@synopackageland/cli 0.3.9 → 0.4.0

package/dist/publish/platform-service-release.js

@@ -1,333 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { buildImmutableAttestationKey, buildImmutableSpkKey, } from "@synopackageland/package-source/index-manifest";
-import { createR2CuratedReleasePublisher, publishCuratedRelease, } from "@synopackageland/package-source/publish-spk";
-import { createPlatformAttestationSignerFromEnv, digestPlatformServiceReleaseClaims, PLATFORM_SERVICE_PACKAGE_IDENTITY, PlatformServiceReleaseError, } from "../attestation/platform-service.js";
-export const SYNOPKGLAND_SOURCE_REVISION_ENV = "SYNOPKGLAND_SOURCE_REVISION";
-export const PLATFORM_SERVICE_OS_MIN_VER = "7.2-69057";
-/** Errors owned by the platform release entry point, separate from signer errors. */
-export class PlatformReleaseError extends Error {
-    code;
-    constructor(code, detail) {
-        super(detail ? `${code}: ${detail}` : code);
-        this.code = code;
-        this.name = "PlatformReleaseError";
-    }
-}
-/**
- * Build, attest and publish one immutable Broker SPK release.
- *
- * All cheap input gates run before the broker builder is loaded or invoked.
- * Publication is delegated to the package-source three-phase boundary, which
- * enforces artifact -> attestation -> index ordering.
- */
-export async function releasePlatformService(options) {
-    const brokerDir = validatePlatformReleaseRequest(options);
-    const builder = options.builder ?? (await loadPlatformServiceBuilder(brokerDir));
-    const baseline = readReleaseBaseline(builder);
-    if (options.build <= baseline.baselineBuild) {
-        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
-    }
-    const version = `${baseline.sourceVersion}-${String(options.build).padStart(4, "0")}`;
-    const workspace = mkdtempSync(join(tmpdir(), "synopkgland-platform-release-"));
-    try {
-        const outputPath = join(workspace, `${PLATFORM_SERVICE_PACKAGE_IDENTITY}.spk`);
-        try {
-            await builder.buildBrokerSpk({ outputPath, releaseVersion: version });
-            if (!existsSync(outputPath)) {
-                throw new Error("broker builder did not create the requested output");
-            }
-        }
-        catch (error) {
-            rethrowKnownReleaseError(error);
-            throw new PlatformReleaseError("PLATFORM_BUILD_FAILED");
-        }
-        let artifact;
-        try {
-            artifact = digestArtifact(outputPath);
-        }
-        catch (error) {
-            rethrowKnownReleaseError(error);
-            throw new PlatformReleaseError("PLATFORM_BUILD_FAILED");
-        }
-        const attestationInput = {
-            packageIdentity: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            sourceVersion: baseline.sourceVersion,
-            packageBuild: options.build,
-            packageVersion: version,
-            artifactDigest: artifact.sha256,
-            sourceRevision: options.sourceRevision,
-            osMinVer: PLATFORM_SERVICE_OS_MIN_VER,
-            arch: "noarch",
-        };
-        let signed;
-        try {
-            signed = await options.signer.sign(attestationInput);
-            assertPlatformClaims(signed.claims, attestationInput);
-        }
-        catch (error) {
-            rethrowKnownReleaseError(error);
-            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
-        }
-        let verified;
-        try {
-            verified = await options.signer.verify(signed.token);
-            assertPlatformClaims(verified, attestationInput);
-            if (signed.attestationDigest !== digestPlatformServiceReleaseClaims(verified)) {
-                throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", "attestation digest does not match verified claims");
-            }
-        }
-        catch (error) {
-            rethrowKnownReleaseError(error);
-            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
