@synopackageland/cli 0.17.4 → 0.17.5

package/dist/runtime/runtime-budgets.js

@@ -0,0 +1,13 @@
+/**
+ * A CGI's declared request budget owns operation work. Binary and Compose Apps
+ * have no compiled CGI deadline to configure, so their existing status allowance
+ * can enlarge the shared operation budget above its 60-second default.
+ */
+export function operationBudgetSeconds(source) {
+    return source.backend?.timeoutSeconds ?? Math.max(60, source.lifecycleTimeouts?.status ?? source.daemon?.timeouts?.status ?? 5);
+}
+/** First released SDK that decodes operation/lifecycle budget config fields. */
+export function runtimeBudgetSdkSupported(sdk) {
+    const [major, minor, patch] = sdk.split('.').map(Number);
+    return major > 0 || minor > 17 || minor === 17 && patch >= 5;
+}

package/dist/standalone/background.d.ts

@@ -18,7 +18,7 @@ export declare function readBackground(value: unknown, fail: (error: StandaloneE
 export declare function renderBackgroundResource(): string;
 /** The worker's arguments: none for a Go App's own worker, `--worker` for the bridge runtime (spec/bridge/v1). */
 export declare const BRIDGE_WORKER_ARGS: readonly ["--worker"];
-export declare function renderBackgroundUnit(pkg: string, args?: readonly string[]): string;
+export declare function renderBackgroundUnit(pkg: string, args?: readonly string[], stopSeconds?: number): string;
 /** Shell function that stops the worker in lifecycle hooks; call it as `stop_background_worker`. */
 export declare function renderBackgroundWorkerStop(pkg: string): string;
 /**
@@ -32,8 +32,8 @@ export declare function renderBackgroundWorkerStop(pkg: string): string;
  * exits. Stop only such a manager, as the package user; the acquire that
  * follows then starts a fresh one.
  */
-export declare function renderUserManagerRecovery(): string;
+export declare function renderUserManagerRecovery(startSeconds?: number): string;
 /** Shell function that starts the worker and names the failed step; call it as `start_background_worker`. */
 export declare function renderBackgroundWorkerStart(pkg: string): string;
 /** Package Center's start/stop/status map straight onto the user unit. */
-export declare function renderBackgroundControl(pkg: string): string;
+export declare function renderBackgroundControl(pkg: string, startSeconds?: number): string;

package/dist/standalone/background.js

@@ -24,7 +24,7 @@ export function renderBackgroundResource() {
 }
 /** The worker's arguments: none for a Go App's own worker, `--worker` for the bridge runtime (spec/bridge/v1). */
 export const BRIDGE_WORKER_ARGS = ["--worker"];
-export function renderBackgroundUnit(pkg, args = []) {
+export function renderBackgroundUnit(pkg, args = [], stopSeconds = 30) {
     return `[Unit]
 Description=${pkg} background worker
 
