@synopackageland/cli 0.14.1 → 0.15.0

package/dist/standalone/manifest.js

@@ -1,40 +1,64 @@
 import { isWebLaunchMode } from "../contract/web-launch.js";
-import { validWebAPIProfiles } from '../runtime/webapi-profile.js';
+import { validWebAPIProfiles, } from "../runtime/webapi-profile.js";
 import { validateMetadata } from "../package-metadata.js";
-import { validDelegate } from "../runtime/executor-policy.js";
+import { validDelegate, } from "../runtime/executor-policy.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { parse } from "yaml";
-import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
-import { checkGlossary, loadCatalogs, readInfoTranslations } from "./i18n.js";
-import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR } from "./root-ops.js";
+import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
+import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
+import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
 import { readDaemon } from "./daemon.js";
-import { readIdentityGateway } from "./identity-gateway.js";
+import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
 import { readAppScripts } from "./app-scripts.js";
 import { readBackground } from "./background.js";
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage, } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
-import { API_PERMISSIONS_FILE, floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration } from "../portal/alias.js";
+import { API_PERMISSIONS_FILE, floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions, } from "./api-permissions.js";
+import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration, } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
-import { LOGIN_COLOR, loginImageProblem } from "../build-spk/login-style.js";
+import { LOGIN_COLOR, loginImageProblem, } from "../build-spk/login-style.js";
 import { validateReproducible } from "../reproducible-config.js";
-import { appSdkVersion, SDK_MODULE } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_MODULE, } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
 import { readWindowSize } from "./window-size.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
-import { requestTimeoutSeconds, rootRunDeadlineProblem, TIMEOUT_USAGE, validTimeoutSeconds } from "./request-timeout.js";
-import { BRIDGE_RUNTIMES, isBridgeBackend, overlaps, readBridgeBackend } from "./bridge-backend.js";
+import { requestTimeoutSeconds, rootRunDeadlineProblem, TIMEOUT_USAGE, validTimeoutSeconds, } from "./request-timeout.js";
+import { BRIDGE_RUNTIMES, isBridgeBackend, overlaps, readBridgeBackend, } from "./bridge-backend.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
  */
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 export const KNOWN_FIELDS = new Set([
-    "schema", "package", "version", "build", "displayname", "description",
-    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "identity_gateway", "compose", "install", "uninstall", "entry", "portal", "icon", "reproducible", "root", "login_style",
+    "ctl",
+    "schema",
+    "package",
+    "version",
+    "build",
+    "displayname",
+    "description",
+    "metadata",
+    "maintainer",
+    "os_min_ver",
+    "arches",
+    "backend",
+    "ui",
+    "capabilities",
+    "i18n",
+    "daemon",
+    "identity_gateway",
+    "compose",
+    "install",
+    "uninstall",
+    "entry",
+    "portal",
+    "icon",
+    "reproducible",
+    "root",
+    "login_style",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
@@ -67,7 +91,9 @@ class Collector {
         return resolved;
     }
     text(value, field) {
-        if (typeof value !== "string" || value.trim() === "" || /[\r\n"\\]/.test(value)) {
+        if (typeof value !== "string" ||
+            value.trim() === "" ||
+            /[\r\n"\\]/.test(value)) {
             return this.fail("STANDALONE_TEXT_INVALID", `${field} must be single-line, non-empty text without " or \\.`);
         }
         return value;
@@ -76,24 +102,38 @@ class Collector {
 export function loadStandaloneManifest(root) {
     const file = join(root, STANDALONE_MANIFEST);
     if (!existsSync(file)) {
-        return { ok: false, errors: [{ code: "STANDALONE_MANIFEST_MISSING", message: `${STANDALONE_MANIFEST} was not found.` }] };
+        return {
+            ok: false,
+            errors: [
+                {
+                    code: "STANDALONE_MANIFEST_MISSING",
+                    message: `${STANDALONE_MANIFEST} was not found.`,
+                },
+            ],
+        };
     }
     let raw;
     try {
         raw = parse(readFileSync(file, "utf8"));
     }
     catch (error) {
