@synopackageland/cli 0.3.10 → 0.4.1

package/dist/init.js

@@ -1,12 +1,13 @@
-import { mkdirSync, cpSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, relative } from "node:path";
+import { templatesRoot } from "./template-paths.js";
 const TEMPLATE_NAMES = [
     "hello-web",
     "hello-web-page",
     "hello-files",
     "compose-import",
-    "native",
+    "binary",
+    "native-go",
 ];
 export function isTemplateName(value) {
     return TEMPLATE_NAMES.includes(value);
@@ -14,19 +15,134 @@ export function isTemplateName(value) {
 export function listTemplates() {
     return [...TEMPLATE_NAMES];
 }
-function templatesRoot() {
-    const moduleDir = dirname(fileURLToPath(import.meta.url));
-    const distTemplates = join(moduleDir, "templates");
-    if (existsSync(distTemplates)) {
-        return distTemplates;
-    }
-    return join(moduleDir, "..", "templates");
+/**
+ * native-go --privilege root: files laid over the native-go template, and the
+ * files they replace.
+ */
+const ROOT_OVERLAY = "native-go-root";
+const ROOT_REPLACED = ["backend/internal/app/root_none.go"];
+/** Templates whose identity is filled in at init (placeholders in these files). */
+const SUBSTITUTED = {
+    "native-go": ["dsm-package.yaml", "README.md"],
+};
+const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
+/** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
+const RENAMED = { gitignore: ".gitignore" };
+function words(dir) {
+    return basename(dir).split(/[^A-Za-z0-9]+/).filter(Boolean);
+}
+function defaultPackageId(dir) {
+    const id = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+    return PACKAGE_ID.test(id) ? id : "MyPackage";
+}
+function defaultDisplayName(dir) {
+    const name = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+    return name || "My Package";
+}
+function templateFiles(root, dir = root) {
+    return readdirSync(dir).flatMap((name) => {
+        const path = join(dir, name);
+        return statSync(path).isDirectory() ? templateFiles(root, path) : [relative(root, path)];
+    });
+}
+function targetName(file) {
+    return RENAMED[file] ?? file;
 }
-export function initFromTemplate(template, targetDir) {
+export function initFromTemplate(template, targetDir, options = {}) {
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
         throw new Error(`找不到模板：${template}`);
     }
+    const substitutions = substitutionsFor(template, targetDir, options);
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    const overlays = [
+        ...(privilege === "root" ? [ROOT_OVERLAY] : []),
+        ...(options.ui === "vue" ? ["native-go-vue"] : []),
+        ...(options.integration ? ["native-go-integration"] : []),
+        ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
+    ].map(name => join(templatesRoot(), name));
+    // Shared legal resources also live in the CLI package; only the template
+    // terms are an unconditional part of a generated project.
+    const shared = join(templatesRoot(), "_shared");
+    const files = [...templateFiles(source), "LICENSES/TEMPLATE.txt", ...overlays.flatMap(root => templateFiles(root)),
+        ...(options.ui === "vue" ? ["frontend/third-party-notices.mjs"] : []),
+        ...(options.integration === "better-auth" ? ["node/third-party-notices.mjs", ...templateFiles(join(shared, 'notice-overrides')).map(file => `node/notice-overrides/${file}`)] : [])];
+    const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
+    if (collisions.length > 0) {
+        throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
+    }
     mkdirSync(targetDir, { recursive: true });
     cpSync(source, targetDir, { recursive: true });
+    mkdirSync(join(targetDir, "LICENSES"), { recursive: true });
+    cpSync(join(shared, "LICENSES/TEMPLATE.txt"), join(targetDir, "LICENSES/TEMPLATE.txt"));
+    for (const overlay of overlays)
+        cpSync(overlay, targetDir, { recursive: true });
+    for (const dir of [...(options.ui === "vue" ? ["frontend"] : []), ...(options.integration === "better-auth" ? ["node"] : [])]) {
