@mearl/setup 3.0.0-beta.7 → 3.0.0-beta.9

package/README.md

@@ -1,6 +1,6 @@
 # @mearl/setup
 
-3.0 当前以 beta 发行。使用 `@beta` 入口安装同版本的 setup、运行包和扩展；正式版 `latest` 保留 2.22。组织能力由独立 preset 分发。
+3.0 当前以 beta 发行。使用 `@beta` 入口安装同版本的 setup、运行包和扩展；正式版使用 `latest` 标签。
 
 Mearl 环境的一次性安装、更新、卸载与配置工具。无需先全局安装 setup：
 
@@ -29,13 +29,13 @@ npx @mearl/setup@beta preset repair [--replace-skill <name> ...]
 一个命令安装 skill 并注册它的 CLI、SDK 和 MCP 能力：
 
 ```bash
-npx @mearl/setup@beta plugin install https://github.com/mearlhq/mearl/tree/codex/open-source-ready --skill browser-tab-manager --yes
+npx @mearl/setup@beta plugin install https://github.com/mearlhq/mearl --skill browser-tab-manager --yes
 mearl tabs summary
 ```
 
 安装参数传给固定版本的公共 Skills CLI（当前 skills@1.5.0，兼容项目的 Node 最低版本），使用全局共享目录。公共 CLI 的默认 symlink 和复制模式都可注册；复制模式通过 list --global --json 确认本次成功结果对应的 canonical path，不猜测目录，也不扫描其他 Skills。自定义 CLI 可通过 MEARL_SKILLS_PATH 指定。参数不接受截断后置选项的 -- 分隔符。
 
-安装宿主提供的本地插件目录决定哪些能力由 preset 管理。install/update 只维护该目录中的托管注册，保留用户自行注册的同名插件；普通外网环境没有组织专属名单，也不探测组织 registry。卸载最后一个依赖环境时移除托管插件与 Mearl Skill；其他环境仍需要时保留。--skip-skill 与版本线安装维持原有跳过规则。整套 preset 准备、权限、宿主同步及实际安装状态通过统一安装合同处理。
+安装宿主提供的本地插件目录决定哪些能力由 preset 管理。install/update 维护目录中的托管注册，保留用户自行注册的插件。卸载最后一个依赖环境时移除托管插件与 Mearl Skill；其他环境需要时保留。配置准备、宿主同步和实际安装状态共用 [安装合同](../../docs/preset-installation.md)。
 
 Native preset 批次新建的插件注册使用 setup 托管归属，后续通过 Agent 更新仍保留该归属；同目录已有的用户注册保持原归属，自定义用户别名也会保留。托管卸载遇到用户别名共用同一 Skill 时，只清除托管注册并保留 Skill 文件。
 
@@ -89,7 +89,7 @@ npx @mearl/setup@beta provider update example-device
 npx @mearl/setup@beta provider uninstall example-device
 ```
 
-安装参数接受包名、版本或 dist-tag；更新和卸载可使用 providerId 或完整包名。核心 @mearl 包固定使用公共 npm registry；其余 scope 沿用调用方的包管理器配置，组织 registry 由能力安装引导提供。安装沿用启动 setup 的包管理器，
+安装参数接受包名、版本或 dist-tag；更新和卸载可使用 providerId 或完整包名。核心 @mearl 包固定使用公共 npm registry；其余 scope 沿用调用方的包管理器配置。安装沿用启动 setup 的包管理器，
 更新和卸载沿用当前 Provider 的原包管理器。Provider 登记只保存
 经过校验的包名、安装目录和包内入口；不接受包自行注入启动命令、参数、工作目录或环境变量。
 卸载仅在包管理器成功移除包后清除登记，以便失败时可以重试。
@@ -245,9 +245,9 @@ npx @mearl/setup@beta provider install @example/mearl-provider-cloud
 
 `mearl-setup preset apply <source-url-or-path>` 准备确切资源、激活本机 Node 选择，并向兼容扩展同步同一批浏览器资源；`preset update` 保留用户覆盖，`preset status` 只读检查实际就绪状态。退出码 3 表示存在待同步/安装组件。完整扩展、默认设置、Skills/Provider 和网页一键安装使用同一实际状态核验，见 [本机安装合同](../../docs/preset-installation.md)。
 
-普通 install/update 在替换包前保存选中 preset 的确切资源和期望选择，运行时初始化后再同步宿主和安装 Skills；`extension --full` 也在替换扩展前完成准备。已有本机 preset 优先保留，显式 `--preset` 可更新或修复资源。配置或资源不可用会在包变更前停止，不回退到无内部能力的安装。部分升级后的重试使用已保存安装记录，即使包版本已变为 3.x 也不重新下载。卸载不准备或安装 preset。
+install/update 在替换包前保存选中 Preset 的确切资源和期望选择，运行时初始化后同步宿主并安装 Skills；`extension --full` 在替换扩展前完成同一准备流程。已有本机选择优先保留，显式 `--preset` 用于更新或修复资源。配置或资源不可用时停止包变更；部分升级后的重试使用已保存记录。卸载不准备或安装 Preset。
 
-默认目录为公共站点的 `installation.json`，可通过 `MEARL_INSTALLATION_CONFIG_URL` 指定其他 HTTPS 目录（本地验证允许回环 HTTP）。核心不包含组织 ID 或私有来源；目录沿用网页安装的校验合同。本机与浏览器未全部确认时仍报告 pending，准备成功不表示已发行或已完成真实企业授权验收。
+默认目录为公共站点的 `installation.json`，可通过 `MEARL_INSTALLATION_CONFIG_URL` 指定其他 HTTPS 目录（本地验证允许回环 HTTP）。目录采用网页安装的校验合同；本机与浏览器未全部确认时报告 pending。
 
 ## 浏览器 preset 与发行入口
 

package/dist/lifecycle.d.ts

@@ -5,6 +5,8 @@ import { detectGlobalPackage, type PackageManagerInstallation, type PackageDetec
 import { type DetectedMearlProfiles, type MearlProfile } from './profiles.js';
 import { uninstallNativeHostArtifacts } from './nativeHost.js';
 import { type CommandRunner } from '@mearl/daemon-core';
+import { readInstallationManagement } from '@mearl/daemon-core/installation';
+import { claimPresetInstallation } from './presetInstallationLease.js';
 import { installManagedPlugins, uninstallManagedPlugins } from './managedPlugins.js';
 import { uninstallPlugin } from './plugin.js';
 import { uninstallProviderPackage } from './provider.js';
@@ -30,6 +32,8 @@ export interface MearlLifecycleOptions {
     env?: NodeJS.ProcessEnv;
 }
 export interface MearlLifecycleDependencies {