-        return { ok: false, errors: [{ code: "STANDALONE_MANIFEST_YAML", message: String(error) }] };
+        return {
+            ok: false,
+            errors: [{ code: "STANDALONE_MANIFEST_YAML", message: String(error) }],
+        };
     }
     const c = new Collector(root);
-    if (existsSync(join(root, "compose.yaml")) && !(isRecord(raw) && isRecord(raw.compose) && raw.compose.file === "compose.yaml"))
+    if (existsSync(join(root, "compose.yaml")) &&
+        !(isRecord(raw) && isRecord(raw.compose)))
         c.fail("PROJECT_RUNTIME_EXCLUSIVE", "compose.yaml and dsm-package.yaml are mutually exclusive; keep only one.");
     if (!isRecord(raw)) {
         c.fail("STANDALONE_MANIFEST_YAML", `${STANDALONE_MANIFEST} must be a YAML object.`);
         return { ok: false, errors: c.errors };
     }
     const manifest = readManifest(raw, c);
-    return manifest && c.errors.length === 0 ? { ok: true, manifest } : { ok: false, errors: c.errors };
+    return manifest && c.errors.length === 0
+        ? { ok: true, manifest }
+        : { ok: false, errors: c.errors };
 }
 function readManifest(raw, c) {
     for (const key of Object.keys(raw)) {
@@ -113,21 +153,31 @@ function readManifest(raw, c) {
         c.fail("STANDALONE_SCHEMA_INVALID", "schema: 2 is required; use schema: 2 with backend.kind: go|binary, and change privilege: root, background and fileStation to capabilities.rootOps: true, capabilities.jobs: true and capabilities.files: session respectively.");
     }
     const capabilities = readCapabilities(raw.capabilities, c);
+    if (capabilities.composeMounts && raw.compose === undefined)
+        c.fail("CAPABILITY_UNSUPPORTED", "composeMounts applies only to Compose.");
+    if (raw.compose !== undefined && raw.backend !== undefined)
+        c.fail("PROJECT_RUNTIME_EXCLUSIVE", "Compose uses the SDK gateway, not a dummy App backend; remove backend.");
     const rootOps = readRootOps(capabilities.rootOps === true, c);
-    const rootPrograms = raw.root === undefined ? undefined : readRootPrograms(raw.root, capabilities.rootOps === true, rootOps, c);
+    const rootPrograms = raw.root === undefined
+        ? undefined
+        : readRootPrograms(raw.root, capabilities.rootOps === true, rootOps, c);
     const packageId = typeof raw.package === "string" && PACKAGE_ID.test(raw.package)
         ? raw.package
         : c.fail("STANDALONE_PACKAGE_INVALID", "package must start with a letter and contain only alphanumerics (2-64 characters).");
     const version = typeof raw.version === "string" && VERSION.test(raw.version)
         ? raw.version
         : c.fail("STANDALONE_VERSION_INVALID", "version must be a numeric version such as 1.2.0 (build goes in build).");
-    const build = Number.isInteger(raw.build) && raw.build >= 1 && raw.build <= 9999
+    const build = Number.isInteger(raw.build) &&
+        raw.build >= 1 &&
+        raw.build <= 9999
         ? raw.build
         : c.fail("STANDALONE_BUILD_INVALID", "build must be an integer from 1 to 9999.");
     const osMinVer = typeof raw.os_min_ver === "string" && OS_MIN_VER.test(raw.os_min_ver)
         ? raw.os_min_ver
         : c.fail("STANDALONE_OS_MIN_VER_INVALID", "os_min_ver format is <major>.<minor>-<build>, for example 7.2-64570.");
-    if (capabilities.rootOps === true && osMinVer && !isDsmAtLeast(osMinVer, DEFAULT_MIN_DSM)) {
+    if (capabilities.rootOps === true &&
+        osMinVer &&
+        !isDsmAtLeast(osMinVer, DEFAULT_MIN_DSM)) {
         c.fail("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
     const displayname = c.text(raw.displayname, "displayname");
@@ -142,16 +192,25 @@ function readManifest(raw, c) {
             c.fail("STANDALONE_TEXT_INVALID", "The metadata fields are malformed; check the text, email, URLs and screenshots.");
         }
     const arches = readArches(raw.arches, c);
-    const binaryProblem = rootOps && arches && (raw.root === undefined || rootPrograms) ? rootBinaryProblem(rootOps, rootPrograms, arches) : undefined;
+    const binaryProblem = rootOps && arches && (raw.root === undefined || rootPrograms)
+        ? rootBinaryProblem(rootOps, rootPrograms, arches)
+        : undefined;
     if (binaryProblem)
         c.fail("STANDALONE_ROOT_PROGRAMS_INVALID", binaryProblem);
-    const backend = arches && readBackend(raw.backend, arches, c);
+    const backend = raw.compose !== undefined && raw.backend === undefined
+        ? { kind: "binary", files: {} }
+        : arches && readBackend(raw.backend, arches, c);
     if (backend && backend.kind !== "binary" && rootOps) {
         // root.run may run a program without settings (its defaults) or with run.
