@synopackageland/cli 0.14.1 → 0.15.0

package/dist/standalone/resource.js

@@ -9,10 +9,14 @@ import { portalResource } from "../portal/package.js";
 export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
     const resource = {
-        ...(m.compose ? renderDockerProjectResource(m.package, "compose", false) : {}),
+        ...(m.compose && !m.compose.plan.mounts_blocked
+            ? renderDockerProjectResource(m.package, "compose", false, m.compose.plan.project_name)
+            : {}),
         ...(dataShare ? { "data-share": dataShare } : {}),
         ...(m.capabilities.jobs ? { "systemd-user-unit": {} } : {}),
         ...(portal ? portalResource() : {}),
     };
-    return Object.keys(resource).length > 0 ? JSON.stringify(resource) : undefined;
+    return Object.keys(resource).length > 0
+        ? JSON.stringify(resource)
+        : undefined;
 }

package/dist/standalone/spk.d.ts

@@ -11,10 +11,11 @@ export interface AssembleOptions {
     manifest: StandaloneManifest;
     arch: NativeArchFamily;
     /** The compiled or prebuilt CGI executable, already checked. */
-    cgiPath: string;
+    cgiPath?: string;
     outputPath: string;
     executor?: ExecutorArtifact;
     daemonControl?: string;
+    composeControl?: string;
     /** The SDK identity gateway, required exactly when the manifest declares identity_gateway. */
     identityGateway?: string;
     /** The compiled background worker, required exactly when capabilities.jobs is enabled. */
@@ -23,6 +24,8 @@ export interface AssembleOptions {
     app?: string;
     /** The SDK's portal panel text, required exactly when the manifest declares a portal. */
     portalText?: PortalCatalogs;
+    apiRegistry?: Record<string, string>;
+    apiDescription?: import("../ctl/descriptor.js").Descriptor;
 }
 /**
  * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle

package/dist/standalone/spk.js

@@ -1,3 +1,4 @@
+import { sdkSource } from "../runtime/sdk-source.js";
 import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
@@ -5,36 +6,36 @@ import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync,
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
-import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons } from "../build-spk/dsm-icons.js";
+import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons, } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
-import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
-import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
-import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
+import { renderInstallWizardFiles, renderNativeInstallWizard, } from "../build-spk/install-wizard.js";
+import { writeWizardUiFiles, } from "../build-spk/wizard-i18n.js";
+import { renderDelegateScopeSteps } from "../build-spk/delegate-scope.js";
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
-import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
+import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
 import { loginStyleAssets } from "../build-spk/login-style.js";
-import { copyStandaloneNotices } from "../build-spk/notices.js";
+import { copyStandaloneNotices, copyNoticeTree } from "../build-spk/notices.js";
 import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
-import { composeSource } from "./compose.js";
+import { writeComposePayload } from "./compose.js";
 import { copyDaemonPayload } from "./daemon.js";
-import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig } from "./identity-gateway.js";
-import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS } from "./background.js";
+import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
+import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { nativePortal } from "./portal.js";
 import { portalByExecutor } from "../build-spk/dsm-version.js";
-import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
-import { executorPlan } from "../runtime/executor-build.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep, } from "../portal/package.js";
+import { executorPlan, } from "../runtime/executor-build.js";
 import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
-import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
-import { stateItemTexts, uninstallExecProblem, uninstallRecord } from "./uninstall.js";
+import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, } from "./shared-folder.js";
+import { stateItemTexts, uninstallExecProblem, uninstallRecord, } from "./uninstall.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
 const MAX_UI_BYTES = 64 * 1024 * 1024;
@@ -63,26 +64,39 @@ export async function assembleStandaloneSpk(options) {
     const { manifest } = options;
     const staging = mkdtempSync(join(tmpdir(), "syno-standalone-spk-"));
     try {
-        if ((manifest.capabilities.rootOps || manifest.capabilities.delegate || manifest.capabilities.webapi) && !options.executor)
+        if ((manifest.capabilities.rootOps ||
+            manifest.capabilities.delegate ||
+            manifest.capabilities.webapi) &&
+            !options.executor)
             throw new StandaloneBuildError("EXECUTOR_PIN_REQUIRED", "Executor artifact required.");
         const icons = packageIcons(manifest.icon);
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
-        copyUiTree(manifest.ui.dir, appDir);
+        if (!manifest.compose)
+            copyUiTree(manifest.ui.dir, appDir);
+        else
+            mkdirSync(appDir, { recursive: true });
         const assetVersion = digestTree(appDir).slice(0, 12);
-        const login = manifest.portal ? loginStyleAssets(manifest.loginStyle) : undefined;
+        const login = manifest.portal
+            ? loginStyleAssets(manifest.loginStyle)
+            : undefined;
         writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons, login?.fields));
         for (const [path, bytes] of login?.files ?? [])
             writeFile(join(uiRoot, path), bytes);
-        writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
+        if (!manifest.compose)
+            writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
         writeUiTexts(uiRoot, appTitle(manifest));
+        if (options.apiDescription)
+            writeFile(join(staging, "package", "synopkgland-api.json"), JSON.stringify(options.apiDescription) + "\n");
         const cgiTarget = join(staging, "package", CGI_PAYLOAD_PATH);
         mkdirSync(dirname(cgiTarget), { recursive: true });
-        copyFileSync(options.cgiPath, cgiTarget);
-        chmodSync(cgiTarget, EXEC_MODE);
-        if (manifest.daemon || manifest.compose) {
+        if (options.cgiPath) {
+            copyFileSync(options.cgiPath, cgiTarget);
+            chmodSync(cgiTarget, EXEC_MODE);
+        }
