@webskill/sdk 0.17.0 → 0.19.0

package/dist/mcp.js

@@ -1107,4 +1107,458 @@ async function connectRemoteEndpoint(registry, config) {
 }
 
 //#endregion
-export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, PAGE_HOST_ANCHOR_KEY, TemporarySkillProvider, WEB_MCP_SOURCE_ID_MAX, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, declareDataSourcesToPageHost, endpointToolLlmName, notifyPageHost, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+//#region ../mcp/src/pageHost/mcpVisibilityStore.ts
+/** WebMCP 在名单里占用的保留端点名 */
+const WEB_MCP_ENDPOINT = "webmcp";
+const toolKey = (endpoint, tool) => `${endpoint}/${tool}`;
+const readList = (storage, key) => {
+	try {
+		const raw = storage?.getItem(key);
+		const parsed = raw ? JSON.parse(raw) : [];
+		return new Set(Array.isArray(parsed) ? parsed.filter((x) => typeof x === "string") : []);
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+};
+const writeList = (storage, key, list) => {
+	try {
+		storage?.setItem(key, JSON.stringify([...list]));
+	} catch {}
+};
+const toggle = (list, key, present) => {
+	if (present) list.add(key);
+	else list.delete(key);
+	return list;
+};
+/**
+* localStorage 默认实现。键形：
+* `<ns>.mcp.endpoints-disabled` / `<ns>.mcp.tools-disabled` /
+* `<ns>.mcp.tools-on-demand` / `<ns>.webmcp-enabled`。
+*
+* 名单里的工具**一律带 endpoint**（`<endpoint>/<tool>`）。旧实现存裸工具名，
+* 两个端点注册同名工具时禁用其一会连坐另一个——那个缺陷在这里一次修完。
+*
+* 一律实时读存储、不做进程内缓存：console 改完当轮生效是既有语义。
+*/
+function createLocalStorageMcpVisibility(namespace) {
+	const endpointsKey = `${namespace}.mcp.endpoints-disabled`;
+	const toolsKey = `${namespace}.mcp.tools-disabled`;
+	const onDemandKey = `${namespace}.mcp.tools-on-demand`;
+	const webMcpKey = `${namespace}.webmcp-enabled`;
+	const storage = () => {
+		try {
+			return globalThis.localStorage;
+		} catch {
+			return;
+		}
+	};
+	return {
+		isEndpointEnabled: (endpoint) => !readList(storage(), endpointsKey).has(endpoint),
+		setEndpointEnabled: (endpoint, enabled) => writeList(storage(), endpointsKey, toggle(readList(storage(), endpointsKey), endpoint, !enabled)),
+		isToolEnabled: (endpoint, tool) => !readList(storage(), toolsKey).has(toolKey(endpoint, tool)),
+		setToolEnabled: (endpoint, tool, enabled) => writeList(storage(), toolsKey, toggle(readList(storage(), toolsKey), toolKey(endpoint, tool), !enabled)),
+		toolDisclosure: (endpoint, tool) => readList(storage(), onDemandKey).has(toolKey(endpoint, tool)) ? "on-demand" : "always",
+		setToolDisclosure: (endpoint, tool, value) => writeList(storage(), onDemandKey, toggle(readList(storage(), onDemandKey), toolKey(endpoint, tool), value === "on-demand")),
+		isWebMcpEnabled: () => {
+			try {
+				return storage()?.getItem(webMcpKey) !== "0";
+			} catch {
+				return true;
+			}
+		},
+		setWebMcpEnabled: (enabled) => {
+			try {
+				storage()?.setItem(webMcpKey, enabled ? "1" : "0");
+			} catch {}
+		}
+	};
+}
+
+//#endregion
+//#region ../mcp/src/pageHost/createPageMcpEndpoint.ts
+const resolve = (value) => value === void 0 ? [] : typeof value === "function" ? value() : value;
+/** 裸返回值 → MCP 响应。structuredContent 只在返回值是非数组对象时给出（规范用 z.record） */
+function toMcpResult(value) {
+	const content = [{
+		type: "text",
+		text: JSON.stringify(value ?? null)
+	}];
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? {
+		content,
+		structuredContent: value
+	} : { content };
+}
+/** zod 为 optional peer：与 serveSkillAsMcp 同款懒加载 */
+async function toZodShape(schema) {
+	const { fromJSONSchema } = await import("zod");
