@synopackageland/cli 0.12.2 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.13.0 (2026-10-17)
+
+- Add the identity gateway for daemon web applications and package-account compose upstreams: OIDC, header and token modes, validated native payload targets and bounded connection policies. UDP connections are handled separately from TCP.
+- `account.on_delete` declares application account/session cleanup when a local DSM account disappears; domain accounts support explicit gateway purge. Bundle the `identity-gateway` skill for wrapping and verifying existing open-source applications.
+- Generated Apps pin templates/SDK 0.13.0 and UI 0.10.5; record the 0.13.0 executor/lifecycle digests. Skill examples use the released SDK version. This CLI builds SDK 0.13.x; upgrade backend and frontend pins together.
+
+繁中摘要：daemon 與 package-account compose App 可宣告 identity gateway，以 DSM 身分透過 OIDC、header 或 token 登入，並限制原生 payload 目標與網路連線（區分 UDP／TCP）。`account.on_delete` 宣告本機 DSM 帳號刪除時的 App 帳號／session 清理；網域帳號支援明確 purge。新增 `identity-gateway` skill 說明既有 OSS App 的包裝及驗證。templates／SDK 同步 0.13.0、UI 0.10.5，更新 executor digest 與範例版本；此 CLI 建置 SDK 0.13.x，後端／前端 pin 應一併升級。
+
 ## 0.12.2 (2026-10-16)
 
 - Generated Apps use templates 0.12.2, SDK 0.12.2 and UI 0.10.3. SDK 0.12.2 types `ctx.launchParams` and `ctx.onLaunch` and adds `followLaunchRoute`, `launchRoute` and `dsmLaunchURL`.

package/assets/go/daemon/main.go

@@ -33,6 +33,7 @@ type deadlines struct {
 	Uninstall int `json:"uninstall"`
 }
 type config struct {
+	Network       *networkPolicy    `json:"network,omitempty"`
 	Package       string            `json:"package"`
 	Exec          string            `json:"exec"`
 	Args          []string          `json:"args"`
@@ -464,6 +465,23 @@ func (c *controller) supervise() error {
 	signals := make(chan os.Signal, 1)
 	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
 	defer signal.Stop(signals)
+	if c.Network != nil {
+		deadline := time.Now().Add(time.Duration(c.Timeouts.Start-2) * time.Second)
+		for {
+			err := checkNetwork("/proc/net", os.Geteuid(), c.Network)
+			if err == nil {
+				break
+			}
+			if !time.Now().Before(deadline) {
+				return err
+			}
+			select {
+			case <-signals:
+				return errors.New("compose startup interrupted")
+			case <-time.After(100 * time.Millisecond):
+			}
+		}
+	}
 	cmd := c.child(c.Args)
 	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
 	if err := cmd.Start(); err != nil {
@@ -552,8 +570,15 @@ func (c *controller) supervise() error {
 			}
 		}
 	}()
+	tick := time.NewTicker(time.Second)
+	defer tick.Stop()
 	for {
 		select {
+		case <-tick.C:
+			if err := checkNetwork("/proc/net", os.Geteuid(), c.Network); err != nil {
+				clean = stop() == nil
+				return err
+			}
 		case <-done:
 			return nil
 		case <-signals:

