@synopackageland/cli 0.14.1 → 0.15.1

package/dist/standalone/daemon.js

@@ -1,37 +1,63 @@
 import { goChildEnv } from "../runtime/go-env.js";
-import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
-import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
-import { goAssetDir } from "../template-paths.js";
+import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
+import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
+import { CLI_VERSION } from "../cli-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
-const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
+const fields = new Set([
+    "exec",
+    "targets",
+    "args",
+    "env",
+    "timeouts",
+    "uninstall_args",
+]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 /** A fixed argv or env value: only the package's own directories expand. */
-export const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
-    && !v.replaceAll("${SYNOPKG_PKGDEST}", "").replaceAll("${SYNOPKG_PKGVAR}", "").includes("${");
+export const token = (v) => typeof v === "string" &&
+    Buffer.byteLength(v) <= 4096 &&
+    !v.includes("\0") &&
+    !v
+        .replaceAll("${SYNOPKG_PKGDEST}", "")
+        .replaceAll("${SYNOPKG_PKGVAR}", "")
+        .includes("${");
 /** An application variable that cannot steer the loader, the shell or DSM. */
-export const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
-    && !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
+export const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k) &&
+    !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
 /** A relative path to a fixed executable, without `.` or `..` parts. */
-export const relativeExec = (v) => typeof v === "string" && v.length <= 200
-    && /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) && !v.split("/").some(p => p === "." || p === "..");
+export const relativeExec = (v) => typeof v === "string" &&
+    v.length <= 200 &&
+    /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) &&
+    !v.split("/").some((p) => p === "." || p === "..");
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
-    const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon accepts only fixed exec, targets, args, env and timeouts; paths must be inside the project, and the environment does not accept loader/shell/system variables." }); return undefined; };
-    if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
+    const invalid = () => {
+        fail({
+            code: "STANDALONE_DAEMON_INVALID",
+            message: "daemon accepts only fixed exec, targets, args, env and timeouts; paths must be inside the project, and the environment does not accept loader/shell/system variables.",
+        });
+        return undefined;
+    };
+    if (!record(value) || Object.keys(value).some((k) => !fields.has(k)))
         return invalid();
     if (!relativeExec(value.exec))
         return invalid();
-    if (!record(value.targets) || Object.keys(value.targets).length !== arches.length)
+    if (!record(value.targets) ||
+        Object.keys(value.targets).length !== arches.length)
         return invalid();
     const targets = {};
     for (const arch of arches) {
         const path = value.targets[arch];
-        if (typeof path !== "string" || !path.trim() || path.includes("\0") || isAbsolute(path) || path.split(/[\\/]/).includes(".."))
+        if (typeof path !== "string" ||
+            !path.trim() ||
+            path.includes("\0") ||
+            isAbsolute(path) ||
+            path.split(/[\\/]/).includes(".."))
             return invalid();
         const resolved = resolve(root, path), rel = relative(root, resolved);
         if (!rel || rel.startsWith("..") || isAbsolute(rel))
@@ -42,32 +68,81 @@ export function readDaemon(value, root, arches, fail) {
     if (!Array.isArray(args) || args.length > 64 || !args.every(token))
         return invalid();
     const uninstall = value.uninstall_args;
-    if (uninstall !== undefined && (!Array.isArray(uninstall) || !uninstall.length || uninstall.length > 64 || !uninstall.every(token)))
+    if (uninstall !== undefined &&
+        (!Array.isArray(uninstall) ||
+            !uninstall.length ||
+            uninstall.length > 64 ||
+            !uninstall.every(token)))
         return invalid();
     const env = value.env ?? {};
-    if (!record(env) || Object.keys(env).length > 64 || Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
+    if (!record(env) ||
+        Object.keys(env).length > 64 ||
+        Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
         return invalid();
     const limits = value.timeouts ?? {};
-    if (!record(limits) || Object.keys(limits).some(k => !["start", "stop", "status", "uninstall"].includes(k)))
+    if (!record(limits) ||
+        Object.keys(limits).some((k) => !["start", "stop", "status", "uninstall"].includes(k)))
         return invalid();
     // Defaults hold under IO load on a busy NAS; DSM's package unit allows 3600 s.
-    const timeouts = { start: limits.start ?? 30, stop: limits.stop ?? 30, status: limits.status ?? 5, uninstall: limits.uninstall ?? 60 };
+    const timeouts = {
+        start: limits.start ?? 30,
+        stop: limits.stop ?? 30,
+        status: limits.status ?? 5,
+        uninstall: limits.uninstall ?? 60,
+    };
     for (const [key, v] of Object.entries(timeouts)) {
-        if (!Number.isInteger(v) || v < (key === "status" ? 1 : 2) || v > (key === "status" ? 10 : 120))
+        if (!Number.isInteger(v) ||
+            v < (key === "status" ? 1 : 2) ||
+            v > (key === "status" ? 10 : 120))
             return invalid();
     }
-    return { exec: value.exec, targets, args, ...(uninstall ? { uninstall_args: uninstall } : {}), env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])), timeouts: timeouts };
+    return {
+        exec: value.exec,
+        targets,
+        args,
+        ...(uninstall ? { uninstall_args: uninstall } : {}),
+        env: Object.fromEntries(Object.keys(env)
+            .sort()
+            .map((key) => [key, env[key]])),
+        timeouts: timeouts,
+    };
 }
 export function daemonConfig(manifest) {
-    const { exec, args, uninstall_args, env, timeouts } = manifest.compose ? composeDaemon(manifest) : manifest.identityGateway ? gatewayDaemon(manifest.daemon) : manifest.daemon;
-    return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts, ...(manifest.compose ? { network: composeNetwork(manifest) } : {}) }) + "\n";
+    const { exec, args, uninstall_args, env, timeouts } = manifest.compose
+        ? composeDaemon(manifest)
+        : manifest.identityGateway
+            ? gatewayDaemon(manifest.daemon)
+            : manifest.daemon;
+    return (JSON.stringify({
+        package: manifest.package,
+        exec,
+        args,
+        ...(uninstall_args ? { uninstall_args } : {}),
+        env,
+        timeouts,
+        ...(manifest.compose ? { network: composeNetwork(manifest) } : {}),
+    }) + "\n");
 }
 export async function buildDaemonControl(manifest, arch, work, run) {
-    if (!manifest.daemon && !manifest.compose)
+    if (!manifest.daemon && !(manifest.compose && manifest.identityGateway))
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
-    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: goAssetDir("daemon"), env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
+    const result = await run("go", [
+        "build",
+        "-trimpath",
+        "-buildvcs=false",
+        "-ldflags",
+        "-s -w -buildid=",
+        "-o",
+        out,
+        "./daemonctl",
+    ], {
+        cwd: sdkSource(manifest.identityGateway?.sdk ??
+            (manifest.backend.kind === "go"
+                ? appSdkVersion(manifest.backend)
+                : undefined) ??
+            CLI_VERSION).goDir,
+        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);
@@ -82,7 +157,10 @@ export async function buildDaemonControl(manifest, arch, work, run) {
 export function copyDaemonPayload(manifest, arch, target, controller) {
     const daemon = manifest.daemon ?? composeDaemon(manifest);
     const source = daemon.targets[arch];
-    copyPayloadTree(manifest.root, source, join(target, "payload"));
+    if (source)
+        copyPayloadTree(manifest.root, source, join(target, "payload"));
+    else
+        mkdirSync(join(target, "payload"), { recursive: true });
     if (!manifest.compose) {
         const exec = join(source, daemon.exec);
         const problem = checkCgiBinary(manifest.root, exec, arch);
@@ -92,11 +170,15 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
     }
     copyFileSync(controller, join(target, "control"));
     chmodSync(join(target, "control"), 0o755);
-    writeFileSync(join(target, "config.json"), daemonConfig(manifest), { mode: 0o644 });
+    writeFileSync(join(target, "config.json"), daemonConfig(manifest), {
+        mode: 0o644,
+    });
 }
 /** Copies a bounded, link-free package-account payload tree. */
 export function copyPayloadTree(root, source, target) {
-    const invalid = (message) => { throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", message); };
+    const invalid = (message) => {
+        throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", message);
+    };
     let total = 0;
     const walk = (from, to) => {
         const stat = lstatSync(from);
@@ -111,7 +193,7 @@ export function copyPayloadTree(root, source, target) {
         }
         else if (stat.isFile()) {
             total += stat.size;
-            if (total > 512 * 1024 * 1024 || (stat.mode & 0o6000))
+            if (total > 512 * 1024 * 1024 || stat.mode & 0o6000)
                 invalid(`The daemon payload does not accept setid bits or more than 512 MiB: ${from}`);
             copyFileSync(from, to);
             chmodSync(to, stat.mode & 0o111 ? 0o755 : 0o644);

