From 30fcea600de3191ed9230c8cb772f0090906d393 Mon Sep 17 00:00:00 2001
From: fullstackjam <fullstackjam@outlook.com>
Date: Sat, 24 Oct 2026 22:46:55 +0800
Subject: [PATCH 1/4] fix(packages): separate taps and normalize package
 exports

---
 src/docs/config-options.md                    |   8 +
 src/lib/components/ConfigDetail.svelte        | 130 +++++++++----
 src/lib/components/ConfigEditor.svelte        | 134 +++++++++-----
 src/lib/components/PackageManager.svelte      | 172 +++++++++++++++++-
 src/lib/packages.test.ts                      |  88 +++++++++
 src/lib/packages.ts                           |  88 +++++++++
 .../[username]/[slug]/config/+server.ts       | 102 ++++-------
 .../[username]/[slug]/config/server.test.ts   |  58 +++++-
 src/routes/api/configs/+server.ts             |  41 ++++-
 src/routes/api/configs/[slug]/+server.ts      |  69 ++++---
 src/routes/api/configs/[slug]/server.test.ts  |  52 ++++++
 .../api/configs/alias/[alias]/+server.ts      |  95 ++++------
 .../api/configs/from-snapshot/+server.ts      |  54 +++---
 src/routes/api/configs/server.test.ts         |  31 ++++
 src/routes/dashboard/+page.svelte             | 120 +++++++-----
 15 files changed, 924 insertions(+), 318 deletions(-)
 create mode 100644 src/lib/packages.test.ts
 create mode 100644 src/lib/packages.ts

diff --git a/src/docs/config-options.md b/src/docs/config-options.md
index 68b08c7..c76851c 100644
--- a/src/docs/config-options.md
+++ b/src/docs/config-options.md
@@ -71,6 +71,14 @@ The tools and apps to install. Stored as an array of package objects, each with
 
 Each entry is an object: `{ "name": "package-name", "type": "formula" | "cask" | "npm" | "tap" }`. Names must match Homebrew or npm package names exactly. Taps are added before formulae and casks are installed.
 
+Use `formula` or `cask` for fully qualified software names such as
+`oven-sh/bun/bun`; their `owner/repository` tap is derived automatically.
+Use `tap` only for a repository name such as `oven-sh/bun` when you want to
+retain that source independently of its packages. The editor lists sources in
+a separate Homebrew taps section, with the packages that require each source.
+Automatically derived sources disappear when their last package is removed;
+manually retained sources remain. Taps do not count toward the editor's software total.
+
 **Limits:** max 500 packages per config; name max 200 characters (alphanumeric, `.`, `_`, `-`, `@`, `/`).
 
 ### `custom_script`
diff --git a/src/lib/components/ConfigDetail.svelte b/src/lib/components/ConfigDetail.svelte
index cf0d826..fea5e9d 100644
--- a/src/lib/components/ConfigDetail.svelte
+++ b/src/lib/components/ConfigDetail.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { goto } from '$app/navigation';
+	import { normalizePackages, resolvePackages } from '$lib/packages';
 	import { getCatalogItem } from '$lib/macos-prefs-catalog';
 	import ShareModal from '$lib/components/ShareModal.svelte';
 	import MacOSPreferencesDisplay from '$lib/components/MacOSPreferencesDisplay.svelte';
@@ -105,10 +106,7 @@
 	}
 
 	function escapeHtml(str: string): string {
-		return str
-			.replace(/&/g, '&amp;')
-			.replace(/</g, '&lt;')
-			.replace(/>/g, '&gt;');
+		return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 	}
 
 	/** Color comments muted and the leading command token accent, comp-style. */
@@ -122,18 +120,14 @@
 		config.dotfiles_repo ? config.dotfiles_repo.replace(/^https?:\/\//, '').replace(/\.git$/, '') : ''
 	);
 
-	const configPkgs: { name: string; type: string }[] = $derived(
-		Array.isArray(config.packages)
-			? config.packages.map((p: any) => (typeof p === 'string' ? { name: p, type: 'formula' } : p))
-			: []
+	const configPkgs = $derived(
+		normalizePackages(Array.isArray(config.packages) ? config.packages : [], config.snapshot?.packages)
 	);
-
-	const configCli = $derived(
-		configPkgs.filter((p) => p.type !== 'cask' && p.type !== 'npm' && p.type !== 'tap')
-	);
-	const configApps = $derived(configPkgs.filter((p) => p.type === 'cask'));
-	const configNpm = $derived(configPkgs.filter((p) => p.type === 'npm'));
-	const configTaps = $derived(configPkgs.filter((p) => p.type === 'tap'));
+	const packageGroups = $derived(resolvePackages(configPkgs));
+	const configCli = $derived(packageGroups.formulae);
+	const configApps = $derived(packageGroups.casks);
+	const configNpm = $derived(packageGroups.npm);
+	const configTaps = $derived(packageGroups.taps);
 
 	// Package "fingerprint" — tall bars colored by type, behind the hero.
 	const fpCounts = $derived({
@@ -158,9 +152,7 @@
 	const shell = $derived(snapshot.shell || {});
 	const git = $derived(snapshot.git || {});
 	const devToolsRaw = $derived(snapshot.dev_tools || []);
-	const devTools = $derived(
-		devToolsRaw.map((t: any) => (typeof t === 'string' ? t : t?.name || String(t)))
-	);
+	const devTools = $derived(devToolsRaw.map((t: any) => (typeof t === 'string' ? t : t?.name || String(t))));
 
 	const prefsByCategory = $derived.by(() => {
 		const map: Record<string, { pref: any; catalogItem: ReturnType<typeof getCatalogItem> }[]> = {};
@@ -179,11 +171,35 @@
 	<div class="container">
 		<div class="topbar">
 			<a href="/explore" class="back">
-				<svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><path d="M19 12H5" /><path d="m12 19-7-7 7-7" /></svg>
+				<svg
+					width="15"
+					height="15"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2.5"
+					stroke-linecap="round"
+					stroke-linejoin="round"><path d="M19 12H5" /><path d="m12 19-7-7 7-7" /></svg
+				>
 				Back to explore
 			</a>
 			<button class="share" onclick={() => (showShareModal = true)}>
-				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="18" cy="5" r="3" /><circle cx="6" cy="12" r="3" /><circle cx="18" cy="19" r="3" /><line x1="8.59" y1="13.51" x2="15.42" y2="17.49" /><line x1="15.41" y1="6.51" x2="8.59" y2="10.49" /></svg>
+				<svg
+					width="14"
+					height="14"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"
+					><circle cx="18" cy="5" r="3" /><circle cx="6" cy="12" r="3" /><circle cx="18" cy="19" r="3" /><line
+						x1="8.59"
+						y1="13.51"
+						x2="15.42"
+						y2="17.49"
+					/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49" /></svg
+				>
 				Share
 			</button>
 		</div>
@@ -215,7 +231,22 @@
 
 						<div class="meta">
 							<span class="meta-item">
-								<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /><polyline points="7 10 12 15 17 10" /><line x1="12" y1="15" x2="12" y2="3" /></svg>
+								<svg
+									width="14"
+									height="14"
+									viewBox="0 0 24 24"
+									fill="none"
+									stroke="currentColor"
+									stroke-width="2"
+									stroke-linecap="round"
+									stroke-linejoin="round"
+									><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /><polyline points="7 10 12 15 17 10" /><line
+										x1="12"
+										y1="15"
+										x2="12"
+										y2="3"
+									/></svg
+								>
 								<span class="strong">{config.install_count || 0}</span> installs
 							</span>
 							{#if formatDate(config.updated_at)}
@@ -224,7 +255,9 @@
 							{#if dnaLegend.length > 0}
 								<span class="counts">
 									{#each dnaLegend as l}
-										<span class="count" title={l.label}><span class="swatch" style="background:{l.color};"></span>{l.n}</span>
+										<span class="count" title={l.label}
+											><span class="swatch" style="background:{l.color};"></span>{l.n}</span
+										>
 									{/each}
 								</span>
 							{/if}
@@ -258,7 +291,14 @@
 						<div class="kv"><span class="k">Base preset</span><span class="v">{config.base_preset}</span></div>
 					{/if}
 					{#if config.dotfiles_repo}
-						<div class="kv"><span class="k">Dotfiles</span><a class="v link" href={config.dotfiles_repo} target="_blank" rel="noopener noreferrer">{dotfilesLabel}</a></div>
+						<div class="kv">
+							<span class="k">Dotfiles</span><a
+								class="v link"
+								href={config.dotfiles_repo}
+								target="_blank"
+								rel="noopener noreferrer">{dotfilesLabel}</a
+							>
+						</div>
 					{/if}
 					<div class="kv"><span class="k">macOS prefs</span><span class="v">{macosPrefs.length} applied</span></div>
 				</div>
@@ -268,7 +308,10 @@
 		<div class="sections">
 			{#if configCli.length > 0}
 				<section class="pkg-section">
-					<h3 class="pkg-head"><span class="swatch" style="background:var(--accent);"></span>Formulae <span class="count">{configCli.length}</span></h3>
+					<h3 class="pkg-head">
+						<span class="swatch" style="background:var(--accent);"></span>Formulae
+						<span class="count">{configCli.length}</span>
+					</h3>
 					<div class="pkg-grid">
 						{#each configCli as p}
 							<a class="pkg-card" href={getPackageUrl(p.name, 'formula')} target="_blank" rel="noopener noreferrer">
@@ -282,7 +325,10 @@
 
 			{#if configApps.length > 0}
 				<section class="pkg-section">
-					<h3 class="pkg-head"><span class="swatch" style="background:var(--amber);"></span>Casks <span class="count">{configApps.length}</span></h3>
+					<h3 class="pkg-head">
+						<span class="swatch" style="background:var(--amber);"></span>Casks
+						<span class="count">{configApps.length}</span>
+					</h3>
 					<div class="pkg-grid">
 						{#each configApps as p}
 							<a class="pkg-card" href={getPackageUrl(p.name, 'cask')} target="_blank" rel="noopener noreferrer">
@@ -296,10 +342,15 @@
 
 			{#if configNpm.length > 0}
 				<section class="pkg-section">
-					<h3 class="pkg-head"><span class="swatch" style="background:#7aa2e3;"></span>NPM globals <span class="count">{configNpm.length}</span></h3>
+					<h3 class="pkg-head">
+						<span class="swatch" style="background:#7aa2e3;"></span>NPM globals
+						<span class="count">{configNpm.length}</span>
+					</h3>
 					<div class="chips">
 						{#each configNpm as p}
-							<a class="chip npm" href={getPackageUrl(p.name, 'npm')} target="_blank" rel="noopener noreferrer">{p.name}</a>
+							<a class="chip npm" href={getPackageUrl(p.name, 'npm')} target="_blank" rel="noopener noreferrer"
+								>{p.name}</a
+							>
 						{/each}
 					</div>
 				</section>
@@ -307,7 +358,10 @@
 
 			{#if configTaps.length > 0}
 				<section class="pkg-section">
-					<h3 class="pkg-head"><span class="swatch" style="background:var(--text-muted);"></span>Homebrew taps <span class="count">{configTaps.length}</span></h3>
+					<h3 class="pkg-head">
+						<span class="swatch" style="background:var(--text-muted);"></span>Homebrew taps
+						<span class="count">{configTaps.length}</span>
+					</h3>
 					<div class="chips">
 						{#each configTaps as p}
 							<span class="chip">{p.name}</span>
@@ -341,9 +395,15 @@
 				<section class="pkg-section">
 					<h3 class="pkg-head">Shell &amp; Git</h3>
 					<div class="kv-list">
-						{#if shell.default}<div class="kv-row"><span class="k">Shell</span><span class="v">{shell.default}</span></div>{/if}
-						{#if shell.oh_my_zsh}<div class="kv-row"><span class="k">Oh My Zsh</span><span class="v accent">installed</span></div>{/if}
-						{#if shell.theme}<div class="kv-row"><span class="k">Theme</span><span class="v">{shell.theme}</span></div>{/if}
+						{#if shell.default}<div class="kv-row">
+								<span class="k">Shell</span><span class="v">{shell.default}</span>
+							</div>{/if}
+						{#if shell.oh_my_zsh}<div class="kv-row">
+								<span class="k">Oh My Zsh</span><span class="v accent">installed</span>
+							</div>{/if}
+						{#if shell.theme}<div class="kv-row">
+								<span class="k">Theme</span><span class="v">{shell.theme}</span>
+							</div>{/if}
 						{#each Object.entries(git) as [key, value]}
 							<div class="kv-row"><span class="k">git.{key}</span><span class="v">{value}</span></div>
 						{/each}
@@ -412,7 +472,9 @@
 		font-size: 0.8rem;
 		color: var(--text-secondary);
 		cursor: pointer;
-		transition: border-color 0.15s ease, color 0.15s ease;
+		transition:
+			border-color 0.15s ease,
+			color 0.15s ease;
 	}
 
 	.share:hover {
@@ -661,7 +723,9 @@
 		font-size: 0.86rem;
 		font-weight: 500;
 		cursor: pointer;
-		transition: filter 0.15s ease, transform 0.15s ease;
+		transition:
+			filter 0.15s ease,
+			transform 0.15s ease;
 	}
 
 	.use:hover:not(:disabled) {
diff --git a/src/lib/components/ConfigEditor.svelte b/src/lib/components/ConfigEditor.svelte
index e3bb6bb..e123c93 100644
--- a/src/lib/components/ConfigEditor.svelte
+++ b/src/lib/components/ConfigEditor.svelte
@@ -5,6 +5,7 @@
 	import PackageManager from './PackageManager.svelte';
 	import MacOSPreferencesEditor from './MacOSPreferencesEditor.svelte';
 	import { PRESET_PACKAGES } from '$lib/presets';
+	import { normalizePackages, resolvePackages } from '$lib/packages';
 
 	let { slug, skipAuth = false }: { slug?: string; skipAuth?: boolean } = $props();
 	const isNew = !slug;
@@ -58,6 +59,17 @@
 		});
 	}
 
+	const selectedGroups = $derived(
+		resolvePackages(
+			normalizePackages(
+				Array.from(selectedPackages.entries()).map(([key, type]) => ({ name: key.slice(type.length + 1), type }))
+			)
+		)
+	);
+	const softwareCount = $derived(
+		selectedGroups.formulae.length + selectedGroups.casks.length + selectedGroups.npm.length
+	);
+
 	const dirty = $derived(initialSnapshot !== '' && captureSnapshot() !== initialSnapshot);
 	const canSave = $derived(isNew || dirty || rawMode);
 
