@synopackageland/cli 0.3.6 → 0.3.8

package/dist/build-spk/generator.js

@@ -20,9 +20,23 @@ import { renderNativePrivilege, renderNativeStartStopStatus, renderNativePostuni
 import { renderHeadlessResourceMarker, renderResourceConfig, renderResourceWorkerStartStopStatus, } from "./resource-worker.js";
 const FILE_MODE = 0o644;
 const SCRIPT_MODE = 0o755;
+function hasInterpolation(value) {
+    if (typeof value === "string") {
+        return /\$\{([^}]+)\}/.test(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some(hasInterpolation);
+    }
+    if (value && typeof value === "object") {
+        return Object.values(value).some(hasInterpolation);
+    }
+    return false;
+}
 const INSTALL_UIFILE = "install_uifile";
 const UPGRADE_UIFILE = "upgrade_uifile";
 const UNINSTALL_UIFILE = "uninstall_uifile";
+const HEADLESS_PROBE_VOLUME = "./.synopkgland:/run/synopkgland:ro";
+const HEADLESS_PROBE_README = "Reserved bind target for package-user headless status probing.\n";
 export const EMBEDDED_ATTESTATION_RELATIVE_PATH = ".synopkgland/attestation.jwt";
 const SCRIPT_NAMES = [
     "preinst",
@@ -171,11 +185,12 @@ export async function buildSpk(options) {
             const resourceProjectDir = join(staging, "package", "compose");
             mkdirSync(resourceProjectDir, { recursive: true });
             const dsmUserParam = collectInstallParameters(contract).find((p) => p.param.type === "dsm_user");
-            if (dsmUserParam) {
+            let composeContent;
+            if (dsmUserParam || rwEligibility?.headless === true || hasOidcCompat(contract)) {
                 const rawYaml = readFileSync(options.project.composePath, "utf8");
                 const doc = parseDocument(rawYaml);
                 const services = doc.get("services");
-                if (services && typeof services === "object" && typeof services.toJSON === "function") {
+                if (dsmUserParam && services && typeof services === "object" && typeof services.toJSON === "function") {
                     const serviceNames = Object.keys(services.toJSON());
                     for (const sName of serviceNames) {
                         const userVal = new Scalar(`\${${dsmUserParam.name}_UID}:\${${dsmUserParam.name}_GID}`);
@@ -183,15 +198,49 @@ export async function buildSpk(options) {
                         doc.setIn(["services", sName, "user"], userVal);
                     }
                 }
-                let composeContent = doc.toString();
-                const escaped = `\\$\\{${dsmUserParam.name}_UID\\}:\\$\\{${dsmUserParam.name}_GID\\}`;
-                composeContent = composeContent.replace(new RegExp(`^([ \\t]*)user:\\s*"${escaped}"`, "gm"), `$1user: "\${${dsmUserParam.name}_UID}:\${${dsmUserParam.name}_GID}"\n$1# synopkgland:group_add ${dsmUserParam.name}`);
-                writeFileSync(join(resourceProjectDir, "docker-compose.yml"), composeContent, "utf8");
+                if (hasOidcCompat(contract) && services && typeof services === "object" && typeof services.toJSON === "function") {
+                    const rawServices = services.toJSON();
+                    for (const [sName, sValue] of Object.entries(rawServices)) {
+                        if (sValue && typeof sValue === "object" && hasInterpolation(sValue)) {
+                            const str = JSON.stringify(sValue);
+                            if (str.includes("SYNOPKGLAND_OIDC_ISSUER")) {
+                                const serviceDoc = doc.getIn(["services", sName]);
+                                const existingExtraHosts = serviceDoc?.get?.("extra_hosts");
+                                const hostGatewayMapping = "${SYNOPKGLAND_OIDC_ISSUER_HOST}:host-gateway";
+                                if (!existingExtraHosts) {
+                                    doc.setIn(["services", sName, "extra_hosts"], [hostGatewayMapping]);
+                                }
