@synopackageland/cli 0.7.3 → 0.9.0

package/dist/standalone/build.js

@@ -1,5 +1,6 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { goModulePath, privateSdkHint, SDK_MODULE } from "../runtime/sdk-source.js";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { goBuildEnv } from "../build-spk/dsm-arch.js";
@@ -11,20 +12,61 @@ import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
-/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
-export const runCommand = (command, args, options) => {
-    const result = spawnSync(command, args, {
+import { checkJobs, commitOutputs, forEachArch } from "./arch-jobs.js";
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept, and captured stdout. */
+export const runCommand = (command, args, options) => new Promise((done) => {
+    const child = spawn(command, args, {
         cwd: options.cwd,
         env: options.env,
-        stdio: ["ignore", process.stderr, "pipe"],
-        encoding: "utf8",
+        stdio: ["ignore", options.capture ? "pipe" : process.stderr, "pipe"],
     });
-    if (result.stderr) {
-        process.stderr.write(result.stderr);
-    }
-    const missing = result.error?.code === "ENOENT";
-    return { status: result.status, stderr: result.stderr ?? "", missing };
-};
+    let stderr = "";
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        process.stderr.write(chunk);
+    });
+    child.on("error", (error) => done({ status: null, stderr, missing: error.code === "ENOENT" }));
+    child.on("close", (status) => done({ status, stderr, missing: false, ...(options.capture ? { stdout } : {}) }));
+});
+/** `runCommand` for concurrent builds: every output line goes to stderr behind `prefix`, so architectures stay apart. */
+export function prefixedRunner(prefix) {
+    return (command, args, options) => new Promise((done) => {
+        const child = spawn(command, args, { cwd: options.cwd, env: options.env, stdio: ["ignore", "pipe", "pipe"] });
+        let stderr = "";
+        let stdout = "";
+        if (options.capture) {
+            child.stdout.setEncoding("utf8");
+            child.stdout.on("data", (chunk) => { stdout += chunk; });
+        }
+        const relay = (stream, keep) => {
+            let partial = "";
+            stream.setEncoding("utf8");
+            stream.on("data", (chunk) => {
+                if (keep)
+                    stderr += chunk;
+                const lines = (partial + chunk).split("\n");
+                partial = lines.pop();
+                for (const line of lines)
+                    process.stderr.write(`${prefix}${line}\n`);
+            });
+            stream.on("end", () => { if (partial)
+                process.stderr.write(`${prefix}${partial}\n`); });
+        };
+        if (!options.capture)
+            relay(child.stdout, false);
+        relay(child.stderr, true);
+        child.on("error", (error) => done({ status: null, stderr, missing: error.code === "ENOENT" }));
+        child.on("close", (status) => done({ status, stderr, missing: false, ...(options.capture ? { stdout } : {}) }));
+    });
+}
+/** The runner one architecture uses: the caller's, or a labelled one while several architectures share the terminal. */
+export function runnerFor(run, jobs, arch) {
+    return run ?? (jobs > 1 ? prefixedRunner(`[${arch}] `) : runCommand);
+}
 /** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export async function buildStandalone(options) {
     const loaded = loadStandaloneManifest(options.root);
@@ -41,45 +83,49 @@ export async function buildStandalone(options) {
     if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
-    const run = options.run ?? runCommand;
+    const jobs = checkJobs(options.jobs);
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
             throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
         }
     }
-    buildUi(manifest, run);
+    await buildUi(manifest, options.run ?? runCommand);
     const outDir = options.outDir ?? join(options.root, "dist");
     const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
+    const warnings = new Set();
     try {
-        const outputs = [];
-        for (const arch of arches) {
-            const executor = buildExecutor(manifest, arch, work, run);
+        const outputs = await commitOutputs(outDir, (stage) => forEachArch(arches, jobs, async (arch) => {
+            const run = runnerFor(options.run, jobs, arch);
+            const archWork = join(work, arch);
+            mkdirSync(archWork);
+            const executor = await buildExecutor(manifest, arch, archWork, run);
+            executor?.warnings.forEach(warning => warnings.add(warning));
             const builtManifest = executor ? { ...manifest, executor } : manifest;
-            const cgiPath = backendFor(builtManifest, arch, work, run);
-            const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
+            const cgiPath = await backendFor(builtManifest, arch, archWork, run);
+            const problem = checkCgiBinary(manifest.backend.kind === "go" ? archWork : manifest.root, cgiPath, arch);
             if (problem) {
                 throw new StandaloneBuildError(problem.code, problem.message);
             }
-            const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
-            const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const backgroundWorker = buildBackgroundWorker(builtManifest, arch, work, run);
+            const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
+            const backgroundWorker = await buildBackgroundWorker(builtManifest, arch, archWork, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
-            outputs.push(outputPath);
-        }
-        return { outputs };
+            return outputPath;
+        }));
+        return { outputs, warnings: [...warnings] };
     }
     finally {
         rmSync(work, { recursive: true, force: true });
     }
 }
-function buildUi(manifest, run) {
+async function buildUi(manifest, run) {
     const build = manifest.ui.build;
     if (!build) {
         return;
     }
     const [command, ...args] = build.command;
-    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
+    const result = await run(command, args, { cwd: build.cwd, env: { ...process.env } });
     if (result.missing || result.status !== 0) {
         const installHint = command === "npm" && existsSync(join(build.cwd, "package.json")) && !existsSync(join(build.cwd, "node_modules"))
             ? `\nUI 依賴尚未安裝。請在 ${build.cwd} 執行 npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"}，然後重新執行 build。`
@@ -87,7 +133,7 @@ function buildUi(manifest, run) {
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
-function backendFor(manifest, arch, work, run) {
+async function backendFor(manifest, arch, work, run) {
     const backend = manifest.backend;
     if (backend.kind === "binary") {
         return backend.files[arch];
@@ -97,6 +143,9 @@ function backendFor(manifest, arch, work, run) {
     if (readApiPermissions(backend.dir, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend.dir, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
+    const module = goModulePath(backend.dir);
+    if (!module)
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} 沒有 module 行；backend 必須是一個 Go module。`);
     const out = join(work, `api-${arch}.cgi`);
     const ldflags = [
         "-s",
@@ -104,8 +153,8 @@ function backendFor(manifest, arch, work, run) {
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
         `-X main.version=${manifest.spkVersion}`,
-        `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
-        `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
         ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
@@ -113,7 +162,7 @@ function backendFor(manifest, arch, work, run) {
         ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
         ...(manifest.portal ? ["-X main.portal=on"] : []),
     ].join(" ");
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
         env: { ...process.env, ...goBuildEnv(arch) },
     });
@@ -121,19 +170,20 @@ function backendFor(manifest, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
     }
     if (result.status !== 0) {
-        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);
+        const fetchingSdk = result.stderr.includes(`${SDK_MODULE}@`) ? privateSdkHint() : "";
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}${fetchingSdk}`);
     }
     return out;
 }
 /** The fixed worker is a second binary of the project's own Go module. */
-function buildBackgroundWorker(manifest, arch, work, run) {
+async function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
     const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`, ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
     ].join(" ");
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
         env: { ...process.env, ...goBuildEnv(arch) },
     });

