@synopackageland/cli 0.5.3 → 0.6.0

package/dist/native/load.js

@@ -1,11 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { parseDocument } from "yaml";
-export function loadNative(nativePath) {
-    if (!existsSync(nativePath)) {
-        return null;
-    }
-    const source = readFileSync(nativePath, "utf8");
-    const doc = parseDocument(source);
-    const native = (doc.toJSON() ?? {});
-    return { native, source, doc };
-}

package/dist/native/types.d.ts

@@ -1,28 +0,0 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
-/** One target's binary source. `path` is Personal-only; Curated needs `url` + `sha256`. */
-export interface NativeTarget {
-    path?: string;
-    url?: string;
-    sha256?: string;
-    strip_components?: number;
-}
-/**
- * The single service process a native App runs. `exec` is relative to
- * SYNOPKG_PKGDEST, which N0 proved is the payload root itself. There is no
- * `user:` field: DSM creates the package user at install time and already owns
- * SYNOPKG_PKGVAR, so generated scripts neither create a user nor chown.
- */
-export interface NativeService {
-    exec: string;
-    args?: string[];
-    env?: Record<string, string>;
-}
-/** Parsed `native.yaml`. Schema 1 only; unknown or higher versions are refused. */
-export interface NativeConfig {
-    schema: number;
-    targets: Partial<Record<NativeArchFamily, NativeTarget>>;
-    service: NativeService;
-}
-export declare const NATIVE_FILENAME = "native.yaml";
-/** Data written into SYNOPKG_PKGVAR survives upgrades; `target/` is replaced wholesale. */
-export declare const PKGVAR_PLACEHOLDER = "${SYNOPKG_PKGVAR}";

package/dist/native/types.js

@@ -1,3 +0,0 @@
-export const NATIVE_FILENAME = "native.yaml";
-/** Data written into SYNOPKG_PKGVAR survives upgrades; `target/` is replaced wholesale. */
-export const PKGVAR_PLACEHOLDER = "${SYNOPKG_PKGVAR}";

package/dist/native/validate.d.ts

@@ -1,6 +0,0 @@
-import type { ValidationError } from "../types.js";
-import type { ParsedNative } from "./load.js";
-export interface NativeValidationOptions {
-    profile?: "personal" | "listing";
-}
-export declare function validateNative(parsed: ParsedNative, nativeFile: string, options?: NativeValidationOptions): ValidationError[];