package/assets/go/daemon/network.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// Host-network containers use the package UID. The kernel tables, rather than
+// an application's claimed environment setting, prove its listener bindings.
+// This is a configuration guard, not a network namespace or a firewall.
+type networkPolicy struct {
+	Ports       []int `json:"ports"`
+	PublicPorts []int `json:"public_ports"`
+}
+
+func containsPort(ports []int, port int) bool {
+	for _, p := range ports {
+		if p == port {
+			return true
+		}
+	}
+	return false
+}
+
+func checkSocketTable(raw string, uid int, p *networkPolicy, udp bool) error {
+	_, err := socketPorts(raw, uid, p, udp)
+	return err
+}
+
+func socketPorts(raw string, uid int, p *networkPolicy, udp bool) (map[int]bool, error) {
+	found := map[int]bool{}
+	scan := bufio.NewScanner(strings.NewReader(raw))
+	if !scan.Scan() {
+		return nil, errors.New("missing socket table header")
+	}
+	for scan.Scan() {
+		f := strings.Fields(scan.Text())
+		if len(f) == 0 {
+			continue
+		}
+		if len(f) < 10 {
+			return nil, errors.New("invalid socket table")
+		}
+		owner, err := strconv.Atoi(f[7])
+		if err != nil {
+			return nil, err
+		}
+		if owner != uid {
+			continue
+		}
+		if (!udp && f[3] != "0A") || (udp && f[3] != "07") {
+			continue
+		}
+		endpoint := strings.Split(f[1], ":")
+		if len(endpoint) != 2 {
+			return nil, errors.New("invalid socket endpoint")
+		}
+		port64, err := strconv.ParseInt(endpoint[1], 16, 32)
+		if err != nil {
+			return nil, err
+		}
+		port := int(port64)
+		if !udp && containsPort(p.PublicPorts, port) {
+			continue
+		}
+		// /proc/net's IPv4 and IPv6 words are little-endian on supported DSM arches.
+		loopback := endpoint[0] == "0100007F" || endpoint[0] == "00000000000000000000000001000000"
+		if !loopback {
+			return nil, fmt.Errorf("compose package listener on port %d is not bound to loopback", port)
+		}
+		if !udp && containsPort(p.Ports, port) && endpoint[0] == "0100007F" {
+			found[port] = true
+		}
+	}
+	return found, scan.Err()
+}
+
+func checkNetwork(dir string, uid int, p *networkPolicy) error {
+	if p == nil {
+		return nil
+	}
+	found := map[int]bool{}
+	for _, name := range []string{"tcp", "tcp6", "udp", "udp6"} {
+		raw, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil {
+			return err
+		}
+		ports, err := socketPorts(string(raw), uid, p, strings.HasPrefix(name, "udp"))
+		if err != nil {
+			return err
+		}
+		for port := range ports {
+			found[port] = true
+		}
+	}
+	for _, port := range p.Ports {
+		if !found[port] {
+			return fmt.Errorf("compose upstream port %d is not ready as the package UID on 127.0.0.1", port)
+		}
+	}
+	return nil
+}

package/assets/go/daemon/network_test.go

@@ -0,0 +1,86 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestComposeNetworkPolicy(t *testing.T) {
+	uid := os.Geteuid()
+	for _, tc := range []struct {
+		name, addr, state, port string
+		ok                      bool
+	}{
+		{"loopback", "0100007F", "0A", "6D64", true},
+		{"wildcard", "00000000", "0A", "6D64", false},
+		{"other loopback", "0200007F", "0A", "6D64", false},
+		{"public gateway", "00000000", "0A", "6D60", true},
+		{"unknown port", "00000000", "0A", "6D66", false},
+		{"connected", "00000000", "01", "6D66", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			line := socketFixture(tc.addr, tc.port, tc.state, uid)
+			err := checkSocketTable(line, uid, &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}, false)
+			if (err == nil) != tc.ok {
+				t.Fatalf("got %v, expected ok %v", err, tc.ok)
+			}
+		})
+	}
+}
+
+func TestComposeNetworkRequiresOwnedUpstream(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"tcp", "tcp6", "udp", "udp6"} {
+		os.WriteFile(filepath.Join(dir, name), []byte("header\n"), 0600)
+	}
+	p := &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}
+	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
+		t.Fatal("missing upstream accepted")
+	}
+	os.WriteFile(filepath.Join(dir, "tcp"), []byte(socketFixture("0100007F", "6D64", "0A", os.Geteuid()+1)), 0600)
+	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
+		t.Fatal("foreign upstream accepted")
+	}
+	os.WriteFile(filepath.Join(dir, "tcp"), []byte(socketFixture("0100007F", "6D64", "0A", os.Geteuid())), 0600)
+	if err := checkNetwork(dir, os.Geteuid(), p); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(dir, "udp"), []byte(socketFixture("00000000", "6D66", "07", os.Geteuid())), 0600)
+	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
+		t.Fatal("UDP wildcard accepted")
+	}
+}
+
+func socketFixture(addr, port, state string, uid int) string {
+	return fmt.Sprintf("header\n 0: %s:%s 00000000:0000 %s 0:0 0:0 0 %d 0 1\n", addr, port, state, uid)
+}
+
+func TestComposeUDPConnectedIsNotAListener(t *testing.T) {
+	raw := socketFixture("EA53110A", "BEEF", "01", os.Geteuid())
+	if err := checkSocketTable(raw, os.Geteuid(), &networkPolicy{Ports: []int{28004}}, true); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestComposeIPv6AndUDPPublicPort(t *testing.T) {
+	p := &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}
+	for _, tc := range []struct {
+		addr, port string
+		udp, ok    bool
+	}{
+		{"00000000000000000000000001000000", "6D64", false, true},
+		{"00000000000000000000000000000000", "6D64", false, false},
+		{"00000000", "6D60", true, false},
+	} {
+		state := "0A"
+		if tc.udp {
+			state = "07"
+		}
+		err := checkSocketTable(socketFixture(tc.addr, tc.port, state, os.Geteuid()), os.Geteuid(), p, tc.udp)
+		if (err == nil) != tc.ok {
+			t.Fatalf("%+v: %v", tc, err)
+		}
+	}
+}

