@synopackageland/cli 0.5.0 → 0.6.0

package/dist/native/load.js

@@ -1,11 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { parseDocument } from "yaml";
-export function loadNative(nativePath) {
-    if (!existsSync(nativePath)) {
-        return null;
-    }
-    const source = readFileSync(nativePath, "utf8");
-    const doc = parseDocument(source);
-    const native = (doc.toJSON() ?? {});
-    return { native, source, doc };
-}

package/dist/native/types.d.ts

@@ -1,28 +0,0 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
-/** One target's binary source. `path` is Personal-only; Curated needs `url` + `sha256`. */
-export interface NativeTarget {
-    path?: string;
-    url?: string;
-    sha256?: string;
-    strip_components?: number;
-}
-/**
- * The single service process a native App runs. `exec` is relative to
- * SYNOPKG_PKGDEST, which N0 proved is the payload root itself. There is no
- * `user:` field: DSM creates the package user at install time and already owns
- * SYNOPKG_PKGVAR, so generated scripts neither create a user nor chown.
- */
-export interface NativeService {
-    exec: string;
-    args?: string[];
-    env?: Record<string, string>;
-}
-/** Parsed `native.yaml`. Schema 1 only; unknown or higher versions are refused. */
-export interface NativeConfig {
-    schema: number;
-    targets: Partial<Record<NativeArchFamily, NativeTarget>>;
-    service: NativeService;
-}
-export declare const NATIVE_FILENAME = "native.yaml";
-/** Data written into SYNOPKG_PKGVAR survives upgrades; `target/` is replaced wholesale. */
-export declare const PKGVAR_PLACEHOLDER = "${SYNOPKG_PKGVAR}";

package/dist/native/types.js

@@ -1,3 +0,0 @@
-export const NATIVE_FILENAME = "native.yaml";
-/** Data written into SYNOPKG_PKGVAR survives upgrades; `target/` is replaced wholesale. */
-export const PKGVAR_PLACEHOLDER = "${SYNOPKG_PKGVAR}";

package/dist/native/validate.d.ts

@@ -1,6 +0,0 @@
-import type { ValidationError } from "../types.js";
-import type { ParsedNative } from "./load.js";
-export interface NativeValidationOptions {
-    profile?: "personal" | "listing";
-}
-export declare function validateNative(parsed: ParsedNative, nativeFile: string, options?: NativeValidationOptions): ValidationError[];

package/dist/native/validate.js

@@ -1,143 +0,0 @@
-import { makeError } from "../errors.js";
-import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
-import { PKGVAR_PLACEHOLDER } from "./types.js";
-import { getValuePosition } from "../contract/load.js";
-function nativeSpan(file, doc, pathSegments, pathString) {
-    const dotPath = pathString ?? pathSegments.join(".");
-    if (!doc) {
-        return { file, line: 1, column: 1, path: dotPath };
-    }
-    const pos = getValuePosition(doc, pathSegments) ?? { line: 1, column: 1 };
-    return { file, line: pos.line, column: pos.column, path: dotPath };
-}
-const HEX64_REGEX = /^[0-9a-fA-F]{64}$/;
-export function validateNative(parsed, nativeFile, options = {}) {
-    const errors = [];
-    const profile = options.profile ?? "personal";
-    const { native, doc } = parsed;
-    const rawObj = (native && typeof native === "object" ? native : {});
-    // 1. schema 必須是整數且只接受 1。未知或更高值 → 拒絕，不靜默降級。
-    if (typeof native.schema !== "number" || !Number.isInteger(native.schema) || native.schema !== 1) {
-        errors.push(makeError("NATIVE_SCHEMA_INVALID", nativeSpan(nativeFile, doc, ["schema"]), `native.yaml schema 必須是整數且只接受 1，收到 ${JSON.stringify(native.schema)}。`, "請將 schema 設定為 1。"));
-    }
-    // 3. targets 的 key 只接受 x86_64、aarch64，至少要有一個。其他 key → 拒絕。
-    const targets = rawObj.targets;
-    if (!targets || typeof targets !== "object" || Array.isArray(targets)) {
-        errors.push(makeError("NATIVE_TARGETS_REQUIRED", nativeSpan(nativeFile, doc, ["targets"]), "native.yaml 必須包含 targets 物件，且至少宣告一個架構（x86_64 或 aarch64）。", "請在 targets 底下宣告 x86_64 或 aarch64 的 binary 來源。"));
-    }
-    else {
-        const targetEntries = Object.entries(targets);
-        if (targetEntries.length === 0) {
-            errors.push(makeError("NATIVE_TARGETS_EMPTY", nativeSpan(nativeFile, doc, ["targets"]), "targets 不得為空，至少要宣告一個架構（x86_64 或 aarch64）。", "請在 targets 底下宣告 x86_64 或 aarch64 的 binary 來源。"));
-        }
-        for (const [archKey, targetVal] of targetEntries) {
-            if (!isNativeArchFamily(archKey)) {
-                errors.push(makeError("NATIVE_ARCH_UNKNOWN", nativeSpan(nativeFile, doc, ["targets", archKey]), `不支援的架構「${archKey}」，targets 的 key 只接受 x86_64 或 aarch64。`, "請將 targets 的 key 改為 x86_64 或 aarch64。"));
-                continue;
-            }
-            if (!targetVal || typeof targetVal !== "object" || Array.isArray(targetVal)) {
-                errors.push(makeError("NATIVE_TARGET_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey]), `targets.${archKey} 必須是物件。`, "請指定 path 或 url 及 sha256。"));
-                continue;
-            }
-            const targetObj = targetVal;
-            const hasPath = typeof targetObj.path === "string" && targetObj.path.trim().length > 0;
-            const hasUrl = typeof targetObj.url === "string" && targetObj.url.trim().length > 0;
-            // 4. 每個 target 必須恰好有 path: 或 url: 之一。
-            if ((hasPath && hasUrl) || (!hasPath && !hasUrl)) {
-                errors.push(makeError("NATIVE_TARGET_SOURCE_EXCLUSIVE", nativeSpan(nativeFile, doc, ["targets", archKey]), `targets.${archKey} 必須恰好有 path 或 url 之一。`, "請只提供 path（本機開發）或 url（發佈）。"));
-            }
-            // 5. path: 只在 personal profile 合法。listing profile 只接受 url: ＋ sha256:（url 沒有 sha256 也要拒絕）。
-            if (profile === "listing") {
-                if (hasPath) {
-                    errors.push(makeError("NATIVE_PATH_FORBIDDEN_IN_LISTING", nativeSpan(nativeFile, doc, ["targets", archKey, "path"]), `Listing profile 不允許使用 path（targets.${archKey}.path），只接受 url ＋ sha256。`, "請在 targets 中改用 url 與 sha256 指向上游 release asset。"));
-                }
-                if (hasUrl && (!targetObj.sha256 || typeof targetObj.sha256 !== "string" || targetObj.sha256.trim() === "")) {
-                    errors.push(makeError("NATIVE_SHA256_REQUIRED_IN_LISTING", nativeSpan(nativeFile, doc, ["targets", archKey]), `Listing profile 的 targets.${archKey} 必須包含 sha256。`, "請提供 64 位元 SHA-256 雜湊值。"));
-                }
-            }
-            // 6. sha256 給了就必須是 64 個 hex 字元（大小寫都收，比對時 normalize 成小寫）。
-            if (targetObj.sha256 !== undefined) {
-                if (typeof targetObj.sha256 !== "string" || !HEX64_REGEX.test(targetObj.sha256)) {
-                    errors.push(makeError("NATIVE_SHA256_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey, "sha256"]), `targets.${archKey}.sha256 必須是 64 個十六進位字元 (hex)。`, "請提供有效的 64 位元 SHA-256 hex 字串。"));
-                }
-            }
-            // 7. strip_components 給了必須是 >= 0 的整數。
-            if (targetObj.strip_components !== undefined) {
