@synopackageland/cli 0.15.4 → 0.17.0

package/dist/init.js

@@ -1,3 +1,4 @@
+import { validateForkRecipe, writeForkScaffold } from "./init-upstream.js";
 import { goChildEnv } from "./runtime/go-env.js";
 import { spawnSync } from "node:child_process";
 import { parse, parseDocument } from "yaml";
@@ -112,6 +113,30 @@ function isTemplateBuildArtifact(path) {
     return (name === "node_modules" || name === "dist" || name === ".go-results.json");
 }
 export function initFromTemplate(template, targetDir, options = {}) {
+    if (options.upstreamFork) {
+        if (template !== "compose" && template !== "native-go")
+            throw new Error("[INIT_OPTIONS_UNSUPPORTED] --upstream-fork supports compose or native-go.");
+        validateForkRecipe(template, options);
+        const packaging = join(targetDir, "synology");
+        if (existsSync(packaging))
+            throw new Error("[INIT_TARGET_NOT_EMPTY] synology/ already exists.");
+        initFromTemplate(template, packaging, {
+            ...options,
+            packageId: options.packageId ?? defaultPackageId(targetDir),
+            displayName: options.displayName ?? defaultDisplayName(targetDir),
+            upstreamFork: false,
+            upstreamImage: undefined,
+        });
+        writeForkScaffold(packaging, template, options);
+        return;
+    }
+    if (options.upstreamImage)
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] Image recipe options require --upstream-fork.");
+    const hasHealth = options.healthPath !== undefined || options.healthStatus !== undefined;
+    if (hasHealth && (template !== "compose" || typeof options.healthPath !== "string" ||
+        !/^\/(?!\/)[^\s#\\]*$/.test(options.healthPath) || !Number.isInteger(options.healthStatus) ||
+        options.healthStatus < 200 || options.healthStatus > 299))
+        throw new Error("[INIT_HEALTH_INVALID] Compose health needs both --health-path /actual-endpoint and --health-status 2xx; redirects are not followed.");
     if (!isTemplateName(template))
         throw new Error(`[INIT_TEMPLATE_UNKNOWN] Unknown template: ${template}`);
     const requested = capabilityNames(options.with ?? []);
@@ -261,6 +286,18 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     if (template === "compose" && options.from)
         importCompose(options.from, targetDir);
+    if (template === "compose") {
+        const path = join(targetDir, "dsm-package.yaml");
+        const doc = parseDocument(readFileSync(path, "utf8"));
+        if (doc.hasIn(["compose", "web"])) {
+            doc.deleteIn(["compose", "web", "health"]);
+            if (hasHealth)
+                doc.setIn(["compose", "web", "health"], { path: options.healthPath, status: options.healthStatus });
+        }
+        writeFileSync(path, String(doc));
+        const guidance = readFileSync(new URL("../assets/init-compose.md", import.meta.url), "utf8");
+        writeFileSync(join(targetDir, "AGENTS.md"), guidance);
+    }
     if (template === "binary") {
         mkdirSync(join(targetDir, "prebuilt"), { recursive: true });
         for (const [arch, goarch] of [
@@ -356,7 +393,6 @@ function importCompose(from, targetDir) {
     if (candidates.length === 1)
         doc.setIn(["compose", "web"], {
             ...candidates[0],
-            health: { path: "/", status: 200 },
         });
     else {
         doc.deleteIn(["compose", "web"]);

package/dist/portal/alias.d.ts

@@ -11,12 +11,8 @@ export declare const PORTAL_ALIAS_MAX = 64;
  * of Synology Apps, as observed on DSM 7.4-90069. DSM stays the authority.
  */
 export declare const RESERVED_PORTAL_ALIASES: readonly string[];
-/**
- * A portal needs the executor tier: DSM removes the alias files on uninstall
- * but leaves nginx serving the alias, and only the root executor purge can
- * reload it. A no-privilege App never runs anything as root.
- */
-export declare const PORTAL_REQUIRES_EXECUTOR = "portal needs the executor level (capabilities.rootOps or delegate): after uninstall DSM does not reload nginx, and a root executor must remove the sign-in alias. An App without an executor should remove portal and let an administrator configure a reverse proxy in DSM.";
+/** DSM below 7.2 refuses unsigned web-config; only an executor can register the entry there. */
+export declare const PORTAL_REQUIRES_EXECUTOR = "portal before DSM 7.2-64570 needs an executor (capabilities.rootOps, delegate or webapi) to register its entry: DSM 7.1 rejects the unsigned web-config worker. Raise os_min_ver to 7.2-64570 or later, add an executor capability, or remove portal. DSM reloads nginx through INFO; a no-privilege App never runs root code.";
 export interface PortalDeclaration {
     alias: string;
 }