+    readManagement?: typeof readInstallationManagement;
+    claimLifecycle?: () => ReturnType<typeof claimPresetInstallation>;
     prepareBrowserPreset?: typeof prepareBrowserSetupPreset;
     preparePreset?: typeof prepareSetupPreset;
     onPresetStatus?: (status: PresetInstallStatus) => void;

package/dist/lifecycle.js

@@ -1,6 +1,7 @@
 import { SETUP_VERSION } from './setupVersion.js';
 import fs from 'node:fs';
 import path from 'node:path';
+import { homedir } from 'node:os';
 import { createInterface } from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { listPluginNames } from '@mearl/client/plugin';
@@ -9,7 +10,9 @@ import { runGlobalMearlSkillOperation } from './skills.js';
 import { buildGlobalPackageCommand, detectGlobalPackage, resolveInvokingPackageManager, resolvePackageManagerInstallation, } from './packageManager.js';
 import { MEARL_PROFILES, detectMearlProfiles, } from './profiles.js';
 import { uninstallNativeHostArtifacts } from './nativeHost.js';
-import { executableNames, prependCommandPath, runCommand, } from '@mearl/daemon-core';
+import { executableNames, prependCommandPath, runCommand, withOwnedCommands, } from '@mearl/daemon-core';
+import { readInstallationManagement, setupManagementCommand, setupRuntimeCompatible } from '@mearl/daemon-core/installation';
+import { claimPresetInstallation } from './presetInstallationLease.js';
 import { isMearlReleaseLine, mearlPackageSelector } from './version.js';
 import { installManagedPlugins, uninstallManagedPlugins, } from './managedPlugins.js';
 import { uninstallPlugin } from './plugin.js';
@@ -176,6 +179,38 @@ export async function runMearlLifecycle(options, dependencies = {}) {
     if (options.targetLine && !isMearlReleaseLine(options.targetLine)) {
         throw new Error('targetLine must be a valid Mearl release line such as 2.3.x');
     }
+    const writeLine = dependencies.writeLine ?? (line => console.error(line));
+    let lease;
+    try {
+        lease = (dependencies.claimLifecycle ?? (() => claimPresetInstallation(path.join(homedir(), '.agents', '.mearl-setup-lifecycle.json'))))();
+        const readManagement = () => (dependencies.readManagement ?? readInstallationManagement)({ directory: (options.env ?? process.env).MEARL_CAPABILITY_DIR });
+        let acceptedRevision = (await readManagement()).revision;
+        let selector = mearlPackageSelector(SETUP_VERSION, options.targetLine);
+        const assertManagement = async (expected = acceptedRevision) => {
+            const { setup, revision } = await readManagement();
+            if (revision !== expected)
+                throw new Error('PRESET_SELECTION_CHANGED: The selected preset changed during setup.');
+            if (setup && options.operation !== 'uninstall' && !setupRuntimeCompatible(setup, SETUP_VERSION, options.targetLine)) {
+                throw new Error(`SETUP_RUNTIME_CONFLICT: The selected preset requires ${setup.runtime}. Use ${setupManagementCommand(setup)} ${options.operation}.`);
+            }
+            selector = setup?.runtime ? options.targetLine ?? SETUP_VERSION : mearlPackageSelector(SETUP_VERSION, options.targetLine);
+        };
+        await assertManagement();
+        const runner = dependencies.runCommand ?? runCommand;
+        return await withOwnedCommands(lease.lifecycle, () => executeLifecycle(options, {
+            ...dependencies,
+            runCommand: async (...args) => { await assertManagement(); return runner(...args); },
+        }, async (revision) => { await assertManagement(revision); acceptedRevision = revision; }, () => selector));
+    }
+    catch (error) {
+        writeLine(`Setup: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+    finally {
+        lease?.release();
+    }
+}
+async function executeLifecycle(options, dependencies, acceptPreset, packageSelector) {
     const env = options.env ?? process.env;
