dsh-comfyui 0.4.0 → 0.5.1

package/lib/analyze.d.ts

@@ -20,7 +20,9 @@ export interface GraphGroupLike {
 }
 export interface GraphLike {
     nodes: GraphNodeLike[];
-    links: Array<[number, number, number, number, number, string] | number[]>;
+    /** Saved rows are positional or object entries depending on the frontend
+     * version — always consumed through {@link normalizeLinks}. */
+    links: unknown[];
     groups?: GraphGroupLike[];
 }
 export interface IsolatedNode {

package/lib/analyze.js

@@ -5,6 +5,7 @@
  * graph links (with bypassed and dangling nodes excluded). The analysis feeds
  * the extract (拆分) choices in the panel and the agent-facing skill.
  */
+import { normalizeLinks } from './graph.js';
 function isObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -27,7 +28,7 @@ export function analyzeGraph(graph) {
         return { ok: false, error: '无法解析图文件（缺少 nodes/links）' };
     }
     const nodes = graph.nodes;
-    const links = graph.links;
+    const links = normalizeLinks(graph.links);
     const groups = Array.isArray(graph.groups) ? graph.groups : [];
     const active = nodes.filter((node) => node.mode !== 4);
     const activeById = new Map(active.map((node) => [node.id, node]));

package/lib/convert.d.ts

@@ -1,12 +1,3 @@
-/**
- * Convert a ComfyUI UI-graph workflow (the format the ComfyUI frontend saves
- * to the server via /api/userdata) into the API format accepted by POST
- * /prompt. Modeled on the frontend's convertToApiFormat: input links become
- * [nodeId, slot] references, widgets_values are zipped onto input names in
- * object_info order (control_after_generate is the extra seed widget), and
- * Reroute / bypassed (mode 4) nodes are skipped with their links rewired.
- * Nodes the conversion cannot represent fail loudly with the offending type.
- */
 export interface ApiWorkflow {
     [nodeId: string]: {
         class_type: string;

package/lib/convert.js

@@ -1,3 +1,13 @@
+/**
+ * Convert a ComfyUI UI-graph workflow (the format the ComfyUI frontend saves
+ * to the server via /api/userdata) into the API format accepted by POST
+ * /prompt. Modeled on the frontend's convertToApiFormat: input links become
+ * [nodeId, slot] references, widgets_values are zipped onto input names in
+ * object_info order (control_after_generate is the extra seed widget), and
+ * Reroute / bypassed (mode 4) nodes are skipped with their links rewired.
+ * Nodes the conversion cannot represent fail loudly with the offending type.
+ */
+import { normalizeLinks } from './graph.js';
 /** Node types that exist only in the UI and carry no data flow. */
 const UI_ONLY = new Set(['Note', 'StickyNote', 'Reroute', 'Fast Groups Bypasser (rgthree)']);
 function isObject(value) {
@@ -195,13 +205,11 @@ export function convertGraphToApi(graph, objectInfo, options) {
         };
     });
     const links = new Map();
-    for (const raw of rawLinks) {
-        if (!Array.isArray(raw) || raw.length < 6)
-            continue;
-        const link = raw;
-        if (typeof link[0] === 'number')
-            links.set(link[0], link);
-    }
+    // normalizeLinks accepts both the legacy positional rows and the v0.4
+    // frontend's object entries; anything unreadable is skipped, exactly like
+    // the old array-only guard did.
+    for (const link of normalizeLinks(rawLinks))
+        links.set(link[0], link);
     const nodesById = new Map(nodes.map((node) => [node.id, node]));
     const included = options?.includeNodeIds;
     const candidates = included !== undefined ? nodes.filter((node) => included.has(node.id)) : nodes;

package/lib/graph.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ComfyUI UI-graph link normalization. The frontend changed how saved graphs
+ * serialize the `links` array: rows used to be positional
+ * (`[id, originId, originSlot, targetId, targetSlot, type]`), while the v0.4
+ * frontend writes object entries
+ * (`{ id, origin_id, origin_slot, target_id, target_slot, type }`). Analysis
+ * and conversion both want one canonical shape, so both go through
+ * {@link normalizeLinks} before touching a graph.
+ */
+/** Canonical link row: [linkId, originId, originSlot, targetId, targetSlot, type]. */
+export type GraphLink = [number, number, number, number, number, string];
+/** Normalize one link entry; undefined when the entry is not a readable link. */
+export declare function normalizeLink(raw: unknown): GraphLink | undefined;
+/** Normalize a whole `links` array, skipping entries that are not readable. */
+export declare function normalizeLinks(raw: unknown): GraphLink[];

