@synopackageland/cli 0.5.3 → 0.6.0

package/dist/standalone/inspect-helper.js

@@ -1,103 +0,0 @@
-import { bootstrapOps } from "./authorization.js";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import * as tar from "tar";
-import { windowScriptName } from "./dsm-window.js";
-import { helperOps } from "./helper.js";
-import { sha256 } from "./helper-inventory.js";
-import { renderStandaloneScript } from "./lifecycle.js";
-import { rootTasks } from "./root-window.js";
-import { decodeSDKRegistry } from "./worker-registry.js";
-/** Artifact consistency only; bytes, approval and health never certify NAS access. */
-export async function inspectHelper(dir, info, findings, daemon = false) {
-    const files = new Map();
-    const windowPath = `ui/${windowScriptName({ build: Number(info.version?.split("-").at(-1)) })}`;
-    const windows = [];
-    let oversized = false;
-    await tar.t({ file: join(dir, "package.tgz"), onReadEntry(entry) {
-            const path = entry.path.replace(/^\.\//, "");
-            // Enumerate candidates to reject extras; only the INFO-derived exact path is read.
-            if (/^ui\/window-[^/]*\.js$/.test(path))
-                windows.push(path);
-            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["authorization/manifest.json", "integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
-                return;
-            const limit = ["integration/helper", "ui/cgi/api.cgi"].includes(path) ? 64 * 1024 * 1024 : 1024 * 1024;
-            if (files.has(path) || entry.size > limit) {
-                oversized = true;
-                return;
-            }
-            const chunks = [];
-            let size = 0;
-            entry.on("data", (chunk) => { size += chunk.length; if (size <= limit)
-                chunks.push(chunk);
-            else
-                oversized = true; });
-            entry.on("end", () => files.set(path, Buffer.concat(chunks)));
-        } });
-    try {
-        if (oversized)
-            throw new Error("oversized/duplicate payload");
-        const bytes = (path) => { const b = files.get(path); if (!b)
-            throw new Error(`missing ${path}`); return b; };
-        const raw = bytes("integration/inventory.json").toString("utf8");
-        const i = JSON.parse(raw);
-        const keys = i.dataAccess === undefined ? "package,payloadDigest,protocol,registryDigest,version" : "dataAccess,package,payloadDigest,protocol,registryDigest,version";
-        if (Object.keys(i).sort().join(",") !== keys || (i.dataAccess !== undefined && (i.protocol !== 2 || !["unavailable", "relaxed"].includes(i.dataAccess))) ||
-            i.package !== info.package || i.version !== info.version || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(i.package) || !/^\d+(\.\d+){0,3}-\d{4}$/.test(i.version) || ![1, 2].includes(i.protocol) ||
-            !/^[a-f0-9]{64}$/.test(i.payloadDigest) || !/^[a-f0-9]{64}$/.test(i.registryDigest) || JSON.stringify(i) !== raw)
-            throw new Error("invalid inventory");
-        if (windows.length !== 1 || windows[0] !== windowPath)
-            throw new Error("missing/ambiguous window or build mismatch");
-        const helper = bytes("integration/helper");
-        if (sha256(helper) !== i.payloadDigest || !helper.includes(Buffer.from(JSON.stringify({ ...i, payloadDigest: "" }))) ||
-            !bytes("ui/cgi/api.cgi").includes(Buffer.from(raw)))
-            throw new Error("payload/compiled inventory mismatch");
-        const workers = bytes("integration/workers.json");
-        const rawRegistry = JSON.parse(workers.toString("utf8"));
-        const sdkRegistry = !Array.isArray(rawRegistry);
-        const registry = sdkRegistry ? decodeSDKRegistry(workers).inert : rawRegistry;
-        if (sdkRegistry && (i.protocol !== 2 || i.dataAccess !== "relaxed" || !helper.includes(workers)))
-            throw new Error("compiled SDK registry mismatch");
-        if (!Array.isArray(registry) || registry.length > 16 || sha256(workers) !== i.registryDigest || (!sdkRegistry && JSON.stringify(registry) !== workers.toString("utf8")))
-            throw new Error("invalid registry");
-        let previous = "", total = 0;
-        for (const worker of registry) {
-            if (!worker || Object.keys(worker).sort().join(",") !== "digest,id" || typeof worker.id !== "string" ||
-                !/^[a-z][a-z0-9_]{0,31}$/.test(worker.id) || (previous && (sdkRegistry ? previous >= worker.id : previous.localeCompare(worker.id, "en") >= 0)) ||
-                !/^[a-f0-9]{64}$/.test(worker.digest))
-                throw new Error("invalid worker");
-            const content = bytes(`integration/workers/${worker.id}`);
-            total += content.length;
-            if (total > 1024 * 1024 || sha256(content) !== worker.digest)
-                throw new Error("worker digest mismatch");
-            previous = worker.id;
-        }
-        if ([...files.keys()].filter(p => p.startsWith("integration/workers/")).length !== registry.length)
-            throw new Error("unregistered worker");
-        const manifest = { package: i.package, spkVersion: i.version, privilege: "root", integration: { protocol: i.protocol, workers: {} } };
-        const tasks = JSON.parse(/\.rootTasks = (\[[^\n]+\]);/.exec(bytes(windowPath).toString("utf8"))?.[1] ?? "null");
-        const originalOps = helperOps(manifest, i);
-        let expected = rootTasks({ ...manifest, rootOps: originalOps });
-        // Existing CLI 0.5 archives have inline hash-pinned helper tasks. New
-        // bootstrap archives carry an additional independently inspected inventory.
-        if (files.has("authorization/manifest.json")) {
-            const plan = JSON.parse(bytes("authorization/manifest.json").toString("utf8"));
-            if (JSON.stringify(plan.inventory.operations.filter((op) => op.name.startsWith("helper_"))) !== JSON.stringify(originalOps))
-                throw new Error("bootstrap helper binding mismatch");
-            expected = rootTasks({ ...manifest, rootOps: bootstrapOps({ ...manifest, rootOps: originalOps }, plan.bootstrapSha256) });
-        }
-        if (!Array.isArray(tasks) || JSON.stringify(tasks.filter(t => t.op?.startsWith("helper_"))) !== JSON.stringify(expected))
-            throw new Error("approved task mismatch");
-        // Daemon lifecycle is verified separately with the complete daemon config.
-        if (!daemon)
-            for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
-                if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
-                    throw new Error("lifecycle mismatch");
-            }
-        return { protocol: i.protocol, dataAccess: i.dataAccess ?? "unavailable" };
-    }
-    catch {
-        findings.push("integration inventory、digest、compiled binding、worker 或 lifecycle 不符合固定契約");
-        return undefined;
-    }
-}

