@synopackageland/cli 0.14.1 → 0.15.1

package/dist/compose/analyze.js

@@ -1,49 +1,13 @@
-import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+const DIGEST_PINNED_IMAGE = /@sha256:[a-f0-9]{64}$/;
+import { existsSync, readFileSync } from "node:fs";
 import { parseDocument } from "yaml";
-import { composeSpan, makeError } from "../errors.js";
-import { collectInstallParameters, loadContract } from "../contract/load.js";
-import { undeclaredPrivilegeFindings } from "./privilege.js";
-import { scanComposePrivilege } from "./privilege.js";
-const DOCKER_SOCKET_PATHS = [
-    "/var/run/docker.sock",
-    "/var/run/docker.sock/",
-    "/var/run/containers/container-manager.sock",
-    "/var/run/containers/container-manager.sock/",
-];
-const composeProjectRoots = new WeakMap();
-const composeSources = new WeakMap();
-const composeDocuments = new WeakMap();
-const composeContracts = new WeakMap();
-const HOST_BIND_ERROR_CODES = new Set([
-    "COMPOSE_BIND_SOURCE_FORBIDDEN",
-    "COMPOSE_BIND_SOURCE_UNDECLARED",
-    "COMPOSE_BIND_SUFFIX_INVALID",
-    "COMPOSE_HOST_BIND_FORBIDDEN",
-    "COMPOSE_NAMED_VOLUME_UNDECLARED",
-]);
-export function loadCompose(composePath) {
-    if (!existsSync(composePath)) {
+/** Raw structural utilities for tooling; SDK compose owns all runtime policy. */
+export function loadCompose(path) {
+    if (!existsSync(path))
         return null;
-    }
-    const source = readFileSync(composePath, "utf8");
-    const doc = parseDocument(source);
-    const compose = (doc.toJSON() ?? {});
-    if (compose && typeof compose === "object") {
-        composeProjectRoots.set(compose, dirname(resolve(composePath)));
-        composeSources.set(compose, source);
-        composeDocuments.set(compose, doc);
-        const contractPath = join(dirname(resolve(composePath)), "synology-app.yaml");
-        if (existsSync(contractPath)) {
-            try {
-                composeContracts.set(compose, loadContract(contractPath).contract);
-            }
-            catch {
-                // Contract validation reports malformed input; Compose analysis still returns its own findings.
-            }
-        }
-    }
-    return { compose, source, document: doc };
+    const source = readFileSync(path, "utf8");
+    const document = parseDocument(source);
+    return { compose: document.toJSON() ?? {}, source, document };
 }
 export function listServiceNames(compose) {
     if (!compose.services || typeof compose.services !== "object") {
@@ -90,36 +54,53 @@ function splitPortEntry(entry) {
         if (hostIp === undefined && parts.length === 3) {
             hostIp = parts.shift();
         }
-        return { ...(hostIp ? { hostIp } : {}), hostPort: parts[0], containerPort: parts[parts.length - 1] };
+        return {
+            ...(hostIp ? { hostIp } : {}),
+            hostPort: parts[0],
+            containerPort: parts[parts.length - 1],
+        };
     }
     if (entry && typeof entry === "object") {
         const record = entry;
-        const hostIp = typeof record.host_ip === "string" && record.host_ip ? record.host_ip : undefined;
+        const hostIp = typeof record.host_ip === "string" && record.host_ip
+            ? record.host_ip
+            : undefined;
         const published = record.published ?? record.target;
         return {
             ...(hostIp ? { hostIp } : {}),
-            ...(typeof published === "number" || typeof published === "string" ? { hostPort: String(published) } : {}),
-            ...(typeof record.target === "number" ? { containerPort: String(record.target) } : {}),
+            ...(typeof published === "number" || typeof published === "string"
+                ? { hostPort: String(published) }
+                : {}),
+            ...(typeof record.target === "number"
+                ? { containerPort: String(record.target) }
+                : {}),
         };
     }
     return null;
 }
 function parsePortEntry(entry) {
-    if (entry && typeof entry === "object" && typeof entry.published === "string") {
+    if (entry &&
+        typeof entry === "object" &&
+        typeof entry.published === "string") {
         return null;
     }
     const hostPort = Number(splitPortEntry(entry)?.hostPort);
     return Number.isInteger(hostPort) ? hostPort : null;
 }
 function isLoopbackAddress(address) {
-    return address !== undefined && (address === "::1" || /^127(\.\d{1,3}){3}$/.test(address));
+    return (address !== undefined &&
+        (address === "::1" || /^127(\.\d{1,3}){3}$/.test(address)));
 }
 /** Every way a Compose service is reachable from outside its container network. */
 export function listPortExposures(compose) {
     const exposures = [];
     for (const [service, definition] of Object.entries(compose.services ?? {})) {
         if (definition.network_mode === "host") {
-            exposures.push({ service, entry: "network_mode: host", loopbackOnly: false });
+            exposures.push({
+                service,
+                entry: "network_mode: host",
+                loopbackOnly: false,
+            });
         }
         const ports = definition.ports;
         for (const entry of ports ? (Array.isArray(ports) ? ports : [ports]) : []) {
@@ -129,7 +110,9 @@ export function listPortExposures(compose) {
                 service,
                 entry: typeof entry === "string" ? entry : JSON.stringify(entry),
                 ...(hostPort === null ? {} : { hostPort }),
-                ...(parsed?.containerPort ? { containerPort: parsed.containerPort } : {}),
+                ...(parsed?.containerPort
+                    ? { containerPort: parsed.containerPort }
+                    : {}),
                 loopbackOnly: isLoopbackAddress(parsed?.hostIp),
             });
         }
@@ -150,83 +133,6 @@ export function collectPublishedTcpPorts(compose) {
     }
     return result;
 }
-/**
- * Checks if a Compose contract and document are eligible for the zero-config DSM resource-worker path.
