@mearl/preset 3.0.0-beta.4 → 3.0.0-beta.7

package/dist/prepare.js

@@ -1,16 +1,21 @@
-import { BundleError, MAX_BROWSER_STORAGE_BYTES, bundleDigest, bundleSourceUrl, prepareBundle } from './bundle.js';
+import { BundleError, MAX_BROWSER_STORAGE_BYTES, MAX_BUNDLE_MANIFEST_BYTES, bundleDigest, bundleSourceUrl, prepareBundle, validateBundleManifest } from './bundle.js';
+import { satisfies } from 'semver';
 import { clonePresetDefaults, validatePreset } from './manifest.js';
 import { resolvePreset } from './resolve.js';
 export async function presetSnapshotRevision(value) {
     return bundleDigest(new TextEncoder().encode(JSON.stringify(value)));
 }
+/** Select candidates without assuming that inferred locations have been discovered. */
+function selectPresetPackages(preset, runtimes) {
+    const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false && (entry.targets ?? ['browser', 'node']).some(runtime => runtimes.includes(runtime)));
+    if (entries.length > 64)
+        throw new BundleError('BUNDLE_QUOTA', 'A preset can activate at most 64 packages');
+    return entries;
+}
 /** Each execution location must be able to satisfy its own package dependencies. */
 export function presetPackages(preset, runtimes) {
-    if (runtimes.includes('node') && runtimes.includes('browser') && Object.values(preset.packages).some(entry => entry.enabled !== false && !entry.runtimes?.length)) {
-        throw new BundleError('BUNDLE_INCOMPATIBLE', 'Every enabled package must declare its browser and/or Node runtime');
-    }
     for (const runtime of runtimes) {
-        const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false && entry.runtimes?.includes(runtime));
+        const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false && (entry.targets ?? ['browser', 'node']).includes(runtime));
         const ids = new Set(entries.map(([id]) => id));
         for (const [id, entry] of entries) {
             if (entry.dependsOn?.some(dependency => !ids.has(dependency))) {
@@ -25,10 +30,37 @@ export function presetPackages(preset, runtimes) {
             }
         }
     }
-    const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false && entry.runtimes?.some(runtime => runtimes.includes(runtime)));
-    if (entries.length > 64)
-        throw new BundleError('BUNDLE_QUOTA', 'A preset can activate at most 64 packages');
-    return entries;
+    return selectPresetPackages(preset, runtimes);
+}
+export function bundleTargets(bundle) {
+    const contributions = bundle.manifest.contributions;
+    const targets = [];
+    if (contributions && (Object.keys(contributions.browserRuntimes ?? {}).length || Object.keys(contributions.pageRuntimes ?? {}).length || contributions.appProfiles?.length || contributions.extension || contributions.requestUi || contributions.browserViews || contributions.browserControls))
+        targets.push('browser');
+    if (Object.keys(contributions?.nodeRuntimes ?? {}).length)
+        targets.push('node');
+    return targets.length ? targets : ['browser', 'node'];
+}
+/** Resolved activation choices are derived data; source manifests remain unchanged. */
+export function applyPackageTargets(preset, targets) {
+    const enabled = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false);
+    if (enabled.length !== Object.keys(targets).length)
+        throw new BundleError('BUNDLE_INTEGRITY', 'Package target selection does not match the preset');
+    const packages = { ...preset.packages };
+    for (const [id, entry] of enabled) {
+        const selected = targets[id];
+        if (!Array.isArray(selected) || !selected.length || selected.length > 2 || new Set(selected).size !== selected.length || selected.some(target => target !== 'browser' && target !== 'node') || entry.targets && JSON.stringify(entry.targets) !== JSON.stringify(selected))
+            throw new BundleError('BUNDLE_INTEGRITY', 'Invalid package target selection');
+        packages[id] = { ...entry, targets: [...selected] };
+    }
+    return { ...preset, packages };
+}
+export function verifyPackageTargets(preset, bundles) {
+    for (const bundle of bundles) {
+        const available = bundleTargets(bundle);
+        if (preset.packages[bundle.manifest.id]?.targets?.some(target => !available.includes(target)))
+            throw new BundleError('BUNDLE_INCOMPATIBLE', 'Package does not support the selected target');
+    }
 }
 /** Shared preparation performs no installation, code execution or permission changes. */
 export async function preparePresetPackages(source, options, runtimes) {
@@ -47,7 +79,7 @@ export async function preparePresetPackages(source, options, runtimes) {
         return bytes;
     };
     const manifests = {};
-    const preset = await resolvePreset(source, {
+    let preset = await resolvePreset(source, {
         mearlApiVersion: options.mearlApiVersion,
         signal: options.signal,
         load: async (url) => {
@@ -63,18 +95,49 @@ export async function preparePresetPackages(source, options, runtimes) {
