@synopackageland/cli 0.17.4 → 0.17.6

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,5 @@
+import { nativePortal } from "./portal.js";
+import { nativeGatewaySupported, renderNativeGatewayConfig, renderNativeGatewayPrepare, NATIVE_GATEWAY_CONFIG, gatewayEntryPath } from './native-gateway.js';
 import { inspectPortalInfo } from "../portal/info.js";
 import { isDeepStrictEqual } from "node:util";
 import { inspectApiDescription } from "./api-description-inspect.js";
@@ -18,7 +20,7 @@ import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.
 import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
-import { daemonConfig, readDaemon } from "./daemon.js";
+import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -26,7 +28,7 @@ import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, BRIDGE_WORKER_ARGS, bac
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER, } from "./shared-folder.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard, } from "../build-spk/install-wizard.js";
-import { renderDelegateScopeSteps, renderDelegateInstallDraft, } from "../build-spk/delegate-scope.js";
+import { renderDelegateScopeSteps, } from "../build-spk/delegate-scope.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUiConfig } from "./dsm-window.js";
@@ -110,6 +112,10 @@ export async function inspectSpk(spkPath, expectedKind) {
                     (raw.entry !== undefined &&
                         !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
+                if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
+                    throw new Error();
+                if (raw.operationSeconds !== undefined && (!Number.isInteger(raw.operationSeconds) || raw.operationSeconds < 1 || raw.operationSeconds > 3600))
+                    throw new Error();
                 metadata = raw;
             }
             catch {
@@ -145,6 +151,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
+        const nativeGateway = await recoverNativeGateway(dir, metadata.native_gateway, info, findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
         const appScripts = standalone || kind === "container"
@@ -155,7 +162,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             : undefined;
         // Resource-worker portals use DSM-owned INFO reload, with no executor requirement.
         const portal = standalone
-            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings)
+            ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings, nativeGateway)
             : undefined;
         if (portal &&
             info.os_min_ver &&
@@ -163,7 +170,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
-        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose);
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver);
         checkScripts(dir, findings);
         checkUninstall(dir, findings);
         if (kind === "container")
@@ -191,10 +198,10 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway)
             : undefined;
         if (background)
-            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go");
+            checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts);
         let executor;
         if ((metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") ||
             paths.has("executor/executor")) {
@@ -224,6 +231,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             if (![...paths].some((path) => path.startsWith("daemon/"))) {
                 const lifecycleManifest = {
                     package: info.package,
+                    lifecycleTimeouts: metadata.lifecycleTimeouts,
                     capabilities: {
                         rootOps: true,
                         ...(background ? { jobs: { worker: "sha256-v1" } } : {}),
@@ -261,7 +269,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === "install-selected", portal, hasExecutor, nativeGateway, info.os_min_ver);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -622,7 +630,8 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             os_min_ver: info.os_min_ver,
             build: Number(info.version?.split("-").pop()),
             arches: [arch],
-            backend: { kind: "binary", files: {} },
+            backend: { kind: "binary", files: {}, ...(metadata.operationSeconds ? { timeoutSeconds: metadata.operationSeconds } : {}) },
+            lifecycleTimeouts: metadata.lifecycleTimeouts,
             ui: { dir: root, launch: metadata.launch },
             capabilities: {
                 ...(metadata.capabilities?.includes("composeMounts")
@@ -635,7 +644,7 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
         };
         if (Boolean(c.web) !== Boolean(g))
             throw new Error("Web ingress must have a complete identity gateway");
-        if (gateway && gateway !== identityGatewayConfig(manifest))
+        if (gateway && !matchesGatewayConfig(gateway, manifest))
             throw new Error("gateway configuration differs from the declared package contract");
         if (readOptional(join(dir, "conf/privilege")) !== renderNativePrivilege())
