@synopackageland/cli 0.2.0 → 0.3.0

package/dist/bin.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
-import { runCuratedReleaseCli } from "./publish/curated-release.js";
 loadDotEnv();
-const execution = process.argv[2] === "release"
-    ? runCuratedReleaseCli(process.argv)
-    : runCli(process.argv).then(() => 0);
-execution.then((status) => {
+// Release authority lives in the separate `synopkgland-release` binary, so the
+// developer-facing tool has no publish surface at all.
+runCli(process.argv).then(() => 0).then((status) => {
     process.exitCode = status;
 }).catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));

package/dist/cli.js

@@ -16,6 +16,7 @@ import { followProjectLogs } from "./log.js";
 import { testProjectOnHost } from "./test-host.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
 import { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
+import { formatPreflight, runPublicReleasePreflight } from "./publish/preflight.js";
 import { createExecGitHubCli, createExecGitOps } from "./publish/github-pr.js";
 import { communityAppsGitHubRepo } from "./publish/github-repo.js";
 function collectKvOption(value, previous, flag, example) {
@@ -52,12 +53,11 @@ export async function runCli(argv) {
     program
         .command("validate")
         .description("驗證 App Contract 與 Compose")
-        .option("--curated", "使用 Curated listing profile（未宣告 privilege 為紅燈）")
         .action((options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = resolveProject(process.cwd(), global.project);
         const result = validateProject(project, {
-            profile: options.curated ? "listing" : "personal",
+            profile: "personal",
         });
         if (result.warnings && result.warnings.length > 0) {
             console.error(formatErrors(result.warnings));
@@ -329,15 +329,31 @@ export async function runCli(argv) {
         console.log(`已產生 ${result.outputPath}`);
     });
     program
-        .command("publish")
-        .description("對 Community Apps 建立 GitHub Pull Request（不上傳 SPK、不簽署）")
+        .command("public-release-submit")
+        .description("送審公開發佈：先跑完本機所有 Curated 檢查，通過才對 Community Apps 建立 Pull Request。"
+        + "不上傳 SPK、不簽署、不發佈——實際發佈由 maintainer 合併後的 trusted CI 執行。")
+        .option("--check", "只跑本機檢查，不建立 Pull Request")
         .option("--base <branch>", "PR 目標分支", "master")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = resolveProject(process.cwd(), global.project);
+        const preflight = await runPublicReleasePreflight(project);
+        if (!preflight.ok) {
+            // A gate's reasons belong on stderr so CI logs and `2>` capture them.
+            console.error(formatPreflight(preflight));
+            console.error("\n本機檢查未通過，未建立 Pull Request。");
+            process.exit(1);
+        }
+        console.log(formatPreflight(preflight));
+        if (options.check) {
+            console.log("\n本機檢查全部通過。加上 --check 以外的執行才會送審。");
+            return;
+        }
         const communityAppsRoot = resolveCommunityAppsRoot(project.root);
         if (!communityAppsRoot) {
-            console.error("找不到 synopkgland-community-apps/apps。請在 monorepo 根目錄執行，或設定 SYNOPKGLAND_COMMUNITY_APPS_ROOT。");
+            console.error("送審需要 Community Apps 定義倉庫的本機副本。請先取得它，再從你的 App 專案目錄重跑：\n"
+                + "  git clone https://github.com/synopackageland/synopkgland-community-apps.git\n"
+                + "  export SYNOPKGLAND_COMMUNITY_APPS_ROOT=$PWD/synopkgland-community-apps");
             process.exit(1);
         }
         const repoRoot = dirname(communityAppsRoot);

package/dist/publish/preflight.d.ts

@@ -0,0 +1,24 @@
+import type { ProjectRoot } from "../discovery.js";
+export interface PreflightCheck {
+    /** Stable id so scripts and docs can refer to a specific gate. */
+    id: string;
+    title: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface PreflightResult {
+    ok: boolean;
+    checks: PreflightCheck[];
+}
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export declare function runPublicReleasePreflight(project: ProjectRoot): Promise<PreflightResult>;
+export declare function formatPreflight(result: PreflightResult): string;

package/dist/publish/preflight.js

@@ -0,0 +1,116 @@
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isDevelopmentPackageIdentity } from "@synopackageland/package-source/index-manifest";
+import { buildSpk } from "../build-spk/generator.js";
+import { loadCompose } from "../compose/analyze.js";
+import { loadContract } from "../contract/load.js";
+import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
+import { loadNative } from "../native/load.js";
+import { validateProject } from "../validate.js";
+import { validateCuratedCompose } from "./curated-release.js";
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export async function runPublicReleasePreflight(project) {
+    const checks = [];
+    const add = (check) => {
+        checks.push(check);
+        return check.ok;
+    };
+    const validation = validateProject(project, { profile: "listing" });
+    add({
+        id: "listing-validate",
+        title: "App Contract 與 runtime 通過 Curated listing profile",
+        ok: validation.ok,
+        detail: validation.ok ? undefined : validation.errors.map((error) => error.code).join(", "),
+    });
+    const contract = loadContract(project.contractPath).contract;
+    const packageIdentity = typeof contract.package === "string" ? contract.package : "";
+    const formalIdentity = packageIdentity.length > 0 && !isDevelopmentPackageIdentity(packageIdentity);
+    add({
+        id: "formal-identity",
+        title: "Package Identity 是正式身分（不是 .dev）",
+        ok: formalIdentity,
+        detail: formalIdentity
+            ? undefined
+            : packageIdentity.length === 0
+                ? "App Contract 缺少 package 欄位。"
+                : `Curated 不接受 development identity：${packageIdentity}`,
+    });
+    const nativePath = project.nativePath;
+    const isNative = nativePath !== undefined && existsSync(nativePath);
+    if (isNative) {
+        const parsedNative = loadNative(nativePath);
+        const families = Object.keys(parsedNative?.native.targets ?? {}).filter(isNativeArchFamily);
+        const pinned = families.filter((family) => {
+            const target = parsedNative?.native.targets?.[family];
+            return typeof target?.url === "string" && typeof target?.sha256 === "string";
+        });
+        add({
+            id: "curated-runtime",
+            title: "每個 native target 都以 url + sha256 釘住",
+            ok: families.length > 0 && pinned.length === families.length,
+            detail: families.length === 0
+                ? "native.yaml 沒有宣告任何 target。"
+                : pinned.length === families.length
+                    ? undefined
+                    : `缺少 url 或 sha256：${families.filter((f) => !pinned.includes(f)).join(", ")}`,
+        });
+    }
+    else {
+        const parsedCompose = loadCompose(project.composePath);
+        const gate = parsedCompose
+            ? validateCuratedCompose(parsedCompose.compose)
+            : { ok: false, errors: ["CURATED_COMPOSE_MISSING"] };
+        add({
+            id: "curated-runtime",
+            title: "Compose 只用釘住 digest 的公開 image，且沒有 build:",
+            ok: gate.ok,
+            detail: gate.ok ? undefined : gate.errors.join(", "),
+        });
+    }
+    // The strongest local gate: actually produce the artifact. For native this
+    // fetches each pinned asset and refuses it unless the bytes hash to the
+    // declared sha256, so a bad pin fails here instead of in CI.
+    if (checks.every((check) => check.ok)) {
+        const staging = mkdtempSync(join(tmpdir(), "synopkgland-preflight-"));
+        try {
+            const families = isNative
+                ? Object.keys(loadNative(nativePath)?.native.targets ?? {}).filter(isNativeArchFamily)
+                : [undefined];
+            for (const family of families) {
+                const built = await buildSpk({
+                    project,
+                    outputPath: join(staging, `${packageIdentity}-${family ?? "noarch"}.spk`),
+                    ...(family ? { archFamily: family } : {}),
+                });
+                add({
+                    id: family ? `spk-builds:${family}` : "spk-builds",
+                    title: family ? `SPK 可建置（${family}，含 sha256 比對）` : "SPK 可建置",
+                    ok: built.ok,
+                    detail: built.ok ? undefined : built.errors.join(", "),
+                });
+                if (!built.ok) {
+                    break;
+                }
+            }
+        }
+        finally {
+            rmSync(staging, { recursive: true, force: true });
+        }
+    }
+    return { ok: checks.every((check) => check.ok), checks };
+}
+export function formatPreflight(result) {
+    return result.checks
+        .map((check) => `${check.ok ? "✔" : "✖"} ${check.title}${check.detail ? `\n    ${check.detail}` : ""}`)
+        .join("\n");
+}

package/dist/publish/publish.d.ts

@@ -1,6 +1,9 @@
 import type { ProjectRoot } from "../discovery.js";
+import { type PreflightResult } from "./preflight.js";
 import type { GitHubCli, GitOps } from "./github-pr.js";
 export interface PublishProjectOptions {
+    /** Injected in tests; production runs the real local gate set. */
+    preflight?: (project: ProjectRoot) => Promise<PreflightResult>;
     project: ProjectRoot;
     communityAppsRoot?: string;
     baseBranch?: string;
@@ -10,6 +13,7 @@ export interface PublishProjectOptions {
     now?: () => Date;
 }
 export interface PublishProjectResult {
+    preflight?: PreflightResult;
     ok: boolean;
     code?: string;
     message?: string;

package/dist/publish/publish.js

@@ -1,6 +1,6 @@
 import { join, resolve } from "node:path";
 import { loadContract } from "../contract/load.js";
-import { validateProject } from "../validate.js";
+import { runPublicReleasePreflight } from "./preflight.js";
 import { assertDirectoryMatchesPackage, COMMUNITY_APPS_APPS_DIR, COMMUNITY_APPS_DIR, communityAppDirectory, resolveCommunityAppsRoot, } from "./community-path.js";
 import { listSyncedRelativePaths, syncPackagingDefinition } from "./sync-definition.js";
 function slugifyPackageIdentity(packageIdentity) {
@@ -28,12 +28,20 @@ function renderPullRequestBody(packageIdentity, appRelativePath, files) {
     ].join("\n");
 }
 export async function publishProject(options) {
-    const validation = validateProject(options.project, { profile: "listing" });
-    if (!validation.ok) {
+    // Every locally decidable gate runs before anything is pushed, so a
+    // definition CI would reject never costs a maintainer a review.
+    const preflight = options.preflight
+        ? await options.preflight(options.project)
+        : await runPublicReleasePreflight(options.project);
+    if (!preflight.ok) {
         return {
             ok: false,
-            code: "VALIDATION_FAILED",
-            message: validation.errors.map((error) => error.code).join(", "),
+            code: "PREFLIGHT_FAILED",
+            message: preflight.checks
+                .filter((check) => !check.ok)
+                .map((check) => `${check.id}${check.detail ? `: ${check.detail}` : ""}`)
+                .join("; "),
+            preflight,
         };
     }
     const communityRoot = options.communityAppsRoot ?? resolveCommunityAppsRoot(options.project.root);

package/dist/release-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/release-bin.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * Trusted-CI entry point. Kept out of the `synopkgland` developer binary on
+ * purpose: allocating a Package Build, signing attestations and publishing to
+ * the Curated Package Source require release authority that a developer's
+ * machine must never hold. Only CI running from the reviewed merged revision
+ * has the keyring, the ledger write credential and the publish credential.
+ */
+import { loadDotEnv } from "./load-env.js";
+import { runCuratedReleaseCli } from "./publish/curated-release.js";
+loadDotEnv();
+runCuratedReleaseCli(["node", "synopkgland-release", "release", ...process.argv.slice(2)])
+    .then((status) => {
+    process.exitCode = status;
+})
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
-    "synopkgland": "./dist/bin.js"
+    "synopkgland": "./dist/bin.js",
+    "synopkgland-release": "./dist/release-bin.js"
   },
   "files": [
     "dist",