-        }
-        const artifactKey = buildImmutableSpkKey({
-            package: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            version,
-            sha256: artifact.sha256,
-        });
-        const attestationKey = buildImmutableAttestationKey({
-            package: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            version,
-            artifactDigest: artifact.sha256,
-        });
-        const tokenSha256 = digestBytes(Buffer.from(signed.token, "utf8"), "sha256");
-        const attestation = {
-            kind: "platform-service-release",
-            packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            version,
-            packageBuild: options.build,
-            artifactDigest: artifact.sha256,
-            key: attestationKey,
-            token: signed.token,
-            digest: signed.attestationDigest,
-            tokenSha256,
-            verificationJwk: options.signer.verificationJwk,
-        };
-        const index = {
-            packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            version,
-            displayname: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            description: "Trusted control plane for Synology App Packages.",
-            maintainer: "Synology",
-            osMinVer: PLATFORM_SERVICE_OS_MIN_VER,
-            artifact: {
-                key: artifactKey,
-                size: artifact.size,
-                md5: artifact.md5,
-                sha256: artifact.sha256,
-            },
-            attestation: {
-                kind: "platform-service-release",
-                key: attestationKey,
-                digest: signed.attestationDigest,
-                packageBuild: options.build,
-                artifactDigest: artifact.sha256,
-            },
-        };
-        try {
-            await publishCuratedRelease({
-                artifact: {
-                    packageId: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-                    version,
-                    path: outputPath,
-                    key: artifactKey,
-                    size: artifact.size,
-                    md5: artifact.md5,
-                    sha256: artifact.sha256,
-                },
-                attestation,
-                index,
-            }, options.publisher);
-        }
-        catch (error) {
-            rethrowKnownReleaseError(error);
-            throw new PlatformReleaseError("PLATFORM_RELEASE_FAILED");
-        }
-        return {
-            packageIdentity: PLATFORM_SERVICE_PACKAGE_IDENTITY,
-            packageBuild: options.build,
-            version,
-            artifactKey,
-            artifactDigest: artifact.sha256,
-            attestationKey,
-            attestationDigest: signed.attestationDigest,
-        };
-    }
-    finally {
-        rmSync(workspace, { recursive: true, force: true });
-    }
-}
-/** Run the trusted platform release verb and emit exactly one line. */
-export async function runPlatformServiceReleaseCli(argv = process.argv, env = process.env, dependencies = {}) {
-    const writeStdout = dependencies.writeStdout ?? ((line) => process.stdout.write(line));
-    const writeStderr = dependencies.writeStderr ?? ((line) => process.stderr.write(line));
-    try {
-        if (argv[2] !== "release-platform-service" ||
-            !argv[3] ||
-            !argv[4] ||
-            argv.length > 5) {
-            throw new PlatformReleaseError("PLATFORM_RELEASE_USAGE");
-        }
-        if (argv.slice(2).some((argument) => argument.endsWith(".spk"))) {
-            throw new PlatformReleaseError("PLATFORM_ARTIFACT_INPUT_FORBIDDEN");
-        }
-        const build = parseBuild(argv[4]);
-        const sourceRevision = resolveSourceRevision(env);
-        const brokerDir = resolve(process.cwd(), argv[3]);
-        validatePlatformBrokerDirectory(brokerDir);
