@pwa-platform/entry-resilience 0.1.0

package/dist/page/messages.d.ts

@@ -0,0 +1,24 @@
+export type PwaEntryPageLocale = "zh-CN" | "en";
+export type PwaEntryPageMessages = {
+    readonly documentTitle: string;
+    readonly loading: string;
+    readonly empty: string;
+    readonly headlineMigrating: string;
+    readonly headlineIncident: string;
+    readonly headlineUnconfirmedOutage: string;
+    /** Must contain the literal sequence `{expiresAt}` exactly once — see src/vite/options.ts's validation. */
+    readonly expiry: string;
+    /** Must contain the literal sequence `{host}` exactly once — see src/vite/options.ts's validation. */
+    readonly go: string;
+};
+/** Every key `PwaEntryPageMessages` has, in the order spec's contract table lists them — the closed set
+ *  src/vite/options.ts checks a host's `messages` override's keys against. */
+export declare const ENTRY_PAGE_MESSAGE_KEYS: readonly (keyof PwaEntryPageMessages)[];
+/** Built-in copy per locale — spec's contract table, character for character. The `zh-CN` column is exactly the
+ *  strings the page rendered before this revision (test/page/messages.test.ts pins this against the previous
+ *  hard-coded literals so it cannot drift). */
+export declare const ENTRY_PAGE_MESSAGES: Readonly<Record<PwaEntryPageLocale, PwaEntryPageMessages>>;
+/** Combines the built-in table for `locale` with a host's (already validated) partial override, one key at a
+ *  time — an override key always wins, an absent one falls back to the built-in copy. */
+export declare function mergeEntryPageMessages(locale: PwaEntryPageLocale, overrides?: Partial<PwaEntryPageMessages>): PwaEntryPageMessages;
+//# sourceMappingURL=messages.d.ts.map

package/dist/page/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/page/messages.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAAC;AAEhD,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,2GAA2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;8EAC8E;AAC9E,eAAO,MAAM,uBAAuB,EAAE,SAAS,CAAC,MAAM,oBAAoB,CAAC,EASf,CAAC;AAE7D;;+CAE+C;AAC/C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAqB1F,CAAC;AAEF;yFACyF;AACzF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GACxC,oBAAoB,CAEtB"}

package/dist/page/messages.js

@@ -0,0 +1,43 @@
+/** Every key `PwaEntryPageMessages` has, in the order spec's contract table lists them — the closed set
+ *  src/vite/options.ts checks a host's `messages` override's keys against. */
+export const ENTRY_PAGE_MESSAGE_KEYS = [
+    "documentTitle",
+    "loading",
+    "empty",
+    "headlineMigrating",
+    "headlineIncident",
+    "headlineUnconfirmedOutage",
+    "expiry",
+    "go",
+];
+/** Built-in copy per locale — spec's contract table, character for character. The `zh-CN` column is exactly the
+ *  strings the page rendered before this revision (test/page/messages.test.ts pins this against the previous
+ *  hard-coded literals so it cannot drift). */
+export const ENTRY_PAGE_MESSAGES = {
+    "zh-CN": {
+        documentTitle: "备用入口",
+        loading: "正在检查备用入口…",
+        empty: "当前没有可用的备用入口",
+        headlineMigrating: "应用正在迁移到新地址",
+        headlineIncident: "应用当前的入口出现故障",
+        headlineUnconfirmedOutage: "主入口可能暂时无法访问（未经确认）",
+        expiry: "此通知有效期至 {expiresAt}",
+        go: "前往 {host}",
+    },
+    en: {
+        documentTitle: "Alternative entry",
+        loading: "Checking for alternative entries…",
+        empty: "No alternative entry is available right now",
+        headlineMigrating: "This app is moving to a new address",
+        headlineIncident: "This app's usual address is having problems",
+        headlineUnconfirmedOutage: "The usual address may be unreachable (unconfirmed)",
+        expiry: "This notice is valid until {expiresAt}",
+        go: "Go to {host}",
+    },
+};
+/** Combines the built-in table for `locale` with a host's (already validated) partial override, one key at a
+ *  time — an override key always wins, an absent one falls back to the built-in copy. */
+export function mergeEntryPageMessages(locale, overrides) {
+    return { ...ENTRY_PAGE_MESSAGES[locale], ...overrides };
+}
+//# sourceMappingURL=messages.js.map