+	return fromJSONSchema(schema);
+}
+const defaultWebMcpApi = () => {
+	const doc = globalThis.document;
+	const nav = globalThis.navigator;
+	return doc?.modelContext ?? nav?.modelContext;
+};
+function createPageMcpEndpoint(options) {
+	const { endpoint } = options;
+	const visibility = options.visibility ?? createLocalStorageMcpVisibility(endpoint);
+	const registry = new EndpointRegistry();
+	const pageSkills = new TemporarySkillProvider({
+		registry,
+		endpoint
+	});
+	const webMcpList = options.webMcp === false ? [] : options.webMcp === void 0 ? [new ExperimentalWebMcpAdapter(defaultWebMcpApi, { enabled: visibility.isWebMcpEnabled() })] : options.webMcp instanceof ExperimentalWebMcpAdapter ? [options.webMcp] : options.webMcp;
+	const webmcp = webMcpList[0];
+	const plugin = new McpRuntimePlugin({
+		registry,
+		webMcp: webMcpList,
+		endpoints: [endpoint],
+		...options.onWarning ? { onWarning: options.onWarning } : {},
+		...options.trust ? { trust: options.trust } : {},
+		visibility: {
+			isEndpointEnabled: (name) => visibility.isEndpointEnabled(name),
+			isEndpointToolEnabled: (name, tool) => visibility.isToolEnabled(name, tool),
+			isWebMcpToolEnabled: (tool) => visibility.isWebMcpEnabled() && visibility.isToolEnabled("webmcp", tool),
+			endpointToolDisclosure: (name, tool) => {
+				const value = visibility.toolDisclosure(name, tool);
+				return value === "always" ? void 0 : value;
+			},
+			webMcpToolDisclosure: (tool) => {
+				const value = visibility.toolDisclosure(WEB_MCP_ENDPOINT, tool);
+				return value === "always" ? void 0 : value;
+			}
+		}
+	});
+	const toolSource = {
+		kind: "mcp",
+		listToolSpecs: () => plugin.listToolSpecs(),
+		canHandle: (name) => plugin.canHandle(name),
+		call: (name, args) => plugin.call(name, args),
+		argCaptureTrust: (name) => plugin.argCaptureTrust(name),
+		listSkills: () => pageSkills.listSkills(),
+		loadSkill: (name) => pageSkills.loadSkill(name),
+		readFile: (name, path) => pageSkills.readFile(name, path),
+		...options.systemPrompt ? { systemPrompt: options.systemPrompt } : {}
+	};
+	let current;
+	let serving;
+	async function serveNow() {
+		const [{ McpServer: McpServerCtor }, { Client: ClientCtor }] = await Promise.all([import("@modelcontextprotocol/sdk/server/mcp.js"), import("@modelcontextprotocol/sdk/client/index.js")]);
+		const server = new McpServerCtor({
+			name: options.serverInfo?.name ?? endpoint,
+			version: options.serverInfo?.version ?? "1.0.0"
+		});
+		for (const tool of resolve(options.tools)) server.registerTool(tool.spec.name, {
+			description: tool.spec.description ?? "",
+			...tool.spec.inputSchema ? { inputSchema: await toZodShape(tool.spec.inputSchema) } : {}
+		}, async (args) => toMcpResult(await tool.run(args ?? {})));
+		for (const skill of resolve(options.skills)) await serveSkillAsMcp(server, skill);
+		const channel = new MessageChannel();
+		await server.connect(new MessageChannelTransport(channel.port2));
+		const client = new ClientCtor({
+			name: options.clientInfo?.name ?? `${endpoint}-host`,
+			version: options.clientInfo?.version ?? "1.0.0"
+		});
+		await client.connect(new MessageChannelTransport(channel.port1));
+		registry.set(endpoint, client);
+		const prev = current;
+		current = {
+			server,
+			client
+		};
+		if (prev) {
+			await prev.client.close().catch(() => void 0);
+			await prev.server.close().catch(() => void 0);
+		}
+	}
+	function serve() {
+		serving = (serving ?? Promise.resolve()).catch(() => void 0).then(() => serveNow());
