@synopackageland/cli 0.1.0 → 0.2.0

package/dist/publish/curated-release.js

@@ -10,6 +10,8 @@ import { digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabiliti
 import { CuratedTrustRootError, loadCuratedTrustRoot, resolveCuratedSigningTrust, } from "../attestation/keyring.js";
 import { loadContract } from "../contract/load.js";
 import { loadCompose } from "../compose/analyze.js";
+import { loadNative } from "../native/load.js";
+import { infoArchValue, isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { EMBEDDED_ATTESTATION_RELATIVE_PATH, buildSpk, extractSpk, } from "../build-spk/generator.js";
 import { findProjectRoot } from "../discovery.js";
 import { validateProject } from "../validate.js";
@@ -112,95 +114,172 @@ export async function releaseCurated(options) {
         const workspace = mkdtempSync(join(tmpdir(), "synopkgland-curated-release-"));
         try {
             const releaseProject = copyReleaseProject(options.project, workspace, packageIdentity);
-            const outputPath = join(workspace, `${packageIdentity}.spk`);
             const buildFn = options.buildSpk ?? buildSpk;
-            const built = await buildFn({
-                project: releaseProject,
-                outputPath,
-                packageIdentity,
-                displayname: prepared.displayname,
-                spkVersion: prepared.version,
-                embeddedAttestationToken: embedded.token,
-            });
-            if (!built.ok || !built.outputPath) {
-                throw new CuratedReleaseError("CURATED_BUILD_FAILED");
-            }
-            await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
-            const artifact = digestArtifact(built.outputPath);
             if (!options.signer.signRelease) {
                 throw new CuratedReleaseError("CURATED_RELEASE_SIGNER_MISSING");
             }
-            const detachedInput = {
-                packageIdentity,
-                packageVersion: prepared.version,
-                packageBuild: options.build,
-                artifactDigest: artifact.sha256,
-                embeddedAttestationDigest: embedded.attestationDigest,
-            };
-            let detached;
-            try {
-                detached = await options.signer.signRelease(detachedInput);
-            }
-            catch (error) {
-                if (error instanceof CuratedReleaseError) {
-                    throw error;
-                }
-                throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-            }
-            assertDetachedAttestation(detached, detachedInput);
-            await verifySignedToken(options.signer, detached.token, "release");
-            const artifactKey = buildImmutableSpkKey({
-                package: packageIdentity,
-                version: prepared.version,
-                sha256: artifact.sha256,
-            });
-            const attestationKey = buildImmutableAttestationKey({
-                package: packageIdentity,
-                version: prepared.version,
-                artifactDigest: artifact.sha256,
-            });
-            const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
             if (!options.signer.verificationJwk) {
                 throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
             }
-            const attestation = {
-                packageId: packageIdentity,
-                version: prepared.version,
-                packageBuild: options.build,
-                artifactDigest: artifact.sha256,
-                embeddedAttestationDigest: embedded.attestationDigest,
-                key: attestationKey,
-                token: detached.token,
-                digest: detached.attestationDigest,
-                tokenSha256,
-                verificationJwk: options.signer.verificationJwk,
-            };
-            const index = {
-                packageId: packageIdentity,
-                version: prepared.version,
-                displayname: prepared.displayname,
-                description: prepared.description,
-                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
-                osMinVer: prepared.osMinVer,
-                artifact: {
-                    key: artifactKey,
-                    size: artifact.size,
-                    md5: artifact.md5,
+            if (!prepared.isNative) {
+                // Compose single-artifact release
+                const outputPath = join(workspace, `${packageIdentity}.spk`);
+                const built = await buildFn({
+                    project: releaseProject,
+                    outputPath,
+                    packageIdentity,
+                    displayname: prepared.displayname,
+                    spkVersion: prepared.version,
+                    embeddedAttestationToken: embedded.token,
+                });
+                if (!built.ok || !built.outputPath) {
+                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
+                }
