@webskill/sdk 0.2.4 → 0.2.6

package/dist/governance.js

@@ -1,12 +1,11 @@
-import { A as unzipWithLimits, b as isValidSkillName, d as assertSafePathSegment, j as validateSkills, k as resolveInsideRoot, u as WebSkillError } from "./dist-D7MsoMPx.js";
-import { S as WebSkillRuntime } from "./dist-CV64gN62.js";
-import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-Chgf2tcy.js";
+import { C as messageOf, M as unzipWithLimits, N as validateSkills, f as assertSafePathSegment, j as resolveInsideRoot, u as WebSkillError, x as isValidSkillName } from "./dist-BQzncxXg.js";
+import { S as WebSkillRuntime } from "./dist-BXpDDZpR.js";
+import { i as NodeFS, s as ProcessSandboxExecutor, u as exportArchive } from "./dist-DWFDb1Ww.js";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import { mkdtemp } from "node:fs/promises";
-import { createHash } from "node:crypto";
 
-//#region ../governance/dist/index.js
+//#region ../governance/dist/documentSource-C6gq6pbk.js
 const invalid = (message, details) => {
 	throw new WebSkillError("CANDIDATE_INVALID", message, details);
 };
@@ -217,181 +216,12 @@ var LlmCandidateGenerator = class {
 		return candidate;
 	}
 };
-/** 默认策略：任何候选都必须人工审批 */
-var AlwaysHumanApprovalPolicy = class {
-	evaluate(candidate) {
-		return {
-			needsHuman: true,
-			reason: `Candidate "${candidate.name}" requires human approval (risk: ${candidate.risk})`
-		};
-	}
-};
-/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
-var CompositeApprovalPolicy = class {
-	#rules;
-	#fallback;
-	constructor(rules, fallback) {
-		this.#rules = rules;
-		this.#fallback = fallback ?? new AlwaysHumanApprovalPolicy();
-	}
-	evaluate(candidate) {
-		for (const rule of this.#rules) {
-			const decision = rule(candidate);
-			if (decision) return decision;
-		}
-		return this.#fallback.evaluate(candidate);
-	}
-};
-const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
-/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
-var ApprovalWorkflow = class {
-	#policy;
-	#audit;
-	#store;
-	#skillManager;
-	#versions;
-	#fs;
-	constructor(deps) {
-		this.#policy = deps.policy;
-		this.#audit = deps.audit;
-		this.#store = deps.store;
-		this.#skillManager = deps.skillManager;
-		this.#versions = deps.versions;
-		this.#fs = deps.fs ?? new NodeFS();
-	}
-	/** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
-	async review(candidateId, input) {
-		const candidate = await this.#store.get(candidateId);
-		if (candidate.status !== "draft" && candidate.status !== "pending-review") throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidateId}" cannot be reviewed from status "${candidate.status}"`);
-		const decision = this.#policy.evaluate(candidate);
-		let approved;
-		if (decision.needsHuman) {
-			if (!input.uiBridge) {
-				await this.#store.updateStatus(candidateId, "pending-review");
-				throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" requires human approval: ${decision.reason}`);
-			}
-			await this.#store.updateStatus(candidateId, "pending-review");
-			const response = await input.uiBridge.request({
-				type: "confirm",
-				id: `approval-${candidateId}`,
-				message: `Approve candidate "${candidate.name}" (risk: ${candidate.risk})? ${decision.reason}`,
-				defaultValue: false
-			});
-			approved = response.cancelled !== true && response.value === true;
-		} else approved = true;
-		const updated = await this.#store.updateStatus(candidateId, approved ? "approved" : "rejected");
-		await this.#audit.append({
-			type: "candidate.reviewed",
-			target: candidateId,
-			actor: input.actor,
-			data: {
-				approved,
-				reason: decision.reason
-			}
-		});
-		return updated;
-	}
-	/** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
-	async publish(candidateId, input) {
-		const candidate = await this.#store.get(candidateId);
-		if (candidate.status !== "approved") throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" must be approved before publishing (status: ${candidate.status})`);
-		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-candidate-"))).split(path.sep).join("/");
-		try {
-			const skillDir = `${stagingRoot}/${candidate.name}`;
-			for (const file of candidate.files) await this.#fs.writeText(resolveInsideRoot(skillDir, file.path), file.content);
-			const report = await validateSkills(this.#fs, [stagingRoot]);
-			if (!report.ok) {
