@pwa-platform/entry-resilience 0.1.0

package/dist/diagnostics.js

@@ -0,0 +1,51 @@
+// Every diagnostic this package can produce, plus the closed shape every one of them takes. Codes are the only
+// thing callers may branch on; `path` is a JSON-Pointer-like location built from field names and array indices
+// that are always known ahead of time — never from a value read out of the manifest being checked. That is what
+// keeps the "never echo input" rule (see the module's trust model) mechanically true rather than merely intended.
+//
+// ADR-0033 (2026-09-23) removed the package's cryptographic trust root: the platform no longer verifies a signed
+// envelope, so every code that named an envelope, a public key set, a build-time seed or a discovery-source fetch
+// against an origin approval list was deleted here along with src/verify.ts, src/keys.ts (see tasks/pwa-entry-
+// resilience/plan.md, "EM2") and src/browser/discovery.ts's `entry.discovery-*` codes ("EM3").
+export const ENTRY_DIAGNOSTIC_CODES = [
+    // Manifest field validation (src/manifest.ts): the plain object the application hands in.
+    "entry.manifest-invalid-shape",
+    "entry.app-id-mismatch",
+    "entry.environment-mismatch",
+    "entry.sequence-invalid",
+    "entry.expires-at-invalid",
+    "entry.expired",
+    "entry.validity-period-too-long",
+    "entry.status-invalid",
+    "entry.reason-invalid-shape",
+    "entry.reason-code-invalid",
+    "entry.reason-message-invalid",
+    "entry.entries-too-many",
+    "entry.entry-invalid-shape",
+    "entry.entry-origin-invalid",
+    "entry.entry-start-path-invalid",
+    // Write-time "does this beat what is already stored" decision (src/select.ts, src/update.ts).
+    "entry.sequence-not-greater",
+    // Display decision (src/decide.ts) and storage/runtime ports (src/resolve.ts, src/update.ts).
+    "entry.no-entries",
+    "entry.storage-unavailable",
+    "entry.storage-write-failed",
+    "entry.runtime-unavailable",
+    "entry.return-path-dropped",
+    // pwaEntryResilience plugin option validation and build integration (src/vite/), see
+    // spec/pwa-entry-resilience.md's "构建集成". Build-time-only: they name a plugin option or a build state, never a
+    // manifest field.
+    "entry.max-validity-days-invalid",
+    "entry.css-invalid",
+    "entry.option-removed",
+    "entry.locale-invalid",
+    "entry.message-invalid",
+    "entry.base-mismatch",
+    "entry.platform-plugin-missing",
+    "entry.platform-plan-unavailable",
+    "entry.recovery-page-not-precached",
+];
+export function diagnostic(code, path) {
+    return { code, path };
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,+GAA+G;AAC/G,gHAAgH;AAChH,kHAAkH;AAClH,EAAE;AACF,iHAAiH;AACjH,kHAAkH;AAClH,+GAA+G;AAC/G,+FAA+F;AAE/F,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,0FAA0F;IAC1F,8BAA8B;IAC9B,uBAAuB;IACvB,4BAA4B;IAC5B,wBAAwB;IACxB,0BAA0B;IAC1B,eAAe;IACf,gCAAgC;IAChC,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,8BAA8B;IAC9B,wBAAwB;IACxB,2BAA2B;IAC3B,4BAA4B;IAC5B,gCAAgC;IAChC,8FAA8F;IAC9F,4BAA4B;IAC5B,8FAA8F;IAC9F,kBAAkB;IAClB,2BAA2B;IAC3B,4BAA4B;IAC5B,2BAA2B;IAC3B,2BAA2B;IAC3B,qFAAqF;IACrF,8GAA8G;IAC9G,kBAAkB;IAClB,iCAAiC;IACjC,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,+BAA+B;IAC/B,iCAAiC;IACjC,mCAAmC;CAC3B,CAAC;AAaX,MAAM,UAAU,UAAU,CAAC,IAAyB,EAAE,IAAyB;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { runEntryRecovery } from "./check.js";
+export type { EntryRecoveryResult, EntryRuntimeConfig, EntryRuntimePorts } from "./check.js";
+export { decideRecovery } from "./decide.js";
+export type { EntryDecision, EntryProbes } from "./decide.js";
+export { ENTRY_DIAGNOSTIC_CODES } from "./diagnostics.js";
+export type { EntryDiagnostic, EntryDiagnosticCode, EntryDiagnosticPath } from "./diagnostics.js";
+export { parseEntryManifest } from "./manifest.js";