package/dist/native/validate.js

@@ -1,143 +0,0 @@
-import { makeError } from "../errors.js";
-import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
-import { PKGVAR_PLACEHOLDER } from "./types.js";
-import { getValuePosition } from "../contract/load.js";
-function nativeSpan(file, doc, pathSegments, pathString) {
-    const dotPath = pathString ?? pathSegments.join(".");
-    if (!doc) {
-        return { file, line: 1, column: 1, path: dotPath };
-    }
-    const pos = getValuePosition(doc, pathSegments) ?? { line: 1, column: 1 };
-    return { file, line: pos.line, column: pos.column, path: dotPath };
-}
-const HEX64_REGEX = /^[0-9a-fA-F]{64}$/;
-export function validateNative(parsed, nativeFile, options = {}) {
-    const errors = [];
-    const profile = options.profile ?? "personal";
-    const { native, doc } = parsed;
-    const rawObj = (native && typeof native === "object" ? native : {});
-    // 1. schema 必須是整數且只接受 1。未知或更高值 → 拒絕，不靜默降級。
-    if (typeof native.schema !== "number" || !Number.isInteger(native.schema) || native.schema !== 1) {
-        errors.push(makeError("NATIVE_SCHEMA_INVALID", nativeSpan(nativeFile, doc, ["schema"]), `native.yaml schema 必須是整數且只接受 1，收到 ${JSON.stringify(native.schema)}。`, "請將 schema 設定為 1。"));
-    }
-    // 3. targets 的 key 只接受 x86_64、aarch64，至少要有一個。其他 key → 拒絕。
-    const targets = rawObj.targets;
-    if (!targets || typeof targets !== "object" || Array.isArray(targets)) {
-        errors.push(makeError("NATIVE_TARGETS_REQUIRED", nativeSpan(nativeFile, doc, ["targets"]), "native.yaml 必須包含 targets 物件，且至少宣告一個架構（x86_64 或 aarch64）。", "請在 targets 底下宣告 x86_64 或 aarch64 的 binary 來源。"));
-    }
-    else {
-        const targetEntries = Object.entries(targets);
-        if (targetEntries.length === 0) {
-            errors.push(makeError("NATIVE_TARGETS_EMPTY", nativeSpan(nativeFile, doc, ["targets"]), "targets 不得為空，至少要宣告一個架構（x86_64 或 aarch64）。", "請在 targets 底下宣告 x86_64 或 aarch64 的 binary 來源。"));
-        }
-        for (const [archKey, targetVal] of targetEntries) {
-            if (!isNativeArchFamily(archKey)) {
-                errors.push(makeError("NATIVE_ARCH_UNKNOWN", nativeSpan(nativeFile, doc, ["targets", archKey]), `不支援的架構「${archKey}」，targets 的 key 只接受 x86_64 或 aarch64。`, "請將 targets 的 key 改為 x86_64 或 aarch64。"));
-                continue;
-            }
-            if (!targetVal || typeof targetVal !== "object" || Array.isArray(targetVal)) {
-                errors.push(makeError("NATIVE_TARGET_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey]), `targets.${archKey} 必須是物件。`, "請指定 path 或 url 及 sha256。"));
-                continue;
-            }
-            const targetObj = targetVal;
-            const hasPath = typeof targetObj.path === "string" && targetObj.path.trim().length > 0;
-            const hasUrl = typeof targetObj.url === "string" && targetObj.url.trim().length > 0;
-            // 4. 每個 target 必須恰好有 path: 或 url: 之一。
-            if ((hasPath && hasUrl) || (!hasPath && !hasUrl)) {
-                errors.push(makeError("NATIVE_TARGET_SOURCE_EXCLUSIVE", nativeSpan(nativeFile, doc, ["targets", archKey]), `targets.${archKey} 必須恰好有 path 或 url 之一。`, "請只提供 path（本機開發）或 url（發佈）。"));
-            }
-            // 5. path: 只在 personal profile 合法。listing profile 只接受 url: ＋ sha256:（url 沒有 sha256 也要拒絕）。
-            if (profile === "listing") {
-                if (hasPath) {
-                    errors.push(makeError("NATIVE_PATH_FORBIDDEN_IN_LISTING", nativeSpan(nativeFile, doc, ["targets", archKey, "path"]), `Listing profile 不允許使用 path（targets.${archKey}.path），只接受 url ＋ sha256。`, "請在 targets 中改用 url 與 sha256 指向上游 release asset。"));
-                }
-                if (hasUrl && (!targetObj.sha256 || typeof targetObj.sha256 !== "string" || targetObj.sha256.trim() === "")) {
-                    errors.push(makeError("NATIVE_SHA256_REQUIRED_IN_LISTING", nativeSpan(nativeFile, doc, ["targets", archKey]), `Listing profile 的 targets.${archKey} 必須包含 sha256。`, "請提供 64 位元 SHA-256 雜湊值。"));
-                }
-            }
-            // 6. sha256 給了就必須是 64 個 hex 字元（大小寫都收，比對時 normalize 成小寫）。
-            if (targetObj.sha256 !== undefined) {
-                if (typeof targetObj.sha256 !== "string" || !HEX64_REGEX.test(targetObj.sha256)) {
-                    errors.push(makeError("NATIVE_SHA256_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey, "sha256"]), `targets.${archKey}.sha256 必須是 64 個十六進位字元 (hex)。`, "請提供有效的 64 位元 SHA-256 hex 字串。"));
-                }
-            }
-            // 7. strip_components 給了必須是 >= 0 的整數。
-            if (targetObj.strip_components !== undefined) {
