@synopackageland/cli 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.28.0 (2026-10-24)
+
+- Depend on templates `~0.28.0` with SDK/App 0.28.0 and UI 0.14.10. SDK 0.28.0 reuses executor/v0.27.0 through executor manifest format 1; no executor digests change.
+- Default the Compose startup budget to 900 seconds and document slow-NAS readiness; the SDK owns health timing and the Starting status. No per-App option is added.
+- Keep UI CGI scripts executable in built SPKs, and let external OIDC resume tokens reach only the fixed DSM CGI.
+- The release gate checks SDK 0.27.1+ executor builds against the SDK executor manifest instead of requiring a frozen legacy table entry.
+
+## 0.27.1 (2026-10-23)
+
+- Read executor release mappings, toolchain and six payload pins from SDK executor manifest format 1. Accept compatible SDK minors independently of CLI versions; keep the frozen 0.26.0/0.27.0 fallback. Remove the CLI digest-recording script.
+
 ## 0.27.0 (2026-10-23)
 
 - Depend on templates `~0.27.0` with SDK/App 0.27.0 and UI 0.14.9. Templates patches can ship independently and resolve during npm installation/update; runtime uses the installed templates without network fetching. SDK minor upgrades still require a CLI release for executor mappings/digests and `SDK_UNSUPPORTED` checks. New scaffolds use browser same-origin DSM file operations and the idle-storage fixes.

package/README.md

@@ -52,28 +52,33 @@ The CLI packages, deploys and checks. The app-side code is the SDK
 `github.com/synopackageland/syno-pkg-land-sdk` and the npm package `@synopackageland/sdk` (Vue components at
 `@synopackageland/sdk/vue`). The `require github.com/synopackageland/syno-pkg-land-sdk` line in
 `backend/go.mod` is the app's only SDK version; `build` compiles the executor of that version
-and checks it against the digests shipped in this CLI. A CLI builds the SDK releases of its own minor version
-(CLI X.Y.z builds SDK X.Y.*) that its digest table records; `EXECUTOR_DIGEST_MISMATCH` names the ones it knows.
+and checks both payloads against the resolved SDK's `executor-manifest.json`.
+The manifest declares format 1, the exact executor release, its Go toolchain and
+six SHA-256 digests. SDK minor versions are independent of CLI minor versions.
 
-The SDK repositories are private. The CLI adds `github.com/synopackageland/*` to its Go
-children's `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving existing environment and
-`go env -w` settings. Give git a credential that can read
-`https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`);
-a failed fetch reports `SDK_DOWNLOAD_FAILED`.
+SDK module downloads preserve normal Go checksum verification and the user's Go
+settings; Go Apps also check their existing `backend/go.sum`. Commit that file
+alongside npm lockfiles. Do not disable checksum verification for public SDK
+packages. Private mirrors can use explicitly configured Go authentication and
+checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
 CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.27.0 depends on `~0.27.0`: npm installation or
-update can select the latest templates patch in the 0.27 minor line. Templates
+`@synopackageland/templates`. CLI 0.28.0 depends on `~0.28.0`: npm installation or
+update can select the latest templates patch in the 0.28 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
-The templates' SDK pin must stay in the CLI-supported minor line. An SDK minor
-upgrade still needs a CLI release for its executor mapping/digests and
-`SDK_UNSUPPORTED` checks. Runtime SDK defaults continue to come from the actual
-installed templates, independently of the CLI patch version.
+The CLI accepts SDK executor manifest format 1 across SDK minor versions. The
+exact SDK Go module sum anchors the build manifest; npm integrity anchors the
+identical manifest in `@synopackageland/sdk/executor-manifest.json`. No manifest
+is fetched at NAS runtime. Missing, malformed or unsupported new manifests fail
+closed. SDK 0.26.0 and 0.27.0 retain the CLI's frozen legacy inventory.
+SDK defaults continue to come from the actual installed templates. An SDK minor
+release no longer requires a CLI release; new CLI capabilities or a new manifest
+format can still require one.
 