@@ -143,15 +155,11 @@
 					if (data.packages?.length) {
 						const map = new Map<string, string>();
 						const descs = new Map<string, string>();
-						for (const pkg of data.packages) {
-							if (typeof pkg === 'string') {
-								map.set(pkgKey(pkg, 'formula'), 'formula');
-							} else {
-								const t = pkg.type || 'formula';
-								const k = pkgKey(pkg.name, t);
-								map.set(k, t);
-								if (pkg.desc) descs.set(k, pkg.desc);
-							}
+						for (const pkg of normalizePackages(data.packages, data.snapshot?.packages)) {
+							const t = pkg.type || 'formula';
+							const k = pkgKey(pkg.name, t);
+							map.set(k, t);
+							if (pkg.desc) descs.set(k, pkg.desc);
 						}
 						selectedPackages = map;
 						packageDescs = descs;
@@ -181,22 +189,16 @@
 					custom_script: config.custom_script || '',
 					dotfiles_repo: config.dotfiles_repo || ''
 				};
-				macosPrefs = Array.isArray(config.snapshot?.macos_prefs)
-					? mapPrefs(config.snapshot.macos_prefs)
-					: [];
+				macosPrefs = Array.isArray(config.snapshot?.macos_prefs) ? mapPrefs(config.snapshot.macos_prefs) : [];
 				const savedPkgs = config.packages || [];
-				if (savedPkgs.length > 0) {
+				if (Array.isArray(config.packages)) {
 					const newMap = new Map<string, string>();
 					const newDescs = new Map<string, string>();
-					for (const pkg of savedPkgs) {
-						if (typeof pkg === 'string') {
-							newMap.set(pkgKey(pkg, 'formula'), 'formula');
-						} else {
-							const t = pkg.type || 'formula';
-							const k = pkgKey(pkg.name, t);
-							newMap.set(k, t);
-							if (pkg.desc) newDescs.set(k, pkg.desc);
-						}
+					for (const pkg of normalizePackages(savedPkgs, config.snapshot?.packages)) {
+						const t = pkg.type || 'formula';
+						const k = pkgKey(pkg.name, t);
+						newMap.set(k, t);
+						if (pkg.desc) newDescs.set(k, pkg.desc);
 					}
 					selectedPackages = newMap;
 					packageDescs = newDescs;
@@ -242,15 +244,11 @@
 		};
 		const newMap = new Map<string, string>();
 		const newDescs = new Map<string, string>();
-		for (const pkg of parsed.packages || []) {
-			if (typeof pkg === 'string') {
-				newMap.set(pkgKey(pkg, 'formula'), 'formula');
-			} else {
-				const t = pkg.type || 'formula';
-				const k = pkgKey(pkg.name, t);
-				newMap.set(k, t);
-				if (pkg.desc) newDescs.set(k, pkg.desc);
-			}
+		for (const pkg of normalizePackages(parsed.packages || [], parsed.snapshot?.packages)) {
+			const t = pkg.type || 'formula';
+			const k = pkgKey(pkg.name, t);
+			newMap.set(k, t);
+			if (pkg.desc) newDescs.set(k, pkg.desc);
 		}
 		selectedPackages = newMap;
 		packageDescs = newDescs;
@@ -345,7 +343,16 @@
 		<!-- save bar -->
 		<div class="savebar">
 			<button class="back" onclick={() => goto('/dashboard')}>
-				<svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><path d="M19 12H5" /><path d="m12 19-7-7 7-7" /></svg>
+				<svg
+					width="15"
+					height="15"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2.5"
+					stroke-linecap="round"
+					stroke-linejoin="round"><path d="M19 12H5" /><path d="m12 19-7-7 7-7" /></svg
+				>
 				Back to dashboard
 			</button>
 			<div class="savebar-right">
@@ -358,8 +365,22 @@
 				{:else if !isNew}
 					<span class="status saved">✓ All changes saved</span>
 				{/if}
-				<button class="raw-btn" class:active={rawMode} onclick={toggleRaw} title={rawMode ? 'Back to the form' : 'Edit raw JSON'}>
-					<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="16 18 22 12 16 6" /><polyline points="8 6 2 12 8 18" /></svg>
+				<button
+					class="raw-btn"
+					class:active={rawMode}
+					onclick={toggleRaw}
+					title={rawMode ? 'Back to the form' : 'Edit raw JSON'}
+				>
+					<svg
+						width="13"
+						height="13"
+						viewBox="0 0 24 24"
+						fill="none"
+						stroke="currentColor"
+						stroke-width="2.5"
+						stroke-linecap="round"
+						stroke-linejoin="round"><polyline points="16 18 22 12 16 6" /><polyline points="8 6 2 12 8 18" /></svg
+					>
 					Raw
 				</button>
 				{#if dirty && !rawMode}
@@ -379,7 +400,8 @@
 						<span class="term-name">config.json</span>
 						<span class="term-note">editable · consumed by the CLI</span>
 					</div>
-					<textarea class="raw-textarea" bind:value={rawJson} spellcheck="false" autocomplete="off" autocapitalize="off"></textarea>
+					<textarea class="raw-textarea" bind:value={rawJson} spellcheck="false" autocomplete="off" autocapitalize="off"
+					></textarea>
 				</div>
 			</div>
 		{:else}
@@ -393,7 +415,11 @@
 						<div class="identity-foot">
 							<div class="vis-pills">
 								{#each ['public', 'unlisted', 'private'] as v (v)}
-									<button class="vis-pill" class:active={formData.visibility === v} onclick={() => (formData.visibility = v)}>{v}</button>
+									<button
+										class="vis-pill"
+										class:active={formData.visibility === v}
+										onclick={() => (formData.visibility = v)}>{v}</button
+									>
 								{/each}
 							</div>
 							<div class="alias-field">
@@ -408,7 +434,10 @@
 				<section>
 					<div class="eyebrow-row">
 						<p class="eyebrow"><span class="gt">&gt;</span> STACK</p>
-						<span class="eyebrow-count">{selectedPackages.size} packages</span>
+						<span class="eyebrow-count"
+							>{softwareCount} packages{#if selectedGroups.taps.length > 0}
+								· {selectedGroups.taps.length} taps{/if}</span
+						>
 					</div>
 					<PackageManager
 						{selectedPackages}
@@ -423,7 +452,11 @@
 					<p class="eyebrow"><span class="gt">&gt;</span> SYSTEM</p>
 					<div class="card">
 						<div class="field-label">Dotfiles repository</div>
-						<input class="text-input" bind:value={formData.dotfiles_repo} placeholder="https://github.com/you/dotfiles" />
+						<input
+							class="text-input"
+							bind:value={formData.dotfiles_repo}
+							placeholder="https://github.com/you/dotfiles"
+						/>
 						<p class="field-hint">Cloned &amp; deployed via GNU Stow after install.</p>
 						<div class="field-label field-label-spaced">macOS preferences</div>
 						<MacOSPreferencesEditor bind:macosPrefs />
@@ -437,7 +470,22 @@
 						<div class="term-head">
 							<span class="dot dot-red"></span><span class="dot dot-amber"></span><span class="dot dot-green"></span>
 							<label class="term-name" for="post-install-script">post-install.sh</label>
-							<button type="button" class="term-edit" onclick={() => scriptTextarea?.focus()}><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7"/><path d="M18.5 2.5a2.12 2.12 0 0 1 3 3L12 15l-4 1 1-4Z"/></svg>Edit script</button>
+							<button type="button" class="term-edit" onclick={() => scriptTextarea?.focus()}
+								><svg
+									width="12"
+									height="12"
+									viewBox="0 0 24 24"
+									fill="none"
+									stroke="currentColor"
+									stroke-width="2"
+									stroke-linecap="round"
+									stroke-linejoin="round"
+									aria-hidden="true"
+									><path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7" /><path
+										d="M18.5 2.5a2.12 2.12 0 0 1 3 3L12 15l-4 1 1-4Z"
+									/></svg
+								>Edit script</button
+							>
 						</div>
 						<textarea
 							id="post-install-script"
@@ -452,7 +500,9 @@
 							placeholder={scriptPlaceholder}
 						></textarea>
 					</div>
-					<p class="field-hint" id="script-hint">Edit the script above, then click Save changes. Runs after packages, shell, dotfiles, and macOS preferences.</p>
+					<p class="field-hint" id="script-hint">
+						Edit the script above, then click Save changes. Runs after packages, shell, dotfiles, and macOS preferences.
+					</p>
 				</section>
 			</div>
 		{/if}
@@ -613,7 +663,9 @@
 		font-size: 0.84rem;
 		font-weight: 500;
 		cursor: pointer;
-		transition: filter 0.15s ease, transform 0.15s ease;
+		transition:
+			filter 0.15s ease,
+			transform 0.15s ease;
 	}
 
 	.save:hover:not(:disabled) {
diff --git a/src/lib/components/PackageManager.svelte b/src/lib/components/PackageManager.svelte
index 12c8351..ccb2d0b 100644
--- a/src/lib/components/PackageManager.svelte
+++ b/src/lib/components/PackageManager.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { getHomebrewTap, isTapName, normalizePackages, resolvePackages } from '$lib/packages';
 	interface SearchResult {
 		name: string;
 		desc: string;
@@ -39,12 +40,29 @@
 	}
 
 	// Selected packages in insertion order.
-	const packageList = $derived(
-		Array.from(selectedPackages.entries()).map(([key, type]) => ({
-			name: key.slice(type.length + 1),
-			type
-		}))
+	const selectedList = $derived(
+		normalizePackages(
+			Array.from(selectedPackages.entries()).map(([key, type]) => ({
+				name: key.slice(type.length + 1),
+				type
+			}))
+		)
 	);
+	const packageList = $derived(selectedList.filter((pkg) => pkg.type !== 'tap'));
+	const taps = $derived(resolvePackages(selectedList).taps);
+	let tapName = $state('');
+	let tapError = $state('');
+
+	function addTap() {
+		const name = tapName.trim();
+		if (!isTapName(name)) {
+			tapError = 'Enter a Homebrew source as owner/repository.';
+			return;
+		}
+		if (!selectedPackages.has(pkgKey(name, 'tap'))) togglePackage(name, 'tap');
+		tapName = '';
+		tapError = '';
+	}
 
 	let searchOpen = $state(false);
 	let searchQuery = $state('');
@@ -54,7 +72,7 @@
 	let searchTimer: ReturnType<typeof setTimeout> | null = null;
 
 	function isTapPackage(q: string): boolean {
-		return /^[a-z0-9_-]+\/[a-z0-9_-]+\/[a-z0-9_-]+$/i.test(q);
+		return getHomebrewTap(q) !== null && /^[a-z0-9_.+@/-]+$/i.test(q);
 	}
 
 	async function runSearch(query: string) {
@@ -75,7 +93,10 @@
 					: [];
 			searchResults = [...brew, ...npm];
 			if (isTapPackage(query) && !searchResults.some((r) => r.name === query)) {
-				searchResults.unshift({ name: query, desc: 'Third-party tap package', type: 'tap' });
+				searchResults.unshift(
+					{ name: query, desc: 'Homebrew formula from a third-party source', type: 'formula' },
+					{ name: query, desc: 'Homebrew cask from a third-party source', type: 'cask' }
+				);
 			}
 		} catch {
 			searchResults = [];
@@ -131,13 +152,31 @@
 
 	{#if !searchOpen}
 		<button class="add-pkg" onclick={openSearch}>
-			<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--text-muted)" stroke-width="2" stroke-linecap="round"><line x1="12" y1="5" x2="12" y2="19" /><line x1="5" y1="12" x2="19" y2="12" /></svg>
+			<svg
+				width="14"
+				height="14"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="var(--text-muted)"
+				stroke-width="2"
+				stroke-linecap="round"><line x1="12" y1="5" x2="12" y2="19" /><line x1="5" y1="12" x2="19" y2="12" /></svg
+			>
 			<span>Search Homebrew &amp; npm to add a package…</span>
 		</button>
 	{:else}
 		<div class="search">
 			<div class="search-bar">
-				<svg class="search-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8" /><path d="m21 21-4.3-4.3" /></svg>
+				<svg
+					class="search-icon"
+					width="15"
+					height="15"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"><circle cx="11" cy="11" r="8" /><path d="m21 21-4.3-4.3" /></svg
+				>
 				<input
 					bind:this={searchInput}
 					class="search-input"
@@ -167,9 +206,120 @@
 			{/if}
 		</div>
 	{/if}
+	<details class="tap-sources">
+		<summary>Homebrew taps <span>{taps.length}</span></summary>
+		<p class="tap-hint">
+			Sources are added automatically for selected packages. Keep a source independently to retain it after removing its
+			packages.
+		</p>
+		{#each taps as tap (tap.name)}
+			<div class="tap-source">
+				<div>
+					<span class="tap-name">{tap.name}</span>
+					{#if tap.requiredBy.length > 0}
+						<p class="tap-hint" title={tap.requiredBy.join(', ')}>
+							Required by {tap.requiredBy.map((name) => displayName(name, 'formula')).join(', ')}
+						</p>
+					{/if}
+				</div>
+				<label class="tap-keep">
+					<input
+						type="checkbox"
+						checked={tap.explicit}
+						aria-label="Keep {tap.name} independently"
+						onchange={() => togglePackage(tap.name, 'tap')}
+					/>
+					Keep independently
+				</label>
+			</div>
+		{/each}
+		<form
+			class="tap-add"
+			onsubmit={(event) => {
+				event.preventDefault();
+				addTap();
+			}}
+		>
+			<input aria-label="Homebrew tap" placeholder="owner/repository" bind:value={tapName} />
+			<button type="submit">Add source</button>
+		</form>
+		{#if tapError}<p class="tap-error" role="alert">{tapError}</p>{/if}
+	</details>
 </div>
 
 <style>
+	.tap-sources {
+		margin-top: 22px;
+		border-top: 1px solid var(--border);
+		padding-top: 16px;
+	}
+	.tap-sources summary {
+		cursor: pointer;
+		font-size: 0.8rem;
+		color: var(--text-secondary);
+	}
+	.tap-sources summary span {
+		color: var(--text-muted);
+		margin-left: 6px;
+	}
+	.tap-hint {
+		color: var(--text-muted);
+		font-size: 0.72rem;
+		line-height: 1.6;
+		margin: 8px 0;
+	}
+	.tap-source {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+		gap: 12px;
+		padding: 10px 0;
+		border-bottom: 1px solid var(--border);
+		flex-wrap: wrap;
+	}
+	.tap-name {
+		font-size: 0.8rem;
+		overflow-wrap: anywhere;
+	}
+	.tap-keep {
+		display: flex;
+		align-items: center;
+		gap: 6px;
+		font-size: 0.7rem;
+		color: var(--text-secondary);
+	}
+	.tap-add {
+		display: flex;
+		gap: 8px;
+		margin-top: 12px;
+		flex-wrap: wrap;
+	}
+	.tap-add input {
+		flex: 1;
+		min-width: 120px;
+		padding: 8px 10px;
+		border: 1px solid var(--border);
+		border-radius: 6px;
+		background: var(--bg-primary);
+		color: var(--text-primary);
+		font: inherit;
+		font-size: 0.78rem;
+	}
+	.tap-add button {
+		padding: 8px 10px;
+		border: 1px solid var(--border);
+		border-radius: 6px;
+		background: var(--bg-secondary);
+		color: var(--text-secondary);
+		font: inherit;
+		font-size: 0.75rem;
+		cursor: pointer;
+	}
+	.tap-error {
+		color: var(--danger, #c44);
+		font-size: 0.75rem;
+	}
+
 	.card {
 		background: var(--bg-secondary);
 		border: 1px solid var(--border);
@@ -275,7 +425,9 @@
 		font-family: inherit;
 		cursor: pointer;
 		text-align: left;
-		transition: border-color 0.15s ease, background 0.15s ease;
+		transition:
+			border-color 0.15s ease,
+			background 0.15s ease;
 	}
 