         // The SDK's spec/protocol/v1 Timeouts say how long the executor and its client wait.
         const timeouts = appSdkTimeouts(backend);
-        const runnable = rootOps.map(op => ({ op, setting: rootPrograms?.programs?.[op.name] })).filter(({ setting }) => !setting || setting.run)
-            .map(({ op, setting }) => ({ name: op.name, timeoutSeconds: setting?.run?.timeout_s ?? timeouts.rootRunDefaultSeconds }));
+        const runnable = rootOps
+            .map((op) => ({ op, setting: rootPrograms?.programs?.[op.name] }))
+            .filter(({ setting }) => !setting || setting.run)
+            .map(({ op, setting }) => ({
+            name: op.name,
+            timeoutSeconds: setting?.run?.timeout_s ?? timeouts.rootRunDefaultSeconds,
+        }));
         const problem = rootRunDeadlineProblem(runnable, requestTimeoutSeconds(backend), timeouts.rootRunRequestMarginSeconds);
         if (problem)
             c.fail("STANDALONE_REQUEST_TIMEOUT_SHORT", problem);
@@ -172,14 +231,52 @@ function readManifest(raw, c) {
                 c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/${API_PERMISSIONS_FILE[backend.kind]} must define the centralized API policy: ${String(error)}`);
         }
     }
-    const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
-    const compose = arches && readComposeApp(raw.compose, c.root, arches, e => c.fail(e.code, e.message));
-    if (raw.compose !== undefined && (raw.daemon !== undefined || raw.identity_gateway === undefined || Object.keys(capabilities).length || !osMinVer || !isDsmAtLeast(osMinVer, "7.2.1-69057")))
-        c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose requires identity_gateway, DSM >= 7.2.1, no daemon and no capabilities.");
-    const identityGateway = readIdentityGateway(raw.identity_gateway, daemon || (compose ? { targets: compose.targets } : undefined), e => c.fail(e.code, e.message));
-    if (compose && identityGateway && (!Object.values(compose.services).some(s => s.port === identityGateway.upstream) || Object.values(compose.services).some(s => Object.values(identityGateway.listen).includes(s.port) || s.port === identityGateway.oidc?.issuer_port)))
+    const daemon = arches &&
+        readDaemon(raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+    const gatewayRaw = isRecord(raw.identity_gateway) ? raw.identity_gateway : {};
+    const compose = arches &&
+        readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), {
+            package: packageId,
+            sdk: typeof gatewayRaw.sdk === "string" ? gatewayRaw.sdk : undefined,
+            mode: typeof gatewayRaw.mode === "string" ? gatewayRaw.mode : "none",
+            composeMounts: capabilities.composeMounts,
+        });
+    if (raw.compose !== undefined &&
+        (raw.daemon !== undefined ||
+            Object.keys(capabilities).some((k) => k !== "composeMounts") ||
+            !osMinVer ||
+            !isDsmAtLeast(osMinVer, "7.2.1-69057")))
+        c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose requires DSM >= 7.2.1, no daemon and only the explicit composeMounts capability.");
+    const gatewayValue = compose?.web
+        ? {
+            sdk: compose.sdk,
+            mode: "none",
+            listen: { http: 28000 },
+            ...gatewayRaw,
+            upstream: compose.plan.ingress?.port ??
+                compose.web.host_port ??
+                compose.web.port,
+        }
+        : raw.identity_gateway;
+    if (compose?.web && gatewayRaw.upstream !== undefined)
+        c.fail("COMPOSE_WEB_INVALID", "Compose upstream is derived from the SDK Compose ingress endpoint; remove identity_gateway.upstream.");
+    const identityGateway = readIdentityGateway(gatewayValue, daemon || (compose ? { targets: compose.targets } : undefined), (e) => c.fail(e.code, e.message), false, Boolean(compose?.plan.ingress));
+    if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
+        c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose and identity_gateway must use the same SDK release.");
+    if (compose &&
+        identityGateway?.access === "public" &&
+        (raw.entry !== undefined || compose.plan.mounts_blocked))
+        c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "public ingress cannot bypass entry controls or expose blocked Shared Folder settings.");
+    if (compose &&
+        identityGateway &&
+        (!Object.values(compose.services).some((s) => s.port === identityGateway.upstream) ||
+            (!compose.plan.ingress &&
+                Object.values(compose.services).some((s) => Object.values(identityGateway.listen).includes(s.port) ||
+                    s.port === identityGateway.oidc?.issuer_port))))
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose service ports must contain upstream and not overlap gateway or issuer ports.");
-    if (capabilities.jobs && raw.daemon !== undefined && capabilities.delegate?.lifetime !== 'until-revoked') {
+    if (capabilities.jobs &&
+        raw.daemon !== undefined &&
+        capabilities.delegate?.lifetime !== "until-revoked") {
         c.fail("CAPABILITY_COMBINATION_INVALID", "daemon can only coexist with an explicit until-revoked delegate fixed worker; plain capabilities.jobs stays mutually exclusive.");
     }
     if (backend?.kind === "binary") {
@@ -191,7 +288,10 @@ function readManifest(raw, c) {
     if (backend && isBridgeBackend(backend)) {
         // The runtime offers delegate only as the until-revoked files.moveFromStaging integration (spec/bridge/v1).
         const delegate = capabilities.delegate;
-        if (delegate && !(delegate.lifetime === "until-revoked" && delegate.operations.join() === "files.moveFromStaging" && delegate.destinations?.length)) {
+        if (delegate &&
+            !(delegate.lifetime === "until-revoked" &&
+                delegate.operations.join() === "files.moveFromStaging" &&
+                delegate.destinations?.length)) {
             c.fail("CAPABILITY_UNSUPPORTED", `For backend.runtime: ${backend.kind}, capabilities.delegate supports only operations: [files.moveFromStaging], destinations and lifetime: until-revoked.`);
         }
         if (raw.daemon !== undefined)
@@ -199,8 +299,15 @@ function readManifest(raw, c) {
         if (permissions)
             checkBridgeMethods(backend, permissions, c);
     }
-    const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
-    const entry = raw.entry === undefined ? undefined : readEntry(raw.entry, backend, permissions?.policy, c);
+    const sharedFolder = raw.install === undefined
+        ? undefined
+        : readSharedFolder(raw.install, (e) => c.fail(e.code, e.message));
+    const entry = raw.entry === undefined
+        ? undefined
+        : raw.compose !== undefined &&
+            (raw.entry === "admin-only" || raw.entry === "app-privilege")
+            ? raw.entry
+            : readEntry(raw.entry, backend, permissions?.policy, c);
     if (entry === "admin-only" && permissions) {
         const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
@@ -208,8 +315,26 @@ function readManifest(raw, c) {
         }
         permissions.policy = floored.policy;
     }
-    const ui = readUi(raw.ui, c);
-    if (backend && isBridgeBackend(backend) && ui && overlaps(backend.dir, ui.dir)) {
+    const ui = raw.compose !== undefined
+        ? {
+            dir: c.root,
+            ...(isRecord(raw.ui) && raw.ui.launch !== undefined
+                ? { launch: raw.ui.launch }
+                : {}),
+        }
+        : readUi(raw.ui, c);
+    if (raw.compose !== undefined &&
+        isRecord(raw.ui) &&
+        Object.keys(raw.ui).some((k) => k !== "launch"))
+        c.fail("STANDALONE_UI_INVALID", "Compose uses the SDK gateway; ui accepts only launch.");
+    if (raw.compose !== undefined &&
+        ui?.launch !== undefined &&
+        !isWebLaunchMode(ui.launch))
+        c.fail("STANDALONE_UI_LAUNCH_INVALID", "ui.launch must be dsm-window or new-page.");
+    if (backend &&
+        isBridgeBackend(backend) &&
+        ui &&
+        overlaps(backend.dir, ui.dir)) {
         c.fail("STANDALONE_BRIDGE_APP_IN_UI", "backend.dir and ui.dir must not overlap: DSM serves the files under ui/ directly, so the App directory (target/app) cannot be inside it.");
     }
     if (capabilities.identity && ui && !ui.build)
@@ -217,40 +342,72 @@ function readManifest(raw, c) {
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "The delegate install-selected scope can only be confirmed in a Vue panel; plain UI does not support it, use a vue UI (init --ui vue).");
     if (backend && backend.kind !== "binary") {
-        for (const problem of sdkProblems(backend, ui?.build?.cwd, isBridgeBackend(backend) || Boolean(capabilities.delegate || capabilities.rootOps || capabilities.webapi)))
+        for (const problem of sdkProblems(backend, ui?.build?.cwd, isBridgeBackend(backend) ||
+            Boolean(capabilities.delegate || capabilities.rootOps || capabilities.webapi)))
             c.fail(problem.code, problem.message);
     }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
     if (capabilities.webapi && backend) {
         const sdk = sdkVersionOrUndefined(backend);
-        if (!sdk || Number(sdk.split('.')[0]) === 0 && Number(sdk.split('.')[1]) < 11)
+        if (!sdk ||
+            (Number(sdk.split(".")[0]) === 0 && Number(sdk.split(".")[1]) < 11))
             c.fail("SDK_UNSUPPORTED", "capabilities.webapi requires SDK 0.11.0 or later; update backend and frontend together.");
-        const raw = Object.values(capabilities.webapi).some(profile => (profile.raw_max_bytes ?? 0) > 0);
-        const [major, minor, patch] = (sdk ?? '0.0.0').split('.').map(Number);
