@synopackageland/cli 0.17.3 → 0.17.5

package/dist/standalone/daemon.js

@@ -1,5 +1,6 @@
+import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { goChildEnv } from "../runtime/go-env.js";
-import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
@@ -79,23 +80,9 @@ export function readDaemon(value, root, arches, fail) {
         Object.keys(env).length > 64 ||
         Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
         return invalid();
-    const limits = value.timeouts ?? {};
-    if (!record(limits) ||
-        Object.keys(limits).some((k) => !["start", "stop", "status", "uninstall"].includes(k)))
-        return invalid();
-    // Defaults hold under IO load on a busy NAS; DSM's package unit allows 3600 s.
-    const timeouts = {
-        start: limits.start ?? 30,
-        stop: limits.stop ?? 30,
-        status: limits.status ?? 5,
-        uninstall: limits.uninstall ?? 60,
-    };
-    for (const [key, v] of Object.entries(timeouts)) {
-        if (!Number.isInteger(v) ||
-            v < (key === "status" ? 1 : 2) ||
-            v > (key === "status" ? 10 : 120))
-            return invalid();
-    }
+    const timeouts = readLifecycleTimeouts(value.timeouts, fail);
+    if (!timeouts)
+        return undefined;
     return {
         exec: value.exec,
         targets,
@@ -107,6 +94,11 @@ export function readDaemon(value, root, arches, fail) {
         timeouts: timeouts,
     };
 }
+function daemonSdkVersion(manifest) {
+    return manifest.identityGateway?.sdk ??
+        (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
+        templateSdkVersion();
+}
 export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts } = manifest.compose
         ? composeDaemon(manifest)
@@ -120,6 +112,8 @@ export function daemonConfig(manifest) {
         ...(uninstall_args ? { uninstall_args } : {}),
         env,
         timeouts,
+        ...(runtimeBudgetSdkSupported(daemonSdkVersion(manifest))
+            ? { operation_seconds: operationBudgetSeconds(manifest) } : {}),
         ...(manifest.compose ? { network: composeNetwork(manifest) } : {}),
     }) + "\n");
 }
@@ -137,11 +131,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         out,
         "./daemonctl",
     ], {
-        cwd: sdkSource(manifest.identityGateway?.sdk ??
-            (manifest.backend.kind === "go"
-                ? appSdkVersion(manifest.backend)
-                : undefined) ??
-            templateSdkVersion()).goDir,
+        cwd: runtimeBudgetSource(sdkSource(daemonSdkVersion(manifest)).goDir, manifest),
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)
@@ -212,3 +202,26 @@ export function copyPayloadTree(root, source, target) {
         invalid(`Cannot read the daemon payload: ${String(error)}`);
     }
 }
+/** Existing lifecycle namespace; a timeout-only declaration runs no daemon. */
+export function readLifecycleTimeouts(value, fail) {
+    const v = value ?? {};
+    const bad = () => { fail({ code: 'STANDALONE_DAEMON_INVALID', message: 'daemon.timeouts accepts start/stop/uninstall 2–3600s and status 1–3600s.' }); return undefined; };
+    if (!record(v) || Object.keys(v).some(k => !['start', 'stop', 'status', 'uninstall'].includes(k)))
+        return bad();
+    const limits = { start: v.start ?? 30, stop: v.stop ?? 30, status: v.status ?? 5, uninstall: v.uninstall ?? 60 };
+    for (const [key, n] of Object.entries(limits))
+        if (!Number.isInteger(n) || Number(n) < (key === 'status' ? 1 : 2) || Number(n) > 3600)
+            return bad();
+    return limits;
+}
+/** Legacy SDKs keep their supported config and timeout bounds. */
+export function runtimeBudgetSource(dir, manifest) {
+    if (!existsSync(join(dir, 'internal/runtimebudget/budget.go'))) {
+        const timeouts = manifest?.daemon?.timeouts ?? manifest?.lifecycleTimeouts;
+        if (!manifest || operationBudgetSeconds(manifest) > 60 || timeouts &&
+            (timeouts.start > 120 || timeouts.stop > 120 || timeouts.status > 10 || timeouts.uninstall > 120)) {
+            throw new StandaloneBuildError('STANDALONE_DAEMON_BUILD_FAILED', 'The requested timeouts need an SDK with runtime budget support; use SDK 0.17.5 or later before rebuilding.');
+        }
+    }
+    return dir;
+}

