@mearl/preset 3.0.0 → 3.0.2

package/README.en.md

@@ -12,6 +12,8 @@ Browser and Node share one inheritance resolution and resource download; see [co
 
 The main entry shares preset validation and inheritance resolution across browsers and Node, without filesystem, network, credential, or browser permission side effects. Callers supply manifest loading. Optional `@mearl/preset/bundles` provides resource validation, bounded downloads, and explicitly invoked browser-local storage; see [browser bundles](../../docs/browser-bundles.en.md).
 
+`@mearl/preset/pageRuntime` provides the page runtime host and source generation functions for standalone page injection scripts.
+
 ```ts
 import { resolvePreset, mergePresetDefaults } from '@mearl/preset';
 

package/README.md

@@ -12,6 +12,8 @@
 
 主入口在浏览器和 Node 中共享 preset 清单校验与继承解析，没有文件系统、网络、凭据或浏览器权限副作用；清单加载由调用方提供。可选子入口 `@mearl/preset/bundles` 提供资源校验、受限下载和显式调用的浏览器本地存储，见 [能力包说明](../../docs/browser-bundles.md)。
 
+`@mearl/preset/pageRuntime` 为独立的页面注入脚本提供页面运行时宿主及注入源码生成函数。
+
 ```ts
 import { resolvePreset, mergePresetDefaults } from '@mearl/preset';
 

package/dist/browserPreset.js

@@ -1,19 +1,32 @@
 import { selectBrowserControl } from './browserControls.js';
 import { BundleError, MAX_BROWSER_STORAGE_BYTES, verifyBundle } from './bundle.js';
-import { satisfies } from 'semver';
-import { preparePresetPackages, presetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets } from './prepare.js';
+import satisfies from 'semver/functions/satisfies.js';
+import { preparePresetPackages, presetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets, } from './prepare.js';
 /** Core browser defaults also need synchronization when no browser package is declared. */
 export function presetRequiresBrowser(preset) {
-    return Object.values(preset.packages).some(entry => entry.enabled !== false && entry.targets?.includes('browser')) || Object.keys(preset.appProfiles).length > 0 || Object.keys(preset.defaults).some(key => key === 'simulation' || key === 'extension' || key === 'services');
+    return (Object.values(preset.packages).some(entry => entry.enabled !== false && entry.targets?.includes('browser')) ||
+        Object.keys(preset.appProfiles).length > 0 ||
+        Object.keys(preset.defaults).some(key => key === 'simulation' || key === 'extension' || key === 'services'));
 }
 /** Browser selection can be derived from the same accepted batch without another download. */
 export async function browserPresetSnapshot(source, manifests, preset, bundles) {
     const ids = new Set(presetPackages(preset, ['browser']).map(([id]) => id));
     const selected = bundles.filter(bundle => ids.has(bundle.manifest.id));
     selectBrowserControl(selected);
-    const packageTargets = Object.fromEntries(Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false).map(([id, entry]) => [id, entry.targets]));
-    const data = { source, manifests, bundleRevisions: Object.fromEntries(selected.map(bundle => [bundle.manifest.id, bundle.revision])), packageTargets };
-    return { snapshot: { ...data, revision: await presetSnapshotRevision(data) }, preset, bundles: selected };
+    const packageTargets = Object.fromEntries(Object.entries(preset.packages)
+        .filter(([, entry]) => entry.enabled !== false)
+        .map(([id, entry]) => [id, entry.targets]));
+    const data = {
+        source,
+        manifests,
+        bundleRevisions: Object.fromEntries(selected.map(bundle => [bundle.manifest.id, bundle.revision])),
+        packageTargets,
+    };
+    return {
+        snapshot: { ...data, revision: await presetSnapshotRevision(data) },
+        preset,
+        bundles: selected,
+    };
 }
 export async function prepareBrowserPreset(source, options) {
     const prepared = await preparePresetPackages(source, options, ['browser']);
@@ -29,7 +42,9 @@ export async function verifyPreparedBrowserPreset(value, mearlApiVersion) {
         throw new BundleError('BUNDLE_QUOTA', 'Browser preset package count exceeds 64');
     let total = 0;
     for (const bundle of value.bundles) {
-        if (!bundle?.resources || typeof bundle.resources !== 'object' || Array.isArray(bundle.resources))
+        if (!bundle?.resources ||
+            typeof bundle.resources !== 'object' ||
+            Array.isArray(bundle.resources))
             throw new BundleError('BUNDLE_INVALID', 'Expected package resource buffers');
         const resources = Object.values(bundle.resources);
         if (resources.length > 64)
@@ -46,10 +61,14 @@ export async function verifyPreparedBrowserPreset(value, mearlApiVersion) {
         verifyBrowserPreset(value.snapshot, mearlApiVersion),
         Promise.all(value.bundles.map(bundle => verifyBundle(bundle, mearlApiVersion))),
     ]);
-    if (bundles.length !== Object.keys(graph.snapshot.bundleRevisions).length || new Set(bundles.map(bundle => bundle.manifest.id)).size !== bundles.length || bundles.some(bundle => {
-        const entry = graph.preset.packages[bundle.manifest.id];
-        return graph.snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision || entry?.source !== bundle.source || (entry.version && !satisfies(bundle.manifest.version, entry.version));
-    }))
+    if (bundles.length !== Object.keys(graph.snapshot.bundleRevisions).length ||
+        new Set(bundles.map(bundle => bundle.manifest.id)).size !== bundles.length ||
+        bundles.some(bundle => {
+            const entry = graph.preset.packages[bundle.manifest.id];
+            return (graph.snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision ||
+                entry?.source !== bundle.source ||
+                (entry.version && !satisfies(bundle.manifest.version, entry.version)));
+        }))
         throw new BundleError('BUNDLE_INTEGRITY', 'Browser activation requires every exact package');
     selectBrowserControl(bundles);
     verifyPackageTargets(graph.preset, bundles);

package/dist/bundle.d.ts

@@ -58,5 +58,7 @@ export declare function bundleDigest(bytes: Uint8Array): Promise<string>;
 export declare function readBundleJson(bundle: PreparedBundle, name: string): unknown;
 export declare function readBundleText(bundle: PreparedBundle, name: string): string;
 export declare function prepareBundle(source: string, options: PrepareBundleOptions): Promise<PreparedBundle>;
+/** Loads the resources declared by a validated manifest at its canonical source. */
+export declare function loadBundleResources(source: string, manifest: BundleManifest, options: Pick<PrepareBundleOptions, 'load' | 'signal'>): Promise<PreparedBundle>;
 /** Revalidates persisted snapshots without network access and returns independent resource buffers. */
 export declare function verifyBundle(bundle: PreparedBundle, mearlApiVersion: string): Promise<PreparedBundle>;

