@sparkelf/dsh-plus 0.2.4-alpha.48 → 0.2.5-alpha.49

package/lib/bin.js

@@ -2,10 +2,10 @@
 import { i as readPatchSet, r as runApply } from "./apply-08huHfLG.js";
 import { createRequire } from "node:module";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { homedir } from "node:os";
-import semver from "semver";
+import semver, { valid, validRange } from "semver";
 import { parseDocument } from "yaml";
 import { fileURLToPath } from "node:url";
 import { createServer } from "node:net";
@@ -75,7 +75,301 @@ function newerVersion(name, installed, registry = "https://registry.npmjs.org")
 	return publishedVersions(name, registry).filter((entry) => semver.gt(entry.version, installed)).at(-1);
 }
 //#endregion
-//#region lib/types/standalone-capabilities.js
+//#region lib/types/manifest.js
+/**
+* Derive the profile's override table from the distribution's own facts.
+*
+* The distribution records one truth per fact: the patch set names the official packages it
+* patches, the runtime names the version its republished builds carry, and an edition names the
+* capabilities a deployment omits. The override table npm and pnpm read is a projection of those
+* three, never a fourth list: an entry that cannot be derived fails the build instead of being
+* carried forward, which is what kept a stale `@deepseek-ai/dsh-client-ui-slots` pin alive long
+* after the patch behind it had gone.
+*
+* @module manifest
+*/
+/** npm scope every patched official package is republished under. */
+const OFFICIAL_PREFIX = "@deepseek-ai/";
+/** npm scope the distribution publishes its republished builds under. */
+const REPUBLISHED_PREFIX = "@sparkelf/";
+function record(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
+	return value;
+}
+/** A declared value as text, or the fallback when the manifest holds something else. */
+function text(value, fallback = "") {
+	return typeof value === "string" ? value : fallback;
+}
+function stringArray(value, label) {
+	if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry === "")) throw new Error(label + " must be a non-empty string array");
+	return value;
+}
+function stringMap(value, label) {
+	const result = {};
+	for (const [name, spec] of Object.entries(record(value, label))) {
+		if (typeof spec !== "string" || spec === "") throw new Error(label + "." + name + " must be a non-empty string");
+		result[name] = spec;
+	}
+	return result;
+}
+/**
+* The republished scope name for one official package.
+*
+* @param official - an `@deepseek-ai/dsh-*` name.
+* @returns the `@sparkelf/dsh-*` name the distribution publishes it as.
+*/
+function republishedName(official) {
+	if (!official.startsWith(OFFICIAL_PREFIX)) throw new Error(official + " is not an official package name");
+	return REPUBLISHED_PREFIX + official.slice(13);
+}
+/**
+* Derive the redirect table from the patch set.
+*
+* Every `dsh-source` entry republishes the packages its payload modifies, because a registry
+* installation has no source tree to patch. An entry that changes only types sets
+* `target.republish: false` and must say why; anything else would look like a redirect that
+* silently never happens.
+*
+* @param entries - the distribution's patch entries.
+* @param runtimeVersion - exact version the republished builds carry.
+* @returns official name to `npm:` alias spec.
+*/
+function deriveRedirects(entries, runtimeVersion) {
+	const redirects = {};
+	const ids = {};
+	for (const entry of entries) {
+		if (entry.target.kind !== "dsh-source") continue;
+		const packages = entry.target.packages ?? [];
+		if (packages.length === 0) throw new Error("patch entry " + entry.id + " declares no target packages");
+		if (!(entry.target.republish !== false)) {
+			if (entry.target.reason === void 0 || entry.target.reason.trim() === "") throw new Error("patch entry " + entry.id + " sets republish:false without a reason");
+			continue;
+		}
+		for (const official of packages) {
+			const spec = "npm:" + republishedName(official) + "@" + runtimeVersion;
+			if (redirects[official] !== void 0 && redirects[official] !== spec) throw new Error("patch entries " + (ids[official] ?? "?") + " and " + entry.id + " redirect " + official + " to different targets");
+			redirects[official] = spec;
+			ids[official] = entry.id;
+		}
+	}
+	if (Object.keys(redirects).length === 0) throw new Error("the patch set declares no republishable target");
+	return {
+		redirects,
+		ids
+	};
+}
+/** Read and validate the facts one installed distribution declares. */
+function readDistributionFacts(directory) {
+	const manifest = record(JSON.parse(readFileSync(join(directory, "package.json"), "utf8")), "distribution manifest");
+	const plus = record(manifest.dshPlus, "dshPlus");
+	const profile = record(plus.profile, "dshPlus.profile");
+	if (profile.overrides !== void 0) throw new Error("dshPlus.profile.overrides is retired; overrides are derived from dshPlus.patchSet");
+	const runtimeVersion = text(record(plus.runtime, "dshPlus.runtime").version);
+	if (valid(runtimeVersion) === null) throw new Error("dshPlus.runtime.version must be an exact version, got: " + runtimeVersion);
+	const omission = record(plus.omission, "dshPlus.omission");
+	const omissionPackage = text(omission.package);
+	const omissionVersion = text(omission.version);
+	if (!omissionPackage.startsWith("@sparkelf/") || valid(omissionVersion) === null) throw new Error("dshPlus.omission must name an @sparkelf package and an exact version");
+	if (validRange(text(record(plus.compatibility, "dshPlus.compatibility").dsh)) === null) throw new Error("dshPlus.compatibility.dsh must be a semver range");
+	const rawEntries = record(plus.patchSet, "dshPlus.patchSet").entries;
+	if (!Array.isArray(rawEntries) || rawEntries.length === 0) throw new Error("dshPlus.patchSet.entries must be a non-empty array");
+	const { redirects, ids } = deriveRedirects(rawEntries.map((value, index) => {
+		const entry = record(value, "patchSet.entries[" + String(index) + "]");
+		const target = record(entry.target, "patchSet.entries[" + String(index) + "].target");
+		const targetFacts = { kind: text(target.kind) };
+		if (target.packages !== void 0) Object.assign(targetFacts, { packages: stringArray(target.packages, "target.packages") });
+		if (target.republish === false) Object.assign(targetFacts, { republish: false });
+		if (typeof target.reason === "string") Object.assign(targetFacts, { reason: target.reason });
+		return {
+			id: text(entry.id),
+			target: targetFacts
+		};
+	}), runtimeVersion);
+	const dependencies = stringMap(profile.dependencies, "dshPlus.profile.dependencies");
+	const allowBuilds = {};
+	for (const [name, allowed] of Object.entries(record(profile.allowBuilds, "dshPlus.profile.allowBuilds"))) {
+		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
+		allowBuilds[name] = allowed;
+	}
+	const editions = {};
+	const rawEditions = plus.editions === void 0 ? {} : record(plus.editions, "dshPlus.editions");
+	for (const [id, value] of Object.entries(rawEditions)) {
+		const edition = record(value, "dshPlus.editions." + id);
+		const rawPackages = edition.packages;
+		if (rawPackages === void 0) throw new Error("dshPlus.editions." + id + ".packages is required");
+		const names = Array.isArray(rawPackages) ? stringArray(rawPackages, "dshPlus.editions." + id + ".packages") : Object.keys(record(rawPackages, "dshPlus.editions." + id + ".packages"));
+		for (const name of names) if (dependencyKey(dependencies, name) === void 0) throw new Error("edition \"" + id + "\" installs " + name + ", which dshPlus.profile.dependencies does not pin");
+		const omit = stringArray(edition.omit ?? [], "dshPlus.editions." + id + ".omit");
+		for (const name of omit) if (dependencies[name] === void 0 && manifest.dependencies?.[name] === void 0) throw new Error("edition \"" + id + "\" omits " + name + ", which the distribution does not declare");
+		const excludePackages = stringArray(edition.excludePackages ?? [], "dshPlus.editions." + id + ".excludePackages");
+		for (const name of excludePackages) {
+			if (dependencies[name] === void 0 && !stringArray(edition.bundles ?? [], "x").includes(name)) throw new Error("edition \"" + id + "\" excludes " + name + ", which it does not install or mount");
+			if (omit.includes(name)) throw new Error("edition \"" + id + "\" both excludes and omits " + name);
+			for (const [other, spec] of Object.entries(dependencies)) if (/^npm:/u.test(spec) && spec.includes(name + "@")) throw new Error("edition \"" + id + "\" excludes " + name + " but " + other + " aliases it");
+		}
+		const bundles = stringArray(edition.bundles ?? [], "dshPlus.editions." + id + ".bundles");
+		for (const name of bundles) if (omit.includes(name)) throw new Error("edition \"" + id + "\" mounts " + name + " but also omits it");
+		editions[id] = {
+			label: text(edition.label, id),
+			profile: text(edition.profile, "plus"),
+			bundles,
+			packages: names,
+			omit,
+			excludePackages
+		};
+	}
+	return {
+		name: String(manifest.name),
+		version: String(manifest.version),
+		runtimeVersion,
+		omissionSpec: "npm:" + omissionPackage + "@" + omissionVersion,
+		bundles: stringArray(profile.bundles, "dshPlus.profile.bundles"),
+		dependencies,
+		allowBuilds,
+		redirects,
+		redirectIds: ids,
+		editions
+	};
+}
+/**
+* The dependency-table key that installs one package.
+*
+* A bundle published under a scope we own is installed through an alias: the official name a
+* consumer imports (`dsh-better-sidebar`) is the key, and the spec names our build
+* (`npm:@sparkelf/dsh-better-sidebar@…`). Editions name the real package, so the
+* lookup has to follow the alias or it reports a reviewed package as unpinned.
+*
+* @param dependencies - the distribution's dependency table.
+* @param name - package name an edition names.
+* @returns the key that installs it, or undefined when the distribution does not carry it.
+*/
+function dependencyKey(dependencies, name) {
+	if (dependencies[name] !== void 0) return name;
+	for (const [key, spec] of Object.entries(dependencies)) if (/^npm:(@[^/]+\/[^@]+)@/u.exec(spec)?.[1] === name) return key;
+}
+/**
+* Project an edition into the profile npm and pnpm install.
+*
+* The distribution's reviewed order is the base; the edition names the bundle order and package
+* set it installs and the capabilities it must not run. Versions always come from
+* `profile.dependencies`, so an edition cannot pin a version the distribution did not review.
+* No edition means the full distribution, which is what a launcher start without a selection
+* materializes.
+*
+* @param facts - validated distribution facts.
+* @param editionId - edition to project, or undefined for the full distribution.
+* @returns the profile's dependencies, bundles, and override table.
+*/
+function projectEdition(facts, editionId, extraExcludes = []) {
+	const edition = editionId === void 0 ? void 0 : facts.editions[editionId];
+	if (editionId !== void 0 && edition === void 0) throw new Error("unknown edition \"" + editionId + "\"; declared: " + (Object.keys(facts.editions).join(", ") || "(none)"));
+	const excludedNames = new Set([...edition?.excludePackages ?? [], ...extraExcludes]);
+	for (const name of excludedNames) if (!(facts.dependencies[name] !== void 0 || facts.bundles.includes(name))) throw new Error("exclude names " + name + ", which the distribution does not install or mount");
+	const omittedNames = new Set(edition?.omit ?? []);
+	const omitted = {};
+	for (const name of omittedNames) omitted[name] = facts.omissionSpec;
+	const dependencies = {};
+	const sharedOfficials = Object.keys(facts.dependencies).filter((name) => name.startsWith("@deepseek-ai/dsh"));
+	const packageNames = edition === void 0 ? [...new Set([...Object.keys(facts.dependencies), ...sharedOfficials])] : [...new Set([...edition.packages, ...sharedOfficials])];
+	for (const name of packageNames) {
+		if (omittedNames.has(name) || excludedNames.has(name)) continue;
+		const key = dependencyKey(facts.dependencies, name) ?? name;
+		const spec = facts.dependencies[key];
+		if (spec === void 0) throw new Error(name + " is not a reviewed package");
+		dependencies[key] = spec;
+	}
+	for (const [name, spec] of Object.entries(facts.redirects)) {
+		if (omittedNames.has(name) || excludedNames.has(name)) continue;
+		dependencies[name] = spec;
+	}
+	const bundles = (edition === void 0 ? [...facts.bundles] : [...new Set(edition.bundles)]).filter((name) => !excludedNames.has(name));
+	for (const name of bundles) if (!facts.bundles.includes(name) && !(edition?.bundles ?? []).includes(name)) throw new Error("edition \"" + String(editionId) + "\" mounts bundle " + name + ", which the distribution does not declare");
+	const overrides = {};
+	for (const [name, spec] of Object.entries(facts.redirects)) {
+		if (omittedNames.has(name) || excludedNames.has(name)) continue;
+		overrides[name] = spec;
+	}
+	overrides["@deepseek-ai/dsh"] = facts.runtimeVersion;
+	Object.assign(overrides, omitted);
+	return {
+		profileName: edition?.profile ?? "plus",
+		dependencies,
+		bundles,
+		overrides,
+		allowBuilds: facts.allowBuilds,
+		omittedPackages: omitted
+	};
+}
+/**
+* Assert every redirect target is served by a registry.
+*
+* A redirect names a published build; one that names a version the registry does not serve
+* installs nothing at all, and the failure surfaces as a resolver error that reads like a
+* packaging defect rather than a release that never happened.
+*
+* @param redirects - official name to `npm:` alias spec.
+* @param registry - npm registry base URL.
+* @returns nothing; throws on the first unavailable target.
+*/
+async function assertRedirectsPublished(redirects, registry = "https://registry.npmjs.org") {
+	for (const spec of Object.values(redirects)) {
+		const match = /^npm:(@[^/]+\/[^@]+)@(.+)$/u.exec(spec);
+		if (match === null) throw new Error("redirect " + spec + " is not an npm alias");
+		const [, name, version] = match;
+		if (name === void 0 || version === void 0) throw new Error("redirect " + spec + " is not an npm alias");
+		if (!(await fetch(registry.replace(/\/$/u, "") + "/" + name.replace("/", "%2f") + "/" + version)).ok) throw new Error("redirect target " + name + "@" + version + " is not served by " + registry);
+	}
+}
+/**
+* Write the profile manifest and the pnpm workspace the install reads.
+*
+* npm reads `overrides` from the root manifest and pnpm reads them from the workspace file, so
+* both are written from the same projection. Resolver settings a container needs (store location,
+* supported architectures, release-age window) belong to the caller and are appended to the
+* workspace file afterwards.
+*
+* @param directory - profile directory to write into.
+* @param facts - validated distribution facts.
+* @param editionId - edition to project.
+* @param extraExcludes - packages the caller drops on top of the edition's own exclusions.
+* @returns the projection that was written.
+*/
+function writeProfileProjection(directory, facts, editionId, extraExcludes = []) {
+	const projection = projectEdition(facts, editionId, extraExcludes);
+	mkdirSync(directory, { recursive: true });
+	const dependencies = {
+		"@sparkelf/dsh-plus": facts.version,
+		"@deepseek-ai/dsh": facts.runtimeVersion,
+		...projection.dependencies
+	};
+	writeFileSync(join(directory, "package.json"), JSON.stringify({
+		name: "dsh-profile-" + projection.profileName,
+		private: true,
+		type: "module",
+		dependencies,
+		dsh: { profile: {
+			bundles: projection.bundles,
+			patchReload: "live"
+		} }
+	}, null, 2) + "\n");
+	const workspace = [
+		"packages:",
+		"  - .",
+		"nodeLinker: hoisted",
+		"autoInstallPeers: false",
+		"",
+		"overrides:",
+		...Object.keys(projection.overrides).sort().map((name) => "  " + JSON.stringify(name) + ": " + (projection.overrides[name] ?? "")),
+		"",
+		"allowBuilds:",
+		...Object.keys(projection.allowBuilds).sort().map((name) => "  " + JSON.stringify(name) + ": " + String(projection.allowBuilds[name])),
+		""
+	];
+	writeFileSync(join(directory, "pnpm-workspace.yaml"), workspace.join("\n"));
+	return projection;
+}
+//#endregion
+//#region lib/types/capabilities.js
 /** Capabilities offered at install time, in interview order. */
 const CAPABILITIES = [
 	{
@@ -498,7 +792,7 @@ function insertCapabilityRows(state, rows, withSelector) {
 * @param home - the deployment home, where generated service units are recorded.
 * @returns the ids whose service is ready.
 */
-async function installCapabilityServices(answers, home) {
+function installCapabilityServices(answers, home) {
 	const enabled = new Set(answers.enabled);
 	const ready = [];
 	mkdirSync(home, { recursive: true });
@@ -634,7 +928,7 @@ function desktopDriverAvailable() {
 	return spawnSync("cua-driver", ["--version"], { stdio: "ignore" }).status === 0;
 }
 //#endregion
-//#region lib/types/standalone-server.js
+//#region lib/types/server.js
 /**
 * Process lifecycle for one standalone Plus server.
 *
@@ -790,7 +1084,7 @@ async function waitForAuthenticatedUrl(logPath, timeoutMilliseconds) {
 	}
 }
 //#endregion
-//#region lib/types/standalone-profile.js
+//#region lib/types/profile.js
 /**
 * Runtime paths and profile composition for a standalone Plus installation.
 *
@@ -801,67 +1095,31 @@ async function waitForAuthenticatedUrl(logPath, timeoutMilliseconds) {
 * the launcher mounts exactly the bundles the profile names and nothing expands a
 * bundle's own list.
 */
-/** Profile name a standalone installation owns when its package declares none. */
-const STANDALONE_PROFILE = "plus";
+/** Profile name the launcher materializes when no edition is selected. */
+const DEFAULT_PROFILE = "plus";
+function requireRecord(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
+	return value;
+}
 /**
-* Read the deployment facts the installing package declares.
+* Resolve the file that was actually invoked from the path the shell was handed.
 *
-* A standalone package describes the profile it materializes and the capabilities it
-* omits, so a reduced variant owns a differently named profile and a reduced install
-* without the distribution naming either. The declaration travels with the package
-* because npm resolves the tree long before any command of ours runs.
+* A global npm install links `<prefix>/bin/dsh-plus` to the package entry. Resolving
+* `@sparkelf/dsh-plus` from that link starts at the bin directory, which has no
+* `node_modules`, so every globally installed command reported the distribution as
+* missing. The real path is the package file, and the package resolves its own name.
 *
-* @param anchor - path inside the installing package's tree.
-* @param fallback - profile name to use when the declaration is absent.
-* @returns the declared profile name and omitted capabilities.
+* @param invoked - `process.argv[1]`, or undefined when node ran without a script.
+* @param fallback - this module's own file, used when there is no script path.
+* @returns an absolute path that exists, or the input when it cannot be resolved.
 */
-function readStandaloneDeclaration(anchor, fallback = STANDALONE_PROFILE) {
-	let current = resolve(anchor);
-	for (;;) {
-		const declared = readStandaloneFacts(join(current, "package.json"));
-		if (declared !== void 0) return declared;
-		const parent = dirname(current);
-		if (parent === current) return {
-			profileName: fallback,
-			omittedPackages: {}
-		};
-		current = parent;
-	}
-}
-/** Read one manifest's standalone declaration, or undefined when it carries none. */
-function readStandaloneFacts(manifestPath) {
-	if (!existsSync(manifestPath)) return void 0;
-	let standalone;
+function resolveInvocationAnchor(invoked, fallback) {
+	if (invoked === void 0 || invoked === "") return realpathSync(fallback);
 	try {
-		standalone = JSON.parse(readFileSync(manifestPath, "utf8")).dshPlusStandalone;
+		return realpathSync(invoked);
 	} catch {
-		return;
-	}
-	const profile = standalone?.profile;
-	if (standalone === void 0 || typeof profile !== "string" || profile === "") return void 0;
-	const rawOmitted = standalone.omittedPackages;
-	const omittedPackages = {};
-	if (rawOmitted !== void 0 && typeof rawOmitted === "object" && !Array.isArray(rawOmitted)) for (const [name, spec] of Object.entries(rawOmitted)) {
-		if (typeof spec !== "string" || spec === "") throw new Error("dshPlusStandalone.omittedPackages." + name + " must be a non-empty string");
-		omittedPackages[name] = spec;
+		return resolve(invoked);
 	}
-	return {
-		profileName: profile,
-		omittedPackages
-	};
-}
-function requireRecord(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
-	return value;
-}
-function requireStringArray(value, label) {
-	if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) throw new Error(label + " must be a string array");
-	return value;
-}
-/** Read one non-empty string field. */
-function requireString(value, label) {
-	if (typeof value !== "string" || value.trim() === "") throw new Error(label + " must be a non-empty string");
-	return value;
 }
 /** Resolve the DSH home, honouring the environment override the launcher itself reads. */
 function resolveHome(env = process.env) {
@@ -900,12 +1158,11 @@ function isWithin(candidate, parent, platform = process.platform) {
 * @returns absolute path to the installed distribution.
 */
 function resolveDistributionDirectory(anchor) {
-	const ownDirectory = dirname(dirname(fileURLToPath(import.meta.url)));
 	let resolved;
 	try {
 		resolved = dirname(createRequire(anchor).resolve("@sparkelf/dsh-plus/package.json"));
 	} catch {
-		return ownDirectory;
+		throw new Error("@sparkelf/dsh-plus is not installed in " + dirname(anchor) + "; run this command from the directory that installed it");
 	}
 	let current = resolve(dirname(anchor));
 	for (;;) {
@@ -914,56 +1171,25 @@ function resolveDistributionDirectory(anchor) {
 		if (parent === current) break;
 		current = parent;
 	}
-	return ownDirectory;
+	throw new Error("@sparkelf/dsh-plus resolved outside " + resolve(dirname(anchor)) + " (found " + resolved + "); run this command from the directory that installed it");
 }
-function readDistributionProfile(distributionDirectory) {
-	const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, "package.json"), "utf8")), "Plus distribution manifest");
-	const plus = requireRecord(manifest.dshPlus, "dshPlus");
-	const profile = requireRecord(plus.profile, "dshPlus.profile");
-	const dependencies = requireDependencyMap(requireRecord(profile.dependencies, "dshPlus.profile.dependencies"), "dshPlus.profile.dependencies");
-	const rawAllowBuilds = requireRecord(profile.allowBuilds, "dshPlus.profile.allowBuilds");
-	const allowBuilds = {};
-	for (const [name, allowed] of Object.entries(rawAllowBuilds)) {
-		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
-		allowBuilds[name] = allowed;
-	}
-	const overrides = {};
-	const rawOverrides = profile.overrides === void 0 ? {} : requireRecord(profile.overrides, "dshPlus.profile.overrides");
-	for (const [name, spec] of Object.entries(rawOverrides)) {
-		if (typeof spec !== "string" || spec === "") throw new Error("dshPlus.profile.overrides." + name + " must be a non-empty string");
-		overrides[name] = spec;
-	}
-	const editions = {};
-	const rawEditions = plus.editions === void 0 ? {} : requireRecord(plus.editions, "dshPlus.editions");
-	for (const [id, value] of Object.entries(rawEditions)) {
-		const edition = requireRecord(value, "dshPlus.editions." + id);
-		editions[id] = {
-			label: requireString(edition.label, "dshPlus.editions." + id + ".label"),
-			bundles: requireStringArray(edition.bundles, "dshPlus.editions." + id + ".bundles"),
-			packages: requireDependencyMap(requireRecord(edition.packages, "dshPlus.editions." + id + ".packages"), "dshPlus.editions." + id + ".packages")
-		};
-	}
-	const compatibility = requireRecord(plus.compatibility, "dshPlus.compatibility");
+/** The reviewed bundle order and pins the installed distribution declares, for one variant. */
+function readDistributionProfile(distributionDirectory, editionId, extraExcludes = []) {
+	const facts = readDistributionFacts(distributionDirectory);
+	const projection = projectEdition(facts, editionId, extraExcludes);
 	return {
-		name: String(manifest.name),
-		bundles: requireStringArray(profile.bundles, "dshPlus.profile.bundles"),
-		dependencies,
-		allowBuilds,
-		overrides,
-		editions,
-		dshRange: String(compatibility.dsh),
-		version: String(manifest.version)
+		name: facts.name,
+		version: facts.version,
+		dshRange: ">=" + facts.runtimeVersion,
+		runtimeVersion: facts.runtimeVersion,
+		bundles: projection.bundles,
+		dependencies: projection.dependencies,
+		allowBuilds: projection.allowBuilds,
+		overrides: projection.overrides,
+		omittedPackages: projection.omittedPackages,
+		editions: facts.editions
 	};
 }
-/** Read one package-name-to-spec map, rejecting empty entries. */
-function requireDependencyMap(value, label) {
-	const dependencies = {};
-	for (const [name, spec] of Object.entries(value)) {
-		if (typeof spec !== "string" || spec === "") throw new Error(label + "." + name + " must be a non-empty string");
-		dependencies[name] = spec;
-	}
-	return dependencies;
-}
 /**
 * Give the profile its own installed tree, built from the distribution's declarations.
 *
@@ -980,22 +1206,131 @@ function requireDependencyMap(value, label) {
 * twice; `dsh-plus apply` remains the command that reinstalls after a change.
 *
 * @param paths - resolved standalone paths.
-* @param consumerDirectory - directory whose `node_modules` holds the installation.
 */
-function installProfilePackages(paths, consumerDirectory) {
-	if (!existsSync(join(consumerDirectory, "node_modules"))) {
-		installWithRegistryFallback(paths);
-		alignReplacedPackageNames(join(paths.profileDirectory, "node_modules"));
-		return;
-	}
+function installProfilePackages(paths, omitted = /* @__PURE__ */ new Set(), runtimeVersion, registry) {
 	const profileModules = join(paths.profileDirectory, "node_modules");
 	if (existsSync(profileModules)) {
 		linkNestedBundles(paths, profileModules);
 		return;
 	}
-	installWithRegistryFallback(paths);
-	alignReplacedPackageNames(profileModules);
+	installWithRegistryFallback(paths.profileDirectory);
+	if (runtimeVersion !== void 0 && registry !== void 0) alignOfficialVersions(paths.profileDirectory, runtimeVersion, registry);
+	alignReplacedPackageNames(profileModules, omitted);
 	linkNestedBundles(paths, profileModules);
+	assertProfileBundles(paths.profileDirectory);
+}
+/** Package names a package declares as peers on the official runtime family. */
+function officialPeers(profileDirectory) {
+	const peers = /* @__PURE__ */ new Set();
+	const manifests = [];
+	for (const scope of [join(profileDirectory, "node_modules"), join(profileDirectory, "node_modules", "@deepseek-ai")]) {
+		if (!existsSync(scope)) continue;
+		for (const entry of readdirSync(scope)) {
+			if (entry.startsWith(".")) continue;
+			if (entry.startsWith("@") && entry !== "@deepseek-ai") continue;
+			if (entry === "@deepseek-ai") {
+				for (const scoped of readdirSync(scope)) manifests.push(join(scope, scoped, "package.json"));
+				continue;
+			}
+			manifests.push(join(scope, entry, "package.json"));
+		}
+	}
+	for (const manifestPath of manifests) {
+		if (!existsSync(manifestPath)) continue;
+		try {
+			const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			for (const peer of Object.keys(manifest.peerDependencies ?? {})) if (peer.startsWith("@deepseek-ai/dsh") && peer !== "@deepseek-ai/dsh") peers.add(peer);
+		} catch {}
+	}
+	return peers;
+}
+/**
+* Which of the given package versions a registry serves.
+*
+* The probe runs in one Node child: one process per name is slow, and the caller needs the
+* answer before the second install.
+*
+* @param names - package names to check.
+* @param version - exact version each must serve.
+* @param registry - registry base URL.
+* @returns the names the registry serves at that version.
+*/
+function servedVersions(names, version, registry) {
+	if (names.length === 0) return /* @__PURE__ */ new Set();
+	const result = spawnSync(process.execPath, [
+		"--input-type=module",
+		"-e",
+		`
+    const [names, version, registry] = JSON.parse(process.argv[1])
+    const base = registry.replace(/\\/$/, '')
+    const queue = [...names]
+    const served = []
+    await Promise.all(Array.from({ length: 10 }, async () => {
+      while (queue.length > 0) {
+        const name = queue.shift()
+        try {
+          const response = await fetch(base + '/' + name.replace('/', '%2f') + '/' + version)
+          if (response.ok) served.push(name)
+        } catch {}
+      }
+    }))
+    process.stdout.write(served.join('\\n'))
+  `,
+		JSON.stringify([
+			names,
+			version,
+			registry
+		])
+	], { encoding: "utf8" });
+	if (result.status !== 0) return /* @__PURE__ */ new Set();
+	return new Set(result.stdout.split("\n").map((entry) => entry.trim()).filter((entry) => entry !== ""));
+}
+/**
+* Move the shared official services onto the runtime's exact version.
+*
+* The republished builds were cut against one runtime, and DSH disables a row when the exact
+* peers a plugin declares disagree with the process it shares. Plugins declare those services as
+* peers, so the names worth pinning are the peers actually installed -- read from the tree and
+* checked against the registry. The rest of the official family keeps its resolved versions:
+* pinning everything traded one mismatch for a tree with holes.
+*
+* @param profileDirectory - profile whose tree was just installed.
+* @param runtimeVersion - exact runtime the profile boots.
+* @param registry - registry the profile installs from.
+* @returns how many services were realigned.
+*/
+function alignOfficialVersions(profileDirectory, runtimeVersion, registry) {
+	const served = servedVersions([...officialPeers(profileDirectory)], runtimeVersion, registry);
+	if (served.size === 0) return 0;
+	const workspacePath = join(profileDirectory, "pnpm-workspace.yaml");
+	const document = parseDocument(readFileSync(workspacePath, "utf8"));
+	let changed = 0;
+	for (const name of served) {
+		if (document.getIn(["overrides", name]) === runtimeVersion) continue;
+		document.setIn(["overrides", name], runtimeVersion);
+		changed += 1;
+	}
+	if (changed === 0) return 0;
+	writeFileSync(workspacePath, String(document));
+	rmSync(join(profileDirectory, "pnpm-lock.yaml"), { force: true });
+	installWithRegistryFallback(profileDirectory);
+	return changed;
+}
+/**
+* Assert every bundle row the profile declares resolves in its installed tree.
+*
+* A row without an installed package mounts nothing and reports nothing: the client module
+* system simply never registers it, and every earlier step passes. Reading the rows back from
+* the manifest on disk rather than from the projection is what makes this cover the tree the
+* launcher actually boots.
+*
+* @param profileDirectory - profile whose node_modules was just installed.
+*/
+function assertProfileBundles(profileDirectory) {
+	const manifest = JSON.parse(readFileSync(join(profileDirectory, "package.json"), "utf8"));
+	const missing = [];
+	for (const name of manifest.dsh?.profile?.bundles ?? []) if (!existsSync(join(profileDirectory, "node_modules", name, "package.json"))) missing.push(name);
+	if (missing.length > 0) throw new Error("the profile mounts bundles it did not install: " + missing.join(", "));
 }
 /**
 * Install the profile from the first registry that answers.
@@ -1006,20 +1341,18 @@ function installProfilePackages(paths, consumerDirectory) {
 *
 * @param paths - resolved standalone paths.
 */
-function installWithRegistryFallback(paths) {
+function installWithRegistryFallback(profileDirectory) {
 	const registries = registryOrder();
 	for (const [index, registry] of registries.entries()) {
-		if (index > 0) rmSync(join(paths.profileDirectory, "pnpm-lock.yaml"), { force: true });
 		const result = spawnSync("pnpm", [
 			"install",
 			"--no-frozen-lockfile",
 			"--registry",
 			registry
 		], {
-			cwd: paths.profileDirectory,
+			cwd: profileDirectory,
 			stdio: "inherit",
-			shell: process.platform === "win32",
-			timeout: 5 * 6e4
+			shell: process.platform === "win32"
 		});
 		if (result.error !== void 0) throw result.error;
 		if (result.status === 0) return;
@@ -1044,22 +1377,37 @@ function installWithRegistryFallback(paths) {
 *
 * @param profileModules - the profile's \`node_modules\` directory.
 */
-function alignReplacedPackageNames(profileModules) {
-	const scoped = join(profileModules, "@deepseek-ai");
-	if (!existsSync(scoped)) return;
-	for (const entry of readdirSync(scoped)) {
-		const manifestPath = join(scoped, entry, "package.json");
-		if (!existsSync(manifestPath)) continue;
+function alignReplacedPackageNames(profileModules, omitted = /* @__PURE__ */ new Set()) {
+	if (!existsSync(profileModules)) return;
+	const align = (expected, manifestPath) => {
+		if (!existsSync(manifestPath)) return;
 		const declared = JSON.parse(readFileSync(manifestPath, "utf8"));
-		const expected = "@deepseek-ai/" + entry;
-		if (declared.name === expected) continue;
-		const replaced = {
+		if (declared.name === expected || omitted.has(expected)) return;
+		const temporary = manifestPath + ".dsh-name";
+		writeFileSync(temporary, JSON.stringify({
 			...declared,
 			name: expected
-		};
-		const temporary = manifestPath + ".dsh-name";
-		writeFileSync(temporary, JSON.stringify(replaced, null, 2) + "\n");
+		}, null, 2) + "\n");
 		renameSync(temporary, manifestPath);
+	};
+	for (const entry of readdirSync(profileModules)) {
+		if (entry.startsWith(".")) continue;
+		if (!entry.startsWith("@")) {
+			const manifestPath = join(profileModules, entry, "package.json");
+			if (!existsSync(manifestPath)) continue;
+			const declared = JSON.parse(readFileSync(manifestPath, "utf8"));
+			if (declared.name === void 0 || declared.name === entry) continue;
+			const [scope, name] = declared.name.split("/");
+			if (scope === void 0 || name === void 0) continue;
+			mkdirSync(join(profileModules, scope), { recursive: true });
+			const link = join(profileModules, scope, name);
+			if (existsSync(link)) continue;
+			try {
+				symlinkSync(join("..", entry), link, "junction");
+			} catch {}
+			continue;
+		}
+		for (const scoped of readdirSync(join(profileModules, entry))) align(entry + "/" + scoped, join(profileModules, entry, scoped, "package.json"));
 	}
 }
 /** The npm registry the distribution installs from by default. */
@@ -1078,7 +1426,7 @@ const MAINLAND_REGISTRY = "https://registry.npmmirror.com";
 */
 function registryOrder() {
 	const configured = process.env.DSH_PLUS_INSTALL_REGISTRY;
-	if (configured !== void 0 && configured !== "") return [configured, configured === MAINLAND_REGISTRY ? OFFICIAL_REGISTRY : MAINLAND_REGISTRY];
+	if (configured !== void 0 && configured !== "") return [configured, MAINLAND_REGISTRY];
 	const locale = [
 		process.env.LANG,
 		process.env.LC_ALL,
@@ -1154,15 +1502,22 @@ function linkBundle(consumerModules, name, source) {
 	} catch {}
 }
 /** Resolve every path a command needs, without creating anything. */
-function resolvePaths(anchor, env = process.env) {
+function resolvePaths(anchor, env = process.env, editionId) {
 	const home = resolveHome(env);
-	const declaration = readStandaloneDeclaration(anchor);
+	const distributionDirectory = resolveDistributionDirectory(anchor);
+	let profileName = DEFAULT_PROFILE;
+	let omittedPackages = {};
+	if (editionId !== void 0) {
+		const projection = projectEdition(readDistributionFacts(distributionDirectory), editionId);
+		profileName = projection.profileName;
+		omittedPackages = projection.omittedPackages;
+	}
 	return {
 		home,
-		profileName: declaration.profileName,
-		omittedPackages: declaration.omittedPackages,
-		profileDirectory: join(home, "profiles", declaration.profileName),
-		distributionDirectory: resolveDistributionDirectory(anchor)
+		profileName,
+		omittedPackages,
+		profileDirectory: join(home, "profiles", profileName),
+		distributionDirectory
 	};
 }
 /**
@@ -1178,105 +1533,43 @@ function resolvePaths(anchor, env = process.env) {
 * that installed them.
 *
 * @param paths - resolved standalone paths.
-* @param consumerDirectory - directory whose `node_modules` holds the installed packages.
-* @param edition - edition id whose package list to install, or undefined for the default.
+* @param editionId - product edition to materialize.
+* @param extraExcludes - packages the caller drops on top of the edition's own exclusions.
+* @param dryRun - write the profile files without installing their dependency tree.
 * @returns whether this call created the manifest.
 */
-function ensureProfile(paths, consumerDirectory, edition) {
+function ensureProfile(paths, editionId, extraExcludes = [], dryRun = false) {
 	const manifestPath = join(paths.profileDirectory, "package.json");
-	const distribution = readDistributionProfile(paths.distributionDirectory);
-	const composition = edition === void 0 ? void 0 : distribution.editions[edition];
-	if (edition !== void 0 && composition === void 0) {
-		const offered = Object.keys(distribution.editions);
-		throw new Error("unknown edition \"" + edition + "\"; this release offers " + (offered.length === 0 ? "(none)" : offered.join(", ")));
-	}
-	for (const name of Object.keys(composition?.packages ?? {})) if (name.startsWith("@deepseek-ai/")) throw new Error("edition \"" + String(edition) + "\" lists the official package " + name + "; editions contain only third-party or self-developed plugins");
-	const runtime = distribution.dshRange.replace(/^>=?/u, "");
-	const baseBundles = composition === void 0 ? distribution.bundles : distribution.bundles.filter((bundle) => bundle.startsWith("@deepseek-ai/") || bundle === "@sparkelf/dsh-plus");
-	const basePackages = composition === void 0 ? distribution.dependencies : {
-		"@deepseek-ai/dsh": distribution.dshRange,
-		"@sparkelf/dsh-plus": distribution.version,
-		"@deepseek-ai/cordis": "^4.0.6-alpha.1",
-		"@deepseek-ai/cordis-plugin-group": "^1.0.6-alpha.1",
-		"@deepseek-ai/cordis-plugin-include": "^1.0.11-alpha.1",
-		"@deepseek-ai/cordis-plugin-loader": "^1.0.7-alpha.1",
-		"@deepseek-ai/dsh-home-paths": runtime,
-		"@deepseek-ai/dsh-launch-environment": runtime,
-		"@deepseek-ai/dsh-agent": runtime,
-		"@deepseek-ai/dsh-llm": runtime,
-		"@deepseek-ai/dsh-scope": runtime,
-		"@deepseek-ai/dsh-session": runtime,
-		"@deepseek-ai/dsh-system-prompt": runtime,
-		"@deepseek-ai/dsh-user-approval": runtime,
-		"@deepseek-ai/dsh-attachment": runtime,
-		"@deepseek-ai/dsh-compaction": runtime,
-		"@deepseek-ai/dsh-fs": runtime,
-		"@deepseek-ai/dsh-shell": runtime,
-		"@deepseek-ai/dsh-spill": runtime,
-		"@deepseek-ai/dsh-sandbox": runtime,
-		"@deepseek-ai/dsh-ptc-runtime": runtime,
-		"@deepseek-ai/dsh-llm-deepseek": runtime,
-		"@deepseek-ai/dsh-deepseek-account": runtime,
-		"@deepseek-ai/dsh-anonymous-user-id": runtime,
-		"@deepseek-ai/dsh-bash-local": runtime,
-		"@deepseek-ai/dsh-client-store": runtime,
-		"@deepseek-ai/dsh-jobs": runtime,
-		"@deepseek-ai/dsh-sdk-protocol": runtime,
-		"@deepseek-ai/dsh-session-persistence": runtime,
-		"@deepseek-ai/dsh-session-telemetry": runtime,
-		"@deepseek-ai/dsh-session-title-llm": runtime,
-		"@deepseek-ai/dsh-util-workspace-path": runtime,
-		"@deepseek-ai/dsh-workflow": runtime,
-		...Object.fromEntries(baseBundles.filter((bundle) => bundle.startsWith("@deepseek-ai/dsh-")).map((bundle) => [bundle, runtime]))
-	};
-	const compositionPackages = composition === void 0 ? basePackages : {
-		...basePackages,
-		...composition.packages
-	};
-	for (const [alias, target] of Object.entries({
-		"dsh-better-sidebar": "@sparkelf/dsh-better-sidebar",
-		"dsh-sql-workbench": "@sparkelf/dsh-sql-workbench"
-	})) {
-		const spec = compositionPackages[target];
-		if (spec !== void 0 && compositionPackages[alias] === void 0) compositionPackages[alias] = "npm:" + target + "@" + spec;
-	}
-	const compositionBundles = composition === void 0 ? baseBundles : [...baseBundles, ...composition.bundles];
+	const distribution = readDistributionProfile(paths.distributionDirectory, editionId, extraExcludes);
 	if (existsSync(manifestPath)) {
-		if (composition !== void 0) {
-			const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, "utf8")), "Plus profile manifest");
-			manifest.dependencies = {
-				...manifest.dependencies,
-				...compositionPackages
-			};
-			manifest.dsh = {
-				...manifest.dsh,
-				profile: {
-					...manifest.dsh?.profile,
-					bundles: [...compositionBundles],
-					...edition === void 0 ? {} : { plusEdition: edition }
-				}
-			};
-			writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
-		}
-		writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, paths.omittedPackages);
-		installProfilePackages(paths, consumerDirectory);
+		writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, {
+			...paths.omittedPackages,
+			...distribution.omittedPackages
+		});
+		if (!dryRun) installProfilePackages(paths, new Set(Object.keys(distribution.omittedPackages)), distribution.runtimeVersion, registryOrder()[0]);
 		return false;
 	}
 	mkdirSync(paths.profileDirectory, { recursive: true });
 	const manifest = {
-		name: "dsh-profile-plus",
+		name: "dsh-profile-" + paths.profileName,
 		private: true,
 		type: "module",
-		dependencies: compositionPackages,
+		dependencies: {
+			"@sparkelf/dsh-plus": distribution.version,
+			"@deepseek-ai/dsh": distribution.dshRange,
+			...distribution.dependencies
+		},
 		dsh: { profile: {
-			bundles: [...compositionBundles],
-			patchReload: "live",
-			...edition === void 0 ? {} : { plusEdition: edition }
+			bundles: distribution.bundles,
+			patchReload: "live"
 		} }
 	};
 	writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
-	writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, paths.omittedPackages);
-	installProfilePackages(paths, consumerDirectory);
+	writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, {
+		...paths.omittedPackages,
+		...distribution.omittedPackages
+	});
+	if (!dryRun) installProfilePackages(paths, new Set(Object.keys(distribution.omittedPackages)), distribution.runtimeVersion, registryOrder()[0]);
 	return true;
 }
 /**
@@ -1299,7 +1592,7 @@ function writeProfileOverrides(profileDirectory, overrides, allowBuilds, omitted
 	for (const [name, spec] of Object.entries(omittedPackages)) document.setIn(["overrides", name], spec);
 	for (const [name, allowed] of Object.entries(allowBuilds)) document.setIn(["allowBuilds", name], allowed);
 	if (document.get("nodeLinker") === void 0) document.set("nodeLinker", "hoisted");
-	if (document.get("autoInstallPeers") === void 0) document.set("autoInstallPeers", true);
+	if (document.get("autoInstallPeers") === void 0) document.set("autoInstallPeers", false);
 	writeFileSync(workspacePath, String(document));
 }
 /** Run git in one directory, returning undefined instead of throwing when asked to. */
@@ -1355,18 +1648,7 @@ function resolveInstalledPackage(from, packageName) {
 	try {
 		manifestPath = requireFrom.resolve(packageName + "/package.json");
 	} catch {
-		let directory;
-		try {
-			directory = dirname(requireFrom.resolve(packageName));
-		} catch {
-			throw new Error(packageName + " is not installed under " + from);
-		}
-		while (!existsSync(resolve(directory, "package.json"))) {
-			const parent = dirname(directory);
-			if (parent === directory) throw new Error(packageName + " has no resolvable package manifest under " + from);
-			directory = parent;
-		}
-		manifestPath = resolve(directory, "package.json");
+		throw new Error(packageName + " is not installed under " + from);
 	}
 	const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, "utf8")), packageName + " manifest");
 	return {
@@ -1377,7 +1659,7 @@ function resolveInstalledPackage(from, packageName) {
 	};
 }
 //#endregion
-//#region lib/types/standalone-cli.js
+//#region lib/types/cli.js
 /**
 * The `dsh-plus` command line for a standalone installation.
 *
@@ -1387,6 +1669,8 @@ function resolveInstalledPackage(from, packageName) {
 * layer — a profile created on first start, a free port chosen without asking, a
 * server that survives the terminal, and one place to read the URL.
 */
+/** Edition the offline build projects when the caller names none. */
+const DEFAULT_EDITION = "intranet-team";
 /** Milliseconds a start waits for the server to answer before reporting failure. */
 const READY_TIMEOUT_MILLISECONDS = 9e4;
 /** Profile patch file the capability interview rewrites (the profile's user layer). */
@@ -1396,8 +1680,9 @@ function parseStartOptions(argv) {
 	let host = "127.0.0.1";
 	let open = true;
 	let foreground = false;
-	let edition;
 	let capabilities;
+	let edition;
+	const exclude = [];
 	for (let index = 0; index < argv.length; index += 1) {
 		const token = argv[index];
 		if (token === "--port" || token === "-p") {
@@ -1429,6 +1714,13 @@ function parseStartOptions(argv) {
 			index += 1;
 			continue;
 		}
+		if (token === "--exclude") {
+			const value = argv[index + 1];
+			if (value === void 0 || value === "") throw new Error("--exclude requires a package name");
+			exclude.push(value);
+			index += 1;
+			continue;
+		}
 		if (token === "--capabilities") {
 			const value = argv[index + 1];
 			if (value === void 0) throw new Error("--capabilities requires a comma-separated list, or an empty string for none");
@@ -1446,8 +1738,9 @@ function parseStartOptions(argv) {
 		host,
 		open,
 		foreground,
+		capabilities,
 		edition,
-		capabilities
+		exclude
 	};
 }
 /**
@@ -1511,12 +1804,21 @@ function installationAnchor() {
 * @returns absolute path to the invoked command, or this module when argv carries none.
 */
 function declarationAnchor() {
-	const invoked = process.argv[1];
-	return invoked === void 0 || invoked === "" ? fileURLToPath(import.meta.url) : resolve(invoked);
+	return resolveInvocationAnchor(process.argv[1], fileURLToPath(import.meta.url));
 }
-/** The launcher entry this installation must drive. */
-function launcherEntry(anchor) {
-	return createRequire(anchor).resolve("@deepseek-ai/dsh/lib/bin.js");
+/**
+* The launcher entry this installation must drive.
+*
+* The profile owns the runtime tree, so the launcher is resolved from the profile rather than
+* from the directory that installed the command: a global distribution has no launcher of its
+* own, and one resolved from the consumer would be a second copy of the process the profile
+* mounts.
+*
+* @param profileDirectory - profile whose node_modules carries the launcher.
+* @returns absolute path to the launcher entry.
+*/
+function launcherEntry(profileDirectory) {
+	return createRequire(join(profileDirectory, "package.json")).resolve("@deepseek-ai/dsh/lib/bin.js");
 }
 /** Run the server in this process, inheriting stdio. */
 function runForeground(entry, profileName, port, host, open) {
@@ -1532,60 +1834,9 @@ function runForeground(entry, profileName, port, host, open) {
 	if (!open) args.push("--no-open");
 	return spawnSync(process.execPath, args, { stdio: "inherit" }).status ?? 1;
 }
-/** Parse the install command's edition selection. */
-function parseInstallOptions(argv) {
-	let edition;
-	let profile;
-	for (let index = 0; index < argv.length; index += 1) {
-		const token = argv[index];
-		if (token === "--edition") {
-			const value = argv[index + 1];
-			if (value === void 0 || value === "") throw new Error("--edition requires a value");
-			edition = value;
-			index += 1;
-			continue;
-		}
-		if (token === "--profile") {
-			const value = argv[index + 1];
-			if (value === void 0 || value === "") throw new Error("--profile requires a value");
-			profile = value;
-			index += 1;
-			continue;
-		}
-		throw new Error("unknown option: " + String(token));
-	}
-	if (edition === void 0) throw new Error("install requires --edition personal or --edition team");
-	return {
-		edition,
-		profile
-	};
-}
-/**
-* Install one edition's package manifest into the profile.
-*
-* The profile's `package.json` is the install artifact; there is no separate standalone
-* package. A later `start` uses the same manifest, so changing the edition is a new
-* install rather than a second product.
-*
-* @param argv - arguments after `install`.
-* @returns the process exit code.
-*/
-function install(argv) {
-	const { edition, profile } = parseInstallOptions(argv);
-	const base = resolvePaths(declarationAnchor());
-	const paths = profile === void 0 ? base : {
-		...base,
-		profileName: profile,
-		profileDirectory: join(base.home, "profiles", profile)
-	};
-	ensureProfile(paths, installationRoot(), edition);
-	console.log("Installed the " + edition + " edition into " + paths.profileDirectory);
-	return 0;
-}
 async function start(argv) {
 	const options = parseStartOptions(argv);
-	const anchor = installationAnchor();
-	const paths = resolvePaths(declarationAnchor());
+	const paths = resolvePaths(declarationAnchor(), process.env, options.edition);
 	if (!pnpmAvailable()) {
 		const command = pnpmInstallCommand();
 		console.log("pnpm is required to install the plus profile, and was not found.");
@@ -1615,20 +1866,19 @@ async function start(argv) {
 		}
 		console.log("pnpm installed.");
 	}
-	const created = ensureProfile(paths, installationRoot(), options.edition);
+	const created = ensureProfile(paths, options.edition, options.exclude);
 	console.log(created ? "Created the " + paths.profileName + " profile at " + paths.profileDirectory : "Using the existing " + paths.profileName + " profile");
-	if (options.edition !== void 0) console.log("Edition: " + options.edition);
 	for (const label of applyProfileNpmPatches(paths.distributionDirectory, paths.profileDirectory)) console.log("Applied the reviewed patch " + label);
 	const answers = created || !existsSync(join(paths.home, "capabilities.json")) ? options.capabilities === void 0 ? await interviewCapabilities(true) : selectCapabilities(options.capabilities) : void 0;
 	if (answers !== void 0) {
-		const ready = await installCapabilityServices(answers, paths.home);
+		const ready = installCapabilityServices(answers, paths.home);
 		writeCapabilityPatch(paths.profileDirectory, answers);
 		writeCapabilityEnvironment(paths.home, answers);
 		console.log("  Enabled: " + (answers.enabled.length === 0 ? "(none)" : answers.enabled.join(", ")));
 		if (answers.enabled.length > 0) console.log("  Services ready: " + (ready.length === 0 ? "(none)" : ready.join(", ")));
 		if (answers.enabled.includes("exa") && answers.exaApiKey === void 0) console.log("  Exa: add EXA_API_KEY to " + join(paths.home, CAPABILITY_ENV_FILE) + " when you have a key.");
 	}
-	const entry = launcherEntry(anchor);
+	const entry = launcherEntry(paths.profileDirectory);
 	if (options.foreground) return runForeground(entry, paths.profileName, options.port, options.host, options.open);
 	const existing = readState(paths.home);
 	if (existing !== void 0) {
@@ -1960,31 +2210,223 @@ async function doctor() {
 	const record = readCapabilityRecord(paths.home);
 	const drifted = record === void 0 ? [] : CAPABILITIES.filter((capability) => record.enabled.includes(capability.id) !== actual.mounted.includes(capability.id));
 	check(drifted.length === 0, drifted.length === 0 ? "capabilities: " + (actual.mounted.length === 0 ? "(none enabled)" : actual.mounted.join(", ")) : "capabilities disagree with capabilities.json: " + drifted.map((capability) => capability.id).join(", ") + " (run dsh-plus capabilities)");
-	const profileManifestPath = join(paths.profileDirectory, "package.json");
-	if (existsSync(profileManifestPath)) {
-		const profileManifest = JSON.parse(readFileSync(profileManifestPath, "utf8"));
-		const editionId = profileManifest.dsh?.profile?.plusEdition;
-		if (editionId !== void 0) {
-			const edition = readDistributionProfile(paths.distributionDirectory).editions[editionId];
-			if (edition === void 0) check(false, "edition \"" + editionId + "\" is not declared by this distribution");
-			else {
-				const bundles = new Set(profileManifest.dsh?.profile?.bundles ?? []);
-				const missingBundles = edition.bundles.filter((bundle) => !bundles.has(bundle));
-				const packageNames = Object.keys(edition.packages);
-				const missingPackages = packageNames.filter((name) => !existsSync(join(paths.profileDirectory, "node_modules", ...name.split("/"), "package.json")));
-				check(missingBundles.length === 0, "edition " + editionId + ": " + String(edition.bundles.length - missingBundles.length) + "/" + String(edition.bundles.length) + " bundles mounted" + (missingBundles.length === 0 ? "" : " (missing " + missingBundles.join(", ") + ")"));
-				check(missingPackages.length === 0, "edition " + editionId + ": " + String(packageNames.length - missingPackages.length) + "/" + String(packageNames.length) + " packages installed" + (missingPackages.length === 0 ? "" : " (missing " + missingPackages.join(", ") + ")"));
-			}
-		}
-	}
 	console.log(failures === 0 ? "No problems found." : String(failures) + " problem(s) found.");
 	return failures === 0 ? 0 : 1;
 }
+function parseInstallOptions(argv) {
+	let edition;
+	const exclude = [];
+	let dryRun = false;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		const value = argv[index + 1];
+		if (token === "--dry-run") {
+			dryRun = true;
+			continue;
+		}
+		if (token === "--edition") {
+			if (value === void 0 || value === "") throw new Error("--edition requires a value");
+			edition = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--exclude") {
+			if (value === void 0 || value === "") throw new Error("--exclude requires a package name");
+			exclude.push(value);
+			index += 1;
+			continue;
+		}
+		throw new Error("unknown option: " + String(token));
+	}
+	return {
+		edition,
+		exclude,
+		dryRun
+	};
+}
+/**
+* Materialize a profile without starting the server.
+*
+* The build system installs the distribution once and needs the profile on disk before it
+* snapshots the image; starting a server to create it would also start a process the image
+* must then kill.
+*
+* @param argv - arguments after the command word.
+* @returns the process exit code.
+*/
+function install(argv) {
+	if (argv.includes("--help") || argv.includes("-h")) {
+		console.log(USAGE);
+		return 0;
+	}
+	const options = parseInstallOptions(argv);
+	const paths = resolvePaths(declarationAnchor(), process.env, options.edition);
+	const created = ensureProfile(paths, options.edition, options.exclude, options.dryRun);
+	console.log((created ? "Created the " : "Using the existing ") + paths.profileName + " profile at " + paths.profileDirectory);
+	return 0;
+}
+function parseManifestOptions(argv) {
+	let distribution;
+	let out;
+	let edition = DEFAULT_EDITION;
+	const exclude = [];
+	let runtime;
+	let registry = "https://registry.npmjs.org";
+	let verify = false;
+	let check = false;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		const value = argv[index + 1];
+		if (token === "--distribution") {
+			if (value === void 0) throw new Error("--distribution requires a value");
+			distribution = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--out") {
+			if (value === void 0) throw new Error("--out requires a value");
+			out = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--edition") {
+			if (value === void 0) throw new Error("--edition requires a value");
+			edition = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--exclude") {
+			if (value === void 0) throw new Error("--exclude requires a package name");
+			exclude.push(value);
+			index += 1;
+			continue;
+		}
+		if (token === "--runtime") {
+			if (value === void 0) throw new Error("--runtime requires a value");
+			runtime = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--registry") {
+			if (value === void 0) throw new Error("--registry requires a value");
+			registry = value;
+			index += 1;
+			continue;
+		}
+		if (token === "--verify") {
+			verify = true;
+			continue;
+		}
+		if (token === "--check") {
+			check = true;
+			continue;
+		}
+		throw new Error("unknown option: " + String(token));
+	}
+	return {
+		distribution,
+		out,
+		edition,
+		exclude,
+		runtime,
+		registry,
+		verify,
+		check
+	};
+}
+/**
+* Write or verify the profile manifest a build installs.
+*
+* `--out` names the profile directory. `--check` compares what is there against a fresh
+* projection instead of writing, so a committed profile cannot drift from the distribution.
+*
+* @param argv - arguments after the command word.
+* @returns the process exit code.
+*/
+async function manifest(argv) {
+	const options = parseManifestOptions(argv);
+	const directory = options.distribution ?? resolveDistributionDirectory(declarationAnchor());
+	const facts = options.runtime === void 0 ? readDistributionFacts(directory) : {
+		...readDistributionFacts(directory),
+		runtimeVersion: options.runtime
+	};
+	const projection = projectEdition(facts, options.edition, options.exclude);
+	if (options.verify) await assertRedirectsPublished({
+		...facts.redirects,
+		...projection.omittedPackages
+	}, options.registry);
+	if (options.out === void 0) throw new Error("manifest requires --out <directory>");
+	if (options.check) {
+		const written = join(options.out, "package.json");
+		if (!existsSync(written)) throw new Error("manifest: " + written + " does not exist; run the generator");
+		const actual = JSON.parse(readFileSync(written, "utf8"));
+		const expectedDependencies = {
+			"@sparkelf/dsh-plus": facts.version,
+			"@deepseek-ai/dsh": ">=" + facts.runtimeVersion,
+			...projection.dependencies
+		};
+		const drift = [];
+		for (const [name, spec] of Object.entries(expectedDependencies)) if (actual.dependencies?.[name] !== spec) drift.push("dependency " + name);
+		for (const name of Object.keys(actual.dependencies ?? {})) if (expectedDependencies[name] === void 0) drift.push("extra dependency " + name);
+		for (const bundle of projection.bundles) if (!(actual.dsh?.profile?.bundles ?? []).includes(bundle)) drift.push("bundle " + bundle);
+		if (drift.length > 0) throw new Error("manifest: " + written + " is stale in " + drift.join(", "));
+		console.log("manifest: " + written + " matches the distribution");
+		return 0;
+	}
+	writeProfileProjection(options.out, facts, options.edition, options.exclude);
+	console.log(JSON.stringify({
+		profile: projection.profileName,
+		runtime: facts.runtimeVersion,
+		bundles: projection.bundles.length,
+		dependencies: Object.keys(projection.dependencies).length,
+		redirects: Object.keys(facts.redirects).length,
+		overrides: Object.keys(projection.overrides).length,
+		omitted: Object.keys(projection.omittedPackages)
+	}));
+	return 0;
+}
+/**
+* Print the distribution facts a build or a release gate consumes.
+*
+* @param argv - accepts `--distribution <dir>` only.
+* @returns the process exit code.
+*/
+function inspect(argv) {
+	let directory;
+	for (let index = 0; index < argv.length; index += 1) {
+		if (argv[index] !== "--distribution") throw new Error("unknown option: " + String(argv[index]));
+		directory = argv[index + 1];
+		if (directory === void 0) throw new Error("--distribution requires a value");
+		index += 1;
+	}
+	const facts = readDistributionFacts(directory ?? resolveDistributionDirectory(declarationAnchor()));
+	console.log(JSON.stringify({
+		name: facts.name,
+		version: facts.version,
+		runtime: facts.runtimeVersion,
+		profile: facts.name,
+		bundles: facts.bundles,
+		dependencies: facts.dependencies,
+		redirects: facts.redirects,
+		redirectPatch: facts.redirectIds,
+		editions: Object.entries(facts.editions).map(([id, edition]) => ({
+			id,
+			label: edition.label,
+			profile: edition.profile,
+			bundles: edition.bundles.length,
+			packages: edition.packages.length,
+			omit: edition.omit.length
+		}))
+	}, null, 2));
+	return 0;
+}
 const USAGE = [
 	"Usage: dsh-plus <command> [options]",
 	"",
 	"Commands:",
-	"  install       install an edition package manifest into the profile",
+	"  install       materialize the profile without starting the server",
+	"  manifest      write or verify the profile manifest a build installs",
+	"  inspect       print the distribution facts as JSON",
 	"  start         start the server (first run creates the profile)",
 	"  stop          stop the server",
 	"  status        report whether the server is running",
@@ -1992,16 +2434,26 @@ const USAGE = [
 	"  update        move to a newer distribution release",
 	"  doctor        check this installation",
 	"",
+	"install options:",
+	"  --edition <id>  product edition to materialize (personal, team, intranet-team)",
+	"  --exclude <pkg> drop a package and its bundle row (repeatable)",
+	"",
+	"manifest options:",
+	"  --out <dir>          profile directory to write",
+	"  --edition <id>       product edition to project (default: intranet-team)",
+	"  --exclude <pkg>      drop a package and its bundle row (repeatable)",
+	"  --runtime <version>  override the runtime version the redirects name",
+	"  --registry <url>     registry checked by --verify",
+	"  --verify             fail unless every redirect target is published",
+	"  --check              compare --out with a fresh projection instead of writing",
+	"",
 	"start options:",
 	"  --port <n>     port to prefer (default " + String(DEFAULT_PORT) + "; a taken port moves to the next free one)",
 	"  --host <h>     interface to bind (default 127.0.0.1)",
 	"  --no-open      do not open a browser",
 	"  --foreground   run in this terminal instead of in the background",
-	"  --edition <id> install the named edition manifest (personal or team)",
-	"",
-	"install options:",
-	"  --edition <id>  package manifest to install (personal or team)",
-	"  --profile <n>   profile name to install into (default: this installation)",
+	"  --edition <id> product edition to materialize",
+	"  --exclude <pkg> drop a package and its bundle row (repeatable)",
 	"",
 	"capabilities options:",
 	"  --enable <ids>   enable the comma-separated capability ids",
@@ -2025,6 +2477,8 @@ async function runStandaloneCli(argv) {
 		return 0;
 	}
 	if (command === "install") return install(rest);
+	if (command === "manifest") return await manifest(rest);
+	if (command === "inspect") return inspect(rest);
 	if (command === "start") return await start(rest);
 	if (command === "stop") return stop();
 	if (command === "status") return status();