@mearl/preset 3.0.0-beta.4 → 3.0.0-beta.7

package/README.md

@@ -1,5 +1,7 @@
 # @mearl/preset
 
+3.x 的声明、配置、能力目录及对象存储设计见 [能力包模型](../../docs/capability-model.md)。包支持的位置从贡献推导，Preset 的可选 `targets` 仅选择启用子集；操作和登录定义归包，配置覆盖归 Preset 与用户。
+
 浏览器包的准备与本地存储见 [能力包](../../docs/browser-bundles.md)，整套原子激活与 App 实现映射见 [浏览器 Preset](../../docs/browser-presets.md)。这两类能力通过 `@mearl/preset/bundles` 导出。
 
 浏览器和 Node 共用一次继承解析及资源下载，见 [整套资源准备](../../docs/preset-preparation.md)。`preparePreset` 返回完整确切图与兼容的浏览器投影；Node 模块选择直接复用同批字节，准备过程不执行代码或安装外部环境。
@@ -35,7 +37,7 @@ Node 模块快照与宿主加载合同见 [Node 能力包](../../docs/node-capab
   "extends": { "source": "../base/preset.json", "version": "^1" },
   "requires": { "mearlApi": "^1" },
   "packages": {
-    "capture": { "source": "./capture/package.json", "runtimes": ["browser"] },
+    "capture": { "source": "./capture/package.json", "targets": ["browser"] },
     "unused": { "enabled": false }
   },
   "skills": {},
@@ -56,6 +58,47 @@ Node 模块快照与宿主加载合同见 [Node 能力包](../../docs/node-capab
 - 结果保留父级到子级的确切版本链和各组件最近声明来源，加载失败不会生成部分成功的结果。
 - 拒绝未知字段、非 JSON 配置和原型污染键。清单总量不超过 256 Ki UTF-16 code units，defaults 最大嵌套 32 层。
 
-本包尚不包含完整 preset 安装器、preset 锁文件持久化或 UI。浏览器宿主和 setup 需要复用同一解析结果接续资源准备、权限、注册与激活；能力包本地存储只负责已校验快照的事务替换。
+本包负责通用清单解析、校验和资源图，不执行安装或展示 UI。完整安装器、preset 锁文件持久化、权限、注册与激活由浏览器宿主及 setup 提供，见 [安装宿主](../../docs/preset-installation.md)；能力包本地存储负责已校验快照的事务替换。
 
 Skill manager 的可选 `readSources(scope, cwd)` 返回该管理器核验过的来源收据，结构与 setup 的 `TrackedSkillSource` 一致。CLI 与 Native 安装状态共用该读取接口；管理器负责持久化、校验和失效自身补充记录，公共宿主继续核对来源、ref、清单身份与托管归属。未提供时读取标准 Skills 锁文件。
+
+## 工具目录
+
+Preset 可通过 `defaults.extension.toolCatalogs` 注册额外的可安装工具目录：
+
+```json
+{
+  "defaults": {
+    "extension": {
+      "toolCatalogs": {
+        "team": {
+          "url": "https://tools.example.com/toolbox.json",
+          "label": "Team"
+        }
+      }
+    }
+  }
+}
+```
+
+目录使用绝对 HTTPS URL（本机开发允许 loopback HTTP），最多 16 个。使用稳定的目录 ID，子 preset 可只覆盖 `url` 或 `label`，或设置 `enabled: false` 禁用父级目录。官方目录始终保留且优先，不能使用保留 ID `official`。需要跨域访问时在 preset 的 `permissions.origins` 声明相应域名，由现有授权流程取得权限。
+
+目录 JSON 与官方目录使用同一结构，最多 256 项、256 KiB：
+
+```json
+{
+  "tools": [{
+    "id": "plugin:team-tool",
+    "plugin": "team-tool",
+    "repository": "example/skills",
+    "skill": "team-tool",
+    "title": "Team tool",
+    "description": "A tool for the team",
+    "icon": "wrench"
+  }]
+}
+```
+
+`repository` 也支持 HTTPS/SSH Git 来源和固定 ref（例如 `git@code.example.com:team/skills.git#release/v3`），安装时原样交给 preset 选择的 Skills 管理器。清单不接受 shell 参数、凭据或本地文件路径，也不执行其中的代码；列出工具不会自动安装。
+
+各来源并发读取、独立缓存，重试时刷新当前目录；失败时保留该来源已有缓存，其他来源仍可使用。相同插件 ID 与安装来源去重；同 ID 指向不同仓库或 Skill 时保留优先目录并提示冲突。较低优先目录的安装按钮会等待前面的目录完成检查，避免加载顺序改变安装目标。更换或禁用目录后，旧来源和迟到响应不会留在当前列表。

