@synopackageland/cli 0.14.1 → 0.15.0

package/dist/standalone/inspect-spk.js

@@ -1,40 +1,51 @@
+import { isDeepStrictEqual } from "node:util";
+import { inspectApiDescription } from "./api-description-inspect.js";
 import { dsmLauncherType } from "../contract/app-launch.js";
-import { isWebLaunchMode, resolvedWebLaunch, trustedAppEntryPath, usesAuthGateway } from "../contract/web-launch.js";
+import { isWebLaunchMode, resolvedWebLaunch, trustedAppEntryPath, usesAuthGateway, } from "../contract/web-launch.js";
 import { loadContract } from "../contract/load.js";
-import { readComposeApp } from "./compose.js";
+import { readComposeApp, composeSource, dsmComposeProblem, COMPOSE_READINESS_LIMITATION, } from "./compose.js";
 import { createHash } from "node:crypto";
 import { inspectNativeLayout } from "./native-layout.js";
 import { checkBridgeApp, checkBridgeExecutor } from "./inspect-bridge.js";
-import { inspectExecutor, inspectExecutorAnchor } from "../runtime/executor-inspect.js";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { inspectExecutor, inspectExecutorAnchor, } from "../runtime/executor-inspect.js";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, } from "node:fs";
 import { unwrapAppScripts } from "./app-scripts.js";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
-import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
-import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON } from "../build-spk/dsm-version.js";
+import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
-import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, BRIDGE_WORKER_ARGS, backgroundUnitName, renderBackgroundUnit } from "./background.js";
+import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, BRIDGE_WORKER_ARGS, backgroundUnitName, renderBackgroundUnit, } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
-import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
-import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
-import { renderDelegateScopeSteps, renderDelegateInstallDraft } from "../build-spk/delegate-scope.js";
+import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER, } from "./shared-folder.js";
+import { renderInstallWizardFiles, renderNativeInstallWizard, } from "../build-spk/install-wizard.js";
+import { renderDelegateScopeSteps, renderDelegateInstallDraft, } from "../build-spk/delegate-scope.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
+import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
+import { renderUiConfig } from "./dsm-window.js";
+import { identityGatewayConfig, readIdentityGateway, } from "./identity-gateway.js";
+import { checkCgiBinary } from "./binary.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
-import { uninstallCleanup } from "../runtime/uninstall-cleanup.js";
-import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
+import { uninstallCleanup, } from "../runtime/uninstall-cleanup.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep, } from "../portal/package.js";
 import { isPortalAlias } from "../portal/alias.js";
 import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
 import { isDefaultLoginAsset } from "../build-spk/login-style.js";
 import { decodePng } from "../build-spk/png.js";
 /** The SPK kind of each sdk-package.json backend a CGI is built for: Go itself, or the runtime of an App in another language. */
-const COMPILED_KIND = { go: "native-go", python: "native-python", node: "native-node", rust: "native-rust" };
+const COMPILED_KIND = {
+    go: "native-go",
+    python: "native-python",
+    node: "native-node",
+    rust: "native-rust",
+};
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
     return inspectSpk(spkPath, "native-go");
@@ -52,21 +63,51 @@ export async function inspectSpk(spkPath, expectedKind) {
             mkdirSync(target);
             await tar.x({ file: join(dir, "package.tgz"), cwd: target });
             findings.push(...inspectNativeLayout(dir, target, info));
-            for (const key of ["package", "version", "arch", "os_min_ver", "checksum"])
+            for (const key of [
+                "package",
+                "version",
+                "arch",
+                "os_min_ver",
+                "checksum",
+            ])
                 if (!info[key])
                     findings.push(`Missing INFO ${key}`);
             const icon = inspectPackageIcons(dir, findings);
-            return { kind: "native-layout", package: info.package, version: info.version, arch: info.arch,
-                signed: existsSync(join(dir, "syno_signature.asc")), payload, findings, capabilities: [], icon };
+            return {
+                kind: "native-layout",
+                package: info.package,
+                version: info.version,
+                arch: info.arch,
+                signed: existsSync(join(dir, "syno_signature.asc")),
+                payload,
+                findings,
+                capabilities: [],
+                icon,
+            };
         }
         const payload = await listPayload(join(dir, "package.tgz"), findings);
-        const paths = new Set(payload.map(entry => entry.path));
+        const paths = new Set(payload.map((entry) => entry.path));
         let metadata = {};
         const metadataText = readOptional(join(dir, "sdk-package.json"));
         if (metadataText !== undefined) {
             try {
                 const raw = JSON.parse(metadataText);
-                if ((raw.launch !== undefined && !isWebLaunchMode(raw.launch)) || raw.schema !== 2 || !["go", "python", "node", "rust", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate", "webapi"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
+                if ((raw.launch !== undefined && !isWebLaunchMode(raw.launch)) ||
+                    raw.schema !== 2 ||
+                    !["go", "python", "node", "rust", "binary"].includes(raw.backend) ||
+                    !Array.isArray(raw.capabilities) ||
+                    raw.capabilities.some((name) => ![
+                        "files",
+                        "jobs",
+                        "identity",
+                        "rootOps",
+                        "delegate",
+                        "webapi",
+                        "composeMounts",
+                    ].includes(String(name))) ||
+                    new Set(raw.capabilities).size !== raw.capabilities.length ||
+                    (raw.entry !== undefined &&
+                        !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
                 metadata = raw;
             }
@@ -74,27 +115,51 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json does not match the schema 2 capability inventory.");
             }
         }
-        const uninstallHook = metadata.uninstall === undefined ? undefined : readUninstallRecord(metadata.uninstall, metadata.capabilities?.includes("rootOps") === true);
+        if (metadata.compose !== undefined) {
+            const result = await inspectUnifiedCompose(dir, payload, metadata, findings);
+            result.icon = inspectPackageIcons(dir, findings);
+            return result;
+        }
+        const uninstallHook = metadata.uninstall === undefined
+            ? undefined
+            : readUninstallRecord(metadata.uninstall, metadata.capabilities?.includes("rootOps") === true);
         if (metadata.uninstall !== undefined && !uninstallHook)
             findings.push("UNINSTALL_RECORD_INVALID the uninstall in sdk-package.json is not the uninstall setting synopkgland build writes.");
         const binaryBackend = metadata.backend === "binary";
         // A strict standalone inspection names the language the CGI was built from.
         const compiled = COMPILED_KIND[metadata.backend ?? "go"] ?? "native-go";
-        const kind = (expectedKind === "native-go" ? compiled : expectedKind) ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : compiled);
+        const kind = (expectedKind === "native-go" ? compiled : expectedKind) ??
+            (paths.has("compose.yaml")
+                ? "container"
+                : binaryBackend
+                    ? "binary"
+                    : compiled);
         const compiledKind = Object.values(COMPILED_KIND).includes(kind);
         const standalone = compiledKind || kind === "binary";
-        const combined = metadata.compose === undefined ? undefined : await recoverCompose(dir, metadata.compose, findings);
+        const combined = metadata.compose === undefined
+            ? undefined
+            : await recoverCompose(dir, metadata.compose, findings);
         const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined));
-        if (combined && (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
+        if (combined &&
+            (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
-        const appScripts = standalone || kind === "container" ? unwrapAppScripts(join(dir, "scripts"), findings) : [];
-        const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
+        const appScripts = standalone || kind === "container"
+            ? unwrapAppScripts(join(dir, "scripts"), findings)
+            : [];
+        const sharedFolder = standalone
+            ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst")))
+            : undefined;
         // A Compose App has no executor, so its SPK never carries a portal.