@@ -33,7 +33,7 @@ Type=simple
 ExecStart=${[`/var/packages/${pkg}/target/${BACKGROUND_WORKER_PAYLOAD}`, ...args].join(" ")}
 UMask=0077
 KillMode=control-group
-TimeoutStopSec=10
+TimeoutStopSec=${stopSeconds}
 Restart=no
 `;
 }
@@ -66,13 +66,15 @@ export function renderBackgroundWorkerStop(pkg) {
  * exits. Stop only such a manager, as the package user; the acquire that
  * follows then starts a fresh one.
  */
-export function renderUserManagerRecovery() {
+export function renderUserManagerRecovery(startSeconds = 30) {
     return `recover_user_manager() {
   uid="$(id -u)" || return 1
   [ "$uid" != 0 ] || return 0
-  i=0
-  while [ "$(/usr/bin/loginctl show-user "$uid" -p State 2>/dev/null)" = State=closing ] && [ "$i" -lt 100 ]; do
-    sleep 0.1; i=$((i + 1))
+  manager_now() { awk '{print int($1)}' /proc/uptime; }
+  manager_until=$(( $(manager_now) + ${startSeconds} ))
+  while [ "$(/usr/bin/loginctl show-user "$uid" -p State 2>/dev/null)" = State=closing ]; do
+    [ "$(manager_now)" -lt "$manager_until" ] || { echo "package user manager still closing" >&2; return 1; }
+    sleep 0.1
   done
   [ -S "/run/user/$uid/systemd/private" ] && return 0
   for exe in /proc/[0-9]*/exe; do
@@ -81,12 +83,11 @@ export function renderUserManagerRecovery() {
     case " $(tr '\\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null)" in *" --user "*) ;; *) continue ;; esac
     echo "package user manager $pid has no socket in /run/user/$uid; stopping it so DSM starts a fresh one" >&2
     kill -TERM "$pid" || return 1
-    i=0
     # DSM's bash logs a failed kill to syslog even with 2>/dev/null, so the
     # exit is looked up in /proc.
     while [ -d "/proc/$pid" ]; do
-      [ "$i" -lt 100 ] || { echo "package user manager $pid did not exit" >&2; return 1; }
-      sleep 0.1; i=$((i + 1))
+      [ "$(manager_now)" -lt "$manager_until" ] || { echo "package user manager $pid did not exit" >&2; return 1; }
+      sleep 0.1
     done
   done
 }
@@ -105,10 +106,10 @@ export function renderBackgroundWorkerStart(pkg) {
 `;
 }
 /** Package Center's start/stop/status map straight onto the user unit. */
-export function renderBackgroundControl(pkg) {
+export function renderBackgroundControl(pkg, startSeconds = 30) {
     const unit = backgroundUnitName(pkg);
     return `#!/bin/sh
-${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+${renderUserManagerRecovery(startSeconds)}${renderBackgroundWorkerStart(pkg)}case "$1" in
   prestart) recover_user_manager ;;
   prestop) exit 0 ;;
   start) start_background_worker ;;

package/dist/standalone/compose.d.ts

@@ -1,7 +1,9 @@
+import { type ComposeAppData } from "../runtime/compose-data.js";
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Daemon } from "./daemon.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface ComposePlan {
+    app_data?: ComposeAppData;
     startup_timeout_seconds?: number;
     ingress?: {
         address: string;
@@ -79,7 +81,7 @@ export declare function readComposeApp(value: unknown, root: string, arches: Nat
     architecture?: NativeArchFamily;
     imageProofs?: unknown;
 }): ComposeApp | undefined;
-export declare function composeDaemon(m: Pick<StandaloneManifest, "compose">): Daemon;
+export declare function composeDaemon(m: Pick<StandaloneManifest, "compose" | "lifecycleTimeouts">): Daemon;
 export declare function composeNetwork(m: Pick<StandaloneManifest, "compose" | "identityGateway" | "spkVersion">): {
     public_ports: number[];
     readiness?: {

package/dist/standalone/compose.js

@@ -1,3 +1,4 @@
+import { validComposeAppData } from "../runtime/compose-data.js";
 import { composeDiagnosisMessages, renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { COMPOSE_ERRORS } from "./compose-errors.js";
 import { spawnSync } from "node:child_process";
@@ -117,6 +118,12 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
             plan.startup_timeout_seconds !== value.startup_timeout_seconds)
             throw new Error("[SDK_COMPOSE_UNSUPPORTED] This SDK does not implement the declared startup budget; use the matching SDK/CLI release.");
         const document = parse(plan.effective);
+        const volumes = Object.entries(document?.volumes ?? {});
+        if ((!validComposeAppData(plan.app_data, context.package ?? "ComposeApp")
+            || JSON.stringify(plan.app_data) !== JSON.stringify(plan.lock?.app_data)
+            || plan.app_data.project !== plan.project_name || plan.app_data.volumes.length !== volumes.length
+            || volumes.some(([key, value]) => !plan.app_data.volumes.some(v => v.key === key && v.name === value.name))))
+            throw new Error("[SDK_COMPOSE_UNSUPPORTED] This SDK does not provide the complete Compose App data contract; update the SDK and rebuild.");
         const web = value.web;
         return {
             declaration: { ...value },
@@ -150,7 +157,7 @@ export function composeDaemon(m) {
         args: ["run"],
         targets: m.compose.targets,
         env: {},
-        timeouts: { start: m.compose.plan.startup_timeout_seconds ?? 120, stop: 30, status: 5, uninstall: 60 },
+        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 120 },
     };
 }
 export function composeNetwork(m) {

