@synopackageland/cli 0.14.1 → 0.15.1

package/dist/standalone/identity-gateway.js

@@ -1,9 +1,10 @@
 import { existsSync, lstatSync } from "node:fs";
 import { join } from "node:path";
-import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
+import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { checkCgiBinary } from "./binary.js";
+import { isWebAccessMode, DSM_GROUP_NAME, } from "../contract/web-launch.js";
 import { relativeExec, token } from "./daemon.js";
 import { StandaloneBuildError } from "./spk.js";
 /** The SDK's identity gateway: the daemon wrapper and the DSM-origin authorize CGI. */
@@ -15,27 +16,39 @@ export const GATEWAY_PAYLOAD_DIR = "_sso";
 export const GATEWAY_EXEC = `${GATEWAY_PAYLOAD_DIR}/gateway`;
 export const GATEWAY_CONFIG_PATH = "sso/gateway.json";
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
-const only = (v, keys) => Object.keys(v).every(k => keys.includes(k));
+const only = (v, keys) => Object.keys(v).every((k) => keys.includes(k));
 const port = (v) => Number.isInteger(v) && v > 0 && v < 65536;
 /** An absolute local path without dot segments, backslashes or a query. */
-const localPath = (v) => typeof v === "string" && v.length <= 512 && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(v)
-    && !v.startsWith("//") && !v.split("/").some(p => p === "." || p === "..");
+const localPath = (v) => typeof v === "string" &&
+    v.length <= 512 &&
+    /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(v) &&
+    !v.startsWith("//") &&
+    !v.split("/").some((p) => p === "." || p === "..");
 const strings = (v, ok, max = 64) => Array.isArray(v) && v.length <= max && v.every(ok);
 const name = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(v);
 const headerName = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(v);
 const claimValue = (v) => typeof v === "string" && /^[A-Za-z0-9_.:-]{1,64}$/.test(v);
 /** A mobile app's custom-scheme redirect; web schemes are same-origin redirect_paths instead. */
-const nativeRedirect = (v) => typeof v === "string" && v.length <= 512 && /^[a-z][a-z0-9+.-]*:[^\s]*$/.test(v)
-    && !/^(https?|javascript|data|vbscript|file|blob|about):/.test(v);
+const nativeRedirect = (v) => typeof v === "string" &&
+    v.length <= 512 &&
+    /^[a-z][a-z0-9+.-]*:[^\s]*$/.test(v) &&
+    !/^(https?|javascript|data|vbscript|file|blob|about):/.test(v);
 const DSM_PORTS = [5000, 5001];
 /** Only {uid} and {name}, which the gateway expands inside one argv element or path element. */
-const placeholders = (v) => (v.match(/\{[^{}]*\}/g) ?? []).every(p => p === "{uid}" || p === "{name}");
+const placeholders = (v) => (v.match(/\{[^{}]*\}/g) ?? []).every((p) => p === "{uid}" || p === "{name}");
 /** A clean path under the package var directory that names the account, outside the gateway's sso/. */
-const removePath = (v) => typeof v === "string" && v.length <= 512 && placeholders(v)
-    && /^[A-Za-z0-9_{}][A-Za-z0-9_.{}-]*(\/[A-Za-z0-9_.{}-]+)*$/.test(v) && !v.split("/").some(p => p === "." || p === "..")