- * Zero-config slice rejects:
- * - any install parameter
- * - any ${...} interpolation anywhere in compose document
- * - compose secrets or configs
- * - build: stanzas
- * - privileged / host network / device / root-like capabilities
- * - any non-headless App without a unique literal published adminport status probe
- */
-export function resourceWorkerEligibility(contract, compose) {
-    const reasons = [];
-    const headless = contract.adminport === undefined && collectPublishedTcpPorts(compose).size === 0;
-    if (contract.install && Object.keys(contract.install).length > 0) {
-        reasons.push("HAS_INSTALL_PARAMETERS");
-    }
-    if (hasInterpolation(compose)) {
-        reasons.push("HAS_COMPOSE_INTERPOLATION");
-    }
-    if ((compose.secrets && Object.keys(compose.secrets).length > 0) ||
-        (compose.configs && typeof compose.configs === "object" && Object.keys(compose.configs).length > 0)) {
-        reasons.push("HAS_COMPOSE_SECRETS_OR_CONFIGS");
-    }
-    if (hasBuildStanza(compose)) {
-        reasons.push("HAS_BUILD_STANZA");
-    }
-    if (scanComposePrivilege(compose).length > 0) {
-        reasons.push("HAS_PRIVILEGED_CAPABILITY");
-    }
-    let resolvedAdminport;
-    if (contract.adminport === undefined) {
-        if (!headless) {
-            reasons.push("WEB_APP_MISSING_OR_AMBIGUOUS_ADMINPORT");
-        }
-    }
-    else {
-        const rawPort = Number(contract.adminport);
-        if (!Number.isInteger(rawPort) || rawPort <= 0 || rawPort > 65535) {
-            reasons.push("WEB_APP_MISSING_OR_AMBIGUOUS_ADMINPORT");
-        }
-        else {
-            const published = collectPublishedTcpPorts(compose);
-            const services = published.get(rawPort) ?? [];
-            if (services.length !== 1) {
-                reasons.push("WEB_APP_MISSING_OR_AMBIGUOUS_ADMINPORT");
-            }
-            else {
-                resolvedAdminport = rawPort;
-            }
-        }
-    }
-    return {
-        eligible: reasons.length === 0,
-        reasons,
-        headless,
-        adminport: resolvedAdminport,
-    };
-}
-function hasInterpolation(value) {
-    if (typeof value === "string") {
-        return /\$\{([^}]+)\}/.test(value);
-    }
-    if (Array.isArray(value)) {
-        return value.some(hasInterpolation);
-    }
-    if (value && typeof value === "object") {
-        return Object.values(value).some(hasInterpolation);
-    }
-    return false;
-}
-function hasBuildStanza(compose) {
-    if (!compose.services) {
-        return false;
-    }
-    return Object.values(compose.services).some((service) => "build" in service && service.build !== undefined);
-}
-const DIGEST_PINNED_IMAGE = /@sha256:[0-9a-f]{64}$/i;
 /** Service images a registry can move: anything without a trailing `@sha256:<64 hex>` digest. */
 export function collectUnpinnedImages(compose) {
     const unpinned = [];
@@ -238,650 +144,3 @@ export function collectUnpinnedImages(compose) {
     }
     return unpinned;
 }
-const HEADLESS_UNSUPPORTED_REASONS = new Set([
-    "HAS_COMPOSE_SECRETS_OR_CONFIGS",
-    "HAS_BUILD_STANZA",
-    "HAS_PRIVILEGED_CAPABILITY",
-]);
-const HEADLESS_PACKAGE_ONLY_PARAMETER_TYPES = new Set([
-    "string",
-    "boolean",
-    "shared_folder",
-    "dsm_user",
-    "posix_all_shares",
-]);
-/**
- * Chooses the local route D0 can safely emit. The first dynamic slice is
- * deliberately small: only string/boolean wizard answers interpolated as
- * ordinary Compose values. Secrets/configs remain rejected because the live
- * DSM worker does not load docker-compose.override.yml, and no secret may be
- * placed in the project .env.
