@synopackageland/cli 0.7.3 → 0.8.0

package/dist/standalone/arch-jobs.d.ts

@@ -0,0 +1,11 @@
+/** `--jobs`: how many architectures build at once; 1 keeps the sequential build. */
+export declare function checkJobs(jobs?: number): number;
+/**
+ * Builds each architecture, at most `jobs` at a time, and returns the results in
+ * `arches` order. After a failure no further architecture starts; running ones
+ * finish so they clean up. The first failure in `arches` order is rethrown with
+ * `[arch]` in front of its message.
+ */
+export declare function forEachArch<A extends string, T>(arches: readonly A[], jobs: number, build: (arch: A) => Promise<T>): Promise<T[]>;
+/** Builds every SPK in a private folder inside `outDir` and moves them into `outDir` only when all of them succeed. */
+export declare function commitOutputs(outDir: string, build: (stage: string) => Promise<string[]>): Promise<string[]>;

package/dist/standalone/arch-jobs.js

@@ -0,0 +1,54 @@
+import { mkdirSync, mkdtempSync, renameSync, rmSync } from "node:fs";
+import { basename, join } from "node:path";
+/** `--jobs`: how many architectures build at once; 1 keeps the sequential build. */
+export function checkJobs(jobs = 1) {
+    if (!Number.isSafeInteger(jobs) || jobs < 1) {
+        throw Object.assign(new Error(`[CLI_JOBS_INVALID] --jobs must be a positive integer, got ${jobs}.`), { code: "CLI_JOBS_INVALID" });
+    }
+    return jobs;
+}
+/**
+ * Builds each architecture, at most `jobs` at a time, and returns the results in
+ * `arches` order. After a failure no further architecture starts; running ones
+ * finish so they clean up. The first failure in `arches` order is rethrown with
+ * `[arch]` in front of its message.
+ */
+export async function forEachArch(arches, jobs, build) {
+    const results = [];
+    const failures = [];
+    let next = 0;
+    const worker = async () => {
+        while (next < arches.length && !failures.length) {
+            const index = next++;
+            try {
+                results[index] = await build(arches[index]);
+            }
+            catch (error) {
+                failures.push({ index, error });
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(checkJobs(jobs), arches.length) }, worker));
+    const [first] = failures.sort((a, b) => a.index - b.index);
+    if (first) {
+        if (first.error instanceof Error)
+            first.error.message = `[${arches[first.index]}] ${first.error.message}`;
+        throw first.error;
+    }
+    return results;
+}
+/** Builds every SPK in a private folder inside `outDir` and moves them into `outDir` only when all of them succeed. */
+export async function commitOutputs(outDir, build) {
+    mkdirSync(outDir, { recursive: true });
+    const stage = mkdtempSync(join(outDir, ".synopkgland-build-"));
+    try {
+        return (await build(stage)).map((staged) => {
+            const output = join(outDir, basename(staged));
+            renameSync(staged, output);
+            return output;
+        });
+    }
+    finally {
+        rmSync(stage, { recursive: true, force: true });
+    }
+}

package/dist/standalone/build.d.ts

@@ -4,11 +4,14 @@ export interface CommandResult {
     stderr: string;
     /** The program itself was not found. */
     missing?: boolean;
+    /** Standard output, when the caller asked to capture it. */
+    stdout?: string;
 }
 export type CommandRunner = (command: string, args: string[], options: {
     cwd: string;
     env: Record<string, string | undefined>;
-}) => CommandResult;
+    capture?: boolean;
+}) => CommandResult | Promise<CommandResult>;
 export interface StandaloneBuildOptions {
     root: string;
     /** Defaults to every arch in the manifest. */
@@ -17,10 +20,16 @@ export interface StandaloneBuildOptions {
     outDir?: string;
     /** INFO os_min_ver for every SPK (a release such as 7.1, or a full 7.x-build); defaults to the manifest's. */
     minDsm?: string;
+    /** Architectures built at once; defaults to 1. */
+    jobs?: number;
     run?: CommandRunner;
 }
-/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept, and captured stdout. */
 export declare const runCommand: CommandRunner;
+/** `runCommand` for concurrent builds: every output line goes to stderr behind `prefix`, so architectures stay apart. */
+export declare function prefixedRunner(prefix: string): CommandRunner;
+/** The runner one architecture uses: the caller's, or a labelled one while several architectures share the terminal. */
+export declare function runnerFor(run: CommandRunner | undefined, jobs: number, arch: string): CommandRunner;
 /** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
     outputs: string[];

