@synopackageland/cli 0.17.3 → 0.17.5

package/dist/ctl/service.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { CtlError, errorData, choose } from './errors.js';
-import { APP_COOKIE, createRequest } from './transport.js';
+import { APP_COOKIE, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { DESCRIPTION_METHOD, validateDescriptor, ajv } from './descriptor.js';
 import { runFlow } from './flows.js';
 import { SensitiveOutput } from './redaction.js';
@@ -14,11 +14,13 @@ export class CtlClient {
     store;
     host;
     request;
-    constructor(store, host, request) {
+    constructor(store, host, request, timeoutMs = CTL_TIMEOUT_MS) {
         this.store = store;
         this.host = host;
-        this.request = request ?? createRequest(host.origin, 10000, host.ca ? readFileSync(host.ca, 'utf8') : undefined);
+        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), host.ca ? readFileSync(host.ca, 'utf8') : undefined);
     }
+    until;
+    remaining(fallback) { return this.until === undefined ? fallback : Math.max(0, this.until - performance.now()); }
     async valid() { try {
         await this.inventory(await this.store.session(this.host));
         return true;
@@ -102,11 +104,23 @@ export class CtlClient {
         return { apps: results.flatMap(r => r.description ? [r.description] : []), diagnostics: results.flatMap(r => r.error ? [r.error] : []), cacheHits };
     }
     async execute(name, path, args, options = {}) {
+        try {
+            return await this.executeWithin(name, path, args, options);
+        }
+        finally {
+            this.until = undefined;
+        }
+    }
+    async executeWithin(name, path, args, options = {}) {
+        const started = performance.now();
+        this.until = started + (options.timeoutMs ?? CTL_TIMEOUT_MS);
         const listing = await this.discover(options);
         const app = selectApp(listing.apps, name);
         const { id, operation } = selectOperation(app, path);
         const params = operationInput(operation, args, options.stdin, `run: synopkgland ctl ${name} ${operation.cli.join(' ')} --host ${this.host.name} --help`);
         const output = new SensitiveOutput(params, operation.paramsSchema);
+        if (options.timeoutMs === undefined && operation.flow.type === 'job')
+            this.until = started + operation.flow.timeoutMs;
         try {
             const plan = requestPlan(app, id, params);
             if (operation.flow.type === 'upload')
@@ -135,9 +149,9 @@ export class CtlClient {
                     return response.data;
                 };
                 const ca = this.host.ca ? readFileSync(this.host.ca, 'utf8') : undefined;
-                const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: options.timeoutMs,
-                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, timeoutMs: options.timeoutMs }),
-                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, timeoutMs: options.timeoutMs, file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
+                const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS),
+                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
+                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
                 if (operation.resultSchema && !ajv.validate(operation.resultSchema, result))
                     throw new CtlError('CTL_RESPONSE_INVALID', 'Result does not match command schema.', 'Check the App version.', 5);
                 return output.clean(result, operation.resultSchema);

package/dist/ctl/transfers.d.ts

@@ -1,4 +1,4 @@
-import type { DsmSession } from './transport.js';
+import { type DsmSession } from './transport.js';
 export declare function localFile(file: unknown): {
     file: string;
     size: number;