+                                else if (Array.isArray(existingExtraHosts.toJSON?.())) {
+                                    const arr = existingExtraHosts.toJSON();
+                                    if (!arr.includes(hostGatewayMapping)) {
+                                        doc.setIn(["services", sName, "extra_hosts"], [...arr, hostGatewayMapping]);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                if (rwEligibility?.headless === true) {
+                    injectHeadlessProbeVolume(doc);
+                }
+                composeContent = doc.toString();
+                if (dsmUserParam) {
+                    const escaped = `\\$\\{${dsmUserParam.name}_UID\\}:\\$\\{${dsmUserParam.name}_GID\\}`;
+                    composeContent = composeContent.replace(new RegExp(`^([ \\t]*)user:\\s*"${escaped}"`, "gm"), `$1user: "\${${dsmUserParam.name}_UID}:\${${dsmUserParam.name}_GID}"\n$1# synopkgland:group_add ${dsmUserParam.name}`);
+                }
             }
             else {
-                copyFileSync(options.project.composePath, join(resourceProjectDir, "docker-compose.yml"));
+                composeContent = readFileSync(options.project.composePath, "utf8");
             }
+            composeContent = injectPosixAllSharesMarkers(composeContent, contract);
+            writeFileSync(join(resourceProjectDir, "docker-compose.yml"), composeContent, "utf8");
             chmodSync(join(resourceProjectDir, "docker-compose.yml"), FILE_MODE);
+            if (rwEligibility?.headless === true) {
+                const probePayloadDir = join(resourceProjectDir, ".synopkgland");
+                mkdirSync(probePayloadDir, { recursive: true });
+                writeFileSync(join(probePayloadDir, "README"), HEADLESS_PROBE_README, "utf8");
+                chmodSync(join(probePayloadDir, "README"), FILE_MODE);
+            }
             const routeMarkerDir = join(staging, "package", ".synopkgland");
             mkdirSync(routeMarkerDir, { recursive: true });
             const routeMarker = join(routeMarkerDir, "route");
@@ -307,6 +356,7 @@ function renderPrivilege() {
 }
 const SHARED_FOLDER_MOUNT_CONSENT = "此 App 會用你在這台 NAS 選的資料夾；整顆應用都看得到。Shared Folder Mount 是整個 App Instance 的 container access：能打開這個 App 的使用者，容器裡的程式都看得到該 Share，即使該使用者在 File Station 看不到。這不是逐使用者 DSM ACL。要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
 const HOMES_MOUNT_CONSENT = "此 App 會使用這台 NAS 已啟用的 User Home；整顆應用的容器都看得到，容器路徑由 Compose 決定。這不是逐使用者 DSM ACL；要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
+const POSIX_ALL_SHARES_MAX_WARNING = "掛載這台 NAS 目前列出的每一個共用資料夾。容器內可讀（或讀寫，依 Compose 模式）所有這些資料夾的檔案。安裝後新建的共用資料夾不會自動加入。由管理員決定是否安裝。";
 const DSM_USER_RUN_AS_CONSENT = "寫進 Share 的新檔在 File Station 顯示為你選的那位 DSM 使用者。點開此 App 的人共用這個磁碟身分，不是逐登入 ACL。";
 const DSM_USER_UPGRADE_CONSENT = "升級時更換 Container Run-as 不會 chown Share 上的舊檔；只有升級後寫入的新檔才會使用新的磁碟身分。";
 const SHARED_FOLDER_RW_UPGRADE_CONSENT = "此版本把 Share 掛載改為讀寫；容器可讀取並寫入你選的 Share，不再是唯讀。";
@@ -387,6 +437,46 @@ function composeUsesOnlyAppSpace(compose) {
     const sources = volumeSources(compose);
     return sources.every((source) => source.startsWith("${SYNOPKG_PKGVAR}") || source.startsWith("${SYNO_APP_SECRETS_DIR}"));
 }
+function injectHeadlessProbeVolume(doc) {
+    const compose = (doc.toJSON() ?? {});
+    const serviceName = Object.keys(compose.services ?? {})[0];
+    if (!serviceName) {
+        return;
+    }
+    const existingVolumes = compose.services?.[serviceName]?.volumes;
+    const volumes = existingVolumes == null
+        ? []
+        : Array.isArray(existingVolumes)
+            ? [...existingVolumes]
+            : [existingVolumes];
+    if (!volumes.some((volume) => volume === HEADLESS_PROBE_VOLUME)) {
+        volumes.push(HEADLESS_PROBE_VOLUME);
+    }
+    doc.setIn(["services", serviceName, "volumes"], volumes);
+}
+function injectPosixAllSharesMarkers(composeContent, contract) {
