@synopackageland/cli 0.6.0 → 0.6.1

package/README.md

@@ -28,7 +28,7 @@ Native-go needs Go 1.25+ and defaults to Vue; install frontend dependencies befo
 
 An App session identifies the person but does not create File Station authority. Files without a live DSM cookie return `dsm_session_required`; sensitive business methods may return `session_revalidation_required`. Sign in to DSM on the same hostname. P2 scope is a usage restriction, not the permission boundary; per-operation account/AppPriv checks must reject disabled accounts and denied application access. Digest-locked boot tasks restore the executor after reboot; complete integrated lifecycle acceptance remains pending.
 
-Native-go/binary require schema 2 `dsm-package.yaml`, with `backend: {kind: go, dir: backend}` or `backend: {kind: binary, files: {x86_64: prebuilt/api-x86_64}}`. Capability values are `files: session`, `jobs: true` (or `{worker: sha256-v1}`), `identity: standalone`, `rootOps: true`, `delegate: {operations: [files.write], scope: home}` inside `capabilities`. Jobs and daemon are mutually exclusive. Binary/compose do not support files/jobs/login/delegate; current rootOps also requires Go. Business route access comes from `backend/internal/api/permissions.json`; SDK-owned route policy cannot be overridden.
+Generated native-go/binary require schema 2 `dsm-package.yaml`, with `backend: {kind: go, dir: backend}` or `backend: {kind: binary, files: {x86_64: prebuilt/api-x86_64}}`. Capability values are `files: session`, `jobs: true` (or `{worker: sha256-v1}`), `identity: standalone`, `rootOps: true`, `delegate: {operations: [files.write], scope: home}` inside `capabilities`. Jobs and daemon are mutually exclusive. Binary/compose do not support files/jobs/login/delegate; current rootOps also requires Go. Business route access comes from `backend/internal/api/permissions.json`; SDK-owned route policy cannot be overridden.
 
 See the [delegate guide](../../website/src/content/docs/docs/guides/delegate.md) ([繁體中文](../../website/src/content/docs/zh-tw/docs/guides/delegate.md)) and [administrator lifecycle checks](../../website/src/content/docs/docs/concepts/lifecycle.md) ([繁體中文](../../website/src/content/docs/zh-tw/docs/concepts/lifecycle.md)) for exact operations, errors and cleanup.
 
@@ -94,3 +94,14 @@ Keep `backend/THIRD_PARTY_NOTICES.txt` current if you change Go modules.
 The supplied notice inventory covers the pinned template dependencies and Go
 runtime; arbitrary developer binaries, Go module additions, container images,
 custom UI bundles and upstream applications need their own notice inventory.
+
+### Existing native products
+
+Schema 2 also supports `backend: {kind: native}` with `layout` and `native` declarations.
+This preserves project-owned multi-executable payloads, metadata/conf, lifecycle hooks,
+checksum-pinned DSM toolkits and x86_64/aarch64/armv8/armv7 families. Lifecycle and
+systemd remain package-only; root task authorization is an explicit product responsibility.
+The separate `@synopackageland/cli/authorization-sdk` export provides the pinned-task
+host adapter and Vue authorization gate. Generated Go rootOps/delegate still use the executor.
+See the [native layout and migration guide](../../website/src/content/docs/docs/guides/native-layout.md)
+([繁體中文](../../website/src/content/docs/zh-tw/docs/guides/native-layout.md)).

package/dist/authorization-sdk.d.ts

@@ -0,0 +1,7 @@
+/** Explicit build-time adapter for native products with their own pinned root tasks.
+ * Generated Go capabilities continue to use the protected executor.
+ * No task/grant is created by importing this module.
+ */
+export { ROOT_RUNTIME, type RootTask } from './standalone/native-root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
+export declare const authorizationTemplateDirectory: URL;

package/dist/authorization-sdk.js

@@ -0,0 +1,7 @@
+/** Explicit build-time adapter for native products with their own pinned root tasks.
+ * Generated Go capabilities continue to use the protected executor.
+ * No task/grant is created by importing this module.
+ */
+export { ROOT_RUNTIME } from './standalone/native-root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
+export const authorizationTemplateDirectory = new URL('../templates/native-authorization/', import.meta.url);

