@sparkelf/dsh-plus 0.2.1-rc.2.4 → 0.2.2-alpha.2.1

package/lib/apply-08huHfLG.js

@@ -0,0 +1,665 @@
+import { createRequire } from "node:module";
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { satisfies, valid, validRange } from "semver";
+import { parseDocument } from "yaml";
+//#region lib/types/patch-set.js
+/**
+* Read the Plus distribution's embedded patch set.
+*
+* The distribution owns one patch set for official DSH and, separately, the patches it
+* carries for third-party packages. Both live inside the distribution package: the
+* manifest declares entries, and each entry's payload is a file under `patches/`. A
+* consumer resolves no independently published patch package.
+*
+* The two lists are governed differently. A Plus entry must target an official package
+* that the profile republishes and overrides; a third-party entry must name its upstream
+* and a retirement condition, and never becomes part of the official patch set.
+*/
+function object(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
+	return value;
+}
+function string(value, label) {
+	if (typeof value !== "string" || value === "") throw new Error(label + " must be a non-empty string");
+	return value;
+}
+function range(value, label) {
+	const text = string(value, label);
+	if (validRange(text) === null) throw new Error(label + " is not a semantic-version range: " + text);
+	return text;
+}
+/** A payload stays inside the distribution package it is declared by. */
+function patchFile(distributionDirectory, declared, label) {
+	const absolute = resolve(distributionDirectory, declared);
+	const local = relative(distributionDirectory, absolute);
+	if (local === "" || isAbsolute(local) || local === ".." || local.startsWith("../")) throw new Error(label + " must stay inside the distribution package: " + declared);
+	if (!existsSync(absolute)) throw new Error(label + " does not exist: " + absolute);
+	return local.replaceAll("\\", "/");
+}
+function sourceTarget(value, sourceBaseRevision, label) {
+	const target = object(value, label);
+	if (target.kind !== "dsh-source") throw new Error(label + ".kind must be dsh-source");
+	if (!Array.isArray(target.paths) || target.paths.length === 0) throw new Error(label + ".paths must be a non-empty array");
+	const paths = target.paths.map((entry, index) => {
+		const path = string(entry, label + ".paths[" + String(index) + "]");
+		if (!path.endsWith("/")) throw new Error(label + ".paths entries must be repository directory prefixes");
+		return path;
+	});
+	if (!Array.isArray(target.packages) || target.packages.length === 0) throw new Error(label + ".packages must be a non-empty array");
+	return {
+		kind: "dsh-source",
+		baseRevision: sourceBaseRevision,
+		packages: target.packages.map((entry, index) => {
+			const name = string(entry, label + ".packages[" + String(index) + "]");
+			if (!name.startsWith("@deepseek-ai/")) throw new Error(label + ".packages entries must be official package names");
+			return name;
+		}),
+		paths
+	};
+}
+function npmTarget(value, label) {
+	const target = object(value, label);
+	if (target.kind !== "npm") throw new Error(label + ".kind must be npm");
+	return {
+		kind: "npm",
+		name: string(target.name, label + ".name"),
+		range: range(target.range, label + ".range")
+	};
+}
+function entry(value, scope, sourceBaseRevision, distributionDirectory, label) {
+	const record = object(value, label);
+	const id = string(record.id, label + ".id");
+	const dsh = range(record.dsh, label + ".dsh");
+	const file = patchFile(distributionDirectory, string(record.file, label + ".file"), label + ".file");
+	const retireWhen = string(record.retireWhen, label + ".retireWhen");
+	const targetLabel = label + ".target";
+	const target = scope === "plus" ? object(record.target, targetLabel).kind === "dsh-source" ? sourceTarget(record.target, sourceBaseRevision, targetLabel) : npmTarget(record.target, targetLabel) : npmTarget(record.target, targetLabel);
+	if (scope === "third-party") return {
+		id,
+		scope,
+		dsh,
+		file,
+		retireWhen,
+		upstreamUrl: string(record.upstreamUrl, label + ".upstreamUrl"),
+		target
+	};
+	return {
+		id,
+		scope,
+		dsh,
+		file,
+		retireWhen,
+		target
+	};
+}
+/**
+* Read and validate the embedded patch set from an installed distribution.