+export type { ManifestResult as EntryManifestParseResult } from "./manifest.js";
+export { ENTRY_MANIFEST_REASON_CODES, ENTRY_MANIFEST_STATUSES, } from "./types.js";
+export type { EntryManifest, EntryManifestEntry, EntryManifestReason, EntryManifestReasonCode, EntryManifestStatus, EntryManifestValidationContext, } from "./types.js";
+export { createEntryRecoveryChecker, createIndexedDbStore, createProbes, } from "./browser/index.js";
+export type { CreateIndexedDbStoreOptions, CreateProbesOptions, EntryCheckerConfig, EntryCheckOptions, EntryIndexedDbStore, } from "./browser/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EAAE,cAAc,IAAI,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+// Public entry: the entry-recovery manifest contract, its standalone validator, the display decision, the
+// page-side query function and its browser adapters. The recovery page (src/page/) and the Vite plugin (src/vite/)
+// are implemented but not re-exported here: the plugin has its own entry point (see the package's `./vite`
+// export), and the recovery page is only ever loaded by the build the plugin emits, never imported directly by an
+// application.
+//
+// This package's actual page-side API for applications — `checkEntryRecovery` and `updateEntryManifest` — lives on
+// the `./client` export (src/client/index.ts) instead, since both need the Vite plugin's virtual config module.
+// What is exported below is everything under that: the pure orchestration (`runEntryRecovery`), the manifest
+// contract's types and validator, and the browser port builders, for anything that wants to assemble its own
+// wiring rather than use the client facade.
+//
+// `parseEntryManifest` (spec/pwa-entry-resilience.md's "修订：导出清单校验函数") is exported here specifically so a
+// caller can validate a manifest in Node — a CI check or a backend self-check before handing it to
+// `updateEntryManifest` — without a browser. It is re-exported verbatim from src/manifest.ts, which stays the only
+// place its rules are implemented; its result type is renamed on the way out (`ManifestResult` ->
+// `EntryManifestParseResult`) to read as public API, but the internal name in src/manifest.ts is unchanged.
+//
+// The write-time "does this beat what's stored" decision (src/select.ts) and `runEntryManifestUpdate`
+// (src/update.ts) stay internal — only `updateEntryManifest`, wired on `./client`, exposes that path.
+export { runEntryRecovery } from "./check.js";
+export { decideRecovery } from "./decide.js";
+export { ENTRY_DIAGNOSTIC_CODES } from "./diagnostics.js";
+export { parseEntryManifest } from "./manifest.js";
+export { ENTRY_MANIFEST_REASON_CODES, ENTRY_MANIFEST_STATUSES, } from "./types.js";
+export { createEntryRecoveryChecker, createIndexedDbStore, createProbes, } from "./browser/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,mHAAmH;AACnH,2GAA2G;AAC3G,kHAAkH;AAClH,eAAe;AACf,EAAE;AACF,mHAAmH;AACnH,gHAAgH;AAChH,6GAA6G;AAC7G,6GAA6G;AAC7G,4CAA4C;AAC5C,EAAE;AACF,yGAAyG;AACzG,mGAAmG;AACnG,mHAAmH;AACnH,kGAAkG;AAClG,4GAA4G;AAC5G,EAAE;AACF,sGAAsG;AACtG,sGAAsG;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAUpB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/internal/base64url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Strict base64url decode: only `A-Z a-z 0-9 - _`, no `=` padding, no whitespace, and no non-canonical
+ * trailing bits (the "spare" bits in the last character group must be zero). Never throws; an invalid
+ * encoding returns `undefined`. Deliberately does not use `atob`/`Buffer`, neither of which reject this
+ * strictly.
+ */
+export declare function decodeBase64Url(value: string): Uint8Array<ArrayBuffer> | undefined;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/internal/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAoBlF"}

