@synopackageland/cli 0.14.1 → 0.15.1

package/dist/standalone/compose.d.ts

@@ -1,22 +1,109 @@
-import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
-import { type Daemon } from './daemon.js';
-import type { StandaloneError, StandaloneManifest } from './manifest.js';
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { type Daemon } from "./daemon.js";
+import type { StandaloneError, StandaloneManifest } from "./manifest.js";
+export interface ComposePlan {
+    ingress?: {
+        address: string;
+        subnet: string;
+        port: number;
+        service: string;
+        candidate: number;
+    };
+    schema: number;
+    project_name: string;
+    package: string;
+    inputs: Array<{
+        path: string;
+        sha256: string;
+        content: string;
+    }>;
+    override: string;
+    effective: string;
+    sha256: string;
+    mounts_blocked: boolean;
+    acceptance_blockers: string[];
+    services: Array<{
+        service: string;
+        user: string;
+        container_root: boolean;
+        egress: string;
+        network: string;
+        mounts: unknown[] | null;
+    }>;
+    images: Array<{
+        service: string;
+        source: string;
+        reference: string;
+        pinned: boolean;
+    }>;
+    image_proofs?: Record<string, unknown>;
+    lock: Record<string, unknown>;
+}
 export interface ComposeApp {
+    /** Original manifest declaration; runtime semantics belong to the SDK planner. */
+    declaration: Record<string, unknown>;
     file: string;
-    targets: Daemon['targets'];
+    sdk: string;
+    targets: Daemon["targets"];
     services: Record<string, {
         address_env: string;
         port: number;
     }>;
+    web?: {
+        service: string;
+        port: number;
+        host_port?: number;
+        base_path?: string;
+        health?: {
+            path: string;
+            status: number;
+        };
+    };
     document: Record<string, any>;
+    plan: ComposePlan;
 }
-/** Explicit host-network policy; ordinary Compose keeps its existing rejection rules. */
-export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void): ComposeApp | undefined;
-export declare function composeDaemon(m: Pick<StandaloneManifest, 'compose'>): Daemon;
-export declare function composeNetwork(m: Pick<StandaloneManifest, 'compose' | 'identityGateway'>): {
-    ports: number[];
+export declare const COMPOSE_FIELDS: readonly ["resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
+export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void, context?: {
+    package?: string;
+    sdk?: string;
+    mode?: string;
+    composeMounts?: boolean;
+    resolveImages?: boolean;
+    architecture?: NativeArchFamily;
+    imageProofs?: unknown;
+}): ComposeApp | undefined;
+export declare function composeDaemon(m: Pick<StandaloneManifest, "compose">): Daemon;
+export declare function composeNetwork(m: Pick<StandaloneManifest, "compose" | "identityGateway" | "spkVersion">): {
     public_ports: number[];
+    readiness?: {
+        version: string;
+        plan_sha256: string;
+        health: {
+            path: string;
+            status: number;
+        } | undefined;
+    } | undefined;
+    ingress?: {
+        candidate: number;
+    } | undefined;
+    mode: string;
+    ports: number[];
 };
 export declare function composeSource(c: ComposeApp): string;
-/** preinst only materializes values in the incoming payload; DSM creates var before acquire. */
+/** Retain upstream bytes, the true override and a lock without secret values. */
+export declare function writeComposePayload(c: ComposeApp, root: string, target: string, gateway?: unknown): void;
+/** Only package identity values are materialized, in the incoming tree. */
 export declare function renderComposeInstall(pkg: string): string;
+/** The same SDK entry point supplies the package-account install materializer. */
+export declare function buildComposeControl(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: import("./build.js").CommandRunner): Promise<string | undefined>;
+/** Only the build resolves registry metadata; check and inspect remain offline. */
+export declare function lockComposeImages(m: StandaloneManifest, arch: NativeArchFamily, resolveImages: boolean, imageProofs?: unknown): StandaloneManifest;