package/dist/standalone/daemon.d.ts

@@ -30,3 +30,7 @@ export declare function buildDaemonControl(manifest: StandaloneManifest, arch: N
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;
 /** Copies a bounded, link-free package-account payload tree. */
 export declare function copyPayloadTree(root: string, source: string, target: string): void;
+/** Existing lifecycle namespace; a timeout-only declaration runs no daemon. */
+export declare function readLifecycleTimeouts(value: unknown, fail: (e: StandaloneError) => void): Daemon['timeouts'] | undefined;
+/** Legacy SDKs keep their supported config and timeout bounds. */
+export declare function runtimeBudgetSource(dir: string, manifest?: StandaloneManifest): string;

package/dist/standalone/daemon.js

@@ -1,5 +1,6 @@
+import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { goChildEnv } from "../runtime/go-env.js";
-import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
@@ -79,23 +80,9 @@ export function readDaemon(value, root, arches, fail) {
         Object.keys(env).length > 64 ||
         Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
         return invalid();
-    const limits = value.timeouts ?? {};
-    if (!record(limits) ||
-        Object.keys(limits).some((k) => !["start", "stop", "status", "uninstall"].includes(k)))
-        return invalid();
-    // Defaults hold under IO load on a busy NAS; DSM's package unit allows 3600 s.
-    const timeouts = {
-        start: limits.start ?? 30,
-        stop: limits.stop ?? 30,
-        status: limits.status ?? 5,
-        uninstall: limits.uninstall ?? 60,
-    };
-    for (const [key, v] of Object.entries(timeouts)) {
-        if (!Number.isInteger(v) ||
-            v < (key === "status" ? 1 : 2) ||
-            v > (key === "status" ? 10 : 120))
-            return invalid();
-    }
+    const timeouts = readLifecycleTimeouts(value.timeouts, fail);
+    if (!timeouts)
+        return undefined;
     return {
         exec: value.exec,
         targets,
@@ -107,6 +94,11 @@ export function readDaemon(value, root, arches, fail) {
         timeouts: timeouts,
     };
 }
+function daemonSdkVersion(manifest) {
+    return manifest.identityGateway?.sdk ??
+        (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
+        templateSdkVersion();
+}
 export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts } = manifest.compose
         ? composeDaemon(manifest)
@@ -120,6 +112,8 @@ export function daemonConfig(manifest) {
         ...(uninstall_args ? { uninstall_args } : {}),
         env,
         timeouts,
+        ...(runtimeBudgetSdkSupported(daemonSdkVersion(manifest))
+            ? { operation_seconds: operationBudgetSeconds(manifest) } : {}),
         ...(manifest.compose ? { network: composeNetwork(manifest) } : {}),
     }) + "\n");
 }
@@ -137,11 +131,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         out,
         "./daemonctl",
     ], {
-        cwd: sdkSource(manifest.identityGateway?.sdk ??
-            (manifest.backend.kind === "go"
-                ? appSdkVersion(manifest.backend)
-                : undefined) ??
-            templateSdkVersion()).goDir,
+        cwd: runtimeBudgetSource(sdkSource(daemonSdkVersion(manifest)).goDir, manifest),
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)
@@ -212,3 +202,26 @@ export function copyPayloadTree(root, source, target) {
         invalid(`Cannot read the daemon payload: ${String(error)}`);
     }
 }
+/** Existing lifecycle namespace; a timeout-only declaration runs no daemon. */
+export function readLifecycleTimeouts(value, fail) {
+    const v = value ?? {};
+    const bad = () => { fail({ code: 'STANDALONE_DAEMON_INVALID', message: 'daemon.timeouts accepts start/stop/uninstall 2–3600s and status 1–3600s.' }); return undefined; };
+    if (!record(v) || Object.keys(v).some(k => !['start', 'stop', 'status', 'uninstall'].includes(k)))
+        return bad();
+    const limits = { start: v.start ?? 30, stop: v.stop ?? 30, status: v.status ?? 5, uninstall: v.uninstall ?? 60 };
+    for (const [key, n] of Object.entries(limits))
+        if (!Number.isInteger(n) || Number(n) < (key === 'status' ? 1 : 2) || Number(n) > 3600)
+            return bad();
+    return limits;
+}
+/** Legacy SDKs keep their supported config and timeout bounds. */
+export function runtimeBudgetSource(dir, manifest) {
+    if (!existsSync(join(dir, 'internal/runtimebudget/budget.go'))) {
+        const timeouts = manifest?.daemon?.timeouts ?? manifest?.lifecycleTimeouts;
+        if (!manifest || operationBudgetSeconds(manifest) > 60 || timeouts &&
+            (timeouts.start > 120 || timeouts.stop > 120 || timeouts.status > 10 || timeouts.uninstall > 120)) {
+            throw new StandaloneBuildError('STANDALONE_DAEMON_BUILD_FAILED', 'The requested timeouts need an SDK with runtime budget support; use SDK 0.17.5 or later before rebuilding.');
+        }
+    }
+    return dir;
+}