-                if (typeof targetObj.strip_components !== "number" ||
-                    !Number.isInteger(targetObj.strip_components) ||
-                    targetObj.strip_components < 0) {
-                    errors.push(makeError("NATIVE_STRIP_COMPONENTS_INVALID", nativeSpan(nativeFile, doc, ["targets", archKey, "strip_components"]), `targets.${archKey}.strip_components 必須是 >= 0 的整數。`, "請提供大於或等於 0 的整數值。"));
-                }
-            }
-        }
-    }
-    // service 檢查
-    const service = rawObj.service;
-    if (!service || typeof service !== "object" || Array.isArray(service)) {
-        errors.push(makeError("NATIVE_SERVICE_REQUIRED", nativeSpan(nativeFile, doc, ["service"]), "native.yaml 必須包含 service 定義。", "請在 native.yaml 新增 service 區塊，包含 exec、args 與 env。"));
-        return errors;
-    }
-    const serviceObj = service;
-    // 10 & 11. service 禁止的欄位：user (規則10) 以及 shell 字串欄位 command, pre_start, post_start, shell 等 (規則11)
-    if ("user" in serviceObj) {
-        errors.push(makeError("NATIVE_SERVICE_USER_FORBIDDEN", nativeSpan(nativeFile, doc, ["service", "user"]), "service 不允許包含 user 欄位（DSM 在安裝時會自動建立並管理 package user）。", "請移除 service.user 欄位。"));
-    }
-    for (const forbiddenField of ["command", "pre_start", "post_start", "shell"]) {
-        if (forbiddenField in serviceObj) {
-            errors.push(makeError("NATIVE_SERVICE_SHELL_FIELD_FORBIDDEN", nativeSpan(nativeFile, doc, ["service", forbiddenField]), `service 不允許包含 shell 欄位「${forbiddenField}」，執行設定請使用 exec 與 args。`, `請移除 service.${forbiddenField}，改用 exec 與 args。`));
-        }
-    }
-    // 9. service.exec 必填、必須是相對路徑：不接受絕對路徑、不接受任何 .. path segment、不接受空字串。
-    const exec = serviceObj.exec;
-    if (typeof exec !== "string" || exec.trim() === "") {
-        errors.push(makeError("NATIVE_EXEC_REQUIRED", nativeSpan(nativeFile, doc, ["service", "exec"]), "service.exec 為必填項目，且不可為空字串。", "請提供相對於 package 根目錄的可執行檔路徑（例如 Radarr 或 bin/my-app）。"));
-    }
-    else {
-        const trimmedExec = exec.trim();
-        const segments = trimmedExec.split(/[/\\]/);
-        if (trimmedExec.startsWith("/") || trimmedExec.startsWith("\\") || segments.some((s) => s === "..")) {
-            errors.push(makeError("NATIVE_EXEC_INVALID_PATH", nativeSpan(nativeFile, doc, ["service", "exec"]), `service.exec「${exec}」必須是相對路徑，不可為絕對路徑或包含「..」路徑區段。`, "請使用純相對路徑（例如 Radarr 或 bin/app），不得以 / 開頭或包含 ..。"));
-        }
-    }
-    // 11. args 必須是字串 array
-    let argsValid = true;
-    if (serviceObj.args !== undefined) {
-        if (!Array.isArray(serviceObj.args) || !serviceObj.args.every((item) => typeof item === "string")) {
-            argsValid = false;
-            errors.push(makeError("NATIVE_ARGS_INVALID", nativeSpan(nativeFile, doc, ["service", "args"]), "service.args 必須是字串陣列（string[]）。", "請將 args 定義為字串清單，例如 [\"--config\", \"${SYNOPKG_PKGVAR}/config.yaml\"]。"));
-        }
-    }
-    // 12. env 必須是 string→string 的 map。
-    let envValid = true;
-    if (serviceObj.env !== undefined) {
-        if (!serviceObj.env ||
-            typeof serviceObj.env !== "object" ||
-            Array.isArray(serviceObj.env) ||
-            !Object.values(serviceObj.env).every((val) => typeof val === "string")) {
-            envValid = false;
-            errors.push(makeError("NATIVE_ENV_INVALID", nativeSpan(nativeFile, doc, ["service", "env"]), "service.env 必須是 string 到 string 的 key-value map。", "請確認 service.env 中每個環境變數的值皆為字串。"));
-        }
-    }
-    // 8. service.args 或 service.env 至少要出現一次 ${SYNOPKG_PKGVAR}，否則拒絕。用 PKGVAR_PLACEHOLDER 常數比對。
-    let hasPkgvarPlaceholder = false;
-    if (argsValid && Array.isArray(serviceObj.args)) {
-        for (const arg of serviceObj.args) {
-            if (typeof arg === "string" && arg.includes(PKGVAR_PLACEHOLDER)) {
-                hasPkgvarPlaceholder = true;
-                break;
-            }
-        }
-    }
-    if (!hasPkgvarPlaceholder && envValid && serviceObj.env && typeof serviceObj.env === "object" && !Array.isArray(serviceObj.env)) {
-        for (const val of Object.values(serviceObj.env)) {
-            if (typeof val === "string" && val.includes(PKGVAR_PLACEHOLDER)) {
-                hasPkgvarPlaceholder = true;
-                break;
-            }
-        }
-    }
-    if (!hasPkgvarPlaceholder) {
-        errors.push(makeError("NATIVE_PKGVAR_REQUIRED", nativeSpan(nativeFile, doc, ["service"]), `service.args 或 service.env 必須至少包含一次「${PKGVAR_PLACEHOLDER}」，以確保資料寫入持久化目錄。`, `請在 service.args 或 service.env 中傳入 ${PKGVAR_PLACEHOLDER}（例如 -data=\${SYNOPKG_PKGVAR} 或 TMPDIR: \${SYNOPKG_PKGVAR}/tmp）。`));
-    }
-    return errors;
-}