+                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
+                const artifact = digestArtifact(built.outputPath);
+                const detachedInput = {
+                    packageIdentity,
+                    packageVersion: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                };
+                let detached;
+                try {
+                    detached = await options.signer.signRelease(detachedInput);
+                }
+                catch (error) {
+                    if (error instanceof CuratedReleaseError) {
+                        throw error;
+                    }
+                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+                }
+                assertDetachedAttestation(detached, detachedInput);
+                await verifySignedToken(options.signer, detached.token, "release");
+                const artifactKey = buildImmutableSpkKey({
+                    package: packageIdentity,
+                    version: prepared.version,
                     sha256: artifact.sha256,
-                },
-                attestation: {
+                });
+                const attestationKey = buildImmutableAttestationKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    artifactDigest: artifact.sha256,
+                });
+                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
+                const attestation = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
                     key: attestationKey,
+                    token: detached.token,
                     digest: detached.attestationDigest,
+                    tokenSha256,
+                    verificationJwk: options.signer.verificationJwk,
+                };
+                const index = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    displayname: prepared.displayname,
+                    description: prepared.description,
+                    ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
+                    osMinVer: prepared.osMinVer,
+                    artifact: {
+                        key: artifactKey,
+                        size: artifact.size,
+                        md5: artifact.md5,
+                        sha256: artifact.sha256,
+                    },
+                    attestation: {
+                        key: attestationKey,
+                        digest: detached.attestationDigest,
+                        packageBuild: options.build,
+                        artifactDigest: artifact.sha256,
+                        embeddedAttestationDigest: embedded.attestationDigest,
+                    },
+                };
+                // This is the only transition to external publication. Both tokens have
+                // been claim-checked, signature-checked when the signer supplies a key,
+                // and the embedded token was read back from the final SPK first.
+                await publishCuratedRelease({
+                    artifact: {
+                        packageId: packageIdentity,
+                        version: prepared.version,
+                        path: built.outputPath,
+                        key: artifactKey,
+                        size: artifact.size,
+                        md5: artifact.md5,
+                        sha256: artifact.sha256,
+                    },
+                    attestation,
+                    index,
+                }, options.publisher);
+                return {
+                    packageIdentity,
                     packageBuild: options.build,
+                    version: prepared.version,
+                    artifactKey,
                     artifactDigest: artifact.sha256,
+                    attestationKey,
                     embeddedAttestationDigest: embedded.attestationDigest,
-                },
-            };
-            // This is the only transition to external publication. Both tokens have
-            // been claim-checked, signature-checked when the signer supplies a key,
-            // and the embedded token was read back from the final SPK first.
-            await publishCuratedRelease({
-                artifact: {
+                    attestationDigest: detached.attestationDigest,
+                };
+            }
+            // Native multi-arch release (1 Build -> N artifacts)
+            const targetFamilies = Object.keys(prepared.native?.targets ?? {}).filter(isNativeArchFamily);
+            if (targetFamilies.length === 0) {
+                throw new CuratedReleaseError("CURATED_NATIVE_TARGETS_EMPTY");
+            }
+            const builtArches = [];
+            for (const family of targetFamilies) {
+                const outputPath = join(workspace, `${packageIdentity}-${family}.spk`);
+                const built = await buildFn({
+                    project: releaseProject,
+                    outputPath,
+                    packageIdentity,
+                    displayname: prepared.displayname,
+                    spkVersion: prepared.version,
+                    embeddedAttestationToken: embedded.token,
+                    archFamily: family,
+                });
+                if (!built.ok || !built.outputPath) {
+                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
+                }
+                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
+                const artifact = digestArtifact(built.outputPath);
+                const detachedInput = {
+                    packageIdentity,
+                    packageVersion: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                };
+                let detached;
+                try {
+                    detached = await options.signer.signRelease(detachedInput);
+                }
+                catch (error) {
+                    if (error instanceof CuratedReleaseError) {
+                        throw error;
+                    }
+                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+                }
+                assertDetachedAttestation(detached, detachedInput);
+                await verifySignedToken(options.signer, detached.token, "release");
+                const artifactKey = buildImmutableSpkKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    sha256: artifact.sha256,
+                });
+                const attestationKey = buildImmutableAttestationKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    artifactDigest: artifact.sha256,
+                });
+                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
+                const releaseArtifact = {
                     packageId: packageIdentity,
                     version: prepared.version,
                     path: built.outputPath,
@@ -208,19 +287,89 @@ export async function releaseCurated(options) {
                     size: artifact.size,
                     md5: artifact.md5,
                     sha256: artifact.sha256,
+                };
+                const releaseAttestation = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                    key: attestationKey,
+                    token: detached.token,
+                    digest: detached.attestationDigest,
+                    tokenSha256,
+                    verificationJwk: options.signer.verificationJwk,
+                };
+                const archPlatforms = infoArchValue(family).split(" ");
+                const archArtifact = {
+                    key: artifactKey,
+                    size: artifact.size,
+                    md5: artifact.md5,
+                    sha256: artifact.sha256,
+                    arch: archPlatforms,
+                    attestation: {
+                        key: attestationKey,
+                        digest: detached.attestationDigest,
+                        packageBuild: options.build,
+                        artifactDigest: artifact.sha256,
+                        embeddedAttestationDigest: embedded.attestationDigest,
+                    },
+                };
+                builtArches.push({
+                    family,
+                    outputPath: built.outputPath,
+                    artifact,
+                    artifactKey,
+                    attestationKey,
+                    detached,
+                    tokenSha256,
+                    releaseArtifact,
+                    releaseAttestation,
+                    archArtifact,
+                });
+            }
+            const primary = builtArches[0];
+            const allArchs = targetFamilies.flatMap((family) => infoArchValue(family).split(" "));
+            const indexPayload = {
+                packageId: packageIdentity,
+                version: prepared.version,
+                displayname: prepared.displayname,
+                description: prepared.description,
+                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
+                osMinVer: prepared.osMinVer,
+                arch: allArchs,
+                artifact: {
+                    key: primary.artifactKey,
+                    size: primary.artifact.size,
+                    md5: primary.artifact.md5,
+                    sha256: primary.artifact.sha256,
+                },
+                attestation: {
+                    key: primary.attestationKey,
+                    digest: primary.detached.attestationDigest,
+                    packageBuild: options.build,
+                    artifactDigest: primary.artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
                 },
-                attestation,
-                index,
-            }, options.publisher);
+                artifacts: builtArches.map((item) => item.archArtifact),
+            };
+            // 5. Publication order: all artifacts -> all detached attestations -> index
+            for (const item of builtArches) {
+                await options.publisher.uploadArtifact(item.releaseArtifact);
+            }
+            for (const item of builtArches) {
+                await options.publisher.uploadAttestation(item.releaseAttestation);
+            }
+            await options.publisher.updateIndex(indexPayload);
             return {
                 packageIdentity,
                 packageBuild: options.build,
                 version: prepared.version,
-                artifactKey,
-                artifactDigest: artifact.sha256,
-                attestationKey,
+                artifactKey: primary.artifactKey,
+                artifactDigest: primary.artifact.sha256,
+                attestationKey: primary.attestationKey,
                 embeddedAttestationDigest: embedded.attestationDigest,
-                attestationDigest: detached.attestationDigest,
+                attestationDigest: primary.detached.attestationDigest,
             };
         }
         finally {
@@ -352,6 +501,25 @@ function prepareRelease(project, build) {
     if (!validation.ok) {
         throw new CuratedReleaseError("CURATED_VALIDATION_FAILED", validation.errors.map((error) => error.code).join(","));
     }
+    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
+    const isNative = existsSync(nativePath);
+    if (isNative) {
+        const parsedNative = loadNative(nativePath);
+        if (!parsedNative) {
+            throw new CuratedReleaseError("CURATED_NATIVE_MISSING");
+        }
+        return {
+            isNative: true,
+            contract,
+            native: parsedNative.native,
+            packageIdentity,
+            version,
+            displayname: String(contract.displayname),
+            description: String(contract.description),
+            maintainer: typeof contract.maintainer === "string" ? contract.maintainer : undefined,
+            osMinVer: String(contract.os_min_ver),
+        };
+    }
     const parsedCompose = loadCompose(project.composePath);
     if (!parsedCompose) {
         throw new CuratedReleaseError("CURATED_COMPOSE_MISSING");
@@ -361,6 +529,7 @@ function prepareRelease(project, build) {
         throw new CuratedReleaseError("CURATED_COMPOSE_GATE_FAILED", composeGate.errors.join(","));
     }
     return {
+        isNative: false,
         contract,
         compose: parsedCompose.compose,
         packageIdentity,
@@ -376,15 +545,22 @@ function copyReleaseProject(source, workspace, packageIdentity) {
     mkdirSync(root, { recursive: true });
     const contractPath = join(root, "synology-app.yaml");
     const composePath = join(root, "compose.yaml");
+    const nativePath = join(root, "native.yaml");
     writeFileSync(contractPath, readFileSync(source.contractPath));
-    writeFileSync(composePath, readFileSync(source.composePath));
+    if (existsSync(source.composePath)) {
+        writeFileSync(composePath, readFileSync(source.composePath));
+    }
+    const srcNative = source.nativePath ?? join(source.root, "native.yaml");
+    if (existsSync(srcNative)) {
+        writeFileSync(nativePath, readFileSync(srcNative));
+    }
     for (const name of ["icon.png", "README.md", "html"]) {
         const sourcePath = join(source.root, name);
         if (existsSync(sourcePath)) {
             cpSync(sourcePath, join(root, name), { recursive: true });
         }
     }
-    return { root, contractPath, composePath };
+    return { root, contractPath, composePath, nativePath };
 }
 function digestArtifact(path) {
     const bytes = readFileSync(path);
@@ -403,11 +579,21 @@ function digestFile(path) {
  */
 export function digestReleaseBundle(project) {
     const files = [];
-    for (const name of ["compose.yaml", "synology-app.yaml"]) {
-        if (!existsSync(join(project.root, name)) || !statSync(join(project.root, name)).isFile()) {
-            throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", name);
-        }
-        files.push(name);
+    if (!existsSync(project.contractPath) || !statSync(project.contractPath).isFile()) {
+        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "synology-app.yaml");
+    }
+    files.push("synology-app.yaml");
+    const hasCompose = existsSync(project.composePath) && statSync(project.composePath).isFile();
+    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
+    const hasNative = existsSync(nativePath) && statSync(nativePath).isFile();
+    if (!hasCompose && !hasNative) {
+        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "compose.yaml");
+    }
+    if (hasCompose) {
+        files.push("compose.yaml");
+    }
+    if (hasNative) {
+        files.push("native.yaml");
     }
     const htmlRoot = join(project.root, "html");
     if (existsSync(htmlRoot)) {
@@ -453,7 +639,7 @@ function collectCapabilities(contract, compose) {
             capabilities.push(`install.${name}:${parameter.type}`);
         }
     }
-    if (Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
+    if (compose && Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
         capabilities.push("compose.privileged");
     }
     return normalizeCapabilities(capabilities);

package/dist/templates/native/native.yaml

@@ -0,0 +1,16 @@
+schema: 1
+
+targets:
+  x86_64:
+    path: ./dist/app-x86_64.tar.gz
+    strip_components: 1
+  aarch64:
+    path: ./dist/app-aarch64.tar.gz
+    strip_components: 1
+
+service:
+  exec: bin/app
+  args:
+    - "-data=${SYNOPKG_PKGVAR}"
+  env:
+    TMPDIR: ${SYNOPKG_PKGVAR}/tmp

package/dist/templates/native/synology-app.yaml

@@ -0,0 +1,7 @@
+schema: 1
+package: com.example.native-app
+version: 0.1.0
+displayname: Native App
+description: A minimal Syno Package Land native binary app template.
+maintainer: Syno Package Land
+os_min_ver: "7.2-60000"

package/dist/types.d.ts

@@ -56,4 +56,4 @@ export interface ComposeDocument {
     secrets?: Record<string, unknown>;
     [key: string]: unknown;
 }
-export type TemplateName = "hello-web" | "hello-web-page" | "hello-files" | "compose-import";
+export type TemplateName = "hello-web" | "hello-web-page" | "hello-files" | "compose-import" | "native";

package/dist/validate.js

@@ -1,25 +1,58 @@
 import { existsSync } from "node:fs";
+import { join } from "node:path";
 import { collectInstallParameters, loadContract } from "./contract/load.js";
 import { validateContract } from "./contract/validate.js";
 import { collectComposeInterpolations, collectVolumeSourceInterpolations, loadCompose, validateAdminPortMapping, validateComposeHostBinds, validateComposeRunAs, validateComposeSecurity, } from "./compose/analyze.js";
-import { COMPOSE_FILENAME, CONTRACT_FILENAME } from "./discovery.js";
+import { loadNative } from "./native/load.js";
+import { validateNative } from "./native/validate.js";
+import { COMPOSE_FILENAME, CONTRACT_FILENAME, NATIVE_FILENAME, } from "./discovery.js";
 import { declaredPrivilegeFlags } from "./compose/privilege.js";
 export function validateProject(project, options = {}) {
     const profile = options.profile ?? "personal";
     const errors = [];
     const contractFile = CONTRACT_FILENAME;
     const composeFile = COMPOSE_FILENAME;
+    const nativeFile = NATIVE_FILENAME;
     const parsed = loadContract(project.contractPath);
     errors.push(...validateContract(parsed, contractFile));
-    if (!existsSync(project.composePath)) {
+    const hasCompose = existsSync(project.composePath);
+    const nativePath = project.nativePath ?? join(project.root, NATIVE_FILENAME);
+    const hasNative = existsSync(nativePath);
+    // 2. native.yaml 與 compose.yaml 互斥：兩個都有 → 拒絕；兩個都沒有 → 拒絕。
+    if (hasCompose && hasNative) {
+        errors.push({
+            code: "PROJECT_RUNTIME_EXCLUSIVE",
+            span: { file: nativeFile, line: 1, column: 1 },
+            message: "專案同時存在 compose.yaml 與 native.yaml，兩者互斥。",
+            suggestion: "請選擇使用 compose.yaml（容器 App）或 native.yaml（原生二進位 App），並刪除另一個檔案。",
+        });
+        return { ok: false, errors };
+    }
+    if (!hasCompose && !hasNative) {
         errors.push({
             code: "COMPOSE_MISSING",
             span: { file: composeFile, line: 1, column: 1 },
-            message: "找不到 compose.yaml。",
-            suggestion: "請在專案根目錄建立 compose.yaml。",
+            message: "找不到 compose.yaml 或 native.yaml。",
+            suggestion: "請在專案根目錄建立 compose.yaml 或 native.yaml。",
         });
         return { ok: false, errors };
     }
+    if (hasNative) {
+        const parsedNative = loadNative(nativePath);
+        if (!parsedNative) {
+            errors.push({
+                code: "NATIVE_LOAD_FAILED",
+                span: { file: nativeFile, line: 1, column: 1 },
+                message: "無法讀取 native.yaml。",
+                suggestion: "請確認 native.yaml 存在且格式為合法 YAML。",
+            });
+            return { ok: false, errors };
+        }
+        errors.push(...validateNative(parsedNative, nativeFile, { profile }));
+        const warnings = errors.filter((item) => item.severity === "warning");
+        const hardErrors = errors.filter((item) => item.severity !== "warning");
+        return { ok: hardErrors.length === 0, errors: hardErrors, warnings };
+    }
     const parsedCompose = loadCompose(project.composePath);
     if (!parsedCompose) {
         return { ok: false, errors };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
-    "synopkgland": "dist/bin.js"
+    "synopkgland": "./dist/bin.js"
   },
   "files": [
     "dist",
@@ -17,13 +17,9 @@
     "test": "npm run build && node --import tsx --test test/**/*.test.ts",
     "prepublishOnly": "npm run build"
   },
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  },
   "dependencies": {
-    "@synopackageland/dev-sdk": "0.1.0",
-    "@synopackageland/package-source": "0.1.0",
+    "@synopackageland/dev-sdk": "^0.2.0",
+    "@synopackageland/package-source": "^0.2.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "jose": "^6.0.10",
@@ -34,5 +30,9 @@
     "@types/node": "^22.13.10",
     "tsx": "^4.19.3",
     "typescript": "^5.8.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
   }
 }

package/skills/reference/diagnose.md

@@ -10,7 +10,21 @@
 | `CONTRACT_SCHEMA_UNSUPPORTED` | `schema` 必須為整數 `1` |
 | `CONTRACT_INVALID_STRING`／`CONTRACT_ADMINPORT_INVALID` | 修正字串或 `adminport` 型別 |
 | `INSTALL_STRING_*`／`INSTALL_PARAMETER_UNREFERENCED` | 修正 install 預設值；在 compose 加 `${參數名}` |
-| `COMPOSE_MISSING` | 建立 `compose.yaml` |
+| `COMPOSE_MISSING` | 建立 `compose.yaml`（容器 App）或 `native.yaml`（原生 binary App） |
+| `PROJECT_RUNTIME_EXCLUSIVE` | `compose.yaml` 與 `native.yaml` 互斥，刪掉其中一個 |
+| `NATIVE_SCHEMA_INVALID` | `native.yaml` 的 `schema` 只接受 `1` |
+| `NATIVE_TARGETS_REQUIRED` / `NATIVE_TARGETS_EMPTY` | 在 `targets` 底下至少宣告一個 `x86_64` 或 `aarch64` |
+| `NATIVE_ARCH_UNKNOWN` | `targets` 的 key 只接受 `x86_64`、`aarch64` |
+| `NATIVE_TARGET_SOURCE_EXCLUSIVE` | 每個 target 只能有 `path:` 或 `url:` 其中一個 |
+| `NATIVE_PATH_FORBIDDEN_IN_LISTING` | Curated 上架只接受 `url:` ＋ `sha256:`；本機開發才可以用 `path:` |
+| `NATIVE_SHA256_REQUIRED_IN_LISTING` | 補上 `sha256:`，CI 要能自己重抓比對 |
+| `NATIVE_SHA256_INVALID` | `sha256` 必須是 64 個 hex 字元 |
+| `NATIVE_STRIP_COMPONENTS_INVALID` | `strip_components` 必須是 >= 0 的整數 |
+| `NATIVE_EXEC_REQUIRED` / `NATIVE_EXEC_INVALID_PATH` | `service.exec` 必填，且必須是相對 `SYNOPKG_PKGDEST` 的路徑，不可為絕對路徑或含 `..` |
+| `NATIVE_PKGVAR_REQUIRED` | `service.args` 或 `service.env` 至少要用一次 `${SYNOPKG_PKGVAR}`，否則升級時資料會被連同 `target/` 一起換掉 |
+| `NATIVE_SERVICE_USER_FORBIDDEN` | 拿掉 `service.user`：DSM 自己建 package user，`SYNOPKG_PKGVAR` 已經是對的 owner |
+| `NATIVE_SERVICE_SHELL_FIELD_FORBIDDEN` | 拿掉 `command:` / `pre_start:` 這類 shell 欄位；`args` 是陣列，逐項傳給 exec，不經 shell |
+| `NATIVE_ARGS_INVALID` / `NATIVE_ENV_INVALID` | `args` 必須是字串陣列，`env` 必須是 string→string |
 | `COMPOSE_PRIVILEGED_FORBIDDEN` 等安全碼 | 移除 privileged、host 網路、socket 掛載等 |
 | `COMPOSE_SERVICE_NOT_FOUND` | 修正 `adminport` 對應的 service |
 | `CONTRACT_ADMINPORT_UNMAPPED` | 在 compose 發布與 `adminport` 相同的 host port |

package/templates/native/native.yaml

@@ -0,0 +1,16 @@
+schema: 1
+
+targets:
+  x86_64:
+    path: ./dist/app-x86_64.tar.gz
+    strip_components: 1
+  aarch64:
+    path: ./dist/app-aarch64.tar.gz
+    strip_components: 1
+
+service:
+  exec: bin/app
+  args:
+    - "-data=${SYNOPKG_PKGVAR}"
+  env:
+    TMPDIR: ${SYNOPKG_PKGVAR}/tmp

package/templates/native/synology-app.yaml

@@ -0,0 +1,7 @@
+schema: 1
+package: com.example.native-app
+version: 0.1.0
+displayname: Native App
+description: A minimal Syno Package Land native binary app template.
+maintainer: Syno Package Land
+os_min_ver: "7.2-60000"

package/dist/deploy/package-source.d.ts

@@ -1,7 +0,0 @@
-import { DEFAULT_PACKAGE_SOURCE_ORIGIN, fetchPackageSourceManifest, publishSpkToSource, resolvePublishTarget, type PublishTarget, type PublishSpkResult } from "@synology/package-source/publish-spk";
-import { resolveNextSpkVersion } from "@synology/package-source/next-version";
-import type { IndexManifest } from "@synology/package-source/index-manifest";
-export { DEFAULT_PACKAGE_SOURCE_ORIGIN, fetchPackageSourceManifest, publishSpkToSource, resolvePublishTarget, resolveNextSpkVersion, };
-export type { PublishTarget, PublishSpkResult, IndexManifest };
-export declare function resolvePackageSourceManifest(origin?: string): Promise<IndexManifest | null>;
-export declare function publishBuiltSpk(spkPath: string, target?: PublishTarget): Promise<PublishSpkResult>;

package/dist/deploy/package-source.js

@@ -1,17 +0,0 @@
-import { DEFAULT_PACKAGE_SOURCE_ORIGIN, fetchPackageSourceManifest, publishSpkToSource, resolvePublishTarget, } from "@synology/package-source/publish-spk";
-import { resolveNextSpkVersion } from "@synology/package-source/next-version";
-export { DEFAULT_PACKAGE_SOURCE_ORIGIN, fetchPackageSourceManifest, publishSpkToSource, resolvePublishTarget, resolveNextSpkVersion, };
-const LIVE_TEST_FALLBACK_ORIGIN = "https://syno-package-source-throwaway.bidacumen.workers.dev";
-export async function resolvePackageSourceManifest(origin = resolvePublishTarget().origin) {
-    const manifest = await fetchPackageSourceManifest(origin);
-    if (manifest) {
-        return manifest;
-    }
-    if (origin !== LIVE_TEST_FALLBACK_ORIGIN) {
-        return fetchPackageSourceManifest(LIVE_TEST_FALLBACK_ORIGIN);
-    }
-    return null;
-}
-export async function publishBuiltSpk(spkPath, target = resolvePublishTarget()) {
-    return publishSpkToSource(spkPath, target);
-}