-                if (typeof targetObj.strip_components !== "number" ||
-                    !Number.isInteger(targetObj.strip_components) ||
-                    targetObj.strip_components < 0) {
-                    errors.push(makeError("NATIVE_STRIP_COMPONENTS_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey, "strip_components"]), `targets.${archKey}.strip_components 必須是 >= 0 的整數。`, "請提供大於或等於 0 的整數值。"));
-                }
-            }
-        }
-    }
-    // service 檢查
-    const service = rawObj.service;
-    if (!service || typeof service !== "object" || Array.isArray(service)) {
-        errors.push(makeError("NATIVE_SERVICE_REQUIRED", nativeSpan(nativeFile, doc, ["service"]), "native.yaml 必須包含 service 定義。", "請在 native.yaml 新增 service 區塊，包含 exec、args 與 env。"));
-        return errors;
-    }
-    const serviceObj = service;
-    // 10 & 11. service 禁止的欄位：user (規則10) 以及 shell 字串欄位 command, pre_start, post_start, shell 等 (規則11)
-    if ("user" in serviceObj) {
-        errors.push(makeError("NATIVE_SERVICE_USER_FORBIDDEN", nativeSpan(nativeFile, doc, ["service", "user"]), "service 不允許包含 user 欄位（DSM 在安裝時會自動建立並管理 package user）。", "請移除 service.user 欄位。"));
-    }
-    for (const forbiddenField of ["command", "pre_start", "post_start", "shell"]) {
-        if (forbiddenField in serviceObj) {
-            errors.push(makeError("NATIVE_SERVICE_SHELL_FIELD_FORBIDDEN", nativeSpan(nativeFile, doc, ["service", forbiddenField]), `service 不允許包含 shell 欄位「${forbiddenField}」，執行設定請使用 exec 與 args。`, `請移除 service.${forbiddenField}，改用 exec 與 args。`));
-        }
-    }
-    // 9. service.exec 必填、必須是相對路徑：不接受絕對路徑、不接受任何 .. path segment、不接受空字串。
-    const exec = serviceObj.exec;
-    if (typeof exec !== "string" || exec.trim() === "") {
-        errors.push(makeError("NATIVE_EXEC_REQUIRED", nativeSpan(nativeFile, doc, ["service", "exec"]), "service.exec 為必填項目，且不可為空字串。", "請提供相對於 package 根目錄的可執行檔路徑（例如 Radarr 或 bin/my-app）。"));
-    }
-    else {
-        const trimmedExec = exec.trim();
-        const segments = trimmedExec.split(/[/\\]/);
-        if (trimmedExec.startsWith("/") || trimmedExec.startsWith("\\") || segments.some((s) => s === "..")) {
-            errors.push(makeError("NATIVE_EXEC_INVALID_PATH", nativeSpan(nativeFile, doc, ["service", "exec"]), `service.exec「${exec}」必須是相對路徑，不可為絕對路徑或包含「..」路徑區段。`, "請使用純相對路徑（例如 Radarr 或 bin/app），不得以 / 開頭或包含 ..。"));
-        }
-    }
-    // 11. args 必須是字串 array
-    let argsValid = true;
-    if (serviceObj.args !== undefined) {
-        if (!Array.isArray(serviceObj.args) || !serviceObj.args.every((item) => typeof item === "string")) {
-            argsValid = false;
-            errors.push(makeError("NATIVE_ARGS_INVALID", nativeSpan(nativeFile, doc, ["service", "args"]), "service.args 必須是字串陣列（string[]）。", "請將 args 定義為字串清單，例如 [\"--config\", \"${SYNOPKG_PKGVAR}/config.yaml\"]。"));
-        }
-    }
-    // 12. env 必須是 string→string 的 map。
-    let envValid = true;
-    if (serviceObj.env !== undefined) {
-        if (!serviceObj.env ||
-            typeof serviceObj.env !== "object" ||
-            Array.isArray(serviceObj.env) ||
-            !Object.values(serviceObj.env).every((val) => typeof val === "string")) {
-            envValid = false;
-            errors.push(makeError("NATIVE_ENV_INVALID", nativeSpan(nativeFile, doc, ["service", "env"]), "service.env 必須是 string 到 string 的 key-value map。", "請確認 service.env 中每個環境變數的值皆為字串。"));
-        }
-    }
-    // 8. service.args 或 service.env 至少要出現一次 ${SYNOPKG_PKGVAR}，否則拒絕。用 PKGVAR_PLACEHOLDER 常數比對。
-    let hasPkgvarPlaceholder = false;
-    if (argsValid && Array.isArray(serviceObj.args)) {
-        for (const arg of serviceObj.args) {
-            if (typeof arg === "string" && arg.includes(PKGVAR_PLACEHOLDER)) {
-                hasPkgvarPlaceholder = true;
-                break;
-            }
-        }
-    }
-    if (!hasPkgvarPlaceholder && envValid && serviceObj.env && typeof serviceObj.env === "object" && !Array.isArray(serviceObj.env)) {
-        for (const val of Object.values(serviceObj.env)) {
-            if (typeof val === "string" && val.includes(PKGVAR_PLACEHOLDER)) {
-                hasPkgvarPlaceholder = true;
-                break;
-            }
-        }
-    }
-    if (!hasPkgvarPlaceholder) {
-        errors.push(makeError("NATIVE_PKGVAR_REQUIRED", nativeSpan(nativeFile, doc, ["service"]), `service.args 或 service.env 必須至少包含一次「${PKGVAR_PLACEHOLDER}」，以確保資料寫入持久化目錄。`, `請在 service.args 或 service.env 中傳入 ${PKGVAR_PLACEHOLDER}（例如 -data=\${SYNOPKG_PKGVAR} 或 TMPDIR: \${SYNOPKG_PKGVAR}/tmp）。`));
-    }
-    return errors;
-}

