@synopackageland/cli 0.3.10 → 0.4.1

package/dist/attestation/keyring.js

@@ -1,168 +0,0 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { importJWK } from "jose";
-export const CURATED_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING_PATH";
-export const CURATED_ATTESTATION_KEYRING_ENV = "SYNOPKGLAND_CURATED_ATTESTATION_KEYRING";
-const TRUST_ROOT_FIELDS = new Set(["version", "keys"]);
-const TRUST_ROOT_ENTRY_FIELDS = new Set(["kid", "status", "publicJwk"]);
-const PUBLIC_JWK_FIELDS = new Set([
-    "kty",
-    "n",
-    "e",
-    "alg",
-    "use",
-    "key_ops",
-    "kid",
-    "x5c",
-    "x5t",
-    "x5t#S256",
-]);
-export class CuratedTrustRootError extends Error {
-    code;
-    constructor(code, message = code) {
-        super(message);
-        this.code = code;
-        this.name = "CuratedTrustRootError";
-    }
-}
-export async function loadCuratedTrustRoot(env = process.env) {
-    const rawFromEnv = env[CURATED_ATTESTATION_KEYRING_ENV]?.trim();
-    const pathFromEnv = env[CURATED_ATTESTATION_KEYRING_PATH_ENV]?.trim();
-    if (rawFromEnv && pathFromEnv) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Configure either the curated public keyring JSON or its path, not both.");
-    }
-    if (!rawFromEnv && !pathFromEnv) {
-        throw trustRootError("CURATED_TRUST_ROOT_MISSING", "The release signing custody contract requires a curated public keyring.");
-    }
-    let raw;
-    try {
-        raw = rawFromEnv ?? readFileSync(resolve(pathFromEnv), "utf8");
-    }
-    catch {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Unable to read the curated public keyring.");
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring is not valid JSON.");
-    }
-    return parseCuratedTrustRoot(parsed);
-}
-export function parseCuratedTrustRoot(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring must be an object.");
-    }
-    const record = value;
-    if (containsPrivateJwkField(record)) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains private RSA material.");
-    }
-    assertKnownFields(record, TRUST_ROOT_FIELDS, "The curated public keyring");
-    if (record.version !== 1 || !Array.isArray(record.keys)) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring must use schema version 1.");
-    }
-    const seen = new Set();
-    const keys = [];
-    for (const rawEntry of record.keys) {
-        if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
-            throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains a malformed entry.");
-        }
-        const entry = rawEntry;
-        assertKnownFields(entry, TRUST_ROOT_ENTRY_FIELDS, "The curated public keyring entry");
-        if (typeof entry.kid !== "string" ||
-            entry.kid.length === 0 ||
-            seen.has(entry.kid) ||
-            (entry.status !== "active" && entry.status !== "verify-only" && entry.status !== "revoked") ||
-            !entry.publicJwk ||
-            typeof entry.publicJwk !== "object" ||
-            Array.isArray(entry.publicJwk)) {
-            throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring contains an invalid entry.");
-        }
-        seen.add(entry.kid);
-        const publicJwk = entry.publicJwk;
-        validatePublicJwk(publicJwk, entry.kid);
-        keys.push({ kid: entry.kid, status: entry.status, publicJwk });
-    }
-    return { version: 1, keys };
-}
-export async function resolveCuratedSigningTrust(root, kid, signingPublicJwk) {
-    if (root.keys.length === 0) {
-        throw trustRootError("CURATED_TRUST_ROOT_MISSING", "The curated public keyring contains no trusted keys.");
