@webskill/sdk 0.5.0 → 0.7.0

package/dist/browser.js

@@ -1,6 +1,6 @@
 import { A as parseSkillMarkdown, B as unzipWithLimits, H as verifyManifest, L as resolveInsideRoot, M as readResponseWithLimit, N as readSkillSignature, O as messageOf, T as isValidSkillName, U as verifySkillSignature, V as validateSkills, _ as atomicWriteText, f as SkillDiscovery, h as assertRemoteUrlAllowed, j as parseSkillPackManifest, m as WebSkillError, o as SKILLS_LOCKFILE, r as MANIFEST_EXCLUDED_FILES, s as SKILL_MANIFEST_FILE, u as SKILL_PACK_FILE, v as buildCatalog, w as exportSkills, y as buildManifest } from "./dist-8oQRa8Xz.js";
-import { J as normalizeToolError, P as createWebSkillApi, U as mergeCatalogEntries, W as networkPolicyLibSource, Y as parseBridgeRequest, a as AnthropicClient, d as FsMemoryStore, f as FsRunSnapshotStore, g as GoogleGenAiClient, i as AgentLoop, k as bridgeError, o as CapabilityApproval, q as normalizeToolContent, u as FsArtifactStore, v as OpenAiCompatibleClient, y as ProgressiveRouter } from "./dist-6C03DShK.js";
-import { n as MockLlmClient } from "./testing-DDCJWvgA.js";
+import { B as bridgeError, C as ProgressiveRouter, S as OpenAiCompatibleClient, U as createWebSkillApi, a as AgentLoop, b as GoogleGenAiClient, c as CapabilityApproval, ct as normalizeToolError, g as FsRunSnapshotStore, h as FsMemoryStore, it as networkPolicyLibSource, lt as parseBridgeRequest, m as FsArtifactStore, nt as mergeCatalogEntries, o as AnthropicClient, st as normalizeToolContent } from "./dist-D0qW6e40.js";
+import { n as MockLlmClient } from "./testing-CYTFqkDm.js";
 
 //#region ../browser/dist/index.js
 /** 检测当前环境是否可用 OPFS（navigator.storage.getDirectory） */
@@ -63,7 +63,12 @@ var OpfsProvider = class {
 			const name = segments.pop();
 			if (!name) throw new WebSkillError("FS_NOT_FOUND", `Invalid file path: ${p}`);
 			const handle = await (await this.#walkDir(`/${segments.join("/")}`, true)).getFileHandle(name, { create: true });
-			const size = (await handle.getFile()).size;
+			let size = 0;
+			try {
+				size = (await handle.getFile()).size;
+			} catch (e) {
+				if (!isDomException(e, "NotFoundError")) throw e;
+			}
 			const writable = await handle.createWritable({ keepExistingData: true });
 			await writable.write({
 				type: "write",
@@ -1417,12 +1422,218 @@ function startDictation(options) {
 		recognition.stop();
 	} };
 }
-/** 值可能是凭据的输入类型：即便宿主忘了写进 exclude 也不读值 */
+/** 动图无法在不丢帧的前提下走单帧编码管线，超限直接拒绝（裁决 D-2） */
+const UNCOMPRESSABLE_MIME_TYPES = /* @__PURE__ */ new Set(["image/gif"]);
+const QUALITY_STEPS = [
+	.9,
+	.7,
+	.5
+];
+const SCALE_STEP = .75;
+const MAX_ROUNDS = 5;
+/**
+* 把图片压到字节预算内（0.6.0 FR-11.3）。
+* 先逐级降质，仍超限则按长边逐步缩放，最多 5 轮；仍超限抛 `ATTACHMENT_TOO_LARGE`。
+*
+* 编码一律交给平台（`OffscreenCanvas.convertToBlob`），不手写编码器（AGENTS.md §6）。
+* 因此本函数只能在浏览器里用，落在 `@webskill/browser` 而不是 core/runtime（AC-G6）。
+*/
+async function compressImageToBudget(file, maxBytes) {
+	const originalBytes = file.size;
+	if (originalBytes <= maxBytes) return {
+		blob: file,
+		originalBytes,
+		compressedBytes: originalBytes,
+		scaled: false
+	};
+	if (UNCOMPRESSABLE_MIME_TYPES.has(file.type)) throw new WebSkillError("ATTACHMENT_TYPE_REJECTED", `GIF cannot be compressed without dropping animation; the file is ${formatBytes(originalBytes)} which exceeds the ${formatBytes(maxBytes)} limit`);
+	if (typeof createImageBitmap !== "function" || typeof OffscreenCanvas !== "function") throw new WebSkillError("ATTACHMENT_TOO_LARGE", `Image is ${formatBytes(originalBytes)} which exceeds the ${formatBytes(maxBytes)} limit, and this browser cannot re-encode images`);