package/dist/standalone/dsm-window.js

@@ -2,13 +2,13 @@ import { resolvedSdkLaunch, dsmLauncherType } from "../contract/app-launch.js";
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { LAUNCH_PARAMS_RUNTIME } from "./launch-params.js";
 import { DSM_LANGS } from "./i18n.js";
-import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs, } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { portalRuntime } from "./portal-window.js";
 import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { uiTitleFields } from "../build-spk/ui-texts.js";
-import { packageIcons, windowIconFile, windowIconTemplate } from "../build-spk/dsm-icons.js";
+import { packageIcons, windowIconFile, windowIconTemplate, } from "../build-spk/dsm-icons.js";
 import { DEFAULT_WINDOW, FULL_PAGE_MIN_WIDTH } from "./window-size.js";
 import { requestTimeoutSeconds } from "./request-timeout.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
@@ -68,7 +68,13 @@ export function windowScriptName(manifest) {
  * IP rules); DSM then filters the launcher and the CGI checks the same rule.
  */
 function launcherAccess(manifest) {
-    return manifest.entry ? entryLauncherAccess(manifest.entry) : { allUsers: permitsOrdinaryUsers(manifest.apiPermissions) };
+    return manifest.entry
+        ? entryLauncherAccess(manifest.entry)
+        : {
+            allUsers: manifest.compose
+                ? manifest.identityGateway?.access !== "dsm-admins"
+                : permitsOrdinaryUsers(manifest.apiPermissions),
+        };
 }
 /** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
 export function entryLauncherAccess(entry) {
@@ -77,11 +83,17 @@ export function entryLauncherAccess(entry) {
         : { allUsers: true, grantPrivilege: "all", advanceGrantPrivilege: true };
 }
 export function appTitle(manifest) {
-    return { displayname: manifest.displayname, description: manifest.description, info: manifest.i18n?.info };
+    return {
+        displayname: manifest.displayname,
+        description: manifest.description,
+        info: manifest.i18n?.info,
+    };
 }
 /** The app name by locale, as `ui/texts` names the window: `createI18n(lang, ...).t("app_title")`. */
 function displayNameCatalogs(manifest) {
-    const catalogs = { en: { app_title: manifest.displayname } };
+    const catalogs = {
+        en: { app_title: manifest.displayname },
+    };
     for (const [locale, text] of Object.entries(manifest.i18n?.info ?? {})) {
         if (text?.displayname)
             catalogs[locale] = { app_title: text.displayname };
@@ -97,6 +109,21 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
     const icon = windowIconTemplate(icons);
     const ns = `SYNO.SDS.${manifest.package}`;
     const titleFields = uiTitleFields(appTitle(manifest));
+    if (manifest.compose) {
+        if (!manifest.identityGateway)
+            return "{}\n";
+        return (JSON.stringify({
+            ".url": {
+                [`${ns}.Instance`]: {
+                    type: dsmLauncherType(resolvedSdkLaunch(manifest), false),
+                    ...titleFields,
+                    icon,
+                    ...launcherAccess(manifest),
+                    url: `/webman/3rdparty/${manifest.package}/sso/open.cgi`,
+                },
+            },
+        }, null, 2) + "\n");
+    }
     return `${JSON.stringify({
         [windowScriptName(manifest)]: {
             [`${ns}.Instance`]: {
@@ -148,7 +175,8 @@ export function renderWindowScript(manifest, assetVersion, icons = packageIcons(
         throw new Error("A portal App's window needs the SDK's portal panel text.");
     return `/* Generated by synopkgland build. Edit your UI in the project's ui folder. */
 Ext.ns(${JSON.stringify(ns)});
-${sessionRuntime ? `
+${sessionRuntime
+        ? `
 // The SDK owns recovery; all calls share one bounded, same-origin attempt.
 ${ns}.session = (function () {
 ${sessionRuntime}
@@ -158,7 +186,8 @@ ${sessionRuntime}
     fetch: function (url, options) { return fetch(url, options); }
   });
 })();
-` : ''}
+`
+        : ""}
 
