@sparkelf/dsh-plus 0.2.1-rc.2.4 → 0.2.2-alpha.2.2

package/lib/types/patch-set.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Read the Plus distribution's embedded patch set.
+ *
+ * The distribution owns one patch set for official DSH and, separately, the patches it
+ * carries for third-party packages. Both live inside the distribution package: the
+ * manifest declares entries, and each entry's payload is a file under `patches/`. A
+ * consumer resolves no independently published patch package.
+ *
+ * The two lists are governed differently. A Plus entry must target an official package
+ * that the profile republishes and overrides; a third-party entry must name its upstream
+ * and a retirement condition, and never becomes part of the official patch set.
+ */
+/** An npm package the distribution patches in place. */
+export interface NpmPatchTarget {
+    readonly kind: 'npm';
+    readonly name: string;
+    readonly range: string;
+}
+/** One official source path set, applied to the exact `dshPlus.sourceBase` revision. */
+export interface SourcePatchTarget {
+    readonly kind: 'dsh-source';
+    readonly baseRevision: string;
+    /** Official packages the patch modifies; each must be republished and overridden. */
+    readonly packages: readonly string[];
+    readonly paths: readonly string[];
+}
+/** Where one patch payload lands. */
+export type PatchTarget = NpmPatchTarget | SourcePatchTarget;
+/** Who owns the entry: the Plus official delta or a carried third-party patch. */
+export type PatchScope = 'plus' | 'third-party';
+/** One entry of the embedded patch set. */
+export interface PatchSetEntry {
+    /** Stable identity used by the lock and by retirement records. */
+    readonly id: string;
+    readonly scope: PatchScope;
+    /** DSH range the entry applies to. */
+    readonly dsh: string;
+    /** Payload path, relative to the distribution package. */
+    readonly file: string;
+    /** The behavior or upstream release that retires this entry. */
+    readonly retireWhen: string;
+    /** Third-party entries name the upstream they track. */
+    readonly upstreamUrl?: string;
+    readonly target: PatchTarget;
+}
+/** The distribution's complete embedded patch declaration. */
+export interface PatchSet {
+    readonly entries: readonly PatchSetEntry[];
+    readonly thirdPartyPatches: readonly PatchSetEntry[];
+    readonly sourceBaseRevision: string;
+}
+/**
+ * Read and validate the embedded patch set from an installed distribution.
+ * @param distributionDirectory - installed `@sparkelf/dsh-plus` directory.
+ * @param manifest - its parsed package manifest.
+ * @returns the ordered Plus entries, third-party entries, and the exact source base.
+ */
+export declare function readPatchSet(distributionDirectory: string, manifest: Record<string, unknown>): PatchSet;
+//# sourceMappingURL=patch-set.d.ts.map

package/lib/types/patch-set.js

@@ -0,0 +1,132 @@
+/**
+ * Read the Plus distribution's embedded patch set.
+ *
+ * The distribution owns one patch set for official DSH and, separately, the patches it
+ * carries for third-party packages. Both live inside the distribution package: the
+ * manifest declares entries, and each entry's payload is a file under `patches/`. A
+ * consumer resolves no independently published patch package.
+ *
+ * The two lists are governed differently. A Plus entry must target an official package
+ * that the profile republishes and overrides; a third-party entry must name its upstream
+ * and a retirement condition, and never becomes part of the official patch set.