 For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with

package/dist/error-registry.js

@@ -909,8 +909,13 @@ export const ERROR_REGISTRY = {
         },
         SDK_UNSUPPORTED: {
             code: "SDK_UNSUPPORTED",
-            description: "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.",
-            suggestion: "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message).",
+            description: "The SDK has an unsupported executor manifest format or lacks a known legacy inventory.",
+            suggestion: "Use an SDK with executor manifest format 1, or update the CLI when a new manifest format is needed.",
+        },
+        SDK_MANIFEST_INVALID: {
+            code: "SDK_MANIFEST_INVALID",
+            description: "The resolved SDK executor manifest has invalid versions, toolchain or payload digests.",
+            suggestion: "Reinstall the exact locked SDK package and verify its integrity; do not replace its manifest with runtime data.",
         },
         SDK_DIR_NOT_READY: {
             code: "SDK_DIR_NOT_READY",

package/dist/runtime/executor-build.js

@@ -1,7 +1,7 @@
 import { goChildEnv } from "./go-env.js";
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
+import { PINNED_GO_TOOLCHAIN, pinnedGoBuildEnv, goBinaryVersion } from '../build-spk/go-toolchain.js';
 import { sdkBackend } from '../standalone/manifest.js';
 import { StandaloneBuildError } from '../standalone/spk.js';
 import { checkCgiBinary } from '../standalone/binary.js';
@@ -11,7 +11,7 @@ import { copyModule, verifyExecutorDigests } from './executor-source.js';
 import { requiredSdk } from './sdk-source.js';
 import { rootProgramsUnsupported } from './root-programs.js';
 import { executorPolicyProblem } from './executor-policy-check.js';
-/** CLI-owned build flags; the release digest table is computed the same way, so they must not change within an SDK minor. */
+/** Manifest format 1's reproducible build flags; changing them requires a new format. */
 const GO_BUILD = ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o'];
 function failure(error) {
     const message = error.message;
@@ -32,6 +32,8 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     catch (error) {
         throw failure(error);
     }
+    const toolchain = sdk.manifest?.executorDigests.goToolchain ?? PINNED_GO_TOOLCHAIN;
+    const toolchainHint = `These executor binaries need ${toolchain}; install it on PATH or allow Go to download that exact toolchain.`;
     const dir = join(work, `executor-${arch}`);
     mkdirSync(dir);
     const source = join(dir, 'source');
@@ -42,22 +44,24 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
         throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor sources of SDK ${sdk.version} are missing: ${error.message}`);
     }
     const binary = join(dir, 'executor');
-    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
+    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch), GOTOOLCHAIN: toolchain }) });
     if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${toolchainHint}\n${result.stderr}`);
     const problem = checkCgiBinary(work, binary, arch);
     if (problem)
         throw new StandaloneBuildError(problem.code, problem.message);
     const lifecycleBinary = join(dir, 'lifecycle');
-    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
+    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch), GOTOOLCHAIN: toolchain }) });
     if (lifecycleResult.missing || lifecycleResult.status !== 0)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${PINNED_GO_HINT}\n${lifecycleResult.stderr}`);
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${toolchainHint}\n${lifecycleResult.stderr}`);
     const lifecycleProblem = checkCgiBinary(work, lifecycleBinary, arch);
     if (lifecycleProblem)
         throw new StandaloneBuildError(lifecycleProblem.code, lifecycleProblem.message);
-    const toolchainProblem = pinnedGoProblem(binary) ?? pinnedGoProblem(lifecycleBinary);
-    if (toolchainProblem)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', toolchainProblem);
+    for (const file of [binary, lifecycleBinary]) {
+        const actual = goBinaryVersion(file);
+        if (actual !== toolchain)
+            throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `${file} was built by ${actual ?? 'an unknown Go release'}, not ${toolchain}.`);
+    }
     const executorDigest = sha256(readFileSync(binary));
     let warnings;
     try {
@@ -79,7 +83,7 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     const policyText = executorPolicyText(policy);
     let refused;
     try {
-        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env);
+        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env, toolchain);
     }
     catch (error) {
         throw failure(error);

package/dist/runtime/executor-policy-check.d.ts

@@ -4,9 +4,9 @@ import { type StandaloneManifest } from '../standalone/manifest.js';
  * undefined when it accepts it. The executor is
  * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
  */
-export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv, toolchain?: string): string | undefined;
 /** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
-export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv, toolchain?: string): string | undefined;
 /** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
 export declare function manifestPolicyProblem(m: StandaloneManifest, env?: NodeJS.ProcessEnv): {
     code: string;

