@avantf/dsh-plugin-base 0.5.1 → 0.5.3

package/README.md

@@ -69,7 +69,7 @@ npm install @avantf/dsh-plugin-base
 
 ```ts
 // ── ① 构建期：把零依赖的 bootstrap 拷进自己的源码树，按相对路径 import ──────────────
-//    cp node_modules/@avantf/dsh-plugin-base/dist/bootstrap.js src/envinit-bootstrap.js
+//    cp node_modules/@avantf/dsh-plugin-base/lib/bootstrap.js src/envinit-bootstrap.js
 //    （有打包步骤时用 ./preset 自动内联，见「运行时装载」。）
 import { loadFramework } from './envinit-bootstrap.js'
 
@@ -229,12 +229,6 @@ framework.createProvisioner({
 })
 ```
 
-清单可以不联网检查：
-
-```bash
-provision lint manifest.json
-```
-
 ### 取用就绪资源
 
 ```ts

package/{dist → lib}/bootstrap.d.ts

@@ -3,7 +3,7 @@
  * @module bootstrap
  */
 /** The bootstrap version; the resolved framework must satisfy {@link supportedRange}. */
-export declare const VERSION = "0.5.1";
+export declare const VERSION = "0.5.3";
 /**
  * The framework interval this bootstrap can launch.
  *

package/{dist → lib}/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,yFAAyF;AACzF,eAAO,MAAM,OAAO,UAAU,CAAA;AAC9B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAI9C,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AA8LD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAoC7G;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAaxG;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,MAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyCnG"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,yFAAyF;AACzF,eAAO,MAAM,OAAO,UAAU,CAAA;AAC9B;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAI9C,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAqOD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAkC7G;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAaxG;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,MAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyCnG"}

package/{dist → lib}/bootstrap.js

@@ -2,12 +2,11 @@
  * Resolve the framework copy the caller's tree already has.
  * @module bootstrap
  */
-import { promises as fsp } from 'node:fs';
-import { createRequire } from 'node:module';
+import { existsSync, promises as fsp, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 /** The bootstrap version; the resolved framework must satisfy {@link supportedRange}. */
-export const VERSION = '0.5.1';
+export const VERSION = '0.5.3';
 /**
  * The framework interval this bootstrap can launch.
  *
@@ -211,6 +210,47 @@ function entryOf(dir, manifest) {
         relative = manifest['main'];
     return join(dir, relative ?? 'index.js');
 }
+/** The name a `package.json` declares, or `undefined`. */
+function manifestName(manifestPath) {
+    try {
+        const parsed = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const name = parsed.name;
+        return typeof name === 'string' ? name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The framework directory, resolved by walking THIS FILE's ancestor chain only.
+ *
+ * WHY THIS DOES NOT USE `createRequire(...).resolve()`. Node falls back to `Module.globalPaths`
+ * when a package is not found under any ancestor's `node_modules`, and `Module.globalPaths` is
+ * seeded from `NODE_PATH` AT PROCESS START (pnpm sets it for every `pnpm run` process, so it
+ * survives deleting the variable at runtime). With that fallback a caller whose own tree has NO
+ * base silently resolved whatever the process environment happened to provide — a copy outside the
+ * plugin's tree, exactly the false green this lookup exists to avoid (`compat.ts`'s
+ * `resolveRuntimeVersion` and `preset.ts`'s `resolveFrameworkDir` record the same trap and walk
+ * the ancestors for the same reason).
+ *
+ * Two answers are legitimate, in walk order: `<dir>/node_modules/<PACKAGE>` (the package manager's
+ * copy) and a `package.json` whose OWN name is the package (self-reference — running from inside
+ * the framework's own tree: a dev checkout, this repo's tests).
+ */
+function resolveFrameworkDir() {
+    let current = dirname(fileURLToPath(import.meta.url));
+    for (;;) {
+        const installed = join(current, 'node_modules', ...PACKAGE.split('/'));
+        if (existsSync(join(installed, 'package.json')))
+            return installed;
+        if (manifestName(join(current, 'package.json')) === PACKAGE)
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
 /**
  * Report the framework copy this caller's tree resolves to, or `undefined` with a warning.
  * Never throws and never installs anything.
@@ -233,11 +273,8 @@ export async function ensureFramework(options) {
             return undefined;
         }
         const supported = options.supportedRange ?? supportedRange;
-        let dir;
-        try {
-            dir = dirname(createRequire(import.meta.url).resolve(`${PACKAGE}/package.json`));
-        }
-        catch {
+        const dir = resolveFrameworkDir();
+        if (dir === undefined) {
             warn(`${PACKAGE} is not installed for this plugin — install it with the package manager (pnpm install)`);
             return undefined;
         }

package/{dist → lib}/compat.d.ts

@@ -202,6 +202,16 @@ export declare function readBuildVersions(buildUrl: string | URL, packages: read
  * @param name - the peer package.