-        const signer = dependencies.signer ?? (await createPlatformAttestationSignerFromEnv(env));
-        const publisher = dependencies.publisher ?? createR2CuratedReleasePublisher();
-        const result = await releasePlatformService({
-            brokerDir,
-            build,
-            sourceRevision,
-            signer,
-            publisher,
-            builder: dependencies.builder,
-        });
-        writeStdout(`${JSON.stringify({
-            packageIdentity: result.packageIdentity,
-            packageBuild: result.packageBuild,
-            version: result.version,
-            artifactDigest: result.artifactDigest,
-            attestationDigest: result.attestationDigest,
-        })}\n`);
-        return 0;
-    }
-    catch (error) {
-        writeStderr(`${releaseErrorCode(error)}\n`);
-        return 1;
-    }
-}
-function validatePlatformReleaseRequest(options) {
-    if (typeof options.brokerDir !== "string" ||
-        options.brokerDir.endsWith(".spk") ||
-        String(options.build).endsWith(".spk") ||
-        typeof options.sourceRevision !== "string" ||
-        options.sourceRevision.endsWith(".spk")) {
-        throw new PlatformReleaseError("PLATFORM_ARTIFACT_INPUT_FORBIDDEN");
-    }
-    if (!Number.isSafeInteger(options.build) || options.build <= 0) {
-        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
-    }
-    if (!/^[a-f0-9]{40}$/.test(options.sourceRevision)) {
-        throw new PlatformReleaseError("PLATFORM_SOURCE_REVISION_MISSING");
-    }
-    const brokerDir = resolve(options.brokerDir);
-    validatePlatformBrokerDirectory(brokerDir);
-    return brokerDir;
-}
-function validatePlatformBrokerDirectory(brokerDir) {
-    if (basename(brokerDir) !== "broker" ||
-        basename(dirname(brokerDir)) !== "packages") {
-        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
-    }
-    let packageJson;
-    try {
-        packageJson = JSON.parse(readFileSync(join(brokerDir, "package.json"), "utf8"));
-    }
-    catch {
-        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
-    }
-    if (!packageJson ||
-        typeof packageJson !== "object" ||
-        Array.isArray(packageJson) ||
-        packageJson.name !== "@synology/app-broker") {
-        throw new PlatformReleaseError("PLATFORM_BROKER_DIR_INVALID");
-    }
-    if (existsSync(join(brokerDir, "synology-app.yaml"))) {
-        throw new PlatformReleaseError("PLATFORM_APP_PROJECT_FORBIDDEN");
-    }
-}
-function parseBuild(value) {
-    if (!/^\d+$/.test(value)) {
-        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
-    }
-    const build = Number(value);
-    if (!Number.isSafeInteger(build) || build <= 0) {
-        throw new PlatformReleaseError("PLATFORM_BUILD_INVALID");
-    }
-    return build;
-}
-function resolveSourceRevision(env) {
-    const raw = env[SYNOPKGLAND_SOURCE_REVISION_ENV] ?? env.GITHUB_SHA;
-    const sourceRevision = typeof raw === "string" ? raw.trim() : "";
-    if (!/^[a-f0-9]{40}$/.test(sourceRevision)) {
-        throw new PlatformReleaseError("PLATFORM_SOURCE_REVISION_MISSING");
-    }
-    return sourceRevision;
-}
-async function loadPlatformServiceBuilder(brokerDir) {
-    const modulePath = join(brokerDir, "dist", "spk", "build.js");
-    let loaded;
-    try {
-        loaded = (await import(pathToFileURL(modulePath).href));
-    }
-    catch {
-        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
-    }
-    if (typeof loaded.buildBrokerSpk !== "function" ||
-        typeof loaded.brokerReleaseBaseline !== "function") {
-        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
-    }
-    return {
-        buildBrokerSpk: loaded.buildBrokerSpk,
-        brokerReleaseBaseline: loaded.brokerReleaseBaseline,
-    };
-}
-function readReleaseBaseline(builder) {
-    let baseline;
-    try {
-        baseline = builder.brokerReleaseBaseline();
-    }
-    catch {