package/dist/standalone/job-diagnostics.d.ts

@@ -1 +0,0 @@
-export declare function formatJobDiagnostic(raw: string | Uint8Array): string;

package/dist/standalone/job-diagnostics.js

@@ -1,49 +0,0 @@
-import { strictJSON } from './worker-contract-json.js';
-const WORKER_SAFE_REASONS = ['invalid-request', 'incompatible', 'unsupported', 'replay', 'stale', 'expired', 'denied', 'unavailable', 'suspended', 'revoked', 'fenced', 'busy', 'limit-exceeded', 'canceled', 'timeout', 'partial', 'commit-uncertain', 'cleanup-required', 'internal'];
-// S5 formatter only: no command registration, network, SSH or raw-log reader.
-// Reject the whole projection on schema/serializer failure; never echo input.
-export function formatJobDiagnostic(raw) {
-    try {
-        const record = (value, required, optional = []) => {
-            if (!value || typeof value !== 'object' || Array.isArray(value))
-                throw 0;
-            const o = value;
-            if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
-                throw 0;
-            return o;
-        };
-        const d = record(strictJSON(raw, 32768), ['diagnosticSchema', 'availability', 'jobs', 'total', 'truncated']);
-        if (d.diagnosticSchema !== 1 || d.availability !== 'unavailable' || !Array.isArray(d.jobs) || d.jobs.length > 10 || !Number.isSafeInteger(d.total) || d.total < d.jobs.length || d.total > 256 || typeof d.truncated !== 'boolean' || d.truncated !== (d.total > d.jobs.length))
-            throw 0;
-        const aliases = new Set();
-        const jobs = d.jobs.map(value => {
-            const j = record(value, ['alias', 'state', 'cancelRequested', 'drained', 'effectsUnknown'], ['safeReason']);
-            if (typeof j.alias !== 'string' || !/^[a-f0-9]{64}$/.test(j.alias) || !['pending', 'running', 'cancel-requested', 'draining', 'succeeded', 'failed', 'canceled', 'interrupted', 'cleanup-required'].includes(j.state))
-                throw 0;
-            if (['cancelRequested', 'drained', 'effectsUnknown'].some(k => typeof j[k] !== 'boolean'))
-                throw 0;
-            if (j.safeReason !== undefined && !WORKER_SAFE_REASONS.includes(j.safeReason))
-                throw 0;
-            if (aliases.has(j.alias))
-                throw 0;
-            aliases.add(j.alias);
-            if (j.state === 'succeeded' && (!j.drained || j.cancelRequested || j.effectsUnknown || j.safeReason !== undefined))
-                throw 0;
-            if (['pending', 'running'].includes(j.state) && (j.drained || j.cancelRequested))
-                throw 0;
-            if (['cancel-requested', 'draining'].includes(j.state) && (!j.cancelRequested || j.drained))
-                throw 0;
-            if (j.state === 'cleanup-required' && (j.drained || j.safeReason !== 'cleanup-required'))
-                throw 0;
-            if (['failed', 'interrupted', 'canceled'].includes(j.state) && j.safeReason === undefined)
-                throw 0;
-            if (j.state === 'canceled' && !j.cancelRequested)
-                throw 0;
-            return { alias: j.alias, state: j.state, ...(j.safeReason === undefined ? {} : { safeReason: j.safeReason }), cancelRequested: j.cancelRequested, drained: j.drained, effectsUnknown: j.effectsUnknown };
-        });
-        return JSON.stringify({ diagnosticSchema: 1, availability: 'unavailable', jobs, total: d.total, truncated: d.truncated }) + '\n';
-    }
-    catch {
-        return '{"safeReason":"invalid-request"}\n';
-    }
-}

package/dist/standalone/lifecycle-helper.d.ts

@@ -1,2 +0,0 @@
-/** Non-privileged management veto shared by the generated package hooks. */
-export declare function renderHelperStoppedCheck(packageId: string, revoke?: boolean): string;

package/dist/standalone/lifecycle-helper.js

@@ -1,12 +0,0 @@
-/** Non-privileged management veto shared by the generated package hooks. */
-export function renderHelperStoppedCheck(packageId, revoke = false) {
-    return `${revoke ? `/var/packages/${packageId}/target/integration/helper revoke && ` : ''}/var/packages/${packageId}/target/integration/helper check-stopped || {
-  message='Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.'
-  printf '%s\\n' "$message" >&2
-  if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then
-    (printf '%s\\n' "$message" >> "$SYNOPKG_TEMP_LOGFILE") 2>/dev/null || :
-  fi
-  exit 1
-}
-`;
-}