+export declare function composeInputs(root: string, file: string, envFile?: string): ComposePlan["inputs"];
+/** Local development uses the same SDK model and package-account preparer. */
+export declare function prepareLocalCompose(m: StandaloneManifest, pkgvar: string): void;
+/** DSM first-install preinst runs before pkgvar exists and before worker acquire. */
+export declare function dsmComposeProblem(c: ComposeApp): {
+    code: string;
+    message: string;
+} | undefined;
+export declare const COMPOSE_READINESS_LIMITATION = "Availability only: App health + fixed endpoint TCP + package lifecycle acquire generation matching the installed version. This does not attest the actual Docker image, project or generation. Another process already executing locally on the NAS may impersonate the fixed endpoint. Accepted for this local-code-execution threat model; replace with full official readback when available.";

package/dist/standalone/compose.js

@@ -1,90 +1,321 @@
-import { lstatSync, readFileSync } from 'node:fs';
-import { isAbsolute, relative, resolve } from 'node:path';
-import { parse, stringify } from 'yaml';
-import { readDaemon } from './daemon.js';
-const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
-const only = (v, keys) => Object.keys(v).every(k => keys.includes(k));
-const vars = new Set(['SYNOPKGLAND_UID', 'SYNOPKGLAND_GID', 'SYNOPKG_PKGVAR']);
-/** Explicit host-network policy; ordinary Compose keeps its existing rejection rules. */
-export function readComposeApp(value, root, arches, fail) {
+import { COMPOSE_ERRORS } from "./compose-errors.js";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { parse } from "yaml";
+import { CLI_VERSION } from "../cli-version.js";
+import { goChildEnv } from "../runtime/go-env.js";
+import { sdkSource } from "../runtime/sdk-source.js";
+import { readDaemon } from "./daemon.js";
+export const COMPOSE_FIELDS = [
+    "resource_prefix",
+    "files",
+    "env_files",
+    "profiles",
+    "web",
+    "data",
+    "shares",
+    "network",
+    "services",
+    "helpers",
+    "sdk",
+];
+const record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const planners = new Map();
+/** Build one trusted SDK tool per process. Never execute the App's payload. */
+function planner(sdk) {
+    if (process.env.SYNOPKGLAND_COMPOSE_PLANNER &&
+        process.env.SYNOPKGLAND_SDK_DIR)
+        return process.env.SYNOPKGLAND_COMPOSE_PLANNER;
+    const source = sdkSource(sdk);
+    const key = source.goDir;
+    const cached = planners.get(key);
+    if (cached)
+        return cached;
+    if (!existsSync(join(source.goDir, "compose/cmd/plan/main.go")))
+        throw new Error("[SDK_COMPOSE_UNSUPPORTED] This SDK has no unified Compose planner; use the matching SDK/CLI release.");
+    const work = mkdtempSync(join(tmpdir(), "synopkgland-compose-tool-"));
+    const out = join(work, "plan");
+    const result = spawnSync("go", ["build", "-trimpath", "-buildvcs=false", "-o", out, "./compose/cmd/plan"], {
+        cwd: source.goDir,
+        env: goChildEnv(),
+        encoding: "utf8",
+        timeout: 120_000,
+        maxBuffer: 2 << 20,
+    });
+    if (result.status !== 0) {
+        rmSync(work, { recursive: true, force: true });
+        throw new Error(`[SDK_COMPOSE_BUILD_FAILED] Cannot build the SDK planner: ${result.stderr || result.error?.message}`);
+    }
+    planners.set(key, out);
+    process.once("exit", () => rmSync(work, { recursive: true, force: true }));
+    return out;
+}
+export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value === undefined)
         return;
-    const invalid = (why) => { fail({ code: 'STANDALONE_IDENTITY_GATEWAY_INVALID', message: `compose identity_gateway: ${why}` }); return undefined; };
-    if (arches.some(a => a !== 'x86_64' && a !== 'aarch64'))
-        return invalid('Container Manager supports x86_64 and aarch64, not armv7.');
-    if (!record(value) || !only(value, ['file', 'targets', 'services']) || typeof value.file !== 'string')
-        return invalid('accepts file, targets and services.');
-    const path = resolve(root, value.file), rel = relative(root, path);
-    if (!rel || isAbsolute(value.file) || rel.startsWith('..') || value.file.split(/[\\/]/).includes('..'))
