@synopackageland/cli 0.3.9 → 0.4.0

package/dist/host/port-info-lookup.js

@@ -0,0 +1,87 @@
+import { dsmFetch } from "./dsm-http.js";
+const PORT_INFO_API = "SYNO.Core.Service.PortInfo";
+function asRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}
+function validPortRange(value) {
+    const match = /^(\d+)(?:\s*-\s*(\d+))?$/.exec(value.trim());
+    if (!match) {
+        return false;
+    }
+    const start = Number(match[1]);
+    const end = Number(match[2] ?? match[1]);
+    return (Number.isSafeInteger(start) &&
+        Number.isSafeInteger(end) &&
+        start >= 1 &&
+        start <= end &&
+        end <= 65535);
+}
+/**
+ * Parses the native DSM response, not a synoagentcli operation envelope.
+ * `undefined` means "cannot tell" and deliberately allows deployment to
+ * continue. An empty `port_info` list has the same fail-open meaning.
+ */
+export function parsePortInfo(payload) {
+    const outer = asRecord(payload);
+    const data = asRecord(outer?.data);
+    const items = data?.port_info;
+    if (outer?.success !== true || !Array.isArray(items) || items.length === 0) {
+        return undefined;
+    }
+    const entries = [];
+    for (const item of items) {
+        const record = asRecord(item);
+        if (!record) {
+            return undefined;
+        }
+        const desc = record?.desc;
+        const dstPort = record?.dst_port;
+        const name = record?.name;
+        const portId = record?.port_id;
+        const protocol = record?.protocol;
+        if (typeof desc !== "string" ||
+            typeof name !== "string" ||
+            typeof portId !== "string" ||
+            typeof protocol !== "string" ||
+            !Array.isArray(dstPort) ||
+            dstPort.length === 0 ||
+            !dstPort.every((value) => typeof value === "string" && validPortRange(value))) {
+            return undefined;
+        }
+        const srcPort = record.src_port;
+        if (srcPort !== undefined &&
+            srcPort !== null &&
+            (!Array.isArray(srcPort) || !srcPort.every((value) => typeof value === "string"))) {
+            return undefined;
+        }
+        entries.push({
+            desc,
+            dst_port: [...dstPort],
+            name,
+            port_id: portId,
+            protocol,
+            ...(srcPort === undefined ? {} : { src_port: srcPort === null ? null : [...srcPort] }),
+        });
+    }
+    return entries;
+}
+export async function fetchPortInfo(dsmOrigin, cookieHeader, request = dsmFetch) {
+    try {
+        const query = new URLSearchParams({
+            api: PORT_INFO_API,
+            version: "1",
+            method: "load",
+        });
+        const response = await request(`${dsmOrigin.replace(/\/$/, "")}/webapi/entry.cgi?${query.toString()}`, { headers: { cookie: cookieHeader } });
+        if (!response.ok) {
+            return undefined;
+        }
+        return parsePortInfo(await response.json());
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/host/port-info.d.ts

@@ -0,0 +1,33 @@
+/** One row returned by SYNO.Core.Service.PortInfo/load. */
+export interface PortInfoEntry {
+    desc: string;
+    dst_port: readonly string[];
+    name: string;
+    port_id: string;
+    protocol: string;
+    src_port?: readonly string[] | null;
+}
+export type DsmPortInfoEntry = PortInfoEntry;
+export type PortInfoRow = PortInfoEntry;
+export interface PortConflict {
+    port: number;
+    services: readonly string[];
+    occupants: readonly PortInfoEntry[];
+}
+/**
+ * Returns the Docker container name represented by a DSM port row, when the
+ * row has Docker's known `port_id` or `desc` shape. Other DSM services are
+ * intentionally returned as undefined so they remain conflicts.
+ */
+export declare function dockerContainerName(entry: PortInfoEntry): string | undefined;
+export declare function formatPortOccupant(entry: PortInfoEntry): string;
+/**
+ * Finds occupied published ports, ignoring only containers that are one of
+ * the Compose containers for this exact package identity. A same-identity
+ * occupant is the existing install being upgraded or reinstalled.
+ */
+export declare function findPortConflicts(input: {
+    publishedPorts: ReadonlyMap<number, readonly string[]>;
+    packageIdentity: string;
+    portInfo: readonly PortInfoEntry[];
+}): PortConflict[];