-        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
-    }
-    if (!baseline ||
-        typeof baseline.sourceVersion !== "string" ||
-        !/^\d+\.\d+\.\d+$/.test(baseline.sourceVersion) ||
-        !Number.isSafeInteger(baseline.baselineBuild) ||
-        baseline.baselineBuild < 0) {
-        throw new PlatformReleaseError("PLATFORM_BUILDER_UNAVAILABLE");
-    }
-    return baseline;
-}
-function digestArtifact(path) {
-    const bytes = readFileSync(path);
-    return {
-        size: bytes.byteLength,
-        md5: digestBytes(bytes, "md5"),
-        sha256: digestBytes(bytes, "sha256"),
-    };
-}
-function digestBytes(bytes, algorithm) {
-    return createHash(algorithm).update(bytes).digest("hex");
-}
-function assertPlatformClaims(claims, expected) {
-    if (!claims ||
-        claims.packageIdentity !== expected.packageIdentity ||
-        claims.sourceVersion !== expected.sourceVersion ||
-        claims.packageBuild !== expected.packageBuild ||
-        claims.packageVersion !== expected.packageVersion ||
-        claims.artifactDigest !== expected.artifactDigest ||
-        claims.sourceRevision !== expected.sourceRevision ||
-        claims.osMinVer !== expected.osMinVer ||
-        claims.arch !== expected.arch) {
-        throw new PlatformServiceReleaseError("PLATFORM_ATTESTATION_INVALID", "platform release claims do not bind the release input");
-    }
-}
-function rethrowKnownReleaseError(error) {
-    if (error instanceof PlatformServiceReleaseError || error instanceof PlatformReleaseError) {
-        throw error;
-    }
-}
-function releaseErrorCode(error) {
-    if (error instanceof PlatformServiceReleaseError || error instanceof PlatformReleaseError) {
-        return error.code;
-    }
-    return "PLATFORM_RELEASE_FAILED";
-}

package/dist/publish/preflight.d.ts

@@ -1,24 +0,0 @@
-import type { ProjectRoot } from "../discovery.js";
-export interface PreflightCheck {
-    /** Stable id so scripts and docs can refer to a specific gate. */
-    id: string;
-    title: string;
-    ok: boolean;
-    detail?: string;
-}
-export interface PreflightResult {
-    ok: boolean;
-    checks: PreflightCheck[];
-}
-/**
- * Every gate for a public release that can be decided on the developer's own
- * machine. Submitting runs these first so a definition that CI would reject
- * never reaches review; `--check` runs the same set and stops.
- *
- * Deliberately excludes anything needing release authority: Build allocation,
- * attestation signing and catalog publication belong to trusted CI running
- * from the merged revision, and no local run can stand in for a maintainer's
- * approval.
- */
-export declare function runPublicReleasePreflight(project: ProjectRoot): Promise<PreflightResult>;
-export declare function formatPreflight(result: PreflightResult): string;

package/dist/publish/preflight.js

@@ -1,138 +0,0 @@
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { CURATED_BUILD_OFFSET, isDevelopmentPackageIdentity, } from "@synopackageland/package-source/index-manifest";
-import { buildSpk } from "../build-spk/generator.js";
-import { classifyComposeRoute, loadCompose } from "../compose/analyze.js";
-import { loadContract } from "../contract/load.js";
-import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
-import { loadNative } from "../native/load.js";
-import { validateProject } from "../validate.js";
-import { validateCuratedCompose } from "./curated-release.js";
-/**
- * Every gate for a public release that can be decided on the developer's own
- * machine. Submitting runs these first so a definition that CI would reject
- * never reaches review; `--check` runs the same set and stops.
- *
- * Deliberately excludes anything needing release authority: Build allocation,
- * attestation signing and catalog publication belong to trusted CI running
- * from the merged revision, and no local run can stand in for a maintainer's
- * approval.