package/dist/error-registry.js

@@ -479,6 +479,21 @@ export const ERROR_REGISTRY = {
         "description": "The built supervisor is missing while assembling the daemon SPK.",
         "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the controller."
     },
+    "STANDALONE_IDENTITY_GATEWAY_INVALID": {
+        "code": "STANDALONE_IDENTITY_GATEWAY_INVALID",
+        "description": "The identity_gateway declaration does not match the gateway contract.",
+        "suggestion": "Declare a daemon; set sdk, mode (oidc, header or token), the App's loopback upstream port and distinct listen ports other than 5000/5001; keep passthrough and redirects local paths outside /_sso; oidc needs issuer_port and clients, header needs headers.user, token needs token.exec in the daemon payload."
+    },
+    "STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED": {
+        "code": "STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED",
+        "description": "The SDK identity gateway could not be built from identity_gateway.sdk.",
+        "suggestion": "Use an SDK release that contains idgateway/cmd/gateway, install Go (builds pin go1.26.9) and check the compiler stderr."
+    },
+    "STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED": {
+        "code": "STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED",
+        "description": "The built identity gateway is missing while assembling the SPK.",
+        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the gateway."
+    },
     "STANDALONE_SHARED_FOLDER_INVALID": {
         "code": "STANDALONE_SHARED_FOLDER_INVALID",
         "description": "The install.sharedFolder declaration in dsm-package.yaml is invalid.",

package/dist/runtime/executor-digests.json

@@ -1,27 +1,5 @@
 {
-    "0.12.0": {
-        "x86_64": "abe0a42699fed06aeeb7520e5a4f3393cae64f83a66773b70630f0db0c5ed107",
-        "aarch64": "1fdf171a665279f16ca1c2605a54996b2359fa69531c6fe4e890f5bda61c1bef",
-        "armv7": "946f73df833929283f94289f025fd73897416777be5e0867d1e73f0b6c3031d7",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.12.1": {
-        "x86_64": "efe409287770f6b70e7f8465e8767eeb2413b9ab8775020cf4dffb1555d7bf1f",
-        "aarch64": "d68c9889ed2391e918b9c278679ea0a01cd04425528c11090700a3b6341fc543",
-        "armv7": "9149a05efb9f2d7d86a400707099b3d657382b1c0dbad6588be8c500e90445cc",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.12.2": {
+    "0.13.0": {
         "x86_64": "efe409287770f6b70e7f8465e8767eeb2413b9ab8775020cf4dffb1555d7bf1f",
         "aarch64": "d68c9889ed2391e918b9c278679ea0a01cd04425528c11090700a3b6341fc543",
         "armv7": "9149a05efb9f2d7d86a400707099b3d657382b1c0dbad6588be8c500e90445cc",

