@synopackageland/cli 0.3.0 → 0.3.2

package/dist/host/dsm-compound.js

@@ -0,0 +1,120 @@
+export class DsmCompoundError extends Error {
+    code;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.code = code;
+        this.name = "DsmCompoundError";
+        this.api = options.api;
+        this.method = options.method;
+        this.errorCode = options.errorCode;
+        this.dsmErrorCode = options.dsmErrorCode;
+        this.detail = options.detail;
+    }
+    api;
+    method;
+    errorCode;
+    dsmErrorCode;
+    detail;
+}
+/**
+ * Parse the response envelope returned by SYNO.Entry.Request compound calls.
+ * A textual DSM error code is intentionally not converted to a number.
+ */
+export function parseDsmCompoundResponse(raw) {
+    const root = requireRecord(raw, "response");
+    if (typeof root.success !== "boolean") {
+        throw invalidShape("response.success must be a boolean");
+    }
+    const data = requireRecord(root.data, "response.data");
+    if (typeof data.has_fail !== "boolean") {
+        throw invalidShape("response.data.has_fail must be a boolean");
+    }
+    if (!Array.isArray(data.result)) {
+        throw invalidShape("response.data.result must be an array");
+    }
+    const results = data.result.map((rawResult, index) => {
+        const result = requireRecord(rawResult, `response.data.result[${index}]`);
+        const api = requireNonEmptyString(result.api, `response.data.result[${index}].api`);
+        const method = requireNonEmptyString(result.method, `response.data.result[${index}].method`);
+        if (typeof result.success !== "boolean") {
+            throw invalidShape(`response.data.result[${index}].success must be a boolean`);
+        }
+        const error = result.error;
+        if (error !== undefined && !isRecord(error)) {
+            throw invalidShape(`response.data.result[${index}].error must be an object when present`);
+        }
+        const errorCode = numericErrorCode(error);
+        return errorCode === undefined
+            ? { api, method, success: result.success }
+            : { api, method, success: result.success, errorCode };
+    });
+    return { hasFail: data.has_fail, results };
+}
+/**
+ * Fail closed on every DSM compound failure signal. The returned parsed value
+ * is only reachable when the top-level request and every compound step pass.
+ */
+export function assertDsmCompoundResponse(raw) {
+    const root = requireRecord(raw, "response");
+    if (root.success !== true) {
+        const errorCode = numericErrorCode(root.error);
+        throw new DsmCompoundError("DSM_REQUEST_FAILED", "DSM SYNO.Entry.Request compound request failed", {
+            dsmErrorCode: errorCode,
+            detail: root.error ?? root,
+        });
+    }
+    const parsed = parseDsmCompoundResponse(raw);
+    const resultRecords = root.data.result;
+    const dependencyConflictIndex = parsed.results.findIndex((result) => result.errorCode === 4552);
+    if (dependencyConflictIndex >= 0) {
+        const result = parsed.results[dependencyConflictIndex];
+        throw new DsmCompoundError("DSM_DEPENDENCY_CONFLICT", `DSM ${result.api}/${result.method} rejected the package because a dependency is running`, {
+            api: result.api,
+            method: result.method,
+            errorCode: result.errorCode,
+            dsmErrorCode: 4552,
+            detail: failureDetail(resultRecords[dependencyConflictIndex]),
+        });
+    }
+    const firstFailureIndex = parsed.results.findIndex((result) => result.success === false);
+    if (parsed.hasFail || firstFailureIndex >= 0) {
+        const result = firstFailureIndex >= 0 ? parsed.results[firstFailureIndex] : undefined;
+        throw new DsmCompoundError("DSM_COMPOUND_FAILED", result
+            ? `DSM compound step ${result.api}/${result.method} failed`
+            : "DSM compound request reported a failed step", {
+            api: result?.api,
+            method: result?.method,
+            errorCode: result?.errorCode,
+            detail: firstFailureIndex >= 0 ? failureDetail(resultRecords[firstFailureIndex]) : root.data,
+        });
+    }
+    return parsed;
+}
+function failureDetail(rawResult) {
+    const result = isRecord(rawResult) ? rawResult : undefined;
+    return result?.error ?? rawResult;
+}
+function numericErrorCode(error) {
+    if (!isRecord(error) || typeof error.code !== "number" || !Number.isFinite(error.code)) {
+        return undefined;
+    }
+    return error.code;
+}
+function requireRecord(value, path) {
+    if (!isRecord(value)) {
+        throw invalidShape(`${path} must be an object`);
+    }
+    return value;
+}
+function requireNonEmptyString(value, path) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw invalidShape(`${path} must be a non-empty string`);
+    }
+    return value;
+}
+function invalidShape(message) {
+    return new TypeError(`Invalid DSM compound response: ${message}`);
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}

package/dist/host/fake-nas.d.ts

@@ -2,6 +2,7 @@ import type { AttestationKind, HostInstallRecord, NasHost } from "./types.js";
 export interface FakeNasHostOptions {
     curated?: string[];
     dsmOrigin?: string;
+    homesPath?: string;
     installationId?: string;
     shares?: Record<string, string>;
     installedEnv?: Record<string, Record<string, string>>;

package/dist/host/fake-nas.js

@@ -24,6 +24,9 @@ export function createFakeNasHost(options = {}) {
         async resolveSharePath(logicalName) {
             return shares[logicalName];
         },
+        async resolveHomesPath() {
+            return options.homesPath;
+        },
         async getInstalledProjectEnv(packageIdentity) {
             const env = installedEnv[packageIdentity];
             return env ? { ...env } : undefined;

package/dist/host/types.d.ts

@@ -1,3 +1,4 @@
+import type { InstalledPackageState } from "./catalog-install.js";
 export type AttestationKind = "local" | "app-package" | "none";
 export interface DeployIdentity {
     packageId: string;
@@ -50,9 +51,12 @@ export interface NasHost {
      */
     getArchFamily?(): Promise<"x86_64" | "aarch64" | undefined>;
     resolveSharePath?(logicalName: string): Promise<string | undefined>;
+    /** Resolve the NAS-specific user-home root when DSM User Home is enabled. */
+    resolveHomesPath?(): Promise<string | undefined>;
     getInstalledProjectEnv?(packageIdentity: string): Promise<Record<string, string> | undefined>;
     ensurePackageSource?(origin: string): Promise<void>;
     getInstalledPackageVersion?(packageIdentity: string): Promise<string | undefined>;
+    getInstalledPackageState?(packageIdentity: string): Promise<InstalledPackageState | undefined>;
     getAttestationInfo(packageIdentity: string): Promise<HostAttestationInfo>;
     isPackageInstalled(packageIdentity: string): Promise<boolean>;
     fetchContainerLogs(packageIdentity: string): Promise<string[]>;

package/dist/publish/curated-release.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { decodeJwt, decodeProtectedHeader, importJWK, importPKCS8, importSPKI, jwtVerify, } from "jose";
-import { buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
+import { CURATED_BUILD_OFFSET, buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
 import { createR2CuratedReleasePublisher, publishCuratedRelease, } from "@synopackageland/package-source/publish-spk";
 import { digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabilities, signCuratedAppPackageAttestationToken, signCuratedReleaseAttestationToken, } from "../attestation/app-package.js";
 import { CuratedTrustRootError, loadCuratedTrustRoot, resolveCuratedSigningTrust, } from "../attestation/keyring.js";
@@ -496,7 +496,7 @@ function prepareRelease(project, build) {
     if (/-\d+$/.test(appVersion)) {
         throw new CuratedReleaseError("CURATED_BUILD_MUST_NOT_BE_IN_SOURCE_VERSION");
     }
-    const version = `${appVersion}-${String(build).padStart(4, "0")}`;
+    const version = `${appVersion}-${String(CURATED_BUILD_OFFSET + build).padStart(5, "0")}`;
     const validation = validateProject(project, { profile: "listing" });
     if (!validation.ok) {
         throw new CuratedReleaseError("CURATED_VALIDATION_FAILED", validation.errors.map((error) => error.code).join(","));
@@ -805,7 +805,7 @@ function parseBuild(value) {
     return build;
 }
 function isValidBuild(build) {
-    return Number.isSafeInteger(build) && build > 0;
+    return Number.isSafeInteger(build) && build > 0 && build < CURATED_BUILD_OFFSET;
 }
 async function loadJwkSigningMaterial(raw, kidFromEnv) {
     const parsed = JSON.parse(raw);

package/dist/publish/platform-service-release.d.ts

@@ -0,0 +1,60 @@
+import { type CuratedReleasePublisher } from "@synopackageland/package-source/publish-spk";
+import { type PlatformServiceReleaseErrorCode, type PlatformAttestationSigner } from "../attestation/platform-service.js";
+export declare const SYNOPKGLAND_SOURCE_REVISION_ENV = "SYNOPKGLAND_SOURCE_REVISION";
+export declare const PLATFORM_SERVICE_OS_MIN_VER = "7.2-69057";
+export type PlatformReleaseErrorCode = "PLATFORM_RELEASE_USAGE" | "PLATFORM_BROKER_DIR_INVALID" | "PLATFORM_APP_PROJECT_FORBIDDEN" | "PLATFORM_ARTIFACT_INPUT_FORBIDDEN" | "PLATFORM_BUILD_INVALID" | "PLATFORM_SOURCE_REVISION_MISSING" | "PLATFORM_BUILDER_UNAVAILABLE" | "PLATFORM_BUILD_FAILED" | "PLATFORM_RELEASE_FAILED" | PlatformServiceReleaseErrorCode;
+/** Errors owned by the platform release entry point, separate from signer errors. */
+export declare class PlatformReleaseError extends Error {
+    readonly code: PlatformReleaseErrorCode;
+    constructor(code: PlatformReleaseErrorCode, detail?: string);
+}
+export interface PlatformServiceReleaseBaseline {
+    sourceVersion: string;
+    baselineBuild: number;
+}
+export interface PlatformServiceBuildOptions {
+    outputPath: string;
+    releaseVersion: string;
+}
+/** The broker-side module contract used by production and by release tests. */
+export interface PlatformServiceBuilder {
+    buildBrokerSpk(options: PlatformServiceBuildOptions): unknown | Promise<unknown>;
+    brokerReleaseBaseline(): PlatformServiceReleaseBaseline;
+}
+export interface PlatformServiceReleaseOptions {
+    brokerDir: string;
+    build: number;
+    sourceRevision: string;
+    signer: PlatformAttestationSigner;
+    publisher: CuratedReleasePublisher;
+    /** Tests may inject a builder; production loads the broker-side module. */
+    builder?: PlatformServiceBuilder;
+}
+export interface PlatformServiceReleaseResult {
+    packageIdentity: string;
+    packageBuild: number;
+    version: string;
+    artifactKey: string;
+    artifactDigest: string;
+    attestationKey: string;
+    attestationDigest: string;
+}
+export interface PlatformServiceReleaseCliDependencies {
+    /** Test seams; production creates these from the environment and R2 target. */
+    signer?: PlatformAttestationSigner;
+    publisher?: CuratedReleasePublisher;
+    builder?: PlatformServiceBuilder;
+    /** Optional output seams keep CLI tests independent of process-global streams. */
+    writeStdout?: (line: string) => void;
+    writeStderr?: (line: string) => void;
+}
+/**
+ * Build, attest and publish one immutable Broker SPK release.
+ *
+ * All cheap input gates run before the broker builder is loaded or invoked.
+ * Publication is delegated to the package-source three-phase boundary, which
+ * enforces artifact -> attestation -> index ordering.
+ */
+export declare function releasePlatformService(options: PlatformServiceReleaseOptions): Promise<PlatformServiceReleaseResult>;
+/** Run the trusted platform release verb and emit exactly one line. */
+export declare function runPlatformServiceReleaseCli(argv?: string[], env?: NodeJS.Dict<string>, dependencies?: PlatformServiceReleaseCliDependencies): Promise<number>;

package/dist/publish/platform-service-release.js

@@ -0,0 +1,333 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
+import { createR2CuratedReleasePublisher, publishCuratedRelease, } from "@synopackageland/package-source/publish-spk";
+import { createPlatformAttestationSignerFromEnv, digestPlatformServiceReleaseClaims, PLATFORM_SERVICE_PACKAGE_IDENTITY, PlatformServiceReleaseError, } from "../attestation/platform-service.js";
+export const SYNOPKGLAND_SOURCE_REVISION_ENV = "SYNOPKGLAND_SOURCE_REVISION";
+export const PLATFORM_SERVICE_OS_MIN_VER = "7.2-69057";
+/** Errors owned by the platform release entry point, separate from signer errors. */
+export class PlatformReleaseError extends Error {
+    code;
+    constructor(code, detail) {
+        super(detail ? `${code}: ${detail}` : code);
+        this.code = code;
+        this.name = "PlatformReleaseError";
+    }
+}
+/**
+ * Build, attest and publish one immutable Broker SPK release.
+ *
+ * All cheap input gates run before the broker builder is loaded or invoked.
+ * Publication is delegated to the package-source three-phase boundary, which
+ * enforces artifact -> attestation -> index ordering.
+ */
+export async function releasePlatformService(options) {
+    const brokerDir = validatePlatformReleaseRequest(options);
+    const builder = options.builder ?? (await loadPlatformServiceBuilder(brokerDir));
+    const baseline = readReleaseBaseline(builder);
+    if (options.build <= baseline.baselineBuild) {
+        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
+    }
+    const version = `${baseline.sourceVersion}-${String(options.build).padStart(4, "0")}`;
+    const workspace = mkdtempSync(join(tmpdir(), "synopkgland-platform-release-"));
+    try {
+        const outputPath = join(workspace, `${PLATFORM_SERVICE_PACKAGE_IDENTITY}.spk`);
+        try {
+            await builder.buildBrokerSpk({ outputPath, releaseVersion: version });
+            if (!existsSync(outputPath)) {
+                throw new Error("broker builder did not create the requested output");
+            }
+        }
+        catch (error) {
+            rethrowKnownReleaseError(error);
+            throw new PlatformReleaseError("PLATFORM_BUILD_FAILED");
+        }
+        let artifact;
+        try {
+            artifact = digestArtifact(outputPath);
+        }
+        catch (error) {
+            rethrowKnownReleaseError(error);
+            throw new PlatformReleaseError("PLATFORM_BUILD_FAILED");
+        }
+        const attestationInput = {
+            packageIdentity: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            sourceVersion: baseline.sourceVersion,
+            packageBuild: options.build,
+            packageVersion: version,
+            artifactDigest: artifact.sha256,
+            sourceRevision: options.sourceRevision,
+            osMinVer: PLATFORM_SERVICE_OS_MIN_VER,
+            arch: "noarch",
+        };
+        let signed;
+        try {
+            signed = await options.signer.sign(attestationInput);
+            assertPlatformClaims(signed.claims, attestationInput);
+        }
+        catch (error) {
+            rethrowKnownReleaseError(error);
+            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
+        }
+        let verified;
+        try {
+            verified = await options.signer.verify(signed.token);
+            assertPlatformClaims(verified, attestationInput);
+            if (signed.attestationDigest !== digestPlatformServiceReleaseClaims(verified)) {
+                throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", "attestation digest does not match verified claims");
+            }
+        }
+        catch (error) {
+            rethrowKnownReleaseError(error);
+            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
+        }
+        const artifactKey = buildImmutableSpkKey({
+            package: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            version,
+            sha256: artifact.sha256,
+        });
+        const attestationKey = buildImmutableAttestationKey({
+            package: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            version,
+            artifactDigest: artifact.sha256,
+        });
+        const tokenSha256 = digestBytes(Buffer.from(signed.token, "utf8"), "sha256");
+        const attestation = {
+            kind: "platform-service-release",
+            packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            version,
+            packageBuild: options.build,
+            artifactDigest: artifact.sha256,
+            key: attestationKey,
+            token: signed.token,
+            digest: signed.attestationDigest,
+            tokenSha256,
+            verificationJwk: options.signer.verificationJwk,
+        };
+        const index = {
+            packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            version,
+            displayname: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            description: "Trusted control plane for Synology App Packages.",
+            maintainer: "Synology",
+            osMinVer: PLATFORM_SERVICE_OS_MIN_VER,
+            artifact: {
+                key: artifactKey,
+                size: artifact.size,
+                md5: artifact.md5,
+                sha256: artifact.sha256,
+            },
+            attestation: {
+                kind: "platform-service-release",
+                key: attestationKey,
+                digest: signed.attestationDigest,
+                packageBuild: options.build,
+                artifactDigest: artifact.sha256,
+            },
+        };
+        try {
+            await publishCuratedRelease({
+                artifact: {
+                    packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+                    version,
+                    path: outputPath,
+                    key: artifactKey,
+                    size: artifact.size,
+                    md5: artifact.md5,
+                    sha256: artifact.sha256,
+                },
+                attestation,
+                index,
+            }, options.publisher);
+        }
+        catch (error) {
+            rethrowKnownReleaseError(error);
+            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
+        }
+        return {
+            packageIdentity: PLATFORM_SERVICE_PACKAGE_IDENTITY,
+            packageBuild: options.build,
+            version,
+            artifactKey,
+            artifactDigest: artifact.sha256,
+            attestationKey,
+            attestationDigest: signed.attestationDigest,
+        };
+    }
+    finally {
+        rmSync(workspace, { recursive: true, force: true });
+    }
+}
+/** Run the trusted platform release verb and emit exactly one line. */
+export async function runPlatformServiceReleaseCli(argv = process.argv, env = process.env, dependencies = {}) {
+    const writeStdout = dependencies.writeStdout ?? ((line) => process.stdout.write(line));
+    const writeStderr = dependencies.writeStderr ?? ((line) => process.stderr.write(line));
+    try {
+        if (argv[2] !== "release-platform-service" ||
+            !argv[3] ||
+            !argv[4] ||
+            argv.length > 5) {
+            throw new PlatformReleaseError("PLATFORM_RELEASE_USAGE");
+        }
+        if (argv.slice(2).some((argument) => argument.endsWith(".spk"))) {
+            throw new PlatformReleaseError("PLATFORM_ARTIFACT_INPUT_FORBIDDEN");
+        }
+        const build = parseBuild(argv[4]);
+        const sourceRevision = resolveSourceRevision(env);
+        const brokerDir = resolve(process.cwd(), argv[3]);
+        validatePlatformBrokerDirectory(brokerDir);
+        const signer = dependencies.signer ?? (await createPlatformAttestationSignerFromEnv(env));
+        const publisher = dependencies.publisher ?? createR2CuratedReleasePublisher();
+        const result = await releasePlatformService({
+            brokerDir,
+            build,
+            sourceRevision,
+            signer,
+            publisher,
+            builder: dependencies.builder,
+        });
+        writeStdout(`${JSON.stringify({
+            packageIdentity: result.packageIdentity,
+            packageBuild: result.packageBuild,
+            version: result.version,
+            artifactDigest: result.artifactDigest,
+            attestationDigest: result.attestationDigest,
+        })}\n`);
+        return 0;
+    }
+    catch (error) {
+        writeStderr(`${releaseErrorCode(error)}\n`);
+        return 1;
+    }
+}
+function validatePlatformReleaseRequest(options) {
+    if (typeof options.brokerDir !== "string" ||
+        options.brokerDir.endsWith(".spk") ||
+        String(options.build).endsWith(".spk") ||
+        typeof options.sourceRevision !== "string" ||
+        options.sourceRevision.endsWith(".spk")) {
+        throw new PlatformReleaseError("PLATFORM_ARTIFACT_INPUT_FORBIDDEN");
+    }
+    if (!Number.isSafeInteger(options.build) || options.build <= 0) {
+        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
+    }
+    if (!/^[a-f0-9]{40}$/.test(options.sourceRevision)) {
+        throw new PlatformReleaseError("PLATFORM_SOURCE_REVISION_MISSING");
+    }
+    const brokerDir = resolve(options.brokerDir);
+    validatePlatformBrokerDirectory(brokerDir);
+    return brokerDir;
+}
+function validatePlatformBrokerDirectory(brokerDir) {
+    if (basename(brokerDir) !== "broker" ||
+        basename(dirname(brokerDir)) !== "packages") {
+        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(readFileSync(join(brokerDir, "package.json"), "utf8"));
+    }
+    catch {
+        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
+    }
+    if (!packageJson ||
+        typeof packageJson !== "object" ||
+        Array.isArray(packageJson) ||
+        packageJson.name !== "@synology/app-broker") {
+        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
+    }
+    if (existsSync(join(brokerDir, "synology-app.yaml"))) {
+        throw new PlatformReleaseError("PLATFORM_APP_PROJECT_FORBIDDEN");
+    }
+}
+function parseBuild(value) {
+    if (!/^\d+$/.test(value)) {
+        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
+    }
+    const build = Number(value);
+    if (!Number.isSafeInteger(build) || build <= 0) {
+        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
+    }
+    return build;
+}
+function resolveSourceRevision(env) {
+    const raw = env[SYNOPKGLAND_SOURCE_REVISION_ENV] ?? env.GITHUB_SHA;
+    const sourceRevision = typeof raw === "string" ? raw.trim() : "";
+    if (!/^[a-f0-9]{40}$/.test(sourceRevision)) {
+        throw new PlatformReleaseError("PLATFORM_SOURCE_REVISION_MISSING");
+    }
+    return sourceRevision;
+}
+async function loadPlatformServiceBuilder(brokerDir) {
+    const modulePath = join(brokerDir, "dist", "spk", "build.js");
+    let loaded;
+    try {
+        loaded = (await import(pathToFileURL(modulePath).href));
+    }
+    catch {
+        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
+    }
+    if (typeof loaded.buildBrokerSpk !== "function" ||
+        typeof loaded.brokerReleaseBaseline !== "function") {
+        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
+    }
+    return {
+        buildBrokerSpk: loaded.buildBrokerSpk,
+        brokerReleaseBaseline: loaded.brokerReleaseBaseline,
+    };
+}
+function readReleaseBaseline(builder) {
+    let baseline;
+    try {
+        baseline = builder.brokerReleaseBaseline();
+    }
+    catch {
+        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
+    }
+    if (!baseline ||
+        typeof baseline.sourceVersion !== "string" ||
+        !/^\d+\.\d+\.\d+$/.test(baseline.sourceVersion) ||
+        !Number.isSafeInteger(baseline.baselineBuild) ||
+        baseline.baselineBuild < 0) {
+        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
+    }
+    return baseline;
+}
+function digestArtifact(path) {
+    const bytes = readFileSync(path);
+    return {
+        size: bytes.byteLength,
+        md5: digestBytes(bytes, "md5"),
+        sha256: digestBytes(bytes, "sha256"),
+    };
+}
+function digestBytes(bytes, algorithm) {
+    return createHash(algorithm).update(bytes).digest("hex");
+}
+function assertPlatformClaims(claims, expected) {
+    if (!claims ||
+        claims.packageIdentity !== expected.packageIdentity ||
+        claims.sourceVersion !== expected.sourceVersion ||
+        claims.packageBuild !== expected.packageBuild ||
+        claims.packageVersion !== expected.packageVersion ||
+        claims.artifactDigest !== expected.artifactDigest ||
+        claims.sourceRevision !== expected.sourceRevision ||
+        claims.osMinVer !== expected.osMinVer ||
+        claims.arch !== expected.arch) {
+        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", "platform release claims do not bind the release input");
+    }
+}
+function rethrowKnownReleaseError(error) {
+    if (error instanceof PlatformServiceReleaseError || error instanceof PlatformReleaseError) {
+        throw error;
+    }
+}
+function releaseErrorCode(error) {
+    if (error instanceof PlatformServiceReleaseError || error instanceof PlatformReleaseError) {
+        return error.code;
+    }
+    return "PLATFORM_RELEASE_FAILED";
+}

package/dist/publish/preflight.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { isDevelopmentPackageIdentity } from "@synopackageland/package-source/index-manifest";
+import { CURATED_BUILD_OFFSET, isDevelopmentPackageIdentity, } from "@synopackageland/package-source/index-manifest";
 import { buildSpk } from "../build-spk/generator.js";
 import { loadCompose } from "../compose/analyze.js";
 import { loadContract } from "../contract/load.js";
@@ -33,6 +33,19 @@ export async function runPublicReleasePreflight(project) {
         detail: validation.ok ? undefined : validation.errors.map((error) => error.code).join(", "),
     });
     const contract = loadContract(project.contractPath).contract;
+    const contractVersion = typeof contract.version === "string" ? contract.version.trim() : "";
+    const sourceBuild = /-(\d+)$/.exec(contractVersion);
+    const sourceBuildNumber = sourceBuild ? Number(sourceBuild[1]) : undefined;
+    add({
+        id: "version-namespace",
+        title: "App Contract 不手寫 Curated Package Build",
+        ok: sourceBuildNumber === undefined ||
+            (Number.isSafeInteger(sourceBuildNumber) && sourceBuildNumber < CURATED_BUILD_OFFSET),
+        detail: sourceBuildNumber !== undefined &&
+            (!Number.isSafeInteger(sourceBuildNumber) || sourceBuildNumber >= CURATED_BUILD_OFFSET)
+            ? "CURATED_BUILD_MUST_NOT_BE_IN_SOURCE_VERSION"
+            : undefined,
+    });
     const packageIdentity = typeof contract.package === "string" ? contract.package : "";
     const formalIdentity = packageIdentity.length > 0 && !isDevelopmentPackageIdentity(packageIdentity);
     add({

package/dist/release-bin.js

@@ -8,8 +8,12 @@
  */
 import { loadDotEnv } from "./load-env.js";
 import { runCuratedReleaseCli } from "./publish/curated-release.js";
+import { runPlatformServiceReleaseCli } from "./publish/platform-service-release.js";
 loadDotEnv();
-runCuratedReleaseCli(["node", "synopkgland-release", "release", ...process.argv.slice(2)])
+const releaseRun = process.argv[2] === "release-platform-service"
+    ? runPlatformServiceReleaseCli(process.argv, process.env)
+    : runCuratedReleaseCli(["node", "synopkgland-release", "release", ...process.argv.slice(2)]);
+releaseRun
     .then((status) => {
     process.exitCode = status;
 })

package/dist/templates/hello-files/compose.yaml

@@ -4,5 +4,7 @@ services:
     command: ["sleep", "infinity"]
     user: "${RUN_AS_UID}:${RUN_AS_GID}"
     volumes:
+      # Dynamic Shared Folder plus writable /state is Broker-managed and is
+      # intentionally outside the zero-config docker-project resource-worker path.
       - "${MEDIA_SHARE}/data:/data:ro"
       - "${SYNOPKG_PKGVAR}/state:/state"

package/dist/templates/hello-web/compose.yaml

@@ -1,7 +1,18 @@
 services:
   web:
-    image: nginx:alpine
+    image: busybox:1.36
+    # 兩個平台限制，改動前先看 docs/impl/STATUS.md 的 2026-08-24 段：
+    # 1) command／entrypoint 陣列不得有純數字元素（例如 "18333"）。DSM 的
+    #    docker-project worker 會在 YAML round-trip 時掉引號、把它變成整數，
+    #    postinst acquire 直接失敗（error 276 → 套件 broken/150，且 worker_msg
+    #    為空，開發者看不到原因）。所以 port 要包在單一字串裡。
+    #    `synopkgland validate` 已會擋這個寫法。
+    # 2) 預設不用 8080：那個 port 在真實 NAS 上很常被既有容器占用，而 port
+    #    衝突同樣以那個看不出原因的 broken/150 呈現。
+    # 官方 nginx image 也不能用：resource worker 注入任意 package UID/GID，
+    # nginx entrypoint 啟動階段需要 root，會在該身分下直接退出。
+    command: ["sh","-c","httpd -f -p 18333 -h /usr/share/nginx/html"]
     ports:
-      - "8080:80"
+      - "18333:18333"
     volumes:
-      - "${SYNOPKG_PKGVAR}/html:/usr/share/nginx/html:ro"
+      - "./html:/usr/share/nginx/html:ro"

package/dist/templates/hello-web/synology-app.yaml

@@ -6,7 +6,7 @@ description: A minimal Syno Package Land web app template.
 maintainer: Syno Package Land
 os_min_ver: "7.2-69057"
 adminprotocol: http
-adminport: 8080
+adminport: 18333
 adminurl: /
 integration:
   web: