@synopackageland/cli 0.13.1 → 0.15.0

package/dist/build-spk/resource-worker.d.ts

@@ -1,20 +1,8 @@
-import type { AppContract, ComposeDocument } from "../types.js";
-import { type ResourceWorkerEligibility } from "../compose/analyze.js";
-export { classifyComposeRoute, resourceWorkerEligibility, type ComposeRoute, type ComposeRouteClassification, type ResourceWorkerEligibility, type ResourceWorkerIneligibleReason, } from "../compose/analyze.js";
+/** Static metadata for DSM's official Container Manager worker. No runtime code. */
 export declare function composeProjectName(packageId: string): string;
 /**
  * `forcePull` re-resolves every image tag on install, which can move an image
  * shared with other containers. Digest-pinned images cannot move, so it is only
  * needed (and kept, to preserve upgrade behaviour) while a tag is unpinned.
  */
-export declare function renderDockerProjectResource(packageId: string, projectPath?: string, forcePull?: boolean): Record<string, unknown>;
-export declare function renderWebserviceResource(contract: AppContract, adminport: number): Record<string, unknown>;
-export declare function renderResourceConfig(contract: AppContract, eligibility: ResourceWorkerEligibility, compose: ComposeDocument): string;
-/**
- * Renders the lifecycle control script for the Docker Project resource-worker
- * route. ContainerManager owns the actual project start/stop operation through
- * the worker timing hooks; the package script must wait for that operation to
- * leave a reachable service and must not claim running unconditionally.
- */
-export declare function renderResourceWorkerStartStopStatus(packageId: string, adminport?: number, headless?: boolean): string;
-export declare function renderHeadlessResourceMarker(): string;
+export declare function renderDockerProjectResource(packageId: string, projectPath?: string, forcePull?: boolean, projectNameOverride?: string): Record<string, unknown>;

package/dist/build-spk/resource-worker.js

@@ -1,6 +1,4 @@
-import { collectUnpinnedImages } from "../compose/analyze.js";
-import { cookieStripHeaders, resolvedWebLaunch, usesAuthGateway, webStationAlias, webStationServiceName, } from "../contract/web-launch.js";
-export { classifyComposeRoute, resourceWorkerEligibility, } from "../compose/analyze.js";
+/** Static metadata for DSM's official Container Manager worker. No runtime code. */
 export function composeProjectName(packageId) {
     const slug = packageId
         .toLowerCase()
@@ -13,8 +11,8 @@ export function composeProjectName(packageId) {
  * shared with other containers. Digest-pinned images cannot move, so it is only
  * needed (and kept, to preserve upgrade behaviour) while a tag is unpinned.
  */
-export function renderDockerProjectResource(packageId, projectPath = "compose", forcePull = true) {
-    const projectName = composeProjectName(packageId);
+export function renderDockerProjectResource(packageId, projectPath = "compose", forcePull = true, projectNameOverride) {
+    const projectName = projectNameOverride ?? composeProjectName(packageId);
     return {
         "docker-project": {
             projects: [
@@ -31,164 +29,3 @@ export function renderDockerProjectResource(packageId, projectPath = "compose",
         },
     };
 }
-export function renderWebserviceResource(contract, adminport) {
-    const alias = webStationAlias(String(contract.package));
-    const launch = resolvedWebLaunch(contract);
-    const cookieHeaders = cookieStripHeaders(contract);
-    const proxyHeaderEntries = cookieHeaders.map((header) => ({
-        name: header.name,
-        value: header.value,
-    }));
-    const service = {
-        service: webStationServiceName(alias),
-        display_name: String(contract.displayname ?? contract.package),
-        type: "reverse_proxy",
-        support_alias: true,
-        support_server: false,
-        proxy_target: `http://127.0.0.1:${adminport}`,
-        proxy_headers: proxyHeaderEntries,
-    };
-    const portal = {
-        service: webStationServiceName(alias),
-        name: alias,
-        type: "alias",
-        alias,
-    };
-    if (launch === "dsm-window") {
-        portal.app = String(contract.package);
-    }
-    return {
-        webservice: {
-            services: [service],
-            portals: [portal],
-        },
-    };
-}
-export function renderResourceConfig(contract, eligibility, compose) {
-    const packageId = String(contract.package);
-    const forcePull = collectUnpinnedImages(compose).length > 0;
-    const dockerResource = renderDockerProjectResource(packageId, "compose", forcePull);
-    let combined = { ...dockerResource };
-    // A gateway package is reached through its DSM-authenticated CGI only; a Web
-    // Station portal in front of the container would be an anonymous second door.
-    if (eligibility.adminport !== undefined && !usesAuthGateway(contract)) {
-        const webResource = renderWebserviceResource(contract, eligibility.adminport);
-        combined = {
-            ...combined,
-            ...webResource,
-        };
-    }
-    return `${JSON.stringify(combined, null, 2)}\n`;
-}
-/**
- * Renders the lifecycle control script for the Docker Project resource-worker
- * route. ContainerManager owns the actual project start/stop operation through
- * the worker timing hooks; the package script must wait for that operation to
- * leave a reachable service and must not claim running unconditionally.
- */
-export function renderResourceWorkerStartStopStatus(packageId, adminport, headless = false) {
-    if (headless) {
-        return `#!/bin/sh
-SYNOPKG_PKGNAME="\${SYNOPKG_PKGNAME:-${packageId}}"
-SYNOPKGLAND_PROC_ROOT="\${SYNOPKGLAND_PROC_ROOT:-/proc}"
-
-probe_project_process() {
-  for p in "$SYNOPKGLAND_PROC_ROOT"/[0-9]*; do
-    [ -d "$p" ] || continue
-    if grep -q docker "$p/cgroup" 2>/dev/null &&
-      grep -q \\
-        "@appstore/\${SYNOPKG_PKGNAME}/compose/" \\
-        "$p/mountinfo" 2>/dev/null; then
-      return 0
-    fi
-  done
-  return 1
-}
-
-case "$1" in
-  start|stop) exit 0 ;;
-  status)
-    probe_project_process
-    exit $?
-    ;;
-  *) exit 1 ;;
-esac
-`;
-    }
-    if (adminport === undefined) {
-        return `#!/bin/sh
-case "$1" in
-  start|status)
-    echo "resource-worker package has no published port to probe" >&2
-    exit 3
-    ;;
-  stop) exit 0 ;;
-  *) exit 1 ;;
-esac
-`;
-    }
-    const url = `http://127.0.0.1:${adminport}/`;
-    return `#!/bin/sh
-probe_service() {
-  if command -v curl >/dev/null 2>&1; then
-    curl --silent --output /dev/null --connect-timeout 2 --max-time 5 "${url}"
-    return $?
-  fi
-  if command -v wget >/dev/null 2>&1; then
-    wget --quiet --output-document=/dev/null --timeout=5 --tries=1 "${url}"
-    return $?
-  fi
-  return 127
-}
-
-wait_for_service() {
-  attempts=0
-  while [ "$attempts" -lt 30 ]; do
-    if probe_service; then
-      return 0
-    fi
-    attempts=$((attempts + 1))
-    sleep 1
-  done
-  return 1
-}
-
-case "$1" in
-  start)
-    if wait_for_service; then
-      exit 0
-    fi
-    exit 3
-    ;;
-  stop)
-    exit 0
-    ;;
-  status)
-    if probe_service; then
-      exit 0
-    fi
-    exit 3
-    ;;
-  *)
-    exit 1
-    ;;
-esac
-`;
-}
-export function renderHeadlessResourceMarker() {
-    return `#!/bin/sh
-set -eu
-PKGVAR="\${SYNOPKG_PKGVAR:?}"
-[ -d "$PKGVAR" ] || mkdir -p "$PKGVAR"
-[ ! -L "$PKGVAR" ] || { echo "package var is a symlink" >&2; exit 1; }
-MARKER="$PKGVAR/.docker-project-managed"
-[ ! -L "$MARKER" ] || { echo "docker-project marker is a symlink" >&2; exit 1; }
-tmp="$(mktemp "$PKGVAR/.docker-project-managed.tmp.XXXXXX")"
-trap 'rm -f "$tmp"' EXIT HUP INT TERM
-printf '%s\n' managed > "$tmp"
-chmod 600 "$tmp"
-mv "$tmp" "$MARKER"
-trap - EXIT HUP INT TERM
-exit 0
-`;
-}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { codedMessage, formatErrors } from "./errors.js";
 import { getErrorCode } from "./error-registry.js";
 import { formatInspectReport, inspectProject } from "./inspect.js";
 import { formatPinReport, pinProjectImages } from "./images/pin.js";
-import { initFromTemplate, initNextSteps, isTemplateName, listTemplates } from "./init.js";
+import { initFromTemplate, initNextSteps, isTemplateName, listTemplates, } from "./init.js";
 import { templatesRoot } from "./template-paths.js";
 import { addCapabilities } from "./add.js";
 import { CAPABILITY_NAMES } from "./capabilities.js";
@@ -29,9 +29,9 @@ import { followProjectLogs, followStandaloneLogs } from "./log.js";
