@synopackageland/cli 0.3.10 → 0.4.0

package/dist/build-spk/native-lifecycle.js

@@ -1,5 +1,4 @@
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
-import { BROKER_INSTALLER_VARS, renderBrokerStatusProbe, } from "./broker-glue.js";
 /**
  * Escapes a literal string for safe inclusion in POSIX `/bin/sh` single quotes.
  * A single quote is represented as `'\''` (close single quote, literal escaped single quote, reopen single quote).
@@ -69,7 +68,6 @@ export function renderNativeStartStopStatus(input) {
     const envBlock = envLines.length > 0 ? `\n${envLines.join("\n")}` : "";
     const commandLine = [execToken, ...argTokens].join(" ");
     return `#!/bin/sh
-${BROKER_INSTALLER_VARS}
 PKGDEST="${pkgDestFallback}"
 PKGVAR="${pkgVarFallback}"
 PIDFILE="$PKGVAR/${pkg}.pid"
@@ -129,7 +127,6 @@ case "$1" in
     exit 0
     ;;
   status)
-${renderBrokerStatusProbe(pkg)}
     if pid_alive; then
       exit 0
     fi

package/dist/build-spk/native-payload.js

@@ -27,7 +27,6 @@ export async function materializeNativePayload(options) {
         // The payload root IS SYNOPKG_PKGDEST (/var/packages/<pkg>/target): DSM
         // extracts package.tgz straight into it. Nesting a literal `target/`
         // directory here would put the binary at $SYNOPKG_PKGDEST/target/<exec>.
-        // Same layout the Broker SPK ships (packages/broker/src/spk/build.ts).
         if (kind === "raw") {
             materializeRaw(sourceBytes, targetDir, rawSourceName(sourceName));
         }

package/dist/cli.js

@@ -1,4 +1,6 @@
+import { planDeployment, deployStandalone } from "./deploy/plan.js";
 import { Command } from "commander";
+import { renameSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { findProjectRoot } from "./discovery.js";
 import { loadContract } from "./contract/load.js";
@@ -14,13 +16,11 @@ import { deployProject } from "./deploy/deploy.js";
 import { createNasHost } from "./host/dsm-client.js";
 import { projectInfo, formatProjectInfo } from "./info.js";
 import { followProjectLogs } from "./log.js";
-import { testProjectOnHost } from "./test-host.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
-import { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
-import { formatPreflight, runPublicReleasePreflight } from "./publish/preflight.js";
-import { createExecGitHubCli, createExecGitOps } from "./publish/github-pr.js";
-import { communityAppsGitHubRepo } from "./publish/github-repo.js";
 import { resolveInstallParameterExtraValues } from "./deploy/param-values.js";
+import { findStandaloneRoot, loadStandaloneManifest } from "./standalone/manifest.js";
+import { buildStandalone } from "./standalone/build.js";
+import { inspectSpk } from "./standalone/inspect-spk.js";
 function collectKvOption(value, previous, flag, example) {
     const separator = value.indexOf("=");
     if (separator <= 0) {
@@ -44,6 +44,26 @@ function resolveProject(cwd, project) {
     const start = project ? resolve(cwd, project) : cwd;
     return findProjectRoot(start);
 }
+function standaloneRoot(cwd, project) {
+    return findStandaloneRoot(project ? resolve(cwd, project) : cwd);
+}
+function formatSpkInspection(spk, report) {
+    const lines = [
+        `SPK：${spk}`,
+        `package：${report.package ?? "?"}  version：${report.version ?? "?"}`,
+        `arch：${report.arch ?? "?"}  runtime：${report.kind ?? "?"}`,
+        `簽署：${report.signed ? "有 Synology 簽章" : "未簽署（Package Center 需允許任何發行者）"}`,
+        `CGI：${report.cgi ?? "無"}`,
+        "payload：",
+        ...report.payload.map((entry) => `  ${entry.mode} ${entry.path}`),
+    ];
+    const integration = report.payload.some(entry => entry.path === "integration/helper");
+    lines.push(report.findings.length === 0
+        ? integration ? "檢查：安裝以套件帳號執行；執行期整合另需管理員核准，此檢查不證明 integration ready。" : "檢查：沒有 root 權限需求或異常。"
+        : "問題：");
+    lines.push(...report.findings.map((finding) => `  - ${finding}`));
+    return lines.join("\n");
+}
 function requireProject(cwd, project) {
     const found = resolveProject(cwd, project);
     if (!found) {
@@ -52,6 +72,30 @@ function requireProject(cwd, project) {
     }
     return found;
 }
+async function buildStandaloneCommand(root, arch, options) {
+    if (options.output && !arch) {
+        console.error("-o 只能搭配 --arch 建置單一架構；多架構請用 --out-dir。");
+        process.exit(1);
+    }
+    const outDir = options.output
+        ? dirname(resolve(process.cwd(), options.output))
+        : options.outDir ? resolve(process.cwd(), options.outDir) : undefined;
+    try {
+        const { outputs } = await buildStandalone({ root, arches: arch ? [arch] : undefined, outDir });
+        for (let output of outputs) {
+            if (options.output) {
+                const target = resolve(process.cwd(), options.output);
+                renameSync(output, target);
+                output = target;
+            }
+            console.log(`已產生 ${output}`);
+        }
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+}
 export async function runCli(argv) {
     const program = new Command();
     program
@@ -59,51 +103,20 @@ export async function runCli(argv) {
         .description("Syno Package Land Developer Kit CLI")
         .option("--project <dir>", "App 專案根目錄");
     program
-        .command("doctor")
-        .description("唯讀診斷本機合約／Compose 與 NAS 部署狀態")
-        .option("--host <name>", "synoagentcli profile 或 NAS 名稱")
-        .option("--package <id>", "指定診斷的 Package Identity（省略時由合約判定）")
-        .option("--dev", "診斷 Development Package Identity（{package}.dev）")
-        .option("--json", "輸出 machine-readable JSON 診斷報告")
-        .action(async (options, command) => {
+        .command("validate")
+        .description("驗證 App Contract 與 Compose，或 Standalone Package 的 dsm-package.yaml")
+        .action((_options, command) => {
         const global = command.parent?.opts() ?? {};
-        const project = resolveProject(process.cwd(), global.project);
-        let host = null;
-        if (options.host) {
-            host = createNasHost({ host: options.host });
-            if (!host) {
-                console.error(`[${"HOST_CREDENTIALS_MISSING"}] 找不到 NAS 憑證。請設定 synoagentcli profile 或 DSM_URL／DSM_PASSWORD。`);
+        const standalone = standaloneRoot(process.cwd(), global.project);
+        if (standalone) {
+            const loaded = loadStandaloneManifest(standalone);
+            if (!loaded.ok) {
+                console.error(loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"));
                 process.exit(1);
             }
+            console.log("驗證通過。");
+            return;
         }
-        try {
-            const { runDoctor, formatDoctorReport } = await import("./doctor.js");
-            const report = await runDoctor({
-                project,
-                host,
-                packageId: options.package,
-                dev: options.dev,
-            });
-            if (options.json) {
-                console.log(JSON.stringify(report, null, 2));
-            }
-            else {
-                console.log(formatDoctorReport(report));
-            }
-            if (!report.ok) {
-                process.exit(1);
-            }
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    });
-    program
-        .command("validate")
-        .description("驗證 App Contract 與 Compose")
-        .action((options, command) => {
-        const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
         const result = validateProject(project, {
             profile: "personal",
@@ -119,19 +132,55 @@ export async function runCli(argv) {
     });
     program
         .command("inspect")
-        .description("檢視 Compose 意圖與 Web entry 提示")
-        .action((_options, command) => {
+        .description("檢視 Compose 意圖與 Web entry 提示；--spk 檢查已產生的 SPK")
+        .option("--spk <file>", "不安裝，檢查 SPK 的 identity、檔案 mode 與 root 權限需求")
+        .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
+        if (options.spk) {
+            const spk = resolve(process.cwd(), options.spk);
+            try {
+                const report = await inspectSpk(spk);
+                console.log(formatSpkInspection(spk, report));
+                if (report.findings.length > 0) {
+                    process.exit(1);
+                }
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : String(error));
+                process.exit(1);
+            }
+            return;
+        }
         const project = requireProject(process.cwd(), global.project);
         const report = inspectProject(project);
         console.log(formatInspectReport(report));
     });
     program
         .command("init")
-        .description("從模板建立 App 專案")
+        .description("從模板建立 App 專案（不覆蓋既有檔案）")
         .option("-t, --template <name>", `模板：${listTemplates().join(" | ")}`)
-        .option("--native", "建立 Native Prebuilt Binary App 專案")
+        .option("--binary", "建立 Binary App：以套件自己的帳號執行預先建置的 binary（等同 -t binary）")
+        .option("--package <id>", "native-go：INFO.package（預設由目錄名產生，例如 photo-tagger → PhotoTagger）")
+        .option("--name <display>", "native-go：顯示名稱（預設由目錄名產生）")
+        .option("--privilege <none|root>", "native-go：root 另加由 DSM 管理員在套件視窗核准的 root 操作（預設 none）")
+        .option("--ui <plain|vue>", "native-go：沿用 UI 0.3.1 的 Vue 介面（預設 plain）")
+        .option("--integration <go|better-auth>", "native-go --ui vue：每包 helper 與私有範例；better-auth 才加入 Node")
         .argument("[dir]", "目標目錄", ".")
+        .addHelpText("after", `
+模板分兩類：
+  獨立 Container / Binary App（synology-app.yaml）：
+    容器（compose.yaml）：hello-web、hello-web-page、hello-files、compose-import
+    binary（native.yaml）：執行一個預先建置的 binary 服務；可用 adminport 在自己的 port 提供網頁
+  Standalone Package（未簽署原生 SPK，含 Go CGI 與 DSM 視窗，dsm-package.yaml）：
+    native-go：Go CGI backend + DSM 視窗 UI，預設需登入、admin 動作另外宣告。
+      --privilege root：另加固定的 root 操作（root/<名稱>.sh），由 DSM 管理員在套件視窗
+      以密碼核准後才能執行；預設 none，完全不用 root。
+
+快速開始（native-go，需要 Go 1.24+）：
+  synopkgland init -t native-go my-app
+  cd my-app && $EDITOR backend/internal/app/routes.go ui/app.js
+  synopkgland build-spk          # → dist/<Package>-<version>-<arch>.spk
+  synopkgland inspect --spk dist/<file>.spk`)
         .action(async (dir, options, command) => {
         const global = command.parent?.opts() ?? {};
         if (global.project) {
@@ -139,27 +188,45 @@ export async function runCli(argv) {
             process.exit(1);
         }
         const targetDir = resolve(process.cwd(), dir);
-        if (options.native) {
-            initFromTemplate("native", targetDir);
-            console.log(`已建立 native 專案於 ${targetDir}`);
-            return;
+        const template = options.binary ? "binary" : options.template;
+        if (!template) {
+            console.error(`請指定 -t, --template <name> 或 --binary。可選模板：${listTemplates().join(" | ")}`);
+            process.exit(1);
         }
-        if (!options.template) {
-            console.error(`請指定 -t, --template <name> 或 --native。可選模板：${listTemplates().join(" | ")}`);
+        if (!isTemplateName(template)) {
+            console.error(`未知模板：${template}`);
             process.exit(1);
         }
-        if (!isTemplateName(options.template)) {
-            console.error(`未知模板：${options.template}`);
+        if ((options.package || options.name || options.privilege) && template !== "native-go") {
+            console.error("--package／--name／--privilege 只適用於 -t native-go。");
             process.exit(1);
         }
-        initFromTemplate(options.template, targetDir);
-        console.log(`已建立 ${options.template} 專案於 ${targetDir}`);
+        try {
+            initFromTemplate(template, targetDir, {
+                packageId: options.package,
+                displayName: options.name,
+                privilege: options.privilege,
+                ui: options.ui,
+                integration: options.integration,
+            });
+        }
+        catch (error) {
+            console.error(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+        console.log(`已建立 ${template} 專案於 ${targetDir}`);
+        if (template === "native-go") {
+            console.log(`下一步：
+  cd ${dir}
+  (cd backend && go test ./...)   # 認證與權限政策測試
+  synopkgland build-spk           # 編譯 Go + 打包每個架構的未簽署 SPK
+說明見 README.md。`);
+        }
     });
     program
         .command("dev")
-        .description("啟動本機 mock Broker 與 Compose")
-        .option("--files-root <dir>", "將本機目錄對應為 NAS Logical Path")
-        .action(async (options, command) => {
+        .description("啟動 App 自己的本機 Compose")
+        .action(async (_options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
         const validation = validateProject(project);
@@ -170,10 +237,7 @@ export async function runCli(argv) {
         try {
             const handle = await runDev({
                 project,
-                filesRoot: options.filesRoot,
             });
-            console.log(`Mock Broker：${handle.brokerBaseUrl}`);
-            console.log(`Bootstrap：${handle.bootstrapPath}`);
             console.log("Compose 已就緒。按 Ctrl+C 結束。");
             const shutdown = async () => {
                 await handle.close();
@@ -191,31 +255,9 @@ export async function runCli(argv) {
     program
         .command("test")
         .description("驗證契約並等待 Compose 就緒")
-        .option("--host <name>", "在已部署的 NAS 上執行 Open smoke")
-        .option("--dev", "檢查 Development Package Identity（{package}.dev）")
-        .action(async (options, command) => {
+        .action(async (_options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
-        if (options.host) {
-            const host = createNasHost({ host: options.host });
-            if (!host) {
-                console.error("找不到 NAS 憑證。請設定 synoagentcli profile 或 DSM_URL／DSM_PASSWORD。");
-                process.exit(1);
-            }
-            try {
-                const result = await testProjectOnHost({ project, host, dev: options.dev });
-                if (!result.ok) {
-                    console.error(result.message ?? "測試失敗。");
-                    process.exit(1);
-                }
-                console.log("NAS smoke 測試通過。");
-            }
-            catch (error) {
-                console.error(error instanceof Error ? error.message : String(error));
-                process.exit(1);
-            }
-            return;
-        }
         try {
             const result = await testProject({ project });
             if (!result.ok) {
@@ -231,16 +273,40 @@ export async function runCli(argv) {
     });
     program
         .command("deploy")
-        .description("Inner Loop Deploy 到 NAS（產生 SPK、簽發 Local Attestation、安裝）")
-        .requiredOption("--host <name>", "synoagentcli profile 或 NAS 名稱")
+        .description("建置獨立 SPK 並直接安裝到 DSM")
+        .option("--host <name>", "synoagentcli profile 或 NAS 名稱")
         .option("--arch <family>", "native App 的目標架構：x86_64 或 aarch64（省略時由 NAS 判定）")
         .option("--dev", "部署到 Development Package Identity（{package}.dev）")
-        .option("--replace-curated", "危險：將既有 Curated App Package Attestation 降級為 Local Attestation")
         .option("--share <slot=name>", "此 NAS 上的 Shared Folder 邏輯名（契約 shared_folder 槽，可重複）", collectShareOption)
         .option("--run-as <slot=name>", "此 NAS 上的 DSM 使用者邏輯名（契約 dsm_user 槽）", collectRunAsOption)
         .option("--param <NAME=value>", "契約 string/boolean Install Parameter 答案（可重複）", collectParamOption)
+        .option("--dry-run", "只輸出本機部署計畫，不連接 NAS")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
+        if (options.arch !== undefined && !isNativeArchFamily(String(options.arch))) {
+            throw new Error('--arch accepts x86_64 or aarch64');
+        }
+        const plan = planDeployment(resolve(process.cwd(), global.project ?? '.'), {
+            arch: options.arch, dev: options.dev,
+        });
+        if (options.dryRun) {
+            console.log(JSON.stringify(plan, null, 2));
+            return;
+        }
+        if (!options.host)
+            throw new Error('deploy requires --host, or use --dry-run');
+        if (plan.kind === 'native-go') {
+            if (options.share || options.runAs || options.param)
+                throw new Error('native-go does not accept container install parameters');
+            const host = createNasHost({ host: options.host });
+            if (!host)
+                throw new Error('NAS credentials not found');
+            const output = await deployStandalone(plan, host);
+            console.log(`已部署 ${plan.packageId}: ${output}`);
+            for (const note of plan.notes)
+                console.log(note);
+            return;
+        }
         const project = requireProject(process.cwd(), global.project);
         const parameterCheck = resolveInstallParameterExtraValues({
             contract: loadContract(project.contractPath).contract,
@@ -265,7 +331,6 @@ export async function runCli(argv) {
                 project,
                 host,
                 dev: options.dev,
-                replaceCurated: options.replaceCurated,
                 shareValues: options.share,
                 runAsValues: options.runAs,
                 paramValues: options.param,
@@ -289,7 +354,7 @@ export async function runCli(argv) {
     });
     program
         .command("info")
-        .description("顯示 NAS 上的 attestation、Open URL 與 readiness")
+        .description("顯示 DSM 套件狀態與 Open URL")
         .requiredOption("--host <name>", "synoagentcli profile 或 NAS 名稱")
         .option("--dev", "查詢 Development Package Identity")
         .action(async (options, command) => {
@@ -369,20 +434,27 @@ export async function runCli(argv) {
     });
     program
         .command("build-spk")
-        .description("產生本機 thin SPK（未簽署）")
-        .option("-o, --output <path>", "輸出 .spk 路徑")
-        .option("--arch <family>", "native App 的目標架構：x86_64 或 aarch64（Compose App 不需要）")
+        .description("產生本機未簽署 SPK：容器 App（synology-app.yaml）或 Standalone Package（dsm-package.yaml，會先編譯 UI 與 Go）")
+        .option("-o, --output <path>", "輸出 .spk 路徑（Standalone Package 只在建置單一架構時可用）")
+        .option("--out-dir <dir>", "Standalone Package：輸出目錄（預設 dist/）")
+        .option("--arch <family>", "目標架構：x86_64 或 aarch64（native App 必填；Standalone Package 預設建置 arches 全部）")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
-        const project = requireProject(process.cwd(), global.project);
         if (options.arch !== undefined && !isNativeArchFamily(String(options.arch))) {
             console.error(`--arch 只接受 x86_64 或 aarch64，收到 ${String(options.arch)}。`);
             process.exit(1);
         }
+        const archFamily = options.arch ? String(options.arch) : undefined;
+        const standalone = standaloneRoot(process.cwd(), global.project);
+        if (standalone) {
+            await buildStandaloneCommand(standalone, archFamily, options);
+            return;
+        }
+        const project = requireProject(process.cwd(), global.project);
         const result = await buildSpk({
             project,
             outputPath: options.output ? resolve(process.cwd(), options.output) : undefined,
-            archFamily: options.arch ? String(options.arch) : undefined,
+            archFamily,
         });
         if (!result.ok) {
             console.error(`建置失敗：${result.errors.join(", ")}`);
@@ -390,57 +462,5 @@ export async function runCli(argv) {
         }
         console.log(`已產生 ${result.outputPath}`);
     });
-    program
-        .command("public-release-submit")
-        .description("送審公開發佈：先跑完本機所有 Curated 檢查，通過才對 Community Apps 建立 Pull Request。"
-        + "不上傳 SPK、不簽署、不發佈——實際發佈由 maintainer 合併後的 trusted CI 執行。")
-        .option("--check", "只跑本機檢查，不建立 Pull Request")
-        .option("--base <branch>", "PR 目標分支", "master")
-        .action(async (options, command) => {
-        const global = command.parent?.opts() ?? {};
-        const project = requireProject(process.cwd(), global.project);
-        const preflight = await runPublicReleasePreflight(project);
-        if (!preflight.ok) {
-            // A gate's reasons belong on stderr so CI logs and `2>` capture them.
-            console.error(formatPreflight(preflight));
-            console.error("\n本機檢查未通過，未建立 Pull Request。");
-            process.exit(1);
-        }
-        console.log(formatPreflight(preflight));
-        if (options.check) {
-            console.log("\n本機檢查全部通過。加上 --check 以外的執行才會送審。");
-            return;
-        }
-        const communityAppsRoot = resolveCommunityAppsRoot(project.root);
-        if (!communityAppsRoot) {
-            console.error("送審需要 Community Apps 定義倉庫的本機副本。請先取得它，再從你的 App 專案目錄重跑：\n"
-                + "  git clone https://github.com/synopackageland/synopkgland-community-apps.git\n"
-                + "  export SYNOPKGLAND_COMMUNITY_APPS_ROOT=$PWD/synopkgland-community-apps");
-            process.exit(1);
-        }
-        const repoRoot = dirname(communityAppsRoot);
-        try {
-            const result = await publishProject({
-                project,
-                communityAppsRoot,
-                baseBranch: options.base,
-                github: createExecGitHubCli(repoRoot, communityAppsGitHubRepo()),
-                git: createExecGitOps(repoRoot),
-            });
-            if (!result.ok) {
-                console.error(result.message ?? result.code ?? "publish 失敗。");
-                process.exit(1);
-            }
-            if (result.noChanges) {
-                console.log(result.message ?? "Community Apps 定義已是最新。");
-                return;
-            }
-            console.log(`已建立 PR：${result.prUrl}`);
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    });
     await program.parseAsync(argv);
 }

package/dist/compose/analyze.d.ts

@@ -28,7 +28,7 @@ export interface ResourceWorkerEligibility {
  * - any non-headless App without a unique literal published adminport status probe
  */
 export declare function resourceWorkerEligibility(contract: AppContract, compose: ComposeDocument): ResourceWorkerEligibility;
-export type ComposeRoute = "static-zero-config" | "dynamic" | "broker-installer" | "reject";
+export type ComposeRoute = "static-zero-config" | "dynamic" | "reject";
 export interface ComposeRouteClassification {
     route: ComposeRoute;
     eligibility: ResourceWorkerEligibility;
@@ -42,7 +42,6 @@ export interface ComposeRouteClassification {
  * placed in the project .env.
  */
 export declare function classifyComposeRoute(contract: AppContract, parsed: ParsedCompose, composeFile?: string): ComposeRouteClassification;
-export declare function brokerInstallerRouteWarning(compose: ComposeDocument, composeFile?: string): ValidationError;
 export declare function collectComposeInterpolations(compose: ComposeDocument): Set<string>;
 export declare function validateComposeSecurity(compose: ComposeDocument, composeFile: string, options: {
     profile: "personal" | "listing";

package/dist/compose/analyze.js

@@ -180,7 +180,7 @@ function hasBuildStanza(compose) {
     }
     return Object.values(compose.services).some((service) => "build" in service && service.build !== undefined);
 }
-const HEADLESS_BROKER_FALLBACK_REASONS = new Set([
+const HEADLESS_UNSUPPORTED_REASONS = new Set([
     "HAS_COMPOSE_SECRETS_OR_CONFIGS",
     "HAS_BUILD_STANZA",
     "HAS_PRIVILEGED_CAPABILITY",
@@ -204,7 +204,7 @@ export function classifyComposeRoute(contract, parsed, composeFile = "compose.ya
     const hasHeadlessUnsupportedParameter = collectInstallParameters(contract).some(({ param }) => !HEADLESS_PACKAGE_ONLY_PARAMETER_TYPES.has(String(param.type)));
     const headlessPackageOnly = eligibility.headless &&
         !hasHeadlessUnsupportedParameter &&
-        !eligibility.reasons.some((reason) => HEADLESS_BROKER_FALLBACK_REASONS.has(reason));
+        !eligibility.reasons.some((reason) => HEADLESS_UNSUPPORTED_REASONS.has(reason));
     const localRoute = contract.adminport !== undefined || headlessPackageOnly;
     const rejectErrors = localRoute
         ? collectRouteRejectErrors(contract, parsed, composeFile)
@@ -225,27 +225,11 @@ export function classifyComposeRoute(contract, parsed, composeFile = "compose.ya
     if (eligibility.eligible) {
         return { route: "static-zero-config", eligibility, errors: [] };
     }
-    // Keep the route decision in one place. build-spk must not independently
-    // reinterpret an ineligible Compose as D1: only a route with a resolved
-    // published adminport or an eligible headless Compose, plus at least one
-    // declared install parameter (or oidc_compat declaration), has a package-only materializer.
-    // Every other buildable fallback is Broker.
     if ((eligibility.adminport !== undefined || headlessPackageOnly) &&
-        (collectInstallParameters(contract).length > 0 || hasBrokerManagedOidc(contract))) {
+        (collectInstallParameters(contract).length > 0 || hasInterpolation(parsed.compose))) {
         return { route: "dynamic", eligibility, errors: [] };
     }
-    return { route: "broker-installer", eligibility, errors: [] };
-}
-export function brokerInstallerRouteWarning(compose, composeFile = "compose.yaml") {
-    const path = findDynamicComposePath(compose) ?? "services";
-    return makeError("CURATED_BROKER_ROUTE_FORBIDDEN", composeSpanForPath(compose, composeFile, path), "此 Compose 會落到 Broker installer 路線；rootless Broker 不支援 Container Manager，無法作為 Curated production runtime。", "請改成零設定 resource-worker：使用 ./html bind 與預先 build 的 image；將 ${SYNOPKG_PKGVAR} 等平台 bind 改成 named volume，或改用 D1 dynamic route 的 string/boolean install 參數。", "warning");
-}
-function hasImmutableServiceImages(compose) {
-    const services = compose.services;
-    if (!services || Object.keys(services).length === 0) {
-        return false;
-    }
-    return Object.values(services).every((service) => typeof service.image === "string" && /@sha256:[a-f0-9]{64}$/.test(service.image.trim()));
+    return { route: "reject", eligibility, errors: [makeError("COMPOSE_ROUTE_UNSUPPORTED", composeSpanForPath(parsed.compose, composeFile, "services"), `DSM resource worker cannot manage this Compose: ${eligibility.reasons.join(", ")}`, "Use prebuilt images, supported install parameters and DSM docker-project resources.")] };
 }
 function collectRouteRejectErrors(contract, parsed, composeFile) {
     const { compose } = parsed;
@@ -318,14 +302,10 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
             param.type !== "shared_folder" &&
             param.type !== "dsm_user" &&
             param.type !== "posix_all_shares"));
-    const brokerOidcInterpolationNames = hasBrokerManagedOidc(contract)
-        ? BROKER_OIDC_INTERPOLATION_VARS
-        : [];
     const supportedInterpolationNames = new Set([
         ...supportedParamNames,
         ...dsmUserDerivedNames,
         ...PLATFORM_BIND_VARS,
-        ...brokerOidcInterpolationNames,
     ]);
     const interpolations = collectComposeInterpolations(compose);
     const hasComposeInterpolation = hasInterpolation(compose);
@@ -364,7 +344,7 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
         : "請只使用 ${NAME} 形式，並在 synology-app.yaml 的 install 宣告對應的 string 或 boolean parameter。";
     return makeError("COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED", composeSpanForPath(compose, composeFile, path), "Compose dynamic route 含有不在 D1/D2 白名單內的輸入（" +
         reasonText +
-        "）；這條 route 會拒收，不會靜默落回 Broker fallback。", undeclaredName
+        "）；這條 route 會拒收，不會靜默改用其他執行方式。", undeclaredName
         ? interpolationSuggestion
         : `${interpolationSuggestion} secret/config 因 DSM worker 不讀 docker-compose.override.yml 而拒收，請移除後重新執行 validate。`);
 }
@@ -504,9 +484,6 @@ export function validateComposeSecurity(compose, composeFile, options) {
         ? route.errors.filter((error) => !HOST_BIND_ERROR_CODES.has(error.code))
         : [];
     errors.push(...routeErrors);
-    if (route?.route === "broker-installer" && hasImmutableServiceImages(compose)) {
-        errors.push(brokerInstallerRouteWarning(compose, composeFile));
-    }
     const routeErrorKeys = new Set(routeErrors.map(validationErrorKey));
     if (!compose.services) {
         return errors;
@@ -613,26 +590,6 @@ function isForbiddenSocketMount(source) {
  * ${NAME} must be declared in contract.install as string or boolean.
  */
 const PLATFORM_BIND_VARS = new Set(["SYNOPKG_PKGVAR", "SYNO_APP_SECRETS_DIR"]);
-/**
- * Broker-managed OIDC compatibility injects these two names at install time.
- * They are allowed only for an explicitly declared oidc_compat legacy route;
- * the D1 package-only materializer does not write them.
- */
-const BROKER_OIDC_INTERPOLATION_VARS = new Set([
-    "SYNOPKGLAND_OIDC_ISSUER",
-    "SYNOPKGLAND_OIDC_CLIENT_ID",
-    "SYNOPKGLAND_OIDC_ISSUER_HOST",
-]);
-function hasBrokerManagedOidc(contract) {
-    if (!contract.integration || typeof contract.integration !== "object") {
-        return false;
-    }
-    const identity = contract.integration.identity;
-    if (!identity || typeof identity !== "object") {
-        return false;
-    }
-    return Boolean(identity.oidc_compat);
-}
 const INTERPOLATED_SOURCE = /^\$\{([A-Z0-9_]+)\}(.*)$/;
 const VALID_SUFFIX_SEGMENT = /^[A-Za-z0-9._-]+$/;
 function collectNamedVolumeNames(compose) {

package/dist/contract/unsupported-types.d.ts

@@ -0,0 +1,10 @@
+import type { AppContract } from "../types.js";
+/** Stable gate code for an install type that only the CLI can materialize. */
+export declare const POSIX_ALL_SHARES_LISTING_UNSUPPORTED_CODE: "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED";
+export interface UnsupportedInstallType {
+    name: string;
+    type: string;
+    code: string;
+}
+export declare function findUnsupportedInstallTypes(contract: AppContract): UnsupportedInstallType[];
+export declare function findListingUnsupportedInstallTypes(contract: AppContract): UnsupportedInstallType[];