  * @param base - module URL to resolve from (defaults to this package).
  * @returns the version string, or `undefined`.
+ *
+ * WHY THIS DOES NOT USE `require.resolve`. Node falls back to `Module.globalPaths` when a package is
+ * not found under the base's own `node_modules`, and `Module.globalPaths` is seeded from `NODE_PATH`
+ * AT PROCESS START (pnpm sets it for every `pnpm run` process, so it survives deleting the variable at
+ * runtime). With that fallback, a base with no links of its own silently resolved whatever the
+ * WORKSPACE happened to install — but the one question this function answers is "what do THIS caller's
+ * links point at". Found by the suite: `compat_probes.spec.ts`'s "answers undefined for one without
+ * links" passed under bare `vitest` and failed under `pnpm test`, where the base resolved the
+ * workspace's local-build `dsh-tools@0.2.1-rc.2` (measured 2026-10-19). The walk below therefore
+ * visits ONLY the base directory's ancestors and never consults the process-wide path list.
  */
 export declare function resolveRuntimeVersion(name: string, base?: string | URL): string | undefined;
 /**
@@ -405,7 +415,8 @@ export declare function declaredSchemaKeys(packageId: string, names: readonly st
  * dependency and does not know what a scope IS: the value is passed through opaquely, exactly as the
  * caller's own registry expects it. Omitting it keeps the older reading — the second argument is then
  * `undefined`, which any registry that ignores it (every one that existed through v3) treats exactly as
- * it treated the single-argument call.
+ * it treated the single-argument call. The call is made through `Reflect.apply` with the service as
+ * `this`, because a live service's method must not be extracted (see the note at the call site).
  * @param input - the live context, the real tool names, the logger, and the caller's optional scope.
  * @returns the registrations that did not show up (empty on success).
  */

package/{dist → lib}/compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compat.d.ts","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":"AAuCA;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC/D,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAA;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;IACrD,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,eAAe,GAAG,cAAc,CAAA;AAE3G,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,sGAAsG;AACtG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAYpC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,GAAG,EACtB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAepC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,GAAG,GAAqB,GAAG,MAAM,GAAG,SAAS,CAU5G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,YAAY,EAAE,CAsBvG;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAMzD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,qBAAqB,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAA;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,OAAO,CAWrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,GAAG,YAAY,CA4C3G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,GACvD,YAAY,CAoFd;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,GAAE,MAAM,GAAG,GAAqB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAIpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,CAkBnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,cAAc,GAAG,aAAa,CA0GjE;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,aAAa,CAuBhG;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;CACjD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAUR;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB,GAAG,IAAI,CAaP;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0C1C"}
+{"version":3,"file":"compat.d.ts","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":"AAuCA;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC/D,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAA;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;IACrD,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,eAAe,GAAG,cAAc,CAAA;AAE3G,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,sGAAsG;AACtG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAYpC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,GAAG,EACtB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAepC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,GAAG,GAAqB,GAAG,MAAM,GAAG,SAAS,CAqB5G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,YAAY,EAAE,CAsBvG;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAMzD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,qBAAqB,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAA;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,MAAM,OAAO,CAWrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,GAAG,YAAY,CA4C3G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,GACvD,YAAY,CAoFd;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,GAAE,MAAM,GAAG,GAAqB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAIpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,CAkBnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,cAAc,GAAG,aAAa,CA0GjE;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,aAAa,CAuBhG;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAA;CACjD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAUR;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB,GAAG,IAAI,CAaP;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA+C1C"}

package/{dist → lib}/compat.js

@@ -33,8 +33,8 @@
  *
  * @module @avantf/dsh-plugin-base
  */
-import { readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
+import { readFileSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 /**
  * Every line this module logs carries this token, so a support question can be answered
@@ -161,14 +161,37 @@ export function readBuildVersions(buildUrl, packages, fallback = {}) {
  * @param name - the peer package.
  * @param base - module URL to resolve from (defaults to this package).
  * @returns the version string, or `undefined`.
+ *
+ * WHY THIS DOES NOT USE `require.resolve`. Node falls back to `Module.globalPaths` when a package is
+ * not found under the base's own `node_modules`, and `Module.globalPaths` is seeded from `NODE_PATH`
+ * AT PROCESS START (pnpm sets it for every `pnpm run` process, so it survives deleting the variable at
+ * runtime). With that fallback, a base with no links of its own silently resolved whatever the
+ * WORKSPACE happened to install — but the one question this function answers is "what do THIS caller's
+ * links point at". Found by the suite: `compat_probes.spec.ts`'s "answers undefined for one without
+ * links" passed under bare `vitest` and failed under `pnpm test`, where the base resolved the
+ * workspace's local-build `dsh-tools@0.2.1-rc.2` (measured 2026-10-19). The walk below therefore
+ * visits ONLY the base directory's ancestors and never consults the process-wide path list.