package/dist/standalone/dsm-window.js

@@ -1,3 +1,4 @@
+import { gatewayEntryPath } from './native-gateway.js';
 import { resolvedSdkLaunch, dsmLauncherType } from "../contract/app-launch.js";
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { LAUNCH_PARAMS_RUNTIME } from "./launch-params.js";
@@ -120,7 +121,7 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
                     ...titleFields,
                     icon,
                     ...launcherAccess(manifest),
-                    url: `/webman/3rdparty/${manifest.package}/sso/open.cgi`,
+                    url: gatewayEntryPath(manifest),
                 },
             },
         }, null, 2) + "\n");

package/dist/standalone/identity-gateway.js

@@ -1,3 +1,5 @@
+import { nativeGatewaySupported } from './native-gateway.js';
+import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { existsSync, lstatSync } from "node:fs";
 import { join } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
@@ -5,7 +7,7 @@ import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { checkCgiBinary } from "./binary.js";
 import { isWebAccessMode, DSM_GROUP_NAME, } from "../contract/web-launch.js";
-import { relativeExec, token } from "./daemon.js";
+import { relativeExec, runtimeBudgetSource, token } from "./daemon.js";
 import { StandaloneBuildError } from "./spk.js";
 /** The SDK's identity gateway: the daemon wrapper and the DSM-origin authorize CGI. */
 export const GATEWAY_MAIN = "./idgateway/cmd/gateway";
@@ -309,6 +311,11 @@ export function identityGatewayConfig(m) {
     const g = m.identityGateway;
     return (JSON.stringify({
         package: m.package,
+        ...(nativeGatewaySupported(m) ? { native_ingress: true } : {}),
+        ...(runtimeBudgetSdkSupported(g.sdk) ? {
+            operation_seconds: operationBudgetSeconds(m),
+            stop_seconds: m.daemon?.timeouts.stop ?? m.lifecycleTimeouts?.stop ?? 30,
+        } : {}),
         mode: g.mode,
         access: g.access ?? "dsm-users",
         ...(g.groups ? { groups: g.groups } : {}),
@@ -385,6 +392,7 @@ export async function buildIdentityGateway(m, arch, work, run) {
     catch (error) {
         throw new StandaloneBuildError("SDK_DOWNLOAD_FAILED", error.message.replace(/^\[[A-Z_]+\] /, ""));
     }
+    runtimeBudgetSource(sdk.goDir, m);
     const out = join(work, `identity-gateway-${arch}`);
     const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}`;
     const result = await run("go", [

