@synopackageland/cli 0.20.0 → 0.21.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.21.1 (2026-10-21)
+
+- Resolve SDK/App 0.21.1 to the verified immutable executor/v0.20.0 release while keeping exact SDK-version digest checks.
+- Pin templates 0.21.1 with SDK/App 0.21.1 and UI 0.13.1 for new projects.
+
+## 0.21.0 (2026-10-21)
+
+- Validate and preserve `compose.devices.gpu` in check, build and inspect for optional Intel render-node access and software fallback.
+- Pin SDK/templates 0.21.0 and reuse immutable executor/v0.20.0 with verified unchanged executor/lifecycle digests.
+
 ## 0.20.0 (2026-10-21)
 
 - Align CLI/templates and the supported SDK minor line at 0.20; retain published UI 0.12.5.

package/README.md

@@ -367,3 +367,20 @@ unencrypted-HTTP limitations before opening it. Native resource/startup failures
 fail closed; they do not silently expose a direct listener. The native runtime
 requires the corresponding SDK release; this CLI change does not publish that
 release or change existing manifest version pins.
+
+Compose Apps may opt in to Intel render devices with
+`compose.devices.gpu.services: [media]`. The matching SDK discovers exact devices
+and the native `videodriver` GID at installation; the CLI emits DSM's
+`video-driver` resource. `check` rejects arbitrary paths/GIDs and elevated GPU
+services. `inspect --json` includes `compose.devices.gpu` with the runtime path
+policy, GID source and software fallback, plus outstanding DSM acceptance
+blockers. Keep the package UID and let the App validate its upstream encoder;
+absence of a GPU produces no device mapping. See the matching SDK's Compose GPU
+documentation for the security boundary and hardware validation limits.
+
+DSM's native provider adds NET_BIND_SERVICE to the bounding set for Compose
+packages. The SDK still emits `cap_drop: [ALL]` and requests no `cap_add`; the
+nonroot package process with no-new-privileges has zero effective, permitted and
+ambient capabilities on the tested provider. This general platform behavior is
+not a GPU blocker. Plan metadata describes SDK policy, not an attestation of the
+provider's final container configuration; see the SDK Compose security boundary.

package/dist/cli.js

@@ -344,6 +344,7 @@ export async function runCli(argv) {
                 ...("compose" in loaded.manifest && loaded.manifest.compose
                     ? {
                         compose: {
+                            ...(loaded.manifest.compose.plan.devices ? { devices: loaded.manifest.compose.plan.devices } : {}),
                             images: loaded.manifest.compose.plan.images,
                             services: loaded.manifest.compose.plan.services,
                             mountsBlocked: loaded.manifest.compose.plan.mounts_blocked,
@@ -688,15 +689,18 @@ export async function runCli(argv) {
                         outDir: undefined,
                     }),
             });
+        const builtManifest = standalone && !isNativeLayout(standalone) ? loadStandaloneManifest(standalone) : undefined;
+        const devices = builtManifest && builtManifest.ok ? builtManifest.manifest.compose?.plan.devices : undefined;
         const approval = await Promise.all(outputs.map(async (output) => ({ output, ...await spkApprovalDiff(output, options.baseline && resolve(options.baseline)) })));
         const lines = [
             ...approval.map(item => item.output + "\n" + formatApprovalDiff(item)),
             ...outputs.map((output) => `Built ${output}`),
+            ...(devices?.gpu ? [`GPU: ${devices.gpu.paths}; GID source: ${devices.gpu.gid_source}; fallback: ${devices.gpu.fallback}`] : []),
             ...(reproducible ? reproducibleLines(reproducible) : []),
         ];
         if (reproducible && !reproducible.identical)
             throw Object.assign(failure("BUILD_NOT_REPRODUCIBLE", lines.join("\n"), "Find the payload files that differ between builds (timestamps, random paths, unpinned dependencies) and retry after fixing them."), { report: { outputs, reproducible } });
-        emit("build", { outputs, approval, ...(reproducible ? { reproducible } : {}) }, lines.join("\n"));
+        emit("build", { outputs, approval, ...(devices ? { compose: { devices } } : {}), ...(reproducible ? { reproducible } : {}) }, lines.join("\n"));
     });
     if (json)
         console.log = (...args) => console.error(...args);

