@webskill/sdk 0.6.0 → 0.7.0

package/dist/mcp.js

@@ -1,5 +1,5 @@
 import { O as messageOf, h as assertRemoteUrlAllowed, m as WebSkillError } from "./dist-8oQRa8Xz.js";
-import { at as normalizeToolContent, et as mergeCatalogEntries } from "./dist-DusANsrn.js";
+import { nt as mergeCatalogEntries, st as normalizeToolContent } from "./dist-D0qW6e40.js";
 
 //#region ../mcp/dist/index.js
 /**
@@ -182,6 +182,8 @@ const failure$1 = (code, message) => ({
 		message
 	}
 });
+/** 需要重新授权不是「端点不可用」：压平成后者，模型和界面都会去查网络（0.7.0 FR-22.3） */
+const endpointFailure = (e, message) => failure$1(e instanceof WebSkillError && e.code.startsWith("MCP_OAUTH_") ? e.code : "MCP_ENDPOINT_UNAVAILABLE", message);
 /**
 * endpoint:toolName 调用 + 工具清单缓存（TTL 默认 1s + registry 版本号双失效）。
 */
@@ -204,7 +206,7 @@ var McpToolResolver = class {
 		try {
 			names = await this.#toolNames(endpoint, client);
 		} catch (e) {
-			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Failed to list tools: ${messageOf(e)}`);
+			return endpointFailure(e, `Failed to list tools: ${messageOf(e)}`);
 		}
 		if (!names.has(toolName)) {
 			this.#cache.delete(endpoint);
@@ -222,7 +224,7 @@ var McpToolResolver = class {
 			});
 			return this.#normalizeCallResult(raw);
 		} catch (e) {
-			return failure$1("MCP_ENDPOINT_UNAVAILABLE", `Tool "${toolName}" on endpoint "${endpoint}" failed: ${messageOf(e)}`);
+			return endpointFailure(e, `Tool "${toolName}" on endpoint "${endpoint}" failed: ${messageOf(e)}`);
 		}
 	}
 	async #toolNames(endpoint, client) {
@@ -565,22 +567,182 @@ var McpRuntimePlugin = class {
 		};
 	}
 };
+/**
+* 构造授权相关错误。`message` 只含端点名与阶段，`details` 只有 `{ endpoint, stage }`——
+* 不带 `cause`：SDK 的错误 message 可能回显授权 URL 或 token 端点的响应体（AC-22.6）。
+*/
+function oauthError(code, endpoint, stage, reason) {
+	return new WebSkillError(code, `Remote MCP endpoint "${endpoint}" ${reason} (stage: ${stage})`, {
+		endpoint,
+		stage
+	});
+}
+/** 显式的内存存储，供 examples 与测试使用。**不是缺省行为**——是宿主主动选的（AC-22.7）。 @experimental */
+function createMemoryOAuthStores() {
+	const tokens = /* @__PURE__ */ new Map();
+	const handshakes = /* @__PURE__ */ new Map();
+	return {
+		tokens: {
+			load: (endpoint) => Promise.resolve(tokens.get(endpoint)),
+			save: (endpoint, value) => {
+				tokens.set(endpoint, value);
+				return Promise.resolve();
+			},
+			clear: (endpoint) => {
+				tokens.delete(endpoint);
+				return Promise.resolve();
+			}
+		},
+		handshake: {
+			load: (endpoint) => Promise.resolve(handshakes.get(endpoint)),
+			save: (endpoint, value) => {
+				handshakes.set(endpoint, value);
+				return Promise.resolve();
+			},
+			clear: (endpoint) => {
+				handshakes.delete(endpoint);
+				return Promise.resolve();
+			}
+		}
+	};
+}
+const randomState = () => {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+};
+/**
+* `McpOAuthConfig` → SDK `OAuthClientProvider` 适配器。
+*
+* `state()` 与 `saveCodeVerifier()` 由 SDK 分两次调用（顺序上前者在先），
+* 两者合成一条握手记录：谁先到都把当前已知部分写进去，回程时两项都在。
+* @experimental
+*/
+function createOAuthProvider(endpoint, config) {
+	const { client, tokens: tokenStore, handshake } = config;
+	let pending = {};
+	const persist = async (patch) => {
+		pending = {
+			...pending,
+			...patch
+		};
+		await handshake.save(endpoint, {
+			codeVerifier: pending.codeVerifier ?? "",
+			state: pending.state ?? ""
+		});
+	};
+	return {
+		get redirectUrl() {
+			return client.redirectUri;
+		},
+		get clientMetadata() {
+			return {
+				client_name: "WebSkill SDK",
+				redirect_uris: [client.redirectUri],
+				grant_types: ["authorization_code", "refresh_token"],
+				response_types: ["code"],
+				token_endpoint_auth_method: client.clientSecret === void 0 ? "none" : "client_secret_post",
+				...client.scopes && client.scopes.length > 0 ? { scope: client.scopes.join(" ") } : {}
+			};
+		},
+		async state() {
+			const value = randomState();
+			await persist({ state: value });
+			return value;
+		},
+		clientInformation() {
+			return Promise.resolve({
+				client_id: client.clientId,
+				...client.clientSecret !== void 0 ? { client_secret: client.clientSecret } : {}
+			});
+		},
+		async tokens() {
+			const saved = await tokenStore.load(endpoint);
+			if (!saved) return void 0;
+			return {
+				access_token: saved.accessToken,
+				token_type: saved.tokenType ?? "Bearer",
+				...saved.expiresAt !== void 0 ? { expires_in: Math.max(0, Math.round((saved.expiresAt - Date.now()) / 1e3)) } : {},
+				...saved.refreshToken !== void 0 ? { refresh_token: saved.refreshToken } : {},
+				...saved.scope !== void 0 ? { scope: saved.scope } : {}
+			};
+		},
+		async saveTokens(next) {
+			await tokenStore.save(endpoint, {
+				accessToken: next.access_token,
+				...next.expires_in !== void 0 ? { expiresAt: Date.now() + next.expires_in * 1e3 } : {},
+				...next.refresh_token !== void 0 ? { refreshToken: next.refresh_token } : {},
+				...next.token_type !== void 0 ? { tokenType: next.token_type } : {},
+				...next.scope !== void 0 ? { scope: next.scope } : {}
+			});
+		},
+		async redirectToAuthorization(url) {
+			await config.openAuthorization(url);
+		},
+		async saveCodeVerifier(codeVerifier) {
+			await persist({ codeVerifier });
+		},
+		async codeVerifier() {
+			const saved = await handshake.load(endpoint);
+			if (!saved?.codeVerifier) throw oauthError("MCP_OAUTH_FAILED", endpoint, "exchange", "has no stored PKCE verifier for this handshake");
+			return saved.codeVerifier;
+		},
+		async invalidateCredentials(scope) {
+			if (scope === "all" || scope === "tokens") await tokenStore.clear(endpoint);
+			if (scope === "all" || scope === "verifier") await handshake.clear(endpoint);
+		}
+	};
+}
 async function loadMcpSdk() {
 	try {
-		const [client, sse, streamable] = await Promise.all([
+		const [client, sse, streamable, auth, errors] = await Promise.all([
 			import("@modelcontextprotocol/sdk/client/index.js"),
 			import("@modelcontextprotocol/sdk/client/sse.js"),
-			import("@modelcontextprotocol/sdk/client/streamableHttp.js")
+			import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
+			import("@modelcontextprotocol/sdk/client/auth.js"),
+			import("@modelcontextprotocol/sdk/server/auth/errors.js")
 		]);
 		return {
 			Client: client.Client,
