@webskill/sdk 0.2.4 → 0.2.6

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as unzipWithLimits, C as parseSkillMarkdown, D as renderCatalogJson, E as renderAvailableSkillsXml, M as verifyManifest, N as xmlRenderer, O as resolveArchiveLimits, S as normalizePath, T as readResponseWithLimit, _ as computeDigest, a as SKILL_NAME_MAX_LENGTH, b as isValidSkillName, c as SkillDiscovery, d as assertSafePathSegment, f as atomicWriteText, g as checkSkillRules, h as checkDependencyCycles, i as SKILL_MANIFEST_FILE, j as validateSkills, k as resolveInsideRoot, l as SkillReader, m as buildManifest, n as MemoryFS, o as SKILL_NAME_PATTERN, p as buildCatalog, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as escapeXml, w as parseSkillPackManifest, x as jsonRenderer, y as exportSkills } from "./dist-D7MsoMPx.js";
-import { A as isNetworkAllowed, B as toVercelToolSpecs, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, L as resolveToolName, M as networkUrlHost, N as normalizeErrorCode, O as fromVercelResult, P as normalizeToolContent, R as schemaToForm, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION, z as toLlmToolSpec } from "./dist-CV64gN62.js";
+import { A as resolveArchiveLimits, C as messageOf, D as readResponseWithLimit, E as parseSkillPackManifest, F as xmlRenderer, M as unzipWithLimits, N as validateSkills, O as renderAvailableSkillsXml, P as verifyManifest, S as jsonRenderer, T as parseSkillMarkdown, _ as checkSkillRules, a as SKILL_NAME_MAX_LENGTH, b as exportSkills, c as SkillDiscovery, d as assertRemoteUrlAllowed, f as assertSafePathSegment, g as checkDependencyCycles, h as buildManifest, i as SKILL_MANIFEST_FILE, j as resolveInsideRoot, k as renderCatalogJson, l as SkillReader, m as buildCatalog, n as MemoryFS, o as SKILL_NAME_PATTERN, p as atomicWriteText, r as SKILLS_LOCKFILE, s as SKILL_PACK_FILE, t as DEFAULT_ARCHIVE_LIMITS, u as WebSkillError, v as computeDigest, w as normalizePath, x as isValidSkillName, y as escapeXml } from "./dist-BQzncxXg.js";
+import { A as isNetworkAllowed, B as toVercelToolSpecs, C as bridgeError, D as extractChartSpec, E as createWebSkillApi, F as normalizeToolError, I as parseBridgeRequest, L as resolveToolName, M as networkUrlHost, N as normalizeErrorCode, O as fromVercelResult, P as normalizeToolContent, R as schemaToForm, S as WebSkillRuntime, T as createScriptContext, _ as READ_SKILL_FILE_TOOL, a as AnthropicClient, b as SerializingMemoryStore, c as FsArtifactStore, d as FullDisclosureRouter, f as GoogleGenAiClient, g as READ_SKILL_FILE_INPUT_SCHEMA, h as ProgressiveRouter, i as AgentLoop, j as mergeCatalogEntries, k as fromVercelStreamPart, l as FsMemoryStore, m as OpenAiCompatibleClient, n as ASK_USER_TOOL, o as CapabilityApproval, p as HookRunner, r as ASK_USER_TOOL_NAME, s as EventBus, t as ASK_USER_INPUT_SCHEMA, u as FsRunSnapshotStore, v as READ_SKILL_FILE_TOOL_NAME, w as buildRenderResult, x as TraceRecorder, y as RUN_SNAPSHOT_SCHEMA_VERSION, z as toLlmToolSpec } from "./dist-BXpDDZpR.js";
 