package/dist/standalone/helper-inventory.d.ts

@@ -1,31 +0,0 @@
-import type { SDKWorkerConfig } from "./worker-registry.js";
-export type DataAccessMode = "unavailable" | "relaxed";
-export interface Integration {
-    protocol: 1 | 2;
-    workers: Record<string, string>;
-    identity?: "better-auth";
-    dataAccess?: DataAccessMode;
-    sdkWorkers?: Record<string, SDKWorkerConfig>;
-}
-export interface HelperInventory {
-    package: string;
-    version: string;
-    protocol: number;
-    payloadDigest: string;
-    registryDigest: string;
-    dataAccess?: DataAccessMode;
-}
-/**
- * The privileged helper exists only for an integration that also declares
- * privilege: root. Without it, integration is package-account only.
- */
-export declare const hasHelper: (m: {
-    integration?: unknown;
-    privilege?: "none" | "root";
-}) => boolean;
-export declare const sha256: (b: string | Buffer) => string;
-/** Preserve the original inert inventory byte format, including property order. */
-export declare function inertWorkerRegistry(workers: readonly {
-    id: string;
-    digest: string;
-}[]): string;

package/dist/standalone/helper-inventory.js

@@ -1,11 +0,0 @@
-import { createHash } from "node:crypto";
-/**
- * The privileged helper exists only for an integration that also declares
- * privilege: root. Without it, integration is package-account only.
- */
-export const hasHelper = (m) => m.integration !== undefined && m.privilege === "root";
-export const sha256 = (b) => createHash("sha256").update(b).digest("hex");
-/** Preserve the original inert inventory byte format, including property order. */
-export function inertWorkerRegistry(workers) {
-    return JSON.stringify(workers.map(({ id, digest }) => ({ id, digest })));
-}

package/dist/standalone/helper.d.ts

@@ -1,22 +0,0 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
-import type { CommandRunner } from "./build.js";
-import type { StandaloneError, StandaloneManifest } from "./manifest.js";
-import { type RootOp } from "./root-ops.js";
-export type { Integration, HelperInventory } from "./helper-inventory.js";
-import { type Integration, type HelperInventory } from "./helper-inventory.js";
-export interface WorkerPayload {
-    id: string;
-    digest: string;
-    bytes: Buffer;
-}
-export interface HelperArtifact {
-    binary: string;
-    inventory: HelperInventory;
-    workers: WorkerPayload[];
-    registry?: string;
-    ops: RootOp[];
-}
-export declare function readIntegration(raw: unknown, root: string, fail: (e: StandaloneError) => void): Integration | undefined;
-export declare function assertHelperTaskBudget(script: string, metadata?: string): void;
-export declare function helperOps(m: StandaloneManifest, inventory: HelperInventory): RootOp[];
-export declare function buildHelper(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): HelperArtifact | undefined;