+    const names = collectInstallParameters(contract)
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name);
+    if (names.length === 0) {
+        return composeContent;
+    }
+    const declared = new Set(names);
+    const lines = composeContent.split("\n");
+    const output = [];
+    for (const line of lines) {
+        const match = line.match(/^(\s*)-\s*["']?\$\{([A-Za-z_][A-Za-z0-9_]*)\}:/);
+        const name = match?.[2];
+        if (match && name && declared.has(name)) {
+            const marker = `# synopkgland:posix_all_shares ${name}`;
+            if (output.at(-1)?.trim() !== marker) {
+                output.push(`${match[1]}${marker}`);
+            }
+        }
+        output.push(line);
+    }
+    return output.join("\n");
+}
 const PRIVILEGE_MAX_WARNING = "此 App 的容器有高權限，接近這台 NAS 的 root、幾乎整台機器。是否安裝由你這位管理員決定。";
 function renderInstallWizard(contract, compose) {
     const items = [];
@@ -493,6 +583,39 @@ function renderInstallWizard(contract, compose) {
             });
             continue;
         }
+        if (param.type === "posix_all_shares") {
+            items.push({
+                type: "textblock",
+                desc: POSIX_ALL_SHARES_MAX_WARNING,
+            });
+            items.push({
+                type: "combobox",
+                multiSelect: true,
+                desc: `POSIX all shares: ${name}`,
+                subitems: [{
+                        key: name,
+                        desc: name,
+                        displayField: "name",
+                        valueField: "name",
+                        multiSelect: true,
+                        editable: false,
+                        forceSelection: true,
+                        autoSelect: false,
+                        mode: "remote",
+                        api_store: {
+                            api: "SYNO.Core.Share",
+                            method: "list",
+                            version: 1,
+                            baseParams: { limit: -1, offset: 0 },
+                            root: "shares",
+                            idProperty: "name",
+                            fields: ["name"],
+                        },
+                        validator: { allowBlank: false },
+                    }],
+            });
+            continue;
+        }
         if (param.type === "dsm_user") {
             items.push({
                 type: "combobox",
@@ -590,6 +713,7 @@ function renderDynamicPreinstMaterializer(contract) {
     const allParams = collectInstallParameters(contract);
     const scalarParams = allParams.filter(({ param }) => param.type === "string" || param.type === "boolean");
     const sharedFolderParams = allParams.filter(({ param }) => param.type === "shared_folder");
+    const posixAllSharesParams = allParams.filter(({ param }) => param.type === "posix_all_shares");
     const dsmUserParam = allParams.find(({ param }) => param.type === "dsm_user");
     const lines = [
         "#!/bin/sh",
@@ -652,12 +776,23 @@ function renderDynamicPreinstMaterializer(contract) {
         "  esac",
         "}",
     ];
-    if (sharedFolderParams.length > 0) {
+    if (sharedFolderParams.length > 0 || posixAllSharesParams.length > 0) {
         lines.push("resolve_shared_folder() {", "  share_name=\"$1\"", "  case \"$share_name\" in", "    */*|*..*) die \"invalid share name $share_name\" ;;", "    '') die \"share name is empty\" ;;", "  esac", "  mounts_file=\"${D54_MOUNTS_FILE:-/proc/mounts}\"", "  if [ ! -r \"$mounts_file\" ] && [ -r \"/etc/mtab\" ]; then", "    mounts_file=\"/etc/mtab\"", "  fi", "  if [ ! -r \"$mounts_file\" ]; then", "    die \"cannot read mount points from $mounts_file\"", "  fi", "  vols=\"$(awk '$2 ~ /^\\/volume[0-9]+$/ {print $2}' \"$mounts_file\" | sort -u)\"", '  if [ -z "$vols" ]; then', "    vols=\"$(awk '{print $2}' \"$mounts_file\" | sort -u)\"", "  fi", "  matched=\"\"", "  count=0", "  for v in $vols; do", "    if [ -d \"$v/$share_name\" ]; then", "      matched=\"$v/$share_name\"", "      count=$((count + 1))", "    fi", "  done", "  if [ \"$count\" -eq 0 ]; then", "    die \"share $share_name not found on any volume\"", "  elif [ \"$count\" -gt 1 ]; then", "    die \"share $share_name matched multiple volumes\"", "  fi", "  printf '%s' \"$matched\"", "}");