package/dist/portal/alias.js

@@ -15,12 +15,8 @@ export const RESERVED_PORTAL_ALIASES = [
     "dsfile", "indexdb", "mobile", "oauth", "scripts", "sharing", "ssdp", "synosdsjslib", "synohdpack", "webapi", "webman",
     "calendar", "chatplus", "contacts", "drive", "file", "photo", "sso", "synologymeet",
 ];
-/**
- * A portal needs the executor tier: DSM removes the alias files on uninstall
- * but leaves nginx serving the alias, and only the root executor purge can
- * reload it. A no-privilege App never runs anything as root.
- */
-export const PORTAL_REQUIRES_EXECUTOR = "portal needs the executor level (capabilities.rootOps or delegate): after uninstall DSM does not reload nginx, and a root executor must remove the sign-in alias. An App without an executor should remove portal and let an administrator configure a reverse proxy in DSM.";
+/** DSM below 7.2 refuses unsigned web-config; only an executor can register the entry there. */
+export const PORTAL_REQUIRES_EXECUTOR = "portal before DSM 7.2-64570 needs an executor (capabilities.rootOps, delegate or webapi) to register its entry: DSM 7.1 rejects the unsigned web-config worker. Raise os_min_ver to 7.2-64570 or later, add an executor capability, or remove portal. DSM reloads nginx through INFO; a no-privilege App never runs root code.";
 export function isPortalAlias(value) {
     return typeof value === "string" && PORTAL_ALIAS_PATTERN.test(value) && !RESERVED_PORTAL_ALIASES.includes(value);
 }

package/dist/portal/info.d.ts

@@ -0,0 +1,4 @@
+/** DSM reloads these services after install, upgrade and uninstall; hooks stay unprivileged. */
+export declare function portalInfoFields(fields: Array<[string, string]>, portal: boolean): Array<[string, string]>;
+/** Check a resource-worker Portal. The legacy app.d registration still needs an executor. */
+export declare function inspectPortalInfo(info: Record<string, string>, hasExecutor: boolean): string[];

package/dist/portal/info.js

@@ -0,0 +1,32 @@
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+const RELOAD_SERVICES = "instuninst_restart_services";
+const NGINX = "nginx.service";
+/** DSM reloads these services after install, upgrade and uninstall; hooks stay unprivileged. */
+export function portalInfoFields(fields, portal) {
+    if (!portal)
+        return fields;
+    const services = [...new Set([...fields.filter(([key]) => key === RELOAD_SERVICES)
+                .flatMap(([, value]) => value.split(/\s+/).filter(Boolean)), NGINX])].join(" ");
+    const result = [];
+    let written = false;
+    for (const [key, value] of fields) {
+        if (key !== RELOAD_SERVICES)
+            result.push([key, value]);
+        else if (!written) {
+            result.push([key, services]);
+            written = true;
+        }
+    }
+    if (!written)
+        result.push([RELOAD_SERVICES, services]);
+    return result;
+}
+/** Check a resource-worker Portal. The legacy app.d registration still needs an executor. */
+export function inspectPortalInfo(info, hasExecutor) {
+    const findings = [];
+    if (!(info[RELOAD_SERVICES] ?? "").split(/\s+/).includes(NGINX))
+        findings.push(`PORTAL_RELOAD_MISSING INFO ${RELOAD_SERVICES} must include ${NGINX} so DSM reloads nginx after uninstall`);
+    if (info.os_min_ver && portalByExecutor(info.os_min_ver) && !hasExecutor)
+        findings.push("PORTAL_REQUIRES_EXECUTOR before DSM 7.2-64570 the portal entry must be registered by an executor; raise os_min_ver or declare an executor capability");
+    return findings;
+}