package/dist/standalone/helper.js

@@ -1,123 +0,0 @@
-import { lstatSync, readFileSync, realpathSync } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import { renderRootTaskScript } from "./root-ops.js";
-import { StandaloneBuildError } from "./spk.js";
-import { hasHelper, sha256 } from "./helper-inventory.js";
-import { buildWorkerRegistry, parseSDKWorkers } from "./worker-registry.js";
-const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-export function readIntegration(raw, root, fail) {
-    if (raw === undefined)
-        return undefined;
-    const invalid = () => { fail({ code: "STANDALONE_INTEGRATION_INVALID", message: "integration 需要 protocol: 1 或 2 與 inert workers；sdkWorkers 僅接受 protocol 2／relaxed 的固定 SDK kind、action/mode 與較低 limits。總數最多 16，production unavailable。" }); return undefined; };
-    if (!record(raw) || Object.keys(raw).some(k => !["protocol", "workers", "identity", "dataAccess", "sdkWorkers"].includes(k)) || ![1, 2].includes(raw.protocol) || !record(raw.workers) || Object.keys(raw.workers).length > 16)
-        return invalid();
-    if (raw.identity !== undefined && raw.identity !== "better-auth")
-        return invalid();
-    if (raw.dataAccess !== undefined && (raw.protocol !== 2 || !["unavailable", "relaxed"].includes(raw.dataAccess)))
-        return invalid();
-    const workers = {};
-    for (const [id, file] of Object.entries(raw.workers)) {
-        if (!/^[a-z][a-z0-9_]{0,31}$/.test(id) || typeof file !== "string" || !file || isAbsolute(file) || file.split(/[\\/]/).includes(".."))
-            return invalid();
-        const path = resolve(root, file), rel = relative(root, path);
-        if (rel.startsWith("..") || isAbsolute(rel))
-            return invalid();
-        workers[id] = path;
-    }
-    let sdkWorkers;
-    if (Object.hasOwn(raw, "sdkWorkers")) {
-        if (raw.protocol !== 2 || raw.dataAccess !== "relaxed")
-            return invalid();
-        try {
-            sdkWorkers = parseSDKWorkers(raw.sdkWorkers, Object.keys(workers));
-        }
-        catch {
-            return invalid();
-        }
-    }
-    return { protocol: raw.protocol, workers, ...(raw.identity === "better-auth" ? { identity: "better-auth" } : {}), ...(raw.dataAccess !== undefined ? { dataAccess: raw.dataAccess } : {}), ...(sdkWorkers ? { sdkWorkers } : {}) };
-}
-function snapshotWorkers(m) {
-    let total = 0;
-    return Object.entries(m.integration.workers).sort(([a], [b]) => a.localeCompare(b, "en")).map(([id, path]) => {
-        const rel = relative(realpathSync(m.root), realpathSync(path));
-        if (rel.startsWith("..") || isAbsolute(rel) || !lstatSync(path).isFile())
-            throw new StandaloneBuildError("HELPER_WORKER_UNSAFE", `${id} 必須是專案內的一般檔案，不接受 symlink。`);
-        const bytes = readFileSync(path);
-        total += bytes.length;
-        if (total > 1024 * 1024)
-            throw new StandaloneBuildError("HELPER_WORKERS_TOO_LARGE", "worker inventory payload 合計不可超過 1 MiB。");
-        return { id, digest: sha256(bytes), bytes };
-    });
-}
-export function assertHelperTaskBudget(script, metadata = JSON.stringify({ script })) {
-    if (Buffer.byteLength(script) > 4095)
-        throw new StandaloneBuildError("HELPER_TASK_TOO_LARGE", "helper task 超過 DSM 文件的 4095 bytes 保守限制。");
-    if (Buffer.byteLength(metadata) > 8191)
-        throw new StandaloneBuildError("HELPER_METADATA_TOO_LARGE", "helper scheduler metadata 超過 8191 bytes 有界限制。");
-}
-export function helperOps(m, inventory) {
-    return ["enable", "recover", "teardown", "disable", "repair"].map(action => {
-        const op = { name: `helper_${action}`, protectedOutput: true, body: `#!/bin/sh
-set -eu
-umask 077
-[ "$(id -u)" = 0 ]
-# Verify the installed version as well as the window's exact-script check.
-info=/var/packages/${m.package}/INFO
-[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
-grep -Fqx 'version="${m.spkVersion}"' "$info"
-for p in /var/lib /run; do
-  [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
-  mode=$(stat -c %a "$p")
-  [ "$((0$mode & 0022))" = 0 ]
-done
-s=/var/lib/synopkgland-${m.package}
-r=/run/synopkgland-helper-${m.package}
-for p in "$s" "$r"; do
-  [ ! -L "$p" ]
-  if [ ! -e "$p" ]; then mkdir -m 0755 "$p"; fi
-  [ -d "$p" ] && [ "$(stat -c %u:%a "$p")" = 0:755 ]
-done
-# Copy into a root-owned private file FIRST, then verify the copied bytes.
-# The package may change its source during copy; no unverified byte executes.
-tmp=$(mktemp "$s/.payload.XXXXXX")
-trap 'rm -f "$tmp"' EXIT HUP INT TERM
-dd if=/var/packages/${m.package}/target/integration/helper of="$tmp" bs=65536 count=1025 2>/dev/null
-[ "$(stat -c %s "$tmp")" -le 67108864 ]
-chmod 0700 "$tmp"
-[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${inventory.payloadDigest}' ]
-exe="$s/payload-${inventory.payloadDigest}"
-# Rename only inside the protected directory. Existing executable mappings
-# retain their inode and digest until the controller has verified teardown.
-mv -f "$tmp" "$exe"
-trap - EXIT HUP INT TERM
-exec "$exe" ${action}
-` };
-        const script = renderRootTaskScript(m, op);
-        assertHelperTaskBudget(script, JSON.stringify({ name: `${m.package} root: ${op.name}`, script, owner: "root", enable: false }));
-        return op;
-    });
-}
-export function buildHelper(m, arch, work, run) {
-    if (!m.integration || !hasHelper(m))
-        return undefined;
-    if (m.backend.kind !== "go")
-        throw new StandaloneBuildError("HELPER_GO_REQUIRED", "M1a integration 僅支援 native-go。");
-    const workers = snapshotWorkers(m);
-    const registry = buildWorkerRegistry(workers, m.integration.sdkWorkers, m.backend.dir);
-    const base = { package: m.package, version: m.spkVersion, protocol: m.integration.protocol, payloadDigest: "", registryDigest: sha256(registry), ...(m.integration.dataAccess ? { dataAccess: m.integration.dataAccess } : {}) };
-    const binary = join(work, `helper-${arch}`);
-    const sdkFlags = m.integration.sdkWorkers ? ["-tags=synopkgland_sdk_workers"] : [];
-    const sdkBinding = m.integration.sdkWorkers ? ` -X 'main.sdkWorkerRegistry=${registry}'` : "";
-    const result = run("go", ["build", ...sdkFlags, "-trimpath", "-buildvcs=false", "-ldflags", `-s -w -buildid= -X 'main.helperInventory=${JSON.stringify(base)}'${sdkBinding}`, "-o", binary, "./cmd/helper"], {
-        cwd: m.backend.dir, env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
-    });
-    if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError("HELPER_BUILD_FAILED", `Go helper build 失敗：${result.stderr}`);
-    const payload = readFileSync(binary);
-    if (m.integration.sdkWorkers && (!payload.includes(Buffer.from(registry)) || buildWorkerRegistry(workers, m.integration.sdkWorkers, m.backend.dir) !== registry)) {
-        throw new StandaloneBuildError("HELPER_BUILD_FAILED", "compiled SDK registry 缺失或 source 在建置期間變動；請用完整 SDK 模板重新建置。");
-    }
-    const inventory = { ...base, payloadDigest: sha256(payload) };
-    return { binary, inventory, workers, ...(m.integration.sdkWorkers ? { registry } : {}), ops: helperOps(m, inventory) };
-}