             throw new Error("Compose hooks must run as the package account");
@@ -648,8 +657,15 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
             throw new Error("LAUNCHER_TYPE_MISMATCH classless Compose must use the shared url launcher");
         if (g &&
             (cfg.package !== info.package ||
-                info.adminurl !== `/webman/3rdparty/${info.package}/sso/open.cgi`))
+                info.adminurl !== gatewayEntryPath(manifest)))
             throw new Error("gateway entry mismatch");
+        for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", {
+            composeData: c.plan.app_data,
+            portal: Boolean(nativePortal(manifest)),
+        }))) {
+            if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
+                throw new Error(`unexpected WIZARD_UIFILES/${name}; retained-volume guidance must match the plan`);
+        }
         const appScripts = unwrapAppScripts(join(dir, "scripts"), findings);
         manifest.appScripts = undefined;
         for (const hook of [
@@ -771,7 +787,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -796,6 +812,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 "args",
                 "env",
                 "timeouts",
+                "operation_seconds",
                 "uninstall_args",
                 ...(combined ? ["network"] : []),
             ].includes(key)))
@@ -810,6 +827,8 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
+        if (config.operation_seconds !== undefined && (!Number.isInteger(config.operation_seconds) || config.operation_seconds < 1 || config.operation_seconds > 3600))
+            throw new Error('invalid operation budget');
         if (combined &&
             (daemon.exec !== "_sso/gateway" ||
                 JSON.stringify(daemon.args) !== '["run"]' ||
@@ -820,6 +839,9 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             throw new Error("missing executable");
         const manifest = {
             package: info.package,
+            backend: { kind: 'go', dir: dir, main: './cmd/app', timeoutSeconds: config.operation_seconds ?? 60 },
+            root: dir,
+            ...(combined ? { lifecycleTimeouts: daemon.timeouts } : {}),
             daemon,
             ...combined,
             capabilities: {
@@ -841,11 +863,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 },
             }
             : manifest);
-        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== canonical)
+        const expectedConfig = JSON.parse(canonical);
+        if (config.operation_seconds === undefined)
+            delete expectedConfig.operation_seconds;
+        if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== JSON.stringify(expectedConfig) + '\n')
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
             if (readFileSync(join(dir, "scripts", hook), "utf8") !==
-                renderStandaloneScript(hook, manifest))
+                renderStandaloneScript(hook, nativeGateway ? { ...manifest, os_min_ver: info.os_min_ver, identityGateway: nativeGateway } : manifest))
                 findings.push(`daemon scripts/${hook} does not match the fixed lifecycle`);
         }
         return daemon;
@@ -917,12 +942,50 @@ async function checkContainerExposure(dir, packageTgz, findings) {
 function readOptional(path) {
     return existsSync(path) ? readFileSync(path, "utf8") : undefined;
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose) {
+async function recoverNativeGateway(dir, value, info, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('invalid native gateway record');
+        const plan = value;
+        if (typeof plan.sdk !== 'string' || !plan.listen || typeof plan.listen !== 'object' || Array.isArray(plan.listen)
+            || !Object.keys(plan.listen).length || Object.keys(plan).some(k => !['sdk', 'listen'].includes(k))
+            || Object.entries(plan.listen).some(([k, v]) => !['http', 'https'].includes(k) || !Number.isInteger(v) || v < 1 || v > 65535))
+            throw new Error('invalid native gateway ports');
+        const target = { package: info.package, os_min_ver: info.os_min_ver, identityGateway: plan };
+        if (!nativeGatewaySupported(target))
+            throw new Error('unsupported native gateway SDK/DSM floor');
+        const root = join(dir, 'native-gateway-inspection');
+        mkdirSync(root);
+        await tar.x({ file: join(dir, 'package.tgz'), cwd: root, filter: path => ['sso/gateway.json', NATIVE_GATEWAY_CONFIG].includes(path.replace(/^\.\//, '')) });
+        const config = JSON.parse(readFileSync(join(root, 'sso/gateway.json'), 'utf8'));
+        if (config.native_ingress !== true || config.package !== info.package || !isDeepStrictEqual(config.listen, plan.listen)
+            || config.state_dir !== `/var/packages/${info.package}/var/sso`)
+            throw new Error('native gateway config does not match its package');
+        if (readOptional(join(root, NATIVE_GATEWAY_CONFIG)) !== renderNativeGatewayConfig(target))
+            throw new Error('native gateway ingress differs from its fixed proxy');
+        for (const key of ['instuninst_restart_services', 'startstop_restart_services'])