-        if (raw && (!sdk || major === 0 && (minor < 12 || minor === 12 && patch < 1)))
+        const raw = Object.values(capabilities.webapi).some((profile) => (profile.raw_max_bytes ?? 0) > 0);
+        const [major, minor, patch] = (sdk ?? "0.0.0").split(".").map(Number);
+        if (raw &&
+            (!sdk || (major === 0 && (minor < 12 || (minor === 12 && patch < 1)))))
             c.fail("SDK_UNSUPPORTED", "Raw WebAPI profiles require SDK 0.12.1 or later; update backend and frontend together.");
     }
-    const uninstall = readUninstall(raw.uninstall, { rootOps: capabilities.rootOps === true, ops: rootOps, en: i18n?.catalogs?.en }, e => c.fail(e.code, e.message));
-    const appScripts = readAppScripts(c.root, e => c.fail(e.code, e.message));
-    const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
-        ?? c.fail("STANDALONE_PORTAL_INVALID", "portal must be {} or { alias: <1-64 lowercase alphanumerics or -, not a DSM reserved path> }.");
-    if (portal && !capabilities.rootOps && !capabilities.delegate && !capabilities.webapi) {
+    const uninstall = readUninstall(raw.uninstall, {
+        rootOps: capabilities.rootOps === true,
+        ops: rootOps,
+        en: i18n?.catalogs?.en,
+    }, (e) => c.fail(e.code, e.message));
+    const appScripts = readAppScripts(c.root, (e) => c.fail(e.code, e.message));
+    const portal = raw.portal === undefined || !packageId
+        ? undefined
+        : (readPortalDeclaration(raw.portal, packageId) ??
+            c.fail("STANDALONE_PORTAL_INVALID", "portal must be {} or { alias: <1-64 lowercase alphanumerics or -, not a DSM reserved path> }."));
+    if (portal &&
+        !capabilities.rootOps &&
+        !capabilities.delegate &&
+        !capabilities.webapi) {
         c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
     }
     if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
     const entryProblem = portal && packageId && displayname && osMinVer && portalByExecutor(osMinVer)
-        ? portalEntryProblem(packageId, { application: displayname, alias: portal.alias }) : undefined;
+        ? portalEntryProblem(packageId, {
+            application: displayname,
+            alias: portal.alias,
+        })
+        : undefined;
     if (entryProblem)
         c.fail("STANDALONE_PORTAL_ENTRY_INVALID", entryProblem);
-    const loginStyle = raw.login_style === undefined ? undefined : readLoginStyle(raw.login_style, raw.portal !== undefined, c);
-    if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
-        || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
+    const loginStyle = raw.login_style === undefined
+        ? undefined
+        : readLoginStyle(raw.login_style, raw.portal !== undefined, c);
+    if (!packageId ||
+        !version ||
+        !build ||
+        !osMinVer ||
+        !displayname ||
+        !description ||
+        !maintainer ||
+        !arches ||
+        !backend ||
+        !ui ||
+        (capabilities.rootOps === true && !rootOps)) {
+        return undefined;
+    }
+    if (raw.ctl !== undefined && (!isRecord(raw.ctl) || typeof raw.ctl.enabled !== "boolean" || raw.ctl.enabled && (!raw.ctl.commands || typeof raw.ctl.commands !== "object"))) {
+        c.fail("CTL_DECLARATION_INVALID", "ctl requires enabled and explicit commands.");
         return undefined;
     }
     return {
+        ...(raw.ctl ? { ctl: raw.ctl } : {}),
         root: c.root,
         package: packageId,
         version,
@@ -263,7 +420,13 @@ function readManifest(raw, c) {
         os_min_ver: osMinVer,
         arches,
         backend,
-        ...(permissions ? { apiPermissions: permissions.policy, apiPermissionsDigest: permissions.digest, apiSDKPermissionsDigest: permissions.sdkDigest } : {}),
+        ...(permissions
+            ? {
+                apiPermissions: permissions.policy,
+                apiPermissionsDigest: permissions.digest,
+                apiSDKPermissionsDigest: permissions.sdkDigest,
+            }
+            : {}),
         ui,
         ...(i18n ? { i18n } : {}),
         capabilities,
@@ -291,14 +454,14 @@ function checkBridgeMethods(backend, permissions, c) {
  * Without methods only the SDK names of the policy can be checked.