     const writeLine = dependencies.writeLine ?? (line => console.error(line));
     const existsSync = dependencies.existsSync ?? fs.existsSync;
@@ -290,6 +325,8 @@ export async function runMearlLifecycle(options, dependencies = {}) {
             stagedPreset = await (dependencies.preparePreset ?? prepareSetupPreset)({
                 source: options.presetSource, env,
             });
+            if (stagedPreset)
+                await acceptPreset(stagedPreset.revision);
         }
         catch (error) {
             writeLine(`Preset preparation: ${error instanceof Error ? error.message : String(error)}`);
@@ -322,7 +359,7 @@ export async function runMearlLifecycle(options, dependencies = {}) {
             detected.get('local') ??
             detected.get('cloud') ??
             resolveInvokingManager(env);
-        const sharedClient = await runPackageOperation(clientInstallation, options.operation, [UNIFIED_CLIENT], mearlPackageSelector(SETUP_VERSION, options.targetLine), runner, env, 'Packages (shared client)', writeLine);
+        const sharedClient = await runPackageOperation(clientInstallation, options.operation, [UNIFIED_CLIENT], packageSelector(), runner, env, 'Packages (shared client)', writeLine);
         if (!sharedClient.ok) {
             writeLine('Mearl setup incomplete. Review the messages above.');
             return false;
@@ -362,7 +399,7 @@ export async function runMearlLifecycle(options, dependencies = {}) {
         if (packages.length === 0) {
             continue;
         }
-        const packageResult = await runPackageOperation(installation, packageOperation, packages, mearlPackageSelector(SETUP_VERSION, options.targetLine), runner, env, `Packages (${profile})`, writeLine);
+        const packageResult = await runPackageOperation(installation, packageOperation, packages, packageSelector(), runner, env, `Packages (${profile})`, writeLine);
         if (!packageResult.ok) {
             packagesOk = false;
             continue;
@@ -423,6 +460,8 @@ export async function runMearlLifecycle(options, dependencies = {}) {
     if (packagesOk && selectsInitialPreset && !stagedPreset && !options.presetSource && lifecycleSelected.some(profile => profile === 'local' || profile === 'mcp')) {
         try {
             stagedPreset = await (dependencies.prepareBrowserPreset ?? prepareBrowserSetupPreset)({ env, waitMs: 65_000, writeLine });
+            if (stagedPreset)
+                await acceptPreset(stagedPreset.revision);
         }
         catch (error) {
             writeLine(`Browser preset: ${error instanceof Error ? error.message : String(error)}`);
@@ -432,6 +471,8 @@ export async function runMearlLifecycle(options, dependencies = {}) {
     if (packagesOk && selectsInitialPreset && !stagedPreset && options.defaultPresetSource) {
         try {
             stagedPreset = await (dependencies.preparePreset ?? prepareSetupPreset)({ fallbackSource: options.defaultPresetSource, env });
+            if (stagedPreset)
+                await acceptPreset(stagedPreset.revision);
         }
         catch (error) {
             writeLine(`Default preset: ${error instanceof Error ? error.message : String(error)}`);

package/dist/presetStore.d.ts

@@ -1,46 +1,2 @@
-import { type JsonObject, type CapabilityActivation, type ResolvedPreset } from '@mearl/preset';
-import { type PreparedBundle, type PreparedPreset, type PresetSnapshot } from '@mearl/preset/bundles';
-export interface PresetInstallReceipt {
-    schemaVersion: 1;
-    snapshot: PresetSnapshot;
-    bundles: Array<Omit<PreparedBundle, 'resources'>>;
-    browserRevision: string;
-    nodeRevision: string;
-    managedModules: string[];
-    nodeSyncRequired: boolean;
-    browserSyncRequired?: boolean;
-    overrides: JsonObject;
-    revision: string;
-}
-interface SelectionState {
-    rawHash: string | null;
-    activation?: CapabilityActivation;