             return manifest;
         },
     });
-    const entries = presetPackages(preset, runtimes);
+    const targetsKnown = Object.values(preset.packages).every(entry => entry.enabled === false || Boolean(entry.targets?.length));
+    const entries = targetsKnown ? presetPackages(preset, runtimes) : selectPresetPackages(preset, runtimes);
     const bundles = [];
+    const pending = [];
+    const packageTargets = Object.fromEntries(Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false).map(([id, entry]) => [id, entry.targets ?? []]));
     for (const [id, entry] of entries) {
-        bundles.push(await prepareBundle(entry.source, { ...options, load, expectedId: id, version: entry.version }));
+        const manifestSource = bundleSourceUrl(entry.source);
+        const bytes = Uint8Array.from(await load(manifestSource, { maxBytes: MAX_BUNDLE_MANIFEST_BYTES, signal: options.signal }));
+        let manifest;
+        try {
+            manifest = validateBundleManifest(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)), options.mearlApiVersion);
+        }
+        catch (error) {
+            if (error instanceof BundleError)
+                throw error;
+            throw new BundleError('BUNDLE_INVALID', error instanceof Error ? error.message : 'Invalid package manifest');
+        }
+        if (manifest.id !== id)
+            throw new BundleError('BUNDLE_INVALID', 'Package identity does not match the preset');
+        if (entry.version && !satisfies(manifest.version, entry.version))
+            throw new BundleError('BUNDLE_INCOMPATIBLE', 'Package version does not satisfy the preset');
+        const available = bundleTargets({ manifest });
+        const targets = entry.targets ?? available;
+        if (targets.some(target => !available.includes(target)))
+            throw new BundleError('BUNDLE_INCOMPATIBLE', 'Package does not support the selected target');
+        packageTargets[id] = targets;
+        pending.push({ id, entry, source: manifestSource, bytes });
+    }
+    preset = applyPackageTargets(preset, packageTargets);
+    const selected = new Set(presetPackages(preset, runtimes).map(([id]) => id));
+    for (const candidate of pending) {
+        if (!selected.has(candidate.id))
+            continue;
+        bundles.push(await prepareBundle(candidate.source, { ...options, load: (url, request) => url === candidate.source ? Promise.resolve(candidate.bytes) : load(url, request), expectedId: candidate.id, version: candidate.entry.version }));
     }
+    verifyPackageTargets(preset, bundles);
     options.signal?.throwIfAborted();
-    return { source, manifests, preset, bundles };
+    return { source, manifests, preset, bundles: bundles.filter(bundle => selected.has(bundle.manifest.id)), packageTargets };
 }
 /** The exact graph is checked offline; installed resources are verified by the target store. */
 export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full) {
     const json = clonePresetDefaults(value);
-    const allowed = ['source', 'manifests', 'bundleRevisions', 'revision', ...(full ? ['schemaVersion'] : [])];
+    const allowed = ['source', 'manifests', 'bundleRevisions', 'packageTargets', 'revision', ...(full ? ['schemaVersion'] : [])];
     if (Object.keys(json).some(key => !allowed.includes(key)) || (full && json.schemaVersion !== 1) ||
         typeof json.source !== 'string' || typeof json.revision !== 'string' || !/^[a-f0-9]{64}$/.test(json.revision)) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Invalid stored preset identity');
@@ -93,10 +156,11 @@ export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full)
             throw new BundleError('BUNDLE_INTEGRITY', 'Invalid stored preset source');
         validated[url] = validatePreset(manifest);
     }
-    const data = { ...(full ? { schemaVersion: 1 } : {}), source, manifests: validated, bundleRevisions };
+    const packageTargets = clonePresetDefaults(json.packageTargets);
+    const data = { ...(full ? { schemaVersion: 1 } : {}), source, manifests: validated, bundleRevisions, packageTargets };
     if (await presetSnapshotRevision(data) !== json.revision)
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored preset revision does not match');
-    const preset = await resolvePreset(source, {
+    let preset = await resolvePreset(source, {
         mearlApiVersion,
         load: async (url) => {
             if (!Object.hasOwn(validated, url))
@@ -104,6 +168,7 @@ export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full)
             return validated[url];
         },
     });
+    preset = applyPackageTargets(preset, packageTargets);
     const entries = presetPackages(preset, runtimes);
     if (preset.chain.length !== Object.keys(validated).length || entries.length !== Object.keys(bundleRevisions).length || entries.some(([id]) => !Object.hasOwn(bundleRevisions, id))) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored preset package graph does not match');