- */
-export function classifyComposeRoute(contract, parsed, composeFile = "compose.yaml") {
-    const eligibility = resourceWorkerEligibility(contract, parsed.compose);
-    const hasHeadlessUnsupportedParameter = collectInstallParameters(contract).some(({ param }) => !HEADLESS_PACKAGE_ONLY_PARAMETER_TYPES.has(String(param.type)));
-    const headlessPackageOnly = eligibility.headless &&
-        !hasHeadlessUnsupportedParameter &&
-        !eligibility.reasons.some((reason) => HEADLESS_UNSUPPORTED_REASONS.has(reason));
-    const localRoute = contract.adminport !== undefined || headlessPackageOnly;
-    const rejectErrors = localRoute
-        ? collectRouteRejectErrors(contract, parsed, composeFile)
-        : [];
-    if (rejectErrors.length > 0) {
-        return { route: "reject", eligibility, errors: rejectErrors };
-    }
-    const dynamicError = localRoute
-        ? collectDynamicRouteError(contract, parsed, composeFile)
-        : undefined;
-    if (dynamicError) {
-        return {
-            route: "reject",
-            eligibility,
-            errors: [dynamicError],
-        };
-    }
-    if (eligibility.eligible) {
-        return { route: "static-zero-config", eligibility, errors: [] };
-    }
-    if ((eligibility.adminport !== undefined || headlessPackageOnly) &&
-        (collectInstallParameters(contract).length > 0 || hasInterpolation(parsed.compose))) {
-        return { route: "dynamic", eligibility, errors: [] };
-    }
-    return { route: "reject", eligibility, errors: [makeError("COMPOSE_ROUTE_UNSUPPORTED", composeSpanForPath(parsed.compose, composeFile, "services"), `DSM resource worker cannot manage this Compose: ${eligibility.reasons.join(", ")}`, "Use prebuilt images, supported install parameters and DSM docker-project resources.")] };
-}
-function collectRouteRejectErrors(contract, parsed, composeFile) {
-    const { compose } = parsed;
-    const errors = collectPermanentRouteErrors(contract, parsed, composeFile);
-    const installParams = collectInstallParameters(contract);
-    const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
-    const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
-    const posixAllSharesParams = new Set(installParams
-        .filter(({ param }) => param.type === "posix_all_shares")
-        .map(({ name }) => name));
-    const installParamNames = new Set(installParams.map(({ name }) => name));
-    errors.push(...validateComposeHostBinds(compose, composeFile, {
-        sharedFolderParams,
-        homesParams,
-        posixAllSharesParams,
-        installParamNames,
-    }));
-    return dedupeValidationErrors(errors);
-}
-function collectPermanentRouteErrors(contract, parsed, composeFile) {
-    const headless = contract.adminport === undefined && collectPublishedTcpPorts(parsed.compose).size === 0;
-    if (contract.adminport === undefined && !headless) {
-        return [];
-    }
-    const { compose } = parsed;
-    const errors = [];
-    const dsmUserParams = collectInstallParameters(contract).filter(({ param }) => param.type === "dsm_user");
-    if (compose.services) {
-        for (const [serviceName, service] of Object.entries(compose.services)) {
-            const basePath = `services.${serviceName}`;
-            if ("build" in service && service.build !== undefined) {
-                const path = `${basePath}.build`;
-                errors.push(makeError("COMPOSE_BUILD_FORBIDDEN", composeSpanForPath(compose, composeFile, path), `service "${serviceName}" declares build:; the D0 route does not support install-time build.`, "Remove build: and use an existing image (preferably pinned with image@sha256:...), then run check again."));
-            }
-            if (dsmUserParams.length > 0 && typeof service.user === "string" && service.user.trim() !== "") {
-                const path = `${basePath}.user`;
-                errors.push(makeError("COMPOSE_USER_CONFLICTS_DSM_USER", composeSpanForPath(compose, composeFile, path), `service "${serviceName}" defines user: "${service.user.trim()}", which conflicts with the dsm_user declared in the contract.`, "Remove the user field from Compose; the generator injects user: \"${NAME_UID}:${NAME_GID}\" and group_add from dsm_user."));
-            }
-            errors.push(...validateSocketMounts(compose, service, composeFile, `${basePath}.volumes`));
-        }
-    }
-    for (const finding of scanComposePrivilege(compose)) {
-        errors.push(makeError(finding.code, composeSpanForPath(compose, composeFile, finding.path), `service "${finding.serviceName}" uses ${finding.flag}; the D0 route permanently rejects high-privilege capabilities, even when the contract declares them.`, "Remove privileged, host network/PID/IPC, devices or cap_add, and use a package-only static-zero-config Compose."));
-    }
-    return errors;
-}
-function collectDynamicRouteError(contract, parsed, composeFile) {
-    const { compose } = parsed;
-    const params = collectInstallParameters(contract);