- */
-export async function runPublicReleasePreflight(project) {
-    const checks = [];
-    const add = (check) => {
-        checks.push(check);
-        return check.ok;
-    };
-    const validation = validateProject(project, { profile: "listing" });
-    add({
-        id: "listing-validate",
-        title: "App Contract 與 runtime 通過 Curated listing profile",
-        ok: validation.ok,
-        detail: validation.ok ? undefined : validation.errors.map((error) => error.code).join(", "),
-    });
-    const contract = loadContract(project.contractPath).contract;
-    const contractVersion = typeof contract.version === "string" ? contract.version.trim() : "";
-    const sourceBuild = /-(\d+)$/.exec(contractVersion);
-    const sourceBuildNumber = sourceBuild ? Number(sourceBuild[1]) : undefined;
-    add({
-        id: "version-namespace",
-        title: "App Contract 不手寫 Curated Package Build",
-        ok: sourceBuildNumber === undefined ||
-            (Number.isSafeInteger(sourceBuildNumber) && sourceBuildNumber < CURATED_BUILD_OFFSET),
-        detail: sourceBuildNumber !== undefined &&
-            (!Number.isSafeInteger(sourceBuildNumber) || sourceBuildNumber >= CURATED_BUILD_OFFSET)
-            ? "CURATED_BUILD_MUST_NOT_BE_IN_SOURCE_VERSION"
-            : undefined,
-    });
-    const packageIdentity = typeof contract.package === "string" ? contract.package : "";
-    const formalIdentity = packageIdentity.length > 0 && !isDevelopmentPackageIdentity(packageIdentity);
-    add({
-        id: "formal-identity",
-        title: "Package Identity 是正式身分（不是 .dev）",
-        ok: formalIdentity,
-        detail: formalIdentity
-            ? undefined
-            : packageIdentity.length === 0
-                ? "App Contract 缺少 package 欄位。"
-                : `Curated 不接受 development identity：${packageIdentity}`,
-    });
-    const nativePath = project.nativePath;
-    const isNative = nativePath !== undefined && existsSync(nativePath);
-    if (isNative) {
-        const parsedNative = loadNative(nativePath);
-        const families = Object.keys(parsedNative?.native.targets ?? {}).filter(isNativeArchFamily);
-        const pinned = families.filter((family) => {
-            const target = parsedNative?.native.targets?.[family];
-            return typeof target?.url === "string" && typeof target?.sha256 === "string";
-        });
-        add({
-            id: "curated-runtime",
-            title: "每個 native target 都以 url + sha256 釘住",
-            ok: families.length > 0 && pinned.length === families.length,
-            detail: families.length === 0
-                ? "native.yaml 沒有宣告任何 target。"
-                : pinned.length === families.length
-                    ? undefined
-                    : `缺少 url 或 sha256：${families.filter((f) => !pinned.includes(f)).join(", ")}`,
-        });
-    }
-    else {
-        const parsedCompose = loadCompose(project.composePath);
-        const gate = parsedCompose
-            ? validateCuratedCompose(parsedCompose.compose)
-            : { ok: false, errors: ["CURATED_COMPOSE_MISSING"] };
-        add({
-            id: "curated-runtime",
-            title: "Compose 只用釘住 digest 的公開 image，且沒有 build:",
-            ok: gate.ok,
-            detail: gate.ok ? undefined : gate.errors.join(", "),
-        });
-        const route = parsedCompose
-            ? classifyComposeRoute(contract, parsedCompose)
-            : undefined;
-        add({
-            id: "curated-route",
-            title: "Compose 不使用 Broker installer 路線",
-            ok: route?.route !== "broker-installer",
-            detail: route?.route === "broker-installer" ? "CURATED_BROKER_ROUTE_FORBIDDEN" : undefined,
-        });
-    }
-    // The strongest local gate: actually produce the artifact. For native this
-    // fetches each pinned asset and refuses it unless the bytes hash to the
-    // declared sha256, so a bad pin fails here instead of in CI.