-export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };
+export { ASK_USER_INPUT_SCHEMA, ASK_USER_TOOL, ASK_USER_TOOL_NAME, AgentLoop, AnthropicClient, CapabilityApproval, DEFAULT_ARCHIVE_LIMITS, EventBus, FsArtifactStore, FsMemoryStore, FsRunSnapshotStore, FullDisclosureRouter, GoogleGenAiClient, HookRunner, MemoryFS, OpenAiCompatibleClient, ProgressiveRouter, READ_SKILL_FILE_INPUT_SCHEMA, READ_SKILL_FILE_TOOL, READ_SKILL_FILE_TOOL_NAME, RUN_SNAPSHOT_SCHEMA_VERSION, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SKILL_NAME_MAX_LENGTH, SKILL_NAME_PATTERN, SKILL_PACK_FILE, SerializingMemoryStore, SkillDiscovery, SkillReader, TraceRecorder, WebSkillError, WebSkillRuntime, assertRemoteUrlAllowed, assertSafePathSegment, atomicWriteText, bridgeError, buildCatalog, buildManifest, buildRenderResult, checkDependencyCycles, checkSkillRules, computeDigest, createScriptContext, createWebSkillApi, escapeXml, exportSkills, extractChartSpec, fromVercelResult, fromVercelStreamPart, isNetworkAllowed, isValidSkillName, jsonRenderer, mergeCatalogEntries, messageOf, networkUrlHost, normalizeErrorCode, normalizePath, normalizeToolContent, normalizeToolError, parseBridgeRequest, parseSkillMarkdown, parseSkillPackManifest, readResponseWithLimit, renderAvailableSkillsXml, renderCatalogJson, resolveArchiveLimits, resolveInsideRoot, resolveToolName, schemaToForm, toLlmToolSpec, toVercelToolSpecs, unzipWithLimits, validateSkills, verifyManifest, xmlRenderer };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
-import { F as SkillDocument, N as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-DZShzhon.js";
+import { I as SkillDocument, P as SkillCatalogEntry, T as JsonSchema, m as LlmToolSpec } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { it as ToolResult, v as ExternalSkillProvider, xt as mergeCatalogEntries, y as ExternalToolSource } from "./index-DJOha4b6.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -252,6 +252,10 @@ interface RemoteEndpointConfig {
   headers?: Record<string, string>;
   /** 连接超时；0/缺省 = 不超时 */
   timeoutMs?: number;
+  /** 显式允许 http://（SSRF 防护默认仅 https） */
+  allowHttp?: boolean;
+  /** 显式允许私有/环回/链路本地地址（SSRF 防护默认拒绝） */
+  allowPrivateHosts?: boolean;
 }
 /**
  * 远程 MCP endpoint 装配：SDK 官方 StreamableHTTPClientTransport（默认）/