package/dist/bundle.js

@@ -1,4 +1,6 @@
-import { satisfies, valid, validRange } from 'semver';
+import satisfies from 'semver/functions/satisfies.js';
+import valid from 'semver/functions/valid.js';
+import validRange from 'semver/ranges/valid.js';
 import { clonePresetDefaults } from './manifest.js';
 import { validateBrowserControl } from './browserControls.js';
 export const MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
@@ -18,7 +20,9 @@ function invalid(message) {
     throw new BundleError('BUNDLE_INVALID', message);
 }
 function fields(value, names) {
-    if (!value || typeof value !== 'object' || Array.isArray(value) ||
+    if (!value ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
         Object.keys(value).some(key => !names.includes(key)))
         invalid('Unexpected manifest structure');
 }
@@ -48,10 +52,20 @@ export function validateBundleManifest(value, mearlApiVersion) {
     catch {
         invalid('Expected a JSON manifest');
     }
-    fields(json, ['schemaVersion', 'id', 'version', 'requires', 'defaults', 'resources', 'contributions']);
+    fields(json, [
+        'schemaVersion',
+        'id',
+        'version',
+        'requires',
+        'defaults',
+        'resources',
+        'contributions',
+    ]);
     if (json.defaults !== undefined)
         json.defaults = clonePresetDefaults(json.defaults);
-    if (json.schemaVersion !== 1 || typeof json.id !== 'string' || !/^[a-z][a-z0-9-]{0,79}$/.test(json.id))
+    if (json.schemaVersion !== 1 ||
+        typeof json.id !== 'string' ||
+        !/^[a-z][a-z0-9-]{0,79}$/.test(json.id))
         invalid('Invalid bundle identity');
     if (typeof json.version !== 'string' || valid(json.version) !== json.version)
         invalid('Expected an exact bundle version');
@@ -74,45 +88,77 @@ export function validateBundleManifest(value, mearlApiVersion) {
     for (const [name, resource] of resources) {
         path(name);
         fields(resource, ['sha256', 'byteLength']);
-        if (typeof resource.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(resource.sha256) ||
-            typeof resource.byteLength !== 'number' || !Number.isSafeInteger(resource.byteLength) || resource.byteLength < 0)
+        if (typeof resource.sha256 !== 'string' ||
+            !/^[a-f0-9]{64}$/.test(resource.sha256) ||
+            typeof resource.byteLength !== 'number' ||
+            !Number.isSafeInteger(resource.byteLength) ||
+            resource.byteLength < 0)
             invalid('Invalid resource metadata');
         total += resource.byteLength;
         if (total > MAX_BUNDLE_BYTES)
             throw new BundleError('BUNDLE_QUOTA', 'Bundle resources exceed 16 MiB');
     }
     if (json.contributions !== undefined) {
-        fields(json.contributions, ['appProfiles', 'pageRuntimes', 'nodeRuntimes', 'browserRuntimes', 'extension', 'requestUi', 'browserViews', 'browserControls']);
+        fields(json.contributions, [
+            'appProfiles',
+            'pageRuntimes',
+            'nodeRuntimes',
+            'browserRuntimes',
+            'extension',
+            'requestUi',
+            'browserViews',
+            'browserControls',
+        ]);
         const extension = json.contributions.extension;
-        if (extension !== undefined && (typeof extension !== 'string' || !Object.hasOwn(json.resources, extension)))
+        if (extension !== undefined &&
+            (typeof extension !== 'string' || !Object.hasOwn(json.resources, extension)))
             invalid('Extension contributions must reference a declared resource');
-        if (typeof extension === 'string' && json.resources[extension].byteLength > MAX_REQUEST_UI_BYTES)
+        if (typeof extension === 'string' &&
+            json.resources[extension].byteLength > MAX_REQUEST_UI_BYTES)
             throw new BundleError('BUNDLE_QUOTA', 'Extension contributions exceed 64 KiB');
         const controls = json.contributions.browserControls;
-        if (controls !== undefined && (typeof controls !== 'string' || !Object.hasOwn(json.resources, controls)))
+        if (controls !== undefined &&
+            (typeof controls !== 'string' || !Object.hasOwn(json.resources, controls)))
             invalid('Browser controls must reference a declared resource');
-        if (typeof controls === 'string' && json.resources[controls].byteLength > MAX_REQUEST_UI_BYTES)
+        if (typeof controls === 'string' &&
+            json.resources[controls].byteLength > MAX_REQUEST_UI_BYTES)
             throw new BundleError('BUNDLE_QUOTA', 'Browser controls exceed 64 KiB');
-        if (json.contributions.requestUi !== undefined && (typeof json.contributions.requestUi !== 'string' || !Object.hasOwn(json.resources, json.contributions.requestUi)))
+        if (json.contributions.requestUi !== undefined &&
+            (typeof json.contributions.requestUi !== 'string' ||
+                !Object.hasOwn(json.resources, json.contributions.requestUi)))
             invalid('Request UI must reference a declared resource');
-        if (typeof json.contributions.requestUi === 'string' && json.resources[json.contributions.requestUi].byteLength > MAX_REQUEST_UI_BYTES)
+        if (typeof json.contributions.requestUi === 'string' &&
+            json.resources[json.contributions.requestUi].byteLength >
+                MAX_REQUEST_UI_BYTES)
             throw new BundleError('BUNDLE_QUOTA', 'Request UI exceeds 64 KiB');
         if (json.contributions.browserViews !== undefined) {
-            fields(json.contributions.browserViews, ['requestImport', 'requestCases', 'captureLauncher', 'captureController']);
+            fields(json.contributions.browserViews, [
+                'requestImport',
+                'requestCases',
+                'captureLauncher',
+                'captureController',
+            ]);
             for (const resource of Object.values(json.contributions.browserViews)) {
                 if (typeof resource !== 'string' || !Object.hasOwn(json.resources, resource))
                     invalid('Browser views must reference declared resources');
-                if (json.resources[resource].byteLength > MAX_REQUEST_UI_BYTES)
+                if (json.resources[resource].byteLength >
+                    MAX_REQUEST_UI_BYTES)
                     throw new BundleError('BUNDLE_QUOTA', 'Browser view definition exceeds 64 KiB');
             }
         }
         const profiles = json.contributions.appProfiles === undefined ? [] : json.contributions.appProfiles;
-        if (!Array.isArray(profiles) || profiles.some(name => typeof name !== 'string' || !Object.hasOwn(json.resources, name)) ||
+        if (!Array.isArray(profiles) ||
+            profiles.some(name => typeof name !== 'string' || !Object.hasOwn(json.resources, name)) ||
             new Set(profiles).size !== profiles.length)
             invalid('App profiles must reference distinct declared resources');
         const runtimes = json.contributions.pageRuntimes;
         if (runtimes !== undefined) {
-            if (!runtimes || typeof runtimes !== 'object' || Array.isArray(runtimes) || Object.entries(runtimes).some(([id, name]) => !/^[a-z][a-z0-9-]{0,79}$/.test(id) || typeof name !== 'string' || !Object.hasOwn(json.resources, name)))
+            if (!runtimes ||
+                typeof runtimes !== 'object' ||