 			SSEClientTransport: sse.SSEClientTransport,
-			StreamableHTTPClientTransport: streamable.StreamableHTTPClientTransport
+			StreamableHTTPClientTransport: streamable.StreamableHTTPClientTransport,
+			UnauthorizedError: auth.UnauthorizedError,
+			OAuthError: errors.OAuthError
 		};
 	} catch (e) {
 		throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", "The \"@modelcontextprotocol/sdk\" package is required for remote MCP endpoints; install it first (npm i @modelcontextprotocol/sdk)", e);
 	}
 }
+/** 运行期的未授权（含刷新失败）必须在 endpoint 层转成 `WebSkillError`，否则 401 会以工具结果的形式进模型上下文 */
+function wrapOAuthClient(client, endpoint, oauth, isUnauthorized) {
+	const guard = async (work) => {
+		try {
+			return await work();
+		} catch (e) {
+			if (!isUnauthorized(e)) throw e;
+			await oauth.tokens.clear(endpoint);
+			throw oauthError("MCP_OAUTH_REQUIRED", endpoint, "refresh", "needs authorization again");
+		}
+	};
+	return {
+		listTools: () => guard(() => client.listTools()),
+		callTool: (input) => guard(() => client.callTool(input)),
+		listPrompts: () => guard(() => client.listPrompts()),
+		getPrompt: (input) => guard(() => client.getPrompt(input)),
+		listResources: () => guard(() => client.listResources()),
+		readResource: (input) => guard(() => client.readResource(input))
+	};
+}
+/** 授权注入的完整性校验：缺一项就是宿主的配置错误，不是运行期授权问题（AC-22.7） */
+function assertOAuthConfigured(endpoint, oauth) {
+	const missing = [];
+	if (!oauth.client?.clientId) missing.push("client.clientId");
+	if (!oauth.client?.redirectUri) missing.push("client.redirectUri");
+	if (!oauth.tokens) missing.push("tokens");
+	if (!oauth.handshake) missing.push("handshake");
+	if (typeof oauth.openAuthorization !== "function") missing.push("openAuthorization");
+	if (missing.length > 0) throw oauthError("MCP_OAUTH_NOT_CONFIGURED", endpoint, "discover", `is missing OAuth wiring: ${missing.join(", ")}`);
+}
 /**
 * 远程 MCP endpoint 装配：SDK 官方 StreamableHTTPClientTransport（默认）/
 * SSEClientTransport（遗留）连接远端 server，注册进 EndpointRegistry——
@@ -588,7 +750,7 @@ async function loadMcpSdk() {
 * 返回 close 句柄：断开后 unregister（临时技能随既有生命周期自然消失）。
 */
 async function connectRemoteEndpoint(registry, config) {
-	const { Client, SSEClientTransport, StreamableHTTPClientTransport } = await loadMcpSdk();
+	const { Client, SSEClientTransport, StreamableHTTPClientTransport, UnauthorizedError, OAuthError } = await loadMcpSdk();
 	let url;
 	try {
 		url = new URL(config.url);
@@ -599,46 +761,81 @@ async function connectRemoteEndpoint(registry, config) {
 		allowHttp: config.allowHttp ?? false,
 		allowPrivateHosts: config.allowPrivateHosts ?? false
 	});
+	const oauth = config.oauth;
+	if (oauth) assertOAuthConfigured(config.endpoint, oauth);
+	const authProvider = oauth ? createOAuthProvider(config.endpoint, oauth) : void 0;
 	const requestInit = config.headers ? { headers: config.headers } : void 0;
-	const transport = config.transport === "sse" ? new SSEClientTransport(url, { ...requestInit ? { requestInit } : {} }) : new StreamableHTTPClientTransport(url, { ...requestInit ? { requestInit } : {} });
+	const transportOptions = {
+		...requestInit ? { requestInit } : {},
+		...authProvider ? { authProvider } : {}
+	};
+	const makeTransport = () => config.transport === "sse" ? new SSEClientTransport(url, transportOptions) : new StreamableHTTPClientTransport(url, transportOptions);
 	const client = new Client({
 		name: "webskill-remote-client",
 		version: "0.1.0"
 	});
+	const isUnauthorized = (e) => e instanceof UnauthorizedError || e instanceof OAuthError;
 	const unavailable = (e) => new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Failed to connect remote MCP endpoint "${config.endpoint}" at ${config.url}: ${messageOf(e)}`, e);
-	try {
+	let closed = false;
+	const close = async () => {
+		if (closed) return;
+		closed = true;
+		registry.unregister(config.endpoint);
+		try {
+			await client.close();
+		} catch (e) {
+			throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Failed to close remote MCP endpoint "${config.endpoint}": ${messageOf(e)}`, e);
+		}
+	};
+	const register = () => {
+		try {
+			const entry = client;
+			registry.register(config.endpoint, oauth ? wrapOAuthClient(entry, config.endpoint, oauth, isUnauthorized) : entry);
+		} catch (e) {
+			client.close().catch(() => void 0);
+			throw unavailable(e);
+		}
+	};
+	const openConnection = async (transport) => {
 		let connect = client.connect(transport);
 		if (config.timeoutMs && config.timeoutMs > 0) {
 			const timeoutMs = config.timeoutMs;
 			connect = Promise.race([connect, new Promise((_resolve, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`Connection timed out after ${timeoutMs}ms`)), timeoutMs))]);
 		}
 		await connect;
-	} catch (e) {
+	};
+	const finishAuthorization = async (code, state) => {
+		const saved = await oauth.handshake.load(config.endpoint);
+		if (!saved || saved.state === "" || saved.state !== state) throw oauthError("MCP_OAUTH_FAILED", config.endpoint, "authorize", "received a mismatched authorization state");
+		const transport = makeTransport();
 		try {
-			await client.close();
-		} catch {}
-		throw unavailable(e);
-	}
+			await transport.finishAuth(code);
+		} catch (e) {
+			throw oauthError(isUnauthorized(e) ? "MCP_OAUTH_REQUIRED" : "MCP_OAUTH_FAILED", config.endpoint, "exchange", "could not exchange the authorization code");
+		}
+		await oauth.handshake.clear(config.endpoint);
+		await openConnection(transport);
+		register();
+	};
 	try {
-		registry.register(config.endpoint, client);
+		await openConnection(makeTransport());
 	} catch (e) {
+		if (oauth && isUnauthorized(e)) return {
+			close,
+			finishAuthorization,
+			authorizationRequired: true
+		};
 		try {
 			await client.close();
 		} catch {}
 		throw unavailable(e);
 	}
-	let closed = false;
-	return { close: async () => {
-		if (closed) return;
-		closed = true;
-		registry.unregister(config.endpoint);
-		try {
-			await client.close();
-		} catch (e) {
-			throw new WebSkillError("MCP_ENDPOINT_UNAVAILABLE", `Failed to close remote MCP endpoint "${config.endpoint}": ${messageOf(e)}`, e);
-		}
-	} };
+	register();
+	return {
+		close,
+		...oauth ? { finishAuthorization } : {}
+	};
 }
 