package/dist/standalone/native-layout.d.ts

@@ -1,74 +0,0 @@
-import type { CommandRunner } from './build.js';
-export declare const LAYOUT_ARCHES: {
-    readonly x86_64: readonly [2, 62];
-    readonly aarch64: readonly [2, 183];
-    readonly armv8: readonly [2, 183];
-    readonly armv7: readonly [1, 40];
-};
-export type LayoutArch = keyof typeof LAYOUT_ARCHES;
-type Hook = {
-    command: string[];
-    cwd: string;
-    env: Record<string, string>;
-};
-type Toolkit = {
-    url: string;
-    sha256: string;
-};
-type Binary = {
-    path: string;
-    linkage: 'static' | 'dynamic';
-    arches?: LayoutArch[];
-};
-export interface NativeLayout {
-    root: string;
-    package: string;
-    version: string;
-    build: number;
-    displayname: string;
-    description: string;
-    maintainer: string;
-    os_min_ver: string;
-    privilege: 'none';
-    arches: LayoutArch[];
-    layout: {
-        payload: string;
-        metadata: string;
-        binaries: Binary[];
-    };
-    native: {
-        prepare?: Hook;
-        hook: Hook;
-        toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
-    };
-}
-export declare function isNativeLayout(root: string): boolean;
-export declare function loadNativeLayout(root: string): {
-    ok: true;
-    manifest: NativeLayout;
-} | {
-    ok: false;
-    errors: {
-        code: string;
-        message: string;
-    }[];
-};
-export declare function verifyToolkitArchive(path: string, expected: string): void;
-export declare function layoutFiles(root: string): Array<{
-    path: string;
-    mode: number;
-    sha256: string;
-}>;
-export declare function checkLayoutBinary(root: string, b: Binary, arch: LayoutArch): void;
-export declare function checkLayoutMetadata(root: string, inspection?: boolean, packageId?: string): void;
-export declare function buildNativeLayout(options: {
-    root: string;
-    arches?: string[];
-    outDir?: string;
-    build?: number;
-    run?: CommandRunner;
-}): Promise<{
-    outputs: string[];
-}>;
-export declare function inspectNativeLayout(dir: string, payload: string, info: Record<string, string>): string[];
-export {};