package/dist/runtime/dsm-version.d.ts

@@ -1,6 +1,6 @@
 /** Self-contained: the same function is embedded in the DSM window. True only
  * when DSM refused a request because this method version is unavailable, the
- * one refusal that may be retried with an older version. DSM 7.1.1 (t-0234)
+ * one refusal that may be retried with an older version. DSM 7.1.1
  * returns 104 for a version above maxVersion and 103 for a method absent at an
  * existing version. Accepts the numeric code and the window's dsm_ form. */
 export declare function versionUnsupported(code: unknown): boolean;

package/dist/runtime/dsm-version.js

@@ -1,6 +1,6 @@
 /** Self-contained: the same function is embedded in the DSM window. True only
  * when DSM refused a request because this method version is unavailable, the
- * one refusal that may be retried with an older version. DSM 7.1.1 (t-0234)
+ * one refusal that may be retried with an older version. DSM 7.1.1
  * returns 104 for a version above maxVersion and 103 for a method absent at an
  * existing version. Accepts the numeric code and the window's dsm_ form. */
 export function versionUnsupported(code) {

package/dist/runtime/executor-digests.json

@@ -1,30 +1,8 @@
 {
-    "0.15.0": {
-        "x86_64": "efe409287770f6b70e7f8465e8767eeb2413b9ab8775020cf4dffb1555d7bf1f",
-        "aarch64": "d68c9889ed2391e918b9c278679ea0a01cd04425528c11090700a3b6341fc543",
-        "armv7": "9149a05efb9f2d7d86a400707099b3d657382b1c0dbad6588be8c500e90445cc",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.15.1": {
-        "x86_64": "4f47fb43f6e60dbad064afb0bbec96dd009fa046670e2c4b590b128a855cb404",
-        "aarch64": "c903b09ad657a838f0c62b6688e65e9094572b22b969770fca92fcc3640a5364",
-        "armv7": "8178d90de7ea720530bb9496e50ed118086b0e57382d84675aadc68f482d219f",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.15.2": {
-        "x86_64": "4f47fb43f6e60dbad064afb0bbec96dd009fa046670e2c4b590b128a855cb404",
-        "aarch64": "c903b09ad657a838f0c62b6688e65e9094572b22b969770fca92fcc3640a5364",
-        "armv7": "8178d90de7ea720530bb9496e50ed118086b0e57382d84675aadc68f482d219f",
+    "0.17.0": {
+        "x86_64": "68f372684997258adc61312f2c353e1a286a6b5aaa556f716b4e6ba6f33893d0",
+        "aarch64": "f6950301e201a4ebc14577a4554fa1b671f90d0f354d1e8809f4d1dafb57c723",
+        "armv7": "e77c9b6ae22ecfa85d9834af3350192e445987265a7ca6c02ca9b01d88a1b4f7",
         "lifecycle": {
             "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
             "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",

package/dist/runtime/sdk-batch.d.ts

@@ -0,0 +1,2 @@
+/** The SDK's plain browser factory, embedded without imposing a TS build on Go Apps. */
+export declare function appSdkBatchRuntime(backend: object, env?: NodeJS.ProcessEnv): string;

package/dist/runtime/sdk-batch.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { appSdkVersion, sdkBelowFloor, sdkSource } from './sdk-source.js';
+/** The SDK's plain browser factory, embedded without imposing a TS build on Go Apps. */
+export function appSdkBatchRuntime(backend, env = process.env) {
+    if (backend.kind === 'binary')
+        return '';
+    const version = appSdkVersion(backend);
+    if (!version || sdkBelowFloor(version))
+        return '';
+    const sdk = sdkSource(version, env);
+    let source;
+    try {
+        source = readFileSync(join(sdk.goDir, 'ts/src/batch.js'), 'utf8');
+    }
+    catch (error) {
+        // Older supported SDKs retain their desktop-only carrier behavior.
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+    return source.replace(/^export function createBatch\(/m, 'function createBatch(');
+}