+                Array.isArray(runtimes) ||
+                Object.entries(runtimes).some(([id, name]) => !/^[a-z][a-z0-9-]{0,79}$/.test(id) ||
+                    typeof name !== 'string' ||
+                    !Object.hasOwn(json.resources, name)))
                 invalid('Page runtimes must reference declared resources');
             for (const name of Object.values(runtimes)) {
                 const resource = json.resources[name];
@@ -125,15 +171,26 @@ export function validateBundleManifest(value, mearlApiVersion) {
             const label = kind === 'nodeRuntimes' ? 'Node' : 'Browser';
             if (runtimes === undefined)
                 continue;
-            if (!runtimes || typeof runtimes !== 'object' || Array.isArray(runtimes) || Object.keys(runtimes).length > 16)
+            if (!runtimes ||
+                typeof runtimes !== 'object' ||
+                Array.isArray(runtimes) ||
+                Object.keys(runtimes).length > 16)
                 invalid(`Invalid ${label} runtime declarations`);
             for (const [host, declaration] of Object.entries(runtimes)) {
                 if (!/^[a-z][a-z0-9-]{0,79}$/.test(host))
                     invalid(`Invalid ${label} runtime host`);
                 fields(declaration, ['entry', 'bindings']);
-                if (typeof declaration.entry !== 'string' || !Object.hasOwn(json.resources, declaration.entry) || !declaration.entry.endsWith('.cjs'))
+                if (typeof declaration.entry !== 'string' ||
+                    !Object.hasOwn(json.resources, declaration.entry) ||
+                    !declaration.entry.endsWith('.cjs'))
                     invalid(`${label} runtime entry must reference a declared CommonJS resource`);
-                if (!declaration.bindings || typeof declaration.bindings !== 'object' || Array.isArray(declaration.bindings) || Object.keys(declaration.bindings).length > 256 || Object.entries(declaration.bindings).some(([hook, handler]) => !/^[a-z][a-zA-Z0-9_.-]{0,127}$/.test(hook) || typeof handler !== 'string' || !/^[a-z][a-zA-Z0-9_.-]{0,127}$/.test(handler)))
+                if (!declaration.bindings ||
+                    typeof declaration.bindings !== 'object' ||
+                    Array.isArray(declaration.bindings) ||
+                    Object.keys(declaration.bindings).length > 256 ||
+                    Object.entries(declaration.bindings).some(([hook, handler]) => !/^[a-z][a-zA-Z0-9_.-]{0,127}$/.test(hook) ||
+                        typeof handler !== 'string' ||
+                        !/^[a-z][a-zA-Z0-9_.-]{0,127}$/.test(handler)))
                     invalid(`Invalid ${label} runtime bindings`);
             }
         }
@@ -143,7 +200,12 @@ export function validateBundleManifest(value, mearlApiVersion) {
     return json;
 }
 export async function bundleDigest(bytes) {
-    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(bytes).buffer);
+    const buffer = bytes.buffer;
+    // WebCrypto snapshots fixed, non-shared input views before hashing asynchronously.
+    const data = buffer instanceof ArrayBuffer && !('resizable' in buffer && buffer.resizable)
+        ? new Uint8Array(buffer, bytes.byteOffset, bytes.byteLength)
+        : Uint8Array.from(bytes);
+    const digest = await crypto.subtle.digest('SHA-256', data);
     return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
 }
 async function manifestRevision(source, manifest) {
@@ -172,7 +234,8 @@ export function readBundleText(bundle, name) {
 export async function prepareBundle(source, options) {
     options.signal?.throwIfAborted();
     source = bundleSourceUrl(source);
-    if (options.version !== undefined && (!options.version.trim() || validRange(options.version) === null))
+    if (options.version !== undefined &&
+        (!options.version.trim() || validRange(options.version) === null))
         invalid('Invalid requested bundle version');
     const bytes = Uint8Array.from(await options.load(source, { maxBytes: MAX_BUNDLE_MANIFEST_BYTES, signal: options.signal }));
     options.signal?.throwIfAborted();
@@ -190,18 +253,31 @@ export async function prepareBundle(source, options) {
         invalid('Bundle identity does not match the requested package');
     if (options.version && !satisfies(manifest.version, options.version))
         throw new BundleError('BUNDLE_INCOMPATIBLE', 'Bundle version does not satisfy the requested range');
+    return loadBundleResources(source, manifest, options);
+}
+/** Loads the resources declared by a validated manifest at its canonical source. */
+export async function loadBundleResources(source, manifest, options) {
     const resources = {};
     for (const [name, expected] of Object.entries(manifest.resources)) {
         options.signal?.throwIfAborted();
-        const resource = Uint8Array.from(await options.load(new URL(name, source).href, { maxBytes: expected.byteLength, signal: options.signal }));
+        const resource = Uint8Array.from(await options.load(new URL(name, source).href, {
+            maxBytes: expected.byteLength,
+            signal: options.signal,
+        }));
         options.signal?.throwIfAborted();
-        if (resource.byteLength !== expected.byteLength || await bundleDigest(resource) !== expected.sha256) {
+        if (resource.byteLength !== expected.byteLength ||
+            (await bundleDigest(resource)) !== expected.sha256) {
             throw new BundleError('BUNDLE_INTEGRITY', `Resource integrity check failed: ${name}`);
         }
         resources[name] = resource;
     }
     options.signal?.throwIfAborted();
-    const prepared = { source, manifest, revision: await manifestRevision(source, manifest), resources };
+    const prepared = {
+        source,
+        manifest,
+        revision: await manifestRevision(source, manifest),
+        resources,
+    };
     if (manifest.contributions?.browserControls)
         validateBrowserControl(readBundleJson(prepared, manifest.contributions.browserControls));
     return prepared;
@@ -211,7 +287,8 @@ export async function verifyBundle(bundle, mearlApiVersion) {
     const source = bundleSourceUrl(bundle.source);
     const manifest = validateBundleManifest(bundle.manifest, mearlApiVersion);
     const revision = bundle.revision;
-    if (!bundle.resources || typeof bundle.resources !== 'object' ||
+    if (!bundle.resources ||
+        typeof bundle.resources !== 'object' ||
         Object.keys(bundle.resources).length !== Object.keys(manifest.resources).length)
         invalid('Stored resource set does not match the manifest');
     const resources = {};
@@ -225,10 +302,10 @@ export async function verifyBundle(bundle, mearlApiVersion) {
         }
         resources[name] = bytes;
     }
-    if (await manifestRevision(source, manifest) !== revision)
+    if ((await manifestRevision(source, manifest)) !== revision)
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored manifest revision does not match');
     for (const [name, expected] of Object.entries(manifest.resources)) {
-        if (await bundleDigest(resources[name]) !== expected.sha256)
+        if ((await bundleDigest(resources[name])) !== expected.sha256)
             throw new BundleError('BUNDLE_INTEGRITY', `Stored resource integrity check failed: ${name}`);
     }
     const prepared = { source, manifest, revision, resources };

