@synopackageland/cli 0.1.0

package/README.md

@@ -0,0 +1,13 @@
+# @synopackageland/cli
+
+Syno Package Land Developer Kit CLI (`synopkgland`).
+
+```bash
+# from repository root
+npm install
+npm run build
+npx synopkgland validate --project packages/app-cli/templates/hello-web
+npx synopkgland init -t hello-web ./my-app
+```
+
+Day-to-day is `synopkgland init`. GitHub template mirrors (not product repos): [`synopkgland-hello-web`](https://github.com/synopackageland/synopkgland-hello-web) (`dsm-window`) and [`synopkgland-hello-web-page`](https://github.com/synopackageland/synopkgland-hello-web-page) (`new-page`). Curated Packaging Definitions go to [`synopkgland-community-apps`](https://github.com/synopackageland/synopkgland-community-apps).

package/dist/attestation/app-package.d.ts

@@ -0,0 +1,86 @@
+import { type JWK } from "jose";
+export declare const PLATFORM_ATTESTATION_ISSUER = "synopkgland-curated";
+export declare const APP_PACKAGE_ATTESTATION_TYP = "app-package-attestation";
+export declare const APP_PACKAGE_ATTESTATION_VERSION: 2;
+export declare const CURATED_RELEASE_ATTESTATION_TYP = "curated-release-attestation";
+export declare const CURATED_RELEASE_ATTESTATION_VERSION: 1;
+export interface AppPackageSigningKey {
+    kid: string;
+    privateKey: CryptoKey;
+}
+export interface LabAttestationKeys extends AppPackageSigningKey {
+    publicKey: CryptoKey;
+    publicJwk: JWK;
+}
+/** Inputs for the token embedded in the generated SPK. */
+export interface CuratedAppPackageAttestationInput {
+    packageIdentity: string;
+    packageVersion: string;
+    packageBuild: number;
+    contractDigest: string;
+    bundleDigest: string;
+    capabilities: string[];
+}
+/** Inputs for the detached token published beside the final SPK. */
+export interface CuratedReleaseAttestationInput {
+    packageIdentity: string;
+    packageVersion: string;
+    packageBuild: number;
+    artifactDigest: string;
+    embeddedAttestationDigest: string;
+}
+export interface AppPackageAttestationClaims {
+    typ: typeof APP_PACKAGE_ATTESTATION_TYP;
+    version: typeof APP_PACKAGE_ATTESTATION_VERSION;
+    packageIdentity: string;
+    packageVersion: string;
+    packageBuild: number;
+    contractDigest: string;
+    bundleDigest: string;
+    capabilities: string[];
+    issuedAt: string;
+}
+export interface CuratedReleaseAttestationClaims {
+    typ: typeof CURATED_RELEASE_ATTESTATION_TYP;
+    version: typeof CURATED_RELEASE_ATTESTATION_VERSION;
+    packageIdentity: string;
+    packageVersion: string;
+    packageBuild: number;
+    artifactDigest: string;
+    embeddedAttestationDigest: string;
+    issuedAt: string;
+}
+export declare function loadOrCreateLabAttestationKeys(filePath: string): Promise<LabAttestationKeys>;
+/**
+ * Sign the local development token used by the inner-loop flow.
+ * Curated releases must use the v2 function below and never this helper.
+ */
+export declare function signAppPackageAttestationToken(input: {
+    packageIdentity: string;
+    contractDigest: string;
+    bundleDigest: string;
+    capabilities: string[];
+}, keys: LabAttestationKeys): Promise<{
+    token: string;
+    attestationDigest: string;
+}>;
+/** Sign the v2 App Package Attestation embedded in a Curated SPK. */
+export declare function signCuratedAppPackageAttestationToken(input: CuratedAppPackageAttestationInput, key: AppPackageSigningKey): Promise<{
+    token: string;
+    attestationDigest: string;
+    claims: AppPackageAttestationClaims;
+}>;
+/** Sign the v1 detached release attestation for a final SPK archive. */
+export declare function signCuratedReleaseAttestationToken(input: CuratedReleaseAttestationInput, key: AppPackageSigningKey): Promise<{
+    token: string;
+    attestationDigest: string;
+    claims: CuratedReleaseAttestationClaims;
+}>;
+/** Stable JSON representation used by the embedded token's jti binding. */
+export declare function canonicalAppPackageClaims(claims: AppPackageAttestationClaims): string;
+export declare function digestAppPackageClaims(claims: AppPackageAttestationClaims): string;
+/** Stable JSON representation used by the detached token's jti binding. */
+export declare function canonicalCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
+export declare function digestCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
+export declare function normalizeCapabilities(capabilities: string[]): string[];
+export declare function assertPackageVersionBinding(packageVersion: string, packageBuild: number): void;

package/dist/attestation/app-package.js

@@ -0,0 +1,199 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { SignJWT, exportJWK, generateKeyPair, importJWK } from "jose";
+export const PLATFORM_ATTESTATION_ISSUER = "synopkgland-curated";
+export const APP_PACKAGE_ATTESTATION_TYP = "app-package-attestation";
+export const APP_PACKAGE_ATTESTATION_VERSION = 2;
+export const CURATED_RELEASE_ATTESTATION_TYP = "curated-release-attestation";
+export const CURATED_RELEASE_ATTESTATION_VERSION = 1;
+export async function loadOrCreateLabAttestationKeys(filePath) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    if (existsSync(filePath)) {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        return {
+            kid: parsed.kid,
+            privateKey: (await importJWK(parsed.privateJwk, "RS256")),
+            publicKey: (await importJWK(parsed.publicJwk, "RS256")),
+            publicJwk: parsed.publicJwk,
+        };
+    }
+    const { publicKey, privateKey } = await generateKeyPair("RS256", { extractable: true });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    const kid = createHash("sha256").update(JSON.stringify(publicJwk)).digest("hex").slice(0, 16);
+    publicJwk.kid = kid;
+    privateJwk.kid = kid;
+    writeFileSync(filePath, `${JSON.stringify({ kid, privateJwk, publicJwk }, null, 2)}\n`, { mode: 0o600 });
+    return { kid, privateKey, publicKey, publicJwk };
+}
+/**
+ * Sign the local development token used by the inner-loop flow.
+ * Curated releases must use the v2 function below and never this helper.
+ */
+export async function signAppPackageAttestationToken(input, keys) {
+    const claims = {
+        typ: APP_PACKAGE_ATTESTATION_TYP,
+        version: 1,
+        packageIdentity: input.packageIdentity,
+        contractDigest: input.contractDigest,
+        bundleDigest: input.bundleDigest,
+        capabilities: normalizeCapabilities(input.capabilities),
+        issuedAt: new Date().toISOString(),
+    };
+    const canonical = JSON.stringify({
+        artifactDigest: null,
+        bundleDigest: claims.bundleDigest,
+        capabilities: claims.capabilities,
+        contractDigest: claims.contractDigest,
+        issuedAt: claims.issuedAt,
+        packageBuild: null,
+        packageIdentity: claims.packageIdentity,
+        typ: claims.typ,
+        version: claims.version,
+    });
+    const attestationDigest = sha256(canonical);
+    const token = await signClaims(claims, keys, attestationDigest);
+    return { token, attestationDigest };
+}
+/** Sign the v2 App Package Attestation embedded in a Curated SPK. */
+export async function signCuratedAppPackageAttestationToken(input, key) {
+    assertCuratedAppPackageInput(input);
+    const claims = {
+        typ: APP_PACKAGE_ATTESTATION_TYP,
+        version: APP_PACKAGE_ATTESTATION_VERSION,
+        packageIdentity: input.packageIdentity,
+        packageVersion: input.packageVersion,
+        packageBuild: input.packageBuild,
+        contractDigest: input.contractDigest,
+        bundleDigest: input.bundleDigest,
+        capabilities: normalizeCapabilities(input.capabilities),
+        issuedAt: new Date().toISOString(),
+    };
+    const attestationDigest = digestAppPackageClaims(claims);
+    const token = await signClaims(claims, key, attestationDigest);
+    return { token, attestationDigest, claims };
+}
+/** Sign the v1 detached release attestation for a final SPK archive. */
+export async function signCuratedReleaseAttestationToken(input, key) {
+    assertCuratedReleaseInput(input);
+    const claims = {
+        typ: CURATED_RELEASE_ATTESTATION_TYP,
+        version: CURATED_RELEASE_ATTESTATION_VERSION,
+        packageIdentity: input.packageIdentity,
+        packageVersion: input.packageVersion,
+        packageBuild: input.packageBuild,
+        artifactDigest: input.artifactDigest,
+        embeddedAttestationDigest: input.embeddedAttestationDigest,
+        issuedAt: new Date().toISOString(),
+    };
+    const attestationDigest = digestCuratedReleaseClaims(claims);
+    const token = await signClaims(claims, key, attestationDigest);
+    return { token, attestationDigest, claims };
+}
+/** Stable JSON representation used by the embedded token's jti binding. */
+export function canonicalAppPackageClaims(claims) {
+    return JSON.stringify({
+        bundleDigest: claims.bundleDigest,
+        capabilities: normalizeCapabilities(claims.capabilities),
+        contractDigest: claims.contractDigest,
+        issuedAt: claims.issuedAt,
+        packageBuild: claims.packageBuild,
+        packageIdentity: claims.packageIdentity,
+        packageVersion: claims.packageVersion,
+        typ: claims.typ,
+        version: claims.version,
+    });
+}
+export function digestAppPackageClaims(claims) {
+    return sha256(canonicalAppPackageClaims(claims));
+}
+/** Stable JSON representation used by the detached token's jti binding. */
+export function canonicalCuratedReleaseClaims(claims) {
+    return JSON.stringify({
+        artifactDigest: claims.artifactDigest,
+        embeddedAttestationDigest: claims.embeddedAttestationDigest,
+        issuedAt: claims.issuedAt,
+        packageBuild: claims.packageBuild,
+        packageIdentity: claims.packageIdentity,
+        packageVersion: claims.packageVersion,
+        typ: claims.typ,
+        version: claims.version,
+    });
+}
+export function digestCuratedReleaseClaims(claims) {
+    return sha256(canonicalCuratedReleaseClaims(claims));
+}
+export function normalizeCapabilities(capabilities) {
+    if (!Array.isArray(capabilities)) {
+        throw new Error("capabilities must be an array");
+    }
+    const normalized = new Set();
+    for (const capability of capabilities) {
+        if (typeof capability !== "string" || capability.length === 0) {
+            throw new Error("capabilities must contain non-empty strings");
+        }
+        normalized.add(capability);
+    }
+    return [...normalized].sort();
+}
+export function assertPackageVersionBinding(packageVersion, packageBuild) {
+    if (typeof packageVersion !== "string" || packageVersion.length === 0) {
+        throw new Error("packageVersion must be a non-empty string");
+    }
+    const match = /-(\d+)$/.exec(packageVersion);
+    if (!match || Number(match[1]) !== packageBuild) {
+        throw new Error("packageVersion and packageBuild must agree");
+    }
+}
+async function signClaims(claims, key, attestationDigest) {
+    if (typeof key.kid !== "string" || key.kid.length === 0) {
+        throw new Error("attestation signing key kid is required");
+    }
+    const packageIdentity = claims.packageIdentity;
+    if (typeof packageIdentity !== "string") {
+        throw new Error("attestation package identity is required");
+    }
+    return new SignJWT({ ...claims })
+        .setProtectedHeader({ alg: "RS256", kid: key.kid, typ: "JWT" })
+        .setIssuer(PLATFORM_ATTESTATION_ISSUER)
+        .setSubject(packageIdentity)
+        .setJti(attestationDigest)
+        .sign(key.privateKey);
+}
+function assertCuratedAppPackageInput(input) {
+    assertIdentityAndVersion(input.packageIdentity, input.packageVersion);
+    assertPackageBuild(input.packageBuild);
+    assertPackageVersionBinding(input.packageVersion, input.packageBuild);
+    assertSha256Digest(input.contractDigest, "contractDigest");
+    assertSha256Digest(input.bundleDigest, "bundleDigest");
+    normalizeCapabilities(input.capabilities);
+}
+function assertCuratedReleaseInput(input) {
+    assertIdentityAndVersion(input.packageIdentity, input.packageVersion);
+    assertPackageBuild(input.packageBuild);
+    assertPackageVersionBinding(input.packageVersion, input.packageBuild);
+    assertSha256Digest(input.artifactDigest, "artifactDigest");
+    assertSha256Digest(input.embeddedAttestationDigest, "embeddedAttestationDigest");
+}
+function assertIdentityAndVersion(packageIdentity, packageVersion) {
+    if (typeof packageIdentity !== "string" || packageIdentity.trim().length === 0) {
+        throw new Error("packageIdentity must be a non-empty string");
+    }
+    if (typeof packageVersion !== "string" || packageVersion.trim().length === 0) {
+        throw new Error("packageVersion must be a non-empty string");
+    }
+}
+function assertPackageBuild(packageBuild) {
+    if (!Number.isSafeInteger(packageBuild) || packageBuild < 1) {
+        throw new Error("packageBuild must be a positive safe integer");
+    }
+}
+function assertSha256Digest(value, name) {
+    if (!/^[a-f0-9]{64}$/.test(value)) {
+        throw new Error(`${name} must be a lowercase SHA-256 digest`);
+    }
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}

package/dist/attestation/install-on-host.d.ts

@@ -0,0 +1,14 @@
+import type { JWK } from "jose";
+import type { HostCredentials } from "../host/types.js";
+export declare function loginDsmCookie(credentials: HostCredentials): Promise<string>;
+export declare function installAppPackageAttestationOnNas(options: {
+    credentials: HostCredentials;
+    token: string;
+    publicJwk: JWK;
+}): Promise<{
+    ok: boolean;
+    status: number;
+    code?: string;
+    message?: string;
+    kind?: string;
+}>;

package/dist/attestation/install-on-host.js

@@ -0,0 +1,52 @@
+import { IDENTITY_CGI_PATH } from "../host/broker-paths.js";
+export async function loginDsmCookie(credentials) {
+    const dsmOrigin = credentials.dsmOrigin.replace(/\/$/, "");
+    const query = new URLSearchParams({
+        api: "SYNO.API.Auth",
+        version: "3",
+        method: "login",
+        account: credentials.username,
+        passwd: credentials.password,
+        session: "FileStation",
+        format: "cookie",
+    });
+    const response = await fetch(`${dsmOrigin}/webapi/entry.cgi?${query.toString()}`);
+    const setCookie = typeof response.headers.getSetCookie === "function"
+        ? response.headers.getSetCookie()
+        : response.headers.get("set-cookie")
+            ? [response.headers.get("set-cookie")]
+            : [];
+    return setCookie
+        .map((line) => line.split(";")[0]?.trim())
+        .filter((pair) => Boolean(pair))
+        .join("; ");
+}
+export async function installAppPackageAttestationOnNas(options) {
+    const dsmOrigin = options.credentials.dsmOrigin.replace(/\/$/, "");
+    const cookie = await loginDsmCookie(options.credentials);
+    const response = await fetch(`${dsmOrigin}${IDENTITY_CGI_PATH}/api/v1/inner-loop/accept-app-package`, {
+        method: "POST",
+        headers: {
+            cookie,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({ token: options.token, publicJwk: options.publicJwk }),
+    });
+    const text = await response.text();
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, status: response.status, code: "INNER_LOOP_API_MISSING", message: text.slice(0, 200) };
+    }
+    if (!response.ok) {
+        return {
+            ok: false,
+            status: response.status,
+            code: body.error?.code,
+            message: body.error?.message,
+        };
+    }
+    return { ok: true, status: response.status, kind: body.kind };
+}

package/dist/attestation/keyring.d.ts

@@ -0,0 +1,21 @@
+import { type JWK } from "jose";
+export declare const CURATED_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING_PATH";
+export declare const CURATED_ATTESTATION_KEYRING_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING";
+export type CuratedTrustRootStatus = "active" | "verify-only" | "revoked";
+export type CuratedTrustRootErrorCode = "CURATED_TRUST_ROOT_MISSING" | "CURATED_TRUST_ROOT_INVALID" | "CURATED_SIGNING_KEY_UNKNOWN" | "CURATED_SIGNING_KEY_REVOKED" | "CURATED_SIGNING_KEY_NOT_ACTIVE" | "CURATED_SIGNING_KEY_MISMATCH";
+export interface CuratedTrustRootEntry {
+    kid: string;
+    status: CuratedTrustRootStatus;
+    publicJwk: JWK;
+}
+export interface CuratedTrustRoot {
+    version: 1;
+    keys: CuratedTrustRootEntry[];
+}
+export declare class CuratedTrustRootError extends Error {
+    readonly code: CuratedTrustRootErrorCode;
+    constructor(code: CuratedTrustRootErrorCode, message?: string);
+}
+export declare function loadCuratedTrustRoot(env?: NodeJS.Dict<string>): Promise<CuratedTrustRoot>;
+export declare function parseCuratedTrustRoot(value: unknown): CuratedTrustRoot;
+export declare function resolveCuratedSigningTrust(root: CuratedTrustRoot, kid: string, signingPublicJwk: JWK): Promise<CryptoKey>;

package/dist/attestation/keyring.js

@@ -0,0 +1,168 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { importJWK } from "jose";
+export const CURATED_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING_PATH";
+export const CURATED_ATTESTATION_KEYRING_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING";
+const TRUST_ROOT_FIELDS = new Set(["version", "keys"]);
+const TRUST_ROOT_ENTRY_FIELDS = new Set(["kid", "status", "publicJwk"]);
+const PUBLIC_JWK_FIELDS = new Set([
+    "kty",
+    "n",
+    "e",
+    "alg",
+    "use",
+    "key_ops",
+    "kid",
+    "x5c",
+    "x5t",
+    "x5t#S256",
+]);
+export class CuratedTrustRootError extends Error {
+    code;
+    constructor(code, message = code) {
+        super(message);
+        this.code = code;
+        this.name = "CuratedTrustRootError";
+    }
+}
+export async function loadCuratedTrustRoot(env = process.env) {
+    const rawFromEnv = env[CURATED_ATTESTATION_KEYRING_ENV]?.trim();
+    const pathFromEnv = env[CURATED_ATTESTATION_KEYRING_PATH_ENV]?.trim();
+    if (rawFromEnv && pathFromEnv) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Configure either the curated public keyring JSON or its path, not both.");
+    }
+    if (!rawFromEnv && !pathFromEnv) {
+        throw trustRootError("CURATED_TRUST_ROOT_MISSING", "The release signing custody contract requires a curated public keyring.");
+    }
+    let raw;
+    try {
+        raw = rawFromEnv ?? readFileSync(resolve(pathFromEnv), "utf8");
+    }
+    catch {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Unable to read the curated public keyring.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring is not valid JSON.");
+    }
+    return parseCuratedTrustRoot(parsed);
+}
+export function parseCuratedTrustRoot(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring must be an object.");
+    }
+    const record = value;
+    if (containsPrivateJwkField(record)) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains private RSA material.");
+    }
+    assertKnownFields(record, TRUST_ROOT_FIELDS, "The curated public keyring");
+    if (record.version !== 1 || !Array.isArray(record.keys)) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring must use schema version 1.");
+    }
+    const seen = new Set();
+    const keys = [];
+    for (const rawEntry of record.keys) {
+        if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+            throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains a malformed entry.");
+        }
+        const entry = rawEntry;
+        assertKnownFields(entry, TRUST_ROOT_ENTRY_FIELDS, "The curated public keyring entry");
+        if (typeof entry.kid !== "string" ||
+            entry.kid.length === 0 ||
+            seen.has(entry.kid) ||
+            (entry.status !== "active" && entry.status !== "verify-only" && entry.status !== "revoked") ||
+            !entry.publicJwk ||
+            typeof entry.publicJwk !== "object" ||
+            Array.isArray(entry.publicJwk)) {
+            throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains an invalid entry.");
+        }
+        seen.add(entry.kid);
+        const publicJwk = entry.publicJwk;
+        validatePublicJwk(publicJwk, entry.kid);
+        keys.push({ kid: entry.kid, status: entry.status, publicJwk });
+    }
+    return { version: 1, keys };
+}
+export async function resolveCuratedSigningTrust(root, kid, signingPublicJwk) {
+    if (root.keys.length === 0) {
+        throw trustRootError("CURATED_TRUST_ROOT_MISSING", "The curated public keyring contains no trusted keys.");
+    }
+    const entry = root.keys.find((candidate) => candidate.kid === kid);
+    if (!entry) {
+        throw trustRootError("CURATED_SIGNING_KEY_UNKNOWN", `The signing kid is not in the curated keyring: ${kid}`);
+    }
+    if (entry.status === "revoked") {
+        throw trustRootError("CURATED_SIGNING_KEY_REVOKED", `The signing kid is revoked: ${kid}`);
+    }
+    if (entry.status !== "active") {
+        throw trustRootError("CURATED_SIGNING_KEY_NOT_ACTIVE", `The signing kid is not active: ${kid}`);
+    }
+    if (signingPublicJwk.kty !== entry.publicJwk.kty ||
+        signingPublicJwk.n !== entry.publicJwk.n ||
+        signingPublicJwk.e !== entry.publicJwk.e) {
+        throw trustRootError("CURATED_SIGNING_KEY_MISMATCH", `The signing material does not match curated kid: ${kid}`);
+    }
+    try {
+        return (await importJWK(entry.publicJwk, "RS256"));
+    }
+    catch {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring key could not be imported.");
+    }
+}
+function validatePublicJwk(jwk, expectedKid) {
+    if (!jwk || typeof jwk !== "object") {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated key is not a JWK object.");
+    }
+    const record = jwk;
+    if (containsPrivateJwkField(record)) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated keyring contains private RSA material.");
+    }
+    assertKnownFields(record, PUBLIC_JWK_FIELDS, "Curated trust-root JWK");
+    if (record.kty !== "RSA" ||
+        typeof record.n !== "string" ||
+        typeof record.e !== "string" ||
+        record.alg !== "RS256" ||
+        record.kid !== expectedKid) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys must be public RS256 RSA JWKs with matching kid.");
+    }
+    if (record.use !== undefined && record.use !== "sig") {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys must use sig.");
+    }
+    if (record.key_ops !== undefined &&
+        (!Array.isArray(record.key_ops) ||
+            record.key_ops.length === 0 ||
+            new Set(record.key_ops).size !== record.key_ops.length ||
+            record.key_ops.some((operation) => operation !== "verify"))) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys may only verify signatures.");
+    }
+    if (record.x5c !== undefined &&
+        (!Array.isArray(record.x5c) || record.x5c.some((certificate) => typeof certificate !== "string"))) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root x5c must be an array of strings.");
+    }
+    if ((record.x5t !== undefined && typeof record.x5t !== "string") ||
+        (record["x5t#S256"] !== undefined && typeof record["x5t#S256"] !== "string")) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root thumbprints must be strings.");
+    }
+}
+function containsPrivateJwkField(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    if (Array.isArray(value)) {
+        return value.some((item) => containsPrivateJwkField(item));
+    }
+    const record = value;
+    return ["d", "p", "q", "dp", "dq", "qi", "oth"].some((field) => Object.prototype.hasOwnProperty.call(record, field)) || Object.values(record).some((nested) => containsPrivateJwkField(nested));
+}
+function assertKnownFields(record, allowed, label) {
+    const unknown = Object.keys(record).find((key) => !allowed.has(key));
+    if (unknown) {
+        throw trustRootError("CURATED_TRUST_ROOT_INVALID", `${label} contains unknown field: ${unknown}`);
+    }
+}
+function trustRootError(code, message) {
+    return new CuratedTrustRootError(code, message);
+}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { loadDotEnv } from "./load-env.js";
+import { runCli } from "./cli.js";
+import { runCuratedReleaseCli } from "./publish/curated-release.js";
+loadDotEnv();
+const execution = process.argv[2] === "release"
+    ? runCuratedReleaseCli(process.argv)
+    : runCli(process.argv).then(() => 0);
+execution.then((status) => {
+    process.exitCode = status;
+}).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/build-spk/dsm-arch.d.ts

@@ -0,0 +1,4 @@
+export type NativeArchFamily = "x86_64" | "aarch64";
+export declare const NATIVE_ARCH_PLATFORMS: Record<NativeArchFamily, readonly string[]>;
+export declare function isNativeArchFamily(value: string): value is NativeArchFamily;
+export declare function infoArchValue(family: NativeArchFamily): string;

package/dist/build-spk/dsm-arch.js

@@ -0,0 +1,32 @@
+export const NATIVE_ARCH_PLATFORMS = {
+    x86_64: [
+        "apollolake",
+        "avoton",
+        "braswell",
+        "broadwell",
+        "broadwellnk",
+        "broadwellnkv2",
+        "broadwellntbap",
+        "bromolow",
+        "cedarview",
+        "denverton",
+        "epyc7002",
+        "geminilake",
+        "geminilakenk",
+        "grantley",
+        "icelaked",
+        "kvmx64",
+        "purley",
+        "r1000",
+        "r1000nk",
+        "v1000",
+        "v1000nk",
+    ],
+    aarch64: ["armada37xx", "rtd1296", "rtd1619b"],
+};
+export function isNativeArchFamily(value) {
+    return value === "x86_64" || value === "aarch64";
+}
+export function infoArchValue(family) {
+    return NATIVE_ARCH_PLATFORMS[family].join(" ");
+}

package/dist/build-spk/dsm-icons.d.ts

@@ -0,0 +1,2 @@
+export declare function writeDsmWindowIcons(uiDir: string): void;
+export declare function writePackageCenterIcons(spkRoot: string): void;