+        cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
+    }
+    if (options.integration === "better-auth")
+        cpSync(join(shared, 'notice-overrides'), join(targetDir, 'node/notice-overrides'), { recursive: true });
+    if (privilege === "root")
+        ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
+    for (const [from, to] of Object.entries(RENAMED)) {
+        if (files.includes(from)) {
+            renameSync(join(targetDir, from), join(targetDir, to));
+        }
+    }
+    for (const file of new Set([...(SUBSTITUTED[template] ?? []), ...overlays.flatMap(root => templateFiles(root))])) {
+        const path = join(targetDir, targetName(file));
+        let text = readFileSync(path, "utf8");
+        for (const [token, value] of Object.entries(substitutions)) {
+            text = text.replaceAll(token, value);
+        }
+        writeFileSync(path, text);
+    }
+    if (options.ui === "vue") {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
+        rmSync(join(targetDir, "ui"), { recursive: true });
+    }
+    if (options.integration === "better-auth")
+        rmSync(join(targetDir, "backend/internal/app/identity_none.go"));
+    if (options.integration) {
+        const mod = join(targetDir, "backend/go.mod");
+        writeFileSync(mod, readFileSync(mod, "utf8").replace("go 1.24", "go 1.25"));
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + `\nintegration:\n  protocol: ${options.integrationProtocol ?? 1}\n  workers: {}\n` + (options.integration === "better-auth" ? "  identity: better-auth\n" : "") + (options.dataAccess ? `  dataAccess: ${options.dataAccess}\n` : ""));
+        const routes = join(targetDir, "backend/internal/app/routes.go");
+        writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
+    }
+}
+function substitutionsFor(template, targetDir, options) {
+    if (options.privilege !== undefined && template !== "native-go") {
+        throw new Error("[INIT_PRIVILEGE_UNSUPPORTED] --privilege 只適用於 -t native-go。");
+    }
+    if ((options.ui !== undefined || options.integration !== undefined) && template !== "native-go")
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui/--integration 只適用於 native-go。");
+    if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
+        throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
+    if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
+        throw new Error("[INIT_INTEGRATION_INVALID] --integration 只接受 go 或 better-auth。");
+    if (options.dataAccess !== undefined && (!options.integration || options.integrationProtocol !== 2 || !["unavailable", "relaxed"].includes(options.dataAccess)))
+        throw new Error("[INIT_DATA_ACCESS_INVALID] --data-access 只接受 unavailable 或 relaxed，且需要 --integration 與 --integration-protocol 2；缺少已認證 adapter 仍拒絕 NAS 操作。");
+    if (options.integrationProtocol !== undefined && (!options.integration || ![1, 2].includes(options.integrationProtocol)))
+        throw new Error("[INIT_INTEGRATION_PROTOCOL_INVALID] --integration-protocol 只接受 1 或 2，且需要 --integration；protocol 2 不啟用 NAS data path。");
+    if (options.integration && (options.ui !== "vue" || options.privilege === "none"))
+        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 --ui vue 與 root privilege（自動選用）。");
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    if (privilege !== "none" && privilege !== "root") {
+        throw new Error(`[INIT_PRIVILEGE_INVALID] --privilege 只接受 none 或 root，收到「${String(privilege)}」。`);
+    }
+    if (!SUBSTITUTED[template]) {
+        return {};
+    }
+    const packageId = options.packageId ?? defaultPackageId(targetDir);
+    if (!PACKAGE_ID.test(packageId)) {
+        throw new Error(`[INIT_PACKAGE_INVALID] package「${packageId}」必須以英文字母開頭，只含英數字（2–64 字），例如 PhotoTagger。`);
+    }
+    const displayName = options.displayName ?? defaultDisplayName(targetDir);
+    if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
+        throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
+    }
+    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege };
 }