package/dist/cli.js

@@ -23,6 +23,7 @@ import { followProjectLogs, followStandaloneLogs } from "./log.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
 import { resolveInstallParameterExtraValues } from "./deploy/param-values.js";
 import { findStandaloneRoot, loadStandaloneManifest, } from "./standalone/manifest.js";
+import { buildNativeLayout, isNativeLayout, loadNativeLayout, LAYOUT_ARCHES } from "./standalone/native-layout.js";
 import { buildStandalone } from "./standalone/build.js";
 import { inspectSpk } from "./standalone/inspect-spk.js";
 function failure(code, message, hint = "修正設定後重試；使用 --help 查看指令用法。") {
@@ -69,12 +70,9 @@ async function standaloneBuild(root, arches, options) {
         : options.outDir
             ? resolve(options.outDir)
             : undefined;
-    const result = await buildStandalone({
-        root,
-        arches,
-        outDir,
-        minDsm: options.minDsm,
-    });
+    const result = isNativeLayout(root)
+        ? await buildNativeLayout({ root, arches, outDir, minDsm: options.minDsm })
+        : await buildStandalone({ root, arches: arches, outDir, minDsm: options.minDsm });
     return result.outputs.map((output) => {
         if (!options.output)
             return output;
@@ -141,12 +139,12 @@ export async function runCli(argv) {
             throw failure(validation.errors[0].code, formatErrors(validation.errors), validation.errors[0].suggestion);
         const standalone = standaloneRoot(rootOf(command));
         if (standalone) {
-            const loaded = loadStandaloneManifest(standalone);
+            const loaded = isNativeLayout(standalone) ? loadNativeLayout(standalone) : loadStandaloneManifest(standalone);
             if (!loaded.ok)
                 throw failure(loaded.errors[0].code, loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"), "將 dsm-package.yaml 更新為 schema: 2，修正宣告後重試。");
             emit("check", {
                 package: loaded.manifest.package,
-                capabilities: loaded.manifest.capabilities,
+                capabilities: "capabilities" in loaded.manifest ? loaded.manifest.capabilities : {},
             }, "驗證通過。");
             return;
         }
@@ -377,21 +375,27 @@ export async function runCli(argv) {
         .option("--json", "輸出單一 JSON 物件")
         .option("-o, --output <path>", "輸出 SPK，搭配單一 --arch")
         .option("--out-dir <dir>", "輸出目錄，原生專案預設 dist/")
-        .option("--arch <families>", `架構，可用逗號分隔：${NATIVE_ARCH_FAMILIES.join(",")}`)
+        .option("--arch <families>", `架構，可用逗號分隔：${NATIVE_ARCH_FAMILIES.join(",")}；native layout 另支援 armv8,armv7`)
         .option("--min-dsm <version>", "最低 DSM 版本，省略時使用 manifest 值")
         .action(async (options, command) => {
+        const root = rootOf(command);
+        const standalone = standaloneRoot(root);
         let arches;
         try {
             arches =
                 options.arch === undefined
                     ? undefined
-                    : parseArchList(String(options.arch));
+                    : standalone && isNativeLayout(standalone)
+                        ? String(options.arch).split(",").map((arch) => {
+                            if (!Object.hasOwn(LAYOUT_ARCHES, arch))
+                                throw new Error(`Native layout arch must be one of ${Object.keys(LAYOUT_ARCHES).join(", ")}`);
+                            return arch;
+                        })
+                        : parseArchList(String(options.arch));
         }
         catch (error) {
             throw failure("CLI_ARCH_INVALID", error instanceof Error ? error.message : String(error));
         }
-        const root = rootOf(command);
-        const standalone = standaloneRoot(root);
         const outputs = standalone
             ? await standaloneBuild(standalone, arches, options)
             : await containerBuild(requireProject(root), arches, options);

package/dist/error-registry.js

@@ -1,4 +1,9 @@
 export const ERROR_REGISTRY = {
+    "NATIVE_LAYOUT_INVALID": {
+        code: "NATIVE_LAYOUT_INVALID",
+        description: "Native layout manifest, hook, toolkit or artifact violates the package-only contract.",
+        suggestion: "Use schema 2 with backend.kind: native; check paths, ELF linkage and checksum pins."
+    },
     "COMPOSE_ROUTE_UNSUPPORTED": {
         "code": "COMPOSE_ROUTE_UNSUPPORTED",
         "description": "Compose 沒有可用的 DSM resource worker 執行路徑。",

package/dist/standalone/inspect-spk.d.ts

@@ -1,6 +1,6 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
-export type SpkKind = "native-go" | "binary" | "container";
+export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
     package?: string;