-        const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
-        if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
+        const portal = standalone
+            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings)
+            : undefined;
+        if (portal &&
+            info.os_min_ver &&
+            OS_MIN_VER.test(info.os_min_ver) &&
+            !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
         checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose);
@@ -102,15 +167,36 @@ export async function inspectSpk(spkPath, expectedKind) {
         checkUninstall(dir, findings);
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
-        const bridge = compiledKind && kind !== "native-go" ? await checkBridgeApp(dir, metadata.backend, info, payload, findings) : undefined;
-        const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor");
+        if (metadata.ctl || paths.has("synopkgland-api.json")) {
+            if (!metadata.ctl ||
+                !paths.has("synopkgland-api.json") ||
+                [...paths].some((path) => path.startsWith("ui/") && path.endsWith("synopkgland-api.json")))
+                findings.push("CTL_DESCRIPTOR_LAYOUT_INVALID API description must be private and match its build record.");
+            else {
+                const apiDir = join(dir, "api-description-inspection");
+                mkdirSync(apiDir);
+                await tar.x({
+                    file: join(dir, "package.tgz"),
+                    cwd: apiDir,
+                    filter: (path) => path.replace(/^\.\//, "") === "synopkgland-api.json",
+                });
+                findings.push(...inspectApiDescription(readFileSync(join(apiDir, "synopkgland-api.json"), "utf8"), { id: info.package, version: info.version }, metadata.ctl.hash, metadata.ctl.registry));
+            }
+        }
+        const bridge = compiledKind && kind !== "native-go"
+            ? await checkBridgeApp(dir, metadata.backend, info, payload, findings)
+            : undefined;
+        const hasExecutor = (metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor");
         if (standalone && portal && !hasExecutor)
             findings.push("PORTAL_REQUIRES_EXECUTOR portal needs the executor level (rootOps or delegate): after uninstall only a root purge can stop nginx serving the alias");
-        const daemon = standalone ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined) : undefined;
+        const daemon = standalone
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined)
+            : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go");
         let executor;
-        if ((metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor")) {
+        if ((metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") ||
+            paths.has("executor/executor")) {
             const executorDir = join(dir, "executor-inspection");
             mkdirSync(executorDir);
             await tar.x({ file: join(dir, "package.tgz"), cwd: executorDir });
@@ -119,38 +205,60 @@ export async function inspectSpk(spkPath, expectedKind) {
             executor = inspected.executor;
             if (executor)
                 findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
-            if (executor?.policy.portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
+            if (executor?.policy.portal &&
+                info.os_min_ver &&
+                OS_MIN_VER.test(info.os_min_ver) &&
+                !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
                 findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_EXECUTOR_MIN_DSM} the executor needs to register a portal`);
             }
-            if (executor && executor.policy.purge !== uninstallHook?.uninstall.purge.root)
+            if (executor &&
+                executor.policy.purge !== uninstallHook?.uninstall.purge.root)
                 findings.push(`UNINSTALL_ROOT_POLICY_MISMATCH the executor policy purge "${executor.policy.purge ?? ""}" differs from uninstall.purge.root "${uninstallHook?.uninstall.purge.root ?? ""}".`);
-            if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
+            if (payload.find((p) => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
-            if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
+            if (payload.find((p) => p.path === "executor/lifecycle")?.mode !== "0755")
                 findings.push("Executor lifecycle helper must be executable.");
-            if (![...paths].some(path => path.startsWith("daemon/"))) {
-                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) }, ...(uninstallHook ? { uninstall: uninstallHook.uninstall } : {}) };
+            if (![...paths].some((path) => path.startsWith("daemon/"))) {
+                const lifecycleManifest = {
+                    package: info.package,
+                    capabilities: {
+                        rootOps: true,
+                        ...(background ? { jobs: { worker: "sha256-v1" } } : {}),
+                    },
+                    ...(uninstallHook ? { uninstall: uninstallHook.uninstall } : {}),
+                };
                 for (const hook of ["preuninst", "preupgrade", "start-stop-status"]) {
-                    if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, lifecycleManifest))
+                    if (readOptional(join(dir, "scripts", hook)) !==
+                        renderStandaloneScript(hook, lifecycleManifest))
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal), ...uninstallWizardOptions(uninstallHook) }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", {
+                executor: true,
+                portal: Boolean(portal),
+                portalEntry: Boolean(executor?.policy.portal),
+                ...uninstallWizardOptions(uninstallHook),
+            }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
         }
         if (bridge)
             checkBridgeExecutor(bridge, executor, findings);
-        if (background && daemon && (executor?.policy.lifetime !== 'until-revoked' || !metadata.capabilities?.includes('delegate'))) {
-            findings.push('daemon/background combination requires an explicitly pinned until-revoked delegate policy.');
+        if (background &&
+            daemon &&
+            (executor?.policy.lifetime !== "until-revoked" ||
+                !metadata.capabilities?.includes("delegate"))) {
+            findings.push("daemon/background combination requires an explicitly pinned until-revoked delegate policy.");
         }
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
         const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings);
-        const loginStyle = standalone ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings) : undefined;
+        const loginStyle = standalone
+            ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
+            : undefined;
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal, hasExecutor);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -164,12 +272,29 @@ export async function inspectSpk(spkPath, expectedKind) {
             ...(launch ? { launch } : {}),
             icon,
             ...(executor ? { executor } : {}),
-            ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
-            ...(executor?.policy.portal ? { portal: { appId: executor.policy.app, alias: executor.policy.portal.alias } } : {}),
+            ...(portal
+                ? { portal: { appId: portal.appId, alias: portal.alias } }
+                : {}),
+            ...(executor?.policy.portal
+                ? {
+                    portal: {
+                        appId: executor.policy.app,
+                        alias: executor.policy.portal.alias,
+                    },
+                }
+                : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
             ...(appScripts.length ? { appScripts } : {}),
             ...(loginStyle ? { loginStyle } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }) } : {}),
+            ...(standalone
+                ? {
+                    uninstallCleanup: uninstallCleanup(info.package, {
+                        executor: hasExecutor,
+                        portal: Boolean(portal),
+                        portalEntry: Boolean(executor?.policy.portal),
+                    }),
+                }
+                : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,
@@ -177,7 +302,10 @@ export async function inspectSpk(spkPath, expectedKind) {
             cgi: cgiEntry?.mode === "0755" ? CGI_PAYLOAD_PATH : undefined,
             payload,
             findings,
-            capabilities: (metadata.capabilities ?? []).map(name => ({ name, requiresAdminApproval: name === "rootOps" || name === "delegate" || name === "webapi" })),
+            capabilities: (metadata.capabilities ?? []).map((name) => ({
+                name,
+                requiresAdminApproval: name === "rootOps" || name === "delegate" || name === "webapi",
+            })),
         };
     }
     finally {
@@ -190,7 +318,11 @@ const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 async function checkLaunchConfiguration(dir, info, native, declared, alias, findings) {
     const target = join(dir, "launch-inspection");
     mkdirSync(target);
-    await tar.x({ file: join(dir, "package.tgz"), cwd: target, filter: path => ["ui/config", "synology-app.yaml"].includes(path.replace(/^\.\//, "")) });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: target,
+        filter: (path) => ["ui/config", "synology-app.yaml"].includes(path.replace(/^\.\//, "")),
+    });
     let launch = declared ?? "dsm-window";
     let url;
     if (!native) {
@@ -213,24 +345,42 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
         try {
             const resource = JSON.parse(readFileSync(join(dir, "conf/resource"), "utf8"));
             const portals = resource.webservice?.portals ?? [];
-            if (usesAuthGateway(contract) ? portals.length > 0 : portals.some((p) => p.app !== (launch === "dsm-window" ? info.package : undefined))) {
+            if (usesAuthGateway(contract)
+                ? portals.length > 0
+                : portals.some((p) => p.app !== (launch === "dsm-window" ? info.package : undefined))) {
                 findings.push(`${LAUNCHER_PORTAL_MISMATCH} Web Station entries differ from the declared access and launch mode; rebuild with synopkgland build`);
             }
         }
-        catch { /* checkConf reports invalid resources */ }
+        catch {
+            /* checkConf reports invalid resources */
+        }
     }
     const appId = native ? `SYNO.SDS.${info.package}.Instance` : info.package;
     let launcher;
     try {
         const config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
-        launcher = Object.values(config).map((entries) => entries[appId]).find(Boolean);
+        launcher = Object.values(config)
+            .map((entries) => entries[appId])
+            .find(Boolean);
+    }
+    catch {
+        /* report the missing or malformed launcher below */
     }
-    catch { /* report the missing or malformed launcher below */ }
     const type = dsmLauncherType(launch, native);
-    if (!launcher || launcher.type !== type || info.dsmuidir !== "ui" || info.dsmappname !== appId || (native ? launcher.appWindow !== `SYNO.SDS.${info.package}.MainWindow` : launcher.url !== url || info.adminurl !== url)) {
+    if (!launcher ||
+        launcher.type !== type ||
+        info.dsmuidir !== "ui" ||
+        info.dsmappname !== appId ||
+        (native
+            ? launcher.appWindow !== `SYNO.SDS.${info.package}.MainWindow`
+            : launcher.url !== url || info.adminurl !== url)) {
         findings.push(`${LAUNCHER_TYPE_MISMATCH} ${launch} requires a ${type} launcher at ${appId} and matching INFO entry; rebuild with synopkgland build`);
     }
-    if (launcher && (launcher.defaultAlias !== alias || (!alias && (launcher.loginStyle !== undefined || launcher.loginIcon !== undefined)))) {
+    if (launcher &&
+        (launcher.defaultAlias !== alias ||
+            (!alias &&
+                (launcher.loginStyle !== undefined ||
+                    launcher.loginIcon !== undefined)))) {
         findings.push(`${LAUNCHER_PORTAL_MISMATCH} defaultAlias and login fields require an explicit matching portal declaration; remove them or opt in to portal and rebuild`);
     }
     return launch;
@@ -239,20 +389,32 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
 async function checkEntryLauncher(dir, pkg, entry, findings) {
     const target = join(dir, "entry-inspection");
     mkdirSync(target);
-    await tar.x({ file: join(dir, "package.tgz"), cwd: target, filter: path => path.replace(/^\.\//, "") === "ui/config" });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: target,
+        filter: (path) => path.replace(/^\.\//, "") === "ui/config",
+    });
     let launcher;
     try {
         const config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
         launcher = Object.values(config)[0]?.[`SYNO.SDS.${pkg}.Instance`];
     }
-    catch { /* reported below */ }
+    catch {
+        /* reported below */
+    }
     const expected = entryLauncherAccess(entry);
     const fields = ["allUsers", "grantPrivilege", "advanceGrantPrivilege"];
-    if (!launcher || fields.some(field => launcher[field] !== expected[field])) {
+    if (!launcher ||
+        fields.some((field) => launcher[field] !== expected[field])) {
         findings.push(`ENTRY_LAUNCHER_MISMATCH sdk-package.json declares entry: ${entry}, but the ui/config launcher is not ${JSON.stringify(expected)}; regenerate it with synopkgland build`);
     }
 }
-const LOGIN_STYLE_FILES = ["defaultLoginWallpaper", "defaultLoginWallpaperThumbnail", "loginPreviewThumbnailMaskPath", "titleImgPath"];
+const LOGIN_STYLE_FILES = [
+    "defaultLoginWallpaper",
+    "defaultLoginWallpaperThumbnail",
+    "loginPreviewThumbnailMaskPath",
+    "titleImgPath",
+];
 /**
  * The launcher's loginStyle and the ui/ files it names, at 1x and 2x. A portal
  * App without one shows a blank Control Panel > Login Portal thumbnail.
@@ -260,13 +422,19 @@ const LOGIN_STYLE_FILES = ["defaultLoginWallpaper", "defaultLoginWallpaperThumbn
 async function inspectLoginStyle(dir, pkg, portal, findings) {
     const target = join(dir, "login-style-inspection");
     mkdirSync(target);
-    await tar.x({ file: join(dir, "package.tgz"), cwd: target, filter: path => path.replace(/^\.\//, "").startsWith("ui/") });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: target,
+        filter: (path) => path.replace(/^\.\//, "").startsWith("ui/"),
+    });
     let launcher;
     try {
         const config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
         launcher = Object.values(config)[0]?.[`SYNO.SDS.${pkg}.Instance`];
     }
-    catch { /* reported by the other checks */ }
+    catch {
+        /* reported by the other checks */
+    }
     const style = launcher?.loginStyle;
     if (typeof style !== "object" || style === null) {
         if (portal)
@@ -278,9 +446,12 @@ async function inspectLoginStyle(dir, pkg, portal, findings) {
         const path = fields[field];
         if (path === undefined)
             return undefined;
-        const files = typeof path === "string" && !path.split("/").includes("..") && !path.startsWith("/")
-            ? ["1x", "2x"].map(scale => join(target, "ui", path.replace("{0}", scale))) : [];
-        if (!files.length || !files.every(file => existsSync(file))) {
+        const files = typeof path === "string" &&
+            !path.split("/").includes("..") &&
+            !path.startsWith("/")
+            ? ["1x", "2x"].map((scale) => join(target, "ui", path.replace("{0}", scale)))
+            : [];
+        if (!files.length || !files.every((file) => existsSync(file))) {