+	const bitmap = await createImageBitmap(file);
+	try {
+		let width = bitmap.width;
+		let height = bitmap.height;
+		let scaled = false;
+		let best;
+		for (let round = 0; round < MAX_ROUNDS; round += 1) {
+			for (const quality of QUALITY_STEPS) {
+				const blob = await encode(bitmap, width, height, quality);
+				const candidate = {
+					blob,
+					originalBytes,
+					compressedBytes: blob.size,
+					scaled,
+					quality
+				};
+				if (blob.size <= maxBytes) return candidate;
+				if (!best || blob.size < best.compressedBytes) best = candidate;
+			}
+			width = Math.max(1, Math.round(width * SCALE_STEP));
+			height = Math.max(1, Math.round(height * SCALE_STEP));
+			scaled = true;
+		}
+		throw new WebSkillError("ATTACHMENT_TOO_LARGE", `Image is still ${formatBytes(best?.compressedBytes ?? originalBytes)} after compression, which exceeds the ${formatBytes(maxBytes)} limit`);
+	} finally {
+		bitmap.close();
+	}
+}
+async function encode(bitmap, width, height, quality) {
+	const canvas = new OffscreenCanvas(width, height);
+	const ctx = canvas.getContext("2d");
+	if (!ctx) throw new WebSkillError("ATTACHMENT_TOO_LARGE", "Failed to acquire a 2D canvas context for image compression");
+	ctx.drawImage(bitmap, 0, 0, width, height);
+	return canvas.convertToBlob({
+		type: "image/jpeg",
+		quality
+	});
+}
+function formatBytes(bytes) {
+	return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+/** @experimental */
+function isCaptureFailure(result) {
+	return "reason" in result;
+}
+const CAPTURABLE_TAGS = /* @__PURE__ */ new Set([
+	"IMG",
+	"CANVAS",
+	"SVG"
+]);
+/** 只有这三种标签能取像；其余元素连取像入口都不进（FR-12.1，由 T-02-15 守门） @experimental */
+function isCapturableElement(element) {
+	return CAPTURABLE_TAGS.has(element.tagName.toUpperCase());
+}
+function base64Of(bytes) {
+	let binary = "";
+	const chunk = 32768;
+	for (let i = 0; i < bytes.length; i += chunk) binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+	return btoa(binary);
+}
+function splitDataUrl(dataUrl) {
+	const comma = dataUrl.indexOf(",");
+	if (!dataUrl.startsWith("data:") || comma === -1) return void 0;
+	const meta = dataUrl.slice(5, comma);
+	if (!meta.endsWith(";base64")) return void 0;
+	return {
+		mimeType: meta.slice(0, -7),
+		data: dataUrl.slice(comma + 1)
+	};
+}
+/** 压到预算内；压不下去时把失败原因原样上抛给调用方转成 `CaptureFailure` */
+async function toBudget(id, level, blob, maxBytes) {
+	const compressed = await compressImageToBudget(blob, maxBytes);
+	const buffer = await compressed.blob.arrayBuffer();
+	return {
+		id,
+		mimeType: compressed.blob.type === "" ? "application/octet-stream" : compressed.blob.type,
+		data: base64Of(new Uint8Array(buffer)),
+		level,
+		originalBytes: compressed.originalBytes,
+		bytes: compressed.compressedBytes
+	};
+}
+/** L1：`<img>` 取原图字节。跨域且无 CORS 头时 fetch 失败，不改用 canvas 重绘（同样会被污染） */
+async function captureImg(element, id, maxBytes) {
+	const src = element.currentSrc !== "" ? element.currentSrc : element.src;
+	if (src === "") throw new Error("the <img> element has no resolved source");
+	const inline = splitDataUrl(src);
+	if (inline) {
+		const bytes = Uint8Array.from(atob(inline.data), (char) => char.charCodeAt(0));
+		return toBudget(id, "src", new Blob([bytes], { type: inline.mimeType }), maxBytes);
+	}
+	const response = await fetch(src, { mode: "cors" });
+	if (response.type === "opaque") throw new Error("the response is opaque, so its bytes cannot be read");