package/dist/page/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/page/messages.ts"],"names":[],"mappings":"AAoBA;8EAC8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAA4C;IAC9E,eAAe;IACf,SAAS;IACT,OAAO;IACP,mBAAmB;IACnB,kBAAkB;IAClB,2BAA2B;IAC3B,QAAQ;IACR,IAAI;CACsD,CAAC;AAE7D;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAA+D;IAC7F,OAAO,EAAE;QACP,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,aAAa;QACpB,iBAAiB,EAAE,YAAY;QAC/B,gBAAgB,EAAE,aAAa;QAC/B,yBAAyB,EAAE,mBAAmB;QAC9C,MAAM,EAAE,qBAAqB;QAC7B,EAAE,EAAE,WAAW;KAChB;IACD,EAAE,EAAE;QACF,aAAa,EAAE,mBAAmB;QAClC,OAAO,EAAE,mCAAmC;QAC5C,KAAK,EAAE,6CAA6C;QACpD,iBAAiB,EAAE,qCAAqC;QACxD,gBAAgB,EAAE,6CAA6C;QAC/D,yBAAyB,EAAE,oDAAoD;QAC/E,MAAM,EAAE,wCAAwC;QAChD,EAAE,EAAE,cAAc;KACnB;CACF,CAAC;AAEF;yFACyF;AACzF,MAAM,UAAU,sBAAsB,CACpC,MAA0B,EAC1B,SAAyC;IAEzC,OAAO,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1D,CAAC"}

package/dist/page/model.d.ts

@@ -0,0 +1,16 @@
+import type { EntryResolution } from "../resolve.js";
+export type EntryPageEntry = {
+    readonly host: string;
+    readonly href: string;
+};
+export type EntryPageModel = {
+    readonly kind: "none";
+} | {
+    readonly kind: "entries";
+    readonly status: "migrating" | "incident" | "unconfirmed-outage";
+    readonly message: string | null;
+    readonly expiresAt: string;
+    readonly entries: readonly EntryPageEntry[];
+};
+export declare function buildPageModel(resolution: EntryResolution, returnPath: string | null): EntryPageModel;
+//# sourceMappingURL=model.d.ts.map

package/dist/page/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/page/model.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C,CAAC;AAqCN,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAiBrG"}

package/dist/page/model.js

@@ -0,0 +1,51 @@
+/**
+ * `"2026-10-01T08:00:00Z"` -> `"2026-10-01 08:00 UTC"`. String slicing only, never `Date`: the manifest contract
+ * (spec's "契约" table) guarantees `expiresAt` is strictly `YYYY-MM-DDTHH:mm:ssZ`, so this cannot depend on the
+ * viewer's time zone or locale the way `toLocaleString` would.
+ */
+function formatExpiresAt(value) {
+    return `${value.slice(0, 10)} ${value.slice(11, 16)} UTC`;
+}
+/**
+ * Builds one entry's host/href, or `undefined` if it must be dropped.
+ *
+ * `startPath` was already validated at sign time (see this package's T1 record, "给 T6 的记录" in
+ * tasks/pwa-entry-resilience/plan.md), but this re-asserts it as defense in depth rather than trusting that to
+ * still hold: `new URL(startPath, origin)` is resolved and its own `origin` is required to still equal the
+ * manifest's declared `origin` — a `startPath` such as `"//evil.example/x"` or an absolute
+ * `"https://evil.example/"` would otherwise escape the approved origin at render time.
+ */
+function buildEntry(entry, returnPath) {
+    let url;
+    try {
+        url = new URL(entry.startPath, entry.origin);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.origin !== entry.origin)
+        return undefined;
+    if (returnPath !== null)
+        url.searchParams.set("pwa-return", returnPath);
+    return { host: url.host, href: url.href };
+}
+export function buildPageModel(resolution, returnPath) {
+    if (resolution.kind === "none")
+        return { kind: "none" };
+    const entries = [];
+    for (const entry of resolution.entries) {
+        const built = buildEntry(entry, returnPath);
+        if (built !== undefined)
+            entries.push(built);
+    }
+    if (entries.length === 0)
+        return { kind: "none" };
+    return {
+        kind: "entries",
+        status: resolution.status,
+        message: resolution.manifest.reason.message ?? null,
+        expiresAt: formatExpiresAt(resolution.manifest.expiresAt),
+        entries,
+    };
+}
+//# sourceMappingURL=model.js.map