package/dist/runtime/executor-policy-check.js

@@ -3,7 +3,7 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { PINNED_GO_HINT, PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
+import { PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
 import { sdkBackend } from '../standalone/manifest.js';
 import { executorPolicy, executorPolicyText } from './executor-policy.js';
 import { requiredSdk } from './sdk-source.js';
@@ -14,14 +14,14 @@ const CHECK_POLICY = 'check-policy';
  * undefined when it accepts it. The executor is
  * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
  */
-export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env) {
+export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env, toolchain = PINNED_GO_TOOLCHAIN) {
     const dir = mkdtempSync(join(tmpdir(), 'synopkgland-check-policy-'));
     try {
         const binary = join(dir, 'executor');
         const { GOOS: _os, GOARCH: _arch, ...host } = env;
-        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: goChildEnv({ ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }), encoding: 'utf8' });
+        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: goChildEnv({ ...host, GOTOOLCHAIN: toolchain, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }), encoding: 'utf8' });
         if (build.error || build.status !== 0)
-            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. ${PINNED_GO_HINT}\n${build.stderr || build.error?.message}`);
+            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. This SDK's executor needs ${toolchain}.\n${build.stderr || build.error?.message}`);
         const result = spawnSync(binary, [CHECK_POLICY, '--package', pkg], { input: policyText, encoding: 'utf8' });
         if (result.status === 0)
             return undefined;
@@ -43,13 +43,13 @@ const POLICY_FIX = [
     [/policy entry/, 'fix entry in dsm-package.yaml'],
 ];
 /** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
-export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env) {
-    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env);
+export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env, toolchain = PINNED_GO_TOOLCHAIN) {
+    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env, toolchain);
     if (!reason)
         return undefined;
     const fix = POLICY_FIX.find(([pattern]) => pattern.test(reason))?.[1] ?? 'fix the declaration in dsm-package.yaml';
     return `The executor of SDK ${sdkVersion} refuses this App's policy (executor: ${reason}), so the NAS would refuse it at approval: ${fix}.`
-        + ' If dsm-package.yaml already matches the manifest reference, this CLI and the SDK disagree: use the SDK version this CLI release names.';
+        + ' If dsm-package.yaml already matches the manifest reference, check the SDK manifest contract and the CLI capability support.';
 }
 /** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
 export function manifestPolicyProblem(m, env = process.env) {
@@ -58,7 +58,7 @@ export function manifestPolicyProblem(m, env = process.env) {
     try {
         const sdk = requiredSdk(sdkBackend(m), env);
         for (const text of new Set(m.arches.map(arch => executorPolicyText(executorPolicy(m, arch))))) {
-            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env);
+            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env, sdk.manifest?.executorDigests.goToolchain);
             if (message)
                 return { code: 'EXECUTOR_POLICY_REJECTED', message };
         }

package/dist/runtime/executor-source.d.ts

@@ -1,21 +1,17 @@
 import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
 import type { SdkSource } from './sdk-source.js';
-type ArchDigests = Record<NativeArchFamily, string>;
+import { type ExecutorDigests } from './sdk-executor-manifest.js';
 /** Released SDK versions: the sha256 of the executor and lifecycle helper built from them, per architecture. */
-export type ExecutorDigestTable = Record<string, ArchDigests & {
-    lifecycle: ArchDigests;
-    goToolchain: string;
-}>;
+export type ExecutorDigestTable = Record<string, ExecutorDigests>;
 export declare const SHIPPED_EXECUTOR_DIGESTS: ExecutorDigestTable;
 /** Copy a module directory (the module cache is read-only) so the build owns a writable tree. */
 export declare function copyModule(source: string, target: string): void;
 /**
  * A released SDK's executor is only shipped when its bytes equal the digest
- * table; a local SDK checkout (SYNOPKGLAND_SDK_DIR) is built unverified.
+ * manifest (or frozen legacy table); a local SDK checkout is built unverified.
  * Returns the warnings to show.
  */
 export declare function verifyExecutorDigests(sdk: SdkSource, arch: NativeArchFamily, built: {
     executor: string;
     lifecycle: string;
 }, table?: ExecutorDigestTable): string[];
-export {};

