@synopackageland/cli 0.3.10 → 0.4.0

package/dist/attestation/platform-service.js

@@ -1,250 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { SignJWT, importJWK, jwtVerify } from "jose";
-/**
- * Trust contract for releasing the platform service (the Broker SPK) itself.
- * This is deliberately a separate issuer, typ and keyring from the curated App
- * chain: the Broker carries the curated trust root as *data*, so that root can
- * never double as the authority that signs the Broker's own releases.
- */
-export const PLATFORM_ATTESTATION_ISSUER = "synopkgland-platform";
-export const PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP = "platform-service-release-attestation";
-export const PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION = 1;
-export const PLATFORM_SERVICE_PACKAGE_IDENTITY = "SynoPkgLandService";
-export const PLATFORM_KEYRING_PURPOSE = "platform-service-release";
-export const PLATFORM_ATTESTATION_PRIVATE_JWK_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_PRIVATE_JWK";
-export const PLATFORM_ATTESTATION_KID_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KID";
-export const PLATFORM_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KEYRING_PATH";
-export class PlatformServiceReleaseError extends Error {
-    code;
-    constructor(code, detail) {
-        super(detail ? `${code}: ${detail}` : code);
-        this.code = code;
-        this.name = "PlatformServiceReleaseError";
-    }
-}
-const PRIVATE_JWK_FIELDS = ["d", "p", "q", "dp", "dq", "qi", "oth", "k"];
-const KEY_STATUSES = new Set(["active", "verify-only", "revoked"]);
-export function parsePlatformKeyringDocument(raw) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "not an object");
-    }
-    const document = raw;
-    if (document.version !== 1 || !Array.isArray(document.keys)) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "unsupported document shape");
-    }
-    if (document.purpose !== PLATFORM_KEYRING_PURPOSE) {
-        // A curated keyring document has no purpose field at all; refusing here is
-        // what keeps the Broker's bundled trust root from signing the Broker.
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_PURPOSE_MISMATCH");
-    }
-    for (const entry of document.keys) {
-        if (!entry ||
-            typeof entry.kid !== "string" ||
-            entry.kid.length === 0 ||
-            !KEY_STATUSES.has(entry.status) ||
-            !entry.publicJwk ||
-            typeof entry.publicJwk !== "object") {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "invalid key entry");
-        }
-        if (PRIVATE_JWK_FIELDS.some((field) => field in entry.publicJwk)) {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_PRIVATE_MATERIAL");
-        }
-        if (entry.publicJwk.kty !== "RSA" || typeof entry.publicJwk.n !== "string") {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "not a public RSA key");
-        }
-    }
-    if (!document.keys.some((entry) => entry.status === "active")) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_NO_ACTIVE_KEY");
-    }
-    return document;
-}
-export function readPlatformKeyringFile(path) {
-    let raw;
-    try {
-        raw = readFileSync(path, "utf8");
-    }
-    catch (error) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", `unable to read keyring: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "keyring is not valid JSON");
-    }
-    return parsePlatformKeyringDocument(parsed);
-}
-export function canonicalPlatformServiceReleaseClaims(claims) {
-    return JSON.stringify({
-        arch: claims.arch,
-        artifactDigest: claims.artifactDigest,
-        issuedAt: claims.issuedAt,
-        osMinVer: claims.osMinVer,
-        packageBuild: claims.packageBuild,
-        packageIdentity: claims.packageIdentity,
-        packageVersion: claims.packageVersion,
-        sourceRevision: claims.sourceRevision,
-        sourceVersion: claims.sourceVersion,
-        typ: claims.typ,
-        version: claims.version,
-    });
-}
-export function digestPlatformServiceReleaseClaims(claims) {
-    return createHash("sha256").update(canonicalPlatformServiceReleaseClaims(claims)).digest("hex");
-}
-export async function signPlatformServiceReleaseAttestationToken(input, key) {
-    assertPlatformInput(input);
-    if (typeof key.kid !== "string" || key.kid.length === 0) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID", "kid required");
-    }
-    const claims = {
-        typ: PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP,
-        version: PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION,
-        packageIdentity: input.packageIdentity,
-        sourceVersion: input.sourceVersion,
-        packageBuild: input.packageBuild,
-        packageVersion: input.packageVersion,
-        artifactDigest: input.artifactDigest,
-        sourceRevision: input.sourceRevision,
-        osMinVer: input.osMinVer,
-        arch: input.arch,
-        issuedAt: new Date().toISOString(),
-    };
-    const attestationDigest = digestPlatformServiceReleaseClaims(claims);
-    const token = await new SignJWT({ ...claims })
-        .setProtectedHeader({ alg: "RS256", kid: key.kid, typ: "JWT" })
-        .setIssuer(PLATFORM_ATTESTATION_ISSUER)
-        .setSubject(claims.packageIdentity)
-        .setJti(attestationDigest)
-        .sign(key.privateKey);
-    return { token, attestationDigest, claims };
-}
-export async function verifyPlatformServiceReleaseAttestationToken(token, keyring) {
-    parsePlatformKeyringDocument(keyring);
-    try {
-        const header = decodeHeader(token);
-        const entry = keyring.keys.find((candidate) => candidate.kid === header.kid && candidate.status !== "revoked");
-        if (!entry) {
-            throw new Error("unknown or revoked kid");
-        }
-        const publicKey = (await importJWK(entry.publicJwk, "RS256"));
-        const result = await jwtVerify(token, publicKey, {
-            algorithms: ["RS256"],
-            issuer: PLATFORM_ATTESTATION_ISSUER,
-        });
-        if (result.protectedHeader.alg !== "RS256" ||
-            result.protectedHeader.typ !== "JWT" ||
-            result.protectedHeader.kid !== entry.kid) {
-            throw new Error("token header mismatch");
-        }
-        const payload = result.payload;
-        if (payload.typ !== PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP ||
-            payload.version !== PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION) {
-            throw new Error("token typ mismatch");
-        }
-        const claims = {
-            typ: payload.typ,
-            version: payload.version,
-            packageIdentity: payload.packageIdentity,
-            sourceVersion: payload.sourceVersion,
-            packageBuild: payload.packageBuild,
-            packageVersion: payload.packageVersion,
-            artifactDigest: payload.artifactDigest,
-            sourceRevision: payload.sourceRevision,
-            osMinVer: payload.osMinVer,
-            arch: payload.arch,
-            issuedAt: payload.issuedAt,
-        };
-        assertPlatformInput(claims);
-        if (typeof claims.issuedAt !== "string" || Number.isNaN(Date.parse(claims.issuedAt))) {
-            throw new Error("issuedAt is not a timestamp");
-        }
-        if (result.payload.jti !== digestPlatformServiceReleaseClaims(claims)) {
-            throw new Error("jti does not bind the claims");
-        }
-        return claims;
-    }
-    catch (error) {
-        if (error instanceof PlatformServiceReleaseError) {
-            throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", error.message);
-        }
-        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", error instanceof Error ? error.message : String(error));
-    }
-}
-export async function createPlatformAttestationSignerFromEnv(env = process.env) {
-    const jwkRaw = env[PLATFORM_ATTESTATION_PRIVATE_JWK_ENV]?.trim();
-    const kidFromEnv = env[PLATFORM_ATTESTATION_KID_ENV]?.trim();
-    const keyringPath = env[PLATFORM_ATTESTATION_KEYRING_PATH_ENV]?.trim();
-    if (!jwkRaw) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_MISSING");
-    }
-    if (!keyringPath) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", `${PLATFORM_ATTESTATION_KEYRING_PATH_ENV} is required`);
-    }
-    const keyring = readPlatformKeyringFile(keyringPath);
-    let privateJwk;
-    let privateKey;
-    try {
-        privateJwk = JSON.parse(jwkRaw);
-        privateKey = (await importJWK(privateJwk, "RS256"));
-    }
-    catch {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID");
-    }
-    const kid = kidFromEnv || (typeof privateJwk.kid === "string" ? privateJwk.kid : "");
-    if (!kid) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID", "kid required");
-    }
-    const trustEntry = keyring.keys.find((entry) => entry.kid === kid && entry.status === "active");
-    if (!trustEntry) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_KEY_UNKNOWN");
-    }
-    const signingKey = { kid, privateKey };
-    return {
-        sign: (input) => signPlatformServiceReleaseAttestationToken(input, signingKey),
-        verify: (token) => verifyPlatformServiceReleaseAttestationToken(token, keyring),
-        verificationJwk: trustEntry.publicJwk,
-    };
-}
-function assertPlatformInput(input) {
-    const fail = (detail) => {
-        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INPUT_INVALID", detail);
-    };
-    if (input.packageIdentity !== PLATFORM_SERVICE_PACKAGE_IDENTITY) {
-        fail("packageIdentity must be the platform service identity");
-    }
-    if (!/^\d+\.\d+\.\d+$/.test(input.sourceVersion)) {
-        fail("sourceVersion must be plain semver without a Build suffix");
-    }
-    if (!Number.isSafeInteger(input.packageBuild) || input.packageBuild < 1) {
-        fail("packageBuild must be a positive safe integer");
-    }
-    if (input.packageVersion !== `${input.sourceVersion}-${String(input.packageBuild).padStart(4, "0")}`) {
-        fail("packageVersion must be sourceVersion plus the zero-padded Build");
-    }
-    if (!/^[a-f0-9]{64}$/.test(input.artifactDigest)) {
-        fail("artifactDigest must be a lowercase SHA-256 digest");
-    }
-    if (!/^[a-f0-9]{40}$/.test(input.sourceRevision)) {
-        fail("sourceRevision must be a full git commit SHA");
-    }
-    if (!/^\d+\.\d+-\d+$/.test(input.osMinVer)) {
-        fail("osMinVer must look like 7.2-69057");
-    }
-    if (input.arch !== "noarch") {
-        fail("the platform service is noarch");
-    }
-}
-function decodeHeader(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
-        throw new Error("not a compact JWT");
-    }
-    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-    if (!header || typeof header !== "object" || Array.isArray(header)) {
-        throw new Error("invalid JWT header");
-    }
-    return header;
-}

package/dist/build-spk/broker-glue.d.ts

@@ -1,16 +0,0 @@
-/**
- * The Broker installer glue every Managed Profile App carries, independent of
- * runtime. Compose and native Apps install through the same socket, so the
- * Local Attestation gate and the registration-status probe live here once.
- */
-/** Shell variable preamble locating the Broker installer and its socket. */
-export declare const BROKER_INSTALLER_VARS = "INSTALLER=\"${BROKER_INSTALLER:-/var/packages/SynoPkgLandService/target/bin/synopkgland-installer}\"\nSOCKET=\"${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}\"";
-/**
- * The `status` probe: asks the Broker whether this App is still registered.
- * `removed` exits 150 so DSM shows the App as removed by the platform;
- * `unknown` exits 4. Anything else falls through to the caller, which decides
- * what "running" means for its runtime.
- */
-export declare function renderBrokerStatusProbe(packageIdentity: string): string;
-/** `preinst` / `preupgrade`: refuse to install when the Broker socket is absent. */
-export declare const BROKER_SOCKET_REQUIRED_SCRIPT = "#!/bin/sh\nSOCKET=\"${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}\"\nif [ ! -S \"$SOCKET\" ]; then\n  echo \"SynoPkgLandService installer socket is not available\" >&2\n  exit 1\nfi\nexit 0\n";

package/dist/build-spk/broker-glue.js

@@ -1,40 +0,0 @@
-/**
- * The Broker installer glue every Managed Profile App carries, independent of
- * runtime. Compose and native Apps install through the same socket, so the
- * Local Attestation gate and the registration-status probe live here once.
- */
-/** Shell variable preamble locating the Broker installer and its socket. */
-export const BROKER_INSTALLER_VARS = `INSTALLER="\${BROKER_INSTALLER:-/var/packages/SynoPkgLandService/target/bin/synopkgland-installer}"
-SOCKET="\${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}"`;
-/**
- * The `status` probe: asks the Broker whether this App is still registered.
- * `removed` exits 150 so DSM shows the App as removed by the platform;
- * `unknown` exits 4. Anything else falls through to the caller, which decides
- * what "running" means for its runtime.
- */
-export function renderBrokerStatusProbe(packageIdentity) {
-    return `    if [ -x "$INSTALLER" ] && [ -S "$SOCKET" ]; then
-      "$INSTALLER" --socket "$SOCKET" --phase status --attempt-id "status-$$" \\
-        --package-identity "${packageIdentity}" --package-version "\${SYNOPKG_PKGVER}" \\
-        --package-path "\${SYNOPKG_PKGDEST}" --bundle-path "\${SYNOPKG_PKGDEST}" \\
-        --pkg-var "\${SYNOPKG_PKGVAR}" --pkg-home "\${SYNOPKG_PKGHOME}" >/tmp/synopkgland-status.$$ 2>/dev/null || true
-      if grep -q '"registrationStatus":"removed"' /tmp/synopkgland-status.$$ 2>/dev/null; then
-        rm -f /tmp/synopkgland-status.$$
-        exit 150
-      fi
-      if grep -q '"registrationStatus":"unknown"' /tmp/synopkgland-status.$$ 2>/dev/null; then
-        rm -f /tmp/synopkgland-status.$$
-        exit 4
-      fi
-      rm -f /tmp/synopkgland-status.$$
-    fi`;
-}
-/** `preinst` / `preupgrade`: refuse to install when the Broker socket is absent. */
-export const BROKER_SOCKET_REQUIRED_SCRIPT = `#!/bin/sh
-SOCKET="\${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}"
-if [ ! -S "$SOCKET" ]; then
-  echo "SynoPkgLandService installer socket is not available" >&2
-  exit 1
-fi
-exit 0
-`;

package/dist/deploy/catalog-publish.d.ts

@@ -1,3 +0,0 @@
-import { type PublishSpkResult } from "@synopackageland/package-source/publish-spk";
-export declare function publishBuiltSpk(spkPath: string): Promise<PublishSpkResult>;
-export declare function packageSourceOrigin(): string;

package/dist/deploy/catalog-publish.js

@@ -1,7 +0,0 @@
-import { publishSpkToSource, resolvePublishTarget, } from "@synopackageland/package-source/publish-spk";
-export async function publishBuiltSpk(spkPath) {
-    return publishSpkToSource(spkPath, resolvePublishTarget());
-}
-export function packageSourceOrigin() {
-    return resolvePublishTarget().origin;
-}

package/dist/doctor.d.ts

@@ -1,22 +0,0 @@
-import type { ProjectRoot } from "./discovery.js";
-import type { NasHost } from "./host/types.js";
-export type DoctorCheckStatus = "pass" | "fail" | "skip" | "warn";
-export interface DoctorCheck {
-    id: string;
-    status: DoctorCheckStatus;
-    code?: string;
-    message: string;
-    suggestion?: string;
-}
-export interface DoctorReport {
-    ok: boolean;
-    checks: DoctorCheck[];
-}
-export interface RunDoctorOptions {
-    project?: ProjectRoot | null;
-    host?: NasHost | null;
-    packageId?: string;
-    dev?: boolean;
-}
-export declare function runDoctor(options: RunDoctorOptions): Promise<DoctorReport>;
-export declare function formatDoctorReport(report: DoctorReport): string;