-    && v.split("/")[0] !== "sso" && /\{(uid|name)\}/.test(v);
+const removePath = (v) => typeof v === "string" &&
+    v.length <= 512 &&
+    placeholders(v) &&
+    /^[A-Za-z0-9_{}][A-Za-z0-9_.{}-]*(\/[A-Za-z0-9_.{}-]+)*$/.test(v) &&
+    !v.split("/").some((p) => p === "." || p === "..") &&
+    v.split("/")[0] !== "sso" &&
+    /\{(uid|name)\}/.test(v);
 function readAccount(v, daemon) {
-    if (!record(v) || !only(v, ["on_delete"]) || !Array.isArray(v.on_delete) || v.on_delete.length > 16)
+    if (!record(v) ||
+        !only(v, ["on_delete"]) ||
+        !Array.isArray(v.on_delete) ||
+        v.on_delete.length > 16)
         return "account accepts on_delete, a list of at most 16 actions.";
     const actions = [];
     for (const a of v.on_delete) {
@@ -43,11 +56,16 @@ function readAccount(v, daemon) {
             actions.push({ remove: a.remove });
             continue;
         }
-        if (!record(a) || !only(a, ["exec"]) || !Array.isArray(a.exec) || !relativeExec(a.exec[0]) || !strings(a.exec.slice(1), s => token(s) && placeholders(s))) {
+        if (!record(a) ||
+            !only(a, ["exec"]) ||
+            !Array.isArray(a.exec) ||
+            !relativeExec(a.exec[0]) ||
+            !strings(a.exec.slice(1), (s) => token(s) && placeholders(s))) {
             return "each account.on_delete action is { remove: <path under the var directory naming {uid} or {name}> } or { exec: [<program in the daemon payload>, args...] }; {uid} and {name} are the only placeholders.";
         }
         const argv = a.exec;
-        if (!Object.values(daemon.targets).every(dir => existsSync(join(dir, argv[0]))))
+        if (!Object.keys(daemon.targets).length ||
+            !Object.values(daemon.targets).every((dir) => existsSync(join(dir, argv[0]))))
             return `account.on_delete exec ${argv[0]} is not in the daemon payload.`;
         actions.push({ exec: argv });
     }
@@ -58,88 +76,210 @@ function readRoles(v) {
         return undefined;
     if (!record(v) || !only(v, ["claim", "admin", "user"]))
         return false;
-    const roles = { claim: v.claim ?? "groups", admin: v.admin ?? "admin", ...(v.user !== undefined ? { user: v.user } : {}) };
-    return claimValue(roles.claim) && claimValue(roles.admin) && (roles.user === undefined || claimValue(roles.user)) ? roles : false;
+    const roles = {
+        claim: v.claim ?? "groups",
+        admin: v.admin ?? "admin",
+        ...(v.user !== undefined ? { user: v.user } : {}),
+    };
+    return claimValue(roles.claim) &&
+        claimValue(roles.admin) &&
+        (roles.user === undefined || claimValue(roles.user))
+        ? roles
+        : false;
 }
 function readClient(v) {
-    if (!record(v) || !only(v, ["id", "redirect_paths", "native_redirects", "pkce", "roles"]))
+    if (!record(v) ||
+        !only(v, ["id", "redirect_paths", "native_redirects", "pkce", "roles"]))
         return undefined;
     const native = v.native_redirects ?? [], roles = readRoles(v.roles);
-    if (!name(v.id) || !strings(v.redirect_paths, localPath) || !strings(native, nativeRedirect) || (v.pkce !== undefined && typeof v.pkce !== "boolean") || roles === false)
+    if (!name(v.id) ||
+        !strings(v.redirect_paths, localPath) ||
+        !strings(native, nativeRedirect) ||
+        (v.pkce !== undefined && typeof v.pkce !== "boolean") ||
+        roles === false)
         return undefined;
     if (!v.redirect_paths.length && !native.length)
         return undefined;
-    return { id: v.id, redirect_paths: v.redirect_paths, native_redirects: native, require_pkce: v.pkce === true, ...(roles ? { roles } : {}) };
+    return {
+        id: v.id,
+        redirect_paths: v.redirect_paths,
+        native_redirects: native,
+        require_pkce: v.pkce === true,
+        ...(roles ? { roles } : {}),
+    };
 }
-export function readIdentityGateway(value, daemon, fail) {
+export function readIdentityGateway(value, daemon, fail, packagedPayload = false, composeBridge = false) {
     if (value === undefined)
         return undefined;
-    const invalid = (why) => { fail({ code: "STANDALONE_IDENTITY_GATEWAY_INVALID", message: `identity_gateway: ${why}` }); return undefined; };
+    const invalid = (why) => {
+        fail({
+            code: "STANDALONE_IDENTITY_GATEWAY_INVALID",
+            message: `identity_gateway: ${why}`,
+        });
+        return undefined;