package/dist/internal/base64url.js

@@ -0,0 +1,32 @@
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const CHAR_VALUES = new Map([...BASE64URL_ALPHABET].map((char, index) => [char, index]));
+const STRICT_CHARSET = /^[A-Za-z0-9_-]*$/;
+/**
+ * Strict base64url decode: only `A-Z a-z 0-9 - _`, no `=` padding, no whitespace, and no non-canonical
+ * trailing bits (the "spare" bits in the last character group must be zero). Never throws; an invalid
+ * encoding returns `undefined`. Deliberately does not use `atob`/`Buffer`, neither of which reject this
+ * strictly.
+ */
+export function decodeBase64Url(value) {
+    if (!STRICT_CHARSET.test(value) || value.length % 4 === 1)
+        return undefined;
+    const bytes = [];
+    let bits = 0;
+    let bitCount = 0;
+    for (const char of value) {
+        const charValue = CHAR_VALUES.get(char);
+        if (charValue === undefined)
+            return undefined;
+        bits = ((bits << 6) | charValue) & 0xffff;
+        bitCount += 6;
+        if (bitCount >= 8) {
+            bitCount -= 8;
+            bytes.push((bits >>> bitCount) & 0xff);
+        }
+    }
+    // Whatever is left over is padding bits that carry no byte; a canonical encoding always zeroes them.
+    if (bitCount > 0 && (bits & ((1 << bitCount) - 1)) !== 0)
+        return undefined;
+    return new Uint8Array(bytes);
+}
+//# sourceMappingURL=base64url.js.map

package/dist/internal/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,kEAAkE,CAAC;AAC9F,MAAM,WAAW,GAAgC,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACtH,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC;QAC1C,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,qGAAqG;IACrG,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3E,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/internal/iso-date.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Strict ISO 8601 UTC parse: exactly `YYYY-MM-DDTHH:mm:ssZ`, with every field range-checked (including
+ * leap years). `Date.parse` accepts many non-conformant formats and silently rolls over out-of-range
+ * fields instead of rejecting them, so it is never used here. Returns epoch milliseconds, or `undefined`
+ * when `value` is not in this exact form.
+ */
+export declare function parseStrictIsoUtc(value: string): number | undefined;
+//# sourceMappingURL=iso-date.d.ts.map

package/dist/internal/iso-date.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-date.d.ts","sourceRoot":"","sources":["../../src/internal/iso-date.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuBnE"}

package/dist/internal/iso-date.js

@@ -0,0 +1,39 @@
+const ISO_UTC = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})Z$/;
+const DAYS_IN_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function isLeapYear(year) {
+    return (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+}
+/**
+ * Strict ISO 8601 UTC parse: exactly `YYYY-MM-DDTHH:mm:ssZ`, with every field range-checked (including
+ * leap years). `Date.parse` accepts many non-conformant formats and silently rolls over out-of-range
+ * fields instead of rejecting them, so it is never used here. Returns epoch milliseconds, or `undefined`
+ * when `value` is not in this exact form.
+ */
+export function parseStrictIsoUtc(value) {
+    const match = ISO_UTC.exec(value);
+    if (!match)
+        return undefined;
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText] = match;
+    if (!yearText || !monthText || !dayText || !hourText || !minuteText || !secondText)
+        return undefined;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const hour = Number(hourText);
+    const minute = Number(minuteText);
+    const second = Number(secondText);
+    // Below the Unix epoch's year is out of range for this contract: every manifest/key timestamp this package
+    // compares is epoch-relative, so a pre-1970 year could otherwise parse to a negative-but-finite value that
+    // silently satisfies every ordering check it is compared against (independent review finding, 2026-09-17).
+    if (year < 1970)
+        return undefined;
+    if (month < 1 || month > 12)
+        return undefined;
+    const daysInMonth = month === 2 && isLeapYear(year) ? 29 : DAYS_IN_MONTH[month - 1];
+    if (daysInMonth === undefined || day < 1 || day > daysInMonth)
+        return undefined;
+    if (hour > 23 || minute > 59 || second > 59)
+        return undefined;
+    return Date.UTC(year, month - 1, day, hour, minute, second);
+}
+//# sourceMappingURL=iso-date.js.map