package/dist/standalone/build.js

@@ -1,5 +1,5 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { goBuildEnv } from "../build-spk/dsm-arch.js";
@@ -11,20 +11,61 @@ import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
-/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
-export const runCommand = (command, args, options) => {
-    const result = spawnSync(command, args, {
+import { checkJobs, commitOutputs, forEachArch } from "./arch-jobs.js";
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept, and captured stdout. */
+export const runCommand = (command, args, options) => new Promise((done) => {
+    const child = spawn(command, args, {
         cwd: options.cwd,
         env: options.env,
-        stdio: ["ignore", process.stderr, "pipe"],
-        encoding: "utf8",
+        stdio: ["ignore", options.capture ? "pipe" : process.stderr, "pipe"],
     });
-    if (result.stderr) {
-        process.stderr.write(result.stderr);
-    }
-    const missing = result.error?.code === "ENOENT";
-    return { status: result.status, stderr: result.stderr ?? "", missing };
-};
+    let stderr = "";
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        process.stderr.write(chunk);
+    });
+    child.on("error", (error) => done({ status: null, stderr, missing: error.code === "ENOENT" }));
+    child.on("close", (status) => done({ status, stderr, missing: false, ...(options.capture ? { stdout } : {}) }));
+});
+/** `runCommand` for concurrent builds: every output line goes to stderr behind `prefix`, so architectures stay apart. */
+export function prefixedRunner(prefix) {
+    return (command, args, options) => new Promise((done) => {
+        const child = spawn(command, args, { cwd: options.cwd, env: options.env, stdio: ["ignore", "pipe", "pipe"] });
+        let stderr = "";
+        let stdout = "";
+        if (options.capture) {
+            child.stdout.setEncoding("utf8");
+            child.stdout.on("data", (chunk) => { stdout += chunk; });
+        }
+        const relay = (stream, keep) => {
+            let partial = "";
+            stream.setEncoding("utf8");
+            stream.on("data", (chunk) => {
+                if (keep)
+                    stderr += chunk;
+                const lines = (partial + chunk).split("\n");
+                partial = lines.pop();
+                for (const line of lines)
+                    process.stderr.write(`${prefix}${line}\n`);
+            });
+            stream.on("end", () => { if (partial)
+                process.stderr.write(`${prefix}${partial}\n`); });
+        };
+        if (!options.capture)
+            relay(child.stdout, false);
+        relay(child.stderr, true);
+        child.on("error", (error) => done({ status: null, stderr, missing: error.code === "ENOENT" }));
+        child.on("close", (status) => done({ status, stderr, missing: false, ...(options.capture ? { stdout } : {}) }));
+    });
+}
+/** The runner one architecture uses: the caller's, or a labelled one while several architectures share the terminal. */
+export function runnerFor(run, jobs, arch) {
+    return run ?? (jobs > 1 ? prefixedRunner(`[${arch}] `) : runCommand);
+}
 /** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export async function buildStandalone(options) {
     const loaded = loadStandaloneManifest(options.root);
@@ -41,45 +82,47 @@ export async function buildStandalone(options) {
     if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
-    const run = options.run ?? runCommand;
+    const jobs = checkJobs(options.jobs);
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
             throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
         }
     }
-    buildUi(manifest, run);