+    };
     if (!daemon)
         return invalid("needs daemon (native child) or compose (Container Manager upstream).");
-    if (!record(value) || !only(value, ["sdk", "mode", "upstream", "listen", "passthrough", "redirects", "email_domain", "session_ttl", "roles", "headers", "oidc", "token", "account"])) {
+    if (!record(value) ||
+        !only(value, [
+            "sdk",
+            "mode",
+            "access",
+            "groups",
+            "max_upload_bytes",
+            "response_header_timeout_seconds",
+            "upstream",
+            "listen",
+            "passthrough",
+            "redirects",
+            "email_domain",
+            "session_ttl",
+            "roles",
+            "headers",
+            "oidc",
+            "token",
+            "account",
+        ])) {
         return invalid("accepts only sdk, mode, upstream, listen, passthrough, redirects, email_domain, session_ttl, roles, headers, oidc, token and account.");
     }
     const v = value;
+    const access = v.access ?? "dsm-users";
+    if (!isWebAccessMode(access) || (access === "public" && v.mode !== "none"))
+        return invalid("access must be dsm-users, dsm-admins, dsm-groups or public (none mode only).");
+    if (access === "dsm-groups" &&
+        (!Array.isArray(v.groups) ||
+            !v.groups.length ||
+            !v.groups.every((g) => typeof g === "string" && DSM_GROUP_NAME.test(g))))
+        return invalid("dsm-groups requires a nonempty exact groups allowlist.");
+    if (v.groups !== undefined && access !== "dsm-groups")
+        return invalid("groups applies only to access: dsm-groups.");
+    if (v.max_upload_bytes !== undefined &&
+        (!Number.isSafeInteger(v.max_upload_bytes) ||
+            Number(v.max_upload_bytes) < 1 ||
+            Number(v.max_upload_bytes) > 16 * 1024 ** 3))
+        return invalid("max_upload_bytes must be 1–16 GiB.");
+    if (v.response_header_timeout_seconds !== undefined &&
+        (!Number.isInteger(v.response_header_timeout_seconds) ||
+            Number(v.response_header_timeout_seconds) < 1 ||
+            Number(v.response_header_timeout_seconds) > 3600))
+        return invalid("response_header_timeout_seconds must be 1–3600.");
     if (typeof v.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(v.sdk))
         return invalid("sdk must be the SDK release (x.y.z) to build the gateway from.");
-    if (v.mode !== "oidc" && v.mode !== "header" && v.mode !== "token")
-        return invalid("mode must be oidc, header or token.");
+    if (v.mode !== "none" &&
+        v.mode !== "oidc" &&
+        v.mode !== "header" &&
+        v.mode !== "token")
+        return invalid("mode must be none, oidc, header or token.");
     if (!port(v.upstream))
         return invalid("upstream must be the App's loopback port.");
     const listen = v.listen;
-    if (!record(listen) || !only(listen, ["http", "https"]) || (listen.http === undefined && listen.https === undefined)
-        || ![listen.http, listen.https].every(p => p === undefined || port(p)))
+    if (!record(listen) ||
+        !only(listen, ["http", "https"]) ||
+        (listen.http === undefined && listen.https === undefined) ||
+        ![listen.http, listen.https].every((p) => p === undefined || port(p)))
         return invalid("listen needs an http and/or https port.");
     const issuer = record(v.oidc) ? v.oidc.issuer_port : undefined;
-    const ports = [listen.http, listen.https, v.upstream, issuer].filter(p => p !== undefined);
-    if (new Set(ports).size !== ports.length || ports.some(p => DSM_PORTS.includes(p)))
+    const ports = [
+        listen.http,
+        listen.https,
+        ...(composeBridge ? [] : [v.upstream]),
+        issuer,
+    ].filter((p) => p !== undefined);
+    if (new Set(ports).size !== ports.length ||
+        ports.some((p) => DSM_PORTS.includes(p)))
         return invalid("listen, upstream and oidc.issuer_port must be distinct and not DSM's 5000/5001.");
     const passthrough = v.passthrough ?? [];
-    if (!strings(passthrough, p => localPath(p) && p !== "/" && !/^\/_sso(\/|$)/.test(p)))
+    if (!strings(passthrough, (p) => localPath(p) && p !== "/" && !/^\/_sso(\/|$)/.test(p)))
         return invalid("passthrough must be path prefixes such as /share/, outside /_sso.");
     const redirects = v.redirects ?? {};
