@pwa-platform/sw-runtime 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PWA Platform contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,9 @@
+# @pwa-platform/sw-runtime
+
+Service worker and recovery runtime for PWA Platform.
+
+Internal platform service worker and recovery worker implementation. Applications should not register its entries directly.
+
+This is a `0.1.0` prerelease. It provides online use, installation integration, static precaching, a safe offline fallback, and controlled updates. It does not enable runtime business API caching, private data caching, automatic write replay, or Push for applications. Production deployment requires the application and infrastructure checks described in the PWA Platform release runbook.
+
+License: MIT.

package/dist/build/config.d.ts

@@ -0,0 +1,10 @@
+import { type PwaPlan } from "@pwa-platform/contracts";
+import { type PwaPlatformWorkerConfig, type PwaRecoveryWorkerConfig } from "../shared/config.js";
+/**
+ * The platform worker's runtime config: only the plan fields the worker reads, with the precache cache name computed
+ * by contracts. Throws for an invalid plan (the message lists diagnostic codes and paths only).
+ */
+export declare function createPlatformWorkerConfig(plan: PwaPlan): PwaPlatformWorkerConfig;
+/** The recovery worker's config: the app's cache prefix computed by contracts. Throws for an invalid plan. */
+export declare function createRecoveryWorkerConfig(plan: PwaPlan): PwaRecoveryWorkerConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/build/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/build/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,uBAAuB,CAcjF;AAED,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,uBAAuB,CAQjF"}

package/dist/build/config.js

@@ -0,0 +1,40 @@
+import { appCachePrefix, cacheName, validatePlan } from "@pwa-platform/contracts";
+import { validatePlatformWorkerConfig, validateRecoveryWorkerConfig, } from "../shared/config.js";
+/**
+ * The platform worker's runtime config: only the plan fields the worker reads, with the precache cache name computed
+ * by contracts. Throws for an invalid plan (the message lists diagnostic codes and paths only).
+ */
+export function createPlatformWorkerConfig(plan) {
+    const validated = validPlan(plan);
+    const { identity, requestBaselineDenials, pathRules, offlineFallback, updateMode } = validated;
+    return validatePlatformWorkerConfig({
+        kind: "platform",
+        version: 1,
+        scope: identity.scope,
+        precacheCacheName: cacheName(identity, "precache"),
+        requestBaselineDenials: [...requestBaselineDenials],
+        pathRules: pathRules.map(({ pathPrefix, action }) => ({ pathPrefix, action })),
+        offlineFallback: offlineFallback.enabled ? { enabled: true, path: offlineFallback.path } : { enabled: false },
+        updateMode,
+        offlineWrites: validated.schemaVersion === 2 ? validated.offlineWrites : { enabled: false },
+    });
+}
+/** The recovery worker's config: the app's cache prefix computed by contracts. Throws for an invalid plan. */
+export function createRecoveryWorkerConfig(plan) {
+    const { identity } = validPlan(plan);
+    return validateRecoveryWorkerConfig({
+        kind: "recovery",
+        version: 1,
+        appCachePrefix: appCachePrefix(identity),
+        offlineWriteDatabaseName: `pwa-offline-write:${encodeURIComponent(identity.appId)}:${encodeURIComponent(identity.environment)}:${encodeURIComponent(identity.cacheNamespaceSeed)}`,
+    });
+}
+function validPlan(plan) {
+    const result = validatePlan(plan);
+    if (!result.ok) {
+        const findings = result.diagnostics.map(({ code, path }) => `${code} at ${path === "" ? "(root)" : path}`);
+        throw new Error(`Cannot create a worker config from an invalid PwaPlan: ${findings.join(", ")}`);
+    }
+    return result.value;
+}
+//# sourceMappingURL=config.js.map

package/dist/build/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/build/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,yBAAyB,CAAC;AAChG,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAG7B,MAAM,qBAAqB,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC/F,OAAO,4BAA4B,CAAC;QAClC,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,iBAAiB,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClD,sBAAsB,EAAE,CAAC,GAAG,sBAAsB,CAAC;QACnD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,eAAe,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7G,UAAU;QACV,aAAa,EAAE,SAAS,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC5F,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,4BAA4B,CAAC;QAClC,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;QACxC,wBAAwB,EAAE,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE;KACnL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC"}