package/dist/runtime/executor-digests.json

@@ -1 +1,24 @@
-{ "0.20.0": { "x86_64": "e27cfeb85fed221b06f9c58166f02c0f701a724308cd17c96a43a843a0b5c4aa", "aarch64": "908db00cbd37d072f6ffc339e7bca24da5efb8cddd4befcbad02c7398beb7191", "armv7": "a0f35d62ec80a1bf3fb49f5e2d1a5f7576eda569a6fd0695084cec6cb8e100bc", "lifecycle": { "x86_64": "9bb53301670b43cdcd6e21cebac99ab7abd82962d874f32423a81e6cb49d4972", "aarch64": "38fe873c86eb102c850baa1f304114a83a31d1df72defd22792bc37610fec9bb", "armv7": "256fb348b275da7ac5728a3cb7cb7c65660de0d5c2c59430ab4f5ade1b0a3681" }, "goToolchain": "go1.26.9" } }
+{
+    "0.21.0": {
+        "x86_64": "e27cfeb85fed221b06f9c58166f02c0f701a724308cd17c96a43a843a0b5c4aa",
+        "aarch64": "908db00cbd37d072f6ffc339e7bca24da5efb8cddd4befcbad02c7398beb7191",
+        "armv7": "a0f35d62ec80a1bf3fb49f5e2d1a5f7576eda569a6fd0695084cec6cb8e100bc",
+        "lifecycle": {
+            "x86_64": "9bb53301670b43cdcd6e21cebac99ab7abd82962d874f32423a81e6cb49d4972",
+            "aarch64": "38fe873c86eb102c850baa1f304114a83a31d1df72defd22792bc37610fec9bb",
+            "armv7": "256fb348b275da7ac5728a3cb7cb7c65660de0d5c2c59430ab4f5ade1b0a3681"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.21.1": {
+        "x86_64": "e27cfeb85fed221b06f9c58166f02c0f701a724308cd17c96a43a843a0b5c4aa",
+        "aarch64": "908db00cbd37d072f6ffc339e7bca24da5efb8cddd4befcbad02c7398beb7191",
+        "armv7": "a0f35d62ec80a1bf3fb49f5e2d1a5f7576eda569a6fd0695084cec6cb8e100bc",
+        "lifecycle": {
+            "x86_64": "9bb53301670b43cdcd6e21cebac99ab7abd82962d874f32423a81e6cb49d4972",
+            "aarch64": "38fe873c86eb102c850baa1f304114a83a31d1df72defd22792bc37610fec9bb",
+            "armv7": "256fb348b275da7ac5728a3cb7cb7c65660de0d5c2c59430ab4f5ade1b0a3681"
+        },
+        "goToolchain": "go1.26.9"
+    }
+}

package/dist/runtime/sdk-source.d.ts

@@ -36,8 +36,8 @@ export declare function sdkRequirement(backendDir: string): string | undefined;
 export declare function goModulePath(backendDir: string): string | undefined;
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
- * local sdk checkout (development and gates only); otherwise both modules
- * come from `go mod download` of exactly that version.
+ * local sdk checkout (development and gates only); otherwise modules come from
+ * `go mod download`; unchanged executor releases are pinned above.
  */
 export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */

package/dist/runtime/sdk-source.js

@@ -75,16 +75,18 @@ function goMod(backendDir) {
         return '';
     }
 }
+/** SDK releases that reuse an immutable executor release with identical payload bytes. */
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
- * local sdk checkout (development and gates only); otherwise both modules
- * come from `go mod download` of exactly that version.
+ * local sdk checkout (development and gates only); otherwise modules come from
+ * `go mod download`; unchanged executor releases are pinned above.
  */
 export function sdkSource(version, env = process.env, download = (spec) => goModDownload(spec, env)) {
     const dir = env.SYNOPKGLAND_SDK_DIR;
     if (dir)
         return { version, goDir: dir, executorDir: join(dir, 'executor'), local: true };
-    return { version, goDir: download(`${SDK_MODULE}@v${version}`), executorDir: download(`${EXECUTOR_MODULE}@v${version}`), local: false };
+    return { version, goDir: download(`${SDK_MODULE}@v${version}`), executorDir: download(`${EXECUTOR_MODULE}@v${EXECUTOR_RELEASES[version] ?? version}`), local: false };
 }
 const downloaded = new Map();
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */

package/dist/standalone/compose-errors.js

@@ -1,5 +1,10 @@
 /** SDK planner errors accepted at this versioned tool boundary. */
 export const COMPOSE_ERRORS = {
+    COMPOSE_GPU_INVALID: {
+        code: "COMPOSE_GPU_INVALID",
+        description: "The GPU declaration requires bounded package-UID services.",
+        suggestion: "Declare compose.devices.gpu.services with distinct active service names. Keep package UID, no added capabilities, and let the SDK discover Intel render devices and the native videodriver GID.",
+    },
     COMPOSE_STARTUP_INVALID: {
         code: "COMPOSE_STARTUP_INVALID",
         description: "The container startup budget is invalid.",

