@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go-vue/frontend/test/nas-ui.test.ts

@@ -0,0 +1,261 @@
+// @vitest-environment jsdom
+import {expect, test, vi} from 'vitest'
+import {nextTick} from 'vue'
+import {mount} from '../src/main'
+import {createMockNasService} from '../src/nas/mock-provider'
+import {catalogs, nasCopy, format, errorCopy} from '../src/nas/i18n'
+import type {NasProvider} from '../src/nas/provider'
+import type {Context} from '../src/context'
+
+async function settle() {for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}await new Promise(r=>setTimeout(r,25))}
+function click(root:HTMLElement, text:string) {const b=[...root.querySelectorAll('button')].find(b=>b.textContent?.trim()===text || b.getAttribute('aria-label')===text);expect(b,text).toBeTruthy();b!.click()}
+function fixture(nas:NasProvider | undefined, user='normal1', locale='en') {
+ const root=document.createElement('div');document.body.append(root)
+ const reopen:Array<()=>void>=[]
+ const ctx={locale,reopen(fn:()=>void){reopen.push(fn)},call:vi.fn(async(method:string)=> {
+  if(method==='app.status') return {package:'SamePackage',version:'1',user,admin:user==='admin'}
+  if(method==='integration.status') return {state:'not-enabled',reason:'not-requested',packageRunning:'unknown',scheduler:'not-probed'}
+  throw {code:'unknown_method'}
+ })} as Context
+ const app=mount(root,ctx,{nasProvider:nas})
+ return {root,app,ctx,reopen}
+}
+function cleanup(...fixtures:ReturnType<typeof fixture>[]) {for(const f of fixtures){f.app.unmount();f.root.remove()}}
+
+test('managed account pilot stays visibly off with maintenance and approval restrictions',async()=> {
+ const f=fixture(createMockNasService().connect('admin'),'admin')
+ try {
+  await settle()
+  expect(f.root.textContent).toContain('Managed account pilot: off')
+  expect(f.root.textContent).toContain('Account changes or unverified identity revoke access')
+  expect(f.root.textContent).toContain('Enabling this pilot is unavailable in this build')
+  expect([...f.root.querySelectorAll('button')].some(b=>b.textContent?.includes('Enable managed'))).toBe(false)
+ } finally {cleanup(f)}
+})
+
+test('nine complete catalogs resolve DSM locale aliases with English fallback',()=> {
+ expect(Object.keys(catalogs)).toEqual(['en','zh-TW','zh-CN','ja','ko','de','fr','es','it'])
+ for(const catalog of Object.values(catalogs)) {
+  expect(Object.keys(catalog).sort()).toEqual(Object.keys(catalogs.en).sort())
+  expect(Object.values(catalog).every(s=>typeof s==='string' && s.trim().length>0)).toBe(true)
+  for(const key of Object.keys(catalogs.en) as Array<keyof typeof catalogs.en>) {
+   expect(catalog[key].match(/\{\w+\}/g) ?? []).toEqual(catalogs.en[key].match(/\{\w+\}/g) ?? [])
+  }
+ }
+ expect(nasCopy('cht')).toEqual(catalogs['zh-TW'])
+ expect(nasCopy('zh_CN')).toEqual(catalogs['zh-CN'])
+ expect(nasCopy('unknown')).toEqual(catalogs.en)
+})
+
+test('account changes discard the bound provider UI and its pending candidate context',async()=> {
+ const provider=createMockNasService().connect('normal1'), cancel=vi.spyOn(provider,'cancel'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle()
+  f.ctx.call=vi.fn(async(method:string)=>method==='app.status'?{package:'SamePackage',version:'1',user:'normal2',admin:false}:{state:'not-enabled',reason:'not-requested',packageRunning:'unknown',scheduler:'not-probed'})
+  f.reopen.forEach(fn=>fn());await settle()
+  expect(f.root.textContent).toContain('normal2')
+  expect(f.root.querySelector('[role="dialog"]')).toBeNull()
+  expect(f.root.textContent).not.toContain('Choose my folder')
+  expect(cancel).toHaveBeenCalled()
+ } finally {cleanup(f)}
+})
+
+test('all nine locale UIs localize dialog controls and allow keyboard review without mouse-only actions',async()=> {
+ for(const locale of Object.keys(catalogs)) {
+  const copy=nasCopy(locale), f=fixture(createMockNasService().connect('normal1'),'normal1',locale)
+  try {
+   await settle();click(f.root,copy.choosePersonal);await settle()
+   const selected=[...f.root.querySelectorAll('button')].find(b=>b.getAttribute('aria-label')===format(copy.select,'Projects'))!
+   selected.focus();expect(document.activeElement).toBe(selected)
+   // Native Button remains a keyboard-activatable button (browser verifies Enter).
+   expect(selected.tagName).toBe('BUTTON');selected.click();await settle()
+   click(f.root,copy.review);await settle();expect(f.root.textContent).toContain(copy.persistent)
+   expect(f.root.querySelector(`button[aria-label="${copy.close}"]`)).toBeTruthy()
+   click(f.root,copy.cancel);await settle()
+  } finally {cleanup(f)}
+ }
+})
+
+test('home unavailable is recoverable and native diagnostics are never rendered',async()=> {
+ const provider=createMockNasService({homeAvailable:false}).connect('normal1'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle()
+  expect(f.root.textContent).toContain('Required native identity or permission proof is unavailable')
