@synopackageland/cli 0.1.0 → 0.3.0

package/dist/publish/curated-release.js

@@ -10,6 +10,8 @@ import { digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabiliti
 import { CuratedTrustRootError, loadCuratedTrustRoot, resolveCuratedSigningTrust, } from "../attestation/keyring.js";
 import { loadContract } from "../contract/load.js";
 import { loadCompose } from "../compose/analyze.js";
+import { loadNative } from "../native/load.js";
+import { infoArchValue, isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { EMBEDDED_ATTESTATION_RELATIVE_PATH, buildSpk, extractSpk, } from "../build-spk/generator.js";
 import { findProjectRoot } from "../discovery.js";
 import { validateProject } from "../validate.js";
@@ -112,95 +114,172 @@ export async function releaseCurated(options) {
         const workspace = mkdtempSync(join(tmpdir(), "synopkgland-curated-release-"));
         try {
             const releaseProject = copyReleaseProject(options.project, workspace, packageIdentity);
-            const outputPath = join(workspace, `${packageIdentity}.spk`);
             const buildFn = options.buildSpk ?? buildSpk;
-            const built = await buildFn({
-                project: releaseProject,
-                outputPath,
-                packageIdentity,
-                displayname: prepared.displayname,
-                spkVersion: prepared.version,
-                embeddedAttestationToken: embedded.token,
-            });
-            if (!built.ok || !built.outputPath) {
-                throw new CuratedReleaseError("CURATED_BUILD_FAILED");
-            }
-            await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
-            const artifact = digestArtifact(built.outputPath);
             if (!options.signer.signRelease) {
                 throw new CuratedReleaseError("CURATED_RELEASE_SIGNER_MISSING");
             }
-            const detachedInput = {
-                packageIdentity,
-                packageVersion: prepared.version,
-                packageBuild: options.build,
-                artifactDigest: artifact.sha256,
-                embeddedAttestationDigest: embedded.attestationDigest,
-            };
-            let detached;
-            try {
-                detached = await options.signer.signRelease(detachedInput);
-            }
-            catch (error) {
-                if (error instanceof CuratedReleaseError) {
-                    throw error;
-                }
-                throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
-            }
-            assertDetachedAttestation(detached, detachedInput);
-            await verifySignedToken(options.signer, detached.token, "release");
-            const artifactKey = buildImmutableSpkKey({
-                package: packageIdentity,
-                version: prepared.version,
-                sha256: artifact.sha256,
-            });
-            const attestationKey = buildImmutableAttestationKey({
-                package: packageIdentity,
-                version: prepared.version,
-                artifactDigest: artifact.sha256,
-            });
-            const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
             if (!options.signer.verificationJwk) {
                 throw new CuratedReleaseError("CURATED_ATTESTATION_SIGNATURE_INVALID");
             }
-            const attestation = {
-                packageId: packageIdentity,
-                version: prepared.version,
-                packageBuild: options.build,
-                artifactDigest: artifact.sha256,
-                embeddedAttestationDigest: embedded.attestationDigest,
-                key: attestationKey,
-                token: detached.token,
-                digest: detached.attestationDigest,
-                tokenSha256,
-                verificationJwk: options.signer.verificationJwk,
-            };
-            const index = {
-                packageId: packageIdentity,
-                version: prepared.version,
-                displayname: prepared.displayname,
-                description: prepared.description,
-                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
-                osMinVer: prepared.osMinVer,
-                artifact: {
-                    key: artifactKey,
-                    size: artifact.size,
-                    md5: artifact.md5,
+            if (!prepared.isNative) {
+                // Compose single-artifact release
+                const outputPath = join(workspace, `${packageIdentity}.spk`);
+                const built = await buildFn({
+                    project: releaseProject,
+                    outputPath,
+                    packageIdentity,
+                    displayname: prepared.displayname,
+                    spkVersion: prepared.version,
+                    embeddedAttestationToken: embedded.token,
+                });
+                if (!built.ok || !built.outputPath) {
+                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
+                }
+                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
+                const artifact = digestArtifact(built.outputPath);
+                const detachedInput = {
+                    packageIdentity,
+                    packageVersion: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                };
+                let detached;
+                try {
+                    detached = await options.signer.signRelease(detachedInput);
+                }
+                catch (error) {
+                    if (error instanceof CuratedReleaseError) {
+                        throw error;
+                    }
+                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+                }
+                assertDetachedAttestation(detached, detachedInput);
+                await verifySignedToken(options.signer, detached.token, "release");
+                const artifactKey = buildImmutableSpkKey({
+                    package: packageIdentity,
+                    version: prepared.version,
                     sha256: artifact.sha256,
-                },
-                attestation: {
+                });
+                const attestationKey = buildImmutableAttestationKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    artifactDigest: artifact.sha256,
+                });
+                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
+                const attestation = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
                     key: attestationKey,
+                    token: detached.token,
                     digest: detached.attestationDigest,
+                    tokenSha256,
+                    verificationJwk: options.signer.verificationJwk,
+                };
+                const index = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    displayname: prepared.displayname,
+                    description: prepared.description,
+                    ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
+                    osMinVer: prepared.osMinVer,
+                    artifact: {
+                        key: artifactKey,
+                        size: artifact.size,
+                        md5: artifact.md5,
+                        sha256: artifact.sha256,
+                    },
+                    attestation: {
+                        key: attestationKey,
+                        digest: detached.attestationDigest,
+                        packageBuild: options.build,
+                        artifactDigest: artifact.sha256,
+                        embeddedAttestationDigest: embedded.attestationDigest,
+                    },
+                };
+                // This is the only transition to external publication. Both tokens have
+                // been claim-checked, signature-checked when the signer supplies a key,
+                // and the embedded token was read back from the final SPK first.
+                await publishCuratedRelease({
+                    artifact: {
+                        packageId: packageIdentity,
+                        version: prepared.version,
+                        path: built.outputPath,
+                        key: artifactKey,
+                        size: artifact.size,
+                        md5: artifact.md5,
+                        sha256: artifact.sha256,
+                    },
+                    attestation,
+                    index,
+                }, options.publisher);
+                return {
+                    packageIdentity,
                     packageBuild: options.build,
+                    version: prepared.version,
+                    artifactKey,
                     artifactDigest: artifact.sha256,
+                    attestationKey,
                     embeddedAttestationDigest: embedded.attestationDigest,
-                },
-            };
-            // This is the only transition to external publication. Both tokens have
-            // been claim-checked, signature-checked when the signer supplies a key,
-            // and the embedded token was read back from the final SPK first.
-            await publishCuratedRelease({
-                artifact: {
+                    attestationDigest: detached.attestationDigest,
+                };
+            }
+            // Native multi-arch release (1 Build -> N artifacts)
+            const targetFamilies = Object.keys(prepared.native?.targets ?? {}).filter(isNativeArchFamily);
+            if (targetFamilies.length === 0) {
+                throw new CuratedReleaseError("CURATED_NATIVE_TARGETS_EMPTY");
+            }
+            const builtArches = [];
+            for (const family of targetFamilies) {
+                const outputPath = join(workspace, `${packageIdentity}-${family}.spk`);
+                const built = await buildFn({
+                    project: releaseProject,
+                    outputPath,
+                    packageIdentity,
+                    displayname: prepared.displayname,
+                    spkVersion: prepared.version,
+                    embeddedAttestationToken: embedded.token,
+                    archFamily: family,
+                });
+                if (!built.ok || !built.outputPath) {
+                    throw new CuratedReleaseError("CURATED_BUILD_FAILED");
+                }
+                await assertEmbeddedAttestationInSpk(built.outputPath, embedded.token, embeddedInput, options.signer);
+                const artifact = digestArtifact(built.outputPath);
+                const detachedInput = {
+                    packageIdentity,
+                    packageVersion: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                };
+                let detached;
+                try {
+                    detached = await options.signer.signRelease(detachedInput);
+                }
+                catch (error) {
+                    if (error instanceof CuratedReleaseError) {
+                        throw error;
+                    }
+                    throw new CuratedReleaseError("CURATED_RELEASE_ATTESTATION_BINDING_FAILED");
+                }
+                assertDetachedAttestation(detached, detachedInput);
+                await verifySignedToken(options.signer, detached.token, "release");
+                const artifactKey = buildImmutableSpkKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    sha256: artifact.sha256,
+                });
+                const attestationKey = buildImmutableAttestationKey({
+                    package: packageIdentity,
+                    version: prepared.version,
+                    artifactDigest: artifact.sha256,
+                });
+                const tokenSha256 = digestBytes(Buffer.from(detached.token, "utf8"));
+                const releaseArtifact = {
                     packageId: packageIdentity,
                     version: prepared.version,
                     path: built.outputPath,
@@ -208,19 +287,89 @@ export async function releaseCurated(options) {
                     size: artifact.size,
                     md5: artifact.md5,
                     sha256: artifact.sha256,
+                };
+                const releaseAttestation = {
+                    packageId: packageIdentity,
+                    version: prepared.version,
+                    packageBuild: options.build,
+                    artifactDigest: artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
+                    key: attestationKey,
+                    token: detached.token,
+                    digest: detached.attestationDigest,
+                    tokenSha256,
+                    verificationJwk: options.signer.verificationJwk,
+                };
+                const archPlatforms = infoArchValue(family).split(" ");
+                const archArtifact = {
+                    key: artifactKey,
+                    size: artifact.size,
+                    md5: artifact.md5,
+                    sha256: artifact.sha256,
+                    arch: archPlatforms,
+                    attestation: {
+                        key: attestationKey,
+                        digest: detached.attestationDigest,
+                        packageBuild: options.build,
+                        artifactDigest: artifact.sha256,
+                        embeddedAttestationDigest: embedded.attestationDigest,
+                    },
+                };
+                builtArches.push({
+                    family,
+                    outputPath: built.outputPath,
+                    artifact,
+                    artifactKey,
+                    attestationKey,
+                    detached,
+                    tokenSha256,
+                    releaseArtifact,
+                    releaseAttestation,
+                    archArtifact,
+                });
+            }
+            const primary = builtArches[0];
+            const allArchs = targetFamilies.flatMap((family) => infoArchValue(family).split(" "));
+            const indexPayload = {
+                packageId: packageIdentity,
+                version: prepared.version,
+                displayname: prepared.displayname,
+                description: prepared.description,
+                ...(prepared.maintainer ? { maintainer: prepared.maintainer } : {}),
+                osMinVer: prepared.osMinVer,
+                arch: allArchs,
+                artifact: {
+                    key: primary.artifactKey,
+                    size: primary.artifact.size,
+                    md5: primary.artifact.md5,
+                    sha256: primary.artifact.sha256,
+                },
+                attestation: {
+                    key: primary.attestationKey,
+                    digest: primary.detached.attestationDigest,
+                    packageBuild: options.build,
+                    artifactDigest: primary.artifact.sha256,
+                    embeddedAttestationDigest: embedded.attestationDigest,
                 },
-                attestation,
-                index,
-            }, options.publisher);
+                artifacts: builtArches.map((item) => item.archArtifact),
+            };
+            // 5. Publication order: all artifacts -> all detached attestations -> index
+            for (const item of builtArches) {
+                await options.publisher.uploadArtifact(item.releaseArtifact);
+            }
+            for (const item of builtArches) {
+                await options.publisher.uploadAttestation(item.releaseAttestation);
+            }
+            await options.publisher.updateIndex(indexPayload);
             return {
                 packageIdentity,
                 packageBuild: options.build,
                 version: prepared.version,
-                artifactKey,
-                artifactDigest: artifact.sha256,
-                attestationKey,
+                artifactKey: primary.artifactKey,
+                artifactDigest: primary.artifact.sha256,
+                attestationKey: primary.attestationKey,
                 embeddedAttestationDigest: embedded.attestationDigest,
-                attestationDigest: detached.attestationDigest,
+                attestationDigest: primary.detached.attestationDigest,
             };
         }
         finally {
@@ -352,6 +501,25 @@ function prepareRelease(project, build) {
     if (!validation.ok) {
         throw new CuratedReleaseError("CURATED_VALIDATION_FAILED", validation.errors.map((error) => error.code).join(","));
     }
+    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
+    const isNative = existsSync(nativePath);
+    if (isNative) {
+        const parsedNative = loadNative(nativePath);
+        if (!parsedNative) {
+            throw new CuratedReleaseError("CURATED_NATIVE_MISSING");
+        }
+        return {
+            isNative: true,
+            contract,
+            native: parsedNative.native,
+            packageIdentity,
+            version,
+            displayname: String(contract.displayname),
+            description: String(contract.description),
+            maintainer: typeof contract.maintainer === "string" ? contract.maintainer : undefined,
+            osMinVer: String(contract.os_min_ver),
+        };
+    }
     const parsedCompose = loadCompose(project.composePath);
     if (!parsedCompose) {
         throw new CuratedReleaseError("CURATED_COMPOSE_MISSING");
@@ -361,6 +529,7 @@ function prepareRelease(project, build) {
         throw new CuratedReleaseError("CURATED_COMPOSE_GATE_FAILED", composeGate.errors.join(","));
     }
     return {
+        isNative: false,
         contract,
         compose: parsedCompose.compose,
         packageIdentity,
@@ -376,15 +545,22 @@ function copyReleaseProject(source, workspace, packageIdentity) {
     mkdirSync(root, { recursive: true });
     const contractPath = join(root, "synology-app.yaml");
     const composePath = join(root, "compose.yaml");
+    const nativePath = join(root, "native.yaml");
     writeFileSync(contractPath, readFileSync(source.contractPath));
-    writeFileSync(composePath, readFileSync(source.composePath));
+    if (existsSync(source.composePath)) {
+        writeFileSync(composePath, readFileSync(source.composePath));
+    }
+    const srcNative = source.nativePath ?? join(source.root, "native.yaml");
+    if (existsSync(srcNative)) {
+        writeFileSync(nativePath, readFileSync(srcNative));
+    }
     for (const name of ["icon.png", "README.md", "html"]) {
         const sourcePath = join(source.root, name);
         if (existsSync(sourcePath)) {
             cpSync(sourcePath, join(root, name), { recursive: true });
         }
     }
-    return { root, contractPath, composePath };
+    return { root, contractPath, composePath, nativePath };
 }
 function digestArtifact(path) {
     const bytes = readFileSync(path);
@@ -403,11 +579,21 @@ function digestFile(path) {
  */
 export function digestReleaseBundle(project) {
     const files = [];
-    for (const name of ["compose.yaml", "synology-app.yaml"]) {
-        if (!existsSync(join(project.root, name)) || !statSync(join(project.root, name)).isFile()) {
-            throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", name);
-        }
-        files.push(name);
+    if (!existsSync(project.contractPath) || !statSync(project.contractPath).isFile()) {
+        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "synology-app.yaml");
+    }
+    files.push("synology-app.yaml");
+    const hasCompose = existsSync(project.composePath) && statSync(project.composePath).isFile();
+    const nativePath = project.nativePath ?? join(project.root, "native.yaml");
+    const hasNative = existsSync(nativePath) && statSync(nativePath).isFile();
+    if (!hasCompose && !hasNative) {
+        throw new CuratedReleaseError("CURATED_BUNDLE_FILE_MISSING", "compose.yaml");
+    }
+    if (hasCompose) {
+        files.push("compose.yaml");
+    }
+    if (hasNative) {
+        files.push("native.yaml");
     }
     const htmlRoot = join(project.root, "html");
     if (existsSync(htmlRoot)) {
@@ -453,7 +639,7 @@ function collectCapabilities(contract, compose) {
             capabilities.push(`install.${name}:${parameter.type}`);
         }
     }
-    if (Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
+    if (compose && Object.values(compose.services ?? {}).some((service) => service.privileged === true)) {
         capabilities.push("compose.privileged");
     }
     return normalizeCapabilities(capabilities);

package/dist/publish/preflight.d.ts

@@ -0,0 +1,24 @@
+import type { ProjectRoot } from "../discovery.js";
+export interface PreflightCheck {
+    /** Stable id so scripts and docs can refer to a specific gate. */
+    id: string;
+    title: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface PreflightResult {
+    ok: boolean;
+    checks: PreflightCheck[];
+}
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export declare function runPublicReleasePreflight(project: ProjectRoot): Promise<PreflightResult>;
+export declare function formatPreflight(result: PreflightResult): string;

package/dist/publish/preflight.js

@@ -0,0 +1,116 @@
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isDevelopmentPackageIdentity } from "@synopackageland/package-source/index-manifest";
+import { buildSpk } from "../build-spk/generator.js";
+import { loadCompose } from "../compose/analyze.js";
+import { loadContract } from "../contract/load.js";
+import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
+import { loadNative } from "../native/load.js";
+import { validateProject } from "../validate.js";
+import { validateCuratedCompose } from "./curated-release.js";
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export async function runPublicReleasePreflight(project) {
+    const checks = [];
+    const add = (check) => {
+        checks.push(check);
+        return check.ok;
+    };
+    const validation = validateProject(project, { profile: "listing" });
+    add({
+        id: "listing-validate",
+        title: "App Contract 與 runtime 通過 Curated listing profile",
+        ok: validation.ok,
+        detail: validation.ok ? undefined : validation.errors.map((error) => error.code).join(", "),
+    });
+    const contract = loadContract(project.contractPath).contract;
+    const packageIdentity = typeof contract.package === "string" ? contract.package : "";
+    const formalIdentity = packageIdentity.length > 0 && !isDevelopmentPackageIdentity(packageIdentity);
+    add({
+        id: "formal-identity",
+        title: "Package Identity 是正式身分（不是 .dev）",
+        ok: formalIdentity,
+        detail: formalIdentity
+            ? undefined
+            : packageIdentity.length === 0
+                ? "App Contract 缺少 package 欄位。"
+                : `Curated 不接受 development identity：${packageIdentity}`,
+    });
+    const nativePath = project.nativePath;
+    const isNative = nativePath !== undefined && existsSync(nativePath);
+    if (isNative) {
+        const parsedNative = loadNative(nativePath);
+        const families = Object.keys(parsedNative?.native.targets ?? {}).filter(isNativeArchFamily);
+        const pinned = families.filter((family) => {
+            const target = parsedNative?.native.targets?.[family];
+            return typeof target?.url === "string" && typeof target?.sha256 === "string";
+        });
+        add({
+            id: "curated-runtime",
+            title: "每個 native target 都以 url + sha256 釘住",
+            ok: families.length > 0 && pinned.length === families.length,
+            detail: families.length === 0
+                ? "native.yaml 沒有宣告任何 target。"
+                : pinned.length === families.length
+                    ? undefined
+                    : `缺少 url 或 sha256：${families.filter((f) => !pinned.includes(f)).join(", ")}`,
+        });
+    }
+    else {
+        const parsedCompose = loadCompose(project.composePath);
+        const gate = parsedCompose
+            ? validateCuratedCompose(parsedCompose.compose)
+            : { ok: false, errors: ["CURATED_COMPOSE_MISSING"] };
+        add({
+            id: "curated-runtime",
+            title: "Compose 只用釘住 digest 的公開 image，且沒有 build:",
+            ok: gate.ok,
+            detail: gate.ok ? undefined : gate.errors.join(", "),
+        });
+    }
+    // The strongest local gate: actually produce the artifact. For native this
+    // fetches each pinned asset and refuses it unless the bytes hash to the
+    // declared sha256, so a bad pin fails here instead of in CI.
+    if (checks.every((check) => check.ok)) {
+        const staging = mkdtempSync(join(tmpdir(), "synopkgland-preflight-"));
+        try {
+            const families = isNative
+                ? Object.keys(loadNative(nativePath)?.native.targets ?? {}).filter(isNativeArchFamily)
+                : [undefined];
+            for (const family of families) {
+                const built = await buildSpk({
+                    project,
+                    outputPath: join(staging, `${packageIdentity}-${family ?? "noarch"}.spk`),
+                    ...(family ? { archFamily: family } : {}),
+                });
+                add({
+                    id: family ? `spk-builds:${family}` : "spk-builds",
+                    title: family ? `SPK 可建置（${family}，含 sha256 比對）` : "SPK 可建置",
+                    ok: built.ok,
+                    detail: built.ok ? undefined : built.errors.join(", "),
+                });
+                if (!built.ok) {
+                    break;
+                }
+            }
+        }
+        finally {
+            rmSync(staging, { recursive: true, force: true });
+        }
+    }
+    return { ok: checks.every((check) => check.ok), checks };
+}
+export function formatPreflight(result) {
+    return result.checks
+        .map((check) => `${check.ok ? "✔" : "✖"} ${check.title}${check.detail ? `\n    ${check.detail}` : ""}`)
+        .join("\n");
+}

package/dist/publish/publish.d.ts

@@ -1,6 +1,9 @@
 import type { ProjectRoot } from "../discovery.js";
+import { type PreflightResult } from "./preflight.js";
 import type { GitHubCli, GitOps } from "./github-pr.js";
 export interface PublishProjectOptions {
+    /** Injected in tests; production runs the real local gate set. */
+    preflight?: (project: ProjectRoot) => Promise<PreflightResult>;
     project: ProjectRoot;
     communityAppsRoot?: string;
     baseBranch?: string;
@@ -10,6 +13,7 @@ export interface PublishProjectOptions {
     now?: () => Date;
 }
 export interface PublishProjectResult {
+    preflight?: PreflightResult;
     ok: boolean;
     code?: string;
     message?: string;

package/dist/publish/publish.js

@@ -1,6 +1,6 @@
 import { join, resolve } from "node:path";
 import { loadContract } from "../contract/load.js";
-import { validateProject } from "../validate.js";
+import { runPublicReleasePreflight } from "./preflight.js";
 import { assertDirectoryMatchesPackage, COMMUNITY_APPS_APPS_DIR, COMMUNITY_APPS_DIR, communityAppDirectory, resolveCommunityAppsRoot, } from "./community-path.js";
 import { listSyncedRelativePaths, syncPackagingDefinition } from "./sync-definition.js";
 function slugifyPackageIdentity(packageIdentity) {
@@ -28,12 +28,20 @@ function renderPullRequestBody(packageIdentity, appRelativePath, files) {
     ].join("\n");
 }
 export async function publishProject(options) {
-    const validation = validateProject(options.project, { profile: "listing" });
-    if (!validation.ok) {
+    // Every locally decidable gate runs before anything is pushed, so a
+    // definition CI would reject never costs a maintainer a review.
+    const preflight = options.preflight
+        ? await options.preflight(options.project)
+        : await runPublicReleasePreflight(options.project);
+    if (!preflight.ok) {
         return {
             ok: false,
-            code: "VALIDATION_FAILED",
-            message: validation.errors.map((error) => error.code).join(", "),
+            code: "PREFLIGHT_FAILED",
+            message: preflight.checks
+                .filter((check) => !check.ok)
+                .map((check) => `${check.id}${check.detail ? `: ${check.detail}` : ""}`)
+                .join("; "),
+            preflight,
         };
     }
     const communityRoot = options.communityAppsRoot ?? resolveCommunityAppsRoot(options.project.root);

package/dist/release-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/release-bin.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * Trusted-CI entry point. Kept out of the `synopkgland` developer binary on
+ * purpose: allocating a Package Build, signing attestations and publishing to
+ * the Curated Package Source require release authority that a developer's
+ * machine must never hold. Only CI running from the reviewed merged revision
+ * has the keyring, the ledger write credential and the publish credential.
+ */
+import { loadDotEnv } from "./load-env.js";
+import { runCuratedReleaseCli } from "./publish/curated-release.js";
+loadDotEnv();
+runCuratedReleaseCli(["node", "synopkgland-release", "release", ...process.argv.slice(2)])
+    .then((status) => {
+    process.exitCode = status;
+})
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});