+	if (!response.ok) throw new Error(`fetching the source returned HTTP ${response.status}`);
+	return toBudget(id, "src", await response.blob(), maxBytes);
+}
+/** L2：`<canvas>` 读回。画布被跨域内容污染时 `toDataURL` 抛 SecurityError，不再兜底（裁决 D-3） */
+async function captureCanvas(element, id, maxBytes) {
+	const parsed = splitDataUrl(element.toDataURL("image/png"));
+	if (parsed === void 0) throw new Error("the canvas produced an unreadable data URL");
+	const bytes = Uint8Array.from(atob(parsed.data), (char) => char.charCodeAt(0));
+	return toBudget(id, "canvas", new Blob([bytes], { type: parsed.mimeType }), maxBytes);
+}
+/** L2：内联 `<svg>` 序列化。SVG 是文本，不进压缩管线——重编码成位图反而丢信息 */
+function captureSvg(element, id, maxBytes) {
+	const markup = new XMLSerializer().serializeToString(element);
+	const data = base64Of(new TextEncoder().encode(markup));
+	const bytes = data.length;
+	if (bytes > maxBytes) throw new Error(`the serialized SVG is ${bytes} bytes, which exceeds the budget`);
+	return {
+		id,
+		mimeType: "image/svg+xml",
+		data,
+		level: "canvas",
+		originalBytes: bytes,
+		bytes
+	};
+}
+/**
+* 取一个元素的图像（0.6.0 FR-12.1）。
+*
+* 按元素类型分派，不做无意义的尝试：`<img>` 只走 L1，`<canvas>` / `<svg>` 只走 L2，
+* 两者互不兜底。失败返回 `CaptureFailure` 而不是抛错——一张图抓不到不该让整次感知失败。
+* @experimental
+*/
+async function captureElementImage(element, options) {
+	const { id, maxBytes } = options;
+	const tag = element.tagName.toUpperCase();
+	if (tag === "IMG") try {
+		return await captureImg(element, id, maxBytes);
+	} catch (e) {
+		return {
+			id,
+			reason: `L1 could not read the image source: ${describeError(e)}`,
+			triedLevels: ["src"]
+		};
+	}
+	if (tag === "CANVAS") try {
+		return await captureCanvas(element, id, maxBytes);
+	} catch (e) {
+		return {
+			id,
+			reason: `L2 could not read the canvas: ${describeError(e)}`,
+			triedLevels: ["canvas"]
+		};
+	}
+	if (tag === "SVG") try {
+		return captureSvg(element, id, maxBytes);
+	} catch (e) {
+		return {
+			id,
+			reason: `L2 could not serialize the SVG: ${describeError(e)}`,
+			triedLevels: ["canvas"]
+		};
+	}
+	return {
+		id,
+		reason: `<${element.tagName.toLowerCase()}> is not a capturable element`,
+		triedLevels: []
+	};
+}
+function describeError(e) {
+	if (e instanceof DOMException && e.name === "SecurityError") return "the canvas is tainted by cross-origin data";
+	if (e instanceof TypeError) return "the request was blocked, most likely by CORS";
+	return e instanceof Error ? e.message : String(e);
+}
+/** 值可能是凭据的输入类型：即便宿主忘了写进 exclude 也不读值。操作侧复用同一份，不另写 */
 const SECRET_INPUT_TYPES = /* @__PURE__ */ new Set(["password", "hidden"]);
+/** 可被操作的角色：只给这些节点发句柄，其余节点模型连提都提不出来 */
+const ACTIONABLE_ROLES = /* @__PURE__ */ new Set([
+	"button",
+	"checkbox",
+	"combobox",
+	"form",
+	"link",
+	"radio",
+	"searchbox",
+	"switch",
+	"textbox"
+]);
 /** tag → 可访问性角色的最小映射；命中不了就退到 generic，不猜 */
 const ROLE_BY_TAG = {
 	A: "link",
 	BUTTON: "button",
+	CANVAS: "img",
 	H1: "heading",
 	H2: "heading",
 	H3: "heading",
@@ -1435,6 +1646,7 @@ const ROLE_BY_TAG = {
 	OL: "list",
 	P: "paragraph",
 	SELECT: "combobox",
+	SVG: "img",
 	TABLE: "table",
 	TD: "cell",
 	TEXTAREA: "textbox",
@@ -1454,14 +1666,14 @@ const clip = (text) => {
 	const normalized = text.replace(/\s+/g, " ").trim();
 	return normalized.length > MAX_TEXT ? `${normalized.slice(0, MAX_TEXT)}…` : normalized;
 };
-function roleOf(element) {
+function roleOf$1(element) {
 	const explicit = element.getAttribute("role");
 	if (explicit !== null && explicit.trim() !== "") return explicit.trim();
