@synopackageland/cli 0.17.4 → 0.17.5

package/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Changelog
 
-## Unreleased
+## 0.17.5 (2026-10-20)
+
+- Run native HTTPS preparation inside the SDK lifecycle steps before App hooks, keeping generated hook wrappers inspectable.
+
+- Preserve older SDK gateway/controller JSON and supported timeout limits so their direct-connection fallback remains buildable; reject expanded budgets that require SDK 0.17.5.
+
+- Keep Compose named volumes without adding executor/root permissions; warn before uninstall and report their exact undeleted names in nine native locales when delete-data is selected. Clear package-owned data/config/home contents only on explicit uninstall, preserving data on upgrades, stops and keep.
+
+- Default supported gateway Apps to a DSM-managed HTTPS origin using native package resources and a private authenticated gateway socket. Preserve direct connections for older SDK/DSM targets with an explanation before opening them.
+- Prepare private connection credentials as the package account after DSM creates package state, and reject modified gateway proxy settings during SPK inspection.
+- Apply `ctl --timeout` to discovery, JSON requests, polling and transfer inactivity without replaying uncertain writes; use a 62-second default transport allowance.
+- Reuse `daemon.timeouts` for native, Compose and background lifecycle work, including declarations that need no daemon executable. Allow lifecycle and App purge budgets up to 3600 seconds while retaining the Compose startup cap.
+- Generate matching gateway, supervisor and approved executor budgets, preserve them through SPK inspection, and report pending uninstall cleanup within bounded TERM/reap reserve.
+
+- Pin templates 0.17.8 and SDK/App 0.17.5, including UI 0.12.4 full-page layout. Updated executor and lifecycle payloads require administrator reapproval after upgrading rebuilt Apps.
 
 ## 0.17.4 (2026-10-19)
 

package/README.md

@@ -315,7 +315,11 @@ App is absent from discovery results; no business operation runs.
 `ctl host list/show` can also succeed while reporting `authenticated:false` and
 exit 0. Check discovery `apps`/`diagnostics` and session fields as well as the exit
 code when deciding whether an App is ready.
-After a network or job timeout, query the App's state before retrying a write.
+`ctl --timeout <seconds>` applies to discovery, JSON calls, polling and transfer
+inactivity. The transport default is 62 seconds; a supplied 1–3600-second budget
+is shared across the operation. Jobs retain their described wait default when no
+override is supplied. After a network or job timeout, query the App's state before
+retrying a write.
 
 Read `synopkgland skill show ctl` for the AI workflow, batch discovery approval,
 cache refresh, host removal/revocation and explicit `ctl.commands` authoring.
@@ -328,3 +332,25 @@ share a request; results keep input order and retain per-method errors. A batch
 uses the same token recovery, request deadline and cancellation as `ctx.call`,
 and is never replayed automatically. Older SDKs and binary backends retain the
 single-call client. Rebuild the window with the current CLI/SDK to adopt it.
+
+### DSM-managed gateway HTTPS
+
+With gateway SDK 0.17.5 or later and a package target of DSM 7.2-64570 or later,
+the build uses DSM's native web-config worker for a separate HTTPS App origin.
+No Web Station dependency or executor capability is added. nginx inherits DSM's
+system default certificate, which must be trusted by the browser and cover the
+App hostname. The package never reads DSM's private key.
+
+The declared HTTPS port is served by nginx. If only an HTTP port was declared,
+that port becomes the HTTPS entry; use the generated gateway launcher. A second
+HTTP port redirects to HTTPS. nginx connects to a private, mutually authenticated
+gateway socket and preserves the session, client IP, CSRF and WebSocket checks.
+The package-account post-install/upgrade hooks prepare private connection
+credentials with DSM's OpenSSL after DSM creates package state and before
+package start activates nginx.
+
+Older SDK/DSM targets retain the direct listener and explain its certificate or
+unencrypted-HTTP limitations before opening it. Native resource/startup failures
+fail closed; they do not silently expose a direct listener. The native runtime
+requires the corresponding SDK release; this CLI change does not publish that
+release or change existing manifest version pins.