+        if (manifest.daemon || (manifest.compose && manifest.identityGateway)) {
             if (!options.daemonControl)
                 throw new StandaloneBuildError("STANDALONE_DAEMON_ARTIFACT_REQUIRED", "daemon controller artifact required.");
             copyDaemonPayload(manifest, options.arch, join(staging, "package", "daemon"), options.daemonControl);
@@ -90,7 +104,11 @@ export async function assembleStandaloneSpk(options) {
         if (manifest.identityGateway) {
             if (!options.identityGateway)
                 throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED", "identity gateway artifact required.");
-            for (const path of [GATEWAY_CGI_PATH, `daemon/payload/${GATEWAY_EXEC}`]) {
+            for (const path of [
+                GATEWAY_CGI_PATH,
+                "ui/sso/open.cgi",
+                `daemon/payload/${GATEWAY_EXEC}`,
+            ]) {
                 const target = join(staging, "package", path);
                 mkdirSync(dirname(target), { recursive: true });
                 copyFileSync(options.identityGateway, target);
@@ -113,10 +131,33 @@ export async function assembleStandaloneSpk(options) {
             copyAppTree(options.app, join(staging, "package", "app"));
         }
         // A daemon is a Go program of the project's backend directory.
-        const sdk = backend.kind !== 'binary' ? backend : manifest.daemon ? { kind: 'go', dir: join(manifest.root, 'backend') } : undefined;
-        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), { go: backend.kind !== 'binary' || Boolean(manifest.daemon), rust: backend.kind === 'rust', sdk });
+        const sdk = backend.kind !== "binary"
+            ? backend
+            : manifest.daemon
+                ? { kind: "go", dir: join(manifest.root, "backend") }
+                : undefined;
+        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, "package"), {
+            go: backend.kind !== "binary" ||
+                Boolean(manifest.daemon || manifest.compose),
+            rust: backend.kind === "rust",
+            sdk,
+        });
+        if (manifest.compose) {
+            const source = sdkSource(manifest.compose.sdk);
+            copyNoticeTree(join(source.goDir, "LICENSE"), join(staging, "package/LICENSES/SDK.txt"));
+            copyNoticeTree(join(source.goDir, "compose/THIRD_PARTY_NOTICES.txt"), join(staging, "package/LICENSES/COMPOSE-THIRD_PARTY_NOTICES.txt"));
+            const nativeAdmin = join(source.goDir, "dsm/native");
+            for (const name of [
+                "admin_check.c",
+                "apppriv_check.c",
+                "build.sh",
+                "provenance.json",
+                "licenses",
+            ])
+                copyNoticeTree(join(nativeAdmin, name), join(staging, "package/LICENSES/native-admin", name));
+        }
         if (manifest.daemon)
-            copyFileSync(new URL('../../assets/licenses/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+            copyFileSync(new URL("../../assets/licenses/TEMPLATE.txt", import.meta.url), join(staging, "package", "LICENSES", "DAEMON-LICENSE.txt"));
         const portal = nativePortal(manifest);
         if (portal) {
             writeFile(join(staging, "package", PORTAL_JSON_RELPATH), renderPortalJson(portal));
@@ -138,16 +179,48 @@ export async function assembleStandaloneSpk(options) {
                     copyExecutable(op.binary[options.arch].path, join(staging, "package", "root", op.name));
             }
         }
-        const hook = manifest.uninstall && uninstallExecProblem(join(staging, "package"), manifest.uninstall.purge);
+        const hook = manifest.uninstall &&
+            uninstallExecProblem(join(staging, "package"), manifest.uninstall.purge);
         if (hook)
             throw new StandaloneBuildError(hook.code, hook.message);
-        if (manifest.compose)
-            writeFile(join(staging, "package/compose/docker-compose.yml"), composeSource(manifest.compose));
+        if (manifest.compose) {
+            const target = join(staging, "package/compose");
+            writeComposePayload(manifest.compose, manifest.root, target, identityGatewayDeclaration(manifest.identityGateway));
+            if (!options.composeControl)
+                throw new StandaloneBuildError("SDK_COMPOSE_BUILD_FAILED", "Compose runtime artifact required.");
+            copyFileSync(options.composeControl, join(target, "control"));
+            chmodSync(join(target, "control"), EXEC_MODE);
+        }
         const packageTgz = join(staging, "package.tgz");
-        await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
+        await createReproducibleTar(join(staging, "package"), packageTgz, {
+            gzip: true,
+        });
         rmSync(join(staging, "package"), { recursive: true, force: true });
-        const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, launch: resolvedSdkLaunch(manifest), capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.compose ? { compose: { services: manifest.compose.services } } : {}), ...(manifest.entry ? { entry: manifest.entry } : {}), ...(manifest.uninstall ? { uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs) } : {}) }));
+        const checksum = createHash("md5")
+            .update(readFileSync(packageTgz))
+            .digest("hex");
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({
+            schema: 2,
+            ...(options.apiDescription ? { ctl: { hash: options.apiDescription.sha256, registry: options.apiRegistry } } : {}),
+            backend: manifest.backend.kind,
+            launch: resolvedSdkLaunch(manifest),
+            capabilities: Object.keys(manifest.capabilities).sort(),
+            ...(manifest.compose
+                ? {
+                    compose: {
+                        sdk: manifest.compose.sdk,
+                        declaration: manifest.compose.declaration,
+                        gateway: identityGatewayDeclaration(manifest.identityGateway),
+                    },
+                }
+                : {}),
+            ...(manifest.entry ? { entry: manifest.entry } : {}),
+            ...(manifest.uninstall
+                ? {
+                    uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs),
+                }
+                : {}),
+        }));
         writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
@@ -165,18 +238,37 @@ export async function assembleStandaloneSpk(options) {
         for (const name of manifest.appScripts ?? [])
             copyExecutable(join(manifest.root, APP_SCRIPTS_DIR, name), join(staging, APP_SCRIPTS_SPK_DIR, name));
         const folder = manifest.sharedFolder;
-        const steps = manifest.capabilities.delegate?.scope === 'install-selected'
-            ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
-            : folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard;
-        const install = renderInstallWizardFiles(manifest.package, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
+        const steps = manifest.capabilities.delegate?.scope === "install-selected"
+            ? (t) => [
+                ...renderDelegateScopeSteps(t),
+                ...(folder
+                    ? sharedFolderInstallSteps(manifest.package, folder)(t)
+                    : []),
+            ]
+            : folder
+                ? sharedFolderInstallSteps(manifest.package, folder)
+                : renderNativeInstallWizard;
+        const install = renderInstallWizardFiles(manifest.package, portal
+            ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)]
+            : steps);
         writeWizardUiFiles(staging, {
             ...install.static,
             ...install.dynamic,
-            ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
+            ...(folder
+                ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder)
+                : {}),
             ...renderUninstallWizardFiles(manifest.package, "native", {
-                executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)),
+                executor: Boolean(options.executor),
+                portal: Boolean(portal),
+                portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)),
                 rootPurge: Boolean(manifest.uninstall?.purge.root),
-                ...(manifest.uninstall?.state ? { state: { items: (locale) => stateItemTexts(manifest.uninstall, manifest.i18n?.catalogs, locale) } } : {}),
+                ...(manifest.uninstall?.state
+                    ? {
+                        state: {
+                            items: (locale) => stateItemTexts(manifest.uninstall, manifest.i18n?.catalogs, locale),
+                        },
+                    }
+                    : {}),
             }),
         });
         writePackageCenterIcons(staging, icons);
@@ -219,8 +311,15 @@ function renderInfo(manifest, arch, checksum, executorDigest) {
     // Package Center writes INFO as root; root tasks accept only this executor.
     if (executorDigest)
         fields.push([EXECUTOR_ANCHOR, executorDigest]);
-    if (manifest.compose)
-        fields.push(["install_dep_packages", "ContainerManager"]);
+    if (manifest.compose) {
+        // DSM dependency status can fail while the official docker-project worker is available.
+        // Let that worker check availability; never start or repair Container Manager here.
+        if (manifest.identityGateway)
+            fields.push([
+                "adminurl",
+                `/webman/3rdparty/${manifest.package}/sso/open.cgi`,
+            ]);
+    }
     const backend = manifest.backend;
     if (isBridgeBackend(backend) && backend.node)
         fields.push(["install_dep_packages", backend.node.package]);