-				const errors = report.issues.filter((i) => i.severity === "error");
-				throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
-			}
-			const manifest = await this.#skillManager.install({
-				type: "local",
-				path: skillDir
-			});
-			const archiveOut = `${stagingRoot}/version-archive.zip`;
-			await exportArchive(this.#fs, `${this.#skillManager.managedRoot}/${candidate.name}`, {
-				format: "zip",
-				outPath: archiveOut
-			});
-			await this.#versions.add(candidate.name, {
-				reason: `Publish candidate ${candidateId}`,
-				manifest,
-				archive: await this.#fs.readBinary(archiveOut)
-			});
-			await this.#store.updateStatus(candidateId, "published");
-			await this.#audit.append({
-				type: "skill.published",
-				target: candidate.name,
-				actor: input.actor,
-				data: {
-					candidateId,
-					digest: manifest.integrity.digest
-				}
-			});
-			return manifest;
-		} catch (e) {
-			if (e instanceof WebSkillError) throw e;
-			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to publish candidate "${candidateId}": ${messageOf$1(e)}`, e);
-		} finally {
-			try {
-				await this.#fs.remove(stagingRoot, { recursive: true });
-			} catch {}
-		}
-	}
-	/**
-	* 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
-	* 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
-	* RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
-	*/
-	async applyRollback(skillName, versionId, input) {
-		assertSafePathSegment(skillName, "skill name");
-		assertSafePathSegment(versionId, "version id");
-		const version = await this.#versions.get(skillName, versionId);
-		const archive = await this.#versions.readArchive(skillName, versionId);
-		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-rollback-"))).split(path.sep).join("/");
-		try {
-			const skillDir = `${stagingRoot}/${skillName}`;
-			for (const [rel, content] of await unzipWithLimits(archive)) {
-				if (rel.endsWith("/")) continue;
-				await this.#fs.writeBinary(resolveInsideRoot(skillDir, rel), content);
-			}
-			const report = await validateSkills(this.#fs, [stagingRoot]);
-			if (!report.ok) {
-				const errors = report.issues.filter((i) => i.severity === "error");
-				throw new WebSkillError("GOVERNANCE_FAILED", `Rollback archive of "${skillName}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
-			}
-			const manifest = await this.#skillManager.install({
-				type: "local",
-				path: skillDir
-			});
-			if (manifest.integrity.digest !== version.manifest.integrity.digest) throw new WebSkillError("GOVERNANCE_FAILED", `Rollback of "${skillName}" to version "${versionId}" produced a digest mismatch: expected ${version.manifest.integrity.digest}, got ${manifest.integrity.digest}`);
-			await this.#versions.add(skillName, {
-				reason: input.reason ?? `Rollback to version ${versionId}`,
-				manifest,
-				archive
-			});
-			await this.#audit.append({
-				type: "skill.rolled_back",
-				target: skillName,
-				actor: input.actor,
-				data: {
-					targetVersionId: versionId,
-					reason: input.reason
-				}
-			});
-			return manifest;
-		} catch (e) {
-			if (e instanceof WebSkillError) throw e;
-			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to roll back "${skillName}" to version "${versionId}": ${messageOf$1(e)}`, e);
-		} finally {
-			try {
-				await this.#fs.remove(stagingRoot, { recursive: true });
-			} catch {}
-		}
-	}
-};
 const fileOf$1 = (root) => `${root}/.webskill/audit.jsonl`;
-const sha256Hex = (text) => createHash("sha256").update(text, "utf8").digest("hex");
+/** 环境无关 sha256（WebCrypto；Node ≥17 与浏览器均有 globalThis.crypto.subtle） */
+const sha256Hex$1 = async (text) => {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+};
 /** 链字段之外的规范化事件载荷（hash 计算输入） */
 function canonical(event) {
 	return JSON.stringify({
@@ -433,7 +263,7 @@ var FsAuditLog = class {
 		if (lines.length === 0) return "GENESIS";
 		try {
 			const last = JSON.parse(lines.at(-1));
-			return last.hash ?? sha256Hex(canonical(last));
+			return last.hash ?? await sha256Hex$1(canonical(last));
 		} catch (e) {
 			throw new WebSkillError("GOVERNANCE_FAILED", `Audit log tail line at ${path} is corrupted; refusing to append (the chain must not silently restart)`, e);
 		}
@@ -449,7 +279,7 @@ var FsAuditLog = class {
 			...event.data !== void 0 ? { data: event.data } : {},
 			prevHash
 		};
-		full.hash = sha256Hex(canonical(full));