package/dist/build-spk/compose-retained-data.d.ts

@@ -0,0 +1,11 @@
+import { type ComposeAppData } from "../runtime/compose-data.js";
+import { type Locale } from "../standalone/i18n.js";
+export declare const COMPOSE_DATA_RETAINED = "COMPOSE_DATA_RETAINED";
+/** Same segment spacing as the SDK image-pull diagnosis; support code goes last. */
+export declare function composeRetainedMessage(data: ComposeAppData, locale: Locale): string;
+/**
+ * Embedded in the native hook: postuninst need not find an already removed
+ * payload/helper. Names describe the plan, not a privileged Docker readback.
+ * Reporting is informational and must never prevent package removal.
+ */
+export declare function renderComposeRetainedData(data?: ComposeAppData): string;

package/dist/build-spk/compose-retained-data.js

@@ -0,0 +1,34 @@
+import { COMPOSE_DELETE_CHOICE } from "../runtime/compose-data.js";
+import { DSM_LANGS, LOCALES } from "../standalone/i18n.js";
+import { translator } from "./wizard-i18n.js";
+export const COMPOSE_DATA_RETAINED = "COMPOSE_DATA_RETAINED";
+/** Same segment spacing as the SDK image-pull diagnosis; support code goes last. */
+export function composeRetainedMessage(data, locale) {
+    const t = translator(locale);
+    const separator = ["zh-TW", "zh-CN", "ja"].includes(locale) ? "" : " ";
+    return t("compose.retained.message", { volumes: data.volumes.map(v => v.name).join(", ") }) +
+        separator + t("compose.diagnosis.error_code", { code: COMPOSE_DATA_RETAINED });
+}
+const quote = (text) => `'${text.replaceAll("'", "'\\''")}'`;
+/**
+ * Embedded in the native hook: postuninst need not find an already removed
+ * payload/helper. Names describe the plan, not a privileged Docker readback.
+ * Reporting is informational and must never prevent package removal.
+ */
+export function renderComposeRetainedData(data) {
+    if (!data?.volumes.length)
+        return "";
+    const cases = LOCALES.map(locale => `    ${locale}|${DSM_LANGS[locale]}) compose_data_message=${quote(composeRetainedMessage(data, locale))} ;;`).join("\n");
+    return `${COMPOSE_DELETE_CHOICE}if [ "$compose_remove_data" -eq 1 ]; then
+  case "\${SYNOPKG_DSM_LANGUAGE:-enu}" in
+${cases}
+    *) compose_data_message=${quote(composeRetainedMessage(data, "en"))} ;;
+  esac
+  if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ] && [ ! -L "$SYNOPKG_TEMP_LOGFILE" ]; then
+    if [ ! -e "$SYNOPKG_TEMP_LOGFILE" ] || [ -f "$SYNOPKG_TEMP_LOGFILE" ]; then
+      (printf '%s\\n' "$compose_data_message" >> "$SYNOPKG_TEMP_LOGFILE") 2>/dev/null || :
+    fi
+  fi
+fi
+`;
+}

package/dist/build-spk/delete-app-data.d.ts

@@ -8,7 +8,7 @@
  * pre-0.5 key `delete_app_data` and DSM's `wizard_` mirror of either key are
  * still honoured for scripted callers.
  *
- * Deletion never runs on an upgrade: DSM replays postuninst for the old
+ * Deletion runs only on exact UNINSTALL, never on an upgrade or stop: DSM replays postuninst for the old
  * version, and the new version must find its data.
  *
  * Every root is resolved first and must land on `/volumeN/@<area>/<package>`

package/dist/build-spk/delete-app-data.js

@@ -4,7 +4,7 @@ function shellQuote(value) {
 export function renderDeleteAppDataBlock(packageName, roots, options = {}) {
     const calls = roots.map((root) => `  delete_root "$${root.variable}" ${root.area}`).join("\n");
     return `remove_additional=0
-if [ "\${SYNOPKG_PKG_STATUS:-}" != UPGRADE ]; then
+if [ "\${SYNOPKG_PKG_STATUS:-}" = UNINSTALL ]; then
   for flag in "\${pkgwizard_remove_additional:-}" "\${wizard_pkgwizard_remove_additional:-}" "\${delete_app_data:-}" "\${wizard_delete_app_data:-}"; do
     case "$flag" in
       true|True|TRUE|yes|1) remove_additional=1 ;;