 import { formatSkillList, readSkill, resolveSkillsRoot } from "./skill.js";
 import { resolveInstallParameterExtraValues } from "./deploy/param-values.js";
 import { findStandaloneRoot, loadStandaloneManifest, } from "./standalone/manifest.js";
-import { buildNativeLayout, isNativeLayout, loadNativeLayout, LAYOUT_ARCHES } from "./standalone/native-layout.js";
+import { buildNativeLayout, isNativeLayout, loadNativeLayout, LAYOUT_ARCHES, } from "./standalone/native-layout.js";
 import { buildStandalone, runnerFor } from "./standalone/build.js";
-import { checkJobs, commitOutputs, forEachArch } from "./standalone/arch-jobs.js";
+import { checkJobs, commitOutputs, forEachArch, } from "./standalone/arch-jobs.js";
 import { checkReproducible } from "./reproducible.js";
 import { inspectAnySpk } from "./spk/inspect.js";
 function failure(code, message, hint = "Fix the configuration and retry; use --help to see command usage.") {
@@ -61,9 +61,19 @@ function formatIconReport(report, manifestFile) {
         lines: report.source === "custom"
             ? [`Icon: custom ${report.path}`]
             : report.source === "layout"
-                ? ["Icon: provided by the layout metadata's PACKAGE_ICON*.PNG (if present)", `info: set icon: in ${manifestFile} to have the CLI generate the Package Center icon.`]
-                : ["Icon: SDK default icon", `info: set icon: in ${manifestFile} to <a square PNG (at least 256x256) or an icon_<size>.png directory> to use your own icon.`],
-        ...(report.solid ? { warning: "warning: the icon is a single colour, so Package Center and the DSM main menu show a flat block; use an icon with a graphic." } : {}),
+                ? [
+                    "Icon: provided by the layout metadata's PACKAGE_ICON*.PNG (if present)",
+                    `info: set icon: in ${manifestFile} to have the CLI generate the Package Center icon.`,
+                ]
+                : [
+                    "Icon: SDK default icon",
+                    `info: set icon: in ${manifestFile} to <a square PNG (at least 256x256) or an icon_<size>.png directory> to use your own icon.`,
+                ],
+        ...(report.solid
+            ? {
+                warning: "warning: the icon is a single colour, so Package Center and the DSM main menu show a flat block; use an icon with a graphic.",
+            }
+            : {}),
     };
 }
 const LABEL = { error: "error", warning: "warning" };
@@ -95,8 +105,12 @@ function formatSpkChecks(report) {
 function formatRootSteps(report) {
     const policy = report.executor?.policy;
     const steps = [
-        ...(policy?.start ? [`start ${policy.start} (once after each install or upgrade)`] : []),
-        ...(policy?.stop ? [`stop ${policy.stop} (at package stop and upgrade)`] : []),
+        ...(policy?.start
+            ? [`start ${policy.start} (once after each install or upgrade)`]
+            : []),
+        ...(policy?.stop
+            ? [`stop ${policy.stop} (at package stop and upgrade)`]
+            : []),
         ...(policy?.purge ? [`purge ${policy.purge} (at uninstall)`] : []),
     ];
     return steps.length ? [`Root steps: ${steps.join(", ")}`] : [];
@@ -105,19 +119,47 @@ function formatSpkReport(spk, report) {
     return [
         `SPK: ${spk}`,
         `package: ${report.package ?? "?"}  version: ${report.version ?? "?"}`,
-        report.synopkgland ? `arch: ${report.arch ?? "?"}  runtime: ${report.kind ?? "?"}` : `arch: ${report.arch ?? "?"}  build: not synopkgland (DSM format only)`,
+        report.synopkgland
+            ? `arch: ${report.arch ?? "?"}  runtime: ${report.kind ?? "?"}`
+            : `arch: ${report.arch ?? "?"}  build: not synopkgland (DSM format only)`,
+        ...(report.compose
+            ? [
+                `Compose readiness: ${report.compose.readiness.profile}`,
+                report.compose.readiness.limitation,
+            ]
+            : []),
         `Signature: ${report.signed ? "Synology-signed" : "unsigned (Package Center must allow any publisher)"}`,
         ...(report.synopkgland ? [`CGI: ${report.cgi ?? "none"}`] : []),
-        ...(report.icon ? [`Icon: ${report.icon.source === "default" ? "SDK default icon" : report.icon.source === "custom" ? `custom (PACKAGE_ICON_256 sha256 ${report.icon.sha256.slice(0, 12)}…)` : "no PACKAGE_ICON"}`] : []),
-        ...(report.entry === "admin-only" ? ["Entry: entry: admin-only; only a DSM administrator can open it and call any route (including SDK routes)"] : []),
-        ...(report.entry === "app-privilege" ? ["Entry: entry: app-privilege; DSM Control Panel > Application Privileges decides who can use it"] : []),
+        ...(report.icon
+            ? [
+                `Icon: ${report.icon.source === "default" ? "SDK default icon" : report.icon.source === "custom" ? `custom (PACKAGE_ICON_256 sha256 ${report.icon.sha256.slice(0, 12)}…)` : "no PACKAGE_ICON"}`,
+            ]
+            : []),
+        ...(report.entry === "admin-only"
+            ? [
+                "Entry: entry: admin-only; only a DSM administrator can open it and call any route (including SDK routes)",
+            ]
+            : []),
+        ...(report.entry === "app-privilege"
+            ? [
+                "Entry: entry: app-privilege; DSM Control Panel > Application Privileges decides who can use it",
+            ]
+            : []),
         ...formatRootSteps(report),
-        ...(report.appScripts ? [`App scripts: ${report.appScripts.join(", ")} (scripts/app, run by the generated scripts of the same name as the package account)`] : []),
+        ...(report.appScripts
+            ? [
+                `App scripts: ${report.appScripts.join(", ")} (scripts/app, run by the generated scripts of the same name as the package account)`,
+            ]
+            : []),
         ...(report.loginStyle ? [formatLoginStyle(report.loginStyle)] : []),
-        ...(report.portal ? [`Application Portal: default alias /${report.portal.alias}/ (${report.portal.appId}), active after an administrator applies it`] : []),
+        ...(report.portal
+            ? [
+                `Application Portal: default alias /${report.portal.alias}/ (${report.portal.appId}), active after an administrator applies it`,
+            ]
+            : []),
         ...report.capabilities.map((cap) => `Capability ${cap.name}: ${cap.requiresAdminApproval ? "needs DSM administrator approval" : "ready after install"}`),
         "payload:",
-        ...(report.uninstallCleanup ?? []).map(item => `Uninstall cleanup (if needed): ${item.target} — ${item.condition} ${item.action}`),
+        ...(report.uninstallCleanup ?? []).map((item) => `Uninstall cleanup (if needed): ${item.target} — ${item.condition} ${item.action}`),
         ...report.payload.map((e) => `  ${e.mode} ${e.path}`),
         ...formatSpkChecks(report),
     ].join("\n");
@@ -131,8 +173,20 @@ async function standaloneBuild(root, arches, options) {
             ? resolve(options.outDir)
             : undefined;
     const result = isNativeLayout(root)
-        ? await buildNativeLayout({ root, arches, outDir, minDsm: options.minDsm, jobs: options.jobs })
-        : await buildStandalone({ root, arches: arches, outDir, minDsm: options.minDsm, jobs: options.jobs });
+        ? await buildNativeLayout({
+            root,
+            arches,
+            outDir,
+            minDsm: options.minDsm,
+            jobs: options.jobs,
+        })
+        : await buildStandalone({
+            root,
+            arches: arches,
+            outDir,
+            minDsm: options.minDsm,
+            jobs: options.jobs,
+        });
     result.warnings?.forEach((warning) => console.error(warning));
     return result.outputs.map((output) => {
         if (!options.output)
@@ -145,26 +199,46 @@ async function standaloneBuild(root, arches, options) {
 /** What the reproducible check needs to know about the project being built. */
 function reproducibleTarget(standalone, project, arches) {
     if (!standalone)
-        return { root: project.root, manifestPath: project.contractPath, arches: arches ?? [] };
+        return {
+            root: project.root,
+            manifestPath: project.contractPath,
+            arches: arches ?? [],
+        };
     const manifestPath = join(standalone, "dsm-package.yaml");
     if (!isNativeLayout(standalone)) {
         const loaded = loadStandaloneManifest(standalone);
-        return { root: standalone, manifestPath, arches: arches ?? (loaded.ok ? loaded.manifest.arches : []) };
+        return {
+            root: standalone,
+            manifestPath,
+            arches: arches ?? (loaded.ok ? loaded.manifest.arches : []),
+        };
     }
     const loaded = loadNativeLayout(standalone);
     if (!loaded.ok)
         return { root: standalone, manifestPath, arches: arches ?? [] };
     // Toolkit pins decide what the native hooks compile against.
-    const toolkits = createHash("sha256").update(JSON.stringify(loaded.manifest.native.toolkits)).digest("hex");
-    return { root: standalone, manifestPath, arches: arches ?? loaded.manifest.arches, extraInputs: { "native.toolkits": toolkits } };
+    const toolkits = createHash("sha256")
+        .update(JSON.stringify(loaded.manifest.native.toolkits))
+        .digest("hex");
+    return {
+        root: standalone,
+        manifestPath,
+        arches: arches ?? loaded.manifest.arches,
+        extraInputs: { "native.toolkits": toolkits },
+    };
 }
 function reproducibleLines(report) {
     if (report.skipped)
-        return [`Reproducible check: the dependency fingerprint ${report.fingerprint.slice(0, 12)} matches the last passing run, skipping.`];
+        return [
+            `Reproducible check: the dependency fingerprint ${report.fingerprint.slice(0, 12)} matches the last passing run, skipping.`,
+        ];
     return report.results.map((result) => result.identical
         ? `Reproducible check: ${basename(result.output)} is identical (sha256 ${result.sha256[0].slice(0, 12)})`
         : `Reproducible check: ${basename(result.output)} differs (sha256 ${result.sha256[0].slice(0, 12)} ≠ ${result.sha256[1].slice(0, 12)})\n` +
-            [...result.payload.map((file) => `  payload ${file}`), ...result.metadata.map((file) => `  metadata ${file}`)].join("\n"));
+            [
+                ...result.payload.map((file) => `  payload ${file}`),
+                ...result.metadata.map((file) => `  metadata ${file}`),
+            ].join("\n"));
 }
 const ARCH_REQUIRED = [
     "NATIVE_ARCH_FAMILY_REQUIRED",
@@ -177,8 +251,16 @@ async function containerBuild(project, arches, options) {
         throw failure("CONTAINER_ARCH_UNSUPPORTED", `Container Manager Apps support only ${CONTAINER_ARCH_FAMILIES.join(", ")}; DSM does not provide Container Manager for ${unsupported}.`);
     const output = options.output ? resolve(options.output) : undefined;
     const build = async (archFamily, outputPath = output) => {
-        const result = await buildSpk({ project, archFamily, outputPath, minDsm: options.minDsm, gatewayRun: archFamily && runnerFor(undefined, jobs, archFamily) });
-        if (!result.ok && !(archFamily === undefined && result.errors.every((code) => ARCH_REQUIRED.includes(code))))