  */
 export function resolveRuntimeVersion(name, base = import.meta.url) {
     try {
-        const require = createRequire(base);
-        // Built at runtime so a bundler cannot constant-fold it and resolve at build time.
-        const manifest = require.resolve(`${name}/package.json`);
-        const parsed = JSON.parse(readFileSync(manifest, 'utf8'));
-        return typeof parsed.version === 'string' && parsed.version !== '' ? parsed.version : undefined;
+        const start = typeof base === 'string' && isAbsolute(base)
+            ? dirname(base)
+            : dirname(fileURLToPath(base));
+        for (let dir = resolve(start);; dir = dirname(dir)) {
+            const manifest = join(dir, 'node_modules', name, 'package.json');
+            try {
+                // A directory hit can still be a dangling link; the stat keeps "unknown" honest.
+                if (statSync(manifest).isFile()) {
+                    const parsed = JSON.parse(readFileSync(manifest, 'utf8'));
+                    return typeof parsed.version === 'string' && parsed.version !== '' ? parsed.version : undefined;
+                }
+            }
+            catch {
+                // Not here; keep walking.
+            }
+            if (dirname(dir) === dir)
+                return undefined;
+        }
     }
     catch {
         return undefined;
@@ -724,7 +747,8 @@ export function declaredSchemaKeys(packageId, names) {
  * dependency and does not know what a scope IS: the value is passed through opaquely, exactly as the
  * caller's own registry expects it. Omitting it keeps the older reading — the second argument is then
  * `undefined`, which any registry that ignores it (every one that existed through v3) treats exactly as
- * it treated the single-argument call.
+ * it treated the single-argument call. The call is made through `Reflect.apply` with the service as
+ * `this`, because a live service's method must not be extracted (see the note at the call site).
  * @param input - the live context, the real tool names, the logger, and the caller's optional scope.
  * @returns the registrations that did not show up (empty on success).
  */
@@ -750,11 +774,16 @@ export function verifyRegisteredFaces(input) {
     if (isRecord(tools) && typeof tools['get'] === 'function') {
         for (const name of input.toolNames) {
             try {
-                // The property is read once and called with the caller's scope; a `get` that only accepts one
-                // parameter (every registry v3 and earlier knew) simply ignores the second argument, so the
-                // omitted-scope reading is unchanged.
-                const get = tools['get'];
-                if (get(name, input.scope) === undefined)
+                // The property is read once and APPLIED WITH THE SERVICE AS `this` — the receiver is not
+                // decoration. A live Cordis service hands out PROXIED methods, and the dsh tools registry
+                // implements this one as `this.view(scope).visible.get(name)`: extract the function and call
+                // it bare and `this` is `undefined`, so it throws `Cannot read properties of undefined
+                // (reading 'view')`, falls into the catch below, and EVERY name is reported missing even
+                // though the registry was answering fine. Measured on dsh 0.2.0-rc.2:
+                // `tools.get(n, scope)` resolves while `const g = tools.get; g(n, scope)` throws. A registry
+                // whose `get` ignores the second argument (every generation through v3) is unaffected: the
+                // omitted-scope reading stays the one-argument lookup it always was.
+                if (Reflect.apply(tools['get'], tools, [name, input.scope]) === undefined)
                     missing.push(name);
             }
             catch {

package/{dist → lib}/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../src/lint.ts"],"names":[],"mappings":"AASA,mDAAmD;AACnD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAsF,CAAA;AAEjI,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAiC,CAAA;AAExF,+EAA+E;AAC/E,eAAO,MAAM,mCAAmC,EAAE,SAAS,MAAM,EAMhE,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAoC,CAAA;AAEjF,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAUxC,CAAA;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAGzF;AAED,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CAC1C;AAUD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIpD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAqDD,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAgJ1D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CASzD"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../src/lint.ts"],"names":[],"mappings":"AAWA,mDAAmD;AACnD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAsF,CAAA;AAEjI,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAiC,CAAA;AAExF,+EAA+E;AAC/E,eAAO,MAAM,mCAAmC,EAAE,SAAS,MAAM,EAMhE,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAoC,CAAA;AAEjF,oCAAoC;AACpC,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAUxC,CAAA;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAGzF;AAED,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CAC1C;AAUD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIpD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAqDD,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAgJ1D;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CASzD"}

package/{dist → lib}/lint.js

@@ -1,5 +1,7 @@
 /**
- * `provision lint` — the offline, purely static manifest check.