+		return serving;
+	}
+	return {
+		endpoint,
+		registry,
+		plugin,
+		pageSkills,
+		webmcp,
+		webMcpSources: webMcpList,
+		toolSource,
+		visibility,
+		ready: serve().catch(() => void 0),
+		serve,
+		async close() {
+			const prev = current;
+			current = void 0;
+			registry.unregister(endpoint);
+			if (prev) {
+				await prev.client.close().catch(() => void 0);
+				await prev.server.close().catch(() => void 0);
+			}
+		}
+	};
+}
+
+//#endregion
+//#region ../mcp/src/pageHost/createConnectFacade.ts
+const SCHEMA_SUMMARY_MAX = 120;
+/** localStorage 版远程端点存储（键 `<ns>.mcp.remote-endpoints`） */
+function createLocalStorageRemoteEndpoints(namespace) {
+	const key = `${namespace}.mcp.remote-endpoints`;
+	return {
+		load() {
+			try {
+				const raw = globalThis.localStorage?.getItem(key);
+				const parsed = raw ? JSON.parse(raw) : [];
+				return Array.isArray(parsed) ? parsed : [];
+			} catch {
+				return [];
+			}
+		},
+		save(configs) {
+			try {
+				globalThis.localStorage?.setItem(key, JSON.stringify(configs));
+			} catch {}
+		}
+	};
+}
+function createConnectFacade(options) {
+	const host = options.host;
+	const builtin = host.endpoint;
+	const visibility = host.visibility;
+	const store = options.remoteEndpoints === false ? void 0 : options.remoteEndpoints ?? void 0;
+	let remoteConfigs = store?.load() ?? [];
+	const connections = /* @__PURE__ */ new Map();
+	const unsupported = (what) => {
+		throw new WebSkillError("TOOL_UNSUPPORTED", `${what} is not supported by this host: it does not persist remote MCP endpoints.`);
+	};
+	const persist = () => store?.save(remoteConfigs);
+	/**
+	* 配置对象上的 `disabledTools` 是**镜像**：唯一写入源是 `visibility`。
+	* 两处各写一份的话，「治理在工作」就得靠手工保持同步。
+	*/
+	const mirrorDisabledTools = (config, tools) => {
+		const disabled = tools.filter((tool) => !visibility.isToolEnabled(config.name, tool));
+		if (disabled.length > 0) config.disabledTools = disabled;
+		else delete config.disabledTools;
+	};
+	const listOf = async (endpoint) => {
+		const { tools } = await host.registry.get(endpoint).listTools();
+		return tools;
+	};
+	const toolView = (endpoint, tool) => ({
+		endpoint,
+		name: tool.name,
+		enabled: visibility.isToolEnabled(endpoint, tool.name),
+		disclosure: visibility.toolDisclosure(endpoint, tool.name),
+		...tool.description !== void 0 ? { description: tool.description } : {},
+		...tool.inputSchema !== void 0 ? {
+			schemaSummary: JSON.stringify(tool.inputSchema).slice(0, SCHEMA_SUMMARY_MAX),
+			inputSchema: tool.inputSchema
+		} : {}
+	});
+	async function connectRemote(config) {
+		const prev = connections.get(config.name);
+		if (prev) await prev.close().catch(() => void 0);
+		connections.set(config.name, {
+			close: () => Promise.resolve(),
+			status: "connecting"
+		});
+		try {
+			const handle = await connectRemoteEndpoint(host.registry, {
+				endpoint: config.name,
+				url: config.url,
+				...config.transport ? { transport: config.transport } : {},
+				...config.headers ? { headers: config.headers } : {},
+				allowHttp: config.allowHttp ?? false,
+				allowPrivateHosts: config.allowPrivateHosts ?? false
+			});
+			connections.set(config.name, {
+				close: handle.close,
+				status: "connected"
+			});
+			try {
+				const tools = await listOf(config.name);
+				connections.set(config.name, {
+					close: handle.close,
+					status: "connected",
+					toolCount: tools.length
+				});
+			} catch {}
+		} catch (e) {
+			connections.set(config.name, {
+				close: () => Promise.resolve(),