package/dist/standalone/inspect-helper.d.ts

@@ -1,6 +0,0 @@
-export interface IntegrationInspection {
-    protocol: 1 | 2;
-    dataAccess: "unavailable" | "relaxed";
-}
-/** Artifact consistency only; bytes, approval and health never certify NAS access. */
-export declare function inspectHelper(dir: string, info: Record<string, string>, findings: string[], daemon?: boolean): Promise<IntegrationInspection | undefined>;

package/dist/standalone/inspect-helper.js

@@ -1,93 +0,0 @@
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import * as tar from "tar";
-import { windowScriptName } from "./dsm-window.js";
-import { helperOps } from "./helper.js";
-import { sha256 } from "./helper-inventory.js";
-import { renderStandaloneScript } from "./lifecycle.js";
-import { rootTasks } from "./root-window.js";
-import { decodeSDKRegistry } from "./worker-registry.js";
-/** Artifact consistency only; bytes, approval and health never certify NAS access. */
-export async function inspectHelper(dir, info, findings, daemon = false) {
-    const files = new Map();
-    const windowPath = `ui/${windowScriptName({ build: Number(info.version?.split("-").at(-1)) })}`;
-    const windows = [];
-    let oversized = false;
-    await tar.t({ file: join(dir, "package.tgz"), onReadEntry(entry) {
-            const path = entry.path.replace(/^\.\//, "");
-            // Enumerate candidates to reject extras; only the INFO-derived exact path is read.
-            if (/^ui\/window-[^/]*\.js$/.test(path))
-                windows.push(path);
-            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
-                return;
-            const limit = ["integration/helper", "ui/cgi/api.cgi"].includes(path) ? 64 * 1024 * 1024 : 1024 * 1024;
-            if (files.has(path) || entry.size > limit) {
-                oversized = true;
-                return;
-            }
-            const chunks = [];
-            let size = 0;
-            entry.on("data", (chunk) => { size += chunk.length; if (size <= limit)
-                chunks.push(chunk);
-            else
-                oversized = true; });
-            entry.on("end", () => files.set(path, Buffer.concat(chunks)));
-        } });
-    try {
-        if (oversized)
-            throw new Error("oversized/duplicate payload");
-        const bytes = (path) => { const b = files.get(path); if (!b)
-            throw new Error(`missing ${path}`); return b; };
-        const raw = bytes("integration/inventory.json").toString("utf8");
-        const i = JSON.parse(raw);
-        const keys = i.dataAccess === undefined ? "package,payloadDigest,protocol,registryDigest,version" : "dataAccess,package,payloadDigest,protocol,registryDigest,version";
-        if (Object.keys(i).sort().join(",") !== keys || (i.dataAccess !== undefined && (i.protocol !== 2 || !["unavailable", "relaxed"].includes(i.dataAccess))) ||
-            i.package !== info.package || i.version !== info.version || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(i.package) || !/^\d+(\.\d+){0,3}-\d{4}$/.test(i.version) || ![1, 2].includes(i.protocol) ||
-            !/^[a-f0-9]{64}$/.test(i.payloadDigest) || !/^[a-f0-9]{64}$/.test(i.registryDigest) || JSON.stringify(i) !== raw)
-            throw new Error("invalid inventory");
-        if (windows.length !== 1 || windows[0] !== windowPath)
-            throw new Error("missing/ambiguous window or build mismatch");
-        const helper = bytes("integration/helper");
-        if (sha256(helper) !== i.payloadDigest || !helper.includes(Buffer.from(JSON.stringify({ ...i, payloadDigest: "" }))) ||
-            !bytes("ui/cgi/api.cgi").includes(Buffer.from(raw)))
-            throw new Error("payload/compiled inventory mismatch");
-        const workers = bytes("integration/workers.json");
-        const rawRegistry = JSON.parse(workers.toString("utf8"));
-        const sdkRegistry = !Array.isArray(rawRegistry);
-        const registry = sdkRegistry ? decodeSDKRegistry(workers).inert : rawRegistry;
-        if (sdkRegistry && (i.protocol !== 2 || i.dataAccess !== "relaxed" || !helper.includes(workers)))
-            throw new Error("compiled SDK registry mismatch");
-        if (!Array.isArray(registry) || registry.length > 16 || sha256(workers) !== i.registryDigest || (!sdkRegistry && JSON.stringify(registry) !== workers.toString("utf8")))
-            throw new Error("invalid registry");
-        let previous = "", total = 0;
-        for (const worker of registry) {
-            if (!worker || Object.keys(worker).sort().join(",") !== "digest,id" || typeof worker.id !== "string" ||
-                !/^[a-z][a-z0-9_]{0,31}$/.test(worker.id) || (previous && (sdkRegistry ? previous >= worker.id : previous.localeCompare(worker.id, "en") >= 0)) ||
-                !/^[a-f0-9]{64}$/.test(worker.digest))
-                throw new Error("invalid worker");
-            const content = bytes(`integration/workers/${worker.id}`);
-            total += content.length;
-            if (total > 1024 * 1024 || sha256(content) !== worker.digest)
-                throw new Error("worker digest mismatch");
-            previous = worker.id;
-        }
-        if ([...files.keys()].filter(p => p.startsWith("integration/workers/")).length !== registry.length)
-            throw new Error("unregistered worker");
-        const manifest = { package: i.package, spkVersion: i.version, privilege: "root", integration: { protocol: i.protocol, workers: {} } };
-        const tasks = JSON.parse(/\.rootTasks = (\[[^\n]+\]);/.exec(bytes(windowPath).toString("utf8"))?.[1] ?? "null");
-        const expected = rootTasks({ ...manifest, rootOps: helperOps(manifest, i) });
-        if (!Array.isArray(tasks) || JSON.stringify(tasks.filter(t => t.op?.startsWith("helper_"))) !== JSON.stringify(expected))
-            throw new Error("approved task mismatch");
-        // Daemon lifecycle is verified separately with the complete daemon config.
-        if (!daemon)
-            for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
-                if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
-                    throw new Error("lifecycle mismatch");
-            }
-        return { protocol: i.protocol, dataAccess: i.dataAccess ?? "unavailable" };
-    }
-    catch {
-        findings.push("integration inventory、digest、compiled binding、worker 或 lifecycle 不符合固定契約");
-        return undefined;
-    }
-}

