@pwa-platform/entry-resilience 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PWA Platform contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# @pwa-platform/entry-resilience
+
+Optional entry recovery for a PWA whose original address is moving or unavailable. Install it alongside
+`@pwa-platform/vite`; use the same `PwaIdentity` object for both Vite plugins. The package supports Vite 5 and 8
+on Node 22 or later.
+
+The application obtains a manifest through its own request layer and hands the decoded object to the client API.
+The platform checks its shape, increasing sequence and expiry, then stores it locally. A recovery page shows a
+validated alternative address; navigation happens only after the user clicks it. Neither cookies nor login state
+move between origins.
+
+## Install and configure
+
+```sh
+npm install @pwa-platform/entry-resilience @pwa-platform/vite
+```
+
+```ts
+// vite.config.ts — reuse the identity already passed to pwa()
+import { pwa } from "@pwa-platform/vite";
+import { pwaEntryResilience } from "@pwa-platform/entry-resilience/vite";
+
+plugins: [
+  pwa({ identity, policy, install, topology }),
+  pwaEntryResilience({ identity, maxValidityDays: 30, locale: "zh-CN" }),
+]
+```
+
+The PWA policy must classify the mount-relative `/pwa-entry.html` as a `cache-first` asset, and its fingerprinted
+script under `/assets` as an asset too. The build rejects a recovery page that is not precached. `locale` accepts
+`"zh-CN"` or `"en"`; `messages` overrides individual strings. The `css` option appends host CSS after the
+default recovery-page style. To change the button, override `--pwa-entry-accent` and
+`--pwa-entry-accent-fg` in `.pwa-entry`; see the [integration guide](https://github.com/haigeerlab/pwa-platform/blob/main/docs/guides/entry-recovery-integration.md)
+for light/dark theme selectors and strict CSP hashes.
+
+```ts
+import { updateEntryManifest, checkEntryRecovery, setPwaTheme } from "@pwa-platform/entry-resilience/client";
+
+const result = await updateEntryManifest(await api.getEntryManifest());
+if (!result.accepted) reportDiagnostics(result.diagnostics);
+
+const recovery = await checkEntryRecovery({ returnPath: location.pathname });
+if (recovery.kind === "available") showRecoveryLink(recovery.recoveryPageUrl);
+
+setPwaTheme("system"); // or "light" / "dark"
+```
+
+The application owns the request, authentication, decryption and polling. Keep the manifest endpoint protected:
+the platform validates structure and timing, but does not authenticate its source or restrict destination origins.
+An ordinary device-wide loss of connectivity with a `normal` manifest does not create a domain-outage suggestion.
+
+## Validate a manifest before you publish it
+
+Use the same validator in Node before publishing a manifest so an invalid manifest fails CI or the backend job
+instead of being silently rejected only by a browser page.
+
+```js
+import { parseEntryManifest } from "@pwa-platform/entry-resilience";
+
+const manifest = {
+  sequence: 7,
+  expiresAt: "2026-10-01T08:00:00Z",
+  status: "migrating",
+  reason: { code: "planned-migration", message: "Domain retires October 1." },
+  entries: [{ origin: "https://new.example.com", startPath: "/app/" }],
+};
+
+const result = parseEntryManifest(manifest, {
+  appId: "pwaexample",
+  environment: "production",
+  // Match the maxValidityDays in this app's Vite config.
+  maxValidityDays: 30,
+  // Inject the moment at which validity should be judged.
+  now: Date.now(),
+});
+
+if (!result.ok) {
+  for (const { code, path } of result.diagnostics) {
+    console.error(`${path || "(manifest)"}: ${code}`);
+  }
+  process.exit(1);
+}
+```
+
+`parseEntryManifest` never throws or reads ambient state. It is the same shape validator used by
+`updateEntryManifest`; expiry and sequence are checked again when the browser accepts the manifest. Use an
+`expiresAt` value in `YYYY-MM-DDTHH:mm:ssZ` format without milliseconds.