-    receipt?: PresetInstallReceipt;
-    prepared?: PreparedPreset;
-    preset?: ResolvedPreset;
-}
-/** One pointer binds the desired preset, user overrides and exact Node selection. */
-export declare class PresetInstallationStore {
-    readonly directory: string;
-    readonly mearlApiVersion: string;
-    private readonly pointer;
-    constructor(options?: {
-        directory?: string;
-        mearlApiVersion?: string;
-    });
-    private assertCurrent;
-    current(options?: {
-        verifyResources?: boolean;
-    }): Promise<SelectionState>;
-    apply(input: Pick<PreparedPreset, 'snapshot' | 'bundles'>, options: {
-        expectedRevision: string | null;
-        overrides?: JsonObject;
-        signal?: AbortSignal;
-        confirm?: () => Promise<void>;
-    }): Promise<PresetInstallReceipt>;
-    rollback(expectedRevision: string): Promise<void>;
-    collectGarbage(): Promise<void>;
-    private collectLocked;
-}
-export declare function presetSelectionRevision(state: SelectionState): string | null;
-export {};
+export { PresetInstallationStore, presetSelectionRevision } from '@mearl/daemon-core/installation';
+export type { PresetInstallReceipt } from '@mearl/daemon-core/installation';

package/dist/presetStore.js

@@ -1,248 +1 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { constants, closeSync, fstatSync, lstatSync, linkSync, mkdirSync, openSync, readSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { withRecordLock } from '@mearl/daemon-core';
-import { mergePresetDefaults, prepareNodeBundleSnapshot, prepareCapabilitySnapshot, verifyCapabilityActivation, resolveCapabilityConfig, MAX_CAPABILITY_SELECTION_BYTES } from '@mearl/preset';
-import { BundleError, MAX_BROWSER_STORAGE_BYTES, presetRequiresBrowser, validateBundleManifest, verifyPreset, verifyBrowserPreset, verifyPreparedPreset } from '@mearl/preset/bundles';
-const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
-const hashPattern = /^[a-f0-9]{64}$/;
-const MAX_RECEIPT_BYTES = 16 * 1024 * 1024;
-const MAX_OVERRIDES_BYTES = 262_144;
-const POINTER_BYTES = MAX_CAPABILITY_SELECTION_BYTES + 128;
-function readBounded(file, limit) {
-    const before = lstatSync(file);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > limit)
-        throw new Error('Invalid preset resource file or size');
-    const descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    try {
-        const stat = fstatSync(descriptor);
-        if (!stat.isFile() || stat.size > limit)
-            throw new Error('Invalid preset resource file or size');
-        const bytes = Buffer.alloc(Math.min(stat.size, limit) + 1);
-        let length = 0;
-        while (length < bytes.byteLength) {
-            const count = readSync(descriptor, bytes, length, bytes.byteLength - length, null);
-            if (count === 0)
-                break;
-            length += count;
-        }
-        if (length > stat.size)
-            throw new Error('Preset resource changed while reading');
-        return bytes.subarray(0, length);
-    }
-    finally {
-        closeSync(descriptor);
-    }
-}
-function optionalFile(file, limit) {
-    try {
-        return readBounded(file, limit);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw error;
-    }
-}
-function atomicWrite(file, bytes) {
-    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-    try {
-        writeFileSync(temporary, bytes, { flag: 'wx', mode: 0o600 });
-        renameSync(temporary, file);
-    }
-    finally {
-        rmSync(temporary, { force: true });
-    }
-}
-function revision(state) {
-    return state.activation?.installationRevision ?? (state.activation ? `node:${state.activation.revision}` : null);
-}
-function overrides(value) {
-    const accepted = mergePresetDefaults({}, value);
-    if (Buffer.byteLength(JSON.stringify(accepted)) > MAX_OVERRIDES_BYTES)