package/dist/preset.js

@@ -1,5 +1,5 @@
 import { browserPresetSnapshot } from './browserPreset.js';
-import { preparePresetPackages, presetSnapshotRevision, verifyPresetGraph } from './prepare.js';
+import { preparePresetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets } from './prepare.js';
 import { satisfies } from 'semver';
 import { BundleError, MAX_BROWSER_STORAGE_BYTES, verifyBundle } from './bundle.js';
 export async function preparePreset(source, options) {
@@ -9,6 +9,7 @@ export async function preparePreset(source, options) {
         source: prepared.source,
         manifests: prepared.manifests,
         bundleRevisions: Object.fromEntries(prepared.bundles.map(bundle => [bundle.manifest.id, bundle.revision])),
+        packageTargets: prepared.packageTargets,
     };
     const snapshot = { ...data, revision: await presetSnapshotRevision(data) };
     const browser = await browserPresetSnapshot(prepared.source, prepared.manifests, prepared.preset, prepared.bundles);
@@ -44,6 +45,7 @@ export async function verifyPreparedPreset(value, mearlApiVersion) {
         Promise.all(value.bundles.map(bundle => verifyBundle(bundle, mearlApiVersion))),
     ]);
     const { snapshot, preset } = graph;
+    verifyPackageTargets(preset, bundles);
     if (bundles.length !== Object.keys(snapshot.bundleRevisions).length || new Set(bundles.map(bundle => bundle.manifest.id)).size !== bundles.length || bundles.some(bundle => {
         const entry = preset.packages[bundle.manifest.id];
         return snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision || entry?.source !== bundle.source || (entry.version && !satisfies(bundle.manifest.version, entry.version));

package/dist/requestUi.d.ts

@@ -49,7 +49,9 @@ export interface SelectedBrowserRequestUi {
     definition: BrowserRequestUi;
 }
 export declare function validateBrowserUiText(value: unknown): void;
-export declare function browserUiHttpUrl(value: unknown): string;
+export declare function browserUiHttpUrl(value: unknown, options?: {
+    allowFragment?: boolean;
+}): string;
 export declare function validateBrowserRequestUi(input: unknown): BrowserRequestUi;
 /** Contribution validation is pure; factories and UI side effects belong to the host. */
 export declare function selectBrowserRequestUi(bundles: PreparedBundle[], apiVersion: string): SelectedBrowserRequestUi | undefined;

package/dist/requestUi.js

@@ -10,7 +10,7 @@ export function validateBrowserUiText(value) {
     if (typeof value.en !== 'string' || !value.en.trim() || Object.values(value).some(entry => typeof entry !== 'string' || entry.length > 1024 || !entry.trim()))
         invalid('Request UI text requires bounded translations');
 }
-export function browserUiHttpUrl(value) {
+export function browserUiHttpUrl(value, options = {}) {
     if (typeof value !== 'string' || value.length > 4096)
         invalid('Invalid request UI URL');
     let url;
@@ -20,7 +20,7 @@ export function browserUiHttpUrl(value) {
     catch {
         invalid('Invalid request UI URL');
     }
-    if (url.username || url.password || url.hash || url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)))
+    if (url.username || url.password || !options.allowFragment && url.hash || url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)))
         invalid('Request UI requires credential-free HTTPS or loopback URLs');
     return url.href;
 }