 //#endregion
-export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, TemporarySkillProvider, catalogMerge, connectRemoteEndpoint, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };
+export { EndpointRegistry, ExperimentalWebMcpAdapter, McpRuntimePlugin, McpToolResolver, MessageChannelTransport, TemporarySkillProvider, catalogMerge, connectRemoteEndpoint, createMemoryOAuthStores, createOAuthProvider, endpointToolLlmName, parseEndpointToolLlmName, parseWebMcpToolLlmName, serveSkillAsMcp, validateJsonRpcMessage, webMcpToolLlmName };

package/dist/node.d.ts

@@ -1,6 +1,6 @@
-import { I as JsonSchema, N as FileStat, O as ArchiveLimits, P as FileSystemProvider, U as SKILLS_LOCKFILE, W as SKILL_MANIFEST_FILE, Y as SignatureAuditSink, _t as VerifyResult, at as SkillManifest, b as UiBridge, c as InteractionResponse, dt as SkillsLockfile, ht as UnsignedPolicy, it as SkillManagerPort, pt as TrustedKeyStore, s as InteractionRequest, tt as SkillInstallSource, y as RenderResultRequest } from "./types-4pg-qp_I-Gq63X8Oa.js";
-import { A as FsArtifactStore, Ct as ScriptExecutionContext, J as NetworkPolicy, St as SchemaInferer, Ut as ToolResult, Vt as ToolDefinition, _ as BridgeCapabilities, f as ApprovalScope, fn as createScriptContext, j as FsMemoryStore, on as WebSkillRuntime, sn as WebSkillRuntimeDeps, wt as ScriptExecutor } from "./index-C-KFAZoF.js";
-import { a as AuditLog, p as CandidateStore, r as ApprovalPolicy, u as CandidateSkill, v as SkillVersionStore } from "./skillVersionStore-BzLbzFOL-CxdAFWO2.js";
+import { A as ArchiveLimits, F as FileStat, G as SKILLS_LOCKFILE, I as FileSystemProvider, K as SKILL_MANIFEST_FILE, R as JsonSchema, Z as SignatureAuditSink, _t as UnsignedPolicy, c as InteractionResponse, ht as TrustedKeyStore, ot as SkillManagerPort, pt as SkillsLockfile, rt as SkillInstallSource, s as InteractionRequest, st as SkillManifest, x as UiBridge, y as RenderResultRequest, yt as VerifyResult } from "./types-CcxRLdJG-DCXyw1US.js";
+import { Et as ScriptExecutor, Kt as ToolResult, M as FsMemoryStore, Tt as ScriptExecutionContext, Wt as ToolDefinition, Y as NetworkPolicy, _ as BridgeCapabilities, f as ApprovalScope, hn as createScriptContext, j as FsArtifactStore, ln as WebSkillRuntime, un as WebSkillRuntimeDeps, wt as SchemaInferer } from "./index-DkbABR43.js";
+import { a as AuditLog, p as CandidateStore, r as ApprovalPolicy, u as CandidateSkill, v as SkillVersionStore } from "./skillVersionStore-Bl-ElD45-CWPvGvoq.js";
 import { n as LlmEnvConfig, s as probeLlmCapabilities, t as LlmCapabilities } from "./env-AK3cSMEA-Dli6QU5E.js";
 import { Readable, Writable } from "node:stream";
 //#region ../node/dist/index.d.ts