+ */
+import { existsSync } from 'node:fs';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { validRange } from 'semver';
+function object(value, label) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(label + ' must be an object');
+    return value;
+}
+function string(value, label) {
+    if (typeof value !== 'string' || value === '')
+        throw new Error(label + ' must be a non-empty string');
+    return value;
+}
+function range(value, label) {
+    const text = string(value, label);
+    if (validRange(text) === null)
+        throw new Error(label + ' is not a semantic-version range: ' + text);
+    return text;
+}
+/** A payload stays inside the distribution package it is declared by. */
+function patchFile(distributionDirectory, declared, label) {
+    const absolute = resolve(distributionDirectory, declared);
+    const local = relative(distributionDirectory, absolute);
+    if (local === '' || isAbsolute(local) || local === '..' || local.startsWith('../')) {
+        throw new Error(label + ' must stay inside the distribution package: ' + declared);
+    }
+    if (!existsSync(absolute))
+        throw new Error(label + ' does not exist: ' + absolute);
+    return local.replaceAll('\\', '/');
+}
+function sourceTarget(value, sourceBaseRevision, label) {
+    const target = object(value, label);
+    if (target.kind !== 'dsh-source')
+        throw new Error(label + '.kind must be dsh-source');
+    if (!Array.isArray(target.paths) || target.paths.length === 0)
+        throw new Error(label + '.paths must be a non-empty array');
+    const paths = target.paths.map((entry, index) => {
+        const path = string(entry, label + '.paths[' + String(index) + ']');
+        if (!path.endsWith('/'))
+            throw new Error(label + '.paths entries must be repository directory prefixes');
+        return path;
+    });
+    if (!Array.isArray(target.packages) || target.packages.length === 0) {
+        throw new Error(label + '.packages must be a non-empty array');
+    }
+    const packages = target.packages.map((entry, index) => {
+        const name = string(entry, label + '.packages[' + String(index) + ']');
+        if (!name.startsWith('@deepseek-ai/'))
+            throw new Error(label + '.packages entries must be official package names');
+        return name;
+    });
+    return { kind: 'dsh-source', baseRevision: sourceBaseRevision, packages, paths };
+}
+function npmTarget(value, label) {
+    const target = object(value, label);
+    if (target.kind !== 'npm')
+        throw new Error(label + '.kind must be npm');
+    return {
+        kind: 'npm',
+        name: string(target.name, label + '.name'),
+        range: range(target.range, label + '.range'),
+    };
+}
+function entry(value, scope, sourceBaseRevision, distributionDirectory, label) {
+    const record = object(value, label);
+    const id = string(record.id, label + '.id');
+    const dsh = range(record.dsh, label + '.dsh');
+    const file = patchFile(distributionDirectory, string(record.file, label + '.file'), label + '.file');
+    const retireWhen = string(record.retireWhen, label + '.retireWhen');
+    const targetLabel = label + '.target';
+    const target = scope === 'plus'
+        ? (object(record.target, targetLabel).kind === 'dsh-source'
+            ? sourceTarget(record.target, sourceBaseRevision, targetLabel)
+            : npmTarget(record.target, targetLabel))
+        : npmTarget(record.target, targetLabel);
+    if (scope === 'third-party') {
+        return {
+            id,
+            scope,
+            dsh,
+            file,
+            retireWhen,
+            upstreamUrl: string(record.upstreamUrl, label + '.upstreamUrl'),
+            target,
+        };
+    }
+    return { id, scope, dsh, file, retireWhen, target };
+}
+/**
+ * Read and validate the embedded patch set from an installed distribution.
+ * @param distributionDirectory - installed `@sparkelf/dsh-plus` directory.
+ * @param manifest - its parsed package manifest.
+ * @returns the ordered Plus entries, third-party entries, and the exact source base.
+ */
+export function readPatchSet(distributionDirectory, manifest) {
+    const plus = object(manifest.dshPlus, 'dshPlus');
+    const sourceBase = object(plus.sourceBase, 'dshPlus.sourceBase');
+    const sourceBaseRevision = string(sourceBase.revision, 'dshPlus.sourceBase.revision');
+    const declaration = object(plus.patchSet, 'dshPlus.patchSet');
+    if (declaration.formatVersion !== 1)
+        throw new Error('dshPlus.patchSet.formatVersion must be 1');
+    if (!Array.isArray(declaration.entries) || declaration.entries.length === 0) {
+        throw new Error('dshPlus.patchSet.entries must be a non-empty array');
+    }
+    const entries = declaration.entries.map((value, index) => entry(value, 'plus', sourceBaseRevision, distributionDirectory, 'dshPlus.patchSet.entries[' + String(index) + ']'));
+    const thirdPartyRaw = plus.thirdPartyPatches;
+    const thirdParty = thirdPartyRaw === undefined
+        ? []
+        : (Array.isArray(thirdPartyRaw)
+            ? thirdPartyRaw.map((value, index) => entry(value, 'third-party', sourceBaseRevision, distributionDirectory, 'dshPlus.thirdPartyPatches[' + String(index) + ']'))
+            : (() => { throw new Error('dshPlus.thirdPartyPatches must be an array'); })());
+    const ids = new Set();
+    for (const item of [...entries, ...thirdParty]) {
+        if (ids.has(item.id))
+            throw new Error('duplicate patch entry id: ' + item.id);
+        ids.add(item.id);
+    }
+    return { entries, thirdPartyPatches: thirdParty, sourceBaseRevision };
+}
+//# sourceMappingURL=patch-set.js.map

package/lib/types/standalone-cli.js

@@ -25,6 +25,7 @@ function parseStartOptions(argv) {
     let host = '127.0.0.1';
     let open = true;
     let foreground = false;
+    let edition;
     let capabilities;
     for (let index = 0; index < argv.length; index += 1) {
         const token = argv[index];
@@ -52,6 +53,14 @@ function parseStartOptions(argv) {
             foreground = true;
             continue;
         }
+        if (token === '--edition') {
+            const value = argv[index + 1];
+            if (value === undefined || value === '')
+                throw new Error('--edition requires a value');
+            edition = value;
+            index += 1;
+            continue;
+        }
         if (token === '--capabilities') {
             const value = argv[index + 1];
             if (value === undefined)
@@ -73,7 +82,7 @@ function parseStartOptions(argv) {
         }
         throw new Error('unknown option: ' + String(token));
     }
-    return { port, host, open, foreground, capabilities };
+    return { port, host, open, foreground, edition, capabilities };
 }
 /**
  * Resolve a stated capability selection.
@@ -157,6 +166,54 @@ function runForeground(entry, profileName, port, host, open) {
     const result = spawnSync(process.execPath, args, { stdio: 'inherit' });
     return result.status ?? 1;
 }
+/** Parse the install command's edition selection. */
+function parseInstallOptions(argv) {
+    let edition;
+    let profile;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index];
+        if (token === '--edition') {
+            const value = argv[index + 1];
+            if (value === undefined || value === '')
+                throw new Error('--edition requires a value');
+            edition = value;
+            index += 1;
+            continue;
+        }
+        if (token === '--profile') {
+            const value = argv[index + 1];
+            if (value === undefined || value === '')
+                throw new Error('--profile requires a value');
+            profile = value;
+            index += 1;
+            continue;
+        }
+        throw new Error('unknown option: ' + String(token));
+    }
+    if (edition === undefined)
+        throw new Error('install requires --edition personal or --edition team');
+    return { edition, profile };
+}
+/**
+ * Install one edition's package manifest into the profile.
+ *
+ * The profile's `package.json` is the install artifact; there is no separate standalone
+ * package. A later `start` uses the same manifest, so changing the edition is a new
+ * install rather than a second product.
+ *
+ * @param argv - arguments after `install`.
+ * @returns the process exit code.
+ */
+function install(argv) {
+    const { edition, profile } = parseInstallOptions(argv);
+    const base = resolvePaths(declarationAnchor());
+    const paths = profile === undefined
+        ? base
+        : { ...base, profileName: profile, profileDirectory: join(base.home, 'profiles', profile) };
+    ensureProfile(paths, installationRoot(), edition);
+    console.log('Installed the ' + edition + ' edition into ' + paths.profileDirectory);
+    return 0;
+}
 async function start(argv) {
     const options = parseStartOptions(argv);
     const anchor = installationAnchor();
@@ -202,10 +259,12 @@ async function start(argv) {
         }
         console.log('pnpm installed.');
     }
-    const created = ensureProfile(paths, installationRoot());
+    const created = ensureProfile(paths, installationRoot(), options.edition);
     console.log(created
         ? 'Created the ' + paths.profileName + ' profile at ' + paths.profileDirectory
         : 'Using the existing ' + paths.profileName + ' profile');
+    if (options.edition !== undefined)
+        console.log('Edition: ' + options.edition);
     // The profile symlinks the consumer's packages, so a patch lands on the installed
     // copy the launcher loads. A reinstall restores the published bytes, which is why
     // this runs on every start rather than only when the profile was created.
@@ -581,6 +640,30 @@ async function doctor() {
         ? 'capabilities: ' + (actual.mounted.length === 0 ? '(none enabled)' : actual.mounted.join(', '))
         : 'capabilities disagree with ' + CAPABILITY_RECORD + ': ' + drifted.map(capability => capability.id).join(', ')
             + ' (run dsh-plus capabilities)');
+    const profileManifestPath = join(paths.profileDirectory, 'package.json');
+    if (existsSync(profileManifestPath)) {
+        const profileManifest = JSON.parse(readFileSync(profileManifestPath, 'utf8'));
+        const editionId = profileManifest.dsh?.profile?.plusEdition;
+        if (editionId !== undefined) {
+            const distribution = readDistributionProfile(paths.distributionDirectory);
+            const edition = distribution.editions[editionId];
+            if (edition === undefined) {
+                check(false, 'edition "' + editionId + '" is not declared by this distribution');
+            }
+            else {
+                const bundles = new Set(profileManifest.dsh?.profile?.bundles ?? []);
+                const missingBundles = edition.bundles.filter(bundle => !bundles.has(bundle));
+                const packageNames = Object.keys(edition.packages);
+                const missingPackages = packageNames.filter(name => !existsSync(join(paths.profileDirectory, 'node_modules', ...name.split('/'), 'package.json')));
+                check(missingBundles.length === 0, 'edition ' + editionId + ': ' + String(edition.bundles.length - missingBundles.length) + '/'
+                    + String(edition.bundles.length) + ' bundles mounted'
+                    + (missingBundles.length === 0 ? '' : ' (missing ' + missingBundles.join(', ') + ')'));
+                check(missingPackages.length === 0, 'edition ' + editionId + ': ' + String(packageNames.length - missingPackages.length) + '/'
+                    + String(packageNames.length) + ' packages installed'
+                    + (missingPackages.length === 0 ? '' : ' (missing ' + missingPackages.join(', ') + ')'));
+            }
+        }
+    }
     console.log(failures === 0 ? 'No problems found.' : String(failures) + ' problem(s) found.');
     return failures === 0 ? 0 : 1;
 }
@@ -588,6 +671,7 @@ const USAGE = [
     'Usage: dsh-plus <command> [options]',
     '',
     'Commands:',
+    '  install       install an edition package manifest into the profile',
     '  start         start the server (first run creates the profile)',
     '  stop          stop the server',
     '  status        report whether the server is running',
@@ -600,6 +684,11 @@ const USAGE = [
     '  --host <h>     interface to bind (default 127.0.0.1)',
     '  --no-open      do not open a browser',
     '  --foreground   run in this terminal instead of in the background',
+    '  --edition <id> install the named edition manifest (personal or team)',
+    '',
+    'install options:',
+    '  --edition <id>  package manifest to install (personal or team)',
+    '  --profile <n>   profile name to install into (default: this installation)',
     '',
     'capabilities options:',
     '  --enable <ids>   enable the comma-separated capability ids',
@@ -622,6 +711,8 @@ export async function runStandaloneCli(argv) {
         console.log(USAGE);
         return 0;
     }
+    if (command === 'install')
+        return install(rest);
     if (command === 'start')
         return await start(rest);
     if (command === 'stop')

package/lib/types/standalone-profile.d.ts

@@ -93,12 +93,18 @@ export declare function isWithin(candidate: string, parent: string, platform?: N
  */
 export declare function resolveDistributionDirectory(anchor: string): string;
 /** The reviewed bundle order and pins the installed distribution declares. */
+export interface EditionComposition {
+    readonly label: string;
+    readonly bundles: readonly string[];
+    readonly packages: Readonly<Record<string, string>>;
+}
 export declare function readDistributionProfile(distributionDirectory: string): {
     readonly name: string;
     readonly bundles: readonly string[];
     readonly dependencies: Readonly<Record<string, string>>;
     readonly allowBuilds: Readonly<Record<string, boolean>>;
     readonly overrides: Readonly<Record<string, string>>;
+    readonly editions: Readonly<Record<string, EditionComposition>>;
     readonly dshRange: string;
     readonly version: string;
 };
@@ -191,9 +197,10 @@ export declare function resolvePaths(anchor: string, env?: NodeJS.ProcessEnv): S
  *
  * @param paths - resolved standalone paths.
  * @param consumerDirectory - directory whose `node_modules` holds the installed packages.
+ * @param edition - edition id whose package list to install, or undefined for the default.
  * @returns whether this call created the manifest.
  */
-export declare function ensureProfile(paths: StandalonePaths, consumerDirectory: string): boolean;
+export declare function ensureProfile(paths: StandalonePaths, consumerDirectory: string, edition?: string): boolean;
 /**
  * Apply the reviewed npm-target patches to the profile's installed packages.
  *

package/lib/types/standalone-profile.js

@@ -11,9 +11,11 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, symlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { dirname, join, posix, resolve, win32 } from 'node:path';
 import { parseDocument } from 'yaml';
+import { readPatchSet } from "./patch-set.js";
 /** Profile name a standalone installation owns when its package declares none. */
 export const STANDALONE_PROFILE = 'plus';
 /**
@@ -97,6 +99,12 @@ function requireStringArray(value, label) {
         throw new Error(label + ' must be a string array');
     return value;
 }
+/** Read one non-empty string field. */
+function requireString(value, label) {
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new Error(label + ' must be a non-empty string');
+    return value;
+}
 /** Resolve the DSH home, honouring the environment override the launcher itself reads. */
 export function resolveHome(env = process.env) {
     const configured = env.DSH_HOME;
@@ -135,12 +143,15 @@ export function isWithin(candidate, parent, platform = process.platform) {
  * @returns absolute path to the installed distribution.
  */
 export function resolveDistributionDirectory(anchor) {
+    const ownDirectory = dirname(dirname(fileURLToPath(import.meta.url)));
     let resolved;
     try {
         resolved = dirname(createRequire(anchor).resolve('@sparkelf/dsh-plus/package.json'));
     }
     catch {
-        throw new Error('@sparkelf/dsh-plus is not installed in ' + dirname(anchor) + '; run this command from the directory that installed it');
+        // `npx @sparkelf/dsh-plus ...` runs the CLI from a temporary install, so the consumer
+        // tree has no copy to resolve. The running module's own package is the distribution.
+        return ownDirectory;
     }
     // A resolution that leaves the consumer tree means the module answered from its own
     // installation, which reports health for a distribution the consumer never installed.
@@ -156,21 +167,14 @@ export function resolveDistributionDirectory(anchor) {
             break;
         current = parent;
     }
-    throw new Error('@sparkelf/dsh-plus resolved outside ' + resolve(dirname(anchor)) + ' (found ' + resolved + '); run this command from the directory that installed it');
+    return ownDirectory;
 }
-/** The reviewed bundle order and pins the installed distribution declares. */
 export function readDistributionProfile(distributionDirectory) {
     const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, 'package.json'), 'utf8')), 'Plus distribution manifest');
     const plus = requireRecord(manifest.dshPlus, 'dshPlus');
     const profile = requireRecord(plus.profile, 'dshPlus.profile');
-    const rawDependencies = requireRecord(profile.dependencies, 'dshPlus.profile.dependencies');
+    const dependencies = requireDependencyMap(requireRecord(profile.dependencies, 'dshPlus.profile.dependencies'), 'dshPlus.profile.dependencies');
     const rawAllowBuilds = requireRecord(profile.allowBuilds, 'dshPlus.profile.allowBuilds');
-    const dependencies = {};
-    for (const [name, spec] of Object.entries(rawDependencies)) {
-        if (typeof spec !== 'string' || spec === '')
-            throw new Error('dshPlus.profile.dependencies.' + name + ' must be a non-empty string');
-        dependencies[name] = spec;
-    }
     const allowBuilds = {};
     for (const [name, allowed] of Object.entries(rawAllowBuilds)) {
         if (typeof allowed !== 'boolean')
@@ -189,6 +193,16 @@ export function readDistributionProfile(distributionDirectory) {
             throw new Error('dshPlus.profile.overrides.' + name + ' must be a non-empty string');
         overrides[name] = spec;
     }
+    const editions = {};
+    const rawEditions = plus.editions === undefined ? {} : requireRecord(plus.editions, 'dshPlus.editions');
+    for (const [id, value] of Object.entries(rawEditions)) {
+        const edition = requireRecord(value, 'dshPlus.editions.' + id);
+        editions[id] = {
+            label: requireString(edition.label, 'dshPlus.editions.' + id + '.label'),
+            bundles: requireStringArray(edition.bundles, 'dshPlus.editions.' + id + '.bundles'),
+            packages: requireDependencyMap(requireRecord(edition.packages, 'dshPlus.editions.' + id + '.packages'), 'dshPlus.editions.' + id + '.packages'),
+        };
+    }
     const compatibility = requireRecord(plus.compatibility, 'dshPlus.compatibility');
     return {
         name: String(manifest.name),
@@ -196,10 +210,21 @@ export function readDistributionProfile(distributionDirectory) {
         dependencies,
         allowBuilds,
         overrides,
+        editions,
         dshRange: String(compatibility.dsh),
         version: String(manifest.version),
     };
 }
+/** Read one package-name-to-spec map, rejecting empty entries. */
+function requireDependencyMap(value, label) {
+    const dependencies = {};
+    for (const [name, spec] of Object.entries(value)) {
+        if (typeof spec !== 'string' || spec === '')
+            throw new Error(label + '.' + name + ' must be a non-empty string');
+        dependencies[name] = spec;
+    }
+    return dependencies;
+}
 /**
  * Give the profile its own installed tree, built from the distribution's declarations.
  *
@@ -221,7 +246,12 @@ export function readDistributionProfile(distributionDirectory) {
 export function installProfilePackages(paths, consumerDirectory) {
     const consumerModules = join(consumerDirectory, 'node_modules');
     if (!existsSync(consumerModules)) {
-        throw new Error('no node_modules in ' + consumerDirectory + '; run npm install there first');
+        // `npx @sparkelf/dsh-plus` runs from a temporary package tree that has no launcher
+        // beside it. The profile installs its own tree, so there is nothing to link from
+        // the caller; only the profile's packages matter.
+        installWithRegistryFallback(paths);
+        alignReplacedPackageNames(join(paths.profileDirectory, 'node_modules'));
+        return;
     }
     const profileModules = join(paths.profileDirectory, 'node_modules');
     if (existsSync(profileModules)) {
@@ -250,6 +280,9 @@ function installWithRegistryFallback(paths) {
             cwd: paths.profileDirectory,
             stdio: 'inherit',
             shell: process.platform === 'win32',
+            // A registry that accepts the connection but never answers would otherwise hold the
+            // first start for pnpm's full retry budget before the fallback got a chance.
+            timeout: 5 * 60_000,
         });
         if (result.error !== undefined)
             throw result.error;
@@ -430,12 +463,61 @@ export function resolvePaths(anchor, env = process.env) {
  *
  * @param paths - resolved standalone paths.
  * @param consumerDirectory - directory whose `node_modules` holds the installed packages.
+ * @param edition - edition id whose package list to install, or undefined for the default.
  * @returns whether this call created the manifest.
  */
-export function ensureProfile(paths, consumerDirectory) {
+export function ensureProfile(paths, consumerDirectory, edition) {
     const manifestPath = join(paths.profileDirectory, 'package.json');
     const distribution = readDistributionProfile(paths.distributionDirectory);
+    const composition = edition === undefined ? undefined : distribution.editions[edition];
+    if (edition !== undefined && composition === undefined) {
+        const offered = Object.keys(distribution.editions);
+        throw new Error('unknown edition "' + edition + '"; this release offers '
+            + (offered.length === 0 ? '(none)' : offered.join(', ')));
+    }
+    // An edition lists only third-party, fork, and self-developed plugins. The official
+    // runtime is the CLI's responsibility and must not be duplicated in that list.
+    for (const name of Object.keys(composition?.packages ?? {})) {
+        if (name.startsWith('@deepseek-ai/')) {
+            throw new Error('edition "' + String(edition) + '" lists the official package ' + name
+                + '; editions contain only third-party or self-developed plugins');
+        }
+    }
+    const runtime = distribution.dshRange.replace(/^>=?/u, '');
+    const baseBundles = composition === undefined
+        ? distribution.bundles
+        : distribution.bundles.filter(bundle => bundle.startsWith('@deepseek-ai/') || bundle === '@sparkelf/dsh-plus');
+    const basePackages = composition === undefined
+        ? distribution.dependencies
+        : {
+            '@deepseek-ai/dsh': distribution.dshRange,
+            '@sparkelf/dsh-plus': distribution.version,
+            ...Object.fromEntries(baseBundles
+                .filter(bundle => bundle.startsWith('@deepseek-ai/dsh-'))
+                .map(bundle => [bundle, runtime])),
+        };
+    const compositionPackages = composition === undefined
+        ? basePackages
+        : { ...basePackages, ...composition.packages };
+    const compositionBundles = composition === undefined
+        ? baseBundles
+        : [...baseBundles, ...composition.bundles];
     if (existsSync(manifestPath)) {
+        // A selected edition is an explicit install choice, so its packages and bundle order
+        // replace the profile's rather than being ignored. Other profile decisions stay.
+        if (composition !== undefined) {
+            const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, 'utf8')), 'Plus profile manifest');
+            manifest.dependencies = { ...manifest.dependencies, ...compositionPackages };
+            manifest.dsh = {
+                ...manifest.dsh,
+                profile: {
+                    ...manifest.dsh?.profile,
+                    bundles: [...compositionBundles],
+                    ...(edition === undefined ? {} : { plusEdition: edition }),
+                },
+            };
+            writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+        }
         // The workspace carries decisions the distribution owns — overrides and the build
         // script allowlist — and a distribution release changes them. Rewriting on every
         // start is what lets an upgraded installation receive the new values; a profile
@@ -449,18 +531,12 @@ export function ensureProfile(paths, consumerDirectory) {
         name: 'dsh-profile-' + STANDALONE_PROFILE,
         private: true,
         type: 'module',
-        dependencies: {
-            '@sparkelf/dsh-plus': distribution.version,
-            // The launcher's own tree supplies every service package the bundles mount. A
-            // profile that lists only the distribution's plugins installs a partial tree and
-            // fails at load with a module the launcher would have carried.
-            '@deepseek-ai/dsh': distribution.dshRange,
-            ...distribution.dependencies,
-        },
+        dependencies: compositionPackages,
         dsh: {
             profile: {
-                bundles: distribution.bundles,
+                bundles: [...compositionBundles],
                 patchReload: 'live',
+                ...(edition === undefined ? {} : { plusEdition: edition }),
             },
         },
     };
@@ -536,34 +612,20 @@ function git(root, args, acceptFailure = false) {
  */
 export function applyProfileNpmPatches(distributionDirectory, profileDirectory) {
     const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, 'package.json'), 'utf8')), 'Plus distribution manifest');
-    const plus = requireRecord(manifest.dshPlus, 'dshPlus');
-    const names = plus.patchPackages;
-    if (!Array.isArray(names))
-        throw new Error('dshPlus.patchPackages must be an array');
+    const patchSet = readPatchSet(distributionDirectory, manifest);
     const applied = [];
-    for (const value of names) {
-        if (typeof value !== 'string' || value === '')
-            throw new Error('dshPlus.patchPackages entries must be non-empty strings');
-        const patchPackage = resolveInstalledPackage(distributionDirectory, value);
-        const declaration = requireRecord(patchPackage.manifest.dshPatch, value + ' dshPatch');
-        const variants = declaration.variants;
-        if (!Array.isArray(variants))
-            throw new Error(value + ' dshPatch.variants must be an array');
-        for (const entry of variants) {
-            const variant = requireRecord(entry, value + ' variant');
-            const target = requireRecord(variant.target, value + ' variant target');
-            // Only npm targets reach an installed package; a source target needs the
-            // official checkout, which a standalone installation does not have.
-            if (target.kind !== 'npm')
-                continue;
-            const targetName = String(target.name);
-            const patched = resolveInstalledPackage(profileDirectory, targetName);
-            const file = resolve(patchPackage.directory, String(variant.file));
-            if (git(patched.directory, ['apply', '--reverse', '--check', file], true) !== undefined)
-                continue;
-            git(patched.directory, ['apply', file]);
-            applied.push(value + ' -> ' + targetName);
-        }
+    for (const entry of [...patchSet.entries, ...patchSet.thirdPartyPatches]) {
+        // Only npm targets reach an installed package; a source target needs the
+        // official checkout, which a standalone installation does not have.
+        if (entry.target.kind !== 'npm')
+            continue;
+        const targetName = entry.target.name;
+        const patched = resolveInstalledPackage(profileDirectory, targetName);
+        const file = resolve(distributionDirectory, entry.file);
+        if (git(patched.directory, ['apply', '--reverse', '--check', file], true) !== undefined)
+            continue;
+        git(patched.directory, ['apply', file]);
+        applied.push(entry.id + ' -> ' + targetName);
     }
     return applied;
 }
@@ -575,7 +637,22 @@ function resolveInstalledPackage(from, packageName) {
         manifestPath = requireFrom.resolve(packageName + '/package.json');
     }
     catch {
-        throw new Error(packageName + ' is not installed under ' + from);
+        // Some packages do not export `./package.json`; resolve the entry module instead and walk
+        // up to the directory that holds the manifest.
+        let directory;
+        try {
+            directory = dirname(requireFrom.resolve(packageName));
+        }
+        catch {
+            throw new Error(packageName + ' is not installed under ' + from);
+        }
+        while (!existsSync(resolve(directory, 'package.json'))) {
+            const parent = dirname(directory);
+            if (parent === directory)
+                throw new Error(packageName + ' has no resolvable package manifest under ' + from);
+            directory = parent;
+        }
+        manifestPath = resolve(directory, 'package.json');
     }
     const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, 'utf8')), packageName + ' manifest');
     return { name: packageName, version: String(manifest.version), directory: dirname(manifestPath), manifest };