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,5 @@
+import { nativePortal } from "./portal.js";
+import { nativeGatewaySupported, renderNativeGatewayConfig, renderNativeGatewayPrepare, NATIVE_GATEWAY_CONFIG, gatewayEntryPath } from './native-gateway.js';
 import { inspectPortalInfo } from "../portal/info.js";
 import { isDeepStrictEqual } from "node:util";
 import { inspectApiDescription } from "./api-description-inspect.js";
@@ -18,7 +20,7 @@ import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.
 import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
-import { daemonConfig, readDaemon } from "./daemon.js";
+import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -110,6 +112,10 @@ export async function inspectSpk(spkPath, expectedKind) {
                     (raw.entry !== undefined &&
                         !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
+                if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
+                    throw new Error();
+                if (raw.operationSeconds !== undefined && (!Number.isInteger(raw.operationSeconds) || raw.operationSeconds < 1 || raw.operationSeconds > 3600))
+                    throw new Error();
                 metadata = raw;
             }
             catch {
@@ -145,6 +151,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
+        const nativeGateway = await recoverNativeGateway(dir, metadata.native_gateway, info, findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
         const appScripts = standalone || kind === "container"
@@ -163,7 +170,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
-        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose);
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver);
         checkScripts(dir, findings);
         checkUninstall(dir, findings);
         if (kind === "container")
@@ -191,10 +198,10 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway)
             : undefined;
         if (background)
-            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go");
+            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts);
         let executor;
         if ((metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") ||
             paths.has("executor/executor")) {
@@ -224,6 +231,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             if (![...paths].some((path) => path.startsWith("daemon/"))) {
                 const lifecycleManifest = {
                     package: info.package,
+                    lifecycleTimeouts: metadata.lifecycleTimeouts,
                     capabilities: {
                         rootOps: true,
                         ...(background ? { jobs: { worker: "sha256-v1" } } : {}),
@@ -622,7 +630,8 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             os_min_ver: info.os_min_ver,
             build: Number(info.version?.split("-").pop()),
             arches: [arch],
-            backend: { kind: "binary", files: {} },
+            backend: { kind: "binary", files: {}, ...(metadata.operationSeconds ? { timeoutSeconds: metadata.operationSeconds } : {}) },
+            lifecycleTimeouts: metadata.lifecycleTimeouts,
             ui: { dir: root, launch: metadata.launch },
             capabilities: {
                 ...(metadata.capabilities?.includes("composeMounts")
@@ -635,7 +644,7 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
         };
         if (Boolean(c.web) !== Boolean(g))
             throw new Error("Web ingress must have a complete identity gateway");
-        if (gateway && gateway !== identityGatewayConfig(manifest))
+        if (gateway && !matchesGatewayConfig(gateway, manifest))
             throw new Error("gateway configuration differs from the declared package contract");
         if (readOptional(join(dir, "conf/privilege")) !== renderNativePrivilege())
             throw new Error("Compose hooks must run as the package account");
@@ -648,8 +657,15 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             throw new Error("LAUNCHER_TYPE_MISMATCH classless Compose must use the shared url launcher");
         if (g &&
             (cfg.package !== info.package ||
-                info.adminurl !== `/webman/3rdparty/${info.package}/sso/open.cgi`))