 	.add-pkg:hover {
diff --git a/src/lib/packages.test.ts b/src/lib/packages.test.ts
new file mode 100644
index 0000000..2f8f6f3
--- /dev/null
+++ b/src/lib/packages.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest';
+import { getHomebrewTap, isTapName, normalizePackages, resolvePackages, type SnapshotPackages } from './packages';
+
+describe('Homebrew package sources', () => {
+	it('distinguishes repository names from qualified software names', () => {
+		expect(isTapName('oven-sh/bun')).toBe(true);
+		expect(isTapName('oven-sh/bun/bun')).toBe(false);
+		expect(isTapName('@larksuite/cli')).toBe(false);
+		expect(getHomebrewTap('oven-sh/bun/bun')).toBe('oven-sh/bun');
+		expect(getHomebrewTap('@larksuite/cli')).toBeNull();
+		expect(getHomebrewTap('git')).toBeNull();
+	});
+
+	it('repairs legacy tap packages and removes their duplicate short formulae', () => {
+		expect(
+			normalizePackages([
+				{ name: 'bun', type: 'formula' },
+				{ name: 'oven-sh/bun/bun', type: 'tap', desc: 'Runtime' },
+				{ name: 'oven-sh/bun', type: 'tap' }
+			])
+		).toEqual([
+			{ name: 'oven-sh/bun/bun', type: 'formula', desc: 'Runtime' },
+			{ name: 'oven-sh/bun', type: 'tap' }
+		]);
+	});
+
+	it('uses snapshot cask hints for legacy names without overriding explicit choices', () => {
+		expect(
+			normalizePackages(
+				[
+					'example/apps/editor',
+					{ name: 'example/apps/viewer', type: 'tap' },
+					{ name: 'example/apps/cli', type: 'formula' }
+				],
+				{ casks: ['editor', 'viewer', 'cli'] }
+			).map((pkg) => pkg.type)
+		).toEqual(['cask', 'cask', 'formula']);
+	});
+
+	it('ignores malformed historical snapshot hints', () => {
+		const snapshot = JSON.parse('{"casks":{},"taps":"invalid"}') as SnapshotPackages;
+		expect(normalizePackages(['git'], snapshot)).toEqual([{ name: 'git', type: 'formula' }]);
+	});
+
+	it('recovers snapshot-only taps for legacy string lists', () => {
+		expect(normalizePackages(['git'], { taps: ['example/tools'] })).toEqual([
+			{ name: 'git', type: 'formula' },
+			{ name: 'example/tools', type: 'tap' }
+		]);
+	});
+
+	it.each([[], [{ name: 'git', type: 'formula' }]].map((packages) => ({ packages })))(
+		'does not restore removed sources from a snapshot: $packages',
+		({ packages }) => {
+			expect(resolvePackages(normalizePackages(packages, { taps: ['old/tools'] })).taps).toEqual([]);
+		}
+	);
+
+	it('deduplicates sources shared by formulae, casks and explicit entries', () => {
+		const groups = resolvePackages(
+			normalizePackages([
+				{ name: 'example/tools/cli', type: 'formula' },
+				{ name: 'example/tools/app', type: 'cask' },
+				{ name: 'example/tools', type: 'tap' },
+				{ name: '@example/cli', type: 'npm' }
+			])
+		);
+		expect(groups.formulae.map((pkg) => pkg.name)).toEqual(['example/tools/cli']);
+		expect(groups.casks.map((pkg) => pkg.name)).toEqual(['example/tools/app']);
+		expect(groups.npm.map((pkg) => pkg.name)).toEqual(['@example/cli']);
+		expect(groups.taps).toEqual([
+			{
+				name: 'example/tools',
+				explicit: true,
+				requiredBy: ['example/tools/cli', 'example/tools/app']
+			}
+		]);
+	});
+
+	it('drops inferred sources with the last dependent package but retains manual sources', () => {
+		const software = normalizePackages([{ name: 'example/tools/cli', type: 'formula' }]);
+		expect(resolvePackages(software).taps[0].explicit).toBe(false);
+		expect(resolvePackages(software.filter((pkg) => pkg.name !== 'example/tools/cli')).taps).toEqual([]);
+		expect(resolvePackages(normalizePackages([{ name: 'example/tools', type: 'tap' }])).taps).toEqual([
+			{ name: 'example/tools', explicit: true, requiredBy: [] }
+		]);
+	});
+});
diff --git a/src/lib/packages.ts b/src/lib/packages.ts
new file mode 100644
index 0000000..c2ec52c
--- /dev/null
+++ b/src/lib/packages.ts
@@ -0,0 +1,88 @@
+export type PackageType = 'formula' | 'cask' | 'npm' | 'tap';
+
+export interface ConfigPackage {
+	name: string;
+	type: PackageType;
+	desc?: string;
+}
+
+export type PackageInput = string | { name: string; type?: string; desc?: string };
+
+export interface SnapshotPackages {
+	casks?: string[];
+	taps?: string[];
+}
+
+export interface TapSource {
+	name: string;
+	explicit: boolean;
+	requiredBy: string[];
+}
+
+export function isTapName(name: string): boolean {
+	return /^[a-z0-9_-]+\/[a-z0-9_.-]+$/i.test(name);
+}
+
+export function getHomebrewTap(name: string): string | null {
+	const parts = name.split('/');
+	return parts.length === 3 && isTapName(parts.slice(0, 2).join('/')) && parts[2] ? parts.slice(0, 2).join('/') : null;
+}
+
+/** Repair legacy tap packages without changing explicit formula/cask choices. */
+export function normalizePackages(packages: readonly PackageInput[], snapshot?: SnapshotPackages): ConfigPackage[] {
+	const casks = new Set(
+		Array.isArray(snapshot?.casks) ? snapshot.casks.filter((name) => typeof name === 'string') : []
+	);
+	const inputs: PackageInput[] = [...packages];
+	// Only legacy string lists need snapshot sources. Typed lists are authoritative,
+	// so removing a source in the editor cannot resurrect it from an old snapshot.
+	if (packages.some((pkg) => typeof pkg === 'string') && Array.isArray(snapshot?.taps)) {
+		for (const name of snapshot.taps) {
+			if (typeof name === 'string') inputs.push({ name, type: 'tap' });
+		}
+	}
+	const legacyFormulaNames = new Set(
+		inputs.flatMap((pkg) =>
+			typeof pkg !== 'string' && pkg.type === 'tap' && getHomebrewTap(pkg.name) ? [pkg.name.split('/')[2]] : []
+		)
+	);
+	const normalized = new Map<string, ConfigPackage>();
+	for (const input of inputs) {
+		const pkg = typeof input === 'string' ? { name: input } : input;
+		let type: PackageType;
+		if (pkg.type === 'npm' || pkg.type === 'cask' || pkg.type === 'formula') {
+			type = pkg.type;
+		} else if (isTapName(pkg.name)) {
+			type = 'tap';
+		} else {
+			type = casks.has(pkg.name) || casks.has(pkg.name.split('/').pop() || '') ? 'cask' : 'formula';
+		}
+		if (type === 'formula' && legacyFormulaNames.has(pkg.name)) continue;
+		const key = `${type}:${pkg.name}`;
+		const previous = normalized.get(key);
+		normalized.set(key, {
+			name: pkg.name,
+			type,
+			...(previous?.desc || pkg.desc ? { desc: pkg.desc || previous?.desc } : {})
+		});
+	}
+	return [...normalized.values()];
+}
+
+/** Combine manually retained sources with dependencies of selected Homebrew packages. */
+export function resolvePackages(packages: readonly ConfigPackage[]) {
+	const formulae = packages.filter((pkg) => pkg.type === 'formula');
+	const casks = packages.filter((pkg) => pkg.type === 'cask');
+	const npm = packages.filter((pkg) => pkg.type === 'npm');
+	const sources = new Map<string, TapSource>();
+	for (const pkg of packages) {
+		const name =
+			pkg.type === 'tap' ? pkg.name : pkg.type === 'formula' || pkg.type === 'cask' ? getHomebrewTap(pkg.name) : null;
+		if (!name) continue;
+		const source = sources.get(name) || { name, explicit: false, requiredBy: [] };
+		if (pkg.type === 'tap') source.explicit = true;
+		else if (!source.requiredBy.includes(pkg.name)) source.requiredBy.push(pkg.name);
+		sources.set(name, source);
+	}
+	return { formulae, casks, npm, taps: [...sources.values()] };
+}
diff --git a/src/routes/[username]/[slug]/config/+server.ts b/src/routes/[username]/[slug]/config/+server.ts
index 63b5cc2..56e4048 100644
--- a/src/routes/[username]/[slug]/config/+server.ts
+++ b/src/routes/[username]/[slug]/config/+server.ts
@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import { normalizePackages, resolvePackages, type PackageInput, type SnapshotPackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getPackageDescription } from '$lib/package-metadata';
 import { getUserIdAndName, getConfigCLIData, getValidToken } from '$lib/server/db';
@@ -33,41 +34,37 @@ export const GET: RequestHandler = async ({ platform, params, request }) => {
 		}
 	}
 
-	const tapsSet = new Set<string>();
-	const snapshotCasks = new Set<string>();
+	let snapshotPackages: SnapshotPackages | undefined;
 	type MacOSPrefOut = { domain: string; key: string; type: string; value: string; desc: string; host?: string };
 	let macosPrefs: MacOSPrefOut[] | null = null;
 
 	if (config.snapshot) {
 		try {
 			const snapshot = JSON.parse(config.snapshot);
-			for (const tap of snapshot.packages?.taps || []) {
-				tapsSet.add(tap);
-			}
-			for (const cask of snapshot.packages?.casks || []) {
-				snapshotCasks.add(cask);
-			}
+			snapshotPackages = snapshot.packages;
 			if (Array.isArray(snapshot.macos_prefs) && snapshot.macos_prefs.length > 0) {
-				const filtered = snapshot.macos_prefs.filter(
-					(p: unknown): p is Record<string, unknown> =>
-						typeof p === 'object' &&
-						p !== null &&
-						typeof (p as Record<string, unknown>).domain === 'string' &&
-						typeof (p as Record<string, unknown>).key === 'string' &&
-						typeof (p as Record<string, unknown>).value === 'string'
-				).map((p: Record<string, unknown>) => {
-					const out: MacOSPrefOut = {
-						domain: p.domain as string,
-						key: p.key as string,
-						type: typeof p.type === 'string' ? p.type : '',
-						value: p.value as string,
-						desc: typeof p.desc === 'string' ? p.desc : ''
-					};
-					// `host` selects the ByHost scope (defaults -currentHost). Mirrors Go `omitempty`:
-					// only emit when non-empty so payloads stay clean for the common main-domain case.
-					if (typeof p.host === 'string' && p.host !== '') out.host = p.host;
-					return out;
-				});
+				const filtered = snapshot.macos_prefs
+					.filter(
+						(p: unknown): p is Record<string, unknown> =>
+							typeof p === 'object' &&
+							p !== null &&
+							typeof (p as Record<string, unknown>).domain === 'string' &&
+							typeof (p as Record<string, unknown>).key === 'string' &&
+							typeof (p as Record<string, unknown>).value === 'string'
+					)
+					.map((p: Record<string, unknown>) => {
+						const out: MacOSPrefOut = {
+							domain: p.domain as string,
+							key: p.key as string,
+							type: typeof p.type === 'string' ? p.type : '',
+							value: p.value as string,
+							desc: typeof p.desc === 'string' ? p.desc : ''
+						};
+						// `host` selects the ByHost scope (defaults -currentHost). Mirrors Go `omitempty`:
+						// only emit when non-empty so payloads stay clean for the common main-domain case.
+						if (typeof p.host === 'string' && p.host !== '') out.host = p.host;
+						return out;
+					});
 				if (filtered.length > 0) macosPrefs = filtered;
 			}
 		} catch (err) {
@@ -75,40 +72,16 @@ export const GET: RequestHandler = async ({ platform, params, request }) => {
 		}
 	}
 
-	const rawPackages: any[] = JSON.parse(config.packages || '[]');
-	const formulae: { name: string; desc: string }[] = [];
-	const casks: { name: string; desc: string }[] = [];
-	const npms: { name: string; desc: string }[] = [];
-
-	for (const pkg of rawPackages) {
-		const name = typeof pkg === 'string' ? pkg : pkg.name;
-		const desc = (typeof pkg === 'object' && pkg.desc) || getPackageDescription(name);
-
-		if (typeof pkg === 'string') {
-			if (snapshotCasks.has(pkg)) {
-				casks.push({ name, desc });
-			} else {
-				formulae.push({ name, desc });
-			}
-		} else {
-			if (pkg.type === 'npm') {
-				npms.push({ name, desc });
-			} else if (pkg.type === 'cask') {
-				casks.push({ name, desc });
-			} else {
-				formulae.push({ name, desc });
-			}
-		}
-	}
-
-	for (const pkg of formulae) {
-		const parts = pkg.name.split('/');
-		if (parts.length === 3) {
-			tapsSet.add(`${parts[0]}/${parts[1]}`);
-		}
-	}
-
-	const taps = Array.from(tapsSet);
+	const rawPackages: PackageInput[] = JSON.parse(config.packages || '[]');
+	const groups = resolvePackages(normalizePackages(rawPackages, snapshotPackages));
+	const withDescription = (pkg: { name: string; desc?: string }) => ({
+		name: pkg.name,
+		desc: pkg.desc || getPackageDescription(pkg.name)
+	});
+	const formulae = groups.formulae.map(withDescription);
+	const casks = groups.casks.map(withDescription);
+	const npms = groups.npm.map(withDescription);
+	const taps = groups.taps.map((tap) => tap.name);
 
 	return json({
 		username: user.username,
@@ -121,7 +94,10 @@ export const GET: RequestHandler = async ({ platform, params, request }) => {
 		npm: npms,
 		dotfiles_repo: config.dotfiles_repo || '',
 		post_install: config.custom_script
-			? config.custom_script.split('\n').map((s: string) => s.trim()).filter((s: string) => s.length > 0)
+			? config.custom_script
+					.split('\n')
+					.map((s: string) => s.trim())
+					.filter((s: string) => s.length > 0)
 			: [],
 		macos_prefs: macosPrefs
 	});
diff --git a/src/routes/[username]/[slug]/config/server.test.ts b/src/routes/[username]/[slug]/config/server.test.ts
index b29690a..e34d9b5 100644
--- a/src/routes/[username]/[slug]/config/server.test.ts
+++ b/src/routes/[username]/[slug]/config/server.test.ts
@@ -6,6 +6,7 @@
 import { describe, it, expect, beforeEach } from 'vitest';
 import { env } from 'cloudflare:test';
 import { GET } from './+server';
+import { GET as GET_ALIAS } from '../../../api/configs/alias/[alias]/+server';
 import { resetDb, seed, strip } from '$lib/test/seed';
 import { call } from '$lib/test/call';
 import { mockUser, mockPublicConfig, mockPrivateConfig, mockApiToken, mockExpiredApiToken } from '$lib/test/fixtures';
@@ -157,9 +158,10 @@ describe('data parsing', () => {
 		expect(json.npm).toContainEqual(expect.objectContaining({ name: 'typescript' }));
 	});
 