package/dist/log.js

@@ -6,14 +6,13 @@ export async function followProjectLogs(options) {
         return { ok: false, lines: [], diagnostics: { code: "NOT_INSTALLED" } };
     }
     const lines = await options.host.fetchContainerLogs(identity.packageId);
-    const info = await options.host.getAttestationInfo(identity.packageId);
+    const info = await options.host.getInstalledPackageState?.(identity.packageId);
     return {
         ok: true,
         lines,
         diagnostics: {
             packageIdentity: identity.packageId,
-            attestationKind: info.attestationKind,
-            readiness: info.readiness,
+            readiness: info?.status,
             redacted: true,
         },
     };

package/dist/native/validate.js

@@ -11,7 +11,6 @@ function nativeSpan(file, doc, pathSegments, pathString) {
     return { file, line: pos.line, column: pos.column, path: dotPath };
 }
 const HEX64_REGEX = /^[0-9a-fA-F]{64}$/;
-const FORBIDDEN_SERVICE_FIELDS = ["user", "command", "pre_start", "post_start", "shell"];
 export function validateNative(parsed, nativeFile, options = {}) {
     const errors = [];
     const profile = options.profile ?? "personal";

package/dist/standalone/binary.d.ts

@@ -0,0 +1,9 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { StandaloneError } from "./manifest.js";
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily): StandaloneError | undefined;

package/dist/standalone/binary.js

@@ -0,0 +1,67 @@
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { relative } from "node:path";
+const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+const PT_INTERP = 3;
+const MAX_BINARY_BYTES = 256 * 1024 * 1024;
+const HEADER_BYTES = 64 * 1024;
+function fail(code, message) {
+    return { code, message };
+}
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export function checkCgiBinary(projectRoot, file, arch) {
+    let stat;
+    try {
+        stat = lstatSync(file);
+    }
+    catch {
+        return fail("STANDALONE_BINARY_MISSING", `找不到 ${arch} 的 backend 執行檔：${file}`);
+    }
+    if (!stat.isFile()) {
+        return fail("STANDALONE_BINARY_NOT_REGULAR", `${file} 必須是一般檔案（不可是 symlink 或目錄）。`);
+    }
+    const rel = relative(realpathSync(projectRoot), realpathSync(file));
+    if (rel.startsWith("..")) {
+        return fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${file} 實際位於專案目錄之外。`);
+    }
+    if (stat.size > MAX_BINARY_BYTES) {
+        return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
+    }
+    return checkElf(readHeader(file), file, arch);
+}
+function readHeader(file) {
+    const fd = openSync(file, "r");
+    try {
+        const buf = Buffer.alloc(HEADER_BYTES);
+        return buf.subarray(0, readSync(fd, buf, 0, HEADER_BYTES, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function checkElf(buf, file, arch) {
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 64-bit little-endian Linux ELF 執行檔。`);
+    if (buf.length < 64 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[4] !== 2 || buf[5] !== 1) {
+        return notElf;
+    }
+    const machine = buf.readUInt16LE(18);
+    if (machine !== ELF_MACHINE[arch]) {
+        return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
+    }
+    const phoff = Number(buf.readBigUInt64LE(32));
+    const phentsize = buf.readUInt16LE(54);
+    const phnum = buf.readUInt16LE(56);
+    if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
+        return notElf;
+    }
+    for (let i = 0; i < phnum; i++) {
+        if (buf.readUInt32LE(phoff + i * phentsize) === PT_INTERP) {
+            return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
+        }
+    }
+    return undefined;
+}

package/dist/standalone/build.d.ts

@@ -0,0 +1,25 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+export interface CommandResult {
+    status: number | null;
+    stderr: string;
+    /** The program itself was not found. */
+    missing?: boolean;
+}
+export type CommandRunner = (command: string, args: string[], options: {
+    cwd: string;
+    env: Record<string, string | undefined>;
+}) => CommandResult;
+export interface StandaloneBuildOptions {
+    root: string;
+    /** Defaults to every arch in the manifest. */
+    arches?: NativeArchFamily[];
+    /** Defaults to `<root>/dist`. */
+    outDir?: string;
+    run?: CommandRunner;
+}
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export declare const runCommand: CommandRunner;
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
+    outputs: string[];
+}>;

