@synopackageland/cli 0.3.9 → 0.4.0

package/dist/standalone/build.js

@@ -0,0 +1,108 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkCgiBinary } from "./binary.js";
+import { loadStandaloneManifest } from "./manifest.js";
+import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
+import { buildHelper } from "./helper.js";
+const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export const runCommand = (command, args, options) => {
+    const result = spawnSync(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["ignore", "inherit", "pipe"],
+        encoding: "utf8",
+    });
+    if (result.stderr) {
+        process.stderr.write(result.stderr);
+    }
+    const missing = result.error?.code === "ENOENT";
+    return { status: result.status, stderr: result.stderr ?? "", missing };
+};
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export async function buildStandalone(options) {
+    const loaded = loadStandaloneManifest(options.root);
+    if (!loaded.ok) {
+        const [first] = loaded.errors;
+        throw new StandaloneBuildError(first.code, loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"));
+    }
+    const manifest = loaded.manifest;
+    const run = options.run ?? runCommand;
+    const arches = options.arches ?? manifest.arches;
+    for (const arch of arches) {
+        if (!manifest.arches.includes(arch)) {
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+        }
+    }
+    buildUi(manifest, run);
+    if (manifest.integration?.identity === "better-auth") {
+        const result = run("npm", ["run", "build"], { cwd: join(manifest.root, "node"), env: { ...process.env } });
+        if (result.missing || result.status !== 0)
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_BUILD_FAILED", `Optional Better Auth build failed.\n${result.stderr}`);
+    }
+    const outDir = options.outDir ?? join(options.root, "dist");
+    const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
+    try {
+        const outputs = [];
+        for (const arch of arches) {
+            const helper = buildHelper(manifest, arch, work, run);
+            if (helper) {
+                const problem = checkCgiBinary(work, helper.binary, arch);
+                if (problem)
+                    throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const cgiPath = backendFor(manifest, arch, work, run, helper);
+            const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
+            if (problem) {
+                throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const builtManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper });
+            outputs.push(outputPath);
+        }
+        return { outputs };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+function buildUi(manifest, run) {
+    const build = manifest.ui.build;
+    if (!build) {
+        return;
+    }
+    const [command, ...args] = build.command;
+    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
+    if (result.missing || result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。\n${result.stderr}`);
+    }
+}
+function backendFor(manifest, arch, work, run, helper) {
+    const backend = manifest.backend;
+    if (backend.kind === "binary") {
+        return backend.files[arch];
+    }
+    const out = join(work, `api-${arch}.cgi`);
+    const ldflags = [
+        "-s",
+        "-w",
+        "-buildid=",
+        `-X main.packageID=${manifest.package}`,
+        `-X main.version=${manifest.spkVersion}`,
+        ...(helper ? [`-X 'main.helperInventory=${JSON.stringify(helper.inventory)}'`] : []),
+    ].join(" ");
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+        cwd: backend.dir,
+        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+    });
+    if (result.missing) {
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.24 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
+    }
+    if (result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);
+    }
+    return out;
+}

package/dist/standalone/dsm-window.d.ts

@@ -0,0 +1,26 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
+export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+export declare function cgiUrl(packageId: string): string;
+/**
+ * `createI18n(dsmLang, catalogs)` → `{ locale, t }`, plain ES5 so it runs in
+ * DSM's desktop as is. The DSM language picks a shipped catalog (else
+ * English); missing keys fall back to English, then to the key itself.
+ * `t(key, { count })` looks up `key.one` / `key.other` via Intl.PluralRules.
+ */
+export declare const I18N_RUNTIME: string;
+/**
+ * The wrapper file name carries the build so DSM never serves a wrapper
+ * cached from the previous version after an upgrade.
+ */
+export declare function windowScriptName(manifest: StandaloneManifest): string;
+/** `ui/config`: registers the DSM main-menu app and its window class. */
+export declare function renderUiConfig(manifest: StandaloneManifest): string;
+/**
+ * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
+ * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
+ * `assetVersion` busts browser caches when the UI changes.
+ */
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string): string;