package/dist/page/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/page/model.ts"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,KAA8D,EAC9D,UAAyB;IAEzB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAElD,IAAI,UAAU,KAAK,IAAI;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAExE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE,UAAyB;IACnF,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAExD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI;QACnD,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzD,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/page/render.d.ts

@@ -0,0 +1,24 @@
+import type { EntryPageModel } from "./model.js";
+import type { PwaEntryPageMessages } from "./messages.js";
+export type PageElement = {
+    textContent: string | null;
+    append(...children: PageElement[]): void;
+    setAttribute(name: string, value: string): void;
+    addEventListener(type: "click", listener: () => void): void;
+};
+export type PageDocument = {
+    createElement(tag: "h1" | "p" | "ul" | "li" | "button"): PageElement;
+};
+/**
+ * Renders `model` into `root`, replacing whatever was there. `navigate` is only ever registered as a click
+ * listener here — it is never called during rendering, including when there is exactly one entry, and no
+ * attribute carries an entry's `href`: it lives only in the closure the listener captures.
+ *
+ * Every element created here — including `root` itself — carries the class from spec/pwa-entry-resilience.md's
+ * "修订：恢复页的默认样式与宿主定制" class table, and no other: test/page/render.test.ts and
+ * test/page/class-alignment.test.ts hold both halves of that contract (every class used here appears in the
+ * default stylesheet, src/vite/default-style.ts, and vice versa) so structure and styling cannot silently drift
+ * apart from one another.
+ */
+export declare function renderPage(root: PageElement, model: EntryPageModel | "loading", doc: PageDocument, navigate: (href: string) => void, messages: PwaEntryPageMessages): void;
+//# sourceMappingURL=render.d.ts.map

package/dist/page/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/page/render.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAAE,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,CAAA;CAAE,CAAC;AAmBpG;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,EAAE,oBAAoB,GAC7B,IAAI,CAuCN"}