package/dist/standalone/authorization-window.d.ts

@@ -1,2 +0,0 @@
-/** Shared host flow. CGI plans are never accepted as completed authorization. */
-export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/authorization-window.js

@@ -1,28 +0,0 @@
-/** Shared host flow. CGI plans are never accepted as completed authorization. */
-export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options) {
-  var busy = null;
-  function fail(code) { var error = new Error(code); error.code = code; return error; }
-  function status() { return options.call("authorization.status").then(function (d) {
-    if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
-    return d;
-  }); }
-  function plan(method) { return options.call(method).then(function (p) {
-    if (!p || p.command !== "authorization" || p.schema_version !== 1 || p.phase !== "plan" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail("authorization_bad_response");
-    var seen = {};
-    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
-    return p;
-  }); }
-  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
-  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
-    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op) : null; });
-  }); },Promise.resolve()); }
-  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
-    return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
-  }); },revoke:function () { return exclusive(function () {
-    return plan("authorization.revoke").then(function (p) {
-      if (p.withdraw === true && typeof options.withdraw !== "function") throw fail("authorization_bad_response");
-      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize(["helper_disable"],true) : Promise.resolve();
-      return disabled.then(function () { return p.purge === true ? authorize(["helper_purge"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });
-    }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
-  }); }};
-}`;

package/dist/standalone/authorization.d.ts

@@ -1,48 +0,0 @@
-import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
-import type { CommandRunner } from './build.js';
-import { type RootOp } from './root-ops.js';
-import type { StandaloneManifest } from './manifest.js';
-export interface PinnedFile {
-    path: string;
-    size: number;
-    sha256: string;
-}
-export interface AuthorizationInventory {
-    schema: 2;
-    package: string;
-    version: string;
-    arch: string;
-    operations: RootOp[];
-    files: PinnedFile[];
-    digest: string;
-}
-export interface AuthorizationArtifact {
-    binary: string;
-    inventory: AuthorizationInventory;
-    bootstrapSha256: string;
-    ops: RootOp[];
-}
-export declare function authorizationInventory(m: {
-    package: string;
-    spkVersion: string;
-    rootOps?: RootOp[];
-}, arch: string, files: PinnedFile[]): AuthorizationInventory;
-export declare function bootstrapOps(m: {
-    package: string;
-    spkVersion: string;
-    rootOps?: RootOp[];
-}, pin: string): RootOp[];
-export declare function authorizationPlan(a: AuthorizationArtifact, m: {
-    package: string;
-    spkVersion: string;
-}): {
-    schema: number;
-    package: string;
-    version: string;
-    bootstrapSha256: string;
-    inventory: AuthorizationInventory;
-    tasks: import("./root-window.js").RootTask[];
-};
-export declare function buildAuthorization(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): AuthorizationArtifact | undefined;
-/** Archive consistency, not publisher authenticity or device runtime certification. */
-export declare function inspectAuthorization(dir: string, pkg: string, version: string): string[];