package/dist/standalone/daemon.d.ts

@@ -20,5 +20,5 @@ export interface Daemon {
 }
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
-export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): string | undefined;
+export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;

package/dist/standalone/daemon.js

@@ -1,7 +1,7 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
-import { templatesRoot } from "../template-paths.js";
+import { goAssetDir } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
@@ -55,12 +55,12 @@ export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts } = manifest.daemon;
     return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts }) + "\n";
 }
-export function buildDaemonControl(manifest, arch, work, run) {
+export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon)
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
-    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
+        cwd: goAssetDir("daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);

package/dist/standalone/dsm-window.js

@@ -1,6 +1,6 @@
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
@@ -320,7 +320,7 @@ function settingsOnlyApproval(manifest) {
  */
 function renderRootParts(ns, manifest) {
     return {
-        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest.executor))};
+        definitions: `${ns}.rootTasks = ${JSON.stringify(manifest.executor.tasks)};
 ${ns}.createRootAccess = (function () {
 ${ROOT_RUNTIME}
   return createRootAccess;

package/dist/standalone/inspect-spk.d.ts

@@ -40,3 +40,4 @@ export interface SpkInspection {
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;
 /** Auto-detect the generated runtime; retain strict native-go inspection when requested. */
 export declare function inspectSpk(spkPath: string, expectedKind?: SpkKind): Promise<SpkInspection>;
+export declare function listPayload(packageTgz: string, findings: string[]): Promise<SpkInspection["payload"]>;

package/dist/standalone/inspect-spk.js

@@ -509,7 +509,7 @@ function checkUninstall(dir, findings) {
             findings.push(`UNINSTALL_WIZARD_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/postuninst 沒有讀它`);
     }
 }
-async function listPayload(packageTgz, findings) {
+export async function listPayload(packageTgz, findings) {
     if (!existsSync(packageTgz)) {
         findings.push("缺少 package.tgz");
         return [];

