@deepseek-ai/dsh-app-boot 0.1.5-rc.2 → 0.1.6-alpha.2

package/lib/index.js

@@ -1,8 +1,8 @@
-import { createRequire } from "node:module";
+import { createRequire, isBuiltin } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { parseEnv } from "node:util";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import * as yaml from "js-yaml";
 import { Context, Service } from "@deepseek-ai/cordis";
 import Loader, { EntryGroup, EntryTree, isJsExpr } from "@deepseek-ai/cordis-plugin-loader";
@@ -12,7 +12,8 @@ import Group from "@deepseek-ai/cordis-plugin-group";
 import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createLaunchEnvironmentSnapshot } from "@deepseek-ai/dsh-launch-environment";
 import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
-import { resolve as resolve$1 } from "resolve.exports";
+import { imports, resolve as resolve$1 } from "resolve.exports";
+import { getEnvironmentData, setEnvironmentData } from "node:worker_threads";
 //#region ../../../vendor/include/src/index.ts
 const JsExpr = new yaml.Type("tag:yaml.org,2002:js", {
 	kind: "scalar",
@@ -45,8 +46,7 @@ function retryableWriteError(error) {
 * Apply patch lists to an entry list — THE patch semantics of this include,
 * shared by mounting (`applyPatches`) and offline config tooling
 * (`dsh --dump-config`) so a dump can never drift from what boots. The input
-* is never mutated and the result is always detached from it (even with no
-* patches): patching or mounting shared entry objects would bake earlier
+* is never mutated: patching shared entry objects would bake earlier patch
 * values into the cached parse, so repeated application (config hot-reloads)
 * could never revert a removed or changed patch. Inserted entries are indexed
 * as they are added, so a later patch in the same list can target a row an
@@ -57,8 +57,8 @@ function retryableWriteError(error) {
 * @returns a detached entry list with every applicable patch applied.
 */
 function applyEntryPatches(data, patches, warn) {
+	if (!patches?.length) return [...data];
 	data = structuredClone(data);
-	if (!patches?.length) return data;
 	const entryMap = /* @__PURE__ */ new Map();
 	const buildMap = (entries) => {
 		for (const entry of entries) {
@@ -106,14 +106,6 @@ function applyEntryPatches(data, patches, warn) {
 	}
 	return data;
 }
-var ConfigFileError = class extends Error {
-	stage;
-	constructor(stage, path, cause) {
-		super(`failed to ${stage} config file ${path}`, { cause });
-		this.stage = stage;
-		this.name = "ConfigFileError";
-	}
-};
 /** Loader entry tree backed by a YAML or JSON file. */
 var Include = class extends EntryTree {
 	config;
@@ -127,7 +119,6 @@ var Include = class extends EntryTree {
 	writeTask;
 	pendingWrite;
 	writeQueue = Promise.resolve();
-	applyQueue = Promise.resolve();
 	constructor(ctx, config) {
 		super(ctx);
 		this.config = config;
@@ -138,29 +129,15 @@ var Include = class extends EntryTree {
 		this.type = writable[ext];
 		this.readonly = !this.type;
 		this.ctx.baseUrl = new URL(".", pathToFileURL(this.filename)).href;
-		ctx.on("internal/update", async (config, _, next) => {
+		ctx.on("internal/update", (config, _, next) => {
 			if (config.path !== this.config.path) return next();
-			await this.enqueue(async () => {
-				const data = this.applyPatches(this.data, config.patches);
-				await this.root.update(data);
-				this.config = config;
+			this.config = config;
+			this.root.update(this.applyPatches(this.data, config.patches)).catch((error) => {
+				this.ctx.logger.warn("config update at %C failed", this.filename);
+				this.ctx.logger.warn(error);
 			});
 		});
 	}
-	/**
-	* Serialize one child-tree mutation behind every earlier one. The group's
-	* transactional `update` is not reentrant: two concurrent applies (the init
-	* apply racing an HMR-triggered refresh from the watcher's initial scan)
-	* interleave create and rollback on the same entries and strand the include
-	* fiber without settling, so every apply path funnels through this queue.
-	* A predecessor's failure is its own caller's outcome and never gates the
-	* next task.
-	*/
-	enqueue(task) {
-		const run = this.applyQueue.then(task, task);
-		this.applyQueue = run.then(() => {}, () => {});
-		return run;
-	}
 	async checkAccess() {
 		if (!this.type) return;
 		try {
@@ -170,77 +147,63 @@ var Include = class extends EntryTree {
 		}
 	}
 	async read(forced = false) {
-		let content;
-		try {
-			content = await readFile(this.filename, "utf8");
-		} catch (error) {
-			throw new ConfigFileError("read", this.filename, error);
-		}
-		if (!forced && this.content === content) return;
+		const content = await readFile(this.filename, "utf8");
+		if (!forced && this.content === content) return false;
 		let data;
-		try {
-			if (this.type === "application/yaml") data = yaml.load(content, { schema });
-			else if (this.type === "application/json") data = JSON.parse(content);
-			else {
-				const module = await import(
-					/* @vite-ignore */
-					this.filename
+		if (this.type === "application/yaml") data = yaml.load(content, { schema: entryListSchema });
+		else if (this.type === "application/json") data = JSON.parse(content);
+		else {
+			const module = await import(
+				/* @vite-ignore */
+				this.filename
 );
-				data = module.default || module;
-			}
-		} catch (error) {
-			throw new ConfigFileError("parse", this.filename, error);
+			data = module.default || module;
 		}
-		if (!Array.isArray(data)) throw new ConfigFileError("validate", this.filename, /* @__PURE__ */ new TypeError("config file must be a top-level array"));
-		return {
-			content,
-			data
-		};
+		if (!Array.isArray(data)) throw new TypeError(`config file must be a top-level array of entries: ${this.filename}`);
+		this.content = content;
+		this.data = data;
+		await this.checkAccess();
+		return true;
 	}
-	applyPatches(data, patches) {
+	applyPatches(data, patches = this.config.patches) {
 		return applyEntryPatches(data, patches, (message, ...args) => {
 			this.ctx.root.logger?.("loader").warn(message, ...args);
 		});
 	}
 	async *[Service.init]() {
-		let candidate;
 		try {
-			candidate = await this.read(true);
+			await this.read();
 		} catch (error) {
-			if (!(error instanceof ConfigFileError) || error.stage !== "read" || error.cause?.code !== "ENOENT") throw error;
+			if (error?.code !== "ENOENT") throw error;
 			if (this.config.initial) {
 				await this._writeFile(this.config.initial);
-				candidate = await this.read(true);
+				await this.read(true);
 			} else throw new Error(`config file not found: ${this.filename}`);
 		}
 		yield () => this.stop();
-		await this.apply(candidate);
+		await this.root.update(this.applyPatches(this.data));
 	}
 	async stop() {
-		await this.root.stop();
-		await this.flushWrite();
+		try {
+			await this.flushWrite();
+		} finally {
+			this.root.stop();
+			await this.flushWrite();
+		}
 	}
 	/**
-	* Re-read the file and transactionally refresh child entries when content changed.
-	* @returns a promise resolving after the new tree commits, or immediately when unchanged.
-	* @throws when reading, parsing, validation, application, or rollback fails; the last good tree remains active when rollback succeeds.
+	* Re-read the file and refresh child entries when content changed. An
+	* unreadable or unparsable file logs a warning and keeps the last good
+	* tree: a hot-reload of a live app must never take the process down.
 	*/
 	async refresh() {
-		await this.enqueue(async () => {
-			const candidate = await this.read();
-			if (!candidate) return;
-			await this._apply(candidate);
-		});
-	}
-	apply(candidate) {
-		return this.enqueue(() => this._apply(candidate));
-	}
-	async _apply(candidate) {
-		const data = this.applyPatches(candidate.data, this.config.patches);
-		await this.root.update(data);
-		this.content = candidate.content;
-		this.data = candidate.data;
-		await this.checkAccess();
+		try {
+			if (!await this.read()) return;
+			await this.root.update(this.applyPatches(this.data));
+		} catch (error) {
+			this.ctx.logger.warn("config reload at %C failed; keeping the running tree", this.filename);
+			this.ctx.logger.warn(error);
+		}
 	}
 	async _writeFile(config) {
 		if (this.readonly) throw new Error(`cannot overwrite readonly config`);
@@ -283,6 +246,70 @@ var Include = class extends EntryTree {
 	}
 };
 //#endregion
+//#region lib/types/profile-resolution/legacy-links.js
+/** Legacy profile-link inspection shared by the disk materializer and runtime resolver. */
+/** Profile-private package links projected into its pnpm-managed node_modules. */
+const PROFILE_MODULE_FALLBACK_DIR = ".dsh-module-fallback";
+/**
+* Return whether the process reads application modules from pkg's virtual filesystem.
+* @returns whether pkg owns the module filesystem.
+*/
+function isPackagedExecutable() {
+	return process.pkg !== void 0;
+}
+/**
+* Resolve a directory through the active carrier's filesystem implementation.
+* @param path - directory path to canonicalize.
+* @returns the canonical directory path.
+*/
+function realModuleDirectory(path) {
+	return isPackagedExecutable() ? realpathSync(path) : realpathSync.native(path);
+}
+/**
+* Resolve a link target without following the final path component.
+* @param path - candidate path whose parent is canonicalized.
+* @returns the canonical candidate, or undefined when its parent is absent.
+*/
+function canonicalLinkPath(path) {
+	try {
+		return join(realModuleDirectory(dirname(path)), basename(path));
+	} catch (error) {
+		/* v8 ignore next 2 -- a non-ENOENT realpath failure requires a host filesystem fault */
+		if (error.code === "ENOENT") return void 0;
+		/* v8 ignore next -- see the host-filesystem exception above */
+		throw error;
+	}
+}
+/**
+* Return whether a symlink or junction points at the same path as `target`.
+* @param link - symlink or junction to inspect.
+* @param target - expected target path.
+* @returns whether both paths identify the same entry.
+*/
+function symlinkPointsTo(link, target) {
+	const canonicalActual = canonicalLinkPath(resolve(dirname(link), readlinkSync(link)));
+	const canonicalTarget = canonicalLinkPath(resolve(target));
+	return canonicalActual !== void 0 && canonicalActual === canonicalTarget;
+}
+/**
+* Return whether an observed profile package must not claim local precedence.
+* @param profileDir - profile directory containing the package projection.
+* @param packageName - bare package name to inspect.
+* @returns whether the entry is a managed fallback link or disappeared during inspection.
+*/
+function isProfileModuleFallbackLink(profileDir, packageName) {
+	const link = join(profileDir, "node_modules", packageName);
+	const target = join(profileDir, PROFILE_MODULE_FALLBACK_DIR, "node_modules", packageName);
+	try {
+		return lstatSync(link).isSymbolicLink() && symlinkPointsTo(link, target);
+	} catch (error) {
+		/* v8 ignore next 2 -- a vanished candidate cannot claim local precedence */
+		if (error.code === "ENOENT") return true;
+		/* v8 ignore next -- non-ENOENT lstat/readlink failures require a host filesystem fault */
+		throw error;
+	}
+}
+//#endregion
 //#region lib/types/profile.js
 /**
 * Profile discovery, initialization, and patch-layer composition for the
@@ -312,8 +339,6 @@ var Include = class extends EntryTree {
 const PROFILES_DIR = "profiles";
 /** The user patch layer inside a profile directory (hot-reloaded on long-lived surfaces). */
 const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
-/** Profile-private package links projected into its pnpm-managed node_modules. */
-const PROFILE_MODULE_FALLBACK_DIR = ".dsh-module-fallback";
 /**
 * Resolve a profile's directory under the Harness home.
 * @param name - the profile name (`dsh --profile <name>`).