package/dist/bundleStore.d.ts

@@ -63,6 +63,7 @@ export declare class BrowserBundleStore {
         installation?: BrowserPresetInstallation;
         expectedInstallationToken: string | null;
     }, expectedBundleRevisions?: Record<string, string>): Promise<void>;
+    uninstallPreset(expectedRevision: string, expectedInstallationToken: string | null): Promise<void>;
     /** Verifies all resources before a compare-and-swap transaction replaces the active snapshot. */
     install(bundle: PreparedBundle, expectedRevision: string | null, expectedBundleRevisions?: Record<string, string>): Promise<void>;
     remove(id: string, expectedRevision: string): Promise<void>;

package/dist/bundleStore.js

@@ -1,8 +1,11 @@
-import { BundleError, MAX_BUNDLE_BYTES, MAX_BROWSER_STORAGE_BYTES, MAX_PAGE_RUNTIME_BYTES, bundleDigest, verifyBundle } from './bundle.js';
-import { verifyBrowserPreset, verifyPreparedBrowserPreset } from './browserPreset.js';
+import { BundleError, MAX_BUNDLE_BYTES, MAX_BROWSER_STORAGE_BYTES, MAX_PAGE_RUNTIME_BYTES, bundleDigest, verifyBundle, } from './bundle.js';
+import { verifyBrowserPreset, verifyPreparedBrowserPreset, } from './browserPreset.js';
 import { mergePresetDefaults } from './resolve.js';
 function installationMetadata(value) {
-    if (!value || Object.keys(value).some(key => !['revision', 'browserRevision', 'overrides'].includes(key)) || !/^[a-f0-9]{64}$/.test(value.revision) || !/^[a-f0-9]{64}$/.test(value.browserRevision))
+    if (!value ||
+        Object.keys(value).some(key => !['revision', 'browserRevision', 'overrides'].includes(key)) ||
+        !/^[a-f0-9]{64}$/.test(value.revision) ||
+        !/^[a-f0-9]{64}$/.test(value.browserRevision))
         throw new BundleError('BUNDLE_INVALID', 'Invalid browser installation identity');
     const overrides = mergePresetDefaults({}, value.overrides);
     if (new TextEncoder().encode(JSON.stringify(overrides)).byteLength > 262144)
@@ -17,18 +20,25 @@ function captureRevisions(input) {
     if (input === undefined)
         return;
     const entries = Object.entries(input);
-    if (entries.length > 64 || entries.some(([id, revision]) => !/^[a-z][a-z0-9-]{0,79}$/.test(id) || typeof revision !== 'string'))
+    if (entries.length > 64 ||
+        entries.some(([id, revision]) => !/^[a-z][a-z0-9-]{0,79}$/.test(id) || typeof revision !== 'string'))
         throw new BundleError('BUNDLE_INVALID', 'Invalid expected browser bundle selection');
     return Object.fromEntries(entries);
 }
 function checkRevisions(records, expected) {
-    if (expected && (records.length !== Object.keys(expected).length || records.some(record => !Object.hasOwn(expected, record.id) || expected[record.id] !== record.revision)))
+    if (expected &&
+        (records.length !== Object.keys(expected).length ||
+            records.some(record => !Object.hasOwn(expected, record.id) || expected[record.id] !== record.revision)))
         throw new BundleError('BUNDLE_CONFLICT', 'Browser bundles changed while contributions were being validated');
 }
 function storedBundle(bundle) {
     const { resources, ...metadata } = bundle;
-    return { id: bundle.manifest.id, revision: bundle.revision,
-        byteLength: Object.values(resources).reduce((sum, bytes) => sum + bytes.byteLength, 0), bundle: metadata };
+    return {
+        id: bundle.manifest.id,
+        revision: bundle.revision,
+        byteLength: Object.values(resources).reduce((sum, bytes) => sum + bytes.byteLength, 0),
+        bundle: metadata,
+    };
 }
 function bundleObjectHashes(records) {
     const hashes = new Set();
@@ -61,13 +71,17 @@ function readObjects(records, store) {
     const hashes = bundleObjectHashes(records);
     for (const hash of hashes) {
         const request = store.get(hash);
-        request.onsuccess = () => { if (request.result)
-            result.set(hash, request.result); };
+        request.onsuccess = () => {
+            if (request.result)
+                result.set(hash, request.result);
+        };
     }
     return result;
 }
 function checkStorageBudget(records, runtimes) {
-    if (records.some(record => !Number.isSafeInteger(record.byteLength) || record.byteLength < 0 || record.byteLength > MAX_BUNDLE_BYTES) ||
+    if (records.some(record => !Number.isSafeInteger(record.byteLength) ||
+        record.byteLength < 0 ||
+        record.byteLength > MAX_BUNDLE_BYTES) ||
         runtimes.some(runtime => !(runtime.bytes instanceof Uint8Array) || runtime.bytes.byteLength > MAX_BUNDLE_BYTES)) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored resource size is invalid');
     }
@@ -100,10 +114,16 @@ export class BrowserBundleStore {
             request.onerror = () => reject(request.error);
             request.onsuccess = () => {
                 const database = request.result;
-                database.onversionchange = () => { database.close(); this.database = undefined; };
+                database.onversionchange = () => {
+                    database.close();
+                    this.database = undefined;
+                };
                 resolve(database);
             };
-        }).catch(error => { this.database = undefined; throw error; });
+        }).catch(error => {
+            this.database = undefined;
+            throw error;
+        });
         return this.database;
     }
     async close() {
@@ -118,11 +138,19 @@ export class BrowserBundleStore {
             const transaction = database.transaction([STORE, PRESET, OBJECTS], 'readonly');
             const request = transaction.objectStore(STORE).getAll();
             let objects = new Map();
-            request.onsuccess = () => { objects = readObjects(request.result, transaction.objectStore(OBJECTS)); };
+            request.onsuccess = () => {
+                objects = readObjects(request.result, transaction.objectStore(OBJECTS));
+            };
             const active = transaction.objectStore(PRESET).get('active');
             const installation = transaction.objectStore(PRESET).get('installation');
             const token = transaction.objectStore(PRESET).get('installationToken');
-            transaction.oncomplete = () => resolve({ objects, records: request.result, active: active.result, installation: installation.result, installationToken: token.result ?? null });
+            transaction.oncomplete = () => resolve({
+                objects,
+                records: request.result,
+                active: active.result,
+                installation: installation.result,
+                installationToken: token.result ?? null,
+            });
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Bundle read failed'));
         });
     }
@@ -132,7 +160,9 @@ export class BrowserBundleStore {
         const record = await new Promise((resolve, reject) => {
             const transaction = database.transaction([STORE, OBJECTS], 'readonly');
             const request = transaction.objectStore(STORE).get(id);
-            request.onsuccess = () => { objects = readObjects(request.result ? [request.result] : [], transaction.objectStore(OBJECTS)); };
+            request.onsuccess = () => {
+                objects = readObjects(request.result ? [request.result] : [], transaction.objectStore(OBJECTS));
+            };
             transaction.oncomplete = () => resolve(request.result);
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Bundle read failed'));
         });
@@ -150,7 +180,8 @@ export class BrowserBundleStore {
             resources[name] = object.bytes;
         }
         const bundle = await verifyBundle({ ...record.bundle, resources }, this.options.mearlApiVersion);
-        if (Object.values(bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0) !== record.byteLength) {
+        if (Object.values(bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0) !==
+            record.byteLength) {
             throw new BundleError('BUNDLE_INTEGRITY', 'Stored resource size does not match');
         }
         return bundle;
@@ -158,13 +189,16 @@ export class BrowserBundleStore {
     async list() {
         const bundles = [];
         const errors = [];
-        const { objects, records, active, installation: storedInstallation, installationToken } = await this.records();
+        const { objects, records, active, installation: storedInstallation, installationToken, } = await this.records();
         for (const record of records) {
             try {
                 bundles.push(await this.verified(record, objects));
             }
             catch (error) {
-                errors.push({ id: record.id, error: error instanceof Error ? error.message : 'Invalid stored bundle' });
+                errors.push({
+                    id: record.id,
+                    error: error instanceof Error ? error.message : 'Invalid stored bundle',
+                });
             }
         }
         let activation;
@@ -181,8 +215,12 @@ export class BrowserBundleStore {
             }
             if (activation) {
                 for (const [id, revision] of Object.entries(activation.snapshot.bundleRevisions)) {
-                    if (!bundles.some(bundle => bundle.manifest.id === id && bundle.revision === revision) && !errors.some(error => error.id === id)) {
-                        errors.push({ id, error: 'BUNDLE_INTEGRITY: An active preset package is missing or corrupt' });
+                    if (!bundles.some(bundle => bundle.manifest.id === id && bundle.revision === revision) &&
+                        !errors.some(error => error.id === id)) {
+                        errors.push({
+                            id,
+                            error: 'BUNDLE_INTEGRITY: An active preset package is missing or corrupt',
+                        });