package/dist/page/render.js

@@ -0,0 +1,61 @@
+/** Maps a model status to the `messages` key carrying its headline — see spec/pwa-entry-resilience.md's "修订：恢
+ *  复页的构建期语言与文案覆盖" contract table. */
+const STATUS_HEADLINE_KEY = {
+    migrating: "headlineMigrating",
+    incident: "headlineIncident",
+    "unconfirmed-outage": "headlineUnconfirmedOutage",
+};
+function paragraph(doc, text, className) {
+    const element = doc.createElement("p");
+    element.textContent = text;
+    element.setAttribute("class", className);
+    return element;
+}
+/**
+ * Renders `model` into `root`, replacing whatever was there. `navigate` is only ever registered as a click
+ * listener here — it is never called during rendering, including when there is exactly one entry, and no
+ * attribute carries an entry's `href`: it lives only in the closure the listener captures.
+ *
+ * Every element created here — including `root` itself — carries the class from spec/pwa-entry-resilience.md's
+ * "修订：恢复页的默认样式与宿主定制" class table, and no other: test/page/render.test.ts and
+ * test/page/class-alignment.test.ts hold both halves of that contract (every class used here appears in the
+ * default stylesheet, src/vite/default-style.ts, and vice versa) so structure and styling cannot silently drift
+ * apart from one another.
+ */
+export function renderPage(root, model, doc, navigate, messages) {
+    root.textContent = "";
+    root.setAttribute("class", "pwa-entry");
+    if (model === "loading") {
+        root.append(paragraph(doc, messages.loading, "pwa-entry__loading"));
+        return;
+    }
+    if (model.kind === "none") {
+        root.append(paragraph(doc, messages.empty, "pwa-entry__empty"));
+        return;
+    }
+    const heading = doc.createElement("h1");
+    heading.textContent = messages[STATUS_HEADLINE_KEY[model.status]];
+    heading.setAttribute("class", "pwa-entry__headline");
+    root.append(heading);
+    if (model.message !== null)
+        root.append(paragraph(doc, model.message, "pwa-entry__message"));
+    root.append(paragraph(doc, messages.expiry.replace("{expiresAt}", () => model.expiresAt), "pwa-entry__expiry"));
+    const list = doc.createElement("ul");
+    list.setAttribute("class", "pwa-entry__list");
+    for (const entry of model.entries) {
+        const item = doc.createElement("li");
+        item.setAttribute("class", "pwa-entry__item");
+        const button = doc.createElement("button");
+        // A replacement function, not a string: a host may contain `$` (a valid URL host), and a string replacement would
+        // read `$&` or `$'` in it as a pattern.
+        button.textContent = messages.go.replace("{host}", () => entry.host);
+        button.setAttribute("type", "button");
+        button.setAttribute("class", "pwa-entry__button");
+        const href = entry.href;
+        button.addEventListener("click", () => navigate(href));
+        item.append(button);
+        list.append(item);
+    }
+    root.append(list);
+}
+//# sourceMappingURL=render.js.map

package/dist/page/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/page/render.ts"],"names":[],"mappings":"AAiBA;qCACqC;AACrC,MAAM,mBAAmB,GAErB;IACF,SAAS,EAAE,mBAAmB;IAC9B,QAAQ,EAAE,kBAAkB;IAC5B,oBAAoB,EAAE,2BAA2B;CAClD,CAAC;AAEF,SAAS,SAAS,CAAC,GAAiB,EAAE,IAAY,EAAE,SAAiB;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CACxB,IAAiB,EACjB,KAAiC,EACjC,GAAiB,EACjB,QAAgC,EAChC,QAA8B;IAE9B,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACtB,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAErB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAEhH,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,kHAAkH;QAClH,wCAAwC;QACxC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,31 @@
+import type { EntryProbes } from "./decide.js";
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryManifest, EntryManifestEntry } from "./types.js";
+export type EntryRuntimeConfig = {
+    readonly appId: string;
+    readonly environment: string;
+    readonly scope: string;
+    readonly recoveryPagePath: string;
+    /** Not read by this file's own read path; carried here so the one virtual config module (src/vite/index.ts) can
+     *  also supply it to `updateEntryManifest`'s wiring (src/update.ts's `EntryManifestUpdateConfig`, shared via
+     *  src/client/index.ts) without a second config shape. */
+    readonly maxValidityDays: number;
+};
+export type EntryRuntimePorts = EntryProbes & {
+    now(): number;
+    currentOrigin(): string;
+    loadStored(): Promise<EntryManifest | null>;
+};
+export type EntryResolution = {
+    readonly kind: "none";
+    readonly diagnostics: readonly EntryDiagnostic[];
+} | {
+    readonly kind: "available";
+    readonly status: "migrating" | "incident" | "unconfirmed-outage";
+    readonly manifest: EntryManifest;
+    /** The entries the recovery page may show — see `EntryDecision`'s own field of the same name. */
+    readonly entries: readonly EntryManifestEntry[];
+    readonly diagnostics: readonly EntryDiagnostic[];
+};
+export declare function resolveEntryRecovery(config: EntryRuntimeConfig, ports: EntryRuntimePorts): Promise<EntryResolution>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;8DAE0D;IAC1D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG;IAC5C,GAAG,IAAI,MAAM,CAAC;IACd,aAAa,IAAI,MAAM,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GAC3E;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CAClD,CAAC;AAWN,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/dist/resolve.js