             findings.push(`LOGIN_STYLE_FILE_MISSING ui/config loginStyle.${field} names ui/${String(path)}, which the payload does not carry`);
             return undefined;
         }
@@ -289,13 +460,22 @@ async function inspectLoginStyle(dir, pkg, portal, findings) {
     const [wallpaper] = LOGIN_STYLE_FILES.map(read);
     return {
         color: String(fields.mainColor ?? ""),
-        wallpaper: wallpaper && isDefaultLoginAsset("wallpaper.jpg", wallpaper) ? "default" : "custom",
-        title: fields.titleImgPath !== undefined ? "custom" : launcher.loginIcon !== undefined ? "app-icon" : "none",
+        wallpaper: wallpaper && isDefaultLoginAsset("wallpaper.jpg", wallpaper)
+            ? "default"
+            : "custom",
+        title: fields.titleImgPath !== undefined
+            ? "custom"
+            : launcher.loginIcon !== undefined
+                ? "app-icon"
+                : "none",
     };
 }
 /** Package Center shows PACKAGE_ICON at 64 and 256 px; the package source refuses a release whose icon is over 256 KiB. */
 function inspectPackageIcons(dir, findings) {
-    for (const [name, size] of [["PACKAGE_ICON.PNG", 64], ["PACKAGE_ICON_256.PNG", 256]]) {
+    for (const [name, size] of [
+        ["PACKAGE_ICON.PNG", 64],
+        ["PACKAGE_ICON_256.PNG", 256],
+    ]) {
         const bytes = readOptionalBytes(join(dir, name));
         if (!bytes)
             continue;
@@ -317,7 +497,10 @@ function inspectPackageIcons(dir, findings) {
         return { source: "none" };
     return big.equals(defaultPackageIcons().packageIcon256)
         ? { source: "default" }
-        : { source: "custom", sha256: createHash("sha256").update(big).digest("hex") };
+        : {
+            source: "custom",
+            sha256: createHash("sha256").update(big).digest("hex"),
+        };
 }
 function readOptionalBytes(path) {
     return existsSync(path) ? readFileSync(path) : undefined;
@@ -328,16 +511,18 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
     if (info.os_min_ver && !OS_MIN_VER.test(info.os_min_ver)) {
         findings.push(`INFO os_min_ver "${info.os_min_ver}" is not the DSM 7 <version>-<build> (for example 7.1-42661)`);
     }
-    else if (kind === "container" && info.os_min_ver && !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)) {
+    else if (kind === "container" &&
+        info.os_min_ver &&
+        !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)) {
         findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${CONTAINER_MIN_DSM} a container App needs; docker-project/Container Manager starts at DSM 7.2.1, so on an earlier DSM it installs but cannot start`);
     }
     const tokens = (info.arch ?? "").split(" ").filter(Boolean);
     if (tokens.length === 0 || tokens.includes("noarch"))
         return;
-    for (const token of tokens.filter(token => !familyOfArchToken(token))) {
+    for (const token of tokens.filter((token) => !familyOfArchToken(token))) {
         findings.push(`INFO arch contains an unknown platform "${token}"`);
     }
-    const families = new Set(tokens.map(familyOfArchToken).filter(family => family !== undefined));
+    const families = new Set(tokens.map(familyOfArchToken).filter((family) => family !== undefined));
     if (families.size > 1) {
         findings.push(`INFO arch mixes several architectures (${[...families].join(", ")}); an SPK contains binaries for one architecture only`);
     }
@@ -347,31 +532,224 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
     const cgi = join(dir, "cgi-inspection");
     mkdirSync(cgi);
     // Only the header is read; the CGI is never run.
-    await tar.x({ file: join(dir, "package.tgz"), cwd: cgi, filter: path => path.replace(/^\.\//, "") === CGI_PAYLOAD_PATH });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: cgi,
+        filter: (path) => path.replace(/^\.\//, "") === CGI_PAYLOAD_PATH,
+    });
     const header = readFileSync(join(cgi, CGI_PAYLOAD_PATH)).subarray(0, 20);
-    const machine = header.length === 20 && header.toString("latin1", 0, 4) === "\x7fELF" ? header.readUInt16LE(18) : undefined;
-    const actual = NATIVE_ARCH_FAMILIES.find(family => ELF_MACHINE[family] === machine);
+    const machine = header.length === 20 && header.toString("latin1", 0, 4) === "\x7fELF"
+        ? header.readUInt16LE(18)
+        : undefined;
+    const actual = NATIVE_ARCH_FAMILIES.find((family) => ELF_MACHINE[family] === machine);
     if (actual && actual !== declared) {
         findings.push(`INFO arch declares ${declared}, but ${CGI_PAYLOAD_PATH} is a ${actual} executable`);
     }
 }
+/** Replay the SDK planner over archived source bytes, not merely a mutable lock. */
+async function inspectUnifiedCompose(dir, payload, metadata, findings) {
+    const info = readInfo(join(dir, "INFO"), findings, "binary", true);
+    const base = {
+        kind: "container",
+        package: info.package,
+        version: info.version,
+        arch: info.arch,
+        signed: existsSync(join(dir, "syno_signature.asc")),
+        payload,
+        findings,
+        launch: metadata.launch,
+        capabilities: (metadata.capabilities ?? []).map((name) => ({
+            name,
+            requiresAdminApproval: true,
+        })),
+    };
+    const root = join(dir, "unified-compose-inspection");
+    mkdirSync(root);
+    await tar.x({ file: join(dir, "package.tgz"), cwd: root });
+    try {
+        if (metadata.capabilities?.some((c) => c !== "composeMounts"))
+            throw new Error("Compose cannot claim an undeclared executor capability");
+        const declaration = metadata.compose;
+        const saved = JSON.parse(readFileSync(join(root, "compose/request.json"), "utf8"));
+        if (!isDeepStrictEqual(saved, declaration))
+            throw new Error("Compose request inventory differs from the payload");
+        const gateway = readOptional(join(root, "sso/gateway.json"));
+        const cfg = gateway ? JSON.parse(gateway) : undefined;
+        const arch = info.arch.split(/\s+/).map(familyOfArchToken).find(Boolean) ?? "x86_64";
+        const { helpers: _, ...raw } = saved.declaration;
+        const c = readComposeApp(raw, join(root, "compose/upstream"), [arch], (e) => {
+            throw new Error(`[${e.code}] ${e.message}`);
+        }, {
+            package: info.package,
+            sdk: saved.sdk,
+            mode: cfg?.mode ?? "none",
+            composeMounts: metadata.capabilities?.includes("composeMounts"),
+            architecture: arch,
+            imageProofs: JSON.parse(readFileSync(join(root, "compose/images.json"), "utf8")),
+        });
+        if (!c)
+            throw new Error("missing Compose plan");
+        if (c.plan.images.some((i) => !i.pinned || !c.plan.image_proofs?.[i.source]))
+            throw new Error("COMPOSE_IMAGE_LOCK_INVALID every service needs verified immutable image metadata");
+        if (composeSource(c) !==
+            readFileSync(join(root, "compose/docker-compose.yml"), "utf8"))
+            throw new Error("worker Compose differs from the SDK plan");
+        if (c.plan.override !==
+            readFileSync(join(root, "compose/generated.override.yaml"), "utf8"))
+            throw new Error("generated override differs from the SDK plan");
+        if (JSON.stringify(c.plan.lock) !==
+            JSON.stringify(JSON.parse(readFileSync(join(root, "compose/compose.lock.json"), "utf8"))))
+            throw new Error("source/image/policy lock differs from the SDK plan");
+        c.targets = {};
+        const g = saved.gateway
+            ? readIdentityGateway(saved.gateway, { targets: { [arch]: join(root, "daemon/payload") } }, (e) => {
+                throw new Error(e.message);
+            }, true)
+            : undefined;
+        // The complete gateway declaration is retained separately so native argv
+        // adapters are inspected against their actual packaged payload.