package/dist/standalone/job-diagnostics.d.ts

@@ -1 +0,0 @@
-export declare function formatJobDiagnostic(raw: string | Uint8Array): string;

package/dist/standalone/job-diagnostics.js

@@ -1,49 +0,0 @@
-import { strictJSON } from './worker-contract-json.js';
-const WORKER_SAFE_REASONS = ['invalid-request', 'incompatible', 'unsupported', 'replay', 'stale', 'expired', 'denied', 'unavailable', 'suspended', 'revoked', 'fenced', 'busy', 'limit-exceeded', 'canceled', 'timeout', 'partial', 'commit-uncertain', 'cleanup-required', 'internal'];
-// S5 formatter only: no command registration, network, SSH or raw-log reader.
-// Reject the whole projection on schema/serializer failure; never echo input.
-export function formatJobDiagnostic(raw) {
-    try {
-        const record = (value, required, optional = []) => {
-            if (!value || typeof value !== 'object' || Array.isArray(value))
-                throw 0;
-            const o = value;
-            if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
-                throw 0;
-            return o;
-        };
-        const d = record(strictJSON(raw, 32768), ['diagnosticSchema', 'availability', 'jobs', 'total', 'truncated']);
-        if (d.diagnosticSchema !== 1 || d.availability !== 'unavailable' || !Array.isArray(d.jobs) || d.jobs.length > 10 || !Number.isSafeInteger(d.total) || d.total < d.jobs.length || d.total > 256 || typeof d.truncated !== 'boolean' || d.truncated !== (d.total > d.jobs.length))
-            throw 0;
-        const aliases = new Set();
-        const jobs = d.jobs.map(value => {
-            const j = record(value, ['alias', 'state', 'cancelRequested', 'drained', 'effectsUnknown'], ['safeReason']);
-            if (typeof j.alias !== 'string' || !/^[a-f0-9]{64}$/.test(j.alias) || !['pending', 'running', 'cancel-requested', 'draining', 'succeeded', 'failed', 'canceled', 'interrupted', 'cleanup-required'].includes(j.state))
-                throw 0;
-            if (['cancelRequested', 'drained', 'effectsUnknown'].some(k => typeof j[k] !== 'boolean'))
-                throw 0;
-            if (j.safeReason !== undefined && !WORKER_SAFE_REASONS.includes(j.safeReason))
-                throw 0;
-            if (aliases.has(j.alias))
-                throw 0;
-            aliases.add(j.alias);
-            if (j.state === 'succeeded' && (!j.drained || j.cancelRequested || j.effectsUnknown || j.safeReason !== undefined))
-                throw 0;
-            if (['pending', 'running'].includes(j.state) && (j.drained || j.cancelRequested))
-                throw 0;
-            if (['cancel-requested', 'draining'].includes(j.state) && (!j.cancelRequested || j.drained))
-                throw 0;
-            if (j.state === 'cleanup-required' && (j.drained || j.safeReason !== 'cleanup-required'))
-                throw 0;
-            if (['failed', 'interrupted', 'canceled'].includes(j.state) && j.safeReason === undefined)
-                throw 0;
-            if (j.state === 'canceled' && !j.cancelRequested)
-                throw 0;
-            return { alias: j.alias, state: j.state, ...(j.safeReason === undefined ? {} : { safeReason: j.safeReason }), cancelRequested: j.cancelRequested, drained: j.drained, effectsUnknown: j.effectsUnknown };
-        });
-        return JSON.stringify({ diagnosticSchema: 1, availability: 'unavailable', jobs, total: d.total, truncated: d.truncated }) + '\n';
-    }
-    catch {
-        return '{"safeReason":"invalid-request"}\n';
-    }
-}