package/dist/browser/index.d.ts

@@ -0,0 +1,28 @@
+import type { EntryRecoveryResult } from "../check.js";
+import type { EntryRuntimeConfig, EntryRuntimePorts } from "../resolve.js";
+import type { EntryManifest } from "../types.js";
+export type EntryCheckerConfig = EntryRuntimeConfig & {
+    /** Passed through to `createProbes`: the app's mount path, e.g. `"/app/"`. */
+    readonly mountPath: string;
+};
+export type EntryCheckOptions = {
+    readonly returnPath?: string;
+};
+/**
+ * Assembles the real browser ports (probes, IndexedDB store, `Date.now`, `location.origin`) that
+ * `createEntryRecoveryChecker` (below), src/client/index.ts's `checkEntryRecovery`/`updateEntryManifest` (which
+ * share one instance across both calls) and the recovery page (src/page/main.ts, which calls
+ * `resolveEntryRecovery` directly rather than `runEntryRecovery`) all need. `saveStored` is included alongside the
+ * `EntryRuntimePorts` fields so the same object also satisfies `EntryManifestUpdatePorts` (src/update.ts) without a
+ * second IndexedDB store being opened for the write path.
+ */
+export declare function createEntryRuntimePorts(config: EntryCheckerConfig): EntryRuntimePorts & {
+    saveStored(manifest: EntryManifest): Promise<void>;
+};
+/** Builds `checkEntryRecovery`, wiring real browser ports around the pure `runEntryRecovery`. */
+export declare function createEntryRecoveryChecker(config: EntryCheckerConfig): (options?: EntryCheckOptions) => Promise<EntryRecoveryResult>;
+export { createIndexedDbStore } from "./indexeddb.js";
+export type { EntryIndexedDbStore, CreateIndexedDbStoreOptions } from "./indexeddb.js";
+export { createProbes } from "./probes.js";
+export type { CreateProbesOptions } from "./probes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/browser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG;IACpD,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,iBAAiB,GAAG;IAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAY5E;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,GACzB,CAAC,OAAO,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAG/D;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/browser/index.js

@@ -0,0 +1,39 @@
+// Assembles the browser ports (probes, IndexedDB store, `Date.now`, `location.origin`) into the page-side
+// `checkEntryRecovery` function described in spec/pwa-entry-resilience.md's "页面侧 API". The Vite plugin supplies
+// `config` from its virtual module.
+//
+// ADR-0033 (2026-09-23) removed the discovery-source fetch from the read path (`checkEntryRecovery` now only reads
+// what a prior `updateEntryManifest` call stored — see src/resolve.ts and src/update.ts), so `createEntryRuntimePorts`
+// no longer builds a `fetchDiscovery` port, and src/browser/discovery.ts is deleted along with it (EM3,
+// tasks/pwa-entry-resilience/plan.md).
+import { runEntryRecovery } from "../check.js";
+import { createIndexedDbStore } from "./indexeddb.js";
+import { createProbes } from "./probes.js";
+/**
+ * Assembles the real browser ports (probes, IndexedDB store, `Date.now`, `location.origin`) that
+ * `createEntryRecoveryChecker` (below), src/client/index.ts's `checkEntryRecovery`/`updateEntryManifest` (which
+ * share one instance across both calls) and the recovery page (src/page/main.ts, which calls
+ * `resolveEntryRecovery` directly rather than `runEntryRecovery`) all need. `saveStored` is included alongside the
+ * `EntryRuntimePorts` fields so the same object also satisfies `EntryManifestUpdatePorts` (src/update.ts) without a
+ * second IndexedDB store being opened for the write path.
+ */
+export function createEntryRuntimePorts(config) {
+    const probes = createProbes({ mountPath: config.mountPath });
+    const store = createIndexedDbStore({ appId: config.appId, environment: config.environment });
+    return {
+        now: () => Date.now(),
+        currentOrigin: () => location.origin,
+        loadStored: store.loadStored,
+        saveStored: store.saveStored,
+        probePrimary: probes.probePrimary,
+        probeAlternate: probes.probeAlternate,
+    };
+}
+/** Builds `checkEntryRecovery`, wiring real browser ports around the pure `runEntryRecovery`. */
+export function createEntryRecoveryChecker(config) {
+    const ports = createEntryRuntimePorts(config);
+    return (options = {}) => runEntryRecovery(config, ports, options);
+}
+export { createIndexedDbStore } from "./indexeddb.js";
+export { createProbes } from "./probes.js";
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,gHAAgH;AAChH,oCAAoC;AACpC,EAAE;AACF,mHAAmH;AACnH,uHAAuH;AACvH,wGAAwG;AACxG,uCAAuC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7F,OAAO;QACL,GAAG,EAAE,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC7B,aAAa,EAAE,GAAW,EAAE,CAAC,QAAQ,CAAC,MAAM;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CACxC,MAA0B;IAE1B,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,CAAC,UAA6B,EAAE,EAAgC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrH,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/browser/indexeddb.d.ts