-	it('parses snapshot for taps and casks', async () => {
+	it('parses snapshot taps for legacy string packages', async () => {
 		await seedPublic({
 			...mockPublicConfig,
+			packages: JSON.stringify(['git']),
 			snapshot: JSON.stringify({
 				packages: { taps: ['homebrew/cask-fonts'], casks: ['font-fira-code'] }
 			})
@@ -324,9 +326,11 @@ describe('data parsing', () => {
 			packages: { name: string; desc?: string }[];
 			casks: { name: string; desc: string }[];
 			npm: { name: string; desc: string }[];
+			taps: string[];
 		};
 		expect(json.packages).toContainEqual({ name: 'git', desc: 'Version control' });
-		expect(json.packages).toContainEqual(expect.objectContaining({ name: 'homebrew/cask-fonts' }));
+		expect(json.packages.map((pkg) => pkg.name)).not.toContain('homebrew/cask-fonts');
+		expect(json.taps).toContain('homebrew/cask-fonts');
 		expect(json.casks).toContainEqual({ name: 'docker', desc: 'Containers' });
 		expect(json.npm).toContainEqual({ name: 'typescript', desc: 'Typed JS' });
 	});
@@ -424,3 +428,53 @@ describe('error handling', () => {
 		expect(json.error).toContain('Config not found');
 	});
 });
+
+describe.each([
+	['config', GET, { username: 'testuser', slug: 'public-config' }],
+	['alias', GET_ALIAS, { alias: 'publiccfg' }]
+] as const)('%s source export', (_name, handler, params) => {
+	const exportConfig = async (packages: unknown[], snapshotTaps: string[] = []) => {
+		await seedPublic({
+			...mockPublicConfig,
+			packages: JSON.stringify(packages),
+			snapshot: JSON.stringify({ packages: { taps: snapshotTaps } })
+		});
+		const response = await call(handler, opts({ params }));
+		expect(response.status).toBe(200);
+		return (await response.json()) as {
+			packages: (string | { name: string })[];
+			casks: (string | { name: string })[];
+			npm: (string | { name: string })[];
+			taps: string[];
+		};
+	};
+	const names = (packages: (string | { name: string })[]) =>
+		packages.map((pkg) => (typeof pkg === 'string' ? pkg : pkg.name));
+
+	it('exports sources separately and derives them from both formulae and casks', async () => {
+		const data = await exportConfig([
+			{ name: 'oven-sh/bun/bun', type: 'tap' },
+			{ name: 'oven-sh/bun', type: 'tap' },
+			{ name: 'example/apps/editor', type: 'cask' },
+			{ name: '@larksuite/cli', type: 'npm' }
+		]);
+		expect(names(data.packages)).toEqual(['oven-sh/bun/bun']);
+		expect(names(data.casks)).toEqual(['example/apps/editor']);
+		expect(names(data.npm)).toEqual(['@larksuite/cli']);
+		expect(data.taps).toEqual(['oven-sh/bun', 'example/apps']);
+	});
+
+	it('retains a manually selected tap without software', async () => {
+		const data = await exportConfig([{ name: 'example/tools', type: 'tap' }]);
+		expect(data.packages).toEqual([]);
+		expect(data.taps).toEqual(['example/tools']);
+	});
+
+	it.each([[], [{ name: 'git', type: 'formula' }]].map((packages) => ({ packages })))(
+		'does not resurrect removed snapshot taps: $packages',
+		async ({ packages }) => {
+			const data = await exportConfig(packages, ['old/tools']);
+			expect(data.taps).toEqual([]);
+		}
+	);
+});
diff --git a/src/routes/api/configs/+server.ts b/src/routes/api/configs/+server.ts
index 1e2d05b..74ef98b 100644
--- a/src/routes/api/configs/+server.ts
+++ b/src/routes/api/configs/+server.ts
@@ -1,7 +1,14 @@
 import { json } from '@sveltejs/kit';
+import { normalizePackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getCurrentUser, slugify, generateId } from '$lib/server/auth';
-import { validateCustomScript, validateDotfilesRepo, validatePackages, validateMacOSPrefs, RESERVED_ALIASES } from '$lib/server/validation';
+import {
+	validateCustomScript,
+	validateDotfilesRepo,
+	validatePackages,
+	validateMacOSPrefs,
+	RESERVED_ALIASES
+} from '$lib/server/validation';
 import { checkRateLimit, getRateLimitKey, RATE_LIMITS } from '$lib/server/rate-limit';
 import { getUserConfigs, getConfigId, aliasExists, countUserConfigs, createConfig } from '$lib/server/db';
 
@@ -15,7 +22,10 @@ export const GET: RequestHandler = async ({ platform, cookies, request }) => {
 	const rlKey = getRateLimitKey('config-read', user.id);
 	const rl = checkRateLimit(rlKey, RATE_LIMITS.CONFIG_READ);
 	if (!rl.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } }
+		);
 	}
 
 	const results = await getUserConfigs(env.DB, user.id);
@@ -61,7 +71,19 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 		return json({ error: 'Invalid request body' }, { status: 400 });
 	}
 
-	const { name, description, base_preset, packages, custom_script, visibility, alias, dotfiles_repo, snapshot, snapshot_at, forked_from } = body;
+	const {
+		name,
+		description,
+		base_preset,
+		packages,
+		custom_script,
+		visibility,
+		alias,
+		dotfiles_repo,
+		snapshot,
+		snapshot_at,
+		forked_from
+	} = body;
 
 	if (visibility !== undefined && !['public', 'unlisted', 'private'].includes(visibility)) {
 		return json({ error: 'Invalid visibility. Must be public, unlisted, or private' }, { status: 400 });
@@ -70,7 +92,10 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	const rlKeyW = getRateLimitKey('config-write', user.id);
 	const rlW = checkRateLimit(rlKeyW, RATE_LIMITS.CONFIG_WRITE);
 	if (!rlW.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rlW.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rlW.retryAfter! / 1000)) } }
+		);
 	}
 
 	const pv = validatePackages(packages);
@@ -90,8 +115,10 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	}
 
 	if (!name) return json({ error: 'Name is required' }, { status: 400 });
-	if (typeof name !== 'string' || name.length > 100) return json({ error: 'Name must be a string of 100 characters or less' }, { status: 400 });
-	if (description !== undefined && description !== '' && (typeof description !== 'string' || description.length > 500)) return json({ error: 'Description must be a string of 500 characters or less' }, { status: 400 });
+	if (typeof name !== 'string' || name.length > 100)
+		return json({ error: 'Name must be a string of 100 characters or less' }, { status: 400 });
+	if (description !== undefined && description !== '' && (typeof description !== 'string' || description.length > 500))
+		return json({ error: 'Description must be a string of 500 characters or less' }, { status: 400 });
 
 	const slug = slugify(name);
 	if (!slug) return json({ error: 'Invalid name' }, { status: 400 });
@@ -128,7 +155,7 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 			name,
 			description: description || '',
 			base_preset: base_preset || 'developer',
-			packages: JSON.stringify(packages || []),
+			packages: JSON.stringify(normalizePackages(packages || [], snapshot?.packages)),
 			custom_script: custom_script || '',
 			visibility: visibility || 'unlisted',
 			alias: cleanAlias,
diff --git a/src/routes/api/configs/[slug]/+server.ts b/src/routes/api/configs/[slug]/+server.ts
index fe5cb17..ce10e5e 100644
--- a/src/routes/api/configs/[slug]/+server.ts
+++ b/src/routes/api/configs/[slug]/+server.ts
@@ -1,9 +1,23 @@
 import { json } from '@sveltejs/kit';
+import { normalizePackages, type PackageInput, type SnapshotPackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getCurrentUser, slugify } from '$lib/server/auth';
-import { validateCustomScript, validateDotfilesRepo, validatePackages, validateMacOSPrefs, RESERVED_ALIASES } from '$lib/server/validation';
+import {
+	validateCustomScript,
+	validateDotfilesRepo,
+	validatePackages,
+	validateMacOSPrefs,
+	RESERVED_ALIASES
+} from '$lib/server/validation';
 import { checkRateLimit, getRateLimitKey, RATE_LIMITS } from '$lib/server/rate-limit';
-import { getConfig, getConfigIdAndAlias, slugConflict, aliasExistsExcluding, updateConfig, deleteConfig } from '$lib/server/db';
+import {
+	getConfig,
+	getConfigIdAndAlias,
+	slugConflict,
+	aliasExistsExcluding,
+	updateConfig,
+	deleteConfig
+} from '$lib/server/db';
 
 export const GET: RequestHandler = async ({ platform, cookies, params, request }) => {
 	const env = platform?.env;
@@ -15,7 +29,10 @@ export const GET: RequestHandler = async ({ platform, cookies, params, request }
 	const rlKey = getRateLimitKey('config-read', user.id);
 	const rl = checkRateLimit(rlKey, RATE_LIMITS.CONFIG_READ);
 	if (!rl.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } }
+		);
 	}
 
 	const config = await getConfig(env.DB, user.id, params.slug);
@@ -23,8 +40,7 @@ export const GET: RequestHandler = async ({ platform, cookies, params, request }
 
 	const installUrl = config.alias ? `${env.APP_URL}/${config.alias}` : `${env.APP_URL}/${user.username}/${params.slug}`;
 
-	const rawPkgs = JSON.parse((config.packages as string) || '[]');
-	const needsTypeInference = rawPkgs.length > 0 && typeof rawPkgs[0] === 'string';
+	const rawPkgs: PackageInput[] = JSON.parse((config.packages as string) || '[]');
 
 	// Parse snapshot once and reuse for cask inference and macos_prefs extraction.
 	let parsedSnapshot: Record<string, unknown> | null = null;
@@ -36,23 +52,7 @@ export const GET: RequestHandler = async ({ platform, cookies, params, request }
 		}
 	}
 
-	let caskSet = new Set<string>();
-	if (needsTypeInference && parsedSnapshot) {
-		const casks: string[] = (parsedSnapshot as any).packages?.casks || [];
-		for (const c of casks) {
-			caskSet.add(c);
-		}
-	}
-
-	const packages = rawPkgs.map((p: any) => {
-		if (typeof p === 'string') {
-			const parts = p.split('/');
-			if (parts.length === 3) return { name: p, type: 'tap' };
-			if (caskSet.has(p)) return { name: p, type: 'cask' };
-			return { name: p, type: 'formula' };
-		}
-		return p;
-	});
+	const packages = normalizePackages(rawPkgs, parsedSnapshot?.packages as SnapshotPackages | undefined);
 
 	type MacOSPrefOut = { domain: string; key: string; type?: string; value: string; desc?: string; host?: string };
 	let macosPrefs: MacOSPrefOut[] | null = null;
@@ -110,7 +110,18 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 		return json({ error: 'Invalid request body' }, { status: 400 });
 	}
 
-	const { name, description, base_preset, packages, custom_script, visibility, alias, dotfiles_repo, snapshot, snapshot_at } = body;
+	const {
+		name,
+		description,
+		base_preset,
+		packages,
+		custom_script,
+		visibility,
+		alias,
+		dotfiles_repo,
+		snapshot,
+		snapshot_at
+	} = body;
 
 	if (visibility !== undefined && !['public', 'unlisted', 'private'].includes(visibility)) {
 		return json({ error: 'Invalid visibility. Must be public, unlisted, or private' }, { status: 400 });
@@ -119,7 +130,10 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 	const rlKeyW = getRateLimitKey('config-write', user.id);
 	const rlW = checkRateLimit(rlKeyW, RATE_LIMITS.CONFIG_WRITE);
 	if (!rlW.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rlW.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rlW.retryAfter! / 1000)) } }
+		);
 	}
 
 	if (packages !== undefined) {
@@ -177,7 +191,7 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 			name: name || null,
 			description: description !== undefined ? description : null,
 			base_preset: base_preset || null,
-			packages: packages ? JSON.stringify(packages) : null,
+			packages: packages ? JSON.stringify(normalizePackages(packages, snapshot?.packages)) : null,
 			custom_script: custom_script !== undefined ? custom_script : null,
 			visibility: visibility !== undefined ? visibility : null,
 			alias: newAlias,
@@ -207,7 +221,10 @@ export const DELETE: RequestHandler = async ({ platform, cookies, params, reques
 	const rlKeyD = getRateLimitKey('config-write', user.id);
 	const rlD = checkRateLimit(rlKeyD, RATE_LIMITS.CONFIG_WRITE);
 	if (!rlD.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rlD.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rlD.retryAfter! / 1000)) } }
+		);
 	}
 
 	await deleteConfig(env.DB, user.id, params.slug);
diff --git a/src/routes/api/configs/[slug]/server.test.ts b/src/routes/api/configs/[slug]/server.test.ts
index 885a4b5..962a521 100644
--- a/src/routes/api/configs/[slug]/server.test.ts
+++ b/src/routes/api/configs/[slug]/server.test.ts
@@ -107,6 +107,35 @@ describe('GET /api/configs/[slug]', () => {
 	});
 });
 
+describe('legacy package type repair', () => {
+	it('returns qualified packages as software and repositories as taps', async () => {
+		await seed(db, {
+			users: [userRow()],
+			api_tokens: [mockApiToken],
+			configs: [
+				{
+					...mockConfig,
+					packages: JSON.stringify([
+						'git',
+						'oven-sh/bun',
+						{ name: 'oven-sh/bun/bun', type: 'tap' },
+						{ name: 'example/apps/editor', type: 'cask' }
+					])
+				}
+			]
+		});
+		const response = await call(GET, callOpts({ token: mockApiToken.token }));
+		expect(response.status).toBe(200);
+		const data = (await response.json()) as { config: { packages: { name: string; type: string }[] } };
+		expect(data.config.packages).toEqual([
+			{ name: 'git', type: 'formula' },
+			{ name: 'oven-sh/bun', type: 'tap' },
+			{ name: 'oven-sh/bun/bun', type: 'formula' },
+			{ name: 'example/apps/editor', type: 'cask' }
+		]);
+	});
+});
+
 describe('PUT /api/configs/[slug]', () => {
 	const authedPut = (body: unknown, overrides: Record<string, unknown> = {}) =>
 		call(PUT, callOpts({ method: 'PUT', token: mockApiToken.token, body, ...overrides }));
@@ -370,3 +399,26 @@ describe('DELETE /api/configs/[slug]', () => {
 		expect(survivor).not.toBeNull();
 	});
 });
+
+describe('package source save round-trip', () => {
+	it('repairs legacy writes and persists source removal over stale snapshot data', async () => {
+		await seed(db, { users: [userRow()], configs: [mockConfig], api_tokens: [mockApiToken] });
+		const saved = await call(
+			PUT,
+			callOpts({
+				method: 'PUT',
+				token: mockApiToken.token,
+				body: { packages: [{ name: 'oven-sh/bun/bun', type: 'tap' }], snapshot: { packages: { taps: ['old/tools'] } } }
+			})
+		);
+		expect(saved.status).toBe(200);
+		const read = await call(GET, callOpts({ token: mockApiToken.token }));
+		const data = (await read.json()) as { config: { packages: { name: string; type: string }[] } };
+		expect(data.config.packages).toEqual([{ name: 'oven-sh/bun/bun', type: 'formula' }]);
+		const cleared = await call(PUT, callOpts({ method: 'PUT', token: mockApiToken.token, body: { packages: [] } }));
+		expect(cleared.status).toBe(200);
+		const reloaded = await call(GET, callOpts({ token: mockApiToken.token }));
+		const empty = (await reloaded.json()) as { config: { packages: unknown[] } };
+		expect(empty.config.packages).toEqual([]);
+	});
+});
diff --git a/src/routes/api/configs/alias/[alias]/+server.ts b/src/routes/api/configs/alias/[alias]/+server.ts
index acd1205..0993431 100644
--- a/src/routes/api/configs/alias/[alias]/+server.ts
+++ b/src/routes/api/configs/alias/[alias]/+server.ts
@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import { normalizePackages, resolvePackages, type PackageInput, type SnapshotPackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getConfigByAliasForAPI } from '$lib/server/db';
 