package/dist/standalone/native-layout.js

@@ -1,318 +0,0 @@
-/** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
-import { createHash } from 'node:crypto';
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { parse } from 'yaml';
-import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
-import { runCommand } from './build.js';
-export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
-function fail(message) { throw new Error(`NATIVE_LAYOUT_INVALID: ${message}`); }
-const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
-function object(value, fields) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        fail('expected object');
-    const obj = value;
-    if (Object.keys(obj).some(k => !fields.includes(k)))
-        fail('unknown field');
-    return obj;
-}
-function text(value) {
-    if (typeof value !== 'string' || !value || /[\r\n"\\\0]/.test(value))
-        fail('invalid text');
-    return value;
-}
-function pathText(value) {
-    const path = text(value);
-    if (isAbsolute(path) || path.split('/').some(p => p === '..' || p === '') || /[{}]/.test(path.replaceAll('{arch}', '')))
-        fail('path must stay inside project');
-    return path;
-}
-function inside(root, path) {
-    const full = resolve(root, path);
-    const rel = relative(realpathSync(root), realpathSync(full));
-    if (rel === '..' || rel.startsWith('../') || isAbsolute(rel))
-        fail('path escapes project');
-    return full;
-}
-function hook(value) {
-    const h = object(value, ['command', 'cwd', 'env']);
-    if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
-        fail('hook requires argv');
-    const env = object(h.env ?? {}, Object.keys(h.env ?? {}));
-    for (const [key, value] of Object.entries(env))
-        if (!/^[A-Z_][A-Z0-9_]*$/.test(key) || typeof value !== 'string' || value.includes('\0') || key.startsWith('SYNOPKGLAND_'))
-            fail('invalid hook environment');
-    return { command: h.command, cwd: pathText(h.cwd ?? '.'), env };
-}
-export function isNativeLayout(root) {
-    try {
-        return parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8'))?.layout !== undefined;
-    }
-    catch {
-        return false;
-    }
-}
-export function loadNativeLayout(root) {
-    try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
-        if (m.schema !== 1 || m.privilege !== 'none')
-            fail('schema 1 and privilege: none required');
-        if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
-            fail('invalid package/version/DSM');
-        if (!Number.isSafeInteger(m.build) || m.build < 1 || m.build > 2147483647)
-            fail('build must be 1..2147483647');
-        for (const k of ['displayname', 'description', 'maintainer'])
-            text(m[k]);
-        if (!Array.isArray(m.arches) || !m.arches.length || new Set(m.arches).size !== m.arches.length || m.arches.some((a) => !Object.hasOwn(LAYOUT_ARCHES, a)))
-            fail('invalid architecture list');
-        const layout = object(m.layout, ['payload', 'metadata', 'binaries']);
-        layout.payload = pathText(layout.payload);
-        layout.metadata = pathText(layout.metadata);
-        if (!Array.isArray(layout.binaries) || !layout.binaries.length)
-            fail('binary assertions required');
-        for (const b of layout.binaries) {
-            object(b, ['path', 'linkage', 'arches']);
-            pathText(b.path);
-            if (!['static', 'dynamic'].includes(b.linkage))
-                fail('declare binary linkage');
-            if (b.arches !== undefined && (!Array.isArray(b.arches) || !b.arches.length || b.arches.some((a) => !m.arches.includes(a))))
-                fail('invalid binary arches');
-        }
-        const native = object(m.native, ['prepare', 'hook', 'toolkits']);
-        const toolkits = object(native.toolkits ?? {}, m.arches);
-        for (const entries of Object.values(toolkits)) {
-            if (!Array.isArray(entries) || !entries.length)
-                fail('toolkits require archives');
-            for (const t of entries) {
-                object(t, ['url', 'sha256']);
-                const u = new URL(t.url);
-                if (u.protocol !== 'https:' || u.username || u.password || !/^[a-f0-9]{64}$/.test(t.sha256))
-                    fail('toolkits require HTTPS and SHA-256');
-            }
-        }
-        return { ok: true, manifest: { ...m, root: resolve(root), native: { hook: hook(native.hook), ...(native.prepare ? { prepare: hook(native.prepare) } : {}), toolkits } } };
-    }
-    catch (error) {
-        return { ok: false, errors: [{ code: 'NATIVE_LAYOUT_INVALID', message: String(error) }] };
-    }
-}
-export function verifyToolkitArchive(path, expected) {
-    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
-        fail('toolkit checksum mismatch');
-}
-async function toolkitFor(m, arch, run) {
-    const inputs = m.native.toolkits[arch] ?? [];
-    if (!inputs.length)
-        return '';
-    const cache = resolve(process.env.SYNOPKGLAND_CACHE_DIR ?? join(m.root, '.synopkgland-cache'));
-    mkdirSync(cache, { recursive: true, mode: 0o700 });
-    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
-        fail('toolkit cache must be owned and private');
-    const archives = [];
-    for (const input of inputs) {
-        const archive = join(cache, `${input.sha256}.txz`);
-        if (!existsSync(archive)) {
-            const download = mkdtempSync(join(cache, '.download-'));
-            try {
-                const out = join(download, 'archive');
-                const r = run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
-                if (r.status !== 0)
-                    fail('toolkit download failed');
-                verifyToolkitArchive(out, input.sha256);
-                renameSync(out, archive);
-            }
-            finally {
-                rmSync(download, { recursive: true, force: true });
-            }
-        }
-        verifyToolkitArchive(archive, input.sha256);
-        archives.push(archive);
-    }
-    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
-    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
-    try {
-        for (const archive of archives) {
-            const r = run('tar', ['-xJf', archive, '-C', stage, '--keep-directory-symlink'], { cwd: m.root, env: { ...process.env } });
-            if (r.status !== 0)
-                fail('toolkit extraction failed');
-        }
-        return stage;
-    }
-    catch (e) {
-        rmSync(stage, { recursive: true, force: true });
-        throw e;
-    }
-}
-function runHook(m, h, env, run) {
-    const [cmd, ...args] = h.command;
-    const r = run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
-    if (r.status !== 0 || r.missing)
-        fail(`native hook failed: ${r.stderr}`);
-}
-export function layoutFiles(root) {
-    if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink())
-        fail('layout root must be a regular directory');
-    const files = [];
-    let total = 0;
-    const walk = (prefix) => {
-        for (const name of readdirSync(join(root, prefix)).sort()) {
-            const path = prefix ? `${prefix}/${name}` : name;
-            const s = lstatSync(join(root, path));
-            if (s.isSymbolicLink() || (!s.isFile() && !s.isDirectory()))
-                fail('layout contains symlink or special file');
-            if (s.mode & 0o6000)
-                fail('privileged file modes are forbidden');
-            if (s.isDirectory())
-                walk(path);
-            else {
-                total += s.size;
-                if (s.size > 256 * 1024 * 1024 || total > 1024 * 1024 * 1024)
-                    fail('layout exceeds size bound');
-                files.push({ path, mode: s.mode & 0o111 ? 0o755 : 0o644, sha256: digest(readFileSync(join(root, path))) });
-            }
-        }
-    };
-    walk('');
-    return files;
-}
-export function checkLayoutBinary(root, b, arch) {