package/dist/runtime/uninstall-cleanup.js

@@ -16,7 +16,7 @@ export function uninstallCleanup(pkg, { executor = false, portal = false, portal
         executor
             ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
             : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
-        ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
+        ...(portal ? [{ target: `${pkg} Login Portal alias`, condition: 'Only if automatic cleanup failed and the alias still opens a DSM page after the asynchronous reload.', action: 'DSM removes the alias configuration and reloads the web server automatically through INFO instuninst_restart_services. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
         ...(executor && portalEntry ? [{ target: `${pkg} Application Portal entry`, condition: 'After uninstall, if the executor was not running or was never approved, so it could not remove the entry.', action: `Administrator, as root: ${portalEntryCleanupCommands(pkg).join('; ')}` }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];

package/dist/skill.js

@@ -14,6 +14,7 @@ const SKILL_CATALOG = [
         file: "reference/compose.md",
         when: "Upstream Compose with the SDK planner, fixed identity and support boundary",
     },
+    { id: "upstream-fork", file: "reference/upstream-fork.md", when: "Package an upstream source fork without changing upstream files" },
     {
         id: "wrap",
         file: "reference/wrap.md",

package/dist/standalone/build.js

@@ -1,3 +1,4 @@
+import { PORTAL_REQUIRES_EXECUTOR } from "../portal/alias.js";
 import { buildApiDescription } from "./api-description.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { spawn } from "node:child_process";
@@ -10,7 +11,7 @@ import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM,
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest, } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
-import { buildComposeControl, lockComposeImages, dsmComposeProblem, } from "./compose.js";
+import { buildComposeControl, buildComposeStorageInit, lockComposeImages, dsmComposeProblem, } from "./compose.js";
 import { buildDaemonControl } from "./daemon.js";
 import { buildIdentityGateway } from "./identity-gateway.js";
 import { buildExecutor } from "../runtime/executor-build.js";
@@ -113,6 +114,10 @@ export async function buildStandalone(options) {
         !isDsmAtLeast(manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
+    if (manifest.portal && portalByExecutor(manifest.os_min_ver) &&
+        !manifest.capabilities.rootOps && !manifest.capabilities.delegate && !manifest.capabilities.webapi) {
+        throw new StandaloneBuildError("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
+    }
     if (manifest.compose && !isDsmAtLeast(manifest.os_min_ver, "7.2.1-69057"))
         throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose identity_gateway requires DSM >= 7.2.1.");
     const composeProblem = manifest.compose && dsmComposeProblem(manifest.compose);
@@ -148,6 +153,7 @@ export async function buildStandalone(options) {
             const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
             const identityGateway = await buildIdentityGateway(manifest, arch, archWork, run);
             const composeControl = await buildComposeControl(manifest, arch, archWork, run);
+            const composeStorageInit = await buildComposeStorageInit(manifest, arch, archWork, run);
             // A portal needs the executor, so the executor's SDK carries the panel text.
             const portalText = manifest.portal && executor
                 ? portalCatalogs(sdkSource(executor.sdk).goDir)
@@ -160,6 +166,7 @@ export async function buildStandalone(options) {
                 daemonControl,
                 identityGateway,
                 composeControl,
+                composeStorageInit,
                 backgroundWorker,
                 executor,
                 app,

package/dist/standalone/compose-errors.js

@@ -1,5 +1,20 @@
 /** SDK planner errors accepted at this versioned tool boundary. */
 export const COMPOSE_ERRORS = {
+    COMPOSE_STORAGE_INIT_INVALID: {
+        code: "COMPOSE_STORAGE_INIT_INVALID",
+        description: "The container storage initialization declaration is invalid.",
+        suggestion: "Declare private subdirectories on writable mounts and explicit upstream entrypoint/command argv; keep the service nonroot. The SDK initializer is supplied by the SPK.",
+    },
+    COMPOSE_STORAGE_NOT_WRITABLE: {
+        code: "COMPOSE_STORAGE_NOT_WRITABLE",
+        description: "The package UID cannot initialize or write its private container data.",
+        suggestion: "Use a writable mount base with a package-owned private subtree; inspect ownership, permissions, read-only storage, quota and free space. Do not add root or chown hooks.",
+    },
+    COMPOSE_STORAGE_COMMAND_INVALID: {
+        code: "COMPOSE_STORAGE_COMMAND_INVALID",
+        description: "The application command after storage preflight cannot be executed.",
+        suggestion: "Declare the actual upstream executable and arguments. Keep the upstream official image unchanged; the SPK supplies the SDK initializer.",
+    },
     COMPOSE_SUBNET_STATE_INVALID: {
         code: "COMPOSE_SUBNET_STATE_INVALID",
         description: "The private ingress history is invalid or has foreign ownership.",