+  provider.begin=async()=>{throw {code:'unknown',message:'/volume1/private-secret stderr'}}
+  click(f.root,'Retry');await settle()
+  expect(f.root.textContent).toContain('The request failed')
+  expect(f.root.textContent).not.toMatch(/private-secret|stderr/)
+ } finally {cleanup(f)}
+})
+
+test('picker browse, separate selection/summary, cancel, empty and confirm use injected provider only',async()=> {
+ const service=createMockNasService(), provider=service.connect('normal1'), cancel=vi.spyOn(provider,'cancel'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle()
+  expect(f.root.textContent).toContain('Mock preview')
+  expect(f.root.querySelector('[role="dialog"]')).toBeTruthy()
+  click(f.root,'Select Projects');await settle()
+  expect(f.root.textContent).not.toContain('Persistent access')
+  click(f.root,'Review access');await settle()
+  expect(f.root.textContent).toContain('Persistent access')
+  click(f.root,'Cancel');await settle()
+  expect(cancel).toHaveBeenCalled()
+  expect(await provider.grants(new AbortController().signal)).toEqual([])
+  click(f.root,'Choose my folder');await settle();click(f.root,'Open Empty folder');await settle()
+  expect(f.root.textContent).toContain('This folder is empty')
+  click(f.root,'Back');await settle();click(f.root,'Select Projects');await settle();click(f.root,'Review access');await settle();click(f.root,'Confirm access');await settle()
+  expect(f.root.querySelector('[role="dialog"]')).toBeNull()
+  expect(f.root.textContent).toContain('Active')
+ } finally {cleanup(f)}
+})
+
+test('two same-package apps retain local modality, unique ARIA IDs and cancellation isolation',async()=> {
+ const service=createMockNasService(), a=fixture(service.connect('normal1')), b=fixture(service.connect('normal2'))
+ const body=document.body.getAttribute('style')
+ try {
+  await settle();click(a.root,'Choose my folder');click(b.root,'Choose my folder');await settle()
+  const ids=[...document.querySelectorAll('[id]')].map(n=>n.id).filter(Boolean)
+  expect(new Set(ids).size).toBe(ids.length)
+  for(const f of [a,b]) {
+   const dialog=f.root.querySelector('[role="dialog"]')!
+   expect(dialog.hasAttribute('aria-modal')).toBe(false)
+   for(const name of ['aria-labelledby','aria-describedby']) expect(f.root.querySelector(`[id="${dialog.getAttribute(name)}"]`)).toBeTruthy()
+  }
+  expect(getComputedStyle(b.root).pointerEvents).not.toBe('none')
+  click(a.root,'Cancel');await settle()
+  expect(a.root.querySelector('[role="dialog"]')).toBeNull()
+  expect(b.root.querySelector('[role="dialog"]')).toBeTruthy()
+  expect(document.body.getAttribute('style')).toBe(body)
+ } finally {cleanup(a,b)}
+})
+
+test('intent expiry is actionable; revoked but not drained never claims transfers stopped',async()=> {
+ let now=1000
+ const service=createMockNasService({now:()=>now,drained:false}), provider=service.connect('normal1'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle();click(f.root,'Select Projects');await settle();click(f.root,'Review access');await settle()
+  now+=30_000;click(f.root,'Confirm access');await settle()
+  expect(f.root.textContent).toContain('expired')
+  expect(await provider.grants(new AbortController().signal)).toEqual([])
+  click(f.root,'Cancel');await settle();click(f.root,'Choose my folder');await settle();click(f.root,'Select Projects');await settle();click(f.root,'Review access');await settle();click(f.root,'Confirm access');await settle()
+  click(f.root,'Revoke');await settle()
+  expect(f.root.textContent).toContain('already sent or written')
+  click(f.root,'Confirm revoke');await settle()
+  expect(f.root.textContent).toContain('Revoked; stopping transfers')
+ } finally {cleanup(f)}
+})
+
+test('unmount aborts late browse and cancels its context without creating a grant',async()=> {
+ const provider=createMockNasService().connect('normal1'), base=provider.list.bind(provider)
+ let resolve!:()=>void, requestSignal!:AbortSignal
+ provider.list=async(...args)=>{requestSignal=args[3];await new Promise<void>(r=>resolve=r);return base(...args)}
+ const cancel=vi.spyOn(provider,'cancel'), f=fixture(provider)
+ await settle();click(f.root,'Choose my folder');await settle();f.app.unmount()
+ expect(requestSignal.aborted).toBe(true);expect(cancel).toHaveBeenCalled()
+ resolve();await settle();expect(f.root.childElementCount).toBe(0);f.root.remove()
+})
+
+test('late begin after close is canceled and rapid double review consumes one intent',async()=> {
+ const provider=createMockNasService().connect('normal1'), begin=provider.begin.bind(provider)
+ let release!:()=>void
+ provider.begin=async(kind,signal)=>{await new Promise<void>(r=>release=r);return begin(kind,new AbortController().signal)}
+ const cancel=vi.spyOn(provider,'cancel'), prepare=vi.spyOn(provider,'prepare'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle();click(f.root,'Cancel');await settle()
+  release();await settle();expect(cancel).toHaveBeenCalled();expect(f.root.querySelector('[role="dialog"]')).toBeNull()
+  provider.begin=begin