package/dist/node.js

@@ -1,6 +1,7 @@
 import { A as parseSkillMarkdown, B as unzipWithLimits, H as verifyManifest, I as resolveArchiveLimits, L as resolveInsideRoot, M as readResponseWithLimit, N as readSkillSignature, O as messageOf, T as isValidSkillName, U as verifySkillSignature, V as validateSkills, _ as atomicWriteText, g as assertSafePathSegment, h as assertRemoteUrlAllowed, j as parseSkillPackManifest, m as WebSkillError, o as SKILLS_LOCKFILE, r as MANIFEST_EXCLUDED_FILES, s as SKILL_MANIFEST_FILE, u as SKILL_PACK_FILE, w as exportSkills, y as buildManifest } from "./dist-8oQRa8Xz.js";
-import { I as WebSkillRuntime, V as createScriptContext, at as normalizeToolContent, c as CapabilityApproval, m as FsMemoryStore, nt as networkPolicyLibSource, ot as normalizeToolError, p as FsArtifactStore, st as parseBridgeRequest, z as bridgeError } from "./dist-DusANsrn.js";
+import { B as bridgeError, H as createScriptContext, L as WebSkillRuntime, c as CapabilityApproval, ct as normalizeToolError, h as FsMemoryStore, it as networkPolicyLibSource, lt as parseBridgeRequest, m as FsArtifactStore, st as normalizeToolContent } from "./dist-D0qW6e40.js";
 import { i as probeLlmCapabilities } from "./env-8cY40DXB-CGnEVZby.js";
+import { t as AUDIT_EVENT_TYPES } from "./eventTypes-DjIQpt8Y-Bj3vghj4.js";
 import { createRequire } from "node:module";
 import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, realpathSync } from "node:fs";
@@ -2259,7 +2260,7 @@ var ApprovalWorkflow = class {
 			});
 			await this.#store.updateStatus(candidateId, "published");
 			await this.#audit.append({
-				type: "skill.published",
+				type: AUDIT_EVENT_TYPES.skillPublished,
 				target: candidate.name,
 				actor: input.actor,
 				data: {

package/dist/{openUiLibrary-Bdrji9qK-DzAxRlTY.js → openUiLibrary-Bdrji9qK-D2LxmM-a.js}

@@ -1,5 +1,5 @@
 import { nt as uiCatalog } from "./dist-DnYG2-eY.js";
-import { t as CatalogNode } from "./catalogComponents-Dr5dFMAb-Dacibl1e.js";
+import { t as CatalogNode } from "./catalogComponents-Dr5dFMAb-DKH_7VPI.js";
 import { z } from "zod";
 import { Component, Fragment, createContext, useCallback, useContext, useEffect, useInsertionEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";

package/dist/{skillVersionStore-BzLbzFOL-CxdAFWO2.d.ts → skillVersionStore-Bl-ElD45-CWPvGvoq.d.ts}

@@ -1,5 +1,5 @@
-import { B as PageQuery, P as FileSystemProvider, Q as SkillCatalogEntry, at as SkillManifest, z as Page } from "./types-4pg-qp_I-Gq63X8Oa.js";
-//#region ../governance/dist/skillVersionStore-BzLbzFOL.d.ts
+import { H as PageQuery, I as FileSystemProvider, V as Page, et as SkillCatalogEntry, st as SkillManifest } from "./types-CcxRLdJG-DCXyw1US.js";
+//#region ../governance/dist/skillVersionStore-Bl-ElD45.d.ts
 //#region src/types.d.ts
 type CandidateStatus = 'draft' | 'pending-review' | 'approved' | 'published' | 'rejected';
 /** `generated` 是 0.5.0 的技能自动生成来源（需求 12 号 AC-9.1） */
@@ -49,6 +49,12 @@ interface AuditQueryFilter {
   since?: string;
   /** 含端点（`ts <= until`） */
   until?: string;
+  /**
+   * true 时链校验失败不抛错，改为在结果里报告断点（`chainBrokenAt` / `chainReason`）。
+   * **仅用于人工查看的降级展示**：程序化消费方（合规导出等）拿到部分结果而不知情
+   * 比直接失败更危险。默认 false，保持既有行为。
+   */
+  tolerateBrokenChain?: boolean;
 }
 interface AuditLog {
   append(event: Omit<AuditEvent, 'id' | 'ts'> & {

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { _ as MemoryStore, b as UiBridge, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput } from "./types-4pg-qp_I-Gq63X8Oa.js";
+import { _ as MemoryStore, c as InteractionResponse, l as LlmClient, m as LlmStreamEvent, n as ArtifactStore, p as LlmResponse, s as InteractionRequest, t as Artifact, u as LlmCompleteInput, x as UiBridge } from "./types-CcxRLdJG-DCXyw1US.js";
 import { a as loadGoogleConfigFromEnv, i as loadAnthropicConfigFromEnv, n as LlmEnvConfig, o as loadLlmConfigFromEnv, r as ProviderEnvConfig } from "./env-AK3cSMEA-Dli6QU5E.js";
 //#region ../runtime/dist/testing.d.ts
 //#region src/llm/mockLlmClient.d.ts

package/dist/{types-4pg-qp_I-Gq63X8Oa.d.ts → types-CcxRLdJG-DCXyw1US.d.ts}

@@ -1,6 +1,6 @@
 //#region ../core/dist/index.d.ts
 //#region src/errors.d.ts
-type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_NOT_ALLOWED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'TOOL_RESOLUTION_EXHAUSTED' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'SKILL_UNKNOWN_ALLOWED_TOOL' | 'SKILL_UNKNOWN_DEPENDENCY' | 'SKILL_CIRCULAR_DEPENDENCY' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE' | 'RUN_SNAPSHOT_SCHEMA_UNSUPPORTED' | 'RUN_TRACE_INCOMPATIBLE' | 'SESSION_INCOMPATIBLE' | 'SIGNATURE_MISSING' | 'SIGNATURE_MALFORMED' | 'SIGNATURE_UNTRUSTED_KEY' | 'SIGNATURE_MISMATCH' | 'SIGNATURE_UNSUPPORTED' | 'MCP_STDIO_SPAWN_FAILED' | 'MCP_STDIO_EXITED' | 'MCP_STDIO_TIMEOUT' | 'TS_RESOURCE_URL_REJECTED' | 'TS_TRANSPILER_UNAVAILABLE' | 'TS_TRANSPILE_FAILED' | 'TODO_LIST_INVALID' | 'TODO_ITEM_NOT_FOUND' | 'SKILL_GENERATION_DISABLED' | 'SKILL_GENERATION_LIMIT_EXCEEDED' | 'SKILL_GENERATION_VALIDATION_FAILED' | 'DELEGATION_UNAVAILABLE' | 'DELEGATION_IN_PROGRESS' | 'DELEGATION_BUDGET_EXCEEDED' | 'PROFILE_IMPORT_INVALID' | 'PROFILE_IMPORT_VERSION_UNSUPPORTED' | 'PROFILE_IMPORT_CREDENTIAL_REJECTED' | 'PROFILE_KEY_UNAVAILABLE' | 'DICTATION_UNAVAILABLE' | 'DICTATION_PERMISSION_DENIED' | 'DICTATION_FAILED' | 'PERCEPTION_NOT_ENABLED' | 'PERCEPTION_FAILED' | 'MODEL_IMAGE_UNSUPPORTED' | 'MODEL_TOOLS_UNSUPPORTED' | 'ATTACHMENT_TOO_LARGE' | 'ATTACHMENT_TYPE_REJECTED';
+type WebSkillErrorCode = 'FS_NOT_FOUND' | 'FS_PATH_OUTSIDE_ROOT' | 'SKILL_NOT_FOUND' | 'SKILL_INVALID_METADATA' | 'SKILL_INVALID_NAME' | 'SKILL_DUPLICATE_NAME' | 'SKILL_UNSUPPORTED_SCRIPT' | 'VALIDATION_FAILED' | 'TOOL_NOT_FOUND' | 'TOOL_EXECUTION_FAILED' | 'NETWORK_BLOCKED' | 'TOOL_UNSUPPORTED' | 'TOOL_NOT_ALLOWED' | 'TOOL_SCHEMA_UNAVAILABLE' | 'TOOL_RESOLUTION_EXHAUSTED' | 'RUN_TIMEOUT' | 'RUN_MAX_TURNS_EXCEEDED' | 'RUN_FAILED' | 'RUN_CANCELLED' | 'RUN_INTERACTION_TIMEOUT' | 'UI_UNAVAILABLE' | 'LLM_UNAVAILABLE' | 'LLM_REQUEST_FAILED' | 'INSTALL_FAILED' | 'UNINSTALL_FAILED' | 'EXPORT_FAILED' | 'INTEGRITY_FAILED' | 'FS_PERMISSION_DENIED' | 'MCP_ENDPOINT_UNAVAILABLE' | 'MCP_TOOL_NOT_FOUND' | 'CANDIDATE_INVALID' | 'APPROVAL_REQUIRED' | 'SKILL_QUARANTINED' | 'SKILL_DISABLED' | 'SKILL_UNKNOWN_ALLOWED_TOOL' | 'SKILL_UNKNOWN_DEPENDENCY' | 'SKILL_CIRCULAR_DEPENDENCY' | 'GOVERNANCE_FAILED' | 'RUN_SNAPSHOT_NOT_FOUND' | 'RUN_SNAPSHOT_EXPIRED' | 'RUN_SNAPSHOT_INCOMPATIBLE' | 'RUN_SNAPSHOT_SCHEMA_UNSUPPORTED' | 'RUN_TRACE_INCOMPATIBLE' | 'SESSION_INCOMPATIBLE' | 'SIGNATURE_MISSING' | 'SIGNATURE_MALFORMED' | 'SIGNATURE_UNTRUSTED_KEY' | 'SIGNATURE_MISMATCH' | 'SIGNATURE_UNSUPPORTED' | 'MCP_STDIO_SPAWN_FAILED' | 'MCP_STDIO_EXITED' | 'MCP_STDIO_TIMEOUT' | 'MCP_OAUTH_REQUIRED' | 'MCP_OAUTH_FAILED' | 'MCP_OAUTH_NOT_CONFIGURED' | 'PAGE_ACTION_OUT_OF_SCOPE' | 'PAGE_ACTION_STALE_REF' | 'PAGE_ACTION_DECLINED' | 'TS_RESOURCE_URL_REJECTED' | 'TS_TRANSPILER_UNAVAILABLE' | 'TS_TRANSPILE_FAILED' | 'TODO_LIST_INVALID' | 'TODO_ITEM_NOT_FOUND' | 'SKILL_GENERATION_DISABLED' | 'SKILL_GENERATION_LIMIT_EXCEEDED' | 'SKILL_GENERATION_VALIDATION_FAILED' | 'DELEGATION_UNAVAILABLE' | 'DELEGATION_IN_PROGRESS' | 'DELEGATION_BUDGET_EXCEEDED' | 'PROFILE_IMPORT_INVALID' | 'PROFILE_IMPORT_VERSION_UNSUPPORTED' | 'PROFILE_IMPORT_CREDENTIAL_REJECTED' | 'PROFILE_KEY_UNAVAILABLE' | 'DICTATION_UNAVAILABLE' | 'DICTATION_PERMISSION_DENIED' | 'DICTATION_FAILED' | 'PERCEPTION_NOT_ENABLED' | 'PERCEPTION_FAILED' | 'MODEL_IMAGE_UNSUPPORTED' | 'MODEL_TOOLS_UNSUPPORTED' | 'ATTACHMENT_TOO_LARGE' | 'ATTACHMENT_TYPE_REJECTED';
 /**
  * 所有公开 API 抛出的结构化错误，code 供上层可编程处理
  * @stable
@@ -582,7 +582,7 @@ declare function escapeXml(text: string): string;
 declare function renderAvailableSkillsXml(catalog: SkillCatalog): string;
 declare const xmlRenderer: CatalogRenderer;
 //#endregion
-//#region ../runtime/dist/types-4pg-qp_I.d.ts
+//#region ../runtime/dist/types-CcxRLdJG.d.ts
 //#region src/llm/streamTypes.d.ts
 /** 流式 LLM 事件（OpenAI SSE / Vercel fullStream 统一映射） */
 type LlmStreamEvent = {
@@ -681,6 +681,25 @@ interface ArtifactStore {
   listArtifacts(runId: string): Promise<Artifact[]>;
 }
 //#endregion
+//#region src/skillGeneration/candidateMarker.d.ts
+/**
+ * 一个已提交待审批的技能候选。字段固定为 `{ id, name }`——
+ * 这条通道只用来把候选交接给界面，扩字段要走 AC-G12 登记。
+ * @experimental
+ */
+interface SkillCandidateMarker {
+  id: string;
+  name: string;
+}
+/**
+ * `$skillCandidate` 约定的形状校验：JSON content 的 data 含合法 `$skillCandidate` 键 → 候选载荷。
+ *
+ * 与 `$chart` / `$todo` / `$surface` 同一条既有通道，是第四个。
+ * 候选的生成与存储全部在 `@webskill/agent`，runtime 只认这个形状，畸形忽略不炸。
+ * @experimental
+ */
+declare function extractSkillCandidate(data: unknown): SkillCandidateMarker | undefined;
+//#endregion
 //#region src/interaction/types.d.ts
 /**
  * 交互的发起方标识（FR-11.6）。串行委派下父 agent 与子 agent 都能发起交互，
@@ -743,7 +762,7 @@ type InteractionRequest = {
    */
   type: 'authorize';
   id: string;
-  capability: 'readReference' | 'writeArtifact' | 'confirm';
+  capability: 'readReference' | 'writeArtifact' | 'confirm' | 'pageAction';
   message: string;
   details?: unknown;
 });
@@ -801,6 +820,12 @@ interface RenderResultRequest {
   summary?: string;
   blocks: RenderBlock[];
   artifacts?: Artifact[];
+  /**
+   * 引擎注入的「最终输出」markdown block 在 `blocks` 中的下标；未注入时缺省。
+   * 消费方据此剔除与消息正文重复的那一块，**不得改用正文字符串比较**。
+   * 技能作者自己产出的 block 不在此字段的范围内。
+   */
+  outputBlockIndex?: number;
 }
 /** A user action exposed by a generative UI surface. @experimental */