package/dist/standalone/manifest.d.ts

@@ -1,6 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import { type DelegateCapability } from "../runtime/executor-policy.js";
-import type { ExecutorPins } from "../runtime/executor-tasks.js";
+import type { ExecutorPins, ExecutorTask } from "../runtime/executor-tasks.js";
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Catalogs, type InfoTranslations } from "./i18n.js";
 export type { InfoText } from "./i18n.js";
@@ -58,7 +58,10 @@ export interface StandaloneManifest {
     capabilities: Capabilities;
     /** Fixed root/<name>.sh operations, enabled by capabilities.rootOps. */
     rootOps?: RootOp[];
-    executor?: ExecutorPins;
+    /** Set by build: the pins and the root tasks generated from the App's SDK executor. */
+    executor?: ExecutorPins & {
+        tasks: ExecutorTask[];
+    };
     daemon?: Daemon;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;

package/dist/standalone/manifest.js

@@ -13,6 +13,9 @@ import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
 import { readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
+import { validateReproducible } from "../reproducible-config.js";
+import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
+import { sdkProblems } from "./sdk-check.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -20,7 +23,7 @@ import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 export const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon",
+    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon", "reproducible",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
@@ -87,6 +90,14 @@ function readManifest(raw, c) {
             c.fail("STANDALONE_FIELD_UNKNOWN", `不支援的欄位「${key}」。Standalone Package 不接受自訂 lifecycle scripts 或 DSM conf。`);
         }
     }
+    if (raw.reproducible !== undefined) {
+        try {
+            validateReproducible(raw.reproducible);
+        }
+        catch (error) {
+            c.fail("REPRODUCIBLE_INVALID", error.message);
+        }
+    }
     if (raw.schema !== 2) {
         c.fail("STANDALONE_SCHEMA_INVALID", "schema: 2 必填；請改成 schema: 2、backend.kind: go|binary，並將 privilege: root、background、fileStation 分別改為 capabilities.rootOps: true、capabilities.jobs: true、capabilities.files: session。");
     }
@@ -142,7 +153,7 @@ function readManifest(raw, c) {
     const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
     const entry = raw.entry === undefined ? undefined : readEntry(raw.entry, backend, permissions?.policy, c);
     if (entry === "admin-only" && permissions) {
-        const floored = floorAtAdministrators(permissions.policy);
+        const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
             c.fail("STANDALONE_ENTRY_WIDENED", `entry: admin-only 以管理員為所有 route 的下限；permissions.json 的 ${floored.widened.join("、")} 會開放給其他人。請改為 administrators，或改用 entry: app-privilege／省略 entry。`);
         }
@@ -153,6 +164,10 @@ function readManifest(raw, c) {
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
+    if (backend?.kind === "go") {
+        for (const problem of sdkProblems(backend.dir, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
+            c.fail(problem.code, problem.message);
+    }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
@@ -213,9 +228,9 @@ function readEntry(value, backend, policy, c) {
     if (!backend)
         return undefined;
     const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
-    if (backend.kind !== "go" || !existsSync(join(backend.dir, "internal/dsm/entry.go"))
+    if (backend.kind !== "go" || !sdkRequirement(backend.dir)
         || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "entry 需要 Go backend 內的 SDK entry gate：請從 SDK 範本複製 internal/dsm/entry.go、apppriv.go 與 native bridge，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。");
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");

package/dist/standalone/native-layout.d.ts

@@ -63,6 +63,8 @@ export declare function loadNativeLayout(root: string): {
     }[];
 };
 export declare function verifyToolkitArchive(path: string, expected: string): void;
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
 export declare function layoutFiles(root: string): Array<{
     path: string;
     mode: number;
@@ -76,6 +78,7 @@ export declare function buildNativeLayout(options: {
     outDir?: string;
     build?: number;
     minDsm?: string;
+    jobs?: number;
     run?: CommandRunner;
 }): Promise<{
     outputs: string[];

package/dist/standalone/native-layout.js

@@ -2,14 +2,20 @@ import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
-import { runCommand } from './build.js';
+import { runCommand, runnerFor } from './build.js';
+import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
+import { validateReproducible } from '../reproducible-config.js';
 import { resolveMinDsm } from '../build-spk/dsm-version.js';
+import { infoArchValue } from '../build-spk/dsm-arch.js';
+import { LIFECYCLE_SCRIPTS, REPLACE_SCRIPTS } from '../spk/dsm-spec.js';
 import { renderPackageIcons, writePackageCenterIcons } from '../build-spk/dsm-icons.js';
 export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
+/** INFO arch: aarch64 is not an Appendix A value, so it lists the platforms as native-go and binary do. */
+const layoutInfoArch = (arch) => arch === 'aarch64' ? infoArchValue('aarch64') : arch;
 function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
 function object(value, fields) {
@@ -84,7 +90,7 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
@@ -105,6 +111,8 @@ export function loadNativeLayout(root) {
             fail('invalid architecture list');
         if (m.icon !== undefined)
             m.icon = icon(root, m.icon);
+        if (m.reproducible !== undefined)
+            validateReproducible(m.reproducible);
         const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
@@ -142,11 +150,37 @@ export function verifyToolkitArchive(path, expected) {
     if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
         fail('toolkit checksum mismatch');
 }
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export function toolkitCacheDir(env, platform, home) {
+    if (env.SYNOPKGLAND_CACHE_DIR)
+        return resolve(env.SYNOPKGLAND_CACHE_DIR);
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'synopkgland');
+    const xdg = env.XDG_CACHE_HOME;
+    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
+}
+// Concurrent architectures that pin the same archive share one download.
+const downloads = new Map();
+async function download(m, cache, input, archive, run) {
+    const tmp = mkdtempSync(join(cache, '.download-'));
+    try {
+        const out = join(tmp, 'archive');
+        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
+        if (r.status !== 0)
+            fail('toolkit download failed');
+        // Rename is atomic, so another build process sees either no archive or a verified one.
+        verifyToolkitArchive(out, input.sha256);
+        renameSync(out, archive);
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
 async function toolkitFor(m, arch, run) {
     const inputs = m.native.toolkits[arch] ?? [];
     if (!inputs.length)
         return '';
-    const cache = resolve(process.env.SYNOPKGLAND_CACHE_DIR ?? join(m.root, '.synopkgland-cache'));
+    const cache = toolkitCacheDir(process.env, process.platform, homedir());
     mkdirSync(cache, { recursive: true, mode: 0o700 });
     if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
         fail('toolkit cache must be owned and private');
@@ -154,18 +188,12 @@ async function toolkitFor(m, arch, run) {
     for (const input of inputs) {
         const archive = join(cache, `${input.sha256}.txz`);
         if (!existsSync(archive)) {
-            const download = mkdtempSync(join(cache, '.download-'));
-            try {
-                const out = join(download, 'archive');
-                const r = run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
-                if (r.status !== 0)
-                    fail('toolkit download failed');
-                verifyToolkitArchive(out, input.sha256);
-                renameSync(out, archive);
-            }
-            finally {
-                rmSync(download, { recursive: true, force: true });
+            let pending = downloads.get(archive);
+            if (!pending) {
+                pending = download(m, cache, input, archive, run).finally(() => downloads.delete(archive));
+                downloads.set(archive, pending);
             }
+            await pending;
         }
         verifyToolkitArchive(archive, input.sha256);
         archives.push(archive);
@@ -173,8 +201,11 @@ async function toolkitFor(m, arch, run) {
     // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
     const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
     try {
+        const flavor = await tarFlavor(m, run);
         for (const archive of archives) {
-            const r = run('tar', ['-xJf', archive, '-C', stage, '--keep-directory-symlink'], { cwd: m.root, env: { ...process.env } });
+            if (flavor === 'bsdtar')
+                await refuseEscapingMembers(m, archive, run);
+            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd: m.root, env: { ...process.env } });
             if (r.status !== 0)
                 fail('toolkit extraction failed');
         }
@@ -185,9 +216,33 @@ async function toolkitFor(m, arch, run) {
         throw e;
     }
 }
-function runHook(m, h, env, run) {
+/**
+ * A later toolkit archive may write through a directory symlink an earlier one
+ * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
+ * bsdtar only with -P, which also allows absolute and .. members, so those are
+ * refused from the listing first.
+ */
+async function tarFlavor(m, run) {
+    const r = await run('tar', ['--version'], { cwd: m.root, env: { ...process.env }, capture: true });
+    const version = r.status === 0 ? r.stdout ?? '' : '';
+    if (/\bGNU tar\b/.test(version))
+        return 'gnu';
+    if (/\bbsdtar\b/.test(version))
+        return 'bsdtar';
+    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
+}
+async function refuseEscapingMembers(m, archive, run) {
+    const r = await run('tar', ['-tJf', archive], { cwd: m.root, env: { ...process.env }, capture: true });