                     }
                 }
             }
@@ -198,8 +236,17 @@ export class BrowserBundleStore {
                 installationError = error instanceof Error ? error.message : 'Invalid browser installation';
             }
         }
-        return { bundles, errors, activation, activationError, installation, installationError, installationToken, activeRevision: active?.revision ?? null,
-            revisions: Object.fromEntries(records.map(record => [record.id, record.revision])) };
+        return {
+            bundles,
+            errors,
+            activation,
+            activationError,
+            installation,
+            installationError,
+            installationToken,
+            activeRevision: active?.revision ?? null,
+            revisions: Object.fromEntries(records.map(record => [record.id, record.revision])),
+        };
     }
     async activePreset() {
         const database = await this.open();
@@ -222,7 +269,10 @@ export class BrowserBundleStore {
             transaction.oncomplete = () => resolve(request.result);
             transaction.onabort = transaction.onerror = () => reject(transaction.error ?? new Error('Browser runtime read failed'));
         });
-        if (!(record?.bytes instanceof Uint8Array) || record.sha256 !== sha256 || record.bytes.byteLength > MAX_BUNDLE_BYTES || await bundleDigest(record.bytes) !== sha256) {
+        if (!(record?.bytes instanceof Uint8Array) ||
+            record.sha256 !== sha256 ||
+            record.bytes.byteLength > MAX_BUNDLE_BYTES ||
+            (await bundleDigest(record.bytes)) !== sha256) {
             throw new BundleError('BUNDLE_INTEGRITY', 'Pinned browser runtime is missing or corrupt');
         }
         return Uint8Array.from(record.bytes);
@@ -248,7 +298,8 @@ export class BrowserBundleStore {
     }
     async updateRuntimePins(input, replace) {
         const patch = Object.entries(input).map(([owner, sha256]) => {
-            if (!/^[a-zA-Z0-9:._-]{1,200}$/.test(owner) || sha256 !== null && !/^[a-f0-9]{64}$/.test(sha256))
+            if (!/^[a-zA-Z0-9:._-]{1,200}$/.test(owner) ||
+                (sha256 !== null && !/^[a-f0-9]{64}$/.test(sha256)))
                 throw new BundleError('BUNDLE_INVALID', 'Invalid page runtime reference');
             return { owner, sha256 };
         });
@@ -302,7 +353,9 @@ export class BrowserBundleStore {
             const transaction = database.transaction([PRESET, STORE, OBJECTS], 'readonly');
             const current = transaction.objectStore(PRESET).get('active');
             const bundle = transaction.objectStore(STORE).get(id);
-            bundle.onsuccess = () => { objects = readObjects(bundle.result ? [bundle.result] : [], transaction.objectStore(OBJECTS)); };
+            bundle.onsuccess = () => {
+                objects = readObjects(bundle.result ? [bundle.result] : [], transaction.objectStore(OBJECTS));
+            };
             transaction.oncomplete = () => {
                 if (current.result?.revision !== activation.snapshot.revision) {
                     reject(new BundleError('BUNDLE_CONFLICT', 'The selected preset changed during profile lookup'));
@@ -320,10 +373,18 @@ export class BrowserBundleStore {
     /** Packages and the exact preset graph become visible together, after host contribution checks. */
     async activatePreset(input, replacements, expectedRevision, association, expectedBundleRevisions) {
         const selection = captureRevisions(expectedBundleRevisions);
-        const accepted = association?.installation && { installation: installationMetadata(association.installation), expected: association.expectedInstallationToken };
-        if (association && association.expectedInstallationToken !== null && !/^[a-f0-9]{64}$/.test(association.expectedInstallationToken) || accepted && accepted.installation.browserRevision !== input.revision)
+        const accepted = association?.installation && {
+            installation: installationMetadata(association.installation),
+            expected: association.expectedInstallationToken,
+        };
+        if ((association &&
+            association.expectedInstallationToken !== null &&
+            !/^[a-f0-9]{64}$/.test(association.expectedInstallationToken)) ||
+            (accepted && accepted.installation.browserRevision !== input.revision))
             throw new BundleError('BUNDLE_INVALID', 'Invalid browser installation selection');
-        if (replacements.length > 64 || replacements.reduce((total, item) => total + Object.values(item.bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0), 0) > MAX_BROWSER_STORAGE_BYTES) {
+        if (replacements.length > 64 ||
+            replacements.reduce((total, item) => total +
+                Object.values(item.bundle.resources).reduce((sum, bytes) => sum + bytes.byteLength, 0), 0) > MAX_BROWSER_STORAGE_BYTES) {
             throw new BundleError('BUNDLE_QUOTA', 'Preset packages exceed the browser storage budget');
         }
         const expected = replacements.map(item => item.expectedRevision);
@@ -351,14 +412,20 @@ export class BrowserBundleStore {
                     transaction.abort();
                     return;
                 }
-                if ((active.result?.revision ?? null) !== expectedRevision || association && (installation.result ?? null) !== association.expectedInstallationToken || next.some(item => (records.result.find(record => record.id === item.bundle.manifest.id)?.revision ?? null) !== item.expectedRevision)) {
+                if ((active.result?.revision ?? null) !== expectedRevision ||
+                    (association &&
+                        (installation.result ?? null) !== association.expectedInstallationToken) ||
+                    next.some(item => (records.result.find(record => record.id === item.bundle.manifest.id)?.revision ??
+                        null) !== item.expectedRevision)) {
                     failure = new BundleError('BUNDLE_CONFLICT', 'Preset or packages changed while activation was being prepared');
                     transaction.abort();
                     return;
                 }
                 const replacing = new Set(next.map(item => item.bundle.manifest.id));
                 const previousManaged = new Set(Object.keys(active.result?.bundleRevisions ?? {}));
-                if (accepted && next.some(item => !previousManaged.has(item.bundle.manifest.id) && records.result.some(record => record.id === item.bundle.manifest.id))) {
+                if (accepted &&
+                    next.some(item => !previousManaged.has(item.bundle.manifest.id) &&
+                        records.result.some(record => record.id === item.bundle.manifest.id))) {
                     failure = new BundleError('BUNDLE_CONFLICT', 'A preset package conflicts with an independently installed browser package');
                     transaction.abort();
                     return;
@@ -405,6 +472,47 @@ export class BrowserBundleStore {
             transaction.onabort = transaction.onerror = () => reject(failure ?? transaction.error ?? new Error('Preset activation failed'));
         });
     }
+    async uninstallPreset(expectedRevision, expectedInstallationToken) {
+        const selection = await this.activePreset();
+        if (selection?.snapshot.revision !== expectedRevision)
+            throw new BundleError('BUNDLE_CONFLICT', 'The browser preset changed before removal');
+        const managed = selection.snapshot.bundleRevisions;
+        const database = await this.open();
+        await new Promise((resolve, reject) => {
+            const transaction = database.transaction([STORE, PRESET, OBJECTS, PINS], 'readwrite');
+            const store = transaction.objectStore(STORE);
+            const presets = transaction.objectStore(PRESET);
+            const objects = transaction.objectStore(OBJECTS);
+            const records = store.getAll();
+            const retained = objects.getAll();
+            const pins = transaction.objectStore(PINS).getAll();
+            const token = presets.get('installationToken');
+            const active = presets.get('active');
+            let failure;
+            active.onsuccess = () => {
+                if (active.result?.revision !== expectedRevision ||
+                    (token.result ?? null) !== expectedInstallationToken) {
+                    failure = new BundleError('BUNDLE_CONFLICT', 'The browser preset changed before removal');
+                    transaction.abort();
+                    return;
+                }
+                const remaining = records.result.filter(record => {
+                    if (!Object.hasOwn(managed, record.id) || managed[record.id] !== record.revision)
+                        return true;
+                    store.delete(record.id);
+                    return false;
+                });
+                const keep = new Set(referencedObjects(remaining, retained.result, pins.result).map(object => object.sha256));
+                for (const object of retained.result)
+                    if (!keep.has(object.sha256))
+                        objects.delete(object.sha256);
+                for (const key of ['active', 'installation', 'installationToken'])
+                    presets.delete(key);
+            };
+            transaction.oncomplete = () => resolve();
+            transaction.onabort = transaction.onerror = () => reject(failure ?? transaction.error ?? new Error('Browser preset removal failed'));
+        });
+    }
     /** Verifies all resources before a compare-and-swap transaction replaces the active snapshot. */
     async install(bundle, expectedRevision, expectedBundleRevisions) {
         const selection = captureRevisions(expectedBundleRevisions);