+            if (!(info[key] ?? '').split(/\s+/).includes('nginx.service'))
+                throw new Error(`native gateway requires INFO ${key}`);
+        for (const hook of ['postinst', 'postupgrade'])
+            if (!readFileSync(join(dir, 'scripts', hook), 'utf8').includes(renderNativeGatewayPrepare(target)))
+                throw new Error('native gateway credential preparation is missing');
+        return plan;
+    }
+    catch (e) {
+        findings.push(`NATIVE_GATEWAY_INVALID ${e.message}`);
+        return undefined;
+    }
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
     const nativeResource = kind !== "container"
         ? renderStandaloneResource({
             package: pkg ?? "",
+            os_min_ver: osMinVer,
+            ...(nativeGateway ? { identityGateway: nativeGateway } : {}),
             ...(compose ? { compose } : {}),
             capabilities: background
                 ? { jobs: { worker: "sha256-v1" } }
@@ -979,7 +1042,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false) {
+function checkBackground(dir, info, payload, findings, executor, daemon, bridge = false, lifecycleTimeouts) {
     const pkg = info.package;
     if (!pkg)
         return;
@@ -997,12 +1060,13 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
     if (units.length !== 1 ||
         units[0] !== unit ||
         read(`${BACKGROUND_UNIT_DIR}/${unit}`) !==
-            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [])) {
+            renderBackgroundUnit(pkg, bridge ? BRIDGE_WORKER_ARGS : [], daemon?.timeouts.stop ?? lifecycleTimeouts?.stop ?? 30)) {
         findings.push(`${BACKGROUND_UNIT_DIR} must contain only the fixed ${unit} (runs as the package account, no User=, no root)`);
     }
     if (read("scripts/start-stop-status") !==
         renderStandaloneScript("start-stop-status", {
             package: pkg,
+            lifecycleTimeouts,
             ...(daemon ? { daemon } : {}),
             capabilities: {
                 jobs: { worker: "sha256-v1" },
@@ -1017,7 +1081,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon, bridge
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false, nativeGateway, osMinVer) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : [])
         .filter((name) => /^(install|upgrade)_uifile(_|\.|$)/.test(name))
@@ -1027,6 +1091,22 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push("the install.sharedFolder declaration in scripts/postinst is invalid");
     if (!pkg)
         return;
+    // App wrappers have already been validated and unwrapped. Reconstruct the
+    // remaining install-hook inputs from INFO, the payload and its build record.
+    const lifecycleManifest = {
+        package: pkg,
+        os_min_ver: osMinVer,
+        sharedFolder: folder,
+        capabilities: selected
+            ? { delegate: { scope: "install-selected" } }
+            : executor
+                ? { rootOps: true }
+                : {},
+        ...(nativeGateway
+            ? { identityGateway: nativeGateway }
+            : {}),
+        ...portalManifest(portal),
+    };
     const wizards = expectedWizardFiles(pkg, folder, selected, portal);
     const source = selected
         ? "the install-selected policy"
@@ -1046,25 +1126,17 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal,
         findings.push(`WIZARD_UIFILES/${name} is not a wizard file produced by ${source}`);
     if (selected) {
         for (const hook of ["preinst", "postinst"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.includes(renderDelegateInstallDraft(pkg, hook === "preinst")))
-                findings.push(`scripts/${hook} missing install-selected draft handling`);
+            if (readOptional(join(dir, "scripts", hook)) !==
+                renderStandaloneScript(hook, lifecycleManifest))
+                findings.push(`scripts/${hook} does not match the fixed install-selected draft handling`);
         }
     }
-    if (!folder)
+    if (!folder && !portal)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
         if (readOptional(join(dir, "scripts", hook)) !==
-            renderStandaloneScript(hook, {
-                package: pkg,
-                sharedFolder: folder,
-                ...(selected
-                    ? { capabilities: { delegate: { scope: "install-selected" } } }
-                    : executor
-                        ? { capabilities: { rootOps: true } }
-                        : {}),
-                ...portalManifest(portal),
-            })) {
-            findings.push(`scripts/${hook} does not match the fixed script declared by install.sharedFolder`);
+            renderStandaloneScript(hook, lifecycleManifest)) {
+            findings.push(`scripts/${hook} does not match the fixed script declared by ${folder ? "install.sharedFolder" : "portal"}`);
         }
     }
 }
@@ -1096,7 +1168,7 @@ function portalManifest(portal) {
  * files and alias lifecycle must be exactly what the generator writes for the
  * package's own DSM window (native AppInstance or Compose `.url` entry); activation is never part of the package.