+ * The envinit manifest's static lint rules: the field tables and shape checks the provisioner reads
+ * at `declare()` time. Internal (`./internal`, no compatibility promise) — the base ships no CLI, so
+ * these are exercised by the framework and its tests, not by an executable entry point.
  * @module lint
  */
 import { ProvisionError } from './errors.js';

package/{dist → lib}/providers/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/providers/model.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAGV,QAAQ,EAOT,MAAM,aAAa,CAAA;AAEpB,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAG7C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,QAAyB,CAAA;AAuBrD;cACc;AACd,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAA;AAY7C,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AA4gBD;sEACsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,QAAQ,CA8GpF"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/providers/model.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAGV,QAAQ,EAOT,MAAM,aAAa,CAAA;AAEpB,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAG7C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,QAAyB,CAAA;AAuBrD;cACc;AACd,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAA;AAY7C,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAilBD;sEACsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,QAAQ,CAyHpF"}

package/{dist → lib}/providers/model.js

@@ -4,7 +4,7 @@
  */
 import { createHash } from 'node:crypto';
 import { once } from 'node:events';
-import { createWriteStream } from 'node:fs';
+import { createReadStream, createWriteStream } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { finished } from 'node:stream/promises';
 import { ProvisionError } from '../errors.js';
@@ -138,6 +138,19 @@ function flatSidecarDir(home, targetRoot, repo) {
 function sha256Hex(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
+/**
+ * sha256 of a file on disk, STREAMED one chunk at a time: `fs.readFile` would hold a 2 GiB model
+ * file entirely in the heap just to hash it, so `verify` used to spike to the file's full size on
+ * every required file. The read goes through `node:fs` for the same reason {@link openBlobSpill}'s
+ * write does — {@link ProvisionFs} has no streaming API and this change must not move the interface
+ * generation; the path has already been vetted by the seam's `stat` before this runs.
+ */
+async function sha256File(path) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest('hex');
+}
 function text(value) {
     return new TextDecoder().decode(value);
 }
@@ -455,8 +468,26 @@ async function writeBlob(fs, blob, bytes) {
         return;
     await fs.atomicWrite(blob, bytes);
 }
-/** Throw a `verify/failed` for the first file that is not provably usable. */
+/**
+ * A `verify/failed` the provider's own `probe` ALSO reports as a miss.
+ *
+ * The distinction decides whether a shared completion marker is withdrawn (see `verify` below): a
+ * missing, empty or directory required file is already a `found: false` for THIS item, so removing
+ * `refs/<revision>` / `record.json` would only force healthy SIBLING items of the same
+ * repo+revision to reinstall. A content mismatch (`verifyCorrupt`) is invisible to the probe's
+ * existence checks and must withdraw it.
+ */
+class ProbeDetectedVerifyFailure extends ProvisionError {
+    constructor(message) {
+        super('verify/failed', message);
+    }
+}
+/** Throw a `verify/failed` for a problem `probe` already reports as a miss. */
 function verifyFailure(message) {
+    throw new ProbeDetectedVerifyFailure(message);
+}
+/** Throw a `verify/failed` only CONTENT inspection can see — the marker must be withdrawn. */
+function verifyCorrupt(message) {
     throw new ProvisionError('verify/failed', message);
 }
 /** Probe the `flat` layout from the sidecar alone: no network, no mutation. */
@@ -505,27 +536,27 @@ async function verifyHub(ctx, item, spec, resolved) {
             verifyFailure(`模型文件是目录 ${file}：${path}`);
         if (info.size === 0)
             verifyFailure(`模型文件为空 ${file}：${path}`);
-        const digest = sha256Hex(await ctx.fs.readFile(path));
+        const digest = await sha256File(path);
         const link = await ctx.fs.readlink(path);
         if (link !== undefined) {
             // The entry resolves into blobs, so the read above already proved the blob's bytes.
             const target = resolve(dirname(path), link);
             if (!isInside(blobs, target))
-                verifyFailure(`模型文件的链接指向 blobs 之外：${path}`);
+                verifyCorrupt(`模型文件的链接指向 blobs 之外：${path}`);
             const named = basename(target);
             if (!BLOB_PATTERN.test(named))
-                verifyFailure(`模型文件的链接目标名不是 sha256：${path}`);
+                verifyCorrupt(`模型文件的链接目标名不是 sha256：${path}`);
             if (digest !== named)
-                verifyFailure(`模型文件内容与 blob 名不符 ${file}：${path}`);
+                verifyCorrupt(`模型文件内容与 blob 名不符 ${file}：${path}`);
             continue;
         }
         // A real-file fallback carries no expectation; the blob named by its digest must exist intact.