package/dist/skill.js

@@ -5,6 +5,7 @@ const SKILL_CATALOG = [
     { id: "orchestrator", file: "SKILL.md", when: "Read first" },
     { id: "create", file: "reference/create.md", when: "Start from nothing or a one-liner" },
     { id: "wrap", file: "reference/wrap.md", when: "Existing Compose, or adding a contract" },
+    { id: "identity-gateway", file: "reference/identity-gateway.md", when: "Wrap OSS native or container apps with DSM account SSO" },
     { id: "identity", file: "reference/identity.md", when: "Needs a DSM sign-in" },
     { id: "files", file: "reference/files.md", when: "Needs NAS files" },
     { id: "portal", file: "reference/portal.md", when: "Needs a DSM Application Portal alias link" },

package/dist/standalone/build.js

@@ -10,6 +10,7 @@ import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildDaemonControl } from "./daemon.js";
+import { buildIdentityGateway } from "./identity-gateway.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
@@ -88,6 +89,8 @@ export async function buildStandalone(options) {
     if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
+    if (manifest.compose && !isDsmAtLeast(manifest.os_min_ver, "7.2.1-69057"))
+        throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose identity_gateway requires DSM >= 7.2.1.");
     const jobs = checkJobs(options.jobs);
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
@@ -111,9 +114,10 @@ export async function buildStandalone(options) {
             const { cgi: cgiPath, worker: backgroundWorker, app } = await backendFor(builtManifest, arch, archWork, run, bridge);
             const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
+            const identityGateway = await buildIdentityGateway(manifest, arch, archWork, run);
             // A portal needs the executor, so the executor's SDK carries the panel text.
             const portalText = manifest.portal && executor ? portalCatalogs(sdkSource(executor.sdk).goDir) : undefined;
-            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor, app, portalText });
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, identityGateway, backgroundWorker, executor, app, portalText });
             return outputPath;
         }));
         return { outputs, warnings: [...warnings] };

package/dist/standalone/compose.d.ts

@@ -0,0 +1,22 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+import { type Daemon } from './daemon.js';
+import type { StandaloneError, StandaloneManifest } from './manifest.js';
+export interface ComposeApp {
+    file: string;
+    targets: Daemon['targets'];
+    services: Record<string, {
+        address_env: string;
+        port: number;
+    }>;
+    document: Record<string, any>;
+}
+/** Explicit host-network policy; ordinary Compose keeps its existing rejection rules. */
+export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void): ComposeApp | undefined;
+export declare function composeDaemon(m: Pick<StandaloneManifest, 'compose'>): Daemon;
+export declare function composeNetwork(m: Pick<StandaloneManifest, 'compose' | 'identityGateway'>): {
+    ports: number[];
+    public_ports: number[];
+};
+export declare function composeSource(c: ComposeApp): string;
+/** preinst only materializes values in the incoming payload; DSM creates var before acquire. */
+export declare function renderComposeInstall(pkg: string): string;