 interface UiSpecActionCapability {
@@ -894,6 +919,8 @@ interface UiBridge {
   requestSurfaceAction?(input: UiSurfaceActionRequest): Promise<UiSurfaceActionResponse>;
   /** Best-effort cleanup when a surface action wait times out or is cancelled. @experimental */
   cancelSurfaceAction?(nonce: string): void | Promise<void>;
+  /** 已提交待审批的技能候选（`$skillCandidate` 载荷）；未实现时候选只存在于工具返回值里。 @experimental */
+  onSkillCandidate?(runId: string, candidate: SkillCandidateMarker): void | Promise<void>;
   /** 流式文本增量（流式 LLM 路径下由 AgentLoop 转发） */
   onTextDelta?(runId: string, delta: string): Promise<void> | void;
 }
@@ -942,4 +969,4 @@ interface MemoryStore {
   transaction?<T>(scope: string, fn: (inner: MemoryStore) => Promise<T>): Promise<T>;
 }
 //#endregion
-export { SkillDiscovery as $, CryptoKeyLike as A, isValidSkillName as At, PageQuery as B, renderCatalogJson as Bt, UiSpecEvent as C, buildCatalog as Ct, UiSurfaceActionResponse as D, computeDigest as Dt, UiSurfaceActionRequest as E, checkSkillRules as Et, FsTrustedKeyStore as F, parseSkillMarkdown as Ft, SKILL_NAME_MAX_LENGTH as G, unzipWithLimits as Gt, SIGNATURE_SCHEMA_VERSION as H, resolveInsideRoot as Ht, JsonSchema as I, parseSkillPackManifest as It, SKILL_SIGNATURE_FILE as J, verifySkillSignature as Jt, SKILL_NAME_PATTERN as K, validateSkills as Kt, MANIFEST_EXCLUDED_FILES as L, readResponseWithLimit as Lt, DiscoveryResult as M, keyIdOf as Mt, FileStat as N, messageOf as Nt, ArchiveLimits as O, escapeXml as Ot, FileSystemProvider as P, normalizePath as Pt, SkillCatalogEntry as Q, MemoryFS as R, readSkillSignature as Rt, UiSpecDrafts as S, atomicWriteText as St, UiSpecSnapshot as T, checkDependencyCycles as Tt, SKILLS_LOCKFILE as U, signSkill as Ut, RemoteUrlPolicy as V, resolveArchiveLimits as Vt, SKILL_MANIFEST_FILE as W, signaturePayloadBytes as Wt, SignatureVerdict as X, SignatureAuditSink as Y, xmlRenderer as Yt, SkillCatalog as Z, MemoryStore as _, VerifyResult as _t, InteractionOrigin as a, SkillManifest as at, UiBridge as b, assertRemoteUrlAllowed as bt, InteractionResponse as c, SkillReader as ct, LlmContentPart as d, SkillsLockfile as dt, SkillDocument as et, LlmMessage as f, TrustedKey as ft, LlmToolSpec as g, ValidationReport as gt, LlmToolCall as h, UnsignedPolicy as ht, FormField as i, SkillManagerPort as it, DEFAULT_ARCHIVE_LIMITS as j, jsonRenderer as jt, CatalogRenderer as k, exportSkills as kt, LlmClient as l, SkillSignature as lt, LlmStreamEvent as m, UiSpecNode as mt, ArtifactStore as n, SkillIssue as nt, InteractionPolicy as o, SkillMetadata as ot, LlmResponse as p, TrustedKeyStore as pt, SKILL_PACK_FILE as q, verifyManifest as qt, ChartSpec as r, SkillLocation as rt, InteractionRequest as s, SkillPackManifest as st, Artifact as t, SkillInstallSource as tt, LlmCompleteInput as u, SkillSource as ut, RenderBlock as v, WebSkillError as vt, UiSpecPatch as w, buildManifest as wt, UiSpecActionCapability as x, assertSafePathSegment as xt, RenderResultRequest as y, WebSkillErrorCode as yt, Page as z, renderAvailableSkillsXml as zt };
+export { SkillCatalog as $, ArchiveLimits as A, escapeXml as At, MemoryFS as B, readSkillSignature as Bt, UiSpecDrafts as C, assertSafePathSegment as Ct, UiSurfaceActionRequest as D, checkDependencyCycles as Dt, UiSpecSnapshot as E, buildManifest as Et, FileStat as F, messageOf as Ft, SKILLS_LOCKFILE as G, signSkill as Gt, PageQuery as H, renderCatalogJson as Ht, FileSystemProvider as I, normalizePath as It, SKILL_NAME_PATTERN as J, validateSkills as Jt, SKILL_MANIFEST_FILE as K, signaturePayloadBytes as Kt, FsTrustedKeyStore as L, parseSkillMarkdown as Lt, CryptoKeyLike as M, isValidSkillName as Mt, DEFAULT_ARCHIVE_LIMITS as N, jsonRenderer as Nt, UiSurfaceActionResponse as O, checkSkillRules as Ot, DiscoveryResult as P, keyIdOf as Pt, SignatureVerdict as Q, JsonSchema as R, parseSkillPackManifest as Rt, UiSpecActionCapability as S, assertRemoteUrlAllowed as St, UiSpecPatch as T, buildCatalog as Tt, RemoteUrlPolicy as U, resolveArchiveLimits as Ut, Page as V, renderAvailableSkillsXml as Vt, SIGNATURE_SCHEMA_VERSION as W, resolveInsideRoot as Wt, SKILL_SIGNATURE_FILE as X, verifySkillSignature as Xt, SKILL_PACK_FILE as Y, verifyManifest as Yt, SignatureAuditSink as Z, xmlRenderer as Zt, MemoryStore as _, UnsignedPolicy as _t, InteractionOrigin as a, SkillLocation as at, SkillCandidateMarker as b, WebSkillError as bt, InteractionResponse as c, SkillMetadata as ct, LlmContentPart as d, SkillSignature as dt, SkillCatalogEntry as et, LlmMessage as f, SkillSource as ft, LlmToolSpec as g, UiSpecNode as gt, LlmToolCall as h, TrustedKeyStore as ht, FormField as i, SkillIssue as it, CatalogRenderer as j, exportSkills as jt, extractSkillCandidate as k, computeDigest as kt, LlmClient as l, SkillPackManifest as lt, LlmStreamEvent as m, TrustedKey as mt, ArtifactStore as n, SkillDocument as nt, InteractionPolicy as o, SkillManagerPort as ot, LlmResponse as p, SkillsLockfile as pt, SKILL_NAME_MAX_LENGTH as q, unzipWithLimits as qt, ChartSpec as r, SkillInstallSource as rt, InteractionRequest as s, SkillManifest as st, Artifact as t, SkillDiscovery as tt, LlmCompleteInput as u, SkillReader as ut, RenderBlock as v, ValidationReport as vt, UiSpecEvent as w, atomicWriteText as wt, UiBridge as x, WebSkillErrorCode as xt, RenderResultRequest as y, VerifyResult as yt, MANIFEST_EXCLUDED_FILES as z, readResponseWithLimit as zt };