package/dist/template-paths.d.ts

@@ -3,5 +3,3 @@
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;
-/** Go sources the CLI builds into every SPK that needs them; they are not scaffolded. */
-export declare function goAssetDir(name: "daemon" | "gateway"): string;

package/dist/template-paths.js

@@ -1,6 +1,5 @@
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
 /**
  * The scaffold templates come from the exactly pinned @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
@@ -15,7 +14,3 @@ export function templatesRoot(env = process.env, from = import.meta.url) {
         throw new Error("[TEMPLATES_MISSING] @synopackageland/templates is not installed; reinstall @synopackageland/cli, or set SYNOPKGLAND_TEMPLATES_DIR to a templates checkout.");
     }
 }
-/** Go sources the CLI builds into every SPK that needs them; they are not scaffolded. */
-export function goAssetDir(name) {
-    return fileURLToPath(new URL(`../assets/go/${name}`, import.meta.url));
-}

package/dist/test-command.d.ts

@@ -10,4 +10,4 @@ export interface TestProjectResult {
     errors: string[];
 }
 export declare function testProject(options: TestProjectOptions): Promise<TestProjectResult>;
-export { materializeComposePaths, composeEnvDirsExist, prepareComposeEnvironment } from "./compose/env.js";
+export { materializeComposePaths, composeEnvDirsExist, prepareComposeEnvironment, } from "./compose/env.js";

package/dist/test-command.js

@@ -23,4 +23,4 @@ export async function testProject(options) {
     }
     return { ok: true, composeInvoked: true, errors: [] };
 }
-export { materializeComposePaths, composeEnvDirsExist, prepareComposeEnvironment } from "./compose/env.js";
+export { materializeComposePaths, composeEnvDirsExist, prepareComposeEnvironment, } from "./compose/env.js";