package/lib/graph.js

@@ -0,0 +1,48 @@
+/**
+ * ComfyUI UI-graph link normalization. The frontend changed how saved graphs
+ * serialize the `links` array: rows used to be positional
+ * (`[id, originId, originSlot, targetId, targetSlot, type]`), while the v0.4
+ * frontend writes object entries
+ * (`{ id, origin_id, origin_slot, target_id, target_slot, type }`). Analysis
+ * and conversion both want one canonical shape, so both go through
+ * {@link normalizeLinks} before touching a graph.
+ */
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Normalize one link entry; undefined when the entry is not a readable link. */
+export function normalizeLink(raw) {
+    if (Array.isArray(raw)) {
+        if (raw.length < 6)
+            return undefined;
+        const [id, origin, originSlot, target, targetSlot, type] = raw;
+        if (typeof id !== 'number' || typeof origin !== 'number' ||
+            typeof originSlot !== 'number' || typeof target !== 'number' ||
+            typeof targetSlot !== 'number') {
+            return undefined;
+        }
+        return [id, origin, originSlot, target, targetSlot, typeof type === 'string' ? type : ''];
+    }
+    if (isObject(raw)) {
+        const { id, origin_id: origin, origin_slot: originSlot, target_id: target, target_slot: targetSlot, type } = raw;
+        if (typeof id !== 'number' || typeof origin !== 'number' ||
+            typeof originSlot !== 'number' || typeof target !== 'number' ||
+            typeof targetSlot !== 'number') {
+            return undefined;
+        }
+        return [id, origin, originSlot, target, targetSlot, typeof type === 'string' ? type : ''];
+    }
+    return undefined;
+}
+/** Normalize a whole `links` array, skipping entries that are not readable. */
+export function normalizeLinks(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const links = [];
+    for (const entry of raw) {
+        const link = normalizeLink(entry);
+        if (link !== undefined)
+            links.push(link);
+    }
+    return links;
+}

package/lib/index.js

@@ -217,7 +217,9 @@ export async function apply(ctx, entryConfig) {
             const entries = await client.listUserData('workflows');
             const library = await store.listWorkflows();
             return entries
-                .filter((entry) => entry.type === 'file' && entry.name.endsWith('.json'))
+                // Dot entries are ComfyUI bookkeeping (e.g. `.index.json`), not graphs.
+                .filter((entry) => entry.type === 'file' && entry.name.endsWith('.json')
+                && entry.name.split(/[\\/]/).every((segment) => !segment.startsWith('.')))
                 .map((entry) => {
                 const derived = library.filter((workflow) => workflow.comfyuiFile === entry.name);
                 return {
@@ -319,7 +321,12 @@ export async function apply(ctx, entryConfig) {
     // service simply never registers it, and the entry config stands as composed.
     let source = () => resolved;
     ctx.inject(['settings'], (settingsCtx) => {
-        settingsCtx.settings.installSection(ctx, COMFYUI_NS, Config, resolved, {
+        const settings = settingsCtx.settings;
+        if (typeof settings.installSection !== 'function') {
+            ctx.logger.warn('comfyui: settings service lacks installSection — settings page stays read-only, entry config stands');
+            return;
+        }
+        settings.installSection(ctx, COMFYUI_NS, Config, resolved, {
             setSource: (current) => {
                 source = current;
             },

package/lib/routes.js

@@ -2,6 +2,7 @@ import { errorMessage, readJsonBody, readRawBody, sameOrigin, sendJson } from '.
 import { analyzeWorkflowParameters, comboChildInfo, inputOptions, numberSpecOf, refreshParameterMetadata, uploadKindOf } from './params.js';
 import { collectMedia, historyErrorMessage, mediaProxyUrl } from './comfyui.js';
 import { MAX_ASSET_BYTES, SKILL_MAIN, SKILL_PRESET_DIRS, joinFrontmatter, splitFrontmatter } from './skillpack.js';
+import { MAX_IMPORT_BYTES, analyzeImportPackage, applyImportPackage, buildExportPackage } from './transfer.js';
 import { unlink } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
@@ -936,6 +937,186 @@ export function mountComfyUIRoutes(ctx, runtime) {
             sendJson(response, 200, { ok: true });
         }),
     }));
+    // ── Workflow preset transfer (export / import) ──────────────────────────
+    // Export bundles selected library workflows (API format) with their
+    // parameters and skill packs into one .zip download; import parses an
+    // uploaded package and then writes the selection back as NEW workflows.
+    // The packaging, validation and pack writes live in transfer.ts — these
+    // routes only shape HTTP (same-origin, body cap, content types).
+    //
+    // The export body comes in two shapes on purpose: JSON `{ ids }` from a
+    // fetch caller, and an urlencoded form (`ids` repeated) from the panel's
+    // hidden-form submit — the panel downloads natively so the browser, not
+    // JS blob plumbing, owns the whole transfer.
+    //
+    // The native form download means the panel never sees the response body,
+    // so the facts of the last package ride back through `export/last`: the
+    // panel reads it right after submitting and reports what was ACTUALLY
+    // packaged, not what the checkboxes believed.
+    let lastExport = null;
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/export/last',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'GET')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            sendJson(response, 200, { last: lastExport });
+        }),
+    }));
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/export',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            let ids;
+            const contentType = String(request.headers['content-type'] ?? '');
+            if (contentType.includes('application/x-www-form-urlencoded')) {
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                    return;
+                }
+                const raw = await readRawBody(request);
+                ids = [...new URLSearchParams(raw.toString('utf8')).getAll('ids')];
+            }
+            else {
+                const body = await readSameOriginPost(request, response);
+                if (body === undefined)
+                    return;
+                ids = body.ids;
+            }
+            const result = await buildExportPackage(runtime, ids);
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            // Audit trail on purpose: download managers dedupe by URL, so "which
+            // file is which" became a live user question — the log answers it with
+            // the exact packaged set per request, and the receipt the panel shows
+            // carries the file name + size so a stale download can't masquerade as
+            // this export.
+            lastExport = { at: new Date().toISOString(), count: result.count, names: result.names, warnings: result.warnings, filename: result.filename, size: result.bytes.length };
+            ctx.logger.info(`comfyui: 导出 ${result.count} 个工作流 → ${result.filename}（${result.names.join('、')}）${result.warnings.length > 0 ? ` 警告：${result.warnings.join('；')}` : ''}`);
+            response.writeHead(200, {
+                'content-type': 'application/zip',
+                'content-length': String(result.bytes.length),
+                'cache-control': 'no-store',
+                // ASCII file name on purpose: it rides a Content-Disposition header
+                // without RFC 5987 encoding and stays readable on every OS.
+                'content-disposition': `attachment; filename="${result.filename}"`,
+            });
+            response.end(result.bytes);
+        }),
+    }));
+    // Native GET download: the file name rides IN the URL path. A download
+    // manager that derives the saved name from the URL, or re-fetches the URL
+    // itself, still lands on the correct name — and because the export is a
+    // pure read, on the genuine bytes for exactly these ids. This is the
+    // antidote to the intercepted-POST downloads that kept saving stale or
+    // renamed files on one setup (skills "sometimes missing" was those files).
+    // Exact routes above win for `/export` and `/export/last`; this prefix only
+    // sees `/export/<filename>`.
+    disposers.push(webServer.register({
+        kind: 'prefix',
+        path: '/comfyui/workflows/export',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'GET')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            const url = new URL(request.url ?? '/', 'http://localhost');
+            const filename = decodeURIComponent(url.pathname.slice('/comfyui/workflows/export/'.length));
+            // The name is client-supplied but strictly patterned: it only ever
+            // feeds a header value and the receipt, never a filesystem path.
+            if (!/^dsh-comfyui-presets-[0-9A-Za-z-]+\.zip$/.test(filename)) {
+                sendJson(response, 400, { error: 'bad export file name' });
+                return;
+            }
+            const result = await buildExportPackage(runtime, url.searchParams.getAll('ids'));
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            lastExport = { at: new Date().toISOString(), count: result.count, names: result.names, warnings: result.warnings, filename, size: result.bytes.length };
+            ctx.logger.info(`comfyui: 导出 ${result.count} 个工作流 → ${filename}（${result.names.join('、')}）${result.warnings.length > 0 ? ` 警告：${result.warnings.join('；')}` : ''}`);
+            response.writeHead(200, {
+                'content-type': 'application/zip',
+                'content-length': String(result.bytes.length),
+                'cache-control': 'no-store',
+                'content-disposition': `attachment; filename="${filename}"`,
+            });
+            response.end(result.bytes);
+        }),
+    }));
+    // Import is two-phase with zero server-side staging: analyze parses the
+    // uploaded bytes and lists what the package offers; apply re-reads the
+    // same bytes the client still holds and writes the selection. Selection
+    // travels by manifest index (stable, because the same bytes are parsed
+    // again), which avoids URL-encoding arbitrary package ids.
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/import/analyze',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            if (!sameOrigin(request)) {
+                sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                return;
+            }
+            const raw = await readRawBody(request);
+            if (raw.length > MAX_IMPORT_BYTES) {
+                sendJson(response, 413, { error: `预设包不能超过 ${Math.floor(MAX_IMPORT_BYTES / 1024 / 1024)} MB` });
+                return;
+            }
+            const result = analyzeImportPackage(raw);
+            if (!result.ok) {
+                sendJson(response, 400, { error: result.error });
+                return;
+            }
+            sendJson(response, 200, result);
+        }),
+    }));
+    disposers.push(webServer.register({
+        kind: 'exact',
+        path: '/comfyui/workflows/import/apply',
+        handler: withHint(async (request, response) => {
+            if (!methodIs(request, 'POST')) {
+                sendJson(response, 405, { error: 'method not allowed' });
+                return;
+            }
+            if (!sameOrigin(request)) {
+                sendJson(response, 403, { error: 'forbidden: same-origin requests only' });
+                return;
+            }
+            const url = new URL(request.url ?? '/', 'http://localhost');
+            const selected = (url.searchParams.get('select') ?? '')
+                .split(',')
+                .map((part) => Number.parseInt(part, 10))
+                .filter((index) => Number.isInteger(index) && index >= 0);
+            const raw = await readRawBody(request);
+            if (raw.length > MAX_IMPORT_BYTES) {
+                sendJson(response, 413, { error: `预设包不能超过 ${Math.floor(MAX_IMPORT_BYTES / 1024 / 1024)} MB` });
+                return;
+            }
+            try {
+                const result = await applyImportPackage(runtime, raw, selected);
+                if (!result.ok) {
+                    sendJson(response, 400, { error: result.error });
+                    return;
+                }
+                sendJson(response, 200, result);
+            }
+            catch (error) {
+                sendJson(response, 500, { error: errorMessage(error) });
+            }
+        }),
+    }));
     disposers.push(webServer.register({
         kind: 'exact',
         path: '/comfyui/workflows/run',