+* @param distributionDirectory - installed `@sparkelf/dsh-plus` directory.
+* @param manifest - its parsed package manifest.
+* @returns the ordered Plus entries, third-party entries, and the exact source base.
+*/
+function readPatchSet(distributionDirectory, manifest) {
+	const plus = object(manifest.dshPlus, "dshPlus");
+	const sourceBaseRevision = string(object(plus.sourceBase, "dshPlus.sourceBase").revision, "dshPlus.sourceBase.revision");
+	const declaration = object(plus.patchSet, "dshPlus.patchSet");
+	if (declaration.formatVersion !== 1) throw new Error("dshPlus.patchSet.formatVersion must be 1");
+	if (!Array.isArray(declaration.entries) || declaration.entries.length === 0) throw new Error("dshPlus.patchSet.entries must be a non-empty array");
+	const entries = declaration.entries.map((value, index) => entry(value, "plus", sourceBaseRevision, distributionDirectory, "dshPlus.patchSet.entries[" + String(index) + "]"));
+	const thirdPartyRaw = plus.thirdPartyPatches;
+	const thirdParty = thirdPartyRaw === void 0 ? [] : Array.isArray(thirdPartyRaw) ? thirdPartyRaw.map((value, index) => entry(value, "third-party", sourceBaseRevision, distributionDirectory, "dshPlus.thirdPartyPatches[" + String(index) + "]")) : (() => {
+		throw new Error("dshPlus.thirdPartyPatches must be an array");
+	})();
+	const ids = /* @__PURE__ */ new Set();
+	for (const item of [...entries, ...thirdParty]) {
+		if (ids.has(item.id)) throw new Error("duplicate patch entry id: " + item.id);
+		ids.add(item.id);
+	}
+	return {
+		entries,
+		thirdPartyPatches: thirdParty,
+		sourceBaseRevision
+	};
+}
+//#endregion
+//#region lib/types/apply.js
+/** Materialize the Plus distribution's embedded patch set without Desktop. */
+const FORMAT_VERSION = 1;
+function isSelectedNpmPatch(patch) {
+	return patch.target.kind === "npm";
+}
+function readJsonObject(path, label) {
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(label + " must be a JSON object");
+	return parsed;
+}
+function requireObject(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
+	return value;
+}
+function requireString(value, label) {
+	if (typeof value !== "string" || value === "") throw new Error(label + " must be a non-empty string");
+	return value;
+}
+function requireRange(value, label) {
+	const range = requireString(value, label);
+	if (validRange(range) === null) throw new Error(label + " is not a semantic-version range: " + range);
+	return range;
+}
+function requireVersion(value, label) {
+	const version = requireString(value, label);
+	if (valid(version) === null) throw new Error(label + " is not a semantic version: " + version);
+	return version;
+}
+function requireStringArray(value, label) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error(label + " must be a non-empty array");
+	const strings = value.map((entry, index) => requireString(entry, label + "[" + String(index) + "]"));
+	if (new Set(strings).size !== strings.length) throw new Error(label + " must not contain duplicates");
+	return strings;
+}
+function resolveInstalledPackage(distributionDirectory, packageName) {
+	const requireFromDistribution = createRequire(resolve(distributionDirectory, "package.json"));
+	let manifestPath;
+	try {
+		manifestPath = requireFromDistribution.resolve(packageName + "/package.json");
+	} catch {
+		let directory = dirname(requireFromDistribution.resolve(packageName));
+		while (!existsSync(resolve(directory, "package.json"))) {
+			const parent = dirname(directory);
+			if (parent === directory) throw new Error(packageName + " has no resolvable package manifest");
+			directory = parent;
+		}
+		manifestPath = resolve(directory, "package.json");
+	}