package/dist/internal/iso-date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-date.js","sourceRoot":"","sources":["../../src/internal/iso-date.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,oDAAoD,CAAC;AACrE,MAAM,aAAa,GAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACjF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAErG,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAElC,2GAA2G;IAC3G,2GAA2G;IAC3G,2GAA2G;IAC3G,IAAI,IAAI,GAAG,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,WAAW;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,IAAI,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC"}

package/dist/internal/origin.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Normalized origin per the manifest contract: `new URL(value).origin === value` (no userinfo, path, query
+ * or fragment), protocol `https:`, with the sole exception of `http:` on a loopback host (any port).
+ */
+export declare function isNormalizedOrigin(value: string): boolean;
+//# sourceMappingURL=origin.d.ts.map

package/dist/internal/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/internal/origin.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMzD"}

package/dist/internal/origin.js

@@ -0,0 +1,19 @@
+// Loopback hosts the spec treats as potentially trustworthy for local development and tests, matching
+// contracts' internal/paths.ts `isSecureOrigin` exemption list. `URL#hostname` keeps the brackets around an
+// IPv6 literal (`new URL("http://[::1]").hostname === "[::1]"`), so the bracketed form is the correct key.
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * Normalized origin per the manifest contract: `new URL(value).origin === value` (no userinfo, path, query
+ * or fragment), protocol `https:`, with the sole exception of `http:` on a loopback host (any port).
+ */
+export function isNormalizedOrigin(value) {
+    if (!URL.canParse(value))
+        return false;
+    const url = new URL(value);
+    if (url.origin !== value)
+        return false;
+    if (url.protocol === "https:")
+        return true;
+    return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+}
+//# sourceMappingURL=origin.js.map

package/dist/internal/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/internal/origin.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,4GAA4G;AAC5G,2GAA2G;AAC3G,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC"}

package/dist/internal/plain-object.d.ts

@@ -0,0 +1,8 @@
+/** True for `{}`/`Object.create(null)` shaped values; rejects arrays, class instances, `null`, primitives. */
+export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+/**
+ * Closed-shape check: every own key must be in `required` or `optional`, and every `required` key must be
+ * present. This is what "unknown field" rejection and "field may be omitted" rest on throughout this package.
+ */
+export declare function hasKeysWithin(value: Record<string, unknown>, required: readonly string[], optional?: readonly string[]): boolean;
+//# sourceMappingURL=plain-object.d.ts.map

package/dist/internal/plain-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-object.d.ts","sourceRoot":"","sources":["../../src/internal/plain-object.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI9E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,OAAO,CAGT"}

package/dist/internal/plain-object.js

@@ -0,0 +1,16 @@
+/** True for `{}`/`Object.create(null)` shaped values; rejects arrays, class instances, `null`, primitives. */
+export function isPlainObject(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+/**
+ * Closed-shape check: every own key must be in `required` or `optional`, and every `required` key must be
+ * present. This is what "unknown field" rejection and "field may be omitted" rest on throughout this package.
+ */
+export function hasKeysWithin(value, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    return Object.keys(value).every((key) => allowed.has(key)) && required.every((key) => Object.hasOwn(value, key));
+}
+//# sourceMappingURL=plain-object.js.map

package/dist/internal/plain-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-object.js","sourceRoot":"","sources":["../../src/internal/plain-object.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,QAA2B,EAC3B,WAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACnH,CAAC"}

package/dist/internal/theme-key.d.ts

@@ -0,0 +1,2 @@
+export declare function themeStorageKey(appId: string, environment: string): string;
+//# sourceMappingURL=theme-key.d.ts.map

package/dist/internal/theme-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme-key.d.ts","sourceRoot":"","sources":["../../src/internal/theme-key.ts"],"names":[],"mappings":"AASA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1E"}

package/dist/internal/theme-key.js

@@ -0,0 +1,13 @@
+// The `localStorage` key that carries the app's theme preference — spec/pwa-entry-resilience.md's "跟随宿主应用的
+// 主题设置": "公开契约是这个键，不是 setPwaTheme 这个函数". Shared by src/client/index.ts (`setPwaTheme` writes it)
+// and src/page/main.ts (the recovery page reads it before its first render), which must agree on the same key for
+// one app/environment — kept here, rather than duplicated in both, so that agreement cannot drift.
+//
+// Same segment-encoding as src/browser/indexeddb.ts's database name (`pwa-entry:<appId>:<environment>`), but under
+// the unrelated `pwa:theme:` prefix the spec pins character for character, since this is a different storage
+// mechanism (`localStorage`, not IndexedDB) that the recovery page must be able to read without depending on any
+// other part of this package's browser adapters.
+export function themeStorageKey(appId, environment) {
+    return `pwa:theme:${encodeURIComponent(appId)}:${encodeURIComponent(environment)}`;
+}
+//# sourceMappingURL=theme-key.js.map

package/dist/internal/theme-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme-key.js","sourceRoot":"","sources":["../../src/internal/theme-key.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,iGAAiG;AACjG,kHAAkH;AAClH,mGAAmG;AACnG,EAAE;AACF,mHAAmH;AACnH,6GAA6G;AAC7G,iHAAiH;AACjH,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,WAAmB;IAChE,OAAO,aAAa,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AACrF,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,13 @@
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryManifest, EntryManifestValidationContext } from "./types.js";
+export type ManifestResult = {
+    readonly ok: true;
+    readonly manifest: EntryManifest;
+} | {
+    readonly ok: false;
+    readonly diagnostics: readonly EntryDiagnostic[];
+};
+/** Validates the manifest object an application hands in. Whole-manifest rejection: never partially accepted.
+ *  Never throws. */
+export declare function parseEntryManifest(value: unknown, context: EntryManifestValidationContext): ManifestResult;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAuB,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAuBrG,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAAC;AAE7E;oBACoB;AACpB,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,GAAG,cAAc,CAa1G"}