package/dist/standalone/dsm-window.js

@@ -1,3 +1,4 @@
+import { gatewayEntryPath } from './native-gateway.js';
 import { resolvedSdkLaunch, dsmLauncherType } from "../contract/app-launch.js";
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { LAUNCH_PARAMS_RUNTIME } from "./launch-params.js";
@@ -120,7 +121,7 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
                     ...titleFields,
                     icon,
                     ...launcherAccess(manifest),
-                    url: `/webman/3rdparty/${manifest.package}/sso/open.cgi`,
+                    url: gatewayEntryPath(manifest),
                 },
             },
         }, null, 2) + "\n");

package/dist/standalone/identity-gateway.js

@@ -1,3 +1,5 @@
+import { nativeGatewaySupported } from './native-gateway.js';
+import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { existsSync, lstatSync } from "node:fs";
 import { join } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
@@ -5,7 +7,7 @@ import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { checkCgiBinary } from "./binary.js";
 import { isWebAccessMode, DSM_GROUP_NAME, } from "../contract/web-launch.js";
-import { relativeExec, token } from "./daemon.js";
+import { relativeExec, runtimeBudgetSource, token } from "./daemon.js";
 import { StandaloneBuildError } from "./spk.js";
 /** The SDK's identity gateway: the daemon wrapper and the DSM-origin authorize CGI. */
 export const GATEWAY_MAIN = "./idgateway/cmd/gateway";
@@ -309,6 +311,11 @@ export function identityGatewayConfig(m) {
     const g = m.identityGateway;
     return (JSON.stringify({
         package: m.package,
+        ...(nativeGatewaySupported(m) ? { native_ingress: true } : {}),
+        ...(runtimeBudgetSdkSupported(g.sdk) ? {
+            operation_seconds: operationBudgetSeconds(m),
+            stop_seconds: m.daemon?.timeouts.stop ?? m.lifecycleTimeouts?.stop ?? 30,
+        } : {}),
         mode: g.mode,
         access: g.access ?? "dsm-users",
         ...(g.groups ? { groups: g.groups } : {}),
@@ -385,6 +392,7 @@ export async function buildIdentityGateway(m, arch, work, run) {
     catch (error) {
         throw new StandaloneBuildError("SDK_DOWNLOAD_FAILED", error.message.replace(/^\[[A-Z_]+\] /, ""));
     }
+    runtimeBudgetSource(sdk.goDir, m);
     const out = join(work, `identity-gateway-${arch}`);
     const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}`;
     const result = await run("go", [

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,5 @@
+import { nativePortal } from "./portal.js";
+import { nativeGatewaySupported, renderNativeGatewayConfig, renderNativeGatewayPrepare, NATIVE_GATEWAY_CONFIG, gatewayEntryPath } from './native-gateway.js';
 import { inspectPortalInfo } from "../portal/info.js";
 import { isDeepStrictEqual } from "node:util";
 import { inspectApiDescription } from "./api-description-inspect.js";
@@ -18,7 +20,7 @@ import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.
 import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
-import { daemonConfig, readDaemon } from "./daemon.js";
+import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -110,6 +112,10 @@ export async function inspectSpk(spkPath, expectedKind) {
                     (raw.entry !== undefined &&
                         !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
+                if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
+                    throw new Error();
+                if (raw.operationSeconds !== undefined && (!Number.isInteger(raw.operationSeconds) || raw.operationSeconds < 1 || raw.operationSeconds > 3600))
+                    throw new Error();
                 metadata = raw;
             }
             catch {
@@ -145,6 +151,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
+        const nativeGateway = await recoverNativeGateway(dir, metadata.native_gateway, info, findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
         const appScripts = standalone || kind === "container"
@@ -163,7 +170,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
-        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose);
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver);
         checkScripts(dir, findings);
         checkUninstall(dir, findings);
         if (kind === "container")
@@ -191,10 +198,10 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway)
             : undefined;
         if (background)
-            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go");
+            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts);
         let executor;
         if ((metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") ||
             paths.has("executor/executor")) {
@@ -224,6 +231,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             if (![...paths].some((path) => path.startsWith("daemon/"))) {
                 const lifecycleManifest = {
                     package: info.package,
+                    lifecycleTimeouts: metadata.lifecycleTimeouts,
                     capabilities: {
                         rootOps: true,
                         ...(background ? { jobs: { worker: "sha256-v1" } } : {}),
@@ -622,7 +630,8 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             os_min_ver: info.os_min_ver,
             build: Number(info.version?.split("-").pop()),
             arches: [arch],
-            backend: { kind: "binary", files: {} },
+            backend: { kind: "binary", files: {}, ...(metadata.operationSeconds ? { timeoutSeconds: metadata.operationSeconds } : {}) },
+            lifecycleTimeouts: metadata.lifecycleTimeouts,
             ui: { dir: root, launch: metadata.launch },
             capabilities: {
                 ...(metadata.capabilities?.includes("composeMounts")
@@ -635,7 +644,7 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
         };
         if (Boolean(c.web) !== Boolean(g))
             throw new Error("Web ingress must have a complete identity gateway");
-        if (gateway && gateway !== identityGatewayConfig(manifest))
+        if (gateway && !matchesGatewayConfig(gateway, manifest))
             throw new Error("gateway configuration differs from the declared package contract");
         if (readOptional(join(dir, "conf/privilege")) !== renderNativePrivilege())
             throw new Error("Compose hooks must run as the package account");
@@ -648,8 +657,15 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             throw new Error("LAUNCHER_TYPE_MISMATCH classless Compose must use the shared url launcher");
         if (g &&
             (cfg.package !== info.package ||
-                info.adminurl !== `/webman/3rdparty/${info.package}/sso/open.cgi`))
+                info.adminurl !== gatewayEntryPath(manifest)))
             throw new Error("gateway entry mismatch");
+        for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", {
+            composeData: c.plan.app_data,
+            portal: Boolean(nativePortal(manifest)),
+        }))) {
+            if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
+                throw new Error(`unexpected WIZARD_UIFILES/${name}; retained-volume guidance must match the plan`);
+        }
         const appScripts = unwrapAppScripts(join(dir, "scripts"), findings);
         manifest.appScripts = undefined;
         for (const hook of [
@@ -771,7 +787,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -796,6 +812,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 "args",
                 "env",
                 "timeouts",
+                "operation_seconds",
                 "uninstall_args",
                 ...(combined ? ["network"] : []),
             ].includes(key)))
@@ -810,6 +827,8 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
+        if (config.operation_seconds !== undefined && (!Number.isInteger(config.operation_seconds) || config.operation_seconds < 1 || config.operation_seconds > 3600))
+            throw new Error('invalid operation budget');
         if (combined &&
             (daemon.exec !== "_sso/gateway" ||
                 JSON.stringify(daemon.args) !== '["run"]' ||
@@ -820,6 +839,9 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             throw new Error("missing executable");
         const manifest = {
             package: info.package,
+            backend: { kind: 'go', dir: dir, main: './cmd/app', timeoutSeconds: config.operation_seconds ?? 60 },
+            root: dir,
+            ...(combined ? { lifecycleTimeouts: daemon.timeouts } : {}),
             daemon,
             ...combined,
             capabilities: {
@@ -841,11 +863,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 },
             }
             : manifest);
-        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== canonical)
+        const expectedConfig = JSON.parse(canonical);
+        if (config.operation_seconds === undefined)
+            delete expectedConfig.operation_seconds;
+        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== JSON.stringify(expectedConfig) + '\n')
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
             if (readFileSync(join(dir, "scripts", hook), "utf8") !==
-                renderStandaloneScript(hook, manifest))
+                renderStandaloneScript(hook, nativeGateway ? { ...manifest, os_min_ver: info.os_min_ver, identityGateway: nativeGateway } : manifest))
                 findings.push(`daemon scripts/${hook} does not match the fixed lifecycle`);
         }
         return daemon;
@@ -917,12 +942,50 @@ async function checkContainerExposure(dir, packageTgz, findings) {
 function readOptional(path) {
     return existsSync(path) ? readFileSync(path, "utf8") : undefined;
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose) {
+async function recoverNativeGateway(dir, value, info, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('invalid native gateway record');
+        const plan = value;
+        if (typeof plan.sdk !== 'string' || !plan.listen || typeof plan.listen !== 'object' || Array.isArray(plan.listen)
+            || !Object.keys(plan.listen).length || Object.keys(plan).some(k => !['sdk', 'listen'].includes(k))
+            || Object.entries(plan.listen).some(([k, v]) => !['http', 'https'].includes(k) || !Number.isInteger(v) || v < 1 || v > 65535))
+            throw new Error('invalid native gateway ports');
+        const target = { package: info.package, os_min_ver: info.os_min_ver, identityGateway: plan };
+        if (!nativeGatewaySupported(target))
+            throw new Error('unsupported native gateway SDK/DSM floor');
+        const root = join(dir, 'native-gateway-inspection');
+        mkdirSync(root);
+        await tar.x({ file: join(dir, 'package.tgz'), cwd: root, filter: path => ['sso/gateway.json', NATIVE_GATEWAY_CONFIG].includes(path.replace(/^\.\//, '')) });
+        const config = JSON.parse(readFileSync(join(root, 'sso/gateway.json'), 'utf8'));
+        if (config.native_ingress !== true || config.package !== info.package || !isDeepStrictEqual(config.listen, plan.listen)
+            || config.state_dir !== `/var/packages/${info.package}/var/sso`)
+            throw new Error('native gateway config does not match its package');
+        if (readOptional(join(root, NATIVE_GATEWAY_CONFIG)) !== renderNativeGatewayConfig(target))
+            throw new Error('native gateway ingress differs from its fixed proxy');
+        for (const key of ['instuninst_restart_services', 'startstop_restart_services'])
+            if (!(info[key] ?? '').split(/\s+/).includes('nginx.service'))
+                throw new Error(`native gateway requires INFO ${key}`);
+        for (const hook of ['postinst', 'postupgrade'])
+            if (!readFileSync(join(dir, 'scripts', hook), 'utf8').includes(renderNativeGatewayPrepare(target)))
+                throw new Error('native gateway credential preparation is missing');
+        return plan;
+    }
+    catch (e) {
+        findings.push(`NATIVE_GATEWAY_INVALID ${e.message}`);
+        return undefined;
+    }
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
     const nativeResource = kind !== "container"
         ? renderStandaloneResource({
             package: pkg ?? "",
+            os_min_ver: osMinVer,
+            ...(nativeGateway ? { identityGateway: nativeGateway } : {}),
             ...(compose ? { compose } : {}),
             capabilities: background
                 ? { jobs: { worker: "sha256-v1" } }
@@ -979,7 +1042,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false) {
+function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false, lifecycleTimeouts) {
     const pkg = info.package;
     if (!pkg)
         return;
@@ -997,12 +1060,13 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
     if (units.length !== 1 ||
         units[0] !== unit ||
         read(`${BACKGROUND_UNIT_DIR}/${unit}`) !==
-            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [])) {
+            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [], daemon?.timeouts.stop ?? lifecycleTimeouts?.stop ?? 30)) {
         findings.push(`${BACKGROUND_UNIT_DIR} must contain only the fixed ${unit} (runs as the package account, no User=, no root)`);
     }
     if (read("scripts/start-stop-status") !==
         renderStandaloneScript("start-stop-status", {
             package: pkg,
+            lifecycleTimeouts,
             ...(daemon ? { daemon } : {}),
             capabilities: {
                 jobs: { worker: "sha256-v1" },
@@ -1149,7 +1213,7 @@ function checkScripts(dir, findings) {
 }
 const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
 const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
-const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
+const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*(?:!=\s*"?UPGRADE"?|=\s*"?UNINSTALL"?)/;
 function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
@@ -1206,7 +1270,7 @@ function checkUninstall(dir, findings) {
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
-            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without the [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] guard, so an upgrade deletes it by mistake');
+            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without an UNINSTALL-only or != UPGRADE guard, so an upgrade deletes it by mistake');
         if (!/is_package_area\(\)\s*\{/.test(body) ||
             !/if ! is_package_area "\$real"/.test(body))
             findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst does not verify the deleted paths are under /volumeN/@appdata|@apphome|@appconf|@appstore/<package>; an empty or redirected variable deletes the wrong data");
@@ -1265,3 +1329,11 @@ export async function listPayload(packageTgz, findings) {
     });
     return payload;
 }
+function matchesGatewayConfig(actual, manifest) {
+    const saved = JSON.parse(actual), expected = JSON.parse(identityGatewayConfig(manifest));
+    // Older artifacts omit both work-budget members; do not reinterpret their bytes.
+    for (const key of ['operation_seconds', 'stop_seconds'])
+        if (saved[key] === undefined)
+            delete expected[key];
+    return actual === JSON.stringify(expected) + '\n';
+}

package/dist/standalone/lifecycle.js

@@ -1,3 +1,5 @@
+import { renderComposeRetainedData } from "../build-spk/compose-retained-data.js";
+import { renderNativeGatewayPrepare } from './native-gateway.js';
 import { renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { composeDaemon, renderComposeInstall } from "./compose.js";
 import { renderBackgroundControl, renderBackgroundWorkerStart, renderBackgroundWorkerStop, renderUserManagerRecovery, backgroundUnitName, } from "./background.js";
@@ -11,6 +13,14 @@ import { composeAppScript } from "./app-scripts.js";
 const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_uninstall_hook\n';
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
+    const script = renderStandaloneScriptInternal(name, manifest);
+    const prepared = ['postinst', 'postupgrade'].includes(name) ? renderNativeGatewayPrepare(manifest) : '';
+    const sdk = prepared ? script.replace('#!/bin/sh\n', '#!/bin/sh\n' + prepared) : script;
+    return manifest.appScripts?.some((app) => app === name)
+        ? composeAppScript(name, sdk)
+        : sdk;
+}
+function renderStandaloneScriptInternal(name, manifest) {
     if (manifest.compose) {
         const native = {
             ...manifest,
@@ -19,7 +29,7 @@ export function renderStandaloneScript(name, manifest) {
         };
         const body = name === "preinst"
             ? renderComposeInstall(manifest.package)
-            : renderStandaloneScript(name, { ...native, appScripts: undefined });
+            : renderStandaloneScriptInternal(name, { ...native, appScripts: undefined });
         const control = `"/var/packages/${manifest.package}/target/daemon/control"`;
         const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}"`;
         const preflight = name === "start-stop-status"
@@ -37,6 +47,7 @@ export function renderStandaloneScript(name, manifest) {
                 ? `if [ "$1" = prestart ]; then\n  ${renderComposeDiagnosis(project, "prestart")}fi\n`
                 : "";
         const ledger = diagnosis + preflight + remember +
+            (name === "postuninst" ? renderComposeRetainedData(manifest.compose.plan.app_data) : "") +
             (manifest.identityGateway && !manifest.compose.plan.mounts_blocked
                 ? name === "start-stop-status"
                     ? `if [ "$1" = restart ]; then\n  "$0" stop || exit $?\n  exec "$0" start\nfi\nif [ "$1" = start ]; then\n  ${control} acquire ${paths} || exit $?\nelif [ "$1" = stop ]; then\n  ${control} release ${paths} || exit $?\nfi\n`
@@ -47,18 +58,14 @@ export function renderStandaloneScript(name, manifest) {
         const withLedger = ledger
             ? body.replace("#!/bin/sh\n", "#!/bin/sh\n" + ledger)
             : body;
-        return manifest.appScripts?.some((app) => app === name)
-            ? composeAppScript(name, withLedger)
-            : withLedger;
+        return withLedger;
     }
     const portal = nativePortal(manifest);
     const script = renderCapabilityScript(name, manifest);
     const sdk = portal
         ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`)
         : script;
-    return manifest.appScripts?.some((app) => app === name)
-        ? composeAppScript(name, sdk)
-        : sdk;
+    return sdk;
 }
 function renderCapabilityScript(name, manifest) {
     if (name === "preupgrade" &&
@@ -159,7 +166,7 @@ function renderStandaloneScriptBody(name, manifest) {
     if (manifest.daemon)
         return renderDaemonScript(name, manifest);
     if (manifest.capabilities.jobs && name === "start-stop-status")
-        return renderBackgroundControl(manifest.package);
+        return renderBackgroundControl(manifest.package, manifest.lifecycleTimeouts?.start ?? 30);
     if (name === "start-stop-status") {
         return `#!/bin/sh
 case "$1" in
@@ -191,7 +198,7 @@ function renderDelegatedDaemonScript(name, manifest) {
         return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop("stop", "stop")}fi\n${purge}`;
     }
     return `#!/bin/sh
-${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+${workerStop}${renderUserManagerRecovery(manifest.daemon?.timeouts?.start ?? manifest.lifecycleTimeouts?.start ?? 30)}${renderBackgroundWorkerStart(pkg)}case "$1" in
   prestart) recover_user_manager ;;
   prestop) exit 0 ;;
   start)

package/dist/standalone/manifest.d.ts

@@ -86,6 +86,7 @@ export interface StandaloneManifest {
         tasks: ExecutorTask[];
     };
     daemon?: Daemon;
+    lifecycleTimeouts?: Daemon["timeouts"];
     /** `identity_gateway`: signs DSM users in to the daemon's own web UI. */
     identityGateway?: IdentityGateway;
     compose?: ComposeApp;