package/dist/runtime/executor-source.js

@@ -1,6 +1,7 @@
 import { chmodSync, cpSync, lstatSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import EXECUTOR_DIGESTS from './executor-digests.json' with { type: 'json' };
+import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
 export const SHIPPED_EXECUTOR_DIGESTS = EXECUTOR_DIGESTS;
 /** Copy a module directory (the module cache is read-only) so the build owns a writable tree. */
 export function copyModule(source, target) {
@@ -18,13 +19,14 @@ export function copyModule(source, target) {
 }
 /**
  * A released SDK's executor is only shipped when its bytes equal the digest
- * table; a local SDK checkout (SYNOPKGLAND_SDK_DIR) is built unverified.
+ * manifest (or frozen legacy table); a local SDK checkout is built unverified.
  * Returns the warnings to show.
  */
 export function verifyExecutorDigests(sdk, arch, built, table = SHIPPED_EXECUTOR_DIGESTS) {
     if (sdk.local)
         return [`[EXECUTOR_DIGEST_UNVERIFIED] executor built from the local SDK checkout SYNOPKGLAND_SDK_DIR (${arch}, sha256 ${built.executor}); the digest table was not checked. Do not publish this SPK.`];
-    const expected = table[sdk.version];
+    const manifest = sdk.manifest ?? readExecutorManifest(sdk.goDir, sdk.version);
+    const expected = manifest?.executorDigests ?? (predatesExecutorManifest(sdk.version) ? table[sdk.version] : undefined);
     if (!expected)
         throw new Error(`[EXECUTOR_DIGEST_MISMATCH] This CLI has no recorded executor digest for SDK ${sdk.version}; it knows ${Object.keys(table).join(', ') || 'no released SDK'}.`);
     if (expected[arch] !== built.executor)

package/dist/runtime/sdk-executor-manifest.d.ts

@@ -0,0 +1,16 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+export type ArchDigests = Record<NativeArchFamily, string>;
+export type ExecutorDigests = ArchDigests & {
+    lifecycle: ArchDigests;
+    goToolchain: string;
+};
+export interface ExecutorManifest {
+    formatVersion: 1;
+    sdkVersion: string;
+    executorVersion: string;
+    executorDigests: ExecutorDigests;
+}
+/** Read only the resolved, integrity-protected SDK module, never a remote manifest. */
+export declare function readExecutorManifest(goDir: string, version: string): ExecutorManifest | undefined;
+/** Only SDKs released before the manifest contract can use the frozen inventory. */
+export declare function predatesExecutorManifest(version: string): boolean;

package/dist/runtime/sdk-executor-manifest.js

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const versionPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+/** Read only the resolved, integrity-protected SDK module, never a remote manifest. */
+export function readExecutorManifest(goDir, version) {
+    let text;
+    try {
+        text = readFileSync(join(goDir, 'executor-manifest.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    const invalid = () => { throw new Error(`[SDK_MANIFEST_INVALID] SDK ${version} has an invalid executor-manifest.json; reinstall the exact locked SDK package.`); };
+    let m;
+    try {
+        m = JSON.parse(text);
+    }
+    catch {
+        return invalid();
+    }
+    if (!m || typeof m !== 'object' || !Number.isInteger(m.formatVersion))
+        return invalid();
+    if (m.formatVersion !== 1)
+        throw new Error(`[SDK_UNSUPPORTED] SDK ${version} declares executor manifest format ${m.formatVersion}; this CLI understands format 1. Update the CLI to support that format.`);
+    if (m.sdkVersion !== version || !versionPattern.test(m.sdkVersion) || typeof m.executorVersion !== 'string' || !versionPattern.test(m.executorVersion))
+        return invalid();
+    const d = m.executorDigests;
+    if (!d || typeof d.goToolchain !== 'string' || !/^go1\.\d+\.\d+$/.test(d.goToolchain))
+        return invalid();
+    for (const hashes of [d, d.lifecycle])
+        for (const arch of ['x86_64', 'aarch64', 'armv7']) {
+            if (!hashes || typeof hashes[arch] !== 'string' || !/^[a-f0-9]{64}$/.test(hashes[arch]))
+                return invalid();
+        }
+    return m;
+}
+/** Only SDKs released before the manifest contract can use the frozen inventory. */
+export function predatesExecutorManifest(version) {
+    if (!versionPattern.test(version))
+        return false;
+    const [major, minor, patch] = version.split('.').map(Number);
+    return major === 0 && (minor < 27 || (minor === 27 && patch === 0));
+}

package/dist/runtime/sdk-source.d.ts

@@ -1,4 +1,5 @@
 export { goPrivateCovers } from './go-env.js';
+import { type ExecutorManifest } from './sdk-executor-manifest.js';
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
@@ -19,6 +20,7 @@ export interface SdkSource {
     goDir: string;
     executorDir: string;
     local: boolean;
+    manifest?: ExecutorManifest;
 }
 /** How each backend declares the SDK. */
 export declare const SDK_DEPENDENCY: Record<SdkBackend['kind'], string>;
@@ -41,7 +43,7 @@ export declare function goModulePath(backendDir: string): string | undefined;
  */
 export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
-export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
+export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv, moduleDir?: string): string;
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
 export declare function requiredSdk(backend: SdkBackend, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /** Go children fetch the private SDK directly; failed fetches need git credentials. */

