@qlzt/dsh-app-boot 0.0.0-stage → 0.2.1-alpha.2

package/lib/index.js

@@ -0,0 +1,4293 @@
+import { createRequire, isBuiltin } from "node:module";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { inspect, parseEnv } from "node:util";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
+import * as yaml from "js-yaml";
+import { load } from "js-yaml";
+import { Context, Service } from "@deepseek-ai/cordis";
+import Loader, { EntryGroup, EntryTree, ModuleLoader, isJsExpr } from "@deepseek-ai/cordis-plugin-loader";
+import { access, constants, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import Group from "@deepseek-ai/cordis-plugin-group";
+import { dshHomePath, resolveDshHome } from "@qlzt/dsh-home-paths";
+import { createLaunchEnvironmentSnapshot } from "@qlzt/dsh-launch-environment";
+import semver, { parse } from "semver";
+import { withFileLock, writeFileAtomic } from "@qlzt/dsh-atomic-write";
+import { getEnvironmentData, setEnvironmentData } from "node:worker_threads";
+import { imports } from "resolve.exports";
+//#region ../../../vendor/include/src/index.ts
+const JsExpr = new yaml.Type("tag:yaml.org,2002:js", {
+	kind: "scalar",
+	resolve: (data) => typeof data === "string",
+	construct: (data) => ({ __jsExpr: data }),
+	predicate: isJsExpr,
+	represent: (data) => data["__jsExpr"]
+});
+/**
+* The entry-list YAML dialect: `!!js` scalars round-trip as expression nodes
+* the Loader evaluates at entry activation. Exported so config tooling
+* (`dsh --dump-config`) parses and prints exactly the dialect this include
+* mounts.
+*/
+const entryListSchema = yaml.JSON_SCHEMA.extend(JsExpr);
+const schema = entryListSchema;
+const writable = {
+	".json": "application/json",
+	".yaml": "application/yaml",
+	".yml": "application/yaml"
+};
+const supported = new Set(Object.keys(writable));
+const WRITE_RETRY_LIMIT = 10;
+const WRITE_RETRY_DELAY_MS = 50;
+function retryableWriteError(error) {
+	const code = error?.code;
+	return code === "EACCES" || code === "EBUSY" || code === "EPERM";
+}
+/**
+* Apply patch lists to an entry list — THE patch semantics of this include,
+* shared by mounting (`applyPatches`) and offline config tooling
+* (`dsh --dump-config`) so a dump can never drift from what boots. The input
+* is never mutated: patching shared entry objects would bake earlier patch
+* values into the cached parse, so repeated application (config hot-reloads)
+* could never revert a removed or changed patch. Inserted entries are indexed
+* as they are added, so a later patch in the same list can target a row an
+* earlier patch inserted. A patch that matches nothing warns and is skipped.
+* @param data - the parsed entry list (JSON-safe plain data).
+* @param patches - the patch list to apply, in order.
+* @param warn - sink for skipped-patch diagnostics (printf-style, `%C` = code).
+* @returns a detached entry list with every applicable patch applied.
+*/
+function applyEntryPatches(data, patches, warn) {
+	if (!patches?.length) return [...data];
+	data = structuredClone(data);
+	const entryMap = /* @__PURE__ */ new Map();
+	const buildMap = (entries) => {
+		for (const entry of entries) {
+			if (entry.id) entryMap.set(entry.id, entry);
+			if (entry.group && Array.isArray(entry.config)) buildMap(entry.config);
+		}
+	};
+	buildMap(data);
+	for (const patch of patches) {
+		const { id, insert, name, ...overrides } = patch;
+		if (insert) {
+			if (id) {
+				const target = entryMap.get(id);
+				if (!target) {
+					warn("patch insert: entry %C not found", id);
+					continue;
+				}
+				if (!target.group) {
+					warn("patch insert: entry %C is not a group", id);
+					continue;
+				}
+				if (!Array.isArray(target.config)) target.config = [];
+				target.config.push(...insert);
+			} else data.push(...insert);
+			buildMap(insert);
+			continue;
+		}
+		if (!id) {
+			warn("patch: id is required for non-insert patches");
+			continue;
+		}
+		const target = entryMap.get(id);
+		if (!target) {
+			warn("patch: entry %C not found", id);
+			continue;
+		}
+		if (name && name !== target.name) {
+			warn("patch: name mismatch for %C (expected %C, got %C), skipping", id, target.name, name);
+			continue;
+		}
+		for (const [key, value] of Object.entries(overrides)) {
+			if (key === "id") continue;
+			target[key] = value;
+		}
+	}
+	return data;
+}
+/** Loader entry tree backed by a YAML or JSON file. */
+var Include = class extends EntryTree {
+	config;
+	static inject = ["loader"];
+	static [EntryGroup.key] = true;
+	filename;
+	type;
+	readonly;
+	content;
+	data;
+	writeTask;
+	pendingWrite;
+	writeQueue = Promise.resolve();
+	constructor(ctx, config) {
+		super(ctx);
+		this.config = config;
+		this.enableLogs = config.enableLogs ?? ctx.fiber.entry?.parent.tree.enableLogs ?? false;
+		this.filename = fileURLToPath(new URL(this.config.path, this.ctx.baseUrl));
+		const ext = extname(this.filename);
+		if (!supported.has(ext)) throw new Error(`extension "${ext}" not supported`);
+		this.type = writable[ext];
+		this.readonly = !this.type;
+		this.ctx.baseUrl = new URL(".", pathToFileURL(this.filename)).href;
+		ctx.on("internal/update", (config, _, next) => {
+			if (config.path !== this.config.path) return next();
+			this.config = config;
+			this.root.update(this.applyPatches(this.data, config.patches)).catch((error) => {
+				this.ctx.logger.warn("config update at %C failed", this.filename);
+				this.ctx.logger.warn(error);
+			});
+		});
+	}
+	async checkAccess() {
+		if (!this.type) return;
+		try {
+			await access(this.filename, constants.W_OK);
+		} catch {
+			this.readonly = true;
+		}
+	}
+	async read(forced = false) {
+		const content = await readFile(this.filename, "utf8");
+		if (!forced && this.content === content) return false;
+		let data;
+		if (this.type === "application/yaml") data = yaml.load(content, { schema: entryListSchema });
+		else if (this.type === "application/json") data = JSON.parse(content);
+		else {
+			const module = await import(
+				/* @vite-ignore */
+				this.filename
+);
+			data = module.default || module;
+		}
+		if (!Array.isArray(data)) throw new TypeError(`config file must be a top-level array of entries: ${this.filename}`);
+		this.content = content;
+		this.data = data;
+		await this.checkAccess();
+		return true;
+	}
+	applyPatches(data, patches = this.config.patches) {
+		return applyEntryPatches(data, patches, (message, ...args) => {
+			this.ctx.root.logger?.("loader").warn(message, ...args);
+		});
+	}
+	async *[Service.init]() {
+		try {
+			await this.read();
+		} catch (error) {
+			if (error?.code !== "ENOENT") throw error;
+			if (this.config.initial) {
+				await this._writeFile(this.config.initial);
+				await this.read(true);
+			} else throw new Error(`config file not found: ${this.filename}`);
+		}
+		yield () => this.stop();
+		await this.root.update(this.applyPatches(this.data));
+	}
+	async stop() {
+		try {
+			await this.flushWrite();
+		} finally {
+			this.root.stop();
+			await this.flushWrite();
+		}
+	}
+	/**
+	* Re-read the file and refresh child entries when content changed. An
+	* unreadable or unparsable file logs a warning and keeps the last good
+	* tree: a hot-reload of a live app must never take the process down.
+	*/
+	async refresh() {
+		try {
+			if (!await this.read()) return;
+			await this.root.update(this.applyPatches(this.data));
+		} catch (error) {
+			this.ctx.logger.warn("config reload at %C failed; keeping the running tree", this.filename);
+			this.ctx.logger.warn(error);
+		}
+	}
+	async _writeFile(config) {
+		if (this.readonly) throw new Error(`cannot overwrite readonly config`);
+		if (this.type === "application/yaml") this.content = yaml.dump(config, { schema });
+		else if (this.type === "application/json") this.content = JSON.stringify(config, null, 2);
+		await writeFile(this.filename + ".tmp", this.content);
+		for (let retry = 0;; retry++) try {
+			await rename(this.filename + ".tmp", this.filename);
+			return;
+		} catch (error) {
+			if (!retryableWriteError(error) || retry >= WRITE_RETRY_LIMIT) throw error;
+			await setTimeout$1((retry + 1) * WRITE_RETRY_DELAY_MS);
+		}
+	}
+	writeFile(config) {
+		clearTimeout(this.writeTask);
+		this.pendingWrite = config;
+		this.writeTask = setTimeout(() => {
+			this.flushWrite();
+		}, 0);
+	}
+	flushWrite() {
+		clearTimeout(this.writeTask);
+		this.writeTask = void 0;
+		const config = this.pendingWrite;
+		this.pendingWrite = void 0;
+		if (config === void 0) return this.writeQueue;
+		const run = this.writeQueue.then(() => this._writeFile(config), () => this._writeFile(config));
+		this.writeQueue = run;
+		run.catch((error) => {
+			this.ctx.root.logger?.("loader").warn("failed to write config file %C", this.filename);
+			this.ctx.root.logger?.("loader").warn(error);
+		});
+		return run;
+	}
+	/** Schedule a write of the current root entry data. */
+	write() {
+		this.context.emit("loader/config-update");
+		return this.writeFile(this.root.data);
+	}
+};
+//#endregion
+//#region lib/types/plugin-compatibility.js
+/** Evaluate plugin dsh peer requirements without importing plugin code. */
+function objectOf$1(value, field) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${field} must be an object`);
+	return value;
+}
+function runtimeVersionOf(value) {
+	if (typeof value !== "string" || semver.valid(value) === null) throw new Error(`Invalid dsh runtime version: ${JSON.stringify(value)}; expected a semantic version`);
+	return value;
+}
+function identityField(manifest, field) {
+	const value = Object.hasOwn(manifest, field) ? manifest[field] : void 0;
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`Plugin manifest ${field} must be a non-empty string when dsh peers are incompatible`);
+	return value;
+}
+/**
+* Read this app-boot package's version in both source and bundled installations.
+* @returns the validated runtime semantic version, preserving its exact spelling.
+* @throws if package.json cannot be read or its version is missing or invalid.
+*/
+function getDshRuntimeVersion() {
+	const filename = fileURLToPath(new URL("../package.json", import.meta.url));
+	const manifest = objectOf$1(JSON.parse(fs.readFileSync(filename, "utf8")), "app-boot package.json");
+	return runtimeVersionOf(Object.hasOwn(manifest, "version") ? manifest.version : void 0);
+}
+/**
+* Check every @qlzt/dsh or @deepseek-ai/dsh-* peer against the runtime.
+* Prereleases participate in ranges. workspace:^, workspace:~, and workspace:*
+* refer to the current runtime; other invalid ranges are incompatible.
+* @param manifest - parsed plugin package.json; inherited fields are ignored.
+* @param exemptions - exact plugin name@version keys mapped to exact runtime versions.
+* @param runtimeVersion - running dsh version, defaulting to this app-boot package.
+* @returns incompatible peers and exemption status, or undefined when none are incompatible.
+* @throws for malformed manifest peer fields, invalid runtime versions, or missing identity on a mismatch.
+*/
+function evaluatePluginCompatibility(manifest, exemptions = {}, runtimeVersion = getDshRuntimeVersion()) {
+	runtimeVersionOf(runtimeVersion);
+	const fields = objectOf$1(manifest, "Plugin manifest");
+	if (!Object.hasOwn(fields, "peerDependencies")) return void 0;
+	const dependencies = objectOf$1(fields.peerDependencies, "Plugin manifest peerDependencies");
+	const peers = {};
+	for (const [name, range] of Object.entries(dependencies)) {
+		if (typeof range !== "string") throw new Error(`Plugin manifest peerDependencies[${JSON.stringify(name)}] must be a string`);
+		if (name !== "@qlzt/dsh" && !name.startsWith("@deepseek-ai/dsh-")) continue;
+		const requirement = [
+			"workspace:^",
+			"workspace:~",
+			"workspace:*"
+		].includes(range) ? runtimeVersion : range;
+		if (requirement.trim() === "" || !semver.satisfies(runtimeVersion, requirement, { includePrerelease: true })) peers[name] = range;
+	}
+	if (Object.keys(peers).length === 0) return void 0;
+	const name = identityField(fields, "name");
+	const version = identityField(fields, "version");
+	const key = `${name}@${version}`;
+	return {
+		name,
+		version,
+		runtimeVersion,
+		peers,
+		exempted: (Object.hasOwn(exemptions, key) ? exemptions[key] : void 0)?.includes(runtimeVersion) === true
+	};
+}
+/**
+* Describe incompatible peers, their risk, and the exact-version remedy.
+* Surfaces with their own grant mechanism or locale render the structured result themselves.
+* @param issue - incompatible plugin/runtime result, including exempted mismatches.
+* @returns an English diagnostic for logs and stderr.
+*/
+function pluginCompatibilityWarning(issue) {
+	const key = `${issue.name}@${issue.version}`;
+	return `Plugin ${key} is incompatible with dsh ${issue.runtimeVersion}: peerDependencies ${JSON.stringify(issue.peers)}. Running it may cause crashes or data loss. Update the plugin or install a plugin version compatible with this dsh runtime. To accept this risk explicitly, grant the exact-version exemption for ${key} on dsh ${issue.runtimeVersion} with \`dsh plugin allow-version\` or the plugin manager, then retry the installation or restart dsh. Exact-version exemption: ${issue.exempted ? "active" : "not active"}.`;
+}
+//#endregion
+//#region lib/types/profile-compatibility.js
+/** Profile-local compatibility permissions readable before any Cordis plugins load. */
+/** Independent profile metadata; neither package manifests nor Cordis patches carry grants. */
+const PROFILE_COMPATIBILITY_FILENAME = "compatibility.json";
+/** Published and scoped npm package names, as npm accepts them in a manifest dependency key. */
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+/** Whether a decoded record accepts only exact DSH versions. */
+function isVersionList(value) {
+	return Array.isArray(value) && value.every((version) => typeof version === "string" && isExactPluginVersion(version));
+}
+/** Test whether an exemption names a canonical exact SemVer, including build metadata.
+* @param value Version supplied by a manifest or user.
+* @returns False for ranges, prefixes, whitespace, and malformed versions.
+*/
+function isExactPluginVersion(value) {
+	const parsed = parse(value);
+	return parsed !== null && value === `${parsed.version}${parsed.build.length === 0 ? "" : `+${parsed.build.join(".")}`}`;
+}
+/** Validate one explicit exemption without granting it.
+* @param packageVersion Exact npm package-name@version, never an installation spec or range.
+* @param runtimeVersion Exact DSH version, including prerelease and build metadata.
+* @throws When either identity is not canonical.
+*/
+function validatePluginVersionExemption(packageVersion, runtimeVersion) {
+	const separator = packageVersion.lastIndexOf("@");
+	if (separator <= 0 || !PACKAGE_NAME.test(packageVersion.slice(0, separator)) || !isExactPluginVersion(packageVersion.slice(separator + 1)) || !isExactPluginVersion(runtimeVersion)) throw new Error("Version exemptions require an exact npm package-name@version and an exact DSH runtime version");
+}
+/** Read the profile's independent compatibility file without loading plugins.
+* A missing file authorizes nothing. An unreadable or unparsable file authorizes nothing and is
+* reported instead of failing, so a bad file can never make the profile unusable; rejected records
+* are skipped while the remaining valid ones still apply.
+* @param profileDir Absolute profile directory.
+* @returns Accepted exemptions plus every problem found; no manifest fallback is used.
+*/
+function readProfileCompatibility(profileDir) {
+	const filename = join(profileDir, PROFILE_COMPATIBILITY_FILENAME);
+	const unreadable = (reason) => ({
+		exemptions: {},
+		warnings: [`${filename} ${reason}; treating the profile as having no exemptions`],
+		rewritable: false
+	});
+	let text;
+	try {
+		text = readFileSync(filename, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			exemptions: {},
+			warnings: [],
+			rewritable: true
+		};
+		return unreadable(`cannot be read (${String(error)})`);
+	}
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch (error) {
+		return unreadable(`is not valid JSON (${String(error)})`);
+	}
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return unreadable("must map exact package@version keys to DSH version lists");
+	const exemptions = {};
+	const warnings = [];
+	for (const [key, versions] of Object.entries(value)) {
+		const separator = key.lastIndexOf("@");
+		if (separator <= 0 || !PACKAGE_NAME.test(key.slice(0, separator)) || !isExactPluginVersion(key.slice(separator + 1))) {
+			warnings.push(`${filename}: ${JSON.stringify(key)} is not an exact package-name@version key; the record is ignored`);
+			continue;
+		}
+		if (!isVersionList(versions)) {
+			warnings.push(`${filename}: ${key} must contain a list of exact DSH versions; the record is ignored`);
+			continue;
+		}
+		exemptions[key] = versions;
+	}
+	return {
+		exemptions,
+		warnings,
+		rewritable: warnings.length === 0
+	};
+}
+/** Read only the accepted exemptions of a profile.
+* @param profileDir Absolute profile directory.
+* @returns Exact package-name@version keys mapped to their allowed DSH versions.
+*/
+function readProfileVersionExemptions(profileDir) {
+	return readProfileCompatibility(profileDir).exemptions;
+}
+/** Persist one informed grant or revocation under the compatibility file's own lock.
+* @param profileDir Profile directory; no package manifest is created or modified.
+* @param packageVersion Exact manifest package-name@version.
+* @param runtimeVersion Exact DSH version; grants must name the current runtime, revocations may name historical ones.
+* @param enabled Whether to grant rather than revoke.
+* @param acceptRisk Required true for grants after explicit acknowledgement of possible crashes or data loss.
+* @returns After the atomic write. Existing plugin instances are not reloaded by this operation.
+* @throws For invalid identities, missing consent, a stale runtime, or a file the reader rejected,
+* which the user must repair by hand because rewriting it would discard their content.
+*/
+async function setProfileVersionExemption(profileDir, packageVersion, runtimeVersion, enabled, acceptRisk) {
+	validatePluginVersionExemption(packageVersion, runtimeVersion);
+	if (enabled && !acceptRisk) throw new Error("Incompatible plugins may cause crashes or data loss. To grant this exact-version exemption, explicitly acknowledge the risk with --accept-risk (acceptRisk: true).");
+	const current = getDshRuntimeVersion();
+	if (enabled && runtimeVersion !== current) throw new Error(`Cannot approve DSH ${runtimeVersion}: this application runs DSH ${current}. Use --dsh-version ${current}.`);
+	await mkdir(profileDir, { recursive: true });
+	const filename = join(profileDir, PROFILE_COMPATIBILITY_FILENAME);
+	await withFileLock(filename, async () => {
+		const current = readProfileCompatibility(profileDir);
+		if (!current.rewritable) throw new Error(`${PROFILE_COMPATIBILITY_FILENAME} must be repaired before exemptions change:\n${current.warnings.join("\n")}`);
+		const exemptions = current.exemptions;
+		const versions = exemptions[packageVersion] ?? [];
+		if (enabled) exemptions[packageVersion] = [...new Set([...versions, runtimeVersion])];
+		else {
+			const retained = versions.filter((version) => version !== runtimeVersion);
+			if (retained.length) exemptions[packageVersion] = retained;
+			else Reflect.deleteProperty(exemptions, packageVersion);
+		}
+		await writeFileAtomic(filename, JSON.stringify(exemptions, void 0, 2) + "\n", { mode: 384 });
+	});
+}
+//#endregion
+//#region lib/types/profile-resolution/legacy-links.js
+/** Package directory and resource canonicalization through the active runtime carrier's filesystem. */
+/**
+* Return whether the process reads application modules from pkg's virtual filesystem.
+* @returns whether pkg owns the module filesystem.
+*/
+function isPackagedExecutable() {
+	return process.pkg !== void 0;
+}
+/**
+* Resolve a directory through the active carrier's filesystem implementation.
+* @param path - directory path to canonicalize.
+* @returns the canonical directory path.
+*/
+function realModuleDirectory(path) {
+	return isPackagedExecutable() ? realpathSync(path) : realpathSync.native(path);
+}
+/** Canonicalize a module resource, preserving physical file aliases.
+* SEA archive files are symlink-free and support stat and reads, while their containing directories support realpath.
+* @param path Existing module resource path.
+* @returns Canonical resource path under the active carrier's filesystem.
+* @throws When the resource or its directory cannot be inspected or resolved.
+*/
+function realModuleFile(path) {
+	return !isPackagedExecutable() || lstatSync(path).isSymbolicLink() ? realpathSync(path) : join(realModuleDirectory(dirname(path)), basename(path));
+}
+//#endregion
+//#region lib/types/profile.js
+/**
+* Profile discovery, initialization, and patch-layer composition for the
+* `dsh --profile` launcher family.
+*
+* A profile is a directory under `$DSH_HOME/profiles/<name>` holding a
+* `package.json` (out-of-tree plugin dependencies plus the profile manifest
+* `dsh.profile` with its ordered `bundles` list) and a `cordis.patch.yml`
+* (the user's own patch layer, applied after every bundle layer). Bundles are
+* npm packages whose manifest declares
+* `"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }` (one file, or an
+* ordered list of files); the tree is composed by applying each bundle's patch
+* lists in `dsh.profile.bundles` order over an empty entry list, then the
+* profile's own patches, then any launcher layers (`--patch` files and
+* flag-derived patches).
+*
+* Module resolution is two-anchor by construction: a bundle name resolves
+* first from the dsh installation (the launcher's own package), then from the
+* profile directory. Pnpm-managed entries in the profile's `node_modules`
+* resolve first. The runtime resolution supplies packages carried by the
+* installation and selected bundles to Node's ESM and CommonJS resolvers.
+* @module @qlzt/dsh-app-boot/profile
+*/
+/** Directory under the Harness home holding every profile. */
+const PROFILES_DIR = "profiles";
+/** The user patch layer inside a profile directory (hot-reloaded on long-lived surfaces). */
+const PROFILE_PATCH_FILENAME = "cordis.patch.yml";
+/**
+* The patch files a bundle declares, as written: one file for a string
+* `patch`, the listed files in order for an array.
+* @param bundle - the bundle's `dsh.bundle` declaration, as read from package.json.
+* @returns the package-relative patch file paths in application order.
+* @throws {Error} when `patch` is neither a string nor a list of strings.
+*/
+function bundlePatchFiles(bundle) {
+	const declared = typeof bundle.patch === "string" ? [bundle.patch] : bundle.patch;
+	if (!Array.isArray(declared) || !declared.every((file) => typeof file === "string")) throw new Error("dsh.bundle.patch must be a file path or a list of file paths");
+	return declared;
+}
+/**
+* Resolve a bundle declaration to its ordered absolute patch files.
+* @param packageDir - absolute directory of the bundle package.
+* @param bundle - the bundle's `dsh.bundle` declaration, as read from package.json.
+* @returns the absolute patch file paths in application order.
+* @throws {Error} when `patch` is neither a string nor a list of strings.
+*/
+function bundlePatchPaths(packageDir, bundle) {
+	return bundlePatchFiles(bundle).map((file) => join(packageDir, file));
+}
+/**
+* Print each skipped bundle once; loading never prints, so launchers call this once per start.
+* @param binName - the diagnostic prefix.
+* @param profile - the loaded profile.