package/dist/host/port-info.js

@@ -0,0 +1,66 @@
+import { composeProjectName } from "../build-spk/resource-worker.js";
+function parsePortRange(value) {
+    const match = /^(\d+)(?:\s*-\s*(\d+))?$/.exec(value.trim());
+    if (!match) {
+        return undefined;
+    }
+    const start = Number(match[1]);
+    const end = Number(match[2] ?? match[1]);
+    if (!Number.isSafeInteger(start) ||
+        !Number.isSafeInteger(end) ||
+        start < 1 ||
+        end > 65535 ||
+        start > end) {
+        return undefined;
+    }
+    return { start, end };
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function entryCoversPort(entry, port) {
+    return entry.dst_port.some((value) => {
+        const range = parsePortRange(value);
+        return range !== undefined && range.start <= port && port <= range.end;
+    });
+}
+/**
+ * Returns the Docker container name represented by a DSM port row, when the
+ * row has Docker's known `port_id` or `desc` shape. Other DSM services are
+ * intentionally returned as undefined so they remain conflicts.
+ */
+export function dockerContainerName(entry) {
+    const portIdMatch = /^(.*)_tcp$/i.exec(entry.port_id.trim());
+    if (portIdMatch?.[1]) {
+        return portIdMatch[1];
+    }
+    const descMatch = /^Docker\s+(.+)$/i.exec(entry.desc.trim());
+    return descMatch?.[1]?.trim() || undefined;
+}
+export function formatPortOccupant(entry) {
+    return dockerContainerName(entry) ?? (entry.desc.trim() || entry.port_id.trim() || entry.name.trim());
+}
+/**
+ * Finds occupied published ports, ignoring only containers that are one of
+ * the Compose containers for this exact package identity. A same-identity
+ * occupant is the existing install being upgraded or reinstalled.
+ */
+export function findPortConflicts(input) {
+    const conflicts = [];
+    const projectName = composeProjectName(input.packageIdentity);
+    for (const [port, services] of input.publishedPorts) {
+        // Compose names a container <project>-<service>-<replica>. Match the
+        // replica as a number rather than assuming -1: a scaled service would
+        // otherwise look like a foreign occupant and refuse this package's own
+        // redeploy. The service name is still matched exactly, so a different
+        // package whose project name merely shares a prefix stays a conflict.
+        const ownContainer = (containerName) => services.some((service) => new RegExp(`^${escapeRegExp(`${projectName}-${service}-`)}\\d+$`).test(containerName));
+        const occupants = input.portInfo.filter((entry) => entry.protocol.trim().toLowerCase() === "tcp" &&
+            entryCoversPort(entry, port) &&
+            !ownContainer(dockerContainerName(entry) ?? ""));
+        if (occupants.length > 0) {
+            conflicts.push({ port, services, occupants });
+        }
+    }
+    return conflicts;
+}