package/dist/mcp.js

@@ -1,5 +1,5 @@
-import { u as WebSkillError } from "./dist-D7MsoMPx.js";
-import { P as normalizeToolContent, j as mergeCatalogEntries } from "./dist-CV64gN62.js";
+import { C as messageOf, d as assertRemoteUrlAllowed, u as WebSkillError } from "./dist-BQzncxXg.js";
+import { P as normalizeToolContent, j as mergeCatalogEntries } from "./dist-BXpDDZpR.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -172,7 +172,6 @@ var EndpointRegistry = class {
 		for (const resolve of queue) resolve(client);
 	}
 };
-const messageOf$3 = (e) => e instanceof Error ? e.message : String(e);
 /** MCP 结果单项 text 上限（64KB） */
 const MAX_MCP_RESULT_TEXT_BYTES = 64 * 1024;
 const failure$1 = (code, message) => ({
@@ -199,20 +198,20 @@ var McpToolResolver = class {
 		try {
 			client = this.#registry.get(endpoint);
 		} catch (e) {
-			return failure$1("MCP_ENDPOINT_UNAVAILABLE", messageOf$3(e));
+			return failure$1("MCP_ENDPOINT_UNAVAILABLE", messageOf(e));
 		}
 		let names;
 		try {
 			names = await this.#toolNames(endpoint, client);
 		} catch (e) {
-			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Failed to list tools: ${messageOf$3(e)}`);
+			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Failed to list tools: ${messageOf(e)}`);
 		}
 		if (!names.has(toolName)) {
 			this.#cache.delete(endpoint);
 			try {
 				names = await this.#toolNames(endpoint, client);
 			} catch (e) {
-				return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Failed to list tools: ${messageOf$3(e)}`);
+				return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Failed to list tools: ${messageOf(e)}`);
 			}
 			if (!names.has(toolName)) return failure$1("MCP_TOOL_NOT_FOUND", `Tool "${toolName}" not found on endpoint "${endpoint}"`);
 		}
@@ -223,7 +222,7 @@ var McpToolResolver = class {
 			});
 			return this.#normalizeCallResult(raw);
 		} catch (e) {
-			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Tool "${toolName}" on endpoint "${endpoint}" failed: ${messageOf$3(e)}`);
+			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Tool "${toolName}" on endpoint "${endpoint}" failed: ${messageOf(e)}`);
 		}
 	}
 	async #toolNames(endpoint, client) {
@@ -241,7 +240,7 @@ var McpToolResolver = class {
 	/** CallToolResult → ToolResult；isError 转失败；形状消毒（无 content 且无 isError 不当作 ok）+ 大小上限 */
 	#normalizeCallResult(raw) {
 		const result = raw;
-		if (result?.isError !== true && result?.content === void 0) return failure$1("MCP_ENDPOINT_UNAVAILABLE", `MCP tool returned a malformed result (no "content" and no "isError"): ${messageOf$3(raw).slice(0, 200)}`);
+		if (result?.isError !== true && result?.content === void 0) return failure$1("MCP_ENDPOINT_UNAVAILABLE", `MCP tool returned a malformed result (no "content" and no "isError"): ${messageOf(raw).slice(0, 200)}`);
 		const content = normalizeToolContent(result?.content ?? raw);
 		if (result?.isError === true) {
 			const text = content.map((c) => c.text ?? "").filter(Boolean).join("\n");
@@ -272,7 +271,6 @@ function webMcpToolLlmName(toolName) {
 function parseWebMcpToolLlmName(llmName) {
 	return llmName.startsWith("mcp__") && llmName.length > 5 ? llmName.slice(5) : void 0;
 }
-const messageOf$2 = (e) => e instanceof Error ? e.message : String(e);
 const textOfContent = (content) => {
 	if (typeof content === "string") return content;
 	if (typeof content === "object" && content !== null) {
@@ -318,7 +316,7 @@ var TemporarySkillProvider = class {
 		try {
 			result = await client.getPrompt({ name });
 		} catch (e) {
-			throw new WebSkillError("SKILL_NOT_FOUND", `Prompt "${name}" not found on endpoint "${this.#endpoint}": ${messageOf$2(e)}`, e);
+			throw new WebSkillError("SKILL_NOT_FOUND", `Prompt "${name}" not found on endpoint "${this.#endpoint}": ${messageOf(e)}`, e);
 		}
 		const body = (result.messages ?? []).map((m) => textOfContent(m.content)).filter(Boolean).join("\n\n");
 		return {
@@ -343,7 +341,7 @@ var TemporarySkillProvider = class {
 		try {
 			return this.#registry.get(this.#endpoint);
 		} catch (e) {
-			throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", messageOf$2(e), e);
+			throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", messageOf(e), e);
 		}
 	}
 };
@@ -386,7 +384,6 @@ async function serveSkillAsMcp(server, skill) {
 * 实现单一来源在 runtime（runtime 自身合并也用同一函数）。
 */
 const catalogMerge = mergeCatalogEntries;
-const messageOf$1 = (e) => e instanceof Error ? e.message : String(e);
 const failure = (code, message) => ({
 	ok: false,
 	content: [],
@@ -449,7 +446,7 @@ var ExperimentalWebMcpAdapter = class {
 				content: normalizeToolContent(await api.executeTool(toolName, JSON.stringify(args)))
 			};
 		} catch (e) {
-			return failure("TOOL_EXECUTION_FAILED", `WebMCP tool "${toolName}" failed: ${messageOf$1(e)}`);
+			return failure("TOOL_EXECUTION_FAILED", `WebMCP tool "${toolName}" failed: ${messageOf(e)}`);
 		}
 	}
 };
@@ -545,7 +542,6 @@ async function loadMcpSdk() {
 		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", "The \"@modelcontextprotocol/sdk\" package is required for remote MCP endpoints; install it first (npm i @modelcontextprotocol/sdk)", e);
 	}
 }
-const messageOf = (e) => e instanceof Error ? e.message : String(e);
 /**
 * 远程 MCP endpoint 装配：SDK 官方 StreamableHTTPClientTransport（默认）/
 * SSEClientTransport（遗留）连接远端 server，注册进 EndpointRegistry——
@@ -560,6 +556,10 @@ async function connectRemoteEndpoint(registry, config) {
 	} catch (e) {
 		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Invalid remote MCP endpoint URL for "${config.endpoint}": ${JSON.stringify(config.url)}`, e);
 	}
+	assertRemoteUrlAllowed(url.href, {
+		allowHttp: config.allowHttp ?? false,
+		allowPrivateHosts: config.allowPrivateHosts ?? false
+	});
 	const requestInit = config.headers ? { headers: config.headers } : void 0;
 	const transport = config.transport === "sse" ? new SSEClientTransport(url, { ...requestInit ? { requestInit } : {} }) : new StreamableHTTPClientTransport(url, { ...requestInit ? { requestInit } : {} });
 	const client = new Client({