package/dist/ctl/transfers.js

@@ -2,6 +2,7 @@ import { createReadStream, statSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
 import { CtlError } from './errors.js';
+import { CTL_TIMEOUT_MS } from './transport.js';
 export function localFile(file) { if (typeof file !== 'string' || !file)
     throw new CtlError('CTL_INPUT_FILE', 'A local filename is required.', 'Use --file <path>.'); try {
     const stat = statSync(file);
@@ -15,6 +16,8 @@ catch {
 export async function transferRequest(session, path, method, params, options = {}) {
     if (!/^\/webman\/3rdparty\/[A-Za-z][A-Za-z0-9_.+-]*\/cgi\/api\.cgi$/.test(path) || !/^([a-z][a-z0-9_]*\.)+[a-z][a-z0-9_]*$/.test(method))
         throw new CtlError('CTL_PATH_INVALID', 'Invalid transfer binding.', 'Refresh the API description.', 4);
+    if (options.timeoutMs !== undefined && options.timeoutMs <= 0)
+        throw new CtlError('CTL_NETWORK', 'Transfer budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
     const url = new URL(path, session.origin);
     const file = options.file ? localFile(options.file.path) : undefined;
     if (options.file) {
@@ -23,7 +26,7 @@ export async function transferRequest(session, path, method, params, options = {
     const raw = file ? undefined : Buffer.from(JSON.stringify({ method, params }));
     return new Promise((resolve, reject) => {
         const headers = { 'content-type': file ? 'application/octet-stream' : 'application/json', cookie: session.cookie, 'X-SYNO-TOKEN': session.token, origin: session.origin, 'content-length': String(file?.size ?? raw.length) };
-        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: 30000, ...(options.ca ? { ca: options.ca } : {}) }, res => {
+        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}) }, res => {
             const expected = file ? 'application/json' : 'application/x-ndjson';
             if (res.statusCode !== 200 || !res.headers['content-type']?.includes(expected)) {
                 res.resume();
@@ -58,7 +61,7 @@ export async function transferRequest(session, path, method, params, options = {
                 reject(new CtlError('CTL_TRANSFER_FAILED', 'Invalid or failed transfer response.', 'Inspect the App result; do not retry writes blindly.', 5));
             } });
         });
-        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? 30000);
+        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? CTL_TIMEOUT_MS);
         req.once('close', () => clearTimeout(wallTimer));
         req.on('timeout', () => req.destroy());
         req.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer interrupted; completion may be uncertain.', 'Check App state before retrying.', 6)));

package/dist/ctl/transport.d.ts

@@ -1,3 +1,4 @@
+export declare const CTL_TIMEOUT_MS = 62000;
 export declare const APP_COOKIE: unique symbol;
 export interface DsmSession {
     origin: string;
@@ -8,4 +9,4 @@ export interface DsmSession {
 }
 export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
 export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number, ca?: string): JsonRequest;
+export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string): JsonRequest;

package/dist/ctl/transport.js

@@ -2,6 +2,7 @@ import { strictJson } from './json.js';
 import http from 'node:http';
 import https from 'node:https';
 import { CtlError } from './errors.js';
+export const CTL_TIMEOUT_MS = 62000;
 export const APP_COOKIE = Symbol("ctlAppCookie");
 export function canonicalOrigin(input, tunnel = false) {
     let url;
@@ -15,10 +16,13 @@ export function canonicalOrigin(input, tunnel = false) {
         throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
     return url.origin;
 }
-export function createRequest(origin, timeoutMs = 10000, ca) {
+export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
     return async (path, body, session) => {
         if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
             throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
+        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs;
+        if (remaining <= 0)
+            throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
         const url = new URL(path, origin);
         if (url.origin !== origin || (session && session.origin !== origin))
             throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland ctl host list', 4);
@@ -32,7 +36,7 @@ export function createRequest(origin, timeoutMs = 10000, ca) {
                 headers.cookie = session.cookie;
                 headers['X-SYNO-TOKEN'] = session.token;
             }
-            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: timeoutMs, ...(ca ? { ca } : {}) }, res => {
+            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}) }, res => {
                 if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
                     res.resume();
                     reject(new CtlError('CTL_HTTP_ERROR', `HTTP ${res.statusCode}; redirects are never followed.`, 'Check the NAS URL and connection.', 6));
@@ -69,7 +73,7 @@ export function createRequest(origin, timeoutMs = 10000, ca) {
                     }
                 });
             });
-            const wallTimer = setTimeout(() => req.destroy(), timeoutMs);
+            const wallTimer = setTimeout(() => req.destroy(), remaining);
             req.once('close', () => clearTimeout(wallTimer));
             req.on('timeout', () => req.destroy());
             req.on('error', () => reject(new CtlError('CTL_NETWORK', 'NAS request failed or timed out.', 'Check the NAS connection and trusted CA; requests are not replayed.', 6)));