package/dist/host/types.d.ts

@@ -1,76 +1,20 @@
 import type { SharePermissionListing } from "../deploy/share-permission-preflight.js";
 import type { InstalledPackageState } from "./catalog-install.js";
-export type AttestationKind = "local" | "app-package" | "none";
-export type PackageRoute = "package-only" | "broker-installer" | "unknown";
-export type OidcOriginKind = "public-ca" | "quickconnect" | "lan-ip" | "self-signed" | "private-ca" | "http";
-export interface HostOidcOriginEvaluation {
-    ready: boolean;
-    kind: OidcOriginKind;
-    hostname?: string;
-    issuerUrl?: string;
-    setupHint: string;
-}
-export interface HostOidcCompatSettings {
-    enabled: boolean;
-    origin: HostOidcOriginEvaluation;
-}
+import type { PortInfoEntry } from "./port-info.js";
+import type { DsmPortProfileInventory } from "./dsm-port-profile.js";
 export interface DeployIdentity {
     packageId: string;
     displayname: string;
     developmentInstance: boolean;
 }
-export interface AttestationIssueResult {
-    kind: "local";
-    attestationDigest: string;
-    token?: string;
-}
-export interface ResidueItem {
-    kind: "port_profile_sc" | "cm_project_config";
-    path: string;
-    name: string;
-    reason: string;
-}
-export interface DsmResidueInventory {
-    items: ResidueItem[];
-    unreadable: string[];
-}
-export interface HostAttestationInfo {
-    packageIdentity: string;
-    attestationKind: AttestationKind;
-    developmentInstance: boolean;
-    openUrl?: string;
-    readiness?: string;
-    projectName?: string;
-}
-export interface HostInstallRecord {
-    packageId: string;
-    version?: string;
-    source?: "package-center" | "local-spk";
-    extraValues?: Record<string, string>;
-}
 export interface NasHost {
     readonly dsmOrigin: string;
-    readonly installationId: string;
-    requestAttestation(input: {
-        packageIdentity: string;
-        contractDigest: string;
-        bundleDigest: string;
-        capabilities: string[];
-        allowCuratedDowngrade?: boolean;
-    }): Promise<AttestationIssueResult>;
-    installFromCatalog(input: {
-        packageId: string;
-        version?: string;
-        extraValues?: Record<string, string>;
-    }): Promise<void>;
-    installFromLocalSpk?(input: {
+    installFromLocalSpk(input: {
         packageId: string;
         version: string;
         spkPath: string;
         extraValues?: Record<string, string>;
     }): Promise<void>;
-    /** Stop and normally uninstall a formal package while preserving App Data. */
-    uninstallPackage?(packageIdentity: string): Promise<void>;
     /**
      * CPU family of this NAS, for picking a native App's target. Returns
      * undefined when the DSM answer does not map to a family we ship, so the
@@ -88,31 +32,15 @@ export interface NasHost {
     listSharePermissions?(logicalName: string): Promise<SharePermissionListing | undefined>;
     /** Group names a DSM user belongs to, for resolving share permission. */
     listUserGroups?(userName: string): Promise<string[] | undefined>;
+    /** Read SYNO.Core.Service.PortInfo/load using an administrator session. */
+    listPortInfo?(): Promise<PortInfoEntry[] | undefined>;
     /** Resolve the NAS-specific user-home root when DSM User Home is enabled. */
     resolveHomesPath?(): Promise<string | undefined>;
-    getInstalledProjectEnv?(packageIdentity: string): Promise<Record<string, string> | undefined>;
-    ensurePackageSource?(origin: string): Promise<void>;
     getInstalledPackageVersion?(packageIdentity: string): Promise<string | undefined>;
     getInstalledPackageState?(packageIdentity: string): Promise<InstalledPackageState | undefined>;
-    getAttestationInfo(packageIdentity: string): Promise<HostAttestationInfo>;
     isPackageInstalled(packageIdentity: string): Promise<boolean>;
     fetchContainerLogs(packageIdentity: string): Promise<string[]>;
-    getDsmDiagnostics?(packageIdentity?: string): Promise<{
-        dsmResidue?: DsmResidueInventory;
-        packageRoute?: PackageRoute;
-        isPackageOnly?: boolean;
-        [key: string]: unknown;
-    } | undefined>;
-    /** Read the optional administrator OIDC compatibility settings endpoint. */
-    getOidcCompatSettings?(): Promise<HostOidcCompatSettings | undefined>;
-    smokeRequireLogin(input: {
-        packageIdentity: string;
-        cookieHeader: string;
-    }): Promise<{
-        ok: boolean;
-        username?: string;
-    }>;
-    markCurated?(packageIdentity: string): void;
+    getDsmPortProfileInventory?(): Promise<DsmPortProfileInventory | undefined>;
 }
 export interface HostCredentials {
     dsmOrigin: string;