+		full.hash = await sha256Hex$1(canonical(full));
 		await this.#fs.appendText(fileOf$1(this.#root), `${JSON.stringify(full)}\n`);
 		this.#lastHash = full.hash;
 		return full;
@@ -496,7 +326,7 @@ var FsAuditLog = class {
 				brokenAt: i,
 				reason: "prevHash link mismatch (events may have been removed or reordered)"
 			};
-			const expectedHash = sha256Hex(canonical(event));
+			const expectedHash = await sha256Hex$1(canonical(event));
 			if (event.hash !== expectedHash) return {
 				ok: false,
 				brokenAt: i,
@@ -511,19 +341,22 @@ const dirOf = (root, skillName) => {
 	assertSafePathSegment(skillName, "skill name");
 	return `${root}/.webskill/versions/${skillName}`;
 };
-/** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断） */
+/** 版本存储：manifest 快照 + parentVersionId 链；回滚 = 追加新版本（谱系不断）。
+*  保留策略：maxArchivesPerSkill（默认 5）超出时清理最旧版本（json + zip 归档一并删除）。 */
 var SkillVersionStore = class {
 	#root;
 	#fs;
 	#now;
 	#createId;
 	#audit;
+	#maxArchives;
 	constructor(deps) {
 		this.#root = deps.root.replace(/\/+$/, "");
 		this.#fs = deps.fs;
 		this.#now = deps.now;
 		this.#createId = deps.createId;
 		this.#audit = deps.audit;
+		this.#maxArchives = deps.maxArchivesPerSkill ?? 5;
 	}
 	async add(skillName, input) {
 		const existing = await this.list(skillName);
@@ -541,8 +374,19 @@ var SkillVersionStore = class {
 			version.archivePath = archivePath;
 		}
 		await this.#fs.writeText(`${dirOf(this.#root, skillName)}/${version.versionId}.json`, JSON.stringify(version, null, 2));
+		await this.#prune(skillName);
 		return version;
 	}
+	/** 保留策略：超出 maxArchivesPerSkill 时按 createdAt 清理最旧版本（json + zip） */
+	async #prune(skillName) {
+		const versions = await this.list(skillName);
+		const excess = versions.length - this.#maxArchives;
+		if (excess <= 0) return;
+		for (const old of versions.slice(0, excess)) {
+			await this.#fs.remove(`${dirOf(this.#root, skillName)}/${old.versionId}.json`);
+			if (old.archivePath && await this.#fs.exists(old.archivePath)) await this.#fs.remove(old.archivePath);
+		}
+	}
 	/** 读取版本归档字节（applyRollback 用；未捕获归档的旧版本 → GOVERNANCE_FAILED） */
 	async readArchive(skillName, versionId) {
 		const version = await this.get(skillName, versionId);
@@ -804,7 +648,6 @@ var SkillStatePolicy = class {
 		});
 	}
 };
-const messageOf = (e) => e instanceof Error ? e.message : String(e);
 function matchExpected(expected, output, run) {
 	if (expected === void 0) return run.status === "completed";
 	if (typeof expected === "string") return output.includes(expected);
@@ -859,19 +702,6 @@ var EvaluationRunner = class {
 		};
 	}
 };
-/**
-* 治理评估专用 runtime 装配（不可信技能试用路径）：
-* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
-* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
-* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
-* 非安全边界；envWhitelist 同样适用于该执行器）。
-*/
-function createEvaluationRuntime(deps) {
-	return new WebSkillRuntime({
-		...deps,
-		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
-	});
-}
 /** 失败 trace → 回归评估任务建议（prompt 复现 + expected 错误模式） */
 function suggestFromFailedRun(run) {
 	const errorPatterns = run.trace.filter((e) => e.type === "tool.failed" || e.type === "run.failed").map((e) => String(e.data?.["code"] ?? e.message ?? "")).filter(Boolean);
@@ -965,15 +795,208 @@ var DependencyGraph = class DependencyGraph {
 		return out.sort();
 	}
 };
+/** 环境无关 sha256（WebCrypto；Node ≥17 与浏览器均有 globalThis.crypto.subtle） */
+async function sha256Hex(text) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 /** 读文档 + sha256 hash（变更检测用） */
 async function readDocument(fs, path) {
 	const content = await fs.readText(path);
 	return {
 		path,
 		content,
-		hash: createHash("sha256").update(content).digest("hex")
+		hash: await sha256Hex(content)
 	};
 }
+
+//#endregion
+//#region ../governance/dist/index.js
+/** 默认策略：任何候选都必须人工审批 */
+var AlwaysHumanApprovalPolicy = class {
+	evaluate(candidate) {
+		return {
+			needsHuman: true,
+			reason: `Candidate "${candidate.name}" requires human approval (risk: ${candidate.risk})`
+		};
+	}
+};
+/** 规则组合策略：首个命中的规则胜出，全部未命中走 fallback（默认 AlwaysHuman） */
+var CompositeApprovalPolicy = class {
+	#rules;
+	#fallback;
+	constructor(rules, fallback) {
+		this.#rules = rules;
+		this.#fallback = fallback ?? new AlwaysHumanApprovalPolicy();
+	}
+	evaluate(candidate) {
+		for (const rule of this.#rules) {
+			const decision = rule(candidate);