package/dist/ui-react.d.ts

@@ -1,5 +1,5 @@
-import { C as UiSpecEvent, D as UiSurfaceActionResponse, E as UiSurfaceActionRequest, S as UiSpecDrafts, T as UiSpecSnapshot, b as UiBridge, c as InteractionResponse, mt as UiSpecNode, s as InteractionRequest, x as UiSpecActionCapability, y as RenderResultRequest } from "./types-4pg-qp_I-Gq63X8Oa.js";
-import { b as InteractionSpecLabels } from "./index-BMocOEi0.js";
+import { C as UiSpecDrafts, D as UiSurfaceActionRequest, E as UiSpecSnapshot, O as UiSurfaceActionResponse, S as UiSpecActionCapability, c as InteractionResponse, gt as UiSpecNode, s as InteractionRequest, w as UiSpecEvent, x as UiBridge, y as RenderResultRequest } from "./types-CcxRLdJG-DCXyw1US.js";
+import { b as InteractionSpecLabels } from "./index-BwsK9lGk.js";
 import { z } from "zod";
 import { ComponentType, ReactNode } from "react";
 import "react/jsx-runtime";
@@ -410,6 +410,8 @@ interface NativeSpecSurfaceProps {
     surfaceId: string;
     value: Record<string, unknown>;
   }): void;
+  /** 宿主已提供卡片外壳时传 `'none'`，避免嵌套两层卡片。缺省 `'card'`。 */
+  shell?: 'card' | 'none';
 }
 /**
  * Native 档的 catalog registry：把声明树渲染成 ui-kit 组件。
@@ -418,7 +420,7 @@ interface NativeSpecSurfaceProps {
  * 表单行为（草稿跨刷新、必填拦截、默认值）由本组件承接——
  * 节点树取代六类 surface 后，这里是 native 档唯一的渲染实现。
  */
-declare function NativeSpecSurface({ surfaceId, spec, actions, registry, runId, draft, onAction, onDraftChange }: NativeSpecSurfaceProps): import("react").JSX.Element;
+declare function NativeSpecSurface({ surfaceId, spec, actions, registry, runId, draft, onAction, onDraftChange, shell }: NativeSpecSurfaceProps): import("react").JSX.Element;
 //#endregion
 //#region src/catalog/JsonRenderSpecSurface.d.ts
 interface JsonRenderSpecSurfaceProps {