+				status: "failed",
+				error: messageOf(e)
+			});
+		}
+	}
+	for (const config of remoteConfigs) connectRemote(config);
+	const endpointView = (config) => {
+		const conn = connections.get(config.name);
+		return {
+			config: {
+				...config,
+				enabled: visibility.isEndpointEnabled(config.name)
+			},
+			status: conn?.status ?? "unavailable",
+			...conn?.error !== void 0 ? { error: conn.error } : {},
+			...conn?.toolCount !== void 0 ? { toolCount: conn.toolCount } : {}
+		};
+	};
+	/**
+	* 一个 WebMCP 来源的视图。多来源时逐个建、**不合并**——
+	* 合并后「部分来源可用」这个问题就没法回答了（分册 26 FR-26.5）。
+	*/
+	const webMcpSourceOf = (adapter) => ({
+		...adapter.sourceId !== void 0 ? {
+			id: adapter.sourceId,
+			label: adapter.sourceId
+		} : {},
+		isAvailable: () => adapter.isAvailable(),
+		isEnabled: () => visibility.isWebMcpEnabled() && adapter.isEnabled(),
+		setEnabled: (on) => {
+			adapter.setEnabled(on);
+			visibility.setWebMcpEnabled(on);
+		},
+		listTools: async () => {
+			if (!adapter.isEnabled() || !visibility.isWebMcpEnabled()) return [];
+			return (await adapter.listTools() ?? []).map((tool) => ({
+				endpoint: WEB_MCP_ENDPOINT,
+				name: tool.name,
+				enabled: visibility.isToolEnabled(WEB_MCP_ENDPOINT, tool.name),
+				disclosure: visibility.toolDisclosure(WEB_MCP_ENDPOINT, tool.name),
+				...tool.description !== void 0 ? { description: tool.description } : {},
+				...tool.origin !== void 0 ? { origin: tool.origin } : {},
+				...tool.annotations !== void 0 ? { annotations: tool.annotations } : {}
+			}));
+		},
+		setToolEnabled: (tool, enabled) => visibility.setToolEnabled(WEB_MCP_ENDPOINT, tool, enabled),
+		setToolDisclosure: (tool, disclosure) => visibility.setToolDisclosure(WEB_MCP_ENDPOINT, tool, disclosure)
+	});
+	const sources = host.webMcpSources.map(webMcpSourceOf);
+	/**
+	* 装配期建一次并复用：每次读都新建对象的话，React 侧把它放进 `useMemo`
+	* 依赖表就会每帧重算——引用不稳定在这个仓库里烧出过无限重渲染。
+	*/
+	const webmcp = sources.length > 1 ? {
+		...sources[0],
+		sources
+	} : sources[0] ?? {
+		isAvailable: () => false,
+		isEnabled: () => false,
+		setEnabled: () => void 0,
+		listTools: async () => []
+	};
+	return {
+		async listEndpoints() {
+			const builtinTools = await listOf(builtin).catch(() => []);
+			const builtinConfig = {
+				name: builtin,
+				url: options.builtinEndpointUrl ?? `in-process://${builtin}`,
+				enabled: visibility.isEndpointEnabled(builtin)
+			};
+			mirrorDisabledTools(builtinConfig, builtinTools.map((t) => t.name));
+			return [{
+				config: builtinConfig,
+				status: "connected",
+				toolCount: builtinTools.length
+			}, ...remoteConfigs.map(endpointView)];
+		},
+		async addEndpoint(config) {
+			if (!store) unsupported("Adding an endpoint by hand");
+			if (config.name === builtin || remoteConfigs.some((c) => c.name === config.name)) throw new WebSkillError("VALIDATION_FAILED", `Endpoint "${config.name}" is already configured`);
+			remoteConfigs = [...remoteConfigs, config];
+			persist();
+			await connectRemote(config);
+			const conn = connections.get(config.name);
+			if (conn?.status === "failed") throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", conn.error ?? `Failed to connect endpoint "${config.name}"`);
+		},
+		async removeEndpoint(name) {
+			if (!store) unsupported("Removing an endpoint by hand");
+			if (name === builtin) throw new WebSkillError("VALIDATION_FAILED", `The built-in "${builtin}" endpoint cannot be removed: it is this page itself.`);
+			const conn = connections.get(name);
+			if (conn) {