-    const hasUnsupportedComposeFiles = hasComposeSecretsOrConfigs(compose);
-    const supportedParamNames = new Set(params
-        .filter(({ name, param }) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
-        (param.type === "string" ||
-            param.type === "boolean" ||
-            param.type === "shared_folder" ||
-            param.type === "dsm_user" ||
-            param.type === "posix_all_shares"))
-        .map(({ name }) => name));
-    const dsmUserParam = params.find(({ param }) => param.type === "dsm_user");
-    const dsmUserDerivedNames = dsmUserParam
-        ? [
-            `${dsmUserParam.name}_UID`,
-            `${dsmUserParam.name}_GID`,
-            ...Array.from({ length: 8 }, (_, i) => `${dsmUserParam.name}_GROUP_${i + 1}`),
-        ]
-        : [];
-    const unsupportedParam = params.find(({ name, param }) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ||
-        (param.type !== "string" &&
-            param.type !== "boolean" &&
-            param.type !== "shared_folder" &&
-            param.type !== "dsm_user" &&
-            param.type !== "posix_all_shares"));
-    const supportedInterpolationNames = new Set([
-        ...supportedParamNames,
-        ...dsmUserDerivedNames,
-        ...PLATFORM_BIND_VARS,
-    ]);
-    const interpolations = collectComposeInterpolations(compose);
-    const hasComposeInterpolation = hasInterpolation(compose);
-    const unsupportedInterpolation = !hasComposeInterpolation
-        ? undefined
-        : interpolations.size === 0
-            ? "<unsupported interpolation syntax>"
-            : [...interpolations].find((name) => !supportedInterpolationNames.has(name));
-    const hasDynamicInputs = params.length > 0 ||
-        hasUnsupportedComposeFiles ||
-        unsupportedInterpolation !== undefined;
-    if (!hasDynamicInputs) {
-        return undefined;
-    }
-    if (!unsupportedParam && !unsupportedInterpolation && !hasUnsupportedComposeFiles) {
-        return undefined;
-    }
-    const reasons = [];
-    if (unsupportedParam) {
-        reasons.push("unsupported install parameter type: " + String(unsupportedParam.param.type ?? "unknown"));
-    }
-    if (unsupportedInterpolation) {
-        reasons.push("unsupported interpolation: " + unsupportedInterpolation);
-    }
-    if (hasUnsupportedComposeFiles) {
-        reasons.push("Compose secret/config (DSM override route is not loaded)");
-    }
-    const reasonText = reasons.join(", ");
-    const dynamicPath = findDynamicComposePath(compose);
-    const path = dynamicPath ?? (hasUnsupportedComposeFiles ? "secrets" : "services");
-    const undeclaredName = unsupportedInterpolation && !unsupportedInterpolation.startsWith("<")
-        ? unsupportedInterpolation
-        : undefined;
-    const interpolationSuggestion = undeclaredName
-        ? `Declare ${undeclaredName} in the synology-app.yaml install with type string or boolean, or remove the reference from Compose.`
-        : "Use only the ${NAME} form and declare the matching string or boolean parameter in the synology-app.yaml install.";
-    return makeError("COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED", composeSpanForPath(compose, composeFile, path), "The Compose dynamic route contains an input outside the D1/D2 allowlist (" +
-        reasonText +
-        "); this route is rejected and does not silently fall back to another execution mode.", undeclaredName
-        ? interpolationSuggestion
-        : `${interpolationSuggestion} secret/config are rejected because the DSM worker does not read docker-compose.override.yml; remove them and run check again.`);
-}
-function parsedComposeForAnalysis(compose) {
-    const source = composeSources.get(compose) ?? "";
-    const document = composeDocuments.get(compose) ?? parseDocument(source);
-    return { compose, source, document };
-}
-function hasComposeSecretsOrConfigs(compose) {
-    return Boolean((compose.secrets && Object.keys(compose.secrets).length > 0) ||
-        (compose.configs && typeof compose.configs === "object" && Object.keys(compose.configs).length > 0));
-}
-function findDynamicComposePath(compose) {
-    const path = findInterpolationPath(compose, []);
-    if (!path || path.length === 0) {
-        return undefined;
-    }
-    if (path[0] === "services" && path.length >= 3) {
-        return path.slice(0, 3).join(".");
-    }
-    return path.join(".");
-}
-function findInterpolationPath(value, path) {
-    if (typeof value === "string" && /\$\{([^}]+)\}/.test(value)) {
-        return path;
-    }
-    if (Array.isArray(value)) {
-        for (let index = 0; index < value.length; index++) {
-            const found = findInterpolationPath(value[index], [...path, String(index)]);
-            if (found) {
-                return found;
-            }
-        }
-        return undefined;
-    }
-    if (value && typeof value === "object") {
-        for (const [key, child] of Object.entries(value)) {