package/dist/browserControls.d.ts

@@ -0,0 +1,29 @@
+import { type PreparedBundle } from './bundle.js';
+import { type BrowserUiText } from './requestUi.js';
+import { type NetworkRoutePlan } from './networkRoutes.js';
+export interface BrowserSegmentedControl {
+    schemaVersion: 1;
+    id: string;
+    kind: 'segmented';
+    label: BrowserUiText;
+    description: BrowserUiText;
+    defaultValue: string;
+    aliases?: string[];
+    messages: {
+        changed: BrowserUiText;
+        failed: BrowserUiText;
+    };
+    options: Array<{
+        value: string;
+        label: BrowserUiText;
+        networkRoutes: NetworkRoutePlan;
+    }>;
+}
+export interface SelectedBrowserControl {
+    bundleId: string;
+    revision: string;
+    definition: BrowserSegmentedControl;
+}
+export declare function validateBrowserControl(input: unknown): BrowserSegmentedControl;
+/** The network-route surface has one owner, so competing packages cannot silently overwrite it. */
+export declare function selectBrowserControl(bundles: PreparedBundle[]): SelectedBrowserControl | undefined;

package/dist/browserControls.js

@@ -0,0 +1,54 @@
+import { BundleError, readBundleJson } from './bundle.js';
+import { validateBrowserUiText } from './requestUi.js';
+import { parseNetworkRoutePlan } from './networkRoutes.js';
+const id = /^[a-z][a-zA-Z0-9_.-]{0,79}$/;
+function fields(value, names) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !names.includes(key)))
+        throw new BundleError('BUNDLE_INVALID', 'Invalid browser control');
+}
+export function validateBrowserControl(input) {
+    fields(input, ['schemaVersion', 'id', 'kind', 'label', 'description', 'defaultValue', 'aliases', 'messages', 'options']);
+    if (input.schemaVersion !== 1 || input.kind !== 'segmented' || typeof input.id !== 'string' || !id.test(input.id) || typeof input.defaultValue !== 'string' || !id.test(input.defaultValue))
+        throw new BundleError('BUNDLE_INVALID', 'Invalid segmented control');
+    validateBrowserUiText(input.label);
+    validateBrowserUiText(input.description);
+    fields(input.messages, ['changed', 'failed']);
+    validateBrowserUiText(input.messages.changed);
+    validateBrowserUiText(input.messages.failed);
+    if (input.aliases !== undefined && (!Array.isArray(input.aliases) || input.aliases.length > 8 || new Set(input.aliases).size !== input.aliases.length || input.aliases.some(alias => typeof alias !== 'string' || !id.test(alias))))
+        throw new BundleError('BUNDLE_INVALID', 'Invalid browser control aliases');
+    if (!Array.isArray(input.options) || input.options.length < 2 || input.options.length > 8)
+        throw new BundleError('BUNDLE_INVALID', 'Invalid browser control options');
+    const values = new Set();
+    const options = input.options.map(option => {
+        fields(option, ['value', 'label', 'networkRoutes']);
+        if (typeof option.value !== 'string' || !id.test(option.value) || values.has(option.value))
+            throw new BundleError('BUNDLE_INVALID', 'Invalid browser control option');
+        values.add(option.value);
+        validateBrowserUiText(option.label);
+        try {
+            return { value: option.value, label: structuredClone(option.label), networkRoutes: parseNetworkRoutePlan(option.networkRoutes) };
+        }
+        catch {
+            throw new BundleError('BUNDLE_INVALID', 'Invalid control network route plan');
+        }
+    });
+    if (!values.has(input.defaultValue) || options.find(option => option.value === input.defaultValue).networkRoutes.routes.length)
+        throw new BundleError('BUNDLE_INVALID', 'The default option must clear network routes');
+    if (new TextEncoder().encode(JSON.stringify(input)).byteLength > 65536)
+        throw new BundleError('BUNDLE_QUOTA', 'Browser control exceeds 64 KiB');
+    return { schemaVersion: 1, id: input.id, kind: 'segmented', label: structuredClone(input.label), description: structuredClone(input.description), defaultValue: input.defaultValue, messages: structuredClone(input.messages), options, ...(input.aliases ? { aliases: [...input.aliases] } : {}) };
+}
+/** The network-route surface has one owner, so competing packages cannot silently overwrite it. */
+export function selectBrowserControl(bundles) {
+    let selected;
+    for (const bundle of bundles) {
+        const resource = bundle.manifest.contributions?.browserControls;
+        if (!resource)
+            continue;
+        if (selected)
+            throw new BundleError('BUNDLE_CONFLICT', 'Browser network control has multiple providers');
+        selected = { bundleId: bundle.manifest.id, revision: bundle.revision, definition: validateBrowserControl(readBundleJson(bundle, resource)) };
+    }
+    return selected;
+}