package/dist/runtime/compose-data.d.ts

@@ -0,0 +1,10 @@
+/** Only the trusted SDK planner supplies names for retained-data reporting. */
+export interface ComposeAppData {
+    project: string;
+    volumes: Array<{
+        key: string;
+        name: string;
+    }>;
+}
+export declare function validComposeAppData(value: unknown, pkg: string): value is ComposeAppData;
+export declare const COMPOSE_DELETE_CHOICE = "compose_remove_data=0\nif [ \"${SYNOPKG_PKG_STATUS:-}\" = UNINSTALL ]; then\n  for flag in \"${pkgwizard_remove_additional:-}\" \"${wizard_pkgwizard_remove_additional:-}\" \"${delete_app_data:-}\" \"${wizard_delete_app_data:-}\"; do\n    case \"$flag\" in true|True|TRUE|yes|1) compose_remove_data=1 ;; esac\n  done\nfi\n";

package/dist/runtime/compose-data.js

@@ -0,0 +1,20 @@
+export function validComposeAppData(value, pkg) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const inventory = value;
+    return Object.keys(inventory).every(key => ["project", "volumes"].includes(key)) &&
+        typeof inventory.project === "string" && /^[a-z][a-z0-9-]{0,96}$/.test(inventory.project) &&
+        (inventory.project === pkg.toLowerCase() || inventory.project.endsWith("-" + pkg.toLowerCase())) &&
+        Array.isArray(inventory.volumes) && inventory.volumes.length <= 256 &&
+        new Set(inventory.volumes.map(volume => volume?.key)).size === inventory.volumes.length &&
+        inventory.volumes.every(volume => volume && Object.keys(volume).length === 2 &&
+            typeof volume.key === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(volume.key) &&
+            volume.name === inventory.project + "_" + volume.key);
+}
+export const COMPOSE_DELETE_CHOICE = `compose_remove_data=0
+if [ "\${SYNOPKG_PKG_STATUS:-}" = UNINSTALL ]; then
+  for flag in "\${pkgwizard_remove_additional:-}" "\${wizard_pkgwizard_remove_additional:-}" "\${delete_app_data:-}" "\${wizard_delete_app_data:-}"; do
+    case "$flag" in true|True|TRUE|yes|1) compose_remove_data=1 ;; esac
+  done
+fi
+`;