@@ -18,41 +19,37 @@ export const GET: RequestHandler = async ({ platform, params }) => {
 		return json({ error: 'Config is private' }, { status: 403 });
 	}
 
-	const tapsSet = new Set<string>();
-	const snapshotCasks = new Set<string>();
+	let snapshotPackages: SnapshotPackages | undefined;
 	type MacOSPrefOut = { domain: string; key: string; type: string; value: string; desc: string; host?: string };
 	let macosPrefs: MacOSPrefOut[] | null = null;
 
 	if (config.snapshot) {
 		try {
 			const snapshot = JSON.parse(config.snapshot);
-			for (const tap of snapshot.packages?.taps || []) {
-				tapsSet.add(tap);
-			}
-			for (const cask of snapshot.packages?.casks || []) {
-				snapshotCasks.add(cask);
-			}
+			snapshotPackages = snapshot.packages;
 			if (Array.isArray(snapshot.macos_prefs) && snapshot.macos_prefs.length > 0) {
-				const filtered = snapshot.macos_prefs.filter(
-					(p: unknown): p is Record<string, unknown> =>
-						typeof p === 'object' &&
-						p !== null &&
-						typeof (p as Record<string, unknown>).domain === 'string' &&
-						typeof (p as Record<string, unknown>).key === 'string' &&
-						typeof (p as Record<string, unknown>).value === 'string'
-				).map((p: Record<string, unknown>) => {
-					const out: MacOSPrefOut = {
-						domain: p.domain as string,
-						key: p.key as string,
-						type: typeof p.type === 'string' ? p.type : '',
-						value: p.value as string,
-						desc: typeof p.desc === 'string' ? p.desc : ''
-					};
-					// `host` selects the ByHost scope (defaults -currentHost). Mirrors Go `omitempty`:
-					// only emit when non-empty so payloads stay clean for the common main-domain case.
-					if (typeof p.host === 'string' && p.host !== '') out.host = p.host;
-					return out;
-				});
+				const filtered = snapshot.macos_prefs
+					.filter(
+						(p: unknown): p is Record<string, unknown> =>
+							typeof p === 'object' &&
+							p !== null &&
+							typeof (p as Record<string, unknown>).domain === 'string' &&
+							typeof (p as Record<string, unknown>).key === 'string' &&
+							typeof (p as Record<string, unknown>).value === 'string'
+					)
+					.map((p: Record<string, unknown>) => {
+						const out: MacOSPrefOut = {
+							domain: p.domain as string,
+							key: p.key as string,
+							type: typeof p.type === 'string' ? p.type : '',
+							value: p.value as string,
+							desc: typeof p.desc === 'string' ? p.desc : ''
+						};
+						// `host` selects the ByHost scope (defaults -currentHost). Mirrors Go `omitempty`:
+						// only emit when non-empty so payloads stay clean for the common main-domain case.
+						if (typeof p.host === 'string' && p.host !== '') out.host = p.host;
+						return out;
+					});
 				if (filtered.length > 0) macosPrefs = filtered;
 			}
 		} catch (err) {
@@ -60,37 +57,12 @@ export const GET: RequestHandler = async ({ platform, params }) => {
 		}
 	}
 
-	const rawPackages: any[] = JSON.parse(config.packages || '[]');
-	const packageNames: string[] = [];
-	const caskNames: string[] = [];
-	const npmNames: string[] = [];
-
-	for (const pkg of rawPackages) {
-		if (typeof pkg === 'string') {
-			if (snapshotCasks.has(pkg)) {
-				caskNames.push(pkg);
-			} else {
-				packageNames.push(pkg);
-			}
-		} else {
-			if (pkg.type === 'npm') {
-				npmNames.push(pkg.name);
-			} else if (pkg.type === 'cask') {
-				caskNames.push(pkg.name);
-			} else {
-				packageNames.push(pkg.name);
-			}
-		}
-	}
-
-	for (const pkg of packageNames) {
-		const parts = pkg.split('/');
-		if (parts.length === 3) {
-			tapsSet.add(`${parts[0]}/${parts[1]}`);
-		}
-	}
-
-	const taps = Array.from(tapsSet);
+	const rawPackages: PackageInput[] = JSON.parse(config.packages || '[]');
+	const groups = resolvePackages(normalizePackages(rawPackages, snapshotPackages));
+	const packageNames = groups.formulae.map((pkg) => pkg.name);
+	const caskNames = groups.casks.map((pkg) => pkg.name);
+	const npmNames = groups.npm.map((pkg) => pkg.name);
+	const taps = groups.taps.map((tap) => tap.name);
 
 	return json({
 		username: config.username,
@@ -103,7 +75,10 @@ export const GET: RequestHandler = async ({ platform, params }) => {
 		npm: npmNames,
 		dotfiles_repo: config.dotfiles_repo || '',
 		post_install: config.custom_script
-			? config.custom_script.split('\n').map((s: string) => s.trim()).filter((s: string) => s.length > 0)
+			? config.custom_script
+					.split('\n')
+					.map((s: string) => s.trim())
+					.filter((s: string) => s.length > 0)
 			: [],
 		macos_prefs: macosPrefs
 	});
diff --git a/src/routes/api/configs/from-snapshot/+server.ts b/src/routes/api/configs/from-snapshot/+server.ts
index 879a9cc..510d86a 100644
--- a/src/routes/api/configs/from-snapshot/+server.ts
+++ b/src/routes/api/configs/from-snapshot/+server.ts
@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import { normalizePackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getCurrentUser, slugify, generateId } from '$lib/server/auth';
 import { validatePackages } from '$lib/server/validation';
@@ -21,7 +22,10 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 
 	const rl = checkRateLimit(getRateLimitKey('config-write', user.id), RATE_LIMITS.CONFIG_WRITE);
 	if (!rl.allowed) {
-		return json({ error: 'Rate limit exceeded' }, { status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } });
+		return json(
+			{ error: 'Rate limit exceeded' },
+			{ status: 429, headers: { 'Retry-After': String(Math.ceil(rl.retryAfter! / 1000)) } }
+		);
 	}
 
 	const contentLength = parseInt(request.headers.get('content-length') ?? '0', 10);
@@ -39,8 +43,10 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	const { name, description, snapshot, config_slug, visibility, message } = body;
 
 	if (!name) return json({ error: 'Name is required' }, { status: 400 });
-	if (typeof name !== 'string' || name.length > 100) return json({ error: 'Name must be a string of 100 characters or less' }, { status: 400 });
-	if (description !== undefined && description !== '' && (typeof description !== 'string' || description.length > 500)) return json({ error: 'Description must be a string of 500 characters or less' }, { status: 400 });
+	if (typeof name !== 'string' || name.length > 100)
+		return json({ error: 'Name must be a string of 100 characters or less' }, { status: 400 });
+	if (description !== undefined && description !== '' && (typeof description !== 'string' || description.length > 500))
+		return json({ error: 'Description must be a string of 500 characters or less' }, { status: 400 });
 	if (!snapshot) return json({ error: 'Snapshot is required' }, { status: 400 });
 
 	const validVisibilities = ['public', 'unlisted', 'private'];
@@ -57,7 +63,10 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	// Validate snapshot.packages is the canonical structured format:
 	// { formulae: string[], casks: string[], taps: string[], npm: string[], bun?: string[] }
 	if (!snapshot.packages || typeof snapshot.packages !== 'object' || Array.isArray(snapshot.packages)) {
-		return json({ error: 'snapshot.packages must be an object with formulae, casks, taps, npm arrays' }, { status: 400 });
+		return json(
+			{ error: 'snapshot.packages must be an object with formulae, casks, taps, npm arrays' },
+			{ status: 400 }
+		);
 	}
 
 	// Build typed package objects from the full snapshot.
@@ -69,19 +78,6 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	const snapshotBun: string[] = snapshot.packages?.bun || [];
 	const snapshotTaps: string[] = snapshot.packages?.taps || [];
 
-	// Build a set of formula names that are already covered by a tap entry
-	// (e.g. "argoproj/tap/kubectl-argo-rollouts" covers "kubectl-argo-rollouts")
-	// so they don't appear in both CLI and TAPS sections.
-	// Only consider three-segment tap entries (owner/tap/formula) to avoid
-	// false-positive collisions with two-segment tap names like "homebrew/cask".
-	const tapFormulaNames = new Set<string>();
-	for (const t of snapshotTaps) {
-		const parts = t.split('/');
-		if (parts.length === 3) {
-			tapFormulaNames.add(parts[2]);
-		}
-	}
-
 	// Bun globals come from the npm registry and install fine via `npm install -g`,
 	// so we bucket them with npm in the typed `packages` array (the canonical
 	// downstream schema only special-cases `npm` and `cask`). Bun provenance is
@@ -89,18 +85,17 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	const npmSet = new Set(snapshotNpm);
 	const bunAsNpm = snapshotBun.filter((name) => !npmSet.has(name));
 
-	const packages = [
-		...snapshotFormulae
-			.filter((name) => !tapFormulaNames.has(name))
-			.map((name) => ({ name, type: 'formula' })),
+	const rawPackages = [
+		...snapshotFormulae.map((name) => ({ name, type: 'formula' })),
 		...snapshotCasks.map((name) => ({ name, type: 'cask' })),
 		...snapshotNpm.map((name) => ({ name, type: 'npm' })),
 		...bunAsNpm.map((name) => ({ name, type: 'npm' })),
-		...snapshotTaps.map((name) => ({ name, type: 'tap' })),
+		...snapshotTaps.map((name) => ({ name, type: 'tap' }))
 	];
 
-	const pv = validatePackages(packages);
+	const pv = validatePackages(rawPackages);
 	if (!pv.valid) return json({ error: pv.error }, { status: 400 });
+	const packages = normalizePackages(rawPackages, snapshot.packages);
 
 	if (config_slug) {
 		const existing = await getConfig(env.DB, user.id, config_slug);
@@ -201,11 +196,14 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 		createdPackages = [];
 	}
 
-	return json({
-		...created,
-		snapshot: createdSnapshot,
-		packages: createdPackages
-	}, { status: 201 });
+	return json(
+		{
+			...created,
+			snapshot: createdSnapshot,
+			packages: createdPackages
+		},
+		{ status: 201 }
+	);
 };
 
 // The CLI sends PUT for updates — route to the same handler.
diff --git a/src/routes/api/configs/server.test.ts b/src/routes/api/configs/server.test.ts
index 2c37356..d271ce8 100644
--- a/src/routes/api/configs/server.test.ts
+++ b/src/routes/api/configs/server.test.ts
@@ -6,6 +6,7 @@
 import { describe, it, expect, beforeEach } from 'vitest';
 import { env } from 'cloudflare:test';
 import { GET, POST } from './+server';
+import { POST as POST_SNAPSHOT } from './from-snapshot/+server';
 import { resetDb, seed, strip } from '$lib/test/seed';
 import { call } from '$lib/test/call';
 import { mockUser, mockConfig, mockPublicConfig, mockPrivateConfig, mockApiToken } from '$lib/test/fixtures';
@@ -270,3 +271,33 @@ describe('POST /api/configs', () => {
 		expect(json.error).toContain('Maximum 20 configs');
 	});
 });
+
+describe('snapshot source normalization', () => {
+	it('imports legacy qualified tap packages as software and preserves standalone sources', async () => {
+		await seed(db, { users: [userRow()], api_tokens: [mockApiToken] });
+		const response = await call(POST_SNAPSHOT, {
+			url: `${baseUrl}/from-snapshot`,
+			method: 'POST',
+			token: mockApiToken.token,
+			body: {
+				name: 'Imported sources',
+				snapshot: {
+					packages: {
+						formulae: ['bun', 'git'],
+						casks: [],
+						npm: [],
+						taps: ['oven-sh/bun/bun', 'oven-sh/bun', 'example/extra']
+					}
+				}
+			}
+		});
+		expect(response.status).toBe(201);
+		const data = (await response.json()) as { packages: { name: string; type: string }[] };
+		expect(data.packages).toEqual([
+			{ name: 'git', type: 'formula' },
+			{ name: 'oven-sh/bun/bun', type: 'formula' },
+			{ name: 'oven-sh/bun', type: 'tap' },
+			{ name: 'example/extra', type: 'tap' }
+		]);
+	});
+});
diff --git a/src/routes/dashboard/+page.svelte b/src/routes/dashboard/+page.svelte
index efd3312..9b978bd 100644
--- a/src/routes/dashboard/+page.svelte
+++ b/src/routes/dashboard/+page.svelte
@@ -35,9 +35,7 @@
 	let shareConfigName = $state('');
 	let shareCopied = $state(false);
 
