@synopackageland/cli 0.2.0 → 0.3.1

package/dist/bin.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
-import { runCuratedReleaseCli } from "./publish/curated-release.js";
 loadDotEnv();
-const execution = process.argv[2] === "release"
-    ? runCuratedReleaseCli(process.argv)
-    : runCli(process.argv).then(() => 0);
-execution.then((status) => {
+// Release authority lives in the separate `synopkgland-release` binary, so the
+// developer-facing tool has no publish surface at all.
+runCli(process.argv).then(() => 0).then((status) => {
     process.exitCode = status;
 }).catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));

package/dist/build-spk/generator.js

@@ -315,11 +315,12 @@ function volumeMounts(compose) {
     }
     return mounts;
 }
+// A Compose that mounts nothing reaches even less of the NAS than one that
+// mounts only PKGVAR, so it earns the same consent line. Returning false for
+// zero sources left the wizard step with no items at all, and DSM's Package
+// Center rejects that SPK with "Invalid file format".
 function composeUsesOnlyAppSpace(compose) {
     const sources = volumeSources(compose);
-    if (sources.length === 0) {
-        return false;
-    }
     return sources.every((source) => source.startsWith("${SYNOPKG_PKGVAR}") || source.startsWith("${SYNO_APP_SECRETS_DIR}"));
 }
 const PRIVILEGE_MAX_WARNING = "此 App 的容器有高權限，接近這台 NAS 的 root、幾乎整台機器。是否安裝由你這位管理員決定。";
@@ -354,7 +355,10 @@ function renderInstallWizard(contract, compose) {
             desc: capabilityText,
         });
     }
-    if (!hasSharedFolder && !capabilityText && compose && composeUsesOnlyAppSpace(compose)) {
+    // No compose at all is the native branch: the binary gets PKGVAR and nothing
+    // else, so it earns the same line. Requiring a compose left native wizards
+    // empty, which DSM rejects as an invalid package.
+    if (!hasSharedFolder && !capabilityText && (!compose || composeUsesOnlyAppSpace(compose))) {
         items.push({
             desc: APP_OWN_SPACE_CONSENT,
         });

package/dist/cli.js

@@ -16,6 +16,7 @@ import { followProjectLogs } from "./log.js";
 import { testProjectOnHost } from "./test-host.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
 import { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
+import { formatPreflight, runPublicReleasePreflight } from "./publish/preflight.js";
 import { createExecGitHubCli, createExecGitOps } from "./publish/github-pr.js";
 import { communityAppsGitHubRepo } from "./publish/github-repo.js";
 function collectKvOption(value, previous, flag, example) {
@@ -52,12 +53,11 @@ export async function runCli(argv) {
     program
         .command("validate")
         .description("驗證 App Contract 與 Compose")
-        .option("--curated", "使用 Curated listing profile（未宣告 privilege 為紅燈）")
         .action((options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = resolveProject(process.cwd(), global.project);
         const result = validateProject(project, {
-            profile: options.curated ? "listing" : "personal",
+            profile: "personal",
         });
         if (result.warnings && result.warnings.length > 0) {
             console.error(formatErrors(result.warnings));
@@ -329,15 +329,31 @@ export async function runCli(argv) {
         console.log(`已產生 ${result.outputPath}`);
     });
     program
-        .command("publish")
-        .description("對 Community Apps 建立 GitHub Pull Request（不上傳 SPK、不簽署）")
+        .command("public-release-submit")
+        .description("送審公開發佈：先跑完本機所有 Curated 檢查，通過才對 Community Apps 建立 Pull Request。"
+        + "不上傳 SPK、不簽署、不發佈——實際發佈由 maintainer 合併後的 trusted CI 執行。")
+        .option("--check", "只跑本機檢查，不建立 Pull Request")
         .option("--base <branch>", "PR 目標分支", "master")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = resolveProject(process.cwd(), global.project);
+        const preflight = await runPublicReleasePreflight(project);
+        if (!preflight.ok) {
+            // A gate's reasons belong on stderr so CI logs and `2>` capture them.
+            console.error(formatPreflight(preflight));
+            console.error("\n本機檢查未通過，未建立 Pull Request。");
+            process.exit(1);
+        }
+        console.log(formatPreflight(preflight));
+        if (options.check) {
+            console.log("\n本機檢查全部通過。加上 --check 以外的執行才會送審。");
+            return;
+        }
         const communityAppsRoot = resolveCommunityAppsRoot(project.root);
         if (!communityAppsRoot) {
-            console.error("找不到 synopkgland-community-apps/apps。請在 monorepo 根目錄執行，或設定 SYNOPKGLAND_COMMUNITY_APPS_ROOT。");
+            console.error("送審需要 Community Apps 定義倉庫的本機副本。請先取得它，再從你的 App 專案目錄重跑：\n"
+                + "  git clone https://github.com/synopackageland/synopkgland-community-apps.git\n"
+                + "  export SYNOPKGLAND_COMMUNITY_APPS_ROOT=$PWD/synopkgland-community-apps");
             process.exit(1);
         }
         const repoRoot = dirname(communityAppsRoot);

package/dist/contract/validate.js

@@ -2,6 +2,8 @@ import { contractSpan, makeError } from "../errors.js";
 import { collectInstallParameters, getValuePosition, stringViolations, } from "./load.js";
 import { validateContractSchema } from "./schema-validate.js";
 import { isWebLaunchMode, readWebIntegration } from "./web-launch.js";
+/** DSM 7.4 Package Center rejects a longer package identity outright. */
+const DSM_PACKAGE_IDENTITY_MAX = 32;
 const METADATA_STRING_FIELDS = [
     "package",
     "version",
@@ -21,6 +23,14 @@ export function validateContract(parsed, contractFile) {
         }
         errors.push(...validateDeveloperString(value, contractFile, field, getValuePosition(doc, [field]) ?? { line: 1, column: 1 }));
     }
+    // DSM 7.4 Package Center refuses an SPK whose package identity exceeds 32
+    // characters -- "Invalid file format", before the install starts and with
+    // nothing written to synopkg.log. Measured on 10.17.83.200: 32 installs, 33
+    // does not.
+    if (typeof contract.package === "string" && contract.package.length > DSM_PACKAGE_IDENTITY_MAX) {
+        const pos = getValuePosition(doc, ["package"]) ?? { line: 1, column: 1 };
+        errors.push(makeError("CONTRACT_PACKAGE_TOO_LONG", contractSpan(contractFile, pos.line, pos.column, "package"), `Package Identity 超過 DSM 上限 ${DSM_PACKAGE_IDENTITY_MAX} 字元（目前 ${contract.package.length}）。`, "請縮短 package，否則 Package Center 會以「Invalid file format」拒絕安裝。"));
+    }
     if (contract.adminport !== undefined) {
         if (typeof contract.adminport !== "number" || !Number.isInteger(contract.adminport)) {
             const pos = getValuePosition(doc, ["adminport"]) ?? { line: 1, column: 1 };

package/dist/deploy/deploy.d.ts

@@ -1,6 +1,7 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { ProjectRoot } from "../discovery.js";
 import type { NasHost } from "../host/types.js";
+import { resolveDeploySpkVersion } from "./spk-version.js";
 import type { PublishSpkResult } from "@synopackageland/package-source/publish-spk";
 export interface DeployProjectOptions {
     project: ProjectRoot;
@@ -9,6 +10,7 @@ export interface DeployProjectOptions {
     host: NasHost;
     dev?: boolean;
     replaceCurated?: boolean;
+    spkVersionResolver?: typeof resolveDeploySpkVersion;
     catalogPublish?: (spkPath: string) => Promise<PublishSpkResult>;
     shareValues?: Record<string, string>;
     runAsValues?: Record<string, string>;

package/dist/deploy/deploy.js

@@ -67,7 +67,8 @@ export async function deployProject(options) {
                     : String(error),
         };
     }
-    const spkVersion = await resolveDeploySpkVersion(options.project, options.host, identity.packageId);
+    const resolveSpkVersion = options.spkVersionResolver ?? resolveDeploySpkVersion;
+    const spkVersion = await resolveSpkVersion(options.project, options.host, identity.packageId);
     let archFamily = options.archFamily;
     if (archFamily === undefined && options.project.nativePath && existsSync(options.project.nativePath)) {
         archFamily = await options.host.getArchFamily?.();

package/dist/publish/preflight.d.ts

@@ -0,0 +1,24 @@
+import type { ProjectRoot } from "../discovery.js";
+export interface PreflightCheck {
+    /** Stable id so scripts and docs can refer to a specific gate. */
+    id: string;
+    title: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface PreflightResult {
+    ok: boolean;
+    checks: PreflightCheck[];
+}
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export declare function runPublicReleasePreflight(project: ProjectRoot): Promise<PreflightResult>;
+export declare function formatPreflight(result: PreflightResult): string;

package/dist/publish/preflight.js

@@ -0,0 +1,116 @@
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isDevelopmentPackageIdentity } from "@synopackageland/package-source/index-manifest";
+import { buildSpk } from "../build-spk/generator.js";
+import { loadCompose } from "../compose/analyze.js";
+import { loadContract } from "../contract/load.js";
+import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
+import { loadNative } from "../native/load.js";
+import { validateProject } from "../validate.js";
+import { validateCuratedCompose } from "./curated-release.js";
+/**
+ * Every gate for a public release that can be decided on the developer's own
+ * machine. Submitting runs these first so a definition that CI would reject
+ * never reaches review; `--check` runs the same set and stops.
+ *
+ * Deliberately excludes anything needing release authority: Build allocation,
+ * attestation signing and catalog publication belong to trusted CI running
+ * from the merged revision, and no local run can stand in for a maintainer's
+ * approval.
+ */
+export async function runPublicReleasePreflight(project) {
+    const checks = [];
+    const add = (check) => {
+        checks.push(check);
+        return check.ok;
+    };
+    const validation = validateProject(project, { profile: "listing" });
+    add({
+        id: "listing-validate",
+        title: "App Contract 與 runtime 通過 Curated listing profile",
+        ok: validation.ok,
+        detail: validation.ok ? undefined : validation.errors.map((error) => error.code).join(", "),
+    });
+    const contract = loadContract(project.contractPath).contract;
+    const packageIdentity = typeof contract.package === "string" ? contract.package : "";
+    const formalIdentity = packageIdentity.length > 0 && !isDevelopmentPackageIdentity(packageIdentity);
+    add({
+        id: "formal-identity",
+        title: "Package Identity 是正式身分（不是 .dev）",
+        ok: formalIdentity,
+        detail: formalIdentity
+            ? undefined
+            : packageIdentity.length === 0
+                ? "App Contract 缺少 package 欄位。"
+                : `Curated 不接受 development identity：${packageIdentity}`,
+    });
+    const nativePath = project.nativePath;
+    const isNative = nativePath !== undefined && existsSync(nativePath);
+    if (isNative) {
+        const parsedNative = loadNative(nativePath);
+        const families = Object.keys(parsedNative?.native.targets ?? {}).filter(isNativeArchFamily);
+        const pinned = families.filter((family) => {
+            const target = parsedNative?.native.targets?.[family];
+            return typeof target?.url === "string" && typeof target?.sha256 === "string";
+        });
+        add({
+            id: "curated-runtime",
+            title: "每個 native target 都以 url + sha256 釘住",
+            ok: families.length > 0 && pinned.length === families.length,
+            detail: families.length === 0
+                ? "native.yaml 沒有宣告任何 target。"
+                : pinned.length === families.length
+                    ? undefined
+                    : `缺少 url 或 sha256：${families.filter((f) => !pinned.includes(f)).join(", ")}`,
+        });
+    }
+    else {
+        const parsedCompose = loadCompose(project.composePath);
+        const gate = parsedCompose
+            ? validateCuratedCompose(parsedCompose.compose)
+            : { ok: false, errors: ["CURATED_COMPOSE_MISSING"] };
+        add({
+            id: "curated-runtime",
+            title: "Compose 只用釘住 digest 的公開 image，且沒有 build:",
+            ok: gate.ok,
+            detail: gate.ok ? undefined : gate.errors.join(", "),
+        });
+    }
+    // The strongest local gate: actually produce the artifact. For native this
+    // fetches each pinned asset and refuses it unless the bytes hash to the
+    // declared sha256, so a bad pin fails here instead of in CI.
+    if (checks.every((check) => check.ok)) {
+        const staging = mkdtempSync(join(tmpdir(), "synopkgland-preflight-"));
+        try {
+            const families = isNative
+                ? Object.keys(loadNative(nativePath)?.native.targets ?? {}).filter(isNativeArchFamily)
+                : [undefined];
+            for (const family of families) {
+                const built = await buildSpk({
+                    project,
+                    outputPath: join(staging, `${packageIdentity}-${family ?? "noarch"}.spk`),
+                    ...(family ? { archFamily: family } : {}),
+                });
+                add({
+                    id: family ? `spk-builds:${family}` : "spk-builds",
+                    title: family ? `SPK 可建置（${family}，含 sha256 比對）` : "SPK 可建置",
+                    ok: built.ok,
+                    detail: built.ok ? undefined : built.errors.join(", "),
+                });
+                if (!built.ok) {
+                    break;
+                }
+            }
+        }
+        finally {
+            rmSync(staging, { recursive: true, force: true });
+        }
+    }
+    return { ok: checks.every((check) => check.ok), checks };
+}
+export function formatPreflight(result) {
+    return result.checks
+        .map((check) => `${check.ok ? "✔" : "✖"} ${check.title}${check.detail ? `\n    ${check.detail}` : ""}`)
+        .join("\n");
+}

package/dist/publish/publish.d.ts

@@ -1,6 +1,9 @@
 import type { ProjectRoot } from "../discovery.js";
+import { type PreflightResult } from "./preflight.js";
 import type { GitHubCli, GitOps } from "./github-pr.js";
 export interface PublishProjectOptions {
+    /** Injected in tests; production runs the real local gate set. */
+    preflight?: (project: ProjectRoot) => Promise<PreflightResult>;
     project: ProjectRoot;
     communityAppsRoot?: string;
     baseBranch?: string;
@@ -10,6 +13,7 @@ export interface PublishProjectOptions {
     now?: () => Date;
 }
 export interface PublishProjectResult {
+    preflight?: PreflightResult;
     ok: boolean;
     code?: string;
     message?: string;

package/dist/publish/publish.js

@@ -1,6 +1,6 @@
 import { join, resolve } from "node:path";
 import { loadContract } from "../contract/load.js";
-import { validateProject } from "../validate.js";
+import { runPublicReleasePreflight } from "./preflight.js";
 import { assertDirectoryMatchesPackage, COMMUNITY_APPS_APPS_DIR, COMMUNITY_APPS_DIR, communityAppDirectory, resolveCommunityAppsRoot, } from "./community-path.js";
 import { listSyncedRelativePaths, syncPackagingDefinition } from "./sync-definition.js";
 function slugifyPackageIdentity(packageIdentity) {
@@ -28,12 +28,20 @@ function renderPullRequestBody(packageIdentity, appRelativePath, files) {
     ].join("\n");
 }
 export async function publishProject(options) {
-    const validation = validateProject(options.project, { profile: "listing" });
-    if (!validation.ok) {
+    // Every locally decidable gate runs before anything is pushed, so a
+    // definition CI would reject never costs a maintainer a review.
+    const preflight = options.preflight
+        ? await options.preflight(options.project)
+        : await runPublicReleasePreflight(options.project);
+    if (!preflight.ok) {
         return {
             ok: false,
-            code: "VALIDATION_FAILED",
-            message: validation.errors.map((error) => error.code).join(", "),
+            code: "PREFLIGHT_FAILED",
+            message: preflight.checks
+                .filter((check) => !check.ok)
+                .map((check) => `${check.id}${check.detail ? `: ${check.detail}` : ""}`)
+                .join("; "),
+            preflight,
         };
     }
     const communityRoot = options.communityAppsRoot ?? resolveCommunityAppsRoot(options.project.root);

package/dist/release-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/release-bin.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * Trusted-CI entry point. Kept out of the `synopkgland` developer binary on
+ * purpose: allocating a Package Build, signing attestations and publishing to
+ * the Curated Package Source require release authority that a developer's
+ * machine must never hold. Only CI running from the reviewed merged revision
+ * has the keyring, the ledger write credential and the publish credential.
+ */
+import { loadDotEnv } from "./load-env.js";
+import { runCuratedReleaseCli } from "./publish/curated-release.js";
+loadDotEnv();
+runCuratedReleaseCli(["node", "synopkgland-release", "release", ...process.argv.slice(2)])
+    .then((status) => {
+    process.exitCode = status;
+})
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
-    "synopkgland": "./dist/bin.js"
+    "synopkgland": "./dist/bin.js",
+    "synopkgland-release": "./dist/release-bin.js"
   },
   "files": [
     "dist",