package/dist/standalone/dsm-window.js

@@ -0,0 +1,251 @@
+import { DSM_LANGS } from "./i18n.js";
+import { ROOT_MESSAGES } from "./root-messages.js";
+import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+/** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
+export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+export function cgiUrl(packageId) {
+    return `/webman/3rdparty/${packageId}/cgi/api.cgi`;
+}
+const LOCALE_BY_DSM_LANG = Object.fromEntries(Object.entries(DSM_LANGS).map(([locale, lang]) => [lang, locale]));
+/**
+ * `createI18n(dsmLang, catalogs)` → `{ locale, t }`, plain ES5 so it runs in
+ * DSM's desktop as is. The DSM language picks a shipped catalog (else
+ * English); missing keys fall back to English, then to the key itself.
+ * `t(key, { count })` looks up `key.one` / `key.other` via Intl.PluralRules.
+ */
+export const I18N_RUNTIME = `function createI18n(dsmLang, catalogs) {
+  var byLang = ${JSON.stringify(LOCALE_BY_DSM_LANG)};
+  var has = function (object, key) { return Object.prototype.hasOwnProperty.call(object, key); };
+  var wanted = has(byLang, dsmLang) ? byLang[dsmLang] : "en";
+  var locale = has(catalogs, wanted) ? wanted : "en";
+  var own = catalogs[locale] || {};
+  var en = catalogs.en || {};
+  var plural = typeof Intl !== "undefined" && Intl.PluralRules ? new Intl.PluralRules(locale) : null;
+  function lookup(key) {
+    return has(own, key) ? own[key] : has(en, key) ? en[key] : undefined;
+  }
+  function t(key, params) {
+    var text = lookup(key);
+    if (text === undefined && params && typeof params.count === "number") {
+      var form = plural ? plural.select(params.count) : params.count === 1 ? "one" : "other";
+      text = lookup(key + "." + form);
+      if (text === undefined) text = lookup(key + ".other");
+    }
+    if (text === undefined) return key;
+    return text.replace(/\\{(\\w+)\\}/g, function (match, name) {
+      return params && has(params, name) ? String(params[name]) : match;
+    });
+  }
+  return { locale: locale, t: t };
+}`;
+/**
+ * The wrapper file name carries the build so DSM never serves a wrapper
+ * cached from the previous version after an upgrade.
+ */
+export function windowScriptName(manifest) {
+    return `window-${String(manifest.build).padStart(4, "0")}.js`;
+}
+/** `ui/config`: registers the DSM main-menu app and its window class. */
+export function renderUiConfig(manifest) {
+    const ns = `SYNO.SDS.${manifest.package}`;
+    return `${JSON.stringify({
+        [windowScriptName(manifest)]: {
+            [`${ns}.Instance`]: {
+                type: "app",
+                title: manifest.displayname,
+                desc: manifest.description,
+                icon: "images/app_{0}.png",
+                appWindow: `${ns}.MainWindow`,
+                allowMultiInstance: false,
+                allUsers: true,
+                depend: [`${ns}.MainWindow`],
+            },
+            [`${ns}.MainWindow`]: {
+                type: "lib",
+                title: manifest.displayname,
+                icon: "images/app_{0}.png",
+                depend: [],
+            },
+        },
+    }, null, 2)}\n`;
+}
+/**
+ * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
+ * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
+ * `assetVersion` busts browser caches when the UI changes.
+ */
+export function renderWindowScript(manifest, assetVersion) {
+    const pkg = manifest.package;
+    const ns = `SYNO.SDS.${pkg}`;
+    const p = JSON.stringify(pkg);
+    const root = manifest.rootOps ? renderRootParts(ns, manifest) : undefined;
+    return `/* Generated by synopkgland build-spk. Edit your UI in the project's ui folder. */
+Ext.ns(${JSON.stringify(ns)});
+
+${ns}.call = function (method, params) {
+  var headers = { "Content-Type": "application/json" };
+  var token = SYNO.SDS.Session && SYNO.SDS.Session.SynoToken;
+  if (token) {
+    headers["X-SYNO-TOKEN"] = token;
+  }
+  return fetch(${JSON.stringify(cgiUrl(pkg))}, {
+    method: "POST",
+    credentials: "same-origin",
+    headers: headers,
+    body: JSON.stringify({ method: method, params: params || {} })
+  }).then(function (response) {
+    return response.json().catch(function () {
+      return { success: false, error: { code: "bad_response", message: "HTTP " + response.status } };
+    });
+  }, function () {
+    return { success: false, error: { code: "network", message: "The NAS did not answer" } };
+  }).then(function (body) {
+    if (body && body.success === true) {
+      return body.data;
+    }
+    throw (body && body.error) || { code: "bad_response", message: "Unexpected response" };
+  });
+};
+
+${ns}.messages = ${JSON.stringify(manifest.i18n?.catalogs ?? { en: {} })};
+${ns}.createI18n = (function () {
+${I18N_RUNTIME}
+  return createI18n;
+})();
+
+${root ? root.definitions : ""}${ns}.loadApp = function (done) {
+  var apps = window.DsmPackageApps || {};
+  if (apps[${p}]) {