package/dist/runtime/executor-digests.json

@@ -31,5 +31,27 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.17.4": {
+        "x86_64": "68f372684997258adc61312f2c353e1a286a6b5aaa556f716b4e6ba6f33893d0",
+        "aarch64": "f6950301e201a4ebc14577a4554fa1b671f90d0f354d1e8809f4d1dafb57c723",
+        "armv7": "e77c9b6ae22ecfa85d9834af3350192e445987265a7ca6c02ca9b01d88a1b4f7",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.17.5": {
+        "x86_64": "af37ecd6bb5ab3e954b5f5bb3db2499b3cf86f0502afdcea18e8dc0614a46e5d",
+        "aarch64": "87436df3f591e0126d88866922b032968d0dbd01a109de53ab751ef779257baf",
+        "armv7": "de354d6e582ad1fe3124c3f30eb7f3ce8af456b0fcfad8f23c10421d3a3f3d42",
+        "lifecycle": {
+            "x86_64": "f3b368c86677741b48b059699a86c935157ea797634a6116131678e8bbaf33ed",
+            "aarch64": "b6ccd1365844e6eee9db4ce5833b655f4f1e138bf34317cdbd0e2342d3342a9e",
+            "armv7": "57b6350c2812783cb536384f8b363c26d894af6589b5f19464d71d8d0a8035d5"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -18,6 +18,12 @@ export interface DelegateCapability {
 export declare function validDelegate(value: unknown): value is DelegateCapability;
 export declare const sha256: (data: string | Buffer) => string;
 export interface ExecutorPolicy {
+    timeouts?: {
+        start: number;
+        stop: number;
+        purge: number;
+        operation: number;
+    };
     webapi?: WebAPIProfiles;
     v: 1;
     app: string;
@@ -56,9 +62,28 @@ export declare function executorPolicy(m: {
     portal?: PortalDeclaration;
     os_min_ver?: string;
     displayname?: string;
+    daemon?: {
+        timeouts: {
+            start: number;
+            stop: number;
+            status: number;
+            uninstall: number;
+        };
+    };
+    lifecycleTimeouts?: {
+        start: number;
+        stop: number;
+        status: number;
+        uninstall: number;
+    };
+    backend?: {
+        kind: string;
+        timeoutSeconds?: number;
+    };
     uninstall?: {
         purge: {
             root?: string;
+            timeout?: number;
         };
     };
 }, arch?: NativeArchFamily): ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -1,3 +1,4 @@
+import { operationBudgetSeconds } from "./runtime-budgets.js";
 import { validWebAPIProfiles, sortedWebAPIProfiles } from './webapi-profile.js';
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
@@ -57,6 +58,12 @@ export function executorPolicy(m, arch) {
         operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), ...(purge ? { purge } : {}), ...(settings?.stop ? { stop: settings.stop } : {}),
         ...(settings?.start ? { start: settings.start } : {}),
         ...(m.capabilities.webapi ? { webapi: sortedWebAPIProfiles(m.capabilities.webapi) } : {}),
+        ...((m.lifecycleTimeouts || m.daemon || m.backend?.timeoutSeconds || (m.uninstall?.purge.root && m.uninstall.purge.timeout)) ? { timeouts: {
+                start: m.lifecycleTimeouts?.start ?? m.daemon?.timeouts.start ?? 60,
+                stop: m.lifecycleTimeouts?.stop ?? m.daemon?.timeouts.stop ?? 60,
+                purge: m.lifecycleTimeouts?.uninstall ?? m.daemon?.timeouts.uninstall ?? Math.min(3600, Math.max(300, m.uninstall?.purge.timeout ?? 0)),
+                operation: operationBudgetSeconds(m),
+            } } : {}),
         root, ...(settings?.state ? { root_state: true } : {}) };
 }
 /** A script without settings keeps the bare digest; a binary pins the bytes built for this architecture. */
@@ -86,7 +93,7 @@ export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state', 'webapi'].includes(key))
+    if (Object.keys(p).some(key => !['timeouts', 'v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state', 'webapi'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
@@ -97,6 +104,8 @@ export function validExecutorPolicy(value, pkg) {
         || 'root_state' in p && p.root_state !== true
         || Object.entries(p.root).some(([name, entry]) => !ROOT_PROGRAM_NAME.test(name) || rootEntryProblem(entry) !== undefined))
         return false;
+    if (p.timeouts !== undefined && (!p.timeouts || typeof p.timeouts !== 'object' || Array.isArray(p.timeouts) || Object.keys(p.timeouts).sort().join(',') !== 'operation,purge,start,stop' || Object.entries(p.timeouts).some(([key, n]) => !Number.isInteger(n) || n < (key === 'operation' ? 1 : 2) || n > 3600)))
+        return false;
     const rootOps = rootOperations(p.root);
     if (![...ROOT_JOB_OPERATIONS, 'root.run'].every(op => p.operations.includes(op) === rootOps.includes(op)))
         return false;

package/dist/runtime/runtime-budgets.d.ts

@@ -0,0 +1,24 @@
+/** Work budgets use existing author settings; credential lifetimes stay separate. */
+interface OperationBudgetSource {
+    backend?: {
+        kind: string;
+        timeoutSeconds?: number;
+    };
+    daemon?: {
+        timeouts?: {
+            status: number;
+        };
+    };
+    lifecycleTimeouts?: {
+        status: number;
+    };
+}
+/**
+ * A CGI's declared request budget owns operation work. Binary and Compose Apps
+ * have no compiled CGI deadline to configure, so their existing status allowance
+ * can enlarge the shared operation budget above its 60-second default.
+ */
+export declare function operationBudgetSeconds(source: OperationBudgetSource): number;
+/** First released SDK that decodes operation/lifecycle budget config fields. */
+export declare function runtimeBudgetSdkSupported(sdk: string): boolean;
+export {};