         const blobPath = join(blobs, digest);
         const blobInfo = await ctx.fs.stat(blobPath);
         if (blobInfo === undefined || blobInfo.isDirectory || blobInfo.size === 0)
-            verifyFailure(`blob 缺失或为空：${blobPath}`);
-        if (sha256Hex(await ctx.fs.readFile(blobPath)) !== digest)
-            verifyFailure(`blob 内容与名字不符：${blobPath}`);
+            verifyCorrupt(`blob 缺失或为空：${blobPath}`);
+        if ((await sha256File(blobPath)) !== digest)
+            verifyCorrupt(`blob 内容与名字不符：${blobPath}`);
     }
 }
 /** Prove every required `flat` entry matches its recorded digest or the blob its link names. */
@@ -549,23 +580,62 @@ async function verifyFlat(ctx, item, spec) {
             verifyFailure(`模型文件是目录 ${file}：${path}`);
         if (info.size === 0)
             verifyFailure(`模型文件为空 ${file}：${path}`);
-        const digest = sha256Hex(await ctx.fs.readFile(path));
+        const digest = await sha256File(path);
         const link = await ctx.fs.readlink(path);
         if (link !== undefined) {
             // The entry resolves into the sidecar, so the read above already proved the blob's bytes.
             const target = resolve(dirname(path), link);
             if (!isInside(blobs, target))
-                verifyFailure(`模型文件的链接指向 blobs 之外：${path}`);
+                verifyCorrupt(`模型文件的链接指向 blobs 之外：${path}`);
             const named = basename(target);
             if (!BLOB_PATTERN.test(named))
-                verifyFailure(`模型文件的链接目标名不是 sha256：${path}`);
+                verifyCorrupt(`模型文件的链接目标名不是 sha256：${path}`);
             if (digest !== named)
-                verifyFailure(`模型文件内容与 blob 名不符 ${file}：${path}`);
+                verifyCorrupt(`模型文件内容与 blob 名不符 ${file}：${path}`);
         }
         // A names-only record cannot prove content; a recorded digest always can.
         const expected = digests[file];
         if (expected !== undefined && digest !== expected)
-            verifyFailure(`模型文件内容与 record.json 不符 ${file}：${path}`);
+            verifyCorrupt(`模型文件内容与 record.json 不符 ${file}：${path}`);
+    }
+}
+/**
+ * Withdraw the completion marker — `refs/<revision>` (hub) or `record.json` (flat) — after a
+ * CONTENT failure that `probe` cannot see. The core does not quarantine this kind's `dir`: it is
+ * the shared `snapshots/<sha>` / data directory that `refs/<revision>` and every sibling item of
+ * the same repo+sha point at, so renaming it would dangle the ref and fail healthy items with the
+ * broken one (see `provisioner.ts`'s `ensureOne`). The marker is the only state that says
+ * "installed", so dropping it makes the next `probe` a miss and the next `ensure` reinstall,
+ * while the snapshot/blobs stay for everyone else.
+ *
+ * The marker is SHARED by every item of the same repo+revision, which is why `verify` only calls
+ * this for corruption (`verifyCorrupt`) and not for a missing/empty file that this item's own probe
+ * already reports. The marker is re-read before removal and only dropped when it still names the
+ * sha THIS install wrote: a concurrent installer of another revision may already have replaced it,
+ * and its marker is not ours to withdraw. Best-effort throughout — the verify failure is the report.
+ */
+async function withdrawMarker(ctx, item, spec, resolved) {
+    try {
+        if (layoutOf(spec) === FLAT_LAYOUT) {
+            const recordPath = join(flatSidecarDir(ctx.home, item.target.root, spec.repo), RECORD_FILE);
+            let record;
+            try {
+                record = decodeRecord(await ctx.fs.readFile(recordPath));
+            }
+            catch {
+                record = undefined;
+            }
+            if (record !== undefined && record.sha === resolved.version)
+                await ctx.fs.rm(recordPath);
+            return;
+        }
+        const refPath = join(hubRoot(ctx.home, item.target.root, spec.repo), 'refs', spec.revision ?? DEFAULT_REVISION);
+        const recorded = text(await ctx.fs.readFile(refPath)).trim();
+        if (recorded === resolved.version)
+            await ctx.fs.rm(refPath);
+    }
+    catch {
+        // A marker that cannot be read or removed changes nothing about the failure being reported.