package/dist/standalone/compose.d.ts

@@ -23,6 +23,12 @@ export interface ComposePlan {
     mounts_blocked: boolean;
     acceptance_blockers: string[];
     services: Array<{
+        storage_init?: {
+            directories: Array<{
+                base: string;
+                path: string;
+            }>;
+        };
         service: string;
         user: string;
         container_root: boolean;
@@ -96,6 +102,8 @@ export declare function writeComposePayload(c: ComposeApp, root: string, target:
 export declare function renderComposeInstall(pkg: string): string;
 /** The same SDK entry point supplies the package-account install materializer. */
 export declare function buildComposeControl(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: import("./build.js").CommandRunner): Promise<string | undefined>;
+/** The SPK supplies this read-only binary; upstream registry images stay unchanged. */
+export declare function buildComposeStorageInit(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: import("./build.js").CommandRunner): Promise<string | undefined>;
 /** Only the build resolves registry metadata; check and inspect remain offline. */
 export declare function lockComposeImages(m: StandaloneManifest, arch: NativeArchFamily, resolveImages: boolean, imageProofs?: unknown): StandaloneManifest;
 export declare function composeInputs(root: string, file: string, envFile?: string): ComposePlan["inputs"];

package/dist/standalone/compose.js

@@ -194,6 +194,7 @@ export function writeComposePayload(c, root, target, gateway) {
 export function renderComposeInstall(pkg) {
     return `#!/bin/sh
 set -eu
+"\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" preflight || exit $?
 exec "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" prepare --project "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose" --package '${pkg}'
 `;
 }
@@ -201,10 +202,19 @@ exec "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" prepare --project "\${SYNO
 export async function buildComposeControl(m, arch, work, run) {
     if (!m.compose)
         return;
+    return buildComposeTool(m, arch, work, run, "plan");
+}
+/** The SPK supplies this read-only binary; upstream registry images stay unchanged. */
+export async function buildComposeStorageInit(m, arch, work, run) {
+    if (!m.compose?.plan.services.some((s) => s.storage_init))
+        return;
+    return buildComposeTool(m, arch, work, run, "storage-init");
+}
+async function buildComposeTool(m, arch, work, run, tool) {
     const { pinnedGoBuildEnv, pinnedGoProblem } = await import("../build-spk/go-toolchain.js");
     const { checkCgiBinary } = await import("./binary.js");
     const { StandaloneBuildError } = await import("./spk.js");
-    const out = join(work, `compose-control-${arch}`);
+    const out = join(work, `compose-${tool === "plan" ? "control" : tool}-${arch}`);
     const source = sdkSource(m.compose.sdk);
     const result = await run("go", [
         "build",
@@ -214,13 +224,13 @@ export async function buildComposeControl(m, arch, work, run) {
         "-s -w -buildid=",
         "-o",
         out,
-        "./compose/cmd/plan",
+        `./compose/cmd/${tool}`,
     ], {
         cwd: source.goDir,
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.status !== 0 || result.missing)
-        throw new StandaloneBuildError("SDK_COMPOSE_BUILD_FAILED", `Cannot build the SDK Compose control: ${result.stderr}`);
+        throw new StandaloneBuildError("SDK_COMPOSE_BUILD_FAILED", `Cannot build the SDK Compose ${tool}: ${result.stderr}`);
     const error = checkCgiBinary(work, out, arch);
     if (error)
         throw new StandaloneBuildError(error.code, error.message);