+			if (decision) return decision;
+		}
+		return this.#fallback.evaluate(candidate);
+	}
+};
+/** 审批工作流：review（UiBridge confirm 真实接线）/ publish（校验→安装→版本→审计） */
+var ApprovalWorkflow = class {
+	#policy;
+	#audit;
+	#store;
+	#skillManager;
+	#versions;
+	#fs;
+	constructor(deps) {
+		this.#policy = deps.policy;
+		this.#audit = deps.audit;
+		this.#store = deps.store;
+		this.#skillManager = deps.skillManager;
+		this.#versions = deps.versions;
+		this.#fs = deps.fs ?? new NodeFS();
+	}
+	/** 策略评估；needs-human 时经 UiBridge confirm 真实询问，按应答迁移状态 */
+	async review(candidateId, input) {
+		const candidate = await this.#store.get(candidateId);
+		if (candidate.status !== "draft" && candidate.status !== "pending-review") throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidateId}" cannot be reviewed from status "${candidate.status}"`);
+		const decision = this.#policy.evaluate(candidate);
+		let approved;
+		if (decision.needsHuman) {
+			if (!input.uiBridge) {
+				await this.#store.updateStatus(candidateId, "pending-review");
+				throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" requires human approval: ${decision.reason}`);
+			}
+			await this.#store.updateStatus(candidateId, "pending-review");
+			const response = await input.uiBridge.request({
+				type: "confirm",
+				id: `approval-${candidateId}`,
+				message: `Approve candidate "${candidate.name}" (risk: ${candidate.risk})? ${decision.reason}`,
+				defaultValue: false
+			});
+			approved = response.cancelled !== true && response.value === true;
+		} else approved = true;
+		const updated = await this.#store.updateStatus(candidateId, approved ? "approved" : "rejected");
+		await this.#audit.append({
+			type: "candidate.reviewed",
+			target: candidateId,
+			actor: input.actor,
+			data: {
+				approved,
+				reason: decision.reason
+			}
+		});
+		return updated;
+	}
+	/** publish 全链路：approved 前置 → 写出 staging → validateSkills → install → 版本 → 审计 */
+	async publish(candidateId, input) {
+		const candidate = await this.#store.get(candidateId);
+		if (candidate.status !== "approved") throw new WebSkillError("APPROVAL_REQUIRED", `Candidate "${candidate.name}" must be approved before publishing (status: ${candidate.status})`);
+		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-candidate-"))).split(path.sep).join("/");
+		try {
+			const skillDir = `${stagingRoot}/${candidate.name}`;
+			for (const file of candidate.files) await this.#fs.writeText(resolveInsideRoot(skillDir, file.path), file.content);
+			const report = await validateSkills(this.#fs, [stagingRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("GOVERNANCE_FAILED", `Candidate "${candidate.name}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifest = await this.#skillManager.install({
+				type: "local",
+				path: skillDir
+			});
+			const archiveOut = `${stagingRoot}/version-archive.zip`;
+			await exportArchive(this.#fs, `${this.#skillManager.managedRoot}/${candidate.name}`, {
+				format: "zip",
+				outPath: archiveOut
+			});
+			await this.#versions.add(candidate.name, {
+				reason: `Publish candidate ${candidateId}`,
+				manifest,
+				archive: await this.#fs.readBinary(archiveOut)
+			});
+			await this.#store.updateStatus(candidateId, "published");
+			await this.#audit.append({
+				type: "skill.published",
+				target: candidate.name,
+				actor: input.actor,
+				data: {
+					candidateId,
+					digest: manifest.integrity.digest
+				}
+			});
+			return manifest;
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to publish candidate "${candidateId}": ${messageOf(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
+		}
+	}
+	/**
+	* 真实回滚（受审批保护：仅经显式 actor 调用并全程审计）：
+	* 版本归档解包 → staging 校验 → 原子安装（复用安装管线 swap）→ 追加新版本 + 审计。
+	* RepairPlanner 的 rollback 选项（targetVersionId）经本方法执行。
+	*/
+	async applyRollback(skillName, versionId, input) {
+		assertSafePathSegment(skillName, "skill name");
+		assertSafePathSegment(versionId, "version id");
+		const version = await this.#versions.get(skillName, versionId);
+		const archive = await this.#versions.readArchive(skillName, versionId);
+		const stagingRoot = (await mkdtemp(path.join(tmpdir(), "webskill-rollback-"))).split(path.sep).join("/");
+		try {
+			const skillDir = `${stagingRoot}/${skillName}`;
+			for (const [rel, content] of await unzipWithLimits(archive)) {
+				if (rel.endsWith("/")) continue;