-        return invalid('file must be inside the project.');
-    let doc;
-    try {
-        if (lstatSync(path).isSymbolicLink())
-            return invalid('file must not be a symlink.');
-        doc = parse(readFileSync(path, 'utf8'));
+    const invalid = (message, code = "COMPOSE_REQUEST_INVALID") => {
+        fail({ code, message });
+        return undefined;
+    };
+    if (arches.some((a) => a !== "x86_64" && a !== "aarch64"))
+        return invalid("Container Manager supports x86_64 and aarch64, not armv7.");
+    if (!record(value) ||
+        Object.keys(value).some((k) => !COMPOSE_FIELDS.includes(k)) ||
+        !Array.isArray(value.files))
+        return invalid("compose requires files, with optional env_files, profiles, web, data, shares, network, services, helpers and sdk; old file/targets syntax is removed.");
+    if (value.sdk !== undefined &&
+        (typeof value.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(value.sdk)))
+        return invalid("compose.sdk must name the matching SDK release.", "SDK_COMPOSE_UNSUPPORTED");
+    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? CLI_VERSION);
+    let targets = {};
+    if (value.helpers !== undefined) {
+        const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail);
+        if (!d)
+            return;
+        targets = d.targets;
     }
-    catch {
-        return invalid('cannot read compose file.');
+    const { helpers: _, sdk: __, ...declaration } = value;
+    try {
+        const result = spawnSync(planner(sdk), [], {
+            input: JSON.stringify({
+                ...declaration,
+                root,
+                package: context.package ?? "ComposeApp",
+                identity_mode: context.mode ?? "none",
+                compose_mounts: context.composeMounts === true,
+                resolve_images: context.resolveImages === true,
+                registry_mirrors: context.resolveImages &&
+                    process.env.SYNOPKGLAND_COMPOSE_REGISTRY_MIRRORS
+                    ? JSON.parse(process.env.SYNOPKGLAND_COMPOSE_REGISTRY_MIRRORS)
+                    : undefined,
+                architecture: context.architecture,
+                image_proofs: context.imageProofs,
+            }),
+            encoding: "utf8",
+            timeout: 65_000,
+            maxBuffer: 48 << 20,
+        });
+        let plan;
+        try {
+            plan = JSON.parse(result.stdout);
+        }
+        catch {
+            throw new Error(`[SDK_COMPOSE_FAILED] Planner did not return JSON: ${result.stderr || result.error?.message}`);
+        }
+        if (result.status !== 0 || plan.error)
+            throw new Error(plan.error ?? "[SDK_COMPOSE_FAILED] SDK planner failed.");
+        const document = parse(plan.effective);
+        const web = value.web;
+        return {
+            declaration: { ...value },
+            sdk,
+            file: join(root, String(value.files[0])),
+            targets,
+            web,
+            services: web
+                ? {
+                    [web.service]: {
+                        address_env: record(value.services?.[web.service])
+                            ? (value.services[web.service].address_env ?? "")
+                            : "",
+                        port: plan.ingress?.port ?? web.host_port ?? web.port,
+                    },
+                }
+                : {},
+            document,
+            plan,
+        };
     }
-    const payload = readDaemon({ exec: '_sso/gateway', targets: value.targets }, root, arches, fail);
-    if (!payload)
-        return;
-    if (!record(doc) || !only(doc, ['services']) || !record(doc.services) || !Object.keys(doc.services).length || !record(value.services))
-        return invalid('only services are supported; every container needs a services binding policy.');
-    if (Object.keys(value.services).sort().join() !== Object.keys(doc.services).sort().join())
-        return invalid('declare a binding policy for every deployed container.');
-    const ports = new Set();
-    for (const [name, service] of Object.entries(doc.services)) {
-        const policy = value.services[name];
-        if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name) || !record(policy) || !only(policy, ['address_env', 'port']) || !/^[A-Z][A-Z0-9_]*$/.test(policy.address_env) || !Number.isInteger(policy.port) || policy.port < 1024 || policy.port > 65535 || ports.has(policy.port))
-            return invalid(`services.${name} needs address_env and a unique unprivileged port.`);
-        ports.add(policy.port);
-        if (!record(service) || !only(service, ['image', 'network_mode', 'user', 'cap_drop', 'security_opt', 'environment', 'volumes', 'restart', 'command', 'entrypoint', 'working_dir']))
-            return invalid(`${name}: unsupported Compose fields (no build, ports, devices, capabilities, namespaces or Docker socket).`);
-        if (service.network_mode !== 'host')
-            return invalid(`${name}: identity_gateway requires network_mode: host with the app bound to 127.0.0.1; bridge cannot reach the loopback issuer.`);
-        if (typeof service.image !== 'string' || !service.image.trim() || /\s/.test(service.image))
-            return invalid(`${name}: use a prebuilt image.`);
-        if (service.user !== '${SYNOPKGLAND_UID}:${SYNOPKGLAND_GID}')
-            return invalid(`${name}: user must be \${SYNOPKGLAND_UID}:\${SYNOPKGLAND_GID}, materialized from the package account.`);
-        if (JSON.stringify(service.cap_drop) !== '["ALL"]' || JSON.stringify(service.security_opt) !== '["no-new-privileges:true"]')
-            return invalid(`${name}: require cap_drop: [ALL] and security_opt: [no-new-privileges:true].`);
-        if (!record(service.environment) || service.environment[policy.address_env] !== '127.0.0.1' || Object.values(service.environment).some(v => typeof v !== 'string'))
-            return invalid(`${name}: environment.${policy.address_env} must be 127.0.0.1; verify the upstream's actual listen setting.`);
-        if (service.restart !== undefined && service.restart !== 'no')
-            return invalid(`${name}: restart must be no; Container Manager owns the lifecycle.`);
-        if (service.volumes !== undefined && (!Array.isArray(service.volumes) || service.volumes.some((v) => typeof v !== 'string' || !/^\$\{SYNOPKG_PKGVAR\}:\/[A-Za-z0-9_./-]+(?::rw|:ro)?$/.test(v) || v.split(':')[1].split('/').some(p => p === '..' || p === '.') || /docker\.sock|container-manager\.sock/.test(v))))
-            return invalid(`${name}: mount only the DSM-created \${SYNOPKG_PKGVAR} root, with a fixed container path.`);
-        for (const key of ['command', 'entrypoint'])
-            if (service[key] !== undefined && (!Array.isArray(service[key]) || !service[key].every((v) => typeof v === 'string')))
-                return invalid(`${name}: ${key} must be argv.`);
+    catch (error) {
+        const message = error.message;
+        const m = /^\[([A-Z_]+)\]\s*([\s\S]*)$/.exec(message);
+        return invalid(m?.[2] ?? message, m?.[1] && COMPOSE_ERRORS[m[1]] ? m[1] : "SDK_COMPOSE_FAILED");
     }
-    for (const match of JSON.stringify(doc).matchAll(/\$(?:\{([^}]+)\}|([A-Za-z_][A-Za-z0-9_]*))/g))
-        if (!vars.has(match[1] ?? match[2]))
-            return invalid('only package UID, GID and var interpolation is supported.');
-    return { file: path, targets: payload.targets, services: value.services, document: doc };
 }
 export function composeDaemon(m) {
-    return { exec: '_sso/gateway', args: ['run'], targets: m.compose.targets, env: {}, timeouts: { start: 30, stop: 30, status: 5, uninstall: 60 } };
+    return {
+        exec: "_sso/gateway",
+        args: ["run"],
+        targets: m.compose.targets,
+        env: {},
+        timeouts: { start: 120, stop: 30, status: 5, uninstall: 60 },
+    };
 }
 export function composeNetwork(m) {
-    return { ports: Object.values(m.compose.services).map(s => s.port).sort((a, b) => a - b), public_ports: Object.values(m.identityGateway.listen).sort((a, b) => a - b) };
+    const c = m.compose;
+    const host = c.web &&
+        c.plan.services.find((s) => s.service === c.web.service)?.network ===
+            "host";
+    return {
+        mode: c.plan.mounts_blocked ? "settings" : host ? "host" : "bridge",
+        ports: c.web ? [c.plan.ingress?.port ?? c.web.host_port ?? c.web.port] : [],
+        ...(c.plan.ingress
+            ? { ingress: { candidate: c.plan.ingress.candidate } }
+            : {}),
+        ...(!host && c.web && !c.plan.mounts_blocked
+            ? {
+                readiness: {
+                    version: m.spkVersion,
+                    plan_sha256: c.plan.sha256,
+                    health: c.web.health,
+                },
+            }
+            : {}),
+        public_ports: Object.values(m.identityGateway?.listen ?? {}).sort((a, b) => a - b),
+    };
 }
-export function composeSource(c) { return stringify(c.document); }
-/** preinst only materializes values in the incoming payload; DSM creates var before acquire. */
+export function composeSource(c) {
+    return c.plan.effective;
+}
+/** Retain upstream bytes, the true override and a lock without secret values. */
+export function writeComposePayload(c, root, target, gateway) {
+    for (const input of c.plan.inputs) {
+        const bytes = readFileSync(join(root, input.path));
+        if (createHash("sha256").update(bytes).digest("hex") !== input.sha256)
+            throw new Error("[COMPOSE_INPUT_CHANGED] Upstream input changed after planning; check and rebuild.");
+        const path = join(target, "upstream", input.path);
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, bytes, { mode: 0o600 });
+    }
+    mkdirSync(target, { recursive: true });
+    for (const [name, content] of Object.entries({
+        "docker-compose.yml": c.plan.effective,
+        "generated.override.yaml": c.plan.override,
+        "compose.lock.json": JSON.stringify(c.plan.lock, null, 2) + "\n",
+        "request.json": JSON.stringify({ declaration: c.declaration, sdk: c.sdk, gateway }, null, 2) + "\n",
+        "images.json": JSON.stringify(c.plan.image_proofs ?? {}, null, 2) + "\n",
+    }))
+        writeFileSync(join(target, name), content, { mode: 0o600 });
+}
+/** Only package identity values are materialized, in the incoming tree. */
 export function renderComposeInstall(pkg) {
     return `#!/bin/sh
 set -eu
-[ "$(id -u)" != 0 ] || exit 1
-umask 077
-project="\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose"
-[ -d "$project" ] && [ ! -L "$project" ] || exit 1
-[ ! -L "$project/.env" ] || exit 1
-{
-  printf 'SYNOPKGLAND_UID=%s\\n' "$(id -u)"
-  printf 'SYNOPKGLAND_GID=%s\\n' "$(id -g)"
-  printf 'SYNOPKG_PKGVAR=%s\\n' '/var/packages/${pkg}/var'
-} > "$project/.env"
-chmod 600 "$project/.env"
+exec "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" prepare --project "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose" --package '${pkg}'
 `;
 }
+/** The same SDK entry point supplies the package-account install materializer. */
+export async function buildComposeControl(m, arch, work, run) {
+    if (!m.compose)
+        return;
+    const { pinnedGoBuildEnv, pinnedGoProblem } = await import("../build-spk/go-toolchain.js");
+    const { checkCgiBinary } = await import("./binary.js");
+    const { StandaloneBuildError } = await import("./spk.js");
+    const out = join(work, `compose-control-${arch}`);
+    const source = sdkSource(m.compose.sdk);
+    const result = await run("go", [
+        "build",
+        "-trimpath",
+        "-buildvcs=false",
+        "-ldflags",
+        "-s -w -buildid=",
+        "-o",
+        out,
+        "./compose/cmd/plan",
+    ], {
+        cwd: source.goDir,
+        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
+    });
+    if (result.status !== 0 || result.missing)
+        throw new StandaloneBuildError("SDK_COMPOSE_BUILD_FAILED", `Cannot build the SDK Compose control: ${result.stderr}`);
+    const error = checkCgiBinary(work, out, arch);
+    if (error)
+        throw new StandaloneBuildError(error.code, error.message);
+    const toolchain = pinnedGoProblem(out);
+    if (toolchain)
+        throw new StandaloneBuildError("SDK_COMPOSE_BUILD_FAILED", toolchain);
+    return out;
+}
+/** Only the build resolves registry metadata; check and inspect remain offline. */