package/dist/standalone/dsm-window.js

@@ -12,6 +12,7 @@ import { packageIcons, windowIconFile, windowIconTemplate, } from "../build-spk/
 import { DEFAULT_WINDOW, FULL_PAGE_MIN_WIDTH } from "./window-size.js";
 import { requestTimeoutSeconds } from "./request-timeout.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
+import { appSdkBatchRuntime } from "../runtime/sdk-batch.js";
 import { appSdkSessionRuntime } from "../runtime/sdk-session.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
@@ -171,6 +172,7 @@ export function renderWindowScript(manifest, assetVersion, icons = packageIcons(
     const requestTimeout = requestTimeoutSeconds(manifest.backend) * 1000;
     const clientMargin = appSdkTimeouts(manifest.backend).browserMarginMs;
     const sessionRuntime = appSdkSessionRuntime(manifest.backend);
+    const batchRuntime = appSdkBatchRuntime(manifest.backend);
     if (manifest.portal && !portalText)
         throw new Error("A portal App's window needs the SDK's portal panel text.");
     return `/* Generated by synopkgland build. Edit your UI in the project's ui folder. */
@@ -186,13 +188,17 @@ ${sessionRuntime}
     fetch: function (url, options) { return fetch(url, options); }
   });
 })();
+// DSM loads this script when the App launches. A page it gave no SynoToken
+// (Portal, standalone) asks for one now, while app.js downloads, so the
+// first call does not wait a round trip for it after the App mounts.
+if (${ns}.session && !${ns}.session.token()) ${ns}.session.ready();
 `
         : ""}
 
 // The SDK's clientTimeout: past the backend's request deadline
 // (ctx.requestTimeout, from backend.timeout_seconds), so its request_timeout
 // reply arrives first. options.signal aborts the fetch, for a page the user leaves.
-${ns}.callOnce = function (method, params, options, requestTimeout) {
+${ns}.callOnce = function (method, params, options, requestTimeout, envelope) {
   var signal = options && options.signal;
   var canceled = { code: "request_canceled", message: "The request was canceled" };
   if (signal && signal.aborted) {
@@ -224,7 +230,7 @@ ${ns}.callOnce = function (method, params, options, requestTimeout) {
     method: "POST",
     credentials: "same-origin",
     headers: headers,
-    body: JSON.stringify({ method: method, params: params || {} }),
+    body: JSON.stringify(envelope || { method: method, params: params || {} }),
     signal: controller.signal
   }).then(function (response) {
     return response.json().catch(function () {
@@ -254,9 +260,21 @@ ${ns}.callOnce = function (method, params, options, requestTimeout) {
   });
 };
 
+${batchRuntime ? `
+// A batch is one request and is never replayed after a partial result.
+${ns}.batch = (function () {
+${batchRuntime}
+  return function (calls, options, requestTimeout) {
+    return createBatch(function (envelope, callOptions) {
+      return ${ns}.callOnce(null, null, callOptions, requestTimeout, envelope);
+    })(calls, options);
+  };
+})();
+` : ""}
+
 // APP_STOPPED, APP_STARTING and EXECUTOR_STARTING mean the executor op was not
 // sent. A stopped package waits for the user to start it in Package Center, so
-// APP_STOPPED rejects at once (t-0529). A start ends by itself: a call repeats
+// APP_STOPPED rejects at once. A start ends by itself: a call repeats
 // half a second, then doubling, for 4 s of waiting in all, so a short start
 // shows the page nothing and the SDK's starting copy follows a long one within
 // its own 4 s recheck; executor.control, which the window's approval starts the
@@ -264,7 +282,7 @@ ${ns}.callOnce = function (method, params, options, requestTimeout) {
 // deadline; past the wait it rejects with the last refusal, and leaving the
 // page during a wait rejects request_canceled at once. The SDK's status reads
 // are not repeated: its panels show the stopped or starting package and check
-// again on their own (t-0503 R1).
+// again on their own.
 ${ns}.retryCodes = ["APP_STARTING", "EXECUTOR_STARTING"];
 ${ns}.statusReads = ["delegate.status", "authorization.status", "executor.status"];
 ${ns}.call = function (method, params, options, requestTimeout) {
@@ -402,6 +420,7 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
     try { if (typeof _S === "function") lang = _S("lang"); } catch (error) {}
     var ctx = { requestTimeout: ${requestTimeout} };
     var call = function (method, params, options) { return ${ns}.call(method, params, options, ctx.requestTimeout); };
+    var batch = ${batchRuntime ? `function (calls, options) { return ${ns}.batch(calls, options, ctx.requestTimeout); }` : "undefined"};
 ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
       if (me.mountToken !== mountToken) return;
       me.mountPending = false;
@@ -415,6 +434,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
           me.mounted = app.mount(root, Ext.apply(ctx, {
           displayName: ${ns}.createI18n(lang, ${JSON.stringify(displayNameCatalogs(manifest))}).t("app_title"),
           call: call,
+          batch: batch,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
           launchParams: me.launchParams,
@@ -495,6 +515,7 @@ function renderPortalAccess(ns, manifest) {
             isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
             send: ${ns}.webApi(me),
             call: call,
+            batch: batch,
             launch: function (app, params) { SYNO.SDS.AppLaunch(app, params); },
             location: window.location,
             locale: ${ns}.createI18n(lang, ${JSON.stringify(Object.fromEntries(Object.keys(DSM_LANGS).map((locale) => [locale, {}])))}).locale