-    if (checks.every((check) => check.ok)) {
-        const staging = mkdtempSync(join(tmpdir(), "synopkgland-preflight-"));
-        try {
-            const families = isNative
-                ? Object.keys(loadNative(nativePath)?.native.targets ?? {}).filter(isNativeArchFamily)
-                : [undefined];
-            for (const family of families) {
-                const built = await buildSpk({
-                    project,
-                    outputPath: join(staging, `${packageIdentity}-${family ?? "noarch"}.spk`),
-                    ...(family ? { archFamily: family } : {}),
-                });
-                add({
-                    id: family ? `spk-builds:${family}` : "spk-builds",
-                    title: family ? `SPK 可建置（${family}，含 sha256 比對）` : "SPK 可建置",
-                    ok: built.ok,
-                    detail: built.ok ? undefined : built.errors.join(", "),
-                });
-                if (!built.ok) {
-                    break;
-                }
-            }
-        }
-        finally {
-            rmSync(staging, { recursive: true, force: true });
-        }
-    }
-    return { ok: checks.every((check) => check.ok), checks };
-}
-export function formatPreflight(result) {
-    return result.checks
-        .map((check) => `${check.ok ? "✔" : "✖"} ${check.title}${check.detail ? `\n    ${check.detail}` : ""}`)
-        .join("\n");
-}

package/dist/publish/publish.d.ts

@@ -1,27 +0,0 @@
-import type { ProjectRoot } from "../discovery.js";
-import { type PreflightResult } from "./preflight.js";
-import type { GitHubCli, GitOps } from "./github-pr.js";
-export interface PublishProjectOptions {
-    /** Injected in tests; production runs the real local gate set. */
-    preflight?: (project: ProjectRoot) => Promise<PreflightResult>;
-    project: ProjectRoot;
-    communityAppsRoot?: string;
-    baseBranch?: string;
-    branchPrefix?: string;
-    github: GitHubCli;
-    git: GitOps;
-    now?: () => Date;
-}
-export interface PublishProjectResult {
-    preflight?: PreflightResult;
-    ok: boolean;
-    code?: string;
-    message?: string;
-    packageIdentity?: string;
-    prUrl?: string;
-    prNumber?: number;
-    branchName?: string;
-    noChanges?: boolean;
-}
-export declare function publishProject(options: PublishProjectOptions): Promise<PublishProjectResult>;
-export { resolveCommunityAppsRoot, communityAppDirectory, listCommunityAppDirectories } from "./community-path.js";

package/dist/publish/publish.js

@@ -1,136 +0,0 @@
-import { join, resolve } from "node:path";
-import { loadContract } from "../contract/load.js";
-import { runPublicReleasePreflight } from "./preflight.js";
-import { assertDirectoryMatchesPackage, COMMUNITY_APPS_APPS_DIR, COMMUNITY_APPS_DIR, communityAppDirectory, resolveCommunityAppsRoot, } from "./community-path.js";
-import { listSyncedRelativePaths, syncPackagingDefinition } from "./sync-definition.js";
-function slugifyPackageIdentity(packageIdentity) {
-    return packageIdentity.replace(/[^a-zA-Z0-9._-]+/g, "-");
-}
-function renderPullRequestBody(packageIdentity, appRelativePath, files) {
-    return [
-        "## Summary",
-        "",
-        `Publish Packaging Definition for \`${packageIdentity}\`.`,
-        "",
-        "## Checklist",
-        "",
-        "- [ ] 變更摘要",
-        "- [ ] Image 來源（公開 registry／digest）",
-        "- [ ] 是否新增 User File Scope 或 secret",
-        "",
-        "## Synced paths",
-        "",
-        `\`${appRelativePath}/\``,
-        "",
-        files.map((file) => `- \`${file}\``).join("\n"),
-        "",
-        "_Opened by `synopkgland publish`. PR CI runs validate + preview only; no signing or Package Build allocation._",
-    ].join("\n");
-}
-export async function publishProject(options) {
-    // Every locally decidable gate runs before anything is pushed, so a
-    // definition CI would reject never costs a maintainer a review.