+				await this.#fs.writeBinary(resolveInsideRoot(skillDir, rel), content);
+			}
+			const report = await validateSkills(this.#fs, [stagingRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("GOVERNANCE_FAILED", `Rollback archive of "${skillName}" failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifest = await this.#skillManager.install({
+				type: "local",
+				path: skillDir
+			});
+			if (manifest.integrity.digest !== version.manifest.integrity.digest) throw new WebSkillError("GOVERNANCE_FAILED", `Rollback of "${skillName}" to version "${versionId}" produced a digest mismatch: expected ${version.manifest.integrity.digest}, got ${manifest.integrity.digest}`);
+			await this.#versions.add(skillName, {
+				reason: input.reason ?? `Rollback to version ${versionId}`,
+				manifest,
+				archive
+			});
+			await this.#audit.append({
+				type: "skill.rolled_back",
+				target: skillName,
+				actor: input.actor,
+				data: {
+					targetVersionId: versionId,
+					reason: input.reason
+				}
+			});
+			return manifest;
+		} catch (e) {
+			if (e instanceof WebSkillError) throw e;
+			throw new WebSkillError("GOVERNANCE_FAILED", `Failed to roll back "${skillName}" to version "${versionId}": ${messageOf(e)}`, e);
+		} finally {
+			try {
+				await this.#fs.remove(stagingRoot, { recursive: true });
+			} catch {}
+		}
+	}
+};
+/**
+* 治理评估专用 runtime 装配（不可信技能试用路径）：
+* 默认注入 ProcessSandboxExecutor（fork + --permission 真实进程隔离；子进程
+* env 默认清空防密钥泄露，需透传时经 ProcessSandboxOptions.envWhitelist 显式放行）。
+* 可配置 executor 切回 SandboxedScriptExecutor（worker_threads 能力面收敛形态，
+* 非安全边界；envWhitelist 同样适用于该执行器）。
+*/
+function createEvaluationRuntime(deps) {
+	return new WebSkillRuntime({
+		...deps,
+		executor: deps.executor ?? new ProcessSandboxExecutor(deps.fs)
+	});
+}
 const EXTRACT_PROMPT = (doc, nameHint) => [
 	"Extract an executable skill from the following document as STRICT JSON only.",
 	"Schema: {\"name\": string, \"description\": string, \"risk\": \"low\"|\"medium\"|\"high\",",

package/dist/{index-DZShzhon.d.ts → index-DJOha4b6.d.ts}

@@ -1,4 +1,4 @@
-import { F as SkillDocument, G as ValidationReport, I as SkillInstallSource, J as WebSkillErrorCode, M as SkillCatalog, N as SkillCatalogEntry, P as SkillDiscovery, S as DiscoveryResult, T as JsonSchema, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { B as SkillManifest, F as SkillDiscovery, I as SkillDocument, K as ValidationReport, L as SkillInstallSource, N as SkillCatalog, P as SkillCatalogEntry, S as DiscoveryResult, T as JsonSchema, Y as WebSkillErrorCode, _ as RenderResultRequest, a as InteractionPolicy, c as LlmClient, d as LlmResponse, f as LlmStreamEvent, g as RenderBlock, h as MemoryStore, i as FormField, l as LlmCompleteInput, m as LlmToolSpec, n as ArtifactStore, o as InteractionRequest, r as ChartSpec, t as Artifact, u as LlmMessage, v as UiBridge, w as FileSystemProvider } from "./types-CKm5G_eQ-krKWW8WV.js";
 //#region ../runtime/dist/index.d.ts
 //#region src/llm/openAiCompatibleClient.d.ts
 interface OpenAiCompatibleClientConfig {
@@ -270,6 +270,8 @@ interface AgentLoopConfig {
   renderResult?: 'off';
   /** 工具结果回喂上限（字节，默认 100_000；超长头尾保留 + 完整内容落 artifact） */
   toolResultMaxBytes?: number;
+  /** session paramHistory 保留条数上限（默认 50，超出裁最旧） */
+  paramHistoryLimit?: number;
 }
 /** 技能状态拦截 port（治理装配；无注入默认全放行） */
 interface SkillStateGuard {
@@ -379,6 +381,7 @@ type LifecycleListener = (event: LifecycleEvent) => void;
 /** 生命周期事件总线：只读观测，支持按阶段或通配订阅 */
 declare class EventBus {
   #private;
+  constructor(onListenerError?: (error: unknown, event: LifecycleEvent) => void);
   /** 返回取消订阅函数 */
   on(phase: RuntimePhase | '*', listener: LifecycleListener): () => void;
   /** 当前订阅者数量（流式 delta 零订阅零开销判断用） */
@@ -436,6 +439,8 @@ declare class FsMemoryStore implements MemoryStore {
 declare class SerializingMemoryStore implements MemoryStore {
   #private;
   constructor(inner: MemoryStore);
+  /** 当前链上的 scope 数（监控/测试用；空闲时应回落到 0） */
+  get trackedScopeCount(): number;
   get(scope: string, key: string): Promise<unknown>;
   set(scope: string, key: string, value: unknown): Promise<void>;
   delete(scope: string, key: string): Promise<void>;
@@ -649,6 +654,8 @@ interface RunSnapshot {
   renderBlocks?: RenderBlock[];
   /** 交互 id 序号（resume 后续算，避免 id 冲突；旧快照缺省从 0 起） */
   interactionSeq?: number;
+  /** 已累计的交互等待 ms（resume 后续算，保持 totalTimeout 排除交互等待的语义；旧快照缺省为 0） */
+  pausedMs?: number;