package/dist/standalone/compose.js

@@ -0,0 +1,90 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { parse, stringify } from 'yaml';
+import { readDaemon } from './daemon.js';
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const only = (v, keys) => Object.keys(v).every(k => keys.includes(k));
+const vars = new Set(['SYNOPKGLAND_UID', 'SYNOPKGLAND_GID', 'SYNOPKG_PKGVAR']);
+/** Explicit host-network policy; ordinary Compose keeps its existing rejection rules. */
+export function readComposeApp(value, root, arches, fail) {
+    if (value === undefined)
+        return;
+    const invalid = (why) => { fail({ code: 'STANDALONE_IDENTITY_GATEWAY_INVALID', message: `compose identity_gateway: ${why}` }); return undefined; };
+    if (arches.some(a => a !== 'x86_64' && a !== 'aarch64'))
+        return invalid('Container Manager supports x86_64 and aarch64, not armv7.');
+    if (!record(value) || !only(value, ['file', 'targets', 'services']) || typeof value.file !== 'string')
+        return invalid('accepts file, targets and services.');
+    const path = resolve(root, value.file), rel = relative(root, path);
+    if (!rel || isAbsolute(value.file) || rel.startsWith('..') || value.file.split(/[\\/]/).includes('..'))
+        return invalid('file must be inside the project.');
+    let doc;
+    try {
+        if (lstatSync(path).isSymbolicLink())
+            return invalid('file must not be a symlink.');
+        doc = parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return invalid('cannot read compose file.');
+    }
+    const payload = readDaemon({ exec: '_sso/gateway', targets: value.targets }, root, arches, fail);
+    if (!payload)
+        return;
+    if (!record(doc) || !only(doc, ['services']) || !record(doc.services) || !Object.keys(doc.services).length || !record(value.services))
+        return invalid('only services are supported; every container needs a services binding policy.');
+    if (Object.keys(value.services).sort().join() !== Object.keys(doc.services).sort().join())
+        return invalid('declare a binding policy for every deployed container.');
+    const ports = new Set();
+    for (const [name, service] of Object.entries(doc.services)) {
+        const policy = value.services[name];
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name) || !record(policy) || !only(policy, ['address_env', 'port']) || !/^[A-Z][A-Z0-9_]*$/.test(policy.address_env) || !Number.isInteger(policy.port) || policy.port < 1024 || policy.port > 65535 || ports.has(policy.port))
+            return invalid(`services.${name} needs address_env and a unique unprivileged port.`);
+        ports.add(policy.port);
+        if (!record(service) || !only(service, ['image', 'network_mode', 'user', 'cap_drop', 'security_opt', 'environment', 'volumes', 'restart', 'command', 'entrypoint', 'working_dir']))
+            return invalid(`${name}: unsupported Compose fields (no build, ports, devices, capabilities, namespaces or Docker socket).`);
+        if (service.network_mode !== 'host')
+            return invalid(`${name}: identity_gateway requires network_mode: host with the app bound to 127.0.0.1; bridge cannot reach the loopback issuer.`);
+        if (typeof service.image !== 'string' || !service.image.trim() || /\s/.test(service.image))
+            return invalid(`${name}: use a prebuilt image.`);
+        if (service.user !== '${SYNOPKGLAND_UID}:${SYNOPKGLAND_GID}')
+            return invalid(`${name}: user must be \${SYNOPKGLAND_UID}:\${SYNOPKGLAND_GID}, materialized from the package account.`);
+        if (JSON.stringify(service.cap_drop) !== '["ALL"]' || JSON.stringify(service.security_opt) !== '["no-new-privileges:true"]')
+            return invalid(`${name}: require cap_drop: [ALL] and security_opt: [no-new-privileges:true].`);
+        if (!record(service.environment) || service.environment[policy.address_env] !== '127.0.0.1' || Object.values(service.environment).some(v => typeof v !== 'string'))
+            return invalid(`${name}: environment.${policy.address_env} must be 127.0.0.1; verify the upstream's actual listen setting.`);
+        if (service.restart !== undefined && service.restart !== 'no')
+            return invalid(`${name}: restart must be no; Container Manager owns the lifecycle.`);
+        if (service.volumes !== undefined && (!Array.isArray(service.volumes) || service.volumes.some((v) => typeof v !== 'string' || !/^\$\{SYNOPKG_PKGVAR\}:\/[A-Za-z0-9_./-]+(?::rw|:ro)?$/.test(v) || v.split(':')[1].split('/').some(p => p === '..' || p === '.') || /docker\.sock|container-manager\.sock/.test(v))))
+            return invalid(`${name}: mount only the DSM-created \${SYNOPKG_PKGVAR} root, with a fixed container path.`);
+        for (const key of ['command', 'entrypoint'])
+            if (service[key] !== undefined && (!Array.isArray(service[key]) || !service[key].every((v) => typeof v === 'string')))
+                return invalid(`${name}: ${key} must be argv.`);
+    }
+    for (const match of JSON.stringify(doc).matchAll(/\$(?:\{([^}]+)\}|([A-Za-z_][A-Za-z0-9_]*))/g))
+        if (!vars.has(match[1] ?? match[2]))
+            return invalid('only package UID, GID and var interpolation is supported.');
+    return { file: path, targets: payload.targets, services: value.services, document: doc };
+}
+export function composeDaemon(m) {
+    return { exec: '_sso/gateway', args: ['run'], targets: m.compose.targets, env: {}, timeouts: { start: 30, stop: 30, status: 5, uninstall: 60 } };
+}
+export function composeNetwork(m) {
+    return { ports: Object.values(m.compose.services).map(s => s.port).sort((a, b) => a - b), public_ports: Object.values(m.identityGateway.listen).sort((a, b) => a - b) };
+}
+export function composeSource(c) { return stringify(c.document); }
+/** preinst only materializes values in the incoming payload; DSM creates var before acquire. */
+export function renderComposeInstall(pkg) {
+    return `#!/bin/sh
+set -eu
+[ "$(id -u)" != 0 ] || exit 1
+umask 077
+project="\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose"
+[ -d "$project" ] && [ ! -L "$project" ] || exit 1
+[ ! -L "$project/.env" ] || exit 1
+{
+  printf 'SYNOPKGLAND_UID=%s\\n' "$(id -u)"
+  printf 'SYNOPKGLAND_GID=%s\\n' "$(id -g)"
+  printf 'SYNOPKG_PKGVAR=%s\\n' '/var/packages/${pkg}/var'
+} > "$project/.env"
+chmod 600 "$project/.env"
+`;
+}