+                info.adminurl !== gatewayEntryPath(manifest)))
             throw new Error("gateway entry mismatch");
+        for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", {
+            composeData: c.plan.app_data,
+            portal: Boolean(nativePortal(manifest)),
+        }))) {
+            if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
+                throw new Error(`unexpected WIZARD_UIFILES/${name}; retained-volume guidance must match the plan`);
+        }
         const appScripts = unwrapAppScripts(join(dir, "scripts"), findings);
         manifest.appScripts = undefined;
         for (const hook of [
@@ -771,7 +787,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -796,6 +812,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 "args",
                 "env",
                 "timeouts",
+                "operation_seconds",
                 "uninstall_args",
                 ...(combined ? ["network"] : []),
             ].includes(key)))
@@ -810,6 +827,8 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
+        if (config.operation_seconds !== undefined && (!Number.isInteger(config.operation_seconds) || config.operation_seconds < 1 || config.operation_seconds > 3600))
+            throw new Error('invalid operation budget');
         if (combined &&
             (daemon.exec !== "_sso/gateway" ||
                 JSON.stringify(daemon.args) !== '["run"]' ||
@@ -820,6 +839,9 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             throw new Error("missing executable");
         const manifest = {
             package: info.package,
+            backend: { kind: 'go', dir: dir, main: './cmd/app', timeoutSeconds: config.operation_seconds ?? 60 },
+            root: dir,
+            ...(combined ? { lifecycleTimeouts: daemon.timeouts } : {}),
             daemon,
             ...combined,
             capabilities: {
@@ -841,11 +863,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 },
             }
             : manifest);
-        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== canonical)
+        const expectedConfig = JSON.parse(canonical);
+        if (config.operation_seconds === undefined)
+            delete expectedConfig.operation_seconds;
+        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== JSON.stringify(expectedConfig) + '\n')
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
             if (readFileSync(join(dir, "scripts", hook), "utf8") !==
-                renderStandaloneScript(hook, manifest))
+                renderStandaloneScript(hook, nativeGateway ? { ...manifest, os_min_ver: info.os_min_ver, identityGateway: nativeGateway } : manifest))
                 findings.push(`daemon scripts/${hook} does not match the fixed lifecycle`);
         }
         return daemon;
@@ -917,12 +942,50 @@ async function checkContainerExposure(dir, packageTgz, findings) {
 function readOptional(path) {
     return existsSync(path) ? readFileSync(path, "utf8") : undefined;
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose) {
+async function recoverNativeGateway(dir, value, info, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('invalid native gateway record');
+        const plan = value;
+        if (typeof plan.sdk !== 'string' || !plan.listen || typeof plan.listen !== 'object' || Array.isArray(plan.listen)
+            || !Object.keys(plan.listen).length || Object.keys(plan).some(k => !['sdk', 'listen'].includes(k))
+            || Object.entries(plan.listen).some(([k, v]) => !['http', 'https'].includes(k) || !Number.isInteger(v) || v < 1 || v > 65535))
+            throw new Error('invalid native gateway ports');
+        const target = { package: info.package, os_min_ver: info.os_min_ver, identityGateway: plan };
+        if (!nativeGatewaySupported(target))
+            throw new Error('unsupported native gateway SDK/DSM floor');
+        const root = join(dir, 'native-gateway-inspection');
+        mkdirSync(root);
+        await tar.x({ file: join(dir, 'package.tgz'), cwd: root, filter: path => ['sso/gateway.json', NATIVE_GATEWAY_CONFIG].includes(path.replace(/^\.\//, '')) });
+        const config = JSON.parse(readFileSync(join(root, 'sso/gateway.json'), 'utf8'));