@@ -0,0 +1,65 @@
+// Read path for `checkEntryRecovery`, per spec/pwa-entry-resilience.md's revised "页面侧 API": reads the one
+// manifest IndexedDB stores and, if it has not expired, runs the display decision (src/decide.ts) on it. No
+// network request happens here (probes aside) and no multi-source selection: ADR-0033 (2026-09-23) removed the
+// build-time seed and the discovery-source fetch, so there is exactly one manifest to consider, already accepted
+// by a prior `updateEntryManifest` call (src/update.ts).
+//
+// Two behaviors worth calling out explicitly, both confirmed during EM3 (tasks/pwa-entry-resilience/plan.md):
+// - The `currentOrigin`/`now` fail-closed guard below runs before any storage access, even though this file's own
+//   pipeline no longer compares `currentOrigin`'s value against anything (see the guard's own comment).
+// - Expiry is re-checked here, on every read, not only once at `updateEntryManifest` time (see the re-check below).
+import { decideRecovery } from "./decide.js";
+import { diagnostic } from "./diagnostics.js";
+import { parseStrictIsoUtc } from "./internal/iso-date.js";
+/** Runs `fn`, returning `undefined` if it throws. */
+function tryCall(fn) {
+    try {
+        return fn();
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function resolveEntryRecovery(config, ports) {
+    const diagnostics = [];
+    // `currentOrigin` no longer filters any entry (src/select.ts dropped the "no entry may equal the current origin"
+    // rule along with its multi-source selection), but calling it here and failing closed if it throws is kept, on
+    // purpose (confirmed EM3, tasks/pwa-entry-resilience/plan.md): it is this pipeline's one check that the runtime
+    // port layer itself is sane before any storage access, mirroring `now()` right below it and `update.ts`'s own
+    // `now()`-only version of the same guard. `currentOrigin`'s *value* still matters one call later — `check.ts`'s
+    // `runEntryRecovery` calls it again to build the recovery page's return-path URL — so confirming here that it is
+    // callable at all avoids reading storage in an environment where that downstream use would already be broken.
+    const currentOrigin = tryCall(() => ports.currentOrigin());
+    const now = tryCall(() => ports.now());
+    if (currentOrigin === undefined || now === undefined || !Number.isFinite(now)) {
+        diagnostics.push(diagnostic("entry.runtime-unavailable", ""));
+        return { kind: "none", diagnostics };
+    }
+    let stored;
+    try {
+        stored = await ports.loadStored();
+    }
+    catch {
+        diagnostics.push(diagnostic("entry.storage-unavailable", ""));
+        return { kind: "none", diagnostics };
+    }
+    if (stored === null)
+        return { kind: "none", diagnostics };
+    // Confirmed, kept (EM3, tasks/pwa-entry-resilience/plan.md): nothing re-validates the stored manifest's other
+    // fields on read (that already happened once, at `updateEntryManifest` time) — except expiry, re-checked here on
+    // every read. Signing is gone, so nothing else would stop an expired manifest from staying displayed once it is
+    // stored, and the spec requires "过期后不展示" regardless of how long ago the record was written. Config no
+    // longer carries `appId`/`environment` for anything past this loop.
+    const expiresAtMs = parseStrictIsoUtc(stored.expiresAt);
+    if (expiresAtMs === undefined || now >= expiresAtMs) {
+        diagnostics.push(diagnostic("entry.expired", ""));
+        return { kind: "none", diagnostics };
+    }
+    const decision = await decideRecovery(stored, ports);
+    if (decision.kind === "none") {
+        diagnostics.push(...decision.diagnostics);
+        return { kind: "none", diagnostics };
+    }
+    return { kind: "available", status: decision.status, manifest: decision.manifest, entries: decision.entries, diagnostics };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAC5G,+GAA+G;AAC/G,iHAAiH;AACjH,yDAAyD;AACzD,EAAE;AACF,8GAA8G;AAC9G,kHAAkH;AAClH,wGAAwG;AACxG,oHAAoH;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA+B3D,qDAAqD;AACrD,SAAS,OAAO,CAAI,EAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA0B,EAC1B,KAAwB;IAExB,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,iHAAiH;IACjH,+GAA+G;IAC/G,gHAAgH;IAChH,8GAA8G;IAC9G,gHAAgH;IAChH,iHAAiH;IACjH,8GAA8G;IAC9G,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,aAAa,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE1D,8GAA8G;IAC9G,iHAAiH;IACjH,gHAAgH;IAChH,sGAAsG;IACtG,oEAAoE;IACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QACpD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;AAC7H,CAAC"}