package/dist/standalone/authorization.js

@@ -1,116 +0,0 @@
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { renderRootTaskScript } from './root-ops.js';
-import { rootTasks } from './root-window.js';
-import { StandaloneBuildError } from './spk.js';
-import { assertHelperTaskBudget } from './helper.js';
-const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
-export function authorizationInventory(m, arch, files) {
-    const base = { schema: 2, package: m.package, version: m.spkVersion, arch, operations: m.rootOps ?? [], files: [...files].sort((a, b) => a.path.localeCompare(b.path, 'en')) };
-    return { ...base, digest: hash(JSON.stringify(base)) };
-}
-export function bootstrapOps(m, pin) {
-    if (!/^[a-f0-9]{64}$/.test(pin))
-        throw new StandaloneBuildError('AUTHORIZATION_PIN_REQUIRED', 'bootstrap SHA-256 pin required');
-    return (m.rootOps ?? []).map(op => ({ name: op.name, protectedOutput: true, exposeOutput: op.protectedOutput !== true, body: `#!/bin/sh
-set -eu
-umask 077
-[ "$(id -u)" = 0 ]
-info=/var/packages/${m.package}/INFO
-[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
-grep -Fqx 'version="${m.spkVersion}"' "$info"
-for p in /var /var/lib; do
- [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
- mode=$(stat -c %a "$p"); [ "$((0$mode & 0022))" = 0 ]
-done
-s=/var/lib/synopkgland-auth-${m.package}
-[ ! -L "$s" ]
-if [ ! -e "$s" ]; then mkdir -m 0700 "$s"; fi
-[ -d "$s" ] && [ "$(stat -c %u:%a "$s")" = 0:700 ]
-tmp=$(mktemp "$s/.bootstrap.XXXXXX")
-trap 'rm -f "$tmp"; rmdir "$s" 2>/dev/null || :' EXIT HUP INT TERM
-dd if=/var/packages/${m.package}/target/authorization/bootstrap of="$tmp" bs=65536 count=1025 2>/dev/null
-[ "$(stat -c %s "$tmp")" -le 67108864 ]
-chmod 0700 "$tmp"
-[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${pin}' ]
-"$tmp" '${op.name}'
-` }));
-}
-export function authorizationPlan(a, m) {
-    return { schema: 2, package: m.package, version: m.spkVersion, bootstrapSha256: a.bootstrapSha256, inventory: a.inventory, tasks: rootTasks({ ...m, rootOps: a.ops }) };
-}
-export function buildAuthorization(m, arch, work, run) {
-    if (m.privilege !== 'root')
-        return undefined;
-    if (m.backend.kind !== 'go')
-        throw new StandaloneBuildError('AUTHORIZATION_GO_REQUIRED', 'root authorization requires the native-Go CGI template');
-    const files = [];
-    const add = (path, source) => { const bytes = readFileSync(source); files.push({ path, size: bytes.length, sha256: hash(bytes) }); };
-    const walk = (dir) => { for (const name of readdirSync(dir).sort()) {
-        const p = join(dir, name), st = lstatSync(p);
-        if (st.isDirectory())
-            walk(p);
-        else if (st.isFile())
-            add('ui/app/' + relative(m.ui.dir, p).split('\\').join('/'), p);
-        else
-            throw new StandaloneBuildError('AUTHORIZATION_PAYLOAD_UNSAFE', 'UI inventory requires regular files');
-    } };
-    walk(m.ui.dir);
-    // Helper bodies already contain the exact helper digest; worker payloads are
-    // bound by its compiled registry. UI bytes are additionally checked at launch.
-    const inventory = authorizationInventory(m, arch, files);
-    const dir = join(work, 'authorization-' + arch);
-    mkdirSync(dir);
-    const source = readFileSync(new URL('../../templates/_authorization/main.go', import.meta.url), 'utf8');
-    writeFileSync(join(dir, 'main.go'), source);
-    const binary = join(work, 'bootstrap-' + arch);
-    const compiled = JSON.stringify({ ...inventory, operations: inventory.operations.map(op => ({ ...op, body: op.body })) });
-    const result = run('go', ['build', '-trimpath', '-buildvcs=false', '-ldflags', `-s -w -buildid= -X 'main.inventoryBase64=${Buffer.from(compiled).toString('base64')}'`, '-o', binary, 'main.go'], { cwd: dir, env: { ...process.env, CGO_ENABLED: '0', GOOS: 'linux', GOARCH: arch === 'x86_64' ? 'amd64' : 'arm64' } });
-    if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError('AUTHORIZATION_BUILD_FAILED', result.stderr);
-    const bootstrapSha256 = hash(readFileSync(binary));
-    const ops = bootstrapOps(m, bootstrapSha256);
-    ops.forEach(op => assertHelperTaskBudget(renderRootTaskScript(m, op)));
-    return { binary, inventory, bootstrapSha256, ops };
-}
-/** Archive consistency, not publisher authenticity or device runtime certification. */
-export function inspectAuthorization(dir, pkg, version) {
-    if (!existsSync(join(dir, 'authorization/manifest.json')))
-        return ['root authorization manifest missing'];
-    try {
-        const plan = JSON.parse(readFileSync(join(dir, 'authorization/manifest.json'), 'utf8'));
-        if (plan.schema !== 2 || plan.package !== pkg || plan.version !== version || !/^[a-f0-9]{64}$/.test(plan.bootstrapSha256))
-            throw Error();
-        const bytes = readFileSync(join(dir, 'authorization/bootstrap'));
-        if (hash(bytes) !== plan.bootstrapSha256 || !bytes.includes(Buffer.from(Buffer.from(JSON.stringify(plan.inventory)).toString('base64'))))
-            throw Error();
-        const inventory = authorizationInventory({ package: pkg, spkVersion: version, rootOps: plan.inventory.operations }, plan.inventory.arch, plan.inventory.files);
-        if (JSON.stringify(inventory) !== JSON.stringify(plan.inventory))
-            throw Error();
-        if (JSON.stringify(plan.tasks) !== JSON.stringify(rootTasks({ package: pkg, spkVersion: version, rootOps: bootstrapOps({ package: pkg, spkVersion: version, rootOps: inventory.operations }, plan.bootstrapSha256) })))
-            throw Error();
-        const seen = new Set();
-        for (const f of inventory.files) {
-            if (!/^ui\/app\/(?!.*(?:^|\/)\.\.(?:\/|$))[^\x00\\]+$/.test(f.path) || seen.has(f.path))
-                throw Error();
-            seen.add(f.path);
-            const b = readFileSync(join(dir, f.path));
-            if (b.length !== f.size || hash(b) !== f.sha256)
-                throw Error();
-        }
-        const cgi = readFileSync(join(dir, 'ui/cgi/api.cgi'));
-        if (!cgi.includes(Buffer.from(Buffer.from(JSON.stringify(plan)).toString('base64'))))
-            throw Error();
-        const windows = readdirSync(join(dir, 'ui')).filter(f => /^window-\d+\.js$/.test(f));
-        if (windows.length !== 1)
-            throw Error();
-        const window = readFileSync(join(dir, 'ui', windows[0]), 'utf8');
-        if (!window.includes(JSON.stringify(plan.tasks)))
-            throw Error();
-        return [];
-    }
-    catch {
-        return ['root authorization bootstrap pin, inventory, CGI or task binding invalid'];
-    }
-}