package/dist/runtime/sdk-source.js

@@ -1,9 +1,9 @@
 import { spawnSync } from 'node:child_process';
-import { goChildEnv } from './go-env.js';
 export { goPrivateCovers } from './go-env.js';
 import { readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;
@@ -86,16 +86,23 @@ export function sdkSource(version, env = process.env, download = (spec) => goMod
     const dir = env.SYNOPKGLAND_SDK_DIR;
     if (dir)
         return { version, goDir: dir, executorDir: join(dir, 'executor'), local: true };
-    return { version, goDir: download(`${SDK_MODULE}@v${version}`), executorDir: download(`${EXECUTOR_MODULE}@v${EXECUTOR_RELEASES[version] ?? version}`), local: false };
+    const goDir = download(`${SDK_MODULE}@v${version}`);
+    const manifest = readExecutorManifest(goDir, version);
+    if (!manifest && !predatesExecutorManifest(version))
+        throw new Error(`[SDK_UNSUPPORTED] SDK ${version} is missing executor-manifest.json; install a released SDK with manifest format 1.`);
+    return { version, goDir, executorDir: download(`${EXECUTOR_MODULE}@v${manifest?.executorVersion ?? EXECUTOR_RELEASES[version] ?? version}`), local: false, ...(manifest ? { manifest } : {}) };
 }
 const downloaded = new Map();
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
-export function goModDownload(spec, env = process.env) {
-    const key = [spec, env.GOPROXY, env.GOMODCACHE, env.GOPATH].join('\0');
+export function goModDownload(spec, env = process.env, moduleDir = tmpdir()) {
+    const key = [spec, moduleDir, env.GOPROXY, env.GOMODCACHE, env.GOPATH, env.GOSUMDB, env.GONOSUMDB, env.GOPRIVATE].join('\0');
     const cached = downloaded.get(key);
     if (cached)
         return cached;
-    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: tmpdir(), env: goChildEnv({ ...env, GOWORK: 'off', GOFLAGS: '' }), encoding: 'utf8' });
+    // Public SDK manifests rely on Go module sums. Do not add the namespace to
+    // GOPRIVATE/GONOSUMDB as other legacy build children do. For Go Apps the
+    // command also checks the App's existing go.sum in its own module directory.
+    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: moduleDir, env: { ...env, GOWORK: 'off', GOFLAGS: '' }, encoding: 'utf8' });
     let info = {};
     try {
         info = JSON.parse(result.stdout);
@@ -104,6 +111,8 @@ export function goModDownload(spec, env = process.env) {
     if (result.error || result.status !== 0 || !info.Dir) {
         throw new Error(`[SDK_DOWNLOAD_FAILED] go mod download ${spec} failed: ${info.Error ?? result.stderr ?? result.error?.message}${privateSdkHint()}`);
     }
+    if (readExecutorManifest(info.Dir, spec.split('@v')[1] ?? '') && (typeof info.Sum !== 'string' || !/^h1:[A-Za-z0-9+/]{43}=$/.test(info.Sum)))
+        throw new Error(`[SDK_MANIFEST_INVALID] SDK module ${spec} has no verified Go module sum.`);
     downloaded.set(key, info.Dir);
     return info.Dir;
 }
@@ -112,7 +121,7 @@ export function requiredSdk(backend, env = process.env, download) {
     const version = appSdkVersion(backend);
     if (!version)
         throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: ${SDK_DEPENDENCY[backend.kind]}`);
-    return download ? sdkSource(version, env, download) : sdkSource(version, env);
+    return sdkSource(version, env, download ?? (spec => goModDownload(spec, env, backend.kind === 'go' ? backend.dir : undefined)));
 }
 /** Go children fetch the private SDK directly; failed fetches need git credentials. */
 export function privateSdkHint() {