+*/
+function reportSkippedBundles(binName, profile) {
+	for (const { packageName, reason } of profile.skippedBundles) process.stderr.write(`${binName}: skipping profile bundle ${JSON.stringify(packageName)}: ${reason}\n`);
+}
+/**
+* Resolve a profile's directory under the Harness home.
+* @param name - the profile name (`dsh --profile <name>`).
+* @param home - the Harness home; defaults to {@link resolveDshHome}.
+* @returns the absolute profile directory (which may not exist yet).
+*/
+function resolveProfileDir(name, home = resolveDshHome()) {
+	if (name === "" || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name === "node_modules") throw new Error(`dsh: invalid profile name ${JSON.stringify(name)}`);
+	return join(home, PROFILES_DIR, name);
+}
+/** The shipped profile templates auto-initialized on first use, by name. */
+const PROFILE_TEMPLATES = {
+	acp: { bundles: ["@qlzt/dsh-base", "@qlzt/dsh-acp-app"] },
+	web: { bundles: ["@qlzt/dsh-base", "@qlzt/dsh-web-app"] },
+	headless: { bundles: ["@qlzt/dsh-base", "@qlzt/dsh-headless"] },
+	sdk: { bundles: ["@qlzt/dsh-base", "@qlzt/dsh-sdk-app"] },
+	"sdk-minimal": { bundles: ["@qlzt/dsh-sdk-minimal"] }
+};
+/** Installation-owned bundle tuples normalized to the shipped template. */
+const INSTALLATION_OWNED_PROFILE_TUPLES = { headless: [
+	"@qlzt/dsh-base",
+	"@qlzt/dsh-web-app",
+	"@qlzt/dsh-headless"
+] };
+/**
+* Bundles an earlier release shipped and the installation no longer carries;
+* {@link loadProfileDirectory} removes them from the profile's bundle list.
+*/
+const RETIRED_BUNDLES = new Set(["@deepseek-ai/dsh-experimental-schedule-bundle"]);
+/** The bundle list a `dsh plugin` init uses for a name with no shipped template. */
+const DEFAULT_PROFILE_BUNDLES = ["@qlzt/dsh-base"];
+/**
+* The bundles the dsh installation ships for a person to switch on: each a
+* runtime dependency of the installation that declares `dsh.bundle.patch`,
+* an `icon`, and `./locale/*.json` display metadata, selected by no shipped
+* template, and offered switched off by the plugin manager
+* ([rationale](../../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md),
+* [admission](../../../../.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md)).
+*/
+const OPTIONAL_BUNDLES = [
+	"@qlzt/dsh-experimental-session-search",
+	"@qlzt/dsh-experimental-ralph-bundle",
+	"@qlzt/dsh-experimental-terminal-bundle",
+	"@qlzt/dsh-experimental-badge-skill-bundle",
+	"@qlzt/dsh-experimental-session-titles-bundle",
+	"@qlzt/dsh-experimental-agent-team-profile",
+	"@qlzt/dsh-experimental-voice-input-bundle",
+	"@qlzt/dsh-experimental-cot-translation-bundle",
+	"@qlzt/dsh-experimental-auto-review",
+	"@qlzt/dsh-experimental-inspector-profile",
+	"@qlzt/dsh-experimental-tool-worktree"
+];
+const PROFILE_PATCH_TEMPLATE = `# Your patch layer for this dsh profile, applied after every bundle layer:
+# a top-level YAML array of loader patch entries (id-targeted config
+# overrides, disables, and insert lists; \`!!js\` expressions allowed).
+[]
+`;
+const PROFILE_PNPM_WORKSPACE = `packages:
+  - .
+
+nodeLinker: hoisted
+autoInstallPeers: false
+`;
+/**
+* Initialize a profile directory: manifest, empty user patch layer, and the
+* pnpm settings out-of-tree plugins need. Existing files are never touched,
+* so re-running is a no-op on an initialized profile.
+* @param dir - the profile directory from {@link resolveProfileDir}.
+* @param bundles - the initial `dsh.profile.bundles` layer list.
+*/
+function initProfile(dir, bundles) {
+	mkdirSync(dir, { recursive: true });
+	const manifestPath = join(dir, "package.json");
+	if (!existsSync(manifestPath)) {
+		const manifest = {
+			name: `dsh-profile-${basename(dir)}`,
+			private: true,
+			dependencies: {},
+			dsh: { profile: { bundles: [...bundles] } }
+		};
+		writeFileSync(manifestPath, JSON.stringify(manifest, void 0, 2) + "\n");
+	}
+	const patchPath = join(dir, PROFILE_PATCH_FILENAME);
+	if (!existsSync(patchPath)) writeFileSync(patchPath, PROFILE_PATCH_TEMPLATE);
+	const workspacePath = join(dir, "pnpm-workspace.yaml");
+	if (!existsSync(workspacePath)) writeFileSync(workspacePath, PROFILE_PNPM_WORKSPACE);
+}
+/** Directory where the link backend of the dsh 0.1.5 releases projected bundle-carried packages into a profile. */
+const LINK_PROJECTION_DIR = ".dsh-module-fallback";
+/**
+* Remove the package projections a link-backend launch left in a profile.
+* Only symlinks under the profile's `node_modules` whose target lies inside
+* `<profile>/.dsh-module-fallback/node_modules` are unlinked, then that directory is removed;
+* pnpm-installed packages and every other symlink stay. A profile without the directory is untouched.
+* @param dir - the profile directory.
+*/
+function removeLinkProjections(dir) {
+	const owned = join(dir, LINK_PROJECTION_DIR);
+	if (!existsSync(owned)) return;
+	const ownedModules = join(owned, "node_modules");
+	for (const link of symlinksUnder(join(dir, "node_modules"))) if (pointsInto(link, ownedModules)) unlinkSync(link);
+	rmSync(owned, {
+		recursive: true,
+		force: true
+	});
+}
+/** Top-level and scoped entries under a node_modules directory that are symlinks or junctions. */
+function symlinksUnder(modules) {
+	const links = [];
+	if (!existsSync(modules)) return links;
+	for (const entry of readdirSync(modules, { withFileTypes: true })) {
+		const path = join(modules, entry.name);
+		if (entry.isSymbolicLink()) links.push(path);
+		else if (entry.name.startsWith("@") && entry.isDirectory()) {
+			for (const child of readdirSync(path, { withFileTypes: true })) if (child.isSymbolicLink()) links.push(join(path, child.name));
+		}
+	}
+	return links;
+}
+/**
+* Active profile `node_modules` entries linked outside the shared profiles tree and the active profile.
+* Missing targets and files are not linked roots; invalid link chains retain Node's diagnostic.
+*/
+function linkedProfileRoots(profile, profilesDir) {
+	const modules = join(profile.dir, "node_modules");
+	const links = symlinksUnder(modules);
+	if (links.length === 0) return [];
+	let tree;
+	try {
+		tree = realModuleDirectory(profilesDir) + sep;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		tree = resolve(profilesDir) + sep;
+	}
+	const excludedTrees = [tree, realModuleDirectory(profile.dir) + sep];
+	const roots = [];
+	for (const linkPath of links) {
+		let realPath;
+		try {
+			realPath = realModuleDirectory(linkPath);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			continue;
+		}
+		if (excludedTrees.some((prefix) => realPath + sep === prefix || realPath.startsWith(prefix)) || !statSync(realPath).isDirectory()) continue;
+		roots.push({
+			name: relative(modules, linkPath).split(sep).join("/"),
+			realPath
+		});
+	}
+	return roots.sort((left, right) => left.name.localeCompare(right.name));
+}
+/** Whether a symlink's target directory is `root` or lies below it. */
+function pointsInto(link, root) {
+	try {
+		const target = resolve(dirname(link), readlinkSync(link));
+		const parent = realpathSync.native(dirname(target));
+		const rootPath = realpathSync.native(root);
+		return parent === rootPath || parent.startsWith(rootPath + sep);
+	} catch (error) {
+		/* v8 ignore next 2 -- a non-ENOENT realpath failure requires a host filesystem fault */
+		if (error.code === "ENOENT") return false;
+		/* v8 ignore next -- see the host-filesystem exception above */
+		throw error;
+	}
+}
+/** Read one package manifest while traversing a dependency graph. */
+function readPackageManifest(anchor) {
+	return JSON.parse(readFileSync(anchor, "utf8"));
+}
+/** Return dependency names that may be imported by a loader-visible plugin. */
+function profileDependencyNames(manifest) {
+	return [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.peerDependencies ?? {})];
+}
+/** Resolve the installation packages that the runtime resolver supplies to every profile. */
+function collectInstallationScopePackages(installAnchor, skippedBundles) {
+	const canonicalAnchor = join(realModuleDirectory(dirname(installAnchor)), basename(installAnchor));
+	const appManifest = readPackageManifest(canonicalAnchor);
+	const links = /* @__PURE__ */ new Map();
+	const declarers = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	/* v8 ignore next -- a real app manifest always declares its name */
+	if (appManifest.name !== void 0) {
+		links.set(appManifest.name, dirname(installAnchor));
+		declarers.set(appManifest.name, canonicalAnchor);
+		versions.set(appManifest.name, appManifest.version);
+	}
+	const queue = [{
+		anchor: canonicalAnchor,
+		manifest: appManifest
+	}];
+	for (let next = queue.shift(); next !== void 0; next = queue.shift())
+ /* v8 ignore next -- a real app manifest always declares dependencies */
+	for (const dep of profileDependencyNames(next.manifest)) {
+		if (links.has(dep)) continue;
+		const dir = packageDirFromAnchor(next.anchor, dep);
+		if (dir === void 0) continue;
+		const manifestPath = join(realModuleDirectory(dir), "package.json");
+		let manifest;
+		try {
+			manifest = skippedBundles.has(dep) ? readProfileManifest("dsh", dir) : readPackageManifest(manifestPath);
+		} catch (error) {
+			if (!skippedBundles.has(dep)) throw error;
+			continue;
+		}
+		links.set(dep, dir);
+		declarers.set(dep, next.anchor);
+		versions.set(dep, manifest.version);
+		queue.push({
+			anchor: manifestPath,
+			manifest
+		});
+	}
+	return {
+		packageNames: new Set(links.keys()),
+		packageDirs: links,
+		declarers,
+		versions
+	};
+}
+/**
+* Compute the runtime resolution without writing module-resolution files.
+* @param options - installation anchor, optional loaded profile, and Harness home.
+* @returns the complete immutable runtime resolution.
+*/
+async function createRuntimeResolution(options) {
+	const { installAnchor, profile, home = resolveDshHome() } = options;
+	const profilesDir = join(home, PROFILES_DIR);
+	const manifest = readOptionalProfileManifest(profile);
+	const { packageNames, packageDirs, declarers, versions } = collectInstallationScopePackages(installAnchor, new Set(profile?.skippedBundles.map((skipped) => skipped.packageName)));
+	const profileDeclarers = /* @__PURE__ */ new Map();
+	const profileVersions = /* @__PURE__ */ new Map();
+	const localPackageNames = profile === void 0 ? [] : installedProfilePackageNames(profile, manifest);
+	const profilePackages = profile === void 0 ? /* @__PURE__ */ new Map() : collectProfileScopePackages(profile, packageNames, profileDeclarers, profileVersions);
+	const linkedRoots = profile === void 0 ? [] : linkedProfileRoots(profile, profilesDir);
+	return await Promise.resolve(new ProfileRuntimeResolution({
+		installAnchor,
+		profileDir: profile?.dir,
+		home
+	}, {
+		profilesDir,
+		profileDir: profile?.dir,
+		localPackageNames: Object.freeze(localPackageNames),
+		linkedRoots: Object.freeze(linkedRoots.map((root) => Object.freeze(root))),
+		entries: Object.freeze([...[...packageDirs].map(([name, packageDir]) => Object.freeze({
+			name,
+			packageDir,
+			version: versions.get(name),
+			declarer: declarers.get(name),
+			scope: "installation"
+		})), ...[...profilePackages].map(([name, packageDir]) => Object.freeze({
+			name,
+			packageDir,
+			version: profileVersions.get(name),
+			declarer: profileDeclarers.get(name),
+			scope: "profile"
+		}))])
+	}));
+}
+/**
+* A runtime resolution that remembers the inputs it was computed from. Worker environment data carries only its
+* fields; the inputs stay private to the thread that computed it.
+*/
+var ProfileRuntimeResolution = class {
+	profilesDir;
+	profileDir;
+	localPackageNames;
+	entries;
+	linkedRoots;
+	#source;
+	/**
+	* @param source - inputs of {@link createRuntimeResolution}, reused by {@link computeLatestResolution}.
+	* @param table - the computed package table.
+	*/
+	constructor(source, table) {
+		this.#source = source;
+		this.profilesDir = table.profilesDir;
+		this.profileDir = table.profileDir;
+		this.localPackageNames = table.localPackageNames;
+		this.entries = table.entries;
+		this.linkedRoots = table.linkedRoots;
+		Object.freeze(this);
+	}
+	/**
+	* Compute the latest generation from the same installation, profile directory, and Harness home, rereading the
+	* profile's manifest, bundle selection, and installed packages from disk, without retaining synthetic layers.
+	* With no profile directory, only installation packages are recomputed. This instance is unchanged.
+	* @returns a new resolution for the latest generation.
+	*/
+	computeLatestResolution() {
+		const { installAnchor, home, profileDir } = this.#source;
+		return createRuntimeResolution({
+			installAnchor,
+			home,
+			...profileDir === void 0 ? {} : { profile: loadProfileDirectory("dsh", profileDir, installAnchor) }
+		});
+	}
+};
+/** Synthetic profiles used by direct callers may have no on-disk manifest. */
+function readOptionalProfileManifest(profile) {
+	if (profile === void 0) return void 0;
+	try {
+		return readPackageManifest(join(profile.dir, "package.json"));
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+}
+/** Return installed direct dependencies that Node resolves before profile fallback. */
+function installedProfilePackageNames(profile, manifest) {
+	if (manifest === void 0) return [];
+	return profileDependencyNames(manifest).filter((name) => existsSync(join(profile.dir, "node_modules", name, "package.json")));
+}
+/** Collect the first resolvable package directory for each dependency name. */
+function dependencyClosure(anchors, reserved, declarers, versions) {
+	const links = /* @__PURE__ */ new Map();
+	const visited = new Set(reserved);
+	for (const anchor of anchors) {
+		const canonicalAnchor = join(realModuleDirectory(dirname(anchor)), basename(anchor));
+		const manifest = readPackageManifest(canonicalAnchor);
+		/* v8 ignore next -- an installable package manifest always declares its name */
+		if (manifest.name === void 0) continue;
+		if (!visited.has(manifest.name)) {
+			visited.add(manifest.name);
+			links.set(manifest.name, dirname(canonicalAnchor));
+			declarers?.set(manifest.name, canonicalAnchor);
+			versions?.set(manifest.name, manifest.version);
+		}
+		const queue = [{
+			anchor: canonicalAnchor,
+			manifest
+		}];
+		for (let next = queue.shift(); next !== void 0; next = queue.shift())
+ /* v8 ignore next -- an installable package manifest always declares dependencies or peers */
+		for (const dep of profileDependencyNames(next.manifest)) {
+			if (visited.has(dep)) continue;
+			const dir = packageDirFromAnchor(next.anchor, dep);
+			if (dir === void 0) continue;
+			visited.add(dep);
+			links.set(dep, dir);
+			declarers?.set(dep, next.anchor);
+			const manifestPath = join(realModuleDirectory(dir), "package.json");
+			const dependencyManifest = readPackageManifest(manifestPath);
+			versions?.set(dep, dependencyManifest.version);
+			queue.push({
+				anchor: manifestPath,
+				manifest: dependencyManifest
+			});
+		}
+	}
+	return links;
+}
+/** Collect packages carried by the profile's selected bundles that the installation does not supply. */
+function collectProfileScopePackages(profile, installationPackageNames, declarers, versions) {
+	const bundleLinks = dependencyClosure(profile.layers.filter((layer) => !installationPackageNames.has(layer.packageName)).map((layer) => join(layer.packageDir, "package.json")), installationPackageNames, declarers, versions);
+	for (const layer of profile.layers) bundleLinks.delete(layer.packageName);
+	return bundleLinks;
+}
+/**
+* Read a profile's manifest.
+* @param binName - the diagnostic prefix on the thrown error.
+* @param dir - the profile directory.
+* @returns the parsed manifest.
+*/
+function readProfileManifest(binName, dir) {
+	const path = join(dir, "package.json");
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (error) {
+		throw new Error(`${binName}: failed to read profile manifest ${path}: ${String(error)}`);
+	}
+	const parsed = JSON.parse(raw);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${binName}: profile manifest ${path} must hold a JSON object`);
+	return parsed;
+}
+/**
+* Write a profile's manifest back (2-space JSON, trailing newline).
+* @param dir - the profile directory.
+* @param manifest - the manifest value to persist.
+*/
+function writeProfileManifest(dir, manifest) {
+	writeFileSync(join(dir, "package.json"), JSON.stringify(manifest, void 0, 2) + "\n");
+}
+/** Return whether two bundle lists have the same values in the same order. */
+function sameBundles(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+/** Return `manifest` with `dsh.profile.bundles` replaced, preserving all other fields. */
+function withBundles(manifest, bundles) {
+	return {
+		...manifest,
+		dsh: {
+			...manifest.dsh,
+			profile: {
+				...manifest.dsh?.profile,
+				bundles: [...bundles]
+			}
+		}
+	};
+}
+/**
+* Normalize an exact installation-owned bundle tuple to its shipped template,
+* preserving all other manifest fields. Other bundle lists remain untouched.
+*/
+function normalizeShippedProfile(name, dir, manifest) {
+	const installationOwned = INSTALLATION_OWNED_PROFILE_TUPLES[name];
+	const template = PROFILE_TEMPLATES[name];
+	const bundles = manifest.dsh?.profile?.bundles;
+	if (template === void 0 || bundles === void 0) return manifest;
+	if (!(installationOwned !== void 0 && sameBundles(bundles, installationOwned))) return manifest;
+	const normalized = withBundles(manifest, template.bundles);
+	writeProfileManifest(dir, normalized);
+	return normalized;
+}
+/**
+* Remove {@link RETIRED_BUNDLES} from a profile's bundle list, writing the
+* manifest back only when it listed one.
+*/
+function dropRetiredBundles(dir, manifest) {
+	const bundles = manifest.dsh?.profile?.bundles ?? [];
+	const kept = bundles.filter((bundle) => !RETIRED_BUNDLES.has(bundle));
+	if (kept.length === bundles.length) return manifest;
+	const normalized = withBundles(manifest, kept);
+	writeProfileManifest(dir, normalized);
+	return normalized;
+}
+/**
+* Resolve a package's root directory from one anchor without depending on the
+* package exporting `./package.json` (`require.resolve` would need that):
+* probe the require resolution paths for a directory holding the named
+* manifest. This is Node's own node_modules lookup order, so the result
+* matches what the Loader would import from the same anchor, and
+* `existsSync` follows the symlinks pnpm's isolated layout uses.
+*/
+function packageDirFromAnchor(anchor, packageName) {
+	/* v8 ignore next */
+	for (const searchPath of createRequire(anchor).resolve.paths(packageName) ?? []) {
+		const candidate = join(searchPath, packageName);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+/**
+* Resolve one bundle package's directory: installation anchor first, then the
+* profile directory. The installation-first order is the contract that
+* `@qlzt/dsh-base` (and every other in-box bundle) always comes from
+* the same installation as the running dsh, never from a profile-local copy.
+* Resolution does not require the package to export `./package.json`.
+* @param binName - the diagnostic prefix on the thrown error.
+* @param packageName - the bundle's package name from `dsh.profile.bundles`.
+* @param installAnchor - absolute path of a file inside the dsh app package (its package.json).
+* @param profileDir - the profile directory (second anchor).
+* @returns the bundle package's absolute directory.
+*/
+function resolveBundleDir(binName, packageName, installAnchor, profileDir) {
+	for (const anchor of [installAnchor, join(profileDir, "package.json")]) {
+		const dir = packageDirFromAnchor(anchor, packageName);
+		if (dir !== void 0) return dir;
+	}
+	throw new Error(`${binName}: cannot resolve profile bundle ${JSON.stringify(packageName)} from the dsh installation or ${profileDir}; run 'dsh plugin --profile ${basename(profileDir)} install' if its dependency is not installed`);
+}
+/**
+* Load an already initialized profile directory without resolving it through
+* the shared Harness home. This is used by application-owned profiles whose
+* package project and lifecycle belong to that application.
+* Retired bundles are removed from the stored bundle list first, rewriting the
+* manifest when it listed one. Unreadable bundles, and bundles whose own dsh peers the profile does not exempt, are skipped
+* without changing the manifest and listed in `skippedBundles`; nothing is printed.
+* @param binName - the diagnostic prefix on thrown errors.
+* @param dir - absolute profile package directory.
+* @param installAnchor - absolute path of the owning dsh app's package.json.
+* @param options - `userLayer: false` skips reading `cordis.patch.yml`.
+* @returns the successfully loaded bundle layers and optional user patch layer.
+*/
+function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
+	const bundles = dropRetiredBundles(dir, readProfileManifest(binName, dir)).dsh?.profile?.bundles ?? [];
+	const layers = [];
+	const skippedBundles = [];
+	const exemptions = bundles.length === 0 ? {} : readProfileVersionExemptions(dir);
+	for (const packageName of bundles) try {
+		const packageDir = resolveBundleDir(binName, packageName, installAnchor, dir);
+		const bundleManifest = readProfileManifest(binName, packageDir);
+		const bundle = bundleManifest.dsh?.bundle;
+		if (bundle === void 0) throw new Error(`${binName}: profile bundle ${JSON.stringify(packageName)} declares no dsh.bundle in its package.json`);
+		const issue = evaluatePluginCompatibility(bundleManifest, exemptions);
+		if (issue !== void 0 && !issue.exempted) throw new Error(pluginCompatibilityWarning(issue));
+		const patchPaths = bundlePatchPaths(packageDir, bundle);
+		const patches = patchPaths.flatMap((patchPath) => loadOverlayPatches(binName, patchPath));
+		layers.push({
+			packageName,
+			packageDir,
+			patchPaths,
+			patches
+		});
+	} catch (error) {
+		skippedBundles.push({
+			packageName,
+			reason: String(error)
+		});
+	}
+	const patchPath = join(dir, PROFILE_PATCH_FILENAME);
+	const patches = options.userLayer !== false && existsSync(patchPath) ? loadOverlayPatches(binName, patchPath) : [];
+	return {
+		name: basename(dir),
+		dir,
+		layers,
+		patchPath,
+		patches,
+		skippedBundles
+	};
+}
+/**
+* Load a profile: resolve every `dsh.profile.bundles` entry to its patch
+* layer and parse the profile's own patch file. Unreadable or incompatible bundles
+* are skipped and listed in `skippedBundles`; profile manifest and user patch errors still throw.
+* @param binName - the diagnostic prefix on thrown errors.
+* @param name - the profile name.
+* @param installAnchor - absolute path of the dsh app's package.json (first resolution anchor).
+* @param home - the Harness home; defaults to {@link resolveDshHome}.
+* @param options - `userLayer: false` skips reading `cordis.patch.yml`, so a
+* bundles-only consumer (`--dump-default-config`, a recovery diagnostic)
+* cannot fail on a broken user layer.
+* @returns the loaded profile (empty `patches` when the user layer is skipped).