+    done(apps[${p}]);
+    return;
+  }
+  var base = "webman/3rdparty/${pkg}/app/";
+  var css = document.createElement("link");
+  css.rel = "stylesheet";
+  css.href = base + "app.css?v=${assetVersion}";
+  document.head.appendChild(css);
+  var js = document.createElement("script");
+  js.src = base + "app.js?v=${assetVersion}";
+  js.dataset.package = ${p};
+  js.onload = function () { done((window.DsmPackageApps || {})[${p}]); };
+  document.head.appendChild(js);
+};
+
+Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
+  extend: "SYNO.SDS.AppInstance",
+  appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
+});
+
+Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
+  extend: "SYNO.SDS.AppWindow",
+  constructor: function (config) {
+    this.callParent([Ext.apply({
+      width: 960, height: 640, minWidth: 640, minHeight: 420, layout: "fit",
+      ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
+    }, config)]);
+  },
+  onOpen: function () {
+    this.callParent(arguments);
+    var me = this;
+    if (me.mounted) {
+      me.reopenHandlers.forEach(function (fn) { fn(); });
+      return;
+    }
+    me.reopenHandlers = [];
+    var lang = typeof _S === "function" ? _S("lang") : "enu";
+${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
+      var root = me.body && me.body.dom.querySelector(".dsmapp-root");
+      if (app && root && !me.mounted) {
+        var i18n = ${ns}.createI18n(lang, ${ns}.messages);
+        root.lang = i18n.locale;
+        me.mounted = app.mount(root, {
+          call: ${ns}.call,
+          reopen: function (fn) { me.reopenHandlers.push(fn); },
+          appWindow: me,
+          lang: lang,
+          locale: i18n.locale,
+          t: i18n.t${root ? ",\n          root: access" : ""}
+        }) || {};
+      }
+    });
+  },
+  onDestroy: function () {
+    if (this.mounted && this.mounted.unmount) {
+      this.mounted.unmount();
+    }
+    this.mounted = null;
+    this.callParent(arguments);
+  }
+});
+`;
+}
+const ROOT_PANEL_CSS = [
+    ".dsmapp-rootpanel{margin:16px 20px;padding:12px 16px;border:1px solid #d5dce5;border-radius:4px;background:#f7f9fb;font-size:13px;line-height:1.5}",
+    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}",
+    ".dsmapp-rootpanel dl{display:grid;grid-template-columns:max-content 1fr;gap:2px 12px;margin:8px 0}",
+    ".dsmapp-rootpanel dt{color:#526070}.dsmapp-rootpanel dd{margin:0}",
+    ".dsmapp-rootpanel pre{margin:4px 0 8px;padding:6px 8px;background:#fff;border:1px solid #e1e6ec;white-space:pre-wrap;max-height:160px;overflow:auto}",
+    ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
+    ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
+    ".dsmapp-rootpanel-message{color:#c0392b}.dsmapp-rootpanel-hint{color:#526070;font-size:12px}",
+].join("");
+/**
+ * The privilege: root additions to the window: the exact tasks and panel
+ * text, the access runtime wired to DSM's own password confirmation and the
+ * AppWindow's WebAPI channel, and the panel above the app.
+ */
+function renderRootParts(ns, manifest) {
+    return {
+        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest))};
+${ns}.rootMessages = ${JSON.stringify(ROOT_MESSAGES)};
+${ns}.createRootAccess = (function () {
+${ROOT_RUNTIME}
+  return createRootAccess;
+})();
+${ns}.mountRootPanel = (function () {
+${ROOT_PANEL}
+  return mountRootPanel;
+})();
+
+`,
+        html: `autoScroll: true,
+      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div>'`,
+        mount: `    var session = function () {
+      var current = SYNO.SDS.Session || {};
+      return { name: current.user, admin: current.is_admin === true };
+    };
+    var access = ${ns}.createRootAccess({
+      tasks: ${ns}.rootTasks,
+      user: session,
+      send: function (api, method, version, params) {
+        return new Promise(function (resolve, reject) {
+          me.sendWebAPI({
+            api: api, method: method, version: version, params: params, scope: me,
+            callback: function (success, response) {
+              if (success) resolve(response);
+              else reject({ code: "dsm_" + ((response && response.code) || "error") });
+            }
+          });
+        });
+      },
+      confirmPassword: function () {
+        return new Promise(function (resolve) {
+          SYNO.SDS.Utils.PasswordConfirmDialog.openDialog(me, function (confirmation) {
+            resolve((confirmation && confirmation.SynoConfirmPWToken) || null);
+          }, [], function () { resolve(null); });
+        });
+      },
+      call: ${ns}.call,
+      wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
+    });
+    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
+    if (panels) {
+      var rootI18n = ${ns}.createI18n(lang, ${ns}.rootMessages);
+      panels.lang = rootI18n.locale;
+      ${ns}.mountRootPanel(panels, access, rootI18n, ${ns}.rootTasks, session().admin);
+    }
+`,
+    };
+}