-        throw new BundleError('BUNDLE_QUOTA', 'User overrides exceed 256 KiB');
-    return accepted;
-}
-/** One pointer binds the desired preset, user overrides and exact Node selection. */
-export class PresetInstallationStore {
-    directory;
-    mearlApiVersion;
-    pointer;
-    constructor(options = {}) {
-        this.directory = resolve(options.directory ?? (process.env.MEARL_CAPABILITY_DIR || join(homedir(), '.mearl/capabilities')));
-        this.mearlApiVersion = options.mearlApiVersion ?? '1.0.0';
-        this.pointer = join(this.directory, 'active-node.json');
-    }
-    assertCurrent(expected) {
-        const bytes = optionalFile(this.pointer, POINTER_BYTES);
-        if ((bytes ? digest(bytes) : null) !== expected)
-            throw new BundleError('BUNDLE_CONFLICT', 'The installed preset changed during preparation');
-    }
-    async current(options = {}) {
-        const raw = optionalFile(this.pointer, POINTER_BYTES);
-        if (!raw)
-            return { rawHash: null };
-        const rawHash = digest(raw);
-        const activation = await verifyCapabilityActivation(JSON.parse(raw.toString('utf8')));
-        if (!activation.installationRevision)
-            return { rawHash, activation };
-        const captured = withRecordLock(this.pointer, () => {
-            this.assertCurrent(rawHash);
-            const receiptBytes = readBounded(join(this.directory, 'installations', `${activation.installationRevision}.json`), MAX_RECEIPT_BYTES);
-            const receipt = JSON.parse(receiptBytes.toString('utf8'));
-            const { revision: receiptRevision, ...data } = receipt;
-            if (receiptRevision !== activation.installationRevision || digest(JSON.stringify(data)) !== receiptRevision || data.schemaVersion !== 1 ||
-                Object.keys(data).some(key => !['schemaVersion', 'snapshot', 'bundles', 'browserRevision', 'nodeRevision', 'managedModules', 'nodeSyncRequired', 'browserSyncRequired', 'overrides'].includes(key)) || typeof data.nodeSyncRequired !== 'boolean' || (data.browserSyncRequired !== undefined && typeof data.browserSyncRequired !== 'boolean') ||
-                data.nodeRevision !== activation.revision || !Array.isArray(data.bundles) || data.bundles.length > 64 ||
-                !Array.isArray(data.managedModules) || new Set(data.managedModules).size !== data.managedModules.length || data.managedModules.some(id => typeof id !== 'string' || !Object.hasOwn(activation.modules, id))) {
-                throw new BundleError('BUNDLE_INTEGRITY', 'Installed preset receipt does not match its selection');
-            }
-            const acceptedOverrides = overrides(data.overrides);
-            let total = 0;
-            const metadata = data.bundles.map(bundle => {
-                if (Object.keys(bundle).some(key => !['source', 'manifest', 'revision'].includes(key)))
-                    throw new BundleError('BUNDLE_INVALID', 'Invalid installed package metadata');
-                const manifest = validateBundleManifest(bundle.manifest, this.mearlApiVersion);
-                total += Object.values(manifest.resources).reduce((sum, entry) => sum + entry.byteLength, 0);
-                return { ...bundle, manifest };
-            });
-            if (total > MAX_BROWSER_STORAGE_BYTES)
-                throw new BundleError('BUNDLE_QUOTA', 'Installed preset resources exceed 64 MiB');
-            const bundles = options.verifyResources === false ? [] : metadata.map(bundle => ({ ...bundle, resources: Object.fromEntries(Object.entries(bundle.manifest.resources).map(([name, entry]) => [name, readBounded(join(this.directory, 'blobs', `${entry.sha256}.bin`), entry.byteLength)])) }));
-            for (const entry of options.verifyResources === false ? [] : Object.values(activation.modules)) {
-                const bytes = readBounded(join(this.directory, 'objects', `${entry.sha256}.cjs`), entry.byteLength);