  */
-async function recoverPortal(dir, info, appId, paths, payload, findings) {
+async function recoverPortal(dir, info, appId, paths, payload, findings, nativeGateway) {
     const files = [PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH];
     if (!files.some((path) => paths.has(path)))
         return;
@@ -1120,7 +1192,14 @@ async function recoverPortal(dir, info, appId, paths, payload, findings) {
                 renderPortalMustache())
             throw new Error("content");
         for (const hook of ["preinst", "postinst", "postupgrade"]) {
-            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${renderPortalLifecycle(hook, portal)}`))
+            const prepare = ["postinst", "postupgrade"].includes(hook)
+                ? renderNativeGatewayPrepare({
+                    package: info.package,
+                    os_min_ver: info.os_min_ver,
+                    identityGateway: nativeGateway,
+                })
+                : "";
+            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${prepare}${renderPortalLifecycle(hook, portal)}`))
                 throw new Error(hook);
         }
         return portal;
@@ -1149,7 +1228,7 @@ function checkScripts(dir, findings) {
 }
 const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
 const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
-const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
+const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*(?:!=\s*"?UPGRADE"?|=\s*"?UNINSTALL"?)/;
 function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
@@ -1206,7 +1285,7 @@ function checkUninstall(dir, findings) {
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
-            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without the [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] guard, so an upgrade deletes it by mistake');
+            findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst deletes data without an UNINSTALL-only or != UPGRADE guard, so an upgrade deletes it by mistake');
         if (!/is_package_area\(\)\s*\{/.test(body) ||
             !/if ! is_package_area "\$real"/.test(body))
             findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst does not verify the deleted paths are under /volumeN/@appdata|@apphome|@appconf|@appstore/<package>; an empty or redirected variable deletes the wrong data");
@@ -1265,3 +1344,11 @@ export async function listPayload(packageTgz, findings) {
     });
     return payload;
 }
+function matchesGatewayConfig(actual, manifest) {
+    const saved = JSON.parse(actual), expected = JSON.parse(identityGatewayConfig(manifest));
+    // Older artifacts omit both work-budget members; do not reinterpret their bytes.
+    for (const key of ['operation_seconds', 'stop_seconds'])
+        if (saved[key] === undefined)
+            delete expected[key];
+    return actual === JSON.stringify(expected) + '\n';
+}

package/dist/standalone/lifecycle.js

@@ -1,3 +1,5 @@
+import { renderComposeRetainedData } from "../build-spk/compose-retained-data.js";
+import { renderNativeGatewayPrepare } from './native-gateway.js';
 import { renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { composeDaemon, renderComposeInstall } from "./compose.js";
 import { renderBackgroundControl, renderBackgroundWorkerStart, renderBackgroundWorkerStop, renderUserManagerRecovery, backgroundUnitName, } from "./background.js";
@@ -11,6 +13,14 @@ import { composeAppScript } from "./app-scripts.js";
 const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_uninstall_hook\n';
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
+    const script = renderStandaloneScriptInternal(name, manifest);
+    const prepared = ['postinst', 'postupgrade'].includes(name) ? renderNativeGatewayPrepare(manifest) : '';
+    const sdk = prepared ? script.replace('#!/bin/sh\n', '#!/bin/sh\n' + prepared) : script;
+    return manifest.appScripts?.some((app) => app === name)
+        ? composeAppScript(name, sdk)
+        : sdk;
+}
+function renderStandaloneScriptInternal(name, manifest) {
     if (manifest.compose) {
         const native = {
             ...manifest,
@@ -19,7 +29,7 @@ export function renderStandaloneScript(name, manifest) {
         };
         const body = name === "preinst"
             ? renderComposeInstall(manifest.package)
-            : renderStandaloneScript(name, { ...native, appScripts: undefined });
+            : renderStandaloneScriptInternal(name, { ...native, appScripts: undefined });
         const control = `"/var/packages/${manifest.package}/target/daemon/control"`;
