xjerod · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
diff --git a/js/i18n/README.md b/js/i18n/README.md
@@ -9,12 +9,12 @@ This package is consumed via pnpm `link:` (always-symlink), no publish:
 ```jsonc
 // in your app's package.json
 {
-  "dependencies": {
-    "@synthlabs/i18n": "link:../utils/js/i18n",
-  },
-  "devDependencies": {
-    "@inlang/paraglide-js": "^2.16.0",
-  },
+	"dependencies": {
+		"@synthlabs/i18n": "link:../utils/js/i18n"
+	},
+	"devDependencies": {
+		"@inlang/paraglide-js": "^2.16.0"
+	}
 }
 ```
 
@@ -26,30 +26,30 @@ The `@inlang/paraglide-js` peerDep belongs to the consuming app - it owns the ge
 
 ```ts
 // vite.config.ts
-import { sveltekit } from "@sveltejs/kit/vite";
-import { defineConfig } from "vite";
-import { defineParaglide } from "@synthlabs/i18n";
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+import { defineParaglide } from '@synthlabs/i18n';
 
 export default defineConfig({
-  plugins: [
-    sveltekit(),
-    defineParaglide(), // defaults: project ./project.inlang, outdir ./src/lib/paraglide
-  ],
+	plugins: [
+		sveltekit(),
+		defineParaglide() // defaults: project ./project.inlang, outdir ./src/lib/paraglide
+	]
 });
 ```
 
 Default strategy is `['localStorage', 'preferredLanguage', 'baseLocale']` - right for desktop apps. Override for static sites with locale-prefixed URLs:
 
 ```ts
-defineParaglide({ strategy: ["url", "cookie", "baseLocale"] });
+defineParaglide({ strategy: ['url', 'cookie', 'baseLocale'] });
 ```
 
 ### OS-locale detection
 
 ```ts
-import { detectOsLocale } from "@synthlabs/i18n";
+import { detectOsLocale } from '@synthlabs/i18n';
 
-const locale = detectOsLocale(["en", "ru"], "en");
+const locale = detectOsLocale(['en', 'ru'], 'en');
 // "en-US" → "en", "ru-RU" → "ru", "de-DE" → "en" (fallback)
 ```
 
@@ -104,9 +104,9 @@ Validates that every `messages/<locale>.json` has the same key set as the base l
 ```jsonc
 // package.json
 {
-  "scripts": {
-    "check": "svelte-kit sync && svelte-check && i18n-lint ./messages",
-  },
+	"scripts": {
+		"check": "svelte-kit sync && svelte-check && i18n-lint ./messages"
+	}
 }
 ```
 

diff --git a/js/i18n/src/viteConfig.ts b/js/i18n/src/viteConfig.ts
@@ -1,12 +1,7 @@
 import { paraglideVitePlugin } from '@inlang/paraglide-js';
 
 export type ParaglideStrategy =
-	| 'cookie'
-	| 'url'
-	| 'localStorage'
-	| 'preferredLanguage'
-	| 'baseLocale'
-	| 'globalVariable';
+	'cookie' | 'url' | 'localStorage' | 'preferredLanguage' | 'baseLocale' | 'globalVariable';
 
 export interface DefineParaglideOptions {
 	/** Path to the inlang project. Defaults to `./project.inlang`. */

diff --git a/js/inbound/README.md b/js/inbound/README.md
@@ -5,7 +5,7 @@ opt into custom presentation with `ErrorController` and `connectErrorCapture`.
 
 ```ts
 const errors = new ErrorController({
-  log: error => logHandledError(error.message, error.target ?? 'app')
+	log: (error) => logHandledError(error.message, error.target ?? 'app')
 });
 const unsubscribe = errors.subscribe(render);
 const stopTimers = errors.start();

diff --git a/js/inbound/ReportWizard.svelte b/js/inbound/ReportWizard.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { onDestroy, onMount, untrack, type Snippet } from 'svelte';
+	import { SvelteSet } from 'svelte/reactivity';
 	import Logger from '$utils/log';
 	import {
 		inboundCapabilities,
@@ -48,7 +49,7 @@
 	type PreviewStep = 'system' | 'build' | 'log' | 'config' | 'error';
 	const isPreview = (step: StepId): step is PreviewStep =>
 		['system', 'build', 'log', 'config', 'error'].includes(step);
-	const loaded = new Set<PreviewStep>(initialError ? ['error'] : []);
+	const loaded = new SvelteSet<PreviewStep>(initialError ? ['error'] : []);
 	let system = $state<SystemInfo | null>(null);
 	let build = $state<BuildInfo | null>(null);
 	let log = $state<LogPreview | null>(null);
@@ -64,9 +65,7 @@
 	let request = 0;
 	const progressSteps = $derived(wizard.visibleSteps());
 	const progressIndex = $derived(progressSteps.indexOf(wizard.step));
-	const progressPosition = $derived(
-		progressIndex >= 0 ? progressIndex : progressSteps.length - 1
-	);
+	const progressPosition = $derived(progressIndex >= 0 ? progressIndex : progressSteps.length - 1);
 
 	async function load(step: PreviewStep | 'capabilities') {
 		const current = ++request;
@@ -185,9 +184,7 @@
 							disabled:
 								busy ||
 								loading ||
-								(!!failure &&
-									(failure.step === 'capabilities' ||
-										wizard.include[failure.step])),
+								(!!failure && (failure.step === 'capabilities' || wizard.include[failure.step])),
 							onclick: () => wizard.next()
 						}
 	);
@@ -370,8 +367,7 @@
 		{@render button({
 			kind: 'back',
 			label: text.back,
-			disabled:
-				loading || busy || ['username', 'sending', 'done', 'failed'].includes(wizard.step),
+			disabled: loading || busy || ['username', 'sending', 'done', 'failed'].includes(wizard.step),
 			onclick: () => wizard.back()
 		})}
 		{@render button(nextAction)}

diff --git a/js/updater.ts b/js/updater.ts
@@ -162,11 +162,7 @@ export async function checkForAppUpdates(
 				event.preventDefault();
 
 				if (updateAction.kind === 'external') {
-					await openExternalUpdateUrl(
-						updateAction.url,
-						openReleaseNotes,
-						options.onError
-					);
+					await openExternalUpdateUrl(updateAction.url, openReleaseNotes, options.onError);
 					return;
 				}
 
@@ -225,13 +221,7 @@ async function installUpdate(
 					lastPercent = percent;
 					toast.loading(
 						copy.downloadingProgress(percent),
-						downloadingToastOptions(
-							toastId,
-							copy,
-							releaseUrl,
-							openReleaseNotes,
-							onError
-						)
+						downloadingToastOptions(toastId, copy, releaseUrl, openReleaseNotes, onError)
 					);
 				}
 

diff --git a/packaging/tauri/README.md b/packaging/tauri/README.md
@@ -36,3 +36,15 @@ _tauri_smoke_env=('WEBKIT_DISABLE_COMPOSITING_MODE=1')
 
 The shared Arch helpers set `TAURI_PACKAGING_SOURCE_DIR`, `TAURI_PACKAGING_PKGVER`, and
 `TAURI_PACKAGING_PKGREL` while evaluating and building the local PKGBUILD.
+
+## AUR SSH validation
+
+`aur/container-publish.sh --check-access` accepts the same arguments as publication and runs
+only `git ls-remote` after configuring the container account and SSH files. It does not create
+commits or push. The account's registered home and `HOME` both point to the temporary builder
+home, where the supplied SSH directory is installed with private permissions.
+
+Run `bash utils/packaging/tauri/aur/container-ssh.test.sh` from a consuming checkout to test new
+and existing container accounts against a local SSH server. The fixtures verify trusted access,
+reject a different host key, and leave the empty remote unchanged. Docker is required;
+`CONTAINER_RUNTIME` can select another compatible container command.
diff --git a/packaging/tauri/aur/container-entrypoint.sh b/packaging/tauri/aur/container-entrypoint.sh
@@ -9,13 +9,18 @@ pkgrel=
 aur_repository=
 git_user_name=
 git_user_email=
+check_access=()
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=(--check-access)
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -64,28 +69,15 @@ pacman-key --init
 pacman-key --populate archlinux
 pacman -Syu --needed --noconfirm git openssh
 
-build_gid="${HOST_GID:-1000}"
-build_uid="${HOST_UID:-1000}"
-build_group="$(getent group "${build_gid}" | cut -d: -f1 || true)"
-if [[ -z "${build_group}" ]]; then
-  build_group=builder
-  groupadd --gid "${build_gid}" "${build_group}"
-fi
-
-build_user="$(getent passwd "${build_uid}" | cut -d: -f1 || true)"
-if [[ -z "${build_user}" ]]; then
-  build_user=builder
-  useradd --uid "${build_uid}" --gid "${build_group}" --create-home "${build_user}"
-fi
-
 build_home=/tmp/tauri-packaging-builder-home
-install -d -m755 -o "${build_user}" -g "${build_group}" "${build_home}"
-install -d -m700 -o "${build_user}" -g "${build_group}" "${build_home}/.ssh"
-cp -a /run/aur-ssh/. "${build_home}/.ssh/"
-chown -R "${build_user}:${build_group}" "${build_home}/.ssh"
+build_user="$(
+  bash /tauri-packaging/aur/prepare-home.sh \
+    "${HOST_UID:-1000}" "${HOST_GID:-1000}" "${build_home}" /run/aur-ssh
+)"
 
 runuser -u "${build_user}" -- env HOME="${build_home}" \
   /tauri-packaging/aur/publish.sh \
+    "${check_access[@]}" \
     --project-root "${project_root}" \
     --package "${package_path}" \
     --release-tag "${release_tag}" \

diff --git a/packaging/tauri/aur/container-publish.sh b/packaging/tauri/aur/container-publish.sh
@@ -13,13 +13,18 @@ ssh_dir=
 git_user_name=
 git_user_email=
 container_runtime=docker
+check_access=()
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --ssh-dir PATH --git-user-name NAME --git-user-email EMAIL [--container-runtime COMMAND]" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --ssh-dir PATH --git-user-name NAME --git-user-email EMAIL [--container-runtime COMMAND] [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=(--check-access)
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -98,6 +103,7 @@ fi
   --workdir /workspace \
   archlinux:base-devel \
   bash /tauri-packaging/aur/container-entrypoint.sh \
+    "${check_access[@]}" \
     --project-root /workspace \
     --package "${container_package_path}" \
     --release-tag "${release_tag}" \

diff --git a/packaging/tauri/aur/container-ssh.test.sh b/packaging/tauri/aur/container-ssh.test.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+shared_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+"${CONTAINER_RUNTIME:-docker}" run --rm \
+  --volume "${shared_root}:/tauri-packaging:ro" \
+  archlinux:base-devel \
+  bash -c 'pacman -Syu --needed --noconfirm git openssh && bash /tauri-packaging/aur/ssh-home.test.sh'
diff --git a/packaging/tauri/aur/prepare-home.sh b/packaging/tauri/aur/prepare-home.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if (( $# != 4 )); then
+  echo "usage: $0 UID GID HOME SSH_DIRECTORY" >&2
+  exit 2
+fi
+
+build_uid="$1"
+build_gid="$2"
+build_home="$3"
+ssh_directory="$4"
+
+build_group="$(getent group "${build_gid}" | cut -d: -f1 || true)"
+if [[ -z "${build_group}" ]]; then
+  build_group="builder-${build_gid}"
+  groupadd --gid "${build_gid}" "${build_group}"
+fi
+
+build_user="$(getent passwd "${build_uid}" | cut -d: -f1 || true)"
+if [[ -z "${build_user}" ]]; then
+  build_user="builder-${build_uid}"
+  useradd --uid "${build_uid}" --gid "${build_group}" \
+    --home-dir "${build_home}" --create-home "${build_user}"
+elif [[ "$(getent passwd "${build_uid}" | cut -d: -f6)" != "${build_home}" ]]; then
+  usermod --home "${build_home}" "${build_user}"
+fi
+
+install -d -m755 -o "${build_user}" -g "${build_group}" "${build_home}"
+install -d -m700 -o "${build_user}" -g "${build_group}" "${build_home}/.ssh"
+cp -a "${ssh_directory}/." "${build_home}/.ssh/"
+chmod 700 "${build_home}/.ssh"
+find "${build_home}/.ssh" -type f -exec chmod 600 {} +
+chown -R "${build_user}:${build_group}" "${build_home}/.ssh"
+printf '%s\n' "${build_user}"
diff --git a/packaging/tauri/aur/publish.sh b/packaging/tauri/aur/publish.sh
@@ -10,13 +10,18 @@ pkgrel=
 aur_repository=
 git_user_name=
 git_user_email=
+check_access=0
 
 usage() {
-  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL" >&2
+  echo "usage: $0 --project-root PATH --package PATH --release-tag TAG --pkgver VERSION --pkgrel NUMBER --aur-repository URL --git-user-name NAME --git-user-email EMAIL [--check-access]" >&2
 }
 
 while (( $# > 0 )); do
   case "$1" in
+    --check-access)
+      check_access=1
+      shift
+      ;;
     --project-root)
       project_root="${2:-}"
       shift 2
@@ -63,6 +68,12 @@ fi
 
 project_root="$(cd -- "${project_root}" && pwd)"
 package_path="$(realpath -e -- "${package_path}")"
+if (( check_access )); then
+  git ls-remote "${aur_repository}" >/dev/null
+  echo 'AUR SSH access verified without publishing'
+  exit 0
+fi
+
 template="${project_root}/packaging/aur/PKGBUILD.in"
 aur_dir="$(mktemp -d "${TMPDIR:-/tmp}/tauri-packaging-aur.XXXXXXXX")"
 push_output="$(mktemp "${TMPDIR:-/tmp}/tauri-packaging-aur-push.XXXXXXXX.log")"