package/dist/standalone/daemon.d.ts

@@ -28,3 +28,5 @@ export declare function readDaemon(value: unknown, root: string, arches: NativeA
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;
+/** Copies a bounded, link-free package-account payload tree. */
+export declare function copyPayloadTree(root: string, source: string, target: string): void;

package/dist/standalone/daemon.js

@@ -4,6 +4,8 @@ import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
 import { goAssetDir } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
+import { composeDaemon, composeNetwork } from "./compose.js";
+import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
@@ -57,11 +59,11 @@ export function readDaemon(value, root, arches, fail) {
     return { exec: value.exec, targets, args, ...(uninstall ? { uninstall_args: uninstall } : {}), env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])), timeouts: timeouts };
 }
 export function daemonConfig(manifest) {
-    const { exec, args, uninstall_args, env, timeouts } = manifest.daemon;
-    return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts }) + "\n";
+    const { exec, args, uninstall_args, env, timeouts } = manifest.compose ? composeDaemon(manifest) : manifest.identityGateway ? gatewayDaemon(manifest.daemon) : manifest.daemon;
+    return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts, ...(manifest.compose ? { network: composeNetwork(manifest) } : {}) }) + "\n";
 }
 export async function buildDaemonControl(manifest, arch, work, run) {
-    if (!manifest.daemon)
+    if (!manifest.daemon && !manifest.compose)
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
@@ -78,13 +80,27 @@ export async function buildDaemonControl(manifest, arch, work, run) {
     return out;
 }
 export function copyDaemonPayload(manifest, arch, target, controller) {
-    const daemon = manifest.daemon;
+    const daemon = manifest.daemon ?? composeDaemon(manifest);
     const source = daemon.targets[arch];
+    copyPayloadTree(manifest.root, source, join(target, "payload"));
+    if (!manifest.compose) {
+        const exec = join(source, daemon.exec);
+        const problem = checkCgiBinary(manifest.root, exec, arch);
+        if (problem)
+            throw new StandaloneBuildError(problem.code, problem.message);
+        chmodSync(join(target, "payload", daemon.exec), 0o755);
+    }
+    copyFileSync(controller, join(target, "control"));
+    chmodSync(join(target, "control"), 0o755);
+    writeFileSync(join(target, "config.json"), daemonConfig(manifest), { mode: 0o644 });
+}
+/** Copies a bounded, link-free package-account payload tree. */
+export function copyPayloadTree(root, source, target) {
     const invalid = (message) => { throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", message); };
     let total = 0;
     const walk = (from, to) => {
         const stat = lstatSync(from);
-        const rel = relative(realpathSync(manifest.root), realpathSync(from));
+        const rel = relative(realpathSync(root), realpathSync(from));
         if (rel.startsWith("..") || isAbsolute(rel) || stat.isSymbolicLink())
             invalid(`A daemon payload path must not contain a symlink or escape the project: ${from}`);
         if (stat.isDirectory()) {
@@ -106,19 +122,11 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
     try {
         if (!lstatSync(source).isDirectory())
             invalid("daemon.targets must point at a directory.");
-        walk(source, join(target, "payload"));
+        walk(source, target);
     }
     catch (error) {
         if (error instanceof StandaloneBuildError)
             throw error;
         invalid(`Cannot read the daemon payload: ${String(error)}`);
     }
-    const exec = join(source, daemon.exec);
-    const problem = checkCgiBinary(manifest.root, exec, arch);
-    if (problem)
-        throw new StandaloneBuildError(problem.code, problem.message);
-    chmodSync(join(target, "payload", daemon.exec), 0o755);
-    copyFileSync(controller, join(target, "control"));
-    chmodSync(join(target, "control"), 0o755);
-    writeFileSync(join(target, "config.json"), daemonConfig(manifest), { mode: 0o644 });
 }

