriptor, or as fromVercelResult, ot as LinkedDocumentReader, p as ApprovalDecision, pn as TodoTraceEvent, pr as mergeProfileEntries, pt as READ_LINKED_DOCUMENT_TOOL, q as FullDisclosureRouter, qn as appendBehaviorRecords, qt as ScriptExecutor, r as ASK_USER_INPUT_SCHEMA, rn as SkillIntegrityGuard, rr as extractUiSpecEvents, rt as LifecycleHook, s as ActivateLifecycleData, sn as SkillScriptSchemaSource, sr as fromVercelStreamPart, st as MAX_TOOL_STEP_ARG_BYTES, t as ALLOWED_TOOLS_EXCLUSION_REASON, tn as SessionStore, tr as extractChartSpec, tt as LifecycleEvent, u as AgentLoopDeps, un as TEXT_BUDGETED_CONTENT_TYPES, ur as isUnsupportedRunSnapshot, ut as OpenAiCompatibleClientConfig, v as BehaviorScene, vn as ToolResolution, vr as normalizeToolError, vt as RUN_SNAPSHOT_SCHEMA_VERSION, w as CapabilityMode, wn as TraceClock, wr as readUserProfile, wt as RunLimitErrorDetails, x as BridgeRequest, xn as ToolStepRecord, xr as partsToText, xt as RefineUserProfileInput, y as BridgeCapabilities, yn as ToolResult, yr as parseBridgeRequest, yt as RUN_TRACE_SCHEMA_VERSION, z as ExternalToolSource, zn as UserProfileExport, zr as toRecordDigests, zt as RuntimeRun } from "./index-BDyXe-a5.js";
 //#region src/version.d.ts
 /** Generated by scripts/syncVersionConstant.mjs from packages/sdk/package.json. Do not edit by hand. */
 /**
  * Version of the published `@webskill/sdk` package, injected at build time.
  * @stable
  */
-declare const SDK_VERSION = "0.15.0";
+declare const SDK_VERSION = "0.17.0";
 //#endregion
 export { ALLOWED_TOOLS_EXCLUSION_REASON, ASK_USER_FIELD_TYPES, ASK_USER_INPUT_SCHEMA, ASK_USER_MAX_FIELDS, ASK_USER_TOOL, ASK_USER_TOOL_NAME, ATOMIC_TMP_SUFFIX_PATTERN, ATTACHMENT_TEXT_LIMIT, type ActivateLifecycleData, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type AttachmentTextInput, BEHAVIOR_RECORDS_KEY, type BehaviorRecord, type BehaviorRecordKind, type BehaviorScene, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, type ChatAttachmentKind, type CryptoKeyLike, DEFAULT_ARCHIVE_LIMITS, DEFAULT_LOOP_LIMITS, DEFAULT_MAX_DATA_SOURCE_BYTES, DEFAULT_MAX_DOCUMENT_BYTES, DEFAULT_MAX_DOCUMENT_TEXT_BYTES, DEFAULT_MAX_UPLOAD_FILE_BYTES, DEFAULT_USER_PROFILE_LIMITS, DOCX_MIME, type DataSourceInfo, type DiscoveryResult, type DocumentSurfaceHost, type DocumentSurfacePort, type DocxTextExtractor, EMPTY_USER_PROFILE, EventBus, type ExecuteLifecycleData, type ExternalSkillProvider, type ExternalToolSource, FILE_MIME_TYPES, FS_SESSION_PAGE_SIZE, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FsRunTraceStore, FsSessionStore, FsToolStepStore, FsTrustedKeyStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, IMAGE_MIME_TYPES, type InstalledSkillManifest, type IntegrityVerdict, type InteractLifecycleData, type InteractionOrigin, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleEventInit, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LinkedDocumentReader, type LlmClient, type LlmCompleteInput, type LlmContentPart, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmTokenUsage, type LlmToolCall, type LlmToolSpec, MANIFEST_EXCLUDED_FILES, MAX_TOOL_STEP_ARG_BYTES, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, type Page, type PageQuery, type PdfTextExtractor, ProgressiveRouter, READ_LINKED_DOCUMENT_TOOL, READ_LINKED_DOCUMENT_TOOL_NAME, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, RUN_TRACE_SCHEMA_VERSION, type RedactedArgs, type RefineUserProfileInput, type RemoteUrlPolicy, type RenderBlock, type RenderResultRequest, type RouteLifecycleData, type RouteResult, type RunLimitErrorDetails, type RunResult, type RunSnapshot, type RunSnapshotListEntry, type RunSnapshotStore, type RunTerminationReason, type RunToolCall, type RunTraceFile, type