package/dist/return-path.d.ts

@@ -0,0 +1,10 @@
+export type EntryReturnPathContext = {
+    readonly origin: string;
+    readonly scope: string;
+};
+/**
+ * Validates a return path per spec/pwa-entry-resilience.md's "返回路径校验". Returns the input
+ * string unchanged when it is legal, `null` otherwise. Never throws.
+ */
+export declare function normalizeReturnPath(value: unknown, context: EntryReturnPathContext): string | null;
+//# sourceMappingURL=return-path.d.ts.map

package/dist/return-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-path.d.ts","sourceRoot":"","sources":["../src/return-path.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AA2BF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAwBlG"}

package/dist/return-path.js

@@ -0,0 +1,75 @@
+// Return-path validation for `?return=` on the platform recovery page. Every rule mirrors
+// spec/pwa-entry-resilience.md's "返回路径校验" section, in the order it lists them:
+// structural checks on the raw string -> a ".." segment check on the raw string -> decode once -> the same
+// structural and ".." checks re-run on the decoded string -> a URL-based origin/scope check against `value`
+// itself (not the decoded form). On any failure the whole path is discarded; nothing is ever
+// echoed back to a caller, only `null`.
+//
+// The ".." check splits the *entire* string on `/`, `?` and `#` rather than truncating at the first `?`/`#`: a
+// literal `?` introduced by decoding (e.g. `%3f`) would otherwise let a later `..` segment hide past where the
+// raw string's own `?`/`#` truncation stopped looking (independent review finding, 2026-09-17).
+const MAX_LENGTH = 1024;
+/** True if `value` contains a C0 control character (U+0000-U+001F) or DEL (U+007F). */
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Length, single leading `/`, no backslash, no control character — checked both before and after decoding. */
+function isStructurallyValid(value) {
+    if (value.length < 1 || value.length > MAX_LENGTH)
+        return false;
+    if (value[0] !== "/")
+        return false;
+    if (value.length > 1 && (value[1] === "/" || value[1] === "\\"))
+        return false;
+    if (value.includes("\\"))
+        return false;
+    if (hasControlCharacter(value))
+        return false;
+    return true;
+}
+/** True if any `/`-, `?`- or `#`-delimited segment of `value` is exactly `..`. Never truncates at `?`/`#`: the
+ *  whole string is split, so a `..` segment cannot hide past a literal `?`/`#` (see this module's header comment). */
+function hasDotDotSegment(value) {
+    return value.split(/[/?#]/).some((segment) => segment === "..");
+}
+/**
+ * Validates a return path per spec/pwa-entry-resilience.md's "返回路径校验". Returns the input
+ * string unchanged when it is legal, `null` otherwise. Never throws.
+ */
+export function normalizeReturnPath(value, context) {
+    if (typeof value !== "string")
+        return null;
+    if (!isStructurallyValid(value))
+        return null;
+    if (hasDotDotSegment(value))
+        return null;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+    if (!isStructurallyValid(decoded))
+        return null;
+    if (hasDotDotSegment(decoded))
+        return null;
+    let url;
+    try {
+        url = new URL(value, context.origin);
+    }
+    catch {
+        return null;
+    }
+    if (url.origin !== context.origin)
+        return null;
+    if (!url.pathname.startsWith(context.scope))
+        return null;
+    return value;
+}
+//# sourceMappingURL=return-path.js.map

package/dist/return-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-path.js","sourceRoot":"","sources":["../src/return-path.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,+EAA+E;AAC/E,2GAA2G;AAC3G,4GAA4G;AAC5G,6FAA6F;AAC7F,wCAAwC;AACxC,EAAE;AACF,+GAA+G;AAC/G,+GAA+G;AAC/G,gGAAgG;AAEhG,MAAM,UAAU,GAAG,IAAI,CAAC;AAOxB,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+GAA+G;AAC/G,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;sHACsH;AACtH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAA+B;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/select.d.ts