-	const totalInstalls = $derived(
-		configs.reduce((sum, c) => sum + (c.install_count || 0), 0)
-	);
+	const totalInstalls = $derived(configs.reduce((sum, c) => sum + (c.install_count || 0), 0));
 
 	onMount(async () => {
 		await auth.check();
@@ -91,7 +89,7 @@
 					packages: source.packages || [],
 					custom_script: source.custom_script || '',
 					dotfiles_repo: source.dotfiles_repo || '',
-					snapshot: source.snapshot || null,
+					snapshot: source.snapshot || null
 				})
 			);
 			goto('/dashboard/edit/_new');
@@ -114,10 +112,10 @@
 				dotfiles_repo: config.dotfiles_repo || '',
 				snapshot: config.snapshot || null,
 				visibility: config.visibility || 'unlisted',
-				alias: config.alias || null,
+				alias: config.alias || null
 			};
 			const blob = new Blob([JSON.stringify(exported, null, 2)], {
-				type: 'application/json',
+				type: 'application/json'
 			});
 			const url = URL.createObjectURL(blob);
 			const a = document.createElement('a');
@@ -155,16 +153,14 @@
 	async function pushToCommunity(config: Config) {
 		const pkgs = Array.isArray(config.packages) ? config.packages : [];
 		if (pkgs.length < 5 || config.name === 'Default' || !config.description) {
-			alert(
-				'Needs at least 5 packages, a custom name, and a description to share publicly.'
-			);
+			alert('Needs at least 5 packages, a custom name, and a description to share publicly.');
 			return;
 		}
 		try {
 			const response = await fetch(`/api/configs/${config.slug}`, {
 				method: 'PUT',
 				headers: { 'Content-Type': 'application/json' },
-				body: JSON.stringify({ ...config, visibility: 'public' }),
+				body: JSON.stringify({ ...config, visibility: 'public' })
 			});
 			if (!response.ok) {
 				const data = await response.json();
@@ -216,14 +212,14 @@
 			const response = await fetch('/api/brewfile/parse', {
 				method: 'POST',
 				headers: { 'Content-Type': 'application/json' },
-				body: JSON.stringify({ content: brewfileContent }),
+				body: JSON.stringify({ content: brewfileContent })
 			});
 			const data = await response.json();
 			if (!response.ok) {
 				importError = data.error || 'Failed to parse';
 				return;
 			}
-			if (data.packages.length === 0) {
+			if (data.packages.length === 0 && !(data.taps || []).length) {
 				importError = 'No packages found';
 				return;
 			}
@@ -235,10 +231,13 @@
 					name: 'Imported Config',
 					description: `Imported from Brewfile (${data.packages.length} packages)`,
 					base_preset: 'minimal',
-					packages: data.packages.map((pkg: string) => ({
-						name: pkg,
-						type: (data.casks || []).includes(pkg) ? 'cask' : 'formula',
-					})),
+					packages: [
+						...data.packages.map((pkg: string) => ({
+							name: pkg,
+							type: (data.casks || []).includes(pkg) ? 'cask' : 'formula'
+						})),
+						...(data.taps || []).map((name: string) => ({ name, type: 'tap' }))
+					]
 				})
 			);
 			goto('/dashboard/edit/_new');
@@ -263,7 +262,7 @@
 		<div class="page-header">
 			<div>
 				<p class="eyebrow"><span class="accent">&gt;</span> dashboard</p>
-					<h1 class="page-title">My configurations</h1>
+				<h1 class="page-title">My configurations</h1>
 				<p class="page-stats">
 					{configs.length} config{configs.length !== 1 ? 's' : ''}
 					<span class="stats-sep">&middot;</span>
@@ -281,7 +280,16 @@
 		{#if configs.length === 0}
 			<div class="empty">
 				<div class="empty-glyph">
-					<svg width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round">
+					<svg
+						width="48"
+						height="48"
+						viewBox="0 0 24 24"
+						fill="none"
+						stroke="currentColor"
+						stroke-width="1.5"
+						stroke-linecap="round"
+						stroke-linejoin="round"
+					>
 						<rect x="2" y="3" width="20" height="14" rx="2" />
 						<path d="M8 21h8" />
 						<path d="M12 17v4" />
@@ -290,22 +298,14 @@
 					</svg>
 				</div>
 				<h3 class="empty-title">No configurations yet</h3>
-				<p class="empty-desc">
-					Define your machine's DNA. Create a config to get a custom install URL.
-				</p>
-				<Button variant="primary" onclick={() => goto('/dashboard/edit/_new')}>
-					Create First Config
-				</Button>
+				<p class="empty-desc">Define your machine's DNA. Create a config to get a custom install URL.</p>
+				<Button variant="primary" onclick={() => goto('/dashboard/edit/_new')}>Create First Config</Button>
 			</div>
 		{:else}
 			<div class="config-list">
 				{#each configs as config, i (config.id)}
 					<div class="card-wrap" style="animation-delay: {i * 50}ms">
-						<ConfigRow
-							{config}
-							username={$auth.user?.username ?? ''}
-							onaction={handleAction}
-						/>
+						<ConfigRow {config} username={$auth.user?.username ?? ''} onaction={handleAction} />
 					</div>
 				{/each}
 			</div>
@@ -322,12 +322,7 @@
 		role="dialog"
 		tabindex="0"
 	>
-		<div
-			class="modal"
-			onclick={(e) => e.stopPropagation()}
-			onkeydown={(e) => e.stopPropagation()}
-			role="presentation"
-		>
+		<div class="modal" onclick={(e) => e.stopPropagation()} onkeydown={(e) => e.stopPropagation()} role="presentation">
 			<div class="modal-head">
 				<h3>Import Brewfile</h3>
 				<button class="close" onclick={() => (showImportModal = false)}>&times;</button>
@@ -344,9 +339,7 @@
 				<p class="modal-hint">Supports tap, brew, and cask entries</p>
 			</div>
 			<div class="modal-foot">
-				<Button variant="secondary" onclick={() => (showImportModal = false)}>
-					Cancel
-				</Button>
+				<Button variant="secondary" onclick={() => (showImportModal = false)}>Cancel</Button>
 				<Button variant="primary" onclick={importBrewfile}>
 					{importLoading ? 'Parsing...' : 'Import'}
 				</Button>
@@ -381,7 +374,16 @@
 				<div class="share-options">
 					<button class="share-opt" onclick={shareCopyLink}>
 						<span class="share-icon">
-							<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+							<svg
+								width="18"
+								height="18"
+								viewBox="0 0 24 24"
+								fill="none"
+								stroke="currentColor"
+								stroke-width="2"
+								stroke-linecap="round"
+								stroke-linejoin="round"
+							>
 								<rect x="9" y="9" width="13" height="13" rx="2" />
 								<path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" />
 							</svg>
@@ -391,7 +393,9 @@
 					<button class="share-opt" onclick={shareOnTwitter}>
 						<span class="share-icon">
 							<svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor">
-								<path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z" />
+								<path
+									d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"
+								/>
 							</svg>
 						</span>
 						Share on X
@@ -429,7 +433,9 @@
 	}
 
 	@keyframes spin {
-		to { transform: rotate(360deg); }
+		to {
+			transform: rotate(360deg);
+		}
 	}
 
 	/* Header */
@@ -511,7 +517,9 @@
 		font-size: 0.84rem;
 		font-weight: 500;
 		cursor: pointer;
-		transition: filter 0.16s ease, transform 0.16s ease;
+		transition:
+			filter 0.16s ease,
+			transform 0.16s ease;
 	}
 
 	.btn-new:hover {
@@ -598,8 +606,12 @@
 	}
 
 	@keyframes fadeIn {
-		from { opacity: 0; }
-		to { opacity: 1; }
+		from {
+			opacity: 0;
+		}
+		to {
+			opacity: 1;
+		}
 	}
 
 	.modal {
@@ -613,8 +625,14 @@
 	}
 
 	@keyframes slideUp {
-		from { opacity: 0; transform: translateY(16px); }
-		to { opacity: 1; transform: translateY(0); }
+		from {
+			opacity: 0;
+			transform: translateY(16px);
+		}
+		to {
+			opacity: 1;
+			transform: translateY(0);
+		}
 	}
 
 	.share-modal {
@@ -776,8 +794,14 @@
 	}
 
 	@keyframes toastIn {
-		from { opacity: 0; transform: translateX(-50%) translateY(12px); }
-		to { opacity: 1; transform: translateX(-50%) translateY(0); }
+		from {
+			opacity: 0;
+			transform: translateX(-50%) translateY(12px);
+		}
+		to {
+			opacity: 1;
+			transform: translateX(-50%) translateY(0);
+		}
 	}
 
 	@media (max-width: 768px) {

From 94b719535971e192bef81076749c1e2268e5ba0d Mon Sep 17 00:00:00 2001
From: fullstackjam <fullstackjam@outlook.com>
Date: Sat, 24 Oct 2026 22:52:01 +0800
Subject: [PATCH 2/4] fix(packages): preserve historical sources across edits

---
 src/lib/components/ConfigEditor.svelte        | 17 ++++---
 src/lib/packages.test.ts                      | 49 ++++++++++++++++++-
 src/lib/packages.ts                           | 42 ++++++++++++----
 .../[username]/[slug]/config/server.test.ts   | 25 ++++++++--
 src/routes/api/configs/+server.ts             |  7 +--
 src/routes/api/configs/[slug]/+server.ts      | 33 ++++++++-----
 src/routes/api/configs/[slug]/server.test.ts  |  5 +-
 src/routes/api/configs/server.test.ts         |  7 +--
 8 files changed, 145 insertions(+), 40 deletions(-)

diff --git a/src/lib/components/ConfigEditor.svelte b/src/lib/components/ConfigEditor.svelte
index e123c93..3607991 100644
--- a/src/lib/components/ConfigEditor.svelte
+++ b/src/lib/components/ConfigEditor.svelte
@@ -5,7 +5,7 @@
 	import PackageManager from './PackageManager.svelte';
 	import MacOSPreferencesEditor from './MacOSPreferencesEditor.svelte';
 	import { PRESET_PACKAGES } from '$lib/presets';
-	import { normalizePackages, resolvePackages } from '$lib/packages';
+	import { normalizePackages, resolvePackages, syncSnapshotTaps } from '$lib/packages';
 
 	let { slug, skipAuth = false }: { slug?: string; skipAuth?: boolean } = $props();
 	const isNew = !slug;
@@ -221,14 +221,17 @@
 			existingSnapshot !== null || macosPrefs.length > 0
 				? { ...(existingSnapshot || {}), macos_prefs: macosPrefs }
 				: null;
+		const packages = normalizePackages(
+			Array.from(selectedPackages.entries()).map(([key, type]) => {
+				const name = key.slice(type.length + 1);
+				return { name, type, desc: packageDescs.get(key) || '' };
+			})
+		);
 		return {
 			...formData,
 			alias: formData.alias.trim() || null,
-			packages: Array.from(selectedPackages.entries()).map(([key, type]) => {
-				const name = key.slice(type.length + 1);
-				return { name, type, desc: packageDescs.get(key) || '' };
-			}),
-			snapshot: updatedSnapshot
+			packages,
+			snapshot: syncSnapshotTaps(updatedSnapshot, packages)
 		};
 	}
 
@@ -244,7 +247,7 @@
 		};
 		const newMap = new Map<string, string>();
 		const newDescs = new Map<string, string>();
-		for (const pkg of normalizePackages(parsed.packages || [], parsed.snapshot?.packages)) {
+		for (const pkg of normalizePackages(parsed.packages || [], parsed.snapshot?.packages, false)) {
 			const t = pkg.type || 'formula';
 			const k = pkgKey(pkg.name, t);
 			newMap.set(k, t);
diff --git a/src/lib/packages.test.ts b/src/lib/packages.test.ts
index 2f8f6f3..d81da9b 100644
--- a/src/lib/packages.test.ts
+++ b/src/lib/packages.test.ts
@@ -1,5 +1,12 @@
 import { describe, expect, it } from 'vitest';
-import { getHomebrewTap, isTapName, normalizePackages, resolvePackages, type SnapshotPackages } from './packages';
+import {
+	getHomebrewTap,
+	isTapName,
+	normalizePackages,
+	resolvePackages,
+	syncSnapshotTaps,
+	type SnapshotPackages
+} from './packages';
 
 describe('Homebrew package sources', () => {
 	it('distinguishes repository names from qualified software names', () => {
@@ -37,11 +44,49 @@ describe('Homebrew package sources', () => {
 		).toEqual(['cask', 'cask', 'formula']);
 	});
 
+	it('deduplicates legacy casks without removing a same-named formula', () => {
+		expect(
+			normalizePackages(
+				[
+					{ name: 'editor', type: 'formula' },
+					{ name: 'editor', type: 'cask' },
+					{ name: 'example/apps/editor', type: 'tap' }
+				],
+				{ casks: ['editor'] }
+			)
+		).toEqual([
+			{ name: 'editor', type: 'formula' },
+			{ name: 'example/apps/editor', type: 'cask' }
+		]);
+	});
+
 	it('ignores malformed historical snapshot hints', () => {
 		const snapshot = JSON.parse('{"casks":{},"taps":"invalid"}') as SnapshotPackages;
 		expect(normalizePackages(['git'], snapshot)).toEqual([{ name: 'git', type: 'formula' }]);
 	});
 
+	it('preserves snapshot-only sources in historical typed lists', () => {
+		expect(normalizePackages([{ name: 'custom-tool', type: 'formula' }], { taps: ['example/tools'] })).toEqual([
+			{ name: 'custom-tool', type: 'formula' },
+			{ name: 'example/tools', type: 'tap' }
+		]);
+	});
+
+	it('synchronizes sources on save while preserving other snapshot fields', () => {
+		const packages = normalizePackages([{ name: 'example/apps/editor', type: 'cask' }]);
+		const snapshot = {
+			packages: { taps: ['old/tools'], casks: ['editor'] },
+			hostname: 'test-machine',
+			macos_prefs: []
+		};
+		const saved = syncSnapshotTaps(snapshot, packages);
+		expect(saved).toEqual({ ...snapshot, packages: { taps: [], casks: ['editor'] } });
+		expect(resolvePackages(normalizePackages(packages, saved?.packages as SnapshotPackages)).taps).toEqual([
+			{ name: 'example/apps', explicit: false, requiredBy: ['example/apps/editor'] }
+		]);
+		expect(snapshot.packages.taps).toEqual(['old/tools']);
+	});
+
 	it('recovers snapshot-only taps for legacy string lists', () => {
 		expect(normalizePackages(['git'], { taps: ['example/tools'] })).toEqual([
 			{ name: 'git', type: 'formula' },
@@ -52,7 +97,7 @@ describe('Homebrew package sources', () => {
 	it.each([[], [{ name: 'git', type: 'formula' }]].map((packages) => ({ packages })))(
 		'does not restore removed sources from a snapshot: $packages',
 		({ packages }) => {
-			expect(resolvePackages(normalizePackages(packages, { taps: ['old/tools'] })).taps).toEqual([]);
+			expect(resolvePackages(normalizePackages(packages, { taps: ['old/tools'] }, false)).taps).toEqual([]);
 		}
 	);
 
diff --git a/src/lib/packages.ts b/src/lib/packages.ts
index c2ec52c..931a406 100644
--- a/src/lib/packages.ts
+++ b/src/lib/packages.ts
@@ -29,22 +29,29 @@ export function getHomebrewTap(name: string): string | null {
 }
 