package/dist/build-spk/uninstall-wizard.d.ts

@@ -1,3 +1,4 @@
+import type { ComposeAppData } from "../runtime/compose-data.js";
 import type { Locale } from "../standalone/i18n.js";
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
@@ -5,6 +6,7 @@ export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 export declare const DELETE_STATE_KEY = "pkgwizard_delete_state";
 export type UninstallWizardKind = "native" | "container";
 interface UninstallWizardOptions {
+    composeData?: ComposeAppData;
     /** The App runs the root executor (rootOps or delegate), which purges DSM's leftovers on uninstall. */
     executor?: boolean;
     /** The App declares a Login Portal alias (web-config app-portal); DSM reloads nginx through INFO. */

package/dist/build-spk/uninstall-wizard.js

@@ -8,7 +8,7 @@ function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
 const html = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-function renderUninstallWizard(t, locale, packageName, kind, { executor = false, portal = false, portalEntry = false, state, rootPurge = false }) {
+function renderUninstallWizard(t, locale, packageName, kind, { executor = false, portal = false, portalEntry = false, state, rootPurge = false, composeData }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -33,6 +33,7 @@ function renderUninstallWizard(t, locale, packageName, kind, { executor = false,
                 ] : []),
                 ...(executor && rootPurge ? [{ desc: t("uninstall.purge.root", vars) }] : []),
                 ...(state ? [{ desc: t("uninstall.state.heading") }, { desc: list(state.items(locale).map(html)) }] : []),
+                ...(composeData?.volumes.length ? [{ desc: t("uninstall.composeRetained", { volumes: composeData.volumes.map(v => v.name).join(", ") }) }] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",

package/dist/build-spk/wizard-messages.d.ts

@@ -1,4 +1,26 @@
 export declare const WIZARD_MESSAGES: {
+    "uninstall.composeRetained": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "compose.retained.message": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "compose.diagnosis.registry_check": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -1,4 +1,26 @@
 export const WIZARD_MESSAGES = {
+    "uninstall.composeRetained": {
+        "en": "Container data volumes are kept, even when you select delete-data: {volumes}. Their data will NOT be deleted.",
+        "zh-TW": "即使勾選刪除資料，容器資料磁碟區會保留：{volumes}。其中的資料不會刪除。",
+        "zh-CN": "即使勾选删除数据，容器数据卷也会保留：{volumes}。其中的数据不会删除。",
+        "ja": "データ削除を選択しても、コンテナのデータボリュームは保持されます：{volumes}。その中のデータは削除されません。",
+        "ko": "데이터 삭제를 선택해도 컨테이너 데이터 볼륨은 보존됩니다: {volumes}. 볼륨의 데이터는 삭제되지 않습니다.",
+        "de": "Container-Datenvolumes bleiben erhalten, auch wenn Sie die Datenlöschung auswählen: {volumes}. Die darin gespeicherten Daten werden NICHT gelöscht.",
+        "fr": "Les volumes de données des conteneurs sont conservés, même si vous choisissez de supprimer les données : {volumes}. Leurs données ne seront PAS supprimées.",
+        "es": "Los volúmenes de datos de los contenedores se conservan aunque seleccione eliminar datos: {volumes}. Sus datos NO se eliminarán.",
+        "it": "I volumi dati dei container vengono conservati anche se si seleziona l’eliminazione dei dati: {volumes}. I dati al loro interno NON verranno eliminati."
+    },
+    "compose.retained.message": {
+        "en": "Container data volumes were NOT deleted: {volumes}. Their data is kept.",
+        "zh-TW": "容器資料磁碟區並未刪除：{volumes}。其中的資料已保留。",
+        "zh-CN": "容器数据卷并未删除：{volumes}。其中的数据已保留。",
+        "ja": "コンテナのデータボリュームは削除されていません：{volumes}。その中のデータは保持されます。",
+        "ko": "컨테이너 데이터 볼륨이 삭제되지 않았습니다: {volumes}. 볼륨의 데이터는 보존됩니다.",
+        "de": "Container-Datenvolumes wurden NICHT gelöscht: {volumes}. Die darin gespeicherten Daten bleiben erhalten.",
+        "fr": "Les volumes de données des conteneurs n’ont PAS été supprimés : {volumes}. Leurs données sont conservées.",
+        "es": "Los volúmenes de datos de los contenedores NO se eliminaron: {volumes}. Sus datos se conservan.",
+        "it": "I volumi dati dei container NON sono stati eliminati: {volumes}. I dati al loro interno vengono conservati."
+    },
     "compose.diagnosis.registry_check": {
         "en": "Registry check",
         "zh-TW": "登錄站檢查",