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,4 @@
+import { inspectNativeLayout } from "./native-layout.js";
 import { inspectExecutor } from "../runtime/executor-inspect.js";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -27,6 +28,19 @@ export async function inspectSpk(spkPath, expectedKind) {
     try {
         await tar.x({ file: spkPath, cwd: dir });
         const findings = [];
+        if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
+            const info = readInfo(join(dir, "INFO"), findings, "native-layout");
+            const payload = await listPayload(join(dir, "package.tgz"), findings);
+            const target = join(dir, "layout-inspection");
+            mkdirSync(target);
+            await tar.x({ file: join(dir, "package.tgz"), cwd: target });
+            findings.push(...inspectNativeLayout(dir, target, info));
+            for (const key of ["package", "version", "arch", "os_min_ver", "checksum"])
+                if (!info[key])
+                    findings.push(`Missing INFO ${key}`);
+            return { kind: "native-layout", package: info.package, version: info.version, arch: info.arch,
+                signed: existsSync(join(dir, "syno_signature.asc")), payload, findings, capabilities: [] };
+        }
         const payload = await listPayload(join(dir, "package.tgz"), findings);
         const paths = new Set(payload.map(entry => entry.path));
         let metadata = {};

package/dist/standalone/native-authorization-window.d.ts

@@ -0,0 +1,2 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/native-authorization-window.js

@@ -0,0 +1,28 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options) {
+  var busy = null;
+  function fail(code) { var error = new Error(code); error.code = code; return error; }
+  function status() { return options.call("authorization.status").then(function (d) {
+    if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
+    return d;
+  }); }
+  function plan(method) { return options.call(method).then(function (p) {
+    if (!p || p.command !== "authorization" || p.schema_version !== 1 || p.phase !== "plan" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail("authorization_bad_response");
+    var seen = {};
+    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
+    return p;
+  }); }
+  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
+  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
+    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op) : null; });
+  }); },Promise.resolve()); }
+  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
+    return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); },revoke:function () { return exclusive(function () {
+    return plan("authorization.revoke").then(function (p) {
+      if (p.withdraw === true && typeof options.withdraw !== "function") throw fail("authorization_bad_response");
+      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize(["helper_disable"],true) : Promise.resolve();
+      return disabled.then(function () { return p.purge === true ? authorize(["helper_purge"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });
+    }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); }};
+}`;

package/dist/standalone/native-layout.d.ts

@@ -0,0 +1,79 @@
+import type { CommandRunner } from './build.js';
+export declare const LAYOUT_ARCHES: {
+    readonly x86_64: readonly [2, 62];
+    readonly aarch64: readonly [2, 183];
+    readonly armv8: readonly [2, 183];
+    readonly armv7: readonly [1, 40];
+};
+export type LayoutArch = keyof typeof LAYOUT_ARCHES;
+type Hook = {
+    command: string[];
+    cwd: string;
+    env: Record<string, string>;
+};
+type Toolkit = {
+    url: string;
+    sha256: string;
+};
+type Binary = {
+    path: string;
+    linkage: 'static' | 'dynamic';
+    arches?: LayoutArch[];
+};
+export interface NativeLayout {
+    root: string;
+    package: string;
+    version: string;
+    build: number;
+    displayname: string;
+    description: string;
+    maintainer: string;
+    os_min_ver: string;
+    privilege: 'none';
+    arches: LayoutArch[];
+    schema: 2;
+    backend: {
+        kind: 'native';
+    };
+    layout: {
+        payload: string;
+        metadata: string;
+        binaries: Binary[];
+    };
+    native: {
+        prepare?: Hook;
+        hook: Hook;
+        toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
+    };
+}
+export declare function isNativeLayout(root: string): boolean;
+export declare function loadNativeLayout(root: string): {
+    ok: true;
+    manifest: NativeLayout;
+} | {
+    ok: false;
+    errors: {
+        code: string;
+        message: string;
+    }[];
+};
+export declare function verifyToolkitArchive(path: string, expected: string): void;
+export declare function layoutFiles(root: string): Array<{
+    path: string;
+    mode: number;
+    sha256: string;
+}>;
+export declare function checkLayoutBinary(root: string, b: Binary, arch: LayoutArch): void;
+export declare function checkLayoutMetadata(root: string, inspection?: boolean, packageId?: string): void;
+export declare function buildNativeLayout(options: {
+    root: string;
+    arches?: string[];
+    outDir?: string;
+    build?: number;
+    minDsm?: string;
+    run?: CommandRunner;
+}): Promise<{
+    outputs: string[];
+}>;
+export declare function inspectNativeLayout(dir: string, payload: string, info: Record<string, string>): string[];
+export {};