package/dist/standalone/helper.d.ts

@@ -0,0 +1,31 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneError, StandaloneManifest } from "./manifest.js";
+import { type RootOp } from "./root-ops.js";
+export interface Integration {
+    protocol: number;
+    workers: Record<string, string>;
+    identity?: "better-auth";
+}
+export interface HelperInventory {
+    package: string;
+    version: string;
+    protocol: number;
+    payloadDigest: string;
+    registryDigest: string;
+}
+export interface WorkerPayload {
+    id: string;
+    digest: string;
+    bytes: Buffer;
+}
+export interface HelperArtifact {
+    binary: string;
+    inventory: HelperInventory;
+    workers: WorkerPayload[];
+    ops: RootOp[];
+}
+export declare function readIntegration(raw: unknown, root: string, fail: (e: StandaloneError) => void): Integration | undefined;
+export declare function assertHelperTaskBudget(script: string, metadata?: string): void;
+export declare function helperOps(m: StandaloneManifest, inventory: HelperInventory): RootOp[];
+export declare function buildHelper(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): HelperArtifact | undefined;

package/dist/standalone/helper.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { renderRootTaskScript } from "./root-ops.js";
+import { StandaloneBuildError } from "./spk.js";
+const sha256 = (b) => createHash("sha256").update(b).digest("hex");
+const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export function readIntegration(raw, root, fail) {
+    if (raw === undefined)
+        return undefined;
+    const invalid = () => { fail({ code: "STANDALONE_INTEGRATION_INVALID", message: "integration 需要 protocol: 1 與 workers: {固定 ID: 專案內檔案}；最多 16 個，僅作 inventory，不執行 worker。" }); return undefined; };
+    if (!record(raw) || Object.keys(raw).some(k => !["protocol", "workers", "identity"].includes(k)) || raw.protocol !== 1 || !record(raw.workers) || Object.keys(raw.workers).length > 16)
+        return invalid();
+    if (raw.identity !== undefined && raw.identity !== "better-auth")
+        return invalid();
+    const workers = {};
+    for (const [id, file] of Object.entries(raw.workers)) {
+        if (!/^[a-z][a-z0-9_]{0,31}$/.test(id) || typeof file !== "string" || !file || isAbsolute(file) || file.split(/[\\/]/).includes(".."))
+            return invalid();
+        const path = resolve(root, file), rel = relative(root, path);
+        if (rel.startsWith("..") || isAbsolute(rel))
+            return invalid();
+        workers[id] = path;
+    }
+    return { protocol: 1, workers, ...(raw.identity === "better-auth" ? { identity: "better-auth" } : {}) };
+}
+function snapshotWorkers(m) {
+    let total = 0;
+    return Object.entries(m.integration.workers).sort(([a], [b]) => a.localeCompare(b, "en")).map(([id, path]) => {
+        const rel = relative(realpathSync(m.root), realpathSync(path));
+        if (rel.startsWith("..") || isAbsolute(rel) || !lstatSync(path).isFile())
+            throw new StandaloneBuildError("HELPER_WORKER_UNSAFE", `${id} 必須是專案內的一般檔案，不接受 symlink。`);
+        const bytes = readFileSync(path);
+        total += bytes.length;
+        if (total > 1024 * 1024)
+            throw new StandaloneBuildError("HELPER_WORKERS_TOO_LARGE", "worker inventory payload 合計不可超過 1 MiB。");
+        return { id, digest: sha256(bytes), bytes };
+    });
+}
+export function assertHelperTaskBudget(script, metadata = JSON.stringify({ script })) {
+    if (Buffer.byteLength(script) > 4095)
+        throw new StandaloneBuildError("HELPER_TASK_TOO_LARGE", "helper task 超過 DSM 文件的 4095 bytes 保守限制。");
+    if (Buffer.byteLength(metadata) > 8191)
+        throw new StandaloneBuildError("HELPER_METADATA_TOO_LARGE", "helper scheduler metadata 超過 8191 bytes 有界限制。");
+}
+export function helperOps(m, inventory) {
+    return ["enable", "recover", "teardown", "disable"].map(action => {
+        const op = { name: `helper_${action}`, protectedOutput: true, body: `#!/bin/sh