package/dist/build/index.d.ts

@@ -0,0 +1,6 @@
+export { createPlatformWorkerConfig, createRecoveryWorkerConfig } from "./config.js";
+export { injectWorkerConfig, WORKER_CONFIG_INJECTION_POINT } from "./inject.js";
+export { createPathMatcher } from "../shared/path-match.js";
+export type { PwaPlatformWorkerConfig, PwaRecoveryWorkerConfig, PwaWorkerBaselineDenial, PwaWorkerConfig, PwaWorkerPath, PwaWorkerPathRule, PwaWorkerPathRuleAction, } from "../shared/config.js";
+export type { PwaPathMatcher } from "../shared/path-match.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/build/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/build/index.js

@@ -0,0 +1,9 @@
+// Build-time entry (Node): creates the worker configs from a validated PwaPlan and injects them after bundling.
+// Also re-exports the runtime path matcher (shared/path-match.ts) for hosts that need to classify a path against a
+// plan's path rules outside of a worker — e.g. @pwa-platform/nuxt's build-time check for prerendered HTML that
+// falls under a denied path rule (T6). path-match.ts itself imports nothing, so this entry still imports only
+// @pwa-platform/contracts.
+export { createPlatformWorkerConfig, createRecoveryWorkerConfig } from "./config.js";
+export { injectWorkerConfig, WORKER_CONFIG_INJECTION_POINT } from "./inject.js";
+export { createPathMatcher } from "../shared/path-match.js";
+//# sourceMappingURL=index.js.map

package/dist/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/build/index.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,mHAAmH;AACnH,+GAA+G;AAC/G,8GAA8G;AAC9G,2BAA2B;AAC3B,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/build/inject.d.ts

@@ -0,0 +1,13 @@
+import { type PwaWorkerConfig } from "../shared/config.js";
+/** Injection point for the worker config; the bundled worker source must contain it exactly once. */
+export declare const WORKER_CONFIG_INJECTION_POINT = "self.__PWA_WORKER_CONFIG";
+/**
+ * Replaces the injection point in the bundled `workerSource` with `config` serialized as JSON. Call it after bundling,
+ * like the precache manifest injection (ADR-0011).
+ *
+ * The config is validated first and serialized from the validated copy, so the output does not depend on the key
+ * order of the given object. Throws when the config is invalid or the injection point does not occur exactly once.
+ * Pure and deterministic: no file access, bundling or minification.
+ */
+export declare function injectWorkerConfig(workerSource: string, config: PwaWorkerConfig): string;
+//# sourceMappingURL=inject.d.ts.map

package/dist/build/inject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../src/build/inject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEjF,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAYxF"}

package/dist/build/inject.js

@@ -0,0 +1,29 @@
+import { validateWorkerConfig } from "../shared/config.js";
+/** Injection point for the worker config; the bundled worker source must contain it exactly once. */
+export const WORKER_CONFIG_INJECTION_POINT = "self.__PWA_WORKER_CONFIG";
+/**
+ * Replaces the injection point in the bundled `workerSource` with `config` serialized as JSON. Call it after bundling,
+ * like the precache manifest injection (ADR-0011).
+ *
+ * The config is validated first and serialized from the validated copy, so the output does not depend on the key
+ * order of the given object. Throws when the config is invalid or the injection point does not occur exactly once.
+ * Pure and deterministic: no file access, bundling or minification.
+ */
+export function injectWorkerConfig(workerSource, config) {
+    if (typeof workerSource !== "string")
+        throw new TypeError("The worker source must be a string");
+    const serialized = JSON.stringify(validateWorkerConfig(config));
+    const occurrences = countOccurrences(workerSource, WORKER_CONFIG_INJECTION_POINT);
+    if (occurrences !== 1) {
+        throw new Error(`Expected exactly one ${WORKER_CONFIG_INJECTION_POINT} injection point in the worker source, found ${occurrences}`);
+    }
+    const index = workerSource.indexOf(WORKER_CONFIG_INJECTION_POINT);
+    return `${workerSource.slice(0, index)}${serialized}${workerSource.slice(index + WORKER_CONFIG_INJECTION_POINT.length)}`;
+}
+function countOccurrences(text, search) {
+    let count = 0;
+    for (let index = text.indexOf(search); index !== -1; index = text.indexOf(search, index + search.length))
+        count += 1;
+    return count;
+}
+//# sourceMappingURL=inject.js.map

