@synopackageland/cli 0.13.1 → 0.15.0

package/dist/info.js

@@ -6,11 +6,11 @@ import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
 import { loadStandaloneManifest, sdkBackend, } from "./standalone/manifest.js";
 import { inspectSpk } from "./standalone/inspect-spk.js";
-import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
-import { executorPolicy, executorPolicyText, sha256 } from "./runtime/executor-policy.js";
+import { isNativeLayout, loadNativeLayout, } from "./standalone/native-layout.js";
+import { executorPolicy, executorPolicyText, sha256, } from "./runtime/executor-policy.js";
 import { executorTasks } from "./runtime/executor-tasks.js";
 import { requiredSdk } from "./runtime/sdk-source.js";
-import { uninstallCleanup } from "./runtime/uninstall-cleanup.js";
+import { uninstallCleanup, } from "./runtime/uninstall-cleanup.js";
 export async function projectInfo(options) {
     const identity = resolveDeployIdentity(options.project, { dev: options.dev });
     const remote = await options.host.getInstalledPackageState?.(identity.packageId);
@@ -30,12 +30,14 @@ export function classifyRootTasks(expected, inventory) {
     const result = (state, reason) => ({ name: "rootOps", state, reason });
     if (inventory?.unsupported)
         return result("unsupported", inventory.error ?? "DSM scheduler APIs are unavailable.");
-    if (!inventory || inventory.error ||
+    if (!inventory ||
+        inventory.error ||
         !Array.isArray(inventory.tasks) ||
         !Number.isInteger(inventory.total) ||
         inventory.total !== inventory.tasks.length ||
         !expected.length)
-        return result("blocked", inventory?.error ?? "Complete scheduler readback is unavailable; open the DSM package UI to verify approval.");
+        return result("blocked", inventory?.error ??
+            "Complete scheduler readback is unavailable; open the DSM package UI to verify approval.");
     let approval = false;
     for (const task of expected) {
         const named = inventory.tasks.filter((record) => record && record.name === task.name);
@@ -49,11 +51,20 @@ export function classifyRootTasks(expected, inventory) {
         const extra = actual.extra;
         const boot = task.kind === "boot";
         const script = boot ? actual.operation : extra?.script;
-        const rootOwner = actual.owner === "root" || (boot && actual.owner?.["0"] === "root");
-        if ((!boot && (!["string", "number"].includes(typeof actual.id) || !/^\d+$/.test(String(actual.id)))) ||
+        const rootOwner = actual.owner === "root" ||
+            (boot && actual.owner?.["0"] === "root");
+        if ((!boot &&
+            (!["string", "number"].includes(typeof actual.id) ||
+                !/^\d+$/.test(String(actual.id)))) ||
             !rootOwner ||
-            (!boot && (actual.real_owner !== "root" || actual.enable !== false || actual.type !== "script")) ||
-            (boot && (actual.enable !== true || (actual.event ?? actual.trigger_event) !== "bootup" || actual.operation_type !== "script")) ||
+            (!boot &&
+                (actual.real_owner !== "root" ||
+                    actual.enable !== false ||
+                    actual.type !== "script")) ||
+            (boot &&
+                (actual.enable !== true ||
+                    (actual.event ?? actual.trigger_event) !== "bootup" ||
+                    actual.operation_type !== "script")) ||
             typeof script !== "string")
             return result("blocked", `Root task ownership or definition cannot be verified: ${task.name}.`);
         if (script === task.script)
@@ -75,11 +86,23 @@ async function liveRootCapability(m, host, arch) {
             return classified;
         const observed = await host.getExecutorStatus?.(m.package);
         if (observed?.ready !== true || observed.policy_digest !== policyDigest)
-            return { ...classified, state: "blocked", reason: observed?.error ?? "Executor health or policy digest readback could not be verified." };
-        return { ...classified, reason: "Root tasks and the running executor match the source policy (no local SPK, so executor bytes were not compared)." };
+            return {
+                ...classified,
+                state: "blocked",
+                reason: observed?.error ??