+        const manifest = {
+            root,
+            package: info.package,
+            version: info.version,
+            spkVersion: info.version,
+            displayname: info.displayname,
+            description: info.description,
+            maintainer: info.maintainer,
+            os_min_ver: info.os_min_ver,
+            build: Number(info.version?.split("-").pop()),
+            arches: [arch],
+            backend: { kind: "binary", files: {} },
+            ui: { dir: root, launch: metadata.launch },
+            capabilities: {
+                ...(metadata.capabilities?.includes("composeMounts")
+                    ? { composeMounts: true }
+                    : {}),
+            },
+            compose: c,
+            ...(g ? { identityGateway: g } : {}),
+            ...(metadata.entry ? { entry: metadata.entry } : {}),
+        };
+        if (Boolean(c.web) !== Boolean(g))
+            throw new Error("Web ingress must have a complete identity gateway");
+        if (gateway && gateway !== identityGatewayConfig(manifest))
+            throw new Error("gateway configuration differs from the declared package contract");
+        if (readOptional(join(dir, "conf/privilege")) !== renderNativePrivilege())
+            throw new Error("Compose hooks must run as the package account");
+        const resource = renderStandaloneResource(manifest);
+        if (readOptional(join(dir, "conf/resource")) !== resource)
+            throw new Error("unexpected worker resource; unapproved Shares must never auto-acquire");
+        if (readdirSync(join(dir, "conf")).some((n) => !["privilege", ...(resource ? ["resource"] : [])].includes(n)))
+            throw new Error("unexpected Compose resource");
+        if (readOptional(join(root, "ui/config")) !== renderUiConfig(manifest))
+            throw new Error("LAUNCHER_TYPE_MISMATCH classless Compose must use the shared url launcher");
+        if (g &&
+            (cfg.package !== info.package ||
+                info.adminurl !== `/webman/3rdparty/${info.package}/sso/open.cgi`))
+            throw new Error("gateway entry mismatch");
+        const appScripts = unwrapAppScripts(join(dir, "scripts"), findings);
+        manifest.appScripts = undefined;
+        for (const hook of [
+            "preinst",
+            "postinst",
+            "preuninst",
+            "postuninst",
+            "preupgrade",
+            "postupgrade",
+            "start-stop-status",
+        ])
+            if (readOptional(join(dir, "scripts", hook)) !==
+                renderStandaloneScript(hook, manifest))
+                throw new Error(`unexpected scripts/${hook}`);
+        if (appScripts.length)
+            base.appScripts = appScripts;
+        const materializer = checkCgiBinary(root, join(root, "compose/control"), arch);
+        if (materializer)
+            throw new Error(materializer.message);
+        if (payload.find((p) => p.path === "compose/control")?.mode !== "0755")
+            throw new Error("Compose materializer must be executable");
+        const binaries = [
+            "daemon/control",
+            "daemon/payload/_sso/gateway",
+            "ui/sso/authorize.cgi",
+            "ui/sso/open.cgi",
+        ];
+        for (const path of g ? binaries : []) {
+            const problem = checkCgiBinary(root, join(root, path), arch);
+            if (problem)
+                throw new Error(problem.message);
+            if (payload.find((p) => p.path === path)?.mode !== "0755")
+                throw new Error(`${path} must be executable`);
+        }
+        if (g &&
+            readOptional(join(root, "daemon/config.json")) !== daemonConfig(manifest))
+            throw new Error("daemon configuration differs from the SDK profile");
+        if (!isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM))
+            throw new Error("Compose requires DSM >= 7.2.1");
+        const storageProblem = dsmComposeProblem(c);
+        if (storageProblem)
+            throw new Error(`[${storageProblem.code}] ${storageProblem.message}`);
+        base.compose = {
+            ...(c.plan.ingress ? { ingress: c.plan.ingress } : {}),
+            images: c.plan.images,
+            services: c.plan.services,
+            mountsBlocked: c.plan.mounts_blocked,
+            acceptanceBlockers: c.plan.acceptance_blockers,
+            readiness: {
+                profile: c.plan.mounts_blocked
+                    ? "disabled"
+                    : !c.web
+                        ? "none"
+                        : c.plan.services.find((s) => s.service === c.web?.service)
+                            ?.network === "host"
+                            ? "host-uid-listener"
+                            : "health-fixed-ip-lifecycle",
+                limitation: COMPOSE_READINESS_LIMITATION,
+            },
+        };
+    }
+    catch (e) {
+        findings.push(`COMPOSE_ARTIFACT_INVALID ${e.message}`);
+    }
+    return base;
+}
 async function recoverCompose(dir, value, findings) {
     try {
-        if (!value || typeof value !== 'object' || Object.keys(value).join() !== 'services')
-            throw new Error('invalid compose inventory');
-        const root = join(dir, 'compose-inspection');
+        if (!value ||
+            typeof value !== "object" ||
+            Object.keys(value).join() !== "services")
+            throw new Error("invalid compose inventory");
+        const root = join(dir, "compose-inspection");
         mkdirSync(root);
-        await tar.x({ file: join(dir, 'package.tgz'), cwd: root, filter: p => ['compose/docker-compose.yml', 'sso/gateway.json'].includes(p.replace(/^\.\//, '')) });
-        const compose = readComposeApp({ file: 'compose/docker-compose.yml', targets: { x86_64: 'daemon/payload' }, services: value.services }, root, ['x86_64'], e => { throw new Error(e.message); });
+        await tar.x({
+            file: join(dir, "package.tgz"),
+            cwd: root,
+            filter: (p) => ["compose/docker-compose.yml", "sso/gateway.json"].includes(p.replace(/^\.\//, "")),
+        });
+        const compose = readComposeApp({
+            file: "compose/docker-compose.yml",
+            targets: { x86_64: "daemon/payload" },
+            services: value.services,
+        }, root, ["x86_64"], (e) => {
+            throw new Error(e.message);
+        });
         if (!compose)
-            throw new Error('invalid compose');
-        const config = JSON.parse(readFileSync(join(root, 'sso/gateway.json'), 'utf8'));
+            throw new Error("invalid compose");
+        const config = JSON.parse(readFileSync(join(root, "sso/gateway.json"), "utf8"));
         const upstream = /^http:\/\/127\.0\.0\.1:(\d+)$/.exec(config.upstream)?.[1];
         const listen = config.listen;
-        if (!upstream || !Object.values(compose.services).some(s => s.port === Number(upstream)) || !listen || !Object.keys(listen).length || Object.entries(listen).some(([key, port]) => !['http', 'https'].includes(key) || !Number.isInteger(port) || Number(port) < 1024 || Number(port) > 65535 || Object.values(compose.services).some(s => s.port === port)))
-            throw new Error('invalid gateway network');
-        if (config.package !== readInfo(join(dir, 'INFO'), [], 'container').package)
-            throw new Error('gateway package mismatch');
+        if (!upstream ||
+            !Object.values(compose.services).some((s) => s.port === Number(upstream)) ||
+            !listen ||
+            !Object.keys(listen).length ||
+            Object.entries(listen).some(([key, port]) => !["http", "https"].includes(key) ||
+                !Number.isInteger(port) ||
+                Number(port) < 1024 ||
+                Number(port) > 65535 ||
+                Object.values(compose.services).some((s) => s.port === port)))
+            throw new Error("invalid gateway network");
+        if (config.package !== readInfo(join(dir, "INFO"), [], "container").package)
+            throw new Error("gateway package mismatch");
         return { compose, identityGateway: { listen } };
     }
     catch (e) {
@@ -380,37 +758,80 @@ async function recoverCompose(dir, value, findings) {
     }
 }
 async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined) {
-    if (![...paths].some(path => path.startsWith("daemon/")))
+    if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
-        findings.push("daemon INFO must explicitly set precheckstartstop=\"yes\"");
-    if (payload.find(p => p.path === "daemon/control")?.mode !== "0755")
+        findings.push('daemon INFO must explicitly set precheckstartstop="yes"');
+    if (payload.find((p) => p.path === "daemon/control")?.mode !== "0755")
         findings.push("daemon/control is missing or not executable");
     const unpacked = join(dir, "daemon-inspection");
     // Extract only the bounded config; the payload executable is never run.