-    if (!record(redirects) || Object.entries(redirects).some(([from, to]) => !localPath(from) || !localPath(to)))
+    if (!record(redirects) ||
+        Object.entries(redirects).some(([from, to]) => !localPath(from) || !localPath(to)))
         return invalid("redirects maps local paths to local paths.");
-    if (v.email_domain !== undefined && (typeof v.email_domain !== "string" || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(v.email_domain)))
+    if (v.email_domain !== undefined &&
+        (typeof v.email_domain !== "string" ||
+            !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(v.email_domain)))
         return invalid("email_domain must be a domain name.");
-    if (v.session_ttl !== undefined && (!Number.isInteger(v.session_ttl) || v.session_ttl < 60 || v.session_ttl > 86400))
+    if (v.session_ttl !== undefined &&
+        (!Number.isInteger(v.session_ttl) ||
+            v.session_ttl < 60 ||
+            v.session_ttl > 86400))
         return invalid("session_ttl must be 60-86400 seconds.");
     const roles = readRoles(v.roles);
     if (roles === false)
         return invalid("roles accepts claim, admin and user values.");
     const headers = v.headers;
-    if (headers !== undefined && (!record(headers) || !only(headers, ["user", "email", "name", "groups", "uid"]) || !Object.values(headers).every(headerName))) {
+    if (headers !== undefined &&
+        (!record(headers) ||
+            !only(headers, ["user", "email", "name", "groups", "uid"]) ||
+            !Object.values(headers).every(headerName))) {
         return invalid("headers maps user, email, name, groups and uid to header names.");
     }
     if (v.mode === "header" && !(record(headers) && headers.user))
         return invalid("header mode needs headers.user.");
     const gateway = {
-        sdk: v.sdk, mode: v.mode, upstream: v.upstream, listen: { ...(listen.http ? { http: listen.http } : {}), ...(listen.https ? { https: listen.https } : {}) },
-        passthrough: passthrough, redirects: redirects,
-        ...(v.email_domain ? { email_domain: v.email_domain } : {}), ...(v.session_ttl ? { session_ttl: v.session_ttl } : {}),
-        ...(roles ? { roles } : {}), ...(headers ? { headers: headers } : {}),
+        sdk: v.sdk,
+        mode: v.mode,
+        access,
+        ...(Array.isArray(v.groups) ? { groups: v.groups } : {}),
+        ...(v.max_upload_bytes !== undefined
+            ? { max_upload_bytes: v.max_upload_bytes }
+            : {}),
+        ...(v.response_header_timeout_seconds !== undefined
+            ? {
+                response_header_timeout_seconds: v.response_header_timeout_seconds,
+            }
+            : {}),
+        upstream: v.upstream,
+        listen: {
+            ...(listen.http ? { http: listen.http } : {}),
+            ...(listen.https ? { https: listen.https } : {}),
+        },
+        passthrough: passthrough,
+        redirects: redirects,
+        ...(v.email_domain ? { email_domain: v.email_domain } : {}),
+        ...(v.session_ttl ? { session_ttl: v.session_ttl } : {}),
+        ...(roles ? { roles } : {}),
+        ...(headers ? { headers: headers } : {}),
     };
     if (v.mode === "oidc") {
         const o = v.oidc;
-        if (!record(o) || !only(o, ["issuer_port", "clients", "rewrite_json"]) || !port(o.issuer_port) || !Array.isArray(o.clients) || !o.clients.length || o.clients.length > 16) {
+        if (!record(o) ||
+            !only(o, ["issuer_port", "clients", "rewrite_json"]) ||
+            !port(o.issuer_port) ||
+            !Array.isArray(o.clients) ||
+            !o.clients.length ||
+            o.clients.length > 16) {
             return invalid("oidc mode needs oidc.issuer_port and clients.");
         }
         const clients = o.clients.map(readClient);
-        if (clients.some(c => !c) || new Set(clients.map(c => c.id)).size !== clients.length)
+        if (clients.some((c) => !c) ||
+            new Set(clients.map((c) => c.id)).size !== clients.length)
             return invalid("each oidc client needs a unique id and redirect_paths (local paths) or native_redirects (custom schemes).");
         const rewrite = o.rewrite_json ?? [];
-        if (!Array.isArray(rewrite) || !rewrite.every(r => record(r) && only(r, ["method", "path", "field"]) && /^[A-Z]{3,7}$/.test(String(r.method)) && localPath(r.path) && name(r.field))) {
+        if (!Array.isArray(rewrite) ||