  */
 export function bridgeMethodProblems(methods, permissions, file) {
-    const sdk = new Set(Object.values(permissions.sdk).flatMap(names => Object.keys(names)));
+    const sdk = new Set(Object.values(permissions.sdk).flatMap((names) => Object.keys(names)));
     const problems = [];
-    const taken = (methods ?? []).filter(method => sdk.has(method));
+    const taken = (methods ?? []).filter((method) => sdk.has(method));
     if (taken.length)
         problems.push(`App methods must not use an SDK method name: ${taken.join(", ")}.`);
     if (!methods)
         return problems;
-    const unlisted = Object.keys(permissions.policy.methods).filter(method => !sdk.has(method) && !methods.includes(method));
+    const unlisted = Object.keys(permissions.policy.methods).filter((method) => !sdk.has(method) && !methods.includes(method));
     if (unlisted.length)
         problems.push(`${file} sets methods the App does not have: ${unlisted.join(", ")}; the runtime refuses to start.`);
     return problems;
@@ -319,7 +482,12 @@ function readIcon(value, c) {
         return c.fail("STANDALONE_ICON_INVALID", `icon: ${error.message}`);
     }
 }
-const LOGIN_STYLE_FIELDS = ["color", "wallpaper", "wallpaper_thumbnail", "title"];
+const LOGIN_STYLE_FIELDS = [
+    "color",
+    "wallpaper",
+    "wallpaper_thumbnail",
+    "title",
+];
 /** `login_style`: a portal's colour, wallpaper (with its thumbnail) and title image, each optional. */
 function readLoginStyle(value, portal, c) {
     const invalid = (message) => c.fail("STANDALONE_LOGIN_STYLE_INVALID", message);
@@ -327,13 +495,15 @@ function readLoginStyle(value, portal, c) {
         return invalid("login_style must be a mapping with color, wallpaper, wallpaper_thumbnail or title.");
     if (!portal)
         return invalid("login_style styles the Application Portal login page; declare portal as well, or remove login_style.");
-    const unknown = Object.keys(value).filter(key => !LOGIN_STYLE_FIELDS.includes(key));
+    const unknown = Object.keys(value).filter((key) => !LOGIN_STYLE_FIELDS.includes(key));
     if (unknown.length)
         return invalid(`login_style does not accept ${unknown.join(", ")}; use ${LOGIN_STYLE_FIELDS.join(", ")}.`);
-    if (value.color !== undefined && (typeof value.color !== "string" || !LOGIN_COLOR.test(value.color))) {
+    if (value.color !== undefined &&
+        (typeof value.color !== "string" || !LOGIN_COLOR.test(value.color))) {
         return invalid('login_style.color must be a hex colour such as "#0F766E".');
     }
-    if ((value.wallpaper === undefined) !== (value.wallpaper_thumbnail === undefined)) {
+    if ((value.wallpaper === undefined) !==
+        (value.wallpaper_thumbnail === undefined)) {
         return invalid("login_style.wallpaper and login_style.wallpaper_thumbnail go together: DSM uses a package wallpaper only when both are set.");
     }
     const image = (field) => {
@@ -341,18 +511,30 @@ function readLoginStyle(value, portal, c) {
             return undefined;
         const path = c.path(value[field], `login_style.${field}`);
         const problem = path && loginImageProblem(field, path);
-        return problem ? c.fail("STANDALONE_LOGIN_STYLE_IMAGE_INVALID", `login_style.${field}: ${problem}`) : path;
+        return problem
+            ? c.fail("STANDALONE_LOGIN_STYLE_IMAGE_INVALID", `login_style.${field}: ${problem}`)
+            : path;
     };
-    const [wallpaper, thumbnail, title] = [image("wallpaper"), image("wallpaper_thumbnail"), image("title")];
+    const [wallpaper, thumbnail, title] = [
+        image("wallpaper"),
+        image("wallpaper_thumbnail"),
+        image("title"),
+    ];
     return {
         ...(value.color !== undefined ? { color: value.color } : {}),
-        ...(wallpaper && thumbnail ? { wallpaper: { image: wallpaper, thumbnail } } : {}),
+        ...(wallpaper && thumbnail
+            ? { wallpaper: { image: wallpaper, thumbnail } }
+            : {}),
         ...(title ? { title } : {}),
     };
 }
 /** Where each backend kind's CGI main wraps its authenticator in the SDK entry gate. */
 const ENTRY_GATE = {
-    go: { main: b => b.kind === "go" ? join(b.dir, b.main, "main.go") : "", call: "dsm.NewEntryGate(", sdk: `backend/go.mod must require ${SDK_MODULE}` },
+    go: {
+        main: (b) => (b.kind === "go" ? join(b.dir, b.main, "main.go") : ""),
+        call: "dsm.NewEntryGate(",
+        sdk: `backend/go.mod must require ${SDK_MODULE}`,
+    },
 };
 /** The SDK version, or none when the backend has none or pins it wrongly (reported by sdkProblems). */
 function sdkVersionOrUndefined(backend) {
@@ -377,8 +559,10 @@ function readEntry(value, backend, policy, c) {
     // A bridge App's entry gate is the runtime's (bridge.json access).