package/dist/standalone/identity-gateway.d.ts

@@ -0,0 +1,73 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import { type Daemon } from "./daemon.js";
+import type { StandaloneError, StandaloneManifest } from "./manifest.js";
+/** The SDK's identity gateway: the daemon wrapper and the DSM-origin authorize CGI. */
+export declare const GATEWAY_MAIN = "./idgateway/cmd/gateway";
+/** Served by DSM at /webman/3rdparty/<package>/sso/authorize.cgi. */
+export declare const GATEWAY_CGI_PATH = "ui/sso/authorize.cgi";
+/** The gateway inside the daemon payload; the App's payload must leave _sso/ free. */
+export declare const GATEWAY_PAYLOAD_DIR = "_sso";
+export declare const GATEWAY_EXEC = "_sso/gateway";
+export declare const GATEWAY_CONFIG_PATH = "sso/gateway.json";
+export type GatewayMode = "oidc" | "header" | "token";
+export interface GatewayRoles {
+    claim: string;
+    admin: string;
+    user?: string;
+}
+export interface GatewayClient {
+    id: string;
+    redirect_paths: string[];
+    native_redirects: string[];
+    require_pkce: boolean;
+    roles?: GatewayRoles;
+}
+/** `identity_gateway`: signs DSM users in to the App's own web UI. */
+export interface IdentityGateway {
+    /** The SDK release the gateway is built from. */
+    sdk: string;
+    mode: GatewayMode;
+    /** The App's loopback port. */
+    upstream: number;
+    listen: {
+        http?: number;
+        https?: number;
+    };
+    passthrough: string[];
+    redirects: Record<string, string>;
+    email_domain?: string;
+    session_ttl?: number;
+    roles?: GatewayRoles;
+    headers?: Partial<Record<"user" | "email" | "name" | "groups" | "uid", string>>;
+    oidc?: {
+        issuer_port: number;
+        clients: GatewayClient[];
+        rewrite_json: {
+            method: string;
+            path: string;
+            field: string;
+        }[];
+    };
+    token?: {
+        exec: string;
+        args: string[];
+    };
+    /** Account deletion: the gateway runs on_delete when a DSM user that signed in is deleted. */
+    account?: {
+        on_delete: DeleteAction[];
+    };
+}
+/** One delete step; {uid} and {name} are the only placeholders. */
+export type DeleteAction = {
+    remove: string;
+} | {
+    exec: string[];
+};
+export declare function readIdentityGateway(value: unknown, daemon: Pick<Daemon, "targets"> | undefined, fail: (error: StandaloneError) => void): IdentityGateway | undefined;
+/** target/sso/gateway.json, the SDK gateway's configuration (idgateway.Config). */
+export declare function identityGatewayConfig(m: StandaloneManifest): string;
+/** The daemon as the controller runs it: the gateway, with the App as its child. */
+export declare function gatewayDaemon(daemon: Daemon): Daemon;
+/** Builds the gateway from the declared SDK release with the pinned Go, binding its config path. */
+export declare function buildIdentityGateway(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;