   /** 进入 interrupted 时计算的过期时间 */
   interactionExpiresAt: string;
   config: {
@@ -731,6 +738,12 @@ interface AgentLoopDeps {
 declare class AgentLoop {
   #private;
   constructor(deps: AgentLoopDeps, config?: AgentLoopConfig);
+  /**
+   * 取消进行中的 run：触发该 run 的 AbortController（与 totalTimeout 硬期限同一通道），
+   * run 以 cancelled（RUN_CANCELLED）终止；未找到（已终态或不属于本实例）返回 false。
+   * 取消在下一个中断点生效（LLM complete/stream 调用；交互等待不强制中断）。
+   */
+  cancel(runId: string): boolean;
   run(input: {
     sessionId: string;
     userPrompt: string;
@@ -807,9 +820,12 @@ declare class WebSkillRuntime {
   /**
    * 多会话：session 对象的 run(prompt) 跨 run 延续消息历史（同一 session 对话上下文连续）。
    * 既有 runtime.run(prompt) 保持无状态单次语义不变。
+   * 同 handle 并发 run 经 per-handle 队列串行化（防历史 last-writer-wins 丢轮次）；
+   * maxHistoryMessages（默认 100）超出时滚动裁剪中段（保留首尾；边界对齐 tool 契约）。
    */
   createSession(options?: {
     sessionId?: string;
+    maxHistoryMessages?: number;
   }): RuntimeSessionHandle;
   discover(): Promise<DiscoveryResult>;
   run(userPrompt: string, options?: {
@@ -825,6 +841,12 @@ declare class WebSkillRuntime {
    * @experimental
    */
   resumeRun(runId: string): Promise<RunResult>;
+  /**
+   * 取消进行中的 run（chatbot Stop 按钮等）：触发该 run 的 AbortController，
+   * run 以 cancelled（RUN_CANCELLED）终止；未找到活跃 run 返回 false。
+   * 取消在下一个中断点生效（LLM complete/stream；交互等待不强制中断）。
+   */
+  cancel(runId: string): boolean;
 }
 //#endregion
 export { SerializingMemoryStore as $, LifecycleHook as A, toVercelToolSpecs as At, RUN_SNAPSHOT_SCHEMA_VERSION as B, FullDisclosureRouter as C, normalizeErrorCode as Ct, HookRunnerOptions as D, resolveToolName as Dt, HookRunner as E, parseBridgeRequest as Et, OpenAiCompatibleClientConfig as F, RunTerminationReason as G, RunResult as H, ProgressiveRouter as I, RuntimeSession as J, RuntimePhase as K, READ_SKILL_FILE_INPUT_SCHEMA as L, LifecycleListener as M, NetworkPolicy as N, InstalledSkillManifest as O, schemaToForm as Ot, OpenAiCompatibleClient as P, ScriptExecutor as Q, READ_SKILL_FILE_TOOL as R, FsRunSnapshotStore as S, networkUrlHost as St, GoogleGenAiClientConfig as T, normalizeToolError as Tt, RunSnapshot as U, RouteResult as V, RunSnapshotStore as W, SchemaInferer as X, RuntimeSessionHandle as Y, ScriptExecutionContext as Z, EventBus as _, extractChartSpec as _t, AgentLoopConfig as a, TraceClock as at, FsArtifactStore as b, isNetworkAllowed as bt, AnthropicClientConfig as c, TraceRecorder as ct, BridgeCapabilities as d, WebSkillRuntime as dt, SkillRouter as et, BridgeCapability as f, WebSkillRuntimeDeps as ft, CapabilityMode as g, createWebSkillApi as gt, CapabilityApproval as h, createScriptContext as ht, AgentLoop as i, ToolResult as it, LifecycleHookContext as j, LifecycleEvent as k, toLlmToolSpec as kt, ApprovalDecision as l, VercelToolSpec as lt, BridgeResponse as m, buildRenderResult as mt, ASK_USER_TOOL as n, ToolDefinition as nt, AgentLoopDeps as o, TraceEvent as ot, BridgeRequest as p, bridgeError as pt, RuntimeRun as q, ASK_USER_TOOL_NAME as r, ToolResolution as rt, AnthropicClient as s, TraceEventType as st, ASK_USER_INPUT_SCHEMA as t, SkillStateGuard as tt, ApprovalScope as u, WebSkillApi as ut, ExternalSkillProvider as v, fromVercelResult as vt, GoogleGenAiClient as w, normalizeToolContent as wt, FsMemoryStore as x, mergeCatalogEntries as xt, ExternalToolSource as y, fromVercelStreamPart as yt, READ_SKILL_FILE_TOOL_NAME as z };

package/dist/{index-DrHelz72.d.ts → index-DRlYzdr2.d.ts}

@@ -1,5 +1,5 @@
-import { C as FileStat, I as SkillInstallSource, K as VerifyResult, T as JsonSchema, W as SkillsLockfile, _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-DZShzhon.js";
+import { B as SkillManifest, C as FileStat, G as SkillsLockfile, L as SkillInstallSource, T as JsonSchema, _ as RenderResultRequest, o as InteractionRequest, q as VerifyResult, s as InteractionResponse, v as UiBridge, w as FileSystemProvider, y as ArchiveLimits } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { N as NetworkPolicy, Q as ScriptExecutor, X as SchemaInferer, Z as ScriptExecutionContext, b as FsArtifactStore, d as BridgeCapabilities, it as ToolResult, nt as ToolDefinition, u as ApprovalScope, x as FsMemoryStore } from "./index-DJOha4b6.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts
 //#region src/fs/nodeFs.d.ts
@@ -106,6 +106,8 @@ interface ProcessSandboxOptions {
   uiBridge?: UiBridge;
   /** 授权粒度：默认 'once-per-run' */