+    if (r.status !== 0)
+        fail('toolkit extraction failed');
+    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
+        if (member.startsWith('/') || member.split('/').includes('..'))
+            fail(`toolkit member escapes the toolkit folder: ${member}`);
+    }
+}
+async function runHook(m, h, env, run) {
     const [cmd, ...args] = h.command;
-    const r = run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
+    const r = await run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
     if (r.status !== 0 || r.missing)
         fail(`native hook failed: ${r.stderr}`);
 }
@@ -255,6 +310,11 @@ export function checkLayoutMetadata(root, inspection = false, packageId) {
         fail('native layout requires package-only lifecycle privilege');
     if (!existsSync(join(root, 'scripts/start-stop-status')))
         fail('start-stop-status missing');
+    for (const name of [...LIFECYCLE_SCRIPTS, ...REPLACE_SCRIPTS]) {
+        const path = join(root, 'scripts', name);
+        if (existsSync(path) && !(lstatSync(path).mode & 0o111))
+            throw Object.assign(new Error(`NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE: scripts/${name} is not executable (mode ${(lstatSync(path).mode & 0o777).toString(8)}); DSM runs it directly and inspect reports SPK_SCRIPT_NOT_EXECUTABLE. Run chmod +x on it in the layout metadata folder and build again.`), { code: 'NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE' });
+    }
     if (existsSync(join(root, 'conf/resource'))) {
         const resource = object(JSON.parse(readFileSync(join(root, 'conf/resource'), 'utf8')), ['systemd-unit']);
         if (resource['systemd-unit'] !== undefined && Object.keys(object(resource['systemd-unit'], [])).length)
@@ -307,18 +367,20 @@ export async function buildNativeLayout(options) {
     if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
         fail('architecture not declared');
     const icons = m.icon === undefined ? undefined : renderPackageIcons(inside(m.root, m.icon));
-    const run = options.run ?? runCommand;
+    const jobs = checkJobs(options.jobs);
+    if (jobs > 1 && !m.layout.payload.includes('{arch}'))
+        fail('--jobs above 1 needs a layout.payload path with {arch}, so architectures do not overwrite one payload folder');
     const version = `${m.version}-${String(m.build).padStart(4, '0')}`;
     const env = { SYNOPKGLAND_PACKAGE: m.package, SYNOPKGLAND_VERSION: m.version, SYNOPKGLAND_BUILD: String(m.build), SYNOPKGLAND_SPK_VERSION: version, SYNOPKGLAND_PROJECT_DIR: m.root };
     if (m.native.prepare)
-        runHook(m, m.native.prepare, env, run);
-    const outputs = [];
-    for (const requested of arches) {
-        const arch = requested;
+        await runHook(m, m.native.prepare, env, options.run ?? runCommand);
+    const outputs = await commitOutputs(options.outDir ?? join(m.root, 'dist'), (outDir) => forEachArch(arches, jobs, async (arch) => {
+        const run = runnerFor(options.run, jobs, arch);
         const toolkit = await toolkitFor(m, arch, run);
         const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
+        const work = mkdtempSync(join(tmpdir(), 'synopkgland-work-'));
         try {
-            runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit }, run);
+            await runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit, SYNOPKGLAND_WORK_DIR: work }, run);
             const payload = inside(m.root, m.layout.payload.replaceAll('{arch}', arch));
             const metadata = inside(m.root, m.layout.metadata);
             checkLayoutMetadata(metadata, false, m.package);
@@ -339,23 +401,22 @@ export async function buildNativeLayout(options) {
             const files = copyTree(payload, target);
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
-            const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
+            const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
             const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
             writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
-            const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
-            mkdirSync(dirname(output), { recursive: true });
+            const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
-            outputs.push(output);
+            return output;
         }
         finally {
-            rmSync(stage, { recursive: true, force: true });
-            if (toolkit)
-                rmSync(toolkit, { recursive: true, force: true });
+            for (const dir of [stage, work, toolkit])
+                if (dir)
+                    rmSync(dir, { recursive: true, force: true });
         }
-    }
+    }));
     return { outputs };
 }
 export function inspectNativeLayout(dir, payload, info) {
@@ -363,7 +424,7 @@ export function inspectNativeLayout(dir, payload, info) {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
         const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
-        if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
+        if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
         const actual = layoutFiles(payload);

package/dist/standalone/root-window.d.ts

@@ -1,4 +1,4 @@
-export { executorTasks as rootTasks, type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
+export { type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export declare const ROOT_RUNTIME: string;

package/dist/standalone/root-window.js

@@ -1,7 +1,6 @@
 import { bootDefinition, controlDefinition } from '../runtime/executor-tasks.js';
 import { executorScopeTask } from '../runtime/executor-scope-task.js';
 import { versionUnsupported } from '../runtime/dsm-version.js';
-export { executorTasks as rootTasks } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export const ROOT_RUNTIME = `function createRootAccess(options) {