+        const result = await buildSpk({
+            project,
+            archFamily,
+            outputPath,
+            minDsm: options.minDsm,
+            gatewayRun: archFamily && runnerFor(undefined, jobs, archFamily),
+        });
+        if (!result.ok &&
+            !(archFamily === undefined &&
+                result.errors.every((code) => ARCH_REQUIRED.includes(code))))
             throw failure(result.errors[0] ?? "BUILD_FAILED", `Build failed: ${result.errors.join(", ")}`);
         return result;
     };
@@ -190,9 +272,15 @@ async function containerBuild(project, arches, options) {
     if (output)
         throw failure("CLI_OUTPUT_ARCH_REQUIRED", "-o requires a single --arch.");
     const packageId = String(loadContract(project.contractPath).contract.package);
-    return commitOutputs(options.outDir ? resolve(options.outDir) : project.root, (stage) => forEachArch(arches ?? CONTAINER_ARCH_FAMILIES, jobs, async (arch) => (await build(arch, join(stage, `${packageId}-${arch}.spk`))).outputPath));
+    return commitOutputs(options.outDir ? resolve(options.outDir) : project.root, (stage) => forEachArch(arches ?? CONTAINER_ARCH_FAMILIES, jobs, async (arch) => (await build(arch, join(stage, `${packageId}-${arch}.spk`)))
+        .outputPath));
 }
 export async function runCli(argv) {
+    if (argv[2] === "ctl") {
+        const { runCtl } = await import("./ctl/cli.js");
+        await runCtl(argv.slice(3));
+        return;
+    }
     const json = argv.includes("--json");
     const stdout = console.log.bind(console);
     const progress = console.log;
@@ -211,6 +299,7 @@ export async function runCli(argv) {
             throw failure("NAS_CREDENTIALS_MISSING", "NAS credentials were not found.", "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD.");
         return nas;
     };
+    program.command("ctl").description("Control registered NAS Apps using described AI commands (ctl --help)");
     program
         .command("check")
         .description("Validate the manifest, capability combination and Compose")
@@ -223,26 +312,61 @@ export async function runCli(argv) {
             throw failure(validation.errors[0].code, formatErrors(validation.errors), validation.errors[0].suggestion);
         const standalone = standaloneRoot(rootOf(command));
         if (standalone) {
-            const loaded = isNativeLayout(standalone) ? loadNativeLayout(standalone) : loadStandaloneManifest(standalone);
+            const loaded = isNativeLayout(standalone)
+                ? loadNativeLayout(standalone)
+                : loadStandaloneManifest(standalone);
             if (!loaded.ok)
                 throw failure(loaded.errors[0].code, loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"), "Update dsm-package.yaml to schema: 2, fix the declaration and retry.");
-            const declared = "icon" in loaded.manifest && loaded.manifest.icon ? resolve(standalone, loaded.manifest.icon) : undefined;
-            const icon = isNativeLayout(standalone) && !declared ? { source: "layout", solid: false } : iconReport(standalone, declared);
+            const declared = "icon" in loaded.manifest && loaded.manifest.icon
+                ? resolve(standalone, loaded.manifest.icon)
+                : undefined;
+            const icon = isNativeLayout(standalone) && !declared
+                ? { source: "layout", solid: false }
+                : iconReport(standalone, declared);
             const iconText = formatIconReport(icon, "dsm-package.yaml");
             if (iconText.warning)
                 console.error(iconText.warning);
             // A portal build carries the login style; a native layout keeps its own ui/config.
-            const loginStyle = !isNativeLayout(standalone) && "portal" in loaded.manifest && loaded.manifest.portal
-                ? loginStyleReport(standalone, "loginStyle" in loaded.manifest ? loaded.manifest.loginStyle : undefined) : undefined;
+            const loginStyle = !isNativeLayout(standalone) &&
+                "portal" in loaded.manifest &&
+                loaded.manifest.portal
+                ? loginStyleReport(standalone, "loginStyle" in loaded.manifest
+                    ? loaded.manifest.loginStyle
+                    : undefined)
+                : undefined;
             emit("check", {
                 package: loaded.manifest.package,
-                capabilities: "capabilities" in loaded.manifest ? loaded.manifest.capabilities : {},
+                capabilities: "capabilities" in loaded.manifest
+                    ? loaded.manifest.capabilities
+                    : {},
+                ...("compose" in loaded.manifest && loaded.manifest.compose
+                    ? {
+                        compose: {
+                            images: loaded.manifest.compose.plan.images,
+                            services: loaded.manifest.compose.plan.services,
+                            mountsBlocked: loaded.manifest.compose.plan.mounts_blocked,
+                            acceptanceBlockers: loaded.manifest.compose.plan.acceptance_blockers,
+                        },
+                    }
+                    : {}),
                 icon,
                 ...(loginStyle ? { loginStyle } : {}),
-            }, ["Validation passed.", ...iconText.lines, ...(loginStyle ? [
-                    formatLoginStyle(loginStyle),
-                    "info: set login_style: in dsm-package.yaml (color, wallpaper with wallpaper_thumbnail, title) to brand the Login Portal page.",
-                ] : [])].join("\n"));
+            }, [
+                "Validation passed.",
+                ...("compose" in loaded.manifest && loaded.manifest.compose
+                    ? [
+                        "Containers use the fixed package identity; signed-in File Station ACLs are not inherited.",
+                        ...loaded.manifest.compose.plan.acceptance_blockers.map((b) => `Acceptance blocker: ${b}`),
+                    ]
+                    : []),
+                ...iconText.lines,
+                ...(loginStyle
+                    ? [
+                        formatLoginStyle(loginStyle),
+                        "info: set login_style: in dsm-package.yaml (color, wallpaper with wallpaper_thumbnail, title) to brand the Login Portal page.",
+                    ]
+                    : []),
+            ].join("\n"));
             return;
         }
         const project = requireProject(rootOf(command));
@@ -256,7 +380,11 @@ export async function runCli(argv) {
         const iconText = formatIconReport(icon, "synology-app.yaml");
         if (iconText.warning)
             console.error(iconText.warning);
-        emit("check", { report, warnings: result.warnings ?? [], icon }, [`Validation passed.`, formatInspectReport(report), ...iconText.lines].join("\n"));
+        emit("check", { report, warnings: result.warnings ?? [], icon }, [
+            `Validation passed.`,
+            formatInspectReport(report),
+            ...iconText.lines,
+        ].join("\n"));
     });
     program
         .command("inspect <spk>")
@@ -390,8 +518,7 @@ export async function runCli(argv) {
             arch: options.arch,
             dev: options.dev,
         });
-        if (plan.kind !== "container" &&
-            (options.share || options.runAs))
+        if (plan.kind !== "container" && (options.share || options.runAs))
             throw failure("CLI_OPTION_INVALID", "native-go/binary do not accept --share/--run-as; pass install wizard values with --param.");
         if (options.dryRun) {
             emit("deploy", plan, JSON.stringify(plan, null, 2));
@@ -399,7 +526,9 @@ export async function runCli(argv) {
         }
         if (plan.kind !== "container") {
             const host = hostOf(options.host);
-            const output = await deployStandalone(plan, host, { params: options.param });
+            const output = await deployStandalone(plan, host, {
+                params: options.param,
+            });
             const status = await standaloneInfo({ root: plan.root, host });
             emit("deploy", { ...plan, output, status }, `Deployed ${plan.packageId}: ${output}\n${formatProjectInfo(status)}${plan.notes.length ? "\n" + plan.notes.join("\n") : ""}`);
             return;
@@ -472,7 +601,9 @@ export async function runCli(argv) {
         if (result.diagnostics)
             stdout(JSON.stringify(result.diagnostics, null, 2));
     });
-    const skill = program.command("skill").description("Bundled Agent Skill Pack");
+    const skill = program
+        .command("skill")
+        .description("Bundled Agent Skill Pack");
     skill.command("path").action(() => stdout(resolveSkillsRoot()));
     skill.command("list").action(() => stdout(formatSkillList()));
     skill.command("show <id>").action((id) => stdout(readSkill(id)));
@@ -482,14 +613,19 @@ export async function runCli(argv) {
         .option("--json", "Print a single JSON object")
         .option("-o, --output <path>", "Output SPK; use with a single --arch")
         .option("--out-dir <dir>", "Output directory; native projects default to dist/")
-        .option("--arch <families>", `Architectures, comma-separated or repeated: ${NATIVE_ARCH_FAMILIES.join(",")} (armv7 is for native-go and binary, not for Container Manager Apps); native layout also supports armv8`, (value, previous) => [...(previous ?? []), value])
+        .option("--arch <families>", `Architectures, comma-separated or repeated: ${NATIVE_ARCH_FAMILIES.join(",")} (armv7 is for native-go and binary, not for Container Manager Apps); native layout also supports armv8`, (value, previous) => [
+        ...(previous ?? []),
+        value,
+    ])
         .option("--min-dsm <version>", "Minimum DSM version; uses the manifest value when omitted")
         .option("--jobs <n>", "Number of architectures to build in parallel, default 1 (sequential)", Number)
         .option("--verify-reproducible [when]", "Build again from a clean state and compare; when: changed (default, skips when the dependency fingerprint is unchanged) or always")
         .action(async (options, command) => {
         const root = rootOf(command);
         const standalone = standaloneRoot(root);
-        const verify = options.verifyReproducible === true ? "changed" : options.verifyReproducible;
+        const verify = options.verifyReproducible === true
+            ? "changed"
+            : options.verifyReproducible;
         if (verify !== undefined && verify !== "changed" && verify !== "always")
             throw failure("CLI_OPTION_INVALID", `--verify-reproducible accepts only changed or always, got ${verify}.`);
         let arches;
@@ -498,7 +634,10 @@ export async function runCli(argv) {
                 options.arch === undefined
                     ? undefined
                     : standalone && isNativeLayout(standalone)
-                        ? options.arch.join(",").split(",").map((arch) => {
+                        ? options.arch
+                            .join(",")
+                            .split(",")
+                            .map((arch) => {
                             if (!Object.hasOwn(LAYOUT_ARCHES, arch))
                                 throw new Error(`Native layout arch must be one of ${Object.keys(LAYOUT_ARCHES).join(", ")}`);
                             return arch;
@@ -511,18 +650,29 @@ export async function runCli(argv) {
         const project = standalone ? undefined : requireProject(root);
         const build = (overrides = {}) => standalone
             ? standaloneBuild(standalone, arches, { ...options, ...overrides })
-            : containerBuild(project, arches, { ...options, ...overrides });
+            : containerBuild(project, arches, {
+                ...options,
+                ...overrides,
+            });
         const outputs = await build();
-        const reproducible = verify === undefined ? undefined : await checkReproducible({
-            ...reproducibleTarget(standalone, project, arches),
-            outputs,
-            mode: verify,
-            // The second build writes only to its own folder; a single Compose SPK keeps its name there.
-            rebuild: (outDir) => standalone || outputs.length > 1
-                ? build({ output: undefined, outDir })
-                : build({ output: join(outDir, basename(outputs[0])), outDir: undefined }),
-        });
-        const lines = [...outputs.map((output) => `Built ${output}`), ...(reproducible ? reproducibleLines(reproducible) : [])];
+        const reproducible = verify === undefined
+            ? undefined
+            : await checkReproducible({
+                ...reproducibleTarget(standalone, project, arches),
+                outputs,
+                mode: verify,
+                // The second build writes only to its own folder; a single Compose SPK keeps its name there.
+                rebuild: (outDir) => standalone || outputs.length > 1
+                    ? build({ output: undefined, outDir })
+                    : build({
+                        output: join(outDir, basename(outputs[0])),
+                        outDir: undefined,
+                    }),
+            });
+        const lines = [
+            ...outputs.map((output) => `Built ${output}`),
+            ...(reproducible ? reproducibleLines(reproducible) : []),
+        ];
         if (reproducible && !reproducible.identical)
             throw Object.assign(failure("BUILD_NOT_REPRODUCIBLE", lines.join("\n"), "Find the payload files that differ between builds (timestamps, random paths, unpinned dependencies) and retry after fixing them."), { report: { outputs, reproducible } });
         emit("build", { outputs, ...(reproducible ? { reproducible } : {}) }, lines.join("\n"));
@@ -553,7 +703,9 @@ export async function runCli(argv) {
                 ok: false,
                 code,
                 message,
-                hint: detail.hint ?? getErrorCode(code)?.suggestion ?? "Fix the configuration and retry; use --help to see command usage.",
+                hint: detail.hint ??
+                    getErrorCode(code)?.suggestion ??
+                    "Fix the configuration and retry; use --help to see command usage.",
                 ...(detail.report ? { data: detail.report } : {}),
             }));
         }