package/dist/ui-react.js

@@ -1,8 +1,8 @@
 import { r as __exportAll$1 } from "./rolldown-runtime-BOF7iYI8.js";
 import { m as WebSkillError } from "./dist-8oQRa8Xz.js";
-import { Ct as validateUiSpecEvent, wt as validateUiSpecNode } from "./dist-DusANsrn.js";
+import { Et as validateUiSpecNode, Tt as validateUiSpecEvent } from "./dist-D0qW6e40.js";
 import { B as toOpenUiSpecLang, I as shapeInteractionValue, O as interactionToFormModel, P as renderMiniChart, Q as chartSpecFromProps, g as applySuggestion, k as interactionToUiSpec, nt as uiCatalog, tt as renderMiniMarkdown, x as collectValues, z as toJsonRenderSpec } from "./dist-DnYG2-eY.js";
-import { C as Input, S as DropdownMenuTrigger, T as Separator, _ as Checkbox, a as SpecProgress, b as DropdownMenuCheckboxItem, c as SurfaceButton, d as catalogComponentImpls, f as str, g as Button, h as Badge, i as SpecGrid, l as SurfaceField, m as useSurfaceForm, n as CatalogSurfaceProvider, o as SpecTabs, p as useCatalogSurfaceForm, r as EChart, s as SpecTimeline, u as SurfaceFormButtons, v as DataTable, w as Markdown, x as DropdownMenuContent, y as DropdownMenu } from "./catalogComponents-Dr5dFMAb-Dacibl1e.js";
+import { C as Markdown, S as Input, _ as DataTable, a as SpecProgress, b as DropdownMenuContent, c as SurfaceButton, d as catalogComponentImpls, f as str, g as Button, h as Badge, i as SpecGrid, l as SurfaceField, m as useSurfaceForm, n as CatalogSurfaceProvider, o as SpecTabs, p as useCatalogSurfaceForm, r as EChart, s as SpecTimeline, u as SurfaceFormButtons, v as DropdownMenu, w as Separator, x as DropdownMenuTrigger, y as DropdownMenuCheckboxItem } from "./catalogComponents-Dr5dFMAb-DKH_7VPI.js";
 import { z } from "zod";
 import * as React$1 from "react";
 import React, { createContext, useCallback, useContext, useEffect, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
@@ -6912,7 +6912,7 @@ function StreamingText({ bridge }) {
 	});
 }
 /**
-* catalog `Table` 节点的渲染实现：排序 / 筛选 / 分页 / 列显隐 / 行选择 / 虚拟滚动。
+* catalog `Table` 节点的渲染实现：排序 / 筛选 / 分页 / 列显隐 / 虚拟滚动。
 * 这些是宿主侧的呈现能力，不进 catalog props——模型只声明 columns 与 rows。
 * 它们都带 `data-webskill-host-control`，跨渲染器语义对括据此排除宿主控件。
 */
@@ -6920,40 +6920,22 @@ function SpecTable({ columns, rows, label }) {
 	const [sorting, setSorting] = useState([]);
 	const [globalFilter, setGlobalFilter] = useState("");
 	const [columnVisibility, setColumnVisibility] = useState({});
-	const [rowSelection, setRowSelection] = useState({});
 	const scrollRef = useRef(null);
 	const table = useReactTable({
 		data: rows,
-		columns: [{
-			id: "selection",
-			header: ({ table }) => /* @__PURE__ */ jsx(Checkbox, {
-				"aria-label": "Select all rows",
-				checked: table.getIsSomePageRowsSelected() ? "indeterminate" : table.getIsAllPageRowsSelected(),
-				onCheckedChange: (checked) => table.toggleAllPageRowsSelected(checked === true)
-			}),
-			cell: ({ row }) => /* @__PURE__ */ jsx(Checkbox, {
-				"aria-label": `Select row ${row.index + 1}`,
-				checked: row.getIsSelected(),
-				onCheckedChange: (checked) => row.toggleSelected(checked === true)
-			}),
-			enableSorting: false,
-			enableHiding: false
-		}, ...columns.map((header, index) => ({
+		columns: columns.map((header, index) => ({
 			id: `column-${index}`,
 			header,
 			accessorFn: (row) => row[index]
-		}))],
+		})),
 		state: {
 			sorting,
 			globalFilter,
-			columnVisibility,
-			rowSelection
+			columnVisibility
 		},
 		onSortingChange: setSorting,
 		onGlobalFilterChange: setGlobalFilter,
 		onColumnVisibilityChange: setColumnVisibility,
-		onRowSelectionChange: setRowSelection,
-		enableRowSelection: true,
 		globalFilterFn: (row, _columnId, filterValue) => row.original.some((cell) => String(cell ?? "").toLocaleLowerCase().includes(String(filterValue).toLocaleLowerCase())),
 		getCoreRowModel: getCoreRowModel(),
 		getFilteredRowModel: getFilteredRowModel(),
@@ -7221,7 +7203,7 @@ function renderNode(node, context, key, scope) {
 * 表单行为（草稿跨刷新、必填拦截、默认值）由本组件承接——
 * 节点树取代六类 surface 后，这里是 native 档唯一的渲染实现。
 */
-function NativeSpecSurface({ surfaceId, spec, actions, registry, runId, draft, onAction, onDraftChange }) {
+function NativeSpecSurface({ surfaceId, spec, actions, registry, runId, draft, onAction, onDraftChange, shell = "card" }) {
 	const context = {
 		...useSurfaceForm({
 			surfaceId,
@@ -7242,7 +7224,7 @@ function NativeSpecSurface({ surfaceId, spec, actions, registry, runId, draft, o
 		children: ["Invalid UI spec: ", validation.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")]
 	});
 	return /* @__PURE__ */ jsx("div", {
-		className: "webskill-surface webskill-surface--spec",
+		className: shell === "none" ? "webskill-surface--spec" : "webskill-surface webskill-surface--spec",
 		"data-testid": "native-spec-surface",
 		children: renderNode(spec, context, "root")
 	});
@@ -7536,7 +7518,7 @@ function OpenUiSpecSurface({ spec, surfaceId, actions, onAction }) {
 	const [unavailable, setUnavailable] = useState(false);
 	useEffect(() => {
 		let cancelled = false;
-		import("./openUiLibrary-Bdrji9qK-DzAxRlTY.js").then((loaded) => {
+		import("./openUiLibrary-Bdrji9qK-D2LxmM-a.js").then((loaded) => {
 			if (!cancelled) setModule(loaded);
 		}).catch(() => {
 			if (!cancelled) setUnavailable(true);

package/dist/ui-vue.d.ts

@@ -1,4 +1,4 @@
-import { b as UiBridge, c as InteractionResponse, s as InteractionRequest, y as RenderResultRequest } from "./types-4pg-qp_I-Gq63X8Oa.js";
+import { c as InteractionResponse, s as InteractionRequest, x as UiBridge, y as RenderResultRequest } from "./types-CcxRLdJG-DCXyw1US.js";
 import { PropType } from "vue";
 //#region ../ui-vue/dist/index.d.ts
 //#region src/bridgeState.d.ts