package/dist/index.d.ts

@@ -6,14 +6,5 @@ export { initFromTemplate, isTemplateName } from "./init.js";
 export { runDev } from "./dev.js";
 export { testProject } from "./test-command.js";
 export { buildSpk } from "./build-spk/generator.js";
-export { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
-export { communityAppsGitHubRepo, communityAppsGitHubUrl, DEFAULT_GITHUB_OWNER, } from "./publish/github-repo.js";
-export { InMemoryBuildLedger } from "./publish/build-ledger.js";
-export type { BuildLedger } from "./publish/build-ledger.js";
-export { createCuratedAttestationSignerFromEnv, isPublicOciDigest, releaseCurated, runCuratedRelease, runCuratedReleaseCli, digestReleaseBundle, validateCuratedCompose, } from "./publish/curated-release.js";
-export type { CuratedAttestationSignInput, CuratedAttestationSigner, CuratedComposeGateResult, CuratedReleaseSignInput, CuratedReleaseOptions, CuratedReleaseResult, } from "./publish/curated-release.js";
-export { canonicalAppPackageClaims, canonicalCuratedReleaseClaims, digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabilities, assertPackageVersionBinding, signCuratedAppPackageAttestationToken, signCuratedReleaseAttestationToken, } from "./attestation/app-package.js";
-export type { AppPackageAttestationClaims, AppPackageSigningKey, CuratedAppPackageAttestationInput, CuratedReleaseAttestationClaims, CuratedReleaseAttestationInput, } from "./attestation/app-package.js";
-export { startMockBroker, FAKE_USER } from "./mock-broker/server.js";
 export { RecordingComposeRunner } from "./compose/runner.js";
 export type { ValidationError, ValidationResult } from "./types.js";

package/dist/index.js

@@ -5,10 +5,4 @@ export { initFromTemplate, isTemplateName } from "./init.js";
 export { runDev } from "./dev.js";
 export { testProject } from "./test-command.js";
 export { buildSpk } from "./build-spk/generator.js";
-export { publishProject, resolveCommunityAppsRoot } from "./publish/publish.js";
-export { communityAppsGitHubRepo, communityAppsGitHubUrl, DEFAULT_GITHUB_OWNER, } from "./publish/github-repo.js";
-export { InMemoryBuildLedger } from "./publish/build-ledger.js";
-export { createCuratedAttestationSignerFromEnv, isPublicOciDigest, releaseCurated, runCuratedRelease, runCuratedReleaseCli, digestReleaseBundle, validateCuratedCompose, } from "./publish/curated-release.js";
-export { canonicalAppPackageClaims, canonicalCuratedReleaseClaims, digestAppPackageClaims, digestCuratedReleaseClaims, normalizeCapabilities, assertPackageVersionBinding, signCuratedAppPackageAttestationToken, signCuratedReleaseAttestationToken, } from "./attestation/app-package.js";
-export { startMockBroker, FAKE_USER } from "./mock-broker/server.js";
 export { RecordingComposeRunner } from "./compose/runner.js";

package/dist/info.d.ts

@@ -8,7 +8,6 @@ export interface ProjectInfoOptions {
 export declare function projectInfo(options: ProjectInfoOptions): Promise<ProjectInfoResult>;
 export interface ProjectInfoResult {
     packageIdentity: string;
-    attestationKind: "local" | "app-package" | "none";
     developmentInstance: boolean;
     openUrl?: string;
     readiness?: string;