package/dist/build/inject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject.js","sourceRoot":"","sources":["../../src/build/inject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AAEjF,qGAAqG;AACrG,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,MAAuB;IAC9E,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IAClF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wBAAwB,6BAA6B,gDAAgD,WAAW,EAAE,CAAC,CAAC;IACtI,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAClE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACrH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/entries/platform-worker-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=platform-worker-entry.d.ts.map

package/dist/entries/platform-worker-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-worker-entry.d.ts","sourceRoot":"","sources":["../../src/entries/platform-worker-entry.ts"],"names":[],"mappings":""}

package/dist/entries/platform-worker-entry.js

@@ -0,0 +1,3 @@
+import { registerPlatformWorker } from "../worker/index.js";
+registerPlatformWorker({ scope: self, config: self.__PWA_WORKER_CONFIG, manifest: self.__WB_MANIFEST });
+//# sourceMappingURL=platform-worker-entry.js.map

package/dist/entries/platform-worker-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-worker-entry.js","sourceRoot":"","sources":["../../src/entries/platform-worker-entry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAQ5D,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC"}

package/dist/entries/recovery-worker-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recovery-worker-entry.d.ts.map

package/dist/entries/recovery-worker-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-worker-entry.d.ts","sourceRoot":"","sources":["../../src/entries/recovery-worker-entry.ts"],"names":[],"mappings":""}

package/dist/entries/recovery-worker-entry.js

@@ -0,0 +1,4 @@
+// Script bundled by vite-adapter as the recovery worker: reads the injected recovery config.
+import { registerRecoveryWorker } from "../recovery-worker/index.js";
+registerRecoveryWorker({ scope: self, config: self.__PWA_WORKER_CONFIG });
+//# sourceMappingURL=recovery-worker-entry.js.map

package/dist/entries/recovery-worker-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-worker-entry.js","sourceRoot":"","sources":["../../src/entries/recovery-worker-entry.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAMrE,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC"}

package/dist/messages/index.d.ts

@@ -0,0 +1,49 @@
+/** Message a page posts to the waiting platform worker once the user accepts an update. */
+export type PwaSkipWaitingMessage = {
+    readonly type: "pwa:skip-waiting";
+};
+export declare const SKIP_WAITING_MESSAGE: PwaSkipWaitingMessage;
+/**
+ * True only for a plain object (this realm's `Object.prototype` or a null prototype) whose single own property is a
+ * `type` data property equal to `"pwa:skip-waiting"`. Structured-cloned messages have that shape; accessors are
+ * never invoked.
+ */
+export declare function isSkipWaitingMessage(value: unknown): value is PwaSkipWaitingMessage;
+export type PwaOfflineWriteIntentMessage = {
+    readonly targetId: string;
+    readonly path: string;
+    readonly body: unknown;
+    readonly idempotencyKey: string;
+    readonly sessionBinding: string;
+};
+export type PwaOfflineWriteMessage = {
+    readonly type: "pwa:offline-write:enqueue";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly intent: PwaOfflineWriteIntentMessage;
+} | {
+    readonly type: "pwa:offline-write:flush";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly sessionBinding: string;
+} | {
+    readonly type: "pwa:offline-write:clear";
+    readonly version: 1;
+    readonly requestId: string;
+};
+/** The only acknowledgement a page accepts before it unregisters after an offline-write clear request. */
+export type PwaOfflineWriteClearResult = {
+    readonly type: "pwa:offline-write:result";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly status: "cleared";
+};
+/**
+ * Recognizes only the v1 offline-write request envelopes. It deliberately validates only wire shape: target matching,
+ * JSON encoding, length limits and persistence are enforced together by the queue so a future caller cannot mistake
+ * a syntactically valid message for an accepted write. Reads never invoke a page-provided accessor.
+ */
+export declare function isOfflineWriteMessage(value: unknown): value is PwaOfflineWriteMessage;
+/** Matches one closed clear acknowledgement without reading page- or worker-provided accessors. */
+export declare function isOfflineWriteClearResult(value: unknown, requestId: string): value is PwaOfflineWriteClearResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/messages/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,MAAM,qBAAqB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE1E,eAAO,MAAM,oBAAoB,EAAE,qBAAmE,CAAC;AAEvG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAQnF;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,0GAA0G;AAC1G,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CA2BrF;AAED,mGAAmG;AACnG,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,KAAK,IAAI,0BAA0B,CAShH"}

package/dist/messages/index.js

@@ -0,0 +1,90 @@
+export const SKIP_WAITING_MESSAGE = Object.freeze({ type: "pwa:skip-waiting" });
+/**
+ * True only for a plain object (this realm's `Object.prototype` or a null prototype) whose single own property is a
+ * `type` data property equal to `"pwa:skip-waiting"`. Structured-cloned messages have that shape; accessors are
+ * never invoked.
+ */
+export function isSkipWaitingMessage(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== 1 || keys[0] !== "type")
+        return false;
+    const descriptor = Object.getOwnPropertyDescriptor(value, "type");
+    return descriptor !== undefined && "value" in descriptor && descriptor.value === SKIP_WAITING_MESSAGE.type;
+}
+/**
+ * Recognizes only the v1 offline-write request envelopes. It deliberately validates only wire shape: target matching,
+ * JSON encoding, length limits and persistence are enforced together by the queue so a future caller cannot mistake
+ * a syntactically valid message for an accepted write. Reads never invoke a page-provided accessor.
+ */
+export function isOfflineWriteMessage(value) {
+    try {
+        const envelope = plainDataObject(value);
+        if (envelope === undefined || read(envelope, "version") !== 1 || typeof read(envelope, "requestId") !== "string")
+            return false;
+        const type = read(envelope, "type");
+        if (type === "pwa:offline-write:clear")
+            return dataObject(value, ["type", "version", "requestId"]) !== undefined;
+        if (type === "pwa:offline-write:flush") {
+            const flush = dataObject(value, ["type", "version", "requestId", "sessionBinding"]);
+            return flush !== undefined && typeof read(flush, "sessionBinding") === "string";
+        }
+        if (type !== "pwa:offline-write:enqueue")
+            return false;
+        const enqueue = dataObject(value, ["type", "version", "requestId", "intent"]);
+        if (enqueue === undefined)
+            return false;
+        const intent = dataObject(read(enqueue, "intent"), ["targetId", "path", "body", "idempotencyKey", "sessionBinding"]);
+        return (intent !== undefined &&
+            typeof read(intent, "targetId") === "string" &&
+            typeof read(intent, "path") === "string" &&
+            typeof read(intent, "idempotencyKey") === "string" &&
+            typeof read(intent, "sessionBinding") === "string");
+    }
+    catch {
+        // Proxies can throw while revealing their prototype or own keys. A hostile message is simply not our protocol.
+        return false;
+    }
+}
+/** Matches one closed clear acknowledgement without reading page- or worker-provided accessors. */
+export function isOfflineWriteClearResult(value, requestId) {
+    const result = dataObject(value, ["type", "version", "requestId", "status"]);
+    return (result !== undefined &&
+        read(result, "type") === "pwa:offline-write:result" &&
+        read(result, "version") === 1 &&
+        read(result, "requestId") === requestId &&
+        read(result, "status") === "cleared");
+}
+function dataObject(value, keys) {
+    const record = plainDataObject(value);
+    if (record === undefined)
+        return undefined;
+    const actual = Reflect.ownKeys(record);
+    if (actual.length !== keys.length || !keys.every((key) => actual.includes(key)))
+        return undefined;
+    return record;
+}
+function plainDataObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return undefined;
+    const actual = Reflect.ownKeys(value);
+    if (actual.some((key) => typeof key !== "string" || !hasDataProperty(value, key)))
+        return undefined;
+    return value;
+}
+function hasDataProperty(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor !== undefined && "value" in descriptor;
+}
+function read(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor !== undefined && "value" in descriptor ? descriptor.value : undefined;
+}
+//# sourceMappingURL=index.js.map