-            const found = findInterpolationPath(child, [...path, key]);
-            if (found) {
-                return found;
-            }
-        }
-    }
-    return undefined;
-}
-function composeSpanForPath(compose, composeFile, path) {
-    const fallback = composeSpan(composeFile, 1, 1, path);
-    const document = composeDocuments.get(compose);
-    const source = composeSources.get(compose);
-    if (!document || source === undefined) {
-        return fallback;
-    }
-    const offset = composeKeyOffset(document.contents, path.split("."));
-    if (offset === undefined) {
-        return fallback;
-    }
-    const position = lineColumnFromSource(source, offset);
-    return composeSpan(composeFile, position.line, position.column, path);
-}
-function composeKeyOffset(node, path) {
-    let current = node;
-    for (const segment of path) {
-        const items = current && Array.isArray(current.items) ? current.items : [];
-        const pair = items.find((item) => {
-            const key = item?.key;
-            return key && String(key.value) === segment;
-        });
-        if (!pair) {
-            return undefined;
-        }
-        if (segment === path[path.length - 1]) {
-            return pair.key?.range?.[0];
-        }
-        current = pair.value;
-    }
-    return undefined;
-}
-function lineColumnFromSource(source, offset) {
-    let line = 1;
-    let column = 1;
-    for (let index = 0; index < offset && index < source.length; index++) {
-        if (source[index] === "\n") {
-            line++;
-            column = 1;
-        }
-        else {
-            column++;
-        }
-    }
-    return { line, column };
-}
-function dedupeValidationErrors(errors) {
-    const seen = new Set();
-    return errors.filter((error) => {
-        const key = validationErrorKey(error);
-        if (seen.has(key)) {
-            return false;
-        }
-        seen.add(key);
-        return true;
-    });
-}
-function validationErrorKey(error) {
-    return [error.code, error.span.file, error.span.line, error.span.column, error.span.path].join("\u0000");
-}
-export function collectComposeInterpolations(compose) {
-    const names = new Set();
-    walkForInterpolation(compose, names);
-    return names;
-}
-function walkForInterpolation(value, names) {
-    if (typeof value === "string") {
-        for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)) {
-            names.add(match[1]);
-        }
-        return;
-    }
-    if (Array.isArray(value)) {
-        for (const item of value) {
-            walkForInterpolation(item, names);
-        }
-        return;
-    }
-    if (value && typeof value === "object") {
-        for (const child of Object.values(value)) {
-            walkForInterpolation(child, names);
-        }
-    }
-}
-export function validateComposeSecurity(compose, composeFile, options) {
-    const errors = [];
-    const contract = composeContracts.get(compose);
-    const route = contract
-        ? classifyComposeRoute(contract, parsedComposeForAnalysis(compose), composeFile)
-        : undefined;
-    const routeErrors = route
-        ? route.errors.filter((error) => !HOST_BIND_ERROR_CODES.has(error.code))
-        : [];
-    errors.push(...routeErrors);
-    const routeErrorKeys = new Set(routeErrors.map(validationErrorKey));
-    if (!compose.services) {
-        return errors;
-    }
-    const undeclaredSeverity = options.profile === "listing" ? "error" : "warning";
-    for (const finding of undeclaredPrivilegeFindings(compose, options.declaredPrivilege)) {
-        const error = makeError(finding.code, composeSpanForPath(compose, composeFile, finding.path), finding.message, finding.suggestion, undeclaredSeverity);
-        if (!routeErrorKeys.has(validationErrorKey(error))) {
-            errors.push(error);
-        }
-    }
-    for (const [serviceName, service] of Object.entries(compose.services)) {
-        const basePath = `services.${serviceName}`;
-        for (const error of validateSocketMounts(compose, service, composeFile, basePath)) {
-            if (!routeErrorKeys.has(validationErrorKey(error))) {
-                errors.push(error);
-            }
-        }
-        const dependsOn = normalizeDependsOn(service.depends_on);
-        for (const dependency of dependsOn) {
-            if (!compose.services?.[dependency]) {
-                errors.push(makeError("COMPOSE_SERVICE_NOT_FOUND", composeSpanForPath(compose, composeFile, `${basePath}.depends_on`), `Compose references a service that does not exist: "${dependency}".`, "Fix depends_on, or add the matching service definition."));
-            }
-        }
-    }
-    return errors;
-}
-const COMMAND_ARGUMENT_FIELDS = ["command", "entrypoint"];
-const PURE_NUMERIC_STRING = /^[0-9]+$/;
-/**
- * DSM's Docker Project resource worker can lose YAML quotes while acquiring a
- * project. A quoted numeric command argument can therefore become a number;
- * reject that platform-invalid shape before it reaches the NAS.