-    }
-    const entry = root.keys.find((candidate) => candidate.kid === kid);
-    if (!entry) {
-        throw trustRootError("CURATED_SIGNING_KEY_UNKNOWN", `The signing kid is not in the curated keyring: ${kid}`);
-    }
-    if (entry.status === "revoked") {
-        throw trustRootError("CURATED_SIGNING_KEY_REVOKED", `The signing kid is revoked: ${kid}`);
-    }
-    if (entry.status !== "active") {
-        throw trustRootError("CURATED_SIGNING_KEY_NOT_ACTIVE", `The signing kid is not active: ${kid}`);
-    }
-    if (signingPublicJwk.kty !== entry.publicJwk.kty ||
-        signingPublicJwk.n !== entry.publicJwk.n ||
-        signingPublicJwk.e !== entry.publicJwk.e) {
-        throw trustRootError("CURATED_SIGNING_KEY_MISMATCH", `The signing material does not match curated kid: ${kid}`);
-    }
-    try {
-        return (await importJWK(entry.publicJwk, "RS256"));
-    }
-    catch {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated public keyring key could not be imported.");
-    }
-}
-function validatePublicJwk(jwk, expectedKid) {
-    if (!jwk || typeof jwk !== "object") {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated key is not a JWK object.");
-    }
-    const record = jwk;
-    if (containsPrivateJwkField(record)) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "The curated keyring contains private RSA material.");
-    }
-    assertKnownFields(record, PUBLIC_JWK_FIELDS, "Curated trust-root JWK");
-    if (record.kty !== "RSA" ||
-        typeof record.n !== "string" ||
-        typeof record.e !== "string" ||
-        record.alg !== "RS256" ||
-        record.kid !== expectedKid) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys must be public RS256 RSA JWKs with matching kid.");
-    }
-    if (record.use !== undefined && record.use !== "sig") {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys must use sig.");
-    }
-    if (record.key_ops !== undefined &&
-        (!Array.isArray(record.key_ops) ||
-            record.key_ops.length === 0 ||
-            new Set(record.key_ops).size !== record.key_ops.length ||
-            record.key_ops.some((operation) => operation !== "verify"))) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root keys may only verify signatures.");
-    }
-    if (record.x5c !== undefined &&
-        (!Array.isArray(record.x5c) || record.x5c.some((certificate) => typeof certificate !== "string"))) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root x5c must be an array of strings.");
-    }
-    if ((record.x5t !== undefined && typeof record.x5t !== "string") ||
-        (record["x5t#S256"] !== undefined && typeof record["x5t#S256"] !== "string")) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", "Curated trust-root thumbprints must be strings.");
-    }
-}
-function containsPrivateJwkField(value) {
-    if (!value || typeof value !== "object") {
-        return false;
-    }
-    if (Array.isArray(value)) {
-        return value.some((item) => containsPrivateJwkField(item));
-    }
-    const record = value;
-    return ["d", "p", "q", "dp", "dq", "qi", "oth"].some((field) => Object.prototype.hasOwnProperty.call(record, field)) || Object.values(record).some((nested) => containsPrivateJwkField(nested));
-}
-function assertKnownFields(record, allowed, label) {
-    const unknown = Object.keys(record).find((key) => !allowed.has(key));
-    if (unknown) {
-        throw trustRootError("CURATED_TRUST_ROOT_INVALID", `${label} contains unknown field: ${unknown}`);
-    }
-}
-function trustRootError(code, message) {
-    return new CuratedTrustRootError(code, message);
-}

package/dist/attestation/platform-service.d.ts

@@ -1,70 +0,0 @@
-import { type JWK } from "jose";
-import type { AppPackageSigningKey } from "./app-package.js";
-/**
- * Trust contract for releasing the platform service (the Broker SPK) itself.
- * This is deliberately a separate issuer, typ and keyring from the curated App
- * chain: the Broker carries the curated trust root as *data*, so that root can
- * never double as the authority that signs the Broker's own releases.
- */
-export declare const PLATFORM_ATTESTATION_ISSUER = "synopkgland-platform";
-export declare const PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP = "platform-service-release-attestation";
-export declare const PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION: 1;
-export declare const PLATFORM_SERVICE_PACKAGE_IDENTITY = "SynoPkgLandService";
-export declare const PLATFORM_KEYRING_PURPOSE = "platform-service-release";
-export declare const PLATFORM_ATTESTATION_PRIVATE_JWK_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_PRIVATE_JWK";
-export declare const PLATFORM_ATTESTATION_KID_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KID";
-export declare const PLATFORM_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KEYRING_PATH";
-export type PlatformServiceReleaseErrorCode = "PLATFORM_KEYRING_INVALID" | "PLATFORM_KEYRING_PURPOSE_MISMATCH" | "PLATFORM_KEYRING_PRIVATE_MATERIAL" | "PLATFORM_KEYRING_NO_ACTIVE_KEY" | "PLATFORM_SIGNING_MATERIAL_MISSING" | "PLATFORM_SIGNING_MATERIAL_INVALID" | "PLATFORM_SIGNING_KEY_UNKNOWN" | "PLATFORM_ATTESTATION_INPUT_INVALID" | "PLATFORM_ATTESTATION_INVALID";
-export declare class PlatformServiceReleaseError extends Error {
-    readonly code: PlatformServiceReleaseErrorCode;
-    constructor(code: PlatformServiceReleaseErrorCode, detail?: string);
-}
-export interface PlatformServiceReleaseAttestationInput {
-    packageIdentity: string;
-    /** Source version without any Build suffix; the constants file keeps it. */
-    sourceVersion: string;
-    packageBuild: number;
-    /** `${sourceVersion}-<zero-padded Build>`; must agree with packageBuild. */
-    packageVersion: string;
-    /** SHA-256 of the final SPK bytes. */
-    artifactDigest: string;
-    /** Git commit the trusted workflow checked out and built. */
-    sourceRevision: string;
-    osMinVer: string;
-    arch: "noarch";
-}
-export interface PlatformServiceReleaseAttestationClaims extends PlatformServiceReleaseAttestationInput {
-    typ: typeof PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP;
-    version: typeof PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION;
-    issuedAt: string;
-}
-export type PlatformKeyStatus = "active" | "verify-only" | "revoked";
-export interface PlatformKeyringDocument {
-    version: 1;
-    purpose: typeof PLATFORM_KEYRING_PURPOSE;
-    keys: Array<{
-        kid: string;
-        status: PlatformKeyStatus;
-        publicJwk: JWK;
-    }>;
-}
-export interface PlatformAttestationSigner {
-    sign(input: PlatformServiceReleaseAttestationInput): Promise<{
-        token: string;
-        attestationDigest: string;
-        claims: PlatformServiceReleaseAttestationClaims;
-    }>;
-    verify(token: string): Promise<PlatformServiceReleaseAttestationClaims>;
-    verificationJwk: JWK;
-}
-export declare function parsePlatformKeyringDocument(raw: unknown): PlatformKeyringDocument;
-export declare function readPlatformKeyringFile(path: string): PlatformKeyringDocument;
-export declare function canonicalPlatformServiceReleaseClaims(claims: PlatformServiceReleaseAttestationClaims): string;
-export declare function digestPlatformServiceReleaseClaims(claims: PlatformServiceReleaseAttestationClaims): string;
-export declare function signPlatformServiceReleaseAttestationToken(input: PlatformServiceReleaseAttestationInput, key: AppPackageSigningKey): Promise<{
-    token: string;
-    attestationDigest: string;
-    claims: PlatformServiceReleaseAttestationClaims;
-}>;
-export declare function verifyPlatformServiceReleaseAttestationToken(token: string, keyring: PlatformKeyringDocument): Promise<PlatformServiceReleaseAttestationClaims>;
-export declare function createPlatformAttestationSignerFromEnv(env?: NodeJS.Dict<string>): Promise<PlatformAttestationSigner>;

package/dist/attestation/platform-service.js

@@ -1,250 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { SignJWT, importJWK, jwtVerify } from "jose";
-/**
- * Trust contract for releasing the platform service (the Broker SPK) itself.
- * This is deliberately a separate issuer, typ and keyring from the curated App
- * chain: the Broker carries the curated trust root as *data*, so that root can
- * never double as the authority that signs the Broker's own releases.
- */
-export const PLATFORM_ATTESTATION_ISSUER = "synopkgland-platform";
-export const PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP = "platform-service-release-attestation";
-export const PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION = 1;
-export const PLATFORM_SERVICE_PACKAGE_IDENTITY = "SynoPkgLandService";
-export const PLATFORM_KEYRING_PURPOSE = "platform-service-release";
-export const PLATFORM_ATTESTATION_PRIVATE_JWK_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_PRIVATE_JWK";
-export const PLATFORM_ATTESTATION_KID_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KID";
-export const PLATFORM_ATTESTATION_KEYRING_PATH_ENV = "SYNOPKGLAND_PLATFORM_ATTESTATION_KEYRING_PATH";
-export class PlatformServiceReleaseError extends Error {
-    code;
-    constructor(code, detail) {
-        super(detail ? `${code}: ${detail}` : code);
-        this.code = code;
-        this.name = "PlatformServiceReleaseError";
-    }
-}
-const PRIVATE_JWK_FIELDS = ["d", "p", "q", "dp", "dq", "qi", "oth", "k"];
-const KEY_STATUSES = new Set(["active", "verify-only", "revoked"]);
-export function parsePlatformKeyringDocument(raw) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "not an object");
-    }
-    const document = raw;
-    if (document.version !== 1 || !Array.isArray(document.keys)) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "unsupported document shape");
-    }
-    if (document.purpose !== PLATFORM_KEYRING_PURPOSE) {
-        // A curated keyring document has no purpose field at all; refusing here is
-        // what keeps the Broker's bundled trust root from signing the Broker.
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_PURPOSE_MISMATCH");
-    }
-    for (const entry of document.keys) {
-        if (!entry ||
-            typeof entry.kid !== "string" ||
-            entry.kid.length === 0 ||
-            !KEY_STATUSES.has(entry.status) ||
-            !entry.publicJwk ||
-            typeof entry.publicJwk !== "object") {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "invalid key entry");
-        }
-        if (PRIVATE_JWK_FIELDS.some((field) => field in entry.publicJwk)) {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_PRIVATE_MATERIAL");
-        }
-        if (entry.publicJwk.kty !== "RSA" || typeof entry.publicJwk.n !== "string") {
-            throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "not a public RSA key");
-        }
-    }
-    if (!document.keys.some((entry) => entry.status === "active")) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_NO_ACTIVE_KEY");
-    }
-    return document;
-}
-export function readPlatformKeyringFile(path) {
-    let raw;
-    try {
-        raw = readFileSync(path, "utf8");
-    }
-    catch (error) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", `unable to read keyring: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", "keyring is not valid JSON");
-    }
-    return parsePlatformKeyringDocument(parsed);
-}
-export function canonicalPlatformServiceReleaseClaims(claims) {
-    return JSON.stringify({
-        arch: claims.arch,
-        artifactDigest: claims.artifactDigest,
-        issuedAt: claims.issuedAt,
-        osMinVer: claims.osMinVer,
-        packageBuild: claims.packageBuild,
-        packageIdentity: claims.packageIdentity,
-        packageVersion: claims.packageVersion,
-        sourceRevision: claims.sourceRevision,
-        sourceVersion: claims.sourceVersion,
-        typ: claims.typ,
-        version: claims.version,
-    });
-}
-export function digestPlatformServiceReleaseClaims(claims) {
-    return createHash("sha256").update(canonicalPlatformServiceReleaseClaims(claims)).digest("hex");
-}
-export async function signPlatformServiceReleaseAttestationToken(input, key) {
-    assertPlatformInput(input);
-    if (typeof key.kid !== "string" || key.kid.length === 0) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID", "kid required");
-    }
-    const claims = {
-        typ: PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP,
-        version: PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION,
-        packageIdentity: input.packageIdentity,
-        sourceVersion: input.sourceVersion,
-        packageBuild: input.packageBuild,
-        packageVersion: input.packageVersion,
-        artifactDigest: input.artifactDigest,
-        sourceRevision: input.sourceRevision,
-        osMinVer: input.osMinVer,
-        arch: input.arch,
-        issuedAt: new Date().toISOString(),
-    };
-    const attestationDigest = digestPlatformServiceReleaseClaims(claims);
-    const token = await new SignJWT({ ...claims })
-        .setProtectedHeader({ alg: "RS256", kid: key.kid, typ: "JWT" })
-        .setIssuer(PLATFORM_ATTESTATION_ISSUER)
-        .setSubject(claims.packageIdentity)
-        .setJti(attestationDigest)
-        .sign(key.privateKey);
-    return { token, attestationDigest, claims };
-}
-export async function verifyPlatformServiceReleaseAttestationToken(token, keyring) {
-    parsePlatformKeyringDocument(keyring);
-    try {
-        const header = decodeHeader(token);
-        const entry = keyring.keys.find((candidate) => candidate.kid === header.kid && candidate.status !== "revoked");
-        if (!entry) {
-            throw new Error("unknown or revoked kid");
-        }
-        const publicKey = (await importJWK(entry.publicJwk, "RS256"));
-        const result = await jwtVerify(token, publicKey, {
-            algorithms: ["RS256"],
-            issuer: PLATFORM_ATTESTATION_ISSUER,
-        });
-        if (result.protectedHeader.alg !== "RS256" ||
-            result.protectedHeader.typ !== "JWT" ||
-            result.protectedHeader.kid !== entry.kid) {
-            throw new Error("token header mismatch");
-        }
-        const payload = result.payload;
-        if (payload.typ !== PLATFORM_SERVICE_RELEASE_ATTESTATION_TYP ||
-            payload.version !== PLATFORM_SERVICE_RELEASE_ATTESTATION_VERSION) {
-            throw new Error("token typ mismatch");
-        }
-        const claims = {
-            typ: payload.typ,
-            version: payload.version,
-            packageIdentity: payload.packageIdentity,
-            sourceVersion: payload.sourceVersion,
-            packageBuild: payload.packageBuild,
-            packageVersion: payload.packageVersion,
-            artifactDigest: payload.artifactDigest,
-            sourceRevision: payload.sourceRevision,
-            osMinVer: payload.osMinVer,
-            arch: payload.arch,
-            issuedAt: payload.issuedAt,
-        };
-        assertPlatformInput(claims);
-        if (typeof claims.issuedAt !== "string" || Number.isNaN(Date.parse(claims.issuedAt))) {
-            throw new Error("issuedAt is not a timestamp");
-        }
-        if (result.payload.jti !== digestPlatformServiceReleaseClaims(claims)) {
-            throw new Error("jti does not bind the claims");
-        }
-        return claims;
-    }
-    catch (error) {
-        if (error instanceof PlatformServiceReleaseError) {
-            throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", error.message);
-        }
-        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", error instanceof Error ? error.message : String(error));
-    }
-}
-export async function createPlatformAttestationSignerFromEnv(env = process.env) {
-    const jwkRaw = env[PLATFORM_ATTESTATION_PRIVATE_JWK_ENV]?.trim();
-    const kidFromEnv = env[PLATFORM_ATTESTATION_KID_ENV]?.trim();
-    const keyringPath = env[PLATFORM_ATTESTATION_KEYRING_PATH_ENV]?.trim();
-    if (!jwkRaw) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_MISSING");
-    }
-    if (!keyringPath) {
-        throw new PlatformServiceReleaseError("PLATFORM_KEYRING_INVALID", `${PLATFORM_ATTESTATION_KEYRING_PATH_ENV} is required`);
-    }
-    const keyring = readPlatformKeyringFile(keyringPath);
-    let privateJwk;
-    let privateKey;
-    try {
-        privateJwk = JSON.parse(jwkRaw);
-        privateKey = (await importJWK(privateJwk, "RS256"));
-    }
-    catch {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID");
-    }
-    const kid = kidFromEnv || (typeof privateJwk.kid === "string" ? privateJwk.kid : "");
-    if (!kid) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_MATERIAL_INVALID", "kid required");
-    }
-    const trustEntry = keyring.keys.find((entry) => entry.kid === kid && entry.status === "active");
-    if (!trustEntry) {
-        throw new PlatformServiceReleaseError("PLATFORM_SIGNING_KEY_UNKNOWN");
-    }
-    const signingKey = { kid, privateKey };
-    return {
-        sign: (input) => signPlatformServiceReleaseAttestationToken(input, signingKey),
-        verify: (token) => verifyPlatformServiceReleaseAttestationToken(token, keyring),
-        verificationJwk: trustEntry.publicJwk,
-    };
-}
-function assertPlatformInput(input) {
-    const fail = (detail) => {
-        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INPUT_INVALID", detail);
-    };
-    if (input.packageIdentity !== PLATFORM_SERVICE_PACKAGE_IDENTITY) {
-        fail("packageIdentity must be the platform service identity");
-    }
-    if (!/^\d+\.\d+\.\d+$/.test(input.sourceVersion)) {
-        fail("sourceVersion must be plain semver without a Build suffix");
-    }
-    if (!Number.isSafeInteger(input.packageBuild) || input.packageBuild < 1) {
-        fail("packageBuild must be a positive safe integer");
-    }
-    if (input.packageVersion !== `${input.sourceVersion}-${String(input.packageBuild).padStart(4, "0")}`) {
-        fail("packageVersion must be sourceVersion plus the zero-padded Build");
-    }
-    if (!/^[a-f0-9]{64}$/.test(input.artifactDigest)) {
-        fail("artifactDigest must be a lowercase SHA-256 digest");
-    }
-    if (!/^[a-f0-9]{40}$/.test(input.sourceRevision)) {
-        fail("sourceRevision must be a full git commit SHA");
-    }
-    if (!/^\d+\.\d+-\d+$/.test(input.osMinVer)) {
-        fail("osMinVer must look like 7.2-69057");
-    }
-    if (input.arch !== "noarch") {
-        fail("the platform service is noarch");
-    }
-}
-function decodeHeader(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
-        throw new Error("not a compact JWT");
-    }
-    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-    if (!header || typeof header !== "object" || Array.isArray(header)) {
-        throw new Error("invalid JWT header");
-    }
-    return header;
-}

package/dist/build-spk/broker-glue.d.ts

@@ -1,16 +0,0 @@
-/**
- * The Broker installer glue every Managed Profile App carries, independent of
- * runtime. Compose and native Apps install through the same socket, so the
- * Local Attestation gate and the registration-status probe live here once.
- */
-/** Shell variable preamble locating the Broker installer and its socket. */
-export declare const BROKER_INSTALLER_VARS = "INSTALLER=\"${BROKER_INSTALLER:-/var/packages/SynoPkgLandService/target/bin/synopkgland-installer}\"\nSOCKET=\"${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}\"";
-/**
- * The `status` probe: asks the Broker whether this App is still registered.
- * `removed` exits 150 so DSM shows the App as removed by the platform;
- * `unknown` exits 4. Anything else falls through to the caller, which decides
- * what "running" means for its runtime.
- */
-export declare function renderBrokerStatusProbe(packageIdentity: string): string;
-/** `preinst` / `preupgrade`: refuse to install when the Broker socket is absent. */
-export declare const BROKER_SOCKET_REQUIRED_SCRIPT = "#!/bin/sh\nSOCKET=\"${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}\"\nif [ ! -S \"$SOCKET\" ]; then\n  echo \"SynoPkgLandService installer socket is not available\" >&2\n  exit 1\nfi\nexit 0\n";

package/dist/build-spk/broker-glue.js

@@ -1,40 +0,0 @@
-/**
- * The Broker installer glue every Managed Profile App carries, independent of
- * runtime. Compose and native Apps install through the same socket, so the
- * Local Attestation gate and the registration-status probe live here once.
- */
-/** Shell variable preamble locating the Broker installer and its socket. */
-export const BROKER_INSTALLER_VARS = `INSTALLER="\${BROKER_INSTALLER:-/var/packages/SynoPkgLandService/target/bin/synopkgland-installer}"
-SOCKET="\${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}"`;
-/**
- * The `status` probe: asks the Broker whether this App is still registered.
- * `removed` exits 150 so DSM shows the App as removed by the platform;
- * `unknown` exits 4. Anything else falls through to the caller, which decides
- * what "running" means for its runtime.
- */
-export function renderBrokerStatusProbe(packageIdentity) {
-    return `    if [ -x "$INSTALLER" ] && [ -S "$SOCKET" ]; then
-      "$INSTALLER" --socket "$SOCKET" --phase status --attempt-id "status-$$" \\
-        --package-identity "${packageIdentity}" --package-version "\${SYNOPKG_PKGVER}" \\
-        --package-path "\${SYNOPKG_PKGDEST}" --bundle-path "\${SYNOPKG_PKGDEST}" \\
-        --pkg-var "\${SYNOPKG_PKGVAR}" --pkg-home "\${SYNOPKG_PKGHOME}" >/tmp/synopkgland-status.$$ 2>/dev/null || true
-      if grep -q '"registrationStatus":"removed"' /tmp/synopkgland-status.$$ 2>/dev/null; then
-        rm -f /tmp/synopkgland-status.$$
-        exit 150
-      fi
-      if grep -q '"registrationStatus":"unknown"' /tmp/synopkgland-status.$$ 2>/dev/null; then
-        rm -f /tmp/synopkgland-status.$$
-        exit 4
-      fi
-      rm -f /tmp/synopkgland-status.$$
-    fi`;
-}
-/** `preinst` / `preupgrade`: refuse to install when the Broker socket is absent. */
-export const BROKER_SOCKET_REQUIRED_SCRIPT = `#!/bin/sh
-SOCKET="\${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}"
-if [ ! -S "$SOCKET" ]; then
-  echo "SynoPkgLandService installer socket is not available" >&2
-  exit 1
-fi
-exit 0
-`;

package/dist/deploy/catalog-publish.d.ts

@@ -1,3 +0,0 @@
-import { type PublishSpkResult } from "@synopackageland/package-source/publish-spk";
-export declare function publishBuiltSpk(spkPath: string): Promise<PublishSpkResult>;
-export declare function packageSourceOrigin(): string;

package/dist/deploy/catalog-publish.js

@@ -1,7 +0,0 @@
-import { publishSpkToSource, resolvePublishTarget, } from "@synopackageland/package-source/publish-spk";
-export async function publishBuiltSpk(spkPath) {
-    return publishSpkToSource(spkPath, resolvePublishTarget());
-}
-export function packageSourceOrigin() {
-    return resolvePublishTarget().origin;
-}

package/dist/doctor.d.ts

@@ -1,22 +0,0 @@
-import type { ProjectRoot } from "./discovery.js";
-import type { NasHost } from "./host/types.js";
-export type DoctorCheckStatus = "pass" | "fail" | "skip" | "warn";
-export interface DoctorCheck {
-    id: string;
-    status: DoctorCheckStatus;
-    code?: string;
-    message: string;
-    suggestion?: string;
-}
-export interface DoctorReport {
-    ok: boolean;
-    checks: DoctorCheck[];
-}
-export interface RunDoctorOptions {
-    project?: ProjectRoot | null;
-    host?: NasHost | null;
-    packageId?: string;
-    dev?: boolean;
-}
-export declare function runDoctor(options: RunDoctorOptions): Promise<DoctorReport>;
-export declare function formatDoctorReport(report: DoctorReport): string;