package/dist/browserPreset.js

@@ -1,15 +1,18 @@
+import { selectBrowserControl } from './browserControls.js';
 import { BundleError, MAX_BROWSER_STORAGE_BYTES, verifyBundle } from './bundle.js';
 import { satisfies } from 'semver';
-import { preparePresetPackages, presetPackages, presetSnapshotRevision, verifyPresetGraph } from './prepare.js';
+import { preparePresetPackages, presetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets } from './prepare.js';
 /** Core browser defaults also need synchronization when no browser package is declared. */
 export function presetRequiresBrowser(preset) {
-    return Object.values(preset.packages).some(entry => entry.enabled !== false && entry.runtimes?.includes('browser')) || Object.keys(preset.appProfiles).length > 0 || Object.keys(preset.defaults).some(key => key === 'simulation' || key === 'extension' || key === 'services');
+    return Object.values(preset.packages).some(entry => entry.enabled !== false && entry.targets?.includes('browser')) || Object.keys(preset.appProfiles).length > 0 || Object.keys(preset.defaults).some(key => key === 'simulation' || key === 'extension' || key === 'services');
 }
 /** Browser selection can be derived from the same accepted batch without another download. */
 export async function browserPresetSnapshot(source, manifests, preset, bundles) {
     const ids = new Set(presetPackages(preset, ['browser']).map(([id]) => id));
     const selected = bundles.filter(bundle => ids.has(bundle.manifest.id));
-    const data = { source, manifests, bundleRevisions: Object.fromEntries(selected.map(bundle => [bundle.manifest.id, bundle.revision])) };
+    selectBrowserControl(selected);
+    const packageTargets = Object.fromEntries(Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false).map(([id, entry]) => [id, entry.targets]));
+    const data = { source, manifests, bundleRevisions: Object.fromEntries(selected.map(bundle => [bundle.manifest.id, bundle.revision])), packageTargets };
     return { snapshot: { ...data, revision: await presetSnapshotRevision(data) }, preset, bundles: selected };
 }
 export async function prepareBrowserPreset(source, options) {
@@ -48,5 +51,7 @@ export async function verifyPreparedBrowserPreset(value, mearlApiVersion) {
         return graph.snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision || entry?.source !== bundle.source || (entry.version && !satisfies(bundle.manifest.version, entry.version));
     }))
         throw new BundleError('BUNDLE_INTEGRITY', 'Browser activation requires every exact package');
+    selectBrowserControl(bundles);
+    verifyPackageTargets(graph.preset, bundles);
     return { ...graph, bundles };
 }

package/dist/browserViews.d.ts

@@ -16,7 +16,7 @@ export interface BrowserViewDefinition {
     entry: string;
     actions: Record<string, BrowserViewAction>;
     preferences?: Record<string, {
-        legacyKey?: string;
+        shared?: 'editor.highlight' | 'json.viewMode' | 'json.shortcuts' | 'code.shortcuts';
         area?: 'local' | 'session';
     }>;
     transports?: Record<string, BrowserViewTransport>;

package/dist/browserViews.js

@@ -30,13 +30,13 @@ export function validateBrowserView(input) {
     if (value.preferences !== undefined) {
         const aliases = new Set();
         for (const [, preference] of entries(value.preferences, 32)) {
-            fields(preference, ['legacyKey', 'area']);
+            fields(preference, ['shared', 'area']);
             if (preference.area !== undefined && preference.area !== 'local' && preference.area !== 'session')
                 invalid('Invalid browser view preference area');
-            if (preference.legacyKey !== undefined) {
-                if (typeof preference.legacyKey !== 'string' || !/^[a-z][a-zA-Z0-9:_.-]{0,127}$/.test(preference.legacyKey) || aliases.has(preference.legacyKey))
+            if (preference.shared !== undefined) {
+                if (typeof preference.shared !== 'string' || !['editor.highlight', 'json.viewMode', 'json.shortcuts', 'code.shortcuts'].includes(preference.shared) || aliases.has(preference.shared))
                     invalid('Invalid browser view preference alias');
-                aliases.add(preference.legacyKey);
+                aliases.add(preference.shared);
             }
         }
     }
@@ -200,5 +200,5 @@ export function buildBrowserViewPage(html) {
     if (typeof html !== 'string' || !html.trim())
         invalid('Browser view entry must not be empty');
     const policy = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; img-src data: blob:; font-src data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
-    return `<!doctype html><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${policy}"><script>(${installBrowserViewBridge.toString()})();</script>${html}`;
+    return `<!doctype html><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${policy}"><script>(${installBrowserViewBridge.toString()})();</script>${html}<style data-mearl-view-surface>html,body{background:transparent!important}</style>`;
 }