package/dist/standalone/identity-gateway.js

@@ -313,6 +313,7 @@ export function identityGatewayConfig(m) {
         access: g.access ?? "dsm-users",
         ...(g.groups ? { groups: g.groups } : {}),
         ...(m.entry ? { entry: m.entry } : {}),
+        ...(m.compose ? { container_app: true } : {}),
         ...(m.compose?.plan.mounts_blocked ? { compose_blocked: true } : {}),
         ...(g.max_upload_bytes ? { max_upload_bytes: g.max_upload_bytes } : {}),
         ...(g.response_header_timeout_seconds

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,4 @@
+import { inspectPortalInfo } from "../portal/info.js";
 import { isDeepStrictEqual } from "node:util";
 import { inspectApiDescription } from "./api-description-inspect.js";
 import { dsmLauncherType } from "../contract/app-launch.js";
@@ -152,7 +153,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         const sharedFolder = standalone
             ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst")))
             : undefined;
-        // A Compose App has no executor, so its SPK never carries a portal.
+        // Resource-worker portals use DSM-owned INFO reload, with no executor requirement.
         const portal = standalone
             ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings)
             : undefined;
@@ -187,8 +188,8 @@ export async function inspectSpk(spkPath, expectedKind) {
             ? await checkBridgeApp(dir, metadata.backend, info, payload, findings)
             : undefined;
         const hasExecutor = (metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor");
-        if (standalone && portal && !hasExecutor)
-            findings.push("PORTAL_REQUIRES_EXECUTOR portal needs the executor level (rootOps or delegate): after uninstall only a root purge can stop nginx serving the alias");
+        if (standalone && portal)
+            findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
             ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined)
             : undefined;
@@ -205,6 +206,8 @@ export async function inspectSpk(spkPath, expectedKind) {
             executor = inspected.executor;
             if (executor)
                 findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
+            if (executor?.policy.portal && !portal)
+                findings.push(...inspectPortalInfo(info, true));
             if (executor?.policy.portal &&
                 info.os_min_ver &&
                 OS_MIN_VER.test(info.os_min_ver) &&
@@ -668,6 +671,17 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             throw new Error(materializer.message);
         if (payload.find((p) => p.path === "compose/control")?.mode !== "0755")
             throw new Error("Compose materializer must be executable");
+        const initializer = join(root, "compose/storage-init");
+        if (c.plan.services.some((s) => s.storage_init)) {
+            const error = checkCgiBinary(root, initializer, arch);
+            if (error)
+                throw new Error(error.message);
+            if (payload.find((p) => p.path === "compose/storage-init")?.mode !== "0755")
+                throw new Error("Compose storage initializer must be executable");
+        }
+        else if (existsSync(initializer)) {
+            throw new Error("unexpected Compose storage initializer");
+        }
         const binaries = [
             "daemon/control",
             "daemon/payload/_sso/gateway",

package/dist/standalone/lifecycle.js

@@ -21,12 +21,15 @@ export function renderStandaloneScript(name, manifest) {
             : renderStandaloneScript(name, { ...native, appScripts: undefined });
         const control = `"/var/packages/${manifest.package}/target/daemon/control"`;
         const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}"`;
+        const preflight = name === "start-stop-status"
+            ? `case "$1" in prestart|start|restart)\n  "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/compose/control" preflight || exit $? ;;\nesac\n`
+            : "";
         const remember = name === "postinst" &&
             manifest.compose.plan.ingress &&
             !manifest.compose.plan.mounts_blocked
             ? `"/var/packages/${manifest.package}/target/compose/control" remember-ingress --project "/var/packages/${manifest.package}/target/compose" --package '${manifest.package}' || exit $?\n`
             : "";
-        const ledger = remember +
+        const ledger = preflight + remember +
             (manifest.identityGateway && !manifest.compose.plan.mounts_blocked
                 ? name === "start-stop-status"
                     ? `if [ "$1" = restart ]; then\n  "$0" stop || exit $?\n  exec "$0" start\nfi\nif [ "$1" = start ]; then\n  ${control} acquire ${paths} || exit $?\nelif [ "$1" = stop ]; then\n  ${control} release ${paths} || exit $?\nfi\n`