package/dist/validate.d.ts

@@ -1,8 +1,8 @@
+import type { ProjectRoot } from "./discovery.js";
 import type { ValidationResult } from "./types.js";
-import { type ProjectRoot } from "./discovery.js";
 export type AnalyzerProfile = "personal" | "listing";
-export declare function validateProject(project: ProjectRoot, options?: {
+/** All shipped Compose and native projects use the schema-2 build path. */
+export declare function validateProject(project: ProjectRoot, _options?: {
     profile?: AnalyzerProfile;
 }): ValidationResult;
 export { findProjectRoot } from "./discovery.js";
-export type { ProjectRoot } from "./discovery.js";

package/dist/validate.js

@@ -1,149 +1,41 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { contractSpan, makeError } from "./errors.js";
 import { getErrorCode } from "./error-registry.js";
-import { collectInstallParameters, getValuePosition, loadContract } from "./contract/load.js";
-import { validateContract } from "./contract/validate.js";
-import { findListingUnsupportedInstallTypes } from "./contract/unsupported-types.js";
-import { classifyComposeRoute, collectComposeInterpolations, collectVolumeSourceInterpolations, loadCompose, validateAdminPortMapping, validateComposeHostBinds, validateComposeNumericCommandArgs, validateComposeRunAs, validateComposeSecurity, validateGatewayPortLoopback, } from "./compose/analyze.js";
-import { usesAuthGateway } from "./contract/web-launch.js";
-import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { loadStandaloneManifest } from "./standalone/manifest.js";
-import { APP_SCRIPTS_DIR, readAppScripts } from "./standalone/app-scripts.js";
+import { isNativeLayout, loadNativeLayout, } from "./standalone/native-layout.js";
 import { manifestPolicyProblem } from "./runtime/executor-policy-check.js";
-import { COMPOSE_FILENAME, CONTRACT_FILENAME, DSM_PACKAGE_FILENAME, } from "./discovery.js";
-import { declaredPrivilegeFlags } from "./compose/privilege.js";
-export function validateProject(project, options = {}) {
-    const profile = options.profile ?? "personal";
-    const errors = [];
-    const contractFile = CONTRACT_FILENAME;
-    const composeFile = COMPOSE_FILENAME;
-    const standalonePath = join(project.root, DSM_PACKAGE_FILENAME);
-    const hasCompose = existsSync(project.composePath);
-    const hasStandalone = existsSync(standalonePath);
-    if (hasCompose && hasStandalone && isNativeLayout(project.root)) {
-        return { ok: false, errors: [{
-                    code: "PROJECT_RUNTIME_EXCLUSIVE",
-                    span: { file: DSM_PACKAGE_FILENAME, line: 1, column: 1 },
-                    message: "The project has both compose.yaml and dsm-package.yaml, which are mutually exclusive.",
-                    suggestion: "Choose compose.yaml (container App) or dsm-package.yaml (native App) and delete the other file.",
-                }] };
-    }
-    if (hasStandalone) {
-        const loaded = isNativeLayout(project.root) ? loadNativeLayout(project.root) : loadStandaloneManifest(project.root);
-        const policy = loaded.ok && "capabilities" in loaded.manifest ? manifestPolicyProblem(loaded.manifest) : undefined;
-        const problems = loaded.ok ? (policy ? [policy] : []) : loaded.errors;
-        return !problems.length ? { ok: true, errors: [] } : { ok: false, errors: problems.map(error => ({
-                ...error, span: { file: DSM_PACKAGE_FILENAME, line: 1, column: 1 },
-                suggestion: getErrorCode(error.code)?.suggestion ?? "Fix the schema 2 fields and capability declarations in dsm-package.yaml.",
-            })) };
-    }
-    const parsed = loadContract(project.contractPath);
-    errors.push(...validateContract(parsed, contractFile));
-    const capabilities = parsed.contract.capabilities;
-    if (capabilities !== undefined) {
-        errors.push(makeError("CAPABILITY_UNSUPPORTED", contractSpan(contractFile, 1, 1, "capabilities"), "A compose project does not support capabilities.", "Remove capabilities, or use a dsm-package.yaml native-go project."));
-    }
-    readAppScripts(project.root, e => errors.push({ ...e, span: { file: APP_SCRIPTS_DIR, line: 1, column: 1 }, suggestion: getErrorCode(e.code).suggestion }));
-    if (profile === "listing") {
-        for (const { name, type, code } of findListingUnsupportedInstallTypes(parsed.contract)) {
-            const pos = getValuePosition(parsed.doc, ["install", name, "type"]) ??
-                getValuePosition(parsed.doc, ["install", name]) ??
-                { line: 1, column: 1 };
-            errors.push(makeError(code, contractSpan(contractFile, pos.line, pos.column, `install.${name}.type`), `The Install Parameter "${name}" with type: ${type} can only be snapshotted by synopkgland deploy with an administrator session at install time; Package Center and Package Source listing do not support it.`, "Use synopkgland deploy --host <name> so an administrator session takes the Share list snapshot at install time; this type cannot ship through Package Center or Package Source listing."));
-        }
-    }
-    if (!hasCompose) {
-        errors.push({
-            code: "COMPOSE_MISSING",
-            span: { file: composeFile, line: 1, column: 1 },
-            message: "compose.yaml or dsm-package.yaml was not found.",
-            suggestion: "Create compose.yaml or a schema 2 dsm-package.yaml in the project root.",
-        });
-        return { ok: false, errors };
-    }
-    const parsedCompose = loadCompose(project.composePath);
-    if (!parsedCompose) {
-        return { ok: false, errors };
-    }
-    errors.push(...validateComposeSecurity(parsedCompose.compose, composeFile, {
-        profile,
-        declaredPrivilege: declaredPrivilegeFlags(parsed.contract),
-    }));
-    if (classifyComposeRoute(parsed.contract, parsedCompose, composeFile).route !== "reject") {
-        errors.push(...validateComposeNumericCommandArgs(parsedCompose.compose, composeFile));
-    }