     }
+    if (posixAllSharesParams.length > 0) {
+        lines.push("normalize_posix_all_shares() {", "  value=\"$1\"", "  case \"$value\" in", "    \\[*\\]) value=\"$(printf '%s' \"$value\" | sed 's/^[[:space:]]*\\[//; s/\\][[:space:]]*$//; s/\"//g')\" ;;", "  esac", "  printf '%s' \"$value\" | awk -F, '{ for (i = 1; i <= NF; i++) { gsub(/^[ \\t]+|[ \\t]+$/, \"\", $i); if ($i != \"\") print $i } }'", "}", "resolve_posix_all_shares() {", "  raw_list=\"$1\"", "  normalized=\"$(normalize_posix_all_shares \"$raw_list\")\"", "  [ -n \"$normalized\" ] || die \"POSIX_ALL_SHARES_EMPTY\"", "  names=\"\"", "  paths=\"\"", "  count=0", "  while IFS= read -r share_name; do", "    case \"$share_name\" in", "      */*|*..*|@*|'') die \"invalid Share name $share_name\" ;;", "      *[[:cntrl:]]*) die \"invalid Share name $share_name\" ;;", "    esac", "    share_path=\"$(resolve_shared_folder \"$share_name\")\"", "    names=\"${names}${names:+,}${share_name}\"", "    paths=\"${paths}${paths:+,}${share_path}\"", "    count=$((count + 1))", "  done <<EOF", "$normalized", "EOF", "  [ \"$count\" -gt 0 ] || die \"POSIX_ALL_SHARES_EMPTY\"", "  printf '%s\\n%s\\n%s' \"$names\" \"$paths\" \"$count\"", "}", "rewrite_posix_all_shares() {", "  p_name=\"$1\"", "  share_names=\"$2\"", "  share_paths=\"$3\"", "  compose_file=\"$4\"", "  [ -f \"$compose_file\" ] || die \"compose file missing at $compose_file\"", "  [ ! -L \"$compose_file\" ] || die \"compose file is a symlink\"", "  tmp_compose=\"$(mktemp \"${compose_file}.tmp.XXXXXX\")\"", "  awk -v param=\"$p_name\" -v share_names=\"$share_names\" -v share_paths=\"$share_paths\" '", "    BEGIN {", "      name_count = split(share_names, names, \",\")", "      path_count = split(share_paths, paths, \",\")", "      marker = \"# synopkgland:posix_all_shares \" param", "      pending = 0", "      single_quote = sprintf(\"%c\", 39)", "    }", "    {", "      if (index($0, marker) > 0 && $0 ~ /^[ \\t]*# synopkgland:posix_all_shares /) {", "        print $0", "        pending = 1", "        next", "      }", "      if (!pending) { print $0; next }", "      pending = 0", "      line = $0", "      indent = line", "      sub(/[^ \\t].*$/, \"\", indent)", "      entry = line", "      sub(/^[ \\t]*-[ \\t]*/, \"\", entry)", "      if (entry ~ /^\".*\"$/) entry = substr(entry, 2, length(entry) - 2)", "      if (length(entry) >= 2 && substr(entry, 1, 1) == single_quote && substr(entry, length(entry), 1) == single_quote) entry = substr(entry, 2, length(entry) - 2)", "      split(entry, fields, \":\")", "      if (fields[1] != \"${\" param \"}\" || fields[2] == \"\") { print $0; next }", "      mode = \"\"", "      if (length(fields) >= 3) mode = \":\" fields[3]", "      for (i = 1; i <= name_count && i <= path_count; i++) {", "        print indent \"- \" paths[i] \":\" fields[2] \"/\" names[i] mode", "      }", "    }", "  ' \"$compose_file\" > \"$tmp_compose\" || die \"failed to expand POSIX all-shares in $compose_file\"", "  mv \"$tmp_compose\" \"$compose_file\" || die \"failed to replace $compose_file\"", "}");
+    }
     if (dsmUserParam) {