package/dist/standalone/compose.d.ts

@@ -4,6 +4,15 @@ import { type Daemon } from "./daemon.js";
 import type { SharedFolder } from "./shared-folder.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface ComposePlan {
+    devices?: {
+        gpu?: {
+            services: string[];
+            resource: string;
+            gid_source: string;
+            paths: string;
+            fallback: string;
+        };
+    };
     app_data?: ComposeAppData;
     startup_timeout_seconds?: number;
     ingress?: {
@@ -72,7 +81,7 @@ export interface ComposeApp {
     document: Record<string, any>;
     plan: ComposePlan;
 }
-export declare const COMPOSE_FIELDS: readonly ["startup_timeout_seconds", "resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
+export declare const COMPOSE_FIELDS: readonly ["devices", "startup_timeout_seconds", "resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
 export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void, context?: {
     package?: string;
     sdk?: string;

package/dist/standalone/compose.js

@@ -12,6 +12,7 @@ import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
 export const COMPOSE_FIELDS = [
+    "devices",
     "startup_timeout_seconds",
     "resource_prefix",
     "files",
@@ -68,7 +69,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (!record(value) ||
         Object.keys(value).some((k) => !COMPOSE_FIELDS.includes(k)) ||
         !Array.isArray(value.files))
-        return invalid("compose requires files, with optional env_files, profiles, web, data, shares, network, services, helpers and sdk; old file/targets syntax is removed.");
+        return invalid("compose requires files, with optional env_files, profiles, web, data, shares, devices, network, services, helpers and sdk; old file/targets syntax is removed.");
     if (value.sdk !== undefined &&
         (typeof value.sdk !== "string" || !/^\d+\.\d+\.\d+$/.test(value.sdk)))
         return invalid("compose.sdk must name the matching SDK release.", "SDK_COMPOSE_UNSUPPORTED");
@@ -199,6 +200,7 @@ export function writeComposePayload(c, root, target, gateway) {
     mkdirSync(target, { recursive: true });
     for (const [name, content] of Object.entries({
         "docker-compose.yml": c.plan.effective,
+        ...(c.plan.devices?.gpu ? { "gpu.template.yaml": c.plan.effective } : {}),
         "generated.override.yaml": c.plan.override,
         "compose.lock.json": JSON.stringify(c.plan.lock, null, 2) + "\n",
         "request.json": JSON.stringify({ declaration: c.declaration, sdk: c.sdk, gateway }, null, 2) + "\n",

package/dist/standalone/inspect-spk.d.ts

@@ -25,6 +25,7 @@ export interface SpkInspection {
         requiresAdminApproval: boolean;
     }>;
     compose?: {
+        devices?: ComposeApp["plan"]["devices"];
         ingress?: ComposeApp["plan"]["ingress"];
         images: unknown[];
         services: unknown[];

package/dist/standalone/inspect-spk.js

@@ -608,6 +608,8 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
         if (composeSource(c) !==
             readFileSync(join(root, "compose/docker-compose.yml"), "utf8"))
             throw new Error("worker Compose differs from the SDK plan");
+        if (c.plan.devices?.gpu && readFileSync(join(root, "compose/gpu.template.yaml"), "utf8") !== c.plan.effective)
+            throw new Error("GPU template differs from the SDK plan");
         if (c.plan.override !==
             readFileSync(join(root, "compose/generated.override.yaml"), "utf8"))
             throw new Error("generated override differs from the SDK plan");
@@ -732,6 +734,7 @@ async function inspectUnifiedCompose(dir, payload, metadata, findings) {
         if (storageProblem)
             throw new Error(`[${storageProblem.code}] ${storageProblem.message}`);
         base.compose = {
+            ...(c.plan.devices ? { devices: c.plan.devices } : {}),
             ...(c.plan.ingress ? { ingress: c.plan.ingress } : {}),
             images: c.plan.images,
             services: c.plan.services,
@@ -1041,7 +1044,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
             if (!resource["docker-project"])
                 findings.push("the container is missing the docker-project resource");
             for (const key of Object.keys(resource)) {
-                if (!["docker-project", "webservice"].includes(key))
+                if (!["docker-project", "webservice", ...(compose?.plan.devices?.gpu ? ["video-driver"] : [])].includes(key))
                     findings.push(`Unknown container resource: ${key}`);
             }
         }

package/dist/standalone/resource.js

@@ -11,6 +11,7 @@ export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
     const webConfig = { ...(portal ? portalResource()['web-config'] : {}), ...nativeGatewayResource(m) };
     const resource = {
+        ...(m.compose?.plan.devices?.gpu && !m.compose.plan.mounts_blocked ? { "video-driver": {} } : {}),
         ...(m.compose && !m.compose.plan.mounts_blocked
             ? renderDockerProjectResource(m.package, "compose", false, m.compose.plan.project_name)
             : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.20.0",
+  "version": "0.21.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.20.0",
+    "@synopackageland/templates": "0.21.1",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",