- */
-export function validateComposeNumericCommandArgs(compose, composeFile) {
-    const errors = [];
-    if (!compose.services) {
-        return errors;
-    }
-    for (const [serviceName, service] of Object.entries(compose.services)) {
-        const basePath = `services.${serviceName}`;
-        for (const field of COMMAND_ARGUMENT_FIELDS) {
-            const value = service[field];
-            if (!Array.isArray(value)) {
-                continue;
-            }
-            const numericStrings = value.filter((item) => typeof item === "string" && PURE_NUMERIC_STRING.test(item));
-            if (numericStrings.length === 0) {
-                continue;
-            }
-            const quotedValues = numericStrings.map((item) => `"${item}"`).join(", ");
-            errors.push(makeError("COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN", composeSpanForPath(compose, composeFile, `${basePath}.${field}`), `The ${field} array contains the pure numeric string ${quotedValues}. This Compose goes through the DSM Docker Project resource worker; the worker may drop the quotes during a YAML round-trip and turn it into an integer, so project acquire fails.`, `Wrap the whole command in one string, for example ${field}: ["sh", "-c", "httpd -f -p 8080 -h /srv"], or join it with the flag as "-p8080".`));
-        }
-    }
-    return errors;
-}
-function normalizeDependsOn(value) {
-    if (!value) {
-        return [];
-    }
-    if (Array.isArray(value)) {
-        return value.map(String);
-    }
-    if (typeof value === "object") {
-        return Object.keys(value);
-    }
-    return [String(value)];
-}
-function validateSocketMounts(compose, service, composeFile, basePath) {
-    const errors = [];
-    const volumes = normalizeVolumes(service.volumes);
-    for (const mount of volumes) {
-        const source = mount.split(":")[0]?.trim() ?? "";
-        if (isForbiddenSocketMount(source)) {
-            errors.push(makeError("COMPOSE_SOCKET_MOUNT_FORBIDDEN", composeSpanForPath(compose, composeFile, `${basePath}.volumes`), "A Managed Profile does not allow mounting the Docker or Container Manager socket.", "Remove the docker.sock/container-manager socket volume mount."));
-        }
-    }
-    return errors;
-}
-function normalizeVolumes(volumes) {
-    if (!volumes) {
-        return [];
-    }
-    const entries = Array.isArray(volumes) ? volumes : [volumes];
-    return entries
-        .map((entry) => {
-        if (typeof entry === "string") {
-            return entry;
-        }
-        if (entry && typeof entry === "object" && "source" in entry) {
-            return String(entry.source);
-        }
-        return "";
-    })
-        .filter(Boolean);
-}
-function isForbiddenSocketMount(source) {
-    const normalized = source.replace(/\/+$/, "");
-    return DOCKER_SOCKET_PATHS.some((path) => normalized === path.replace(/\/+$/, "") || normalized.endsWith("/docker.sock"));
-}
-/**
- * These are the only implicit interpolation names supplied by the platform.
- * The package-only lifecycle materializer writes both paths; every other
- * ${NAME} must be declared in contract.install as string or boolean.
- */
-const PLATFORM_BIND_VARS = new Set(["SYNOPKG_PKGVAR", "SYNO_APP_SECRETS_DIR"]);
-const INTERPOLATED_SOURCE = /^\$\{([A-Z0-9_]+)\}(.*)$/;
-const VALID_SUFFIX_SEGMENT = /^[A-Za-z0-9._-]+$/;
-function collectNamedVolumeNames(compose) {
-    const volumes = compose.volumes;
-    if (!volumes || typeof volumes !== "object" || Array.isArray(volumes)) {
-        return new Set();
-    }
-    return new Set(Object.keys(volumes));
-}
-export function collectVolumeSourceInterpolations(compose) {
-    const names = new Set();
-    for (const mount of listVolumeMounts(compose)) {
-        const match = mount.source.match(INTERPOLATED_SOURCE);
-        if (match) {
-            names.add(match[1]);
-        }
-    }
-    return names;
-}
-export function validateComposeHostBinds(compose, composeFile, context) {
-    const errors = [];
-    if (!compose.services) {
-        return errors;
-    }
-    const namedVolumes = collectNamedVolumeNames(compose);
-    const projectRoot = composeProjectRoots.get(compose) ?? dirname(resolve(composeFile));
-    for (const [serviceName, service] of Object.entries(compose.services)) {
-        const spanPath = `services.${serviceName}.volumes`;
-        for (const mount of parseVolumeMounts(service.volumes)) {
-            const error = classifyVolumeSource(compose, mount, namedVolumes, context, composeFile, spanPath, projectRoot);
-            if (error) {
-                errors.push(error);
-            }
-        }
-    }
-    return errors;
-}