         lines.push("resolve_dsm_user() {", "  user_name=\"$1\"", "  case \"$user_name\" in", "    */*|*..*|*[[:cntrl:]]*) die \"invalid user name $user_name\" ;;", "    '') die \"user name is empty\" ;;", "  esac", "  u_uid=\"$(id -u -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_uid\" in", "    ''|*[!0-9]*) die \"resolved uid for $user_name is not a valid integer\" ;;", "    0) die \"resolved uid for $user_name cannot be 0 (root)\" ;;", "  esac", "  u_gid=\"$(id -g -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_gid\" in", "    ''|*[!0-9]*) die \"resolved gid for $user_name is not a valid integer\" ;;", "  esac", "  # id -G returns all group ids including primary", "  raw_groups=\"$(id -G -- \"$user_name\" 2>/dev/null || true)\"", "  # filter out primary gid, deduplicate, keep numeric only", "  supp_groups=\"\"", "  for g in $raw_groups; do", "    case \"$g\" in", "      ''|*[!0-9]*) continue ;;", "    esac", "    if [ \"$g\" != \"$u_gid\" ]; then", "      already=0", "      for sg in $supp_groups; do", "        if [ \"$sg\" = \"$g\" ]; then", "          already=1", "          break", "        fi", "      done", "      if [ \"$already\" -eq 0 ]; then", "        supp_groups=\"${supp_groups}${supp_groups:+ }$g\"", "      fi", "    fi", "  done", "  printf '%s %s %s' \"$u_uid\" \"$u_gid\" \"$supp_groups\"", "}", "rewrite_group_add() {", "  p_name=\"$1\"", "  g_list=\"$2\"", "  compose_file=\"$3\"", "  [ -f \"$compose_file\" ] || die \"compose file missing at $compose_file\"", "  [ ! -L \"$compose_file\" ] || die \"compose file is a symlink\"", "  tmp_compose=\"$(mktemp \"${compose_file}.tmp.XXXXXX\")\"", "  awk -v param=\"$p_name\" -v g_list=\"$g_list\" '", "    BEGIN {", "      n = split(g_list, g_arr, \" \")", "    }", "    {", "      regex = \"^[ \\t]*# synopkgland:group_add \" param \"$\"", "      if ($0 ~ regex) {", "        match($0, /^[ \\t]*/)", "        indent = substr($0, RSTART, RLENGTH)", "        if (n > 0) {", "          print indent \"group_add:\"", "          for (i = 1; i <= n; i++) {", "            print indent \"  - ${\" param \"_GROUP_\" i \"}\"", "          }", "        }", "      } else {", "        print $0", "      }", "    }", "  ' \"$compose_file\" > \"$tmp_compose\" || die \"failed to rewrite group_add in $compose_file\"", "  mv \"$tmp_compose\" \"$compose_file\" || die \"failed to replace $compose_file\"", "}");
     }
+    if (hasOidcCompat(contract)) {
+        const identity = contract.integration?.identity;
+        const redirectPath = identity?.oidc_compat?.redirect_path ?? "";
+        const adminProtocol = contract.adminprotocol ?? "http";
+        const adminPort = Number(contract.adminport ?? 0);
+        const escapedRedirectPath = redirectPath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        lines.push("oidc_register() {", "  # DSM compose does not create missing bind sources: the secrets dir must exist even when compat is off.", "  (umask 077 && mkdir -p \"$PROJECT/secrets\" && chmod 700 \"$PROJECT/secrets\") || die \"failed to create $PROJECT/secrets\"", "  OIDC_ISSUER=\"\"", "  OIDC_ISSUER_HOST=\"oidc.invalid\"", "  OIDC_CLIENT_ID=\"\"", "  OIDC_CLIENT_SECRET=\"\"", "  identity_file=\"${SYNOPKGLAND_IDENTITY_FILE:-/var/packages/SynoPkgLandService/var/identity.json}\"", "  if [ ! -r \"$identity_file\" ]; then", "    identity_file=\"/volume1/@appdata/SynoPkgLandService/identity.json\"", "  fi", "  if [ ! -r \"$identity_file\" ]; then", "    # Identity endpoint not found -> Broker not installed -> skip as 404", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  base_url=\"$(python3 -c 'import json, sys; data=json.load(open(sys.argv[1])); print(data.get(\"baseUrl\", \"\"))' \"$identity_file\" 2>/dev/null || true)\"", "  if [ -z \"$base_url\" ]; then", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  attestation_file=\"$T/.synopkgland/attestation.jwt\"", "  if [ ! -f \"$attestation_file\" ]; then", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  attestation_token=\"$(cat \"$attestation_file\")\"", "  phase=\"install\"", "  case \"$STATUS\" in", "    UPGRADE) phase=\"upgrade\" ;;", "    *) phase=\"install\" ;;", "  esac", "  req_body=\"$(python3 -c 'import json, sys; print(json.dumps({\"protocolVersion\": 1, \"attestation\": sys.argv[1], \"packageIdentity\": sys.argv[2], \"packageVersion\": sys.argv[3], \"redirectPath\": sys.argv[4], \"adminProtocol\": sys.argv[5], \"adminPort\": int(sys.argv[6]), \"phase\": sys.argv[7]}))' \"$attestation_token\" \"${SYNOPKG_PKGNAME:?