     const gate = isBridgeBackend(backend) ? undefined : ENTRY_GATE[backend.kind];
     const main = gate?.main(backend) ?? "";
-    if (!isBridgeBackend(backend) && (!gate || !sdkVersionOrUndefined(backend))
-        || gate && (!existsSync(main) || !readFileSync(main, "utf8").includes(gate.call))) {
+    if ((!isBridgeBackend(backend) &&
+        (!gate || !sdkVersionOrUndefined(backend))) ||
+        (gate &&
+            (!existsSync(main) || !readFileSync(main, "utf8").includes(gate.call)))) {
         const shown = main ? relative(c.root, main) : "the backend.main main.go";
         return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry needs the SDK entry gate: ${gate?.sdk ?? `backend/go.mod must require ${SDK_MODULE}`}, and wrap the authenticator with ${gate?.call.slice(0, -1) ?? "dsm.NewEntryGate"} in ${shown}.`);
     }
@@ -392,7 +576,9 @@ function readRootPrograms(value, enabled, ops, c) {
     if (enabled && !ops)
         return undefined;
     const read = readRootSettings(value, ops);
-    return "settings" in read ? read.settings : c.fail("STANDALONE_ROOT_PROGRAMS_INVALID", read.error);
+    return "settings" in read
+        ? read.settings
+        : c.fail("STANDALONE_ROOT_PROGRAMS_INVALID", read.error);
 }
 function readRootOps(enabled, c) {
     const dir = join(c.root, ROOT_OPS_DIR);
@@ -409,10 +595,10 @@ function readRootOps(enabled, c) {
     return loaded.ops;
 }
 function readArches(value, c) {
-    const ok = Array.isArray(value)
-        && value.length > 0
-        && value.every((arch) => typeof arch === "string" && isNativeArchFamily(arch))
-        && new Set(value).size === value.length;
+    const ok = Array.isArray(value) &&
+        value.length > 0 &&
+        value.every((arch) => typeof arch === "string" && isNativeArchFamily(arch)) &&
+        new Set(value).size === value.length;
     return ok
         ? value
         : c.fail("STANDALONE_ARCHES_INVALID", "arches must be a list of unique x86_64/aarch64/armv7 values, at least one.");
@@ -426,7 +612,7 @@ function readBackend(value, arches, c) {
             value = { ...go, kind: "go" };
         }
         else if (BRIDGE_RUNTIMES.includes(value.runtime)) {
-            return readBridgeBackend(value, dir => c.path(dir, "backend.dir"), (code, message) => c.fail(code, message));
+            return readBridgeBackend(value, (dir) => c.path(dir, "backend.dir"), (code, message) => c.fail(code, message));
         }
         else {
             return c.fail("STANDALONE_BACKEND_INVALID", "backend.runtime must be go, python, node or rust.");
@@ -436,7 +622,11 @@ function readBackend(value, arches, c) {
         return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind must be go or binary (or name go, python, node, rust with backend.runtime).");
     }
     if (value.kind === "go") {
-        if (Object.keys(value).some(key => !["kind", "dir", "main", "timeout_seconds"].includes(key)) || (value.main !== undefined && (typeof value.main !== "string" || !GO_MAIN.test(value.main) || value.main.includes("..")))) {
+        if (Object.keys(value).some((key) => !["kind", "dir", "main", "timeout_seconds"].includes(key)) ||
+            (value.main !== undefined &&
+                (typeof value.main !== "string" ||
+                    !GO_MAIN.test(value.main) ||
+                    value.main.includes("..")))) {
             return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: go needs dir, with optional main (./cmd/app by default) and timeout_seconds.");
         }
         const timeout = value.timeout_seconds;
@@ -445,16 +635,23 @@ function readBackend(value, arches, c) {
         const dir = c.path(value.dir, "backend.dir");
         if (!dir)
             return undefined;
-        const backend = { kind: "go", dir, main: value.main ?? "./cmd/app" };
+        const backend = {
+            kind: "go",
+            dir,
+            main: value.main ?? "./cmd/app",
+        };
         if (timeout === undefined)
             return backend;
-        return goReadsTimeout(backend, c) ? { ...backend, timeoutSeconds: timeout } : undefined;
+        return goReadsTimeout(backend, c)
+            ? { ...backend, timeoutSeconds: timeout }
+            : undefined;
     }
     if (value.timeout_seconds !== undefined) {
         return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: binary does not take timeout_seconds: a prebuilt CGI sets its own request deadline.");
     }
     const binary = value.files;
-    if (!isRecord(binary) || Object.keys(value).some(key => !["kind", "files"].includes(key))) {