     }
 }
 /** Build the built-in model-cache provider. */
@@ -668,9 +738,22 @@ export function modelCacheProvider(options = {}) {
         },
         async verify(item, resolved, ctx) {
             const spec = parseSpec(item);
-            if (layoutOf(spec) === FLAT_LAYOUT)
-                return verifyFlat(ctx, item, spec);
-            return verifyHub(ctx, item, spec, resolved);
+            try {
+                if (layoutOf(spec) === FLAT_LAYOUT)
+                    return await verifyFlat(ctx, item, spec);
+                return await verifyHub(ctx, item, spec, resolved);
+            }
+            catch (error) {
+                // This kind bypasses `publish()`, so the core will not quarantine the failed directory.
+                // A CONTENT failure is invisible to `probe`'s existence checks, so the shared marker must
+                // go or the broken copy keeps answering present. A failure the probe already detects
+                // (`ProbeDetectedVerifyFailure`: missing/empty/directory) must NOT withdraw it:
+                // that marker is shared by every item of the same repo+revision, and the failing item is a
+                // miss on its own next probe — removing it would only make healthy siblings reinstall.
+                if (!(error instanceof ProbeDetectedVerifyFailure))
+                    await withdrawMarker(ctx, item, spec, resolved);
+                throw error;
+            }
         },
     };
 }

package/{dist → lib}/providers/npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/providers/npm.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA+B,QAAQ,EAAuE,MAAM,aAAa,CAAA;AAE7I,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAM7C,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC1G;AA4KD;;;iGAGiG;AACjG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAgB,GAAG,MAAM,GAAG,SAAS,CAS7H;AAgID,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CAqKnF"}
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/providers/npm.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA+B,QAAQ,EAAuE,MAAM,aAAa,CAAA;AAE7I,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAM7C,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC1G;AA+KD;;;iGAGiG;AACjG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAgB,GAAG,MAAM,GAAG,SAAS,CAS7H;AAgID,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CAqKnF"}

package/{dist → lib}/providers/npm.js

@@ -68,6 +68,10 @@ async function download(ctx, urls, integrity) {
             bytes = await readCapped(response, DEFAULT_MAX_BYTES);
         }
         catch (error) {
+            // Crossing the byte cap is terminal: every mirror serves the same oversized object, so the
+            // remaining candidates are not tried (same rule as `providers/model.ts` and `net.ts`).
+            if (error instanceof ProvisionError && error.code === 'fetch/too-large')
+                throw error;
             problems.push(`${url} → ${error instanceof Error ? error.message : String(error)}`);
             continue;
         }

package/{dist → lib}/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,SAAS,EACT,KAAK,EAeL,aAAa,EAMb,WAAW,EAEX,kBAAkB,EAMnB,MAAM,YAAY,CAAA;AAEnB,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAA6C,CAAA;AAEvF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAepC,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACtB;AAED;;;iFAGiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAKvF;AA0DD;cACc;AACd,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAk+B1E"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,SAAS,EACT,KAAK,EAeL,aAAa,EAMb,WAAW,EAEX,kBAAkB,EAMnB,MAAM,YAAY,CAAA;AAEnB,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAA6C,CAAA;AAEvF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAepC,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACtB;AAED;;;iFAGiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAKvF;AA0DD;cACc;AACd,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAs/B1E"}

package/{dist → lib}/provisioner.js

@@ -200,38 +200,48 @@ export function createProvisioner(options) {
     const listeners = new Set();
     /** Layout read-only state, decided once per process. */
     let readOnly;
-    let homeChecked = false;
+    /**
+     * The in-flight (then settled) home verdict. Every caller awaits the SAME promise, so a
+     * concurrent `declare`/`ensure` cannot slip past the gate while `readLayout` is still deciding:
+     * the old boolean was set BEFORE the await, so a second caller returned early with `readOnly`
+     * still unset and `ensureOne` then wrote into a too-new/mismatched home. The promise is never
+     * re-created — the verdict is once-per-process, and a rejection is part of the verdict: the body
+     * already folds ordinary IO failures into a `layout/unreadable` read-only code, so a promise
+     * that still rejects is not something a silent retry is expected to fix, and later callers
+     * observe the same failure rather than racing the home again.