package/lib/skill.js

@@ -148,5 +148,6 @@ TTS-Audio-Suite（\`{comfyuiDir}/custom_nodes/tts_audio_suite\`）的"🎭 Chara
 - 面板"ComfyUI 端保存"分区列出每个图工作流：未提取显示"未提取"，已提取显示派生出的运行工作流列表。
 - 点**提取**：单分量直接拆；多分量弹出选项（分析报告 + 整体/按分量/主流程）。也可点**查看**看节点清单和 JSON。
 - 用户也可以不经过图，直接在插件库"新建工作流"粘贴 API JSON（或选择 .json 文件）作为运行工作流导入。
+- 工具栏"导出预设 / 导入预设"：导出把选中的运行工作流连同参数与技能包打包成一个 .zip 预设包；导入选中包内的工作流后**创建为新工作流**（重名自动加"（导入）"后缀），不会覆盖库里已有的工作流，技能包一并还原（超限文件会跳过并提示）。用户要换机 / 备份 / 分享工作流时引导用这对按钮。
 `,
 };

package/lib/skillpack.d.ts

@@ -16,9 +16,18 @@ export declare const MAX_FILE_BYTES: number;
 /** Imported binaries live in `assets/` and never enter the prompt as text, so
  * they get a larger budget than the documents the model reads verbatim. */
 export declare const MAX_ASSET_BYTES: number;
-/** A pack is documentation, not storage — these caps keep it that way. */
-export declare const MAX_PACK_FILES = 100;
+/** A pack is documentation, not storage — these caps keep it that way. The
+ * byte cap is the real storage guard; the file count only stops pathological
+ * noise, so it sits well above real bulk-copied packs (a ComfyUI music
+ * template library lands at 1000+ small .txt files and MUST survive a
+ * preset export → import round trip). */
+export declare const MAX_PACK_FILES = 2000;
 export declare const MAX_PACK_BYTES: number;
+/** Per-file size budget by extension: binaries never enter the prompt as
+ * text, so they get the larger budget wherever they live. Exported because
+ * the preset importer pre-filters oversized files per file (skip + warning)
+ * before handing the batch to {@link SkillPackStore.writeMany}. */
+export declare function sizeLimitOf(file: string): number;
 /** One file inside a pack. */
 export interface SkillFileInfo {
     /** Path relative to the pack root, always forward-slashed (`references/styles.md`). */
@@ -152,6 +161,16 @@ export declare class SkillPackStore {
      * can never bypass a limit the editor honours.
      */
     writeBytes(slug: string, path: string, bytes: Buffer): Promise<SkillPackResult<SkillPackInfo>>;
+    /** Bulk write for preset restore: ONE limit check for the whole batch
+     * instead of per-file enumeration. Per-file checks re-count the entire
+     * pack on every write, so restoring a 1000-file pack that way is O(n²)
+     * filesystem calls — a frozen-looking import for minutes. Grammar and
+     * per-file size limits are still enforced here; the batch is refused
+     * whole (the caller reports which file tripped), never written partially. */
+    writeMany(slug: string, entries: ReadonlyArray<{
+        path: string;
+        bytes: Buffer;
+    }>): Promise<SkillPackResult<SkillPackInfo>>;
     /** Read one file as raw bytes (the panel's image preview and downloads). */
     readBytes(slug: string, path: string): Promise<SkillPackResult<Buffer>>;
     /** Rename one file; SKILL.md is fixed and both sides are validated. */
@@ -247,6 +266,14 @@ export interface WorkflowSkillPacks {
         path: string;
         pack: WorkflowSkillPack;
     }>>;
+    /** Bulk restore path: every entry's `path` is already bucket-qualified
+     * (`references/x.txt` or `SKILL.md`). One limit check for the whole batch —
+     * see {@link SkillPackStore.writeMany} for why per-file checks are not
+     * good enough at 1000-file scale. */
+    importFiles(id: string, entries: ReadonlyArray<{
+        path: string;
+        bytes: Buffer;
+    }>): Promise<SkillPackResult<WorkflowSkillPack>>;
     writeFile(id: string, path: string, content: string): Promise<SkillPackResult<WorkflowSkillPack>>;
     renameFile(id: string, from: string, to: string): Promise<SkillPackResult<WorkflowSkillPack>>;
     deleteFile(id: string, path: string): Promise<SkillPackResult<WorkflowSkillPack>>;