   approvalScope?: ApprovalScope;
+  /** 池维护告警出口（recycle 重生失败等；默认 console.warn） */
+  onWarning?: (message: string) => void;
 }
 /**
  * child_process.fork + --permission 进程沙箱（真实进程隔离）。
@@ -120,7 +122,7 @@ declare class ProcessSandboxExecutor implements ScriptExecutor {
   #private;
   constructor(fs: FileSystemProvider, options?: ProcessSandboxOptions);
   get poolSize(): number;
-  /** 池全部子进程销毁（测试收尾/进程退出前调用） */
+  /** 池全部子进程销毁（测试收尾/进程退出前调用）；排队中的 acquire 一律 reject（不悬挂） */
   dispose(): Promise<void>;
   loadDefinition(skillRoot: string, scriptName: string): Promise<ToolDefinition>;
   execute(input: {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as checkDependencyCycles, A as SKILL_NAME_PATTERN, B as SkillMetadata, C as FileStat, D as SKILLS_LOCKFILE, E as MemoryFS, F as SkillDocument, G as ValidationReport, H as SkillReader, I as SkillInstallSource, J as WebSkillErrorCode, K as VerifyResult, L as SkillIssue, M as SkillCatalog, N as SkillCatalogEntry, O as SKILL_MANIFEST_FILE, P as SkillDiscovery, Q as buildManifest, R as SkillLocation, S as DiscoveryResult, T as JsonSchema, U as SkillSource, V as SkillPackManifest, W as SkillsLockfile, X as atomicWriteText, Y as assertSafePathSegment, Z as buildCatalog, _ as RenderResultRequest, _t as xmlRenderer, a as InteractionPolicy, at as jsonRenderer, b as CatalogRenderer, c as LlmClient, ct as parseSkillPackManifest, d as LlmResponse, dt as renderCatalogJson, et as checkSkillRules, f as LlmStreamEvent, ft as resolveArchiveLimits, g as RenderBlock, gt as verifyManifest, h as MemoryStore, ht as validateSkills, i as FormField, it as isValidSkillName, j as SKILL_PACK_FILE, k as SKILL_NAME_MAX_LENGTH, l as LlmCompleteInput, lt as readResponseWithLimit, m as LlmToolSpec, mt as unzipWithLimits, n as ArtifactStore, nt as escapeXml, o as InteractionRequest, ot as normalizePath, p as LlmToolCall, pt as resolveInsideRoot, q as WebSkillError, r as ChartSpec, rt as exportSkills, s as InteractionResponse, st as parseSkillMarkdown, t as Artifact, tt as computeDigest, u as LlmMessage, ut as renderAvailableSkillsXml, v as UiBridge, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { $ as SerializingMemoryStore, A as LifecycleHook, At as toVercelToolSpecs, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeErrorCode, D as HookRunnerOptions, Dt as resolveToolName, E as HookRunner, Et as parseBridgeRequest, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as schemaToForm, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as normalizeToolError, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, kt as toLlmToolSpec, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as normalizeToolContent, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-DZShzhon.js";
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+import { $ as buildCatalog, A as SKILL_NAME_MAX_LENGTH, B as SkillManifest, C as FileStat, D as RemoteUrlPolicy, E as MemoryFS, F as SkillDiscovery, G as SkillsLockfile, H as SkillPackManifest, I as SkillDocument, J as WebSkillError, K as ValidationReport, L as SkillInstallSource, M as SKILL_PACK_FILE, N as SkillCatalog, O as SKILLS_LOCKFILE, P as SkillCatalogEntry, Q as atomicWriteText, R as SkillIssue, S as DiscoveryResult, T as JsonSchema, U as SkillReader, V as SkillMetadata, W as SkillSource, X as assertRemoteUrlAllowed, Y as WebSkillErrorCode, Z as assertSafePathSegment, _ as RenderResultRequest, _t as unzipWithLimits, a as InteractionPolicy, at as exportSkills, b as CatalogRenderer, bt as xmlRenderer, c as LlmClient, ct as messageOf, d as LlmResponse, dt as parseSkillPackManifest, et as buildManifest, f as LlmStreamEvent, ft as readResponseWithLimit, g as RenderBlock, gt as resolveInsideRoot, h as MemoryStore, ht as resolveArchiveLimits, i as FormField, it as escapeXml, j as SKILL_NAME_PATTERN, k as SKILL_MANIFEST_FILE, l as LlmCompleteInput, lt as normalizePath, m as LlmToolSpec, mt as renderCatalogJson, n as ArtifactStore, nt as checkSkillRules, o as InteractionRequest, ot as isValidSkillName, p as LlmToolCall, pt as renderAvailableSkillsXml, q as VerifyResult, r as ChartSpec, rt as computeDigest, s as InteractionResponse, st as jsonRenderer, t as Artifact, tt as checkDependencyCycles, u as LlmMessage, ut as parseSkillMarkdown, v as UiBridge, vt as validateSkills, w as FileSystemProvider, x as DEFAULT_ARCHIVE_LIMITS, y as ArchiveLimits, yt as verifyManifest, z