 	if (element.tagName === "INPUT") {
 		const type = (element.getAttribute("type") ?? "text").toLowerCase();
 		return INPUT_TYPE_ROLE[type] ?? "textbox";
 	}
-	return ROLE_BY_TAG[element.tagName] ?? "generic";
+	return ROLE_BY_TAG[element.tagName.toUpperCase()] ?? "generic";
 }
 /** 自身直系文本（不含后代元素的文本）：后代会各自成为节点，重复没有意义 */
 function ownText(element) {
@@ -1500,7 +1712,7 @@ function valueOf(element) {
 * 隐藏节点不进结果：屏幕上看不见的东西，用户没有机会发现它被读走了。
 * jsdom 里 `getComputedStyle` 可用但布局是假的，因此只看显式声明，不看尺寸。
 */
-function hidden(element, view) {
+function hidden$1(element, view) {
 	if (element.hasAttribute("hidden")) return true;
 	if (element.getAttribute("aria-hidden") === "true") return true;
 	const inlineStyle = element.getAttribute("style") ?? "";
@@ -1518,27 +1730,59 @@ const SKIPPED_TAGS = /* @__PURE__ */ new Set([
 	"NOSCRIPT",
 	"TEMPLATE"
 ]);
-function describe(element, excluded, doc, view) {
+function describe(element, excluded, doc, view, targets, handles) {
 	if (excluded.has(element)) return void 0;
 	if (SKIPPED_TAGS.has(element.tagName)) return void 0;
-	if (hidden(element, view)) return void 0;
+	if (hidden$1(element, view)) return void 0;
 	const children = [];
 	for (const child of element.children) {
-		const node = describe(child, excluded, doc, view);
+		const node = describe(child, excluded, doc, view, targets, handles);
 		if (node !== void 0) children.push(node);
 	}
 	const name = nameOf(element, doc);
 	const value = valueOf(element);
-	const role = roleOf(element);
+	const role = roleOf$1(element);
 	if (role === "generic" && name === void 0 && value === void 0 && children.length === 0) return void 0;
-	return {
+	const node = {
 		role,
 		...name !== void 0 ? { name } : {},
 		...value !== void 0 ? { value } : {},
 		...children.length > 0 ? { children } : {}
 	};
+	const ref = handles?.issue(element, role);
+	if (ref !== void 0) node.ref = ref;
+	if (targets !== void 0 && isCapturableElement(element)) targets.push({
+		element,
+		node
+	});
+	return node;
 }
 /**
+* 句柄发放与解析。表在 reader 实例内、每次 `read()` 整体替换：
+* 全局表是第二套状态且会跨会话泄漏；不替换则页面变了还能用旧句柄点到别的东西。
+*/
+var HandleIssuer = class {
+	#table = /* @__PURE__ */ new Map();
+	#actionable;
+	#excluded;
+	constructor(actionable, excluded) {
+		this.#actionable = actionable;
+		this.#excluded = excluded;
+	}
+	issue(element, role) {
+		if (!this.#actionable.has(element) || this.#excluded.has(element)) return void 0;
+		if (!ACTIONABLE_ROLES.has(role)) return void 0;
+		const bytes = /* @__PURE__ */ new Uint8Array(8);
+		crypto.getRandomValues(bytes);
+		const ref = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+		this.#table.set(ref, element);
+		return ref;
+	}
+	get table() {
+		return this.#table;
+	}
+};
+/**
 * DOM 遍历实现（设计 09 §2 的「实现层」）。产出只有角色 / 名称 / 值，
 * **不含任何 HTML 标记、class、data 属性或注释**（FR-10.4）。
 *
@@ -1547,21 +1791,204 @@ function describe(element, excluded, doc, view) {
 * @experimental
 */
 function createDomPerceptionReader(options = {}) {
-	return { read(scope) {
-		const doc = options.document ?? globalThis.document;
+	let handles;
+	const resolveDocument = () => options.document ?? globalThis.document;
+	/** 按当前 DOM 重算一次可操作集合；发句柄与执行前各算一次 */
+	const actionSets = (doc) => {
+		const actionable = /* @__PURE__ */ new Set();
+		const excluded = /* @__PURE__ */ new Set();
+		const scope = options.actionScope;
+		if (scope === void 0 || scope.include.length === 0) return {
+			actionable,
+			excluded
+		};
