Package Source (@synopackageland/package-source)

Machine-readable Package Center source for Syno Package Land. A Cloudflare Worker serves a spkrepo-compatible catalog; SPK artifacts live in R2 behind immutable URLs.

Endpoints

| Path | Method | Purpose | | --- | --- | --- | | / | GET/POST | Package catalog (build, arch, major, language query params) | | /api/package | GET/POST | Same catalog (alias) | | /spk/{package}/{version}/{sha256}.spk | GET/HEAD | Immutable SPK download |

DSM Package Center adds the root URL (for example https://packages.example.org/).

Publish order

1. Build SPKs (synopkgland build-spk, broker buildBrokerSpk).
2. Upload each SPK to R2 at a digest-based key (spk/.../{sha256}.spk).
3. Verify MD5/SHA-256 locally.
4. Upload _meta/index.json last.

The publish script enforces checksum-before-index:

npm run publish:fixtures -w @synopackageland/package-source

Environment overrides:

• PACKAGE_SOURCE_BUCKET (default syno-package-source-throwaway)
• PACKAGE_SOURCE_ORIGIN (public URL DSM will use)

Deploy (throwaway)

cd packages/package-source
npm install
wrangler r2 bucket create syno-package-source-throwaway
npm run publish:fixtures
wrangler deploy --env throwaway

Smoke the catalog (throwaway test host — change PACKAGE_SOURCE_ORIGIN when domain moves):

curl "https://packages.varvis.me/?arch=x86_64&build=69057&major=7&language=enu"

workers.dev fallback remains available at deploy output URL.

Tests

npm test -w @synopackageland/package-source

Covers index shape, Broker deppkgs, immutable SPK keys, checksum-then-index ordering, Worker catalog/HEAD behavior.

Notes

• Throwaway public host is currently packages.varvis.me (test-only; see wrangler.jsonc env throwaway).
• No WAF challenge on the packages. worker route (separate from the human website).
• Do not use r2.dev as the official DSM-facing URL.
• deppkgs in the index mirrors SPK install_dep_packages so Package Center can install Broker before hello-web.