package/dist/standalone/helper-inventory.d.ts

@@ -1,31 +0,0 @@
-import type { SDKWorkerConfig } from "./worker-registry.js";
-export type DataAccessMode = "unavailable" | "relaxed";
-export interface Integration {
-    protocol: 1 | 2;
-    workers: Record<string, string>;
-    identity?: "better-auth";
-    dataAccess?: DataAccessMode;
-    sdkWorkers?: Record<string, SDKWorkerConfig>;
-}
-export interface HelperInventory {
-    package: string;
-    version: string;
-    protocol: number;
-    payloadDigest: string;
-    registryDigest: string;
-    dataAccess?: DataAccessMode;
-}
-/**
- * The privileged helper exists only for an integration that also declares
- * privilege: root. Without it, integration is package-account only.
- */
-export declare const hasHelper: (m: {
-    integration?: unknown;
-    privilege?: "none" | "root";
-}) => boolean;
-export declare const sha256: (b: string | Buffer) => string;
-/** Preserve the original inert inventory byte format, including property order. */
-export declare function inertWorkerRegistry(workers: readonly {
-    id: string;
-    digest: string;
-}[]): string;

package/dist/standalone/helper-inventory.js

@@ -1,11 +0,0 @@
-import { createHash } from "node:crypto";
-/**
- * The privileged helper exists only for an integration that also declares
- * privilege: root. Without it, integration is package-account only.
- */
-export const hasHelper = (m) => m.integration !== undefined && m.privilege === "root";
-export const sha256 = (b) => createHash("sha256").update(b).digest("hex");
-/** Preserve the original inert inventory byte format, including property order. */
-export function inertWorkerRegistry(workers) {
-    return JSON.stringify(workers.map(({ id, digest }) => ({ id, digest })));
-}

package/dist/standalone/helper.d.ts

@@ -1,22 +0,0 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
-import type { CommandRunner } from "./build.js";
-import type { StandaloneError, StandaloneManifest } from "./manifest.js";
-import { type RootOp } from "./root-ops.js";
-export type { Integration, HelperInventory } from "./helper-inventory.js";
-import { type Integration, type HelperInventory } from "./helper-inventory.js";
-export interface WorkerPayload {
-    id: string;
-    digest: string;
-    bytes: Buffer;
-}
-export interface HelperArtifact {
-    binary: string;
-    inventory: HelperInventory;
-    workers: WorkerPayload[];
-    registry?: string;
-    ops: RootOp[];
-}
-export declare function readIntegration(raw: unknown, root: string, fail: (e: StandaloneError) => void): Integration | undefined;
-export declare function assertHelperTaskBudget(script: string, metadata?: string): void;
-export declare function helperOps(m: StandaloneManifest, inventory: HelperInventory): RootOp[];
-export declare function buildHelper(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): HelperArtifact | undefined;