package/dist/info.js

@@ -3,27 +3,20 @@ import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
 export async function projectInfo(options) {
     const identity = resolveDeployIdentity(options.project, { dev: options.dev });
-    const remote = await options.host.getAttestationInfo(identity.packageId);
+    const remote = await options.host.getInstalledPackageState?.(identity.packageId);
     const installed = await options.host.isPackageInstalled(identity.packageId);
     const contract = loadContract(options.project.contractPath).contract;
     return {
         packageIdentity: identity.packageId,
-        attestationKind: remote.attestationKind,
         developmentInstance: identity.developmentInstance,
-        openUrl: remote.openUrl ?? appOriginFromContract(options.host.dsmOrigin, contract),
-        readiness: remote.readiness ?? (installed ? "UNKNOWN" : "NOT_INSTALLED"),
+        openUrl: appOriginFromContract(options.host.dsmOrigin, contract),
+        readiness: remote?.status ?? (installed ? "UNKNOWN" : "NOT_INSTALLED"),
         installed,
     };
 }
 export function formatProjectInfo(info) {
-    const attestationLabel = info.attestationKind === "app-package"
-        ? "Curated（App Package Attestation）"
-        : info.attestationKind === "local"
-            ? "Local（Local Attestation）"
-            : "無";
     return [
         `Package Identity：${info.packageIdentity}`,
-        `Attestation：${attestationLabel}`,
         `開發用 Instance：${info.developmentInstance ? "是" : "否"}`,
         `已安裝：${info.installed ? "是" : "否"}`,
         info.openUrl ? `Open URL：${info.openUrl}` : "Open URL：（未設定）",

package/dist/init.d.ts

@@ -1,4 +1,14 @@
 import type { TemplateName } from "./types.js";
 export declare function isTemplateName(value: string): value is TemplateName;
 export declare function listTemplates(): TemplateName[];
-export declare function initFromTemplate(template: TemplateName, targetDir: string): void;
+export interface InitOptions {
+    /** Standalone templates: INFO.package (default: from the directory name). */
+    packageId?: string;
+    /** Standalone templates: display name (default: from the directory name). */
+    displayName?: string;
+    /** native-go: "root" adds administrator-approved root operations (default "none"). */
+    privilege?: "none" | "root";
+    ui?: "plain" | "vue";
+    integration?: "go" | "better-auth";
+}
+export declare function initFromTemplate(template: TemplateName, targetDir: string, options?: InitOptions): void;