+     */
+    let homePromise;
     const pendingDeclared = [];
     /** Decide the home's layout once. */
-    const checkHome = async () => {
-        if (homeChecked)
-            return;
-        homeChecked = true;
-        if (unsupported !== undefined && !unsupportedWarned) {
-            unsupportedWarned = true;
-            logger.warn(`unsupported-envinit: 本副本 ${FRAMEWORK_VERSION} 不满足插件声明的区间 "${String(options.envinitRange)}"；跳过该清单、降级挂载`);
-        }
-        try {
-            const result = await readLayout(fs, home, layout);
-            if (result.kind === 'none') {
-                await writeLayout(fs, home, layout, 'dsh-plugin-base');
+    const checkHome = () => {
+        homePromise ??= (async () => {
+            if (unsupported !== undefined && !unsupportedWarned) {
+                unsupportedWarned = true;
+                logger.warn(`unsupported-envinit: 本副本 ${FRAMEWORK_VERSION} 不满足插件声明的区间 "${String(options.envinitRange)}"；跳过该清单、降级挂载`);
             }
-            else if (result.kind === 'too-new') {
-                readOnly = 'layout/too-new';
-                logger.warn(`layout/too-new: ${home} 由更新的布局写入；本次只读不写`);
+            try {
+                const result = await readLayout(fs, home, layout);
+                if (result.kind === 'none') {
+                    await writeLayout(fs, home, layout, 'dsh-plugin-base');
+                }
+                else if (result.kind === 'too-new') {
+                    readOnly = 'layout/too-new';
+                    logger.warn(`layout/too-new: ${home} 由更新的布局写入；本次只读不写`);
+                }
+                else if (result.kind === 'mismatch') {
+                    readOnly = 'layout/mismatch';
+                    logger.warn(`layout/mismatch: ${home} 的布局是 "${result.file.layout}"，本次是 "${layout}"；本次只读不写`);
+                }
             }
-            else if (result.kind === 'mismatch') {
-                readOnly = 'layout/mismatch';
-                logger.warn(`layout/mismatch: ${home} 的布局是 "${result.file.layout}"，本次是 "${layout}"；本次只读不写`);
+            catch (error) {
+                // A read failure keeps the read-only CONSEQUENCE but gets its own code: every item's report
+                // would otherwise say `layout/too-new` — "a NEWER layout wrote this, leave it alone" — about a
+                // home whose layout nobody managed to read at all.
+                logger.warn(`layout: 无法读写 .layout.json（${reasonOf(error).message}）；按只读继续`);
+                readOnly = 'layout/unreadable';
             }
-        }
-        catch (error) {
-            // A read failure keeps the read-only CONSEQUENCE but gets its own code: every item's report
-            // would otherwise say `layout/too-new` — "a NEWER layout wrote this, leave it alone" — about a
-            // home whose layout nobody managed to read at all.
-            logger.warn(`layout: 无法读写 .layout.json（${reasonOf(error).message}）；按只读继续`);
-            readOnly = 'layout/unreadable';
-        }
+        })();
+        return homePromise;
     };
     /**
      * The failure a persisted row should carry: an explicit `lastError` if something ever sets one,
@@ -687,6 +697,8 @@ export function createProvisioner(options) {
             return settle(declared, started, 'skipped', 'policy/offline');
         const staging = stagingDir(home, item.id, (stagingSequence += 1));
         let published;
+        /** Set only when the core's own `publish()` placed the directory — see the catch below. */
+        let corePublished;
         const installCtx = {
             ...ctx,
             stage: async () => {
@@ -696,6 +708,7 @@ export function createProvisioner(options) {
             publish: async (dir, meta) => {
                 const resolved = await publish(declared, dir, meta);
                 published = resolved;
+                corePublished = resolved;
                 return resolved;
             },
             ...(onProgress === undefined
@@ -735,14 +748,20 @@ export function createProvisioner(options) {
         }
         catch (error) {
             const { code, message } = reasonOf(error);
-            // A published-but-unusable directory is quarantined, never deleted.
-            if (published !== undefined) {
+            // A published-but-unusable directory is quarantined, never deleted — but ONLY a directory the
+            // core itself published through `ctx.publish()`. A provider that bypasses `publish()`
+            // (`model-cache`, whose `dir` is the shared `snapshots/<sha>` that `refs/<revision>` and every
+            // sibling item of the same repo+sha point at) manages its own storage: renaming that directory
+            // here would dangle the ref and take healthy sibling items down with the failed one. Such a
+            // provider withdraws its own completion marker on verify failure instead (see
+            // `providers/model.ts`), which keeps the next `probe` honest without touching shared state.