+            !rewrite.every((r) => record(r) &&
+                only(r, ["method", "path", "field"]) &&
+                /^[A-Z]{3,7}$/.test(String(r.method)) &&
+                localPath(r.path) &&
+                name(r.field))) {
             return invalid("oidc.rewrite_json entries are { method, path, field }.");
         }
-        gateway.oidc = { issuer_port: o.issuer_port, clients: clients, rewrite_json: rewrite };
+        gateway.oidc = {
+            issuer_port: o.issuer_port,
+            clients: clients,
+            rewrite_json: rewrite,
+        };
     }
     if (v.mode === "token") {
         const t = v.token;
-        const args = record(t) ? t.args ?? [] : [];
-        if (!record(t) || !only(t, ["exec", "args"]) || !relativeExec(t.exec) || !strings(args, token))
+        const args = record(t) ? (t.args ?? []) : [];
+        if (!record(t) ||
+            !only(t, ["exec", "args"]) ||
+            !relativeExec(t.exec) ||
+            !strings(args, token))
             return invalid("token mode needs token.exec, a program in the daemon payload.");
-        if (!Object.values(daemon.targets).every(dir => existsSync(join(dir, t.exec))))
+        if (!Object.keys(daemon.targets).length ||
+            !Object.values(daemon.targets).every((dir) => existsSync(join(dir, t.exec))))
             return invalid(`token.exec ${t.exec} is not in the daemon payload.`);
         gateway.token = { exec: t.exec, args: args };
     }
@@ -149,13 +289,16 @@ export function readIdentityGateway(value, daemon, fail) {
             return invalid(account);
         gateway.account = account;
     }
-    if (Object.values(daemon.targets).some(dir => { try {
-        lstatSync(join(dir, GATEWAY_PAYLOAD_DIR));
-        return true;
-    }
-    catch {
-        return false;
-    } })) {
+    if (!packagedPayload &&
+        Object.values(daemon.targets).some((dir) => {
+            try {
+                lstatSync(join(dir, GATEWAY_PAYLOAD_DIR));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        })) {
         return invalid(`the daemon payload must not contain ${GATEWAY_PAYLOAD_DIR}/, where the gateway is installed.`);
     }
     return gateway;
@@ -164,26 +307,70 @@ const packageDest = (m) => `/var/packages/${m.package}/target`;
 /** target/sso/gateway.json, the SDK gateway's configuration (idgateway.Config). */
 export function identityGatewayConfig(m) {
     const g = m.identityGateway;
-    return JSON.stringify({
-        package: m.package, mode: g.mode, upstream: `http://127.0.0.1:${g.upstream}`, listen: g.listen,
-        authorize_cgi: `/webman/3rdparty/${m.package}/sso/authorize.cgi`, state_dir: `/var/packages/${m.package}/var/sso`,
-        passthrough: g.passthrough, redirects: g.redirects,
-        ...(g.email_domain ? { email_domain: g.email_domain } : {}), ...(g.session_ttl ? { session_ttl_seconds: g.session_ttl } : {}),
-        ...(g.roles ? { roles: g.roles } : {}), ...(g.headers ? { headers: g.headers } : {}),
+    return (JSON.stringify({
+        package: m.package,
+        mode: g.mode,
+        access: g.access ?? "dsm-users",
+        ...(g.groups ? { groups: g.groups } : {}),
+        ...(m.entry ? { entry: m.entry } : {}),
+        ...(m.compose?.plan.mounts_blocked ? { compose_blocked: true } : {}),
+        ...(g.max_upload_bytes ? { max_upload_bytes: g.max_upload_bytes } : {}),
+        ...(g.response_header_timeout_seconds
+            ? { response_header_timeout_seconds: g.response_header_timeout_seconds }
+            : {}),
+        upstream: m.compose?.plan.ingress
+            ? `http://${m.compose.plan.ingress.address}:${m.compose.plan.ingress.port}`
+            : `http://127.0.0.1:${g.upstream}`,
+        ...(m.compose?.plan.ingress
+            ? { compose_ingress: { candidate: m.compose.plan.ingress.candidate } }
+            : {}),
+        listen: g.listen,
+        authorize_cgi: `/webman/3rdparty/${m.package}/sso/authorize.cgi`,
+        state_dir: `/var/packages/${m.package}/var/sso`,
+        passthrough: g.passthrough,
+        redirects: g.redirects,
+        ...(g.email_domain ? { email_domain: g.email_domain } : {}),
+        ...(g.session_ttl ? { session_ttl_seconds: g.session_ttl } : {}),
+        ...(g.roles ? { roles: g.roles } : {}),
+        ...(g.headers ? { headers: g.headers } : {}),
         ...(g.oidc ? { oidc: g.oidc } : {}),