package/dist/standalone/build.js

@@ -0,0 +1,110 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkCgiBinary } from "./binary.js";
+import { loadStandaloneManifest } from "./manifest.js";
+import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
+import { buildHelper } from "./helper.js";
+import { buildDaemonControl } from "./daemon.js";
+const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export const runCommand = (command, args, options) => {
+    const result = spawnSync(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["ignore", "inherit", "pipe"],
+        encoding: "utf8",
+    });
+    if (result.stderr) {
+        process.stderr.write(result.stderr);
+    }
+    const missing = result.error?.code === "ENOENT";
+    return { status: result.status, stderr: result.stderr ?? "", missing };
+};
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export async function buildStandalone(options) {
+    const loaded = loadStandaloneManifest(options.root);
+    if (!loaded.ok) {
+        const [first] = loaded.errors;
+        throw new StandaloneBuildError(first.code, loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"));
+    }
+    const manifest = loaded.manifest;
+    const run = options.run ?? runCommand;
+    const arches = options.arches ?? manifest.arches;
+    for (const arch of arches) {
+        if (!manifest.arches.includes(arch)) {
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+        }
+    }
+    buildUi(manifest, run);
+    if (manifest.integration?.identity === "better-auth") {
+        const result = run("npm", ["run", "build"], { cwd: join(manifest.root, "node"), env: { ...process.env } });
+        if (result.missing || result.status !== 0)
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_BUILD_FAILED", `Optional Better Auth build failed.\n${result.stderr}`);
+    }
+    const outDir = options.outDir ?? join(options.root, "dist");
+    const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
+    try {
+        const outputs = [];
+        for (const arch of arches) {
+            const helper = buildHelper(manifest, arch, work, run);
+            if (helper) {
+                const problem = checkCgiBinary(work, helper.binary, arch);
+                if (problem)
+                    throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const cgiPath = backendFor(manifest, arch, work, run, helper);
+            const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
+            if (problem) {
+                throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const daemonControl = buildDaemonControl(manifest, arch, work, run);
+            const builtManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper, daemonControl });
+            outputs.push(outputPath);
+        }
+        return { outputs };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+function buildUi(manifest, run) {
+    const build = manifest.ui.build;
+    if (!build) {
+        return;
+    }
+    const [command, ...args] = build.command;
+    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
+    if (result.missing || result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。\n${result.stderr}`);
+    }
+}
+function backendFor(manifest, arch, work, run, helper) {
+    const backend = manifest.backend;
+    if (backend.kind === "binary") {
+        return backend.files[arch];
+    }
+    const out = join(work, `api-${arch}.cgi`);
+    const ldflags = [
+        "-s",
+        "-w",
+        "-buildid=",
+        `-X main.packageID=${manifest.package}`,
+        `-X main.version=${manifest.spkVersion}`,
+        ...(helper ? [`-X 'main.helperInventory=${JSON.stringify(helper.inventory)}'`] : []),
+    ].join(" ");
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+        cwd: backend.dir,
+        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+    });
+    if (result.missing) {
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.24 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
+    }
+    if (result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);
+    }
+    return out;
+}

package/dist/standalone/daemon.d.ts

@@ -0,0 +1,23 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneError, StandaloneManifest } from "./manifest.js";
+export interface Daemon {
+    /** Fixed foreground executable relative to daemon/payload. */
+    exec: string;
+    /** Architecture-specific project directories, copied without links. */
+    targets: Partial<Record<NativeArchFamily, string>>;
+    args: string[];
+    /** Optional fixed executable argv, after stop, only on uninstall. */
+    uninstall_args?: string[];
+    /** The only application environment inherited beyond PATH/HOME/TMPDIR. */
+    env: Record<string, string>;
+    timeouts: {
+        start: number;
+        stop: number;
+        status: number;
+    };
+}
+export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function daemonConfig(manifest: StandaloneManifest): string;
+export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): string | undefined;
+export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;