+        if (config.native_ingress !== true || config.package !== info.package || !isDeepStrictEqual(config.listen, plan.listen)
+            || config.state_dir !== `/var/packages/${info.package}/var/sso`)
+            throw new Error('native gateway config does not match its package');
+        if (readOptional(join(root, NATIVE_GATEWAY_CONFIG)) !== renderNativeGatewayConfig(target))
+            throw new Error('native gateway ingress differs from its fixed proxy');
+        for (const key of ['instuninst_restart_services', 'startstop_restart_services'])
+            if (!(info[key] ?? '').split(/\s+/).includes('nginx.service'))
+                throw new Error(`native gateway requires INFO ${key}`);
+        for (const hook of ['postinst', 'postupgrade'])
+            if (!readFileSync(join(dir, 'scripts', hook), 'utf8').includes(renderNativeGatewayPrepare(target)))
+                throw new Error('native gateway credential preparation is missing');
+        return plan;
+    }
+    catch (e) {
+        findings.push(`NATIVE_GATEWAY_INVALID ${e.message}`);
+        return undefined;
+    }
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
     const nativeResource = kind !== "container"
         ? renderStandaloneResource({
             package: pkg ?? "",
+            os_min_ver: osMinVer,
+            ...(nativeGateway ? { identityGateway: nativeGateway } : {}),
             ...(compose ? { compose } : {}),
             capabilities: background
                 ? { jobs: { worker: "sha256-v1" } }
@@ -979,7 +1042,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false) {
+function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false, lifecycleTimeouts) {
     const pkg = info.package;
     if (!pkg)
         return;
@@ -997,12 +1060,13 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
     if (units.length !== 1 ||
         units[0] !== unit ||
         read(`${BACKGROUND_UNIT_DIR}/${unit}`) !==
-            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [])) {
+            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [], daemon?.timeouts.stop ?? lifecycleTimeouts?.stop ?? 30)) {
         findings.push(`${BACKGROUND_UNIT_DIR} must contain only the fixed ${unit} (runs as the package account, no User=, no root)`);
     }
     if (read("scripts/start-stop-status") !==
         renderStandaloneScript("start-stop-status", {
             package: pkg,
+            lifecycleTimeouts,
             ...(daemon ? { daemon } : {}),
             capabilities: {
                 jobs: { worker: "sha256-v1" },
@@ -1149,7 +1213,7 @@ function checkScripts(dir, findings) {
 }
 const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
 const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
-const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
+const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*(?:!=\s*"?UPGRADE"?|=\s*"?UNINSTALL"?)/;
 function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
@@ -1206,7 +1270,7 @@ function checkUninstall(dir, findings) {
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
-            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without the [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] guard, so an upgrade deletes it by mistake');
+            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without an UNINSTALL-only or != UPGRADE guard, so an upgrade deletes it by mistake');
         if (!/is_package_area\(\)\s*\{/.test(body) ||
             !/if ! is_package_area "\$real"/.test(body))
             findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst does not verify the deleted paths are under /volumeN/@appdata|@apphome|@appconf|@appstore/<package>; an empty or redirected variable deletes the wrong data");
@@ -1265,3 +1329,11 @@ export async function listPayload(packageTgz, findings) {
     });
     return payload;
 }
+function matchesGatewayConfig(actual, manifest) {
+    const saved = JSON.parse(actual), expected = JSON.parse(identityGatewayConfig(manifest));
+    // Older artifacts omit both work-budget members; do not reinterpret their bytes.
+    for (const key of ['operation_seconds', 'stop_seconds'])
+        if (saved[key] === undefined)
+            delete expected[key];
+    return actual === JSON.stringify(expected) + '\n';
+}