package/dist/node.d.ts

@@ -1,5 +1,5 @@
-import { D as SKILLS_LOCKFILE, I as SkillInstallSource, K as VerifyResult, O as SKILL_MANIFEST_FILE, W as SkillsLockfile, z as SkillManifest } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { ht as createScriptContext } from "./index-DZShzhon.js";
+import { B as SkillManifest, G as SkillsLockfile, L as SkillInstallSource, O as SKILLS_LOCKFILE, k as SKILL_MANIFEST_FILE, q as VerifyResult } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { ht as createScriptContext } from "./index-DJOha4b6.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-BPUBZCwJ-4jat_SVG.js";
-import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-DrHelz72.js";
+import { a as NodeScriptExecutor, c as ProcessSandboxOptions, d as SkillManager, f as exportArchive, i as NodeFS, l as SandboxOptions, n as FileArtifactStore, o as OxcSchemaInferer, p as readArchiveManifest, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as SandboxedScriptExecutor } from "./index-DRlYzdr2.js";
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, type LlmCapabilities, type LlmEnvConfig, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, type ProcessSandboxOptions, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, type SandboxOptions, SandboxedScriptExecutor, type SkillInstallSource, SkillManager, type SkillManifest, type SkillsLockfile, type VerifyResult, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/node.js

@@ -1,6 +1,6 @@
-import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-D7MsoMPx.js";
-import { T as createScriptContext } from "./dist-CV64gN62.js";
+import { i as SKILL_MANIFEST_FILE, r as SKILLS_LOCKFILE } from "./dist-BQzncxXg.js";
+import { T as createScriptContext } from "./dist-BXpDDZpR.js";
 import { i as probeLlmCapabilities } from "./env--jJB-TSX-04klhTYi.js";
-import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-Chgf2tcy.js";
+import { a as NodeScriptExecutor, c as SandboxedScriptExecutor, d as readArchiveManifest, i as NodeFS, l as SkillManager, n as FileArtifactStore, o as OxcSchemaInferer, r as FileMemoryStore, s as ProcessSandboxExecutor, t as CliUiBridge, u as exportArchive } from "./dist-DWFDb1Ww.js";
 
 export { CliUiBridge, FileArtifactStore, FileMemoryStore, NodeFS, NodeScriptExecutor, OxcSchemaInferer, ProcessSandboxExecutor, SKILLS_LOCKFILE, SKILL_MANIFEST_FILE, SandboxedScriptExecutor, SkillManager, createScriptContext, exportArchive, probeLlmCapabilities, readArchiveManifest };

package/dist/{testing-BN18eqbD.js → testing-BUoXvm1u.js}

@@ -1,4 +1,4 @@
-import { u as WebSkillError } from "./dist-D7MsoMPx.js";
+import { u as WebSkillError } from "./dist-BQzncxXg.js";
 
 //#region ../runtime/dist/testing.js
 /**

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { c as LlmClient, d as LlmResponse, f as LlmStreamEvent, h as MemoryStore, l as LlmCompleteInput, n as ArtifactStore, o as InteractionRequest, s as InteractionResponse, t as Artifact, v as UiBridge } from "./types-CKm5G_eQ-krKWW8WV.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-BPUBZCwJ-4jat_SVG.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { t as MemoryArtifactStore } from "./memoryArtifactStore-C9lFVqPF-yFz6yJj0.js";
 import { n as loadGoogleConfigFromEnv, r as loadLlmConfigFromEnv, t as loadAnthropicConfigFromEnv } from "./env--jJB-TSX-04klhTYi.js";
-import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-BN18eqbD.js";
+import { n as MockLlmClient, r as MockUiBridge, t as InMemoryStore } from "./testing-BUoXvm1u.js";
 
 export { InMemoryStore, MemoryArtifactStore, MockLlmClient, MockUiBridge, loadAnthropicConfigFromEnv, loadGoogleConfigFromEnv, loadLlmConfigFromEnv };

package/dist/{types-CKm5G_eQ-BqyXnvoR.d.ts → types-CKm5G_eQ-krKWW8WV.d.ts}

@@ -10,6 +10,8 @@ declare class WebSkillError extends Error {
   readonly details?: unknown;
   constructor(code: WebSkillErrorCode, message: string, details?: unknown);
 }
+/** unknown 异常取消息文本（全仓单一来源，勿再本地重复定义） */
+declare function messageOf(e: unknown): string;
 //#endregion
 //#region src/contracts/jsonSchema.d.ts
 /**
@@ -34,6 +36,10 @@ type SkillInstallSource = {
 } | {
   type: 'http';
   url: string;
+  /** 显式允许 http://（SSRF 防护默认仅 https） */
+  allowHttp?: boolean;
+  /** 显式允许私有/环回/链路本地地址（SSRF 防护默认拒绝） */
+  allowPrivateHosts?: boolean;
 } | {
   type: 'archive';
   data: ArrayBuffer;
@@ -160,7 +166,12 @@ declare class MemoryFS implements FileSystemProvider {
 }
 //#endregion
 //#region src/fs/atomicWrite.d.ts
-/** 原子写文本：先写临时文件再 rename（进程崩溃不留下半写文件；lockfile 等账本场景） */
+/**
+ * 原子写文本：先写临时文件再 rename（进程崩溃不留下半写文件；lockfile 等账本场景）。
+ * 原子性强弱取决于 provider 的 rename 实现：NodeFS/MemoryFS 为真 rename；
+ * OPFS 无原生 move，rename 是 copy+delete（非原子，崩溃可能残留双份），
+ * 对崩溃一致性要求极高的场景在浏览器侧需知悉此前提。
+ */
 declare function atomicWriteText(fs: FileSystemProvider, path: string, content: string): Promise<void>;
 //#endregion
 //#region src/fs/pathSecurity.d.ts
@@ -177,6 +188,25 @@ declare function assertSafePathSegment(segment: string, kind: string): void;
  */
 declare function resolveInsideRoot(root: string, relativePath: string): string;
 //#endregion
+//#region src/net/urlSafety.d.ts
+/**
+ * SSRF 防护（单一来源：node http 安装源与 mcp 远程 endpoint 共用）：
+ * - 协议限 https（http 需显式 opt-in）
+ * - 默认拒私有/环回/链路本地地址字面量（127.0.0.0/8、RFC1918、169.254.0.0/16、localhost、::1、fe80::/10）
+ * 注意：仅校验 URL 字面量主机名；DNS 解析到私有地址的 rebinding 场景不在此层覆盖。
+ */
+interface RemoteUrlPolicy {
+  /** 显式允许 http://（默认仅 https） */
+  allowHttp?: boolean;
+  /** 显式允许私有/环回/链路本地地址（默认拒绝） */
+  allowPrivateHosts?: boolean;
+}
+/**
+ * 校验远程 URL 是否允许连接；违规抛 NETWORK_BLOCKED。
+ * rawUrl 非合法 URL 时抛 TypeError（由调用方按自身错误码包装）。
+ */
+declare function assertRemoteUrlAllowed(rawUrl: string, policy?: RemoteUrlPolicy): URL;
+//#endregion
 //#region src/skill/types.d.ts
 type SkillSource = 'local' | 'mcp' | 'generated' | 'installed';
 /**
@@ -586,4 +616,4 @@ interface MemoryStore {
   transaction?<T>(scope: string, fn: (inner: MemoryStore) => Promise<T>): Promise<T>;
 }
 //#endregion
-export { checkDependencyCycles as $, SKILL_NAME_PATTERN as A, SkillMetadata as B, FileStat as C, SKILLS_LOCKFILE as D, MemoryFS as E, SkillDocument as F, ValidationReport as G, SkillReader as H, SkillInstallSource as I, WebSkillErrorCode as J, VerifyResult as K, SkillIssue as L, SkillCatalog as M, SkillCatalogEntry as N, SKILL_MANIFEST_FILE as O, SkillDiscovery as P, buildManifest as Q, SkillLocation as R, DiscoveryResult as S, JsonSchema as T, SkillSource as U, SkillPackManifest as V, SkillsLockfile as W, atomicWriteText as X, assertSafePathSegment as Y, buildCatalog as Z, RenderResultRequest as _, xmlRenderer as _t, InteractionPolicy as a, jsonRenderer as at, CatalogRenderer as b, LlmClient as c, parseSkillPackManifest as ct, LlmResponse as d, renderCatalogJson as dt, checkSkillRules as et, LlmStreamEvent as f, resolveArchiveLimits as ft, RenderBlock as g, verifyManifest as gt, MemoryStore as h, validateSkills as ht, FormField as i, isValidSkillName as it, SKILL_PACK_FILE as j, SKILL_NAME_MAX_LENGTH as k, LlmCompleteInput as l, readResponseWithLimit as lt, LlmToolSpec as m, unzipWithLimits as mt, ArtifactStore as n, escapeXml as nt, InteractionRequest as o, normalizePath as ot, LlmToolCall as p, resolveInsideRoot as pt, WebSkillError as q, ChartSpec as r, exportSkills as rt, InteractionResponse as s, parseSkillMarkdown as st, Artifact as t, computeDigest as tt, LlmMessage as u, renderAvailableSkillsXml as ut, UiBridge as v, FileSystemProvider as w, DEFAULT_ARCHIVE_LIMITS as x, ArchiveLimits as y, SkillManifest as z };
+export { buildCatalog as $, SKILL_NAME_MAX_LENGTH as A, SkillManifest as B, FileStat as C, RemoteUrlPolicy as D, MemoryFS as E, SkillDiscovery as F, SkillsLockfile as G, SkillPackManifest as H, SkillDocument as I, WebSkillError as J, ValidationReport as K, SkillInstallSource as L, SKILL_PACK_FILE as M, SkillCatalog as N, SKILLS_LOCKFILE as O, SkillCatalogEntry as P, atomicWriteText as Q, SkillIssue as R, DiscoveryResult as S, JsonSchema as T, SkillReader as U, SkillMetadata as V, SkillSource as W, assertRemoteUrlAllowed as X, WebSkillErrorCode as Y, assertSafePathSegment as Z, RenderResultRequest as _, unzipWithLimits as _t, InteractionPolicy as a, exportSkills as at, CatalogRenderer as b, xmlRenderer as bt, LlmClient as c, messageOf as ct, LlmResponse as d, parseSkillPackManifest as dt, buildManifest as et, LlmStreamEvent as f, readResponseWithLimit as ft, RenderBlock as g, resolveInsideRoot as gt, MemoryStore as h, resolveArchiveLimits as ht, FormField as i, escapeXml as it, SKILL_NAME_PATTERN as j, SKILL_MANIFEST_FILE as k, LlmCompleteInput as l, normalizePath as lt, LlmToolSpec as m, renderCatalogJson as mt, ArtifactStore as n, checkSkillRules as nt, InteractionRequest as o, isValidSkillName as ot, LlmToolCall as p, renderAvailableSkillsXml as pt, VerifyResult as q, ChartSpec as r, computeDigest as rt, InteractionResponse as s, jsonRenderer as st, Artifact as t, checkDependencyCycles as tt, LlmMessage as u, parseSkillMarkdown as ut, UiBridge as v, validateSkills as vt, FileSystemProvider as w, DEFAULT_ARCHIVE_LIMITS as x, ArchiveLimits as y, verifyManifest as yt, SkillLocation as z };

package/dist/ui-react.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-krKWW8WV.js";
 //#region ../ui-react/dist/index.d.ts
 //#region src/bridgeState.d.ts
 /**
@@ -17,6 +17,8 @@ declare class ReactBridgeState implements UiBridge {
   request(input: InteractionRequest): Promise<InteractionResponse>;
   /** 组件提交/取消回调 */
   resolve(response: InteractionResponse): void;
+  /** runtime 交互超时/取消：卸载表单并以 cancelled resolve pending Promise（防悬挂 + 残留） */
+  cancel(id: string): void;
   renderResult(input: RenderResultRequest): Promise<void>;
   onTextDelta(runId: string, delta: string): Promise<void>;
 }

package/dist/ui-react.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
+import { C as renderMiniChart, E as shapeInteractionValue, h as collectValues, w as renderMiniMarkdown, x as interactionToFormModel } from "./dist-DNSG9FqC.js";
 import { useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 
@@ -39,6 +39,13 @@ var ReactBridgeState = class {
 		this.#emit();
 		resolver(response);
 	}
+	/** runtime 交互超时/取消：卸载表单并以 cancelled resolve pending Promise（防悬挂 + 残留） */
+	cancel(id) {
+		this.resolve({
+			id,
+			cancelled: true
+		});
+	}
 	async renderResult(input) {
 		this.latestResult = input;
 		this.#emit();

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
+import { _ as RenderResultRequest, o as InteractionRequest, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-krKWW8WV.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts
@@ -18,6 +18,8 @@ declare class VueBridgeState implements UiBridge {
   request(input: InteractionRequest): Promise<InteractionResponse>;
   /** 组件提交/取消回调 */
   resolve(response: InteractionResponse): void;
+  /** runtime 交互超时/取消：卸载表单并以 cancelled resolve pending Promise（防悬挂 + 残留） */
+  cancel(id: string): void;
   renderResult(input: RenderResultRequest): Promise<void>;
   onTextDelta(runId: string, delta: string): Promise<void>;
 }

package/dist/ui-vue.js

@@ -1,4 +1,4 @@
-import { S as renderMiniMarkdown, m as collectValues, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
+import { C as renderMiniChart, E as shapeInteractionValue, h as collectValues, w as renderMiniMarkdown, x as interactionToFormModel } from "./dist-DNSG9FqC.js";
 import { defineComponent, h, reactive, ref } from "vue";
 
 //#region ../ui-vue/dist/index.js
@@ -28,6 +28,13 @@ var VueBridgeState = class {
 		this.state.pending = null;
 		resolver(response);
 	}
+	/** runtime 交互超时/取消：卸载表单并以 cancelled resolve pending Promise（防悬挂 + 残留） */
+	cancel(id) {
+		this.resolve({
+			id,
+			cancelled: true
+		});
+	}
 	async renderResult(input) {
 		this.state.latestResult = input;
 	}

package/dist/ui.d.ts

@@ -1,5 +1,5 @@
-import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-BqyXnvoR.js";
-import { mt as buildRenderResult } from "./index-DZShzhon.js";
+import { _ as RenderResultRequest, g as RenderBlock, o as InteractionRequest, r as ChartSpec, s as InteractionResponse, v as UiBridge } from "./types-CKm5G_eQ-krKWW8WV.js";
+import { mt as buildRenderResult } from "./index-DJOha4b6.js";
 //#region ../ui/dist/index.d.ts
 //#region src/model/formModel.d.ts
 interface FormModel {
@@ -35,7 +35,7 @@ interface CollectedValues {
 }
 /**
  * 严格类型化控件值收集：
- * - number 空串 → undefined（非 0）
+ * - number 空串 → undefined（非 0）；非数值输入（NaN）按缺失处理（required 时入 missingRequired）
  * - select 用 option 值本身经 JSON 编码比对命中（对象值可正确命中）
  * - required 空值列入 missingRequired（由调用方阻止提交并标记）
  */
@@ -133,12 +133,15 @@ declare class VercelUiBridge implements UiBridge {
  * - 每行一条语句 `identifier = Expression`，`root = Component(...)` 为入口
  * - 组件调用参数为位置参数；字符串双引号反斜杠转义
  * - 组件词汇（与应用 Library 约定）：Form(title, children)、
+ *   Text(content)（纯展示文本，authorize 的能力描述用）、
  *   TextField(name, label, required?, defaultValue?)、NumberField、BooleanField(name, label, default?)、
  *   SelectField(name, label, options)、SubmitButton(label, actionType, requestId)、
  *   CancelButton(label, actionType, requestId)
  */
 declare const OPENUI_SUBMIT_ACTION = "webskill:submit";
 declare const OPENUI_CANCEL_ACTION = "webskill:cancel";
+/** authorize 的 Allow 专用动作（提交即批准 → value:true；Deny 走 cancel → cancelled:true） */
+declare const OPENUI_AUTHORIZE_ACTION = "webskill:authorize";
 /** @experimental */
 declare function toOpenUiLang(request: InteractionRequest): string;
 /**
@@ -170,10 +173,19 @@ interface A2uiMessage {
 /** @experimental */
 declare function toA2uiMessages(request: InteractionRequest): A2uiMessage[];
 /**
- * A2UI client→server action 事件 → InteractionResponse
+ * 按 InteractionRequest.type 解码提交值（绑定模型原样回传的是表单对象）：
+ * confirm 仅 confirmed===true 批准；select 还原原始 option 值（非字符串值经 JSON 编码比对）；
+ * form 的 number 字段转 number（NaN 保留原值）；ask 取 answer；authorize 提交即批准。
+ * 纯转换器：任何直接使用 fromA2uiAction 的消费者都应经此拿到正确类型。
  * @experimental
  */
-declare function fromA2uiAction(event: unknown): InteractionResponse;
+declare function decodeInteractionResponse(request: InteractionRequest, response: InteractionResponse): InteractionResponse;
+/**
+ * A2UI client→server action 事件 → InteractionResponse。
+ * 传入 request 时按类型解码提交值（见 decodeInteractionResponse）。
+ * @experimental
+ */
+declare function fromA2uiAction(event: unknown, request?: InteractionRequest): InteractionResponse;
 //#endregion
 //#region src/a2uiRuntime/litRendererBridge.d.ts
 /** @experimental */
@@ -184,6 +196,8 @@ declare class LitRendererBridge implements UiBridge {
     document?: Document;
   });
   request(input: InteractionRequest): Promise<InteractionResponse>;
+  /** runtime 交互超时/取消：移除 surface 并以 cancelled resolve pending Promise（防悬挂 + DOM 残留） */
+  cancel(id: string): void;
 }
 //#endregion
-export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, type A2uiMessage, CHART_PALETTE, type CollectedValues, type ControlModel, type FormModel, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, type VercelToolInvocation, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };
+export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, type A2uiMessage, CHART_PALETTE, type CollectedValues, type ControlModel, type FormModel, LitRendererBridge, OPENUI_AUTHORIZE_ACTION, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, type VercelToolInvocation, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, decodeInteractionResponse, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/dist/ui.js

@@ -1,4 +1,4 @@
-import { w as buildRenderResult } from "./dist-CV64gN62.js";
-import { C as renderRenderResult, D as toVercelToolInvocation, E as toOpenUiLang, S as renderMiniMarkdown, T as toA2uiMessages, _ as fromOpenUiAction, a as CHART_PALETTE, b as renderBlocks, c as OPENUI_SUBMIT_ACTION, d as WEBSKILL_STYLES_CSS, f as WebFormBridge, g as fromA2uiAction, h as ensureStyles, i as A2UI_VERSION, l as VERCEL_INTERACTION_TOOL_NAME, m as collectValues, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as chartToTable, r as A2UI_SUBMIT_ACTION, s as OPENUI_CANCEL_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VercelUiBridge, v as fromVercelToolResult, w as shapeInteractionValue, x as renderMiniChart, y as interactionToFormModel } from "./dist-CeNAzFYi.js";
+import { w as buildRenderResult } from "./dist-BXpDDZpR.js";
+import { C as renderMiniChart, D as toA2uiMessages, E as shapeInteractionValue, O as toOpenUiLang, S as renderBlocks, T as renderRenderResult, _ as ensureStyles, a as CHART_PALETTE, b as fromVercelToolResult, c as OPENUI_CANCEL_ACTION, d as VercelUiBridge, f as WEBSKILL_STYLES_CSS, g as decodeInteractionResponse, h as collectValues, i as A2UI_VERSION, k as toVercelToolInvocation, l as OPENUI_SUBMIT_ACTION, m as chartToTable, n as A2UI_CANCEL_ACTION, o as LitRendererBridge, p as WebFormBridge, r as A2UI_SUBMIT_ACTION, s as OPENUI_AUTHORIZE_ACTION, t as A2UI_BASIC_CATALOG_ID, u as VERCEL_INTERACTION_TOOL_NAME, v as fromA2uiAction, w as renderMiniMarkdown, x as interactionToFormModel, y as fromOpenUiAction } from "./dist-DNSG9FqC.js";
 
-export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };
+export { A2UI_BASIC_CATALOG_ID, A2UI_CANCEL_ACTION, A2UI_SUBMIT_ACTION, A2UI_VERSION, CHART_PALETTE, LitRendererBridge, OPENUI_AUTHORIZE_ACTION, OPENUI_CANCEL_ACTION, OPENUI_SUBMIT_ACTION, VERCEL_INTERACTION_TOOL_NAME, VercelUiBridge, WEBSKILL_STYLES_CSS, WebFormBridge, buildRenderResult, chartToTable, collectValues, decodeInteractionResponse, ensureStyles, fromA2uiAction, fromOpenUiAction, fromVercelToolResult, interactionToFormModel, renderBlocks, renderMiniChart, renderMiniMarkdown, renderRenderResult, shapeInteractionValue, toA2uiMessages, toOpenUiLang, toVercelToolInvocation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webskill/sdk",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "WebSkill \u2014 browser/Node agent skill runtime (skills, tools, MCP, governance, UI)",
   "license": "MIT",
   "type": "module",