package/dist/manifest.js

@@ -0,0 +1,153 @@
+// Validates the plain manifest object the application hands in to `updateEntryManifest` — see
+// spec/pwa-entry-resilience.md's "修订：入口清单由业务应用提供" -> "契约增量". ADR-0033 (2026-09-23) removed the
+// package's cryptographic trust root, so there is no more envelope or signature stage before this runs: this
+// function is now the whole of manifest validation, not (as before that revision) only the part that ran after a
+// signature had already verified.
+import { diagnostic } from "./diagnostics.js";
+import { isNormalizedOrigin } from "./internal/origin.js";
+import { parseStrictIsoUtc } from "./internal/iso-date.js";
+import { hasKeysWithin, isPlainObject } from "./internal/plain-object.js";
+import { ENTRY_MANIFEST_REASON_CODES, ENTRY_MANIFEST_STATUSES } from "./types.js";
+const MANIFEST_REQUIRED_FIELDS = ["sequence", "expiresAt", "status", "reason", "entries"];
+const MANIFEST_OPTIONAL_FIELDS = ["appId", "environment"];
+const REASON_REQUIRED_FIELDS = ["code"];
+const REASON_OPTIONAL_FIELDS = ["message"];
+const ENTRY_FIELDS = ["origin", "startPath"];
+const MAX_ENTRIES = 5;
+const MAX_REASON_MESSAGE_LENGTH = 200;
+const MAX_START_PATH_LENGTH = 512;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** True if `value` contains a C0 control character (U+0000-U+001F) or DEL (U+007F). Avoids a control-character
+ *  regex literal, which most lint configs (including this repo's) flag as suspicious. */
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Validates the manifest object an application hands in. Whole-manifest rejection: never partially accepted.
+ *  Never throws. */
+export function parseEntryManifest(value, context) {
+    if (!isPlainObject(value) || !hasKeysWithin(value, MANIFEST_REQUIRED_FIELDS, MANIFEST_OPTIONAL_FIELDS)) {
+        return { ok: false, diagnostics: [diagnostic("entry.manifest-invalid-shape", "")] };
+    }
+    const diagnostics = [
+        ...topLevelDiagnostics(value, context),
+        ...reasonDiagnostics(value["reason"]),
+        ...entriesDiagnostics(value["entries"]),
+    ];
+    if (diagnostics.length > 0)
+        return { ok: false, diagnostics };
+    return { ok: true, manifest: value };
+}
+function topLevelDiagnostics(value, context) {
+    const diagnostics = [];
+    if ("appId" in value && value["appId"] !== context.appId) {
+        diagnostics.push(diagnostic("entry.app-id-mismatch", "/appId"));
+    }
+    if ("environment" in value && value["environment"] !== context.environment) {
+        diagnostics.push(diagnostic("entry.environment-mismatch", "/environment"));
+    }
+    const sequence = value["sequence"];
+    if (typeof sequence !== "number" || !Number.isSafeInteger(sequence) || sequence < 0) {
+        diagnostics.push(diagnostic("entry.sequence-invalid", "/sequence"));
+    }
+    const expiresAt = value["expiresAt"];
+    const expiresAtMs = typeof expiresAt === "string" ? parseStrictIsoUtc(expiresAt) : undefined;
+    if (expiresAtMs === undefined) {
+        diagnostics.push(diagnostic("entry.expires-at-invalid", "/expiresAt"));
+    }
+    else if (context.now >= expiresAtMs) {
+        // Must be in the future at the moment it is handed in (spec: "过期后不展示" applies to the write path too —
+        // an already-expired manifest could otherwise never be displayed, making acceptance pointless).
+        diagnostics.push(diagnostic("entry.expired", "/expiresAt"));
+    }
+    else if (expiresAtMs - context.now > context.maxValidityDays * DAY_MS) {
+        diagnostics.push(diagnostic("entry.validity-period-too-long", "/expiresAt"));
+    }
+    if (!isEntryManifestStatus(value["status"]))
+        diagnostics.push(diagnostic("entry.status-invalid", "/status"));
+    return diagnostics;
+}
+function isEntryManifestStatus(value) {
+    return typeof value === "string" && ENTRY_MANIFEST_STATUSES.includes(value);
+}
+function reasonDiagnostics(value) {
+    if (!isPlainObject(value) || !hasKeysWithin(value, REASON_REQUIRED_FIELDS, REASON_OPTIONAL_FIELDS)) {
+        return [diagnostic("entry.reason-invalid-shape", "/reason")];
+    }
+    const diagnostics = [];
+    const code = value["code"];
+    if (typeof code !== "string" || !ENTRY_MANIFEST_REASON_CODES.includes(code)) {
+        diagnostics.push(diagnostic("entry.reason-code-invalid", "/reason/code"));
+    }
+    if ("message" in value) {
+        const message = value["message"];
+        if (typeof message !== "string" || message.length > MAX_REASON_MESSAGE_LENGTH || hasControlCharacter(message)) {
+            diagnostics.push(diagnostic("entry.reason-message-invalid", "/reason/message"));
+        }
+    }
+    return diagnostics;