+                    "Executor health or policy digest readback could not be verified.",
+            };
+        return {
+            ...classified,
+            reason: "Root tasks and the running executor match the source policy (no local SPK, so executor bytes were not compared).",
+        };
     }
     catch {
-        return { name: "rootOps", state: "blocked", reason: "DSM executor or root task readback could not be verified." };
+        return {
+            name: "rootOps",
+            state: "blocked",
+            reason: "DSM executor or root task readback could not be verified.",
+        };
     }
 }
 async function rootCapability(m, host, version) {
@@ -108,18 +131,35 @@ async function rootCapability(m, host, version) {
             inspected.package !== m.package ||
             inspected.version !== version)
             return blocked("Executor SPK artifact failed inspection or identity checks.");
-        if (!inspected.executor || JSON.stringify(inspected.executor.policy) !== JSON.stringify(executorPolicy(m, arch)))
+        if (!inspected.executor ||
+            JSON.stringify(inspected.executor.policy) !==
+                JSON.stringify(executorPolicy(m, arch)))
             return blocked("Executor policy differs from source; rebuild and deploy before approval.");
         const inventory = await host.getRootTaskInventory?.(m.package);
         const classified = classifyRootTasks(inspected.executor.tasks, inventory);
-        const executor = { ...inspected.executor, tasks: inspected.executor.tasks.map(task => {
+        const executor = {
+            ...inspected.executor,
+            tasks: inspected.executor.tasks.map((task) => {
                 const one = classifyRootTasks([task], inventory);
-                return { ...task, state: one.state === "unsupported" ? "blocked" : one.state };
-            }) };
+                return {
+                    ...task,
+                    state: one.state === "unsupported" ? "blocked" : one.state,
+                };
+            }),
+        };
         if (classified.state === "ready") {
             const observed = await host.getExecutorStatus?.(m.package);
-            if (!observed || observed.ready !== true || observed.executor_digest !== executor.executorDigest || observed.policy_digest !== executor.policyDigest)
-                return { ...classified, executor, state: "blocked", reason: observed?.error ?? "Executor health or digest readback could not be verified." };
+            if (!observed ||
+                observed.ready !== true ||
+                observed.executor_digest !== executor.executorDigest ||
+                observed.policy_digest !== executor.policyDigest)
+                return {
+                    ...classified,
+                    executor,
+                    state: "blocked",
+                    reason: observed?.error ??
+                        "Executor health or digest readback could not be verified.",
+                };
         }
         return { ...classified, executor };
     }
@@ -140,7 +180,14 @@ export async function standaloneInfo(options) {
     const installed = state.installed;
     const capabilities = [];
     let executor;
-    for (const name of ["files", "jobs", "identity", "rootOps", "delegate", "webapi"]) {
+    for (const name of [
+        "files",
+        "jobs",
+        "identity",
+        "rootOps",
+        "delegate",
+        "webapi",
+    ]) {
         if (!m.capabilities[name])
             continue;
         if (!installed)
@@ -150,7 +197,8 @@ export async function standaloneInfo(options) {
                 reason: "Package is not installed; deploy first.",
             });
         else if (name === "rootOps" || name === "delegate" || name === "webapi") {
-            const result = await rootCapability(m, options.host, remote?.version ?? (await options.host.getInstalledPackageVersion?.(m.package)));
+            const result = await rootCapability(m, options.host, remote?.version ??