package/dist/ctl/cli.js

@@ -6,7 +6,7 @@ import { CtlError, errorData, ctlError } from './errors.js';
 import { CtlStore } from './store.js';
 import { CtlClient, boundedMap } from './service.js';
 import { selectHosts, selectApp, selectOperation, flagName, RESERVED_FLAGS } from './input.js';
-import { canonicalOrigin, createRequest } from './transport.js';
+import { canonicalOrigin, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { loginDsm, logoutDsm } from './dsm-auth.js';
 import { publicOperation } from './redaction.js';
 const USAGE = 'synopkgland ctl host add|list|show|login|logout|remove|revoke; ctl list [--host a,b|--all-hosts] [--app pkg] [--refresh]; ctl <alias|package> <command...> [typed flags|--input file|-] [--dry-run] [--yes]';
@@ -70,7 +70,11 @@ export async function runCtl(argv, io = {}) {
             emit({ ok: true, data: { usage: USAGE } });
             return;
         }
-        const client = (host) => new CtlClient(store, host, io.requestFor?.(host));
+        const timeout = take(args, '--timeout', true);
+        if (timeout && (!/^\d+$/.test(timeout) || Number(timeout) < 1 || Number(timeout) > 3600))
+            throw new CtlError('CTL_ARGUMENT_INVALID', '--timeout must be 1–3600 seconds.', 'Use --timeout 60.');
+        const timeoutMs = timeout ? Number(timeout) * 1000 : CTL_TIMEOUT_MS;
+        const client = (host) => new CtlClient(store, host, io.requestFor?.(host), timeoutMs);
         const discoverOptions = { refresh, app: appFilter, approve, confirm: tty ? async (packages) => /^y(es)?$/i.test(await ask('Allow DSM session to fixed description endpoints for ' + packages.map(p => p.id + '@' + p.version).join(', ') + '? [y/N] ')) : undefined };
         if (args[0] === 'host') {
             const action = args[1], name = args[2];
@@ -100,7 +104,7 @@ export async function runCtl(argv, io = {}) {
                 const host = old ?? { name, origin: canonicalOrigin(url, tunnel), username: usernameOption ?? await ask('DSM account: '), approved: {}, ...(tunnel ? { tunnel: true } : {}), ...(ca ? { ca } : {}) };
                 const previous = old ? await store.credentials.get(store.key(host)) : null;
                 const secret = passwordStdin ? readBounded(0, 4096).replace(/[\r\n]+$/, '') : await ask('User password: ', true);
-                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => ask('DSM OTP: ', true), request: io.requestFor?.(host), ca: host.ca ? readFileSync(host.ca, 'utf8') : undefined });
+                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => ask('DSM OTP: ', true), request: io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined), ca: host.ca ? readFileSync(host.ca, 'utf8') : undefined });
                 try {
                     if (old)
                         await store.credentials.set(store.key(host), session);
@@ -108,7 +112,7 @@ export async function runCtl(argv, io = {}) {
                         await store.add(host, session);
                 }
                 catch (e) {
-                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin)).catch(() => { });
+                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs)).catch(() => { });
                     throw e;
                 }
                 host.lastUsed = new Date().toISOString();
@@ -135,7 +139,7 @@ export async function runCtl(argv, io = {}) {
                 let logoutError;
                 if (session?.cookie) {
                     try {
-                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, 10000, host.ca ? readFileSync(host.ca, 'utf8') : undefined));
+                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined));
                         loggedOut = true;
                     }
                     catch (error) {
@@ -184,7 +188,7 @@ export async function runCtl(argv, io = {}) {
                     return { host: name, ok: true, data: path.length ? { ...view, commands: [view.commands.find(c => c.id === selectOperation(app, path).id)] } : view };
                 }
                 const tail = args.slice(1);
-                const noWait = !!take(tail, '--no-wait'), wait = !!take(tail, '--wait'), timeout = take(tail, '--timeout', true);
+                const noWait = !!take(tail, '--no-wait'), wait = !!take(tail, '--wait');
                 if (noWait && wait)
                     throw new CtlError('CTL_ARGUMENT_INVALID', 'Use --wait or --no-wait.', 'run: synopkgland ctl list --json');
                 if (timeout && (!/^\d+$/.test(timeout) || Number(timeout) < 1 || Number(timeout) > 3600))