+set -eu
+umask 077
+[ "$(id -u)" = 0 ]
+# Verify the installed version as well as the window's exact-script check.
+info=/var/packages/${m.package}/INFO
+[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
+grep -Fqx 'version="${m.spkVersion}"' "$info"
+for p in /var/lib /run; do
+  [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
+  mode=$(stat -c %a "$p")
+  [ "$((0$mode & 0022))" = 0 ]
+done
+s=/var/lib/synopkgland-${m.package}
+r=/run/synopkgland-helper-${m.package}
+for p in "$s" "$r"; do
+  [ ! -L "$p" ]
+  if [ ! -e "$p" ]; then mkdir -m 0755 "$p"; fi
+  [ -d "$p" ] && [ "$(stat -c %u:%a "$p")" = 0:755 ]
+done
+# Copy into a root-owned private file FIRST, then verify the copied bytes.
+# The package may change its source during copy; no unverified byte executes.
+tmp=$(mktemp "$s/.payload.XXXXXX")
+trap 'rm -f "$tmp"' EXIT HUP INT TERM
+dd if=/var/packages/${m.package}/target/integration/helper of="$tmp" bs=65536 count=1025 2>/dev/null
+[ "$(stat -c %s "$tmp")" -le 67108864 ]
+chmod 0700 "$tmp"
+[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${inventory.payloadDigest}' ]
+exe="$s/payload-${inventory.payloadDigest}"
+# Rename only inside the protected directory. Existing executable mappings
+# retain their inode and digest until the controller has verified teardown.
+mv -f "$tmp" "$exe"
+trap - EXIT HUP INT TERM
+exec "$exe" ${action}
+` };
+        const script = renderRootTaskScript(m, op);
+        assertHelperTaskBudget(script, JSON.stringify({ name: `${m.package} root: ${op.name}`, script, owner: "root", enable: false }));
+        return op;
+    });
+}
+export function buildHelper(m, arch, work, run) {
+    if (!m.integration)
+        return undefined;
+    if (m.backend.kind !== "go")
+        throw new StandaloneBuildError("HELPER_GO_REQUIRED", "M1a integration 僅支援 native-go。");
+    const workers = snapshotWorkers(m);
+    const registry = workers.map(({ id, digest }) => ({ id, digest }));
+    const base = { package: m.package, version: m.spkVersion, protocol: m.integration.protocol, payloadDigest: "", registryDigest: sha256(JSON.stringify(registry)) };
+    const binary = join(work, `helper-${arch}`);
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", `-s -w -buildid= -X 'main.helperInventory=${JSON.stringify(base)}'`, "-o", binary, "./cmd/helper"], {
+        cwd: m.backend.dir, env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+    });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError("HELPER_BUILD_FAILED", `Go helper build 失敗：${result.stderr}`);
+    const inventory = { ...base, payloadDigest: sha256(readFileSync(binary)) };
+    return { binary, inventory, workers, ops: helperOps(m, inventory) };
+}

package/dist/standalone/i18n.d.ts

@@ -0,0 +1,28 @@
+import type { StandaloneError } from "./manifest.js";
+/**
+ * UI languages a Standalone Package can ship, as BCP-47 tags (the catalog
+ * file names and the `Intl` locale), with the DSM language code each one
+ * answers to. Every other DSM language opens the app in English.
+ */
+export declare const LOCALES: readonly ["en", "zh-TW", "zh-CN", "ja", "ko", "de", "fr", "es", "it"];
+export type Locale = (typeof LOCALES)[number];
+export declare const DSM_LANGS: Record<Locale, string>;
+export type Catalog = Record<string, string>;
+export type Catalogs = {
+    en: Catalog;
+} & Partial<Record<Locale, Catalog>>;
+export type CatalogsResult = {
+    ok: true;
+    catalogs: Catalogs;
+} | {
+    ok: false;
+    errors: StandaloneError[];
+};
+export declare function isLocale(value: string): value is Locale;
+/** `<dir>/<locale>.json` for each shipped locale; en.json is required. */
+export declare function loadCatalogs(dir: string): CatalogsResult;
+/**
+ * Each glossary term lists the message keys that must use it: in every
+ * shipped locale the message has to contain that locale's official term.
+ */
+export declare function checkGlossary(file: string, catalogs: Catalogs): StandaloneError[];