package/dist/management.js

@@ -1,19 +1,32 @@
-import { valid, validRange, satisfies, subset } from 'semver';
+import satisfies from 'semver/functions/satisfies.js';
+import valid from 'semver/functions/valid.js';
+import subset from 'semver/ranges/subset.js';
+import validRange from 'semver/ranges/valid.js';
 import { isJsonObject, PresetError } from './manifest.js';
 /** Declarative installation guidance; never accepts commands, arguments or executable hooks. */
 export function parseSetupManagement(value) {
     if (value === undefined)
         return;
-    const invalid = () => { throw new PresetError('PRESET_INVALID', 'Invalid defaults.management.setup declaration'); };
-    if (!isJsonObject(value) || Object.keys(value).some(key => key !== 'setup') || !isJsonObject(value.setup))
+    const invalid = () => {
+        throw new PresetError('PRESET_INVALID', 'Invalid defaults.management.setup declaration');
+    };
+    if (!isJsonObject(value) ||
+        Object.keys(value).some(key => key !== 'setup') ||
+        !isJsonObject(value.setup))
         return invalid();
     const setup = value.setup;
     if (Object.keys(setup).some(key => !['package', 'version', 'registry', 'runtime'].includes(key)) ||
-        typeof setup.package !== 'string' || setup.package.length > 214 || !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(setup.package) ||
-        typeof setup.version !== 'string' || setup.version.length > 64 || !(valid(setup.version) === setup.version || /^[a-z][a-z0-9.-]*$/.test(setup.version)))
+        typeof setup.package !== 'string' ||
+        setup.package.length > 214 ||
+        !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(setup.package) ||
+        typeof setup.version !== 'string' ||
+        setup.version.length > 64 ||
+        !(valid(setup.version) === setup.version || /^[a-z][a-z0-9.-]*$/.test(setup.version)))
         return invalid();
     if (setup.registry !== undefined) {
-        if (typeof setup.registry !== 'string' || setup.registry.length > 2048 || !/^https:\/\/[a-zA-Z0-9./:_-]+$/.test(setup.registry))
+        if (typeof setup.registry !== 'string' ||
+            setup.registry.length > 2048 ||
+            !/^https:\/\/[a-zA-Z0-9./:_-]+$/.test(setup.registry))
             return invalid();
         try {
             const url = new URL(setup.registry);
@@ -24,7 +37,8 @@ export function parseSetupManagement(value) {
             return invalid();
         }
     }
-    if (setup.runtime !== undefined && (typeof setup.runtime !== 'string' || setup.runtime.length > 128 || !validRange(setup.runtime)))
+    if (setup.runtime !== undefined &&
+        (typeof setup.runtime !== 'string' || setup.runtime.length > 128 || !validRange(setup.runtime)))
         return invalid();
     return { ...setup };
 }
@@ -32,5 +46,7 @@ export function setupManagementCommand(setup) {
     return `npx${setup.registry ? ` --registry=${setup.registry}` : ''} ${setup.package}@${setup.version}`;
 }
 export function setupRuntimeCompatible(setup, version, targetLine) {
-    return !setup.runtime || (satisfies(version, setup.runtime, { includePrerelease: true }) && (!targetLine || subset(targetLine, setup.runtime, { includePrerelease: true })));
+    return (!setup.runtime ||
+        (satisfies(version, setup.runtime, { includePrerelease: true }) &&
+            (!targetLine || subset(targetLine, setup.runtime, { includePrerelease: true }))));
 }

package/dist/manifest.js

@@ -1,5 +1,6 @@
 import { validateInstallationOrigin } from './installation.js';
-import { valid, validRange } from 'semver';
+import valid from 'semver/functions/valid.js';
+import validRange from 'semver/ranges/valid.js';
 export class PresetError extends Error {
     code;
     constructor(code, message) {
@@ -14,9 +15,10 @@ function invalid(path, reason) {
     throw new PresetError('PRESET_INVALID', `${path}: ${reason}`);
 }
 export function isJsonObject(value) {
-    return value !== null && typeof value === 'object' &&
+    return (value !== null &&
+        typeof value === 'object' &&
         !Array.isArray(value) &&
-        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null));
 }
 function object(value, path) {
     if (!isJsonObject(value))
@@ -88,7 +90,8 @@ function component(value, path, kind) {
         invalid(`${path}.enabled`, 'expected a boolean');
     if ('targets' in value) {
         stringArray(value.targets, `${path}.targets`);
-        if (value.targets.length === 0 || value.targets.some(item => item !== 'browser' && item !== 'node')) {
+        if (value.targets.length === 0 ||
+            value.targets.some(item => item !== 'browser' && item !== 'node')) {
             invalid(`${path}.targets`, 'expected browser and/or node');
         }
     }
@@ -100,7 +103,19 @@ function component(value, path, kind) {
     return json(value, path);
 }
 export function validatePreset(value) {
-    fields(value, 'preset', ['schemaVersion', 'id', 'version', 'extends', 'requires', 'packages', 'skills', 'providers', 'appProfiles', 'defaults', 'permissions']);
+    fields(value, 'preset', [
+        'schemaVersion',
+        'id',
+        'version',
+        'extends',
+        'requires',
+        'packages',
+        'skills',
+        'providers',
+        'appProfiles',
+        'defaults',
+        'permissions',
+    ]);
     if (value.schemaVersion !== 1)
         invalid('schemaVersion', 'only version 1 is supported');
     id(value.id, 'id');
@@ -113,13 +128,20 @@ export function validatePreset(value) {
         text(value.extends.source, 'extends.source');
         if ('version' in value.extends)
             range(value.extends.version, 'extends.version');
-        result.extends = { source: value.extends.source, ...(value.extends.version === undefined ? {} : { version: value.extends.version }) };
+        result.extends = {
+            source: value.extends.source,
+            ...(value.extends.version === undefined ? {} : { version: value.extends.version }),
+        };
     }
     if ('requires' in value) {
         fields(value.requires, 'requires', ['mearlApi']);
         if ('mearlApi' in value.requires)
             range(value.requires.mearlApi, 'requires.mearlApi');
-        result.requires = { ...(value.requires.mearlApi === undefined ? {} : { mearlApi: value.requires.mearlApi }) };
+        result.requires = {
+            ...(value.requires.mearlApi === undefined
+                ? {}
+                : { mearlApi: value.requires.mearlApi }),
+        };
     }
     for (const kind of ['packages', 'skills', 'providers']) {
         if (!(kind in value))
@@ -148,14 +170,18 @@ export function validatePreset(value) {
         const origins = value.permissions.origins ?? [];
         if (origins.length > 64)
             invalid('permissions.origins', 'exceeds 64 scopes');
-        result.permissions = { origins: [...new Set(origins.map((origin, index) => {
+        result.permissions = {
+            origins: [
+                ...new Set(origins.map((origin, index) => {
                     try {
                         return validateInstallationOrigin(origin);
                     }
                     catch {
                         return invalid(`permissions.origins[${index}]`, 'expected an explicit HTTP host scope');
                     }
-                }))] };
+                })),
+            ],
+        };
     }
     if (JSON.stringify(result).length > 262_144)
         invalid('preset', 'manifest exceeds 256 Ki UTF-16 code units');