package/dist/standalone/manifest.js

@@ -234,6 +234,10 @@ function readManifest(raw, c) {
     const daemon = arches &&
         readDaemon(raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
     const gatewayRaw = isRecord(raw.identity_gateway) ? raw.identity_gateway : {};
+    if (raw.compose !== undefined && isRecord(raw.ctl) && raw.ctl.enabled === true)
+        c.fail("CTL_UNSUPPORTED_BACKEND", "Compose does not support automatic ctl descriptions; disable ctl.");
+    if (isRecord(raw.compose) && isRecord(raw.compose.web) && !isRecord(raw.compose.web.health))
+        c.fail("COMPOSE_HEALTH_REQUIRED", "Select compose.web.health.path and expected 2xx status for the actual App. Readiness does not follow redirects; check is static and does not probe HTTP.");
     const compose = arches &&
         readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), {
             package: packageId,
@@ -260,7 +264,8 @@ function readManifest(raw, c) {
         : raw.identity_gateway;
     if (compose?.web && gatewayRaw.upstream !== undefined)
         c.fail("COMPOSE_WEB_INVALID", "Compose upstream is derived from the SDK Compose ingress endpoint; remove identity_gateway.upstream.");
-    const identityGateway = readIdentityGateway(gatewayValue, daemon || (compose ? { targets: compose.targets } : undefined), (e) => c.fail(e.code, e.message), false, Boolean(compose?.plan.ingress));
+    // A failed Compose plan already explains the invalid upstream declaration.
+    const identityGateway = raw.compose !== undefined && !compose ? undefined : readIdentityGateway(gatewayValue, daemon || (compose ? { targets: compose.targets } : undefined), (e) => c.fail(e.code, e.message), false, Boolean(compose?.plan.ingress));
     if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose and identity_gateway must use the same SDK release.");
     if (compose &&
@@ -369,7 +374,7 @@ function readManifest(raw, c) {
         ? undefined
         : (readPortalDeclaration(raw.portal, packageId) ??
             c.fail("STANDALONE_PORTAL_INVALID", "portal must be {} or { alias: <1-64 lowercase alphanumerics or -, not a DSM reserved path> }."));
-    if (portal &&
+    if (portal && osMinVer && portalByExecutor(osMinVer) &&
         !capabilities.rootOps &&
         !capabilities.delegate &&
         !capabilities.webapi) {

package/dist/standalone/native-layout.js

@@ -1,3 +1,4 @@
+import { portalInfoFields } from "../portal/info.js";
 import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
@@ -329,7 +330,7 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)];
+            const info = portalInfoFields([...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)], Boolean(m.portal));
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
@@ -370,8 +371,11 @@ export function inspectNativeLayout(dir, payload, info) {
             fail('package checksum mismatch');
         checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
         const declared = inv.portal === undefined ? undefined : portal(inv.portal, info.package);
-        if (declared)
+        if (declared) {
             checkPortal(declared, info.package, info.displayname ?? '', info.os_min_ver);
+            if (!(info.instuninst_restart_services ?? '').split(/\s+/).includes('nginx.service'))
+                fail('Portal INFO instuninst_restart_services must include nginx.service');
+        }
         checkInfoPortal(readFileSync(join(dir, 'INFO'), 'utf8'), declared);
         return [];
     }

package/dist/standalone/portal-window.js

@@ -204,7 +204,7 @@ export const portalRuntime = (catalogs) => `function createPortalAccess(options)
     };
   }
   // The window reads the status when it opens, so a settings page shows the
-  // portal section as it is (t-0520).
+  // portal section as it is.
   status();
   return access;
 }`;