-function listVolumeMounts(compose) {
-    if (!compose.services) {
-        return [];
-    }
-    const mounts = [];
-    for (const service of Object.values(compose.services)) {
-        mounts.push(...parseVolumeMounts(service.volumes));
-    }
-    return mounts;
-}
-function parseVolumeMounts(volumes) {
-    if (!volumes) {
-        return [];
-    }
-    const entries = Array.isArray(volumes) ? volumes : [volumes];
-    const mounts = [];
-    for (const entry of entries) {
-        if (typeof entry === "string") {
-            const source = parseShortVolumeSource(entry);
-            if (source !== null) {
-                mounts.push({ source });
-            }
-            continue;
-        }
-        if (entry && typeof entry === "object") {
-            const record = entry;
-            if (typeof record.source !== "string" || !record.source.trim()) {
-                continue;
-            }
-            mounts.push({
-                source: record.source.trim(),
-                type: typeof record.type === "string" ? record.type : undefined,
-            });
-        }
-    }
-    return mounts;
-}
-function parseShortVolumeSource(entry) {
-    const trimmed = entry.trim();
-    if (!trimmed) {
-        return null;
-    }
-    const colon = trimmed.indexOf(":");
-    if (colon <= 0) {
-        return null;
-    }
-    return trimmed.slice(0, colon).trim();
-}
-function classifyVolumeSource(compose, mount, namedVolumes, context, composeFile, spanPath, projectRoot) {
-    const source = mount.source;
-    if (!source || isForbiddenSocketMount(source)) {
-        return null;
-    }
-    const span = composeSpanForPath(compose, composeFile, spanPath);
-    if (source.includes("$")) {
-        const match = source.match(INTERPOLATED_SOURCE);
-        const varName = match?.[1];
-        const suffix = match?.[2];
-        if (!varName || suffix === undefined || !isValidatedBindSuffix(suffix)) {
-            return invalidBindSuffix(span);
-        }
-        if (PLATFORM_BIND_VARS.has(varName) ||
-            context.sharedFolderParams.has(varName) ||
-            context.homesParams?.has(varName) ||
-            context.posixAllSharesParams?.has(varName)) {
-            return null;
-        }
-        if (context.installParamNames.has(varName)) {
-            return makeError("COMPOSE_BIND_SOURCE_FORBIDDEN", span, `The parameter "${varName}" cannot be a host bind source.`, "Use ${SYNOPKG_PKGVAR}, ${SYNO_APP_SECRETS_DIR}, an install parameter with type shared_folder, or the platform-resolved type homes slot.");
-        }
-        return makeError("COMPOSE_BIND_SOURCE_UNDECLARED", span, `The volume source references an undeclared parameter "${varName}".`, `Declare ${varName} in the synology-app.yaml install with type shared_folder or homes.`);
-    }
-    if (isProjectRelativePath(source, projectRoot)) {
-        return null;
-    }
-    if (isLiteralHostPath(source)) {
-        return makeError("COMPOSE_HOST_BIND_FORBIDDEN", span, "Writing /volume*, an absolute path or a developer machine path as a Compose volume source is forbidden.", "Use an install parameter with type: shared_folder or homes and take ${PARAM} as the bind source.");
-    }
-    if (mount.type === "tmpfs") {
-        return null;
-    }
-    if (mount.type === "bind") {
-        return makeError("COMPOSE_BIND_SOURCE_FORBIDDEN", span, "Mounting a host source the platform does not allow with type: bind is forbidden.", "Use ${SYNOPKG_PKGVAR}, ${SYNO_APP_SECRETS_DIR} or a ${shared_folder parameter} from the contract.");
-    }
-    if (!namedVolumes.has(source)) {
-        return makeError("COMPOSE_NAMED_VOLUME_UNDECLARED", span, `The short-syntax named volume "${source}" is not declared in the top-level volumes, so it is unclear whether it is a Docker volume or a Share name.`, `Declare ${source} in the top-level volumes, or use \${PARAM} as the shared_folder bind source.`);
-    }
-    return null;
-}
-function invalidBindSuffix(span) {
-    return makeError("COMPOSE_BIND_SUFFIX_INVALID", span, "The path suffix of the volume source is invalid.", "The suffix can only be / followed by one or more [A-Za-z0-9._-] segments, and must not contain .., ${ or an absolute path.");
-}
-function isValidatedBindSuffix(suffix) {
-    if (suffix === "") {
-        return true;
-    }
-    if (suffix.includes("${") || suffix.includes(":")) {
-        return false;
-    }
-    if (!/^(\/[A-Za-z0-9._-]+)+$/.test(suffix)) {
-        return false;
-    }
-    return suffix
-        .split("/")
-        .filter(Boolean)
-        .every((segment) => VALID_SUFFIX_SEGMENT.test(segment) && segment !== "." && segment !== "..");
-}