     const { mkdirSync } = await import("node:fs");
     mkdirSync(unpacked);
-    await tar.x({ file: join(dir, "package.tgz"), cwd: unpacked, filter: path => path.replace(/^\.\//, "") === "daemon/config.json" });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: unpacked,
+        filter: (path) => path.replace(/^\.\//, "") === "daemon/config.json",
+    });
     try {
         const config = JSON.parse(readFileSync(join(unpacked, "daemon/config.json"), "utf8"));
-        if (config.package !== info.package || Object.keys(config).some(key => !["package", "exec", "args", "env", "timeouts", "uninstall_args", ...(combined ? ["network"] : [])].includes(key)))
+        if (config.package !== info.package ||
+            Object.keys(config).some((key) => ![
+                "package",
+                "exec",
+                "args",
+                "env",
+                "timeouts",
+                "uninstall_args",
+                ...(combined ? ["network"] : []),
+            ].includes(key)))
             throw new Error("package/config mismatch");
-        const daemon = readDaemon({ exec: config.exec, args: config.args, uninstall_args: config.uninstall_args, env: config.env, timeouts: config.timeouts, targets: { x86_64: "payload" } }, dir, ["x86_64"], () => { });
+        const daemon = readDaemon({
+            exec: config.exec,
+            args: config.args,
+            uninstall_args: config.uninstall_args,
+            env: config.env,
+            timeouts: config.timeouts,
+            targets: { x86_64: "payload" },
+        }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
-        if (combined && (daemon.exec !== "_sso/gateway" || JSON.stringify(daemon.args) !== '["run"]' || daemon.uninstall_args))
+        if (combined &&
+            (daemon.exec !== "_sso/gateway" ||
+                JSON.stringify(daemon.args) !== '["run"]' ||
+                daemon.uninstall_args))
             throw new Error("compose gateway must run without a child");
-        if (payload.find(p => p.path === `daemon/payload/${daemon.exec}`)?.mode !== "0755")
+        if (payload.find((p) => p.path === `daemon/payload/${daemon.exec}`)?.mode !==
+            "0755")
             throw new Error("missing executable");
-        const manifest = { package: info.package, daemon, ...combined, capabilities: { ...(executor ? { rootOps: true } : {}), ...(background ? { jobs: { worker: 'sha256-v1' } } : {}) } };
+        const manifest = {
+            package: info.package,
+            daemon,
+            ...combined,
+            capabilities: {
+                ...(executor ? { rootOps: true } : {}),
+                ...(background ? { jobs: { worker: "sha256-v1" } } : {}),
+            },
+        };
         // A config from before timeouts.uninstall pairs with a control that rejects the key.
-        const legacy = typeof config.timeouts === "object" && config.timeouts !== null && !("uninstall" in config.timeouts);
+        const legacy = typeof config.timeouts === "object" &&
+            config.timeouts !== null &&
+            !("uninstall" in config.timeouts);
         const { uninstall: _, ...legacyTimeouts } = daemon.timeouts;
-        const canonical = daemonConfig(legacy ? { ...manifest, daemon: { ...daemon, timeouts: legacyTimeouts } } : manifest);
+        const canonical = daemonConfig(legacy
+            ? {
+                ...manifest,
+                daemon: {
+                    ...daemon,
+                    timeouts: legacyTimeouts,
+                },
+            }
+            : manifest);
         if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== canonical)
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
-            if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
+            if (readFileSync(join(dir, "scripts", hook), "utf8") !==
+                renderStandaloneScript(hook, manifest))
                 findings.push(`daemon scripts/${hook} does not match the fixed lifecycle`);
         }
         return daemon;
@@ -436,12 +857,21 @@ function readInfo(path, findings, kind, compose = false) {
             findings.push(`INFO is missing ${key}`);
         }
     }
-    if (kind !== "container" && (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
-        findings.push("INFO must have thirdparty=\"yes\" and dsmuidir=\"ui\" for DSM to serve /webman/3rdparty/<package>/");
+    if (kind !== "container" &&
+        (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
+        findings.push('INFO must have thirdparty="yes" and dsmuidir="ui" for DSM to serve /webman/3rdparty/<package>/');
     }
     // A container needs Container Manager (and Web Station for a portal); a Node App the Node.js it runs on.