+  click(f.root,'Choose my folder');await settle();click(f.root,'Select Projects');await settle()
+  click(f.root,'Review access');click(f.root,'Review access');await settle()
+  expect(prepare).toHaveBeenCalledTimes(1)
+ } finally {cleanup(f)}
+})
+
+test('long folder names stay text, and revoked without Q uses pending cleanup copy',async()=> {
+ const name='<img src=x onerror=alert(1)> '+ '\u5e74\u5ea6\u5831\u544a'.repeat(20)
+ const provider=createMockNasService({personalFolders:[name]}).connect('normal1'), f=fixture(provider)
+ try {
+  await settle();click(f.root,'Choose my folder');await settle()
+  expect(f.root.textContent).toContain(name);expect(f.root.querySelector('img')).toBeNull()
+  click(f.root,'Cancel');await settle()
+  provider.settings=async()=>({canManageShared:false,items:[{grantId:'fixture',revision:2,scopeKind:'user-personal',displayName:name,targetKind:'directory',actions:['nas.files.read'],effectiveState:'revoked',createdAt:1000,canRevoke:true,cleanupRequired:true}]})
+  click(f.root,'Refresh access');await settle()
+  expect(f.root.textContent).toContain('Revoked; cleanup needs verification')
+  expect(f.root.textContent).toContain('Read files')
+  expect(f.root.textContent).not.toContain('List folders')
+ } finally {cleanup(f)}
+})
+
+
+test('S8 production defaults display unavailable for normal/admin even when lifecycle is ready',async()=> {
+ for(const user of ['normal1','admin']) for(const locale of Object.keys(catalogs)) {
+  const f=fixture(undefined,user,locale),copy=nasCopy(locale)
+  try {
+   f.ctx.call=vi.fn(async(method:string)=> {
+    if(method==='app.status') return {package:'SamePackage',version:'1',user,admin:user==='admin'}
+    if(method==='integration.status') return {state:'ready',packageRunning:'running',scheduler:'ready'}
+    if(method==='personal.list') return {items:[]}
+    throw {code:'unknown_method'}
+   })
+   f.reopen.forEach(fn=>fn());await settle()
+   expect(f.root.textContent).toContain(copy.unavailableMessage)
+   expect(f.root.textContent).toContain(copy.pilotUnavailable)
+   expect(f.root.textContent).toContain(copy.noUnlock)
+   expect(f.root.textContent).not.toContain(copy.choosePersonal)
+   expect(f.root.textContent).not.toContain(copy.chooseShared)
+   expect(f.root.textContent).not.toContain(copy.emptyGrant)
+   expect(f.ctx.call.mock.calls.some(([method])=>method.startsWith('nas.'))).toBe(false)
+  } finally {cleanup(f)}
+ }
+})
+
+test('S8 unavailable connected providers are ignored; only development mocks have a picker',async()=> {
+ const connected=createMockNasService().connect('normal1')
+ Object.defineProperty(connected,'mode',{value:'connected'})
+ const settings=vi.spyOn(connected,'settings'),f=fixture(connected)
+ try {
+  await settle()
+  expect(f.root.textContent).toContain(nasCopy('en').unavailableMessage)
+  expect(f.root.textContent).not.toContain('Choose my folder')
+  expect(settings).not.toHaveBeenCalled()
+ } finally {cleanup(f)}
+})
+
+
+test('S8 safe error codes distinguish missing proof, denial, missing method and app authentication',()=> {
+ for(const copy of Object.values(catalogs)) {
+  for(const [code,key] of [['unavailable','errorNativeProof'],['denied','errorDenied'],['unknown_method','errorUnknownMethod'],['unsupported','errorUnsupported'],['session_required','errorSession'],['auth_unavailable','errorAuthentication']] as const) {
+   expect(errorCopy({code,message:'/volume1/private cookie=sid'},copy)).toBe(copy[key])
+   expect(errorCopy({code,message:'/volume1/private cookie=sid'},copy)).not.toMatch(/volume1|cookie=sid/)
+  }
+  expect(new Set(['unavailable','denied','unknown_method','unsupported'].map(code=>errorCopy({code},copy))).size).toBe(4)
+ }
+})
+
+
+test('S8 app request failures use localized safe-code copy without native diagnostics',async()=> {
+ for(const code of ['denied','unknown_method','unavailable','unsupported','session_required','auth_unavailable']) {
+  const f=fixture(undefined,'normal1','cht')
+  try {
+   await settle()
+   f.ctx.call=vi.fn(async()=>{throw {code,message:'/volume1/private cookie=sid'}})
+   f.reopen.forEach(fn=>fn());await settle()
+   expect(f.root.querySelector('[role="alert"]')?.textContent).toBe(errorCopy({code},nasCopy('cht')))
+   expect(f.root.textContent).not.toMatch(/volume1|cookie=sid/)
+  } finally {cleanup(f)}
+ }
+})
+
+ test('S1R risk and reauthorization are disclosed in nine unavailable UIs without data actions',async()=> {
+  for(const locale of Object.keys(catalogs)) {
+   const copy=nasCopy(locale) as any, f=fixture(undefined,'normal1',locale)
+   try {
+    await settle()
+    for(const key of ['relaxedRisk','relaxedReauthorize','relaxedPermissions']) {
+     expect(copy[key],`${locale}:${key}`).toBeTypeOf('string')
+     expect(f.root.textContent).toContain(copy[key])
+    }
+    expect(f.root.textContent).not.toContain(copy.choosePersonal)
+    expect(f.ctx.call.mock.calls.some(([method])=>method.startsWith('nas.'))).toBe(false)
+   } finally {cleanup(f)}
+  }
+ })

package/templates/native-go-vue/frontend/tsconfig.json

@@ -0,0 +1 @@
+{"compilerOptions":{"target":"ES2022","module":"ESNext","moduleResolution":"Bundler","resolveJsonModule":true,"strict":true,"lib":["ES2022","DOM"],"skipLibCheck":true,"types":["vite/client"]},"include":["src/**/*.ts","src/**/*.vue","vite.config.ts"]}

package/templates/native-go-vue/frontend/vite.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from 'vite'
+import vue from '@vitejs/plugin-vue'
+// @ts-expect-error The shared notice tool is a plain Node module.
+import { writeThirdPartyNotices } from './third-party-notices.mjs'
+export default defineConfig(({command}) => ({
+  plugins: [vue(), {name: 'dependency-notices', closeBundle() {writeThirdPartyNotices('.', 'dist/LICENSES', {ui: true})}}],
+  // Library mode must replace Vue dependency env guards for the DSM browser.
+  define: command === 'build' ? {'process.env.NODE_ENV': JSON.stringify('production')} : {},
+  build: {lib: {entry: 'src/main.ts', formats: ['iife'], name: 'DsmVueApp', fileName: () => 'app.js'}, cssCodeSplit: false, rollupOptions: {output: {assetFileNames: 'app.[ext]'}}},
+}))

package/templates/native-go-vue/gitignore

@@ -0,0 +1,2 @@
+dist/
+node_modules/

package/dist/attestation/app-package.d.ts

@@ -1,86 +0,0 @@
-import { type JWK } from "jose";
-export declare const PLATFORM_ATTESTATION_ISSUER = "synopkgland-curated";
-export declare const APP_PACKAGE_ATTESTATION_TYP = "app-package-attestation";
-export declare const APP_PACKAGE_ATTESTATION_VERSION: 2;
-export declare const CURATED_RELEASE_ATTESTATION_TYP = "curated-release-attestation";
-export declare const CURATED_RELEASE_ATTESTATION_VERSION: 1;
-export interface AppPackageSigningKey {
-    kid: string;
-    privateKey: CryptoKey;
-}
-export interface LabAttestationKeys extends AppPackageSigningKey {
-    publicKey: CryptoKey;
-    publicJwk: JWK;
-}
-/** Inputs for the token embedded in the generated SPK. */
-export interface CuratedAppPackageAttestationInput {
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-}
-/** Inputs for the detached token published beside the final SPK. */
-export interface CuratedReleaseAttestationInput {
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    artifactDigest: string;
-    embeddedAttestationDigest: string;
-}
-export interface AppPackageAttestationClaims {
-    typ: typeof APP_PACKAGE_ATTESTATION_TYP;
-    version: typeof APP_PACKAGE_ATTESTATION_VERSION;
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-    issuedAt: string;
-}
-export interface CuratedReleaseAttestationClaims {
-    typ: typeof CURATED_RELEASE_ATTESTATION_TYP;
-    version: typeof CURATED_RELEASE_ATTESTATION_VERSION;
-    packageIdentity: string;
-    packageVersion: string;
-    packageBuild: number;
-    artifactDigest: string;
-    embeddedAttestationDigest: string;
-    issuedAt: string;
-}
-export declare function loadOrCreateLabAttestationKeys(filePath: string): Promise<LabAttestationKeys>;
-/**
- * Sign the local development token used by the inner-loop flow.
- * Curated releases must use the v2 function below and never this helper.
- */
-export declare function signAppPackageAttestationToken(input: {
-    packageIdentity: string;
-    contractDigest: string;
-    bundleDigest: string;
-    capabilities: string[];
-}, keys: LabAttestationKeys): Promise<{
-    token: string;
-    attestationDigest: string;
-}>;
-/** Sign the v2 App Package Attestation embedded in a Curated SPK. */
-export declare function signCuratedAppPackageAttestationToken(input: CuratedAppPackageAttestationInput, key: AppPackageSigningKey): Promise<{
-    token: string;
-    attestationDigest: string;
-    claims: AppPackageAttestationClaims;
-}>;
-/** Sign the v1 detached release attestation for a final SPK archive. */
-export declare function signCuratedReleaseAttestationToken(input: CuratedReleaseAttestationInput, key: AppPackageSigningKey): Promise<{
-    token: string;
-    attestationDigest: string;
-    claims: CuratedReleaseAttestationClaims;
-}>;
-/** Stable JSON representation used by the embedded token's jti binding. */
-export declare function canonicalAppPackageClaims(claims: AppPackageAttestationClaims): string;
-export declare function digestAppPackageClaims(claims: AppPackageAttestationClaims): string;
-/** Stable JSON representation used by the detached token's jti binding. */
-export declare function canonicalCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
-export declare function digestCuratedReleaseClaims(claims: CuratedReleaseAttestationClaims): string;
-export declare function normalizeCapabilities(capabilities: string[]): string[];
-export declare function assertPackageVersionBinding(packageVersion: string, packageBuild: number): void;

package/dist/attestation/app-package.js

@@ -1,206 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { SignJWT, exportJWK, generateKeyPair, importJWK } from "jose";
-import { CURATED_BUILD_OFFSET } from "@synopackageland/package-source/index-manifest";
-export const PLATFORM_ATTESTATION_ISSUER = "synopkgland-curated";
-export const APP_PACKAGE_ATTESTATION_TYP = "app-package-attestation";
-export const APP_PACKAGE_ATTESTATION_VERSION = 2;
-export const CURATED_RELEASE_ATTESTATION_TYP = "curated-release-attestation";
-export const CURATED_RELEASE_ATTESTATION_VERSION = 1;
-export async function loadOrCreateLabAttestationKeys(filePath) {
-    mkdirSync(dirname(filePath), { recursive: true });
-    if (existsSync(filePath)) {
-        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
-        return {
-            kid: parsed.kid,
-            privateKey: (await importJWK(parsed.privateJwk, "RS256")),
-            publicKey: (await importJWK(parsed.publicJwk, "RS256")),
-            publicJwk: parsed.publicJwk,
-        };
-    }
-    const { publicKey, privateKey } = await generateKeyPair("RS256", { extractable: true });
-    const publicJwk = await exportJWK(publicKey);
-    const privateJwk = await exportJWK(privateKey);
-    const kid = createHash("sha256").update(JSON.stringify(publicJwk)).digest("hex").slice(0, 16);
-    publicJwk.kid = kid;
-    privateJwk.kid = kid;
-    writeFileSync(filePath, `${JSON.stringify({ kid, privateJwk, publicJwk }, null, 2)}\n`, { mode: 0o600 });
-    return { kid, privateKey, publicKey, publicJwk };
-}
-/**
- * Sign the local development token used by the inner-loop flow.
- * Curated releases must use the v2 function below and never this helper.
- */
-export async function signAppPackageAttestationToken(input, keys) {
-    const claims = {
-        typ: APP_PACKAGE_ATTESTATION_TYP,
-        version: 1,
-        packageIdentity: input.packageIdentity,
-        contractDigest: input.contractDigest,
-        bundleDigest: input.bundleDigest,
-        capabilities: normalizeCapabilities(input.capabilities),
-        issuedAt: new Date().toISOString(),
-    };
-    const canonical = JSON.stringify({
-        artifactDigest: null,
-        bundleDigest: claims.bundleDigest,
-        capabilities: claims.capabilities,
-        contractDigest: claims.contractDigest,
-        issuedAt: claims.issuedAt,
-        packageBuild: null,
-        packageIdentity: claims.packageIdentity,
-        typ: claims.typ,
-        version: claims.version,
-    });
-    const attestationDigest = sha256(canonical);
-    const token = await signClaims(claims, keys, attestationDigest);
-    return { token, attestationDigest };
-}
-/** Sign the v2 App Package Attestation embedded in a Curated SPK. */
-export async function signCuratedAppPackageAttestationToken(input, key) {
-    assertCuratedAppPackageInput(input);
-    const claims = {
-        typ: APP_PACKAGE_ATTESTATION_TYP,
-        version: APP_PACKAGE_ATTESTATION_VERSION,
-        packageIdentity: input.packageIdentity,
-        packageVersion: input.packageVersion,
-        packageBuild: input.packageBuild,
-        contractDigest: input.contractDigest,
-        bundleDigest: input.bundleDigest,
-        capabilities: normalizeCapabilities(input.capabilities),
-        issuedAt: new Date().toISOString(),
-    };
-    const attestationDigest = digestAppPackageClaims(claims);
-    const token = await signClaims(claims, key, attestationDigest);
-    return { token, attestationDigest, claims };
-}
-/** Sign the v1 detached release attestation for a final SPK archive. */
-export async function signCuratedReleaseAttestationToken(input, key) {
-    assertCuratedReleaseInput(input);
-    const claims = {
-        typ: CURATED_RELEASE_ATTESTATION_TYP,
-        version: CURATED_RELEASE_ATTESTATION_VERSION,
-        packageIdentity: input.packageIdentity,
-        packageVersion: input.packageVersion,
-        packageBuild: input.packageBuild,
-        artifactDigest: input.artifactDigest,
-        embeddedAttestationDigest: input.embeddedAttestationDigest,
-        issuedAt: new Date().toISOString(),
-    };
-    const attestationDigest = digestCuratedReleaseClaims(claims);
-    const token = await signClaims(claims, key, attestationDigest);
-    return { token, attestationDigest, claims };
-}
-/** Stable JSON representation used by the embedded token's jti binding. */
-export function canonicalAppPackageClaims(claims) {
-    return JSON.stringify({
-        bundleDigest: claims.bundleDigest,
-        capabilities: normalizeCapabilities(claims.capabilities),
-        contractDigest: claims.contractDigest,
-        issuedAt: claims.issuedAt,
-        packageBuild: claims.packageBuild,
-        packageIdentity: claims.packageIdentity,
-        packageVersion: claims.packageVersion,
-        typ: claims.typ,
-        version: claims.version,
-    });
-}
-export function digestAppPackageClaims(claims) {
-    return sha256(canonicalAppPackageClaims(claims));
-}
-/** Stable JSON representation used by the detached token's jti binding. */
-export function canonicalCuratedReleaseClaims(claims) {
-    return JSON.stringify({
-        artifactDigest: claims.artifactDigest,
-        embeddedAttestationDigest: claims.embeddedAttestationDigest,
-        issuedAt: claims.issuedAt,
-        packageBuild: claims.packageBuild,
-        packageIdentity: claims.packageIdentity,
-        packageVersion: claims.packageVersion,
-        typ: claims.typ,
-        version: claims.version,
-    });
-}
-export function digestCuratedReleaseClaims(claims) {
-    return sha256(canonicalCuratedReleaseClaims(claims));
-}
-export function normalizeCapabilities(capabilities) {
-    if (!Array.isArray(capabilities)) {
-        throw new Error("capabilities must be an array");
-    }
-    const normalized = new Set();
-    for (const capability of capabilities) {
-        if (typeof capability !== "string" || capability.length === 0) {
-            throw new Error("capabilities must contain non-empty strings");
-        }
-        normalized.add(capability);
-    }
-    return [...normalized].sort();
-}
-export function assertPackageVersionBinding(packageVersion, packageBuild) {
-    if (typeof packageVersion !== "string" || packageVersion.length === 0) {
-        throw new Error("packageVersion must be a non-empty string");
-    }
-    if (!Number.isSafeInteger(packageBuild) ||
-        packageBuild < 1 ||
-        packageBuild >= CURATED_BUILD_OFFSET) {
-        throw new Error("packageBuild must be a positive safe integer below the Curated offset");
-    }
-    const match = /-(\d+)$/.exec(packageVersion);
-    const parsed = match ? Number(match[1]) : NaN;
-    if (parsed !== packageBuild && parsed !== packageBuild + CURATED_BUILD_OFFSET) {
-        throw new Error("packageVersion and packageBuild must agree");
-    }
-}
-async function signClaims(claims, key, attestationDigest) {
-    if (typeof key.kid !== "string" || key.kid.length === 0) {
-        throw new Error("attestation signing key kid is required");
-    }
-    const packageIdentity = claims.packageIdentity;
-    if (typeof packageIdentity !== "string") {
-        throw new Error("attestation package identity is required");
-    }
-    return new SignJWT({ ...claims })
-        .setProtectedHeader({ alg: "RS256", kid: key.kid, typ: "JWT" })
-        .setIssuer(PLATFORM_ATTESTATION_ISSUER)
-        .setSubject(packageIdentity)
-        .setJti(attestationDigest)
-        .sign(key.privateKey);
-}
-function assertCuratedAppPackageInput(input) {
-    assertIdentityAndVersion(input.packageIdentity, input.packageVersion);
-    assertPackageBuild(input.packageBuild);
-    assertPackageVersionBinding(input.packageVersion, input.packageBuild);
-    assertSha256Digest(input.contractDigest, "contractDigest");
-    assertSha256Digest(input.bundleDigest, "bundleDigest");
-    normalizeCapabilities(input.capabilities);
-}
-function assertCuratedReleaseInput(input) {
-    assertIdentityAndVersion(input.packageIdentity, input.packageVersion);
-    assertPackageBuild(input.packageBuild);
-    assertPackageVersionBinding(input.packageVersion, input.packageBuild);
-    assertSha256Digest(input.artifactDigest, "artifactDigest");
-    assertSha256Digest(input.embeddedAttestationDigest, "embeddedAttestationDigest");
-}
-function assertIdentityAndVersion(packageIdentity, packageVersion) {
-    if (typeof packageIdentity !== "string" || packageIdentity.trim().length === 0) {
-        throw new Error("packageIdentity must be a non-empty string");
-    }
-    if (typeof packageVersion !== "string" || packageVersion.trim().length === 0) {
-        throw new Error("packageVersion must be a non-empty string");
-    }
-}
-function assertPackageBuild(packageBuild) {
-    if (!Number.isSafeInteger(packageBuild) || packageBuild < 1) {
-        throw new Error("packageBuild must be a positive safe integer");
-    }
-}
-function assertSha256Digest(value, name) {
-    if (!/^[a-f0-9]{64}$/.test(value)) {
-        throw new Error(`${name} must be a lowercase SHA-256 digest`);
-    }
-}
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}

package/dist/attestation/install-on-host.d.ts

@@ -1,14 +0,0 @@
-import type { JWK } from "jose";
-import type { HostCredentials } from "../host/types.js";
-export declare function loginDsmCookie(credentials: HostCredentials): Promise<string>;
-export declare function installAppPackageAttestationOnNas(options: {
-    credentials: HostCredentials;
-    token: string;
-    publicJwk: JWK;
-}): Promise<{
-    ok: boolean;
-    status: number;
-    code?: string;
-    message?: string;
-    kind?: string;
-}>;

package/dist/attestation/install-on-host.js

@@ -1,52 +0,0 @@
-import { IDENTITY_CGI_PATH } from "../host/broker-paths.js";
-export async function loginDsmCookie(credentials) {
-    const dsmOrigin = credentials.dsmOrigin.replace(/\/$/, "");
-    const query = new URLSearchParams({
-        api: "SYNO.API.Auth",
-        version: "3",
-        method: "login",
-        account: credentials.username,
-        passwd: credentials.password,
-        session: "FileStation",
-        format: "cookie",
-    });
-    const response = await fetch(`${dsmOrigin}/webapi/entry.cgi?${query.toString()}`);
-    const setCookie = typeof response.headers.getSetCookie === "function"
-        ? response.headers.getSetCookie()
-        : response.headers.get("set-cookie")
-            ? [response.headers.get("set-cookie")]
-            : [];
-    return setCookie
-        .map((line) => line.split(";")[0]?.trim())
-        .filter((pair) => Boolean(pair))
-        .join("; ");
-}
-export async function installAppPackageAttestationOnNas(options) {
-    const dsmOrigin = options.credentials.dsmOrigin.replace(/\/$/, "");
-    const cookie = await loginDsmCookie(options.credentials);
-    const response = await fetch(`${dsmOrigin}${IDENTITY_CGI_PATH}/api/v1/inner-loop/accept-app-package`, {
-        method: "POST",
-        headers: {
-            cookie,
-            "content-type": "application/json",
-        },
-        body: JSON.stringify({ token: options.token, publicJwk: options.publicJwk }),
-    });
-    const text = await response.text();
-    let body;
-    try {
-        body = JSON.parse(text);
-    }
-    catch {
-        return { ok: false, status: response.status, code: "INNER_LOOP_API_MISSING", message: text.slice(0, 200) };
-    }
-    if (!response.ok) {
-        return {
-            ok: false,
-            status: response.status,
-            code: body.error?.code,
-            message: body.error?.message,
-        };
-    }
-    return { ok: true, status: response.status, kind: body.kind };
-}

package/dist/attestation/keyring.d.ts

@@ -1,21 +0,0 @@
-import { type JWK } from "jose";
-export declare const CURATED_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING_PATH";
-export declare const CURATED_ATTESTATION_KEYRING_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING";
-export type CuratedTrustRootStatus = "active" | "verify-only" | "revoked";
-export type CuratedTrustRootErrorCode = "CURATED_TRUST_ROOT_MISSING" | "CURATED_TRUST_ROOT_INVALID" | "CURATED_SIGNING_KEY_UNKNOWN" | "CURATED_SIGNING_KEY_REVOKED" | "CURATED_SIGNING_KEY_NOT_ACTIVE" | "CURATED_SIGNING_KEY_MISMATCH";
-export interface CuratedTrustRootEntry {
-    kid: string;
-    status: CuratedTrustRootStatus;
-    publicJwk: JWK;
-}
-export interface CuratedTrustRoot {
-    version: 1;
-    keys: CuratedTrustRootEntry[];
-}
-export declare class CuratedTrustRootError extends Error {
-    readonly code: CuratedTrustRootErrorCode;
-    constructor(code: CuratedTrustRootErrorCode, message?: string);
-}
-export declare function loadCuratedTrustRoot(env?: NodeJS.Dict<string>): Promise<CuratedTrustRoot>;
-export declare function parseCuratedTrustRoot(value: unknown): CuratedTrustRoot;
-export declare function resolveCuratedSigningTrust(root: CuratedTrustRoot, kid: string, signingPublicJwk: JWK): Promise<CryptoKey>;