@@ -326,26 +351,11 @@ function resolveProfileDir(name, home = resolveDshHome()) {
 }
 /** The shipped profile templates auto-initialized on first use, by name. */
 const PROFILE_TEMPLATES = {
-	acp: {
-		bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-acp-app"],
-		patchReload: "startup"
-	},
-	web: {
-		bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"],
-		patchReload: "live"
-	},
-	headless: {
-		bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-headless"],
-		patchReload: "startup"
-	},
-	sdk: {
-		bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-sdk-app"],
-		patchReload: "startup"
-	},
-	"sdk-minimal": {
-		bundles: ["@deepseek-ai/dsh-sdk-minimal"],
-		patchReload: "startup"
-	}
+	acp: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-acp-app"] },
+	web: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"] },
+	headless: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-headless"] },
+	sdk: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-sdk-app"] },
+	"sdk-minimal": { bundles: ["@deepseek-ai/dsh-sdk-minimal"] }
 };
 /** Installation-owned bundle tuples normalized to the shipped template. */
 const INSTALLATION_OWNED_PROFILE_TUPLES = { headless: [
@@ -355,8 +365,13 @@ const INSTALLATION_OWNED_PROFILE_TUPLES = { headless: [
 ] };
 /** The bundle list a `dsh plugin` init uses for a name with no shipped template. */
 const DEFAULT_PROFILE_BUNDLES = ["@deepseek-ai/dsh-base"];
-/** Custom profiles retain the historical live patch-file behavior. */
-const DEFAULT_PROFILE_PATCH_RELOAD = "live";
+/**
+* The bundles the dsh installation ships for a person to switch on: each a
+* runtime dependency of the installation that declares `dsh.bundle.patch`,
+* selected by no shipped template, and offered switched off by the plugin
+* manager ([rationale](../../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)).
+*/
+const OPTIONAL_BUNDLES = ["@deepseek-ai/dsh-experimental-agent-team-profile", "@deepseek-ai/dsh-experimental-agent-team-web-profile"];
 const PROFILE_PATCH_TEMPLATE = `# Your patch layer for this dsh profile, applied after every bundle layer:
 # a top-level YAML array of loader patch entries (id-targeted config
 # overrides, disables, and insert lists; \`!!js\` expressions allowed).
@@ -374,9 +389,8 @@ autoInstallPeers: false
 * so re-running is a no-op on an initialized profile.
 * @param dir - the profile directory from {@link resolveProfileDir}.
 * @param bundles - the initial `dsh.profile.bundles` layer list.
-* @param patchReload - user patch-file lifecycle; custom profiles default to live reload.
 */
-function initProfile(dir, bundles, patchReload = DEFAULT_PROFILE_PATCH_RELOAD) {
+function initProfile(dir, bundles) {
 	mkdirSync(dir, { recursive: true });
 	const manifestPath = join(dir, "package.json");
 	if (!existsSync(manifestPath)) {
@@ -384,10 +398,7 @@ function initProfile(dir, bundles, patchReload = DEFAULT_PROFILE_PATCH_RELOAD) {
 			name: `dsh-profile-${basename(dir)}`,
 			private: true,
 			dependencies: {},
-			dsh: { profile: {
-				bundles: [...bundles],
-				patchReload
-			} }
+			dsh: { profile: { bundles: [...bundles] } }
 		};
 		writeFileSync(manifestPath, JSON.stringify(manifest, void 0, 2) + "\n");
 	}
@@ -429,23 +440,6 @@ function ensureSymlink(link, target) {
 		if (error.code !== "EEXIST" || !lstatSync(link).isSymbolicLink() || !symlinkPointsTo(link, target)) throw error;
 	}
 }
-/** Resolve a link target without following the final path component. */
-function canonicalLinkPath(path) {
-	try {
-		return join(realpathSync.native(dirname(path)), basename(path));
-	} catch (error) {
-		/* v8 ignore next 2 -- a non-ENOENT realpath failure requires a host filesystem fault */
-		if (error.code === "ENOENT") return void 0;
-		/* v8 ignore next -- see the host-filesystem exception above */
-		throw error;
-	}
-}
-/** Return whether a symlink or junction points at the same path as `target`. */
-function symlinkPointsTo(link, target) {
-	const canonicalActual = canonicalLinkPath(resolve(dirname(link), readlinkSync(link)));
-	const canonicalTarget = canonicalLinkPath(resolve(target));
-	return canonicalActual !== void 0 && canonicalActual === canonicalTarget;
-}
 /** Add one profile-owned fallback link without replacing a pnpm-managed entry. */
 function ensureProfileSymlink(link, target) {
 	try {
@@ -481,10 +475,6 @@ function removeProfileSymlink(profileModulesDir, ownedModulesDir, packageName) {
 		if (error.code !== "ENOENT") throw error;
 	}
 }
-/** Return whether the process reads application modules from pkg's virtual filesystem. */
-function isPackagedExecutable() {
-	return process.pkg !== void 0;
-}
 /** Resolve one available explicit package export under Node ESM import conditions. */
 function packageEntryFromPackage(packageName, packageDir, declared, subpath) {
 	let candidates;
@@ -586,11 +576,17 @@ function profileDependencyNames(manifest) {
 	return [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.peerDependencies ?? {})];
 }
 /** Resolve the installation generation that every profile must find through the fallback directory. */
-function resolveModuleFallbackEntries(installAnchor) {
+function resolveModuleFallbackEntries(installAnchor, materialize = true) {
 	const appManifest = readModuleFallbackManifest(installAnchor);
 	const links = /* @__PURE__ */ new Map();
+	const declarers = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
 	/* v8 ignore next -- a real app manifest always declares its name */
-	if (appManifest.name !== void 0) links.set(appManifest.name, dirname(installAnchor));
+	if (appManifest.name !== void 0) {
+		links.set(appManifest.name, dirname(installAnchor));
+		declarers.set(appManifest.name, installAnchor);
+		versions.set(appManifest.name, appManifest.version);
+	}
 	const queue = [{
 		anchor: installAnchor,
 		manifest: appManifest
@@ -602,14 +598,17 @@ function resolveModuleFallbackEntries(installAnchor) {
 		const dir = packageDirFromAnchor(next.anchor, dep);
 		if (dir === void 0) continue;
 		links.set(dep, dir);
+		declarers.set(dep, next.anchor);
 		const manifestPath = join(dir, "package.json");
+		const manifest = readModuleFallbackManifest(manifestPath);
+		versions.set(dep, manifest.version);
 		queue.push({
 			anchor: manifestPath,
-			manifest: readModuleFallbackManifest(manifestPath)
+			manifest
 		});
 	}
 	return {
-		entries: !isPackagedExecutable() ? [...links].map(([packageName, packageDir]) => ({
+		entries: !materialize ? [] : !isPackagedExecutable() ? [...links].map(([packageName, packageDir]) => ({
 			kind: "symlink",
 			packageName,
 			packageDir
@@ -622,7 +621,10 @@ function resolveModuleFallbackEntries(installAnchor) {
 				targets: source.targets
 			}];
 		}),
-		packageNames: new Set(links.keys())
+		packageNames: new Set(links.keys()),
+		packageDirs: links,
+		declarers,
+		versions
 	};
 }
 /** Return whether one existing fallback entry already matches its resolved installation generation. */
@@ -652,18 +654,85 @@ function moduleFallbackCurrent(modulesDir, entries) {
 * `node_modules`; pnpm-managed entries remain authoritative, and another
 * profile's links cannot change its resolution.
 * @param options - installation anchor, optional loaded profile, and Harness home.
-* @returns settlement after the shared fallback and profile-local links are current.
+* @returns the computed fallback generation after optional materialization.
 */
 async function healProfilesModuleFallback(options) {
-	const { installAnchor, profile, home = resolveDshHome() } = options;
-	const modulesDir = join(join(home, PROFILES_DIR), "node_modules");
-	mkdirSync(modulesDir, { recursive: true });
-	const { entries, packageNames } = resolveModuleFallbackEntries(installAnchor);
-	if (!moduleFallbackCurrent(modulesDir, entries)) await withFileLock(modulesDir, () => {
+	const { installAnchor, profile, home = resolveDshHome(), materialize = true } = options;
+	const profilesDir = join(home, PROFILES_DIR);
+	const modulesDir = join(profilesDir, "node_modules");
+	if (materialize) mkdirSync(modulesDir, { recursive: true });
+	const { entries, packageNames, packageDirs, declarers, versions } = resolveModuleFallbackEntries(installAnchor, materialize);
+	if (materialize && !moduleFallbackCurrent(modulesDir, entries)) await withFileLock(modulesDir, () => {
 		if (!moduleFallbackCurrent(modulesDir, entries)) healProfilesModuleFallbackLocked(entries, modulesDir);
 		return Promise.resolve();
 	});
-	if (profile !== void 0) healProfileModuleFallback(profile, packageNames);
+	const profileDeclarers = /* @__PURE__ */ new Map();
+	const profileVersions = /* @__PURE__ */ new Map();
+	const localPackageNames = profile === void 0 ? [] : installedProfilePackageNames(profile);
+	const profilePackages = profile === void 0 ? /* @__PURE__ */ new Map() : healProfileModuleFallback(profile, packageNames, materialize, profileDeclarers, profileVersions);
+	return Object.freeze({
+		profilesDir,
+		profileDir: profile?.dir,
+		localPackageNames: Object.freeze(localPackageNames),
+		entries: Object.freeze([...[...packageDirs].map(([name, packageDir]) => Object.freeze({
+			name,
+			packageDir,
+			version: versions.get(name),
+			declarer: declarers.get(name),
+			scope: "installation"
+		})), ...[...profilePackages].map(([name, packageDir]) => Object.freeze({
+			name,
+			packageDir,
+			version: profileVersions.get(name),
+			declarer: profileDeclarers.get(name),
+			scope: "profile"
+		}))])
+	});
+}
+/** Return installed direct dependencies that Node resolves before profile fallback. */
+function installedProfilePackageNames(profile) {
+	let manifest;
+	try {
+		manifest = readModuleFallbackManifest(join(profile.dir, "package.json"));
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	return profileDependencyNames(manifest).filter((name) => {
+		if (!existsSync(join(join(profile.dir, "node_modules", name), "package.json"))) return false;
+		return !isProfileModuleFallbackLink(profile.dir, name);
+	});
+}
+/**
+* Compute a profile resolution generation without materializing links or proxies.
+* @param options - installation anchor, profile, and optional Harness home.
+* @returns the complete immutable generation.
+*/
+function createProfileResolutionGeneration(options) {
+	return healProfilesModuleFallback({
+		...options,
+		materialize: false
+	});
+}
+/**
+* Supply an application-owned profile with filesystem packages from its installation and selected bundles.
+* All fallback links belong to the profile; no shared Harness-home directory is written.
+* Existing pnpm-managed packages remain authoritative. The caller serializes profile mutations.
+* @param options - owning installation package.json and the loaded application profile.
+*/
+function healIsolatedProfileModuleFallback(options) {
+	const installationLinks = resolveModuleFallbackEntries(options.installAnchor, false).packageDirs;
+	healProfileModuleFallback(options.profile, new Set(installationLinks.keys()), true, void 0, void 0, installationLinks);
+}
+/**
+* Detach this profile's fallback links before a package-manager mutation.
+* Installed packages and links replaced by pnpm remain untouched; the next profile launch restores fallbacks.
+* @param profileDir - profile directory whose package mutation is serialized by the caller.
+*/
+function unlinkProfileModuleFallback(profileDir) {
+	const ownedModulesDir = join(profileDir, PROFILE_MODULE_FALLBACK_DIR, "node_modules");
+	if (!existsSync(ownedModulesDir)) return;
+	for (const name of ownedPackageNames(ownedModulesDir)) removeProfileSymlink(join(profileDir, "node_modules"), ownedModulesDir, name);
 }
 /** Heal one module-fallback generation while the cross-process writer lock is held. */
 function healProfilesModuleFallbackLocked(entries, modulesDir) {
@@ -675,17 +744,19 @@ function healProfilesModuleFallbackLocked(entries, modulesDir) {
 	}
 }
 /** Collect the first resolvable package directory for each dependency name. */
-function dependencyClosure(anchors, reserved, exclude) {
+function dependencyClosure(anchors, reserved, exclude, declarers, versions) {
 	const links = /* @__PURE__ */ new Map();
 	const visited = new Set(reserved);
 	for (const anchor of anchors) {
-		const canonicalAnchor = realpathSync.native(anchor);
+		const canonicalAnchor = join(realModuleDirectory(dirname(anchor)), basename(anchor));
 		const manifest = readModuleFallbackManifest(canonicalAnchor);
 		/* v8 ignore next -- an installable package manifest always declares its name */
 		if (manifest.name === void 0) continue;
 		if (!visited.has(manifest.name)) {
 			visited.add(manifest.name);
 			links.set(manifest.name, dirname(canonicalAnchor));
+			declarers?.set(manifest.name, canonicalAnchor);
+			versions?.set(manifest.name, manifest.version);
 		}
 		const queue = [{
 			anchor: canonicalAnchor,
@@ -699,21 +770,26 @@ function dependencyClosure(anchors, reserved, exclude) {
 			if (dir === void 0) continue;
 			visited.add(dep);
 			links.set(dep, dir);
+			declarers?.set(dep, next.anchor);
 			const manifestPath = join(dir, "package.json");
+			const dependencyManifest = readModuleFallbackManifest(manifestPath);
+			versions?.set(dep, dependencyManifest.version);
 			queue.push({
 				anchor: manifestPath,
-				manifest: readModuleFallbackManifest(manifestPath)
+				manifest: dependencyManifest
 			});
 		}
 	}
 	return links;
 }
 /** Reconcile packages carried only by selected bundles into one profile. */
-function healProfileModuleFallback(profile, installationPackageNames) {
+function healProfileModuleFallback(profile, installationPackageNames, materialize = true, declarers, versions, installationLinks = /* @__PURE__ */ new Map()) {
 	const profileModulesDir = join(profile.dir, "node_modules");
 	const ownedModulesDir = join(profile.dir, PROFILE_MODULE_FALLBACK_DIR, "node_modules");
-	mkdirSync(profileModulesDir, { recursive: true });
-	mkdirSync(ownedModulesDir, { recursive: true });
+	if (materialize) {
+		mkdirSync(profileModulesDir, { recursive: true });
+		mkdirSync(ownedModulesDir, { recursive: true });
+	}
 	const bundleLinks = dependencyClosure(profile.layers.filter((layer) => !installationPackageNames.has(layer.packageName)).map((layer) => join(layer.packageDir, "package.json")), installationPackageNames, (candidate, packageName) => {
 		const profileLink = join(profileModulesDir, packageName);
 		if (canonicalLinkPath(candidate) !== canonicalLinkPath(profileLink)) return false;
@@ -725,10 +801,12 @@ function healProfileModuleFallback(profile, installationPackageNames) {
 			/* v8 ignore next -- see the host-filesystem exception above */
 			throw error;
 		}
-	});
+	}, declarers, versions);
 	for (const layer of profile.layers) bundleLinks.delete(layer.packageName);
-	for (const packageName of ownedPackageNames(ownedModulesDir)) if (!bundleLinks.has(packageName)) removeProfileSymlink(profileModulesDir, ownedModulesDir, packageName);
-	for (const [packageName, target] of bundleLinks) {
+	const links = new Map([...installationLinks, ...bundleLinks]);
+	if (!materialize) return links;
+	for (const packageName of ownedPackageNames(ownedModulesDir)) if (!links.has(packageName)) removeProfileSymlink(profileModulesDir, ownedModulesDir, packageName);
+	for (const [packageName, target] of links) {
 		const ownedLink = join(ownedModulesDir, packageName);
 		mkdirSync(dirname(ownedLink), { recursive: true });
 		ensureSymlink(ownedLink, target);
@@ -736,6 +814,7 @@ function healProfileModuleFallback(profile, installationPackageNames) {
 		mkdirSync(dirname(profileLink), { recursive: true });
 		ensureProfileSymlink(profileLink, ownedLink);
 	}
+	return links;
 }
 /**
 * Read a profile's manifest.
@@ -769,27 +848,21 @@ function sameBundles(left, right) {
 }
 /**
 * Normalize an exact installation-owned bundle tuple to its shipped template,
-* or add the shipped reload default to an exact current tuple. A changed value
-* is written back during profile loading while every other manifest field is
-* preserved; any other bundle list is user-owned and remains untouched.
+* preserving all other manifest fields. Other bundle lists remain untouched.
 */
 function normalizeShippedProfile(name, dir, manifest) {
 	const installationOwned = INSTALLATION_OWNED_PROFILE_TUPLES[name];
 	const template = PROFILE_TEMPLATES[name];
 	const bundles = manifest.dsh?.profile?.bundles;
 	if (template === void 0 || bundles === void 0) return manifest;
-	const isRetiredTuple = installationOwned !== void 0 && sameBundles(bundles, installationOwned);
-	const isCurrentTuple = sameBundles(bundles, template.bundles);
-	const needsReloadDefault = manifest.dsh?.profile?.patchReload === void 0 && isCurrentTuple;
-	if (!isRetiredTuple && !needsReloadDefault) return manifest;
+	if (!(installationOwned !== void 0 && sameBundles(bundles, installationOwned))) return manifest;
 	const normalized = {
 		...manifest,
 		dsh: {
 			...manifest.dsh,
 			profile: {
 				...manifest.dsh?.profile,
-				bundles: [...template.bundles],
-				patchReload: manifest.dsh?.profile?.patchReload ?? template.patchReload
+				bundles: [...template.bundles]
 			}
 		}
 	};
@@ -841,12 +914,7 @@ function resolveBundleDir(binName, packageName, installAnchor, profileDir) {
 * @returns the resolved bundle layers and optional user patch layer.
 */
 function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
-	const manifest = readProfileManifest(binName, dir);
-	const bundles = manifest.dsh?.profile?.bundles ?? [];
-	const rawPatchReload = manifest.dsh?.profile?.patchReload;
-	if (rawPatchReload !== void 0 && rawPatchReload !== "live" && rawPatchReload !== "startup") throw new Error(`${binName}: profile manifest ${join(dir, "package.json")} dsh.profile.patchReload must be "live" or "startup"`);
-	const patchReload = rawPatchReload ?? "live";
-	const layers = bundles.map((packageName) => {
+	const layers = (readProfileManifest(binName, dir).dsh?.profile?.bundles ?? []).map((packageName) => {
 		const packageDir = resolveBundleDir(binName, packageName, installAnchor, dir);
 		const declared = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8")).dsh?.bundle?.patch;
 		if (declared === void 0) throw new Error(`${binName}: profile bundle ${JSON.stringify(packageName)} declares no dsh.bundle in its package.json`);
@@ -865,8 +933,7 @@ function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
 		dir,
 		layers,
 		patchPath,
-		patches,
-		patchReload
+		patches
 	};
 }
 /**
@@ -888,7 +955,7 @@ function loadProfile(binName, name, installAnchor, home = resolveDshHome(), opti
 	if (!existsSync(join(dir, "package.json"))) {
 		const template = PROFILE_TEMPLATES[name];
 		if (template === void 0) throw new Error(`${binName}: profile ${JSON.stringify(name)} does not exist; create it with 'dsh plugin --profile ${name} add <package>'`);
-		initProfile(dir, template.bundles, template.patchReload);
+		initProfile(dir, template.bundles);
 	}
 	normalizeShippedProfile(name, dir, readProfileManifest(binName, dir));
 	return loadProfileDirectory(binName, dir, installAnchor, options);
@@ -908,6 +975,961 @@ function composeEntries(layers, warn = () => {}) {
 	});
 }
 //#endregion
+//#region lib/types/profile-context.js
+/** Launcher-owned profile locations and composition inputs. */
+const TELEMETRY_ROW_ID = "session-telemetry-otel";
+/**
+* Resolve the telemetry opt-out switch into its boot patch. ANY non-empty
+* value (including `'0'`/`'false'`) disables: a privacy switch prefers
+* off-by-mistake over on-by-mistake. A composition without the telemetry row
+* exports nothing, so the switch is then trivially satisfied and no patch is
+* generated — custom profiles need not mount telemetry to run with the
+* switch set.
+* @param disabledEnv - the raw `DSH_TELEMETRY_DISABLED` value (`undefined` when unset).
+* @param hasRow - whether the composition carries the telemetry row.
+* @returns the disable patch, or `undefined` when no hard-disable patch is required.
+*/
+function resolveTelemetryPatch(disabledEnv, hasRow) {
+	if ((disabledEnv ?? "") === "" || !hasRow) return void 0;
+	return {
+		id: TELEMETRY_ROW_ID,
+		disabled: true
+	};
+}
+/** Read current bundle and user layers with the launch-time overlays.
+* @param binName Diagnostic prefix for malformed or missing configuration.
+* @param context Data supplied by the profile launcher.
+* @param initialProfile Already loaded startup profile; omitted reads the current files.
+* @returns Detached ordered patches; this function does not update the Loader.
+*/
+function readProfilePatches(binName, context, initialProfile) {
+	const profile = initialProfile ?? loadProfileDirectory(binName, context.dir, context.installAnchor, { userLayer: false });
+	const patches = structuredClone([
+		...profile.layers.flatMap((layer) => layer.patches),
+		...initialProfile?.patches ?? loadOptionalPatches(binName, context.patchPath) ?? [],
+		...loadOptionalPatches(binName, join(context.home, "cordis.patch.yml")) ?? [],
+		...context.overlays
+	]);
+	const telemetryPatch = resolveTelemetryPatch(context.telemetryDisabledEnv, composeEntries([patches]).some((row) => row.id === TELEMETRY_ROW_ID));
+	if (telemetryPatch !== void 0) patches.push(telemetryPatch);
+	return patches;
+}
+//#endregion
+//#region lib/types/profile-plugins.js
+/** Installed profile dependencies and their bundle activation after package-manager operations. */
+/** Unavailable installed metadata must not prevent listing or removing dependencies. */
+function optionalManifest(binName, packageDir) {
+	try {
+		return readProfileManifest(binName, packageDir);
+	} catch {
+		return;
+	}
+}
+/** Resolve activation metadata with the same installation precedence as profile loading. */
+function bundleManifest(location, name) {
+	let packageDir;
+	try {
+		packageDir = resolveBundleDir(location.binName, name, location.installAnchor, location.profileDir);
+	} catch {
+		return;
+	}
+	return optionalManifest(location.binName, packageDir);
+}
+/**
+* Read installed versions and bundle declarations without requiring loadable plugin code.
+* Missing or unreadable installed metadata leaves the dependency visible for repair or removal.
+* @param location - profile and installation resolution inputs.
+* @returns dependency records in package.json order and the profile manifest.
+*/
+function readProfilePlugins(location) {
+	const manifest = readProfileManifest(location.binName, location.profileDir);
+	const bundles = manifest.dsh?.profile?.bundles ?? [];
+	return {
+		manifest,
+		dependencies: Object.entries(manifest.dependencies ?? {}).map(([name, spec]) => {
+			const installed = optionalManifest(location.binName, join(location.profileDir, "node_modules", name));
+			return {
+				name,
+				version: typeof installed?.version === "string" ? installed.version : spec,
+				bundle: bundleManifest(location, name)?.dsh?.bundle?.patch !== void 0,
+				enabled: bundles.includes(name)
+			};
+		})
+	};
+}
+/**
+* Write a bundle list while preserving the supplied profile's other metadata.
+* @param profileDir - directory whose package.json is updated.
+* @param manifest - current profile manifest, read after the package operation when applicable.
+* @param bundles - ordered active bundle names, including any template entries.
+* @returns the written manifest.
+*/
+function writeProfileBundles(profileDir, manifest, bundles) {
+	const updated = {
+		...manifest,
+		dsh: {
+			...manifest.dsh,
+			profile: {
+				...manifest.dsh?.profile,
+				bundles: [...bundles]
+			}
+		}
+	};
+	writeProfileManifest(profileDir, updated);
+	return updated;
+}
+/**
+* Reconcile installed bundle declarations after a successful package-manager operation.
+* Dependency-managed entries disappear when removed or when their package loses its declaration;
+* template entries retain their order and duplicates. New bundle dependencies activate automatically.
+* @param options - location, inventory captured before pnpm, and whether explicitly disabled bundles remain disabled.
+* @returns updated inventory and newly added ordinary dependencies for caller-owned warnings.
+*/
+function reconcileProfilePlugins(options) {
+	const after = readProfilePlugins(options);
+	const beforeNames = new Set(options.before.dependencies.map((dependency) => dependency.name));
+	const afterNames = new Set(after.dependencies.map((dependency) => dependency.name));
+	const bundleNames = new Set(after.dependencies.filter((dependency) => dependency.bundle).map((dependency) => dependency.name));
+	const disabled = new Set(options.preserveDisabled ? options.before.dependencies.filter((dependency) => dependency.bundle && !dependency.enabled).map((dependency) => dependency.name) : []);
+	const previous = after.manifest.dsh?.profile?.bundles ?? [];
+	const bundles = previous.filter((name) => !(beforeNames.has(name) || afterNames.has(name)) || bundleNames.has(name));
+	for (const dependency of after.dependencies) if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) bundles.push(dependency.name);
+	return {
+		plugins: {
+			manifest: bundles.length !== previous.length || bundles.some((name, index) => name !== previous[index]) ? writeProfileBundles(options.profileDir, after.manifest, bundles) : after.manifest,
+			dependencies: after.dependencies.map((dependency) => ({
+				...dependency,
+				enabled: bundles.includes(dependency.name)
+			}))
+		},
+		addedPlainDependencies: after.dependencies.filter((dependency) => !dependency.bundle && !beforeNames.has(dependency.name)).map((dependency) => dependency.name)
+	};
+}
+//#endregion
+//#region lib/types/profile-sanitize.js
+/** Filesystem recovery for callers that own profile shutdown and write exclusion. */
+/**
+* Back up the profile patch and retain only the caller's recovery bundles.
+* The caller must stop the profile and exclude concurrent profile writes.
+* Installed packages and other manifest fields are preserved; patches are never parsed.
+* Failures propagate and may leave completed changes in place for a retry.
+* @param binName - Diagnostic prefix for invalid profile manifests.
+* @param profileDir - Profile directory to recover without loading its plugins.
+* @param bundles - Ordered bundles to enable after recovery.
+* @returns Backup path with a Unix millisecond timestamp and optional collision ordinal, or undefined if absent.
+*/
+function sanitizeProfile(binName, profileDir, bundles) {
+	const manifest = existsSync(join(profileDir, "package.json")) ? readProfileManifest(binName, profileDir) : void 0;
+	const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+	const backupBase = `${patchPath}.bak-${Date.now()}`;
+	let backupPath = backupBase;
+	let ordinal = 0;
+	while (existsSync(backupPath)) backupPath = `${backupBase}-${++ordinal}`;
+	try {
+		renameSync(patchPath, backupPath);
+	} catch (error) {
+		if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+		backupPath = void 0;
+	}
+	if (manifest !== void 0) writeProfileBundles(profileDir, manifest, bundles);
+	return backupPath;
+}
+//#endregion
+//#region lib/types/profile-resolution/resolver.js
+/** In-memory profile package routing for Node's default ESM and CommonJS loaders. */
+const WORKER_RESOLUTION_KEY = "@deepseek-ai/dsh-app-boot/profile-resolution";
+const EMPTY_ATTRIBUTES = Object.freeze({});
+/**
+* Split a bare request into its package name without allocating path segments.
+* @param request - module specifier to classify.
+* @returns the bare package name, or undefined for non-package requests.
+*/
+function barePackageName(request) {
+	if (!request || request[0] === "." || request[0] === "/" || request[0] === "\\" || request[0] === "#" || request.includes(":") || isBuiltin(request)) return;
+	const first = request.indexOf("/");
+	if (request[0] !== "@") return first < 0 ? request : request.slice(0, first);
+	if (first < 0) return;
+	const second = request.indexOf("/", first + 1);
+	return second < 0 ? request : request.slice(0, second);
+}
+function canonicalPath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+function prefixes(path) {
+	const configured = resolve(path) + sep;
+	const canonical = canonicalPath(path) + sep;
+	return canonical === configured ? [configured] : [configured, canonical];
+}
+function compileGeneration(generation) {
+	const profilePaths = prefixes(generation.profilesDir);
+	const profile = generation.profileDir === void 0 ? [] : prefixes(generation.profileDir);
+	return {
+		entries: new Map(generation.entries.map((entry) => [entry.name, entry])),
+		profilesDir: generation.profilesDir,
+		profileDir: generation.profileDir,
+		profilePaths,
+		profileUrls: profilePaths.map((path) => pathToFileURL(path).href),
+		profile,
+		activeProfileUrls: profile.map((path) => pathToFileURL(path).href),
+		localPackageNames: new Set(generation.localPackageNames),
+		shared: new Set(profilePaths.map((prefix) => join(prefix, "node_modules"))),
+		esmRoutes: /* @__PURE__ */ new Map(),
+		cjsRoutes: /* @__PURE__ */ new Map()
+	};
+}
+function startsWithin(path, roots) {
+	for (const root of roots) if (path.startsWith(root)) return true;
+	return false;
+}
+function nativePackageDir(parent, name) {
+	for (const searchPath of createRequire(parent).resolve.paths(name)) {
+		const candidate = join(searchPath, name);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+function localPackageCandidate(searchPath, name, flavor) {
+	const candidate = join(searchPath, name);
+	const stat = statSync(candidate, { throwIfNoEntry: false });
+	return (flavor === "esm" ? stat?.isDirectory() === true : stat !== void 0 || [
+		".js",
+		".json",
+		".node"
+	].some((extension) => existsSync(candidate + extension))) ? {
+		packageDir: candidate,
+		canBeManagedLink: stat !== void 0
+	} : void 0;
+}
+function selfReferenceName(parent) {
+	let current = dirname(parent);
+	while (true) {
+		const manifestPath = join(current, "package.json");
+		if (existsSync(manifestPath)) {
+			let manifest;
+			try {
+				manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			} catch (_error) {
+				return null;
+			}
+			return typeof manifest.name === "string" && manifest.exports != null ? manifest.name : false;
+		}
+		/* v8 ignore next -- scoped module requests normally find an owning manifest before node_modules. */
+		if (basename(current) === "node_modules") return false;
+		const next = dirname(current);
+		if (next === current) return false;
+		current = next;
+	}
+}
+function packageImportsTarget(parent, request, conditions) {
+	let current = dirname(parent);
+	while (true) {
+		const manifestPath = join(current, "package.json");
+		if (existsSync(manifestPath)) {
+			let manifest;
+			try {
+				manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			} catch (_error) {
+				/* v8 ignore next -- native resolution cannot report MODULE_NOT_FOUND after an invalid scope manifest */
+				return;
+			}
+			try {
+				const target = imports(manifest, request, {
+					conditions: [...conditions],
+					unsafe: true
+				})?.[0];
+				return target !== void 0 && barePackageName(target) !== void 0 ? {
+					specifier: target,
+					parentURL: pathToFileURL(manifestPath).href
+				} : void 0;
+			} catch (_error) {
+				/* v8 ignore next -- native resolution cannot report MODULE_NOT_FOUND before selecting a valid mapping */
+				return;
+			}
+		}
+		if (basename(current) === "node_modules") return void 0;
+		const next = dirname(current);
+		/* v8 ignore next -- a MODULE_NOT_FOUND package-import target always has an owning package scope */
+		if (next === current) return void 0;
+		current = next;
+	}
+}
+function packageSearchPaths(entry, request, cjs) {
+	const name = barePackageName(request);
+	/* v8 ignore next -- fallback routes are created only for bare package requests */
+	if (name === void 0) return cjs._nodeModulePaths(dirname(entry.declarer));
+	const suffix = sep + name.split("/").join(sep);
+	return entry.packageDir.endsWith(suffix) ? [entry.packageDir.slice(0, -suffix.length)] : cjs._nodeModulePaths(dirname(entry.declarer));
+}
+function localCandidateOwnsResolution(candidate, resolved, request, name) {
+	if (startsWithin(resolved, prefixes(candidate))) return true;
+	if (sameResolution(candidate, resolved)) return true;
+	if ([
+		".js",
+		".json",
+		".node"
+	].some((extension) => sameResolution(candidate + extension, resolved))) return true;
+	/* v8 ignore next -- a bounded native lookup can escape a candidate only through its root legacy main */
+	if (request !== name) return false;
+	try {
+		const manifest = JSON.parse(readFileSync(join(candidate, "package.json"), "utf8"));
+		/* v8 ignore next -- a bounded native lookup outside the package directory requires a legacy main */
+		if (typeof manifest.main !== "string") return false;
+		return sameResolution(createRequire(join(candidate, "package.json")).resolve(resolve(candidate, manifest.main)), resolved);
+	} catch (_error) {
+		/* v8 ignore next -- this helper runs only after the same native resolution succeeded */
+		return false;
+	}
+}
+function isUnselectedPackageMiss(error) {
+	const failure = error;
+	return failure.code === "MODULE_NOT_FOUND" && failure.path === void 0;
+}
+function sameResolution(left, right) {
+	if (left === right) return true;
+	const leftPath = left.startsWith("file:") ? fileURLToPath(left) : left;
+	const rightPath = right.startsWith("file:") ? fileURLToPath(right) : right;
+	return canonicalPath(leftPath) === canonicalPath(rightPath);
+}
+/** One mutable pointer to immutable generation data. */
+var ResolutionRouter = class {
+	current;
+	constructor(generation) {
+		this.current = compileGeneration(generation);
+	}
+	replace(generation) {
+		const entries = new Map(generation.entries.map((entry) => [entry.name, entry]));
+		if (generation.profilesDir !== this.current.profilesDir || generation.profileDir !== this.current.profileDir) throw new Error("profile resolution: a generation cannot change its profile scope");
+		for (const [name, current] of this.current.entries) {
+			const next = entries.get(name);
+			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
+		}
+		const localPackageNames = new Set(generation.localPackageNames);
+		for (const name of this.current.localPackageNames) if (!localPackageNames.has(name)) throw new Error(`profile resolution: removing local package ${JSON.stringify(name)} requires a process restart`);
+		for (const name of localPackageNames) if (!this.current.localPackageNames.has(name) && this.current.entries.has(name)) throw new Error(`profile resolution: overriding ${JSON.stringify(name)} locally requires a process restart`);
+		this.current = compileGeneration(generation);
+	}
+	routeScoped(request, parentRoutes, generation, flavor, nativeResolve, cacheable = false) {