package/dist/ctl/flows.js

@@ -32,13 +32,13 @@ export async function runFlow(flow, params, invoke, options) {
         }
         throw new CtlError('CTL_FLOW_LIMIT', 'Pagination page limit reached; result is incomplete.', 'Narrow the query.', 5);
     }
+    const until = performance.now() + Math.min(options.timeoutMs ?? flow.timeoutMs, 3600000);
     const accepted = await invoke(flow.start, params);
     if (options.wait === false)
         return { accepted: true, job: accepted };
     const id = field(accepted, flow.jobId);
     if (!['string', 'number'].includes(typeof id))
         throw new CtlError('CTL_FLOW_RESPONSE', 'Start response has no job ID.', 'Check command metadata; start is not retried.', 5);
-    const until = performance.now() + Math.min(options.timeoutMs ?? flow.timeoutMs, 3600000);
     while (performance.now() < until) {
         const poll = await invoke(flow.poll, { [flow.idParam]: id });
         const state = field(poll, flow.state);

package/dist/ctl/service.d.ts

@@ -15,7 +15,9 @@ export declare class CtlClient {
     store: CtlStore;
     host: Host;
     request: JsonRequest;
-    constructor(store: CtlStore, host: Host, request?: JsonRequest);
+    constructor(store: CtlStore, host: Host, request?: JsonRequest, timeoutMs?: number);
+    private until?;
+    private remaining;
     valid(): Promise<boolean>;
     inventory(session: DsmSession): Promise<{
         id: string;
@@ -34,5 +36,6 @@ export declare class CtlClient {
         wait?: boolean;
         timeoutMs?: number;
     }): Promise<any>;
+    private executeWithin;
     private appCookieSession;
 }

package/dist/ctl/service.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { CtlError, errorData, choose } from './errors.js';
-import { APP_COOKIE, createRequest } from './transport.js';
+import { APP_COOKIE, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { DESCRIPTION_METHOD, validateDescriptor, ajv } from './descriptor.js';
 import { runFlow } from './flows.js';
 import { SensitiveOutput } from './redaction.js';
@@ -14,11 +14,13 @@ export class CtlClient {
     store;
     host;
     request;
-    constructor(store, host, request) {
+    constructor(store, host, request, timeoutMs = CTL_TIMEOUT_MS) {
         this.store = store;
         this.host = host;
-        this.request = request ?? createRequest(host.origin, 10000, host.ca ? readFileSync(host.ca, 'utf8') : undefined);
+        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), host.ca ? readFileSync(host.ca, 'utf8') : undefined);
     }
+    until;
+    remaining(fallback) { return this.until === undefined ? fallback : Math.max(0, this.until - performance.now()); }
     async valid() { try {
         await this.inventory(await this.store.session(this.host));
         return true;
@@ -102,11 +104,23 @@ export class CtlClient {
         return { apps: results.flatMap(r => r.description ? [r.description] : []), diagnostics: results.flatMap(r => r.error ? [r.error] : []), cacheHits };
     }
     async execute(name, path, args, options = {}) {
+        try {
+            return await this.executeWithin(name, path, args, options);
+        }
+        finally {
+            this.until = undefined;
+        }
+    }
+    async executeWithin(name, path, args, options = {}) {
+        const started = performance.now();
+        this.until = started + (options.timeoutMs ?? CTL_TIMEOUT_MS);
         const listing = await this.discover(options);
         const app = selectApp(listing.apps, name);
         const { id, operation } = selectOperation(app, path);
         const params = operationInput(operation, args, options.stdin, `run: synopkgland ctl ${name} ${operation.cli.join(' ')} --host ${this.host.name} --help`);
         const output = new SensitiveOutput(params, operation.paramsSchema);
+        if (options.timeoutMs === undefined && operation.flow.type === 'job')
+            this.until = started + operation.flow.timeoutMs;
         try {
             const plan = requestPlan(app, id, params);
             if (operation.flow.type === 'upload')
@@ -135,9 +149,9 @@ export class CtlClient {
                     return response.data;
                 };
                 const ca = this.host.ca ? readFileSync(this.host.ca, 'utf8') : undefined;
-                const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: options.timeoutMs,
-                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, timeoutMs: options.timeoutMs }),
-                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, timeoutMs: options.timeoutMs, file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
+                const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS),
+                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
+                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
                 if (operation.resultSchema && !ajv.validate(operation.resultSchema, result))
                     throw new CtlError('CTL_RESPONSE_INVALID', 'Result does not match command schema.', 'Check the App version.', 5);
                 return output.clean(result, operation.resultSchema);

package/dist/ctl/transfers.d.ts

@@ -1,4 +1,4 @@
-import type { DsmSession } from './transport.js';
+import { type DsmSession } from './transport.js';
 export declare function localFile(file: unknown): {
     file: string;
     size: number;

package/dist/ctl/transfers.js

@@ -2,6 +2,7 @@ import { createReadStream, statSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
 import { CtlError } from './errors.js';
+import { CTL_TIMEOUT_MS } from './transport.js';
 export function localFile(file) { if (typeof file !== 'string' || !file)
     throw new CtlError('CTL_INPUT_FILE', 'A local filename is required.', 'Use --file <path>.'); try {
     const stat = statSync(file);
@@ -15,6 +16,8 @@ catch {
 export async function transferRequest(session, path, method, params, options = {}) {
     if (!/^\/webman\/3rdparty\/[A-Za-z][A-Za-z0-9_.+-]*\/cgi\/api\.cgi$/.test(path) || !/^([a-z][a-z0-9_]*\.)+[a-z][a-z0-9_]*$/.test(method))
         throw new CtlError('CTL_PATH_INVALID', 'Invalid transfer binding.', 'Refresh the API description.', 4);
+    if (options.timeoutMs !== undefined && options.timeoutMs <= 0)
+        throw new CtlError('CTL_NETWORK', 'Transfer budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
     const url = new URL(path, session.origin);
     const file = options.file ? localFile(options.file.path) : undefined;
     if (options.file) {
@@ -23,7 +26,7 @@ export async function transferRequest(session, path, method, params, options = {
     const raw = file ? undefined : Buffer.from(JSON.stringify({ method, params }));
     return new Promise((resolve, reject) => {
         const headers = { 'content-type': file ? 'application/octet-stream' : 'application/json', cookie: session.cookie, 'X-SYNO-TOKEN': session.token, origin: session.origin, 'content-length': String(file?.size ?? raw.length) };
-        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: 30000, ...(options.ca ? { ca: options.ca } : {}) }, res => {
+        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}) }, res => {
             const expected = file ? 'application/json' : 'application/x-ndjson';
             if (res.statusCode !== 200 || !res.headers['content-type']?.includes(expected)) {
                 res.resume();
@@ -58,7 +61,7 @@ export async function transferRequest(session, path, method, params, options = {
                 reject(new CtlError('CTL_TRANSFER_FAILED', 'Invalid or failed transfer response.', 'Inspect the App result; do not retry writes blindly.', 5));
             } });
         });
-        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? 30000);
+        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? CTL_TIMEOUT_MS);
         req.once('close', () => clearTimeout(wallTimer));
         req.on('timeout', () => req.destroy());
         req.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer interrupted; completion may be uncertain.', 'Check App state before retrying.', 6)));

package/dist/ctl/transport.d.ts

@@ -1,3 +1,4 @@
+export declare const CTL_TIMEOUT_MS = 62000;
 export declare const APP_COOKIE: unique symbol;
 export interface DsmSession {
     origin: string;
@@ -8,4 +9,4 @@ export interface DsmSession {
 }
 export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
 export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number, ca?: string): JsonRequest;
+export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string): JsonRequest;

package/dist/ctl/transport.js

@@ -2,6 +2,7 @@ import { strictJson } from './json.js';
 import http from 'node:http';
 import https from 'node:https';
 import { CtlError } from './errors.js';
+export const CTL_TIMEOUT_MS = 62000;
 export const APP_COOKIE = Symbol("ctlAppCookie");
 export function canonicalOrigin(input, tunnel = false) {
     let url;
@@ -15,10 +16,13 @@ export function canonicalOrigin(input, tunnel = false) {
         throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
     return url.origin;
 }
-export function createRequest(origin, timeoutMs = 10000, ca) {
+export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
     return async (path, body, session) => {
         if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
             throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
+        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs;
+        if (remaining <= 0)
+            throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
         const url = new URL(path, origin);
         if (url.origin !== origin || (session && session.origin !== origin))
             throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland ctl host list', 4);
@@ -32,7 +36,7 @@ export function createRequest(origin, timeoutMs = 10000, ca) {
                 headers.cookie = session.cookie;
                 headers['X-SYNO-TOKEN'] = session.token;
             }
-            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: timeoutMs, ...(ca ? { ca } : {}) }, res => {
+            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}) }, res => {
                 if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
                     res.resume();
                     reject(new CtlError('CTL_HTTP_ERROR', `HTTP ${res.statusCode}; redirects are never followed.`, 'Check the NAS URL and connection.', 6));
@@ -69,7 +73,7 @@ export function createRequest(origin, timeoutMs = 10000, ca) {
                     }
                 });
             });
-            const wallTimer = setTimeout(() => req.destroy(), timeoutMs);
+            const wallTimer = setTimeout(() => req.destroy(), remaining);
             req.once('close', () => clearTimeout(wallTimer));
             req.on('timeout', () => req.destroy());
             req.on('error', () => reject(new CtlError('CTL_NETWORK', 'NAS request failed or timed out.', 'Check the NAS connection and trusted CA; requests are not replayed.', 6)));

package/dist/runtime/compose-data.d.ts

@@ -0,0 +1,10 @@
+/** Only the trusted SDK planner supplies names for retained-data reporting. */
+export interface ComposeAppData {
+    project: string;
+    volumes: Array<{
+        key: string;
+        name: string;
+    }>;
+}
+export declare function validComposeAppData(value: unknown, pkg: string): value is ComposeAppData;
+export declare const COMPOSE_DELETE_CHOICE = "compose_remove_data=0\nif [ \"${SYNOPKG_PKG_STATUS:-}\" = UNINSTALL ]; then\n  for flag in \"${pkgwizard_remove_additional:-}\" \"${wizard_pkgwizard_remove_additional:-}\" \"${delete_app_data:-}\" \"${wizard_delete_app_data:-}\"; do\n    case \"$flag\" in true|True|TRUE|yes|1) compose_remove_data=1 ;; esac\n  done\nfi\n";

package/dist/runtime/compose-data.js

@@ -0,0 +1,20 @@
+export function validComposeAppData(value, pkg) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const inventory = value;
+    return Object.keys(inventory).every(key => ["project", "volumes"].includes(key)) &&
+        typeof inventory.project === "string" && /^[a-z][a-z0-9-]{0,96}$/.test(inventory.project) &&
+        (inventory.project === pkg.toLowerCase() || inventory.project.endsWith("-" + pkg.toLowerCase())) &&
+        Array.isArray(inventory.volumes) && inventory.volumes.length <= 256 &&
+        new Set(inventory.volumes.map(volume => volume?.key)).size === inventory.volumes.length &&
+        inventory.volumes.every(volume => volume && Object.keys(volume).length === 2 &&
+            typeof volume.key === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(volume.key) &&
+            volume.name === inventory.project + "_" + volume.key);
+}
+export const COMPOSE_DELETE_CHOICE = `compose_remove_data=0
+if [ "\${SYNOPKG_PKG_STATUS:-}" = UNINSTALL ]; then
+  for flag in "\${pkgwizard_remove_additional:-}" "\${wizard_pkgwizard_remove_additional:-}" "\${delete_app_data:-}" "\${wizard_delete_app_data:-}"; do
+    case "$flag" in true|True|TRUE|yes|1) compose_remove_data=1 ;; esac
+  done
+fi
+`;

package/dist/runtime/executor-digests.json

@@ -42,5 +42,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.17.5": {
+        "x86_64": "af37ecd6bb5ab3e954b5f5bb3db2499b3cf86f0502afdcea18e8dc0614a46e5d",
+        "aarch64": "87436df3f591e0126d88866922b032968d0dbd01a109de53ab751ef779257baf",
+        "armv7": "de354d6e582ad1fe3124c3f30eb7f3ce8af456b0fcfad8f23c10421d3a3f3d42",
+        "lifecycle": {
+            "x86_64": "f3b368c86677741b48b059699a86c935157ea797634a6116131678e8bbaf33ed",
+            "aarch64": "b6ccd1365844e6eee9db4ce5833b655f4f1e138bf34317cdbd0e2342d3342a9e",
+            "armv7": "57b6350c2812783cb536384f8b363c26d894af6589b5f19464d71d8d0a8035d5"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -18,6 +18,12 @@ export interface DelegateCapability {
 export declare function validDelegate(value: unknown): value is DelegateCapability;
 export declare const sha256: (data: string | Buffer) => string;
 export interface ExecutorPolicy {
+    timeouts?: {
+        start: number;
+        stop: number;
+        purge: number;
+        operation: number;
+    };
     webapi?: WebAPIProfiles;
     v: 1;
     app: string;
@@ -56,9 +62,28 @@ export declare function executorPolicy(m: {
     portal?: PortalDeclaration;
     os_min_ver?: string;
     displayname?: string;
+    daemon?: {
+        timeouts: {
+            start: number;
+            stop: number;
+            status: number;
+            uninstall: number;
+        };
+    };
+    lifecycleTimeouts?: {
+        start: number;
+        stop: number;
+        status: number;
+        uninstall: number;
+    };
+    backend?: {
+        kind: string;
+        timeoutSeconds?: number;
+    };
     uninstall?: {
         purge: {
             root?: string;
+            timeout?: number;
         };
     };
 }, arch?: NativeArchFamily): ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -1,3 +1,4 @@
+import { operationBudgetSeconds } from "./runtime-budgets.js";
 import { validWebAPIProfiles, sortedWebAPIProfiles } from './webapi-profile.js';
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
@@ -57,6 +58,12 @@ export function executorPolicy(m, arch) {
         operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), ...(purge ? { purge } : {}), ...(settings?.stop ? { stop: settings.stop } : {}),
         ...(settings?.start ? { start: settings.start } : {}),
         ...(m.capabilities.webapi ? { webapi: sortedWebAPIProfiles(m.capabilities.webapi) } : {}),
+        ...((m.lifecycleTimeouts || m.daemon || m.backend?.timeoutSeconds || (m.uninstall?.purge.root && m.uninstall.purge.timeout)) ? { timeouts: {
+                start: m.lifecycleTimeouts?.start ?? m.daemon?.timeouts.start ?? 60,
+                stop: m.lifecycleTimeouts?.stop ?? m.daemon?.timeouts.stop ?? 60,
+                purge: m.lifecycleTimeouts?.uninstall ?? m.daemon?.timeouts.uninstall ?? Math.min(3600, Math.max(300, m.uninstall?.purge.timeout ?? 0)),
+                operation: operationBudgetSeconds(m),
+            } } : {}),
         root, ...(settings?.state ? { root_state: true } : {}) };
 }
 /** A script without settings keeps the bare digest; a binary pins the bytes built for this architecture. */
@@ -86,7 +93,7 @@ export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state', 'webapi'].includes(key))
+    if (Object.keys(p).some(key => !['timeouts', 'v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state', 'webapi'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
@@ -97,6 +104,8 @@ export function validExecutorPolicy(value, pkg) {
         || 'root_state' in p && p.root_state !== true
         || Object.entries(p.root).some(([name, entry]) => !ROOT_PROGRAM_NAME.test(name) || rootEntryProblem(entry) !== undefined))
         return false;
+    if (p.timeouts !== undefined && (!p.timeouts || typeof p.timeouts !== 'object' || Array.isArray(p.timeouts) || Object.keys(p.timeouts).sort().join(',') !== 'operation,purge,start,stop' || Object.entries(p.timeouts).some(([key, n]) => !Number.isInteger(n) || n < (key === 'operation' ? 1 : 2) || n > 3600)))
+        return false;
     const rootOps = rootOperations(p.root);
     if (![...ROOT_JOB_OPERATIONS, 'root.run'].every(op => p.operations.includes(op) === rootOps.includes(op)))
         return false;

package/dist/runtime/runtime-budgets.d.ts

@@ -0,0 +1,24 @@
+/** Work budgets use existing author settings; credential lifetimes stay separate. */
+interface OperationBudgetSource {
+    backend?: {
+        kind: string;
+        timeoutSeconds?: number;
+    };
+    daemon?: {
+        timeouts?: {
+            status: number;
+        };
+    };
+    lifecycleTimeouts?: {
+        status: number;
+    };
+}
+/**
+ * A CGI's declared request budget owns operation work. Binary and Compose Apps
+ * have no compiled CGI deadline to configure, so their existing status allowance
+ * can enlarge the shared operation budget above its 60-second default.
+ */
+export declare function operationBudgetSeconds(source: OperationBudgetSource): number;
+/** First released SDK that decodes operation/lifecycle budget config fields. */
+export declare function runtimeBudgetSdkSupported(sdk: string): boolean;
+export {};