package/dist/standalone/compose-errors.js

@@ -13,7 +13,7 @@ export const COMPOSE_ERRORS = {
     COMPOSE_STARTUP_INVALID: {
         code: "COMPOSE_STARTUP_INVALID",
         description: "The container startup budget is invalid.",
-        suggestion: "Set compose.startup_timeout_seconds to an integer from 2 to 900 seconds; the default is 120. Read the same SYNOPKGLAND_STARTUP_BUDGET_SECONDS in the App bootstrap adapter.",
+        suggestion: "Set compose.startup_timeout_seconds to an integer from 2 to 900 seconds; the default is 900, which a loaded HDD NAS may need. Read the same SYNOPKGLAND_STARTUP_BUDGET_SECONDS in the App bootstrap adapter.",
     },
     COMPOSE_STARTUP_TIMEOUT: {
         code: "COMPOSE_STARTUP_TIMEOUT",
@@ -82,8 +82,8 @@ export const COMPOSE_ERRORS = {
     },
     COMPOSE_HEALTH_NOT_READY: {
         code: "COMPOSE_HEALTH_NOT_READY",
-        description: "The App health endpoint did not return the expected status.",
-        suggestion: "Check the declared App health path/status and upstream health; redirects are not followed.",
+        description: "The App health endpoint did not return the expected status within the startup budget.",
+        suggestion: "Check the declared App health path/status and upstream health; redirects are not followed. daemon/daemon.log records how long the App stayed unavailable. Keep the default startup budget on slow NAS devices.",
     },
     COMPOSE_REQUEST_INVALID: {
         code: "COMPOSE_REQUEST_INVALID",

package/dist/standalone/compose.js

@@ -77,7 +77,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value.startup_timeout_seconds !== undefined &&
         (!Number.isInteger(value.startup_timeout_seconds) ||
             value.startup_timeout_seconds < 2 || value.startup_timeout_seconds > 900))
-        return invalid("compose.startup_timeout_seconds must be an integer from 2 to 900 seconds (default 120).", "COMPOSE_STARTUP_INVALID");
+        return invalid("compose.startup_timeout_seconds must be an integer from 2 to 900 seconds (default 900).", "COMPOSE_STARTUP_INVALID");
     let hostUdp;
     if (value.host_udp !== undefined) {
         const ports = new Set();
@@ -178,7 +178,7 @@ export function composeDaemon(m) {
         args: ["run"],
         targets: m.compose.targets,
         env: {},
-        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 120 },
+        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 900 },
     };
 }
 export function composeNetwork(m) {

package/dist/standalone/oidc-resume.d.ts

@@ -1,2 +1,2 @@
-/** No caller-provided URL reaches location: only a transaction and a declared port. */
+/** Only the fixed DSM CGI receives a resume token; external origins are resolved by the SDK. */
 export declare function oidcResumeRuntime(pkg: string, ports: number[]): string;

package/dist/standalone/oidc-resume.js

@@ -1,4 +1,4 @@
-/** No caller-provided URL reaches location: only a transaction and a declared port. */
+/** Only the fixed DSM CGI receives a resume token; external origins are resolved by the SDK. */
 export function oidcResumeRuntime(pkg, ports) {
     return `(function(param) {
   if (typeof param === 'string') {
@@ -14,13 +14,18 @@ export function oidcResumeRuntime(pkg, ports) {
   }
   if (!param || typeof param !== 'object' || Array.isArray(param)) return false;
   var value = param && param.ssoResume;
-  if (typeof value !== 'string') return false;
+  if (typeof value !== 'string' || /\\s/.test(value)) return false;
+  var external = /^[A-Za-z0-9_-]{1,128}:x[01]:[0-9]{1,19}\\.[0-9]{1,19}$/.test(value);
   var parts = /^([A-Za-z0-9_-]{1,128}):([0-9]{1,5})$/.exec(value);
-  if (!parts || ${JSON.stringify(ports)}.indexOf(Number(parts[2])) < 0) return false;
+  if (!external && (!parts || ${JSON.stringify(ports)}.indexOf(Number(parts[2])) < 0)) return false;
   var target = new URL(${JSON.stringify(`/webman/3rdparty/${pkg}/sso/authorize.cgi`)},location.origin);
-  var app = new URL(location.origin); app.port = parts[2]; app.pathname = '/_sso/dsm-return';
-  target.searchParams.set('return',app.href);
-  target.searchParams.set('txn',parts[1]);
+  if (external) {
+    target.searchParams.set('resume',value);
+  } else {
+    var app = new URL(location.origin); app.port = parts[2]; app.pathname = '/_sso/dsm-return';
+    target.searchParams.set('return',app.href);
+    target.searchParams.set('txn',parts[1]);
+  }
   target.searchParams.set('login_attempt','1');
   location.replace(target.href);
   return true;