+		for (const selector of scope.include) for (const root of doc.querySelectorAll(selector)) {
+			actionable.add(root);
+			for (const descendant of root.querySelectorAll("*")) actionable.add(descendant);
+		}
+		for (const selector of scope.exclude ?? []) for (const root of doc.querySelectorAll(selector)) {
+			excluded.add(root);
+			for (const descendant of root.querySelectorAll("*")) excluded.add(descendant);
+		}
+		return {
+			actionable,
+			excluded
+		};
+	};
+	function collect(scope, targets) {
+		const doc = resolveDocument();
 		if (doc === void 0 || scope.include.length === 0) return [];
 		const view = doc.defaultView;
+		const sets = actionSets(doc);
+		handles = new HandleIssuer(sets.actionable, sets.excluded);
 		const excluded = /* @__PURE__ */ new Set();
 		for (const selector of scope.exclude ?? []) for (const element of doc.querySelectorAll(selector)) excluded.add(element);
 		const roots = [];
 		for (const selector of scope.include) for (const element of doc.querySelectorAll(selector)) if (!roots.includes(element)) roots.push(element);
 		const nodes = [];
 		for (const root of roots) {
-			const node = describe(root, excluded, doc, view);
+			const node = describe(root, excluded, doc, view, targets, handles);
 			if (node !== void 0) nodes.push(node);
 		}
 		return nodes;
-	} };
+	}
+	async function readWithImages(scope, capture) {
+		const targets = [];
+		const nodes = collect(scope, targets);
+		const selected = targets.slice(0, capture.maxImages);
+		const images = [];
+		let imageFailures = 0;
+		for (const [index, target] of selected.entries()) {
+			const result = await captureElementImage(target.element, {
+				id: `img-${index + 1}`,
+				maxBytes: capture.maxImageBytes
+			});
+			if (isCaptureFailure(result)) {
+				target.node.imageNote = result.reason;
+				imageFailures += 1;
+				continue;
+			}
+			target.node.imageId = result.id;
+			images.push({
+				id: result.id,
+				mimeType: result.mimeType,
+				data: result.data,
+				level: result.level
+			});
+		}
+		for (const target of targets.slice(capture.maxImages)) target.node.imageNote = "Not captured: the per-message image limit was reached";
+		return {
+			nodes,
+			images,
+			imagesOmitted: targets.length - selected.length,
+			imageFailures
+		};
+	}
+	function read(scope, capture) {
+		if (capture === void 0) return collect(scope, void 0);
+		if (!capture.images || capture.maxImages <= 0) return Promise.resolve({ nodes: collect(scope, void 0) });
+		return readWithImages(scope, capture);
+	}
+	return {
+		read,
+		resolve: (ref) => handles?.table.get(ref),
+		inActionScope: (element) => {
+			const doc = resolveDocument();
+			if (doc === void 0) return false;
+			const sets = actionSets(doc);
+			return sets.actionable.has(element) && !sets.excluded.has(element);
+		}
+	};
+}
+const FILLABLE_TAGS = /* @__PURE__ */ new Set(["INPUT", "TEXTAREA"]);
+/** 只看显式声明，不看尺寸：jsdom 有 getComputedStyle 但没有布局 */
+function hidden(element) {
+	if (element.hasAttribute("hidden")) return true;
+	if (element.getAttribute("aria-hidden") === "true") return true;
+	const inlineStyle = element.getAttribute("style") ?? "";
+	if (/display\s*:\s*none|visibility\s*:\s*hidden/i.test(inlineStyle)) return true;
+	const view = element.ownerDocument.defaultView;
+	if (view !== null) {
+		const computed = view.getComputedStyle(element);
+		if (computed.display === "none" || computed.visibility === "hidden") return true;
+	}
+	return false;
+}
+const inputType = (element) => (element.getAttribute("type") ?? "text").toLowerCase();