package/dist/standalone/helper.js

@@ -1,123 +0,0 @@
-import { lstatSync, readFileSync, realpathSync } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import { renderRootTaskScript } from "./root-ops.js";
-import { StandaloneBuildError } from "./spk.js";
-import { hasHelper, sha256 } from "./helper-inventory.js";
-import { buildWorkerRegistry, parseSDKWorkers } from "./worker-registry.js";
-const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-export function readIntegration(raw, root, fail) {
-    if (raw === undefined)
-        return undefined;
-    const invalid = () => { fail({ code: "STANDALONE_INTEGRATION_INVALID", message: "integration 需要 protocol: 1 或 2 與 inert workers；sdkWorkers 僅接受 protocol 2／relaxed 的固定 SDK kind、action/mode 與較低 limits。總數最多 16，production unavailable。" }); return undefined; };
-    if (!record(raw) || Object.keys(raw).some(k => !["protocol", "workers", "identity", "dataAccess", "sdkWorkers"].includes(k)) || ![1, 2].includes(raw.protocol) || !record(raw.workers) || Object.keys(raw.workers).length > 16)
-        return invalid();
-    if (raw.identity !== undefined && raw.identity !== "better-auth")
-        return invalid();
-    if (raw.dataAccess !== undefined && (raw.protocol !== 2 || !["unavailable", "relaxed"].includes(raw.dataAccess)))
-        return invalid();
-    const workers = {};
-    for (const [id, file] of Object.entries(raw.workers)) {
-        if (!/^[a-z][a-z0-9_]{0,31}$/.test(id) || typeof file !== "string" || !file || isAbsolute(file) || file.split(/[\\/]/).includes(".."))
-            return invalid();
-        const path = resolve(root, file), rel = relative(root, path);
-        if (rel.startsWith("..") || isAbsolute(rel))
-            return invalid();
-        workers[id] = path;
-    }
-    let sdkWorkers;
-    if (Object.hasOwn(raw, "sdkWorkers")) {
-        if (raw.protocol !== 2 || raw.dataAccess !== "relaxed")
-            return invalid();
-        try {
-            sdkWorkers = parseSDKWorkers(raw.sdkWorkers, Object.keys(workers));
-        }
-        catch {
-            return invalid();
-        }
-    }
-    return { protocol: raw.protocol, workers, ...(raw.identity === "better-auth" ? { identity: "better-auth" } : {}), ...(raw.dataAccess !== undefined ? { dataAccess: raw.dataAccess } : {}), ...(sdkWorkers ? { sdkWorkers } : {}) };
-}
-function snapshotWorkers(m) {
-    let total = 0;
-    return Object.entries(m.integration.workers).sort(([a], [b]) => a.localeCompare(b, "en")).map(([id, path]) => {
-        const rel = relative(realpathSync(m.root), realpathSync(path));
-        if (rel.startsWith("..") || isAbsolute(rel) || !lstatSync(path).isFile())
-            throw new StandaloneBuildError("HELPER_WORKER_UNSAFE", `${id} 必須是專案內的一般檔案，不接受 symlink。`);
-        const bytes = readFileSync(path);
-        total += bytes.length;
-        if (total > 1024 * 1024)
-            throw new StandaloneBuildError("HELPER_WORKERS_TOO_LARGE", "worker inventory payload 合計不可超過 1 MiB。");
-        return { id, digest: sha256(bytes), bytes };
-    });
-}
-export function assertHelperTaskBudget(script, metadata = JSON.stringify({ script })) {
-    if (Buffer.byteLength(script) > 4095)
-        throw new StandaloneBuildError("HELPER_TASK_TOO_LARGE", "helper task 超過 DSM 文件的 4095 bytes 保守限制。");
-    if (Buffer.byteLength(metadata) > 8191)
-        throw new StandaloneBuildError("HELPER_METADATA_TOO_LARGE", "helper scheduler metadata 超過 8191 bytes 有界限制。");
-}
-export function helperOps(m, inventory) {
-    return ["enable", "recover", "teardown", "disable", "repair", ...(m.privilege === 'root' ? ['purge'] : [])].map(action => {
-        const op = { name: `helper_${action}`, protectedOutput: true, body: `#!/bin/sh
-set -eu
-umask 077
-[ "$(id -u)" = 0 ]