package/dist/bundle.d.ts

@@ -14,17 +14,20 @@ export interface BundleManifest {
     requires?: {
         mearlApi: string;
     };
+    defaults?: import('./types.js').JsonObject;
     resources: Record<string, {
         sha256: string;
         byteLength: number;
     }>;
     contributions?: {
-        appProfiles: string[];
+        appProfiles?: string[];
         pageRuntimes?: Record<string, string>;
         nodeRuntimes?: Record<string, CapabilityRuntimeDeclaration>;
         browserRuntimes?: Record<string, CapabilityRuntimeDeclaration>;
+        extension?: string;
         requestUi?: string;
         browserViews?: Record<string, string>;
+        browserControls?: string;
     };
 }
 export interface CapabilityRuntimeDeclaration {

package/dist/bundle.js

@@ -1,5 +1,6 @@
 import { satisfies, valid, validRange } from 'semver';
 import { clonePresetDefaults } from './manifest.js';
+import { validateBrowserControl } from './browserControls.js';
 export const MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
 export const MAX_BUNDLE_MANIFEST_BYTES = 64 * 1024;
 export const MAX_BROWSER_STORAGE_BYTES = 64 * 1024 * 1024;
@@ -47,7 +48,9 @@ export function validateBundleManifest(value, mearlApiVersion) {
     catch {
         invalid('Expected a JSON manifest');
     }
-    fields(json, ['schemaVersion', 'id', 'version', 'requires', 'resources', 'contributions']);
+    fields(json, ['schemaVersion', 'id', 'version', 'requires', 'defaults', 'resources', 'contributions']);
+    if (json.defaults !== undefined)
+        json.defaults = clonePresetDefaults(json.defaults);
     if (json.schemaVersion !== 1 || typeof json.id !== 'string' || !/^[a-z][a-z0-9-]{0,79}$/.test(json.id))
         invalid('Invalid bundle identity');
     if (typeof json.version !== 'string' || valid(json.version) !== json.version)
@@ -79,7 +82,17 @@ export function validateBundleManifest(value, mearlApiVersion) {
             throw new BundleError('BUNDLE_QUOTA', 'Bundle resources exceed 16 MiB');
     }
     if (json.contributions !== undefined) {
-        fields(json.contributions, ['appProfiles', 'pageRuntimes', 'nodeRuntimes', 'browserRuntimes', 'requestUi', 'browserViews']);
+        fields(json.contributions, ['appProfiles', 'pageRuntimes', 'nodeRuntimes', 'browserRuntimes', 'extension', 'requestUi', 'browserViews', 'browserControls']);
+        const extension = json.contributions.extension;
+        if (extension !== undefined && (typeof extension !== 'string' || !Object.hasOwn(json.resources, extension)))
+            invalid('Extension contributions must reference a declared resource');
+        if (typeof extension === 'string' && json.resources[extension].byteLength > MAX_REQUEST_UI_BYTES)
+            throw new BundleError('BUNDLE_QUOTA', 'Extension contributions exceed 64 KiB');
+        const controls = json.contributions.browserControls;
+        if (controls !== undefined && (typeof controls !== 'string' || !Object.hasOwn(json.resources, controls)))
+            invalid('Browser controls must reference a declared resource');
+        if (typeof controls === 'string' && json.resources[controls].byteLength > MAX_REQUEST_UI_BYTES)
+            throw new BundleError('BUNDLE_QUOTA', 'Browser controls exceed 64 KiB');
         if (json.contributions.requestUi !== undefined && (typeof json.contributions.requestUi !== 'string' || !Object.hasOwn(json.resources, json.contributions.requestUi)))
             invalid('Request UI must reference a declared resource');
         if (typeof json.contributions.requestUi === 'string' && json.resources[json.contributions.requestUi].byteLength > MAX_REQUEST_UI_BYTES)
@@ -93,7 +106,7 @@ export function validateBundleManifest(value, mearlApiVersion) {
                     throw new BundleError('BUNDLE_QUOTA', 'Browser view definition exceeds 64 KiB');
             }
         }
-        const profiles = json.contributions.appProfiles;
+        const profiles = json.contributions.appProfiles === undefined ? [] : json.contributions.appProfiles;
         if (!Array.isArray(profiles) || profiles.some(name => typeof name !== 'string' || !Object.hasOwn(json.resources, name)) ||
             new Set(profiles).size !== profiles.length)
             invalid('App profiles must reference distinct declared resources');
@@ -188,7 +201,10 @@ export async function prepareBundle(source, options) {
         resources[name] = resource;
     }
     options.signal?.throwIfAborted();
-    return { source, manifest, revision: await manifestRevision(source, manifest), resources };
+    const prepared = { source, manifest, revision: await manifestRevision(source, manifest), resources };
+    if (manifest.contributions?.browserControls)
+        validateBrowserControl(readBundleJson(prepared, manifest.contributions.browserControls));
+    return prepared;
 }
 /** Revalidates persisted snapshots without network access and returns independent resource buffers. */
 export async function verifyBundle(bundle, mearlApiVersion) {
@@ -215,5 +231,8 @@ export async function verifyBundle(bundle, mearlApiVersion) {
         if (await bundleDigest(resources[name]) !== expected.sha256)
             throw new BundleError('BUNDLE_INTEGRITY', `Stored resource integrity check failed: ${name}`);
     }
-    return { source, manifest, revision, resources };
+    const prepared = { source, manifest, revision, resources };
+    if (manifest.contributions?.browserControls)
+        validateBrowserControl(readBundleJson(prepared, manifest.contributions.browserControls));
+    return prepared;
 }