package/dist/init.js

@@ -1,12 +1,13 @@
-import { mkdirSync, cpSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 const TEMPLATE_NAMES = [
     "hello-web",
     "hello-web-page",
     "hello-files",
     "compose-import",
-    "native",
+    "binary",
+    "native-go",
 ];
 export function isTemplateName(value) {
     return TEMPLATE_NAMES.includes(value);
@@ -22,11 +23,118 @@ function templatesRoot() {
     }
     return join(moduleDir, "..", "templates");
 }
-export function initFromTemplate(template, targetDir) {
+/**
+ * native-go --privilege root: files laid over the native-go template, and the
+ * files they replace.
+ */
+const ROOT_OVERLAY = "native-go-root";
+const ROOT_REPLACED = ["backend/internal/app/root_none.go"];
+/** Templates whose identity is filled in at init (placeholders in these files). */
+const SUBSTITUTED = {
+    "native-go": ["dsm-package.yaml", "README.md"],
+};
+const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
+/** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
+const RENAMED = { gitignore: ".gitignore" };
+function words(dir) {
+    return basename(dir).split(/[^A-Za-z0-9]+/).filter(Boolean);
+}
+function defaultPackageId(dir) {
+    const id = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+    return PACKAGE_ID.test(id) ? id : "MyPackage";
+}
+function defaultDisplayName(dir) {
+    const name = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+    return name || "My Package";
+}
+function templateFiles(root, dir = root) {
+    return readdirSync(dir).flatMap((name) => {
+        const path = join(dir, name);
+        return statSync(path).isDirectory() ? templateFiles(root, path) : [relative(root, path)];
+    });
+}
+function targetName(file) {
+    return RENAMED[file] ?? file;
+}
+export function initFromTemplate(template, targetDir, options = {}) {
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
         throw new Error(`找不到模板：${template}`);
     }
+    const substitutions = substitutionsFor(template, targetDir, options);
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    const overlays = [
+        ...(privilege === "root" ? [ROOT_OVERLAY] : []),
+        ...(options.ui === "vue" ? ["native-go-vue"] : []),
+        ...(options.integration ? ["native-go-integration"] : []),
+        ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
+    ].map(name => join(templatesRoot(), name));
+    const files = [...templateFiles(source), ...overlays.flatMap(root => templateFiles(root))];
+    const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
+    if (collisions.length > 0) {
+        throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
+    }
     mkdirSync(targetDir, { recursive: true });
     cpSync(source, targetDir, { recursive: true });
+    for (const overlay of overlays)
+        cpSync(overlay, targetDir, { recursive: true });
+    if (privilege === "root")
+        ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
+    for (const [from, to] of Object.entries(RENAMED)) {
+        if (files.includes(from)) {
+            renameSync(join(targetDir, from), join(targetDir, to));
+        }
+    }
+    for (const file of new Set([...(SUBSTITUTED[template] ?? []), ...overlays.flatMap(root => templateFiles(root))])) {
+        const path = join(targetDir, targetName(file));
+        let text = readFileSync(path, "utf8");
+        for (const [token, value] of Object.entries(substitutions)) {
+            text = text.replaceAll(token, value);
+        }
+        writeFileSync(path, text);
+    }
+    if (options.ui === "vue") {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
+        rmSync(join(targetDir, "ui"), { recursive: true });
+    }
+    if (options.integration === "better-auth")
+        rmSync(join(targetDir, "backend/internal/app/identity_none.go"));
+    if (options.integration) {
+        const mod = join(targetDir, "backend/go.mod");
+        writeFileSync(mod, readFileSync(mod, "utf8").replace("go 1.24", "go 1.25"));
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nintegration:\n  protocol: 1\n  workers: {}\n" + (options.integration === "better-auth" ? "  identity: better-auth\n" : ""));
+        const routes = join(targetDir, "backend/internal/app/routes.go");
+        writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
+    }
+}
+function substitutionsFor(template, targetDir, options) {
+    if (options.privilege !== undefined && template !== "native-go") {
+        throw new Error("[INIT_PRIVILEGE_UNSUPPORTED] --privilege 只適用於 -t native-go。");
+    }
+    if ((options.ui !== undefined || options.integration !== undefined) && template !== "native-go")
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui/--integration 只適用於 native-go。");
+    if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
+        throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
+    if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
+        throw new Error("[INIT_INTEGRATION_INVALID] --integration 只接受 go 或 better-auth。");
+    if (options.integration && (options.ui !== "vue" || options.privilege === "none"))
+        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 --ui vue 與 root privilege（自動選用）。");
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    if (privilege !== "none" && privilege !== "root") {
+        throw new Error(`[INIT_PRIVILEGE_INVALID] --privilege 只接受 none 或 root，收到「${String(privilege)}」。`);
+    }
+    if (!SUBSTITUTED[template]) {
+        return {};
+    }
+    const packageId = options.packageId ?? defaultPackageId(targetDir);
+    if (!PACKAGE_ID.test(packageId)) {
+        throw new Error(`[INIT_PACKAGE_INVALID] package「${packageId}」必須以英文字母開頭，只含英數字（2–64 字），例如 PhotoTagger。`);
+    }
+    const displayName = options.displayName ?? defaultDisplayName(targetDir);
+    if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
+        throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
+    }
+    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege };
 }