-    const allowed = compose ? /^ContainerManager$/ : kind === "container" ? /^(WebStation|ContainerManager)([><=].*)?$/ : kind === "native-node" ? /^Node\.js_v[0-9]{2}([><=].*)?$/ : undefined;
-    if (info.install_dep_packages && !(allowed && info.install_dep_packages.split(":").every(dep => allowed.test(dep)))) {
+    const allowed = compose
+        ? undefined
+        : kind === "container"
+            ? /^(WebStation|ContainerManager)([><=].*)?$/
+            : kind === "native-node"
+                ? /^Node\.js_v[0-9]{2}([><=].*)?$/
+                : undefined;
+    if (info.install_dep_packages &&
+        !(allowed &&
+            info.install_dep_packages.split(":").every((dep) => allowed.test(dep)))) {
         findings.push(`INFO depends on other packages: ${info.install_dep_packages}`);
     }
     return info;
@@ -450,9 +880,15 @@ function readInfo(path, findings, kind, compose = false) {
 async function checkContainerExposure(dir, packageTgz, findings) {
     const extracted = join(dir, "payload");
     mkdirSync(extracted);
-    await tar.x({ file: packageTgz, cwd: extracted, filter: path => path.replace(/^\.\//, "") === "compose.yaml" });
+    await tar.x({
+        file: packageTgz,
+        cwd: extracted,
+        filter: (path) => path.replace(/^\.\//, "") === "compose.yaml",
+    });
     const compose = loadCompose(join(extracted, "compose.yaml"))?.compose;
-    for (const exposure of compose ? listPortExposures(compose).filter(e => !e.loopbackOnly) : []) {
+    for (const exposure of compose
+        ? listPortExposures(compose).filter((e) => !e.loopbackOnly)
+        : []) {
         findings.push(`CONTAINER_PORT_EXPOSED ${exposure.service}: ${exposure.entry} binds to every network interface, so it is reachable without DSM verification; bind it to 127.0.0.1`);
     }
     try {
@@ -460,7 +896,9 @@ async function checkContainerExposure(dir, packageTgz, findings) {
             findings.push("CONTAINER_ANONYMOUS_PORTAL conf/resource registers a Web Station portal that anyone can open without signing in to DSM (integration.web.access: public)");
         }
     }
-    catch { /* checkConf already reports an unreadable conf/resource */ }
+    catch {
+        /* checkConf already reports an unreadable conf/resource */
+    }
 }
 function readOptional(path) {
     return existsSync(path) ? readFileSync(path, "utf8") : undefined;
@@ -468,12 +906,25 @@ function readOptional(path) {
 function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
-    const nativeResource = kind !== "container" ? renderStandaloneResource({ package: pkg ?? "", ...(compose ? { compose } : {}), capabilities: background ? { jobs: { worker: "sha256-v1" } } : {}, ...(sharedFolder ? { sharedFolder } : {}) }, portal) : undefined;
-    if (nativeResource !== undefined && readOptional(join(confDir, "resource")) !== nativeResource) {
+    const nativeResource = kind !== "container"
+        ? renderStandaloneResource({
+            package: pkg ?? "",
+            ...(compose ? { compose } : {}),
+            capabilities: background
+                ? { jobs: { worker: "sha256-v1" } }
+                : {},
+            ...(sharedFolder ? { sharedFolder } : {}),
+        }, portal)
+        : undefined;
+    if (nativeResource !== undefined &&
+        readOptional(join(confDir, "resource")) !== nativeResource) {
         findings.push(`conf/resource must be ${nativeResource} (only the official data-share, systemd-user-unit and web-config, and consistent with the install.sharedFolder and portal declarations)`);
     }
     for (const name of entries) {
-        if (name !== "privilege" && !(kind === "container" && name === "resource") && !(nativeResource !== undefined && name === "resource") && !(background && name === "systemd")) {
+        if (name !== "privilege" &&
+            !(kind === "container" && name === "resource") &&
+            !(nativeResource !== undefined && name === "resource") &&
+            !(background && name === "systemd")) {
             findings.push(`conf/${name} registers an extra resource with DSM; a Standalone Package does not produce it`);
         }
     }
@@ -505,7 +956,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
     }
     const defaults = privilege.defaults;
     if (defaults?.["run-as"] !== "package") {
-        findings.push("conf/privilege defaults.run-as must be \"package\"");
+        findings.push('conf/privilege defaults.run-as must be "package"');
     }
     for (const key of ["tool", "ctrl-script", "executable", "join-groupname"]) {
         if (key in privilege) {
@@ -518,17 +969,32 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
     const pkg = info.package;
     if (!pkg)
         return;
-    const read = (path) => existsSync(join(dir, path)) ? readFileSync(join(dir, path), "utf8") : undefined;
-    if (payload.find(p => p.path === BACKGROUND_WORKER_PAYLOAD)?.mode !== "0755")
+    const read = (path) => existsSync(join(dir, path))
+        ? readFileSync(join(dir, path), "utf8")
+        : undefined;
+    if (payload.find((p) => p.path === BACKGROUND_WORKER_PAYLOAD)?.mode !== "0755")
         findings.push(`${BACKGROUND_WORKER_PAYLOAD} is missing or not executable`);
     if (info.precheckstartstop !== "yes")
-        findings.push("background INFO must explicitly set precheckstartstop=\"yes\" (prestart recovers the package user manager that lost its socket)");
-    const units = existsSync(join(dir, BACKGROUND_UNIT_DIR)) ? readdirSync(join(dir, BACKGROUND_UNIT_DIR)) : [];
+        findings.push('background INFO must explicitly set precheckstartstop="yes" (prestart recovers the package user manager that lost its socket)');
+    const units = existsSync(join(dir, BACKGROUND_UNIT_DIR))
+        ? readdirSync(join(dir, BACKGROUND_UNIT_DIR))
+        : [];
     const unit = backgroundUnitName(pkg);
-    if (units.length !== 1 || units[0] !== unit || read(`${BACKGROUND_UNIT_DIR}/${unit}`) !== renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [])) {
+    if (units.length !== 1 ||
+        units[0] !== unit ||
+        read(`${BACKGROUND_UNIT_DIR}/${unit}`) !==
+            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [])) {
         findings.push(`${BACKGROUND_UNIT_DIR} must contain only the fixed ${unit} (runs as the package account, no User=, no root)`);
     }
-    if (read("scripts/start-stop-status") !== renderStandaloneScript("start-stop-status", { package: pkg, ...(daemon ? { daemon } : {}), capabilities: { jobs: { worker: "sha256-v1" }, ...(executor ? { rootOps: true } : {}) } }))
+    if (read("scripts/start-stop-status") !==
+        renderStandaloneScript("start-stop-status", {
+            package: pkg,
+            ...(daemon ? { daemon } : {}),
+            capabilities: {
+                jobs: { worker: "sha256-v1" },
+                ...(executor ? { rootOps: true } : {}),
+            },
+        }))
         findings.push("background scripts/start-stop-status does not match the fixed synosystemctl lifecycle");
 }
 /**
@@ -539,42 +1005,77 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
  */
 function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
-    const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : []).filter(name => /^(install|upgrade)_uifile(_|\.|$)/.test(name)).sort();
+    const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : [])
+        .filter((name) => /^(install|upgrade)_uifile(_|\.|$)/.test(name))
+        .sort();
     const postinst = readOptional(join(dir, "scripts/postinst"));
     if (!folder && postinst?.includes(SHARED_FOLDER_MARKER))
         findings.push("the install.sharedFolder declaration in scripts/postinst is invalid");
     if (!pkg)
         return;
     const wizards = expectedWizardFiles(pkg, folder, selected, portal);
-    const source = selected ? "the install-selected policy" : folder ? "the install.sharedFolder declaration" : portal ? "the portal declaration" : "the native-go default install wizard";
+    const source = selected
+        ? "the install-selected policy"
+        : folder
+            ? "the install.sharedFolder declaration"
+            : portal
+                ? "the portal declaration"
+                : "the native-go default install wizard";
     // The default native wizard is optional; a declared shared folder or portal needs all of its files.