         const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}"`;
         const preflight = name === "start-stop-status"
@@ -37,6 +47,7 @@ export function renderStandaloneScript(name, manifest) {
                 ? `if [ "$1" = prestart ]; then\n  ${renderComposeDiagnosis(project, "prestart")}fi\n`
                 : "";
         const ledger = diagnosis + preflight + remember +
+            (name === "postuninst" ? renderComposeRetainedData(manifest.compose.plan.app_data) : "") +
             (manifest.identityGateway && !manifest.compose.plan.mounts_blocked
                 ? name === "start-stop-status"
                     ? `if [ "$1" = restart ]; then\n  "$0" stop || exit $?\n  exec "$0" start\nfi\nif [ "$1" = start ]; then\n  ${control} acquire ${paths} || exit $?\nelif [ "$1" = stop ]; then\n  ${control} release ${paths} || exit $?\nfi\n`
@@ -47,18 +58,14 @@ export function renderStandaloneScript(name, manifest) {
         const withLedger = ledger
             ? body.replace("#!/bin/sh\n", "#!/bin/sh\n" + ledger)
             : body;
-        return manifest.appScripts?.some((app) => app === name)
-            ? composeAppScript(name, withLedger)
-            : withLedger;
+        return withLedger;
     }
     const portal = nativePortal(manifest);
     const script = renderCapabilityScript(name, manifest);
     const sdk = portal
         ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`)
         : script;
-    return manifest.appScripts?.some((app) => app === name)
-        ? composeAppScript(name, sdk)
-        : sdk;
+    return sdk;
 }
 function renderCapabilityScript(name, manifest) {
     if (name === "preupgrade" &&
@@ -159,7 +166,7 @@ function renderStandaloneScriptBody(name, manifest) {
     if (manifest.daemon)
         return renderDaemonScript(name, manifest);
     if (manifest.capabilities.jobs && name === "start-stop-status")
-        return renderBackgroundControl(manifest.package);
+        return renderBackgroundControl(manifest.package, manifest.lifecycleTimeouts?.start ?? 30);
     if (name === "start-stop-status") {
         return `#!/bin/sh
 case "$1" in
@@ -191,7 +198,7 @@ function renderDelegatedDaemonScript(name, manifest) {
         return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop("stop", "stop")}fi\n${purge}`;
     }
     return `#!/bin/sh
-${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+${workerStop}${renderUserManagerRecovery(manifest.daemon?.timeouts?.start ?? manifest.lifecycleTimeouts?.start ?? 30)}${renderBackgroundWorkerStart(pkg)}case "$1" in
   prestart) recover_user_manager ;;
   prestop) exit 0 ;;
   start)

package/dist/standalone/manifest.d.ts

@@ -86,6 +86,7 @@ export interface StandaloneManifest {
         tasks: ExecutorTask[];
     };
     daemon?: Daemon;
+    lifecycleTimeouts?: Daemon["timeouts"];
     /** `identity_gateway`: signs DSM users in to the daemon's own web UI. */
     identityGateway?: IdentityGateway;
     compose?: ComposeApp;

package/dist/standalone/manifest.js

@@ -9,7 +9,7 @@ import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
-import { readDaemon } from "./daemon.js";
+import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
 import { readAppScripts } from "./app-scripts.js";
@@ -231,8 +231,10 @@ function readManifest(raw, c) {
                 c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/${API_PERMISSIONS_FILE[backend.kind]} must define the centralized API policy: ${String(error)}`);
         }
     }
+    const timeoutOnly = isRecord(raw.daemon) && Object.keys(raw.daemon).length === 1 && 'timeouts' in raw.daemon;
+    const lifecycleTimeouts = timeoutOnly ? readLifecycleTimeouts(raw.daemon.timeouts, (e) => c.fail(e.code, e.message)) : undefined;
     const daemon = arches &&
-        readDaemon(raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
     const gatewayRaw = isRecord(raw.identity_gateway) ? raw.identity_gateway : {};
     if (raw.compose !== undefined && isRecord(raw.ctl) && raw.ctl.enabled === true)
         c.fail("CTL_UNSUPPORTED_BACKEND", "Compose does not support automatic ctl descriptions; disable ctl.");
@@ -246,7 +248,7 @@ function readManifest(raw, c) {
             composeMounts: capabilities.composeMounts,
         });
     if (raw.compose !== undefined &&
-        (raw.daemon !== undefined ||
+        ((raw.daemon !== undefined && !timeoutOnly) ||
             Object.keys(capabilities).some((k) => k !== "composeMounts") ||
             !osMinVer ||
             !isDsmAtLeast(osMinVer, "7.2.1-69057")))
@@ -280,7 +282,7 @@ function readManifest(raw, c) {
                     s.port === identityGateway.oidc?.issuer_port))))