-function isLiteralHostPath(source) {
-    return source.startsWith("/") || source.startsWith(".") || source.startsWith("~");
-}
-function isProjectRelativePath(source, projectRoot) {
-    if (!source.startsWith("./")) {
-        return false;
-    }
-    const relativeSource = source.slice(2);
-    if (relativeSource.length === 0 ||
-        relativeSource.includes("\0") ||
-        relativeSource.split("/").some((segment) => segment.length === 0 || segment === "..")) {
-        return false;
-    }
-    const projectPath = resolve(projectRoot);
-    const candidatePath = resolve(projectPath, source);
-    if (!isStrictDescendant(candidatePath, projectPath)) {
-        return false;
-    }
-    const realProjectPath = existingRealPath(projectPath);
-    const realCandidatePath = existingRealPath(candidatePath);
-    return (realProjectPath !== undefined &&
-        realCandidatePath !== undefined &&
-        isStrictDescendant(realCandidatePath, realProjectPath));
-}
-function isStrictDescendant(candidatePath, projectPath) {
-    const rel = relative(projectPath, candidatePath);
-    return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !rel.startsWith(sep);
-}
-function existingRealPath(path) {
-    let current = path;
-    while (!existsSync(current)) {
-        const parent = dirname(current);
-        if (parent === current) {
-            return undefined;
-        }
-        current = parent;
-    }
-    try {
-        const realCurrent = realpathSync(current);
-        const missingSuffix = relative(current, path);
-        return resolve(realCurrent, missingSuffix || ".");
-    }
-    catch {
-        return undefined;
-    }
-}
-const NUMERIC_USER = /^(0|[1-9][0-9]*)(:(0|[1-9][0-9]*))?$/;
-const ROOT_USERS = new Set(["0", "0:0", "root"]);
-export function validateComposeRunAs(compose, composeFile, context) {
-    const errors = [];
-    if (!compose.services) {
-        return errors;
-    }
-    for (const [serviceName, service] of Object.entries(compose.services)) {
-        const raw = service.user;
-        if (typeof raw !== "string" || raw.trim() === "") {
-            continue;
-        }
-        const user = raw.trim();
-        const span = composeSpanForPath(compose, composeFile, `services.${serviceName}.user`);
-        if (context.hasDsmUser) {
-            errors.push(makeError("COMPOSE_USER_CONFLICTS_DSM_USER", span, `service "${serviceName}" defines user: "${user}", which conflicts with the dsm_user declared in the contract.`, "Remove the user field from Compose; the generator injects user: \"${NAME_UID}:${NAME_GID}\" and group_add from dsm_user."));
-            continue;
-        }
-        if (user.includes("${")) {
-            continue;
-        }
-        if (context.hasSharedFolder && ROOT_USERS.has(user)) {
-            errors.push(makeError("COMPOSE_USER_ROOT_FORBIDDEN", span, "With a Shared Folder, a container must not write to the Share as uid 0/root.", "Declare dsm_user and use ${NAME_UID}:${NAME_GID} as the Compose user.", "warning"));
-            continue;
-        }
-        if (NUMERIC_USER.test(user)) {
-            errors.push(makeError("COMPOSE_USER_NUMERIC_FORBIDDEN", span, "The contract forbids hard-coded numeric uids.", "Use ${NAME_UID}:${NAME_GID} from the install dsm_user parameter."));
-        }
-    }
-    return errors;
-}
-/** The gateway is the only door: the container's web port must not be reachable except through it. */
-export function validateGatewayPortLoopback(adminport, compose, composeFile) {
-    return listPortExposures(compose)
-        .filter((exposure) => exposure.hostPort === adminport && !exposure.loopbackOnly)
-        .map((exposure) => makeError("COMPOSE_GATEWAY_PORT_EXPOSED", composeSpanForPath(compose, composeFile, `services.${exposure.service}.ports`), `The port ${exposure.entry} of ${exposure.service} binds to every network interface, so the container is reachable without DSM verification.`, `Bind it to loopback only: \"127.0.0.1:${adminport}:${exposure.containerPort ?? adminport}\", or choose public explicitly in integration.web.access in synology-app.yaml.`));
-}
-export function validateAdminPortMapping(adminport, compose, composeFile) {
-    const published = collectPublishedTcpPorts(compose);
-    const services = published.get(adminport) ?? [];
-    if (services.length !== 1) {
-        return [
-            makeError("CONTRACT_ADMINPORT_UNMAPPED", composeSpanForPath(compose, composeFile, `adminport:${adminport}`), `adminport ${adminport} must map to exactly one published TCP port in Compose.`, "Publish the same host port as adminport in compose.yaml and make sure only one service uses it."),
-        ];
-    }
-    return [];
-}