-    const preflight = options.preflight
-        ? await options.preflight(options.project)
-        : await runPublicReleasePreflight(options.project);
-    if (!preflight.ok) {
-        return {
-            ok: false,
-            code: "PREFLIGHT_FAILED",
-            message: preflight.checks
-                .filter((check) => !check.ok)
-                .map((check) => `${check.id}${check.detail ? `: ${check.detail}` : ""}`)
-                .join("; "),
-            preflight,
-        };
-    }
-    const communityRoot = options.communityAppsRoot ?? resolveCommunityAppsRoot(options.project.root);
-    if (!communityRoot) {
-        return {
-            ok: false,
-            code: "COMMUNITY_APPS_ROOT_MISSING",
-            message: "找不到 synopkgland-community-apps/apps。請在 monorepo 根目錄執行，或設定 SYNOPKGLAND_COMMUNITY_APPS_ROOT。",
-        };
-    }
-    const contract = loadContract(options.project.contractPath).contract;
-    const packageIdentity = contract.package;
-    if (typeof packageIdentity !== "string" || packageIdentity.length === 0) {
-        return {
-            ok: false,
-            code: "PACKAGE_IDENTITY_MISSING",
-            message: "App Contract 缺少有效的 package 欄位。",
-        };
-    }
-    const targetDir = communityAppDirectory(communityRoot, packageIdentity);
-    try {
-        assertDirectoryMatchesPackage(packageIdentity, targetDir);
-    }
-    catch (error) {
-        return {
-            ok: false,
-            code: "PACKAGE_DIRECTORY_MISMATCH",
-            message: error instanceof Error ? error.message : String(error),
-        };
-    }
-    if (resolve(options.project.root) === resolve(targetDir)) {
-        return {
-            ok: false,
-            code: "PUBLISH_SOURCE_IS_COMMUNITY_APP",
-            message: "publish 的專案根目錄不能是 Community Apps 目標目錄。請對開發專案執行，不要對 synopkgland-community-apps/apps/<package> 本身執行。",
-            packageIdentity,
-        };
-    }
-    syncPackagingDefinition(options.project, targetDir);
-    const appRelativePath = join(COMMUNITY_APPS_DIR, COMMUNITY_APPS_APPS_DIR, packageIdentity);
-    const syncedFiles = listSyncedRelativePaths(targetDir);
-    const baseBranch = options.baseBranch ?? "master";
-    const branchPrefix = options.branchPrefix ?? "publish";
-    const stamp = (options.now ?? (() => new Date()))().toISOString().replace(/[:.]/g, "-");
-    const branchName = `${branchPrefix}/${slugifyPackageIdentity(packageIdentity)}-${stamp}`;
-    if (!options.git.hasChanges([appRelativePath])) {
-        return {
-            ok: true,
-            noChanges: true,
-            packageIdentity,
-            message: "Community Apps 定義已是最新，未建立 PR。",
-        };
-    }
-    const previousBranch = options.git.currentBranch();
-    try {
-        options.git.checkoutNewBranch(branchName);
-        options.git.add([appRelativePath]);
-        options.git.commit(`Publish ${packageIdentity} packaging definition`, [appRelativePath]);
-        options.git.push(branchName, true);
-        const pr = await options.github.createPullRequest({
-            title: `Publish ${packageIdentity}`,
-            body: renderPullRequestBody(packageIdentity, appRelativePath, syncedFiles),
-            base: baseBranch,
-            head: branchName,
-        });
-        return {
-            ok: true,
-            packageIdentity,
-            prUrl: pr.url,
-            prNumber: pr.number,
-            branchName,
-        };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            code: "PUBLISH_PR_FAILED",
-            message: error instanceof Error ? error.message : String(error),
-            packageIdentity,
-            branchName,
-        };
-    }
-    finally {
-        try {
-            options.git.checkoutExisting(previousBranch);
-        }
-        catch {
-            // Best effort restore; caller may be in a temp repo during tests.
-        }
-    }
-}
-export { resolveCommunityAppsRoot, communityAppDirectory, listCommunityAppDirectories } from "./community-path.js";

package/dist/publish/sync-definition.d.ts

@@ -1,4 +0,0 @@
-import type { ProjectRoot } from "../discovery.js";
-export declare function assertDistinctSyncPaths(sourceRoot: string, targetDir: string): void;
-export declare function syncPackagingDefinition(source: ProjectRoot, targetDir: string): void;
-export declare function listSyncedRelativePaths(targetDir: string): string[];