package/lib/skillpack.js

@@ -23,7 +23,7 @@
  * follows.
  */
 import { mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
-import { isAbsolute, join, relative, resolve } from 'node:path';
+import { isAbsolute, dirname, join, relative, resolve } from 'node:path';
 /**
  * Sub-directories offered by default. These are suggestions, not a whitelist:
  * a pack may hold any directory whose name matches {@link DIR_NAME}, so a user
@@ -49,11 +49,25 @@ export const MAX_FILE_BYTES = 256 * 1024;
 /** Imported binaries live in `assets/` and never enter the prompt as text, so
  * they get a larger budget than the documents the model reads verbatim. */
 export const MAX_ASSET_BYTES = 4 * 1024 * 1024;
-/** A pack is documentation, not storage — these caps keep it that way. */
-export const MAX_PACK_FILES = 100;
+/** A pack is documentation, not storage — these caps keep it that way. The
+ * byte cap is the real storage guard; the file count only stops pathological
+ * noise, so it sits well above real bulk-copied packs (a ComfyUI music
+ * template library lands at 1000+ small .txt files and MUST survive a
+ * preset export → import round trip). */
+export const MAX_PACK_FILES = 2000;
 export const MAX_PACK_BYTES = 20 * 1024 * 1024;
-/** File names: letters, digits, CJK, dot, dash, underscore. No separators, no leading dot. */
-const FILE_NAME = /^[A-Za-z0-9_一-龥][A-Za-z0-9._一-龥-]{0,63}$/;
+/** Per-file size budget by extension: binaries never enter the prompt as
+ * text, so they get the larger budget wherever they live. Exported because
+ * the preset importer pre-filters oversized files per file (skip + warning)
+ * before handing the batch to {@link SkillPackStore.writeMany}. */
+export function sizeLimitOf(file) {
+    return ASSET_EXTENSIONS.includes(extensionOf(file)) ? MAX_ASSET_BYTES : MAX_FILE_BYTES;
+}
+/** File names: letters, digits, CJK, dot, dash, underscore. No separators, no
+ * leading dot. 128 chars, not 64: bulk-copied packs carry long descriptive
+ * template names ("c-pop-guofeng-traditional-chinese-style-cinematic-ballad"),
+ * and a cap they fail makes those files silently invisible to info()/export. */
+const FILE_NAME = /^[A-Za-z0-9_一-龥][A-Za-z0-9._一-龥-]{0,127}$/;
 /** Directory names this module generates and later trusts only after re-validation. */
 const SLUG = /^[a-z0-9][a-z0-9-]{0,79}$/;
 /** Sub-directory names inside a pack: same shape as a file name, no dots. */
@@ -490,6 +504,54 @@ export class SkillPackStore {
         await writeFile(target.value, bytes);
         return this.info(slug);
     }
+    /** Bulk write for preset restore: ONE limit check for the whole batch
+     * instead of per-file enumeration. Per-file checks re-count the entire
+     * pack on every write, so restoring a 1000-file pack that way is O(n²)
+     * filesystem calls — a frozen-looking import for minutes. Grammar and
+     * per-file size limits are still enforced here; the batch is refused
+     * whole (the caller reports which file tripped), never written partially. */
+    async writeMany(slug, entries) {
+        if (entries.length === 0)
+            return this.info(slug);
+        const before = await this.info(slug);
+        if (!before.ok)
+            return before;
+        const existingByPath = new Map(before.value.files.map((file) => [file.path, file.size]));
+        let existingReplacedBytes = 0;
+        let incomingBytes = 0;
+        let newCount = 0;
+        const plan = [];
+        for (const entry of entries) {
+            const target = this.fileOf(slug, entry.path);
+            if (!target.ok)
+                return target;
+            const parsed = parseSkillPath(entry.path);
+            if (!parsed.ok)
+                return parsed;
+            const limit = ASSET_EXTENSIONS.includes(extensionOf(parsed.value.file)) ? MAX_ASSET_BYTES : MAX_FILE_BYTES;
+            if (entry.bytes.length > limit) {
+                return fail(`单个文件不能超过 ${Math.floor(limit / 1024)} KB（${entry.path} 当前 ${Math.ceil(entry.bytes.length / 1024)} KB）`);
+            }
+            const existingSize = existingByPath.get(entry.path);
+            if (existingSize === undefined)
+                newCount += 1;
+            else
+                existingReplacedBytes += existingSize;
+            incomingBytes += entry.bytes.length;
+            plan.push({ target: target.value, bytes: entry.bytes });
+        }
+        if (before.value.files.length + newCount > MAX_PACK_FILES) {
+            return fail(`一个技能包最多 ${MAX_PACK_FILES} 个文件`);
+        }
+        if (before.value.totalBytes - existingReplacedBytes + incomingBytes > MAX_PACK_BYTES) {
+            return fail(`一个技能包最多 ${Math.floor(MAX_PACK_BYTES / 1024 / 1024)} MB`);
+        }
+        for (const item of plan) {
+            await mkdir(dirname(item.target), { recursive: true });
+            await writeFile(item.target, item.bytes);
+        }
+        return this.info(slug);
+    }
     /** Read one file as raw bytes (the panel's image preview and downloads). */
     async readBytes(slug, path) {
         const target = this.fileOf(slug, path);
@@ -738,6 +800,12 @@ export function createWorkflowSkillPacks(host) {
                 return resolved;
             return afterMutation(id, packs.write(resolved.value.slug, path, content));
         },
+        async importFiles(id, entries) {
+            const resolved = await resolvePack(id);
+            if (!resolved.ok)
+                return resolved;
+            return afterMutation(id, packs.writeMany(resolved.value.slug, entries));
+        },
         async renameFile(id, from, to) {
             const resolved = await resolvePack(id);
             if (!resolved.ok)