+		const { parent, profilesDir, requests } = parentRoutes;
+		const name = barePackageName(request);
+		if (name === void 0) return void 0;
+		if (parentRoutes.selfReferenceName === void 0) parentRoutes.selfReferenceName = selfReferenceName(parent);
+		if (parentRoutes.selfReferenceName === name || parentRoutes.selfReferenceName === null) {
+			const state = { route: { kind: "native" } };
+			requests.set(request, state);
+			return state;
+		}
+		const target = generation.entries.get(name);
+		const candidates = [];
+		const localSearchPaths = [];
+		for (const searchPath of createRequire(parent).resolve.paths(name)) {
+			if (generation.shared.has(resolve(searchPath))) break;
+			localSearchPaths.push(searchPath);
+			const candidate = localPackageCandidate(searchPath, name, flavor);
+			if (candidate !== void 0) {
+				if (!(candidate.canBeManagedLink && generation.profile.some((prefix) => candidate.packageDir === join(prefix, "node_modules", name) && isProfileModuleFallbackLink(prefix.slice(0, -1), name)))) candidates.push(candidate);
+			}
+		}
+		if (candidates.length > 0) if (flavor === "cjs" && nativeResolve !== void 0) try {
+			const resolved = nativeResolve(localSearchPaths);
+			const selected = candidates.find((candidate) => localCandidateOwnsResolution(candidate.packageDir, resolved, request, name));
+			if (selected !== void 0) {
+				const state = {
+					route: {
+						kind: "native",
+						packageDir: selected.packageDir
+					},
+					packageDir: selected.packageDir,
+					...cacheable ? { cjs: resolved } : {}
+				};
+				requests.set(request, state);
+				return state;
+			}
+		} catch (error) {
+			if (!isUnselectedPackageMiss(error)) throw error;
+		}
+		else {
+			const selected = candidates[0];
+			const state = {
+				route: {
+					kind: "native",
+					packageDir: selected.packageDir
+				},
+				packageDir: selected.packageDir
+			};
+			requests.set(request, state);
+			return state;
+		}
+		const eligible = target?.scope === "installation" || target?.scope === "profile" && parentRoutes.activeProfile;
+		const after = join(dirname(profilesDir), "package.json");
+		const route = eligible ? {
+			kind: "fallback",
+			entry: target,
+			after
+		} : {
+			kind: "after-fallback",
+			parent: after
+		};
+		const state = { route };
+		if (route.kind === "fallback") requests.set(request, state);
+		return state;
+	}
+	routeLocalPackage(request, parentRoutes, generation) {
+		const name = barePackageName(request);
+		if (name === void 0 || !parentRoutes.activeProfile || !generation.localPackageNames.has(name)) return void 0;
+		const state = { route: { kind: "native" } };
+		parentRoutes.requests.set(request, state);
+		return state;
+	}
+	routeUrl(request, parentURL) {
+		const generation = this.current;
+		let parentRoutes = generation.esmRoutes.get(parentURL);
+		if (parentRoutes === false) return void 0;
+		const cached = parentRoutes?.requests.get(request);
+		if (cached !== void 0) return cached;
+		if (parentRoutes === void 0) {
+			const profileIndex = generation.profileUrls.findIndex((prefix) => parentURL.startsWith(prefix));
+			const activeProfileIndex = generation.activeProfileUrls.findIndex((prefix) => parentURL.startsWith(prefix));
+			if (profileIndex < 0 && activeProfileIndex < 0) {
+				generation.esmRoutes.set(parentURL, false);
+				return;
+			}
+			let parent;
+			try {
+				parent = fileURLToPath(parentURL);
+			} catch {
+				generation.esmRoutes.set(parentURL, false);
+				return;
+			}
+			const profileRoot = profileIndex >= 0 ? generation.profilePaths[profileIndex] : generation.profile[activeProfileIndex];
+			/* v8 ignore next -- one matching index was established above */
+			if (profileRoot === void 0) return void 0;
+			parentRoutes = {
+				parent,
+				profilesDir: profileRoot.slice(0, -1),
+				activeProfile: activeProfileIndex >= 0,
+				requests: /* @__PURE__ */ new Map()
+			};
+			generation.esmRoutes.set(parentURL, parentRoutes);
+		}
+		const local = this.routeLocalPackage(request, parentRoutes, generation);
+		if (local !== void 0) return local;
+		return this.routeScoped(request, parentRoutes, generation, "esm");
+	}
+	routePath(request, parent, nativeResolve, cacheable = false) {
+		const generation = this.current;
+		let parentRoutes = generation.cjsRoutes.get(parent);
+		if (parentRoutes === false) return void 0;
+		const cached = parentRoutes?.requests.get(request);
+		if (cached !== void 0) return cached;
+		if (parentRoutes === void 0) {
+			const profilesDir = generation.profilePaths.find((prefix) => parent.startsWith(prefix));
+			const activeProfile = generation.profile.find((prefix) => parent.startsWith(prefix));
+			if (profilesDir !== void 0 || activeProfile !== void 0) {
+				const profileRoot = profilesDir ?? activeProfile;
+				/* v8 ignore next -- one matching root was established above */
+				if (profileRoot === void 0) return void 0;
+				parentRoutes = {
+					parent,
+					profilesDir: profileRoot.slice(0, -1),
+					activeProfile: activeProfile !== void 0,
+					requests: /* @__PURE__ */ new Map()
+				};
+				generation.cjsRoutes.set(parent, parentRoutes);
+			}
+		}
+		if (parentRoutes === void 0) {
+			generation.cjsRoutes.set(parent, false);
+			return;
+		}
+		return this.routeScoped(request, parentRoutes, generation, "cjs", nativeResolve, cacheable);
+	}
+	explicitRoute(request, paths) {
+		if (barePackageName(request) === void 0) return void 0;
+		for (const [index, path] of paths.entries()) {
+			const parent = join(resolve(path), ".dsh-profile-resolution.cjs");
+			if (startsWithin(parent, this.current.profilePaths) || startsWithin(parent, this.current.profile)) return {
+				index,
+				parent
+			};
+		}
+	}
+	nativeSelfReference(request, parent) {
+		const name = barePackageName(request);
+		if (name === void 0) return false;
+		const self = selfReferenceName(parent);
+		return self === name || self === null;
+	}
+	packageDir(specifier, parentURL) {
+		const name = barePackageName(specifier);
+		if (name === void 0) return void 0;
+		const state = this.routeUrl(specifier, parentURL);
+		if (state?.route.kind === "fallback") return state.route.entry.packageDir;
+		if (state?.packageDir !== void 0) return state.packageDir;
+		let parent;
+		try {
+			parent = state?.route.kind === "after-fallback" ? state.route.parent : fileURLToPath(parentURL);
+		} catch {
+			return;
+		}
+		const found = nativePackageDir(parent, name);
+		if (state !== void 0 && found !== void 0) state.packageDir = found;
+		return found;
+	}
+};
+function internalModules() {
+	const addon = createRequire(import.meta.url)("node-addon-require-builtin");
+	const esmModule = addon.requireBuiltin("internal/modules/esm/loader");
+	const cjsModule = addon.requireBuiltin("internal/modules/cjs/loader");
+	const cjsHelpers = addon.requireBuiltin("internal/modules/helpers");
+	const esmUtils = addon.requireBuiltin("internal/modules/esm/utils");
+	const esmResolve = addon.requireBuiltin("internal/modules/esm/resolve");
+	const esm = esmModule.getOrInitializeCascadedLoader();
+	const modern = "getOrCreateModuleJob" in esm;
+	/* v8 ignore start -- the supported Node 22/24/26 matrix validates each available Internal interface */
+	if (typeof esm.resolveSync !== "function" || typeof Reflect.get(esm, modern ? "getOrCreateModuleJob" : "getModuleJobForImport") !== "function" || !modern && typeof Reflect.get(esm, "resolve") !== "function" || typeof cjsModule.Module._resolveFilename !== "function" || typeof cjsHelpers.getCjsConditions !== "function" || typeof esmUtils.getDefaultConditions !== "function" || typeof esmResolve.defaultResolve !== "function") throw new Error("profile resolution: unsupported Node module loader");
+	/* v8 ignore stop */
+	return {
+		esm,
+		esmDefaultResolve: (specifier, context) => esmResolve.defaultResolve(specifier, context),
+		esmConditions: esmUtils.getDefaultConditions(),
+		cjs: cjsModule.Module,
+		cjsConditions: cjsHelpers.getCjsConditions(),
+		modern
+	};
+}
+function throwWithImporter(error, routedParent, parent) {
+	const code = error.code;
+	if (error instanceof Error && (code === "ERR_MODULE_NOT_FOUND" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED")) {
+		const routedPath = fileURLToPath(routedParent);
+		const parentPath = fileURLToPath(parent);
+		const originalMessage = error.message;
+		const message = originalMessage.replaceAll(routedParent, parent).replaceAll(routedPath, parentPath);
+		const stack = error.stack;
+		error.message = message;
+		/* v8 ignore next -- Node's resolver errors always carry a stack */
+		if (stack !== void 0) error.stack = stack.replace(originalMessage, message);
+	}
+	throw error;
+}
+function throwWithoutCjsAnchor(error, anchor) {
+	const resolved = error;
+	const requireStack = resolved.requireStack;
+	if (error instanceof Error && resolved.code === "MODULE_NOT_FOUND" && requireStack?.[0] !== void 0 && sameResolution(requireStack[0], anchor)) {
+		const originalMessage = error.message;
+		const originalBlock = `\nRequire stack:\n${requireStack.map((path) => `- ${path}`).join("\n")}`;
+		const remaining = requireStack.slice(1);
+		/* v8 ignore next -- routed calls always retain the original importing module */
+		const replacement = remaining.length === 0 ? "" : `\nRequire stack:\n${remaining.map((path) => `- ${path}`).join("\n")}`;
+		error.message = originalMessage.replace(originalBlock, replacement);
+		resolved.requireStack = remaining;
+		const stack = error.stack;
+		/* v8 ignore next -- Node's resolver errors always carry a stack */
+		if (stack !== void 0) error.stack = stack.replace(originalMessage, error.message);
+	}
+	throw error;
+}
+function assertEquivalent(actual, expected, request, parent) {
+	if (sameResolution(actual, expected)) return;
+	throw new Error(`profile resolution mismatch for ${JSON.stringify(request)} from ${parent}: disk resolved ${actual}, generation resolved ${expected}`);
+}
+function assertOptionalEquivalent(actual, expected, request, parent) {
+	if (actual === void 0 && expected === void 0) return;
+	if (actual !== void 0 && expected !== void 0 && sameResolution(actual, expected)) return;
+	throw new Error(`profile resolution mismatch for ${JSON.stringify(request)} from ${parent}: disk selected ${actual ?? "nothing"}, generation selected ${expected ?? "nothing"}`);
+}
+/**
+* Install one profile generation on Node's default ESM and CommonJS resolvers.
+* @param generation - complete package table and profile scope.
+* @param behavior - enforce the generation, or verify a materialized generation.
+* @returns a registration that replaces the generation or restores the native methods.