+    if (!isRecord(binary) ||
+        Object.keys(value).some((key) => !["kind", "files"].includes(key))) {
         return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: binary needs files keyed by architecture pointing at CGI executables.");
     }
     const files = {};
@@ -470,7 +667,9 @@ function readBackend(value, arches, c) {
             c.fail("STANDALONE_BACKEND_INVALID", `backend.files.${key} is not in arches.`);
         }
     }
-    return Object.values(files).every(Boolean) ? { kind: "binary", files } : undefined;
+    return Object.values(files).every(Boolean)
+        ? { kind: "binary", files }
+        : undefined;
 }
 /**
  * The build passes the deadline as -X main.requestTimeout; a main without
@@ -501,15 +700,25 @@ function readUi(value, c) {
     }
     const build = value.build;
     const command = isRecord(build) ? build.command : undefined;
-    if (!Array.isArray(command) || command.length === 0 || !command.every((arg) => typeof arg === "string" && arg !== "")) {
+    if (!Array.isArray(command) ||
+        command.length === 0 ||
+        !command.every((arg) => typeof arg === "string" && arg !== "")) {
         return c.fail("STANDALONE_UI_BUILD_INVALID", "ui.build.command must be an argv string array (not going through a shell), for example [npm, run, build].");
     }
     const cwd = c.path(build.cwd, "ui.build.cwd");
-    return dir && cwd ? { dir, build: { cwd, command: command }, ...launch, ...window } : undefined;
+    return dir && cwd
+        ? {
+            dir,
+            build: { cwd, command: command },
+            ...launch,
+            ...window,
+        }
+        : undefined;
 }
 function readI18n(value, c) {
     const invalid = (why) => c.fail("STANDALONE_I18N_INVALID", `i18n ${why}`);
-    if (!isRecord(value) || Object.keys(value).some((key) => !I18N_FIELDS.has(key))) {
+    if (!isRecord(value) ||
+        Object.keys(value).some((key) => !I18N_FIELDS.has(key))) {
         return invalid("Only messages (the message directory), glossary (the terminology table) and info (per-language INFO text) are accepted.");
     }
     const info = readInfoTranslations(value.info, {
@@ -517,10 +726,14 @@ function readI18n(value, c) {
         text: (text, field) => c.text(text, field),
     });
     if (value.messages === undefined) {
-        return value.glossary === undefined ? info && { info } : invalid("glossary needs messages.");
+        return value.glossary === undefined
+            ? info && { info }
+            : invalid("glossary needs messages.");
     }
     const dir = c.path(value.messages, "i18n.messages");
-    const glossary = value.glossary === undefined ? undefined : c.path(value.glossary, "i18n.glossary");
+    const glossary = value.glossary === undefined
+        ? undefined
+        : c.path(value.glossary, "i18n.glossary");
     if (!dir || (value.glossary !== undefined && !glossary)) {
         return undefined;
     }
@@ -531,7 +744,9 @@ function readI18n(value, c) {
     }
     const drift = glossary ? checkGlossary(glossary, loaded.catalogs) : [];
     drift.forEach((e) => c.fail(e.code, e.message));
-    return info && drift.length === 0 ? { catalogs: loaded.catalogs, info } : undefined;
+    return info && drift.length === 0
+        ? { catalogs: loaded.catalogs, info }
+        : undefined;
 }
 /**
  * The nearest directory at or above `start` that holds dsm-package.yaml,
@@ -562,7 +777,9 @@ function readCapabilities(value, c) {
     }
     const result = {};
     for (const [name, setting] of Object.entries(value)) {
-        if (name === "webapi") {
+        if (name === "composeMounts" && setting === true)
+            result.composeMounts = true;
+        else if (name === "webapi") {
             if (validWebAPIProfiles(setting))
                 result.webapi = setting;
             else
@@ -581,7 +798,7 @@ function readCapabilities(value, c) {
         else if (name === "rootOps" && setting === true)
             result.rootOps = true;
         else if (name === "jobs") {
-            result.jobs = readBackground(setting === true ? { worker: "sha256-v1" } : setting, e => c.fail("CAPABILITY_INVALID", e.message.replace("background", "capabilities.jobs")));
+            result.jobs = readBackground(setting === true ? { worker: "sha256-v1" } : setting, (e) => c.fail("CAPABILITY_INVALID", e.message.replace("background", "capabilities.jobs")));
         }
         else
             c.fail("CAPABILITY_INVALID", `Unsupported capabilities.${name} value; use files: session, identity: standalone, jobs: true or {worker: sha256-v1}, rootOps: true.`);