RunTraceFilter, type RunTraceMetrics, type RunTraceStore, type RunTraceSummary, type RunUploadFiles, type RunUsageSummary, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SDK_VERSION, SENSITIVE_ANNOTATION, SESSION_SCHEMA_VERSION, SIGNATURE_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SKILL_SIGNATURE_FILE, SUPPORTED_DOCUMENT_MIME, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, type SealOptions, type SealRecord, type SealResult, SerializingMemoryStore, type SessionListPage, type SessionMeta, type SessionRecord, type SessionStore, type SignatureAuditSink, type SignatureVerdict, type SkillArchiveDetection, type SkillArchiveShape, type SkillCandidateMarker, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillFailureReport, type SkillInstallSource, type SkillIntegrityGuard, type SkillIssue, type SkillLocation, type SkillManagerPort, type SkillManifest, type SkillMetadata, type SkillOutcomeReporter, type SkillPackManifest, SkillReader, type SkillRouter, type SkillScriptDescriptor, type SkillScriptSchemaSource, type SkillSignature, type SkillSource, type SkillStateGuard, type SkillSuccessReport, type SkillsLockfile, TEXT_BUDGETED_CONTENT_TYPES, TEXT_EXTENSIONS, type TerminalLifecycleData, type TextualToolContent, type TodoTraceEvent, type ToolCallContext, type ToolContent, type ToolDefinition, type ToolDisclosure, type ToolResolution, type ToolResult, type ToolStepReader, type ToolStepRecord, type ToolStepStore, type ToolStepTrust, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type TrustedKey, type TrustedKeyStore, UNSUPPORTED_DOCUMENT_MESSAGE, UNTRUSTED_LINE_LIMIT, UPLOAD_FILES_UNAVAILABLE, USER_PROFILE_EXPORT_VERSION, USER_PROFILE_KEY, USER_PROFILE_NO_INVENTION_RULE, USER_PROFILE_PROMPT_HEADER, USER_PROFILE_REFINE_PROMPT, type UiBridge, type UiSpecActionCapability, type UiSpecDrafts, type UiSpecEvent, type UiSpecNode, type UiSpecPatch, type UiSpecSnapshot, type UiSurfaceActionRequest, type UiSurfaceActionResponse, type UnsignedPolicy, type UnsupportedRunSnapshot, type UploadFileInfo, type UserProfile, type UserProfileEntry, type UserProfileExport, type UserProfileImportDiff, type UserProfileLimits, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, XLSX_MIME, type XlsxTextExtractor, appendBehaviorRecords, applyUserProfileImport, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, classifyAttachment, computeDigest, createScriptContext, createWebSkillApi, detectSkillArchiveShape, detectSkillArchiveShapeFromFs, diffUserProfile, escapeXml, exportSkills, exportUserProfile, extractChartSpec, extractSkillCandidate, extractTodoTraceEvents, extractUiSpecEvents, findUnpairedToolCalls, formatAttachmentText, formatSkillScriptManifest, fromVercelResult, fromVercelStreamPart, interruptedToolResult, isAtomicTempPath, isNetworkAllowed, isUnsupportedRunSnapshot, isValidSkillName, jsonRenderer, keyIdOf, listSkillScripts, mergeCatalogEntries, mergeProfileEntries, messageOf, networkPolicyLibSource, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, parseUserProfileExport, partsToText, readBehaviorRecords, readProfileEntries, readResponseWithLimit, readSkillSignature, readUserProfile, redactToolStepArgs, refineUserProfile, renderAvailableSkillsXml, renderCatalogJson, renderUserProfileContext, resolveArchiveLimits, resolveInsideRoot, resolveToolName, sampleBehaviorRecords, sanitizeUntrustedLine, schemaSourceLabel, schemaToForm, scriptToolName, sealToolCallPairs, signSkill, signaturePayloadBytes, stripArchiveRoot, summarizeRunUsage, summarizeToolCalls, textParts, toBase64, toLlmToolSpec, toRecordDigests, toVercelToolSpecs, unzipWithLimits, validateSkills, validateUiSpecEvent, validateUiSpecNode, verifyManifest, verifySkillSignature, xmlRenderer };