package/dist/prepare.js

@@ -1,5 +1,5 @@
-import { BundleError, MAX_BROWSER_STORAGE_BYTES, MAX_BUNDLE_MANIFEST_BYTES, bundleDigest, bundleSourceUrl, prepareBundle, validateBundleManifest } from './bundle.js';
-import { satisfies } from 'semver';
+import { BundleError, MAX_BROWSER_STORAGE_BYTES, MAX_BUNDLE_MANIFEST_BYTES, bundleDigest, bundleSourceUrl, loadBundleResources, validateBundleManifest, } from './bundle.js';
+import satisfies from 'semver/functions/satisfies.js';
 import { clonePresetDefaults, validatePreset } from './manifest.js';
 import { resolvePreset } from './resolve.js';
 export async function presetSnapshotRevision(value) {
@@ -7,7 +7,8 @@ export async function presetSnapshotRevision(value) {
 }
 /** Select candidates without assuming that inferred locations have been discovered. */
 function selectPresetPackages(preset, runtimes) {
-    const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false && (entry.targets ?? ['browser', 'node']).some(runtime => runtimes.includes(runtime)));
+    const entries = Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false &&
+        (entry.targets ?? ['browser', 'node']).some(runtime => runtimes.includes(runtime)));
     if (entries.length > 64)
         throw new BundleError('BUNDLE_QUOTA', 'A preset can activate at most 64 packages');
     return entries;
@@ -35,7 +36,14 @@ export function presetPackages(preset, runtimes) {
 export function bundleTargets(bundle) {
     const contributions = bundle.manifest.contributions;
     const targets = [];
-    if (contributions && (Object.keys(contributions.browserRuntimes ?? {}).length || Object.keys(contributions.pageRuntimes ?? {}).length || contributions.appProfiles?.length || contributions.extension || contributions.requestUi || contributions.browserViews || contributions.browserControls))
+    if (contributions &&
+        (Object.keys(contributions.browserRuntimes ?? {}).length ||
+            Object.keys(contributions.pageRuntimes ?? {}).length ||
+            contributions.appProfiles?.length ||
+            contributions.extension ||
+            contributions.requestUi ||
+            contributions.browserViews ||
+            contributions.browserControls))
         targets.push('browser');
     if (Object.keys(contributions?.nodeRuntimes ?? {}).length)
         targets.push('node');
@@ -49,7 +57,12 @@ export function applyPackageTargets(preset, targets) {
     const packages = { ...preset.packages };
     for (const [id, entry] of enabled) {
         const selected = targets[id];
-        if (!Array.isArray(selected) || !selected.length || selected.length > 2 || new Set(selected).size !== selected.length || selected.some(target => target !== 'browser' && target !== 'node') || entry.targets && JSON.stringify(entry.targets) !== JSON.stringify(selected))
+        if (!Array.isArray(selected) ||
+            !selected.length ||
+            selected.length > 2 ||
+            new Set(selected).size !== selected.length ||
+            selected.some(target => target !== 'browser' && target !== 'node') ||
+            (entry.targets && JSON.stringify(entry.targets) !== JSON.stringify(selected)))
             throw new BundleError('BUNDLE_INTEGRITY', 'Invalid package target selection');
         packages[id] = { ...entry, targets: [...selected] };
     }
@@ -96,10 +109,14 @@ export async function preparePresetPackages(source, options, runtimes) {
         },
     });
     const targetsKnown = Object.values(preset.packages).every(entry => entry.enabled === false || Boolean(entry.targets?.length));
-    const entries = targetsKnown ? presetPackages(preset, runtimes) : selectPresetPackages(preset, runtimes);
+    const entries = targetsKnown
+        ? presetPackages(preset, runtimes)
+        : selectPresetPackages(preset, runtimes);
     const bundles = [];
     const pending = [];
-    const packageTargets = Object.fromEntries(Object.entries(preset.packages).filter(([, entry]) => entry.enabled !== false).map(([id, entry]) => [id, entry.targets ?? []]));
+    const packageTargets = Object.fromEntries(Object.entries(preset.packages)
+        .filter(([, entry]) => entry.enabled !== false)
+        .map(([id, entry]) => [id, entry.targets ?? []]));
     for (const [id, entry] of entries) {
         const manifestSource = bundleSourceUrl(entry.source);
         const bytes = Uint8Array.from(await load(manifestSource, { maxBytes: MAX_BUNDLE_MANIFEST_BYTES, signal: options.signal }));
@@ -121,25 +138,38 @@ export async function preparePresetPackages(source, options, runtimes) {
         if (targets.some(target => !available.includes(target)))
             throw new BundleError('BUNDLE_INCOMPATIBLE', 'Package does not support the selected target');
         packageTargets[id] = targets;
-        pending.push({ id, entry, source: manifestSource, bytes });
+        pending.push({ source: manifestSource, manifest, bytes });
     }
     preset = applyPackageTargets(preset, packageTargets);
     const selected = new Set(presetPackages(preset, runtimes).map(([id]) => id));
-    for (const candidate of pending) {
-        if (!selected.has(candidate.id))
+    for (const { source: manifestSource, manifest, bytes } of pending) {
+        if (!selected.has(manifest.id))
             continue;
-        bundles.push(await prepareBundle(candidate.source, { ...options, load: (url, request) => url === candidate.source ? Promise.resolve(candidate.bytes) : load(url, request), expectedId: candidate.id, version: candidate.entry.version }));
+        bundles.push(await loadBundleResources(manifestSource, manifest, {
+            // A resource at the manifest URL belongs to the same captured response.
+            load: (url, request) => url === manifestSource ? Promise.resolve(bytes) : load(url, request),
+            signal: options.signal,
+        }));
     }
-    verifyPackageTargets(preset, bundles);
     options.signal?.throwIfAborted();
-    return { source, manifests, preset, bundles: bundles.filter(bundle => selected.has(bundle.manifest.id)), packageTargets };
+    return { source, manifests, preset, bundles, packageTargets };
 }
 /** The exact graph is checked offline; installed resources are verified by the target store. */
 export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full) {
     const json = clonePresetDefaults(value);
-    const allowed = ['source', 'manifests', 'bundleRevisions', 'packageTargets', 'revision', ...(full ? ['schemaVersion'] : [])];
-    if (Object.keys(json).some(key => !allowed.includes(key)) || (full && json.schemaVersion !== 1) ||
-        typeof json.source !== 'string' || typeof json.revision !== 'string' || !/^[a-f0-9]{64}$/.test(json.revision)) {
+    const allowed = [
+        'source',
+        'manifests',
+        'bundleRevisions',
+        'packageTargets',
+        'revision',
+        ...(full ? ['schemaVersion'] : []),
+    ];
+    if (Object.keys(json).some(key => !allowed.includes(key)) ||
+        (full && json.schemaVersion !== 1) ||
+        typeof json.source !== 'string' ||
+        typeof json.revision !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(json.revision)) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Invalid stored preset identity');
     }
     const source = bundleSourceUrl(json.source);
@@ -147,7 +177,8 @@ export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full)
     if (Object.keys(manifests).length > 32)
         throw new BundleError('BUNDLE_QUOTA', 'Stored preset inheritance exceeds 32 manifests');
     const bundleRevisions = clonePresetDefaults(json.bundleRevisions);
-    if (Object.keys(bundleRevisions).length > 64 || Object.values(bundleRevisions).some(revision => typeof revision !== 'string' || !/^[a-f0-9]{64}$/.test(revision))) {
+    if (Object.keys(bundleRevisions).length > 64 ||
+        Object.values(bundleRevisions).some(revision => typeof revision !== 'string' || !/^[a-f0-9]{64}$/.test(revision))) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Invalid stored package revisions');
     }
     const validated = {};
@@ -157,8 +188,14 @@ export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full)
         validated[url] = validatePreset(manifest);
     }
     const packageTargets = clonePresetDefaults(json.packageTargets);
-    const data = { ...(full ? { schemaVersion: 1 } : {}), source, manifests: validated, bundleRevisions, packageTargets };
-    if (await presetSnapshotRevision(data) !== json.revision)
+    const data = {
+        ...(full ? { schemaVersion: 1 } : {}),
+        source,
+        manifests: validated,
+        bundleRevisions,
+        packageTargets,
+    };
+    if ((await presetSnapshotRevision(data)) !== json.revision)
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored preset revision does not match');
     let preset = await resolvePreset(source, {
         mearlApiVersion,
@@ -170,7 +207,9 @@ export async function verifyPresetGraph(value, mearlApiVersion, runtimes, full)
     });
     preset = applyPackageTargets(preset, packageTargets);
     const entries = presetPackages(preset, runtimes);
-    if (preset.chain.length !== Object.keys(validated).length || entries.length !== Object.keys(bundleRevisions).length || entries.some(([id]) => !Object.hasOwn(bundleRevisions, id))) {
+    if (preset.chain.length !== Object.keys(validated).length ||
+        entries.length !== Object.keys(bundleRevisions).length ||
+        entries.some(([id]) => !Object.hasOwn(bundleRevisions, id))) {
         throw new BundleError('BUNDLE_INTEGRITY', 'Stored preset package graph does not match');
     }
     return { snapshot: { ...data, revision: json.revision }, preset };