-    const installParams = collectInstallParameters(parsed.contract);
-    const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
-    const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
-    const posixAllSharesParams = new Set(installParams
-        .filter(({ param }) => param.type === "posix_all_shares")
-        .map(({ name }) => name));
-    const installParamNames = new Set(installParams.map(({ name }) => name));
-    errors.push(...validateComposeHostBinds(parsedCompose.compose, composeFile, {
-        sharedFolderParams,
-        homesParams,
-        posixAllSharesParams,
-        installParamNames,
-    }));
-    if (typeof parsed.contract.adminport === "number") {
-        errors.push(...validateAdminPortMapping(parsed.contract.adminport, parsedCompose.compose, composeFile));
-    }
-    if (typeof parsed.contract.adminport === "number" && usesAuthGateway(parsed.contract)) {
-        errors.push(...validateGatewayPortLoopback(parsed.contract.adminport, parsedCompose.compose, composeFile));
-    }
-    const interpolations = collectComposeInterpolations(parsedCompose.compose);
-    const volumeSourceVars = collectVolumeSourceInterpolations(parsedCompose.compose);
-    const dsmUserParams = installParams.filter(({ param }) => param.type === "dsm_user");
-    const hasSharedFolder = sharedFolderParams.size > 0;
-    if (dsmUserParams.length > 1) {
-        errors.push({
-            code: "CONTRACT_DSM_USER_DUPLICATE",
-            span: { file: contractFile, line: 1, column: 1, path: "install" },
-            message: "Each App has at most one dsm_user.",
-            suggestion: "Keep only one Container Run-as parameter.",
-        });
-    }
-    if (hasSharedFolder && dsmUserParams.length === 0) {
-        errors.push({
-            code: "DSM_USER_REQUIRED",
-            span: { file: contractFile, line: 1, column: 1, path: "install" },
-            message: "With a Shared Folder, declare exactly one dsm_user as the Container Run-as.",
-            suggestion: "Add install.<NAME>.type: dsm_user and reference ${NAME_UID}:${NAME_GID} in Compose.",
-            severity: profile === "listing" ? "error" : "warning",
-        });
-    }
-    errors.push(...validateComposeRunAs(parsedCompose.compose, composeFile, {
-        hasSharedFolder,
-        hasDsmUser: dsmUserParams.length > 0,
-    }).map((item) => item.code === "COMPOSE_USER_ROOT_FORBIDDEN"
-        ? { ...item, severity: (profile === "listing" ? "error" : "warning") }
-        : item));
-    for (const { name, param } of installParams) {
-        const referenced = param.type === "shared_folder" || param.type === "homes" || param.type === "posix_all_shares"
-            ? volumeSourceVars.has(name)
-            : interpolations.has(name);
-        if ((param.type === "string" ||
-            param.type === "boolean" ||
-            param.type === "shared_folder" ||
-            param.type === "homes" ||
-            param.type === "posix_all_shares") &&
-            !referenced) {
-            errors.push({
-                code: "INSTALL_PARAMETER_UNREFERENCED",
-                span: {
-                    file: contractFile,
-                    line: 1,
-                    column: 1,
-                    path: `install.${name}`,
+/** All shipped Compose and native projects use the schema-2 build path. */
+export function validateProject(project, _options = {}) {
+    const file = "dsm-package.yaml";
+    if (!existsSync(join(project.root, file)))
+        return {
+            ok: false,
+            errors: [
+                {
+                    code: "COMPOSE_LEGACY_MANIFEST_REMOVED",
+                    span: { file: "synology-app.yaml", line: 1, column: 1 },
+                    message: "The legacy synology-app.yaml Compose route has been removed.",
+                    suggestion: "Use init -t compose and declare DSM differences in schema-2 dsm-package.yaml; keep upstream Compose unchanged.",
                 },
-                message: `The Install Parameter "${name}" is not referenced in Compose.`,
-                suggestion: `Reference this parameter in compose.yaml as \${${name}}.`,
-            });
+            ],
+        };
+    const loaded = isNativeLayout(project.root)
+        ? loadNativeLayout(project.root)
+        : loadStandaloneManifest(project.root);
+    const policy = loaded.ok && "capabilities" in loaded.manifest
+        ? manifestPolicyProblem(loaded.manifest)
+        : undefined;
+    const problems = loaded.ok ? (policy ? [policy] : []) : loaded.errors;
+    return problems.length
+        ? {
+            ok: false,
+            errors: problems.map((error) => ({
+                ...error,
+                span: { file, line: 1, column: 1 },
+                suggestion: getErrorCode(error.code)?.suggestion ??
+                    "Correct the schema-2 declaration; see the SDK Compose support matrix.",
+            })),
         }
-    }
-    const warnings = errors.filter((item) => item.severity === "warning");
-    const hardErrors = errors.filter((item) => item.severity !== "warning");
-    return { ok: hardErrors.length === 0, errors: hardErrors, warnings };
+        : { ok: true, errors: [] };
 }
 export { findProjectRoot } from "./discovery.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -18,16 +18,18 @@
   ],
   "scripts": {
     "build": "rm -rf dist && tsc",
-    "test": "npm run build && node --import tsx --test test/**/*.test.ts",
+    "test": "npm run build && node --import tsx --test test/*.test.ts test/ctl/*.test.ts",
     "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
     "gates": "bash scripts/ci/gates.sh",
     "gates:fast": "bash scripts/ci/gates.sh --fast",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.14.1",
+    "@napi-rs/keyring": "^2.1.1",
+    "@synopackageland/templates": "0.15.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
+    "json-canonicalize": "^3.0.1",
     "tar": "^7.4.3",
     "yaml": "^2.7.0"
   },