+const isSecret = (element) => element.tagName === "INPUT" && SECRET_INPUT_TYPES.has(inputType(element));
+function accessibleName(element) {
+	const label = element.getAttribute("aria-label");
+	if (label !== null && label.trim() !== "") return label.trim();
+	const text = element.textContent?.replace(/\s+/g, " ").trim() ?? "";
+	if (text !== "") return text;
+	const placeholder = element.getAttribute("placeholder");
+	return placeholder !== null && placeholder.trim() !== "" ? placeholder.trim() : void 0;
+}
+function roleOf(element) {
+	const explicit = element.getAttribute("role");
+	if (explicit !== null && explicit.trim() !== "") return explicit.trim();
+	if (element.tagName === "INPUT") {
+		const type = inputType(element);
+		return type === "checkbox" || type === "radio" ? type : type === "button" || type === "submit" ? "button" : "textbox";
+	}
+	if (element.tagName === "BUTTON") return "button";
+	if (element.tagName === "A") return "link";
+	if (element.tagName === "TEXTAREA") return "textbox";
+	if (element.tagName === "SELECT") return "combobox";
+	if (element.tagName === "FORM") return "form";
+	return "generic";
+}
+const describeElement = (element) => {
+	const name = accessibleName(element);
+	return {
+		role: roleOf(element),
+		...name !== void 0 ? { name } : {},
+		...isSecret(element) ? { secret: true } : {}
+	};
+};
+/**
+* 受控组件必须收到 `input` / `change`：直接写 `.value` 在 React 上会被下一次渲染覆盖，
+* 表现为「填了又没了」。原生 setter 是绕过 React value 劫持的唯一办法。
+*/
+function fillValue(element, value) {
+	const prototype = element.tagName === "INPUT" ? HTMLInputElement.prototype : HTMLTextAreaElement.prototype;
+	const setter = Object.getOwnPropertyDescriptor(prototype, "value")?.set;
+	if (setter) setter.call(element, value);
+	else element.value = value;
+	element.dispatchEvent(new Event("input", { bubbles: true }));
+	element.dispatchEvent(new Event("change", { bubbles: true }));
+}
+/** @experimental */
+function createDomPageActionExecutor(options) {
+	const { reader } = options;
+	const describe = (ref) => {
+		const element = reader.resolve(ref);
+		return element === void 0 ? void 0 : describeElement(element);
+	};
+	const execute = (request) => {
+		const element = reader.resolve(request.ref);
+		if (element === void 0) return {
+			ok: false,
+			target: { role: "generic" },
+			reason: "The element reference is unknown or expired."
+		};
+		const target = describeElement(element);
+		const fail = (reason) => ({
+			ok: false,
+			target,
+			reason
+		});
+		if (!reader.inActionScope(element)) return fail("The element is no longer inside the actionable scope.");
+		if (hidden(element)) return fail("The element is not visible.");
+		if (element.hasAttribute("disabled")) return fail("The element is disabled.");
+		if (request.action === "click") {
+			element.click();
+			return {
+				ok: true,
+				target
+			};
+		}
+		if (request.action === "fill") {
+			if (!FILLABLE_TAGS.has(element.tagName)) return fail("The element is not a text control.");
+			if (element.hasAttribute("readonly")) return fail("The element is read-only.");
+			fillValue(element, request.value ?? "");
+			return {
+				ok: true,
+				target
+			};
+		}
+		const form = element.tagName === "FORM" ? element : element.form;
+		if (!form) return fail("The element does not belong to a form.");
+		form.requestSubmit();
+		return {
+			ok: true,
+			target
+		};
+	};
+	return {
+		execute,
+		describe
+	};
 }
 const isRecord = (v) => typeof v === "object" && v !== null;