package/dist/preset.js

@@ -1,6 +1,6 @@
 import { browserPresetSnapshot } from './browserPreset.js';
-import { preparePresetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets } from './prepare.js';
-import { satisfies } from 'semver';
+import { preparePresetPackages, presetSnapshotRevision, verifyPresetGraph, verifyPackageTargets, } from './prepare.js';
+import satisfies from 'semver/functions/satisfies.js';
 import { BundleError, MAX_BROWSER_STORAGE_BYTES, verifyBundle } from './bundle.js';
 export async function preparePreset(source, options) {
     const prepared = await preparePresetPackages(source, options, ['browser', 'node']);
@@ -27,7 +27,9 @@ export async function verifyPreparedPreset(value, mearlApiVersion) {
         throw new BundleError('BUNDLE_QUOTA', 'Preset package count exceeds 64');
     let total = 0;
     for (const bundle of value.bundles) {
-        if (!bundle?.resources || typeof bundle.resources !== 'object' || Array.isArray(bundle.resources))
+        if (!bundle?.resources ||
+            typeof bundle.resources !== 'object' ||
+            Array.isArray(bundle.resources))
             throw new BundleError('BUNDLE_INVALID', 'Expected package resource buffers');
         const resources = Object.values(bundle.resources);
         if (resources.length > 64)
@@ -46,10 +48,19 @@ export async function verifyPreparedPreset(value, mearlApiVersion) {
     ]);
     const { snapshot, preset } = graph;
     verifyPackageTargets(preset, bundles);
-    if (bundles.length !== Object.keys(snapshot.bundleRevisions).length || new Set(bundles.map(bundle => bundle.manifest.id)).size !== bundles.length || bundles.some(bundle => {
-        const entry = preset.packages[bundle.manifest.id];
-        return snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision || entry?.source !== bundle.source || (entry.version && !satisfies(bundle.manifest.version, entry.version));
-    }))
+    if (bundles.length !== Object.keys(snapshot.bundleRevisions).length ||
+        new Set(bundles.map(bundle => bundle.manifest.id)).size !== bundles.length ||
+        bundles.some(bundle => {
+            const entry = preset.packages[bundle.manifest.id];
+            return (snapshot.bundleRevisions[bundle.manifest.id] !== bundle.revision ||
+                entry?.source !== bundle.source ||
+                (entry.version && !satisfies(bundle.manifest.version, entry.version)));
+        }))
         throw new BundleError('BUNDLE_INTEGRITY', 'Preset installation requires every exact package');
-    return { snapshot, preset, bundles, browser: await browserPresetSnapshot(snapshot.source, snapshot.manifests, preset, bundles) };
+    return {
+        snapshot,
+        preset,
+        bundles,
+        browser: await browserPresetSnapshot(snapshot.source, snapshot.manifests, preset, bundles),
+    };
 }

package/dist/resolve.js

@@ -1,15 +1,17 @@
 import { parseToolboxCatalogs } from './toolboxCatalogs.js';
 import { parseSetupManagement } from './management.js';
-import { satisfies, valid } from 'semver';
+import satisfies from 'semver/functions/satisfies.js';
+import valid from 'semver/functions/valid.js';
 import { clonePresetDefaults, isJsonObject, PresetError, validatePreset } from './manifest.js';
 const kinds = ['packages', 'skills', 'providers'];
 /** Objects merge recursively; arrays, scalars and explicit null replace the previous value. */
 export function mergePresetDefaults(base, overrides) {
     const result = clonePresetDefaults(base);
     for (const [key, value] of Object.entries(clonePresetDefaults(overrides))) {
-        result[key] = isJsonObject(value) && isJsonObject(result[key])
-            ? mergePresetDefaults(result[key], value)
-            : value;
+        result[key] =
+            isJsonObject(value) && isJsonObject(result[key])
+                ? mergePresetDefaults(result[key], value)
+                : value;
     }
     return result;
 }
@@ -93,7 +95,8 @@ export async function resolvePreset(source, options) {
         active.add(url);
         const manifest = validatePreset(await options.load(url));
         options.signal?.throwIfAborted();
-        if (manifest.requires?.mearlApi && !satisfies(options.mearlApiVersion, manifest.requires.mearlApi)) {
+        if (manifest.requires?.mearlApi &&
+            !satisfies(options.mearlApiVersion, manifest.requires.mearlApi)) {
             throw new PresetError('PRESET_INCOMPATIBLE', `${manifest.id} requires Mearl API ${manifest.requires.mearlApi}`);
         }
         let parent;
@@ -106,21 +109,35 @@ export async function resolvePreset(source, options) {
         const result = {
             id: manifest.id,
             version: manifest.version,
-            chain: [...(parent?.chain ?? []), { source: url, id: manifest.id, version: manifest.version }],
+            chain: [
+                ...(parent?.chain ?? []),
+                { source: url, id: manifest.id, version: manifest.version },
+            ],
             packages: { ...parent?.packages },
             skills: { ...parent?.skills },
             providers: { ...parent?.providers },
             appProfiles: { ...parent?.appProfiles, ...manifest.appProfiles },
             defaults: mergePresetDefaults(parent?.defaults ?? {}, manifest.defaults ?? {}),
-            permissions: { origins: [...new Set([...(parent?.permissions.origins ?? []), ...(manifest.permissions?.origins ?? [])])] },
+            permissions: {
+                origins: [
+                    ...new Set([
+                        ...(parent?.permissions.origins ?? []),
+                        ...(manifest.permissions?.origins ?? []),
+                    ]),
+                ],
+            },
         };
         for (const kind of kinds) {
             for (const [id, patch] of Object.entries(manifest[kind] ?? {})) {
                 result[kind][id] = {
                     ...result[kind][id],
                     ...patch,
-                    ...(patch.source === undefined ? {} : { source: componentSource(kind, patch.source, url) }),
-                    ...(patch.migrateFrom === undefined ? {} : { migrateFrom: patch.migrateFrom.map(source => componentSource(kind, source, url)) }),
+                    ...(patch.source === undefined
+                        ? {}
+                        : { source: componentSource(kind, patch.source, url) }),
+                    ...(patch.migrateFrom === undefined
+                        ? {}
+                        : { migrateFrom: patch.migrateFrom.map(source => componentSource(kind, source, url)) }),
                     declaredBy: url,
                 };
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mearl/preset",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Browser-compatible preset validation, inheritance and capability resolution for Mearl",
   "type": "module",
   "license": "Apache-2.0",
@@ -19,6 +19,10 @@
       "types": "./dist/installation.d.ts",
       "import": "./dist/installation.js"
     },
+    "./pageRuntime": {
+      "types": "./dist/pageRuntime.d.ts",
+      "import": "./dist/pageRuntime.js"
+    },
     "./installation-site.json": "./installation-site.json",
     "./networkRoutes": {
       "types": "./dist/networkRoutes.d.ts",