-                if (bytes.byteLength !== entry.byteLength || digest(bytes) !== entry.sha256)
-                    throw new BundleError('BUNDLE_INTEGRITY', 'Installed Node object is missing or corrupt');
-            }
-            return { receipt: { ...receipt, overrides: acceptedOverrides }, bundles };
-        });
-        if (options.verifyResources === false) {
-            const graph = await verifyPreset(captured.receipt.snapshot, this.mearlApiVersion);
-            await verifyBrowserPreset({ source: graph.snapshot.source, manifests: graph.snapshot.manifests, packageTargets: graph.snapshot.packageTargets,
-                bundleRevisions: Object.fromEntries(Object.entries(graph.snapshot.bundleRevisions).filter(([id]) => graph.preset.packages[id].targets?.includes('browser'))), revision: captured.receipt.browserRevision }, this.mearlApiVersion);
-            return { rawHash, activation, receipt: captured.receipt, preset: graph.preset };
-        }
-        const prepared = await verifyPreparedPreset({ snapshot: captured.receipt.snapshot, bundles: captured.bundles }, this.mearlApiVersion);
-        if (prepared.browser.snapshot.revision !== captured.receipt.browserRevision)
-            throw new BundleError('BUNDLE_INTEGRITY', 'Installed browser projection does not match');
-        const selected = await prepareNodeBundleSnapshot(prepared.bundles.filter(bundle => prepared.preset.packages[bundle.manifest.id].targets?.includes('node')), 'native-host', this.mearlApiVersion, resolveCapabilityConfig(mergePresetDefaults(prepared.preset.defaults, captured.receipt.overrides)));
-        if (Object.keys(selected.snapshot.modules).length !== captured.receipt.managedModules.length || captured.receipt.managedModules.some(id => !Object.hasOwn(selected.snapshot.modules, id)) ||
-            Object.entries(selected.snapshot.modules).some(([id, entry]) => JSON.stringify(entry) !== JSON.stringify(activation.modules[id])) ||
-            Object.entries(selected.snapshot.bindings).some(([hook, entry]) => JSON.stringify(entry) !== JSON.stringify(activation.bindings[hook])) ||
-            Object.values(activation.bindings).filter(entry => captured.receipt.managedModules.includes(entry.module)).length !== Object.keys(selected.snapshot.bindings).length) {
-            throw new BundleError('BUNDLE_INTEGRITY', 'Installed managed Node selection does not match its packages');
-        }
-        return { rawHash, activation, prepared, receipt: captured.receipt, preset: prepared.preset };
-    }
-    async apply(input, options) {
-        options.signal?.throwIfAborted();
-        const acceptedOverrides = options.overrides === undefined ? undefined : overrides(options.overrides);
-        const [current, prepared] = await Promise.all([this.current({ verifyResources: false }), verifyPreparedPreset(input, this.mearlApiVersion)]);
-        if (revision(current) !== options.expectedRevision)
-            throw new BundleError('BUNDLE_CONFLICT', 'The installed preset changed');
-        const selected = await prepareNodeBundleSnapshot(prepared.bundles.filter(bundle => prepared.preset.packages[bundle.manifest.id].targets?.includes('node')), 'native-host', this.mearlApiVersion, resolveCapabilityConfig(mergePresetDefaults(prepared.preset.defaults, acceptedOverrides ?? current.receipt?.overrides ?? {})));
-        const previousManaged = new Set(current.receipt?.managedModules ?? []);
-        const unmanaged = Object.fromEntries(Object.entries(current.activation?.modules ?? {}).filter(([id]) => !previousManaged.has(id)));
-        for (const entry of Object.values(unmanaged)) {
-            const bytes = readBounded(join(this.directory, 'objects', `${entry.sha256}.cjs`), entry.byteLength);
-            if (bytes.byteLength !== entry.byteLength || digest(bytes) !== entry.sha256)
-                throw new BundleError('BUNDLE_INTEGRITY', 'An independent Node module is corrupt');
-        }
-        if (Object.keys(selected.snapshot.modules).some(id => Object.hasOwn(unmanaged, id)))
-            throw new BundleError('BUNDLE_CONFLICT', 'A preset module conflicts with an independently installed Node module');
-        const bindings = Object.fromEntries(Object.entries(current.activation?.bindings ?? {}).filter(([, entry]) => Object.hasOwn(unmanaged, entry.module)));
-        if (Object.keys(selected.snapshot.bindings).some(hook => Object.hasOwn(bindings, hook)))
-            throw new BundleError('BUNDLE_CONFLICT', 'A preset hook conflicts with an independently installed Node module');
-        const snapshot = await prepareCapabilitySnapshot({ schemaVersion: 1, modules: { ...unmanaged, ...selected.snapshot.modules }, bindings: { ...bindings, ...selected.snapshot.bindings } });
-        const data = {
-            schemaVersion: 1, snapshot: prepared.snapshot,
-            bundles: prepared.bundles.map(({ source, revision, manifest }) => ({ source, revision, manifest })),
-            browserRevision: prepared.browser.snapshot.revision, nodeRevision: snapshot.revision,
-            managedModules: Object.keys(selected.snapshot.modules), overrides: acceptedOverrides ?? current.receipt?.overrides ?? {},
-            nodeSyncRequired: Boolean(current.receipt?.nodeSyncRequired || current.receipt?.managedModules.length || Object.values(prepared.preset.packages).some(entry => entry.enabled !== false && entry.targets?.includes('node'))),
-            browserSyncRequired: Boolean(current.receipt?.browserSyncRequired || presetRequiresBrowser(prepared.preset)),
-        };
-        const receipt = { ...data, revision: digest(JSON.stringify(data)) };
-        const receiptBytes = JSON.stringify(receipt);
-        if (Buffer.byteLength(receiptBytes) > MAX_RECEIPT_BYTES)
-            throw new BundleError('BUNDLE_QUOTA', 'Preset installation receipt exceeds 16 MiB');
-        const activation = { ...snapshot, installationRevision: receipt.revision };
-        await options.confirm?.();
-        withRecordLock(this.pointer, () => {
-            this.assertCurrent(current.rawHash);
-            options.signal?.throwIfAborted();
-            for (const child of ['blobs', 'objects', 'installations'])
-                mkdirSync(join(this.directory, child), { recursive: true, mode: 0o700 });
-            for (const bundle of prepared.bundles)
-                for (const [name, entry] of Object.entries(bundle.manifest.resources)) {
-                    atomicWrite(join(this.directory, 'blobs', `${entry.sha256}.bin`), bundle.resources[name]);
-                }
-            for (const entry of Object.values(selected.snapshot.modules)) {
-                const destination = join(this.directory, 'objects', `${entry.sha256}.cjs`);
-                const temporary = `${destination}.${randomUUID()}.tmp`;
-                try {
-                    linkSync(join(this.directory, 'blobs', `${entry.sha256}.bin`), temporary);
-                    renameSync(temporary, destination);
-                }
-                finally {
-                    rmSync(temporary, { force: true });
-                }
-            }
-            atomicWrite(join(this.directory, 'installations', `${receipt.revision}.json`), receiptBytes);
-            if (current.receipt?.revision !== receipt.revision)
-                atomicWrite(join(this.directory, 'rollback.json'), JSON.stringify({ candidate: receipt.revision, previous: current.activation ?? null }));
-            atomicWrite(this.pointer, JSON.stringify(activation));
-        });
-        return receipt;
-    }
-    async rollback(expectedRevision) {
-        const current = await this.current({ verifyResources: false });
-        if (current.activation?.installationRevision !== expectedRevision)
-            throw new BundleError('BUNDLE_CONFLICT', 'A newer preset installation cannot be rolled back');
-        const record = JSON.parse(readBounded(join(this.directory, 'rollback.json'), POINTER_BYTES + 256).toString('utf8'));
-        if (record.candidate !== expectedRevision)
-            throw new BundleError('BUNDLE_CONFLICT', 'The preset rollback record has changed');
-        const previous = record.previous === null ? undefined : await verifyCapabilityActivation(record.previous);
-        withRecordLock(this.pointer, () => {
-            this.assertCurrent(current.rawHash);
-            if (previous)
-                atomicWrite(this.pointer, JSON.stringify(previous));
-            else
-                rmSync(this.pointer, { force: true });
-            rmSync(join(this.directory, 'rollback.json'), { force: true });
-            this.collectLocked(previous);
-        });
-    }
-    async collectGarbage() {
-        const current = await this.current({ verifyResources: false });
-        const raw = optionalFile(join(this.directory, 'rollback.json'), POINTER_BYTES + 256);
-        const record = raw && JSON.parse(raw.toString('utf8'));
-        const previous = record?.candidate === current.activation?.installationRevision && record.previous !== null ? await verifyCapabilityActivation(record.previous) : undefined;
-        withRecordLock(this.pointer, () => {
-            this.assertCurrent(current.rawHash);
-            for (const child of ['blobs', 'objects', 'installations'])
-                mkdirSync(join(this.directory, child), { recursive: true, mode: 0o700 });
-            this.collectLocked(current.activation, previous);
-        });
-    }
-    collectLocked(active, previous) {
-        const receipts = new Set([active?.installationRevision, previous?.installationRevision].filter((value) => Boolean(value)));
-        const blobs = new Set();
-        const modules = new Set([active, previous].flatMap(selection => Object.values(selection?.modules ?? {}).map(entry => entry.sha256)));
-        for (const id of receipts) {
-            const record = JSON.parse(readBounded(join(this.directory, 'installations', `${id}.json`), MAX_RECEIPT_BYTES).toString('utf8'));
-            for (const bundle of record.bundles)
-                for (const entry of Object.values(bundle.manifest.resources))
-                    blobs.add(entry.sha256);
-        }
-        for (const [directory, extension, retained] of [['blobs', '.bin', blobs], ['objects', '.cjs', modules], ['installations', '.json', receipts]]) {
-            for (const name of readdirSync(join(this.directory, directory))) {
-                const id = name.slice(0, -extension.length);
-                if (name.endsWith(extension) && hashPattern.test(id) && !retained.has(id))
-                    rmSync(join(this.directory, directory, name), { force: true });
-            }
-        }
-    }
-}
-export function presetSelectionRevision(state) { return revision(state); }
+export { PresetInstallationStore, presetSelectionRevision } from '@mearl/daemon-core/installation';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mearl/setup",
-  "version": "3.0.0-beta.7",
+  "version": "3.0.0-beta.9",
   "description": "One-shot environment setup and configuration for Mearl",
   "type": "module",
   "main": "dist/index.js",
@@ -78,11 +78,11 @@
     "ws": "^8.18.3",
     "semver": "^7.8.5",
     "adm-zip": "^0.6.1",
-    "@mearl/client": "3.0.0-beta.7",
-    "@mearl/provider": "3.0.0-beta.7",
-    "@mearl/daemon-core": "3.0.0-beta.7",
-    "@mearl/preset": "3.0.0-beta.7",
-    "@mearl/browser-core": "3.0.0-beta.7"
+    "@mearl/client": "3.0.0-beta.9",
+    "@mearl/provider": "3.0.0-beta.9",
+    "@mearl/daemon-core": "3.0.0-beta.9",
+    "@mearl/preset": "3.0.0-beta.9",
+    "@mearl/browser-core": "3.0.0-beta.9"
   },
   "devDependencies": {
     "@types/node": "^24.9.1",