package/dist/resolve.js

@@ -1,3 +1,4 @@
+import { parseToolboxCatalogs } from './toolboxCatalogs.js';
 import { satisfies, valid } from 'semver';
 import { clonePresetDefaults, isJsonObject, PresetError, validatePreset } from './manifest.js';
 const kinds = ['packages', 'skills', 'providers'];
@@ -127,6 +128,9 @@ export async function resolvePreset(source, options) {
         return result;
     };
     const result = await load(sourceUrl(source));
+    const extension = result.defaults.extension;
+    if (isJsonObject(extension))
+        parseToolboxCatalogs(extension.toolCatalogs);
     // Dependency validity is checked on the final graph, so children may complete or disable parent entries.
     for (const kind of kinds)
         validateDependencies(kind, result[kind]);

package/dist/toolboxCatalogs.d.ts

@@ -0,0 +1,8 @@
+export interface ToolboxCatalogConfig {
+    url?: string;
+    label?: string;
+    enabled?: boolean;
+}
+export type ToolboxCatalogConfigs = Record<string, ToolboxCatalogConfig>;
+/** Stable keys let child presets patch or disable a parent directory through defaults merging. */
+export declare function parseToolboxCatalogs(input: unknown): ToolboxCatalogConfigs;

package/dist/toolboxCatalogs.js

@@ -0,0 +1,34 @@
+import { isJsonObject, PresetError } from './manifest.js';
+/** Stable keys let child presets patch or disable a parent directory through defaults merging. */
+export function parseToolboxCatalogs(input) {
+    if (input === undefined)
+        return {};
+    function invalid() { throw new PresetError('PRESET_INVALID', 'Invalid extension.toolCatalogs configuration'); }
+    if (!isJsonObject(input) || Object.keys(input).length > 16)
+        invalid();
+    return Object.fromEntries(Object.entries(input).map(([id, entry]) => {
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(id) || id === 'official' || !isJsonObject(entry) || Object.keys(entry).some(key => !['url', 'label', 'enabled'].includes(key)))
+            invalid();
+        if (entry.enabled !== undefined && typeof entry.enabled !== 'boolean')
+            invalid();
+        if (entry.label !== undefined && (typeof entry.label !== 'string' || !entry.label.trim() || entry.label.length > 120))
+            invalid();
+        let url;
+        if (entry.url !== undefined) {
+            if (typeof entry.url !== 'string' || entry.url.length > 2048)
+                invalid();
+            try {
+                const parsed = new URL(entry.url);
+                if (parsed.username || parsed.password || parsed.hash || !(parsed.protocol === 'https:' || parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)))
+                    invalid();
+                url = parsed.href;
+            }
+            catch {
+                invalid();
+            }
+        }
+        else if (entry.enabled !== false)
+            invalid();
+        return [id, { ...(url ? { url } : {}), ...(entry.label !== undefined ? { label: entry.label } : {}), ...(entry.enabled !== undefined ? { enabled: entry.enabled } : {}) }];
+    }));
+}

package/dist/types.d.ts

@@ -11,7 +11,8 @@ export interface PresetComponent {
     /** Previous Skill sources eligible for migration only when setup owns the installation. */
     migrateFrom?: string[];
     enabled?: boolean;
-    runtimes?: PresetRuntime[];
+    /** Optional activation subset; supported locations are defined by the package. */
+    targets?: PresetRuntime[];
     dependsOn?: string[];
 }
 export interface PresetReference {

package/installation-site.json

@@ -0,0 +1,4 @@
+{
+  "url": "https://mearlhq.github.io/mearl/",
+  "extensionId": "aoehhjnofngknnjefamjbplchbolghkm"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mearl/preset",
-  "version": "3.0.0-beta.4",
+  "version": "3.0.0-beta.7",
   "description": "Browser-compatible preset validation, inheritance and capability resolution for Mearl",
   "type": "module",
   "license": "Apache-2.0",
@@ -18,11 +18,17 @@
     "./installation": {
       "types": "./dist/installation.d.ts",
       "import": "./dist/installation.js"
+    },
+    "./installation-site.json": "./installation-site.json",
+    "./networkRoutes": {
+      "types": "./dist/networkRoutes.d.ts",
+      "import": "./dist/networkRoutes.js"
     }
   },
   "files": [
     "dist",
-    "!dist/**/*.map"
+    "!dist/**/*.map",
+    "installation-site.json"
   ],
   "dependencies": {
     "semver": "^7.8.5"
@@ -32,7 +38,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/F-loat/mearl.git",
+    "url": "git+https://github.com/mearlhq/mearl.git",
     "directory": "packages/preset"
   },
   "scripts": {