 /** Repair legacy tap packages without changing explicit formula/cask choices. */
-export function normalizePackages(packages: readonly PackageInput[], snapshot?: SnapshotPackages): ConfigPackage[] {
+export function normalizePackages(
+	packages: readonly PackageInput[],
+	snapshot?: SnapshotPackages,
+	includeSnapshotTaps = true
+): ConfigPackage[] {
 	const casks = new Set(
 		Array.isArray(snapshot?.casks) ? snapshot.casks.filter((name) => typeof name === 'string') : []
 	);
 	const inputs: PackageInput[] = [...packages];
-	// Only legacy string lists need snapshot sources. Typed lists are authoritative,
-	// so removing a source in the editor cannot resurrect it from an old snapshot.
-	if (packages.some((pkg) => typeof pkg === 'string') && Array.isArray(snapshot?.taps)) {
+	// Older editors saved typed software without copying snapshot-only sources.
+	// Reads must retain those sources; writes synchronize the snapshot instead.
+	if (includeSnapshotTaps && Array.isArray(snapshot?.taps)) {
 		for (const name of snapshot.taps) {
 			if (typeof name === 'string') inputs.push({ name, type: 'tap' });
 		}
 	}
-	const legacyFormulaNames = new Set(
-		inputs.flatMap((pkg) =>
-			typeof pkg !== 'string' && pkg.type === 'tap' && getHomebrewTap(pkg.name) ? [pkg.name.split('/')[2]] : []
-		)
+	const legacyPackageKeys = new Set(
+		inputs.flatMap((pkg) => {
+			if (typeof pkg === 'string' || pkg.type !== 'tap' || !getHomebrewTap(pkg.name)) return [];
+			const shortName = pkg.name.split('/')[2];
+			const type = casks.has(pkg.name) || casks.has(shortName) ? 'cask' : 'formula';
+			return [`${type}:${shortName}`];
+		})
 	);
 	const normalized = new Map<string, ConfigPackage>();
 	for (const input of inputs) {
@@ -57,8 +64,8 @@ export function normalizePackages(packages: readonly PackageInput[], snapshot?:
 		} else {
 			type = casks.has(pkg.name) || casks.has(pkg.name.split('/').pop() || '') ? 'cask' : 'formula';
 		}
-		if (type === 'formula' && legacyFormulaNames.has(pkg.name)) continue;
 		const key = `${type}:${pkg.name}`;
+		if (legacyPackageKeys.has(key)) continue;
 		const previous = normalized.get(key);
 		normalized.set(key, {
 			name: pkg.name,
@@ -69,6 +76,23 @@ export function normalizePackages(packages: readonly PackageInput[], snapshot?:
 	return [...normalized.values()];
 }
 
+/** Keep snapshot sources aligned with an explicit package selection on save. */
+export function syncSnapshotTaps(
+	snapshot: unknown,
+	packages: readonly ConfigPackage[]
+): Record<string, unknown> | null {
+	if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot)) return null;
+	const hints = 'packages' in snapshot ? snapshot.packages : null;
+	const snapshotPackages = hints && typeof hints === 'object' && !Array.isArray(hints) ? hints : {};
+	return {
+		...snapshot,
+		packages: {
+			...snapshotPackages,
+			taps: packages.filter((pkg) => pkg.type === 'tap').map((pkg) => pkg.name)
+		}
+	};
+}
+
 /** Combine manually retained sources with dependencies of selected Homebrew packages. */
 export function resolvePackages(packages: readonly ConfigPackage[]) {
 	const formulae = packages.filter((pkg) => pkg.type === 'formula');
diff --git a/src/routes/[username]/[slug]/config/server.test.ts b/src/routes/[username]/[slug]/config/server.test.ts
index e34d9b5..9c11990 100644
--- a/src/routes/[username]/[slug]/config/server.test.ts
+++ b/src/routes/[username]/[slug]/config/server.test.ts
@@ -7,6 +7,7 @@ import { describe, it, expect, beforeEach } from 'vitest';
 import { env } from 'cloudflare:test';
 import { GET } from './+server';
 import { GET as GET_ALIAS } from '../../../api/configs/alias/[alias]/+server';
+import { PUT as UPDATE_CONFIG } from '../../../api/configs/[slug]/+server';
 import { resetDb, seed, strip } from '$lib/test/seed';
 import { call } from '$lib/test/call';
 import { mockUser, mockPublicConfig, mockPrivateConfig, mockApiToken, mockExpiredApiToken } from '$lib/test/fixtures';
@@ -470,11 +471,29 @@ describe.each([
 		expect(data.taps).toEqual(['example/tools']);
 	});
 
-	it.each([[], [{ name: 'git', type: 'formula' }]].map((packages) => ({ packages })))(
-		'does not resurrect removed snapshot taps: $packages',
+	it.each([[], [{ name: 'custom-tool', type: 'formula' }]].map((packages) => ({ packages })))(
+		'preserves historical snapshot-only sources for typed lists: $packages',
 		async ({ packages }) => {
 			const data = await exportConfig(packages, ['old/tools']);
-			expect(data.taps).toEqual([]);
+			expect(data.taps).toEqual(['old/tools']);
 		}
 	);
+
+	it('removes snapshot sources when saving a new selection without resending the snapshot', async () => {
+		await exportConfig([{ name: 'custom-tool', type: 'formula' }], ['old/tools']);
+		await seed(db, { api_tokens: [mockApiToken] });
+		const saved = await call(
+			UPDATE_CONFIG,
+			opts({
+				method: 'PUT',
+				token: mockApiToken.token,
+				params: { slug: 'public-config' },
+				body: { packages: [{ name: 'git', type: 'formula' }] }
+			})
+		);
+		expect(saved.status).toBe(200);
+		const response = await call(handler, opts({ params }));
+		const data = (await response.json()) as { taps: string[] };
+		expect(data.taps).toEqual([]);
+	});
 });
diff --git a/src/routes/api/configs/+server.ts b/src/routes/api/configs/+server.ts
index 74ef98b..728135f 100644
--- a/src/routes/api/configs/+server.ts
+++ b/src/routes/api/configs/+server.ts
@@ -1,5 +1,5 @@
 import { json } from '@sveltejs/kit';
-import { normalizePackages } from '$lib/packages';
+import { normalizePackages, syncSnapshotTaps } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getCurrentUser, slugify, generateId } from '$lib/server/auth';
 import {
@@ -146,6 +146,7 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	}
 
 	const id = generateId();
+	const selectedPackages = normalizePackages(packages || [], snapshot?.packages, false);
 
 	try {
 		await createConfig(env.DB, {
@@ -155,12 +156,12 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 			name,
 			description: description || '',
 			base_preset: base_preset || 'developer',
-			packages: JSON.stringify(normalizePackages(packages || [], snapshot?.packages)),
+			packages: JSON.stringify(selectedPackages),
 			custom_script: custom_script || '',
 			visibility: visibility || 'unlisted',
 			alias: cleanAlias,
 			dotfiles_repo: dotfiles_repo || '',
-			snapshot: snapshot ? JSON.stringify(snapshot) : null,
+			snapshot: snapshot ? JSON.stringify(syncSnapshotTaps(snapshot, selectedPackages)) : null,
 			snapshot_at: snapshot_at || null,
 			forked_from: forked_from || null
 		});
diff --git a/src/routes/api/configs/[slug]/+server.ts b/src/routes/api/configs/[slug]/+server.ts
index ce10e5e..6b0ca63 100644
--- a/src/routes/api/configs/[slug]/+server.ts
+++ b/src/routes/api/configs/[slug]/+server.ts
@@ -1,5 +1,5 @@
 import { json } from '@sveltejs/kit';
-import { normalizePackages, type PackageInput, type SnapshotPackages } from '$lib/packages';
+import { normalizePackages, syncSnapshotTaps, type PackageInput, type SnapshotPackages } from '$lib/packages';
 import type { RequestHandler } from './$types';
 import { getCurrentUser, slugify } from '$lib/server/auth';
 import {
@@ -10,14 +10,7 @@ import {
 	RESERVED_ALIASES
 } from '$lib/server/validation';
 import { checkRateLimit, getRateLimitKey, RATE_LIMITS } from '$lib/server/rate-limit';
-import {
-	getConfig,
-	getConfigIdAndAlias,
-	slugConflict,
-	aliasExistsExcluding,
-	updateConfig,
-	deleteConfig
-} from '$lib/server/db';
+import { getConfig, slugConflict, aliasExistsExcluding, updateConfig, deleteConfig } from '$lib/server/db';
 
 export const GET: RequestHandler = async ({ platform, cookies, params, request }) => {
 	const env = platform?.env;
@@ -156,7 +149,7 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 
 	const slug = params.slug;
 
-	const existing = await getConfigIdAndAlias(env.DB, user.id, slug);
+	const existing = await getConfig(env.DB, user.id, slug);
 	if (!existing) return json({ error: 'Config not found' }, { status: 404 });
 
 	let newSlug = slug;
@@ -185,18 +178,34 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 		}
 	}
 
+	let snapshotToSave = snapshot;
+	let selectedPackages: ReturnType<typeof normalizePackages> | undefined;
+	if (packages !== undefined) {
+		let previousSnapshot = null;
+		if (snapshot === undefined && existing.snapshot) {
+			try {
+				previousSnapshot = JSON.parse(existing.snapshot);
+			} catch (error) {
+				console.error('Failed to parse snapshot while updating package sources:', error);
+			}
+		}
+		const sourceSnapshot = snapshot === undefined ? previousSnapshot : snapshot;
+		selectedPackages = normalizePackages(packages || [], sourceSnapshot?.packages, false);
+		snapshotToSave = syncSnapshotTaps(sourceSnapshot, selectedPackages);
+	}
+
 	try {
 		await updateConfig(env.DB, {
 			newSlug,
 			name: name || null,
 			description: description !== undefined ? description : null,
 			base_preset: base_preset || null,
-			packages: packages ? JSON.stringify(normalizePackages(packages, snapshot?.packages)) : null,
+			packages: selectedPackages ? JSON.stringify(selectedPackages) : null,
 			custom_script: custom_script !== undefined ? custom_script : null,
 			visibility: visibility !== undefined ? visibility : null,
 			alias: newAlias,
 			dotfiles_repo: dotfiles_repo !== undefined ? dotfiles_repo : null,
-			snapshot: snapshot !== undefined ? (snapshot ? JSON.stringify(snapshot) : null) : null,
+			snapshot: snapshotToSave !== undefined ? (snapshotToSave ? JSON.stringify(snapshotToSave) : null) : null,
 			snapshot_at: snapshot_at !== undefined ? snapshot_at : null,
 			userId: user.id,
 			slug
diff --git a/src/routes/api/configs/[slug]/server.test.ts b/src/routes/api/configs/[slug]/server.test.ts
index 962a521..83927e5 100644
--- a/src/routes/api/configs/[slug]/server.test.ts
+++ b/src/routes/api/configs/[slug]/server.test.ts
@@ -413,8 +413,11 @@ describe('package source save round-trip', () => {
 		);
 		expect(saved.status).toBe(200);
 		const read = await call(GET, callOpts({ token: mockApiToken.token }));
-		const data = (await read.json()) as { config: { packages: { name: string; type: string }[] } };
+		const data = (await read.json()) as {
+			config: { packages: { name: string; type: string }[]; snapshot: { packages: { taps: string[] } } };
+		};
 		expect(data.config.packages).toEqual([{ name: 'oven-sh/bun/bun', type: 'formula' }]);
+		expect(data.config.snapshot.packages.taps).toEqual([]);
 		const cleared = await call(PUT, callOpts({ method: 'PUT', token: mockApiToken.token, body: { packages: [] } }));
 		expect(cleared.status).toBe(200);
 		const reloaded = await call(GET, callOpts({ token: mockApiToken.token }));
diff --git a/src/routes/api/configs/server.test.ts b/src/routes/api/configs/server.test.ts
index d271ce8..11f0248 100644
--- a/src/routes/api/configs/server.test.ts
+++ b/src/routes/api/configs/server.test.ts
@@ -284,9 +284,9 @@ describe('snapshot source normalization', () => {
 				snapshot: {
 					packages: {
 						formulae: ['bun', 'git'],
-						casks: [],
+						casks: ['editor'],
 						npm: [],
-						taps: ['oven-sh/bun/bun', 'oven-sh/bun', 'example/extra']
+						taps: ['oven-sh/bun/bun', 'oven-sh/bun', 'example/extra', 'example/apps/editor']
 					}
 				}
 			}
@@ -297,7 +297,8 @@ describe('snapshot source normalization', () => {
 			{ name: 'git', type: 'formula' },
 			{ name: 'oven-sh/bun/bun', type: 'formula' },
 			{ name: 'oven-sh/bun', type: 'tap' },
-			{ name: 'example/extra', type: 'tap' }
+			{ name: 'example/extra', type: 'tap' },
+			{ name: 'example/apps/editor', type: 'cask' }
 		]);
 	});
 });

From 3b2a3c57d604f5e9d61b390fa1ee72cd7f078ac2 Mon Sep 17 00:00:00 2001
From: fullstackjam <fullstackjam@outlook.com>
Date: Sat, 24 Oct 2026 22:52:53 +0800
Subject: [PATCH 3/4] refactor(db): load snapshot metadata for config updates

---
 src/lib/server/db/configs.ts             | 157 +++++------------------
 src/routes/api/configs/[slug]/+server.ts |  11 +-
 2 files changed, 43 insertions(+), 125 deletions(-)

diff --git a/src/lib/server/db/configs.ts b/src/lib/server/db/configs.ts
index e748b9a..c04f2d6 100644
--- a/src/lib/server/db/configs.ts
+++ b/src/lib/server/db/configs.ts
@@ -18,9 +18,7 @@ export async function saveRevision(
 	const id = `rev_${crypto.randomUUID().replace(/-/g, '').slice(0, 16)}`;
 
 	await db
-		.prepare(
-			`INSERT INTO config_revisions (id, config_id, packages, message) VALUES (?, ?, ?, ?)`
-		)
+		.prepare(`INSERT INTO config_revisions (id, config_id, packages, message) VALUES (?, ?, ?, ?)`)
 		.bind(id, configId, packages, message ?? null)
 		.run();
 
@@ -84,43 +82,29 @@ export async function getUserConfigs(db: D1Database, userId: string): Promise<Co
 	return results;
 }
 
-export async function getConfig(
-	db: D1Database,
-	userId: string,
-	slug: string
-): Promise<ConfigRow | null> {
-	return db
-		.prepare('SELECT * FROM configs WHERE user_id = ? AND slug = ?')
-		.bind(userId, slug)
-		.first<ConfigRow>();
+export async function getConfig(db: D1Database, userId: string, slug: string): Promise<ConfigRow | null> {
+	return db.prepare('SELECT * FROM configs WHERE user_id = ? AND slug = ?').bind(userId, slug).first<ConfigRow>();
 }
 
-export async function getConfigIdAndAlias(
+export async function getConfigForUpdate(
 	db: D1Database,
 	userId: string,
 	slug: string
-): Promise<Pick<ConfigRow, 'id' | 'alias'> | null> {
+): Promise<Pick<ConfigRow, 'id' | 'alias' | 'snapshot'> | null> {
 	return db
-		.prepare('SELECT id, alias FROM configs WHERE user_id = ? AND slug = ?')
+		.prepare('SELECT id, alias, snapshot FROM configs WHERE user_id = ? AND slug = ?')
 		.bind(userId, slug)
-		.first<Pick<ConfigRow, 'id' | 'alias'>>();
+		.first<Pick<ConfigRow, 'id' | 'alias' | 'snapshot'>>();
 }
 