@@ -0,0 +1,12 @@
+import type { EntryManifest } from "../types.js";
+export type CreateIndexedDbStoreOptions = {
+    readonly appId: string;
+    readonly environment: string;
+};
+export type EntryIndexedDbStore = {
+    loadStored(): Promise<EntryManifest | null>;
+    saveStored(manifest: EntryManifest): Promise<void>;
+};
+/** Builds the `loadStored`/`saveStored` ports backed by `pwa-entry:<appId>:<environment>`. */
+export declare function createIndexedDbStore({ appId, environment }: CreateIndexedDbStoreOptions): EntryIndexedDbStore;
+//# sourceMappingURL=indexeddb.d.ts.map

package/dist/browser/indexeddb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexeddb.d.ts","sourceRoot":"","sources":["../../src/browser/indexeddb.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5C,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,CAAC;AAgBF,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,2BAA2B,GAAG,mBAAmB,CA6C7G"}

package/dist/browser/indexeddb.js

@@ -0,0 +1,61 @@
+const STORE_NAME = "manifest";
+const RECORD_KEY = "current";
+function openDatabase(databaseName) {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(databaseName, 1);
+        request.onupgradeneeded = () => {
+            request.result.createObjectStore(STORE_NAME);
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+/** Builds the `loadStored`/`saveStored` ports backed by `pwa-entry:<appId>:<environment>`. */
+export function createIndexedDbStore({ appId, environment }) {
+    const databaseName = `pwa-entry:${encodeURIComponent(appId)}:${encodeURIComponent(environment)}`;
+    return {
+        // Open failure (including a `VersionError` when a higher-versioned database already exists on disk),
+        // transaction/request errors and transaction aborts all reject rather than resolving `null` — only a genuinely
+        // missing record does that. Callers already treat a rejected `loadStored` as `entry.storage-unavailable`;
+        // silently returning `null` here would mask a real failure as "nothing stored".
+        async loadStored() {
+            const db = await openDatabase(databaseName);
+            try {
+                return await new Promise((resolve, reject) => {
+                    let transaction;
+                    try {
+                        transaction = db.transaction(STORE_NAME, "readonly");
+                    }
+                    catch (error) {
+                        reject(error);
+                        return;
+                    }
+                    transaction.onabort = () => reject(transaction.error ?? new Error("entry: readonly transaction aborted"));
+                    const request = transaction.objectStore(STORE_NAME).get(RECORD_KEY);
+                    request.onsuccess = () => resolve(request.result ?? null);
+                    request.onerror = () => reject(request.error ?? new Error("entry: get request failed"));
+                });
+            }
+            finally {
+                db.close();
+            }
+        },
+        async saveStored(manifest) {
+            const db = await openDatabase(databaseName);
+            try {
+                await new Promise((resolve, reject) => {
+                    const transaction = db.transaction(STORE_NAME, "readwrite");
+                    transaction.objectStore(STORE_NAME).put(manifest, RECORD_KEY);
+                    transaction.oncomplete = () => resolve();
+                    transaction.onerror = () => reject(transaction.error);
+                    // A quota failure can end the transaction with `abort` and no settled request; without this the write hangs.
+                    transaction.onabort = () => reject(transaction.error);
+                });
+            }
+            finally {
+                db.close();
+            }
+        },
+    };
+}
+//# sourceMappingURL=indexeddb.js.map

package/dist/browser/indexeddb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexeddb.js","sourceRoot":"","sources":["../../src/browser/indexeddb.ts"],"names":[],"mappings":"AAoBA,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,eAAe,GAAG,GAAS,EAAE;YACnC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,EAAE,KAAK,EAAE,WAAW,EAA+B;IACtF,MAAM,YAAY,GAAG,aAAa,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAEjG,OAAO;QACL,qGAAqG;QACrG,+GAA+G;QAC/G,0GAA0G;QAC1G,gFAAgF;QAChF,KAAK,CAAC,UAAU;YACd,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACjE,IAAI,WAA2B,CAAC;oBAChC,IAAI,CAAC;wBACH,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;oBACvD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAc,CAAC,CAAC;wBACvB,OAAO;oBACT,CAAC;oBACD,WAAW,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;oBAChH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACpE,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE,CAAC,OAAO,CAAE,OAAO,CAAC,MAAoC,IAAI,IAAI,CAAC,CAAC;oBAC/F,OAAO,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAuB;YACtC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;oBAC5D,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC9D,WAAW,CAAC,UAAU,GAAG,GAAS,EAAE,CAAC,OAAO,EAAE,CAAC;oBAC/C,WAAW,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBAC5D,6GAA6G;oBAC7G,WAAW,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC9D,CAAC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/browser/probes.d.ts

@@ -0,0 +1,13 @@
+import type { EntryProbes } from "../decide.js";
+export type CreateProbesOptions = {
+    readonly mountPath: string;
+    readonly fetchImpl?: typeof fetch;
+};
+/**
+ * Builds the `EntryProbes` port. The primary probe hits an uncached, non-precached path under the
+ * mount so a network failure cannot be masked by the platform worker's cache; any settled response
+ * (including a 404) counts as reachable. The alternate probe is a `no-cors` cross-origin request:
+ * the response is opaque and never read, so a settled promise is the only signal available.
+ */
+export declare function createProbes({ mountPath, fetchImpl }: CreateProbesOptions): EntryProbes;
+//# sourceMappingURL=probes.d.ts.map

package/dist/browser/probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/browser/probes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC,CAAC;AAIF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,SAAS,EAAE,SAAiB,EAAE,EAAE,mBAAmB,GAAG,WAAW,CAyB/F"}

package/dist/browser/probes.js

@@ -0,0 +1,36 @@
+const PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Builds the `EntryProbes` port. The primary probe hits an uncached, non-precached path under the
+ * mount so a network failure cannot be masked by the platform worker's cache; any settled response
+ * (including a 404) counts as reachable. The alternate probe is a `no-cors` cross-origin request:
+ * the response is opaque and never read, so a settled promise is the only signal available.
+ */
+export function createProbes({ mountPath, fetchImpl = fetch }) {
+    return {
+        async probePrimary() {
+            const url = `${mountPath}__pwa-entry-probe?${Math.random()}`;
+            try {
+                await fetchImpl(url, { cache: "no-store", credentials: "omit", signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async probeAlternate(origin, startPath) {
+            try {
+                await fetchImpl(`${origin}${startPath}`, {
+                    mode: "no-cors",
+                    credentials: "omit",
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+                });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=probes.js.map

package/dist/browser/probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/browser/probes.ts"],"names":[],"mappings":"AASA,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,GAAG,KAAK,EAAuB;IAChF,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,GAAG,GAAG,GAAG,SAAS,qBAAqB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBAChH,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB;YACpD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,EAAE,EAAE;oBACvC,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,MAAM;oBACnB,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;iBAC9C,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/check.d.ts

@@ -0,0 +1,21 @@
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryRuntimeConfig, EntryRuntimePorts } from "./resolve.js";
+export type { EntryRuntimeConfig, EntryRuntimePorts } from "./resolve.js";
+export type EntryRecoveryResult = {
+    readonly kind: "none";
+    readonly diagnostics: readonly EntryDiagnostic[];
+} | {
+    readonly kind: "available";
+    readonly status: "migrating" | "incident" | "unconfirmed-outage";
+    readonly reason: {
+        readonly code: string;
+        readonly message: string | null;
+    };
+    readonly expiresAt: string;
+    readonly recoveryPageUrl: string;
+    readonly diagnostics: readonly EntryDiagnostic[];
+};
+export declare function runEntryRecovery(config: EntryRuntimeConfig, ports: EntryRuntimePorts, options?: {
+    readonly returnPath?: string;
+}): Promise<EntryRecoveryResult>;
+//# sourceMappingURL=check.d.ts.map

package/dist/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE1E,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAC3E;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CAClD,CAAC;AA2BN,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,OAAO,CAAC,mBAAmB,CAAC,CAqB9B"}

package/dist/check.js

@@ -0,0 +1,48 @@
+// Orchestration and the page-side public API: spec/pwa-entry-resilience.md's "页面侧 API" and
+// "存储" sections. `runEntryRecovery` never throws — every port failure becomes a diagnostic (or, for
+// `saveStored`, a diagnostic that does not change the result) — and the result never carries an
+// alternate-entry address: only a link to the platform recovery page, which repeats the whole
+// selection and decision on its own (see src/resolve.ts, which this function is built on).
+import { diagnostic } from "./diagnostics.js";
+import { normalizeReturnPath } from "./return-path.js";
+import { resolveEntryRecovery } from "./resolve.js";
+/** Runs `fn`, returning `undefined` if it throws. */
+function tryCall(fn) {
+    try {
+        return fn();
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildRecoveryPageUrl(config, currentOrigin, returnPath, diagnostics) {
+    if (returnPath === undefined)
+        return config.recoveryPagePath;
+    const normalized = normalizeReturnPath(returnPath, { origin: currentOrigin, scope: config.scope });
+    if (normalized === null) {
+        diagnostics.push(diagnostic("entry.return-path-dropped", ""));
+        return config.recoveryPagePath;
+    }
+    return `${config.recoveryPagePath}?return=${encodeURIComponent(normalized)}`;
+}
+export async function runEntryRecovery(config, ports, options = {}) {
+    const resolution = await resolveEntryRecovery(config, ports);
+    const diagnostics = [...resolution.diagnostics];
+    if (resolution.kind === "none")
+        return { kind: "none", diagnostics };
+    // `resolveEntryRecovery` already required `ports.currentOrigin()` to succeed once to get this far; it is called
+    // again here only because building the recovery page's URL is this function's own concern, not
+    // `EntryResolution`'s. A second failure (there is no reason to expect one from a port that just succeeded) still
+    // fails closed on the return path rather than throwing: the recovery link is built without it.
+    const currentOrigin = tryCall(() => ports.currentOrigin()) ?? "";
+    const recoveryPageUrl = buildRecoveryPageUrl(config, currentOrigin, options.returnPath, diagnostics);
+    return {
+        kind: "available",
+        status: resolution.status,
+        reason: { code: resolution.manifest.reason.code, message: resolution.manifest.reason.message ?? null },
+        expiresAt: resolution.manifest.expiresAt,
+        recoveryPageUrl,
+        diagnostics,
+    };
+}
+//# sourceMappingURL=check.js.map

package/dist/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,oGAAoG;AACpG,gGAAgG;AAChG,8FAA8F;AAC9F,2FAA2F;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAgBpD,qDAAqD;AACrD,SAAS,OAAO,CAAI,EAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA0B,EAC1B,aAAqB,EACrB,UAA8B,EAC9B,WAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC;IAE7D,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnG,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,gBAAgB,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA0B,EAC1B,KAAwB,EACxB,UAA4C,EAAE;IAE9C,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAEhD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,gHAAgH;IAChH,+FAA+F;IAC/F,iHAAiH;IACjH,+FAA+F;IAC/F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAErG,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE;QACtG,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS;QACxC,eAAe;QACf,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,19 @@
+import type { EntryRecoveryResult } from "../check.js";
+import type { EntryManifestUpdateResult as EntryUpdateResult } from "../update.js";
+import type { EntryCheckOptions } from "../browser/index.js";
+export type { EntryUpdateResult };
+export type PwaTheme = "light" | "dark" | "system";
+/** Runs the page-side entry-recovery check. Never throws — see `runEntryRecovery`'s docstring. */
+export declare function checkEntryRecovery(options?: EntryCheckOptions): Promise<EntryRecoveryResult>;
+/** Accepts a manifest the application obtained and decrypted itself. Never throws — see
+ *  `runEntryManifestUpdate`'s docstring. */
+export declare function updateEntryManifest(data: unknown): Promise<EntryUpdateResult>;
+/**
+ * Sets the app's theme preference, read by the recovery page (src/page/main.ts) before its first render — see
+ * spec/pwa-entry-resilience.md's "跟随宿主应用的主题设置". Writes `"light"`/`"dark"` to the storage key
+ * `themeStorageKey` builds; `"system"` removes the key instead, so the recovery page falls back to the system
+ * preference. Never throws: `localStorage` access is wrapped, and a failure (privacy mode, disabled storage, quota)
+ * is treated the same as the preference being absent.
+ */
+export declare function setPwaTheme(theme: PwaTheme): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,yBAAyB,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAYnD,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE5F;AAED;4CAC4C;AAC5C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAQjD"}

package/dist/client/index.js

@@ -0,0 +1,49 @@
+// Page-side entry for apps: spec/pwa-entry-resilience.md's revised "页面侧 API". Reads the plugin-provided virtual
+// module once and shares one lazily-created set of browser ports (IndexedDB, `Date.now`, probes — see
+// src/browser/index.ts's `createEntryRuntimePorts`) between both page-side functions: `checkEntryRecovery`
+// (src/check.ts's `runEntryRecovery`) and `updateEntryManifest` (src/update.ts's `runEntryManifestUpdate`). Neither
+// wrapper builds its own ports — a second IndexedDB store or probe set per call would be wasted work for no benefit,
+// since both read/write the same `pwa-entry:<appId>:<environment>` database.
+//
+// Per ADR-0018's import boundary, this file's only non-relative import is the virtual module; everything else it
+// needs is a relative import into the rest of this package (see src/virtual.d.ts for the module's declared type).
+import config from "virtual:pwa-entry-config";
+import { runEntryRecovery } from "../check.js";
+import { runEntryManifestUpdate } from "../update.js";
+import { createEntryRuntimePorts } from "../browser/index.js";
+import { themeStorageKey } from "../internal/theme-key.js";
+let ports;
+/** Builds the shared browser ports on first use and returns the same instance on every later call. */
+function sharedPorts() {
+    ports ??= createEntryRuntimePorts(config);
+    return ports;
+}
+/** Runs the page-side entry-recovery check. Never throws — see `runEntryRecovery`'s docstring. */
+export function checkEntryRecovery(options) {
+    return runEntryRecovery(config, sharedPorts(), options);
+}
+/** Accepts a manifest the application obtained and decrypted itself. Never throws — see
+ *  `runEntryManifestUpdate`'s docstring. */
+export function updateEntryManifest(data) {
+    return runEntryManifestUpdate(data, config, sharedPorts());
+}
+/**
+ * Sets the app's theme preference, read by the recovery page (src/page/main.ts) before its first render — see
+ * spec/pwa-entry-resilience.md's "跟随宿主应用的主题设置". Writes `"light"`/`"dark"` to the storage key
+ * `themeStorageKey` builds; `"system"` removes the key instead, so the recovery page falls back to the system
+ * preference. Never throws: `localStorage` access is wrapped, and a failure (privacy mode, disabled storage, quota)
+ * is treated the same as the preference being absent.
+ */
+export function setPwaTheme(theme) {
+    try {
+        const key = themeStorageKey(config.appId, config.environment);
+        if (theme === "system")
+            localStorage.removeItem(key);
+        else
+            localStorage.setItem(key, theme);
+    }
+    catch {
+        // Storage unavailable — silently no-op, per the docstring above.
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,sGAAsG;AACtG,2GAA2G;AAC3G,oHAAoH;AACpH,qHAAqH;AACrH,6EAA6E;AAC7E,EAAE;AACF,iHAAiH;AACjH,kHAAkH;AAClH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAQ3D,IAAI,KAA6B,CAAC;AAElC,sGAAsG;AACtG,SAAS,WAAW;IAClB,KAAK,KAAK,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,OAAO,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,QAAQ;YAAE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;;YAChD,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC"}

package/dist/decide.d.ts

@@ -0,0 +1,19 @@
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryManifest, EntryManifestEntry } from "./types.js";
+export type EntryProbes = {
+    probePrimary(): Promise<boolean>;
+    probeAlternate(origin: string, startPath: string): Promise<boolean>;
+};
+export type EntryDecision = {
+    readonly kind: "none";
+    readonly diagnostics: readonly EntryDiagnostic[];
+} | {
+    readonly kind: "available";
+    readonly status: "migrating" | "incident" | "unconfirmed-outage";
+    readonly manifest: EntryManifest;
+    /** Only the entries the spec allows showing: every entry for `migrating`/`incident` (not probed), or only the
+     *  probe-confirmed-reachable ones for `unconfirmed-outage` (see spec's "只展示探测确认可达的入口"). */
+    readonly entries: readonly EntryManifestEntry[];
+};
+export declare function decideRecovery(manifest: EntryManifest, probes: EntryProbes): Promise<EntryDecision>;
+//# sourceMappingURL=decide.d.ts.map

package/dist/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../src/decide.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrE,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAC3E;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;+FAC2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD,CAAC;AAWN,wBAAsB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAuBzG"}

package/dist/decide.js

@@ -0,0 +1,38 @@
+// Display decision for a single already-selected manifest, per spec/pwa-entry-resilience.md's
+// "状态与展示规则". Pure orchestration over injected probes: no clock, no storage, no network of its
+// own, so every branch (empty entries, migrating/incident short-circuiting, normal's probe-then-probe
+// sequencing) is directly testable.
+import { diagnostic } from "./diagnostics.js";
+/** A probe that throws is treated as unreachable, per spec: "探测函数抛出时视为不可达". */
+async function safeProbe(probe) {
+    try {
+        return await probe();
+    }
+    catch {
+        return false;
+    }
+}
+export async function decideRecovery(manifest, probes) {
+    if (manifest.entries.length === 0) {
+        return { kind: "none", diagnostics: [diagnostic("entry.no-entries", "")] };
+    }
+    if (manifest.status === "migrating" || manifest.status === "incident") {
+        return { kind: "available", status: manifest.status, manifest, entries: manifest.entries };
+    }
+    // status === "normal": show nothing unless the primary is unreachable and some alternate is reachable. Every
+    // entry is probed — not only up to the first reachable one — so the page can show every entry that is actually
+    // confirmed reachable, per spec's "只展示探测确认可达的入口" (independent review finding, 2026-09-17).
+    const primaryReachable = await safeProbe(() => probes.probePrimary());
+    if (primaryReachable)
+        return { kind: "none", diagnostics: [] };
+    const reachable = [];
+    for (const entry of manifest.entries) {
+        const alternateReachable = await safeProbe(() => probes.probeAlternate(entry.origin, entry.startPath));
+        if (alternateReachable)
+            reachable.push(entry);
+    }
+    if (reachable.length === 0)
+        return { kind: "none", diagnostics: [] };
+    return { kind: "available", status: "unconfirmed-outage", manifest, entries: reachable };
+}
+//# sourceMappingURL=decide.js.map

package/dist/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../src/decide.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8FAA8F;AAC9F,sGAAsG;AACtG,oCAAoC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoB9C,+EAA+E;AAC/E,KAAK,UAAU,SAAS,CAAC,KAA6B;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAuB,EAAE,MAAmB;IAC/E,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC;IAED,6GAA6G;IAC7G,+GAA+G;IAC/G,2FAA2F;IAC3F,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtE,IAAI,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,kBAAkB,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvG,IAAI,kBAAkB;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3F,CAAC"}

package/dist/diagnostics.d.ts

@@ -0,0 +1,11 @@
+export declare const ENTRY_DIAGNOSTIC_CODES: readonly ["entry.manifest-invalid-shape", "entry.app-id-mismatch", "entry.environment-mismatch", "entry.sequence-invalid", "entry.expires-at-invalid", "entry.expired", "entry.validity-period-too-long", "entry.status-invalid", "entry.reason-invalid-shape", "entry.reason-code-invalid", "entry.reason-message-invalid", "entry.entries-too-many", "entry.entry-invalid-shape", "entry.entry-origin-invalid", "entry.entry-start-path-invalid", "entry.sequence-not-greater", "entry.no-entries", "entry.storage-unavailable", "entry.storage-write-failed", "entry.runtime-unavailable", "entry.return-path-dropped", "entry.max-validity-days-invalid", "entry.css-invalid", "entry.option-removed", "entry.locale-invalid", "entry.message-invalid", "entry.base-mismatch", "entry.platform-plugin-missing", "entry.platform-plan-unavailable", "entry.recovery-page-not-precached"];
+export type EntryDiagnosticCode = (typeof ENTRY_DIAGNOSTIC_CODES)[number];
+/** JSON Pointer (RFC 6901) into the value being checked; `""` addresses the root. */
+export type EntryDiagnosticPath = "" | `/${string}`;
+/** Machine-readable finding. Carries no message and must never be built from an input value. */
+export type EntryDiagnostic = {
+    readonly code: EntryDiagnosticCode;
+    readonly path: EntryDiagnosticPath;
+};
+export declare function diagnostic(code: EntryDiagnosticCode, path: EntryDiagnosticPath): EntryDiagnostic;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,sBAAsB,61BAqCzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC;AAEpD,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAEhG"}