 const isNonEmptyString = (v) => typeof v === "string" && v !== "";
@@ -2076,6 +2503,173 @@ var WorkerRuntimeClient = class {
 		}
 	}
 };
+/**
+* 静态加密的 MemoryStore 包装（FR-19.5）。落盘形态：
+* `{ v: 1, iv: base64, ct: base64 }`；每次写入生成新的 12 字节随机 IV
+* ——AES-GCM 下 IV 重用会同时毁掉机密性与完整性，不能复用。
+*
+* 算法与密钥都交给 Web Crypto，本文件不实现任何密码学原语。
+* @experimental
+*/
+const ENVELOPE_VERSION = 1;
+const toBase64 = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+};
+const allocate = (length) => new Uint8Array(new ArrayBuffer(length));
+const fromBase64 = (text) => {
+	const binary = atob(text);
+	const bytes = allocate(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+};
+const encodeUtf8 = (text) => {
+	const bytes = allocate(text.length * 3);
+	const { written } = new TextEncoder().encodeInto(text, bytes);
+	return bytes.subarray(0, written);
+};
+const isEnvelope = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record["v"] === ENVELOPE_VERSION && typeof record["iv"] === "string" && typeof record["ct"] === "string";
+};
+/**
+* 某条已读出的记忆值是否是密文信封。观测方（如 console）据此决定要不要去取密钥：
+* 加密关着的时候不该为了读一条明文而凭空建出一把密钥。
+* @experimental
+*/
+function isEncryptedMemoryValue(value) {
+	return isEnvelope(value);
+}
+function requireSubtle() {
+	const subtle = globalThis.crypto?.subtle;
+	if (subtle === void 0) throw new WebSkillError("PROFILE_KEY_UNAVAILABLE", "Web Crypto is unavailable, so encrypted memory cannot be read or written. Serve the page over HTTPS or disable encrypted storage.");
+	return subtle;
+}
+/**
+* 用 AES-GCM 包装一个 MemoryStore：值加密后再交给 `inner`，读取时解密。
+* 密钥不可用（未解锁 / 无 Web Crypto）时**拒绝读写并抛结构化错误**，
+* 不静默降级成明文——那会让「已加密」的承诺失效而用户无从察觉。
+*
+* `scopes` 限定加密范围。默认全加密；宿主通常只加密存放个人数据的
+* `user:` 作用域，把运行观测（会话参数历史、技能统计）留作明文供 console 读取。
+* @experimental
+*/
+function createEncryptedMemoryStore(inner, key, options = {}) {
+	const covers = options.scopes ?? (() => true);
+	const requireKey = () => {
+		if (key === void 0) throw new WebSkillError("PROFILE_KEY_UNAVAILABLE", "The encryption key for stored user data is unavailable, so the store refused to read or write.");
+		return key;
+	};
+	const decrypt = async (raw) => {
+		if (raw === void 0 || raw === null) return raw;
+		if (!isEnvelope(raw)) return raw;
+		const plain = await requireSubtle().decrypt({
+			name: "AES-GCM",
+			iv: fromBase64(raw.iv)
+		}, requireKey(), fromBase64(raw.ct));
+		return JSON.parse(new TextDecoder().decode(plain));
+	};
+	const store = {
+		async get(scope, storeKey) {
+			const raw = await inner.get(scope, storeKey);
+			return covers(scope) ? decrypt(raw) : raw;
+		},
+		async set(scope, storeKey, value) {
+			if (!covers(scope)) {
+				await inner.set(scope, storeKey, value);
+				return;
+			}
+			const subtle = requireSubtle();
+			const iv = crypto.getRandomValues(allocate(12));
+			const ct = await subtle.encrypt({
+				name: "AES-GCM",
+				iv
+			}, requireKey(), encodeUtf8(JSON.stringify(value ?? null)));
+			const envelope = {
+				v: ENVELOPE_VERSION,
+				iv: toBase64(iv),
+				ct: toBase64(new Uint8Array(ct))
+			};
+			await inner.set(scope, storeKey, envelope);
+		},
+		async delete(scope, storeKey) {
+			await inner.delete(scope, storeKey);
+		},
+		async list(scope) {
+			const entries = await inner.list(scope);
+			if (!covers(scope)) return entries;
+			return Promise.all(entries.map(async (entry) => ({
+				key: entry.key,
+				value: await decrypt(entry.value)
+			})));
+		},
+		async clear(scope) {
+			await inner.clear(scope);
+		}
+	};