package/dist/bundleStore.js

@@ -11,8 +11,8 @@ function installationMetadata(value) {
 }
 const STORE = 'bundles';
 const PRESET = 'preset';
-const RUNTIMES = 'pageRuntimes';
-const PINS = 'pageRuntimePins';
+const OBJECTS = 'objects';
+const PINS = 'resourcePins';
 function captureRevisions(input) {
     if (input === undefined)
         return;
@@ -25,39 +25,54 @@ function checkRevisions(records, expected) {
     if (expected && (records.length !== Object.keys(expected).length || records.some(record => !Object.hasOwn(expected, record.id) || expected[record.id] !== record.revision)))
         throw new BundleError('BUNDLE_CONFLICT', 'Browser bundles changed while contributions were being validated');
 }
-function runtimePaths(bundle) {
-    return [...new Set([
-            ...Object.values(bundle?.manifest?.contributions?.pageRuntimes ?? {}),
-            ...Object.values(bundle?.manifest?.contributions?.browserRuntimes ?? {}).map(runtime => runtime?.entry),
-        ].filter((name) => typeof name === 'string'))];
+function storedBundle(bundle) {
+    const { resources, ...metadata } = bundle;
+    return { id: bundle.manifest.id, revision: bundle.revision,
+        byteLength: Object.values(resources).reduce((sum, bytes) => sum + bytes.byteLength, 0), bundle: metadata };
 }
-function referencedRuntimes(records, runtimes, pins) {
-    const referenced = new Set(pins.map(pin => pin.sha256));
-    for (const record of records)
-        for (const name of runtimePaths(record.bundle)) {
-            const digest = record.bundle?.manifest?.resources?.[name]?.sha256;
-            if (digest)
-                referenced.add(digest);
-        }
-    return runtimes.filter(runtime => referenced.has(runtime.sha256));
+function bundleObjectHashes(records) {
+    const hashes = new Set();
+    for (const record of records) {
+        const resources = record?.bundle?.manifest?.resources;
+        if (!resources || typeof resources !== 'object' || Array.isArray(resources))
+            continue;
+        for (const resource of Object.values(resources))
+            if (resource && typeof resource.sha256 === 'string' && /^[a-f0-9]{64}$/.test(resource.sha256))
+                hashes.add(resource.sha256);
+    }
+    return hashes;
+}
+function referencedObjects(records, resources, pins) {
+    const referenced = bundleObjectHashes(records);
+    for (const pin of pins)
+        referenced.add(pin.sha256);
+    return resources.filter(resource => referenced.has(resource.sha256));
 }
-function runtimeResources(bundles) {
+function bundleObjects(bundles) {
     const result = new Map();
     for (const bundle of bundles)
-        for (const name of runtimePaths(bundle)) {
-            const resource = bundle?.manifest?.resources?.[name], bytes = bundle?.resources?.[name];
-            if (resource && typeof resource.sha256 === 'string' && /^[a-f0-9]{64}$/.test(resource.sha256) && bytes instanceof Uint8Array && bytes.byteLength === resource.byteLength)
-                result.set(resource.sha256, { sha256: resource.sha256, bytes });
-        }
+        for (const [name, resource] of Object.entries(bundle.manifest.resources))
+            result.set(resource.sha256, { sha256: resource.sha256, bytes: bundle.resources[name] });
     return [...result.values()];
 }
+/** Schedule object reads inside the metadata transaction, preserving one consistent snapshot. */
+function readObjects(records, store) {
+    const result = new Map();
+    const hashes = bundleObjectHashes(records);
+    for (const hash of hashes) {
+        const request = store.get(hash);
+        request.onsuccess = () => { if (request.result)
+            result.set(hash, request.result); };
+    }
+    return result;
+}
 function checkStorageBudget(records, runtimes) {
     if (records.some(record => !Number.isSafeInteger(record.byteLength) || record.byteLength < 0 || record.byteLength > MAX_BUNDLE_BYTES) ||
         runtimes.some(runtime => !(runtime.bytes instanceof Uint8Array) || runtime.bytes.byteLength > MAX_BUNDLE_BYTES)) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored resource size is invalid');
     }
     const retained = runtimes.reduce((sum, runtime) => sum + runtime.bytes.byteLength, 0);
-    const total = records.reduce((sum, record) => sum + record.byteLength, retained);
+    const total = retained;
     if (records.length > 64 || !Number.isSafeInteger(total) || total > MAX_BROWSER_STORAGE_BYTES)
         throw new BundleError('BUNDLE_QUOTA', 'Installed and retained resources exceed the browser storage budget');
 }
@@ -71,14 +86,14 @@ export class BrowserBundleStore {
         if (this.database)
             return this.database;
         this.database = new Promise((resolve, reject) => {
-            const request = (this.options.indexedDB ?? indexedDB).open(this.options.databaseName ?? 'mearl-capability-bundles', 4);
+            const request = (this.options.indexedDB ?? indexedDB).open(this.options.databaseName ?? 'mearl-capabilities-v3', 1);