as SkillLocation } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { $ as SerializingMemoryStore, A as LifecycleHook, At as toVercelToolSpecs, B as RUN_SNAPSHOT_SCHEMA_VERSION, C as FullDisclosureRouter, Ct as normalizeErrorCode, D as HookRunnerOptions, Dt as resolveToolName, E as HookRunner, Et as parseBridgeRequest, F as OpenAiCompatibleClientConfig, G as RunTerminationReason, H as RunResult, I as ProgressiveRouter, J as RuntimeSession, K as RuntimePhase, L as READ_SKILL_FILE_INPUT_SCHEMA, M as LifecycleListener, N as NetworkPolicy, O as InstalledSkillManifest, Ot as schemaToForm, P as OpenAiCompatibleClient, Q as ScriptExecutor, R as READ_SKILL_FILE_TOOL, S as FsRunSnapshotStore, St as networkUrlHost, T as GoogleGenAiClientConfig, Tt as normalizeToolError, U as RunSnapshot, V as RouteResult, W as RunSnapshotStore, X as SchemaInferer, Y as RuntimeSessionHandle, Z as ScriptExecutionContext, _ as EventBus, _t as extractChartSpec, a as AgentLoopConfig, at as TraceClock, b as FsArtifactStore, bt as isNetworkAllowed, c as AnthropicClientConfig, ct as TraceRecorder, d as BridgeCapabilities, dt as WebSkillRuntime, et as SkillRouter, f as BridgeCapability, ft as WebSkillRuntimeDeps, g as CapabilityMode, gt as createWebSkillApi, h as CapabilityApproval, ht as createScriptContext, i as AgentLoop, it as ToolResult, j as LifecycleHookContext, k as LifecycleEvent, kt as toLlmToolSpec, l as ApprovalDecision, lt as VercelToolSpec, m as BridgeResponse, mt as buildRenderResult, n as ASK_USER_TOOL, nt as ToolDefinition, o as AgentLoopDeps, ot as TraceEvent, p as BridgeRequest, pt as bridgeError, q as RuntimeRun, r as ASK_USER_TOOL_NAME, rt as ToolResolution, s as AnthropicClient, st as TraceEventType, t as ASK_USER_INPUT_SCHEMA, tt as SkillStateGuard, u as ApprovalScope, ut as WebSkillApi, v as ExternalSkillProvider, vt as fromVercelResult, w as GoogleGenAiClient, wt as normalizeToolContent, x as FsMemoryStore, xt as mergeCatalogEntries, y as ExternalToolSource, yt as fromVercelStreamPart, z as READ_SKILL_FILE_TOOL_NAME } from "./index-DJOha4b6.js";
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, type AgentLoopConfig, type AgentLoopDeps, AnthropicClient, type AnthropicClientConfig, type ApprovalDecision, type ApprovalScope, type ArchiveLimits, type Artifact, type ArtifactStore, type BridgeCapabilities, type BridgeCapability, type BridgeRequest, type BridgeResponse, CapabilityApproval, type CapabilityMode, type CatalogRenderer, type ChartSpec, DEFAULT_ARCHIVE_LIMITS, type DiscoveryResult, EventBus, type ExternalSkillProvider, type ExternalToolSource, type FileStat, type FileSystemProvider, type FormField, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, type GoogleGenAiClientConfig, HookRunner, type HookRunnerOptions, type InstalledSkillManifest, type InteractionPolicy, type InteractionRequest, type InteractionResponse, type JsonSchema, type LifecycleEvent, type LifecycleHook, type LifecycleHookContext, type LifecycleListener, type LlmClient, type LlmCompleteInput, type LlmMessage, type LlmResponse, type LlmStreamEvent, type LlmToolCall, type LlmToolSpec, MemoryFS, type MemoryStore, type NetworkPolicy, OpenAiCompatibleClient, type OpenAiCompatibleClientConfig, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, type RemoteUrlPolicy, type RenderBlock, type RenderResultRequest, type RouteResult, type RunResult, type RunSnapshot, type RunSnapshotStore, type RunTerminationReason, type RuntimePhase, type RuntimeRun, type RuntimeSession, type RuntimeSessionHandle, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, type SchemaInferer, type ScriptExecutionContext, type ScriptExecutor, SerializingMemoryStore, type SkillCatalog, type SkillCatalogEntry, SkillDiscovery, type SkillDocument, type SkillInstallSource, type SkillIssue, type SkillLocation, type SkillManifest, type SkillMetadata, type SkillPackManifest, SkillReader, type SkillRouter, type SkillSource, type SkillStateGuard, type SkillsLockfile, type ToolDefinition, type ToolResolution, type ToolResult, type TraceClock, type TraceEvent, type TraceEventType, TraceRecorder, type UiBridge, type ValidationReport, type VercelToolSpec, type VerifyResult, type WebSkillApi, WebSkillError, type WebSkillErrorCode, WebSkillRuntime, type WebSkillRuntimeDeps, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, messageOf, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };