@synopackageland/cli 0.3.10 → 0.4.1

package/dist/build-spk/native-lifecycle.js

@@ -1,5 +1,4 @@
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
-import { BROKER_INSTALLER_VARS, renderBrokerStatusProbe, } from "./broker-glue.js";
 /**
  * Escapes a literal string for safe inclusion in POSIX `/bin/sh` single quotes.
  * A single quote is represented as `'\''` (close single quote, literal escaped single quote, reopen single quote).
@@ -69,7 +68,6 @@ export function renderNativeStartStopStatus(input) {
     const envBlock = envLines.length > 0 ? `\n${envLines.join("\n")}` : "";
     const commandLine = [execToken, ...argTokens].join(" ");
     return `#!/bin/sh
-${BROKER_INSTALLER_VARS}
 PKGDEST="${pkgDestFallback}"
 PKGVAR="${pkgVarFallback}"
 PIDFILE="$PKGVAR/${pkg}.pid"
@@ -129,7 +127,6 @@ case "$1" in
     exit 0
     ;;
   status)
-${renderBrokerStatusProbe(pkg)}
     if pid_alive; then
       exit 0
     fi

package/dist/build-spk/native-payload.js

@@ -27,7 +27,6 @@ export async function materializeNativePayload(options) {
         // The payload root IS SYNOPKG_PKGDEST (/var/packages/<pkg>/target): DSM
         // extracts package.tgz straight into it. Nesting a literal `target/`
         // directory here would put the binary at $SYNOPKG_PKGDEST/target/<exec>.
-        // Same layout the Broker SPK ships (packages/broker/src/spk/build.ts).
         if (kind === "raw") {
             materializeRaw(sourceBytes, targetDir, rawSourceName(sourceName));
         }

package/dist/build-spk/notices.d.ts

@@ -0,0 +1,5 @@
+/** Copy legal text only; never follow a project-supplied symlink. */
+export declare function copyNoticeTree(source: string, target: string): void;
+/** Fixed payload location, independent of app code/binary paths. */
+export declare function copyProjectNotices(root: string, payload: string): void;
+export declare function copyStandaloneNotices(root: string, uiDir: string, payload: string, go: boolean, helper: boolean, identity: boolean, goDir?: string): void;

package/dist/build-spk/notices.js

@@ -0,0 +1,60 @@
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+/** Copy legal text only; never follow a project-supplied symlink. */
+export function copyNoticeTree(source, target) {
+    const stat = lstatSync(source);
+    if (stat.isSymbolicLink())
+        throw new Error(`[NOTICE_UNSAFE] Symlink in notice tree: ${source}`);
+    if (stat.isDirectory()) {
+        mkdirSync(target, { recursive: true });
+        for (const name of readdirSync(source).sort())
+            copyNoticeTree(join(source, name), join(target, name));
+    }
+    else if (stat.isFile() && stat.size <= 8 * 1024 * 1024) {
+        mkdirSync(dirname(target), { recursive: true });
+        copyFileSync(source, target);
+    }
+    else
+        throw new Error(`[NOTICE_UNSAFE] Notice must be a bounded regular file: ${source}`);
+}
+/** Fixed payload location, independent of app code/binary paths. */
+export function copyProjectNotices(root, payload) {
+    const dest = join(payload, 'LICENSES');
+    if (existsSync(join(root, 'LICENSES')))
+        copyNoticeTree(join(root, 'LICENSES'), dest);
+    if (existsSync(join(root, 'LICENSE')))
+        copyNoticeTree(join(root, 'LICENSE'), join(dest, 'APP.txt'));
+}
+export function copyStandaloneNotices(root, uiDir, payload, go, helper, identity, goDir = join(root, 'backend')) {
+    copyProjectNotices(root, payload);
+    const dest = join(payload, 'LICENSES');
+    const shared = new URL('../../templates/_shared/', import.meta.url);
+    if (go || helper) {
+        mkdirSync(dest, { recursive: true });
+        for (const name of ['GO-LICENSE', 'GO-PATENTS'])
+            copyFileSync(new URL(name, shared), join(dest, name));
+        if (existsSync(join(goDir, 'THIRD_PARTY_NOTICES.txt')))
+            copyNoticeTree(join(goDir, 'THIRD_PARTY_NOTICES.txt'), join(dest, 'GO-THIRD_PARTY_NOTICES.txt'));
+    }
+    if (helper)
+        copyFileSync(new URL('../../templates/native-go/backend/THIRD_PARTY_NOTICES.txt', import.meta.url), join(dest, 'HELPER-THIRD_PARTY_NOTICES.txt'));
+    const frontend = join(root, 'frontend/package.json');
+    const usesUi = existsSync(frontend) && Boolean(JSON.parse(readFileSync(frontend, 'utf8')).dependencies?.['@synopackageland/ui']);
+    if (usesUi) {
+        for (const name of ['UI-LICENSE', 'UI-THIRD_PARTY.md', 'THIRD_PARTY_NOTICES.txt', 'inventory.json']) {
+            const source = join(uiDir, 'LICENSES', name);
+            if (!existsSync(source))
+                throw new Error(`[NOTICE_MISSING] UI notice missing: ${source}; rebuild frontend`);
+        }
+    }
+    if (existsSync(join(uiDir, 'LICENSES')))
+        copyNoticeTree(join(uiDir, 'LICENSES'), join(dest, 'ui'));
+    if (identity) {
+        const source = join(root, 'node/dist/LICENSES');
+        for (const name of ['THIRD_PARTY_NOTICES.txt', 'inventory.json']) {
+            if (!existsSync(join(source, name)))
+                throw new Error(`[NOTICE_MISSING] Better Auth notice missing: ${name}; rebuild node bundle`);
+        }
+        copyNoticeTree(source, join(dest, 'better-auth'));
+    }
+}

package/dist/cli.js

@@ -1,4 +1,6 @@
+import { planDeployment, deployStandalone } from "./deploy/plan.js";
 import { Command } from "commander";
+import { readFileSync, renameSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { findProjectRoot } from "./discovery.js";
 import { loadContract } from "./contract/load.js";
@@ -14,13 +16,13 @@ import { deployProject } from "./deploy/deploy.js";
 import { createNasHost } from "./host/dsm-client.js";
 import { projectInfo, formatProjectInfo } from "./info.js";
 import { followProjectLogs } from "./log.js";
-import { testProjectOnHost } from "./test-host.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
-import { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
-import { formatPreflight, runPublicReleasePreflight } from "./publish/preflight.js";
-import { createExecGitHubCli, createExecGitOps } from "./publish/github-pr.js";
-import { communityAppsGitHubRepo } from "./publish/github-repo.js";
 import { resolveInstallParameterExtraValues } from "./deploy/param-values.js";
+import { findStandaloneRoot, loadStandaloneManifest } from "./standalone/manifest.js";
+import { buildStandalone } from "./standalone/build.js";
+import { inspectSpk } from "./standalone/inspect-spk.js";
+import { templatesRoot } from "./template-paths.js";
+import { join } from "node:path";
 function collectKvOption(value, previous, flag, example) {
     const separator = value.indexOf("=");
     if (separator <= 0) {
@@ -44,6 +46,27 @@ function resolveProject(cwd, project) {
     const start = project ? resolve(cwd, project) : cwd;
     return findProjectRoot(start);
 }
+function standaloneRoot(cwd, project) {
+    return findStandaloneRoot(project ? resolve(cwd, project) : cwd);
+}
+function formatSpkInspection(spk, report) {
+    const lines = [
+        `SPK：${spk}`,
+        `package：${report.package ?? "?"}  version：${report.version ?? "?"}`,
+        `arch：${report.arch ?? "?"}  runtime：${report.kind ?? "?"}`,
+        `簽署：${report.signed ? "有 Synology 簽章" : "未簽署（Package Center 需允許任何發行者）"}`,
+        `CGI：${report.cgi ?? "無"}`,
+        ...(report.integration ? [`integration protocol：${report.integration.protocol}；NAS data mode：${report.integration.dataAccess}；policy：${report.integration.dataAccess === "relaxed" ? "UID + username" : "unavailable"}；inspect 只核對產物，不證明 runtime adapters／DSM 認證`] : []),
+        "payload：",
+        ...report.payload.map((entry) => `  ${entry.mode} ${entry.path}`),
+    ];
+    const integration = report.payload.some(entry => entry.path === "integration/helper");
+    lines.push(report.findings.length === 0
+        ? integration ? "檢查：安裝以套件帳號執行；執行期整合另需管理員核准，此檢查不證明 integration ready。" : "檢查：沒有 root 權限需求或異常。"
+        : "問題：");
+    lines.push(...report.findings.map((finding) => `  - ${finding}`));
+    return lines.join("\n");
+}
 function requireProject(cwd, project) {
     const found = resolveProject(cwd, project);
     if (!found) {
@@ -52,6 +75,30 @@ function requireProject(cwd, project) {
     }
     return found;
 }
+async function buildStandaloneCommand(root, arch, options) {
+    if (options.output && !arch) {
+        console.error("-o 只能搭配 --arch 建置單一架構；多架構請用 --out-dir。");
+        process.exit(1);
+    }
+    const outDir = options.output
+        ? dirname(resolve(process.cwd(), options.output))
+        : options.outDir ? resolve(process.cwd(), options.outDir) : undefined;
+    try {
+        const { outputs } = await buildStandalone({ root, arches: arch ? [arch] : undefined, outDir });
+        for (let output of outputs) {
+            if (options.output) {
+                const target = resolve(process.cwd(), options.output);
+                renameSync(output, target);
+                output = target;
+            }
+            console.log(`已產生 ${output}`);
+        }
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+}
 export async function runCli(argv) {
     const program = new Command();
     program
@@ -59,51 +106,20 @@ export async function runCli(argv) {
         .description("Syno Package Land Developer Kit CLI")
         .option("--project <dir>", "App 專案根目錄");
     program
-        .command("doctor")
-        .description("唯讀診斷本機合約／Compose 與 NAS 部署狀態")
-        .option("--host <name>", "synoagentcli profile 或 NAS 名稱")
-        .option("--package <id>", "指定診斷的 Package Identity（省略時由合約判定）")
-        .option("--dev", "診斷 Development Package Identity（{package}.dev）")
-        .option("--json", "輸出 machine-readable JSON 診斷報告")
-        .action(async (options, command) => {
+        .command("validate")
+        .description("驗證 App Contract 與 Compose，或 Standalone Package 的 dsm-package.yaml")
+        .action((_options, command) => {
         const global = command.parent?.opts() ?? {};
-        const project = resolveProject(process.cwd(), global.project);
-        let host = null;
-        if (options.host) {
-            host = createNasHost({ host: options.host });
-            if (!host) {
-                console.error(`[${"HOST_CREDENTIALS_MISSING"}] 找不到 NAS 憑證。請設定 synoagentcli profile 或 DSM_URL／DSM_PASSWORD。`);
+        const standalone = standaloneRoot(process.cwd(), global.project);
+        if (standalone) {
+            const loaded = loadStandaloneManifest(standalone);
+            if (!loaded.ok) {
+                console.error(loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"));
                 process.exit(1);
             }
+            console.log("驗證通過。");
+            return;
         }
-        try {
-            const { runDoctor, formatDoctorReport } = await import("./doctor.js");
-            const report = await runDoctor({
-                project,
-                host,
-                packageId: options.package,
-                dev: options.dev,
-            });
-            if (options.json) {
-                console.log(JSON.stringify(report, null, 2));
-            }
-            else {
-                console.log(formatDoctorReport(report));
-            }
-            if (!report.ok) {
-                process.exit(1);
-            }
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    });
-    program
-        .command("validate")
-        .description("驗證 App Contract 與 Compose")
-        .action((options, command) => {
-        const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
         const result = validateProject(project, {
             profile: "personal",
@@ -119,19 +135,57 @@ export async function runCli(argv) {
     });
     program
         .command("inspect")
-        .description("檢視 Compose 意圖與 Web entry 提示")
-        .action((_options, command) => {
+        .description("檢視 Compose 意圖與 Web entry 提示；--spk 檢查已產生的 SPK")
+        .option("--spk <file>", "不安裝，檢查 SPK 的 identity、檔案 mode 與 root 權限需求")
+        .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
+        if (options.spk) {
+            const spk = resolve(process.cwd(), options.spk);
+            try {
+                const report = await inspectSpk(spk);
+                console.log(formatSpkInspection(spk, report));
+                if (report.findings.length > 0) {
+                    process.exit(1);
+                }
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : String(error));
+                process.exit(1);
+            }
+            return;
+        }
         const project = requireProject(process.cwd(), global.project);
         const report = inspectProject(project);
         console.log(formatInspectReport(report));
     });
     program
         .command("init")
-        .description("從模板建立 App 專案")
+        .description("從模板建立 App 專案（不覆蓋既有檔案）")
         .option("-t, --template <name>", `模板：${listTemplates().join(" | ")}`)
-        .option("--native", "建立 Native Prebuilt Binary App 專案")
+        .option("--binary", "建立 Binary App：以套件自己的帳號執行預先建置的 binary（等同 -t binary）")
+        .option("--package <id>", "native-go：INFO.package（預設由目錄名產生，例如 photo-tagger → PhotoTagger）")
+        .option("--name <display>", "native-go：顯示名稱（預設由目錄名產生）")
+        .option("--privilege <none|root>", "native-go：root 另加由 DSM 管理員在套件視窗核准的 root 操作（預設 none）")
+        .option("--ui <plain|vue>", `native-go：沿用 UI ${JSON.parse(readFileSync(join(templatesRoot(), "native-go-vue/frontend/package.json"), "utf8")).dependencies["@synopackageland/ui"]} 的 Vue 介面（預設 plain）`)
+        .option("--integration <go|better-auth>", "native-go --ui vue：每包 helper 與私有範例；better-auth 才加入 Node")
+        .option("--integration-protocol <1|2>", "helper inventory protocol（預設 1）；2 可選 NAS data policy，缺已認證 adapters 仍拒絕")
+        .option("--data-access <unavailable|relaxed>", "protocol 2 build-time 身分模式（預設 unavailable）；relaxed 不繞過 DSM／App／lifecycle gates")
         .argument("[dir]", "目標目錄", ".")
+        .addHelpText("after", `
+模板分兩類：
+  獨立 Container / Binary App（synology-app.yaml）：
+    容器（compose.yaml）：hello-web、hello-web-page、hello-files、compose-import
+    binary（native.yaml）：執行一個預先建置的 binary 服務；可用 adminport 在自己的 port 提供網頁
+  Standalone Package（未簽署原生 SPK，含 Go CGI 與 DSM 視窗，dsm-package.yaml）：
+    native-go：Go CGI backend + DSM 視窗 UI，預設需登入、admin 動作另外宣告。
+      --privilege root：另加固定的 root 操作（root/<名稱>.sh），由 DSM 管理員在套件視窗
+      以密碼核准後才能執行；預設 none，完全不用 root。
+
+快速開始（native-go，需要 Go 1.24+）：
+  synopkgland init -t native-go my-app
+  cd my-app && $EDITOR backend/internal/app/routes.go ui/app.js
+  synopkgland build-spk          # → dist/<Package>-<version>-<arch>.spk
+  synopkgland inspect --spk dist/<file>.spk`)
         .action(async (dir, options, command) => {
         const global = command.parent?.opts() ?? {};
         if (global.project) {
@@ -139,27 +193,47 @@ export async function runCli(argv) {
             process.exit(1);
         }
         const targetDir = resolve(process.cwd(), dir);
-        if (options.native) {
-            initFromTemplate("native", targetDir);
-            console.log(`已建立 native 專案於 ${targetDir}`);
-            return;
+        const template = options.binary ? "binary" : options.template;
+        if (!template) {
+            console.error(`請指定 -t, --template <name> 或 --binary。可選模板：${listTemplates().join(" | ")}`);
+            process.exit(1);
         }
-        if (!options.template) {
-            console.error(`請指定 -t, --template <name> 或 --native。可選模板：${listTemplates().join(" | ")}`);
+        if (!isTemplateName(template)) {
+            console.error(`未知模板：${template}`);
             process.exit(1);
         }
-        if (!isTemplateName(options.template)) {
-            console.error(`未知模板：${options.template}`);
+        if ((options.package || options.name || options.privilege) && template !== "native-go") {
+            console.error("--package／--name／--privilege 只適用於 -t native-go。");
             process.exit(1);
         }
-        initFromTemplate(options.template, targetDir);
-        console.log(`已建立 ${options.template} 專案於 ${targetDir}`);
+        try {
+            initFromTemplate(template, targetDir, {
+                packageId: options.package,
+                displayName: options.name,
+                privilege: options.privilege,
+                ui: options.ui,
+                integration: options.integration,
+                integrationProtocol: options.integrationProtocol === undefined ? undefined : (["1", "2"].includes(options.integrationProtocol) ? Number(options.integrationProtocol) : NaN),
+                dataAccess: options.dataAccess,
+            });
+        }
+        catch (error) {
+            console.error(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+        console.log(`已建立 ${template} 專案於 ${targetDir}`);
+        if (template === "native-go") {
+            console.log(`下一步：
+  cd ${dir}
+  (cd backend && go test ./...)   # 認證與權限政策測試
+  synopkgland build-spk           # 編譯 Go + 打包每個架構的未簽署 SPK
+說明見 README.md。`);
+        }
     });
     program
         .command("dev")
-        .description("啟動本機 mock Broker 與 Compose")
-        .option("--files-root <dir>", "將本機目錄對應為 NAS Logical Path")
-        .action(async (options, command) => {
+        .description("啟動 App 自己的本機 Compose")
+        .action(async (_options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
         const validation = validateProject(project);
@@ -170,10 +244,7 @@ export async function runCli(argv) {
         try {
             const handle = await runDev({
                 project,
-                filesRoot: options.filesRoot,
             });
-            console.log(`Mock Broker：${handle.brokerBaseUrl}`);
-            console.log(`Bootstrap：${handle.bootstrapPath}`);
             console.log("Compose 已就緒。按 Ctrl+C 結束。");
             const shutdown = async () => {
                 await handle.close();
@@ -191,31 +262,9 @@ export async function runCli(argv) {
     program
         .command("test")
         .description("驗證契約並等待 Compose 就緒")
-        .option("--host <name>", "在已部署的 NAS 上執行 Open smoke")
-        .option("--dev", "檢查 Development Package Identity（{package}.dev）")
-        .action(async (options, command) => {
+        .action(async (_options, command) => {
         const global = command.parent?.opts() ?? {};
         const project = requireProject(process.cwd(), global.project);
-        if (options.host) {
-            const host = createNasHost({ host: options.host });
-            if (!host) {
-                console.error("找不到 NAS 憑證。請設定 synoagentcli profile 或 DSM_URL／DSM_PASSWORD。");
-                process.exit(1);
-            }
-            try {
-                const result = await testProjectOnHost({ project, host, dev: options.dev });
-                if (!result.ok) {
-                    console.error(result.message ?? "測試失敗。");
-                    process.exit(1);
-                }
-                console.log("NAS smoke 測試通過。");
-            }
-            catch (error) {
-                console.error(error instanceof Error ? error.message : String(error));
-                process.exit(1);
-            }
-            return;
-        }
         try {
             const result = await testProject({ project });
             if (!result.ok) {
@@ -231,16 +280,40 @@ export async function runCli(argv) {
     });
     program
         .command("deploy")
-        .description("Inner Loop Deploy 到 NAS（產生 SPK、簽發 Local Attestation、安裝）")
-        .requiredOption("--host <name>", "synoagentcli profile 或 NAS 名稱")
+        .description("建置獨立 SPK 並直接安裝到 DSM")
+        .option("--host <name>", "synoagentcli profile 或 NAS 名稱")
         .option("--arch <family>", "native App 的目標架構：x86_64 或 aarch64（省略時由 NAS 判定）")
         .option("--dev", "部署到 Development Package Identity（{package}.dev）")
-        .option("--replace-curated", "危險：將既有 Curated App Package Attestation 降級為 Local Attestation")
         .option("--share <slot=name>", "此 NAS 上的 Shared Folder 邏輯名（契約 shared_folder 槽，可重複）", collectShareOption)
         .option("--run-as <slot=name>", "此 NAS 上的 DSM 使用者邏輯名（契約 dsm_user 槽）", collectRunAsOption)
         .option("--param <NAME=value>", "契約 string/boolean Install Parameter 答案（可重複）", collectParamOption)
+        .option("--dry-run", "只輸出本機部署計畫，不連接 NAS")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
+        if (options.arch !== undefined && !isNativeArchFamily(String(options.arch))) {
+            throw new Error('--arch accepts x86_64 or aarch64');
+        }
+        const plan = planDeployment(resolve(process.cwd(), global.project ?? '.'), {
+            arch: options.arch, dev: options.dev,
+        });
+        if (options.dryRun) {
+            console.log(JSON.stringify(plan, null, 2));
+            return;
+        }
+        if (!options.host)
+            throw new Error('deploy requires --host, or use --dry-run');
+        if (plan.kind === 'native-go') {
+            if (options.share || options.runAs || options.param)
+                throw new Error('native-go does not accept container install parameters');
+            const host = createNasHost({ host: options.host });
+            if (!host)
+                throw new Error('NAS credentials not found');
+            const output = await deployStandalone(plan, host);
+            console.log(`已部署 ${plan.packageId}: ${output}`);
+            for (const note of plan.notes)
+                console.log(note);
+            return;
+        }
         const project = requireProject(process.cwd(), global.project);
         const parameterCheck = resolveInstallParameterExtraValues({
             contract: loadContract(project.contractPath).contract,
@@ -265,7 +338,6 @@ export async function runCli(argv) {
                 project,
                 host,
                 dev: options.dev,
-                replaceCurated: options.replaceCurated,
                 shareValues: options.share,
                 runAsValues: options.runAs,
                 paramValues: options.param,
@@ -289,7 +361,7 @@ export async function runCli(argv) {
     });
     program
         .command("info")
-        .description("顯示 NAS 上的 attestation、Open URL 與 readiness")
+        .description("顯示 DSM 套件狀態與 Open URL")
         .requiredOption("--host <name>", "synoagentcli profile 或 NAS 名稱")
         .option("--dev", "查詢 Development Package Identity")
         .action(async (options, command) => {
@@ -369,20 +441,27 @@ export async function runCli(argv) {
     });
     program
         .command("build-spk")
-        .description("產生本機 thin SPK（未簽署）")
-        .option("-o, --output <path>", "輸出 .spk 路徑")
-        .option("--arch <family>", "native App 的目標架構：x86_64 或 aarch64（Compose App 不需要）")
+        .description("產生本機未簽署 SPK：容器 App（synology-app.yaml）或 Standalone Package（dsm-package.yaml，會先編譯 UI 與 Go）")
+        .option("-o, --output <path>", "輸出 .spk 路徑（Standalone Package 只在建置單一架構時可用）")
+        .option("--out-dir <dir>", "Standalone Package：輸出目錄（預設 dist/）")
+        .option("--arch <family>", "目標架構：x86_64 或 aarch64（native App 必填；Standalone Package 預設建置 arches 全部）")
         .action(async (options, command) => {
         const global = command.parent?.opts() ?? {};
-        const project = requireProject(process.cwd(), global.project);
         if (options.arch !== undefined && !isNativeArchFamily(String(options.arch))) {
             console.error(`--arch 只接受 x86_64 或 aarch64，收到 ${String(options.arch)}。`);
             process.exit(1);
         }
+        const archFamily = options.arch ? String(options.arch) : undefined;
+        const standalone = standaloneRoot(process.cwd(), global.project);
+        if (standalone) {
+            await buildStandaloneCommand(standalone, archFamily, options);
+            return;
+        }
+        const project = requireProject(process.cwd(), global.project);
         const result = await buildSpk({
             project,
             outputPath: options.output ? resolve(process.cwd(), options.output) : undefined,
-            archFamily: options.arch ? String(options.arch) : undefined,
+            archFamily,
         });
         if (!result.ok) {
             console.error(`建置失敗：${result.errors.join(", ")}`);
@@ -390,57 +469,5 @@ export async function runCli(argv) {
         }
         console.log(`已產生 ${result.outputPath}`);
     });
-    program
-        .command("public-release-submit")
-        .description("送審公開發佈：先跑完本機所有 Curated 檢查，通過才對 Community Apps 建立 Pull Request。"
-        + "不上傳 SPK、不簽署、不發佈——實際發佈由 maintainer 合併後的 trusted CI 執行。")
-        .option("--check", "只跑本機檢查，不建立 Pull Request")
-        .option("--base <branch>", "PR 目標分支", "master")
-        .action(async (options, command) => {
-        const global = command.parent?.opts() ?? {};
-        const project = requireProject(process.cwd(), global.project);
-        const preflight = await runPublicReleasePreflight(project);
-        if (!preflight.ok) {
-            // A gate's reasons belong on stderr so CI logs and `2>` capture them.
-            console.error(formatPreflight(preflight));
-            console.error("\n本機檢查未通過，未建立 Pull Request。");
-            process.exit(1);
-        }
-        console.log(formatPreflight(preflight));
-        if (options.check) {
-            console.log("\n本機檢查全部通過。加上 --check 以外的執行才會送審。");
-            return;
-        }
-        const communityAppsRoot = resolveCommunityAppsRoot(project.root);
-        if (!communityAppsRoot) {
-            console.error("送審需要 Community Apps 定義倉庫的本機副本。請先取得它，再從你的 App 專案目錄重跑：\n"
-                + "  git clone https://github.com/synopackageland/synopkgland-community-apps.git\n"
-                + "  export SYNOPKGLAND_COMMUNITY_APPS_ROOT=$PWD/synopkgland-community-apps");
-            process.exit(1);
-        }
-        const repoRoot = dirname(communityAppsRoot);
-        try {
-            const result = await publishProject({
-                project,
-                communityAppsRoot,
-                baseBranch: options.base,
-                github: createExecGitHubCli(repoRoot, communityAppsGitHubRepo()),
-                git: createExecGitOps(repoRoot),
-            });
-            if (!result.ok) {
-                console.error(result.message ?? result.code ?? "publish 失敗。");
-                process.exit(1);
-            }
-            if (result.noChanges) {
-                console.log(result.message ?? "Community Apps 定義已是最新。");
-                return;
-            }
-            console.log(`已建立 PR：${result.prUrl}`);
-        }
-        catch (error) {
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    });
     await program.parseAsync(argv);
 }

package/dist/compose/analyze.d.ts

@@ -28,7 +28,7 @@ export interface ResourceWorkerEligibility {
  * - any non-headless App without a unique literal published adminport status probe
  */
 export declare function resourceWorkerEligibility(contract: AppContract, compose: ComposeDocument): ResourceWorkerEligibility;
-export type ComposeRoute = "static-zero-config" | "dynamic" | "broker-installer" | "reject";
+export type ComposeRoute = "static-zero-config" | "dynamic" | "reject";
 export interface ComposeRouteClassification {
     route: ComposeRoute;
     eligibility: ResourceWorkerEligibility;
@@ -42,7 +42,6 @@ export interface ComposeRouteClassification {
  * placed in the project .env.
  */
 export declare function classifyComposeRoute(contract: AppContract, parsed: ParsedCompose, composeFile?: string): ComposeRouteClassification;
-export declare function brokerInstallerRouteWarning(compose: ComposeDocument, composeFile?: string): ValidationError;
 export declare function collectComposeInterpolations(compose: ComposeDocument): Set<string>;
 export declare function validateComposeSecurity(compose: ComposeDocument, composeFile: string, options: {
     profile: "personal" | "listing";