+export function lockComposeImages(m, arch, resolveImages, imageProofs) {
+    if (!m.compose)
+        return m;
+    let error;
+    const compose = readComposeApp(m.compose.declaration, m.root, m.arches, (e) => {
+        error = e;
+    }, {
+        package: m.package,
+        sdk: m.compose.sdk,
+        mode: m.identityGateway?.mode ?? "none",
+        composeMounts: m.capabilities.composeMounts,
+        resolveImages,
+        architecture: arch,
+        imageProofs,
+    });
+    if (!compose)
+        throw new Error(`[${error?.code ?? "SDK_COMPOSE_FAILED"}] ${error?.message ?? "Cannot lock images"}`);
+    return { ...m, compose };
+}
+export function composeInputs(root, file, envFile) {
+    const result = spawnSync(planner(CLI_VERSION), [
+        "sources",
+        "--root",
+        root,
+        "--file",
+        file,
+        ...(envFile ? ["--env", envFile] : []),
+    ], { encoding: "utf8", timeout: 65_000, maxBuffer: 48 << 20 });
+    const output = JSON.parse(result.stdout);
+    if (result.status !== 0 || !Array.isArray(output))
+        throw new Error(output.error ?? "[SDK_COMPOSE_FAILED] Cannot inventory upstream inputs.");
+    return output;
+}
+/** Local development uses the same SDK model and package-account preparer. */
+export function prepareLocalCompose(m, pkgvar) {
+    if (!m.compose)
+        return;
+    if (m.compose.plan.mounts_blocked)
+        throw new Error("[COMPOSE_PROJECT_CONTROL_UNAVAILABLE] Unapproved Shared Folders cannot be mounted by local dev.");
+    const target = join(m.root, ".synopkgland/local-compose");
+    writeComposePayload(m.compose, m.root, target);
+    const result = spawnSync(planner(m.compose.sdk), [
+        "prepare",
+        "--project",
+        target,
+        "--package",
+        m.package,
+        "--pkgvar",
+        pkgvar,
+    ], { encoding: "utf8", timeout: 15_000 });
+    if (result.status !== 0)
+        throw new Error(result.stderr ||
+            "[SDK_COMPOSE_FAILED] SDK local storage preparation failed.");
+    if (m.compose.plan.ingress) {
+        const remembered = spawnSync(planner(m.compose.sdk), [
+            "remember-ingress",
+            "--project",
+            target,
+            "--package",
+            m.package,
+            "--pkgvar",
+            pkgvar,
+        ], { encoding: "utf8", timeout: 15_000 });
+        if (remembered.status !== 0)
+            throw new Error(remembered.stderr ||
+                "[COMPOSE_SUBNET_STATE_INVALID] Cannot persist the local ingress allocation.");
+    }
+}
+/** DSM first-install preinst runs before pkgvar exists and before worker acquire. */
+export function dsmComposeProblem(c) {
+    if (c.plan.mounts_blocked)
+        return;
+    if (c.plan.services.some((s) => (s.mounts ?? []).some((v) => record(v) &&
+        typeof v.source === "string" &&
+        v.source.startsWith("${SYNOPKG_PKGVAR}/"))))
+        return {
+            code: "COMPOSE_PRIVATE_BIND_TIMING_UNSUPPORTED",
+            message: "DSM creates pkgvar after preinst, but docker-project acquires before postinst. Package-private binds cannot be initialized safely on a clean install; select a compatible named volume explicitly or keep this configuration unsupported. No root or automatic storage conversion is used.",
+        };
+    if (c.web &&
+        c.plan.services.find((s) => s.service === c.web.service)?.network ===
+            "bridge" &&
+        !c.web.health)
+        return {
+            code: "COMPOSE_HEALTH_REQUIRED",
+            message: "Bridge web ingress requires compose.web.health: {path: /health, status: 200}; choose the App's actual unauthenticated health endpoint and expected 2xx status.",
+        };
+}
+export const COMPOSE_READINESS_LIMITATION = "Availability only: App health + fixed endpoint TCP + package lifecycle acquire generation matching the installed version. This does not attest the actual Docker image, project or generation. Another process already executing locally on the NAS may impersonate the fixed endpoint. Accepted for this local-code-execution threat model; replace with full official readback when available.";