-    for (const name of folder || selected || portal ? Object.keys(wizards) : present.filter(n => n in wizards)) {
+    for (const name of folder || selected || portal
+        ? Object.keys(wizards)
+        : present.filter((n) => n in wizards)) {
         if (readOptional(join(wizardDir, name)) !== wizards[name])
             findings.push(`WIZARD_UIFILES/${name} does not match ${source}`);
     }
-    for (const name of present.filter(n => !(n in wizards)))
+    for (const name of present.filter((n) => !(n in wizards)))
         findings.push(`WIZARD_UIFILES/${name} is not a wizard file produced by ${source}`);
     if (selected) {
-        for (const hook of ['preinst', 'postinst']) {
-            if (!readOptional(join(dir, 'scripts', hook))?.includes(renderDelegateInstallDraft(pkg, hook === 'preinst')))
+        for (const hook of ["preinst", "postinst"]) {
+            if (!readOptional(join(dir, "scripts", hook))?.includes(renderDelegateInstallDraft(pkg, hook === "preinst")))
                 findings.push(`scripts/${hook} missing install-selected draft handling`);
         }
     }
     if (!folder)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
-        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : executor ? { capabilities: { rootOps: true } } : {}), ...portalManifest(portal) })) {
+        if (readOptional(join(dir, "scripts", hook)) !==
+            renderStandaloneScript(hook, {
+                package: pkg,
+                sharedFolder: folder,
+                ...(selected
+                    ? { capabilities: { delegate: { scope: "install-selected" } } }
+                    : executor
+                        ? { capabilities: { rootOps: true } }
+                        : {}),
+                ...portalManifest(portal),
+            })) {
             findings.push(`scripts/${hook} does not match the fixed script declared by install.sharedFolder`);
         }
     }
 }
 function expectedWizardFiles(pkg, folder, selected = false, portal) {
-    const steps = selected ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(pkg, folder)(t) : [])] : folder ? sharedFolderInstallSteps(pkg, folder) : renderNativeInstallWizard;
-    const install = renderInstallWizardFiles(pkg, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
-    return { ...install.static, ...install.dynamic, ...(folder ? renderSharedFolderUpgradeWizardFiles(pkg, folder) : {}) };
+    const steps = selected
+        ? (t) => [
+            ...renderDelegateScopeSteps(t),
+            ...(folder ? sharedFolderInstallSteps(pkg, folder)(t) : []),
+        ]
+        : folder
+            ? sharedFolderInstallSteps(pkg, folder)
+            : renderNativeInstallWizard;
+    const install = renderInstallWizardFiles(pkg, portal
+        ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)]
+        : steps);
+    return {
+        ...install.static,
+        ...install.dynamic,
+        ...(folder ? renderSharedFolderUpgradeWizardFiles(pkg, folder) : {}),
+    };
 }
 function portalManifest(portal) {
-    return portal ? { displayname: portal.application, portal: { alias: portal.alias } } : {};
+    return portal
+        ? { displayname: portal.application, portal: { alias: portal.alias } }
+        : {};
 }
 /**
  * The portal declaration is recovered from the payload's etc/portal.json. Its
@@ -583,20 +1084,26 @@ function portalManifest(portal) {
  */
 async function recoverPortal(dir, info, appId, paths, payload, findings) {
     const files = [PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH];
-    if (!files.some(path => paths.has(path)))
+    if (!files.some((path) => paths.has(path)))
         return;
     const unpacked = join(dir, "portal-inspection");
     mkdirSync(unpacked);
-    await tar.x({ file: join(dir, "package.tgz"), cwd: unpacked, filter: path => files.includes(path.replace(/^\.\//, "")) });
+    await tar.x({
+        file: join(dir, "package.tgz"),
+        cwd: unpacked,
+        filter: (path) => files.includes(path.replace(/^\.\//, "")),
+    });
     try {
-        if (files.some(path => payload.find(p => p.path === path)?.mode !== "0644"))
+        if (files.some((path) => payload.find((p) => p.path === path)?.mode !== "0644"))
             throw new Error("mode");
         const json = readFileSync(join(unpacked, PORTAL_JSON_RELPATH), "utf8");
         const alias = JSON.parse(json).alias;
         if (!isPortalAlias(alias))
             throw new Error("alias");
         const portal = { appId, application: info.displayname ?? "", alias };
-        if (json !== renderPortalJson(portal) || readFileSync(join(unpacked, PORTAL_MUSTACHE_RELPATH), "utf8") !== renderPortalMustache())
+        if (json !== renderPortalJson(portal) ||
+            readFileSync(join(unpacked, PORTAL_MUSTACHE_RELPATH), "utf8") !==
+                renderPortalMustache())
             throw new Error("content");
         for (const hook of ["preinst", "postinst", "postupgrade"]) {
             if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${renderPortalLifecycle(hook, portal)}`))
@@ -632,7 +1139,10 @@ const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
 function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
-        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => keys.includes(box.key));
+        return steps
+            .flatMap((step) => step.items ?? [])
+            .flatMap((item) => item.subitems ?? [])
+            .filter((box) => keys.includes(box.key));
     }
     catch {
         return [];
@@ -649,7 +1159,16 @@ function uninstallWizardOptions(hook) {
     if (!hook)
         return {};
     const { uninstall, catalogs } = hook;
-    return { rootPurge: Boolean(uninstall.purge.root), ...(uninstall.state ? { state: { items: (locale) => stateItemTexts(uninstall, catalogs, locale) } } : {}) };
+    return {
+        rootPurge: Boolean(uninstall.purge.root),
+        ...(uninstall.state
+            ? {
+                state: {
+                    items: (locale) => stateItemTexts(uninstall, catalogs, locale),
+                },
+            }
+            : {}),
+    };
 }
 function checkUninstall(dir, findings) {
     const script = join(dir, "scripts", "postuninst");
@@ -657,20 +1176,31 @@ function checkUninstall(dir, findings) {
         return;
     const body = readFileSync(script, "utf8");
     const wizardDir = join(dir, "WIZARD_UIFILES");
-    const wizards = existsSync(wizardDir) ? readdirSync(wizardDir).filter(name => name === "uninstall_uifile" || name.startsWith("uninstall_uifile_")).sort() : [];
-    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), DATA_KEYS).map(box => ({ ...box, name })));
-    checkStateBoxes(dir, wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), [DELETE_STATE_KEY]).map(box => ({ ...box, name }))), findings);
+    const wizards = existsSync(wizardDir)
+        ? readdirSync(wizardDir)
+            .filter((name) => name === "uninstall_uifile" || name.startsWith("uninstall_uifile_"))
+            .sort()
+        : [];
+    const boxes = wizards.flatMap((name) => uninstallBoxes(join(wizardDir, name), DATA_KEYS).map((box) => ({
+        ...box,
+        name,
+    })));
+    checkStateBoxes(dir, wizards.flatMap((name) => uninstallBoxes(join(wizardDir, name), [DELETE_STATE_KEY]).map((box) => ({
+        ...box,
+        name,
+    }))), findings);
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
-            findings.push("UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without the [ \"$SYNOPKG_PKG_STATUS\" != UPGRADE ] guard, so an upgrade deletes it by mistake");
-        if (!/is_package_area\(\)\s*\{/.test(body) || !/if ! is_package_area "\$real"/.test(body))
+            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without the [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] guard, so an upgrade deletes it by mistake');
+        if (!/is_package_area\(\)\s*\{/.test(body) ||
+            !/if ! is_package_area "\$real"/.test(body))
             findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst does not verify the deleted paths are under /volumeN/@appdata|@apphome|@appconf|@appstore/<package>; an empty or redirected variable deletes the wrong data");
-        for (const line of body.split("\n").filter(l => DELETE_COMMAND.test(l))) {
+        for (const line of body.split("\n").filter((l) => DELETE_COMMAND.test(l))) {
             for (const path of line.match(/\/volume\w*\/(?!@app(data|home|conf|store)\/)[^\s"'$;]*/g) ?? [])
                 findings.push(`UNINSTALL_UNSAFE_DELETE scripts/postuninst deletes ${path}, which is not inside the package's own @app* directory`);
         }
-        if (!boxes.some(box => box.name === "uninstall_uifile"))
+        if (!boxes.some((box) => box.name === "uninstall_uifile"))
             findings.push("UNINSTALL_WIZARD_MISSING postuninst deletes data, but WIZARD_UIFILES/uninstall_uifile has no pkgwizard_remove_additional checkbox, so the user cannot choose");
     }
     for (const box of boxes) {