+*/
+function installProfileResolution(generation, behavior = "enforce") {
+	const router = new ResolutionRouter(generation);
+	const { esm, esmDefaultResolve, esmConditions, cjs, cjsConditions, modern } = internalModules();
+	const esmScope = /* @__PURE__ */ new Map();
+	const profilePaths = [...prefixes(generation.profilesDir), ...generation.profileDir === void 0 ? [] : prefixes(generation.profileDir)];
+	const profileUrls = profilePaths.map((path) => pathToFileURL(path).href);
+	let recentEsmParent;
+	let recentEsmScoped = false;
+	let delegatedEsm;
+	const adaptEsm = (native) => {
+		const adapted = (request, parent, attributes) => {
+			const delegated = delegatedEsm;
+			/* v8 ignore next -- reentry requires a separate synchronous Node hook; supported launches install none */
+			if (delegated !== void 0 && delegated.parent === parent && delegated.request === request) return native(request, parent, attributes);
+			if (parent === void 0) return native(request, parent, attributes);
+			let scoped = recentEsmParent === parent ? recentEsmScoped : esmScope.get(parent);
+			if (scoped === void 0) {
+				scoped = startsWithin(parent, profileUrls);
+				esmScope.set(parent, scoped);
+			}
+			if (recentEsmParent !== parent) {
+				recentEsmParent = parent;
+				recentEsmScoped = scoped;
+			}
+			if (!scoped) return native(request, parent, attributes);
+			const state = router.routeUrl(request, parent);
+			if (state === void 0) {
+				const target = request[0] === "#" ? packageImportsTarget(fileURLToPath(parent), request, esmConditions) : void 0;
+				if (target === void 0) return native(request, parent, attributes);
+				const restoreImporter = (error) => throwWithImporter(error, target.parentURL, parent);
+				let expected;
+				try {
+					expected = adapted(target.specifier, target.parentURL, attributes);
+					/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+					if (expected instanceof Promise) expected = expected.catch(restoreImporter);
+				} catch (error) {
+					return restoreImporter(error);
+				}
+				if (behavior === "enforce") return expected;
+				const actual = native(request, parent, attributes);
+				/* v8 ignore start -- Node 22 is the asynchronous adapter and is covered by the external version matrix */
+				if (expected instanceof Promise || actual instanceof Promise) return Promise.all([actual, expected]).then(([resolved, wanted]) => {
+					assertEquivalent(resolved.url, wanted.url, request, parent);
+					return resolved;
+				});
+				/* v8 ignore stop */
+				assertEquivalent(actual.url, expected.url, request, parent);
+				return actual;
+			}
+			const cacheable = attributes === EMPTY_ATTRIBUTES || Object.keys(attributes).length === 0;
+			if (cacheable && state.esm !== void 0) return state.esm;
+			const route = state.route;
+			if (route.kind === "native") {
+				const result = native(request, parent, attributes);
+				if (cacheable && !(result instanceof Promise)) state.esm = result;
+				return result;
+			}
+			const routedParent = pathToFileURL(route.kind === "fallback" ? route.entry.declarer : route.parent).href;
+			if (behavior === "enforce") {
+				const previous = delegatedEsm;
+				delegatedEsm = {
+					parent: routedParent,
+					request
+				};
+				const restoreImporter = (error) => throwWithImporter(error, routedParent, parent);
+				try {
+					let result;
+					try {
+						result = native(request, routedParent, attributes);
+					} catch (error) {
+						return restoreImporter(error);
+					}
+					/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+					if (result instanceof Promise) return result.catch(restoreImporter);
+					if (cacheable) state.esm = result;
+					return result;
+				} finally {
+					delegatedEsm = previous;
+				}
+			}
+			const actual = native(request, parent, attributes);
+			const previous = delegatedEsm;
+			delegatedEsm = {
+				parent: routedParent,
+				request
+			};
+			const restoreImporter = (error) => throwWithImporter(error, routedParent, parent);
+			try {
+				let expected;
+				try {
+					const result = native(request, routedParent, attributes);
+					expected = result;
+					/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+					if (result instanceof Promise) expected = result.catch(restoreImporter);
+				} catch (error) {
+					return restoreImporter(error);
+				}
+				/* v8 ignore start -- Node 22 is the asynchronous adapter and is covered by the external version matrix */
+				if (expected instanceof Promise || actual instanceof Promise) return Promise.all([actual, expected]).then(([resolved, wanted]) => {
+					assertEquivalent(resolved.url, wanted.url, request, parent);
+					if (cacheable) state.esm = resolved;
+					return resolved;
+				});
+				/* v8 ignore stop */
+				assertEquivalent(actual.url, expected.url, request, parent);
+				if (cacheable) state.esm = actual;
+				return actual;
+			} finally {
+				delegatedEsm = previous;
+			}
+		};
+		return adapted;
+	};
+	let restoreEsm;
+	/* v8 ignore else -- CI coverage runs Node 24 v2; the Node 22 matrix exercises the v1 adapter */
+	if (modern) {
+		const loader = esm;
+		const original = Reflect.get(loader, "resolveSync");
+		const resolveRequest = adaptEsm((request, parent, attributes) => original.call(loader, parent, {
+			specifier: request,
+			attributes
+		}));
+		const wrapped = (parent, request, ...rest) => rest.length ? Reflect.apply(original, loader, [
+			parent,
+			request,
+			...rest
+		]) : resolveRequest(request.specifier, parent, request.attributes ?? EMPTY_ATTRIBUTES);
+		loader.resolveSync = wrapped;
+		restoreEsm = () => {
+			/* v8 ignore else -- registrations are disposed in reverse installation order */
+			if (loader.resolveSync === wrapped) loader.resolveSync = original;
+		};
+	} else {
+		const loader = esm;
+		const original = Reflect.get(loader, "resolve");
+		const originalSync = Reflect.get(loader, "resolveSync");
+		const resolveRequest = adaptEsm((request, parent, attributes) => original.call(loader, request, parent, attributes));
+		const resolveRequestSync = adaptEsm((request, parent, attributes) => originalSync.call(loader, request, parent, attributes));
+		const wrapped = (request, parent, attributes = EMPTY_ATTRIBUTES) => resolveRequest(request, parent, attributes);
+		const wrappedSync = (request, parent, attributes = EMPTY_ATTRIBUTES) => resolveRequestSync(request, parent, attributes);
+		loader.resolve = wrapped;
+		loader.resolveSync = wrappedSync;
+		restoreEsm = () => {
+			if (loader.resolve === wrapped) loader.resolve = original;
+			if (loader.resolveSync === wrappedSync) loader.resolveSync = originalSync;
+		};
+	}
+	const originalFilename = Reflect.get(cjs, "_resolveFilename");
+	let delegatedCjs = 0;
+	const resolveRoutedCjs = (request, routed, parent, main, options) => {
+		const anchor = routed.kind === "fallback" ? routed.entry.declarer : routed.parent;
+		const synthetic = new cjs(anchor);
+		synthetic.parent = parent;
+		synthetic.filename = anchor;
+		synthetic.paths = routed.kind === "fallback" ? packageSearchPaths(routed.entry, request, cjs) : cjs._nodeModulePaths(dirname(anchor));
+		try {
+			return originalFilename.call(cjs, request, synthetic, main, options);
+		} catch (error) {
+			return throwWithoutCjsAnchor(error, anchor);
+		}
+	};
+	const resolveNativeCjs = (request, searchPaths, parent, parentFilename, main, conditions) => {
+		const synthetic = new cjs(parentFilename);
+		synthetic.parent = parent;
+		synthetic.filename = parentFilename;
+		synthetic.paths = [...searchPaths];
+		const options = conditions === void 0 ? void 0 : { conditions };
+		return originalFilename.call(cjs, request, synthetic, main, options);
+	};
+	const resolvePackageImportCjs = (target, conditions) => {
+		const state = router.routeUrl(target.specifier, target.parentURL);
+		const resolveFrom = (parentURL) => fileURLToPath(esmDefaultResolve(target.specifier, {
+			parentURL,
+			conditions: [...conditions]
+		}).url);
+		/* v8 ignore next -- the target manifest was found inside the established profile scope */
+		if (state === void 0) return resolveFrom(target.parentURL);
+		if (state.route.kind === "native") return resolveFrom(target.parentURL);
+		const route = state.route;
+		if (route.kind === "after-fallback") return resolveFrom(pathToFileURL(route.parent).href);
+		return resolveFrom(pathToFileURL(route.entry.declarer).href);
+	};
+	const wrappedFilename = (request, parent, main, options) => {
+		if (delegatedCjs || !parent?.filename) return originalFilename.call(cjs, request, parent, main, options);
+		const parentFilename = parent.filename;
+		const cacheable = options?.paths === void 0 && options?.conditions === void 0;
+		const explicitPaths = Array.isArray(options?.paths) ? options.paths : void 0;
+		if (explicitPaths !== void 0 && router.nativeSelfReference(request, parentFilename)) return originalFilename.call(cjs, request, parent, main, options);
+		const explicit = explicitPaths === void 0 ? void 0 : router.explicitRoute(request, explicitPaths);
+		if (options?.paths !== void 0 && explicit === void 0) return originalFilename.call(cjs, request, parent, main, options);
+		if (explicit !== void 0 && explicitPaths !== void 0 && explicit.index > 0) try {
+			return originalFilename.call(cjs, request, parent, main, {
+				...options,
+				paths: explicitPaths.slice(0, explicit.index)
+			});
+		} catch (error) {
+			if (!isUnselectedPackageMiss(error)) throw error;
+		}
+		const state = router.routePath(request, explicit?.parent ?? parentFilename, (searchPaths) => resolveNativeCjs(request, searchPaths, parent, parentFilename, main, options?.conditions), explicit === void 0 && cacheable);
+		if (state === void 0) {
+			const scoped = startsWithin(parentFilename, profilePaths);
+			const conditions = options?.conditions ?? cjsConditions;
+			const target = request[0] === "#" && scoped ? packageImportsTarget(parentFilename, request, conditions) : void 0;
+			if (target === void 0) return originalFilename.call(cjs, request, parent, main, options);
+			const expected = resolvePackageImportCjs(target, conditions);
+			if (behavior === "enforce") return expected;
+			const actual = originalFilename.call(cjs, request, parent, main, options);
+			assertEquivalent(actual, expected, request, parentFilename);
+			return actual;
+		}
+		if (cacheable && state.cjs !== void 0) return state.cjs;
+		const route = state.route;
+		if (route.kind === "native") {
+			const result = originalFilename.call(cjs, request, parent, main, options);
+			if (cacheable) state.cjs = result;
+			return result;
+		}
+		if (route.kind === "after-fallback" && explicit !== void 0 && explicitPaths !== void 0) try {
+			return originalFilename.call(cjs, request, parent, main, {
+				...options,
+				paths: [dirname(route.parent)]
+			});
+		} catch (error) {
+			if (!isUnselectedPackageMiss(error)) throw error;
+			const remaining = explicitPaths.slice(explicit.index + 1);
+			if (remaining.length === 0) throw error;
+			return wrappedFilename(request, parent, main, {
+				...options,
+				paths: remaining
+			});
+		}
+		delegatedCjs++;
+		try {
+			const routedOptions = options?.conditions === void 0 ? void 0 : { conditions: options.conditions };
+			let expected;
+			try {
+				expected = resolveRoutedCjs(request, route, parent, main, routedOptions);
+			} catch (error) {
+				if (route.kind !== "fallback" || !isUnselectedPackageMiss(error)) throw error;
+				try {
+					expected = resolveRoutedCjs(request, {
+						kind: "after-fallback",
+						parent: route.after
+					}, parent, main, routedOptions);
+				} catch (afterError) {
+					const remaining = explicit === void 0 || explicitPaths === void 0 ? [] : explicitPaths.slice(explicit.index + 1);
+					if (!isUnselectedPackageMiss(afterError) || remaining.length === 0) throw afterError;
+					delegatedCjs--;
+					try {
+						return wrappedFilename(request, parent, main, {
+							...options,
+							paths: remaining
+						});
+					} finally {
+						delegatedCjs++;
+					}
+				}
+			}
+			if (behavior === "enforce") {
+				if (cacheable) state.cjs = expected;
+				return expected;
+			}
+			const actual = originalFilename.call(cjs, request, parent, main, options);
+			assertEquivalent(actual, expected, request, parentFilename);
+			if (cacheable) state.cjs = actual;
+			return actual;
+		} finally {
+			delegatedCjs--;
+		}
+	};
+	cjs._resolveFilename = wrappedFilename;
+	return {
+		packageDir(specifier, parentURL) {
+			const expected = router.packageDir(specifier, parentURL);
+			if (behavior !== "verify" || !startsWithin(parentURL, profileUrls)) return expected;
+			const name = barePackageName(specifier);
+			if (name === void 0) return expected;
+			let parent;
+			try {
+				parent = fileURLToPath(parentURL);
+			} catch {
+				return expected;
+			}
+			assertOptionalEquivalent(nativePackageDir(parent, name), expected, specifier, parentURL);
+			return expected;
+		},
+		replace(next) {
+			router.replace(next);
+		},
+		dispose() {
+			/* v8 ignore else -- registrations are disposed in reverse installation order */
+			if (cjs._resolveFilename === wrappedFilename) cjs._resolveFilename = originalFilename;
+			restoreEsm();
+		}
+	};
+}
+/**
+* Publish one generation for Harness-owned Workers.
+* @param generation - complete package table and profile scope.
+* @param behavior - enforce or verify the generation in newly created Workers.
+* @returns a disposer restoring the previous thread environment data.
+*/
+function registerWorkerResolution(generation, behavior = "enforce") {
+	const previous = getEnvironmentData(WORKER_RESOLUTION_KEY);
+	setEnvironmentData(WORKER_RESOLUTION_KEY, {
+		generation,
+		behavior
+	});
+	return () => {
+		setEnvironmentData(WORKER_RESOLUTION_KEY, previous);
+	};
+}
+//#endregion
+//#region lib/types/profile-resolution/service.js
+/** Package metadata resolved through one profile resolution registration. */
+function readPackage(dir, fallbackName) {
+	const manifestPath = join(dir, "package.json");
+	if (!existsSync(manifestPath)) return void 0;
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	const name = manifest.name;
+	const version = manifest.version;
+	return {
+		name: typeof name === "string" ? name : fallbackName,
+		version: typeof version === "string" ? version : void 0,
+		dir,
+		manifestPath,
+		manifest
+	};
+}
+/** Package lookup shared by metadata consumers in one profile process. */
+var PluginPackages = class extends Service {
+	packages = /* @__PURE__ */ new Map();
+	resolver;
+	behavior;
+	disposeWorkerResolution;
+	constructor(ctx, config = {}) {
+		super(ctx, "pluginPackages");
+		this.behavior = config.behavior ?? "enforce";
+		if (config.generation === void 0) return;
+		const resolver = installProfileResolution(config.generation, this.behavior);
+		this.disposeWorkerResolution = registerWorkerResolution(config.generation, this.behavior);
+		this.resolver = resolver;
+		ctx.effect(() => () => {
+			this.disposeWorkerResolution?.();
+			resolver.dispose();
+		}, "profile package resolution");
+	}
+	/**
+	* Publish an additive generation for this process and subsequently created Workers.
+	* @param generation - fully constructed successor generation.