+}
+function entriesDiagnostics(value) {
+    if (!Array.isArray(value))
+        return [diagnostic("entry.entry-invalid-shape", "/entries")];
+    const diagnostics = [];
+    if (value.length > MAX_ENTRIES)
+        diagnostics.push(diagnostic("entry.entries-too-many", "/entries"));
+    value.forEach((entry, index) => diagnostics.push(...entryDiagnostics(entry, index)));
+    return diagnostics;
+}
+function entryDiagnostics(value, index) {
+    if (!isPlainObject(value) || !hasKeysWithin(value, ENTRY_FIELDS)) {
+        return [diagnostic("entry.entry-invalid-shape", `/entries/${index}`)];
+    }
+    const diagnostics = [];
+    const origin = value["origin"];
+    if (typeof origin !== "string" || !isNormalizedOrigin(origin)) {
+        diagnostics.push(diagnostic("entry.entry-origin-invalid", `/entries/${index}/origin`));
+    }
+    const startPath = value["startPath"];
+    if (typeof startPath !== "string" || !isValidStartPath(startPath)) {
+        diagnostics.push(diagnostic("entry.entry-start-path-invalid", `/entries/${index}/startPath`));
+    }
+    return diagnostics;
+}
+/** True if any `/`-delimited segment of `value` is exactly `..`. */
+function hasDotDotSegment(value) {
+    return value.split("/").some((segment) => segment === "..");
+}
+/**
+ * `startPath`'s rules, checked on the raw string and again on its single percent-decoding — the same "raw, then
+ * decoded" shape src/return-path.ts uses for `?return=`, so a percent-encoded `..`, `\`, `//` or control character
+ * cannot slip past the raw-string checks alone. A percent-encoding that fails to decode is rejected outright.
+ */
+function isValidStartPath(value) {
+    if (value.length === 0 || value.length > MAX_START_PATH_LENGTH)
+        return false;
+    if (!value.startsWith("/"))
+        return false;
+    if (value.includes("\\") || value.includes("//"))
+        return false;
+    if (hasControlCharacter(value))
+        return false;
+    if (hasDotDotSegment(value))
+        return false;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(value);
+    }
+    catch {
+        return false;
+    }
+    if (decoded.includes("\\") || decoded.includes("//"))
+        return false;
+    if (hasControlCharacter(decoded))
+        return false;
+    if (hasDotDotSegment(decoded))
+        return false;
+    return true;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+FAA+F;AAC/F,6GAA6G;AAC7G,iHAAiH;AACjH,kCAAkC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAGlF,MAAM,wBAAwB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACnG,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,aAAa,CAAU,CAAC;AACnE,MAAM,sBAAsB,GAAG,CAAC,MAAM,CAAU,CAAC;AACjD,MAAM,sBAAsB,GAAG,CAAC,SAAS,CAAU,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEtD,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;yFACyF;AACzF,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAMD;oBACoB;AACpB,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAuC;IACxF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,WAAW,GAAsB;QACrC,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC;QACtC,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;KACxC,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAsB,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA8B,EAAE,OAAuC;IAClG,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACzD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,aAAa,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;QACtC,sGAAsG;QACtG,gGAAgG;QAChG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,WAAW,GAAG,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,eAAe,GAAG,MAAM,EAAE,CAAC;QACxE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC;IAE7G,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,uBAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QACnG,OAAO,CAAC,UAAU,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAE,2BAAiD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9G,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,UAAU,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC,CAAC;IAExF,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW;QAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC,CAAC;IAEnG,KAAK,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,KAAa,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,UAAU,CAAC,2BAA2B,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,4BAA4B,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,gCAAgC,EAAE,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/page/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/page/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/page/main.ts"],"names":[],"mappings":""}