package/dist/standalone/native-layout.js

@@ -0,0 +1,345 @@
+/** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
+import { createHash } from 'node:crypto';
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
+import { runCommand } from './build.js';
+import { resolveMinDsm } from '../build-spk/dsm-version.js';
+export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
+function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+function object(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('expected object');
+    const obj = value;
+    if (Object.keys(obj).some(k => !fields.includes(k)))
+        fail('unknown field');
+    return obj;
+}
+function text(value) {
+    if (typeof value !== 'string' || !value || /[\r\n"\\\0]/.test(value))
+        fail('invalid text');
+    return value;
+}
+function pathText(value) {
+    const path = text(value);
+    if (isAbsolute(path) || path.split('/').some(p => p === '..' || p === '') || /[{}]/.test(path.replaceAll('{arch}', '')))
+        fail('path must stay inside project');
+    return path;
+}
+function inside(root, path) {
+    const full = resolve(root, path);
+    const rel = relative(realpathSync(root), realpathSync(full));
+    if (rel === '..' || rel.startsWith('../') || isAbsolute(rel))
+        fail('path escapes project');
+    return full;
+}
+function hook(value) {
+    const h = object(value, ['command', 'cwd', 'env']);
+    if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
+        fail('hook requires argv');
+    const env = object(h.env ?? {}, Object.keys(h.env ?? {}));
+    for (const [key, value] of Object.entries(env))
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(key) || typeof value !== 'string' || value.includes('\0') || key.startsWith('SYNOPKGLAND_'))
+            fail('invalid hook environment');
+    return { command: h.command, cwd: pathText(h.cwd ?? '.'), env };
+}
+export function isNativeLayout(root) {
+    try {
+        return (() => { const raw = parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')); return raw?.layout !== undefined || raw?.backend?.kind === 'native'; })();
+    }
+    catch {
+        return false;
+    }
+}
+export function loadNativeLayout(root) {
+    try {
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
+        if (m.schema !== 2)
+            fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
+        const backend = object(m.backend, ['kind']);
+        if (backend.kind !== 'native' || (m.privilege !== undefined && m.privilege !== 'none'))
+            fail('backend.kind: native and package-only privilege required');
+        m.privilege = 'none';
+        if (existsSync(join(root, 'compose.yaml')))
+            fail('compose.yaml and dsm-package.yaml are mutually exclusive');
+        if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
+            fail('invalid package/version/DSM');
+        if (!Number.isSafeInteger(m.build) || m.build < 1 || m.build > 2147483647)
+            fail('build must be 1..2147483647');
+        for (const k of ['displayname', 'description', 'maintainer'])
+            text(m[k]);
+        if (!Array.isArray(m.arches) || !m.arches.length || new Set(m.arches).size !== m.arches.length || m.arches.some((a) => !Object.hasOwn(LAYOUT_ARCHES, a)))
+            fail('invalid architecture list');
+        const layout = object(m.layout, ['payload', 'metadata', 'binaries']);
+        layout.payload = pathText(layout.payload);
+        layout.metadata = pathText(layout.metadata);
+        if (!Array.isArray(layout.binaries) || !layout.binaries.length)
+            fail('binary assertions required');
+        for (const b of layout.binaries) {
+            object(b, ['path', 'linkage', 'arches']);
+            pathText(b.path);
+            if (!['static', 'dynamic'].includes(b.linkage))
+                fail('declare binary linkage');
+            if (b.arches !== undefined && (!Array.isArray(b.arches) || !b.arches.length || b.arches.some((a) => !m.arches.includes(a))))
+                fail('invalid binary arches');
+        }
+        const native = object(m.native, ['prepare', 'hook', 'toolkits']);
+        const toolkits = object(native.toolkits ?? {}, m.arches);
+        for (const entries of Object.values(toolkits)) {
+            if (!Array.isArray(entries) || !entries.length)
+                fail('toolkits require archives');
+            for (const t of entries) {
+                object(t, ['url', 'sha256']);
+                const u = new URL(t.url);
+                if (u.protocol !== 'https:' || u.username || u.password || !/^[a-f0-9]{64}$/.test(t.sha256))
+                    fail('toolkits require HTTPS and SHA-256');
+            }
+        }
+        return { ok: true, manifest: { ...m, root: resolve(root), native: { hook: hook(native.hook), ...(native.prepare ? { prepare: hook(native.prepare) } : {}), toolkits } } };
+    }
+    catch (error) {
+        return { ok: false, errors: [{ code: 'NATIVE_LAYOUT_INVALID', message: String(error) }] };
+    }
+}
+export function verifyToolkitArchive(path, expected) {
+    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
+        fail('toolkit checksum mismatch');
+}
+async function toolkitFor(m, arch, run) {
+    const inputs = m.native.toolkits[arch] ?? [];
+    if (!inputs.length)
+        return '';
+    const cache = resolve(process.env.SYNOPKGLAND_CACHE_DIR ?? join(m.root, '.synopkgland-cache'));
+    mkdirSync(cache, { recursive: true, mode: 0o700 });
+    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
+        fail('toolkit cache must be owned and private');
+    const archives = [];
+    for (const input of inputs) {
+        const archive = join(cache, `${input.sha256}.txz`);
+        if (!existsSync(archive)) {
+            const download = mkdtempSync(join(cache, '.download-'));
+            try {
+                const out = join(download, 'archive');
+                const r = run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
+                if (r.status !== 0)
+                    fail('toolkit download failed');
+                verifyToolkitArchive(out, input.sha256);
+                renameSync(out, archive);
+            }
+            finally {
+                rmSync(download, { recursive: true, force: true });
+            }
+        }
+        verifyToolkitArchive(archive, input.sha256);
+        archives.push(archive);
+    }
+    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
+    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
+    try {
+        for (const archive of archives) {
+            const r = run('tar', ['-xJf', archive, '-C', stage, '--keep-directory-symlink'], { cwd: m.root, env: { ...process.env } });
+            if (r.status !== 0)
+                fail('toolkit extraction failed');
+        }
+        return stage;
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw e;
+    }
+}
+function runHook(m, h, env, run) {
+    const [cmd, ...args] = h.command;
+    const r = run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
+    if (r.status !== 0 || r.missing)
+        fail(`native hook failed: ${r.stderr}`);
+}
+export function layoutFiles(root) {
+    if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink())
+        fail('layout root must be a regular directory');
+    const files = [];
+    let total = 0;
+    const walk = (prefix) => {
+        for (const name of readdirSync(join(root, prefix)).sort()) {
+            const path = prefix ? `${prefix}/${name}` : name;
+            const s = lstatSync(join(root, path));
+            if (s.isSymbolicLink() || (!s.isFile() && !s.isDirectory()))
+                fail('layout contains symlink or special file');
+            if (s.mode & 0o6000)
+                fail('privileged file modes are forbidden');
+            if (s.isDirectory())
+                walk(path);
+            else {
+                total += s.size;
+                if (s.size > 256 * 1024 * 1024 || total > 1024 * 1024 * 1024)
+                    fail('layout exceeds size bound');
+                files.push({ path, mode: s.mode & 0o111 ? 0o755 : 0o644, sha256: digest(readFileSync(join(root, path))) });
+            }
+        }
+    };
+    walk('');
+    return files;
+}
+export function checkLayoutBinary(root, b, arch) {
+    const path = inside(root, b.path);
+    const bytes = readFileSync(path);
+    const [cls, machine] = LAYOUT_ARCHES[arch];
+    if (bytes.length < 64 || bytes.toString('latin1', 0, 4) !== '\x7fELF' || bytes[4] !== cls || bytes[5] !== 1 || bytes.readUInt16LE(18) !== machine || ![2, 3].includes(bytes.readUInt16LE(16)))
+        fail(`ELF architecture mismatch: ${b.path}`);
+    const offset = cls === 1 ? bytes.readUInt32LE(28) : Number(bytes.readBigUInt64LE(32));
+    const size = bytes.readUInt16LE(cls === 1 ? 42 : 54);
+    const count = bytes.readUInt16LE(cls === 1 ? 44 : 56);
+    if (!count || size < (cls === 1 ? 32 : 56) || !Number.isSafeInteger(offset) || offset + size * count > bytes.length)
+        fail('invalid ELF program headers');
+    let dynamic = false;
+    for (let i = 0; i < count; i++)
+        if (bytes.readUInt32LE(offset + size * i) === 3)
+            dynamic = true;
+    if (dynamic !== (b.linkage === 'dynamic'))
+        fail(`ELF linkage mismatch: ${b.path}`);
+    if (!(lstatSync(path).mode & 0o111))
+        fail(`binary must be executable: ${b.path}`);
+}
+function copyTree(from, to) {
+    const entries = layoutFiles(from);
+    for (const entry of entries) {
+        const out = join(to, entry.path);
+        mkdirSync(dirname(out), { recursive: true });
+        copyFileSync(join(from, entry.path), out);
+        chmodSync(out, entry.mode);
+    }
+    return entries;
+}
+export function checkLayoutMetadata(root, inspection = false, packageId) {
+    layoutFiles(root);
+    const p = object(JSON.parse(readFileSync(join(root, 'conf/privilege'), 'utf8')), ['defaults', 'username', 'groupname']);
+    object(p.defaults, ['run-as']);
+    if (p.defaults?.['run-as'] !== 'package' || Object.keys(p).some(k => !['defaults', 'username', 'groupname'].includes(k)) || ['username', 'groupname'].some(k => p[k] !== undefined && p[k] !== packageId) || Object.keys(p.defaults).some(k => k !== 'run-as'))
+        fail('native layout requires package-only lifecycle privilege');
+    if (!existsSync(join(root, 'scripts/start-stop-status')))
+        fail('start-stop-status missing');
+    if (existsSync(join(root, 'conf/resource'))) {
+        const resource = object(JSON.parse(readFileSync(join(root, 'conf/resource'), 'utf8')), ['systemd-unit']);
+        if (resource['systemd-unit'] !== undefined && Object.keys(object(resource['systemd-unit'], [])).length)
+            fail('unsupported resource worker');
+    }
+    if (existsSync(join(root, 'conf/systemd'))) {
+        for (const entry of layoutFiles(join(root, 'conf/systemd'))) {
+            const unit = readFileSync(join(root, 'conf/systemd', entry.path), 'utf8');
+            // Keep the package-only grammar unambiguous; systemd joins continued lines
+            // before interpreting Exec prefixes, which a physical-line check misses.
+            if (/\\\s*$/m.test(unit))
+                fail('systemd unit continuations are unsupported');
+            let section = '';
+            for (const line of unit.split('\n')) {
+                const heading = line.match(/^\s*\[([^\]]+)\]\s*$/);
+                if (heading)
+                    section = heading[1];
+                if (/^\s*(?:User|Group|Exec\w*)\s*=/.test(line) && section !== 'Service')
+                    fail('systemd execution directives require the package Service section');
+            }
+            if (!/^[^/]+\.service$/.test(entry.path))
+                fail('only package service units are supported');
+            const users = [...unit.matchAll(/^\s*User\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
+            const groups = [...unit.matchAll(/^\s*Group\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
+            if (!packageId || users.length !== 1 || users[0] !== packageId || groups.some(group => group !== packageId) || /^\s*(?:AmbientCapabilities|SupplementaryGroups|PermissionsStartOnly|RootDirectory|RootImage)\s*=/m.test(unit) || /^\s*Exec\w*\s*=\s*[-:@|]*[+!]/m.test(unit))
+                fail('systemd unit must run only as the package account');
+        }
+    }
+    for (const name of readdirSync(root))
+        if (!['conf', 'scripts', 'WIZARD_UIFILES', 'PACKAGE_ICON.PNG', 'PACKAGE_ICON_256.PNG', ...(inspection ? ['INFO', 'package.tgz', 'native-layout.json', 'layout-inspection', 'syno_signature.asc'] : [])].includes(name))
+            fail(`unsupported SPK metadata: ${name}`);
+    for (const f of layoutFiles(root)) {
+        if (f.path.startsWith('scripts/') && /\bsudo\b|\bchown\s+root\b|chmod\s+[ugo]*\+s\b/.test(readFileSync(join(root, f.path), 'utf8')))
+            fail('root lifecycle operation forbidden');
+    }
+}
+export async function buildNativeLayout(options) {
+    const loaded = loadNativeLayout(options.root);
+    if (!loaded.ok)
+        fail(loaded.errors.map(e => e.message).join('\n'));
+    const m = loaded.manifest;
+    if (options.minDsm !== undefined)
+        m.os_min_ver = resolveMinDsm(options.minDsm);
+    if (options.build !== undefined) {
+        if (!Number.isSafeInteger(options.build) || options.build < 1 || options.build > 2147483647)
+            fail('invalid build override');
+        m.build = options.build;
+    }
+    const arches = options.arches ?? m.arches;
+    if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
+        fail('architecture not declared');
+    const run = options.run ?? runCommand;
+    const version = `${m.version}-${String(m.build).padStart(4, '0')}`;
+    const env = { SYNOPKGLAND_PACKAGE: m.package, SYNOPKGLAND_VERSION: m.version, SYNOPKGLAND_BUILD: String(m.build), SYNOPKGLAND_SPK_VERSION: version, SYNOPKGLAND_PROJECT_DIR: m.root };
+    if (m.native.prepare)
+        runHook(m, m.native.prepare, env, run);
+    const outputs = [];
+    for (const requested of arches) {
+        const arch = requested;
+        const toolkit = await toolkitFor(m, arch, run);
+        const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
+        try {
+            runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit }, run);
+            const payload = inside(m.root, m.layout.payload.replaceAll('{arch}', arch));
+            const metadata = inside(m.root, m.layout.metadata);
+            checkLayoutMetadata(metadata, false, m.package);
+            layoutFiles(payload);
+            const binaries = m.layout.binaries.filter(b => !b.arches || b.arches.includes(arch));
+            if (!binaries.length)
+                fail("binary assertions required for every architecture");
+            for (const b of binaries)
+                checkLayoutBinary(payload, b, arch);
+            copyTree(metadata, stage);
+            const target = join(stage, 'payload');
+            mkdirSync(target);
+            const files = copyTree(payload, target);
+            await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
+            rmSync(target, { recursive: true });
+            const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
+            writeFileSync(join(stage, 'INFO'), Object.entries(fields).map(([k, v]) => `${k}="${v}"\n`).join(''));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files }));
+            const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
+            mkdirSync(dirname(output), { recursive: true });
+            await createReproducibleTar(stage, output);
+            outputs.push(output);
+        }
+        finally {
+            rmSync(stage, { recursive: true, force: true });
+            if (toolkit)
+                rmSync(toolkit, { recursive: true, force: true });
+        }
+    }
+    return { outputs };
+}
+export function inspectNativeLayout(dir, payload, info) {
+    try {
+        if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
+            fail('invalid native INFO identity/version/DSM');
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
+        if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
+            fail('invalid native layout inventory');
+        checkLayoutMetadata(dir, true, info.package);
+        const actual = layoutFiles(payload);
+        if (JSON.stringify(actual) !== JSON.stringify(inv.files))
+            fail('payload checksum or mode mismatch');
+        if (!Array.isArray(inv.binaries) || !inv.binaries.length)
+            fail('missing binary assertions');
+        for (const b of inv.binaries) {
+            object(b, ['path', 'linkage']);
+            pathText(b.path);
+            if (!['static', 'dynamic'].includes(b.linkage))
+                fail('invalid linkage');
+            checkLayoutBinary(payload, b, inv.arch);
+        }
+        if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
+            fail('package checksum mismatch');
+        return [];
+    }
+    catch (e) {
+        return [String(e)];
+    }
+}