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose service ports must contain upstream and not overlap gateway or issuer ports.");
     if (capabilities.jobs &&
-        raw.daemon !== undefined &&
+        raw.daemon !== undefined && !timeoutOnly &&
         capabilities.delegate?.lifetime !== "until-revoked") {
         c.fail("CAPABILITY_COMBINATION_INVALID", "daemon can only coexist with an explicit until-revoked delegate fixed worker; plain capabilities.jobs stays mutually exclusive.");
     }
@@ -299,7 +301,7 @@ function readManifest(raw, c) {
                 delegate.destinations?.length)) {
             c.fail("CAPABILITY_UNSUPPORTED", `For backend.runtime: ${backend.kind}, capabilities.delegate supports only operations: [files.moveFromStaging], destinations and lifetime: until-revoked.`);
         }
-        if (raw.daemon !== undefined)
+        if (raw.daemon !== undefined && !timeoutOnly)
             c.fail("CAPABILITY_UNSUPPORTED", `backend.runtime: ${backend.kind} does not support daemon; a v1 App runs once per request (exec mode).`);
         if (permissions)
             checkBridgeMethods(backend, permissions, c);
@@ -438,6 +440,7 @@ function readManifest(raw, c) {
         ...(rootOps ? { rootOps } : {}),
         ...(rootPrograms ? { rootPrograms } : {}),
         ...(daemon ? { daemon } : {}),
+        ...(lifecycleTimeouts ? { lifecycleTimeouts } : {}),
         ...(identityGateway ? { identityGateway } : {}),
         ...(compose ? { compose } : {}),
         ...(uninstall ? { uninstall } : {}),

package/dist/standalone/native-gateway.d.ts

@@ -0,0 +1,17 @@
+import type { IdentityGateway } from './identity-gateway.js';
+export type NativeGatewayPlan = Pick<IdentityGateway, 'sdk' | 'listen'>;
+type Target = {
+    package: string;
+    os_min_ver?: string;
+    identityGateway?: NativeGatewayPlan;
+};
+export declare const NATIVE_GATEWAY_CONFIG = "sso/native-nginx.conf";
+export declare function nativeGatewaySdk(sdk: string): boolean;
+export declare function nativeGatewaySupported(m: Target): boolean;
+export declare function gatewayEntryPath(m: Target): string;
+export declare function legacyGatewayNotice(): string;
+export declare function nativeGatewayResource(m: Target): Record<string, unknown> | undefined;
+export declare function renderNativeGatewayConfig(m: Target): string;
+/** Runs after DSM creates pkgvar, before package start activates the nginx resource. */
+export declare function renderNativeGatewayPrepare(m: Target): string;
+export {};

package/dist/standalone/native-gateway.js

@@ -0,0 +1,115 @@
+import { isDsmAtLeast, PORTAL_MIN_DSM } from '../build-spk/dsm-version.js';
+export const NATIVE_GATEWAY_CONFIG = 'sso/native-nginx.conf';
+// Earlier SDK releases do not understand native_ingress. Keep their JSON ABI
+// and put an explanation in front of their existing direct-port launcher.
+export function nativeGatewaySdk(sdk) {
+    const [major, minor, patch] = sdk.split('.').map(Number);
+    return major > 0 || minor > 17 || minor === 17 && patch >= 5;
+}
+export function nativeGatewaySupported(m) {
+    return Boolean(m.identityGateway && nativeGatewaySdk(m.identityGateway.sdk)
+        && m.os_min_ver && isDsmAtLeast(m.os_min_ver, PORTAL_MIN_DSM));
+}
+export function gatewayEntryPath(m) {
+    return `/webman/3rdparty/${m.package}/sso/open.${m.identityGateway && !nativeGatewaySdk(m.identityGateway.sdk) ? 'html' : 'cgi'}`;
+}
+export function legacyGatewayNotice() {
+    return '<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src \'none\'; frame-ancestors \'none\'"><title>Direct App connection</title><p>DSM-managed HTTPS is unavailable for this App. The direct connection may show a certificate warning or use unencrypted HTTP.</p><a href="open.cgi">Continue to the direct connection</a></html>\n';
+}
+export function nativeGatewayResource(m) {
+    if (!nativeGatewaySupported(m))
+        return undefined;
+    const g = m.identityGateway, https = g.listen.https ?? g.listen.http;
+    const ports = [https, ...(g.listen.http && g.listen.http !== https ? [g.listen.http] : [])];
+    return { 'nginx-static-config': { enable: [{ type: 'server', relpath: NATIVE_GATEWAY_CONFIG,
+                    ports: ports.map(port => ({ port, protocol: 'tcp', schema: port === https ? 'https' : 'http' })) }] } };
+}
+export function renderNativeGatewayConfig(m) {
+    if (!nativeGatewaySupported(m))
+        return '';
+    const g = m.identityGateway, port = g.listen.https ?? g.listen.http;
+    const state = `/var/packages/${m.package}/var/sso`;
+    // Public ssl_certificate is deliberately inherited from DSM's http context.