package/dist/runtime/runtime-budgets.js

@@ -0,0 +1,13 @@
+/**
+ * A CGI's declared request budget owns operation work. Binary and Compose Apps
+ * have no compiled CGI deadline to configure, so their existing status allowance
+ * can enlarge the shared operation budget above its 60-second default.
+ */
+export function operationBudgetSeconds(source) {
+    return source.backend?.timeoutSeconds ?? Math.max(60, source.lifecycleTimeouts?.status ?? source.daemon?.timeouts?.status ?? 5);
+}
+/** First released SDK that decodes operation/lifecycle budget config fields. */
+export function runtimeBudgetSdkSupported(sdk) {
+    const [major, minor, patch] = sdk.split('.').map(Number);
+    return major > 0 || minor > 17 || minor === 17 && patch >= 5;
+}

package/dist/standalone/background.d.ts

@@ -18,7 +18,7 @@ export declare function readBackground(value: unknown, fail: (error: StandaloneE
 export declare function renderBackgroundResource(): string;
 /** The worker's arguments: none for a Go App's own worker, `--worker` for the bridge runtime (spec/bridge/v1). */
 export declare const BRIDGE_WORKER_ARGS: readonly ["--worker"];
-export declare function renderBackgroundUnit(pkg: string, args?: readonly string[]): string;
+export declare function renderBackgroundUnit(pkg: string, args?: readonly string[], stopSeconds?: number): string;
 /** Shell function that stops the worker in lifecycle hooks; call it as `stop_background_worker`. */
 export declare function renderBackgroundWorkerStop(pkg: string): string;
 /**
@@ -32,8 +32,8 @@ export declare function renderBackgroundWorkerStop(pkg: string): string;
  * exits. Stop only such a manager, as the package user; the acquire that
  * follows then starts a fresh one.
  */
-export declare function renderUserManagerRecovery(): string;
+export declare function renderUserManagerRecovery(startSeconds?: number): string;
 /** Shell function that starts the worker and names the failed step; call it as `start_background_worker`. */
 export declare function renderBackgroundWorkerStart(pkg: string): string;
 /** Package Center's start/stop/status map straight onto the user unit. */
-export declare function renderBackgroundControl(pkg: string): string;
+export declare function renderBackgroundControl(pkg: string, startSeconds?: number): string;

package/dist/standalone/background.js

@@ -24,7 +24,7 @@ export function renderBackgroundResource() {
 }
 /** The worker's arguments: none for a Go App's own worker, `--worker` for the bridge runtime (spec/bridge/v1). */
 export const BRIDGE_WORKER_ARGS = ["--worker"];
-export function renderBackgroundUnit(pkg, args = []) {
+export function renderBackgroundUnit(pkg, args = [], stopSeconds = 30) {
     return `[Unit]
 Description=${pkg} background worker
 
@@ -33,7 +33,7 @@ Type=simple
 ExecStart=${[`/var/packages/${pkg}/target/${BACKGROUND_WORKER_PAYLOAD}`, ...args].join(" ")}
 UMask=0077
 KillMode=control-group
-TimeoutStopSec=10
+TimeoutStopSec=${stopSeconds}
 Restart=no
 `;
 }
@@ -66,13 +66,15 @@ export function renderBackgroundWorkerStop(pkg) {
  * exits. Stop only such a manager, as the package user; the acquire that
  * follows then starts a fresh one.
  */
-export function renderUserManagerRecovery() {
+export function renderUserManagerRecovery(startSeconds = 30) {
     return `recover_user_manager() {
   uid="$(id -u)" || return 1
   [ "$uid" != 0 ] || return 0
-  i=0
-  while [ "$(/usr/bin/loginctl show-user "$uid" -p State 2>/dev/null)" = State=closing ] && [ "$i" -lt 100 ]; do
-    sleep 0.1; i=$((i + 1))
+  manager_now() { awk '{print int($1)}' /proc/uptime; }
+  manager_until=$(( $(manager_now) + ${startSeconds} ))
+  while [ "$(/usr/bin/loginctl show-user "$uid" -p State 2>/dev/null)" = State=closing ]; do
+    [ "$(manager_now)" -lt "$manager_until" ] || { echo "package user manager still closing" >&2; return 1; }
+    sleep 0.1
   done
   [ -S "/run/user/$uid/systemd/private" ] && return 0
   for exe in /proc/[0-9]*/exe; do
@@ -81,12 +83,11 @@ export function renderUserManagerRecovery() {
     case " $(tr '\\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null)" in *" --user "*) ;; *) continue ;; esac
     echo "package user manager $pid has no socket in /run/user/$uid; stopping it so DSM starts a fresh one" >&2
     kill -TERM "$pid" || return 1
-    i=0
     # DSM's bash logs a failed kill to syslog even with 2>/dev/null, so the
     # exit is looked up in /proc.
     while [ -d "/proc/$pid" ]; do
-      [ "$i" -lt 100 ] || { echo "package user manager $pid did not exit" >&2; return 1; }
-      sleep 0.1; i=$((i + 1))
+      [ "$(manager_now)" -lt "$manager_until" ] || { echo "package user manager $pid did not exit" >&2; return 1; }
+      sleep 0.1
     done
   done
 }
@@ -105,10 +106,10 @@ export function renderBackgroundWorkerStart(pkg) {
 `;
 }
 /** Package Center's start/stop/status map straight onto the user unit. */
-export function renderBackgroundControl(pkg) {
+export function renderBackgroundControl(pkg, startSeconds = 30) {
     const unit = backgroundUnitName(pkg);
     return `#!/bin/sh
-${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+${renderUserManagerRecovery(startSeconds)}${renderBackgroundWorkerStart(pkg)}case "$1" in
   prestart) recover_user_manager ;;
   prestop) exit 0 ;;
   start) start_background_worker ;;

package/dist/standalone/compose-errors.js

@@ -1,5 +1,15 @@
 /** SDK planner errors accepted at this versioned tool boundary. */
 export const COMPOSE_ERRORS = {
+    COMPOSE_STARTUP_INVALID: {
+        code: "COMPOSE_STARTUP_INVALID",
+        description: "The container startup budget is invalid.",
+        suggestion: "Set compose.startup_timeout_seconds to an integer from 2 to 900 seconds; the default is 120. Read the same SYNOPKGLAND_STARTUP_BUDGET_SECONDS in the App bootstrap adapter.",
+    },
+    COMPOSE_STARTUP_TIMEOUT: {
+        code: "COMPOSE_STARTUP_TIMEOUT",
+        description: "Container readiness exhausted its declared startup budget.",
+        suggestion: "Inspect the safe phase code in daemon/daemon.log and upstream migration/bootstrap health. Declare a sufficient bounded startup_timeout_seconds and rebuild; keep ingress closed until ready.",
+    },
     COMPOSE_STORAGE_INIT_INVALID: {
         code: "COMPOSE_STORAGE_INIT_INVALID",
         description: "The container storage initialization declaration is invalid.",

package/dist/standalone/compose.d.ts

@@ -1,7 +1,10 @@
+import { type ComposeAppData } from "../runtime/compose-data.js";
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Daemon } from "./daemon.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface ComposePlan {
+    app_data?: ComposeAppData;
+    startup_timeout_seconds?: number;
     ingress?: {
         address: string;
         subnet: string;
@@ -68,7 +71,7 @@ export interface ComposeApp {
     document: Record<string, any>;
     plan: ComposePlan;
 }
-export declare const COMPOSE_FIELDS: readonly ["resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
+export declare const COMPOSE_FIELDS: readonly ["startup_timeout_seconds", "resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
 export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void, context?: {
     package?: string;
     sdk?: string;
@@ -78,7 +81,7 @@ export declare function readComposeApp(value: unknown, root: string, arches: Nat
     architecture?: NativeArchFamily;
     imageProofs?: unknown;
 }): ComposeApp | undefined;
-export declare function composeDaemon(m: Pick<StandaloneManifest, "compose">): Daemon;
+export declare function composeDaemon(m: Pick<StandaloneManifest, "compose" | "lifecycleTimeouts">): Daemon;
 export declare function composeNetwork(m: Pick<StandaloneManifest, "compose" | "identityGateway" | "spkVersion">): {
     public_ports: number[];
     readiness?: {

package/dist/standalone/compose.js

@@ -1,3 +1,5 @@
+import { validComposeAppData } from "../runtime/compose-data.js";
+import { composeDiagnosisMessages, renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { COMPOSE_ERRORS } from "./compose-errors.js";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -10,6 +12,7 @@ import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
 export const COMPOSE_FIELDS = [
+    "startup_timeout_seconds",
     "resource_prefix",
     "files",
     "env_files",
@@ -69,6 +72,10 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value.sdk !== undefined &&
         (typeof value.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(value.sdk)))
         return invalid("compose.sdk must name the matching SDK release.", "SDK_COMPOSE_UNSUPPORTED");
+    if (value.startup_timeout_seconds !== undefined &&
+        (!Number.isInteger(value.startup_timeout_seconds) ||
+            value.startup_timeout_seconds < 2 || value.startup_timeout_seconds > 900))
+        return invalid("compose.startup_timeout_seconds must be an integer from 2 to 900 seconds (default 120).", "COMPOSE_STARTUP_INVALID");
     const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? templateSdkVersion());
     let targets = {};
     if (value.helpers !== undefined) {
@@ -107,7 +114,16 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
         }
         if (result.status !== 0 || plan.error)
             throw new Error(plan.error ?? "[SDK_COMPOSE_FAILED] SDK planner failed.");
+        if (value.startup_timeout_seconds !== undefined &&
+            plan.startup_timeout_seconds !== value.startup_timeout_seconds)
+            throw new Error("[SDK_COMPOSE_UNSUPPORTED] This SDK does not implement the declared startup budget; use the matching SDK/CLI release.");
         const document = parse(plan.effective);
+        const volumes = Object.entries(document?.volumes ?? {});
+        if ((!validComposeAppData(plan.app_data, context.package ?? "ComposeApp")
+            || JSON.stringify(plan.app_data) !== JSON.stringify(plan.lock?.app_data)
+            || plan.app_data.project !== plan.project_name || plan.app_data.volumes.length !== volumes.length
+            || volumes.some(([key, value]) => !plan.app_data.volumes.some(v => v.key === key && v.name === value.name))))
+            throw new Error("[SDK_COMPOSE_UNSUPPORTED] This SDK does not provide the complete Compose App data contract; update the SDK and rebuild.");
         const web = value.web;
         return {
             declaration: { ...value },
@@ -141,7 +157,7 @@ export function composeDaemon(m) {
         args: ["run"],
         targets: m.compose.targets,
         env: {},
-        timeouts: { start: 120, stop: 30, status: 5, uninstall: 60 },
+        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 120 },
     };
 }
 export function composeNetwork(m) {
@@ -187,6 +203,7 @@ export function writeComposePayload(c, root, target, gateway) {
         "compose.lock.json": JSON.stringify(c.plan.lock, null, 2) + "\n",
         "request.json": JSON.stringify({ declaration: c.declaration, sdk: c.sdk, gateway }, null, 2) + "\n",
         "images.json": JSON.stringify(c.plan.image_proofs ?? {}, null, 2) + "\n",
+        "diagnosis-messages.json": JSON.stringify(composeDiagnosisMessages(), null, 2) + "\n",
     }))
         writeFileSync(join(target, name), content, { mode: 0o600 });
 }
@@ -195,7 +212,7 @@ export function renderComposeInstall(pkg) {
     return `#!/bin/sh
 set -eu
 "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" preflight || exit $?
-exec "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" prepare --project "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose" --package '${pkg}'
+${renderComposeDiagnosis("\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose", "preinst")}exec "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose/control" prepare --project "\${SYNOPKG_PKGINST_TEMP_DIR:?}/compose" --package '${pkg}'
 `;
 }
 /** The same SDK entry point supplies the package-account install materializer. */

package/dist/standalone/daemon.d.ts

@@ -30,3 +30,7 @@ export declare function buildDaemonControl(manifest: StandaloneManifest, arch: N
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;
 /** Copies a bounded, link-free package-account payload tree. */
 export declare function copyPayloadTree(root: string, source: string, target: string): void;
+/** Existing lifecycle namespace; a timeout-only declaration runs no daemon. */
+export declare function readLifecycleTimeouts(value: unknown, fail: (e: StandaloneError) => void): Daemon['timeouts'] | undefined;
+/** Legacy SDKs keep their supported config and timeout bounds. */
+export declare function runtimeBudgetSource(dir: string, manifest?: StandaloneManifest): string;