 // The SDK's clientTimeout: past the backend's request deadline
 // (ctx.requestTimeout, from backend.timeout_seconds), so its request_timeout
@@ -547,7 +576,9 @@ ${PASSWORD_CONFIRM}
       call: call,
       wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
     });
-${settingsOnlyApproval(manifest) ? "" : `    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
+${settingsOnlyApproval(manifest)
+            ? ""
+            : `    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
     if (panels) {
       ${ns}.mountRootPanel(panels, access, ${ns}.createI18n(lang, ${JSON.stringify(rootPanelCatalogs())}).t, session().admin);
     }

package/dist/standalone/identity-gateway.d.ts

@@ -1,5 +1,6 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { CommandRunner } from "./build.js";
+import { type WebAccessMode } from "../contract/web-launch.js";
 import { type Daemon } from "./daemon.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 /** The SDK's identity gateway: the daemon wrapper and the DSM-origin authorize CGI. */
@@ -10,7 +11,7 @@ export declare const GATEWAY_CGI_PATH = "ui/sso/authorize.cgi";
 export declare const GATEWAY_PAYLOAD_DIR = "_sso";
 export declare const GATEWAY_EXEC = "_sso/gateway";
 export declare const GATEWAY_CONFIG_PATH = "sso/gateway.json";
-export type GatewayMode = "oidc" | "header" | "token";
+export type GatewayMode = "none" | "oidc" | "header" | "token";
 export interface GatewayRoles {
     claim: string;
     admin: string;
@@ -28,6 +29,10 @@ export interface IdentityGateway {
     /** The SDK release the gateway is built from. */
     sdk: string;
     mode: GatewayMode;
+    access?: WebAccessMode;
+    groups?: string[];
+    max_upload_bytes?: number;
+    response_header_timeout_seconds?: number;
     /** The App's loopback port. */
     upstream: number;
     listen: {
@@ -64,10 +69,12 @@ export type DeleteAction = {
 } | {
     exec: string[];
 };
-export declare function readIdentityGateway(value: unknown, daemon: Pick<Daemon, "targets"> | undefined, fail: (error: StandaloneError) => void): IdentityGateway | undefined;
+export declare function readIdentityGateway(value: unknown, daemon: Pick<Daemon, "targets"> | undefined, fail: (error: StandaloneError) => void, packagedPayload?: boolean, composeBridge?: boolean): IdentityGateway | undefined;
 /** target/sso/gateway.json, the SDK gateway's configuration (idgateway.Config). */
 export declare function identityGatewayConfig(m: StandaloneManifest): string;
 /** The daemon as the controller runs it: the gateway, with the App as its child. */
 export declare function gatewayDaemon(daemon: Daemon): Daemon;
 /** Builds the gateway from the declared SDK release with the pinned Go, binding its config path. */
 export declare function buildIdentityGateway(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
+/** The manifest form of a normalized gateway, retained for artifact inspection. */
+export declare function identityGatewayDeclaration(g: IdentityGateway | undefined): unknown;