package/dist/standalone/sdk-check.d.ts

@@ -5,7 +5,7 @@ export interface SdkProblem {
 }
 /**
  * The backend's dependency files name the App's SDK version; the frontend
- * package and this CLI must agree with it. `needsSdk`: the App declares
+ * must agree, and the CLI must understand its manifest. `needsSdk`: the App declares
  * delegate or rootOps.
  */
-export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];
+export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkProblem[];

package/dist/standalone/sdk-check.js

@@ -1,16 +1,17 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor } from "../runtime/sdk-source.js";
-const minorLine = (version) => version.split(".").slice(0, 2).join(".");
+import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor, sdkSource, goModDownload } from "../runtime/sdk-source.js";
+import { predatesExecutorManifest } from '../runtime/sdk-executor-manifest.js';
+import { SHIPPED_EXECUTOR_DIGESTS } from '../runtime/executor-source.js';
 /** The file that names each backend kind's SDK version. */
 const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "Cargo.lock", python: "backend.sdk", node: "backend.sdk" };
 /**
  * The backend's dependency files name the App's SDK version; the frontend
- * package and this CLI must agree with it. `needsSdk`: the App declares
+ * must agree, and the CLI must understand its manifest. `needsSdk`: the App declares
  * delegate or rootOps.
  */
-export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
+export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION, env = process.env, download) {
     let version;
     try {
         version = appSdkVersion(backend);
@@ -22,16 +23,29 @@ export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VER
         throw error;
     }
     if (!version) {
-        return needsSdk ? [{ code: "SDK_REQUIRED", message: `Python, Node and Rust Apps, plus capabilities.delegate and rootOps, need the SDK (${minorLine(cliVersion)}.x): ${SDK_DEPENDENCY[backend.kind]}` }] : [];
+        return needsSdk ? [{ code: "SDK_REQUIRED", message: `Python, Node and Rust Apps, plus capabilities.delegate and rootOps, need the SDK: ${SDK_DEPENDENCY[backend.kind]}` }] : [];
     }
     const file = SDK_VERSION_FILE[backend.kind];
     const problems = [];
-    if (minorLine(version) !== minorLine(cliVersion)) {
-        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports only SDK ${minorLine(cliVersion)}.x. Use the matching CLI, or raise the SDK to ${minorLine(cliVersion)}.x.` });
-    }
-    else if (sdkBelowFloor(version)) {
+    if (sdkBelowFloor(version)) {
         problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports SDK ${SDK_FLOOR} or later. Raise the SDK to ${SDK_FLOOR} or later.` });
     }
+    else if (predatesExecutorManifest(version)) {
+        if (!SHIPPED_EXECUTOR_DIGESTS[version])
+            problems.push({ code: 'SDK_UNSUPPORTED', message: `${file} requires SDK ${version}; this pre-manifest SDK has no pinned executor inventory. Use SDK 0.26.0, 0.27.0, or a release with executor manifest format 1.` });
+    }
+    else {
+        try {
+            sdkSource(version, env, download ?? (spec => goModDownload(spec, env, backend.kind === 'go' ? backend.dir : undefined)));
+        }
+        catch (error) {
+            const message = error.message;
+            const tagged = /^\[([A-Z_]+)\] ([\s\S]*)$/.exec(message);
+            if (!tagged)
+                throw error;
+            problems.push({ code: tagged[1], message: tagged[2] });
+        }
+    }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
         problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json has ${SDK_PACKAGE} ${frontend.spec} (${frontend.version ?? "version unreadable"}), while ${file} requires ${version}; the two must match.` });

package/dist/standalone/spk.js

@@ -410,7 +410,7 @@ function copyUiTree(source, target) {
                     throw new StandaloneBuildError("STANDALONE_UI_TOO_LARGE", "The UI directory exceeds 64 MiB.");
                 }
                 copyFileSync(src, join(to, name));
-                chmodSync(join(to, name), FILE_MODE);
+                chmodSync(join(to, name), name.endsWith(".cgi") ? EXEC_MODE : FILE_MODE);
             }
             else {
                 throw new StandaloneBuildError("STANDALONE_UI_SPECIAL_FILE", `The UI directory may contain only regular files and directories: ${src}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -20,14 +20,14 @@
     "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test --test-concurrency=${SYNOPKGLAND_GATE_JOBS:-3} test/*.test.ts test/ctl/*.test.ts",
     "test:glossary": "node --test scripts/test/glossary-drift.test.mjs",
-    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
+    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
     "gates": "bash scripts/ci/gates.sh",
     "gates:fast": "bash scripts/ci/gates.sh --fast",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.27.0",
+    "@synopackageland/templates": "~0.28.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -9,9 +9,12 @@ CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
-reproducible offline-ready installations. An SDK minor upgrade still requires a
-CLI release with executor mappings/digests and `SDK_UNSUPPORTED` validation; a
-templates patch must keep its SDK pin in the CLI-supported minor line.
+reproducible offline-ready installations. SDK minor releases are independent of
+the CLI: executor manifest format 1 in the resolved SDK pins the executor release,
+Go toolchain and six payload digests. Preserve npm integrity and Go module sums.
+The CLI verifies bytes before packaging and never fetches a manifest at NAS runtime.
+Unsupported formats require a CLI update; invalid manifests fail closed. Existing
+SDK 0.26.0/0.27.0 use the frozen legacy inventory.
 