+	*/
+	replace(generation) {
+		if (this.resolver === void 0) throw new Error("plugin-packages: runtime resolution is not installed");
+		this.resolver.replace(generation);
+		this.packages = /* @__PURE__ */ new Map();
+		this.disposeWorkerResolution?.();
+		this.disposeWorkerResolution = registerWorkerResolution(generation, this.behavior);
+	}
+	/**
+	* Locate the package named by a specifier without requiring a package export.
+	* @param specifier - module specifier whose package owns the requested module.
+	* @param parentURL - URL whose Node lookup order applies.
+	* @returns the parsed package, or undefined when no package owns the request.
+	*/
+	packageOf(specifier, parentURL) {
+		const name = barePackageName(specifier);
+		if (name === void 0) return void 0;
+		const dir = this.resolver === void 0 ? packageDirFromParent(name, parentURL) : this.resolver.packageDir(name, parentURL);
+		if (dir === void 0) return void 0;
+		const key = JSON.stringify({
+			dir,
+			name
+		});
+		if (!this.packages.has(key)) this.packages.set(key, readPackage(dir, name));
+		return this.packages.get(key);
+	}
+};
+function packageDirFromParent(name, parentURL) {
+	for (const searchPath of createRequire(parentURL).resolve.paths(name)) {
+		const candidate = join(searchPath, name);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * Shared boot glue for `dsh` profiles, including the CLI packaged by the Python runtime wheel: load the gitignored
@@ -1099,33 +2121,38 @@ function loadLayeredEnv(binName, cwd = process.cwd(), warn = (line) => void proc
 }
 const bootstrapIncludes = /* @__PURE__ */ new WeakMap();
 const userPatchesSchema = entryListSchema;
-/**
-* Watch the user patch layer through Cordis HMR and transactionally reapply it to the boot include.
-* @param ctx - settled app context containing the root Include and an active HMR service.
-* @param options - diagnostic, file, and patch-composition inputs.
-* @returns an asynchronous disposer after the exact-path watcher is ready.
-* @throws when HMR or the root Include is absent, watcher setup fails, or initial path resolution fails.
+/** Apply one complete patch generation and wait for Loader activation diagnostics.
+* @param ctx Booted root context.
+* @param patches Complete ordered patch list.
+* @param binName Diagnostic prefix.
+* @param requiredIds Explicit enablement targets whose existing failures also reject reconciliation.
+* @returns Diagnostics for unchanged pre-existing inactive entries; new or changed failures reject.
 */
-async function watchUserPatches(ctx, options) {
-	const { binName, filename, compose = (patches) => patches } = options;
-	const hmr = ctx.get("hmr");
-	if (hmr === void 0) throw new Error(`${binName}: user patch-layer watching requires the Cordis HMR service`);
+async function reconcileProfilePatches(ctx, patches, binName, requiredIds = []) {
 	const entry = bootstrapIncludes.get(ctx);
-	if (entry === void 0) throw new Error(`${binName}: user patch-layer watching requires the root Include entry`);
-	const register = hmr.registerConfig(filename, async () => {
-		const { patches: _previousPatches, ...includeConfig } = entry.options.config;
-		const patches = compose(loadOptionalPatches(binName, filename) ?? []);
-		await entry.update({ config: {
-			...includeConfig,
-			patches
-		} });
-	});
-	try {
-		return await register;
-	} catch (error) {
-		if (error?.code === "INACTIVE_EFFECT") return async () => {};
-		throw error;
-	}
+	if (entry === void 0) throw new Error(`${binName}: profile reload requires the root Include entry`);
+	const previousFailures = (await inactiveEntries(ctx)).map((failure) => ({
+		...failure,
+		diagnostic: inactiveDiagnostic(failure),
+		fiber: failure.entry.fiber,
+		options: JSON.stringify(failure.entry.options)
+	}));
+	const previousFibers = [...ctx.loader.entries()].flatMap((row) => row.fiber === void 0 ? [] : [{
+		fiber: row.fiber,
+		failed: row.fiber.state === FIBER_FAILED || row.fiber.state === FIBER_DISPOSED
+	}]);
+	const { patches: _previous, ...includeConfig } = entry.options.config;
+	await entry.update({ config: {
+		...includeConfig,
+		patches
+	} });
+	const results = await Promise.allSettled(previousFibers.map(({ fiber }) => fiber.await()));
+	await ctx.loader.await();
+	const failures = await inactiveEntries(ctx);
+	const introduced = failures.filter((failure) => requiredIds.includes(failure.entry.options.id) || !previousFailures.some((previous) => previous.entry === failure.entry && previous.fiber === failure.entry.fiber && previous.options === JSON.stringify(failure.entry.options) && previous.diagnostic === inactiveDiagnostic(failure)));
+	if (introduced.length > 0) throw new Error(activationDiagnostic(binName, introduced).trimEnd());
+	for (const [index, result] of results.entries()) if (result.status === "rejected" && !previousFibers[index]?.failed) throw result.reason;
+	return failures.map(inactiveDiagnostic);
 }
 /**
 * Load an optional patch-list file: a top-level YAML array of loader patch
@@ -1257,7 +2284,7 @@ function renderConfigDump(binName, absoluteConfigPath, layers, warn = (line) =>
 	};
 	let previous = base;
 	let previousWarnings = [];
-	const provenance = base.map(() => ({
+	const entryOrigins = base.map(() => ({
 		origin: baseLabel,
 		patchedBy: []
 	}));
@@ -1270,18 +2297,18 @@ function renderConfigDump(binName, absoluteConfigPath, layers, warn = (line) =>
 		composed = snapshot(count, warnings);
 		for (const line of warnings.slice(previousWarnings.length)) warn(`${binName}: [${layer.label}] ${line}`);
 		const before = previous.map((entry) => JSON.stringify(entry));
-		for (let index = 0; index < composed.length; index += 1) if (index >= before.length) provenance.push({
+		for (let index = 0; index < composed.length; index += 1) if (index >= before.length) entryOrigins.push({
 			origin: layer.label,
 			patchedBy: []
 		});
-		else if (JSON.stringify(composed[index]) !== before[index]) provenance[index]?.patchedBy.push(layer.label);
+		else if (JSON.stringify(composed[index]) !== before[index]) entryOrigins[index]?.patchedBy.push(layer.label);
 		previous = composed;
 		previousWarnings = warnings;
 	}
-	return groupedDump(composed, provenance);
+	return groupedDump(composed, entryOrigins);
 }
 /** Render the composed rows grouped under one source-and-patches comment per contiguous run. */
-function groupedDump(composed, provenance) {
+function groupedDump(composed, entryOrigins) {
 	const lines = [];
 	let currentLabel;
 	let group = [];
@@ -1295,7 +2322,7 @@ function groupedDump(composed, provenance) {
 		group = [];
 	};
 	for (let index = 0; index < composed.length; index += 1) {
-		const record = provenance[index];
+		const record = entryOrigins[index];
 		/* v8 ignore next -- this array is index-aligned with composed by construction */
 		if (record === void 0) continue;
 		const label = record.patchedBy.length === 0 ? record.origin : `${record.origin}, patched by ${record.patchedBy.join(", ")}`;
@@ -1317,7 +2344,7 @@ function groupedDump(composed, provenance) {
 * names; relative names continue to resolve beside the configuration file.
 * @returns the created root Include entry, or `undefined` when a surface
 * disposed the whole tree (taking the Loader service with it) while the
-* transactional create was still settling entry lifecycle.
+* entry creation was in flight.
 */
 async function mountRootInclude(ctx, absoluteConfigPath, patches = [], bareModuleBaseUrl) {
 	ctx.loader.builtins.include = bareModuleBaseUrl === void 0 ? Include : class HostResolvedRootInclude extends Include {
@@ -1372,7 +2399,7 @@ const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2e3;
 /**
 * Install before boot to turn a late unhandled plugin-init rejection into one
 * labelled stderr diagnostic and `exit(1)`. A rejection already included by
-* {@link assertEntriesActivated} is ignored during its process checkpoint;
+* {@link auditStartupEntries} is ignored during its process checkpoint;
 * every other rejection remains fatal. Stdout remains untouched for ACP; the
 * returned function removes the handler.
 *
@@ -1425,50 +2452,99 @@ function installFailLoud(binName, proc = process, release) {
 	return uninstall;
 }
 /**
-* After the tree settles, reject entries with no fiber and name every plugin
-* whose module failed to resolve. Disabled entries are the only valid
-* fiber-less state.
-* @param ctx - the settled context whose loader entries to audit.
-* @param binName - the diagnostic prefix on the thrown error.
-*/
-function assertEntriesLoaded(ctx, binName) {
-	const failed = [...ctx.loader.entries()].filter((entry) => entry.fiber === void 0 && !entry.disabled);
-	if (failed.length > 0) {
-		const names = failed.map((entry) => entry.options.name).join(", ");
-		throw new Error(`${binName}: plugin(s) failed to load: ${names}; Cordis startup failed because these plugin(s) could not be resolved (see the error(s) logged above)`);
-	}
-}
-/**
 * Value mirrors used because Cordis's const enum has no runtime object to import.
-* Keep aligned with `packages/extensions/tool-cordis/src/fiber-state.ts` and
-* `packages/client/web/src/loader-status.ts`.
+* Keep aligned with `packages/client/web/src/loader-status.ts`.
 */
 const FIBER_PENDING = 0;
 const FIBER_ACTIVE = 2;
 const FIBER_FAILED = 3;
-/** Render a thrown plugin value without discarding an Error's original stack. */
+const FIBER_DISPOSED = 4;
+/**
+* Entry ids whose presence defines a usable DSH application.
+*
+* The list is global rather than profile metadata. Missing or disabled ids do
+* not affect startup; an enabled listed entry must activate. The list covers
+* shared Agent execution, application endpoints, and Web bootstrap/transport.
+*/
+const requiredStartupEntryIds = new Set([
+	"agent-loop",
+	"webserver",
+	"modules",
+	"connection",
+	"headless-runner",
+	"acp",
+	"sdk-jsonrpc-server"
+]);
+/** Render plugin stacks, nested causes, and aggregate member failures once per error. */
 function formatActivationError(error) {
-	return error instanceof Error ? error.stack ?? error.message : String(error);
+	const details = [];
+	const seen = /* @__PURE__ */ new Set();
+	function visit(value) {
+		if (!(value instanceof Error)) {
+			details.push(String(value));
+			return;
+		}
+		if (seen.has(value)) return;
+		seen.add(value);
+		details.push(value.stack ?? value.message);
+		if (value.cause !== void 0) visit(value.cause);
+		if (value instanceof AggregateError) value.errors.forEach(visit);
+	}
+	visit(error);
+	return details.join("\n");
 }
+/** Startup audit failure with non-enumerable metadata and original failures as its cause. */
+var StartupError = class extends Error {
+	entries;
+	/** Root configuration and startup logs, attached by boot after disposal. */
+	startup;
+	/**
+	* @param message - concise terminal diagnostic.
+	* @param entries - inactive plugin metadata and original failure values.
+	*/
+	constructor(message, entries) {
+		const failures = entries.flatMap(({ outcome }) => outcome.kind === "failed" ? [outcome.error] : []);
+		super(message, failures.length > 0 ? { cause: new AggregateError(failures, "Plugin activation failures") } : void 0);
+		this.entries = entries;
+		Object.defineProperties(this, {
+			entries: { enumerable: false },
+			startup: { enumerable: false }
+		});
+	}
+};
 /**
-* Reject a settled Loader tree when an enabled entry failed or remains inactive.
-* Plugin failures include the original thrown stack; pending entries name their
-* unresolved services because no plugin error exists for that state. Active
-* entries require no further wait; only failed fibers are awaited to recover
-* their private rejection reason.
-* @param ctx - the settled context whose Loader entries to audit.
-* @param binName - the diagnostic prefix on the thrown error.
-* @returns nothing when every enabled entry is active.
-* @throws after one process rejection checkpoint when an entry failed to
-* import, rejected during activation, or did not become active.
+* Collect Loader activation failures and disabled-expression errors. Failed
+* fibers are awaited to recover their recorded rejection reason and coalesce
+* duplicate Loader notifications through the next process rejection checkpoint.
