@synopackageland/cli 0.3.10 → 0.4.1

package/dist/standalone/host-platform.js

@@ -0,0 +1,42 @@
+/** ES5, self-contained browser runtime, following I18N_RUNTIME's embedding pattern. */
+export const HOST_PLATFORM_RUNTIME = `function inspectHostPlatform(ctx) {
+  ctx = ctx || {};
+  var web = typeof window !== "undefined";
+  var host = false;
+  try {
+    host = !!(web && ctx.appWindow && typeof SYNO !== "undefined" &&
+      SYNO.SDS && typeof SYNO.SDS.AppWindow === "function" &&
+      ctx.appWindow instanceof SYNO.SDS.AppWindow);
+  } catch (error) {
+    // An unsupported host constructor must not break a standalone shell.
+  }
+  function read(key) {
+    if (!host || typeof _S !== "function") return null;
+    try { return _S(key); } catch (error) { return null; }
+  }
+  function text(value) {
+    return typeof value === "string" && /\\S/.test(value) ? value : null;
+  }
+  function versionPart(value) {
+    if (typeof value === "number") {
+      if (!isFinite(value) || value < 0 || Math.floor(value) !== value) return null;
+      value = String(value);
+    }
+    return typeof value === "string" && value.length > 0 && !/\\D/.test(value) ? value : null;
+  }
+  var standalone = read("standalone");
+  var language = text(read("lang"));
+  var major = versionPart(read("majorversion"));
+  var minor = versionPart(read("minorversion"));
+  var fullVersion = text(read("fullversion"));
+  return Object.freeze({
+    web: web,
+    host: host ? "dsm" : web ? "standalone-web" : "unavailable",
+    dsmStandalone: typeof standalone === "boolean" ? standalone : null,
+    dsmLanguage: language,
+    appLocale: text(ctx.locale),
+    systemVersion: major !== null && minor !== null ? major + "." + minor : null,
+    fullVersion: fullVersion,
+    theme: null
+  });
+}`;

package/dist/standalone/host-types.d.ts

@@ -0,0 +1,49 @@
+import type { HostPlatformSnapshot } from "./host-platform.js";
+export type HostTitleResult = {
+    status: "ok";
+    target: "dsm-window" | "document";
+} | {
+    status: "unsupported" | "unavailable" | "invalid-input" | "failed";
+};
+export type HostRequestResult = {
+    status: "requested";
+} | {
+    status: "unsupported" | "unavailable" | "invalid-input" | "blocked" | "failed";
+};
+export type HostURLResult = {
+    status: "requested";
+    windowHandleAvailable: boolean;
+} | {
+    status: "unsupported" | "unavailable" | "invalid-input" | "failed";
+};
+export type HostEvent = "window-resize" | "host-theme-change" | "host-language-change";
+export type HostSubscriptionResult = {
+    status: "subscribed";
+    dispose(): void;
+} | {
+    status: "unsupported" | "unavailable" | "invalid-input" | "failed";
+};
+export type HostFileNavigationResult = {
+    status: "requested";
+    action: "locate-folder" | "highlight-file";
+} | {
+    status: "unsupported" | "unavailable" | "invalid-input" | "failed";
+};
+export type HostUnsupportedResult = {
+    status: "unsupported" | "unavailable";
+};
+export interface HostAdapter {
+    platform(): HostPlatformSnapshot;
+    setTitle(title: string): HostTitleResult;
+    activateWindow(): HostRequestResult;
+    requestClose(): HostRequestResult;
+    openApp(appId: string): HostRequestResult;
+    openURL(url: string): HostURLResult;
+    openFileManager(path: string): HostFileNavigationResult;
+    revealFile(path: string): HostFileNavigationResult;
+    openFile(path: string): HostUnsupportedResult;
+    showFileDetails(paths: readonly string[]): HostUnsupportedResult;
+    openAppSetting(): HostUnsupportedResult;
+    subscribe(event: HostEvent, listener: () => void): HostSubscriptionResult;
+    dispose(): void;
+}

package/dist/standalone/host-types.js

@@ -0,0 +1 @@
+export {};

package/dist/standalone/i18n.d.ts

@@ -0,0 +1,28 @@
+import type { StandaloneError } from "./manifest.js";
+/**
+ * UI languages a Standalone Package can ship, as BCP-47 tags (the catalog
+ * file names and the `Intl` locale), with the DSM language code each one
+ * answers to. Every other DSM language opens the app in English.
+ */
+export declare const LOCALES: readonly ["en", "zh-TW", "zh-CN", "ja", "ko", "de", "fr", "es", "it"];
+export type Locale = (typeof LOCALES)[number];
+export declare const DSM_LANGS: Record<Locale, string>;
+export type Catalog = Record<string, string>;
+export type Catalogs = {
+    en: Catalog;
+} & Partial<Record<Locale, Catalog>>;
+export type CatalogsResult = {
+    ok: true;
+    catalogs: Catalogs;
+} | {
+    ok: false;
+    errors: StandaloneError[];
+};
+export declare function isLocale(value: string): value is Locale;
+/** `<dir>/<locale>.json` for each shipped locale; en.json is required. */
+export declare function loadCatalogs(dir: string): CatalogsResult;
+/**
+ * Each glossary term lists the message keys that must use it: in every
+ * shipped locale the message has to contain that locale's official term.
+ */
+export declare function checkGlossary(file: string, catalogs: Catalogs): StandaloneError[];

package/dist/standalone/i18n.js

@@ -0,0 +1,161 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * UI languages a Standalone Package can ship, as BCP-47 tags (the catalog
+ * file names and the `Intl` locale), with the DSM language code each one
+ * answers to. Every other DSM language opens the app in English.
+ */
+export const LOCALES = ["en", "zh-TW", "zh-CN", "ja", "ko", "de", "fr", "es", "it"];
+export const DSM_LANGS = {
+    en: "enu",
+    "zh-TW": "cht",
+    "zh-CN": "chs",
+    ja: "jpn",
+    ko: "krn",
+    de: "ger",
+    fr: "fre",
+    es: "spn",
+    it: "ita",
+};
+const MESSAGE_KEY = /^[A-Za-z][A-Za-z0-9_-]*(\.[A-Za-z0-9_-]+)*$/;
+export function isLocale(value) {
+    return LOCALES.includes(value);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function placeholders(text) {
+    return [...new Set([...text.matchAll(/\{(\w+)\}/g)].map((m) => m[1]))].sort().join(",");
+}
+function readCatalog(file, locale) {
+    const invalid = (why) => ({
+        error: { code: "STANDALONE_I18N_CATALOG_INVALID", message: `${locale}.json ${why}` },
+    });
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        return invalid(`不是合法的 JSON：${String(error)}`);
+    }
+    if (!isRecord(raw)) {
+        return invalid("必須是 { \"key\": \"text\" } 的 JSON 物件。");
+    }
+    for (const [key, text] of Object.entries(raw)) {
+        if (!MESSAGE_KEY.test(key) || typeof text !== "string") {
+            return invalid(`的「${key}」必須是點分隔的 key（例如 greeting.save）對應一段文字。`);
+        }
+    }
+    return { catalog: raw };
+}
+/** `<dir>/<locale>.json` for each shipped locale; en.json is required. */
+export function loadCatalogs(dir) {
+    const errors = [];
+    const catalogs = {};
+    const files = existsSync(dir) ? readdirSync(dir).filter((name) => name.endsWith(".json")).sort() : [];
+    for (const name of files) {
+        const locale = name.slice(0, -".json".length);
+        if (!isLocale(locale)) {
+            errors.push({
+                code: "STANDALONE_I18N_LOCALE_UNSUPPORTED",
+                message: `${name}：只支援 ${LOCALES.join(", ")}；其他 DSM 語言會顯示英文。`,
+            });
+            continue;
+        }
+        const read = readCatalog(join(dir, name), locale);
+        if ("error" in read) {
+            errors.push(read.error);
+        }
+        else {
+            catalogs[locale] = read.catalog;
+        }
+    }
+    const en = catalogs.en;
+    if (!en) {
+        if (!errors.some((e) => e.code === "STANDALONE_I18N_CATALOG_INVALID")) {
+            errors.push({ code: "STANDALONE_I18N_MESSAGES_MISSING", message: `${dir} 缺少 en.json（所有語言的後備文字）。` });
+        }
+        return { ok: false, errors };
+    }
+    for (const [locale, catalog] of Object.entries(catalogs)) {
+        errors.push(...compareWithEnglish(locale, catalog, en));
+    }
+    return errors.length === 0 ? { ok: true, catalogs: catalogs } : { ok: false, errors };
+}
+function compareWithEnglish(locale, catalog, en) {
+    const missing = Object.keys(en).filter((key) => !(key in catalog));
+    const extra = Object.keys(catalog).filter((key) => !(key in en));
+    if (missing.length > 0 || extra.length > 0) {
+        const parts = [
+            missing.length > 0 ? `缺少 ${missing.join(", ")}` : "",
+            extra.length > 0 ? `多出 ${extra.join(", ")}` : "",
+        ].filter(Boolean);
+        return [{ code: "STANDALONE_I18N_KEYS_MISMATCH", message: `${locale}.json 與 en.json 的 key 不同：${parts.join("；")}。` }];
+    }
+    const drifted = Object.keys(en).filter((key) => placeholders(catalog[key]) !== placeholders(en[key]));
+    return drifted.length === 0
+        ? []
+        : [{
+                code: "STANDALONE_I18N_PLACEHOLDER_MISMATCH",
+                message: `${locale}.json 的 ${drifted.join(", ")} 與 en.json 的 {placeholder} 不一致。`,
+            }];
+}
+function readGlossary(file) {
+    const invalid = (why) => ({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `${file}：${why}` });
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        return invalid(`不是合法的 JSON：${String(error)}`);
+    }
+    if (!isRecord(raw) || !Array.isArray(raw.terms)) {
+        return invalid("必須是 { \"terms\": [...] }。");
+    }
+    const terms = [];
+    for (const term of raw.terms) {
+        const ok = isRecord(term)
+            && typeof term.id === "string"
+            && isRecord(term.text)
+            && Object.entries(term.text).every(([locale, text]) => isLocale(locale) && typeof text === "string" && text !== "")
+            && (term.keys === undefined || (Array.isArray(term.keys) && term.keys.every((key) => typeof key === "string")));
+        if (!ok) {
+            return invalid(`term ${isRecord(term) ? JSON.stringify(term.id) : "?"} 需要 id、以支援語言為 key 的 text，以及選填的 keys 清單。`);
+        }
+        terms.push({ id: term.id, text: term.text, keys: term.keys ?? [] });
+    }
+    return terms;
+}
+/** Case-insensitive: a term can start a sentence or sit inside one ("Backend status"). */
+function containsTerm(message, term, locale) {
+    return message.toLocaleLowerCase(locale).includes(term.toLocaleLowerCase(locale));
+}
+/**
+ * Each glossary term lists the message keys that must use it: in every
+ * shipped locale the message has to contain that locale's official term.
+ */
+export function checkGlossary(file, catalogs) {
+    const terms = readGlossary(file);
+    if (!Array.isArray(terms)) {
+        return [terms];
+    }
+    const errors = [];
+    for (const term of terms) {
+        for (const key of term.keys) {
+            if (!(key in catalogs.en)) {
+                errors.push({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `glossary term ${term.id} 指向不存在的 key ${key}。` });
+                continue;
+            }
+            for (const [locale, catalog] of Object.entries(catalogs)) {
+                const official = term.text[locale];
+                if (official !== undefined && !containsTerm(catalog[key], official, locale)) {
+                    errors.push({
+                        code: "STANDALONE_I18N_GLOSSARY_MISMATCH",
+                        message: `${locale}.json 的 ${key}「${catalog[key]}」沒有使用 Synology 用語「${official}」（glossary term ${term.id}）。`,
+                    });
+                }
+            }
+        }
+    }
+    return errors;
+}

package/dist/standalone/inspect-helper.d.ts

@@ -0,0 +1,6 @@
+export interface IntegrationInspection {
+    protocol: 1 | 2;
+    dataAccess: "unavailable" | "relaxed";
+}
+/** Artifact consistency only; bytes, approval and health never certify NAS access. */
+export declare function inspectHelper(dir: string, info: Record<string, string>, findings: string[], daemon?: boolean): Promise<IntegrationInspection | undefined>;

package/dist/standalone/inspect-helper.js

@@ -0,0 +1,88 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import * as tar from "tar";
+import { windowScriptName } from "./dsm-window.js";
+import { helperOps } from "./helper.js";
+import { sha256 } from "./helper-inventory.js";
+import { renderStandaloneScript } from "./lifecycle.js";
+import { rootTasks } from "./root-window.js";
+/** Artifact consistency only; bytes, approval and health never certify NAS access. */
+export async function inspectHelper(dir, info, findings, daemon = false) {
+    const files = new Map();
+    const windowPath = `ui/${windowScriptName({ build: Number(info.version?.split("-").at(-1)) })}`;
+    const windows = [];
+    let oversized = false;
+    await tar.t({ file: join(dir, "package.tgz"), onReadEntry(entry) {
+            const path = entry.path.replace(/^\.\//, "");
+            // Enumerate candidates to reject extras; only the INFO-derived exact path is read.
+            if (/^ui\/window-[^/]*\.js$/.test(path))
+                windows.push(path);
+            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
+                return;
+            const limit = ["integration/helper", "ui/cgi/api.cgi"].includes(path) ? 64 * 1024 * 1024 : 1024 * 1024;
+            if (files.has(path) || entry.size > limit) {
+                oversized = true;
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            entry.on("data", (chunk) => { size += chunk.length; if (size <= limit)
+                chunks.push(chunk);
+            else
+                oversized = true; });
+            entry.on("end", () => files.set(path, Buffer.concat(chunks)));
+        } });
+    try {
+        if (oversized)
+            throw new Error("oversized/duplicate payload");
+        const bytes = (path) => { const b = files.get(path); if (!b)
+            throw new Error(`missing ${path}`); return b; };
+        const raw = bytes("integration/inventory.json").toString("utf8");
+        const i = JSON.parse(raw);
+        const keys = i.dataAccess === undefined ? "package,payloadDigest,protocol,registryDigest,version" : "dataAccess,package,payloadDigest,protocol,registryDigest,version";
+        if (Object.keys(i).sort().join(",") !== keys || (i.dataAccess !== undefined && (i.protocol !== 2 || !["unavailable", "relaxed"].includes(i.dataAccess))) ||
+            i.package !== info.package || i.version !== info.version || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(i.package) || !/^\d+(\.\d+){0,3}-\d{4}$/.test(i.version) || ![1, 2].includes(i.protocol) ||
+            !/^[a-f0-9]{64}$/.test(i.payloadDigest) || !/^[a-f0-9]{64}$/.test(i.registryDigest) || JSON.stringify(i) !== raw)
+            throw new Error("invalid inventory");
+        if (windows.length !== 1 || windows[0] !== windowPath)
+            throw new Error("missing/ambiguous window or build mismatch");
+        const helper = bytes("integration/helper");
+        if (sha256(helper) !== i.payloadDigest || !helper.includes(Buffer.from(JSON.stringify({ ...i, payloadDigest: "" }))) ||
+            !bytes("ui/cgi/api.cgi").includes(Buffer.from(raw)))
+            throw new Error("payload/compiled inventory mismatch");
+        const workers = bytes("integration/workers.json");
+        const registry = JSON.parse(workers.toString("utf8"));
+        if (!Array.isArray(registry) || registry.length > 16 || sha256(workers) !== i.registryDigest || JSON.stringify(registry) !== workers.toString("utf8"))
+            throw new Error("invalid registry");
+        let previous = "", total = 0;
+        for (const worker of registry) {
+            if (!worker || Object.keys(worker).sort().join(",") !== "digest,id" || typeof worker.id !== "string" ||
+                !/^[a-z][a-z0-9_]{0,31}$/.test(worker.id) || (previous && previous.localeCompare(worker.id, "en") >= 0) ||
+                !/^[a-f0-9]{64}$/.test(worker.digest))
+                throw new Error("invalid worker");
+            const content = bytes(`integration/workers/${worker.id}`);
+            total += content.length;
+            if (total > 1024 * 1024 || sha256(content) !== worker.digest)
+                throw new Error("worker digest mismatch");
+            previous = worker.id;
+        }
+        if ([...files.keys()].filter(p => p.startsWith("integration/workers/")).length !== registry.length)
+            throw new Error("unregistered worker");
+        const manifest = { package: i.package, spkVersion: i.version, integration: { protocol: i.protocol, workers: {} } };
+        const tasks = JSON.parse(/\.rootTasks = (\[[^\n]+\]);/.exec(bytes(windowPath).toString("utf8"))?.[1] ?? "null");
+        const expected = rootTasks({ ...manifest, rootOps: helperOps(manifest, i) });
+        if (!Array.isArray(tasks) || JSON.stringify(tasks.filter(t => t.op?.startsWith("helper_"))) !== JSON.stringify(expected))
+            throw new Error("approved task mismatch");
+        // Daemon lifecycle is verified separately with the complete daemon config.
+        if (!daemon)
+            for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
+                if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
+                    throw new Error("lifecycle mismatch");
+            }
+        return { protocol: i.protocol, dataAccess: i.dataAccess ?? "unavailable" };
+    }
+    catch {
+        findings.push("integration inventory、digest、compiled binding、worker 或 lifecycle 不符合固定契約");
+        return undefined;
+    }
+}

package/dist/standalone/inspect-spk.d.ts

@@ -0,0 +1,23 @@
+import { type IntegrationInspection } from "./inspect-helper.js";
+export type SpkKind = "native-go" | "binary" | "container";
+export interface SpkInspection {
+    kind?: SpkKind;
+    package?: string;
+    version?: string;
+    arch?: string;
+    /** Whether the SPK carries a Synology package signature. */
+    signed: boolean;
+    /** Payload path of the package CGI, when present with mode 0755. */
+    cgi?: string;
+    integration?: IntegrationInspection;
+    payload: Array<{
+        path: string;
+        mode: string;
+    }>;
+    /** Anything that breaks the unsigned, package-account-only contract. */
+    findings: string[];
+}
+/** Reads an SPK without installing it and reports how it would run on DSM. */
+export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;
+/** Auto-detect the generated runtime; retain strict native-go inspection when requested. */
+export declare function inspectSpk(spkPath: string, expectedKind?: SpkKind): Promise<SpkInspection>;

package/dist/standalone/inspect-spk.js

@@ -0,0 +1,209 @@
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as tar from "tar";
+import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
+import { daemonConfig, readDaemon } from "./daemon.js";
+import { renderStandaloneScript } from "./lifecycle.js";
+import { inspectHelper } from "./inspect-helper.js";
+const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
+/** Reads an SPK without installing it and reports how it would run on DSM. */
+export async function inspectStandaloneSpk(spkPath) {
+    return inspectSpk(spkPath, "native-go");
+}
+/** Auto-detect the generated runtime; retain strict native-go inspection when requested. */
+export async function inspectSpk(spkPath, expectedKind) {
+    const dir = mkdtempSync(join(tmpdir(), "syno-inspect-spk-"));
+    try {
+        await tar.x({ file: spkPath, cwd: dir });
+        const findings = [];
+        const payload = await listPayload(join(dir, "package.tgz"), findings);
+        const paths = new Set(payload.map(entry => entry.path));
+        const kind = expectedKind ?? (paths.has(CGI_PAYLOAD_PATH) ? "native-go"
+            : paths.has("native.yaml") ? "binary" : paths.has("compose.yaml") ? "container" : "native-go");
+        const identityPayload = [CGI_PAYLOAD_PATH, "integration/helper", "integration/inventory.json", "integration/workers.json", "integration/identity/app.mjs"].every(path => paths.has(path));
+        const info = readInfo(join(dir, "INFO"), findings, kind, identityPayload);
+        if (kind === "native-go" && paths.has("integration/helper") && info.precheckstartstop !== "yes") {
+            findings.push('integration INFO 必須明確設定 precheckstartstop="yes"，否則 DSM 不執行 prestop');
+        }
+        checkConf(dir, findings, kind);
+        checkScripts(dir, findings);
+        if (kind === "native-go")
+            await checkDaemon(dir, info, paths, payload, findings);
+        let integration;
+        if ([...paths].some(path => path.startsWith("integration/"))) {
+            if (kind !== "native-go" || payload.find(p => p.path === "integration/helper")?.mode !== "0755")
+                findings.push("integration 必須有 native-go executable helper");
+            else if (!findings.length)
+                integration = await inspectHelper(dir, info, findings, paths.has("daemon/config.json"));
+        }
+        const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
+        if (kind === "native-go" && !cgiEntry) {
+            findings.push(`payload 沒有 ${CGI_PAYLOAD_PATH}`);
+        }
+        else if (cgiEntry && cgiEntry.mode !== "0755") {
+            findings.push(`${CGI_PAYLOAD_PATH} 的 mode 是 ${cgiEntry.mode}，應為 0755`);
+        }
+        return {
+            kind,
+            package: info.package,
+            version: info.version,
+            arch: info.arch,
+            signed: existsSync(join(dir, "syno_signature.asc")),
+            cgi: cgiEntry?.mode === "0755" ? CGI_PAYLOAD_PATH : undefined,
+            payload,
+            ...(integration ? { integration } : {}),
+            findings,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+async function checkDaemon(dir, info, paths, payload, findings) {
+    if (![...paths].some(path => path.startsWith("daemon/")))
+        return;
+    if (info.precheckstartstop !== "yes")
+        findings.push('daemon INFO 必須明確設定 precheckstartstop="yes"');
+    if (payload.find(p => p.path === "daemon/control")?.mode !== "0755")
+        findings.push("daemon/control 缺少或非 executable");
+    const unpacked = join(dir, "daemon-inspection");
+    // Extract only the bounded config; the payload executable is never run.
+    const { mkdirSync } = await import("node:fs");
+    mkdirSync(unpacked);
+    await tar.x({ file: join(dir, "package.tgz"), cwd: unpacked, filter: path => path.replace(/^\.\//, "") === "daemon/config.json" });
+    try {
+        const config = JSON.parse(readFileSync(join(unpacked, "daemon/config.json"), "utf8"));
+        if (config.package !== info.package || Object.keys(config).some(key => !["package", "exec", "args", "env", "timeouts", "uninstall_args"].includes(key)))
+            throw new Error("package/config mismatch");
+        const daemon = readDaemon({ exec: config.exec, args: config.args, uninstall_args: config.uninstall_args, env: config.env, timeouts: config.timeouts, targets: { x86_64: "payload" } }, dir, ["x86_64"], () => { });
+        if (!daemon)
+            throw new Error("invalid config");
+        if (payload.find(p => p.path === `daemon/payload/${daemon.exec}`)?.mode !== "0755")
+            throw new Error("missing executable");
+        const manifest = { package: info.package, daemon, ...(paths.has("integration/helper") ? { integration: {} } : {}) };
+        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== daemonConfig(manifest))
+            throw new Error("non-canonical daemon config");
+        for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
+            if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
+                findings.push(`daemon scripts/${hook} 與固定 lifecycle 不符`);
+        }
+    }
+    catch {
+        findings.push("daemon/config.json 或 payload 不符合固定 daemon 契約");
+    }
+}
+function readInfo(path, findings, kind, identityPayload) {
+    if (!existsSync(path)) {
+        findings.push("缺少 INFO");
+        return {};
+    }
+    const info = {};
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        const match = line.match(/^([a-z_]+)="(.*)"$/);
+        if (match) {
+            info[match[1]] = match[2];
+        }
+    }
+    for (const key of ["package", "version", "arch", "os_min_ver"]) {
+        if (!info[key]) {
+            findings.push(`INFO 缺少 ${key}`);
+        }
+    }
+    if (kind === "native-go" && (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
+        findings.push('INFO 必須有 thirdparty="yes" 與 dsmuidir="ui"，DSM 才會提供 /webman/3rdparty/<package>/');
+    }
+    const allowedDependency = kind === "container"
+        ? info.install_dep_packages?.split(":").every(dep => /^(WebStation|ContainerManager)([><=].*)?$/.test(dep))
+        : kind === "native-go" && identityPayload && info.install_dep_packages === "Node.js_v22";
+    if (info.install_dep_packages && !allowedDependency) {
+        findings.push(`INFO 依賴其他套件：${info.install_dep_packages}`);
+    }
+    return info;
+}
+function checkConf(dir, findings, kind) {
+    const confDir = join(dir, "conf");
+    const entries = existsSync(confDir) ? readdirSync(confDir) : [];
+    for (const name of entries) {
+        if (name !== "privilege" && !(kind === "container" && name === "resource")) {
+            findings.push(`conf/${name} 會向 DSM 註冊額外資源；Standalone Package 不產生它`);
+        }
+    }
+    if (kind === "container") {
+        try {
+            const resource = JSON.parse(readFileSync(join(confDir, "resource"), "utf8"));
+            if (!resource["docker-project"])
+                findings.push("container 缺少 docker-project resource");
+            for (const key of Object.keys(resource)) {
+                if (!["docker-project", "webservice"].includes(key))
+                    findings.push(`未知 container resource: ${key}`);
+            }
+        }
+        catch {
+            findings.push("container 缺少有效的 conf/resource");
+        }
+    }
+    if (!entries.includes("privilege")) {
+        findings.push("缺少 conf/privilege（DSM 7 必須以 package 帳號執行）");
+        return;
+    }
+    let privilege;
+    try {
+        privilege = JSON.parse(readFileSync(join(confDir, "privilege"), "utf8"));
+    }
+    catch {
+        findings.push("conf/privilege 不是 JSON");
+        return;
+    }
+    const defaults = privilege.defaults;
+    if (defaults?.["run-as"] !== "package") {
+        findings.push('conf/privilege 的 defaults.run-as 必須是 "package"');
+    }
+    for (const key of ["tool", "ctrl-script", "executable", "join-groupname"]) {
+        if (key in privilege) {
+            findings.push(`conf/privilege 要求 ${key}（root 或額外群組權限）`);
+        }
+    }
+}
+function checkScripts(dir, findings) {
+    const scriptsDir = join(dir, "scripts");
+    if (!existsSync(join(scriptsDir, "start-stop-status"))) {
+        findings.push("缺少 scripts/start-stop-status");
+    }
+    for (const name of existsSync(scriptsDir) ? readdirSync(scriptsDir) : []) {
+        const body = readFileSync(join(scriptsDir, name), "utf8");
+        if (ROOT_SCRIPT_HINTS.some((pattern) => pattern.test(body))) {
+            findings.push(`scripts/${name} 嘗試取得 root 權限（sudo、chown root 或 setuid）`);
+        }
+    }
+}
+async function listPayload(packageTgz, findings) {
+    if (!existsSync(packageTgz)) {
+        findings.push("缺少 package.tgz");
+        return [];
+    }
+    const payload = [];
+    await tar.t({
+        file: packageTgz,
+        onReadEntry: (entry) => {
+            const path = entry.path.replace(/^\.\//, "");
+            const mode = (entry.mode ?? 0) & 0o7777;
+            if (entry.type === "SymbolicLink" || entry.type === "Link") {
+                findings.push(`payload 含連結：${path}`);
+            }
+            if (path.startsWith("/") || path.split("/").includes("..")) {
+                findings.push(`payload 路徑跳出套件目錄：${path}`);
+            }
+            if (mode & 0o6000) {
+                findings.push(`payload 含 setuid/setgid 檔案：${path}`);
+            }
+            if (mode & 0o002) {
+                findings.push(`payload 含所有人可寫的檔案：${path}`);
+            }
+            if (entry.type === "File") {
+                payload.push({ path, mode: mode.toString(8).padStart(4, "0") });
+            }
+        },
+    });
+    return payload;
+}

package/dist/standalone/lifecycle-helper.d.ts

@@ -0,0 +1,2 @@
+/** Non-privileged management veto shared by the generated package hooks. */
+export declare function renderHelperStoppedCheck(packageId: string): string;

package/dist/standalone/lifecycle-helper.js

@@ -0,0 +1,12 @@
+/** Non-privileged management veto shared by the generated package hooks. */
+export function renderHelperStoppedCheck(packageId) {
+    return `/var/packages/${packageId}/target/integration/helper check-stopped || {
+  message='Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.'
+  printf '%s\\n' "$message" >&2
+  if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then
+    (printf '%s\\n' "$message" >> "$SYNOPKG_TEMP_LOGFILE") 2>/dev/null || :
+  fi
+  exit 1
+}
+`;
+}

package/dist/standalone/lifecycle.d.ts

@@ -0,0 +1,3 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** Non-privileged hooks: precheck gates DSM management; no hook tears down root. */
+export declare function renderStandaloneScript(name: string, manifest: StandaloneManifest): string;