package/dist/messages/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,oBAAoB,GAA0B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEvG;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,oBAAoB,CAAC,IAAI,CAAC;AAC7G,CAAC;AAiCD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE/H,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,yBAAyB;YAAE,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,KAAK,SAAS,CAAC;QACjH,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACpF,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,QAAQ,CAAC;QAClF,CAAC;QACD,IAAI,IAAI,KAAK,2BAA2B;YAAE,OAAO,KAAK,CAAC;QAEvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACrH,OAAO,CACL,MAAM,KAAK,SAAS;YACpB,OAAO,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,QAAQ;YAC5C,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,QAAQ;YACxC,OAAO,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,QAAQ;YAClD,OAAO,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,QAAQ,CACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+GAA+G;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,SAAiB;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,OAAO,CACL,MAAM,KAAK,SAAS;QACpB,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,0BAA0B;QACnD,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,SAAS;QACvC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAuB;IACzD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,GAAW;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC;AAC3D,CAAC;AAED,SAAS,IAAI,CAAC,KAA8B,EAAE,GAAW;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC"}

package/dist/push-payload/index.d.ts

@@ -0,0 +1,46 @@
+/** The platform push payload. `v` is closed at 1; every other field is validated by `checkPushPayload`. */
+export type PwaPushPayload = {
+    readonly v: 1;
+    /** 1..120 Unicode code points. */
+    readonly title: string;
+    /** 0..480 Unicode code points. */
+    readonly body?: string;
+    /** 1..64 Unicode code points. Notifications sharing a tag replace one another. */
+    readonly tag?: string;
+    /** 1..2048 Unicode code points. Format-level only: the worker resolves and range-checks the target later. */
+    readonly url?: string;
+    /** 0..256 Unicode code points. Opaque to the platform. */
+    readonly data?: string;
+};
+export declare const PUSH_PAYLOAD_VERSION: 1;
+/** UTF-8 byte limit for the whole payload text (Web Push's 4096-byte record limit, less headroom for encryption). */
+export declare const PUSH_PAYLOAD_MAX_BYTES: 3072;
+export declare const PUSH_PAYLOAD_ISSUE_CODES: readonly ["push.payload-too-large", "push.payload-not-json", "push.payload-not-object", "push.payload-unknown-field", "push.payload-version", "push.payload-field-type", "push.payload-field-length"];
+export type PwaPushPayloadIssueCode = (typeof PUSH_PAYLOAD_ISSUE_CODES)[number];
+/** `path` is a JSON pointer into the payload: `""` for the whole payload, `"/title"` for a single field. */
+export type PwaPushPayloadIssue = {
+    readonly code: PwaPushPayloadIssueCode;
+    readonly path: string;
+};
+export type PwaPushPayloadCheck = {
+    readonly ok: true;
+    readonly value: PwaPushPayload;
+} | {
+    readonly ok: false;
+    readonly issues: readonly PwaPushPayloadIssue[];
+};
+/**
+ * Validates an already-parsed value against the payload format. Reports every issue found, in a deterministic
+ * order: unknown fields (in the order their keys appear on the object), then the version, then each known field in
+ * schema order. Never invokes an accessor property and never includes an input value in an issue. Used directly by
+ * the server-side payload builder (a later task); the worker and `checkPushPayloadText` go through this too.
+ */
+export declare function checkPushPayload(value: unknown): PwaPushPayloadCheck;
+/**
+ * Validates the raw push text as received by the worker: the UTF-8 byte limit on the text itself, then `JSON.parse`,
+ * then `checkPushPayload`. Never throws: a `JSON.parse` failure becomes a `push.payload-not-json` issue.
+ */
+export declare function checkPushPayloadText(text: string): PwaPushPayloadCheck;
+/** Convenience for the worker: the payload, or `null` for anything invalid. */
+export declare function validatePushPayload(text: string): PwaPushPayload | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/push-payload/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/push-payload/index.ts"],"names":[],"mappings":"AAKA,2GAA2G;AAC3G,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,qHAAqH;AACrH,eAAO,MAAM,sBAAsB,EAAG,IAAa,CAAC;AAEpD,eAAO,MAAM,wBAAwB,uMAQ3B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,4GAA4G;AAC5G,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA0B5E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAqDpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAatE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGvE"}

package/dist/push-payload/index.js

@@ -0,0 +1,115 @@
+// The platform push payload: a closed, zero-dependency format shared by the platform worker (which parses and
+// displays it) and the business backend (which constructs it, via @pwa-platform/push/server's re-export). It imports
+// nothing, so the same validation runs unchanged wherever this entry is bundled. Spec: spec/push-module.md "设计 / 1.
+// 推送格式"; ADR-0021.
+export const PUSH_PAYLOAD_VERSION = 1;
+/** UTF-8 byte limit for the whole payload text (Web Push's 4096-byte record limit, less headroom for encryption). */
+export const PUSH_PAYLOAD_MAX_BYTES = 3072;
+export const PUSH_PAYLOAD_ISSUE_CODES = [
+    "push.payload-too-large",
+    "push.payload-not-json",
+    "push.payload-not-object",
+    "push.payload-unknown-field",
+    "push.payload-version",
+    "push.payload-field-type",
+    "push.payload-field-length",
+];
+const FIELD_ORDER = ["title", "body", "tag", "url", "data"];
+const FIELD_LIMITS = {
+    title: { required: true, min: 1, max: 120 },
+    body: { required: false, min: 0, max: 480 },
+    tag: { required: false, min: 1, max: 64 },
+    url: { required: false, min: 1, max: 2048 },
+    data: { required: false, min: 0, max: 256 },
+};
+const KNOWN_KEYS = new Set(["v", "title", "body", "tag", "url", "data"]);
+/** True only for a data property descriptor: an accessor is never invoked to read its value. */
+function isDataDescriptor(descriptor) {
+    return "value" in descriptor;
+}
+/** Unicode code point count, so an astral character (e.g. an emoji) counts once rather than as two UTF-16 units. */
+function codePointLength(text) {
+    return [...text].length;
+}
+/**
+ * Validates an already-parsed value against the payload format. Reports every issue found, in a deterministic
+ * order: unknown fields (in the order their keys appear on the object), then the version, then each known field in
+ * schema order. Never invokes an accessor property and never includes an input value in an issue. Used directly by
+ * the server-side payload builder (a later task); the worker and `checkPushPayloadText` go through this too.
+ */
+export function checkPushPayload(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return { ok: false, issues: [{ code: "push.payload-not-object", path: "" }] };
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        return { ok: false, issues: [{ code: "push.payload-not-object", path: "" }] };
+    }
+    const issues = [];
+    for (const key of Reflect.ownKeys(value)) {
+        if (!KNOWN_KEYS.has(key))
+            issues.push({ code: "push.payload-unknown-field", path: "" });
+    }
+    const versionDescriptor = Object.getOwnPropertyDescriptor(value, "v");
+    if (versionDescriptor === undefined || !isDataDescriptor(versionDescriptor) || versionDescriptor.value !== PUSH_PAYLOAD_VERSION) {
+        issues.push({ code: "push.payload-version", path: "/v" });
+    }
+    const fields = {};
+    for (const field of FIELD_ORDER) {
+        const limit = FIELD_LIMITS[field];
+        const descriptor = Object.getOwnPropertyDescriptor(value, field);
+        if (descriptor === undefined) {
+            if (limit.required)
+                issues.push({ code: "push.payload-field-type", path: `/${field}` });
+            continue;
+        }
+        if (!isDataDescriptor(descriptor) || typeof descriptor.value !== "string") {
+            issues.push({ code: "push.payload-field-type", path: `/${field}` });
+            continue;
+        }
+        const fieldValue = descriptor.value;
+        const length = codePointLength(fieldValue);
+        if (length < limit.min || length > limit.max) {
+            issues.push({ code: "push.payload-field-length", path: `/${field}` });
+            continue;
+        }
+        fields[field] = fieldValue;
+    }
+    if (issues.length > 0)
+        return { ok: false, issues };
+    // `title` is required; with no issues collected, its required-field and type checks above must have passed, so a
+    // value was recorded. (No throw: this module never throws, for any input.)
+    const payload = { title: fields.title };
+    if (fields.body !== undefined)
+        payload.body = fields.body;
+    if (fields.tag !== undefined)
+        payload.tag = fields.tag;
+    if (fields.url !== undefined)
+        payload.url = fields.url;
+    if (fields.data !== undefined)
+        payload.data = fields.data;
+    return { ok: true, value: Object.freeze({ v: PUSH_PAYLOAD_VERSION, ...payload }) };
+}
+/**
+ * Validates the raw push text as received by the worker: the UTF-8 byte limit on the text itself, then `JSON.parse`,
+ * then `checkPushPayload`. Never throws: a `JSON.parse` failure becomes a `push.payload-not-json` issue.
+ */
+export function checkPushPayloadText(text) {
+    if (new TextEncoder().encode(text).length > PUSH_PAYLOAD_MAX_BYTES) {
+        return { ok: false, issues: [{ code: "push.payload-too-large", path: "" }] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, issues: [{ code: "push.payload-not-json", path: "" }] };
+    }
+    return checkPushPayload(parsed);
+}
+/** Convenience for the worker: the payload, or `null` for anything invalid. */
+export function validatePushPayload(text) {
+    const result = checkPushPayloadText(text);
+    return result.ok ? result.value : null;
+}
+//# sourceMappingURL=index.js.map