 */
-async function assertEntriesActivated(ctx, binName) {
-	assertEntriesLoaded(ctx, binName);
+async function inactiveEntries(ctx) {
 	const failures = [];
 	const rejectionReasons = [];
 	for (const entry of ctx.loader.entries()) {
+		try {
+			if (entry.disabled) continue;
+		} catch (error) {
+			failures.push({
+				entry,
+				outcome: {
+					kind: "failed",
+					error,
+					phase: "disabled expression failed"
+				}
+			});
+			continue;
+		}
 		const fiber = entry.fiber;
-		if (fiber === void 0 || entry.disabled) continue;
+		if (fiber === void 0) {
+			failures.push({
+				entry,
+				outcome: {
+					kind: "failed",
+					error: "failed to import"
+				}
+			});
+			continue;
+		}
 		const state = fiber.state;
 		if (state === FIBER_ACTIVE) continue;
 		if (state === FIBER_FAILED) {
@@ -1476,21 +2552,104 @@ async function assertEntriesActivated(ctx, binName) {
 				await fiber.await();
 			} catch (error) {
 				rejectionReasons.push(error);
-				failures.push(`${entry.options.name}: ${formatActivationError(error)}`);
+				failures.push({
+					entry,
+					outcome: {
+						kind: "failed",
+						error
+					}
+				});
 			}
 			continue;
 		}
 		if (state === FIBER_PENDING) {
 			const missing = Object.keys(fiber.inject).filter((service) => fiber.ctx.get(service) === void 0);
-			const subject = missing.length === 1 ? "service" : "services";
-			failures.push(`${entry.options.name}: pending (waiting for ${subject}: ${missing.join(", ") || "unknown"})`);
-		} else failures.push(`${entry.options.name}: fiber state ${String(state)}`);
+			failures.push({
+				entry,
+				outcome: {
+					kind: "pending",
+					missing
+				}
+			});
+		} else failures.push({
+			entry,
+			outcome: {
+				kind: "failed",
+				error: `fiber state ${String(state)}`
+			}
+		});
+	}
+	if (rejectionReasons.length > 0) await observeLoaderRejectionCheckpoint(rejectionReasons);
+	return failures;
+}
+/** Render one failed plugin's original error and activation phase. */
+function failureDetail(outcome) {
+	return `${outcome.phase === void 0 ? "" : `${outcome.phase}: `}${formatActivationError(outcome.error)}`;
+}
+/** Render optional-only warnings without changing startup policy. */
+function activationDiagnostic(binName, failures) {
+	const noun = failures.length === 1 ? "entry" : "entries";
+	return `${binName}: warning: ${String(failures.length)} ${noun} did not activate\n${failures.map(inactiveDiagnostic).join("\n")}\n`;
+}
+/** Stable per-entry text for reload comparisons and optional warnings. */
+function inactiveDiagnostic({ entry, outcome }) {
+	const detail = outcome.kind === "failed" ? failureDetail(outcome) : `pending (waiting for ${outcome.missing.length === 1 ? "service" : "services"}: ${outcome.missing.join(", ") || "unknown"})`;
+	return `${entry.options.id} (${entry.options.name}): ${detail}`;
+}
+/** Group startup failures and pending services, marking every required entry. */
+function startupDiagnostic(binName, failures, required) {
+	const lines = [`${binName}: startup failed: ${String(required.size)} required ${required.size === 1 ? "plugin" : "plugins"} did not activate`];
+	const failed = failures.flatMap(({ entry, outcome }) => outcome.kind === "failed" ? [{
+		entry,
+		outcome
+	}] : []);
+	const pending = failures.flatMap(({ entry, outcome }) => outcome.kind === "pending" ? [{
+		entry,
+		outcome
+	}] : []);
+	pending.sort((left, right) => Number(required.has(right.entry)) - Number(required.has(left.entry)));
+	const label = (entry) => `${entry.options.id}${required.has(entry) ? " (required)" : ""}`;
+	if (failed.length > 0) {
+		lines.push("", `Failed plugins (${String(failed.length)}):`);
+		for (const { entry, outcome } of failed) {
+			lines.push(`  ${label(entry)}`, `    Package: ${entry.options.name}`);
+			lines.push(...failureDetail(outcome).split("\n").map((line) => `    ${line}`));
+		}
 	}
-	if (failures.length > 0) {
-		if (rejectionReasons.length > 0) await observeLoaderRejectionCheckpoint(rejectionReasons);
-		const noun = failures.length === 1 ? "entry" : "entries";
-		throw new Error(`${binName}: ${String(failures.length)} ${noun} did not activate\n${failures.join("\n")}`);
+	if (pending.length > 0) {
+		const width = Math.max(6, ...pending.map(({ entry }) => label(entry).length)) + 2;
+		lines.push("", `Plugins waiting for services (${String(pending.length)}):`, `  ${"Plugin".padEnd(width)}Missing services`);
+		for (const { entry, outcome } of pending) lines.push(`  ${label(entry).padEnd(width)}${outcome.missing.join(", ") || "unknown"}`);
 	}
+	return lines.join("\n");
+}
+/**
+* Apply DSH startup policy to a settled Loader tree.
+*
+* Inactive entries from the global required list reject startup. Other
+* inactive entries join that failure diagnostic, or produce one warning when
+* no required entry failed and leave successful siblings running.
+* Required ids absent from the tree, and disabled required entries, are ignored.
+* A throwing disabled expression is an entry failure, not a disabled entry.
+* The bootstrap Include must activate so unreadable or invalid root config is fatal.
+* @param ctx - the settled context whose Loader entries to audit.
+* @param binName - the prefix on startup diagnostics.
+* @param warn - sink for optional-entry warnings.
+* @returns after optional warnings if required startup checks pass.
+* @throws {@link StartupError} when the bootstrap Include or a required entry is inactive or its disabled expression throws;
+* its message includes optional failures too.
+*/
+async function auditStartupEntries(ctx, binName, warn = (line) => void process.stderr.write(line)) {
+	const failures = await inactiveEntries(ctx);
+	const required = new Set(failures.filter(({ entry }) => entry === bootstrapIncludes.get(ctx) || requiredStartupEntryIds.has(entry.options.id)).map(({ entry }) => entry));
+	if (required.size > 0) throw new StartupError(startupDiagnostic(binName, failures, required), failures.map(({ entry, outcome }) => ({
+		id: entry.options.id,
+		module: entry.options.name,
+		required: required.has(entry),
+		fiberState: entry.fiber?.state,
+		outcome
+	})));
+	if (failures.length > 0) warn(activationDiagnostic(binName, failures));
 }
 /**
 * Boot the Loader against `absoluteConfigPath` and return only after the whole
@@ -1500,12 +2659,11 @@ async function assertEntriesActivated(ctx, binName) {
 * is statically imported and mounted as the `cordis:include` builtin, loading
 * through the ambient module pipeline (vite/tsx/plain ESM). The package build
 * embeds Include while leaving Loader external, so the built include tree and
-* host share one Loader peer. Loader
-* settlement rejects startup failures, which `boot` wraps after disposing the
-* partial context; a missing fiber or never-activating entry is rejected by
-* the final audit, {@link assertEntriesActivated}, which rethrows a plugin's
-* init rejection with its original stack; later unhandled rejections remain
-* covered by {@link installFailLoud}. Built bins need the Loader's native
+* host share one Loader peer. Loader settlement drains entry work without
+* rejecting the whole tree. The final {@link auditStartupEntries} call rejects
+* failures in the global required list and warns about other failed, missing,
+* and pending entries while successful siblings remain active. Later unhandled
+* rejections remain covered by {@link installFailLoud}. Built bins need the Loader's native
 * helper for bare plugin specifiers; relative specifiers do not.
 * @param binName - the diagnostic prefix for load-failure errors.
 * @param absoluteConfigPath - the config to include; must already be absolute
@@ -1516,33 +2674,70 @@ async function assertEntriesActivated(ctx, binName) {
 * @param bareModuleBaseUrl - optional installed-host base for bare package
 * names; use it when the host, rather than the configuration project, owns the
 * complete plugin set.
-* @returns the root context once every entry has started, or as soon as a
+* @returns the root context after the initial startup audit, or as soon as a
 * surface disposed the tree while startup was still in flight.
-* @throws a labelled error after disposing the partial context — `host
+* @throws {@link StartupError} for an inactive required entry, including all inactive plugins in its message;
+* otherwise a labelled error after disposing the partial context — `host
 * preparation failed` when `prepare` threw before any config-tree entry
-* mounted, `plugin tree failed to load` afterwards.
+* mounted, `plugin tree failed to load` afterwards. Cyclic causes terminate
+* diagnostic traversal without replacing the original cause.
 */
 async function boot(binName, absoluteConfigPath, patches, prepare, bareModuleBaseUrl) {
 	const ctx = new Context();
+	const startupLogs = [];
+	const diagnostics = new Context();
+	diagnostics.logger = ctx.logger;
+	diagnostics.logger.exporter({
+		levels: { default: 2 },
+		export: ({ ts, name, type, args }) => {
+			if (type === "warn" || type === "error") startupLogs.push({
+				ts,
+				name,
+				type,
+				args
+			});
+		}
+	});
 	let stage = "host preparation failed";
 	try {
 		ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + "/";
 		ctx.provide("dshHomePath", dshHomePath);
+		ctx.on("internal/update", (_config, _noSave, next) => {
+			Promise.resolve(next()).catch((error) => {
+				ctx.logger.error(error);
+			});
+		}, {
+			global: true,
+			prepend: true
+		});
 		await ctx.plugin(Loader);
 		await prepare?.(ctx);
 		stage = "plugin tree failed to load";
 		await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl);
 		await ctx.get("loader")?.await();
 		if (ctx.get("loader") === void 0) return ctx;
-		await assertEntriesActivated(ctx, binName);
+		await auditStartupEntries(ctx, binName);
 		return ctx;
 	} catch (cause) {
 		await ctx.fiber.dispose();
+		if (cause instanceof StartupError) {
+			cause.startup = {
+				configurationPath: absoluteConfigPath,
+				messages: startupLogs
+			};
+			throw cause;
+		}
 		const detail = cause instanceof Error ? cause.message : String(cause);
 		let deepest = cause;
-		while (deepest instanceof Error && deepest.cause !== void 0) deepest = deepest.cause;
+		const seen = /* @__PURE__ */ new Set();
+		while (deepest instanceof Error && !seen.has(deepest) && deepest.cause !== void 0) {
+			seen.add(deepest);
+			deepest = deepest.cause;
+		}
 		const stack = deepest instanceof AggregateError ? `\n${deepest.stack ?? deepest.message}\n${deepest.errors.map(formatActivationError).join("\n")}` : deepest instanceof Error && deepest !== cause ? `\n${deepest.stack ?? deepest.message}` : "";
 		throw new Error(`${binName}: ${stage}: ${detail}${stack}`, { cause });
+	} finally {
+		await diagnostics.fiber.dispose();
 	}
 }
 /** Prompt-section name for the harness-source location line an app bin adds after boot. */
@@ -1572,4 +2767,4 @@ function addHarnessSourceSection(ctx, sourceRoot) {
 	});
 }
 //#endregion
-export { DEFAULT_PROFILE_BUNDLES, DEFAULT_PROFILE_PATCH_RELOAD, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, PROFILES_DIR, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, addHarnessSourceSection, assertEntriesActivated, assertEntriesLoaded, boot, composeEntries, healProfilesModuleFallback, initProfile, installFailLoud, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, readProfileManifest, renderConfigDump, resolveBundleDir, resolveConfigPath, resolveProfileDir, watchUserPatches, writeProfileManifest };
+export { DEFAULT_PROFILE_BUNDLES, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, OPTIONAL_BUNDLES, PROFILES_DIR, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, StartupError, addHarnessSourceSection, auditStartupEntries, boot, composeEntries, createProfileResolutionGeneration, healIsolatedProfileModuleFallback, healProfilesModuleFallback, initProfile, installFailLoud, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, readProfileManifest, readProfilePatches, readProfilePlugins, reconcileProfilePatches, reconcileProfilePlugins, renderConfigDump, resolveBundleDir, resolveConfigPath, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, unlinkProfileModuleFallback, writeProfileBundles, writeProfileManifest };