package/dist/standalone/daemon.js

@@ -0,0 +1,114 @@
+import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { templatesRoot } from "../template-paths.js";
+import { checkCgiBinary } from "./binary.js";
+import { StandaloneBuildError } from "./spk.js";
+const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
+const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
+    && !v.replaceAll("${SYNOPKG_PKGDEST}", "").replaceAll("${SYNOPKG_PKGVAR}", "").includes("${");
+const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
+    && !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
+export function readDaemon(value, root, arches, fail) {
+    if (value === undefined)
+        return undefined;
+    const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon 只接受固定 exec、targets、args、env 與 timeouts；路徑須在專案內，環境不接受 loader/shell/system 變數。" }); return undefined; };
+    if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
+        return invalid();
+    if (typeof value.exec !== "string" || !/^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(value.exec)
+        || value.exec.split("/").some(p => p === "." || p === "..") || value.exec.length > 200)
+        return invalid();
+    if (!record(value.targets) || Object.keys(value.targets).length !== arches.length)
+        return invalid();
+    const targets = {};
+    for (const arch of arches) {
+        const path = value.targets[arch];
+        if (typeof path !== "string" || !path.trim() || path.includes("\0") || isAbsolute(path) || path.split(/[\\/]/).includes(".."))
+            return invalid();
+        const resolved = resolve(root, path), rel = relative(root, resolved);
+        if (!rel || rel.startsWith("..") || isAbsolute(rel))
+            return invalid();
+        targets[arch] = resolved;
+    }
+    const args = value.args ?? [];
+    if (!Array.isArray(args) || args.length > 64 || !args.every(token))
+        return invalid();
+    const uninstall = value.uninstall_args;
+    if (uninstall !== undefined && (!Array.isArray(uninstall) || !uninstall.length || uninstall.length > 64 || !uninstall.every(token)))
+        return invalid();
+    const env = value.env ?? {};
+    if (!record(env) || Object.keys(env).length > 64 || Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
+        return invalid();
+    const limits = value.timeouts ?? {};
+    if (!record(limits) || Object.keys(limits).some(k => !["start", "stop", "status"].includes(k)))
+        return invalid();
+    const timeouts = { start: limits.start ?? 5, stop: limits.stop ?? 10, status: limits.status ?? 2 };
+    for (const [key, v] of Object.entries(timeouts)) {
+        if (!Number.isInteger(v) || v < (key === "start" ? 2 : key === "stop" ? 2 : 1) || v > (key === "status" ? 10 : 120))
+            return invalid();
+    }
+    return { exec: value.exec, targets, args, ...(uninstall ? { uninstall_args: uninstall } : {}), env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])), timeouts: timeouts };
+}
+export function daemonConfig(manifest) {
+    const { exec, args, uninstall_args, env, timeouts } = manifest.daemon;
+    return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts }) + "\n";
+}
+export function buildDaemonControl(manifest, arch, work, run) {
+    if (!manifest.daemon)
+        return undefined;
+    const out = join(work, `daemon-control-${arch}`);
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
+        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+    });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build 需要 Go 1.24 以上。\n${result.stderr}`);
+    const problem = checkCgiBinary(work, out, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    return out;
+}
+export function copyDaemonPayload(manifest, arch, target, controller) {
+    const daemon = manifest.daemon;
+    const source = daemon.targets[arch];
+    const invalid = (message) => { throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", message); };
+    let total = 0;
+    const walk = (from, to) => {
+        const stat = lstatSync(from);
+        const rel = relative(realpathSync(manifest.root), realpathSync(from));
+        if (rel.startsWith("..") || isAbsolute(rel) || stat.isSymbolicLink())
+            invalid(`daemon payload 路徑不可含 symlink 或跳出專案：${from}`);
+        if (stat.isDirectory()) {
+            mkdirSync(to, { recursive: true });
+            chmodSync(to, 0o755);
+            for (const name of readdirSync(from).sort())
+                walk(join(from, name), join(to, name));
+        }
+        else if (stat.isFile()) {
+            total += stat.size;
+            if (total > 512 * 1024 * 1024 || (stat.mode & 0o6000))
+                invalid(`daemon payload 不接受 setid 或超過 512 MiB：${from}`);
+            copyFileSync(from, to);
+            chmodSync(to, stat.mode & 0o111 ? 0o755 : 0o644);
+        }
+        else
+            invalid(`daemon payload 只接受一般檔案及目錄：${from}`);
+    };
+    try {
+        if (!lstatSync(source).isDirectory())
+            invalid("daemon.targets 必須指向目錄。");
+        walk(source, join(target, "payload"));
+    }
+    catch (error) {
+        if (error instanceof StandaloneBuildError)
+            throw error;
+        invalid(`無法讀取 daemon payload：${String(error)}`);
+    }
+    const exec = join(source, daemon.exec);
+    const problem = checkCgiBinary(manifest.root, exec, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    chmodSync(join(target, "payload", daemon.exec), 0o755);
+    copyFileSync(controller, join(target, "control"));
+    chmodSync(join(target, "control"), 0o755);
+    writeFileSync(join(target, "config.json"), daemonConfig(manifest), { mode: 0o644 });
+}

package/dist/standalone/dsm-window.d.ts

@@ -0,0 +1,26 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
+export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+export declare function cgiUrl(packageId: string): string;
+/**
+ * `createI18n(dsmLang, catalogs)` → `{ locale, t }`, plain ES5 so it runs in
+ * DSM's desktop as is. The DSM language picks a shipped catalog (else
+ * English); missing keys fall back to English, then to the key itself.
+ * `t(key, { count })` looks up `key.one` / `key.other` via Intl.PluralRules.
+ */
+export declare const I18N_RUNTIME: string;
+/**
+ * The wrapper file name carries the build so DSM never serves a wrapper
+ * cached from the previous version after an upgrade.
+ */
+export declare function windowScriptName(manifest: Pick<StandaloneManifest, "build">): string;
+/** `ui/config`: registers the DSM main-menu app and its window class. */
+export declare function renderUiConfig(manifest: StandaloneManifest): string;
+/**
+ * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
+ * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
+ * `assetVersion` busts browser caches when the UI changes.
+ */
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string): string;