+	if (inner.transaction) store.transaction = async (scope, fn) => inner.transaction(scope, async (raw) => fn(createEncryptedMemoryStore(raw, key, options)));
+	return store;
+}
+/**
+* 生成一把不可导出的 AES-GCM 256 密钥（FR-19.5）。不可导出意味着页面脚本
+* 拿不到原始字节，只能通过 Web Crypto 使用它；宿主负责持久化这个句柄（如 IndexedDB）。
+* @experimental
+*/
+async function generateMemoryEncryptionKey() {
+	return requireSubtle().generateKey({
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+const KEY_DB_NAME = "webskill-keys";
+const KEY_STORE_NAME = "keys";
+function request(req) {
+	return new Promise((resolve, reject) => {
+		req.onsuccess = () => resolve(req.result);
+		req.onerror = () => reject(req.error ?? /* @__PURE__ */ new Error("IndexedDB request failed"));
+	});
+}
+function openDb() {
+	const indexedDb = globalThis.indexedDB;
+	if (indexedDb === void 0) throw new WebSkillError("PROFILE_KEY_UNAVAILABLE", "IndexedDB is unavailable, so the encryption key for stored user data cannot be persisted.");
+	return new Promise((resolve, reject) => {
+		const open = indexedDb.open(KEY_DB_NAME, 1);
+		open.onupgradeneeded = () => {
+			if (!open.result.objectStoreNames.contains(KEY_STORE_NAME)) open.result.createObjectStore(KEY_STORE_NAME);
+		};
+		open.onsuccess = () => resolve(open.result);
+		open.onerror = () => reject(open.error ?? /* @__PURE__ */ new Error("IndexedDB open failed"));
+	});
+}
+/**
+* 取（必要时生成）本地数据加密密钥并持久化在 IndexedDB（FR-19.5）。
+* 存的是 `CryptoKey` 句柄本身而不是密钥字节：结构化克隆能存它，
+* 而它是 non-extractable 的，页面脚本与扩展都读不出原始字节。
+* @experimental
+*/
+async function openMemoryEncryptionKey(name = "user-profile") {
+	const db = await openDb();
+	try {
+		const existing = await request(db.transaction(KEY_STORE_NAME, "readonly").objectStore(KEY_STORE_NAME).get(name));
+		if (existing instanceof CryptoKey) return existing;
+		const created = await generateMemoryEncryptionKey();
+		await request(db.transaction(KEY_STORE_NAME, "readwrite").objectStore(KEY_STORE_NAME).put(created, name));
+		return created;
+	} finally {
+		db.close();
+	}
+}
+/** 删除本地数据加密密钥；清除画像与记录时一并调用，避免留下解不开的旧密文 @experimental */
+async function deleteMemoryEncryptionKey(name = "user-profile") {
+	const db = await openDb();
+	try {
+		await request(db.transaction(KEY_STORE_NAME, "readwrite").objectStore(KEY_STORE_NAME).delete(name));
+	} finally {
+		db.close();
+	}
+}
 
 //#endregion
-export { BrowserSkillManager, BrowserWorkerScriptExecutor, ChromeBuiltinLlmClient, IframeWorkerLike, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, checkDictationAvailability, createDomPerceptionReader, createIframeWorker, createLlmClient, extractZipWeb, installWebSkillNavigator, isOpfsAvailable, parseBridgeRequest, parseMainMessage, parseWorkerEvent, probeChromeBuiltinAvailability, sha256HexWeb, startDictation, startWorkerRuntimeHost };
+export { BrowserSkillManager, BrowserWorkerScriptExecutor, ChromeBuiltinLlmClient, IframeWorkerLike, OpfsProvider, TsTranspiler, WORKER_BOOTSTRAP_SOURCE, WorkerRuntimeClient, WorkerUiBridge, bridgeError, captureElementImage, checkDictationAvailability, compressImageToBudget, createDomPageActionExecutor, createDomPerceptionReader, createEncryptedMemoryStore, createIframeWorker, createLlmClient, deleteMemoryEncryptionKey, extractZipWeb, generateMemoryEncryptionKey, installWebSkillNavigator, isCapturableElement, isCaptureFailure, isEncryptedMemoryValue, isOpfsAvailable, openMemoryEncryptionKey, parseBridgeRequest, parseMainMessage, parseWorkerEvent, probeChromeBuiltinAvailability, sha256HexWeb, startDictation, startWorkerRuntimeHost };