package/dist/standalone/lifecycle-helper.d.ts

@@ -1,2 +0,0 @@
-/** Non-privileged management veto shared by the generated package hooks. */
-export declare function renderHelperStoppedCheck(packageId: string): string;

package/dist/standalone/lifecycle-helper.js

@@ -1,12 +0,0 @@
-/** Non-privileged management veto shared by the generated package hooks. */
-export function renderHelperStoppedCheck(packageId) {
-    return `/var/packages/${packageId}/target/integration/helper check-stopped || {
-  message='Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.'
-  printf '%s\\n' "$message" >&2
-  if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then
-    (printf '%s\\n' "$message" >> "$SYNOPKG_TEMP_LOGFILE") 2>/dev/null || :
-  fi
-  exit 1
-}
-`;
-}

package/dist/standalone/native-layout.d.ts

@@ -1,74 +0,0 @@
-import type { CommandRunner } from './build.js';
-export declare const LAYOUT_ARCHES: {
-    readonly x86_64: readonly [2, 62];
-    readonly aarch64: readonly [2, 183];
-    readonly armv8: readonly [2, 183];
-    readonly armv7: readonly [1, 40];
-};
-export type LayoutArch = keyof typeof LAYOUT_ARCHES;
-type Hook = {
-    command: string[];
-    cwd: string;
-    env: Record<string, string>;
-};
-type Toolkit = {
-    url: string;
-    sha256: string;
-};
-type Binary = {
-    path: string;
-    linkage: 'static' | 'dynamic';
-    arches?: LayoutArch[];
-};
-export interface NativeLayout {
-    root: string;
-    package: string;
-    version: string;
-    build: number;
-    displayname: string;
-    description: string;
-    maintainer: string;
-    os_min_ver: string;
-    privilege: 'none';
-    arches: LayoutArch[];
-    layout: {
-        payload: string;
-        metadata: string;
-        binaries: Binary[];
-    };
-    native: {
-        prepare?: Hook;
-        hook: Hook;
-        toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
-    };
-}
-export declare function isNativeLayout(root: string): boolean;
-export declare function loadNativeLayout(root: string): {
-    ok: true;
-    manifest: NativeLayout;
-} | {
-    ok: false;
-    errors: {
-        code: string;
-        message: string;
-    }[];
-};
-export declare function verifyToolkitArchive(path: string, expected: string): void;
-export declare function layoutFiles(root: string): Array<{
-    path: string;
-    mode: number;
-    sha256: string;
-}>;
-export declare function checkLayoutBinary(root: string, b: Binary, arch: LayoutArch): void;
-export declare function checkLayoutMetadata(root: string, inspection?: boolean, packageId?: string): void;
-export declare function buildNativeLayout(options: {
-    root: string;
-    arches?: string[];
-    outDir?: string;
-    build?: number;
-    run?: CommandRunner;
-}): Promise<{
-    outputs: string[];
-}>;
-export declare function inspectNativeLayout(dir: string, payload: string, info: Record<string, string>): string[];
-export {};