@mearl/preset 3.0.0-beta.0 → 3.0.0-beta.2

package/README.md

@@ -49,6 +49,7 @@ Node 模块快照与宿主加载合同见 [Node 能力包](../../docs/node-capab
 - packages、skills、providers 按 ID 合并，子级字段覆盖同 ID 声明；数组整体替换。启用项最终必须存在 source，`enabled:false` 保留停用声明。
 - 组件 `dependsOn` 引用同类组件 ID；检查最终继承图中的缺失、停用和循环依赖。它不表示 runtime 兼容或安装已完成。
 - source 相对声明它的清单解析；子级只修改版本时不会改变继承 source 的基准 URL。
+- Skill 可声明 `migrateFrom` 旧来源列表（最多 16 项），相对地址按声明清单解析；子级整体覆盖，空数组清除。安装器仅在来源收据匹配旧来源、Skill 身份有效且所有关联插件均由 setup 托管时迁移。手动注册、共享的手动别名或其他来源保留并报告冲突；来源匹配仍严格检查 ref。
 - defaults 递归合并对象，数组、标量和 null 替换；用户覆盖单独保存，在解析结果上应用。
 - 权限汇总去重，结果仅表示需求；必须由浏览器安装器另行取得实际授权。
 - appProfiles 是 App ID 到实现标识的覆盖映射。具体档案是否存在、所需包是否可执行，由后续能力目录校验，解析器不宣称已验证模拟效果。
@@ -56,3 +57,5 @@ Node 模块快照与宿主加载合同见 [Node 能力包](../../docs/node-capab
 - 拒绝未知字段、非 JSON 配置和原型污染键。清单总量不超过 256 Ki UTF-16 code units，defaults 最大嵌套 32 层。
 
 本包尚不包含完整 preset 安装器、preset 锁文件持久化或 UI。浏览器宿主和 setup 需要复用同一解析结果接续资源准备、权限、注册与激活；能力包本地存储只负责已校验快照的事务替换。
+
+Skill manager 的可选 `readSources(scope, cwd)` 返回该管理器核验过的来源收据，结构与 setup 的 `TrackedSkillSource` 一致。CLI 与 Native 安装状态共用该读取接口；管理器负责持久化、校验和失效自身补充记录，公共宿主继续核对来源、ref、清单身份与托管归属。未提供时读取标准 Skills 锁文件。

package/dist/manifest.js

@@ -1,3 +1,4 @@
+import { validateInstallationOrigin } from './installation.js';
 import { valid, validRange } from 'semver';
 export class PresetError extends Error {
     code;
@@ -70,12 +71,19 @@ export function clonePresetDefaults(value) {
     object(value, 'defaults');
     return json(value, 'defaults');
 }
-function component(value, path) {
-    fields(value, path, ['source', 'version', 'enabled', 'runtimes', 'dependsOn']);
+function component(value, path, kind) {
+    fields(value, path, ['source', 'version', 'enabled', 'runtimes', 'dependsOn', 'migrateFrom']);
     if ('source' in value)
         text(value.source, `${path}.source`);
     if ('version' in value)
         range(value.version, `${path}.version`);
+    if ('migrateFrom' in value) {
+        if (kind !== 'skills')
+            invalid(`${path}.migrateFrom`, 'only Skills support source migration');
+        stringArray(value.migrateFrom, `${path}.migrateFrom`);
+        if (value.migrateFrom.length > 16)
+            invalid(`${path}.migrateFrom`, 'exceeds 16 sources');
+    }
     if ('enabled' in value && typeof value.enabled !== 'boolean')
         invalid(`${path}.enabled`, 'expected a boolean');
     if ('runtimes' in value) {
@@ -120,7 +128,7 @@ export function validatePreset(value) {
         object(declarations, kind);
         result[kind] = Object.fromEntries(Object.entries(declarations).map(([key, item]) => {
             id(key, `${kind}.${key}`);
-            return [key, component(item, `${kind}.${key}`)];
+            return [key, component(item, `${kind}.${key}`, kind)];
         }));
     }
     if ('appProfiles' in value) {
@@ -137,7 +145,17 @@ export function validatePreset(value) {
         fields(value.permissions, 'permissions', ['origins']);
         if ('origins' in value.permissions)
             stringArray(value.permissions.origins, 'permissions.origins');
-        result.permissions = { origins: [...(value.permissions.origins ?? [])] };
+        const origins = value.permissions.origins ?? [];
+        if (origins.length > 64)
+            invalid('permissions.origins', 'exceeds 64 scopes');
+        result.permissions = { origins: [...new Set(origins.map((origin, index) => {
+                    try {
+                        return validateInstallationOrigin(origin);
+                    }
+                    catch {
+                        return invalid(`permissions.origins[${index}]`, 'expected an explicit HTTP host scope');
+                    }
+                }))] };
     }
     if (JSON.stringify(result).length > 262_144)
         invalid('preset', 'manifest exceeds 256 Ki UTF-16 code units');

package/dist/resolve.js

@@ -118,6 +118,7 @@ export async function resolvePreset(source, options) {
                     ...result[kind][id],
                     ...patch,
                     ...(patch.source === undefined ? {} : { source: componentSource(kind, patch.source, url) }),
+                    ...(patch.migrateFrom === undefined ? {} : { migrateFrom: patch.migrateFrom.map(source => componentSource(kind, source, url)) }),
                     declaredBy: url,
                 };
             }

package/dist/types.d.ts

@@ -8,6 +8,8 @@ export interface PresetComponent {
     /** Bundle URL for packages; installer-specific source for skills and providers. */
     source?: string;
     version?: string;
+    /** Previous Skill sources eligible for migration only when setup owns the installation. */
+    migrateFrom?: string[];
     enabled?: boolean;
     runtimes?: PresetRuntime[];
     dependsOn?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mearl/preset",
-  "version": "3.0.0-beta.0",
+  "version": "3.0.0-beta.2",
   "description": "Browser-compatible preset validation, inheritance and capability resolution for Mearl",
   "type": "module",
   "license": "Apache-2.0",
@@ -30,6 +30,11 @@
   "devDependencies": {
     "@types/semver": "^7.7.1"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/F-loat/mearl.git",
+    "directory": "packages/preset"
+  },
   "scripts": {
     "build": "rm -rf dist/ && tsc",
     "typecheck": "tsc --noEmit",