             request.onupgradeneeded = () => {
                 if (!request.result.objectStoreNames.contains(STORE))
                     request.result.createObjectStore(STORE, { keyPath: 'id' });
                 if (!request.result.objectStoreNames.contains(PRESET))
                     request.result.createObjectStore(PRESET);
-                if (!request.result.objectStoreNames.contains(RUNTIMES))
-                    request.result.createObjectStore(RUNTIMES, { keyPath: 'sha256' });
+                if (!request.result.objectStoreNames.contains(OBJECTS))
+                    request.result.createObjectStore(OBJECTS, { keyPath: 'sha256' });
                 if (!request.result.objectStoreNames.contains(PINS))
                     request.result.createObjectStore(PINS, { keyPath: 'owner' });
             };
@@ -100,30 +115,41 @@ export class BrowserBundleStore {
     async records() {
         const database = await this.open();
         return new Promise((resolve, reject) => {
-            const transaction = database.transaction([STORE, PRESET], 'readonly');
+            const transaction = database.transaction([STORE, PRESET, OBJECTS], 'readonly');
             const request = transaction.objectStore(STORE).getAll();
+            let objects = new Map();
+            request.onsuccess = () => { objects = readObjects(request.result, transaction.objectStore(OBJECTS)); };
             const active = transaction.objectStore(PRESET).get('active');
             const installation = transaction.objectStore(PRESET).get('installation');
             const token = transaction.objectStore(PRESET).get('installationToken');
-            transaction.oncomplete = () => resolve({ records: request.result, active: active.result, installation: installation.result, installationToken: token.result ?? null });
+            transaction.oncomplete = () => resolve({ objects, records: request.result, active: active.result, installation: installation.result, installationToken: token.result ?? null });
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Bundle read failed'));
         });
     }
     async get(id) {
         const database = await this.open();
+        let objects = new Map();
         const record = await new Promise((resolve, reject) => {
-            const transaction = database.transaction(STORE, 'readonly');
+            const transaction = database.transaction([STORE, OBJECTS], 'readonly');
             const request = transaction.objectStore(STORE).get(id);
+            request.onsuccess = () => { objects = readObjects(request.result ? [request.result] : [], transaction.objectStore(OBJECTS)); };
             transaction.oncomplete = () => resolve(request.result);
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Bundle read failed'));
         });
-        return record ? this.verified(record) : undefined;
+        return record ? this.verified(record, objects) : undefined;
     }
-    async verified(record) {
+    async verified(record, objects) {
         if (record.id !== record.bundle?.manifest?.id || record.revision !== record.bundle?.revision) {
             throw new BundleError('BUNDLE_INTEGRITY', 'Stored bundle identity does not match');
         }
-        const bundle = await verifyBundle(record.bundle, this.options.mearlApiVersion);
+        const resources = {};
+        for (const [name, metadata] of Object.entries(record.bundle.manifest.resources)) {
+            const object = objects.get(metadata.sha256);
+            if (!object || object.sha256 !== metadata.sha256)
+                throw new BundleError('BUNDLE_INTEGRITY', 'Stored resource integrity check failed: object is missing');
+            resources[name] = object.bytes;
+        }
+        const bundle = await verifyBundle({ ...record.bundle, resources }, this.options.mearlApiVersion);
         if (Object.values(bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0) !== record.byteLength) {
             throw new BundleError('BUNDLE_INTEGRITY', 'Stored resource size does not match');
         }
@@ -132,10 +158,10 @@ export class BrowserBundleStore {
     async list() {
         const bundles = [];
         const errors = [];
-        const { records, active, installation: storedInstallation, installationToken } = await this.records();
+        const { objects, records, active, installation: storedInstallation, installationToken } = await this.records();
         for (const record of records) {
             try {
-                bundles.push(await this.verified(record));
+                bundles.push(await this.verified(record, objects));
             }
             catch (error) {
                 errors.push({ id: record.id, error: error instanceof Error ? error.message : 'Invalid stored bundle' });
@@ -191,8 +217,8 @@ export class BrowserBundleStore {
             throw new BundleError('BUNDLE_INVALID', 'Invalid browser runtime digest');
         const database = await this.open();