@@ -0,0 +1,16 @@
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryManifest } from "./types.js";
+export type EntrySelectionInput = {
+    readonly stored: EntryManifest | null;
+    readonly incoming: EntryManifest;
+};
+export type EntrySelection = {
+    readonly kind: "accepted";
+    readonly manifest: EntryManifest;
+} | {
+    readonly kind: "rejected";
+    readonly diagnostics: readonly EntryDiagnostic[];
+};
+/** Highest `sequence` wins; equal or lower is rejected without writing. */
+export declare function selectManifest(input: EntrySelectionInput): EntrySelection;
+//# sourceMappingURL=select.d.ts.map

package/dist/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../src/select.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAAC;AAEpF,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAKzE"}

package/dist/select.js

@@ -0,0 +1,17 @@
+// Write-time "does this beat what is already stored" decision — spec/pwa-entry-resilience.md's revised
+// "updateEntryManifest 在校验通过且 sequence 大于已存记录时写入 IndexedDB...序号不大于已存记录时不写入". Pure,
+// synchronous, driven only by its arguments: no clock, storage or network access of its own.
+//
+// ADR-0033 (2026-09-23) removed the three-way (build-time seed / stored / discovery-source) selection this module
+// used to perform, along with the signature verification that decided which candidates were even eligible: there
+// is now exactly one incoming candidate (already field-validated by src/manifest.ts) and one stored record, and the
+// only question is whether the incoming one's `sequence` is strictly greater.
+import { diagnostic } from "./diagnostics.js";
+/** Highest `sequence` wins; equal or lower is rejected without writing. */
+export function selectManifest(input) {
+    if (input.stored !== null && input.incoming.sequence <= input.stored.sequence) {
+        return { kind: "rejected", diagnostics: [diagnostic("entry.sequence-not-greater", "/sequence")] };
+    }
+    return { kind: "accepted", manifest: input.incoming };
+}
+//# sourceMappingURL=select.js.map

package/dist/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../src/select.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,mFAAmF;AACnF,6FAA6F;AAC7F,EAAE;AACF,kHAAkH;AAClH,iHAAiH;AACjH,oHAAoH;AACpH,8EAA8E;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAa9C,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+export declare const ENTRY_MANIFEST_STATUSES: readonly ["normal", "migrating", "incident"];
+export type EntryManifestStatus = (typeof ENTRY_MANIFEST_STATUSES)[number];
+export declare const ENTRY_MANIFEST_REASON_CODES: readonly ["planned-migration", "incident", "none"];
+export type EntryManifestReasonCode = (typeof ENTRY_MANIFEST_REASON_CODES)[number];
+export type EntryManifestReason = {
+    readonly code: EntryManifestReasonCode;
+    /** Plain text, at most 200 UTF-16 code units, no control characters. */
+    readonly message?: string;
+};
+export type EntryManifestEntry = {
+    /** Normalized origin: HTTPS, or HTTP on a loopback host for local development. Not checked against any
+     *  build-time approval list — ADR-0033 removed that list along with the signature it used to backstop. */
+    readonly origin: string;
+    /** Absolute path: starts with `/`, no `..` segments, no backslashes, no `//`, at most 512 characters. */
+    readonly startPath: string;
+};
+/** The plain object the application hands in to `updateEntryManifest`, once parsed and field-validated. */
+export type EntryManifest = {
+    /** Non-negative safe integer; only a manifest with a strictly greater `sequence` than what is already stored
+     *  replaces it (see src/select.ts). */
+    readonly sequence: number;
+    /** ISO 8601 UTC (`YYYY-MM-DDTHH:mm:ssZ`); must be in the future when handed in, and no further out than the
+     *  configured `maxValidityDays`. */
+    readonly expiresAt: string;
+    readonly status: EntryManifestStatus;
+    readonly reason: EntryManifestReason;
+    /** 0 to 5 entries. */
+    readonly entries: readonly EntryManifestEntry[];
+    /** Optional; when given, must equal the application's identity exactly. */
+    readonly appId?: string;
+    /** Optional; when given, must equal the application's identity exactly. */
+    readonly environment?: string;
+};
+/** Everything `parseEntryManifest` needs and cannot read from ambient state — the clock included. */
+export type EntryManifestValidationContext = {
+    readonly appId: string;
+    readonly environment: string;
+    /** Integer 1-90: the maximum number of days between the moment the manifest is handed in and its `expiresAt`. */
+    readonly maxValidityDays: number;
+    /** Current time in epoch milliseconds, injected so validation never reads the system clock. */
+    readonly now: number;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,uBAAuB,8CAA+C,CAAC;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,2BAA2B,oDAAqD,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;8GAC0G;IAC1G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,2GAA2G;AAC3G,MAAM,MAAM,aAAa,GAAG;IAC1B;2CACuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;wCACoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,sBAAsB;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iHAAiH;IACjH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/types.js