-# Verify the installed version as well as the window's exact-script check.
-info=/var/packages/${m.package}/INFO
-[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
-grep -Fqx 'version="${m.spkVersion}"' "$info"
-for p in /var/lib /run; do
-  [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
-  mode=$(stat -c %a "$p")
-  [ "$((0$mode & 0022))" = 0 ]
-done
-s=/var/lib/synopkgland-${m.package}
-r=/run/synopkgland-helper-${m.package}
-for p in "$s" "$r"; do
-  [ ! -L "$p" ]
-  if [ ! -e "$p" ]; then mkdir -m 0755 "$p"; fi
-  [ -d "$p" ] && [ "$(stat -c %u:%a "$p")" = 0:755 ]
-done
-# Copy into a root-owned private file FIRST, then verify the copied bytes.
-# The package may change its source during copy; no unverified byte executes.
-tmp=$(mktemp "$s/.payload.XXXXXX")
-trap 'rm -f "$tmp"' EXIT HUP INT TERM
-dd if=/var/packages/${m.package}/target/integration/helper of="$tmp" bs=65536 count=1025 2>/dev/null
-[ "$(stat -c %s "$tmp")" -le 67108864 ]
-chmod 0700 "$tmp"
-[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${inventory.payloadDigest}' ]
-exe="$s/payload-${inventory.payloadDigest}"
-# Rename only inside the protected directory. Existing executable mappings
-# retain their inode and digest until the controller has verified teardown.
-mv -f "$tmp" "$exe"
-trap - EXIT HUP INT TERM
-exec "$exe" ${action}
-` };
-        const script = renderRootTaskScript(m, op);
-        assertHelperTaskBudget(script, JSON.stringify({ name: `${m.package} root: ${op.name}`, script, owner: "root", enable: false }));
-        return op;
-    });
-}
-export function buildHelper(m, arch, work, run) {
-    if (!m.integration || !hasHelper(m))
-        return undefined;
-    if (m.backend.kind !== "go")
-        throw new StandaloneBuildError("HELPER_GO_REQUIRED", "M1a integration 僅支援 native-go。");
-    const workers = snapshotWorkers(m);
-    const registry = buildWorkerRegistry(workers, m.integration.sdkWorkers, m.backend.dir);
-    const base = { package: m.package, version: m.spkVersion, protocol: m.integration.protocol, payloadDigest: "", registryDigest: sha256(registry), ...(m.integration.dataAccess ? { dataAccess: m.integration.dataAccess } : {}) };
-    const binary = join(work, `helper-${arch}`);
-    const sdkFlags = m.integration.sdkWorkers ? ["-tags=synopkgland_sdk_workers"] : [];
-    const sdkBinding = m.integration.sdkWorkers ? ` -X 'main.sdkWorkerRegistry=${registry}'` : "";
-    const result = run("go", ["build", ...sdkFlags, "-trimpath", "-buildvcs=false", "-ldflags", `-s -w -buildid= -X 'main.helperInventory=${JSON.stringify(base)}'${sdkBinding}`, "-o", binary, "./cmd/helper"], {
-        cwd: m.backend.dir, env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
-    });
-    if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError("HELPER_BUILD_FAILED", `Go helper build 失敗：${result.stderr}`);
-    const payload = readFileSync(binary);
-    if (m.integration.sdkWorkers && (!payload.includes(Buffer.from(registry)) || buildWorkerRegistry(workers, m.integration.sdkWorkers, m.backend.dir) !== registry)) {
-        throw new StandaloneBuildError("HELPER_BUILD_FAILED", "compiled SDK registry 缺失或 source 在建置期間變動；請用完整 SDK 模板重新建置。");
-    }
-    const inventory = { ...base, payloadDigest: sha256(payload) };
-    return { binary, inventory, workers, ...(m.integration.sdkWorkers ? { registry } : {}), ops: helperOps(m, inventory) };
-}

package/dist/standalone/inspect-helper.d.ts

@@ -1,6 +0,0 @@
-export interface IntegrationInspection {
-    protocol: 1 | 2;
-    dataAccess: "unavailable" | "relaxed";
-}
-/** Artifact consistency only; bytes, approval and health never certify NAS access. */
-export declare function inspectHelper(dir: string, info: Record<string, string>, findings: string[], daemon?: boolean): Promise<IntegrationInspection | undefined>;