+    // Only nginx's master reads the package's private upstream key. No DSM key
+    // is read or copied by the package, and no secret appears in this config.
+    return `server {
+    listen ${port} ssl;
+    listen [::]:${port} ssl;
+    server_name _;
+    client_max_body_size 0;
+    location / {
+        proxy_pass https://unix:/tmp/synopkgland-gateway-${m.package}.sock:;
+        proxy_http_version 1.1;
+        proxy_ssl_verify on;
+        proxy_ssl_verify_depth 1;
+        proxy_ssl_server_name on;
+        proxy_ssl_name gateway.invalid;
+        proxy_ssl_trusted_certificate ${state}/native-cert.pem;
+        proxy_ssl_certificate ${state}/native-cert.pem;
+        proxy_ssl_certificate_key ${state}/native-key.pem;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Synopkgland-Client-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+}
+${g.listen.http && g.listen.http !== port ? `server {
+    listen ${g.listen.http};
+    listen [::]:${g.listen.http};
+    server_name _;
+    return 308 https://$host:${port}$request_uri;
+}
+` : ''}`;
+}
+/** Runs after DSM creates pkgvar, before package start activates the nginx resource. */
+export function renderNativeGatewayPrepare(m) {
+    if (!nativeGatewaySupported(m))
+        return '';
+    return `synopkgland_native_keys() (
+  set -eu
+  umask 077
+  v="\${SYNOPKG_PKGVAR:-/var/packages/${m.package}/var}/sso"
+  if [ -L "$v" ]; then echo 'Native HTTPS state must not be a symlink.' >&2; exit 1; fi
+  mkdir -p "$v"
+  if [ "$(stat -c %a "$v")" != 700 ]; then echo 'Native HTTPS state must have mode 0700.' >&2; exit 1; fi
+  c="$v/native-cert.pem"; k="$v/native-key.pem"
+  if [ -e "$c" ] || [ -L "$c" ] || [ -e "$k" ] || [ -L "$k" ]; then
+    for f in "$c" "$k"; do
+      if [ -L "$f" ] || [ ! -f "$f" ] || [ "$(stat -c %a "$f")" != 600 ]; then
+        echo 'Native HTTPS requires a complete private keypair with mode 0600.' >&2; exit 1
+      fi
+    done
+    /usr/bin/openssl x509 -in "$c" -noout -checkend 0 >/dev/null || exit 1
+    cp=$(/usr/bin/openssl x509 -in "$c" -pubkey -noout | /usr/bin/openssl sha256)
+    kp=$(/usr/bin/openssl pkey -in "$k" -pubout | /usr/bin/openssl sha256)
+    [ "$cp" = "$kp" ] || { echo 'Native HTTPS keypair does not match.' >&2; exit 1; }
+    exit 0
+  fi
+  t=$(mktemp -d "$v/.native-tls.XXXXXX")
+  trap 'rm -rf "$t"' EXIT HUP INT TERM
+  cat > "$t/openssl.cnf" <<'NATIVE_TLS_CONFIG'
+[req]
+distinguished_name=subject
+x509_extensions=extensions
+prompt=no
+[subject]
+CN=gateway.invalid
+[extensions]
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign
+extendedKeyUsage=serverAuth,clientAuth
+subjectAltName=DNS:gateway.invalid
+NATIVE_TLS_CONFIG
+  /usr/bin/openssl req -x509 -newkey rsa:2048 -nodes -days 3650 -config "$t/openssl.cnf" -keyout "$t/key.pem" -out "$t/cert.pem" >/dev/null 2>&1 || {
+    echo 'Could not prepare the private native HTTPS connection.' >&2; exit 1;
+  }
+  chmod 600 "$t/key.pem" "$t/cert.pem"
+  mv "$t/key.pem" "$k"
+  mv "$t/cert.pem" "$c"
+)
+synopkgland_native_keys || exit $?
+`;
+}