         const record = await new Promise((resolve, reject) => {
-            const transaction = database.transaction(RUNTIMES, 'readonly');
-            const request = transaction.objectStore(RUNTIMES).get(sha256);
+            const transaction = database.transaction(OBJECTS, 'readonly');
+            const request = transaction.objectStore(OBJECTS).get(sha256);
             transaction.oncomplete = () => resolve(request.result);
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Browser runtime read failed'));
         });
@@ -228,8 +254,8 @@ export class BrowserBundleStore {
         });
         const database = await this.open();
         await new Promise((resolve, reject) => {
-            const transaction = database.transaction([STORE, RUNTIMES, PINS], 'readwrite');
-            const runtimeStore = transaction.objectStore(RUNTIMES);
+            const transaction = database.transaction([STORE, OBJECTS, PINS], 'readwrite');
+            const runtimeStore = transaction.objectStore(OBJECTS);
             const pinStore = transaction.objectStore(PINS);
             const records = transaction.objectStore(STORE).getAll();
             const resources = runtimeStore.getAll();
@@ -237,26 +263,7 @@ export class BrowserBundleStore {
             let failure;
             request.onsuccess = () => {
                 const cached = new Map(resources.result.map(resource => [resource.sha256, resource]));
-                const missing = new Set(patch.flatMap(({ sha256 }) => sha256 && !cached.has(sha256) ? [sha256] : []));
-                let added = false;
-                for (const runtime of runtimeResources(records.result.map(record => record.bundle))) {
-                    if (missing.has(runtime.sha256)) {
-                        cached.set(runtime.sha256, runtime);
-                        runtimeStore.put(runtime);
-                        added = true;
-                    }
-                }
                 const available = [...cached.values()];
-                if (added) {
-                    try {
-                        checkStorageBudget(records.result, available);
-                    }
-                    catch (error) {
-                        failure = error;
-                        transaction.abort();
-                        return;
-                    }
-                }
                 const pins = new Map(replace ? [] : request.result.map((pin) => [pin.owner, pin]));
                 for (const { owner, sha256 } of patch) {
                     if (sha256 === null) {
@@ -273,7 +280,7 @@ export class BrowserBundleStore {
                 pinStore.clear();
                 for (const pin of pins.values())
                     pinStore.put(pin);
-                const retained = new Set(referencedRuntimes(records.result, available, [...pins.values()]).map(runtime => runtime.sha256));
+                const retained = new Set(referencedObjects(records.result, available, [...pins.values()]).map(runtime => runtime.sha256));
                 for (const runtime of available)
                     if (!retained.has(runtime.sha256))
                         runtimeStore.delete(runtime.sha256);
@@ -290,10 +297,12 @@ export class BrowserBundleStore {
             return undefined;
         const id = target.split('/')[0];
         const database = await this.open();
+        let objects = new Map();
         const record = await new Promise((resolve, reject) => {
-            const transaction = database.transaction([PRESET, STORE], 'readonly');
+            const transaction = database.transaction([PRESET, STORE, OBJECTS], 'readonly');
             const current = transaction.objectStore(PRESET).get('active');
             const bundle = transaction.objectStore(STORE).get(id);
+            bundle.onsuccess = () => { objects = readObjects(bundle.result ? [bundle.result] : [], transaction.objectStore(OBJECTS)); };
             transaction.oncomplete = () => {
                 if (current.result?.revision !== activation.snapshot.revision) {
                     reject(new BundleError('BUNDLE_CONFLICT', 'The selected preset changed during profile lookup'));
@@ -306,7 +315,7 @@ export class BrowserBundleStore {
         });
         if (!record || record.revision !== activation.snapshot.bundleRevisions[id])
             throw new BundleError('BUNDLE_INTEGRITY', 'The selected app provider is missing');
-        return { target, bundle: await this.verified(record) };
+        return { target, bundle: await this.verified(record, objects) };
     }
     /** Packages and the exact preset graph become visible together, after host contribution checks. */
     async activatePreset(input, replacements, expectedRevision, association, expectedBundleRevisions) {
@@ -323,11 +332,11 @@ export class BrowserBundleStore {
         const token = accepted ? await bundleDigest(crypto.getRandomValues(new Uint8Array(32))) : null;
         const database = await this.open();
         await new Promise((resolve, reject) => {