+            if (corePublished !== undefined) {
                 try {
-                    await quarantineLocked(published.dir);
-                    logger.warn(`quarantined ${published.dir}: ${message}`);
+                    await quarantineLocked(corePublished.dir);
+                    logger.warn(`quarantined ${corePublished.dir}: ${message}`);
                 }
                 catch (renameError) {
-                    logger.warn(`could not quarantine ${published.dir}: ${reasonOf(renameError).message}`);
+                    logger.warn(`could not quarantine ${corePublished.dir}: ${reasonOf(renameError).message}`);
                 }
             }
             const state = { state: 'failed', code, detail: message };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avantf/dsh-plugin-base",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "The @avantf family base for DSH plugins: startup environment initialisation (declare → probe → fetch → verify → report) plus the host compatibility gate (provision / verdictOf / probes / report / post-registration verification). One package, loaded by the plugins through the inlined bootstrap.",
   "keywords": [
     "dsh",
@@ -19,48 +19,45 @@
   },
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
     },
     "./bootstrap": {
-      "types": "./dist/bootstrap.d.ts",
-      "default": "./dist/bootstrap.js"
+      "types": "./lib/bootstrap.d.ts",
+      "default": "./lib/bootstrap.js"
     },
     "./preset": {
-      "types": "./dist/preset.d.ts",
-      "default": "./dist/preset.js"
+      "types": "./lib/preset.d.ts",
+      "default": "./lib/preset.js"
     },
     "./conformance": {
-      "types": "./dist/conformance.d.ts",
-      "default": "./dist/conformance.js"
+      "types": "./lib/conformance.d.ts",
+      "default": "./lib/conformance.js"
     },
     "./internal": {
-      "types": "./dist/internal.d.ts",
-      "default": "./dist/internal.js"
+      "types": "./lib/internal.d.ts",
+      "default": "./lib/internal.js"
     },
     "./compat": {
-      "types": "./dist/compat.d.ts",
-      "default": "./dist/compat.js"
+      "types": "./lib/compat.d.ts",
+      "default": "./lib/compat.js"
     },
     "./package.json": "./package.json"
   },
   "files": [
-    "dist",
-    "!dist/*.js.map",
-    "!dist/**/*.js.map"
+    "lib",
+    "!lib/*.js.map",
+    "!lib/**/*.js.map"
   ],
   "sideEffects": false,
   "peerDependencies": {
     "zod": ">=4.4.3 <5"
   },
-  "bin": {
-    "provision": "./dist/cli.js"
-  },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.5.0",
     "vitest": "^2.1.0",
-    "zod": "4.6.5"
+    "zod": "4.4.3"
   },
   "license": "MIT",
   "publishConfig": {
@@ -69,16 +66,20 @@
   },
   "repository": {
     "type": "git",
-    "url": "git@gitee.com:ffeng86/dsh-plugins.git",
-    "directory": "base/plugin-base"
+    "url": "git@gitee.com:ffeng86/dsh-plugin-base.git"
   },
   "author": "qunqi.ff",
   "scripts": {
+    "setup": "pnpm install --frozen-lockfile --ignore-scripts --config.strictDepBuilds=false",
+    "compile": "pnpm build",
     "build": "tsc -p tsconfig.json",
     "typecheck": "node scripts/link-dsh.mjs && tsc -p tsconfig.test.json",
     "test": "node scripts/link-dsh.mjs && vitest run",
     "check": "pnpm typecheck && pnpm test",
     "pack": "node scripts/pack.mjs",
-    "release:check": "node scripts/release-check.mjs"
+    "release:check": "node scripts/release-check.mjs",
+    "version:check": "node scripts/version.mjs check",
+    "version:set": "node scripts/version.mjs set",
+    "version:prune": "node scripts/version.mjs prune"
   }
 }

package/dist/cli.d.ts

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-/** Run the CLI and return the process exit code: 0 ok, 1 lint findings, 2 usage/IO error. */
-export declare function main(argv: readonly string[]): Promise<number>;
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAUA,6FAA6F;AAC7F,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBnE"}

package/dist/cli.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-/**
- * `provision` CLI — the offline `provision lint` command.
- * @module cli
- */
-import { readFile } from 'node:fs/promises';
-import { lintManifestText } from './lint.js';
-const USAGE = '用法：provision lint <manifest.json>';
-/** Run the CLI and return the process exit code: 0 ok, 1 lint findings, 2 usage/IO error. */
-export async function main(argv) {
-    const [command, file] = argv;
-    if (command !== 'lint' || file === undefined) {
-        process.stderr.write(`${USAGE}\n`);
-        return 2;
-    }
-    let text;
-    try {
-        text = await readFile(file, 'utf8');
-    }
-    catch (error) {
-        process.stderr.write(`无法读取 ${file}：${error instanceof Error ? error.message : String(error)}\n`);
-        return 2;
-    }
-    const result = lintManifestText(text);
-    for (const finding of result.findings) {
-        const where = finding.itemId === undefined ? '' : `${finding.itemId}: `;
-        process.stdout.write(`${where}[${finding.rule}] ${finding.message}\n`);
-    }
-    if (result.ok) {
-        process.stdout.write('provision lint: ok\n');
-        return 0;
-    }
-    process.stderr.write(`provision lint: ${String(result.findings.length)} 个问题\n`);
-    return 1;
-}
-process.exitCode = await main(process.argv.slice(2));
-//# sourceMappingURL=cli.js.map