@@ -0,0 +1,10 @@
+// Public contract types for the entry-recovery manifest the application hands in. Field names and shapes mirror
+// spec/pwa-entry-resilience.md's "修订：入口清单由业务应用提供" -> "契约增量" section exactly; this module only
+// declares types, it performs no checks (see src/manifest.ts for validation).
+//
+// ADR-0033 (2026-09-23) removed the package's cryptographic trust root: there is no more signed envelope, build-
+// time public key set or `schemaVersion`. `EntryKey`, `EntryEnvelope`, `EntryVerifyContext` and `EntryVerification`
+// existed only for that model and were deleted along with src/verify.ts and src/keys.ts.
+export const ENTRY_MANIFEST_STATUSES = ["normal", "migrating", "incident"];
+export const ENTRY_MANIFEST_REASON_CODES = ["planned-migration", "incident", "none"];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,8FAA8F;AAC9F,8EAA8E;AAC9E,EAAE;AACF,iHAAiH;AACjH,oHAAoH;AACpH,yFAAyF;AAEzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAGpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC"}

package/dist/update.d.ts

@@ -0,0 +1,28 @@
+import type { EntryDiagnostic } from "./diagnostics.js";
+import type { EntryManifest } from "./types.js";
+export type EntryManifestUpdateConfig = {
+    readonly appId: string;
+    readonly environment: string;
+    /** Integer 1-90: the maximum number of days between now and the incoming manifest's `expiresAt`. */
+    readonly maxValidityDays: number;
+};
+export type EntryManifestUpdatePorts = {
+    now(): number;
+    loadStored(): Promise<EntryManifest | null>;
+    saveStored(manifest: EntryManifest): Promise<void>;
+};
+export type EntryManifestUpdateResult = {
+    readonly accepted: true;
+    readonly sequence: number;
+} | {
+    readonly accepted: false;
+    readonly diagnostics: readonly EntryDiagnostic[];
+};
+/**
+ * Validates `data`, compares it against the stored record, and writes it when it wins. Never throws: every port
+ * failure (an unavailable clock, a failed read, a failed write) becomes `{ accepted: false, diagnostics }` rather
+ * than a rejection — there is no room for a diagnostic on the `accepted: true` branch, so any failure that cannot
+ * be represented there must reject instead of silently pretending to have succeeded.
+ */
+export declare function runEntryManifestUpdate(data: unknown, config: EntryManifestUpdateConfig, ports: EntryManifestUpdatePorts): Promise<EntryManifestUpdateResult>;
+//# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5C,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,CAAC;AAEnF;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAoCpC"}