package/dist/standalone/lifecycle.js

@@ -1,3 +1,6 @@
+import { renderComposeRetainedData } from "../build-spk/compose-retained-data.js";
+import { renderNativeGatewayPrepare } from './native-gateway.js';
+import { renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { composeDaemon, renderComposeInstall } from "./compose.js";
 import { renderBackgroundControl, renderBackgroundWorkerStart, renderBackgroundWorkerStop, renderUserManagerRecovery, backgroundUnitName, } from "./background.js";
 import { renderPackagePostuninst } from "../build-spk/native-lifecycle.js";
@@ -10,6 +13,14 @@ import { composeAppScript } from "./app-scripts.js";
 const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_uninstall_hook\n';
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
+    const script = renderStandaloneScriptInternal(name, manifest);
+    const prepared = ['postinst', 'postupgrade'].includes(name) ? renderNativeGatewayPrepare(manifest) : '';
+    const sdk = prepared ? script.replace('#!/bin/sh\n', '#!/bin/sh\n' + prepared) : script;
+    return manifest.appScripts?.some((app) => app === name)
+        ? composeAppScript(name, sdk)
+        : sdk;
+}
+function renderStandaloneScriptInternal(name, manifest) {
     if (manifest.compose) {
         const native = {
             ...manifest,
@@ -18,7 +29,7 @@ export function renderStandaloneScript(name, manifest) {
         };
         const body = name === "preinst"
             ? renderComposeInstall(manifest.package)
-            : renderStandaloneScript(name, { ...native, appScripts: undefined });
+            : renderStandaloneScriptInternal(name, { ...native, appScripts: undefined });
         const control = `"/var/packages/${manifest.package}/target/daemon/control"`;
         const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}"`;
         const preflight = name === "start-stop-status"
@@ -29,7 +40,14 @@ export function renderStandaloneScript(name, manifest) {
             !manifest.compose.plan.mounts_blocked
             ? `"/var/packages/${manifest.package}/target/compose/control" remember-ingress --project "/var/packages/${manifest.package}/target/compose" --package '${manifest.package}' || exit $?\n`
             : "";
-        const ledger = preflight + remember +
+        const project = `\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/compose`;
+        const diagnosis = ["postinst", "postupgrade"].includes(name)
+            ? renderComposeDiagnosis(project, name)
+            : name === "start-stop-status"
+                ? `if [ "$1" = prestart ]; then\n  ${renderComposeDiagnosis(project, "prestart")}fi\n`
+                : "";
+        const ledger = diagnosis + preflight + remember +
+            (name === "postuninst" ? renderComposeRetainedData(manifest.compose.plan.app_data) : "") +
             (manifest.identityGateway && !manifest.compose.plan.mounts_blocked
                 ? name === "start-stop-status"
                     ? `if [ "$1" = restart ]; then\n  "$0" stop || exit $?\n  exec "$0" start\nfi\nif [ "$1" = start ]; then\n  ${control} acquire ${paths} || exit $?\nelif [ "$1" = stop ]; then\n  ${control} release ${paths} || exit $?\nfi\n`
@@ -40,18 +58,14 @@ export function renderStandaloneScript(name, manifest) {
         const withLedger = ledger
             ? body.replace("#!/bin/sh\n", "#!/bin/sh\n" + ledger)
             : body;
-        return manifest.appScripts?.some((app) => app === name)
-            ? composeAppScript(name, withLedger)
-            : withLedger;
+        return withLedger;
     }
     const portal = nativePortal(manifest);
     const script = renderCapabilityScript(name, manifest);
     const sdk = portal
         ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`)
         : script;
-    return manifest.appScripts?.some((app) => app === name)
-        ? composeAppScript(name, sdk)
-        : sdk;
+    return sdk;
 }
 function renderCapabilityScript(name, manifest) {
     if (name === "preupgrade" &&
@@ -152,7 +166,7 @@ function renderStandaloneScriptBody(name, manifest) {
     if (manifest.daemon)
         return renderDaemonScript(name, manifest);
     if (manifest.capabilities.jobs && name === "start-stop-status")
-        return renderBackgroundControl(manifest.package);
+        return renderBackgroundControl(manifest.package, manifest.lifecycleTimeouts?.start ?? 30);
     if (name === "start-stop-status") {
         return `#!/bin/sh
 case "$1" in
@@ -184,7 +198,7 @@ function renderDelegatedDaemonScript(name, manifest) {
         return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop("stop", "stop")}fi\n${purge}`;
     }
     return `#!/bin/sh
-${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+${workerStop}${renderUserManagerRecovery(manifest.daemon?.timeouts?.start ?? manifest.lifecycleTimeouts?.start ?? 30)}${renderBackgroundWorkerStart(pkg)}case "$1" in
   prestart) recover_user_manager ;;
   prestop) exit 0 ;;
   start)

package/dist/standalone/manifest.d.ts

@@ -86,6 +86,7 @@ export interface StandaloneManifest {
         tasks: ExecutorTask[];
     };
     daemon?: Daemon;
+    lifecycleTimeouts?: Daemon["timeouts"];
     /** `identity_gateway`: signs DSM users in to the daemon's own web UI. */
     identityGateway?: IdentityGateway;
     compose?: ComposeApp;

package/dist/standalone/manifest.js

@@ -9,7 +9,7 @@ import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
-import { readDaemon } from "./daemon.js";
+import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
 import { readAppScripts } from "./app-scripts.js";
@@ -231,8 +231,10 @@ function readManifest(raw, c) {
                 c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/${API_PERMISSIONS_FILE[backend.kind]} must define the centralized API policy: ${String(error)}`);
         }
     }
+    const timeoutOnly = isRecord(raw.daemon) && Object.keys(raw.daemon).length === 1 && 'timeouts' in raw.daemon;
+    const lifecycleTimeouts = timeoutOnly ? readLifecycleTimeouts(raw.daemon.timeouts, (e) => c.fail(e.code, e.message)) : undefined;
     const daemon = arches &&
-        readDaemon(raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
     const gatewayRaw = isRecord(raw.identity_gateway) ? raw.identity_gateway : {};
     if (raw.compose !== undefined && isRecord(raw.ctl) && raw.ctl.enabled === true)
         c.fail("CTL_UNSUPPORTED_BACKEND", "Compose does not support automatic ctl descriptions; disable ctl.");
@@ -246,7 +248,7 @@ function readManifest(raw, c) {
             composeMounts: capabilities.composeMounts,
         });
     if (raw.compose !== undefined &&
-        (raw.daemon !== undefined ||
+        ((raw.daemon !== undefined && !timeoutOnly) ||
             Object.keys(capabilities).some((k) => k !== "composeMounts") ||
             !osMinVer ||
             !isDsmAtLeast(osMinVer, "7.2.1-69057")))
@@ -280,7 +282,7 @@ function readManifest(raw, c) {
                     s.port === identityGateway.oidc?.issuer_port))))
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose service ports must contain upstream and not overlap gateway or issuer ports.");
     if (capabilities.jobs &&
-        raw.daemon !== undefined &&
+        raw.daemon !== undefined && !timeoutOnly &&
         capabilities.delegate?.lifetime !== "until-revoked") {
         c.fail("CAPABILITY_COMBINATION_INVALID", "daemon can only coexist with an explicit until-revoked delegate fixed worker; plain capabilities.jobs stays mutually exclusive.");
     }
@@ -299,7 +301,7 @@ function readManifest(raw, c) {
                 delegate.destinations?.length)) {
             c.fail("CAPABILITY_UNSUPPORTED", `For backend.runtime: ${backend.kind}, capabilities.delegate supports only operations: [files.moveFromStaging], destinations and lifetime: until-revoked.`);
         }
-        if (raw.daemon !== undefined)
+        if (raw.daemon !== undefined && !timeoutOnly)
             c.fail("CAPABILITY_UNSUPPORTED", `backend.runtime: ${backend.kind} does not support daemon; a v1 App runs once per request (exec mode).`);
         if (permissions)
             checkBridgeMethods(backend, permissions, c);
@@ -438,6 +440,7 @@ function readManifest(raw, c) {
         ...(rootOps ? { rootOps } : {}),
         ...(rootPrograms ? { rootPrograms } : {}),
         ...(daemon ? { daemon } : {}),
+        ...(lifecycleTimeouts ? { lifecycleTimeouts } : {}),
         ...(identityGateway ? { identityGateway } : {}),
         ...(compose ? { compose } : {}),
         ...(uninstall ? { uninstall } : {}),

package/dist/standalone/native-gateway.d.ts

@@ -0,0 +1,17 @@
+import type { IdentityGateway } from './identity-gateway.js';
+export type NativeGatewayPlan = Pick<IdentityGateway, 'sdk' | 'listen'>;
+type Target = {
+    package: string;
+    os_min_ver?: string;
+    identityGateway?: NativeGatewayPlan;
+};
+export declare const NATIVE_GATEWAY_CONFIG = "sso/native-nginx.conf";
+export declare function nativeGatewaySdk(sdk: string): boolean;
+export declare function nativeGatewaySupported(m: Target): boolean;
+export declare function gatewayEntryPath(m: Target): string;
+export declare function legacyGatewayNotice(): string;
+export declare function nativeGatewayResource(m: Target): Record<string, unknown> | undefined;
+export declare function renderNativeGatewayConfig(m: Target): string;
+/** Runs after DSM creates pkgvar, before package start activates the nginx resource. */
+export declare function renderNativeGatewayPrepare(m: Target): string;
+export {};