 Before releasing an executor App, read [reference/approval-upgrades.md](reference/approval-upgrades.md). Run build/inspect with the previous released SPK as `--baseline` and include the approval difference in release notes. Without a comparable baseline, retention is unknown.
 

package/skills/reference/compose.md

@@ -37,14 +37,21 @@ scripts run as the package account; containers are managed by Container Manager.
 
 ## Startup budget
 
-Set `compose.startup_timeout_seconds: 600` for a slow cold start or migration.
-Omitting it uses 120 seconds; only integers from 2 through 900 are accepted.
+Omit `compose.startup_timeout_seconds`: the default of 900 seconds lets a loaded
+HDD NAS with 2 GB RAM start the App. Declare a shorter value only with device
+evidence; only integers from 2 through 900 are accepted.
 Lock waiting, status, readiness, stability and handoff share that deadline; there
 is no extra fixed handoff allowance. The cap is a policy bound, not a measured
 DSM lifecycle limit. `daemon: {timeouts: {stop: 120, status: 15, uninstall: 300}}`
 configures the other lifecycle phases without declaring a daemon payload.
-A transient health failure closes new ingress while the running App gets one
-operation-budget recovery window; authority or generation failures stop at once.
+One readiness probe may take 30 seconds. A health failure after startup closes
+new ingress and the gateway shows a localized, self-refreshing starting page
+(`app_starting` for API clients) while DSM status stays running; the App gets
+the startup budget to recover before its gateway stops. Authority or generation
+failures stop at once. The SDK raises stricter Compose healthcheck timing to
+timeout 30s, retries 3 and start_period equal to the startup budget; declare the
+health command only, without timing or short in-command limits such as
+`curl --max-time 2`.
 Use a matching SDK that implements the field and rebuild the App; older planners
 are rejected for explicit budgets. The SDK plan drives generated daemon start
 and supplies every container with `SYNOPKGLAND_STARTUP_BUDGET_SECONDS`, overriding
@@ -93,7 +100,7 @@ a build operator trust decision. `check`/`inspect` remain offline.
 
 | Feature | Current behavior |
 | --- | --- |
-| Files in one directory, profiles, anchors, depends_on, healthcheck | Reference-loader semantics retained; DSM worker compatibility needs device acceptance |
+| Files in one directory, profiles, anchors, depends_on, healthcheck | Reference-loader semantics retained; healthcheck timing receives the SDK slow-NAS floor; DSM worker compatibility needs device acceptance |
 | Named local volumes | Stable package namespace, retained across recreation; inspect inventory |
 | Private bind data | DSM build rejects COMPOSE_PRIVATE_BIND_TIMING_UNSUPPORTED: clean-install preinst precedes pkgvar creation, while worker acquire precedes postinst; no root initialization or automatic volume conversion |
 | Image VOLUME | Build inventories verified image config and assigns a stable named volume |
@@ -232,7 +239,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades still require a CLI release with executor mappings/digests and `SDK_UNSUPPORTED` checks. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/lifecycle.md

@@ -115,7 +115,7 @@ Use existing `daemon.timeouts` for start/stop/status/uninstall (defaults
 30/30/5/60 seconds). Start/stop/uninstall accept 2–3600 seconds and status accepts
 1–3600. A `daemon` containing only `timeouts` declares budgets without an
 executable, including background and Compose Apps; Compose start still uses
-`compose.startup_timeout_seconds` (120, 2–900). Background user-manager recovery
+`compose.startup_timeout_seconds` (900, 2–900). Background user-manager recovery
 uses the start allowance and its generated package user unit uses the stop
 allowance with `KillMode=control-group`.