package/dist/log.js

@@ -6,14 +6,13 @@ export async function followProjectLogs(options) {
         return { ok: false, lines: [], diagnostics: { code: "NOT_INSTALLED" } };
     }
     const lines = await options.host.fetchContainerLogs(identity.packageId);
-    const info = await options.host.getAttestationInfo(identity.packageId);
+    const info = await options.host.getInstalledPackageState?.(identity.packageId);
     return {
         ok: true,
         lines,
         diagnostics: {
             packageIdentity: identity.packageId,
-            attestationKind: info.attestationKind,
-            readiness: info.readiness,
+            readiness: info?.status,
             redacted: true,
         },
     };

package/dist/native/validate.js

@@ -11,7 +11,6 @@ function nativeSpan(file, doc, pathSegments, pathString) {
     return { file, line: pos.line, column: pos.column, path: dotPath };
 }
 const HEX64_REGEX = /^[0-9a-fA-F]{64}$/;
-const FORBIDDEN_SERVICE_FIELDS = ["user", "command", "pre_start", "post_start", "shell"];
 export function validateNative(parsed, nativeFile, options = {}) {
     const errors = [];
     const profile = options.profile ?? "personal";

package/dist/standalone/binary.d.ts

@@ -0,0 +1,9 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { StandaloneError } from "./manifest.js";
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily): StandaloneError | undefined;

package/dist/standalone/binary.js

@@ -0,0 +1,67 @@
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { relative } from "node:path";
+const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+const PT_INTERP = 3;
+const MAX_BINARY_BYTES = 256 * 1024 * 1024;
+const HEADER_BYTES = 64 * 1024;
+function fail(code, message) {
+    return { code, message };
+}
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export function checkCgiBinary(projectRoot, file, arch) {
+    let stat;
+    try {
+        stat = lstatSync(file);
+    }
+    catch {
+        return fail("STANDALONE_BINARY_MISSING", `找不到 ${arch} 的 backend 執行檔：${file}`);
+    }
+    if (!stat.isFile()) {
+        return fail("STANDALONE_BINARY_NOT_REGULAR", `${file} 必須是一般檔案（不可是 symlink 或目錄）。`);
+    }
+    const rel = relative(realpathSync(projectRoot), realpathSync(file));
+    if (rel.startsWith("..")) {
+        return fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${file} 實際位於專案目錄之外。`);
+    }
+    if (stat.size > MAX_BINARY_BYTES) {
+        return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
+    }
+    return checkElf(readHeader(file), file, arch);
+}
+function readHeader(file) {
+    const fd = openSync(file, "r");
+    try {
+        const buf = Buffer.alloc(HEADER_BYTES);
+        return buf.subarray(0, readSync(fd, buf, 0, HEADER_BYTES, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function checkElf(buf, file, arch) {
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 64-bit little-endian Linux ELF 執行檔。`);
+    if (buf.length < 64 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[4] !== 2 || buf[5] !== 1) {
+        return notElf;
+    }
+    const machine = buf.readUInt16LE(18);
+    if (machine !== ELF_MACHINE[arch]) {
+        return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
+    }
+    const phoff = Number(buf.readBigUInt64LE(32));
+    const phentsize = buf.readUInt16LE(54);
+    const phnum = buf.readUInt16LE(56);
+    if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
+        return notElf;
+    }
+    for (let i = 0; i < phnum; i++) {
+        if (buf.readUInt32LE(phoff + i * phentsize) === PT_INTERP) {
+            return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
+        }
+    }
+    return undefined;
+}

package/dist/standalone/build.d.ts

@@ -0,0 +1,25 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+export interface CommandResult {
+    status: number | null;
+    stderr: string;
+    /** The program itself was not found. */
+    missing?: boolean;
+}
+export type CommandRunner = (command: string, args: string[], options: {
+    cwd: string;
+    env: Record<string, string | undefined>;
+}) => CommandResult;
+export interface StandaloneBuildOptions {
+    root: string;
+    /** Defaults to every arch in the manifest. */
+    arches?: NativeArchFamily[];
+    /** Defaults to `<root>/dist`. */
+    outDir?: string;
+    run?: CommandRunner;
+}
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export declare const runCommand: CommandRunner;
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
+    outputs: string[];
+}>;