package/dist/page/main.js

@@ -0,0 +1,88 @@
+// The platform's entry-recovery page, published by the Vite plugin at `<mountPath>pwa-entry.html` (see
+// src/vite/index.ts). Independently re-runs the full selection and decision (src/resolve.ts) rather than trusting
+// anything in the URL besides the return path — see spec/pwa-entry-resilience.md's "入口恢复页". Confirmation and
+// navigation happen only here, per docs/adr/0018-entry-resilience-delivery-boundary.md's
+// "确认与导航只在平台恢复页上发生": `navigate` calls the top-level-navigation assignment method on `location`, only
+// ever from a button's click handler, never automatically. Opening a new tab/window and the two other
+// full-address-navigation forms this module must not use are enumerated, and checked for by name, in
+// test/page/source-scan.test.ts — deliberately not spelled out here, so this comment cannot itself trip that scan.
+import config from "virtual:pwa-entry-config";
+import { createEntryRuntimePorts } from "../browser/index.js";
+import { themeStorageKey } from "../internal/theme-key.js";
+import { resolveEntryRecovery } from "../resolve.js";
+import { normalizeReturnPath } from "../return-path.js";
+import { buildPageModel } from "./model.js";
+import { renderPage } from "./render.js";
+/** Maps each adapted `PageElement` back to the native node `adaptedElement` wrapped, so `append` can unwrap its
+ *  children without widening `PageElement`'s own type to expose the native node. */
+const WRAPPED = new WeakMap();
+function unwrap(child) {
+    const native = WRAPPED.get(child);
+    if (native === undefined)
+        throw new Error("append: child was not created by this adapter's PageDocument");
+    return native;
+}
+/**
+ * Adapts a real DOM element to `PageElement`. `render.ts`'s `append(...children: PageElement[])` cannot accept a
+ * real `HTMLElement` directly — the DOM's own `append` takes `(string | Node)[]`, which `PageElement` is not — so
+ * this keeps a reference to the wrapped node (via `WRAPPED`) and unwraps children back to it before delegating.
+ */
+function adaptedElement(native) {
+    const element = {
+        get textContent() {
+            return native.textContent;
+        },
+        set textContent(value) {
+            native.textContent = value;
+        },
+        append(...children) {
+            native.append(...children.map(unwrap));
+        },
+        setAttribute(name, value) {
+            native.setAttribute(name, value);
+        },
+        addEventListener(type, listener) {
+            native.addEventListener(type, listener);
+        },
+    };
+    WRAPPED.set(element, native);
+    return element;
+}
+const pageDocument = { createElement: (tag) => adaptedElement(document.createElement(tag)) };
+/**
+ * Reads the stored theme preference `setPwaTheme` (src/client/index.ts) writes, so it can be applied before the
+ * first render — see spec/pwa-entry-resilience.md's "恢复页在渲染前读取该键". Never throws: a missing key, a value
+ * other than exactly `"light"`/`"dark"`, or `localStorage` itself being unavailable (privacy mode, disabled
+ * storage) all fall back to `undefined`, which leaves the page following the system preference.
+ */
+function readStoredTheme() {
+    try {
+        const value = localStorage.getItem(themeStorageKey(config.appId, config.environment));
+        return value === "light" || value === "dark" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const rootNative = document.getElementById("pwa-entry");
+if (rootNative !== null) {
+    // Set before the first render (below), directly on the native node: `renderPage` only ever manages the `class`
+    // attribute (src/page/render.ts), never `data-theme`, so this cannot be clobbered by a later render call either.
+    const theme = readStoredTheme();
+    if (theme !== undefined)
+        rootNative.setAttribute("data-theme", theme);
+    const root = adaptedElement(rootNative);
+    const navigate = (href) => {
+        location.assign(href);
+    };
+    renderPage(root, "loading", pageDocument, navigate, config.messages);
+    const returnPath = normalizeReturnPath(new URLSearchParams(location.search).get("return"), {
+        origin: location.origin,
+        scope: config.scope,
+    });
+    // resolveEntryRecovery never rejects, but assembling the ports runs synchronously and could throw. Either way the
+    // page must not stay on "checking" forever: any failure renders "no entry", which offers nothing to click.
+    const resolution = (async () => resolveEntryRecovery(config, createEntryRuntimePorts(config)))();
+    void resolution.then((resolved) => renderPage(root, buildPageModel(resolved, returnPath), pageDocument, navigate, config.messages), () => renderPage(root, { kind: "none" }, pageDocument, navigate, config.messages));
+}
+//# sourceMappingURL=main.js.map

package/dist/page/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/page/main.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,kHAAkH;AAClH,6GAA6G;AAC7G,yFAAyF;AACzF,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,mHAAmH;AACnH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;oFACoF;AACpF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAqB,CAAC;AAEjD,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAmB;IACzC,MAAM,OAAO,GAAgB;QAC3B,IAAI,WAAW;YACb,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,KAAoB;YAClC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,QAAuB;YAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,YAAY,CAAC,IAAY,EAAE,KAAa;YACtC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,gBAAgB,CAAC,IAAa,EAAE,QAAoB;YAClD,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,YAAY,GAAiB,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAE3G;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACtF,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;AAExD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;IACxB,+GAA+G;IAC/G,iHAAiH;IACjH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACzF,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,kHAAkH;IAClH,2GAA2G;IAC3G,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,KAAK,UAAU,CAAC,IAAI,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAC7G,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAClF,CAAC;AACJ,CAAC"}