package/dist/push-payload/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/push-payload/index.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,qHAAqH;AACrH,oHAAoH;AACpH,mBAAmB;AAiBnB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAU,CAAC;AAE/C,qHAAqH;AACrH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAa,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,wBAAwB;IACxB,uBAAuB;IACvB,yBAAyB;IACzB,4BAA4B;IAC5B,sBAAsB;IACtB,yBAAyB;IACzB,2BAA2B;CACnB,CAAC;AAgBX,MAAM,WAAW,GAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzF,MAAM,YAAY,GAAmH;IACnI,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;IAC3C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;IAC3C,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACzC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE;IAC3C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;CAC5C,CAAC;AAEF,MAAM,UAAU,GAA6B,IAAI,GAAG,CAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhH,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,UAA8B;IACtD,OAAO,OAAO,IAAI,UAAU,CAAC;AAC/B,CAAC;AAED,oHAAoH;AACpH,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;QAChI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAA8C,EAAE,CAAC;IAE7D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAW,UAAU,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAEpD,iHAAiH;IACjH,2EAA2E;IAC3E,MAAM,OAAO,GAAgF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAe,EAAE,CAAC;IAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAE1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/recovery-worker/index.d.ts

@@ -0,0 +1,18 @@
+import { type PwaRecoveryWorkerConfig } from "../shared/config.js";
+export type PwaRecoveryWorkerOptions = {
+    readonly scope: ServiceWorkerGlobalScope;
+    /** The injected recovery config; validated before any listener is registered. */
+    readonly config: PwaRecoveryWorkerConfig;
+};
+/**
+ * Registers the recovery worker (ADR-0005): it takes over immediately only after it removes every cache and the
+ * identity-derived offline-write database of this app in this environment, then serves nothing, so page requests go
+ * straight to the network. On activation it also cancels this registration's push subscription, after deletion and
+ * before claiming clients, so the business backend starts seeing failed sends and can clean up (ADR-0021, "对
+ * ADR-0012 的修订").
+ *
+ * It registers only `install` and `activate`; it never registers `fetch`, `push` or `notificationclick`, never opens
+ * a cache and never deletes a cache outside `config.appCachePrefix`.
+ */
+export declare function registerRecoveryWorker({ scope, config }: PwaRecoveryWorkerOptions): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/recovery-worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery-worker/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAWxF"}