+    await buildUi(manifest, options.run ?? runCommand);
     const outDir = options.outDir ?? join(options.root, "dist");
     const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
     try {
-        const outputs = [];
-        for (const arch of arches) {
-            const executor = buildExecutor(manifest, arch, work, run);
+        const outputs = await commitOutputs(outDir, (stage) => forEachArch(arches, jobs, async (arch) => {
+            const run = runnerFor(options.run, jobs, arch);
+            const archWork = join(work, arch);
+            mkdirSync(archWork);
+            const executor = await buildExecutor(manifest, arch, archWork, run);
             const builtManifest = executor ? { ...manifest, executor } : manifest;
-            const cgiPath = backendFor(builtManifest, arch, work, run);
-            const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
+            const cgiPath = await backendFor(builtManifest, arch, archWork, run);
+            const problem = checkCgiBinary(manifest.backend.kind === "go" ? archWork : manifest.root, cgiPath, arch);
             if (problem) {
                 throw new StandaloneBuildError(problem.code, problem.message);
             }
-            const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
-            const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const backgroundWorker = buildBackgroundWorker(builtManifest, arch, work, run);
+            const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
+            const backgroundWorker = await buildBackgroundWorker(builtManifest, arch, archWork, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
-            outputs.push(outputPath);
-        }
+            return outputPath;
+        }));
         return { outputs };
     }
     finally {
         rmSync(work, { recursive: true, force: true });
     }
 }
-function buildUi(manifest, run) {
+async function buildUi(manifest, run) {
     const build = manifest.ui.build;
     if (!build) {
         return;
     }
     const [command, ...args] = build.command;
-    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
+    const result = await run(command, args, { cwd: build.cwd, env: { ...process.env } });
     if (result.missing || result.status !== 0) {
         const installHint = command === "npm" && existsSync(join(build.cwd, "package.json")) && !existsSync(join(build.cwd, "node_modules"))
             ? `\nUI 依賴尚未安裝。請在 ${build.cwd} 執行 npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"}，然後重新執行 build。`
@@ -87,7 +130,7 @@ function buildUi(manifest, run) {
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
-function backendFor(manifest, arch, work, run) {
+async function backendFor(manifest, arch, work, run) {
     const backend = manifest.backend;
     if (backend.kind === "binary") {
         return backend.files[arch];
@@ -113,7 +156,7 @@ function backendFor(manifest, arch, work, run) {
         ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
         ...(manifest.portal ? ["-X main.portal=on"] : []),
     ].join(" ");
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
         env: { ...process.env, ...goBuildEnv(arch) },
     });
@@ -126,14 +169,14 @@ function backendFor(manifest, arch, work, run) {
     return out;
 }
 /** The fixed worker is a second binary of the project's own Go module. */
-function buildBackgroundWorker(manifest, arch, work, run) {
+async function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
     const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`, ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
     ].join(" ");
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
         env: { ...process.env, ...goBuildEnv(arch) },
     });

package/dist/standalone/daemon.d.ts

@@ -20,5 +20,5 @@ export interface Daemon {
 }
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
-export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): string | undefined;
+export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;

package/dist/standalone/daemon.js

@@ -55,11 +55,11 @@ export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts } = manifest.daemon;
     return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts }) + "\n";
 }
-export function buildDaemonControl(manifest, arch, work, run) {
+export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon)
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
         cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)

package/dist/standalone/inspect-spk.d.ts

@@ -40,3 +40,4 @@ export interface SpkInspection {
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;
 /** Auto-detect the generated runtime; retain strict native-go inspection when requested. */
 export declare function inspectSpk(spkPath: string, expectedKind?: SpkKind): Promise<SpkInspection>;
+export declare function listPayload(packageTgz: string, findings: string[]): Promise<SpkInspection["payload"]>;

package/dist/standalone/inspect-spk.js

@@ -509,7 +509,7 @@ function checkUninstall(dir, findings) {
             findings.push(`UNINSTALL_WIZARD_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/postuninst 沒有讀它`);
     }
 }
-async function listPayload(packageTgz, findings) {
+export async function listPayload(packageTgz, findings) {
     if (!existsSync(packageTgz)) {
         findings.push("缺少 package.tgz");
         return [];

package/dist/standalone/manifest.js

@@ -13,6 +13,7 @@ import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
 import { readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
+import { validateReproducible } from "../reproducible-config.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -20,7 +21,7 @@ import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 export const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon",
+    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon", "reproducible",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
@@ -87,6 +88,14 @@ function readManifest(raw, c) {
             c.fail("STANDALONE_FIELD_UNKNOWN", `不支援的欄位「${key}」。Standalone Package 不接受自訂 lifecycle scripts 或 DSM conf。`);
         }
     }
+    if (raw.reproducible !== undefined) {
+        try {
+            validateReproducible(raw.reproducible);
+        }
+        catch (error) {
+            c.fail("REPRODUCIBLE_INVALID", error.message);
+        }
+    }
     if (raw.schema !== 2) {
         c.fail("STANDALONE_SCHEMA_INVALID", "schema: 2 必填；請改成 schema: 2、backend.kind: go|binary，並將 privilege: root、background、fileStation 分別改為 capabilities.rootOps: true、capabilities.jobs: true、capabilities.files: session。");
     }

package/dist/standalone/native-layout.d.ts

@@ -63,6 +63,8 @@ export declare function loadNativeLayout(root: string): {
     }[];
 };
 export declare function verifyToolkitArchive(path: string, expected: string): void;
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
 export declare function layoutFiles(root: string): Array<{
     path: string;
     mode: number;
@@ -76,6 +78,7 @@ export declare function buildNativeLayout(options: {
     outDir?: string;
     build?: number;
     minDsm?: string;
+    jobs?: number;
     run?: CommandRunner;
 }): Promise<{
     outputs: string[];

package/dist/standalone/native-layout.js

@@ -2,14 +2,20 @@ import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
-import { runCommand } from './build.js';
+import { runCommand, runnerFor } from './build.js';
+import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
+import { validateReproducible } from '../reproducible-config.js';
 import { resolveMinDsm } from '../build-spk/dsm-version.js';
+import { infoArchValue } from '../build-spk/dsm-arch.js';
+import { LIFECYCLE_SCRIPTS, REPLACE_SCRIPTS } from '../spk/dsm-spec.js';
 import { renderPackageIcons, writePackageCenterIcons } from '../build-spk/dsm-icons.js';
 export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
+/** INFO arch: aarch64 is not an Appendix A value, so it lists the platforms as native-go and binary do. */
+const layoutInfoArch = (arch) => arch === 'aarch64' ? infoArchValue('aarch64') : arch;
 function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
 function object(value, fields) {
@@ -84,7 +90,7 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
@@ -105,6 +111,8 @@ export function loadNativeLayout(root) {
             fail('invalid architecture list');
         if (m.icon !== undefined)
             m.icon = icon(root, m.icon);
+        if (m.reproducible !== undefined)
+            validateReproducible(m.reproducible);
         const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
@@ -142,11 +150,37 @@ export function verifyToolkitArchive(path, expected) {
     if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
         fail('toolkit checksum mismatch');
 }
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export function toolkitCacheDir(env, platform, home) {
+    if (env.SYNOPKGLAND_CACHE_DIR)
+        return resolve(env.SYNOPKGLAND_CACHE_DIR);
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'synopkgland');
+    const xdg = env.XDG_CACHE_HOME;
+    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
+}
+// Concurrent architectures that pin the same archive share one download.
+const downloads = new Map();
+async function download(m, cache, input, archive, run) {
+    const tmp = mkdtempSync(join(cache, '.download-'));
+    try {
+        const out = join(tmp, 'archive');
+        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
+        if (r.status !== 0)
+            fail('toolkit download failed');
+        // Rename is atomic, so another build process sees either no archive or a verified one.
+        verifyToolkitArchive(out, input.sha256);
+        renameSync(out, archive);
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
 async function toolkitFor(m, arch, run) {
     const inputs = m.native.toolkits[arch] ?? [];
     if (!inputs.length)
         return '';
-    const cache = resolve(process.env.SYNOPKGLAND_CACHE_DIR ?? join(m.root, '.synopkgland-cache'));
+    const cache = toolkitCacheDir(process.env, process.platform, homedir());
     mkdirSync(cache, { recursive: true, mode: 0o700 });
     if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
         fail('toolkit cache must be owned and private');
@@ -154,18 +188,12 @@ async function toolkitFor(m, arch, run) {
     for (const input of inputs) {
         const archive = join(cache, `${input.sha256}.txz`);
         if (!existsSync(archive)) {
-            const download = mkdtempSync(join(cache, '.download-'));
-            try {
-                const out = join(download, 'archive');
-                const r = run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
-                if (r.status !== 0)
-                    fail('toolkit download failed');
-                verifyToolkitArchive(out, input.sha256);
-                renameSync(out, archive);
-            }
-            finally {
-                rmSync(download, { recursive: true, force: true });
+            let pending = downloads.get(archive);
+            if (!pending) {
+                pending = download(m, cache, input, archive, run).finally(() => downloads.delete(archive));
+                downloads.set(archive, pending);
             }
+            await pending;
         }
         verifyToolkitArchive(archive, input.sha256);
         archives.push(archive);
@@ -173,8 +201,11 @@ async function toolkitFor(m, arch, run) {
     // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
     const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
     try {
+        const flavor = await tarFlavor(m, run);
         for (const archive of archives) {
-            const r = run('tar', ['-xJf', archive, '-C', stage, '--keep-directory-symlink'], { cwd: m.root, env: { ...process.env } });
+            if (flavor === 'bsdtar')
+                await refuseEscapingMembers(m, archive, run);
+            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd: m.root, env: { ...process.env } });
             if (r.status !== 0)
                 fail('toolkit extraction failed');
         }
@@ -185,9 +216,33 @@ async function toolkitFor(m, arch, run) {
         throw e;
     }
 }
-function runHook(m, h, env, run) {
+/**
+ * A later toolkit archive may write through a directory symlink an earlier one
+ * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
+ * bsdtar only with -P, which also allows absolute and .. members, so those are
+ * refused from the listing first.
+ */
+async function tarFlavor(m, run) {
+    const r = await run('tar', ['--version'], { cwd: m.root, env: { ...process.env }, capture: true });
+    const version = r.status === 0 ? r.stdout ?? '' : '';
+    if (/\bGNU tar\b/.test(version))
+        return 'gnu';
+    if (/\bbsdtar\b/.test(version))
+        return 'bsdtar';
+    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
+}
+async function refuseEscapingMembers(m, archive, run) {
+    const r = await run('tar', ['-tJf', archive], { cwd: m.root, env: { ...process.env }, capture: true });
+    if (r.status !== 0)
+        fail('toolkit extraction failed');
+    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
+        if (member.startsWith('/') || member.split('/').includes('..'))
+            fail(`toolkit member escapes the toolkit folder: ${member}`);
+    }
+}
+async function runHook(m, h, env, run) {
     const [cmd, ...args] = h.command;
-    const r = run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
+    const r = await run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
     if (r.status !== 0 || r.missing)
         fail(`native hook failed: ${r.stderr}`);
 }
@@ -255,6 +310,11 @@ export function checkLayoutMetadata(root, inspection = false, packageId) {
         fail('native layout requires package-only lifecycle privilege');
     if (!existsSync(join(root, 'scripts/start-stop-status')))
         fail('start-stop-status missing');
+    for (const name of [...LIFECYCLE_SCRIPTS, ...REPLACE_SCRIPTS]) {
+        const path = join(root, 'scripts', name);
+        if (existsSync(path) && !(lstatSync(path).mode & 0o111))
+            throw Object.assign(new Error(`NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE: scripts/${name} is not executable (mode ${(lstatSync(path).mode & 0o777).toString(8)}); DSM runs it directly and inspect reports SPK_SCRIPT_NOT_EXECUTABLE. Run chmod +x on it in the layout metadata folder and build again.`), { code: 'NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE' });
+    }
     if (existsSync(join(root, 'conf/resource'))) {
         const resource = object(JSON.parse(readFileSync(join(root, 'conf/resource'), 'utf8')), ['systemd-unit']);
         if (resource['systemd-unit'] !== undefined && Object.keys(object(resource['systemd-unit'], [])).length)
@@ -307,18 +367,20 @@ export async function buildNativeLayout(options) {
     if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
         fail('architecture not declared');
     const icons = m.icon === undefined ? undefined : renderPackageIcons(inside(m.root, m.icon));
-    const run = options.run ?? runCommand;
+    const jobs = checkJobs(options.jobs);
+    if (jobs > 1 && !m.layout.payload.includes('{arch}'))
+        fail('--jobs above 1 needs a layout.payload path with {arch}, so architectures do not overwrite one payload folder');
     const version = `${m.version}-${String(m.build).padStart(4, '0')}`;
     const env = { SYNOPKGLAND_PACKAGE: m.package, SYNOPKGLAND_VERSION: m.version, SYNOPKGLAND_BUILD: String(m.build), SYNOPKGLAND_SPK_VERSION: version, SYNOPKGLAND_PROJECT_DIR: m.root };
     if (m.native.prepare)
-        runHook(m, m.native.prepare, env, run);
-    const outputs = [];
-    for (const requested of arches) {
-        const arch = requested;
+        await runHook(m, m.native.prepare, env, options.run ?? runCommand);
+    const outputs = await commitOutputs(options.outDir ?? join(m.root, 'dist'), (outDir) => forEachArch(arches, jobs, async (arch) => {
+        const run = runnerFor(options.run, jobs, arch);
         const toolkit = await toolkitFor(m, arch, run);
         const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
+        const work = mkdtempSync(join(tmpdir(), 'synopkgland-work-'));
         try {
-            runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit }, run);
+            await runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit, SYNOPKGLAND_WORK_DIR: work }, run);
             const payload = inside(m.root, m.layout.payload.replaceAll('{arch}', arch));
             const metadata = inside(m.root, m.layout.metadata);
             checkLayoutMetadata(metadata, false, m.package);
@@ -339,23 +401,22 @@ export async function buildNativeLayout(options) {
             const files = copyTree(payload, target);
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
-            const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
+            const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
             const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
             writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
-            const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
-            mkdirSync(dirname(output), { recursive: true });
+            const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
-            outputs.push(output);
+            return output;
         }
         finally {
-            rmSync(stage, { recursive: true, force: true });
-            if (toolkit)
-                rmSync(toolkit, { recursive: true, force: true });
+            for (const dir of [stage, work, toolkit])
+                if (dir)
+                    rmSync(dir, { recursive: true, force: true });
         }
-    }
+    }));
     return { outputs };
 }
 export function inspectNativeLayout(dir, payload, info) {
@@ -363,7 +424,7 @@ export function inspectNativeLayout(dir, payload, info) {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
         const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
-        if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
+        if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
         const actual = layoutFiles(payload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/schema/synology-app.schema.json

@@ -43,6 +43,15 @@
       "type": "string",
       "minLength": 1
     },
+    "reproducible": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "build --verify-reproducible settings: dependency files for the fingerprint (inputs) and paths removed before the second build (clean, may use {arch}). Paths are relative to the project.",
+      "properties": {
+        "inputs": { "type": "array", "maxItems": 64, "items": { "type": "string", "minLength": 1 } },
+        "clean": { "type": "array", "maxItems": 64, "items": { "type": "string", "minLength": 1 } }
+      }
+    },
     "icon": {
       "type": "string",
       "minLength": 1,