-    const path = inside(root, b.path);
-    const bytes = readFileSync(path);
-    const [cls, machine] = LAYOUT_ARCHES[arch];
-    if (bytes.length < 64 || bytes.toString('latin1', 0, 4) !== '\x7fELF' || bytes[4] !== cls || bytes[5] !== 1 || bytes.readUInt16LE(18) !== machine || ![2, 3].includes(bytes.readUInt16LE(16)))
-        fail(`ELF architecture mismatch: ${b.path}`);
-    const offset = cls === 1 ? bytes.readUInt32LE(28) : Number(bytes.readBigUInt64LE(32));
-    const size = bytes.readUInt16LE(cls === 1 ? 42 : 54);
-    const count = bytes.readUInt16LE(cls === 1 ? 44 : 56);
-    if (!count || size < (cls === 1 ? 32 : 56) || !Number.isSafeInteger(offset) || offset + size * count > bytes.length)
-        fail('invalid ELF program headers');
-    let dynamic = false;
-    for (let i = 0; i < count; i++)
-        if (bytes.readUInt32LE(offset + size * i) === 3)
-            dynamic = true;
-    if (dynamic !== (b.linkage === 'dynamic'))
-        fail(`ELF linkage mismatch: ${b.path}`);
-    if (!(lstatSync(path).mode & 0o111))
-        fail(`binary must be executable: ${b.path}`);
-}
-function copyTree(from, to) {
-    const entries = layoutFiles(from);
-    for (const entry of entries) {
-        const out = join(to, entry.path);
-        mkdirSync(dirname(out), { recursive: true });
-        copyFileSync(join(from, entry.path), out);
-        chmodSync(out, entry.mode);
-    }
-    return entries;
-}
-export function checkLayoutMetadata(root, inspection = false, packageId) {
-    const p = JSON.parse(readFileSync(join(root, 'conf/privilege'), 'utf8'));
-    if (p.defaults?.['run-as'] !== 'package' || Object.keys(p).some(k => !['defaults', 'username', 'groupname'].includes(k)) || ['username', 'groupname'].some(k => p[k] !== undefined && p[k] !== packageId) || Object.keys(p.defaults).some(k => k !== 'run-as'))
-        fail('native layout requires package-only lifecycle privilege');
-    if (!existsSync(join(root, 'scripts/start-stop-status')))
-        fail('start-stop-status missing');
-    if (existsSync(join(root, 'conf/resource'))) {
-        const resource = object(JSON.parse(readFileSync(join(root, 'conf/resource'), 'utf8')), ['systemd-unit']);
-        if (resource['systemd-unit'] !== undefined && Object.keys(object(resource['systemd-unit'], [])).length)
-            fail('unsupported resource worker');
-    }
-    if (existsSync(join(root, 'conf/systemd'))) {
-        for (const entry of layoutFiles(join(root, 'conf/systemd'))) {
-            const unit = readFileSync(join(root, 'conf/systemd', entry.path), 'utf8');
-            const users = [...unit.matchAll(/^\s*User\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
-            const groups = [...unit.matchAll(/^\s*Group\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
-            if (!packageId || users.length !== 1 || users[0] !== packageId || groups.some(group => group !== packageId) || /^\s*(?:AmbientCapabilities|SupplementaryGroups|PermissionsStartOnly|RootDirectory|RootImage)\s*=/m.test(unit) || /^\s*Exec\w*\s*=\s*[+!]/m.test(unit))
-                fail('systemd unit must run only as the package account');
-        }
-    }
-    for (const name of readdirSync(root))
-        if (!['conf', 'scripts', 'WIZARD_UIFILES', 'PACKAGE_ICON.PNG', 'PACKAGE_ICON_256.PNG', ...(inspection ? ['INFO', 'package.tgz', 'native-layout.json', 'layout-inspection'] : [])].includes(name))
-            fail(`unsupported SPK metadata: ${name}`);
-    for (const f of layoutFiles(root)) {
-        if (f.path.startsWith('scripts/') && /\bsudo\b|\bchown\s+root\b|chmod\s+[ugo]*\+s\b/.test(readFileSync(join(root, f.path), 'utf8')))
-            fail('root lifecycle operation forbidden');
-    }
-}
-export async function buildNativeLayout(options) {
-    const loaded = loadNativeLayout(options.root);
-    if (!loaded.ok)
-        fail(loaded.errors.map(e => e.message).join('\n'));
-    const m = loaded.manifest;
-    if (options.build !== undefined) {
-        if (!Number.isSafeInteger(options.build) || options.build < 1 || options.build > 2147483647)
-            fail('invalid build override');
-        m.build = options.build;
-    }
-    const arches = options.arches ?? m.arches;
-    if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
-        fail('architecture not declared');
-    const run = options.run ?? runCommand;
-    const version = `${m.version}-${String(m.build).padStart(4, '0')}`;
-    const env = { SYNOPKGLAND_PACKAGE: m.package, SYNOPKGLAND_VERSION: m.version, SYNOPKGLAND_BUILD: String(m.build), SYNOPKGLAND_SPK_VERSION: version, SYNOPKGLAND_PROJECT_DIR: m.root };
-    if (m.native.prepare)
-        runHook(m, m.native.prepare, env, run);
-    const outputs = [];
-    for (const requested of arches) {
-        const arch = requested;
-        const toolkit = await toolkitFor(m, arch, run);
-        const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
-        try {
-            runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit }, run);
-            const payload = inside(m.root, m.layout.payload.replaceAll('{arch}', arch));
-            const metadata = inside(m.root, m.layout.metadata);
-            checkLayoutMetadata(metadata, false, m.package);
-            layoutFiles(payload);
-            const binaries = m.layout.binaries.filter(b => !b.arches || b.arches.includes(arch));
-            if (!binaries.length)
-                fail("binary assertions required for every architecture");
-            for (const b of binaries)
-                checkLayoutBinary(payload, b, arch);
-            copyTree(metadata, stage);
-            const target = join(stage, 'payload');
-            mkdirSync(target);
-            const files = copyTree(payload, target);
-            await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
-            rmSync(target, { recursive: true });
-            const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            writeFileSync(join(stage, 'INFO'), Object.entries(fields).map(([k, v]) => `${k}="${v}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files }));
-            const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
-            mkdirSync(dirname(output), { recursive: true });
-            await createReproducibleTar(stage, output);
-            outputs.push(output);
-        }
-        finally {
-            rmSync(stage, { recursive: true, force: true });
-            if (toolkit)
-                rmSync(toolkit, { recursive: true, force: true });
-        }
-    }
-    return { outputs };
-}
-export function inspectNativeLayout(dir, payload, info) {
-    try {
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
-        if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
-            fail('invalid native layout inventory');
-        checkLayoutMetadata(dir, true, info.package);
-        const actual = layoutFiles(payload);
-        if (JSON.stringify(actual) !== JSON.stringify(inv.files))
-            fail('payload checksum or mode mismatch');
-        if (!Array.isArray(inv.binaries) || !inv.binaries.length)
-            fail('missing binary assertions');
-        for (const b of inv.binaries) {
-            object(b, ['path', 'linkage']);
-            pathText(b.path);
-            if (!['static', 'dynamic'].includes(b.linkage))
-                fail('invalid linkage');
-            checkLayoutBinary(payload, b, inv.arch);
-        }
-        if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
-            fail('package checksum mismatch');
-        return [];
-    }
-    catch (e) {
-        return [String(e)];
-    }
-}

package/dist/standalone/root-messages.d.ts

@@ -1,7 +0,0 @@
-import type { Catalog, Locale } from "./i18n.js";
-/**
- * Text of the authorization panel every privilege: root package shows, the
- * same in every package. DSM's own words (Task Scheduler, Run, Remove, …) are
- * taken verbatim from DSM 7.4; test/standalone-root-messages.test.ts pins them.
- */
-export declare const ROOT_MESSAGES: Record<Locale, Catalog>;