+				await conn.close().catch(() => void 0);
+				connections.delete(name);
+			}
+			host.registry.unregister(name);
+			remoteConfigs = remoteConfigs.filter((c) => c.name !== name);
+			persist();
+		},
+		async reconnect(name) {
+			if (name === builtin) {
+				await host.serve();
+				return;
+			}
+			const config = remoteConfigs.find((c) => c.name === name);
+			if (!config) throw new WebSkillError("VALIDATION_FAILED", `Endpoint "${name}" is not configured`);
+			await connectRemote(config);
+		},
+		async listTools() {
+			const out = [];
+			for (const tool of await listOf(builtin).catch(() => [])) out.push(toolView(builtin, tool));
+			for (const config of remoteConfigs) {
+				if (connections.get(config.name)?.status !== "connected") continue;
+				for (const tool of await listOf(config.name).catch(() => [])) out.push(toolView(config.name, tool));
+			}
+			return out;
+		},
+		async testEndpoint(name) {
+			const start = Date.now();
+			try {
+				await listOf(name);
+				return {
+					ok: true,
+					latencyMs: Date.now() - start,
+					checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+				};
+			} catch (e) {
+				return {
+					ok: false,
+					latencyMs: Date.now() - start,
+					error: messageOf(e),
+					detail: e instanceof Error ? e.stack ?? e.message : String(e),
+					checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+				};
+			}
+		},
+		async temporarySkills() {
+			if (options.temporarySkills) return options.temporarySkills();
+			return (await host.pageSkills.listSkills().catch(() => [])).map((skill) => ({
+				name: skill.name,
+				...skill.description !== void 0 ? { description: skill.description } : {},
+				source: skill.source ?? builtin,
+				...skill.root !== void 0 ? { origin: skill.root } : {}
+			}));
+		},
+		...options.temporarySkillDetail ? { temporarySkillDetail: async (name, origin) => options.temporarySkillDetail(name, origin) } : {},
+		...options.pagePerception ? { pagePerception: async () => options.pagePerception() } : {},
+		...options.pageActionConsent ? {
+			pageActionConsents: () => options.pageActionConsent.list(),
+			forgetPageActionConsent: (id) => options.pageActionConsent.forget(id),
+			forgetPageActionConsentScope: (scope) => options.pageActionConsent.forgetScope(scope)
+		} : {},
+		async setEndpointEnabled(name, enabled) {
+			visibility.setEndpointEnabled(name, enabled);
+			const config = remoteConfigs.find((c) => c.name === name);
+			if (config) {
+				config.enabled = enabled;
+				persist();
+			}
+		},
+		async setToolEnabled(endpoint, tool, enabled) {
+			visibility.setToolEnabled(endpoint, tool, enabled);
+			const config = remoteConfigs.find((c) => c.name === endpoint);
+			if (config) {
+				mirrorDisabledTools(config, (await listOf(endpoint).catch(() => [])).map((t) => t.name));
+				persist();
+			}
+		},
+		async setToolDisclosure(endpoint, tool, disclosure) {
+			visibility.setToolDisclosure(endpoint, tool, disclosure);
+		},
+		webmcp
+	};
+}
+
+//#endregion
+export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, PAGE_HOST_ANCHOR_KEY, TemporarySkillProvider, WEB_MCP_ENDPOINT, WEB_MCP_SOURCE_ID_MAX, catalogMerge, connectRemoteEndpoint, createConnectFacade, createLocalStorageMcpVisibility, createLocalStorageRemoteEndpoints, createMemoryOAuthStores, createOAuthProvider, createPageMcpEndpoint, declareDataSourcesToPageHost, endpointToolLlmName, notifyPageHost, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/{miniChart-lauNtZu8.js → miniChart-D0nYMzz8.js}

@@ -29,7 +29,8 @@ const DEFAULT_SURFACE_FORM_TEXTS = {
 	readOnlySnapshot: "This is a saved record — its actions are no longer available.",
 	suggested: DEFAULT_INTERACTION_TEXTS.suggested,
 	useSuggestion: DEFAULT_INTERACTION_TEXTS.useSuggestion,
-	openDocument: "Open document"
+	openDocument: "Open document",
+	noOptions: "No options are available for this field."
 };
 function resolveSurfaceFormTexts(texts) {
 	return texts ? {

package/dist/node.js

@@ -2,7 +2,7 @@ import { n as messageOf, t as WebSkillError } from "./errors-BDZNpC13.js";
 import { A as SKILL_MANIFEST_FILE, D as verifySkillSignature, M as buildManifest, O as MANIFEST_EXCLUDED_FILES, P as verifyManifest, b as parseSkillMarkdown, c as unzipWithLimits, f as SKILL_PACK_FILE, k as SKILLS_LOCKFILE, m as parseSkillPackManifest, o as readResponseWithLimit, p as exportSkills, s as resolveArchiveLimits, t as validateSkills, w as readSkillSignature, y as isValidSkillName } from "./skill-CAJMsLod.js";
 import { a as atomicWriteText, o as isAtomicTempPath, r as resolveInsideRoot, t as assertSafePathSegment } from "./pathSecurity-B1owvJAF.js";
 import { t as assertRemoteUrlAllowed } from "./urlSafety-CiSuCJvX.js";
-import { B as createScriptContext, a as networkPolicyLibSource, c as bridgeError, d as FsMemoryStore, f as WebSkillRuntime, l as parseBridgeRequest, r as normalizeToolError, s as UPLOAD_FILES_UNAVAILABLE, t as CapabilityApproval, u as FsArtifactStore } from "./approval-CBPnGPIm.js";
+import { B as createScriptContext, a as networkPolicyLibSource, c as bridgeError, d as FsMemoryStore, f as WebSkillRuntime, l as parseBridgeRequest, r as normalizeToolError, s as UPLOAD_FILES_UNAVAILABLE, t as CapabilityApproval, u as FsArtifactStore } from "./approval-Bbh_Apwg.js";
 import { n as normalizeToolContent } from "./external-_ZRQe-V9.js";
 import { i as probeLlmCapabilities } from "./env-Bj1MI2Ww.js";
 import { t as AUDIT_EVENT_TYPES } from "./eventTypes-CwciaqCU.js";

package/dist/{openUiLibrary-BJtCG5B1.js → openUiLibrary-b0i7F_oZ.js}

@@ -1,4 +1,4 @@
-import { h as uiCatalog } from "./openUiSpecLang-B4QQ9Tfo.js";
+import { g as uiCatalog } from "./openUiSpecLang-CLXJEeRU.js";
 import { t as CatalogNode } from "./ui-react.js";
 import { Renderer, createLibrary, defineComponent } from "./dist-CTsxblSD.js";
 import { z } from "zod";

package/dist/{openUiSpecLang-B4QQ9Tfo.js → openUiSpecLang-CLXJEeRU.js}

@@ -1,4 +1,4 @@
-import { u as interactionToFormModel } from "./miniChart-lauNtZu8.js";
+import { u as interactionToFormModel } from "./miniChart-D0nYMzz8.js";
 import { toJSONSchema, z } from "zod";
 
 //#region ../ui/src/chart/echart.ts
@@ -738,11 +738,17 @@ const fieldCondition = z.lazy(() => z.union([
 	z.object({ allOf: z.array(fieldCondition).min(1) }),
 	z.object({ anyOf: z.array(fieldCondition).min(1) })
 ]));
-/** 选项既可以写死，也可以声明成异步取值（取值通道属分册 24） */
-const fieldOptions = z.array(z.object({
-	label: z.string(),
-	value: z.union([z.string(), z.number()])
-}));
+/** 选项写死在声明里。异步取值（`optionsSource`）四档渲染器都没实现，已从模型可见接口撤下，见 deferred-items D41 */
+const optionScalar = z.union([z.string(), z.number()]);
+/**
+* 对选项形状宽容：裸标量、缺 label、缺 value 都收。
+* 严格 schema 的代价是整个 `options` 被 sanitize 丢掉 —— 用户拿到的是空下拉，
+* 而不是「少了一个选项」。归一化归 `normalizeFieldOptions`。
+*/
+const fieldOptions = z.array(z.union([optionScalar, z.object({
+	label: optionScalar.optional(),
+	value: optionScalar.optional()
+}).refine((option) => option.label !== void 0 || option.value !== void 0, { message: "Option needs at least one of label / value" })]));
 /** Tabs 的面板与 Grid 的格子必须自成容器，否则「每容器至多一个表单」就没有落脚点 */
 const PANEL = ["Card", "Stack"];
 /**
@@ -1028,8 +1034,12 @@ const uiCatalog = defineUiCatalog({
 					z.boolean(),
 					z.null()
 				]))),
-				/** 列宽权重，长度需与 columns 一致；不一致时整项忽略而不拒绝渲染 */
-				columnWidths: z.array(z.number().positive()).optional()
+				/**
+				* 列宽权重。**这里只管形状，不管取值**：长度不符、负数、全零都由
+				* `normalizeColumnWidths` 整项忽略并回退等权重。在 schema 上写 `positive()`
+				* 会让一个越界的权重把整张表打成降级提示——那正是分册 25 要求不能发生的事。
+				*/
+				columnWidths: z.array(z.number()).optional()
 			}),
 			example: {
 				component: "Table",
@@ -1169,12 +1179,10 @@ const uiCatalog = defineUiCatalog({
 				description: z.string().optional(),
 				defaultValue: z.unknown().optional(),
 				options: fieldOptions.optional(),
-				/** 声明后选项由宕主异步提供；与写死的 options 互斥 */
-				optionsSource: z.string().optional(),
 				visibleWhen: fieldCondition.optional()
 			}),
 			constraints: [
-				"select / multi-select must provide options or optionsSource",
+				"select / multi-select must list every choice in options; an empty options array leaves the user with nothing to pick",
 				"password values are never persisted, never echoed and never enter the user profile",
 				"visibleWhen may only reference fields declared in the same Form"
 			],
@@ -1184,7 +1192,13 @@ const uiCatalog = defineUiCatalog({
 					name: "range",
 					label: "Range",
 					type: "select",
-					options: []
+					options: [{
+						label: "Last 7 days",
+						value: "7d"
+					}, {
+						label: "Last 30 days",
+						value: "30d"
+					}]
 				}
 			}
 		},
@@ -1720,6 +1734,45 @@ function resolveColumnWidths(weights, available, minWidth) {
 	return result;
 }
 
+//#endregion
+//#region ../ui/src/catalog/fieldOptions.ts
+const isScalar = (value) => typeof value === "string" || typeof value === "number";
+/**
+* 模型给出的选项形状五花八门：裸标量（`['January', 'February']`）、只有 `label`、
+* 只有 `value`。整项丢掉的代价是下拉变空，必填字段再也交不出去，
+* 所以能补的一律补齐；补不出标签的（既无 label 又无 value）才丢。
+*/
+function normalizeFieldOptions(raw) {
+	if (!Array.isArray(raw)) return [];
+	const options = [];
+	for (const item of raw) {
+		if (isScalar(item)) {
+			options.push({
+				label: String(item),
+				value: item
+			});
+			continue;
+		}
+		if (item === null || typeof item !== "object") continue;
+		const record = item;
+		const label = record["label"];
+		const value = record["value"];
+		if (isScalar(label) && isScalar(value)) options.push({
+			label: String(label),
+			value
+		});
+		else if (isScalar(label)) options.push({
+			label: String(label),
+			value: label
+		});
+		else if (isScalar(value)) options.push({
+			label: String(value),
+			value
+		});
+	}
+	return options;
+}
+
 //#endregion
 //#region ../ui/src/catalog/toJsonRenderSpec.ts
 /**
@@ -1847,4 +1900,4 @@ function toOpenUiSpecLang(spec, catalog = uiCatalog) {
 }
 
 //#endregion
-export { chartSpecFromProps as C, toEchartsOption as E, DEFAULT_CHART_FONT_SIZES as S, resolveChartFontSizes as T, CATALOG_BUDGET_STAGE as _, SPEC_TABLE_MIN_COLUMN_WIDTH as a, PLANNED_INCREMENT as b, MAX_CONDITION_DEPTH as c, collectScopedValues as d, qualifyFieldName as f, defineUiCatalog as g, uiCatalog as h, SPEC_TABLE_MIN_COLUMN_VAR as i, evaluateFieldCondition as l, UI_CATALOG_PROMPT_BUDGET_BYTES as m, interactionToUiSpec as n, normalizeColumnWidths as o, UI_CATALOG_GROUPS as p, toJsonRenderSpec as r, resolveColumnWidths as s, toOpenUiSpecLang as t, collectFormScopes as u, CATALOG_PROMPT_MAX as v, mountEchart as w, gaugePercent as x, CATALOG_SCHEMA_MAX as y };
+export { DEFAULT_CHART_FONT_SIZES as C, toEchartsOption as D, resolveChartFontSizes as E, gaugePercent as S, mountEchart as T, defineUiCatalog as _, SPEC_TABLE_MIN_COLUMN_VAR as a, CATALOG_SCHEMA_MAX as b, resolveColumnWidths as c, collectFormScopes as d, collectScopedValues as f, uiCatalog as g, UI_CATALOG_PROMPT_BUDGET_BYTES as h, normalizeFieldOptions as i, MAX_CONDITION_DEPTH as l, UI_CATALOG_GROUPS as m, interactionToUiSpec as n, SPEC_TABLE_MIN_COLUMN_WIDTH as o, qualifyFieldName as p, toJsonRenderSpec as r, normalizeColumnWidths as s, toOpenUiSpecLang as t, evaluateFieldCondition as u, CATALOG_BUDGET_STAGE as v, chartSpecFromProps as w, PLANNED_INCREMENT as x, CATALOG_PROMPT_MAX as y };

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { t as MockLlmClient } from "./llm-B7lLH0ZI.js";
+import { t as MockLlmClient } from "./llm-eIQNO9tr.js";
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-D6dLeY55.js";
 import { n as loadGoogleConfigFromEnv, r as loadLlmConfigFromEnv, t as loadAnthropicConfigFromEnv } from "./env-Bj1MI2Ww.js";
 

package/dist/{types-BuacBov_.js → types-DOJI5YC3.js}

@@ -58,12 +58,12 @@ function toActionFrameScopes(scope) {
 	}];
 }
 /**
-* 本版的操作集（FR-25.1 / 0.16.0 FR-13.6）。拖拽、滚动仍不在内；
+* 本版的操作集（FR-25.1 / 0.16.0 FR-13.6 / 0.18.0 FR-10.1）。拖拽仍不在内（D64）；
 * 导航只有 `back` 一个，且它**不接受地址**——可达面被浏览器历史封死（SC-1）。
 *
-* `select`/`set`/`attach` 与既有三个走**同一条** policy 路径，
+* `select`/`set`/`attach`/`scroll` 与既有几个走**同一条** policy 路径，
 * 范围白名单、逐次确认、审计三条硬约束因此天然覆盖到它们——
-* 前提是新动作不绕过 policy 直接调执行器（AC-25.4 守这一点）。
+* 前提是新动作不绕过 policy 直调执行器（AC-25.4 守这一点）。
 * @experimental
 */
 const PAGE_ACTION_KINDS = [
@@ -73,6 +73,7 @@ const PAGE_ACTION_KINDS = [
 	"select",
 	"set",
 	"attach",
+	"scroll",
 	"back"
 ];
 /**

package/dist/ui-react.d.ts

@@ -1,6 +1,6 @@
 import { C as UiSpecActionCapability, D as UiSpecSnapshot, O as UiSurfaceActionRequest, Ot as UiSpecNode, S as UiBridge, T as UiSpecEvent, b as RenderResultRequest, c as InteractionResponse, k as UiSurfaceActionResponse, s as InteractionRequest, w as UiSpecDrafts } from "./types-Btpdd1y--BcxQ10Fa.js";
 import { N as DocumentSurfacePort } from "./index-BDyXe-a5.js";
-import { J as SurfaceHostControlTexts, P as InteractionSpecLabels, q as SurfaceFormTexts, v as ChartFontSizes } from "./index-CaLsVI-m.js";
+import { F as InteractionSpecLabels, J as SurfaceFormTexts, Y as SurfaceHostControlTexts, v as ChartFontSizes } from "./index-ad11wflI.js";
 import { z } from "zod";
 import React$1, { ComponentType, ReactNode } from "react";
 import "react/jsx-runtime";