-            const transaction = database.transaction([STORE, PRESET, RUNTIMES, PINS], 'readwrite');
+            const transaction = database.transaction([STORE, PRESET, OBJECTS, PINS], 'readwrite');
             const store = transaction.objectStore(STORE);
             const presets = transaction.objectStore(PRESET);
             const records = store.getAll();
-            const runtimeStore = transaction.objectStore(RUNTIMES);
+            const runtimeStore = transaction.objectStore(OBJECTS);
             const retained = runtimeStore.getAll();
             const pins = transaction.objectStore(PINS).getAll();
             const installation = presets.get('installationToken');
@@ -356,12 +365,12 @@ export class BrowserBundleStore {
                 }
                 const result = records.result.filter(record => !replacing.has(record.id) && !previousManaged.has(record.id));
                 for (const { bundle } of next)
-                    result.push({ id: bundle.manifest.id, revision: bundle.revision, byteLength: Object.values(bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0), bundle });
-                const resources = runtimeResources(next.map(item => item.bundle));
+                    result.push(storedBundle(bundle));
+                const resources = bundleObjects(next.map(item => item.bundle));
                 const cache = new Map(retained.result.map(runtime => [runtime.sha256, runtime]));
                 for (const runtime of resources)
                     cache.set(runtime.sha256, runtime);
-                const keeping = referencedRuntimes(result, [...cache.values()], pins.result);
+                const keeping = referencedObjects(result, [...cache.values()], pins.result);
                 try {
                     checkStorageBudget(result, keeping);
                 }
@@ -400,21 +409,18 @@ export class BrowserBundleStore {
     async install(bundle, expectedRevision, expectedBundleRevisions) {
         const selection = captureRevisions(expectedBundleRevisions);
         const verified = await verifyBundle(bundle, this.options.mearlApiVersion);
-        const byteLength = Object.values(verified.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0);
-        await this.change(verified.manifest.id, expectedRevision, {
-            id: verified.manifest.id, revision: verified.revision, byteLength, bundle: verified,
-        }, selection);
+        await this.change(verified.manifest.id, expectedRevision, storedBundle(verified), selection, bundleObjects([verified]));
     }
     async remove(id, expectedRevision) {
         await this.change(id, expectedRevision);
     }
-    async change(id, expectedRevision, next, selection) {
+    async change(id, expectedRevision, next, selection, resources = []) {
         const database = await this.open();
         await new Promise((resolve, reject) => {
-            const transaction = database.transaction([STORE, PRESET, RUNTIMES, PINS], 'readwrite');
+            const transaction = database.transaction([STORE, PRESET, OBJECTS, PINS], 'readwrite');
             const store = transaction.objectStore(STORE);
             const active = transaction.objectStore(PRESET).get('active');
-            const runtimeStore = transaction.objectStore(RUNTIMES);
+            const runtimeStore = transaction.objectStore(OBJECTS);
             const retained = runtimeStore.getAll();
             const pins = transaction.objectStore(PINS).getAll();
             let failure;
@@ -442,11 +448,10 @@ export class BrowserBundleStore {
                 }
                 if (next) {
                     const others = records.filter(record => record.id !== id);
-                    const resources = runtimeResources([next.bundle]);
                     const cache = new Map(retained.result.map(runtime => [runtime.sha256, runtime]));
                     for (const runtime of resources)
                         cache.set(runtime.sha256, runtime);
-                    const keeping = referencedRuntimes([...others, next], [...cache.values()], pins.result);
+                    const keeping = referencedObjects([...others, next], [...cache.values()], pins.result);
                     try {
                         checkStorageBudget([...others, next], keeping);
                     }
@@ -465,7 +470,7 @@ export class BrowserBundleStore {
                 }
                 else {
                     store.delete(id);
-                    const keep = new Set(referencedRuntimes(records.filter(record => record.id !== id), retained.result, pins.result).map(runtime => runtime.sha256));
+                    const keep = new Set(referencedObjects(records.filter(record => record.id !== id), retained.result, pins.result).map(runtime => runtime.sha256));
                     for (const runtime of retained.result)
                         if (!keep.has(runtime.sha256))
                             runtimeStore.delete(runtime.sha256);