-        ...(g.token ? { token: { command: [`${packageDest(m)}/daemon/payload/${g.token.exec}`, ...g.token.args] } } : {}),
-        ...(g.account ? { account: {
-                var_dir: `/var/packages/${m.package}/var`,
-                on_delete: g.account.on_delete.map(a => "remove" in a ? a : { exec: [`${packageDest(m)}/daemon/payload/${a.exec[0]}`, ...a.exec.slice(1)] }),
-            } } : {}),
-    }) + "\n";
+        ...(g.token
+            ? {
+                token: {
+                    command: [
+                        `${packageDest(m)}/daemon/payload/${g.token.exec}`,
+                        ...g.token.args,
+                    ],
+                },
+            }
+            : {}),
+        ...(g.account
+            ? {
+                account: {
+                    var_dir: `/var/packages/${m.package}/var`,
+                    on_delete: g.account.on_delete.map((a) => "remove" in a
+                        ? a
+                        : {
+                            exec: [
+                                `${packageDest(m)}/daemon/payload/${a.exec[0]}`,
+                                ...a.exec.slice(1),
+                            ],
+                        }),
+                },
+            }
+            : {}),
+    }) + "\n");
 }
 /** The daemon as the controller runs it: the gateway, with the App as its child. */
 export function gatewayDaemon(daemon) {
     const app = `\${SYNOPKG_PKGDEST}/daemon/payload/${daemon.exec}`;
     return {
-        ...daemon, exec: GATEWAY_EXEC, args: ["run", "--", app, ...daemon.args],
-        ...(daemon.uninstall_args ? { uninstall_args: ["exec", "--", app, ...daemon.uninstall_args] } : {}),
+        ...daemon,
+        exec: GATEWAY_EXEC,
+        args: ["run", "--", app, ...daemon.args],
+        ...(daemon.uninstall_args
+            ? { uninstall_args: ["exec", "--", app, ...daemon.uninstall_args] }
+            : {}),
     };
 }
 /** Builds the gateway from the declared SDK release with the pinned Go, binding its config path. */
@@ -199,8 +386,18 @@ export async function buildIdentityGateway(m, arch, work, run) {
     }
     const out = join(work, `identity-gateway-${arch}`);
     const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}`;
-    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, GATEWAY_MAIN], {
-        cwd: sdk.goDir, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
+    const result = await run("go", [
+        "build",
+        "-trimpath",
+        "-buildvcs=false",
+        "-ldflags",
+        ldflags,
+        "-o",
+        out,
+        GATEWAY_MAIN,
+    ], {
+        cwd: sdk.goDir,
+        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED", `identity gateway (SDK ${sdk.version} ${GATEWAY_MAIN}, ${arch}) build failed; that SDK version must contain the gateway. ${PINNED_GO_HINT}\n${result.stderr}`);
@@ -213,3 +410,22 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED", toolchain);
     return out;
 }
+/** The manifest form of a normalized gateway, retained for artifact inspection. */
+export function identityGatewayDeclaration(g) {
+    if (!g)
+        return undefined;
+    return {
+        ...g,
+        ...(g.oidc
+            ? {
+                oidc: {
+                    ...g.oidc,
+                    clients: g.oidc.clients.map(({ require_pkce, ...c }) => ({
+                        ...c,
+                        pkce: require_pkce,
+                    })),
+                },
+            }
+            : {}),
+    };
+}

package/dist/standalone/inspect-spk.d.ts

@@ -1,4 +1,5 @@
 import { type WebLaunchMode } from "../contract/web-launch.js";
+import { type ComposeApp } from "./compose.js";
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
 import { type AppScriptName } from "./app-scripts.js";
 import type { EntryMode } from "./manifest.js";
@@ -23,6 +24,17 @@ export interface SpkInspection {
         name: string;
         requiresAdminApproval: boolean;
     }>;
+    compose?: {
+        ingress?: ComposeApp["plan"]["ingress"];
+        images: unknown[];
+        services: unknown[];
+        mountsBlocked: boolean;
+        acceptanceBlockers: string[];
+        readiness: {
+            profile: string;
+            limitation: string;
+        };
+    };
     executor?: ExecutorInspection;
     uninstallCleanup?: UninstallCleanupItem[];
     /** Application Portal entry; inactive until an administrator applies the alias. */