Web SDK Phase 8.0: WASM core (core/web-sdk)

.gitignore

@@ -46,3 +46,6 @@ apps/windows-shell-gui/gen/
 
 # Agent run-continuation tooling state
 .sisyphus/
+
+# wasm-pack output for core/web-sdk (regenerate via scripts/build-web-sdk.sh / CI)
+sdk/web/generated/

AGENTS.md

@@ -201,6 +201,18 @@ Platform shell bootstrap binaries that run the shared-core turn-start flow throu
 
 > Validated on macOS: `cargo check --workspace` + `cargo run -p skilly-{windows,linux}-shell -- --smoke` both pass (turn-start `allowed=true`, `phase=completed`). The Tauri GUI builds in CI on Windows.
 
+### Web SDK WASM core (`core/web-sdk`) — Web SDK Phase 8.0
+
+Browser sibling of `core/mobile-sdk`: the shared core (`policy`, `realtime`, `skills`) exposed to JavaScript via `wasm-bindgen`. Adds `composePrompt` (not in the mobile surface) since the browser widget composes the host site's teaching prompt client-side. See `docs/architecture/web-sdk-prd.md`.
+
+| File | Purpose |
+|------|---------|
+| `core/web-sdk/src/lib.rs` | `Web*` serde mirror types + pure `*_impl` (host-testable) + `wasm-bindgen` glue gated to `target_arch = "wasm32"`. Exposes `canStartTurn`, `trialIsExhausted`, `usageIsOverCap`, `composePrompt`, `replayRealtimeEvents`. |
+| `scripts/build-web-sdk.sh` | `wasm-pack build` → `sdk/web/generated/`. |
+| `sdk/web/` | Browser SDK artifacts (sibling of `sdk/ios`, `sdk/android`). |
+
+> The `wasm-bindgen`/`serde-wasm-bindgen` deps are `wasm32`-only, so `cargo test --workspace` stays green on macOS with no wasm toolchain. Host-validated: `cargo test -p skilly-core-web-sdk` (4 tests, incl. `compose_prompt` parity vs the shared `core/skills` fixture). The actual wasm compile runs via `wasm-pack`/CI. The `@skilly/web` widget (Shadow-DOM overlay, DOM digest, selector pointing, voice) is Phase 8.1+.
+
 ### Skill Files
 
 The repo ships 5 bundled skills under `skills/`, also copied into the app bundle under `Resources/skills/` so new users get them without downloading anything.

Cargo.toml

@@ -6,6 +6,7 @@ members = [
     "core/skills",
     "core/realtime",
     "core/mobile-sdk",
+    "core/web-sdk",
     "apps/windows-shell",
     "apps/linux-shell",
 ]

core/web-sdk/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "skilly-core-web-sdk"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+description = "WebAssembly (wasm-bindgen) surface for selected Skilly core APIs. Browser sibling of core/mobile-sdk. See docs/architecture/web-sdk-prd.md."
+
+[lib]
+name = "skilly_core_web_sdk"
+# rlib so the pure *_impl functions + native tests build on the host;
+# cdylib is the artifact wasm-pack compiles for the browser.
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+skilly-core-domain = { path = "../domain" }
+skilly-core-policy = { path = "../policy" }
+skilly-core-realtime = { path = "../realtime" }
+skilly-core-skills = { path = "../skills" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+# wasm-only: the JS bindings layer. Gated to wasm32 so host
+# `cargo check/test --workspace` needs no wasm toolchain (matches the
+# windows-shell-gui exclusion pattern, but here via target-specific deps).
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wasm-bindgen = "0.2"
+serde-wasm-bindgen = "0.6"

core/web-sdk/README.md

@@ -0,0 +1,53 @@
+# skilly-core-web-sdk
+
+WebAssembly surface for selected Skilly core APIs — the **browser sibling of
+`core/mobile-sdk`** (UniFFI). The same shared core (`policy`, `realtime`,
+`skills`) exposed to JavaScript via `wasm-bindgen`. This is **Phase 8.0** of the
+Web SDK plan (`docs/architecture/web-sdk-prd.md`).
+
+## Exposed API (JS names)
+
+| JS function | Input | Output | Core source |
+|-------------|-------|--------|-------------|
+| `canStartTurn(input)` | `WebPolicyInput` | `WebPolicyDecision` | `core/policy` |
+| `trialIsExhausted(input)` | `WebPolicyInput` | `boolean` | `core/policy` |
+| `usageIsOverCap(input)` | `WebPolicyInput` | `boolean` | `core/policy` |
+| `composePrompt(input)` | `{ base_prompt, skill, progress }` | `string` | `core/skills` |
+| `replayRealtimeEvents(eventsJson)` | JSON string | `WebRealtimeReplaySummary \| null` | `core/realtime` |
+
+`composePrompt` is web-specific (not in the mobile surface): the browser widget
+composes the host site's teaching prompt client-side.
+
+## Build layout
+
+- Pure `*_impl` functions + `Web*` serde types are **always compiled** and
+  host-testable — no wasm toolchain required.
+- The `wasm-bindgen` glue is gated to `target_arch = "wasm32"` (and the
+  `wasm-bindgen`/`serde-wasm-bindgen` deps are `wasm32`-only), so
+  `cargo check --workspace` and `cargo test --workspace` stay green on macOS
+  without any wasm tooling.
+
+## Validate (host — no wasm toolchain)
+
+```bash
+cargo test -p skilly-core-web-sdk
+```
+
+Includes `compose_prompt_web_matches_core_skills_fixture`, which reuses the
+shared `core/skills` fixture to prove the web prompt output is byte-identical to
+the core (and therefore to desktop/mobile).
+
+## Build the browser package (wasm)
+
+```bash
+./scripts/build-web-sdk.sh   # wasm-pack → sdk/web/generated/ (gitignored build output)
+```
+
+Requires `rustup target add wasm32-unknown-unknown` + `wasm-pack`. Verified
+output: a ~195KB optimized `.wasm` + JS glue + `.d.ts` exposing `canStartTurn`,
+`trialIsExhausted`, `usageIsOverCap`, `composePrompt`, `replayRealtimeEvents`.
+
+NOTE: on a host with BOTH Homebrew rust and rustup, the toolchain `cargo`
+resolves `rustc` from PATH (Homebrew's, which lacks wasm32 std) and fails with
+"can't find crate for `core`". `scripts/build-web-sdk.sh` handles this
+automatically by pinning `RUSTC`/`PATH` to the rustup toolchain.