-export async function getConfigId(
-	db: D1Database,
-	userId: string,
-	slug: string
-): Promise<Pick<ConfigRow, 'id'> | null> {
+export async function getConfigId(db: D1Database, userId: string, slug: string): Promise<Pick<ConfigRow, 'id'> | null> {
 	return db
 		.prepare('SELECT id FROM configs WHERE user_id = ? AND slug = ?')
 		.bind(userId, slug)
 		.first<Pick<ConfigRow, 'id'>>();
 }
 
-export async function getConfigById(
-	db: D1Database,
-	id: string
-): Promise<ConfigRow | null> {
+export async function getConfigById(db: D1Database, id: string): Promise<ConfigRow | null> {
 	return db
 		.prepare(
 			'SELECT id, slug, name, description, base_preset, packages, snapshot, snapshot_at, visibility FROM configs WHERE id = ?'
@@ -149,14 +133,7 @@ export async function getConfigForCLI(
 ): Promise<
 	| (Pick<
 			ConfigRow,
-			| 'slug'
-			| 'name'
-			| 'base_preset'
-			| 'packages'
-			| 'snapshot'
-			| 'visibility'
-			| 'dotfiles_repo'
-			| 'custom_script'
+			'slug' | 'name' | 'base_preset' | 'packages' | 'snapshot' | 'visibility' | 'dotfiles_repo' | 'custom_script'
 	  > & { username: string })
 	| null
 > {
@@ -172,14 +149,7 @@ export async function getConfigForCLI(
 		.first<
 			Pick<
 				ConfigRow,
-				| 'slug'
-				| 'name'
-				| 'base_preset'
-				| 'packages'
-				| 'snapshot'
-				| 'visibility'
-				| 'dotfiles_repo'
-				| 'custom_script'
+				'slug' | 'name' | 'base_preset' | 'packages' | 'snapshot' | 'visibility' | 'dotfiles_repo' | 'custom_script'
 			> & { username: string }
 		>();
 }
@@ -243,14 +213,7 @@ export async function getConfigByAliasForAPI(
 ): Promise<
 	| (Pick<
 			ConfigRow,
-			| 'slug'
-			| 'name'
-			| 'base_preset'
-			| 'packages'
-			| 'snapshot'
-			| 'visibility'
-			| 'dotfiles_repo'
-			| 'custom_script'
+			'slug' | 'name' | 'base_preset' | 'packages' | 'snapshot' | 'visibility' | 'dotfiles_repo' | 'custom_script'
 	  > & { username: string })
 	| null
 > {
@@ -266,14 +229,7 @@ export async function getConfigByAliasForAPI(
 		.first<
 			Pick<
 				ConfigRow,
-				| 'slug'
-				| 'name'
-				| 'base_preset'
-				| 'packages'
-				| 'snapshot'
-				| 'visibility'
-				| 'dotfiles_repo'
-				| 'custom_script'
+				'slug' | 'name' | 'base_preset' | 'packages' | 'snapshot' | 'visibility' | 'dotfiles_repo' | 'custom_script'
 			> & { username: string }
 		>();
 }
@@ -319,14 +275,7 @@ export async function getUserPublicConfigs(
 ): Promise<
 	Pick<
 		ConfigRow,
-		| 'id'
-		| 'slug'
-		| 'name'
-		| 'description'
-		| 'base_preset'
-		| 'packages'
-		| 'install_count'
-		| 'updated_at'
+		'id' | 'slug' | 'name' | 'description' | 'base_preset' | 'packages' | 'install_count' | 'updated_at'
 	>[]
 > {
 	const { results } = await db
@@ -337,14 +286,7 @@ export async function getUserPublicConfigs(
 		.all<
 			Pick<
 				ConfigRow,
-				| 'id'
-				| 'slug'
-				| 'name'
-				| 'description'
-				| 'base_preset'
-				| 'packages'
-				| 'install_count'
-				| 'updated_at'
+				'id' | 'slug' | 'name' | 'description' | 'base_preset' | 'packages' | 'install_count' | 'updated_at'
 			>
 		>();
 	return results;
@@ -358,14 +300,8 @@ export async function countUserConfigs(db: D1Database, userId: string): Promise<
 	return result?.count ?? 0;
 }
 
-export async function aliasExists(
-	db: D1Database,
-	alias: string
-): Promise<Pick<ConfigRow, 'id'> | null> {
-	return db
-		.prepare('SELECT id FROM configs WHERE alias = ?')
-		.bind(alias)
-		.first<Pick<ConfigRow, 'id'>>();
+export async function aliasExists(db: D1Database, alias: string): Promise<Pick<ConfigRow, 'id'> | null> {
+	return db.prepare('SELECT id FROM configs WHERE alias = ?').bind(alias).first<Pick<ConfigRow, 'id'>>();
 }
 
 export async function aliasExistsExcluding(
@@ -421,8 +357,7 @@ export async function getPublicConfigs(
 ): Promise<{ results: PublicConfigRow[]; total: number }> {
 	const { username, sort, visibility, limit, offset } = options;
 
-	let whereClause =
-		visibility === 'public' ? `c.visibility = 'public'` : `c.visibility IN ('public', 'unlisted')`;
+	let whereClause = visibility === 'public' ? `c.visibility = 'public'` : `c.visibility IN ('public', 'unlisted')`;
 
 	if (!username) {
 		whereClause += ` AND NOT (u.username = 'openboot' AND c.slug = 'default')`;
@@ -475,8 +410,14 @@ export async function getPublicConfigs(
 	}
 
 	const [{ results }, countResult] = await Promise.all([
-		db.prepare(query).bind(...bindings).all<PublicConfigRow>(),
-		db.prepare(countQuery).bind(...countBindings).first<{ count: number }>()
+		db
+			.prepare(query)
+			.bind(...bindings)
+			.all<PublicConfigRow>(),
+		db
+			.prepare(countQuery)
+			.bind(...countBindings)
+			.first<{ count: number }>()
 	]);
 
 	return { results, total: countResult?.count ?? 0 };
@@ -488,16 +429,12 @@ export async function getConfigOGData(
 	slug: string
 ): Promise<Pick<ConfigRow, 'name' | 'description' | 'packages' | 'visibility' | 'base_preset'> | null> {
 	return db
-		.prepare(
-			'SELECT name, description, packages, visibility, base_preset FROM configs WHERE user_id = ? AND slug = ?'
-		)
+		.prepare('SELECT name, description, packages, visibility, base_preset FROM configs WHERE user_id = ? AND slug = ?')
 		.bind(userId, slug)
 		.first<Pick<ConfigRow, 'name' | 'description' | 'packages' | 'visibility' | 'base_preset'>>();
 }
 
-export async function getSitemapConfigs(
-	db: D1Database
-): Promise<{ slug: string; username: string }[]> {
+export async function getSitemapConfigs(db: D1Database): Promise<{ slug: string; username: string }[]> {
 	const { results } = await db
 		.prepare(
 			`SELECT c.slug, u.username FROM configs c JOIN users u ON c.user_id = u.id WHERE c.visibility = 'public' AND c.slug != 'default' ORDER BY c.install_count DESC LIMIT 500`
@@ -550,11 +487,7 @@ export async function createConfig(db: D1Database, p: CreateConfigParams): Promi
 		.run();
 }
 
-export async function createDefaultConfig(
-	db: D1Database,
-	id: string,
-	userId: string
-): Promise<void> {
+export async function createDefaultConfig(db: D1Database, id: string, userId: string): Promise<void> {
 	await db
 		.prepare(
 			`INSERT INTO configs (id, user_id, slug, name, description, base_preset, packages)
@@ -616,15 +549,8 @@ export async function updateConfig(db: D1Database, p: UpdateConfigParams): Promi
 		.run();
 }
 
-export async function deleteConfig(
-	db: D1Database,
-	userId: string,
-	slug: string
-): Promise<void> {
-	await db
-		.prepare('DELETE FROM configs WHERE user_id = ? AND slug = ?')
-		.bind(userId, slug)
-		.run();
+export async function deleteConfig(db: D1Database, userId: string, slug: string): Promise<void> {
+	await db.prepare('DELETE FROM configs WHERE user_id = ? AND slug = ?').bind(userId, slug).run();
 }
 
 export function incrementInstallByAlias(db: D1Database, alias: string): void {
@@ -635,9 +561,7 @@ export function incrementInstallByAlias(db: D1Database, alias: string): void {
 }
 
 export function incrementInstallBySlug(db: D1Database, userId: string, slug: string): void {
-	db.prepare(
-		'UPDATE configs SET install_count = install_count + 1 WHERE user_id = ? AND slug = ?'
-	)
+	db.prepare('UPDATE configs SET install_count = install_count + 1 WHERE user_id = ? AND slug = ?')
 		.bind(userId, slug)
 		.run()
 		.catch((e: unknown) => console.error('install count update failed:', e));
@@ -718,25 +642,12 @@ export interface CreateConfigFromSnapshotParams {
 	visibility: string;
 }
 
-export async function createConfigFromSnapshot(
-	db: D1Database,
-	p: CreateConfigFromSnapshotParams
-): Promise<void> {
+export async function createConfigFromSnapshot(db: D1Database, p: CreateConfigFromSnapshotParams): Promise<void> {
 	await db
 		.prepare(
 			`INSERT INTO configs (id, user_id, slug, name, description, base_preset, packages, snapshot, snapshot_at, visibility)
 			VALUES (?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), ?)`
 		)
-		.bind(
-			p.id,
-			p.userId,
-			p.slug,
-			p.name,
-			p.description,
-			p.base_preset,
-			p.packages,
-			p.snapshot,
-			p.visibility
-		)
+		.bind(p.id, p.userId, p.slug, p.name, p.description, p.base_preset, p.packages, p.snapshot, p.visibility)
 		.run();
 }
diff --git a/src/routes/api/configs/[slug]/+server.ts b/src/routes/api/configs/[slug]/+server.ts
index 6b0ca63..d5d437a 100644
--- a/src/routes/api/configs/[slug]/+server.ts
+++ b/src/routes/api/configs/[slug]/+server.ts
@@ -10,7 +10,14 @@ import {
 	RESERVED_ALIASES
 } from '$lib/server/validation';
 import { checkRateLimit, getRateLimitKey, RATE_LIMITS } from '$lib/server/rate-limit';
-import { getConfig, slugConflict, aliasExistsExcluding, updateConfig, deleteConfig } from '$lib/server/db';
+import {
+	getConfig,
+	getConfigForUpdate,
+	slugConflict,
+	aliasExistsExcluding,
+	updateConfig,
+	deleteConfig
+} from '$lib/server/db';
 
 export const GET: RequestHandler = async ({ platform, cookies, params, request }) => {
 	const env = platform?.env;
@@ -149,7 +156,7 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 
 	const slug = params.slug;
 
-	const existing = await getConfig(env.DB, user.id, slug);
+	const existing = await getConfigForUpdate(env.DB, user.id, slug);
 	if (!existing) return json({ error: 'Config not found' }, { status: 404 });
 
 	let newSlug = slug;

From 4460ea31e9be10df1ef027184702b776a6efdbee Mon Sep 17 00:00:00 2001
From: fullstackjam <fullstackjam@outlook.com>
Date: Sat, 24 Oct 2026 22:53:41 +0800
Subject: [PATCH 4/4] fix(configs): retain optional package update semantics

---
 src/routes/api/configs/+server.ts            |  2 +-
 src/routes/api/configs/[slug]/+server.ts     |  2 +-
 src/routes/api/configs/[slug]/server.test.ts | 11 +++++++++++
 src/routes/api/configs/server.test.ts        | 19 +++++++++++++++++++
 4 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/src/routes/api/configs/+server.ts b/src/routes/api/configs/+server.ts
index 728135f..afdb409 100644
--- a/src/routes/api/configs/+server.ts
+++ b/src/routes/api/configs/+server.ts
@@ -146,7 +146,7 @@ export const POST: RequestHandler = async ({ platform, cookies, request }) => {
 	}
 
 	const id = generateId();
-	const selectedPackages = normalizePackages(packages || [], snapshot?.packages, false);
+	const selectedPackages = normalizePackages(packages || [], snapshot?.packages, packages === undefined);
 
 	try {
 		await createConfig(env.DB, {
diff --git a/src/routes/api/configs/[slug]/+server.ts b/src/routes/api/configs/[slug]/+server.ts
index d5d437a..b9d7300 100644
--- a/src/routes/api/configs/[slug]/+server.ts
+++ b/src/routes/api/configs/[slug]/+server.ts
@@ -187,7 +187,7 @@ export const PUT: RequestHandler = async ({ platform, cookies, params, request }
 
 	let snapshotToSave = snapshot;
 	let selectedPackages: ReturnType<typeof normalizePackages> | undefined;
-	if (packages !== undefined) {
+	if (packages !== undefined && packages !== null) {
 		let previousSnapshot = null;
 		if (snapshot === undefined && existing.snapshot) {
 			try {
diff --git a/src/routes/api/configs/[slug]/server.test.ts b/src/routes/api/configs/[slug]/server.test.ts
index 83927e5..7a526c0 100644
--- a/src/routes/api/configs/[slug]/server.test.ts
+++ b/src/routes/api/configs/[slug]/server.test.ts
@@ -425,3 +425,14 @@ describe('package source save round-trip', () => {
 		expect(empty.config.packages).toEqual([]);
 	});
 });
+
+describe('optional package updates', () => {
+	it('retains the software selection when packages is null', async () => {
+		await seed(db, { users: [userRow()], configs: [mockConfig], api_tokens: [mockApiToken] });
+		const updated = await call(PUT, callOpts({ method: 'PUT', token: mockApiToken.token, body: { packages: null } }));
+		expect(updated.status).toBe(200);
+		const read = await call(GET, callOpts({ token: mockApiToken.token }));
+		const data = (await read.json()) as { config: { packages: unknown[] } };
+		expect(data.config.packages).toEqual(JSON.parse(mockConfig.packages));
+	});
+});
diff --git a/src/routes/api/configs/server.test.ts b/src/routes/api/configs/server.test.ts
index 11f0248..57582c2 100644
--- a/src/routes/api/configs/server.test.ts
+++ b/src/routes/api/configs/server.test.ts
@@ -302,3 +302,22 @@ describe('snapshot source normalization', () => {
 		]);
 	});
 });
+
+describe('snapshot-only config creation', () => {
+	it('preserves sources when the software selection is omitted', async () => {
+		await seed(db, { users: [userRow()], api_tokens: [mockApiToken] });
+		const response = await call(POST, {
+			url: baseUrl,
+			method: 'POST',
+			token: mockApiToken.token,
+			body: { name: 'Sources only', snapshot: { packages: { taps: ['example/tools'] } } }
+		});
+		expect(response.status).toBe(201);
+		const created = (await response.json()) as { slug: string };
+		const list = await call(GET, { url: baseUrl, token: mockApiToken.token });
+		const data = (await list.json()) as { configs: { slug: string; packages: { name: string; type: string }[] }[] };
+		expect(data.configs.find((config) => config.slug === created.slug)?.packages).toEqual([
+			{ name: 'example/tools', type: 'tap' }
+		]);
+	});
+});