+                (await options.host.getInstalledPackageVersion?.(m.package)));
             executor = result.executor;
             const { executor: ignored, ...capability } = result;
             capabilities.push({ ...capability, name });
@@ -162,25 +210,69 @@ export async function standaloneInfo(options) {
                 reason: "Installed package supports this capability without administrator approval.",
             });
     }
+    if (m.compose) {
+        if (m.capabilities.composeMounts)
+            capabilities.push({
+                name: "composeMounts",
+                state: "unsupported",
+                reason: "COMPOSE_PROJECT_CONTROL_UNAVAILABLE: separate protected compose-mount ACL and project control are not verified; no mount grant is issued.",
+            });
+        if (m.compose.web &&
+            m.compose.plan.services.some((s) => s.network === "bridge"))
+            capabilities.push({
+                name: "compose",
+                state: installed && remote?.status === "running" ? "ready" : "blocked",
+                reason: "Bridge uses limited availability readiness: App health, loopback TCP and installed-version lifecycle generation. This does not attest actual Docker image/project/generation; use installed runtime status for readiness.",
+            });
+    }
     if (m.portal)
-        capabilities.push(installed ? await portalCapability(m.package, m.portal.alias, options.host) : {
-            name: "portal", state: "blocked", reason: "Package is not installed; deploy first.",
-        });
+        capabilities.push(installed
+            ? await portalCapability(m.package, m.portal.alias, options.host)
+            : {
+                name: "portal",
+                state: "blocked",
+                reason: "Package is not installed; deploy first.",
+            });
     return {
         ...state,
+        ...(m.compose
+            ? {
+                openUrl: m.compose.web
+                    ? `${options.host.dsmOrigin.replace(/\/$/, "")}/webman/3rdparty/${m.package}/sso/open.cgi`
+                    : undefined,
+            }
+            : {}),
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate || m.capabilities.webapi), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
+        uninstallCleanup: uninstallCleanup(m.package, {
+            executor: Boolean(m.capabilities.rootOps ||
+                m.capabilities.delegate ||
+                m.capabilities.webapi),
+            portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)),
+            portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)),
+        }),
     };
 }
 /** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */
 async function portalCapability(pkg, defaultAlias, host) {
     const status = await host.getPortalStatus?.(pkg);
     if (status?.state === "active" && status.alias)
-        return { name: "portal", state: "ready", reason: `Users open the App at ${host.dsmOrigin.replace(/\/$/, "")}/${encodeURIComponent(status.alias)}/ after DSM sign-in.` };
+        return {
+            name: "portal",
+            state: "ready",
+            reason: `Users open the App at ${host.dsmOrigin.replace(/\/$/, "")}/${encodeURIComponent(status.alias)}/ after DSM sign-in.`,
+        };
     if (status?.state === "inactive")
-        return { name: "portal", state: "needs-admin-approval", reason: `No alias is set; an administrator applies one (default ${defaultAlias}) in the App's Application Portal panel.` };
-    return { name: "portal", state: "blocked", reason: "The App's portal.status could not be read; open the App window to check the Application Portal." };
+        return {
+            name: "portal",
+            state: "needs-admin-approval",
+            reason: `No alias is set; an administrator applies one (default ${defaultAlias}) in the App's Application Portal panel.`,
+        };
+    return {
+        name: "portal",
+        state: "blocked",
+        reason: "The App's portal.status could not be read; open the App window to check the Application Portal.",
+    };
 }
 /** A native layout has no SDK capabilities; report package state only. */
 async function nativeLayoutInfo(root, host) {
@@ -210,7 +302,7 @@ export function formatProjectInfo(info) {
         info.openUrl ? `Open URL: ${info.openUrl}` : "Open URL: (not set)",
         info.readiness ? `Readiness: ${info.readiness}` : "",
         ...info.capabilities.map((cap) => `Capability ${cap.name}: ${cap.state} — ${cap.reason}`),
-        ...(info.uninstallCleanup ?? []).map(item => `Uninstall cleanup (if needed): ${item.target} — ${item.condition} ${item.action}`),
+        ...(info.uninstallCleanup ?? []).map((item) => `Uninstall cleanup (if needed): ${item.target} — ${item.condition} ${item.action}`),
     ]
         .filter(Boolean)
         .join("\n");