+*/
+function loadProfile(binName, name, installAnchor, home = resolveDshHome(), options = {}) {
+	const dir = resolveProfileDir(name, home);
+	if (!existsSync(join(dir, "package.json"))) {
+		const template = PROFILE_TEMPLATES[name];
+		if (template === void 0) throw new Error(`${binName}: profile ${JSON.stringify(name)} does not exist; create it with 'dsh plugin --profile ${name} add <package>'`);
+		initProfile(dir, template.bundles);
+	}
+	removeLinkProjections(dir);
+	normalizeShippedProfile(name, dir, readProfileManifest(binName, dir));
+	return loadProfileDirectory(binName, dir, installAnchor, options);
+}
+/**
+* Compose patch layers into the effective entry list over an empty root —
+* the same single `applyEntryPatches` call the boot include makes, so flag
+* derivation and config dumps see exactly what mounts.
+* @param layers - patch lists in application order.
+* @param warn - sink for skipped-patch diagnostics; defaults to silent (boot repeats them).
+* @returns the composed entry list.
+*/
+function composeEntries(layers, warn = () => {}) {
+	return applyEntryPatches([], structuredClone(layers.flat()), (message, ...args) => {
+		let index = 0;
+		warn(message.replace(/%C/g, () => JSON.stringify(args[index++])));
+	});
+}
+//#endregion
+//#region lib/types/profile-context.js
+/** Launcher-owned profile locations and composition inputs. */
+const TELEMETRY_ROW_ID = "session-telemetry-otel";
+/**
+* Resolve the telemetry opt-out switch into its boot patch. ANY non-empty
+* value (including `'0'`/`'false'`) disables: a privacy switch prefers
+* off-by-mistake over on-by-mistake. A composition without the telemetry row
+* exports nothing, so the switch is then trivially satisfied and no patch is
+* generated — custom profiles need not mount telemetry to run with the
+* switch set.
+* @param disabledEnv - the raw `DSH_TELEMETRY_DISABLED` value (`undefined` when unset).
+* @param hasRow - whether the composition carries the telemetry row.
+* @returns the disable patch, or `undefined` when no hard-disable patch is required.
+*/
+function resolveTelemetryPatch(disabledEnv, hasRow) {
+	if ((disabledEnv ?? "") === "" || !hasRow) return void 0;
+	return {
+		id: TELEMETRY_ROW_ID,
+		disabled: true
+	};
+}
+/** Read current bundle and user layers with the launch-time overlays.
+* @param binName Diagnostic prefix for malformed or missing configuration.
+* @param context Data supplied by the profile launcher.
+* @param initialProfile Already loaded startup profile; omitted reads the current files.
+* @returns Detached ordered patches; this function does not update the Loader.
+*/
+function readProfilePatches(binName, context, initialProfile) {
+	const profile = initialProfile ?? loadProfileDirectory(binName, context.dir, context.installAnchor, { userLayer: false });
+	const patches = structuredClone([
+		...profile.layers.flatMap((layer) => layer.patches),
+		...initialProfile?.patches ?? loadOptionalPatches(binName, context.patchPath) ?? [],
+		...loadOptionalPatches(binName, join(context.home, "cordis.patch.yml")) ?? [],
+		...context.overlays
+	]);
+	const telemetryPatch = resolveTelemetryPatch(context.telemetryDisabledEnv, composeEntries([patches]).some((row) => row.id === TELEMETRY_ROW_ID));
+	if (telemetryPatch !== void 0) patches.push(telemetryPatch);
+	return patches;
+}
+//#endregion
+//#region lib/types/profile-plugins.js
+/** Installed profile dependencies and their bundle activation after package-manager operations. */
+/** Unavailable installed metadata must not prevent listing or removing dependencies. */
+function optionalManifest(binName, packageDir) {
+	try {
+		return readProfileManifest(binName, packageDir);
+	} catch {
+		return;
+	}
+}
+/** Resolve activation metadata with the same installation precedence as profile loading. */
+function bundleManifest(location, name) {
+	let packageDir;
+	try {
+		packageDir = resolveBundleDir(location.binName, name, location.installAnchor, location.profileDir);
+	} catch {
+		return;
+	}
+	return optionalManifest(location.binName, packageDir);
+}
+/**
+* Read installed versions and bundle declarations without requiring loadable plugin code.
+* Missing or unreadable installed metadata leaves the dependency visible for repair or removal.
+* @param location - profile and installation resolution inputs.
+* @returns dependency records in package.json order and the profile manifest.
+*/
+function readProfilePlugins(location) {
+	const manifest = readProfileManifest(location.binName, location.profileDir);
+	const bundles = manifest.dsh?.profile?.bundles ?? [];
+	return {
+		manifest,
+		dependencies: Object.entries(manifest.dependencies ?? {}).map(([name, spec]) => {
+			const installed = optionalManifest(location.binName, join(location.profileDir, "node_modules", name));
+			return {
+				name,
+				version: typeof installed?.version === "string" ? installed.version : spec,
+				bundle: bundleManifest(location, name)?.dsh?.bundle?.patch !== void 0,
+				enabled: bundles.includes(name)
+			};
+		})
+	};
+}
+/**
+* Write a bundle list while preserving the supplied profile's other metadata.
+* @param profileDir - directory whose package.json is updated.
+* @param manifest - current profile manifest, read after the package operation when applicable.
+* @param bundles - ordered active bundle names, including any template entries.
+* @returns the written manifest.
+*/
+function writeProfileBundles(profileDir, manifest, bundles) {
+	const updated = {
+		...manifest,
+		dsh: {
+			...manifest.dsh,
+			profile: {
+				...manifest.dsh?.profile,
+				bundles: [...bundles]
+			}
+		}
+	};
+	writeProfileManifest(profileDir, updated);
+	return updated;
+}
+/**
+* Reconcile installed bundle declarations after a successful package-manager operation.
+* Dependency-managed entries disappear when removed or when their package loses its declaration;
+* template entries retain their order and duplicates. New bundle dependencies activate automatically.
+* @param options - location, inventory captured before pnpm, and whether explicitly disabled bundles remain disabled.
+* @returns updated inventory and newly added ordinary dependencies for caller-owned warnings.
+*/
+function reconcileProfilePlugins(options) {
+	const after = readProfilePlugins(options);
+	const beforeNames = new Set(options.before.dependencies.map((dependency) => dependency.name));
+	const afterNames = new Set(after.dependencies.map((dependency) => dependency.name));
+	const bundleNames = new Set(after.dependencies.filter((dependency) => dependency.bundle).map((dependency) => dependency.name));
+	const disabled = new Set(options.preserveDisabled ? options.before.dependencies.filter((dependency) => dependency.bundle && !dependency.enabled).map((dependency) => dependency.name) : []);
+	const previous = after.manifest.dsh?.profile?.bundles ?? [];
+	const bundles = previous.filter((name) => !(beforeNames.has(name) || afterNames.has(name)) || bundleNames.has(name));
+	for (const dependency of after.dependencies) if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) bundles.push(dependency.name);
+	return {
+		plugins: {
+			manifest: bundles.length !== previous.length || bundles.some((name, index) => name !== previous[index]) ? writeProfileBundles(options.profileDir, after.manifest, bundles) : after.manifest,
+			dependencies: after.dependencies.map((dependency) => ({
+				...dependency,
+				enabled: bundles.includes(dependency.name)
+			}))
+		},
+		addedPlainDependencies: after.dependencies.filter((dependency) => !dependency.bundle && !beforeNames.has(dependency.name)).map((dependency) => dependency.name)
+	};
+}
+//#endregion
+//#region lib/types/profile-sanitize.js
+/** Filesystem recovery for callers that own profile shutdown and write exclusion. */
+/**
+* Back up the profile patch and retain only the caller's recovery bundles.
+* The caller must stop the profile and exclude concurrent profile writes.
+* Installed packages and other manifest fields are preserved; patches are never parsed.
+* Failures propagate and may leave completed changes in place for a retry.
+* @param binName - Diagnostic prefix for invalid profile manifests.
+* @param profileDir - Profile directory to recover without loading its plugins.
+* @param bundles - Ordered bundles to enable after recovery.
+* @returns Backup path with a Unix millisecond timestamp and optional collision ordinal, or undefined if absent.
+*/
+function sanitizeProfile(binName, profileDir, bundles) {
+	const manifest = existsSync(join(profileDir, "package.json")) ? readProfileManifest(binName, profileDir) : void 0;
+	const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+	const backupBase = `${patchPath}.bak-${Date.now()}`;
+	let backupPath = backupBase;
+	let ordinal = 0;
+	while (existsSync(backupPath)) backupPath = `${backupBase}-${++ordinal}`;
+	try {
+		renameSync(patchPath, backupPath);
+	} catch (error) {
+		if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+		backupPath = void 0;
+	}
+	if (manifest !== void 0) writeProfileBundles(profileDir, manifest, bundles);
+	return backupPath;
+}
+//#endregion
+//#region lib/types/profile-resolution/resolver.js
+/** In-memory profile package routing for Node's default ESM and CommonJS loaders. */
+const WORKER_RESOLUTION_KEY = "@qlzt/dsh-app-boot/profile-resolution";
+const EMPTY_ATTRIBUTES = Object.freeze({});
+/**
+* Split a bare request into its package name without allocating path segments.
+* @param request - module specifier to classify.
+* @returns the bare package name, or undefined for non-package requests.
+*/
+function barePackageName(request) {
+	if (!request || request[0] === "." || request[0] === "/" || request[0] === "\\" || request[0] === "#" || request.includes(":") || isBuiltin(request)) return;
+	const first = request.indexOf("/");
+	if (request[0] !== "@") return first < 0 ? request : request.slice(0, first);
+	if (first < 0) return;
+	const second = request.indexOf("/", first + 1);
+	return second < 0 ? request : request.slice(0, second);
+}
+function canonicalPath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+function prefixes(path) {
+	const configured = resolve(path) + sep;
+	const canonical = canonicalPath(path) + sep;
+	return canonical === configured ? [configured] : [configured, canonical];
+}
+function compileResolution(resolution) {
+	return {
+		entries: new Map(resolution.entries.map((entry) => [entry.name, entry])),
+		profilesDir: resolution.profilesDir,
+		profileDir: resolution.profileDir,
+		profilePaths: prefixes(resolution.profilesDir),
+		profile: resolution.profileDir === void 0 ? [] : prefixes(resolution.profileDir),
+		installationPaths: [...new Set(resolution.entries.filter((entry) => entry.scope === "installation").flatMap((entry) => prefixes(entry.packageDir)))],
+		linkedPaths: resolution.linkedRoots.flatMap((root) => prefixes(root.realPath)),
+		localPackageNames: new Set(resolution.localPackageNames),
+		esmRoutes: /* @__PURE__ */ new Map(),
+		cjsRoutes: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* The interception layer of a profile is `<profileParent>/node_modules`: an entry occupies its name there, so its
+* subpath misses continue above it, and a name without an entry continues at it.
+*/
+function computeProfileLayer(dir, active) {
+	const profileParent = dirname(dir);
+	return {
+		kind: "profile",
+		active,
+		localPrefix: dir + sep,
+		nativeAfter: join(profileParent, "package.json"),
+		after: join(dirname(profileParent), "package.json")
+	};
+}
+/** The interception layer of a module path: from its profile directory inside a profiles tree, or its linked root. */
+function findInterceptionLayer(path, resolution) {
+	const treeRoot = resolution.profilePaths.find((prefix) => path.startsWith(prefix));
+	const activeProfile = resolution.profile.find((prefix) => path.startsWith(prefix));
+	const dir = treeRoot !== void 0 ? profileChild(path, treeRoot) : activeProfile?.slice(0, -1);
+	if (dir !== void 0) return computeProfileLayer(dir, activeProfile !== void 0);
+	if (!startsWithin(path, resolution.linkedPaths)) return void 0;
+	if (startsWithin(path, resolution.installationPaths)) return void 0;
+	return { kind: "linked" };
+}
+/** Package names a directory's current manifest lists as peers; an unreadable manifest lists none. */
+function readPeerNames(directory) {
+	try {
+		const peers = JSON.parse(readFileSync(join(directory, "package.json"), "utf8")).peerDependencies;
+		return new Set(peers !== null && typeof peers === "object" ? Object.keys(peers) : []);
+	} catch (_error) {
+		return /* @__PURE__ */ new Set();
+	}
+}
+function startsWithin(path, roots) {
+	for (const root of roots) if (path.startsWith(root)) return true;
+	return false;
+}
+/**
+* The profile directory owning a module inside the profiles tree: the first path segment below the tree root.
+* @param path - module path below `treePrefix`.
+* @param treePrefix - profiles directory with a trailing separator.
+* @returns the profile directory without a trailing separator.
+*/
+function profileChild(path, treePrefix) {
+	const rest = path.slice(treePrefix.length);
+	const end = rest.indexOf(sep);
+	return treePrefix + (end < 0 ? rest : rest.slice(0, end));
+}
+function nativePackageDir(parent, name) {
+	for (const searchPath of createRequire(parent).resolve.paths(name)) {
+		const candidate = join(searchPath, name);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+function localPackageCandidate(searchPath, name, flavor) {
+	const candidate = join(searchPath, name);
+	const stat = statSync(candidate, { throwIfNoEntry: false });
+	return (flavor === "esm" ? stat?.isDirectory() === true : stat !== void 0 || [
+		".js",
+		".json",
+		".node"
+	].some((extension) => existsSync(candidate + extension))) ? candidate : void 0;
+}
+function selfReferenceName(parent) {
+	let current = dirname(parent);
+	while (true) {
+		const manifestPath = join(current, "package.json");
+		if (existsSync(manifestPath)) {
+			let manifest;
+			try {
+				manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			} catch (_error) {
+				return null;
+			}
+			return typeof manifest.name === "string" && manifest.exports != null ? manifest.name : false;
+		}
+		/* v8 ignore next -- scoped module requests normally find an owning manifest before node_modules. */
+		if (basename(current) === "node_modules") return false;
+		const next = dirname(current);
+		if (next === current) return false;
+		current = next;
+	}
+}
+function packageImportsTarget(parent, request, conditions) {
+	let current = dirname(parent);
+	while (true) {
+		const manifestPath = join(current, "package.json");
+		if (existsSync(manifestPath)) {
+			let manifest;
+			try {
+				manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			} catch (_error) {
+				/* v8 ignore next -- native resolution cannot report MODULE_NOT_FOUND after an invalid scope manifest */
+				return;
+			}
+			try {
+				const target = imports(manifest, request, {
+					conditions: [...conditions],
+					unsafe: true
+				})?.[0];
+				return target !== void 0 && barePackageName(target) !== void 0 ? {
+					specifier: target,
+					parentURL: pathToFileURL(manifestPath).href
+				} : void 0;
+			} catch (_error) {
+				/* v8 ignore next -- native resolution cannot report MODULE_NOT_FOUND before selecting a valid mapping */
+				return;
+			}
+		}
+		if (basename(current) === "node_modules") return void 0;
+		const next = dirname(current);
+		/* v8 ignore next -- a MODULE_NOT_FOUND package-import target always has an owning package scope */
+		if (next === current) return void 0;
+		current = next;
+	}
+}
+function packageSearchPaths(entry, request, cjs) {
+	const name = barePackageName(request);
+	/* v8 ignore next -- interception routes are created only for bare package requests */
+	if (name === void 0) return cjs._nodeModulePaths(dirname(entry.declarer));
+	const suffix = sep + name.split("/").join(sep);
+	return entry.packageDir.endsWith(suffix) ? [entry.packageDir.slice(0, -suffix.length)] : cjs._nodeModulePaths(dirname(entry.declarer));
+}
+function localCandidateOwnsResolution(candidate, resolved, request, name) {
+	if (startsWithin(resolved, prefixes(candidate))) return true;
+	if (sameResolution(candidate, resolved)) return true;
+	if ([
+		".js",
+		".json",
+		".node"
+	].some((extension) => sameResolution(candidate + extension, resolved))) return true;
+	/* v8 ignore next -- a bounded native lookup can escape a candidate only through its root legacy main */
+	if (request !== name) return false;
+	try {
+		const manifest = JSON.parse(readFileSync(join(candidate, "package.json"), "utf8"));
+		/* v8 ignore next -- a bounded native lookup outside the package directory requires a legacy main */
+		if (typeof manifest.main !== "string") return false;
+		return sameResolution(createRequire(join(candidate, "package.json")).resolve(resolve(candidate, manifest.main)), resolved);
+	} catch (_error) {
+		/* v8 ignore next -- this helper runs only after the same native resolution succeeded */
+		return false;
+	}
+}
+function isUnselectedPackageMiss(error) {
+	const failure = error;
+	return failure.code === "MODULE_NOT_FOUND" && failure.path === void 0;
+}
+function sameResolution(left, right) {
+	if (left === right) return true;
+	return canonicalPath(left) === canonicalPath(right);
+}
+/** One mutable pointer to the immutable runtime resolution. */
+var ResolutionRouter = class {
+	nodeModulePaths;
+	current;
+	linkedTargets;
+	constructor(resolution, nodeModulePaths) {
+		this.nodeModulePaths = nodeModulePaths;
+		this.current = compileResolution(resolution);
+		this.linkedTargets = new Map(resolution.linkedRoots.map((root) => [root.name, root.realPath]));
+	}
+	replace(successor) {
+		const entries = new Map(successor.entries.map((entry) => [entry.name, entry]));
+		if (successor.profilesDir !== this.current.profilesDir || successor.profileDir !== this.current.profileDir) throw new Error("profile resolution: a successor cannot change its profile scope");
+		for (const [name, current] of this.current.entries) {
+			const next = entries.get(name);
+			if (next === void 0 && current.scope === "profile") continue;
+			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || current.scope === "installation" && !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
+		}
+		const localPackageNames = new Set(successor.localPackageNames);
+		for (const name of localPackageNames) if (!this.current.localPackageNames.has(name) && this.current.entries.has(name)) throw new Error(`profile resolution: overriding ${JSON.stringify(name)} locally requires a process restart`);
+		for (const root of successor.linkedRoots) {
+			const previous = this.linkedTargets.get(root.name);
+			if (previous !== void 0 && !sameResolution(previous, root.realPath)) throw new Error(`profile resolution: relinking ${JSON.stringify(root.name)} requires a process restart`);
+		}
+		const next = compileResolution(successor);
+		for (const { name, realPath } of successor.linkedRoots) if (!this.linkedTargets.has(name)) this.linkedTargets.set(name, realPath);
+		this.current = next;
+	}
+	/** Whether a module path has an interception layer: it lies in the profiles tree, the active profile, or a linked root. */
+	hasInterceptionLayerForPath(path) {
+		return findInterceptionLayer(path, this.current) !== void 0;
+	}
+	/** Whether an importer URL is scoped; the answer is memoized with the importer's routes. */
+	hasInterceptionLayerForUrl(parentURL) {
+		return this.getOrCreateParentRoutesForUrl(parentURL) !== false;
+	}
+	createParentRoutes(parent, resolution) {
+		const layer = findInterceptionLayer(parent, resolution);
+		return layer === void 0 ? void 0 : {
+			parent,
+			layer,
+			requests: /* @__PURE__ */ new Map()
+		};
+	}
+	getOrCreateParentRoutesForUrl(parentURL) {
+		const resolution = this.current;
+		let parentRoutes = resolution.esmRoutes.get(parentURL);
+		if (parentRoutes !== void 0) return parentRoutes;
+		let parent;
+		try {
+			parent = fileURLToPath(parentURL);
+		} catch {
+			parent = void 0;
+		}
+		parentRoutes = parent === void 0 ? false : this.createParentRoutes(parent, resolution) ?? false;
+		resolution.esmRoutes.set(parentURL, parentRoutes);
+		return parentRoutes;
+	}
+	routeScoped(request, parentRoutes, resolution, flavor, cjs) {
+		const { parent, layer, requests } = parentRoutes;
+		const memo = layer.kind === "profile" && (cjs === void 0 || cjs.cacheable);
+		const name = barePackageName(request);
+		if (name === void 0) return void 0;
+		if (parentRoutes.selfReferenceName === void 0 || !memo) parentRoutes.selfReferenceName = selfReferenceName(parent);
+		if (parentRoutes.selfReferenceName === name || parentRoutes.selfReferenceName === null) {
+			const state = { route: { kind: "native" } };
+			if (memo) requests.set(request, state);
+			return state;
+		}
+		if (layer.kind === "linked") return this.routeLinked(request, name, parent, resolution, flavor, cjs);
+		const target = resolution.entries.get(name);
+		const candidates = [];
+		const localSearchPaths = [];
+		for (const searchPath of createRequire(parent).resolve.paths(name)) {
+			if (!searchPath.startsWith(layer.localPrefix)) break;
+			localSearchPaths.push(searchPath);
+			const candidate = localPackageCandidate(searchPath, name, flavor);
+			if (candidate !== void 0) candidates.push(candidate);
+		}
+		if (candidates.length > 0) if (cjs !== void 0) try {
+			const resolved = cjs.resolveNative(localSearchPaths);
+			const selected = candidates.find((candidate) => localCandidateOwnsResolution(candidate, resolved, request, name));
+			if (selected !== void 0) {
+				const state = {
+					route: {
+						kind: "native",
+						packageDir: selected
+					},
+					packageDir: selected,
+					cjs: resolved
+				};
+				if (memo) requests.set(request, state);
+				return state;
+			}
+		} catch (error) {
+			if (!isUnselectedPackageMiss(error)) throw error;
+		}
+		else {
+			const selected = candidates[0];
+			const state = {
+				route: {
+					kind: "native",
+					packageDir: selected
+				},
+				packageDir: selected
+			};
+			requests.set(request, state);
+			return state;
+		}
+		const route = target !== void 0 && (target.scope === "installation" || layer.active) ? {
+			kind: "interception",
+			entry: target,
+			after: layer.after
+		} : {
+			kind: "native-after-interception",
+			parent: layer.nativeAfter
+		};
+		const state = { route };
+		if (route.kind === "interception" && memo) requests.set(request, state);
+		return state;
+	}
+	routeLinked(request, name, parent, resolution, flavor, cjs) {
+		const target = resolution.entries.get(name);
+		if (target === void 0) return { route: { kind: "native" } };
+		const ancestors = this.nodeModulePaths(dirname(parent));
+		const ancestorSet = new Set(ancestors);
+		const searchPaths = flavor === "esm" ? ancestors : createRequire(parent).resolve.paths(name);
+		for (const searchPath of searchPaths) {
+			const directory = dirname(searchPath);
+			if (ancestorSet.has(searchPath) && readPeerNames(directory).has(name)) {
+				const route = {
+					kind: "interception",
+					entry: target,
+					after: join(dirname(directory), "package.json")
+				};
+				if (cjs === void 0) return { route };
+				try {
+					const resolved = cjs.resolveEntry(target, route.after);
+					if (localCandidateOwnsResolution(target.packageDir, resolved, request, name)) return {
+						route,
+						packageDir: target.packageDir,
+						cjs: resolved
+					};
+				} catch (error) {
+					if (!isUnselectedPackageMiss(error)) throw error;
+				}
+				continue;
+			}
+			const candidate = localPackageCandidate(searchPath, name, flavor);
+			if (candidate === void 0) continue;
+			if (cjs === void 0) return {
+				route: {
+					kind: "native",
+					packageDir: candidate
+				},
+				packageDir: candidate
+			};
+			try {
+				const resolved = cjs.resolveNative([searchPath]);
+				if (localCandidateOwnsResolution(candidate, resolved, request, name)) return {
+					route: {
+						kind: "native",
+						packageDir: candidate
+					},
+					packageDir: candidate,
+					cjs: resolved
+				};
+			} catch (error) {
+				if (!isUnselectedPackageMiss(error)) throw error;
+			}
+		}
+		return cjs === void 0 ? { route: { kind: "native" } } : {
+			route: { kind: "native" },
+			cjs: cjs.resolveNative([])
+		};
+	}
+	routeLocalPackage(request, parentRoutes, resolution) {
+		const name = barePackageName(request);
+		const { layer } = parentRoutes;
+		if (name === void 0 || layer.kind !== "profile" || !layer.active || !resolution.localPackageNames.has(name)) return void 0;
+		const state = { route: { kind: "native" } };
+		parentRoutes.requests.set(request, state);
+		return state;
+	}
+	routeUrl(request, parentURL) {
+		const resolution = this.current;
+		const parentRoutes = this.getOrCreateParentRoutesForUrl(parentURL);
+		if (parentRoutes === false) return void 0;
+		const cached = parentRoutes.requests.get(request);
+		if (cached !== void 0) return cached;
+		const local = this.routeLocalPackage(request, parentRoutes, resolution);
+		if (local !== void 0) return local;
+		return this.routeScoped(request, parentRoutes, resolution, "esm");
+	}
+	routePath(request, parent, cjs) {
+		const resolution = this.current;
+		let parentRoutes = resolution.cjsRoutes.get(parent);
+		if (parentRoutes === false) return void 0;
+		const cached = cjs.cacheable ? parentRoutes?.requests.get(request) : void 0;
+		if (cached !== void 0) return cached;
+		if (parentRoutes === void 0) {
+			parentRoutes = this.createParentRoutes(parent, resolution) ?? false;
+			resolution.cjsRoutes.set(parent, parentRoutes);
+			if (parentRoutes === false) return void 0;
+		}
+		return this.routeScoped(request, parentRoutes, resolution, "cjs", cjs);
+	}
+	packageDir(specifier, parentURL) {
+		const name = barePackageName(specifier);
+		if (name === void 0) return void 0;
+		const state = this.routeUrl(name, parentURL);
+		if (state?.route.kind === "interception") return state.route.entry.packageDir;
+		if (state?.packageDir !== void 0) return state.packageDir;
+		let parent;
+		try {
+			parent = state?.route.kind === "native-after-interception" ? state.route.parent : fileURLToPath(parentURL);
+		} catch {
+			return;
+		}
+		const found = nativePackageDir(parent, name);
+		if (state !== void 0 && found !== void 0) state.packageDir = found;
+		return found;
+	}
+};
+function internalModules() {
+	const addon = createRequire(import.meta.url)("node-addon-require-builtin");
+	const esmModule = addon.requireBuiltin("internal/modules/esm/loader");
+	const cjsModule = addon.requireBuiltin("internal/modules/cjs/loader");
+	const cjsHelpers = addon.requireBuiltin("internal/modules/helpers");
+	const esmUtils = addon.requireBuiltin("internal/modules/esm/utils");
+	const esmResolve = addon.requireBuiltin("internal/modules/esm/resolve");
+	const esm = esmModule.getOrInitializeCascadedLoader();
+	const modern = "getOrCreateModuleJob" in esm;
+	/* v8 ignore start -- the supported Node 22/24/26 matrix validates each available Internal interface */
+	if (typeof esm.resolveSync !== "function" || typeof Reflect.get(esm, modern ? "getOrCreateModuleJob" : "getModuleJobForImport") !== "function" || !modern && typeof Reflect.get(esm, "resolve") !== "function" || typeof cjsModule.Module._resolveFilename !== "function" || typeof cjsHelpers.getCjsConditions !== "function" || typeof esmUtils.getDefaultConditions !== "function" || typeof esmResolve.defaultResolve !== "function") throw new Error("profile resolution: unsupported Node module loader");
+	/* v8 ignore stop */
+	return {
+		esm,
+		esmDefaultResolve: (specifier, context) => esmResolve.defaultResolve(specifier, context),
+		esmConditions: esmUtils.getDefaultConditions(),
+		cjs: cjsModule.Module,
+		cjsConditions: cjsHelpers.getCjsConditions(),
+		modern
+	};
+}
+/**
+* Replace a resolver error's message and the same text in its stack.
+* Node's module-hooks thread serializes errors and returns the stack accessor as a read-only configurable
+* data property, so a rejected stack assignment redefines the property value.
+* @param error - resolver error to update in place.
+* @param message - replacement message.
+*/
+function replaceErrorMessage(error, message) {
+	const { message: originalMessage, stack } = error;
+	error.message = message;
+	/* v8 ignore next -- Node's resolver errors always carry a stack */
+	if (stack === void 0) return;
+	const replaced = stack.replace(originalMessage, message);
+	if (!Reflect.set(error, "stack", replaced)) Object.defineProperty(error, "stack", { value: replaced });
+}
+function throwWithImporter(error, routedParent, parent) {
+	const code = error.code;
+	if (error instanceof Error && (code === "ERR_MODULE_NOT_FOUND" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED")) {
+		const routedPath = fileURLToPath(routedParent);
+		const parentPath = fileURLToPath(parent);
+		replaceErrorMessage(error, error.message.replaceAll(routedParent, parent).replaceAll(routedPath, parentPath));
+	}
+	throw error;
+}
+function throwWithoutCjsAnchor(error, anchor) {
+	const resolved = error;
+	const requireStack = resolved.requireStack;
+	if (error instanceof Error && resolved.code === "MODULE_NOT_FOUND" && requireStack?.[0] !== void 0 && sameResolution(requireStack[0], anchor)) {
+		const originalMessage = error.message;
+		const originalBlock = `\nRequire stack:\n${requireStack.map((path) => `- ${path}`).join("\n")}`;
+		const remaining = requireStack.slice(1);
+		/* v8 ignore next -- routed calls always retain the original importing module */
+		const replacement = remaining.length === 0 ? "" : `\nRequire stack:\n${remaining.map((path) => `- ${path}`).join("\n")}`;
+		error.message = originalMessage.replace(originalBlock, replacement);
+		resolved.requireStack = remaining;
+		const stack = error.stack;
+		/* v8 ignore next -- Node's resolver errors always carry a stack */
+		if (stack !== void 0) error.stack = stack.replace(originalMessage, error.message);
+	}
+	throw error;
+}
+/**
+* Install one runtime resolution as the interception on Node's default ESM and CommonJS resolvers.
+* @param resolution - complete package table and profile scope.
+* @returns an interception that publishes a successor or restores the native methods.
+*/
+function installRuntimeInterception(resolution) {
+	const { esm, esmDefaultResolve, esmConditions, cjs, cjsConditions, modern } = internalModules();
+	const router = new ResolutionRouter(resolution, (directory) => cjs._nodeModulePaths(directory));
+	let delegatedEsm;
+	const adaptEsm = (native) => {
+		const adapted = (request, parent, attributes) => {
+			const delegated = delegatedEsm;
+			/* v8 ignore next -- reentry requires a separate synchronous Node hook; supported launches install none */
+			if (delegated !== void 0 && delegated.parent === parent && delegated.request === request) return native(request, parent, attributes);
+			if (parent === void 0 || !router.hasInterceptionLayerForUrl(parent)) return native(request, parent, attributes);
+			const state = router.routeUrl(request, parent);
+			if (state === void 0) {
+				const target = request[0] === "#" ? packageImportsTarget(fileURLToPath(parent), request, esmConditions) : void 0;
+				if (target === void 0) return native(request, parent, attributes);
+				const restoreImporter = (error) => throwWithImporter(error, target.parentURL, parent);
+				let expected;
+				try {
+					expected = adapted(target.specifier, target.parentURL, attributes);
+					/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+					if (expected instanceof Promise) expected = expected.catch(restoreImporter);
+				} catch (error) {
+					return restoreImporter(error);
+				}
+				return expected;
+			}
+			const cacheable = attributes === EMPTY_ATTRIBUTES || Object.keys(attributes).length === 0;
+			if (cacheable && state.esm !== void 0) return state.esm;
+			const route = state.route;
+			if (route.kind === "native") {
+				const result = native(request, parent, attributes);
+				if (cacheable && !(result instanceof Promise)) state.esm = result;
+				return result;
+			}
+			const routedParent = pathToFileURL(route.kind === "interception" ? route.entry.declarer : route.parent).href;
+			const previous = delegatedEsm;
+			delegatedEsm = {
+				parent: routedParent,
+				request
+			};
+			const restoreImporter = (error) => throwWithImporter(error, routedParent, parent);
+			try {
+				let result;
+				try {
+					result = native(request, routedParent, attributes);
+				} catch (error) {
+					return restoreImporter(error);
+				}
+				/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+				if (result instanceof Promise) return result.catch(restoreImporter);
+				if (cacheable) state.esm = result;
+				return result;
+			} finally {
+				delegatedEsm = previous;
+			}
+		};
+		return adapted;
+	};
+	let restoreEsm;
+	/* v8 ignore else -- CI coverage runs Node 24 v2; the Node 22 matrix exercises the v1 adapter */
+	if (modern) {
+		const loader = esm;
+		const original = Reflect.get(loader, "resolveSync");
+		const resolveRequest = adaptEsm((request, parent, attributes) => original.call(loader, parent, {
+			specifier: request,
+			attributes
+		}));
+		const wrapped = (parent, request, ...rest) => rest.length ? Reflect.apply(original, loader, [
+			parent,
+			request,
+			...rest
+		]) : resolveRequest(request.specifier, parent, request.attributes ?? EMPTY_ATTRIBUTES);
+		loader.resolveSync = wrapped;
+		restoreEsm = () => {
+			/* v8 ignore else -- interceptions are disposed in reverse installation order */
+			if (loader.resolveSync === wrapped) loader.resolveSync = original;
+		};
+	} else {
+		const loader = esm;
+		const original = Reflect.get(loader, "resolve");
+		const originalSync = Reflect.get(loader, "resolveSync");
+		const resolveRequest = adaptEsm((request, parent, attributes) => original.call(loader, request, parent, attributes));
+		const resolveRequestSync = adaptEsm((request, parent, attributes) => originalSync.call(loader, request, parent, attributes));
+		const wrapped = (request, parent, attributes = EMPTY_ATTRIBUTES) => resolveRequest(request, parent, attributes);
+		const wrappedSync = (request, parent, attributes = EMPTY_ATTRIBUTES) => resolveRequestSync(request, parent, attributes);
+		loader.resolve = wrapped;
+		loader.resolveSync = wrappedSync;
+		restoreEsm = () => {
+			if (loader.resolve === wrapped) loader.resolve = original;
+			if (loader.resolveSync === wrappedSync) loader.resolveSync = originalSync;
+		};
+	}
+	const originalFilename = Reflect.get(cjs, "_resolveFilename");
+	let delegatedCjs = 0;
+	const resolveRoutedCjs = (request, routed, parent, main, options) => {
+		const anchor = routed.kind === "interception" ? routed.entry.declarer : routed.parent;
+		const synthetic = new cjs(anchor);
+		synthetic.parent = parent;
+		synthetic.filename = anchor;
+		synthetic.paths = routed.kind === "interception" ? packageSearchPaths(routed.entry, request, cjs) : cjs._nodeModulePaths(dirname(anchor));
+		try {
+			return originalFilename.call(cjs, request, synthetic, main, options);
+		} catch (error) {
+			return throwWithoutCjsAnchor(error, anchor);
+		}
+	};
+	const resolveNativeCjs = (request, searchPaths, parent, parentFilename, main, conditions) => {
+		const synthetic = new cjs(parentFilename);
+		if (parent.parent !== void 0) synthetic.parent = parent.parent;
+		synthetic.filename = parentFilename;
+		synthetic.paths = [...searchPaths];
+		const options = conditions === void 0 ? void 0 : { conditions };
+		return originalFilename.call(cjs, request, synthetic, main, options);
+	};
+	const resolvePackageImportCjs = (target, conditions) => {
+		const state = router.routeUrl(target.specifier, target.parentURL);
+		const resolveFrom = (parentURL) => fileURLToPath(esmDefaultResolve(target.specifier, {
+			parentURL,
+			conditions: [...conditions]
+		}).url);
+		/* v8 ignore next -- the target manifest was found inside the established profile scope */
+		if (state === void 0) return resolveFrom(target.parentURL);
+		if (state.route.kind === "native") return resolveFrom(target.parentURL);
+		const route = state.route;
+		if (route.kind === "native-after-interception") return resolveFrom(pathToFileURL(route.parent).href);
+		return resolveFrom(pathToFileURL(route.entry.declarer).href);
+	};
+	const wrappedFilename = (request, parent, main, options) => {
+		if (delegatedCjs || !parent?.filename || options?.paths !== void 0) return originalFilename.call(cjs, request, parent, main, options);
+		const parentFilename = parent.filename;
+		const cacheable = options?.conditions === void 0;
+		const routedOptions = options?.conditions === void 0 ? void 0 : { conditions: options.conditions };
+		const state = router.routePath(request, parentFilename, {
+			cacheable,
+			resolveNative: (searchPaths) => resolveNativeCjs(request, searchPaths, parent, parentFilename, main, options?.conditions),
+			resolveEntry: (entry, after) => {
+				delegatedCjs++;
+				try {
+					return resolveRoutedCjs(request, {
+						kind: "interception",
+						entry,
+						after
+					}, parent, main, routedOptions);
+				} finally {
+					delegatedCjs--;
+				}
+			}
+		});
+		if (state === void 0) {
+			const scoped = router.hasInterceptionLayerForPath(parentFilename);
+			const conditions = options?.conditions ?? cjsConditions;
+			const target = request[0] === "#" && scoped ? packageImportsTarget(parentFilename, request, conditions) : void 0;
+			if (target === void 0) return originalFilename.call(cjs, request, parent, main, options);
+			return resolvePackageImportCjs(target, conditions);
+		}
+		if (state.cjs !== void 0) return state.cjs;
+		const route = state.route;
+		if (route.kind === "native") {
+			const result = originalFilename.call(cjs, request, parent, main, options);
+			if (cacheable) state.cjs = result;
+			return result;
+		}
+		delegatedCjs++;
+		try {
+			let expected;
+			try {
+				expected = resolveRoutedCjs(request, route, parent, main, routedOptions);
+			} catch (error) {
+				if (route.kind !== "interception" || !isUnselectedPackageMiss(error)) throw error;
+				expected = resolveRoutedCjs(request, {
+					kind: "native-after-interception",
+					parent: route.after
+				}, parent, main, routedOptions);
+			}
+			if (cacheable) state.cjs = expected;
+			return expected;
+		} finally {
+			delegatedCjs--;
+		}
+	};
+	cjs._resolveFilename = wrappedFilename;
+	return {
+		packageDir(specifier, parentURL) {
+			return router.packageDir(specifier, parentURL);
+		},
+		replace(next) {
+			router.replace(next);
+		},
+		dispose() {
+			/* v8 ignore else -- interceptions are disposed in reverse installation order */
+			if (cjs._resolveFilename === wrappedFilename) cjs._resolveFilename = originalFilename;
+			restoreEsm();
+		}
+	};
+}
+/**
+* Publish one runtime resolution for Harness-owned Workers.
+* @param resolution - complete package table and profile scope.
+* @returns a disposer restoring the previous thread environment data.
+*/
+function registerWorkerResolution(resolution) {
+	const previous = getEnvironmentData(WORKER_RESOLUTION_KEY);
+	setEnvironmentData(WORKER_RESOLUTION_KEY, { resolution });
+	return () => {
+		setEnvironmentData(WORKER_RESOLUTION_KEY, previous);
+	};
+}
+//#endregion
+//#region lib/types/package-meta.js
+/** Read plugin display text and icons through exported resources without evaluating plugin code. */
+const LANGUAGE_ID = /^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/u;
+/** Maximum raw icon bytes admitted to plugin metadata. */
+const MAX_ICON_BYTES = 256 * 1024;
+const ICON_MEDIA_TYPES = new Map([
+	[".svg", "image/svg+xml"],
+	[".png", "image/png"],
+	[".jpg", "image/jpeg"],
+	[".jpeg", "image/jpeg"],
+	[".webp", "image/webp"]
+]);
+function iconOf(specifier, packageName, parentURL, manifestPath, value) {
+	const icon = manifestPath === void 0 ? void 0 : textOf(value, `${manifestPath}: icon`);
+	let target;
+	let label;
+	if (manifestPath !== void 0 && icon !== void 0) {
+		if (isAbsolute(icon) || win32.isAbsolute(icon) || /^[A-Za-z][A-Za-z\d+.-]*:/u.test(icon)) throw new Error(`${manifestPath}: icon must be a relative file path`);
+		label = manifestPath;
+		const root = realpathSync(dirname(manifestPath));
+		target = resolve(root, icon);
+		const local = relative(root, realModuleFile(target));
+		if (local === ".." || local.startsWith(`..${sep}`) || isAbsolute(local)) throw new Error(`${label}: icon must remain inside its manifest directory`);
+	} else {
+		const exported = optionalResourcePath(`${specifier}/icon`, parentURL);
+		if (exported === void 0) return void 0;
+		target = label = exported;
+		assertPackageOwned(realModuleFile(target), packageName);
+	}
+	const mediaType = ICON_MEDIA_TYPES.get(extname(target).toLowerCase());
+	if (mediaType === void 0) throw new Error(`${label}: icon must be SVG, PNG, JPEG, or WebP`);
+	const file = realModuleFile(target);
+	const stat = statSync(file);
+	if (!stat.isFile()) throw new Error(`${label}: icon must be a regular file`);
+	if (stat.size > MAX_ICON_BYTES) throw new Error(`${label}: icon exceeds 256 KiB`);
+	const bytes = readFileSync(file);
+	if (bytes.length > MAX_ICON_BYTES) throw new Error(`${label}: icon exceeds 256 KiB`);
+	return `data:${mediaType};base64,${bytes.toString("base64")}`;
+}
+/** Require an ancestor of the real file whose package.json names the owning package. */
+function assertPackageOwned(file, name) {
+	for (let directory = dirname(file);; directory = dirname(directory)) {
+		const manifest = join(directory, "package.json");
+		if (existsSync(manifest) && readObject(manifest).name === name) return;
+		if (dirname(directory) === directory) throw new Error(`${file}: icon must remain inside its package directory`);
+	}
+}
+/**
+* Resolve a plugin resource through the active Node ESM resolver without evaluating it.
+* @param specifier - plugin module or exported resource specifier.
+* @param parentURL - owning module-resolution base.
+* @returns the local filesystem path selected by Node and the active profile.
+* @throws when the resolver is unavailable or the resource cannot resolve to a local file.
+*/
+function resolvePluginResource(specifier, parentURL) {
+	const loader = ModuleLoader.fromInternal();
+	if (loader === void 0) throw new Error("Plugin metadata requires the Node module resolver");
+	return fileURLToPath((loader.version === "v2" ? loader.resolveSync(parentURL, {
+		specifier,
+		attributes: {}
+	}) : loader.resolveSync(specifier, parentURL, {})).url);
+}
+function missingResource(error) {
+	const code = error?.code;
+	return code === "ERR_PACKAGE_PATH_NOT_EXPORTED" || code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || code === "ENOENT" || code === "ENOTDIR";
+}
+function optionalResourcePath(specifier, parentURL) {
+	try {
+		return resolvePluginResource(specifier, parentURL);
+	} catch (error) {
+		if (missingResource(error)) return void 0;
+		throw error;
+	}
+}
+function objectOf(value, path) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
+	return value;
+}
+function textOf(value, path) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${path} must be a non-empty string`);
+	return value;
+}
+function readObject(file) {
+	let contents;
+	try {
+		contents = JSON.parse(readFileSync(file, "utf8"));
+	} catch (error) {
+		throw new Error(`${file}: ${String(error)}`);
+	}
+	return objectOf(contents, file);
+}
+function fallbackText(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function dictionariesOf(englishPath, specifier, parentURL) {
+	const dictionaries = /* @__PURE__ */ new Map();
+	for (const entry of readdirSync(dirname(englishPath), { withFileTypes: true })) {
+		if (!entry.name.endsWith(".json")) continue;
+		const resource = `${specifier}/locale/${entry.name}`;
+		const language = entry.name.slice(0, -5);
+		if (!LANGUAGE_ID.test(language)) throw new Error(`${resource} must use a language id as its filename`);
+		const id = language.toLowerCase();
+		if (dictionaries.has(id)) throw new Error(`${resource} duplicates locale ${id}`);
+		const file = resolvePluginResource(resource, parentURL);
+		if (dirname(file) !== dirname(englishPath)) throw new Error(`${resource}: ${file} must share the English locale directory ${dirname(englishPath)}`);
+		const parsed = readObject(file);
+		const meta = parsed.meta === void 0 ? void 0 : objectOf(parsed.meta, `${file}: meta`);
+		dictionaries.set(id, {
+			title: textOf(meta?.title, `${file}: meta.title`),
+			description: textOf(meta?.description, `${file}: meta.description`)
+		});
+	}
+	return dictionaries;
+}
+function localizedText(field, dictionaries, fallback, finalFallback) {
+	const entries = [...dictionaries].flatMap(([language, fields]) => {
+		const value = fields[field];
+		return value === void 0 ? [] : [[language, value]];
+	});
+	if (entries.length === 0) return fallback;
+	return {
+		en: fallback ?? finalFallback,
+		...Object.fromEntries(entries)
+	};
+}
+/**
+* Read plugin locale JSON display text and icon without evaluating JavaScript entries.
+* Only a package-root specifier reads its exported package.json: `name`/`description` fill missing
+* locale fields, and a declared `icon` takes priority over the `<specifier>/icon` resource.
+* A subpath specifier never reads package.json; its icon comes only from `<specifier>/icon`.
+* Manifest icons remain inside their declaring directory; exported icons remain inside their
+* owning package after realpath resolution. Both accept SVG, PNG, JPEG, or WebP up to 256 KiB.
+* Icon failures retain display text without falling back.
+* Non-package specifiers are skipped without invoking the resource resolver.
+* Language files share the directory containing the resolved English resource;
+* each file is resolved through the complete plugin specifier before reading.
+* Translation maps retain an English fallback, ultimately the full module specifier
+* for titles and empty for descriptions.
+* @param specifier - configured plugin module name, including any package subpath.
+* @param parentURL - owning Loader tree's module-resolution base.
+* @returns display fields and any resource diagnostic, or undefined for non-package specifiers or absent metadata.
+*/
+function readPluginMeta(specifier, parentURL) {
+	const packageName = barePackageName(specifier);
+	if (packageName === void 0) return void 0;
+	try {
+		const englishPath = optionalResourcePath(`${specifier}/locale/en.json`, parentURL);
+		const dictionaries = englishPath === void 0 ? /* @__PURE__ */ new Map() : dictionariesOf(englishPath, specifier, parentURL);
+		const manifestPath = packageName === specifier ? optionalResourcePath(`${specifier}/package.json`, parentURL) : void 0;
+		const manifest = manifestPath === void 0 ? void 0 : readObject(manifestPath);
+		const title = localizedText("title", dictionaries, fallbackText(manifest?.name), specifier);
+		const description = localizedText("description", dictionaries, fallbackText(manifest?.description), "");
+		const text = {
+			...title === void 0 ? {} : { title },
+			...description === void 0 ? {} : { description }
+		};
+		let icon;
+		try {
+			icon = iconOf(specifier, packageName, parentURL, manifestPath, manifest?.icon);
+		} catch (error) {
+			return {
+				...text,
+				error: `Plugin metadata for ${specifier}: ${String(error)}`
+			};
+		}
+		if (title === void 0 && description === void 0 && icon === void 0) return void 0;
+		return {
+			...text,
+			...icon === void 0 ? {} : { icon }
+		};
+	} catch (error) {
+		return { error: `Plugin metadata for ${specifier}: ${String(error)}` };
+	}
+}
+//#endregion
+//#region lib/types/compatibility-preflight.js
+/** Compatibility checks at the composition entry points DSH owns; no Loader instrumentation. */
+function readManifest(filename) {
+	return JSON.parse(readFileSync(filename, "utf8"));
+}
+/** Render the patch wording an Include would report, through the profile's logger. */
+function patchWarning(ctx) {
+	return (message, ...args) => {
+		let index = 0;
+		ctx.logger.warn(message.replace(/%C/g, () => JSON.stringify(args[index++])));
+	};
+}
+function manifestOf(ctx, name, parentURL) {
+	if (name.startsWith("cordis:")) return void 0;
+	const specifier = name.startsWith("#") ? resolvePluginResource(name, parentURL) : name;
+	const packages = ctx.get("pluginPackages");
+	const pkg = packages?.packageOf(specifier, parentURL);
+	if (pkg !== void 0) return readManifest(pkg.manifestPath);
+	const bare = barePackageName(specifier);
+	if (bare !== void 0 && packages === void 0) for (const path of createRequire(parentURL).resolve.paths(bare)) {
+		const filename = join(path, bare, "package.json");
+		if (existsSync(filename)) return readManifest(filename);
+	}
+	if (!isAbsolute(specifier) && !specifier.startsWith(".") && !specifier.startsWith("file:")) return void 0;
+	const url = isAbsolute(specifier) ? pathToFileURL(specifier) : new URL(specifier, parentURL);
+	let dir;
+	try {
+		dir = dirname(realpathSync(fileURLToPath(url)));
+	} catch (error) {
+		if ([
+			"ENOENT",
+			"ENOTDIR",
+			"EISDIR"
+		].includes(String(error.code))) return void 0;
+		throw error;
+	}
+	while (true) try {
+		return readManifest(join(dir, "package.json"));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		const parent = dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/** Prepare profile or preset rows before the owning DSH caller passes them to Loader.
+* Only a compatibility conflict denies a row: an entry whose manifest cannot be resolved keeps
+* the Loader's own import failure. A denied ordinary row gains `disabled`; a native Include that
+* reaches a denied plugin is denied as a whole, because its file is never rewritten.
+* @param ctx Context carrying launcher-owned profile facts; non-profile contexts retain their rows.
+* @param entries Complete effective entry list, after patch composition.
+* @param parentURL Resolution base of the tree that will import these rows.
+* @param binName Diagnostic prefix for a denied row; defaults to `dsh`.
+* @returns Detached rows with incompatible entries denied; reads the profile compatibility file once.
+* @throws For malformed compatibility permissions or a profile composition without a resolution base.
+*/
+function prepareProfileEntries(ctx, entries, parentURL, binName = "dsh") {
+	return preflight(ctx, entries, parentURL, (row, reason) => {
+		const label = typeof row.id === "string" ? `row ${JSON.stringify(row.id)}` : row.name;
+		process.stderr.write(`${binName}: disabling profile plugin ${label}: ${reason}\n`);
+	}).rows;
+}
+function preflight(ctx, entries, parentURL, report) {
+	const rows = structuredClone(entries);
+	const profile = ctx.get("profileContext");
+	if (profile === void 0) return {
+		rows,
+		blocked: false
+	};
+	if (parentURL === void 0) throw new Error("Profile compatibility preflight requires a resolution base");
+	const { exemptions, warnings } = readProfileCompatibility(profile.dir);
+	for (const warning of warnings) process.stderr.write(`${warning}\n`);
+	const includes = /* @__PURE__ */ new Set();
+	/** Only a compatibility conflict denies a row; every other failure keeps the Loader's own diagnosis. */
+	const denial = (row, base) => {
+		try {
+			const manifest = manifestOf(ctx, row.name, base);
+			if (manifest === void 0) return void 0;
+			const issue = evaluatePluginCompatibility(manifest, exemptions);
+			return issue === void 0 || issue.exempted ? void 0 : pluginCompatibilityWarning(issue);
+		} catch (error) {
+			return `its declared peer dependencies cannot be validated: ${error instanceof Error ? error.message : String(error)}`;
+		}
+	};
+	const deny = (row, reason) => {
+		row.disabled = true;
+		if (row.group) row.group = false;
+		report(row, reason);
+	};
+	const check = (rows, base) => {
+		let blocked = false;
+		for (const row of rows) {
+			if (row.disabled === true && !row.group) continue;
+			const conflict = denial(row, base);
+			if (conflict !== void 0) {
+				deny(row, conflict);
+				blocked = true;
+				continue;
+			}
+			if ((row.group === true || row.name === "cordis:group" || row.name === "@deepseek-ai/cordis-plugin-group") && Array.isArray(row.config) && check(row.config, base)) blocked = true;
+			if (row.name !== "cordis:include" && row.name !== "@deepseek-ai/cordis-plugin-include") continue;
+			const reached = includedConflicts(row, base);
+			if (reached !== void 0) {
+				deny(row, reached);
+				blocked = true;
+			}
+		}
+		return blocked;
+	};
+	/** Whether a native Include reaches a denied plugin; an unreadable one has no compatibility opinion. */
+	const includedConflicts = (row, base) => {
+		const config = row.config;
+		if (typeof config?.path !== "string" || ![
+			".yml",
+			".yaml",
+			".json"
+		].includes(extname(config.path))) return;
+		const requested = isAbsolute(config.path) ? config.path : fileURLToPath(new URL(config.path, base));
+		const filename = existsSync(requested) ? realpathSync(requested) : requested;
+		if (includes.has(filename)) return void 0;
+		includes.add(filename);
+		try {
+			let data;
+			try {
+				data = load(readFileSync(filename, "utf8"), { schema: entryListSchema });
+			} catch (error) {
+				if (error.code !== "ENOENT" || config.initial === void 0) return void 0;
+				data = config.initial;
+			}
+			if (!Array.isArray(data)) return void 0;
+			return check(applyEntryPatches(data, config.patches, patchWarning(ctx)), pathToFileURL(filename).href) ? `its included file ${filename} reaches an incompatible plugin, and that file is never rewritten` : void 0;
+		} finally {
+			includes.delete(filename);
+		}
+	};
+	return {
+		rows,
+		blocked: check(rows, parentURL)
+	};
+}
+/** Apply compatibility policy to the complete patch composition over a profile's empty root.
+* The caller passes every patch layer of the profile, because this returns one insertion patch for
+* that empty root: a non-empty root config would lose the caller's override patches by id.
+* @param ctx Profile context prepared by the launcher.
+* @param patches Original ordered profile patches; these remain unchanged.
+* @param parentURL Root Include's resolution base.
+* @param binName Diagnostic prefix for a denied row; defaults to `dsh`.
+* @returns One prepared insertion patch for profiles, or the original patches for non-profile callers.
+*/
+function prepareProfilePatches(ctx, patches, parentURL, binName = "dsh") {
+	if (ctx.get("profileContext") === void 0) return patches;
+	const rows = prepareProfileEntries(ctx, applyEntryPatches([], patches, patchWarning(ctx)), parentURL, binName);
+	return rows.length === 0 ? [] : [{ insert: rows }];
+}
+//#endregion
+//#region lib/types/official-bundle-packages.js
+/** Package admission shared by offline catalog generation and release ordering. */
+/** Public DSH release members available through the ordinary on-demand bundle installer. */
+const ON_DEMAND_BUNDLES = ["@qlzt/dsh-subagent-claude-code", "@qlzt/dsh-subagent-codex"];
+//#endregion
+//#region lib/types/official-bundles.generated.js
+/** Generated offline Official bundle metadata. Run pnpm gen-official-bundle-catalog; do not edit. */
+/** Official on-demand entries, independent of installed packages and registry availability. */
+const OFFICIAL_ON_DEMAND_CATALOG = [{
+	packageName: "@qlzt/dsh-subagent-claude-code",
+	meta: {
+		title: {
+			"en": "Claude Code subagent",
+			"zh": "Claude Code 子智能体"
+		},
+		description: {
+			"en": "Delegate one task to Claude Code using its native authentication and settings.",
+			"zh": "使用 Claude Code 原生认证和设置委派单个任务。"
+		},
+		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
+	}
+}, {
+	packageName: "@qlzt/dsh-subagent-codex",
+	meta: {
+		title: {
+			"en": "Codex subagent",
+			"zh": "Codex 子智能体"
+		},
+		description: {
+			"en": "Delegate one task to Codex using its native authentication and settings.",
+			"zh": "使用 Codex 原生认证和设置委派单个任务。"
+		},
+		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
+	}
+}];
+//#endregion
+//#region lib/types/config-schema/native.js
+/** Identity checks at the plugin-export and lazy-builder boundaries. */
+/**
+* Recognize the native Schemastery graph protocol without invoking a validator or serialization hook.
+* @param value - plugin Config export or lazy-builder result.
+* @returns whether native schema fields can be inspected.
+*/
+function isNativeConfigSchema(value) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
+	const meta = Reflect.get(value, "meta");
+	return Reflect.get(value, Symbol.for("schemastery")) === true && typeof Reflect.get(value, "type") === "string" && meta !== null && typeof meta === "object";
+}
+//#endregion
+//#region lib/types/config-schema/pattern.js
+/** Conservative compatibility checks between native RegExp validation and Unicode JSON Schema patterns. */
+function bmpOnly(node) {
+	switch (node.type) {
+		case "Character": return node.value <= 65535 && (node.value < 55296 || node.value > 57343);
+		case "CharacterClassRange": return bmpOnly(node.min) && bmpOnly(node.max) && (node.max.value < 55296 || node.min.value > 57343);
+		case "CharacterClass": return !node.negate && node.elements.every(bmpOnly);
+		case "CharacterSet": return (node.kind === "digit" || node.kind === "space" || node.kind === "word") && !node.negate;
+		case "Quantifier": return bmpOnly(node.element);
+		case "Assertion": return [
+			"start",
+			"end",
+			"word"
+		].includes(node.kind);
+		default: return false;
+	}
+}
+function broadSet(node) {
+	return node.type === "CharacterSet" && (node.kind === "any" || (node.kind === "digit" || node.kind === "space" || node.kind === "word") && node.negate);
+}
+function portableAlternative(alternative) {
+	if (alternative.elements.length === 1 && alternative.elements.some(broadSet)) return true;
+	let broadRepetitions = 0;
+	const wordAssertion = alternative.elements.some((element) => element.type === "Assertion" && element.kind === "word");
+	return alternative.elements.every((element) => {
+		if (element.type === "Quantifier" && element.max === Infinity && element.min <= 1 && broadSet(element.element)) return !wordAssertion && ++broadRepetitions === 1;
+		return bmpOnly(element);
+	});
+}
+function signature(pattern) {
+	const incidental = new Set([
+		"parent",
+		"start",
+		"end",
+		"raw",
+		"references",
+		"resolved"
+	]);
+	return JSON.stringify(pattern, (key, value) => incidental.has(key) ? void 0 : value);
+}
+/**
+* Create a checker for patterns that can retain native acceptance under Unicode regex semantics.
+* Unrecognized flagless syntax stays explicitly partial rather than becoming a misleading constraint.
+* @returns the compatibility predicate; parsing never executes the regular expression against config values.
+*/
+async function createPatternCheck() {
+	const { RegExpParser } = await import("@eslint-community/regexpp");
+	const parser = new RegExpParser();
+	return (source, flags = "") => {
+		if (flags !== "" && flags !== "u") return false;
+		try {
+			const unicode = parser.parsePattern(source, 0, source.length, { unicode: true });
+			if (flags === "u") return true;
+			const native = parser.parsePattern(source, 0, source.length, { unicode: false });
+			return signature(native) === signature(unicode) && native.alternatives.every(portableAlternative);
+		} catch (error) {
+			if (error instanceof SyntaxError) return false;
+			throw error;
+		}
+	};
+}
+//#endregion
+//#region lib/types/config-schema/projector.js
+/** Project native Config input constraints without executing their validators or transform callbacks. */
+/** Definition that projected value positions reference as `#/$defs/loaderExpression`; an enclosing document must define it. */
+const LOADER_EXPRESSION_SCHEMA = {
+	type: "object",
+	properties: { __jsExpr: { type: "string" } },
+	required: ["__jsExpr"],
+	description: "Inert representation of a YAML !!js scalar from the Cordis entry-list parser. Its result is evaluated and validated only at runtime. Extra marker-object fields are ignored by interpolation."
+};
+/** Copy JSON-compatible schema annotations without silently converting non-JSON defaults. */
+function jsonValue(value, nullifyUndefined = false) {
+	const visit = (item, active) => {
+		if (nullifyUndefined && item === void 0) return;
+		if (item === null || typeof item === "string" || typeof item === "boolean") return;
+		if (typeof item === "number" && Number.isFinite(item)) return;
+		if (typeof item !== "object") throw new Error("schema annotation is not JSON-compatible");
+		if (active.has(item)) throw new Error("schema annotation contains a cycle");
+		if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) throw new Error("schema annotation contains a non-JSON object");
+		active.add(item);
+		for (const child of Object.values(item)) visit(child, active);
+		active.delete(item);
+	};
+	visit(value, /* @__PURE__ */ new Set());
+	return JSON.parse(JSON.stringify(value, (_key, item) => nullifyUndefined && item === void 0 ? null : item));
+}
+/** Native constant equality treats omitted and null-valued object members alike. */
+function constant(value, objectComparison) {
+	if (Array.isArray(value)) return {
+		type: "array",
+		minItems: value.length,
+		maxItems: value.length,
+		items: false,
+		...value.length ? { prefixItems: Array.from(value, (item) => constant(item, objectComparison)) } : {}
+	};
+	if (value !== null && typeof value === "object") {
+		objectComparison();
+		const properties = Object.fromEntries(Object.entries(value).map(([key, child]) => [key, constant(child, objectComparison)]));
+		const inherited = Object.getOwnPropertyNames(Object.prototype);
+		const required = Object.keys(properties).filter((key) => !inherited.includes(key) && Reflect.get(value, key) != null);
+		return {
+			type: "object",
+			properties,
+			additionalProperties: { type: "null" },
+			patternProperties: { [`^(?:${inherited.map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})$`]: {} },
+			...required.length ? { required } : {}
+		};
+	}
+	return { const: value };
+}
+/** Add or remove null acceptance; a type list stays deduplicated because a wrapped projection may already accept null. */
+function nullable(core, accepts) {
+	if (typeof core === "boolean") return accepts ? core || { type: "null" } : core && { not: { type: "null" } };
+	const types = typeof core.type === "string" ? [core.type] : core.type;
+	if (types === void 0) return accepts ? { anyOf: [core, { type: "null" }] } : {
+		...core,
+		not: { type: "null" }
+	};
+	const [single, ...rest] = accepts ? [...new Set([...types, "null"])] : types.filter((type) => type !== "null");
+	if (single === void 0) return false;
+	return {
+		...core,
+		type: rest.length ? [single, ...rest] : single
+	};
+}
+/** Add expression alternatives only at config VALUE positions, not property names or applicator branches. */
+function expressions(schema, valuePosition = true, enabled = true) {
+	const result = { ...schema };
+	if (schema.properties) result.properties = Object.fromEntries(Object.entries(schema.properties).map(([key, child]) => [key, expressions(child, true, enabled)]));
+	for (const key of ["items", "additionalProperties"]) if (schema[key] !== void 0) result[key] = schema[key] === false ? false : expressions(schema[key], true, enabled);
+	if (schema.propertyNames) result.propertyNames = expressions(schema.propertyNames, false, false);
+	if (schema.prefixItems) result.prefixItems = schema.prefixItems.map((child) => expressions(child, true, enabled));
+	if (schema.anyOf) result.anyOf = schema.anyOf.map((child) => expressions(child, false, enabled));
+	if (schema.not !== void 0) result.not = expressions(schema.not, false, false);
+	if (!valuePosition || !enabled) return result;
+	const annotations = {};
+	for (const key of [
+		"title",
+		"description",
+		"default",
+		"$comment",
+		"x-cordis"
+	]) if (Object.hasOwn(result, key)) {
+		annotations[key] = result[key];
+		Reflect.deleteProperty(result, key);
+	}
+	return {
+		...annotations,
+		anyOf: [result, { $ref: "#/$defs/loaderExpression" }]
+	};
+}
+/** Check native volatile containment without evaluating values or invoking unresolved lazy builders. */
+function validateVolatilePlacement(node, path, blocked = false, seen = /* @__PURE__ */ new Map()) {
+	const states = seen.get(node) ?? /* @__PURE__ */ new Set();
+	if (states.has(blocked)) return;
+	states.add(blocked);
+	seen.set(node, states);
+	if (node.meta.volatile && blocked) throw new Error(`${path}: volatile fields require a fixed object path without an enclosing volatile field`);
+	const nested = blocked || !!node.meta.volatile;
+	for (const [key, child] of Object.entries(node.dict ?? {})) validateVolatilePlacement(child, `${path}/${key}`, nested, seen);
+	if (node.sKey) validateVolatilePlacement(node.sKey, `${path}/keys`, true, seen);
+	if (node.inner && (node.type !== "lazy" || isNativeConfigSchema(node.inner))) validateVolatilePlacement(node.inner, `${path}/inner`, true, seen);
+	for (const [index, child] of (node.list ?? []).entries()) validateVolatilePlacement(child, `${path}/${index}`, true, seen);
+}
+/**
+* Create an invocation-local projector. Ajv checks only literal defaults against generated schemas;
+* it does not fill defaults, coerce input, or call native plugin validators. Opaque input or metadata effects
+* widen validation with explicit limitations instead of simulating native mutation.
+* @returns a function projecting one trusted native Config graph into the enclosing document's definitions.
+*/
+async function createConfigProjector() {
+	const { Ajv2020 } = await import("ajv/dist/2020.js");
+	const validator = new Ajv2020({
+		strict: false,
+		logger: false,
+		validateFormats: false,
+		addUsedSchema: false
+	});
+	const portablePattern = await createPatternCheck();
+	const builderResults = /* @__PURE__ */ new Map();
+	return (root, prefix) => {
+		validateVolatilePlacement(root, "config");
+		const completed = /* @__PURE__ */ new Map();
+		const strictNodes = /* @__PURE__ */ new Map();
+		const active = /* @__PURE__ */ new Set();
+		const recursiveNames = /* @__PURE__ */ new Map();
+		const definitions = {};
+		const limitations = [];
+		const metadataEffects = [];
+		const limitation = (path, message) => {
+			const text = `${path}: ${message}`;
+			limitations.push(text);
+			return text;
+		};
+		const visit = (node, path, strict = false) => {
+			let key = node;
+			if (strict) {
+				key = strictNodes.get(node) ?? { ...node };
+				strictNodes.set(node, key);
+			}
+			const cached = completed.get(key);
+			if (cached) return cached;
+			if (active.has(key)) {
+				let name = recursiveNames.get(key);
+				if (name === void 0) {
+					name = `${prefix}Recursive${recursiveNames.size}`;
+					recursiveNames.set(key, name);
+				}
+				return {
+					schema: { $ref: `#/$defs/${name}` },
+					acceptsMissing: node.type !== "lazy" && node.meta.required ? false : "unknown",
+					exact: true,
+					recursive: true,
+					effectful: true,
+					mutating: true
+				};
+			}
+			active.add(key);
+			let projection;
+			if (node.type === "lazy") {
+				let inner = node;
+				let meta = node.meta.volatile ? {
+					...node.meta,
+					volatile: false
+				} : node.meta;
+				const chain = /* @__PURE__ */ new Set();
+				let looseProjection;
+				while (inner.type === "lazy") {
+					const cachedInner = isNativeConfigSchema(inner.inner);
+					if (meta.loose) {
+						const message = limitation(path, "lazy loose fallback can accept inputs rejected by its inner schema");
+						if (!cachedInner) metadataEffects.push(limitation(path, "unresolved loose lazy metadata propagation may affect shared schemas"));
+						looseProjection = {
+							schema: { "x-cordis": {
+								loose: true,
+								limitations: [message]
+							} },
+							acceptsMissing: true,
+							exact: false,
+							recursive: false,
+							effectful: true,
+							mutating: false
+						};
+						break;
+					}
+					if (chain.has(inner)) throw new Error(`${path}: lazy cycle has no concrete schema`);
+					chain.add(inner);
+					let next = cachedInner ? inner.inner : builderResults.get(inner);
+					if (next === void 0 && typeof inner.builder === "function") {
+						next = Reflect.apply(inner.builder, inner, []);
+						builderResults.set(inner, next);
+					}
+					if (!isNativeConfigSchema(next)) throw new Error(`${path}: lazy schema has no native builder result or resolved inner schema`);
+					if (!cachedInner && [
+						"required",
+						"default",
+						"min",
+						"max",
+						"step",
+						"pattern",
+						"loose",
+						"volatile"
+					].some((key) => Object.hasOwn(meta, key) && !Object.hasOwn(next.meta, key) && ([
+						"required",
+						"loose",
+						"volatile"
+					].includes(key) ? !!Reflect.get(meta, key) : Reflect.get(meta, key) != null))) metadataEffects.push(limitation(path, "lazy metadata propagation may affect shared schemas; validation requires native execution"));
+					meta = cachedInner ? next.meta : {
+						...meta,
+						...next.meta
+					};
+					validateVolatilePlacement({
+						...next,
+						meta
+					}, `${path}/lazy`, true);
+					inner = next;
+				}
+				projection = looseProjection ?? visit({
+					...inner,
+					meta
+				}, `${path}/lazy`, strict);
+				if (node.meta.volatile) projection = {
+					...projection,
+					schema: {
+						...projection.schema,
+						"x-cordis": {
+							...projection.schema["x-cordis"],
+							volatile: true
+						}
+					}
+				};
+			} else {
+				const ownLimitations = [];
+				const inputLimitations = [];
+				let unsupported = false;
+				const inputLimitation = (message) => {
+					inputLimitations.push(message);
+					ownLimitations.push(limitation(path, message));
+				};
+				const annotation = (value, name) => {
+					try {
+						return {
+							ok: true,
+							value: jsonValue(value)
+						};
+					} catch (error) {
+						ownLimitations.push(limitation(`${path}/${name}`, `annotation omitted: ${error instanceof Error ? error.message : String(error)}`));
+						return { ok: false };
+					}
+				};
+				const children = [];
+				const child = (value, suffix, childStrict = false) => {
+					if (value === void 0) throw new Error(`${path}: ${node.type} schema is missing ${suffix}`);
+					const result = visit(value, `${path}/${suffix}`, childStrict);
+					children.push(result);
+					return result;
+				};
+				const meta = { ...node.meta };
+				for (const key of [
+					"min",
+					"max",
+					"step"
+				]) {
+					if (meta[key] === void 0 || Number.isFinite(meta[key])) continue;
+					if (!(key === "max" ? meta.max === Infinity : key === "min" && meta.min === -Infinity && !meta.step)) inputLimitation(`non-finite ${key} constraint is omitted; native validation is required`);
+					Reflect.deleteProperty(meta, key);
+				}
+				let core;
+				let dictionaryValidation;
+				switch (node.type) {
+					case "any":
+						core = true;
+						break;
+					case "never":
+						core = false;
+						break;
+					case "const":
+						try {
+							core = node.value == null ? false : constant(jsonValue(node.value, true), () => {
+								inputLimitation("object constant inherited-member comparison requires native validation");
+							});
+						} catch (error) {
+							core = true;
+							inputLimitation(`constant constraint requires native validation: ${error instanceof Error ? error.message : String(error)}`);
+						}
+						break;
+					case "boolean":
+						core = { type: "boolean" };
+						break;
+					case "string":
+						core = { type: "string" };
+						if (meta.min !== void 0) if (meta.min <= 1) core.minLength = Math.max(0, Math.ceil(meta.min));
+						else inputLimitation("UTF-16 minimum length requires native validation");
+						if (meta.max !== void 0) if (meta.max < 0) core = false;
+						else {
+							const maximum = Math.floor(meta.max);
+							core.maxLength = maximum;
+							if (maximum > 0) inputLimitation("UTF-16 maximum length requires native validation");
+						}
+						if (meta.pattern && core !== false) if (portablePattern(meta.pattern.source, meta.pattern.flags)) core.pattern = meta.pattern.source;
+						else inputLimitation("regular-expression syntax or Unicode semantics require native validation");
+						break;
+					case "number":
+						core = { type: "number" };
+						if (meta.min !== void 0) core.minimum = meta.min;
+						if (meta.max !== void 0) core.maximum = meta.max;
+						if (meta.step) {
+							const step = Math.abs(meta.step);
+							const origin = meta.min ?? 0;
+							if (!Number.isInteger(step) || origin % step !== 0) inputLimitation("fractional or offset numeric step requires native validation");
+							else if (step === 1) core.type = "integer";
+							else core.multipleOf = step;
+						}
+						break;
+					case "object": {
+						const required = [];
+						core = {
+							type: "object",
+							properties: Object.fromEntries(Object.entries(node.dict ?? {}).map(([key, field]) => {
+								const value = child(field, key);
+								if (value.acceptsMissing === false) required.push(key);
+								return [key, value.schema];
+							}))
+						};
+						if (required.length) core.required = required;
+						break;
+					}
+					case "array":
+						core = {
+							type: "array",
+							items: child(node.inner, "items").schema
+						};
+						if (meta.min !== void 0 && node.inner?.meta.default == null) core.minItems = Math.max(0, Math.ceil(meta.min));
+						if (meta.max !== void 0) if (meta.max < 0) core = false;
+						else core.maxItems = Math.floor(meta.max);
+						break;
+					case "dict": {
+						const valueSchema = child(node.inner, "values").schema;
+						core = {
+							type: "object",
+							additionalProperties: valueSchema
+						};
+						if (node.sKey) {
+							const key = child(node.sKey, "keys");
+							if (!(node.sKey.type === "string" && node.sKey.meta.min === void 0 && node.sKey.meta.max === void 0 && node.sKey.meta.pattern === void 0) && (strict || key.effectful)) {
+								dictionaryValidation = {
+									keySchema: key.schema,
+									valueSchema
+								};
+								core = { type: "object" };
+								inputLimitation(key.effectful ? "dictionary key normalization can overwrite unvalidated values; native validation is required" : "strict dictionary filtering and value validation require native validation");
+							} else core.propertyNames = key.schema;
+						}
+						break;
+					}
+					case "tuple": {
+						if (node.list === void 0) throw new Error(`${path}: tuple schema is missing its list`);
+						const values = node.list.map((item, index) => child(item, String(index)));
+						core = {
+							type: "array",
+							...values.length ? { prefixItems: values.map((item) => item.schema) } : {}
+						};
+						const minimum = values.reduce((length, value, index) => value.acceptsMissing === false ? index + 1 : length, 0);
+						if (minimum) core.minItems = minimum;
+						break;
+					}
+					case "union": {
+						if (node.list === void 0) throw new Error(`${path}: union schema is missing its list`);
+						const variants = node.list.map((item, index) => child(item, String(index), strict));
+						if (variants.slice(0, -1).some((variant) => variant.mutating)) {
+							core = true;
+							inputLimitation("earlier union branches may alter later validation inputs; native validation is required");
+						} else core = variants.length ? { anyOf: variants.map((variant) => variant.schema) } : false;
+						break;
+					}
+					case "transform":
+						core = child(node.inner, "input", true).schema;
+						inputLimitation("transform callback validation and normalization are not executed or projected");
+						break;
+					default:
+						core = true;
+						unsupported = true;
+						inputLimitation(`native schema type ${node.type} is not statically projected`);
+				}
+				if (meta.loose) {
+					core = true;
+					inputLimitation("loose validation can replace invalid values with defaults");
+				}
+				const recursive = children.some((value) => value.recursive);
+				const container = [
+					"object",
+					"array",
+					"dict",
+					"tuple"
+				].includes(node.type);
+				const mutating = unsupported || children.some((value) => value.mutating || container && value.effectful);
+				const exact = inputLimitations.length === 0 && children.every((value) => value.exact);
+				const fallback = meta.default === void 0 ? void 0 : annotation(meta.default, "default");
+				let acceptsMissing;
+				if (meta.required) acceptsMissing = false;
+				else if (unsupported) acceptsMissing = "unknown";
+				else if (meta.default == null) acceptsMissing = true;
+				else if (!fallback?.ok) acceptsMissing = "unknown";
+				else if (recursive) {
+					acceptsMissing = "unknown";
+					inputLimitation("recursive default validation cannot be decided statically");
+				} else if (!exact) acceptsMissing = "unknown";
+				else acceptsMissing = validator.validate(core, fallback.value);
+				const annotations = {};
+				if (fallback?.ok) annotations.default = fallback.value;
+				const native = {};
+				if (typeof meta.description === "string") annotations.description = meta.description;
+				else if (meta.description) {
+					const descriptions = annotation(meta.description, "description");
+					if (descriptions.ok) {
+						native.descriptions = descriptions.value;
+						const description = meta.description.en ?? meta.description[""] ?? Object.values(meta.description)[0];
+						if (typeof description === "string") annotations.description = description;
+					}
+				}
+				if (dictionaryValidation) native.dictionaryValidation = dictionaryValidation;
+				const copy = (name, value) => {
+					if (value === void 0) return;
+					const result = annotation(value, name);
+					if (result.ok) native[name] = result.value;
+				};
+				for (const key of [
+					"role",
+					"extra",
+					"hidden",
+					"disabled",
+					"collapse",
+					"link",
+					"comment",
+					"badges",
+					"loose",
+					"volatile"
+				]) copy(key, meta[key]);
+				if (meta.pattern?.flags) copy("patternFlags", meta.pattern.flags);
+				if (node.type === "union") native.branchSelection = "first-success";
+				if (acceptsMissing === "unknown") native.omissionValidation = "runtime";
+				if (ownLimitations.length) {
+					native.type = node.type;
+					for (const key of [
+						"min",
+						"max",
+						"step",
+						"pattern"
+					]) copy(key, meta[key]);
+					native.limitations = ownLimitations;
+				}
+				if (Object.keys(native).length) annotations["x-cordis"] = native;
+				const input = nullable(core, acceptsMissing !== false);
+				projection = {
+					schema: {
+						...typeof input === "boolean" ? input ? {} : { not: {} } : input,
+						...annotations
+					},
+					acceptsMissing,
+					exact: exact && acceptsMissing !== "unknown",
+					recursive,
+					effectful: unsupported || node.type === "transform" || !!meta.loose || children.some((child) => child.effectful),
+					mutating
+				};
+			}
+			active.delete(key);
+			const name = recursiveNames.get(key);
+			if (name !== void 0) {
+				definitions[name] = projection.schema;
+				projection = {
+					...projection,
+					schema: { $ref: `#/$defs/${name}` }
+				};
+			}
+			completed.set(key, projection);
+			return projection;
+		};
+		const result = visit(root, "config");
+		const schema = expressions(result.schema);
+		return {
+			schema: metadataEffects.length ? { anyOf: [schema, {}] } : schema,
+			definitions: Object.fromEntries(Object.entries(definitions).map(([key, value]) => [key, expressions(value, false)])),
+			acceptsMissing: metadataEffects.length ? "unknown" : result.acceptsMissing,
+			limitations: [...new Set(limitations)]
+		};
+	};
+}
+//#endregion
+//#region lib/types/config-schema/document.js
+/** Compose Loader entry/patch structure and discovered plugin input schemas into one JSON Schema document. */
+const ref = (name) => ({ $ref: `#/$defs/${name}` });
+function metadata() {
+	return {
+		id: {
+			type: "string",
+			description: "Entry id. Loader generates an id when an entry omits it; patches use the configured id."
+		},
+		name: {
+			type: "string",
+			description: "Plugin module specifier. Inserted relative plugin paths are anchored beside their patch file."
+		},
+		config: {},
+		group: {
+			type: ["boolean", "null"],
+			description: "Allows patch indexing and insertion into an entry-list config; does not select the plugin implementation."
+		},
+		disabled: {
+			anyOf: [{ type: ["boolean", "null"] }, ref("loaderExpression")],
+			description: "Boolean or !!js expression. The Loader coerces other truthy values as disabled; this schema rejects them."
+		},
+		inject: { anyOf: [
+			{
+				type: "array",
+				items: { type: "string" }
+			},
+			{ type: "object" },
+			{ type: "null" }
+		] },
+		intercept: { type: ["object", "null"] },
+		isolate: {
+			type: ["object", "null"],
+			additionalProperties: { anyOf: [{ const: true }, { type: "string" }] }
+		}
+	};
+}
+function patchStructure() {
+	return {
+		type: "object",
+		allOf: [ref("entryMetadata")],
+		properties: { insert: ref("entryList") },
+		description: "An insert appends entries, optionally inside the group identified by id. Other patches replace supplied fields; config is replaced wholesale, not deep-merged. A truthy name asserts the existing plugin name rather than renaming it. Unknown targets and non-insert patches without a nonempty id are warned and skipped."
+	};
+}
+/**
+* Build a schema for the composed entry list and a separately addressable root-tree patch list.
+* Unknown plugin names remain open; only collected schemas supply plugin-specific constraints.
+* @param profile - selected profile name.
+* @param collected - declarations discovered without mounting plugins, including include descendants.
+* @param targets - last-id-wins patch targets from the root tree's patch index, excluding include descendants.
+* @param initialDiagnostics - composition and import diagnostics already collected.
+* @returns one JSON Schema document with explicit collection and projection annotations.
+*/
+async function buildConfigSchemaDocument(profile, collected, targets, initialDiagnostics) {
+	const project = await createConfigProjector();
+	const diagnostics = [...initialDiagnostics];
+	const definitions = {
+		loaderExpression: LOADER_EXPRESSION_SCHEMA,
+		entryMetadata: {
+			type: "object",
+			properties: metadata()
+		},
+		entryList: {
+			type: "array",
+			items: ref("entry")
+		},
+		patchList: {
+			type: "array",
+			items: ref("patch")
+		},
+		unknownConfig: { $comment: "No projected Config schema is available; this is unknown configuration, not a prohibition on fields." },
+		includeConfig: {
+			type: "object",
+			required: ["path"],
+			properties: {
+				path: {
+					type: "string",
+					description: "YAML/JSON filename resolved relative to the owning Loader tree. This field is literal, not a !!js expression."
+				},
+				initial: ref("entryList"),
+				patches: {
+					type: "array",
+					items: ref("includePatch")
+				},
+				enableLogs: { type: "boolean" }
+			},
+			description: "Native Include configuration stays literal. initial is used only when the file is absent. Included files have their own module-resolution base and patch target index."
+		},
+		includePatch: patchStructure()
+	};
+	const entries = [];
+	const outputByEntry = /* @__PURE__ */ new Map();
+	const projections = /* @__PURE__ */ new Map();
+	const trees = new Set(["#/$defs/entryList", "#/$defs/includeConfig"]);
+	const requiredConfigs = new Set(trees);
+	const names = new Map([["cordis:group", new Set(["#/$defs/entryList"])], ["cordis:include", new Set(["#/$defs/includeConfig"])]]);
+	for (const entry of collected) {
+		const { native, ...output } = entry;
+		if (entry.tree) output.configRef = entry.tree === "group" ? "#/$defs/entryList" : "#/$defs/includeConfig";
+		else if (native) {
+			let projection = projections.get(native);
+			if (projection === void 0) {
+				const name = `config${projections.size}`;
+				try {
+					const result = project(native, name);
+					definitions[name] = result.schema;
+					Object.assign(definitions, result.definitions);
+					projection = {
+						reference: `#/$defs/${name}`,
+						required: result.acceptsMissing === false,
+						limitations: result.limitations
+					};
+					projections.set(native, projection);
+				} catch (error) {
+					output.status = "error";
+					diagnostics.push({
+						level: "error",
+						path: entry.path,
+						message: error instanceof Error ? error.message : String(error)
+					});
+				}
+			}
+			if (projection) {
+				output.configRef = projection.reference;
+				output.status = projection.limitations.length ? "partial" : "schema";
+				if (projection.required) requiredConfigs.add(projection.reference);
+				for (const message of projection.limitations) diagnostics.push({
+					level: "warning",
+					path: entry.path,
+					message
+				});
+			}
+		}
+		output.configRef ??= "#/$defs/unknownConfig";
+		entries.push(output);
+		outputByEntry.set(entry, output);
+		if (entry.name !== void 0) {
+			const choices = names.get(entry.name) ?? /* @__PURE__ */ new Set();
+			choices.add(output.configRef);
+			names.set(entry.name, choices);
+		}
+	}
+	const dormant = {
+		properties: {
+			disabled: { anyOf: [{ const: true }, ref("loaderExpression")] },
+			group: { not: { const: true } }
+		},
+		required: ["disabled"]
+	};
+	const entryRules = [];
+	for (const [name, choices] of names) {
+		const validated = { properties: { config: { anyOf: [...choices].map((reference) => ({ $ref: reference })) } } };
+		let then = validated;
+		if ([...choices].every((reference) => requiredConfigs.has(reference))) {
+			then = {
+				if: dormant,
+				else: {
+					...validated,
+					required: ["config"]
+				}
+			};
+			if (![...choices].every((reference) => trees.has(reference))) then.then = validated;
+		}
+		entryRules.push({
+			if: {
+				properties: { name: { const: name } },
+				required: ["name"]
+			},
+			then
+		});
+		if (choices.size > 1) diagnostics.push({
+			level: "warning",
+			message: `Plugin ${JSON.stringify(name)} has multiple collected schemas; entry validation accepts their union because module resolution depends on the owning tree.`
+		});
+	}
+	definitions.entry = {
+		type: "object",
+		required: ["name"],
+		allOf: [ref("entryMetadata"), ...entryRules],
+		description: "Loader entry. Unknown metadata and plugin names are accepted; plugin-specific validation is available only for the names collected in this profile. Distinct resolutions of one name use a union of their schemas."
+	};
+	const patchRules = [];
+	for (const [id, target] of targets) {
+		if (target.name === void 0) continue;
+		const configRef = outputByEntry.get(target)?.configRef ?? "#/$defs/unknownConfig";
+		patchRules.push({
+			if: {
+				required: ["id"],
+				properties: { id: { const: id } },
+				allOf: [{ not: { required: ["insert"] } }, { anyOf: [{ not: { required: ["name"] } }, { properties: { name: { enum: ["", target.name] } } }] }]
+			},
+			then: { properties: { config: { $ref: configRef } } }
+		});
+	}
+	definitions.patch = {
+		...patchStructure(),
+		allOf: [ref("entryMetadata"), ...patchRules]
+	};
+	const positions = new Map(entries.map((entry, index) => [entry.path, index]));
+	diagnostics.sort((left, right) => (positions.get(left.path ?? "") ?? -1) - (positions.get(right.path ?? "") ?? -1));
+	return {
+		$schema: "https://json-schema.org/draft/2020-12/schema",
+		title: `Cordis configuration for profile ${profile}`,
+		description: "Describes the parsed entry-list YAML printed by --dump-config. Use $defs.patchList for a profile/home/CLI overlay. Parse !!js with the Cordis entry-list YAML dialect. Expression results, service dependencies, plugin startup checks, and sequence-dependent patch targets still require runtime validation.",
+		$comment: "Bundle, profile, home, and CLI layers apply in that order. A patch config replaces the whole config. JSON Schema defaults are annotations; Schemastery validates a fallback on null/omission unless required rejects it first. Schemastery unions select the first successful branch. Root patch id constraints describe the current index, not ids introduced or changed by earlier patches. Include-local patches have a separate index. Relative plugin insertions require their source patch directory; this document does not infer future overlay locations.",
+		type: "array",
+		items: ref("entry"),
+		$defs: definitions,
+		"x-cordis": {
+			profile,
+			complete: !diagnostics.some((item) => item.level === "error") && !entries.some((entry) => [
+				"partial",
+				"unsupported",
+				"error"
+			].includes(entry.status)) && ![...names.values()].some((choices) => choices.size > 1),
+			entries,
+			diagnostics,
+			patchSchema: "#/$defs/patchList"
+		}
+	};
+}
+//#endregion
+//#region lib/types/config-schema/collect.js
+/** Boot-free inspection of declared plugin Config schemas using profile module resolution. */
+function objectLike(value) {
+	return value !== null && (typeof value === "object" || typeof value === "function");
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function configOf(plugin) {
+	return objectLike(plugin) ? Reflect.get(plugin, "Config") : void 0;
+}
+function validateMetadata(row) {
+	for (const key of ["id", "name"]) {
+		const value = Reflect.get(row, key);
+		if (value !== void 0 && typeof value !== "string") throw new Error(`${key} must be a literal string`);
+	}
+	const group = Reflect.get(row, "group");
+	if (group !== void 0 && group !== null && typeof group !== "boolean") throw new Error("group must be a literal boolean or null");
+}
+function validateEntry(value) {
+	if (!record(value) || typeof value.name !== "string") throw new Error("each entry must be a mapping with a literal plugin name");
+	validateMetadata(value);
+}
+function entryList(value) {
+	if (value === void 0) throw new Error("entry list config is missing");
+	if (!Array.isArray(value)) throw new Error("expected a literal entry list; config expressions are not evaluated");
+	return value;
+}
+function includePatches(value) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value)) throw new Error("include patches must be a literal patch list; config expressions are not evaluated");
+	for (const patch of value) {
+		if (!record(patch) || isJsExpr(patch)) throw new Error("include patches must be literal mappings; config expressions are not evaluated");
+		validateMetadata(patch);
+		if (patch.insert !== void 0) entryList(patch.insert);
+	}
+	return value;
+}
+/**
+* Generate JSON Schema from parsed entry rows and root-tree patches without applying plugins or evaluating expressions.
+* Imports, Config getters, and lazy schema builders execute trusted plugin code; transform callbacks do not. Calls must not overlap
+* another profile-resolution interception; module imports remain cached after the interception is released.
+* @param profile - prepared profile whose directory anchors root module and include resolution.
+* @param entries - unvalidated rows from profile composition; malformed rows become positioned diagnostics without losing siblings.
+* @param resolution - the same immutable package resolution used for profile boot.
+* @param diagnostics - existing composition diagnostics; copied into the returned catalog.
+* @returns a JSON Schema document with partial-result diagnostics and Config references under `x-cordis`.
+* @throws when Node's profile module resolution cannot be installed.
+*/
+async function collectConfigSchemas(profile, entries, resolution, diagnostics = []) {
+	const result = {
+		entries: [],
+		diagnostics: [...diagnostics]
+	};
+	const byOptions = /* @__PURE__ */ new Map();
+	const interception = installRuntimeInterception(resolution);
+	try {
+		const loader = ModuleLoader.fromInternal();
+		if (loader === void 0) throw new Error("config schema dump requires the Node module loader used by profile resolution");
+		const builtins = {
+			group: Group,
+			include: Include
+		};
+		const nativeCarriers = /* @__PURE__ */ new Map();
+		const carrier = async (plugin, baseUrl) => {
+			if (plugin === Group) return "group";
+			if (plugin === Include) return "include";
+			if (!objectLike(plugin) || !Reflect.get(plugin, EntryGroup.key)) return void 0;
+			let resolved = nativeCarriers.get(baseUrl);
+			if (resolved === void 0) {
+				resolved = Promise.allSettled([loader.import("@deepseek-ai/cordis-plugin-group", baseUrl, {}), loader.import("@deepseek-ai/cordis-plugin-include", baseUrl, {})]).then(([group, include]) => {
+					return {
+						group: group.status === "fulfilled" ? Loader.prototype.unwrapExports(group.value) : void 0,
+						include: include.status === "fulfilled" ? Loader.prototype.unwrapExports(include.value) : void 0
+					};
+				});
+				nativeCarriers.set(baseUrl, resolved);
+			}
+			const native = await resolved;
+			if (plugin === native.group) return "group";
+			if (plugin === native.include) return "include";
+			throw new Error("unrecognized Loader tree carrier; use cordis:group or cordis:include for native child collection");
+		};
+		const ancestors = /* @__PURE__ */ new Set();
+		const report = (path, error) => {
+			result.diagnostics.push({
+				level: "error",
+				path,
+				message: error instanceof Error ? error.message : String(error)
+			});
+		};
+		const warn = (path) => (message, ...args) => {
+			let index = 0;
+			result.diagnostics.push({
+				level: "warning",
+				path,
+				message: message.replace(/%C/g, () => JSON.stringify(args[index++]))
+			});
+		};
+		const walkInclude = async (config, baseUrl, path) => {
+			if (config === void 0) throw new Error("include config is missing");
+			if (!record(config) || isJsExpr(config)) throw new Error("include config must be literal; config expressions are not evaluated");
+			if (typeof config.path !== "string") throw new Error("include path must be literal; config expressions are not evaluated");
+			const filename = fileURLToPath(new URL(config.path, baseUrl));
+			const extension = extname(filename);
+			if (![
+				".json",
+				".yaml",
+				".yml"
+			].includes(extension)) throw new Error(`include extension ${JSON.stringify(extension)} is not supported`);
+			let source;
+			let canonical;
+			try {
+				canonical = await realpath(filename);
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+				canonical = filename;
+			}
+			if (ancestors.has(canonical)) throw new Error(`include cycle at ${filename}`);
+			let content;
+			try {
+				content = await readFile(filename, "utf8");
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+				source = config.initial;
+				if (source === void 0) throw new Error(`include file not found: ${filename}`);
+			}
+			if (content !== void 0) try {
+				source = extension === ".json" ? JSON.parse(content) : yaml.load(content, { schema: entryListSchema });
+			} catch (error) {
+				const at = error instanceof yaml.YAMLException ? ` at line ${error.mark.line + 1}, column ${error.mark.column + 1}` : "";
+				throw new Error(`invalid ${extension === ".json" ? "JSON" : "YAML"} include ${filename}${at}`);
+			}
+			const patches = includePatches(config.patches);
+			const rows = entryList(source);
+			let children;
+			try {
+				children = applyEntryPatches(rows, patches, warn(path));
+			} catch (error) {
+				throw new Error(`include patches could not be composed for ${filename}; child declarations are unavailable`, { cause: error });
+			}
+			ancestors.add(canonical);
+			try {
+				await walk(children, new URL(".", pathToFileURL(filename)).href, `${path}/include`);
+			} finally {
+				ancestors.delete(canonical);
+			}
+		};
+		const walk = async (rows, baseUrl, prefix) => {
+			for (const [index, value] of rows.entries()) {
+				const path = `${prefix}/${index}`;
+				const identity = record(value) ? value : void 0;
+				const entry = {
+					path,
+					...typeof identity?.id === "string" ? { id: identity.id } : {},
+					...typeof identity?.name === "string" ? { name: identity.name } : {},
+					status: "error"
+				};
+				result.entries.push(entry);
+				const row = value;
+				try {
+					validateEntry(row);
+				} catch (error) {
+					report(path, error);
+					continue;
+				}
+				entry.status = "absent";
+				byOptions.set(row, entry);
+				let plugin;
+				try {
+					let exports;
+					if (row.name.startsWith("cordis:")) {
+						const name = row.name.slice(7);
+						if (!Object.hasOwn(builtins, name)) throw new Error(`unknown Cordis builtin ${JSON.stringify(row.name)}`);
+						exports = builtins[name];
+					} else exports = await loader.import(row.name, baseUrl, {});
+					plugin = Loader.prototype.unwrapExports(exports);
+					const schema = configOf(plugin);
+					if (schema !== void 0 && schema !== null) if (!isNativeConfigSchema(schema)) {
+						entry.status = "unsupported";
+						report(path, "Config is not a native Schemastery schema");
+					} else {
+						entry.status = "schema";
+						entry.native = schema;
+					}
+				} catch (error) {
+					entry.status = "error";
+					report(path, error);
+				}
+				try {
+					const kind = await carrier(plugin, baseUrl);
+					if (kind === void 0) continue;
+					entry.tree = kind;
+					if (row.config === void 0 && row.group !== true && (row.disabled === true || isJsExpr(row.disabled))) continue;
+					if (kind === "group") await walk(entryList(row.config), baseUrl, `${path}/config`);
+					else await walkInclude(row.config, baseUrl, path);
+				} catch (error) {
+					report(path, error);
+				}
+			}
+		};
+		await walk(entries, pathToFileURL(join(profile.dir, "cordis.yml")).href, "");
+		const targets = /* @__PURE__ */ new Map();
+		const indexTargets = (rows) => {
+			for (const row of rows) {
+				if (!record(row)) continue;
+				if (typeof row.id === "string" && row.id) {
+					const entry = byOptions.get(row);
+					if (entry) targets.set(row.id, entry);
+					else targets.delete(row.id);
+				}
+				if (row.group && Array.isArray(row.config)) indexTargets(row.config);
+			}
+		};
+		indexTargets(entries);
+		return await buildConfigSchemaDocument(profile.name, result.entries, targets, result.diagnostics);
+	} finally {
+		interception.dispose();
+	}
+}
+//#endregion
+//#region lib/types/config-schema/index.js
+/** Profile schema generation: composition diagnostics, runtime resolution, and boot-free discovery. */
+/**
+* Generate JSON Schema for a prepared profile's ordered patch layers without mounting plugins or evaluating expressions.
+* Imports, Config getters, and lazy builders execute trusted code. Native validators and
+* transform callbacks are not executed. Calls must not overlap another profile-resolution interception; collection
+* releases its interception on success or rejection, while Node retains imported modules. Supplied layers are not mutated.
+* Profile preparation, layer selection, process streams, and exit policy belong to the caller.
+* @param profile - prepared on-disk profile whose directory anchors root module and include resolution.
+* @param layers - already parsed patch lists in application order, including caller-selected home and argv overlays.
+* @param installAnchor - package manifest anchoring the installation's runtime dependencies.
+* @returns a JSON Schema document with declaration references, partial results, and diagnostics under `x-cordis`.
+* @throws when composition or runtime resolution cannot be prepared.
+*/
+async function generateConfigSchema(profile, layers, installAnchor) {
+	const diagnostics = [];
+	for (const { packageName } of profile.skippedBundles) diagnostics.push({
+		level: "error",
+		message: `Selected profile bundle ${JSON.stringify(packageName)} could not be loaded; repair or remove its bundle selection.`
+	});
+	return collectConfigSchemas(profile, composeEntries(layers, (message) => diagnostics.push({
+		level: "warning",
+		message
+	})), await createRuntimeResolution({
+		installAnchor,
+		profile
+	}), diagnostics);
+}
+//#endregion
+//#region lib/types/profile-resolution/service.js
+/** Package metadata resolved through one runtime interception. */
+function readPackage(dir, fallbackName) {
+	const manifestPath = join(dir, "package.json");
+	if (!existsSync(manifestPath)) return void 0;
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	const name = manifest.name;
+	const version = manifest.version;
+	return {
+		name: typeof name === "string" ? name : fallbackName,
+		version: typeof version === "string" ? version : void 0,
+		dir,
+		manifestPath,
+		manifest
+	};
+}
+/** Package lookup shared by metadata consumers in one profile process. */
+var PluginPackages = class extends Service {
+	packages = /* @__PURE__ */ new Map();
+	interception;
+	disposeWorkerResolution;
+	current;
+	constructor(ctx, config = {}) {
+		super(ctx, "pluginPackages");
+		if (config.resolution === void 0) return;
+		this.current = config.resolution;
+		const interception = installRuntimeInterception(config.resolution);
+		this.disposeWorkerResolution = registerWorkerResolution(config.resolution);
+		this.interception = interception;
+		ctx.effect(() => () => {
+			this.disposeWorkerResolution?.();
+			interception.dispose();
+		}, "profile package resolution");
+	}
+	/**
+	* Publish a complete successor generation for this process and subsequently created Workers.
+	* Profile mappings and local package names may be removed after their plugins stop; linked roots may also be removed.
+	* Retained profile mappings may change their declarer, but not their normalized directory, version, or scope;
+	* installation mappings must remain unchanged. Publication does not unload modules or clear Node caches.
+	* @param successor - fully constructed generation accepted by {@link RuntimeInterception.replace}.
+	*/
+	replace(successor) {
+		if (this.interception === void 0) throw new Error("plugin-packages: runtime resolution is not installed");
+		this.interception.replace(successor);
+		this.current = successor;
+		this.packages = /* @__PURE__ */ new Map();
+		this.disposeWorkerResolution?.();
+		this.disposeWorkerResolution = registerWorkerResolution(successor);
+	}
+	/**
+	* Publish the latest generation computed by the installed resolution through {@link replace}. Package contents
+	* and loaded modules are not reloaded.
+	* @throws when no resolution is installed, it is plain data rather than a {@link ProfileRuntimeResolution},
+	* reading the latest files fails, or the successor is rejected. A computed resolution without a profile can refresh.
+	*/
+	async refresh() {
+		if (!(this.current instanceof ProfileRuntimeResolution)) throw new Error("plugin-packages: the installed runtime resolution cannot be recomputed");
+		this.replace(await this.current.computeLatestResolution());
+	}
+	/**
+	* Locate the package named by a specifier without requiring a package export.
+	* @param specifier - module specifier whose package owns the requested module.
+	* @param parentURL - URL whose Node lookup order applies.
+	* @returns the parsed package, or undefined when no package owns the request.
+	*/
+	packageOf(specifier, parentURL) {
+		const name = barePackageName(specifier);
+		if (name === void 0) return void 0;
+		const dir = this.interception === void 0 ? packageDirFromParent(name, parentURL) : this.interception.packageDir(name, parentURL);
+		if (dir === void 0) return void 0;
+		const key = JSON.stringify({
+			dir,
+			name
+		});
+		if (!this.packages.has(key)) this.packages.set(key, readPackage(dir, name));
+		return this.packages.get(key);
+	}
+	/**
+	* Read display metadata without loading or activating the target plugin.
+	* @param specifier - configured package module, including package subpaths.
+	* @param parentURL - owning Loader tree's resolution base.
+	* @returns local display metadata or its diagnostic; undefined for non-package requests or absent metadata.
+	*/
+	metaOf(specifier, parentURL) {
+		return readPluginMeta(specifier, parentURL);
+	}
+};
+function packageDirFromParent(name, parentURL) {
+	for (const searchPath of createRequire(parentURL).resolve.paths(name)) {
+		const candidate = join(searchPath, name);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+	}
+}
+//#endregion
+//#region lib/types/index.js
+/**
+* Shared boot glue for `dsh` profiles, including the CLI packaged by the Python runtime wheel: load the gitignored
+* `.env`, install the fail-loud Loader guards, resolve the config path (snapshot-aware), load the
+* optional user patch layers from the Harness home (`~/.dsh`), expose its path resolver to
+* config expressions, and drive the Cordis Loader against a leaf `cordis.yml` until the tree settles.
+* @module @qlzt/dsh-app-boot
+*/
+/**
+* Resolve the config to boot. Replay swaps a `cordis.yml` basename for
+* `cordis.snapshot.yml` in the same directory; every other mode keeps the path.
+* @param configPath - the requested config path (absolute, or relative to `cwd`).
+* @param snapshotMode - the bin's `$DSH_SNAPSHOT` value; only `'replay'` swaps the
+*   basename.
+* @param cwd - the base a relative `configPath` resolves against.
+* @returns the absolute path of the config to boot.
+*/
+function resolveConfigPath(configPath, snapshotMode, cwd = process.cwd()) {
+	const absolute = resolve(cwd, configPath);
+	if (snapshotMode !== "replay") return absolute;
+	return resolve(dirname(absolute), basename(absolute).replace(/cordis\.ya?ml$/, "cordis.snapshot.yml"));
+}
+/**
+* Load the optional gitignored `.env` from `dir`. Missing files fall back to the
+* ambient environment; other read failures are reported through `warn`.
+* @param binName - the diagnostic prefix on the warn line.
+* @param dir - the directory whose `.env` to load.
+* @param warn - sink for the one-line misconfiguration diagnostic.
+*/
+function loadEnv(binName, dir = process.cwd(), warn = (line) => void process.stderr.write(line)) {
+	try {
+		process.loadEnvFile(resolve(dir, ".env"));
+	} catch (error) {
+		if (error?.code !== "ENOENT") warn(`${binName}: failed to load .env: ${String(error)}\n`);
+	}
+}
+/** Exact names no discovered file may set. */
+const BOOTSTRAP_NAMES = new Set([
+	"PATH",
+	"HOME",
+	"USERPROFILE",
+	"SHELL",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_EXTRA_CA_CERTS",
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"BASH_ENV",
+	"ENV",
+	"SHELLOPTS",
+	"BASHOPTS",
+	"PERL5OPT",
+	"PERL5LIB",
+	"PYTHONSTARTUP",
+	"PYTHONPATH",
+	"RUBYOPT",
+	"RUBYLIB",
+	"JAVA_TOOL_OPTIONS",
+	"_JAVA_OPTIONS",
+	"JDK_JAVA_OPTIONS",
+	"PYTHONHOME",
+	"GIT_SSH",
+	"GIT_SSH_COMMAND",
+	"GIT_EXTERNAL_DIFF",
+	"GIT_PAGER",
+	"GIT_EDITOR",
+	"GIT_ASKPASS",
+	"SSH_ASKPASS",
+	"GIT_CONFIG_GLOBAL",
+	"GIT_CONFIG_SYSTEM",
+	"GIT_CONFIG_COUNT",
+	"EDITOR",
+	"VISUAL",
+	"PAGER",
+	"BROWSER",
+	"DEEPSEEK_BASE_URL",
+	"DEEPSEEK_SEARCH_BASE_URL",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_TLS_REJECT_UNAUTHORIZED"
+]);
+/** Name prefixes no discovered file may set. */
+const BOOTSTRAP_PREFIXES = [
+	"DSH_",
+	"XDG_",
+	"DYLD_",
+	"BASH_FUNC_"
+];
+/**
+* The bootstrap names the Harness-home `.env` alone may set. A proxy chooses the route every
+* request takes, so the invoking directory's file — which arrives with a clone — keeps refusing
+* them; the home file is the user's own, and `DSH_HOME` is itself bootstrap-only, so no `.env` can
+* relocate this exemption. The CA and TLS names in the same group stay refused everywhere: they
+* change what is trusted, not where traffic goes.
+*/
+const HOME_LAYER_PROXY_NAMES = new Set([
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY"
+]);
+/**
+* Whether a variable may come only from the inherited process environment
+* because it changes process, runtime, VCS, or network bootstrap. The Harness-home
+* file is additionally allowed {@link HOME_LAYER_PROXY_NAMES}.
+* @param name - the variable name.
+* @returns true when only the inherited environment may supply it.
+*/
+function isBootstrapOnly(name) {
+	const upper = name.toUpperCase();
+	return BOOTSTRAP_NAMES.has(upper) || BOOTSTRAP_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+/**
+* Parse one directory's `.env` without applying it, rejecting bootstrap-only
+* names before any value is materialized.
+* @param binName - the diagnostic prefix on the thrown error.
+* @param dir - the directory whose `.env` to read.
+* @param warn - sink for the one-line unreadable-file diagnostic.
+* @param home - the resolved Harness home; when `dir` is it, {@link HOME_LAYER_PROXY_NAMES} are accepted.
+* @returns the parsed entries, or `undefined` when the file is absent or unreadable.
+* @throws when the file declares a name {@link isBootstrapOnly} rejects and this layer may not set.
+*/
+function readEnvLayer(binName, dir, warn, home) {
+	const path = resolve(dir, ".env");
+	const isHome = resolve(dir) === home;
+	let content;
+	try {
+		content = readFileSync(path, "utf8");
+	} catch (error) {
+		if (error?.code !== "ENOENT") warn(`${binName}: failed to load .env: ${String(error)}\n`);
+		return;
+	}
+	const values = parseEnv(content);
+	for (const name of Object.keys(values)) {
+		if (!isBootstrapOnly(name)) continue;
+		const proxyName = HOME_LAYER_PROXY_NAMES.has(name.toUpperCase());
+		if (isHome && proxyName) continue;
+		const remedy = proxyName ? `export ${name}, or put it in ${resolve(home, ".env")}, which does not travel with a repository` : `export ${name} instead of putting it in a .env file`;
+		throw new Error(`${binName}: ${path} sets "${name}", which only the launching environment may set (it decides how this process starts, where its code and instructions load from, or how it reaches the network); ${remedy}`);
+	}
+	return {
+		path,
+		values
+	};
+}
+/**
+* Load the product CLI's inherited > invoking-directory `.env` > Harness-home
+* `.env` snapshot. The Harness home resolves before either file; both files
+* are checked before either is applied, and accepted values are materialized
+* without replacing inherited ones. The snapshot preserves which layer supplied each value.
+* @param binName - the diagnostic prefix on the diagnostics.
+* @param cwd - the invoking directory whose `.env` is the project layer.
+* @param warn - sink for the one-line misconfiguration diagnostics.
+* @returns this run's frozen environment snapshot.
+* @throws when either file declares a bootstrap-only variable, except {@link HOME_LAYER_PROXY_NAMES} in the Harness-home file.
+*/
+function loadLayeredEnv(binName, cwd = process.cwd(), warn = (line) => void process.stderr.write(line)) {
+	const home = resolveDshHome();
+	const inherited = { ...process.env };
+	const project = readEnvLayer(binName, cwd, warn, home);
+	const user = home === resolve(cwd) ? void 0 : readEnvLayer(binName, home, warn, home);
+	for (const layer of [project, user]) {
+		if (layer === void 0) continue;
+		for (const [name, value] of Object.entries(layer.values)) if (process.env[name] === void 0) process.env[name] = value;
+	}
+	return createLaunchEnvironmentSnapshot([
+		{
+			source: "process",
+			values: inherited
+		},
+		...project === void 0 ? [] : [{
+			source: "project-env",
+			path: project.path,
+			values: project.values
+		}],
+		...user === void 0 ? [] : [{
+			source: "user-env",
+			path: user.path,
+			values: user.values
+		}]
+	]);
+}
+const bootstrapIncludes = /* @__PURE__ */ new WeakMap();
+const userPatchesSchema = entryListSchema;
+/** Apply one complete patch generation and wait for Loader activation diagnostics.
+* @param ctx Booted root context.
+* @param patches Complete ordered patch list.
+* @param binName Diagnostic prefix.
+* @param requiredIds Explicit enablement targets whose existing failures also reject reconciliation.
+* @returns Diagnostics for unchanged pre-existing inactive entries; new or changed failures reject.
+*/
+async function reconcileProfilePatches(ctx, patches, binName, requiredIds = []) {
+	const entry = bootstrapIncludes.get(ctx);
+	if (entry === void 0) throw new Error(`${binName}: profile reload requires the root Include entry`);
+	const previousFailures = (await inactiveEntries(ctx)).map((failure) => ({
+		...failure,
+		diagnostic: inactiveDiagnostic(failure),
+		fiber: failure.entry.fiber,
+		options: JSON.stringify(failure.entry.options)
+	}));
+	const previousFibers = [...ctx.loader.entries()].flatMap((row) => row.fiber === void 0 ? [] : [{
+		fiber: row.fiber,
+		failed: row.fiber.state === FIBER_FAILED || row.fiber.state === FIBER_DISPOSED
+	}]);
+	const { patches: _previous, ...includeConfig } = entry.options.config;
+	const parentURL = new URL(".", new URL(includeConfig.path, entry.parent.tree.ctx.baseUrl)).href;
+	const prepared = prepareProfilePatches(ctx, patches, parentURL, binName);
+	await entry.update({ config: {
+		...includeConfig,
+		patches: prepared
+	} });
+	const results = await Promise.allSettled(previousFibers.map(({ fiber }) => fiber.await()));
+	await ctx.loader.await();
+	const failures = await inactiveEntries(ctx);
+	const introduced = failures.filter((failure) => requiredIds.includes(failure.entry.options.id) || !previousFailures.some((previous) => previous.entry === failure.entry && previous.fiber === failure.entry.fiber && previous.options === JSON.stringify(failure.entry.options) && previous.diagnostic === inactiveDiagnostic(failure)));
+	if (introduced.length > 0) throw new Error(activationDiagnostic(binName, introduced).trimEnd());
+	for (const [index, result] of results.entries()) if (result.status === "rejected" && !previousFibers[index]?.failed) throw result.reason;
+	ctx.emit("app-boot/config-reload");
+	return failures.map(inactiveDiagnostic);
+}
+/**
+* Load an optional patch-list file: a top-level YAML array of loader patch
+* entries (`@deepseek-ai/cordis-plugin-include`'s `PatchOptions`): id-targeted config
+* overrides and `insert` lists, with `!!js` expressions allowed. A missing
+* file means "no layer"; an unreadable, unparsable, or non-array file throws —
+* a present patch file that cannot apply is a misconfiguration and must fail
+* loud at boot, never be silently skipped.
+* @param binName - the diagnostic prefix on the thrown error.
+* @param file - absolute path of the patch file.
+* @returns the parsed patches, or `undefined` when the file does not exist.
+*/
+function loadOptionalPatches(binName, file) {
+	let content;
+	try {
+		content = readFileSync(file, "utf8");
+	} catch (error) {
+		if (error?.code === "ENOENT") return void 0;
+		throw new Error(`${binName}: failed to read patches ${file}: ${String(error)}`);
+	}
+	return parsePatchList(binName, file, content, "patches");
+}
+/**
+* Load a required overlay patch list: a bundle's `cordis.patch.yml` or a
+* `--patch <path>` overlay. Same file format as {@link loadOptionalPatches},
+* but a missing file throws, because the caller named this file — its absence
+* is a misconfiguration, not "no overlay".
+* @param binName - the diagnostic prefix on the thrown error.
+* @param file - absolute path of the overlay file.
+* @returns the parsed patch list.
+*/
+function loadOverlayPatches(binName, file) {
+	let content;
+	try {
+		content = readFileSync(file, "utf8");
+	} catch (error) {
+		throw new Error(`${binName}: failed to read overlay ${file}: ${String(error)}`);
+	}
+	return parsePatchList(binName, file, content, "overlay");
+}
+/** Convert inserted filesystem paths to file URLs, anchoring relative paths beside the patch; keep assertion names literal. */
+function anchorInsertedPluginNames(patches, file) {
+	const base = dirname(resolve(file));
+	const visit = (entry) => {
+		if (typeof entry.name === "string" && (isAbsolute(entry.name) || entry.name.startsWith("./") || entry.name.startsWith("../"))) entry.name = pathToFileURL(resolve(base, entry.name)).href;
+		if (entry.group && Array.isArray(entry.config)) entry.config.forEach(visit);
+	};
+	for (const patch of patches) patch.insert?.forEach(visit);
+	return patches;
+}
+/**
+* Parse one loader patch list: a top-level YAML array of
+* `@deepseek-ai/cordis-plugin-include` `PatchOptions` (id-targeted config overrides and
+* `insert` lists, `!!js` expressions allowed). Every invalid field or value throws,
+* because a patch file that cannot be applied at all is a misconfiguration; a
+* single patch whose target row is absent stays a per-entry Loader warning, so
+* one overlay shared across surfaces does not have to match every tree.
+* @param binName - the diagnostic prefix on the thrown error.
+* @param file - the source path, quoted in errors.
+* @param content - the file's text.
+* @param label - what to call this list in errors (`patches`, `overlay`).
+* @returns the parsed patch list.
+*/
+function parsePatchList(binName, file, content, label) {
+	let parsed;
+	try {
+		parsed = yaml.load(content, { schema: userPatchesSchema });
+	} catch (error) {
+		throw new Error(`${binName}: failed to parse ${label} ${file}: ${String(error)}`);
+	}
+	if (!Array.isArray(parsed)) throw new Error(`${binName}: ${label} ${file} must be a top-level YAML array of loader patch entries`);
+	parsed.forEach((entry, index) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new Error(`${binName}: ${label} entry ${index + 1} in ${file} must be a mapping (a loader patch entry)`);
+	});
+	return anchorInsertedPluginNames(parsed, file);
+}
+/**
+* Compose the configured entry list: parse the base config file with the
+* include's entry-list dialect, apply every layer's patches as ONE flattened
+* list through the include's own patch algorithm (`applyEntryPatches`) — the
+* same call `boot()` makes, so even patch-visibility corner cases (a later
+* layer targeting a group child a plain config replacement introduced, which
+* the single-pass id index never sees) compose identically — then render the
+* result as YAML in the same dialect (`!!js` expressions print verbatim,
+* unevaluated). Row admission is a later stage: a plugin row the compatibility
+* policy denies still appears here, while a denied bundle contributes no layer.
+*
+* Every run of rows from the same file and patch layers is preceded by a `# ==` comment
+* naming the file that contributed the rows and any layers that patched them,
+* so the output stays a loadable YAML document while showing which section
+* comes from which file. The file and patch labels are derived from single-call prefix
+* snapshots (base + layers 1..k), diffed positionally: the patch algorithm
+* only rewrites rows in place or appends, so a top-level index identifies one
+* row across snapshots, and a layer whose addition changes the row (config
+* replacement, disable, group insert) is listed as having patched it.
+*
+* A patch that matches no row is reported through `warn` with its layer
+* label, mirroring the Loader's boot-time warning. Earlier layers' patches
+* see an identical preceding state in every snapshot that includes them, so
+* each snapshot's warning list extends the previous one and the new tail
+* belongs to the added layer.
+* @param binName - the diagnostic prefix on read/parse errors.
+* @param absoluteConfigPath - the base config file `boot()` would include.
+* @param layers - overlay layers in application order (later wins).
+* @param warn - sink for skipped-patch diagnostics; defaults to stderr.
+* @returns the composed entry list rendered as a YAML document with
+* source comment separators.
+*/
+function renderConfigDump(binName, absoluteConfigPath, layers, warn = (line) => void process.stderr.write(`${line}\n`)) {
+	let content;
+	try {
+		content = readFileSync(absoluteConfigPath, "utf8");
+	} catch (error) {
+		throw new Error(`${binName}: failed to read config ${absoluteConfigPath}: ${String(error)}`);
+	}
+	let parsed;
+	try {
+		parsed = yaml.load(content, { schema: entryListSchema });
+	} catch (error) {
+		throw new Error(`${binName}: failed to parse config ${absoluteConfigPath}: ${String(error)}`);
+	}
+	if (!Array.isArray(parsed)) throw new Error(`${binName}: config ${absoluteConfigPath} must be a top-level YAML array of entries`);
+	const baseLabel = basename(absoluteConfigPath);
+	const base = parsed;
+	const snapshot = (count, warnings) => {
+		return applyEntryPatches(base, structuredClone(layers.slice(0, count).flatMap((layer) => layer.patches)), (message, ...args) => {
+			let index = 0;
+			warnings.push(message.replace(/%C/g, () => JSON.stringify(args[index++])));
+		});
+	};
+	let previous = base;
+	let previousWarnings = [];
+	const entryOrigins = base.map(() => ({
+		origin: baseLabel,
+		patchedBy: []
+	}));
+	let composed = base;
+	for (let count = 1; count <= layers.length; count += 1) {
+		const layer = layers[count - 1];
+		/* v8 ignore next -- count iterates 1..length, so the slot exists */
+		if (layer === void 0) continue;
+		const warnings = [];
+		composed = snapshot(count, warnings);
+		for (const line of warnings.slice(previousWarnings.length)) warn(`${binName}: [${layer.label}] ${line}`);
+		const before = previous.map((entry) => JSON.stringify(entry));
+		for (let index = 0; index < composed.length; index += 1) if (index >= before.length) entryOrigins.push({
+			origin: layer.label,
+			patchedBy: []
+		});
+		else if (JSON.stringify(composed[index]) !== before[index]) entryOrigins[index]?.patchedBy.push(layer.label);
+		previous = composed;
+		previousWarnings = warnings;
+	}
+	return groupedDump(composed, entryOrigins);
+}
+/** Render the composed rows grouped under one source-and-patches comment per contiguous run. */
+function groupedDump(composed, entryOrigins) {
+	const lines = [];
+	let currentLabel;
+	let group = [];
+	const flush = () => {
+		if (currentLabel === void 0 || group.length === 0) return;
+		lines.push(`# == ${currentLabel}`);
+		lines.push(yaml.dump(group, {
+			schema: entryListSchema,
+			noRefs: true
+		}).trimEnd());
+		group = [];
+	};
+	for (let index = 0; index < composed.length; index += 1) {
+		const record = entryOrigins[index];
+		/* v8 ignore next -- this array is index-aligned with composed by construction */
+		if (record === void 0) continue;
+		const label = record.patchedBy.length === 0 ? record.origin : `${record.origin}, patched by ${record.patchedBy.join(", ")}`;
+		if (label !== currentLabel) {
+			flush();
+			currentLabel = label;
+		}
+		group.push(composed[index]);
+	}
+	flush();
+	return lines.join("\n") + "\n";
+}
+/**
+* Mount and remember the exact root Include entry used by app boot and user patch-layer HMR.
+* @param ctx - context carrying an initialized Loader service.
+* @param absoluteConfigPath - absolute YAML or JSON configuration path.
+* @param patches - initial app and user patches, applied in order.
+* @param bareModuleBaseUrl - optional installed-host base for bare package
+* names; relative names continue to resolve beside the configuration file.
+* @param binName - diagnostic prefix for a profile plugin denied by compatibility policy; defaults to `dsh`.
+* @returns the created root Include entry, or `undefined` when a surface
+* disposed the whole tree (taking the Loader service with it) while the
+* entry creation was in flight.
+*/
+async function mountRootInclude(ctx, absoluteConfigPath, patches = [], bareModuleBaseUrl, binName = "dsh") {
+	ctx.loader.builtins.include = bareModuleBaseUrl === void 0 ? Include : class HostResolvedRootInclude extends Include {
+		import(name, getOuterStack) {
+			const specifier = isAbsolute(name) ? pathToFileURL(name).href : name;
+			if (name.startsWith(".") || name.startsWith("cordis:")) return super.import(specifier, getOuterStack);
+			const internal = this.ctx.loader.internal;
+			/* v8 ignore next -- Node supplies the internal loader; this preserves the
+			original diagnostic for hypothetical embedders without it. */
+			if (internal === void 0) return super.import(specifier, getOuterStack);
+			return internal.import(specifier, bareModuleBaseUrl, {});
+		}
+	};
+	ctx.loader.builtins.group = Group;
+	const prepared = prepareProfilePatches(ctx, [...patches], pathToFileURL(dirname(absoluteConfigPath)).href + "/", binName);
+	const rootInclude = {
+		id: "include",
+		name: "cordis:include",
+		config: {
+			path: pathToFileURL(absoluteConfigPath).href,
+			...prepared.length > 0 ? { patches: prepared } : {}
+		}
+	};
+	const includeId = await ctx.loader.create(rootInclude);
+	const loader = ctx.get("loader");
+	if (loader === void 0) return void 0;
+	const entry = loader.resolve(includeId);
+	bootstrapIncludes.set(ctx, entry);
+	return entry;
+}
+const assembledActivationRejections = /* @__PURE__ */ new Map();
+function retainAssembledRejection(reason) {
+	assembledActivationRejections.set(reason, (assembledActivationRejections.get(reason) ?? 0) + 1);
+}
+function releaseAssembledRejection(reason) {
+	const count = assembledActivationRejections.get(reason);
+	if (count === void 0 || count === 1) assembledActivationRejections.delete(reason);
+	else assembledActivationRejections.set(reason, count - 1);
+}
+async function observeLoaderRejectionCheckpoint(reasons) {
+	for (const reason of reasons) retainAssembledRejection(reason);
+	try {
+		await new Promise((resolve) => setImmediate(resolve));
+	} finally {
+		for (const reason of reasons) releaseAssembledRejection(reason);
+	}
+}
+/**
+* How long {@link installFailLoud} waits for its `release` hook before exiting
+* anyway. A wedged disposer must delay the fatal exit, never cancel it.
+*/
+const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2e3;
+/**
+* Install before boot to turn an unhandled rejection or an uncaught exception,
+* at any point in the process lifetime, into one labelled stderr diagnostic and
+* `exit(1)`. A rejection already included by {@link auditStartupEntries} is
+* ignored during its process checkpoint; every other rejection and every
+* uncaught exception remains fatal. Control never returns to the failed
+* operation after either: only the throw site knows which state is intact, and
+* a listener that threw mid-update (a stream `'data'` handler, a half-applied
+* registry write) leaves silently wrong results behind if it were resumed. The
+* event loop keeps running only until the release hook settles or times out.
+* Stdout remains untouched for ACP; the returned function removes both handlers.
+*
+* The diagnostic is `util.inspect(err)`, not `err.stack`: a `node:fs` error's
+* `code`, `syscall`, and `path` and any `cause` chain are enumerable properties
+* that the stack line omits, and they are what a crash report needs. Once a
+* handler is installed Node prints nothing of its own, so this line is the
+* only record of the failure.
+*
+* The Loader mounts entries concurrently, so a surface that owns the terminal
+* can already hold it when a sibling entry rejects. Exiting straight from the
+* handler would strand raw mode, bracketed paste, and the keyboard protocol on
+* the user's shell, and leave an in-flight terminal query's reply to land as
+* literal text at the next prompt. `release` is the terminal owner's chance to
+* hand it back; it is awaited under {@link FAIL_LOUD_RELEASE_TIMEOUT_MS}, whose
+* timer stays referenced so a never-settling disposer cannot let Node reach an
+* empty event loop and exit 0 instead of failing.
+*
+* The diagnostic is written before the release so a hanging or failing disposer
+* cannot swallow the reason. The handler stays installed while the release runs
+* — removing it would let a second concurrent rejection become uncaught and kill
+* the process mid-teardown, stranding exactly the terminal state this restores —
+* so a latch keeps the first rejection the reported one and lets later
+* rejections (including the release's own) fall through to the pending exit.
+* @param binName - the diagnostic prefix on the fatal-failure line.
+* @param proc - the process slice to register on; tests inject a fake.
+* @param release - optional teardown awaited before exit, used by a
+*   terminal-owning surface to restore the terminal. Its own failure is
+*   swallowed because the pending fatal exit already owns the outcome.
+* @returns the uninstaller that removes both handlers.
+*/
+function installFailLoud(binName, proc = process, release) {
+	let exiting = false;
+	const report = (err, label) => {
+		if (exiting) return;
+		exiting = true;
+		proc.stderr.write(`${binName}: ${label}: ${inspect(err, {
+			depth: 4,
+			maxArrayLength: 50
+		})}\n`);
+		if (release === void 0) {
+			proc.exit(1);
+			return;
+		}
+		(async () => {
+			let timer;
+			try {
+				await Promise.race([(async () => release())(), new Promise((resolve) => {
+					timer = setTimeout(resolve, FAIL_LOUD_RELEASE_TIMEOUT_MS);
+				})]);
+			} catch {}
+			clearTimeout(timer);
+			proc.exit(1);
+		})();
+	};
+	const onRejection = (err) => {
+		if (assembledActivationRejections.has(err)) return;
+		report(err, "fatal load failure");
+	};
+	const onException = (err) => {
+		report(err, "fatal uncaught exception");
+	};
+	const uninstall = () => {
+		proc.off("unhandledRejection", onRejection);
+		proc.off("uncaughtException", onException);
+	};
+	proc.on("unhandledRejection", onRejection);
+	proc.on("uncaughtException", onException);
+	return uninstall;
+}
+/**
+* Value mirrors used because Cordis's const enum has no runtime object to import.
+* Keep aligned with `packages/client/web/src/loader-status.ts`.
+*/
+const FIBER_PENDING = 0;
+const FIBER_ACTIVE = 2;
+const FIBER_FAILED = 3;
+const FIBER_DISPOSED = 4;
+/**
+* Entry ids whose presence defines a usable DSH application.
+*
+* The list is global rather than profile metadata. Missing or disabled ids do
+* not affect startup; an enabled listed entry must activate. The list covers
+* shared Agent execution, application endpoints, and Web bootstrap/transport.
+*/
+const requiredStartupEntryIds = new Set([
+	"agent-loop",
+	"webserver",
+	"web-runtime",
+	"modules",
+	"connection",
+	"headless-runner",
+	"acp",
+	"sdk-jsonrpc-server"
+]);
+/** Render plugin stacks, nested causes, and aggregate member failures once per error. */
+function formatActivationError(error) {
+	const details = [];
+	const seen = /* @__PURE__ */ new Set();
+	function visit(value) {
+		if (!(value instanceof Error)) {
+			details.push(String(value));
+			return;
+		}
+		if (seen.has(value)) return;
+		seen.add(value);
+		details.push(value.stack ?? value.message);
+		if (value.cause !== void 0) visit(value.cause);
+		if (value instanceof AggregateError) value.errors.forEach(visit);
+	}
+	visit(error);
+	return details.join("\n");
+}
+/** Startup audit failure with non-enumerable metadata and original failures as its cause. */
+var StartupError = class extends Error {
+	entries;
+	/** Root configuration and startup logs, attached by boot after disposal. */
+	startup;
+	/**
+	* @param message - concise terminal diagnostic.
+	* @param entries - inactive plugin metadata and original failure values.
+	*/
+	constructor(message, entries) {
+		const failures = entries.flatMap(({ outcome }) => outcome.kind === "failed" ? [outcome.error] : []);
+		super(message, failures.length > 0 ? { cause: new AggregateError(failures, "Plugin activation failures") } : void 0);
+		this.entries = entries;
+		Object.defineProperties(this, {
+			entries: { enumerable: false },
+			startup: { enumerable: false }
+		});
+	}
+};
+/**
+* Collect Loader activation failures and disabled-expression errors. Failed
+* fibers are awaited to recover their recorded rejection reason and coalesce
+* duplicate Loader notifications through the next process rejection checkpoint.
+*/
+async function inactiveEntries(ctx) {
+	const failures = [];
+	const rejectionReasons = [];
+	for (const entry of ctx.loader.entries()) {
+		try {
+			if (entry.disabled) continue;
+		} catch (error) {
+			failures.push({
+				entry,
+				outcome: {
+					kind: "failed",
+					error,
+					phase: "disabled expression failed"
+				}
+			});
+			continue;
+		}
+		const fiber = entry.fiber;
+		if (fiber === void 0) {
+			failures.push({
+				entry,
+				outcome: {
+					kind: "failed",
+					error: "failed to import"
+				}
+			});
+			continue;
+		}
+		const state = fiber.state;
+		if (state === FIBER_ACTIVE) continue;
+		if (state === FIBER_FAILED) {
+			try {
+				await fiber.await();
+			} catch (error) {
+				rejectionReasons.push(error);
+				failures.push({
+					entry,
+					outcome: {
+						kind: "failed",
+						error
+					}
+				});
+			}
+			continue;
+		}
+		if (state === FIBER_PENDING) {
+			const missing = Object.keys(fiber.inject).filter((service) => fiber.ctx.get(service) === void 0);
+			failures.push({
+				entry,
+				outcome: {
+					kind: "pending",
+					missing
+				}
+			});
+		} else failures.push({
+			entry,
+			outcome: {
+				kind: "failed",
+				error: `fiber state ${String(state)}`
+			}
+		});
+	}
+	if (rejectionReasons.length > 0) await observeLoaderRejectionCheckpoint(rejectionReasons);
+	return failures;
+}
+/** Render one failed plugin's original error and activation phase. */
+function failureDetail(outcome) {
+	return `${outcome.phase === void 0 ? "" : `${outcome.phase}: `}${formatActivationError(outcome.error)}`;
+}
+/** Render optional-only warnings without changing startup policy. */
+function activationDiagnostic(binName, failures) {
+	const noun = failures.length === 1 ? "entry" : "entries";
+	return `${binName}: warning: ${String(failures.length)} ${noun} did not activate\n${failures.map(inactiveDiagnostic).join("\n")}\n`;
+}
+/** Stable per-entry text for reload comparisons and optional warnings. */
+function inactiveDiagnostic({ entry, outcome }) {
+	const detail = outcome.kind === "failed" ? failureDetail(outcome) : `pending (waiting for ${outcome.missing.length === 1 ? "service" : "services"}: ${outcome.missing.join(", ") || "unknown"})`;
+	return `${entry.options.id} (${entry.options.name}): ${detail}`;
+}
+/** Group startup failures and pending services, marking every required entry. */
+function startupDiagnostic(binName, failures, required) {
+	const lines = [`${binName}: startup failed: ${String(required.size)} required ${required.size === 1 ? "plugin" : "plugins"} did not activate`];
+	const failed = failures.flatMap(({ entry, outcome }) => outcome.kind === "failed" ? [{
+		entry,
+		outcome
+	}] : []);
+	const pending = failures.flatMap(({ entry, outcome }) => outcome.kind === "pending" ? [{
+		entry,
+		outcome
+	}] : []);
+	pending.sort((left, right) => Number(required.has(right.entry)) - Number(required.has(left.entry)));
+	const label = (entry) => `${entry.options.id}${required.has(entry) ? " (required)" : ""}`;
+	if (failed.length > 0) {
+		lines.push("", `Failed plugins (${String(failed.length)}):`);
+		for (const { entry, outcome } of failed) {
+			lines.push(`  ${label(entry)}`, `    Package: ${entry.options.name}`);
+			lines.push(...failureDetail(outcome).split("\n").map((line) => `    ${line}`));
+		}
+	}
+	if (pending.length > 0) {
+		const width = Math.max(6, ...pending.map(({ entry }) => label(entry).length)) + 2;
+		lines.push("", `Plugins waiting for services (${String(pending.length)}):`, `  ${"Plugin".padEnd(width)}Missing services`);
+		for (const { entry, outcome } of pending) lines.push(`  ${label(entry).padEnd(width)}${outcome.missing.join(", ") || "unknown"}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Apply DSH startup policy to a settled Loader tree.
+*
+* Inactive entries from the global required list reject startup. Other
+* inactive entries join that failure diagnostic, or produce one warning when
+* no required entry failed and leave successful siblings running.
+* Required ids absent from the tree, and disabled required entries, are ignored.
+* A throwing disabled expression is an entry failure, not a disabled entry.
+* The bootstrap Include must activate so unreadable or invalid root config is fatal.
+* @param ctx - the settled context whose Loader entries to audit.
+* @param binName - the prefix on startup diagnostics.
+* @param warn - sink for optional-entry warnings.
+* @returns after optional warnings if required startup checks pass.
+* @throws {@link StartupError} when the bootstrap Include or a required entry is inactive or its disabled expression throws;
+* its message includes optional failures too.
+*/
+async function auditStartupEntries(ctx, binName, warn = (line) => void process.stderr.write(line)) {
+	const failures = await inactiveEntries(ctx);
+	const required = new Set(failures.filter(({ entry }) => entry === bootstrapIncludes.get(ctx) || requiredStartupEntryIds.has(entry.options.id)).map(({ entry }) => entry));
+	if (required.size > 0) throw new StartupError(startupDiagnostic(binName, failures, required), failures.map(({ entry, outcome }) => ({
+		id: entry.options.id,
+		module: entry.options.name,
+		required: required.has(entry),
+		fiberState: entry.fiber?.state,
+		outcome
+	})));
+	if (failures.length > 0) warn(activationDiagnostic(binName, failures));
+}
+/**
+* Boot the Loader against `absoluteConfigPath` and return only after the whole
+* tree settles. Relative entry names resolve against the config directory;
+* bare package names resolve there by default or against an explicit
+* `bareModuleBaseUrl` for closed packaged runtimes. The bootstrap include
+* is statically imported and mounted as the `cordis:include` builtin, loading
+* through the ambient module pipeline (vite/tsx/plain ESM). The package build
+* embeds Include while leaving Loader external, so the built include tree and
+* host share one Loader peer. Loader settlement drains entry work without
+* rejecting the whole tree. The final {@link auditStartupEntries} call rejects
+* failures in the global required list and warns about other failed, missing,
+* and pending entries while successful siblings remain active. Later unhandled
+* rejections remain covered by {@link installFailLoud}. Built bins need the Loader's native
+* helper for bare plugin specifiers; relative specifiers do not.
+* @param binName - the diagnostic prefix for load-failure errors.
+* @param absoluteConfigPath - the config to include; must already be absolute
+* (see {@link resolveConfigPath}).
+* @param patches - optional overlay patches applied over the included tree
+* (see {@link loadOptionalPatches}); an empty list mounts none.
+* @param prepare - optional host setup run after Loader installation and before any config-tree entry mounts.
+* @param bareModuleBaseUrl - optional installed-host base for bare package
+* names; use it when the host, rather than the configuration project, owns the
+* complete plugin set.
+* @returns the root context after the initial startup audit, or as soon as a
+* surface disposed the tree while startup was still in flight.
+* @throws {@link StartupError} for an inactive required entry, including all inactive plugins in its message;
+* otherwise a labelled error after disposing the partial context — `host
+* preparation failed` when `prepare` threw before any config-tree entry
+* mounted, `plugin tree failed to load` afterwards. Cyclic causes terminate
+* diagnostic traversal without replacing the original cause.
+*/
+async function boot(binName, absoluteConfigPath, patches, prepare, bareModuleBaseUrl) {
+	const ctx = new Context();
+	const startupLogs = [];
+	const diagnostics = new Context();
+	diagnostics.logger = ctx.logger;
+	diagnostics.logger.exporter({
+		levels: { default: 2 },
+		export: ({ ts, name, type, args }) => {
+			if (type === "warn" || type === "error") startupLogs.push({
+				ts,
+				name,
+				type,
+				args
+			});
+		}
+	});
+	let stage = "host preparation failed";
+	try {
+		ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + "/";
+		ctx.provide("dshHomePath", dshHomePath);
+		ctx.on("internal/update", (_config, _noSave, next) => {
+			Promise.resolve(next()).catch((error) => {
+				ctx.logger.error(error);
+			});
+		}, {
+			global: true,
+			prepend: true
+		});
+		await ctx.plugin(Loader);
+		await prepare?.(ctx);
+		stage = "plugin tree failed to load";
+		await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl, binName);
+		await ctx.get("loader")?.await();
+		if (ctx.get("loader") === void 0) return ctx;
+		await auditStartupEntries(ctx, binName);
+		return ctx;
+	} catch (cause) {
+		await ctx.fiber.dispose();
+		if (cause instanceof StartupError) {
+			cause.startup = {
+				configurationPath: absoluteConfigPath,
+				messages: startupLogs
+			};
+			throw cause;
+		}
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		let deepest = cause;
+		const seen = /* @__PURE__ */ new Set();
+		while (deepest instanceof Error && !seen.has(deepest) && deepest.cause !== void 0) {
+			seen.add(deepest);
+			deepest = deepest.cause;
+		}
+		const stack = deepest instanceof AggregateError ? `\n${deepest.stack ?? deepest.message}\n${deepest.errors.map(formatActivationError).join("\n")}` : deepest instanceof Error && deepest !== cause ? `\n${deepest.stack ?? deepest.message}` : "";
+		throw new Error(`${binName}: ${stage}: ${detail}${stack}`, { cause });
+	} finally {
+		await diagnostics.fiber.dispose();
+	}
+}
+/** Prompt-section name for the harness-source location line an app bin adds after boot. */
+const HARNESS_SOURCE_SECTION = "harness:source";
+/**
+* Add a global prompt section naming the on-disk harness source checkout while
+* explicitly distinguishing it from the task workspace and current working
+* directory. The self-referential `dsh-tool-cordis` toolset reads and edits this
+* checkout. Call once on the settled boot context ({@link boot}); the section
+* uses the shared first-party placement after reusable instructions
+* and before the Web surface and persona suffix. A booted tree with no
+* `systemPrompt` service has no prompt to augment, so this is then a no-op
+* that returns `undefined`. The section is
+* registered against the `systemPrompt` service's fiber, so a dev HMR reload of
+* that plugin drops it until the next boot.
+* @param ctx - the settled boot context whose global system prompt to augment.
+* @param sourceRoot - the absolute path to the harness checkout root.
+* @returns the section disposer, or `undefined` when no `systemPrompt` service is mounted.
+*/
+function addHarnessSourceSection(ctx, sourceRoot) {
+	const systemPrompt = ctx.get("systemPrompt");
+	if (systemPrompt === void 0) return void 0;
+	return systemPrompt.section({
+		name: HARNESS_SOURCE_SECTION,
+		order: systemPrompt.getSectionOrder("HARNESS_SOURCE"),
+		text: `The DeepSeek Harness implementation checkout is at ${sourceRoot}. The checkout location and current working directory are separate values and may differ; never infer the working directory from this path. Use pwd to determine the current working directory. Use this checkout only to inspect or extend DSH itself.`
+	});
+}
+//#endregion
+export { DEFAULT_PROFILE_BUNDLES, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, LOADER_EXPRESSION_SCHEMA, OFFICIAL_ON_DEMAND_CATALOG, ON_DEMAND_BUNDLES, OPTIONAL_BUNDLES, PROFILES_DIR, PROFILE_COMPATIBILITY_FILENAME, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, ProfileRuntimeResolution, StartupError, addHarnessSourceSection, auditStartupEntries, boot, bundlePatchFiles, bundlePatchPaths, composeEntries, createConfigProjector, createRuntimeResolution, evaluatePluginCompatibility, generateConfigSchema, getDshRuntimeVersion, initProfile, installFailLoud, isNativeConfigSchema, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, pluginCompatibilityWarning, prepareProfileEntries, prepareProfilePatches, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfilePlugins, readProfileVersionExemptions, reconcileProfilePatches, reconcileProfilePlugins, removeLinkProjections, renderConfigDump, reportSkippedBundles, resolveBundleDir, resolveConfigPath, resolvePluginResource, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, setProfileVersionExemption, writeProfileBundles, writeProfileManifest };