+	const manifest = readJsonObject(manifestPath, packageName + " manifest");
+	return {
+		name: packageName,
+		version: requireVersion(manifest.version, packageName + " version"),
+		directory: dirname(manifestPath),
+		manifest
+	};
+}
+function git(root, args, acceptFailure = false) {
+	const result = spawnSync("git", args, {
+		cwd: root,
+		encoding: "utf8"
+	});
+	if (result.status === 0) return result.stdout.trim();
+	if (acceptFailure) return void 0;
+	const detail = result.stderr.trim();
+	throw new Error("git " + args.join(" ") + " failed" + (detail === "" ? "" : ": " + detail));
+}
+function sourcePatchState(root, file) {
+	if (git(root, [
+		"apply",
+		"--check",
+		file
+	], true) !== void 0) return "pending";
+	if (git(root, [
+		"apply",
+		"--reverse",
+		"--check",
+		file
+	], true) !== void 0) return "applied";
+	git(root, [
+		"apply",
+		"--check",
+		file
+	]);
+	throw new Error("unreachable");
+}
+/** 在隔离index中按真实顺序预演source patches，避免失败后污染official worktree。 */
+function preflightSourcePatches(root, files) {
+	if (files.length === 0) return;
+	const directory = mkdtempSync(resolve(tmpdir(), "dsh-plus-source-patches-"));
+	const index = resolve(directory, "index");
+	const env = {
+		...process.env,
+		GIT_INDEX_FILE: index
+	};
+	const run = (args) => {
+		const result = spawnSync("git", args, {
+			cwd: root,
+			encoding: "utf8",
+			env
+		});
+		if (result.status === 0) return;
+		const detail = result.stderr.trim();
+		throw new Error("git " + args.join(" ") + " failed" + (detail === "" ? "" : ": " + detail));
+	};
+	try {
+		run(["read-tree", "HEAD"]);
+		for (const file of files) run([
+			"apply",
+			"--cached",
+			"--3way",
+			file
+		]);
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function requireSourceBase(root, baseRevision) {
+	const checkoutRevision = requireString(git(root, ["rev-parse", "HEAD"]), "DSH checkout revision");
+	if (checkoutRevision !== baseRevision) throw new Error("DSH checkout must be exact official base " + baseRevision + ", found " + checkoutRevision);
+	return checkoutRevision;
+}
+function prepareSelection(distributionDirectory, profileDirectory, dshRoot) {
+	const distributionManifest = readJsonObject(resolve(distributionDirectory, "package.json"), "Plus distribution manifest");
+	const distributionName = requireString(distributionManifest.name, "Plus distribution name");
+	const distributionVersion = requireVersion(distributionManifest.version, "Plus distribution version");
+	const plus = requireObject(distributionManifest.dshPlus, "Plus distribution dshPlus");
+	if (plus.formatVersion !== FORMAT_VERSION) throw new Error("unsupported dshPlus formatVersion: " + String(plus.formatVersion));
+	const dshRange = requireRange(requireObject(plus.compatibility, "dshPlus.compatibility").dsh, "dshPlus.compatibility.dsh");
+	const baseRevision = requireString(requireObject(plus.sourceBase, "dshPlus.sourceBase").revision, "dshPlus.sourceBase.revision");
+	const profile = requireObject(plus.profile, "dshPlus.profile");
+	const bundles = requireStringArray(profile.bundles, "dshPlus.profile.bundles");
+	const rawProfileDependencySpecs = requireObject(profile.dependencies, "dshPlus.profile.dependencies");
+	const profileDependencySpecs = {};
+	for (const [name, spec] of Object.entries(rawProfileDependencySpecs)) profileDependencySpecs[name] = requireString(spec, "dshPlus.profile.dependencies." + name);
+	const rawAllowBuilds = requireObject(profile.allowBuilds, "dshPlus.profile.allowBuilds");
+	const allowBuilds = {};
+	for (const [name, allowed] of Object.entries(rawAllowBuilds)) {
+		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
+		allowBuilds[name] = allowed;
+	}
+	const patchSet = readPatchSet(distributionDirectory, distributionManifest);
+	const dependencies = requireObject(distributionManifest.dependencies, "Plus distribution dependencies");
+	const dshVersion = requireVersion(readJsonObject(resolve(dshRoot, "package.json"), "DSH source manifest").version, "DSH source version");
+	if (!satisfies(dshVersion, dshRange, { includePrerelease: true })) throw new Error(distributionName + "@" + distributionVersion + " requires DSH " + dshRange + ", found " + dshVersion);
+	const checkoutRevision = requireSourceBase(dshRoot, patchSet.sourceBaseRevision);
+	const patchEntries = [...patchSet.entries, ...patchSet.thirdPartyPatches];
+	const sourceStates = /* @__PURE__ */ new Map();
+	for (const item of patchEntries) {
+		if (!satisfies(dshVersion, item.dsh, { includePrerelease: true })) throw new Error("patch " + item.id + " declares DSH " + item.dsh + ", found " + dshVersion);
+		if (item.target.kind !== "dsh-source") continue;
+		const absoluteFile = resolve(distributionDirectory, item.file);
+		sourceStates.set(absoluteFile, sourcePatchState(dshRoot, absoluteFile));
+	}
+	preflightSourcePatches(dshRoot, [...sourceStates].flatMap(([file, state]) => state === "pending" ? [file] : []));
+	writeProfileRequirements(profileDirectory, profileDependencySpecs, allowBuilds);
+	runPnpm(profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install Plus profile dependencies");
+	const profileDependencies = Object.keys(profileDependencySpecs).sort().map((name) => {
+		return {
+			name,
+			version: resolveInstalledPackage(profileDirectory, name).version
+		};
+	});
+	const runtimePackages = [...Object.keys(dependencies).sort().map((name) => {
+		return {
+			name,
+			version: resolveInstalledPackage(distributionDirectory, name).version
+		};
+	}), ...profileDependencies].sort((left, right) => left.name.localeCompare(right.name));
+	const selected = [];
+	for (const item of patchEntries) {
+		const absoluteFile = resolve(distributionDirectory, item.file);
+		if (item.target.kind === "dsh-source") {
+			selected.push({
+				id: item.id,
+				scope: item.scope,
+				file: item.file,
+				absoluteFile,
+				target: {
+					kind: "dsh-source",
+					baseRevision: patchSet.sourceBaseRevision
+				},
+				alreadyApplied: sourceStates.get(absoluteFile) === "applied"
+			});
+			continue;
+		}
+		const targetVersion = resolveInstalledPackage(item.target.name in profileDependencySpecs ? profileDirectory : distributionDirectory, item.target.name).version;
+		if (!satisfies(targetVersion, item.target.range, { includePrerelease: true })) throw new Error("patch " + item.id + " targets " + item.target.name + " " + item.target.range + ", found " + targetVersion);
+		selected.push({
+			id: item.id,
+			scope: item.scope,
+			file: item.file,
+			absoluteFile,
+			target: {
+				kind: "npm",
+				name: item.target.name,
+				version: targetVersion
+			}
+		});
+	}
+	const lockPatches = selected.map((patch) => {
+		if ("alreadyApplied" in patch) {
+			const { absoluteFile: _absoluteFile, alreadyApplied: _alreadyApplied, ...locked } = patch;
+			return locked;
+		}
+		const { absoluteFile: _absoluteFile, ...locked } = patch;
+		return locked;
+	});
+	return {
+		patches: selected,
+		bundles,
+		runtimePackages,
+		profileDependencies,
+		allowBuilds,
+		lock: {
+			formatVersion: FORMAT_VERSION,
+			distribution: {
+				name: distributionName,
+				version: distributionVersion
+			},
+			dsh: {
+				version: dshVersion,
+				baseRevision,
+				checkoutRevision
+			},
+			runtimePackages,
+			patches: lockPatches
+		}
+	};
+}
+/** 保留每个独立payload，并为同一npm目标生成pnpm可消费的唯一组合patch。 */
+function materializePatchFiles(profileDirectory, patches) {
+	const root = resolve(profileDirectory, ".dsh-plus", "patches");
+	rmSync(root, {
+		recursive: true,
+		force: true
+	});
+	const stablePatches = patches.map((patch) => {
+		const destination = resolve(root, patch.scope, patch.id, basename(patch.file));
+		mkdirSync(dirname(destination), { recursive: true });
+		copyFileSync(patch.absoluteFile, destination);
+		return {
+			...patch,
+			absoluteFile: destination
+		};
+	});
+	const npmGroups = /* @__PURE__ */ new Map();
+	for (const patch of stablePatches) {
+		if (!isSelectedNpmPatch(patch)) continue;
+		const key = patch.target.name + "@" + patch.target.version;
+		const group = npmGroups.get(key);
+		if (group === void 0) npmGroups.set(key, [patch]);
+		else group.push(patch);
+	}
+	const npmPatchFiles = /* @__PURE__ */ new Map();
+	for (const [key, group] of npmGroups) {
+		const first = group[0];
+		if (group.length === 1) {
+			npmPatchFiles.set(key, first.absoluteFile);
+			continue;
+		}
+		const members = group.map((patch) => encodeURIComponent(patch.id)).join("+");
+		const destination = resolve(root, "combined", encodeURIComponent(key), members + ".patch");
+		mkdirSync(dirname(destination), { recursive: true });
+		writeFileSync(destination, group.map((patch) => {
+			const content = readFileSync(patch.absoluteFile, "utf8");
+			return content.endsWith("\n") ? content : content + "\n";
+		}).join(""));
+		npmPatchFiles.set(key, destination);
+	}
+	return {
+		patches: stablePatches,
+		npmPatchFiles
+	};
+}
+function profilePatchConfiguration(profileDirectory, npmPatchFiles) {
+	const document = parseDocument(readFileSync(resolve(profileDirectory, "pnpm-workspace.yaml"), "utf8"));
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	let changed = false;
+	const desiredKeys = new Set(npmPatchFiles.keys());
+	const workspace = requireObject(document.toJS(), "Plus profile workspace");
+	const configured = workspace.patchedDependencies === void 0 ? {} : requireObject(workspace.patchedDependencies, "Plus profile patchedDependencies");
+	for (const [key, value] of Object.entries(configured)) if (typeof value === "string" && value.startsWith(".dsh-plus/patches/") && !desiredKeys.has(key)) {
+		document.deleteIn(["patchedDependencies", key]);
+		changed = true;
+	}
+	for (const [key, file] of npmPatchFiles) {
+		const value = relative(profileDirectory, file).replaceAll("\\", "/");
+		const current = document.getIn(["patchedDependencies", key]);
+		if (current !== void 0 && current !== value && (typeof current !== "string" || !current.startsWith(".dsh-plus/patches/"))) throw new Error("profile patchedDependencies." + key + " is already owned by another payload");
+		if (current === value) continue;
+		document.setIn(["patchedDependencies", key], value);
+		changed = true;
+	}
+	return {
+		text: String(document),
+		changed
+	};
+}
+function writeProfileRequirements(profileDirectory, dependencySpecs, allowBuilds) {
+	const manifestPath = resolve(profileDirectory, "package.json");
+	const manifest = readJsonObject(manifestPath, "DSH profile manifest");
+	const dependencies = requireObject(manifest.dependencies, "DSH profile dependencies");
+	let manifestChanged = false;
+	for (const [name, spec] of Object.entries(dependencySpecs)) {
+		const current = dependencies[name];
+		if (current !== void 0 && current !== spec) throw new Error("profile dependency " + name + " is configured as " + JSON.stringify(current) + ", expected " + spec);
+		if (current === void 0) {
+			dependencies[name] = spec;
+			manifestChanged = true;
+		}
+	}
+	const workspacePath = resolve(profileDirectory, "pnpm-workspace.yaml");
+	const document = parseDocument(readFileSync(workspacePath, "utf8"));
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	let workspaceChanged = false;
+	const autoInstallPeers = document.get("autoInstallPeers");
+	if (autoInstallPeers !== void 0 && autoInstallPeers !== false) throw new Error("profile autoInstallPeers must be false because official peers come from the selected DSH source");
+	if (autoInstallPeers === void 0) {
+		document.set("autoInstallPeers", false);
+		workspaceChanged = true;
+	}
+	const managedFileAsset = (value) => value.startsWith("file:") && (/[\\/]\.dsh[\\/]releases[\\/]plus[\\/].*[\\/]packages[\\/]/u.test(value) || /[\\/]\.dsh-plus[\\/]packages[\\/]/u.test(value));
+	const retiredOverrides = new Set([
+		"@huanlin/dsh-plugin-better-sidebar-plugin-office",
+		"@sparkelf/dsh-office-viewer-fonts",
+		"dsh-better-sidebar",
+		"dsh-video-preview"
+	]);
+	const workspace = requireObject(document.toJS(), "Plus profile workspace");
+	const configuredOverrides = workspace.overrides === void 0 ? {} : requireObject(workspace.overrides, "Plus profile overrides");
+	for (const [name, value] of Object.entries(configuredOverrides)) if (retiredOverrides.has(name) || typeof value === "string" && managedFileAsset(value)) {
+		document.deleteIn(["overrides", name]);
+		workspaceChanged = true;
+	}
+	for (const [name, allowed] of Object.entries(allowBuilds)) {
+		const current = document.getIn(["allowBuilds", name]);
+		if (current !== void 0 && current !== allowed) throw new Error("profile allowBuilds." + name + " is configured as " + JSON.stringify(current) + ", expected " + String(allowed));
+		if (current === void 0) {
+			document.setIn(["allowBuilds", name], allowed);
+			workspaceChanged = true;
+		}
+	}
+	if (manifestChanged) {
+		manifest.dependencies = dependencies;
+		writeFileSync(manifestPath, JSON.stringify(manifest, void 0, 2) + "\n");
+	}
+	if (workspaceChanged) writeFileSync(workspacePath, String(document));
+	return manifestChanged || workspaceChanged;
+}
+function writeProfileComposition(profileDirectory, bundles, runtimePackages) {
+	const path = resolve(profileDirectory, "package.json");
+	const manifest = readJsonObject(path, "DSH profile manifest");
+	const dependencies = requireObject(manifest.dependencies, "DSH profile dependencies");
+	let changed = false;
+	for (const runtimePackage of runtimePackages) {
+		if (dependencies[runtimePackage.name] === void 0) {
+			dependencies[runtimePackage.name] = runtimePackage.version;
+			changed = true;
+			continue;
+		}
+		const installed = resolveInstalledPackage(profileDirectory, runtimePackage.name);
+		if (installed.version !== runtimePackage.version) throw new Error("profile dependency " + runtimePackage.name + " resolves to " + installed.version + ", but the Plus distribution requires " + runtimePackage.version);
+	}
+	const dsh = manifest.dsh === void 0 ? {} : requireObject(manifest.dsh, "DSH profile dsh");
+	const profile = dsh.profile === void 0 ? {} : requireObject(dsh.profile, "DSH profile dsh.profile");
+	if (JSON.stringify(profile.bundles) !== JSON.stringify(bundles)) changed = true;
+	manifest.dependencies = dependencies;
+	manifest.dsh = {
+		...dsh,
+		profile: {
+			...profile,
+			bundles: [...bundles]
+		}
+	};
+	if (changed) writeFileSync(path, JSON.stringify(manifest, void 0, 2) + "\n");
+	return changed;
+}
+function runPnpm(profileDirectory, args, label) {
+	const result = spawnSync("pnpm", args, {
+		cwd: profileDirectory,
+		stdio: "inherit",
+		shell: process.platform === "win32"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(label + " failed with exit code " + String(result.status));
+}
+function pendingSourcePatchFiles(patches) {
+	return patches.flatMap((patch) => "alreadyApplied" in patch && !patch.alreadyApplied ? [patch.absoluteFile] : []);
+}
+function applySelectedPatches(profileDirectory, dshRoot, patches, profileChanged) {
+	const materialized = materializePatchFiles(profileDirectory, patches);
+	const workspacePath = resolve(profileDirectory, "pnpm-workspace.yaml");
+	const workspace = profilePatchConfiguration(profileDirectory, materialized.npmPatchFiles);
+	if (workspace.changed) writeFileSync(workspacePath, workspace.text);
+	if (profileChanged || workspace.changed) runPnpm(profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install in Plus profile");
+	const sourceFiles = pendingSourcePatchFiles(materialized.patches);
+	if (sourceFiles.length > 0) git(dshRoot, ["update-index", "--refresh"], true);
+	for (const file of sourceFiles) git(dshRoot, [
+		"apply",
+		"--3way",
+		file
+	]);
+	if (materialized.patches.some((patch) => patch.target.kind === "dsh-source")) {
+		if (sourceFiles.length > 0) runPnpm(dshRoot, ["install", "--no-frozen-lockfile"], "pnpm install after source patches");
+		runPnpm(dshRoot, ["run", "build:official"], "official DSH build after source patches");
+	}
+}
+function officialPackageRoot(dshRoot) {
+	return resolve(dshRoot, "apps", "cli");
+}
+/**
+* Parse pnpm's workspace roster into exact official package directories.
+* @param dshRoot - exact official DSH checkout root.
+* @param stdout - JSON emitted by `pnpm -r list --json --depth -1`.
+* @returns sorted official package names and directories inside the checkout.
+*/
+function parseOfficialWorkspacePackages(dshRoot, stdout) {
+	const parsed = JSON.parse(stdout);
+	if (!Array.isArray(parsed)) throw new Error("pnpm workspace package list must be an array");
+	const packages = /* @__PURE__ */ new Map();
+	for (const [index, value] of parsed.entries()) {
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("pnpm workspace package list[" + String(index) + "] must be an object");
+		const entry = value;
+		if (typeof entry.name !== "string" || !entry.name.startsWith("@deepseek-ai/")) continue;
+		const localName = entry.name.slice(13);
+		if (localName === "" || localName.includes("/")) throw new Error("unsupported official workspace package name: " + entry.name);
+		if (typeof entry.path !== "string" || entry.path === "") throw new Error("pnpm workspace package " + entry.name + " has no path");
+		const directory = resolve(dshRoot, entry.path);
+		const local = relative(dshRoot, directory);
+		if (isAbsolute(local) || local === ".." || local.startsWith("../")) throw new Error("official workspace package escapes DSH root: " + entry.name);
+		const previous = packages.get(entry.name);
+		if (previous !== void 0 && previous !== directory) throw new Error("duplicate official workspace package: " + entry.name);
+		packages.set(entry.name, directory);
+	}
+	return [...packages].sort(([left], [right]) => left.localeCompare(right)).map(([name, directory]) => ({
+		name,
+		directory
+	}));
+}
+function listOfficialWorkspacePackages(dshRoot) {
+	const result = spawnSync("pnpm", [
+		"-r",
+		"list",
+		"--json",
+		"--depth",
+		"-1"
+	], {
+		cwd: dshRoot,
+		encoding: "utf8",
+		shell: process.platform === "win32"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error("pnpm list official DSH workspace packages failed with exit code " + String(result.status));
+	return parseOfficialWorkspacePackages(dshRoot, result.stdout);
+}
+/**
+* Build the profile's official scope from the CLI closure plus source workspaces.
+* @param profileDirectory - materialized Plus profile root.
+* @param cliScope - official packages already installed under the DSH CLI.
+* @param workspacePackages - additional official source workspaces required by external peers.
+*/
+function materializeOfficialPackageScope(profileDirectory, cliScope, workspacePackages) {
+	if (!existsSync(cliScope)) throw new Error("official DSH dependencies are missing under " + cliScope);
+	const destination = resolve(profileDirectory, "node_modules", "@deepseek-ai");
+	rmSync(destination, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(destination, { recursive: true });
+	const linkType = process.platform === "win32" ? "junction" : "dir";
+	for (const name of readdirSync(cliScope).sort()) symlinkSync(resolve(cliScope, name), resolve(destination, name), linkType);
+	for (const entry of workspacePackages) {
+		const target = resolve(destination, entry.name.slice(13));
+		rmSync(target, {
+			recursive: true,
+			force: true
+		});
+		symlinkSync(entry.directory, target, linkType);
+	}
+}
+function linkOfficialPackages(profileDirectory, dshRoot) {
+	materializeOfficialPackageScope(profileDirectory, resolve(officialPackageRoot(dshRoot), "node_modules", "@deepseek-ai"), listOfficialWorkspacePackages(dshRoot));
+}
+function writeLock(profileDirectory, lock) {
+	const directory = resolve(profileDirectory, ".dsh-plus");
+	mkdirSync(directory, { recursive: true });
+	const path = resolve(directory, "patchset.lock.json");
+	writeFileSync(path, JSON.stringify(lock, void 0, 2) + "\n", { mode: 384 });
+	chmodSync(path, 384);
+	return path;
+}
+function parseApplyArguments(argv) {
+	if (argv[0] !== "apply") throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+	let dshRoot;
+	for (let index = 1; index < argv.length; index += 2) {
+		const key = argv[index];
+		const value = argv[index + 1];
+		if (key !== "--dsh-root" || value === void 0) throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+		dshRoot = resolve(value);
+	}
+	if (dshRoot === void 0) throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+	return {
+		dshRoot,
+		profileDirectory: process.cwd()
+	};
+}
+/**
+* Apply the installed Plus distribution metadata from a DSH profile directory.
+* @param argv - Explicit `apply --dsh-root <path>` command arguments.
+*/
+function runApply(argv) {
+	const { dshRoot, profileDirectory } = parseApplyArguments(argv);
+	if (requireObject(readJsonObject(resolve(profileDirectory, "package.json"), "DSH profile manifest").dependencies, "DSH profile dependencies")["@sparkelf/dsh-plus"] === void 0) throw new Error("current directory is not a DSH profile with @sparkelf/dsh-plus installed");
+	const selection = prepareSelection(dirname(createRequire(resolve(profileDirectory, "package.json")).resolve("@sparkelf/dsh-plus/package.json")), profileDirectory, dshRoot);
+	const profileChanged = writeProfileComposition(profileDirectory, selection.bundles, selection.runtimePackages);
+	applySelectedPatches(profileDirectory, dshRoot, selection.patches, profileChanged);
+	linkOfficialPackages(profileDirectory, dshRoot);
+	const installedProfileDependencies = requireObject(readJsonObject(resolve(profileDirectory, "package.json"), "DSH profile manifest").dependencies, "DSH profile dependencies");
+	selection.lock.profile = {
+		bundles: selection.bundles.map((name) => {
+			return {
+				name,
+				version: (installedProfileDependencies[name] === void 0 ? resolveInstalledPackage(officialPackageRoot(dshRoot), name) : resolveInstalledPackage(profileDirectory, name)).version
+			};
+		}),
+		dependencies: selection.profileDependencies,
+		allowBuilds: selection.allowBuilds
+	};
+	const lock = writeLock(profileDirectory, selection.lock);
+	process.stdout.write("[dsh-plus] applied " + String(selection.patches.length) + " patches; lock " + lock + "\n");
+}
+//#endregion
+export { readPatchSet as i, parseOfficialWorkspacePackages as n, runApply as r, materializeOfficialPackageScope as t };