}\" \"${SYNOPKG_PKGVER:?}\" \"" + escapedRedirectPath + "\" \"" + String(adminProtocol) + "\" \"" + String(adminPort) + "\" \"$phase\")\"", "  resp_file=\"$(mktemp \"$T/oidc_resp.XXXXXX\")\"", "  http_code=\"$(curl -s -S --connect-timeout 5 --max-time 30 -o \"$resp_file\" -w '%{http_code}' -X POST -H 'Content-Type: application/json' --data-binary \"$req_body\" \"${base_url}/internal/v1/oidc/register\" 2>/dev/null || true)\"", "  case \"$http_code\" in [0-9][0-9][0-9]) ;; *) http_code=\"000\" ;; esac", "  if [ \"$http_code\" = \"200\" ]; then", "    parsed_res=\"$(python3 -c 'import json, sys; d=json.load(open(sys.argv[1])); print(d.get(\"issuer\", \"\")); print(d.get(\"issuerHost\", \"\")); print(d.get(\"clientId\", \"\")); print(d.get(\"clientSecret\", \"\"))' \"$resp_file\" 2>/dev/null || true)\"", "    rm -f \"$resp_file\"", "    OIDC_ISSUER=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '1p')\"", "    OIDC_ISSUER_HOST=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '2p')\"", "    OIDC_CLIENT_ID=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '3p')\"", "    OIDC_CLIENT_SECRET=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '4p')\"", "    (umask 077 && mkdir -p \"$PROJECT/secrets\" && printf '%s' \"$OIDC_CLIENT_SECRET\" > \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\")", "  elif [ \"$http_code\" = \"404\" ] || [ \"$http_code\" = \"000\" ]; then", "    rm -f \"$resp_file\"", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    OIDC_ISSUER=\"\"", "    OIDC_ISSUER_HOST=\"oidc.invalid\"", "    OIDC_CLIENT_ID=\"\"", "  else", "    rm -f \"$resp_file\"", "    die \"OIDC_REGISTER_FAILED $http_code\"", "  fi", "}", "oidc_register");
+    }
     lines.push('tmp="$(mktemp "$PROJECT/.env.tmp.XXXXXX")"', 'chmod 600 "$tmp"', '[ "$(stat -c %a "$tmp")" = "600" ] || die "temporary env mode is not 0600"', '[ "$(stat -c %u "$tmp")" = "$(id -u)" ] || die "temporary env owner is not the package user"', "trap 'rm -f \"$tmp\"' EXIT HUP INT TERM", "{");
     const valueVars = [];
     for (const { name, param } of scalarParams) {
@@ -680,19 +815,37 @@ function renderDynamicPreinstMaterializer(contract) {
         lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
             `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required shared folder parameter ${name}"`, "  fi", `  case "$${rawVar}" in`, "    /*) " + pathVar + "=\"$" + rawVar + "\" ;;", "    *) " + pathVar + "=\"$(resolve_shared_folder \"$" + rawVar + "\")\" ;;", "  esac");
     }
+    const posixVars = [];
+    for (const { name } of posixAllSharesParams) {
+        const rawVar = "D54_RAW_POSIX_" + name;
+        const namesVar = "D54_POSIX_NAMES_" + name;
+        const pathsVar = "D54_POSIX_PATHS_" + name;
+        const countVar = "D54_POSIX_COUNT_" + name;
+        posixVars.push({ name, namesVar, pathsVar, countVar });
+        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required POSIX all-shares parameter ${name}"`, "  fi", `  posix_info="$(resolve_posix_all_shares "$${rawVar}")"`, `  ${namesVar}="$(printf '%s\\n' "$posix_info" | sed -n '1p')"`, `  ${pathsVar}="$(printf '%s\\n' "$posix_info" | sed -n '2p')"`, `  ${countVar}="$(printf '%s\\n' "$posix_info" | sed -n '3p')"`, `  rewrite_posix_all_shares "${name}" "$${namesVar}" "$${pathsVar}" "$PROJECT/docker-compose.yml"`);
+    }
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;
         lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawUserVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
             `${rawUserVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required dsm user parameter ${name}"`, "  fi", `  resolved_user_info="$(resolve_dsm_user "$${rawUserVar}")"`, "  set -- $resolved_user_info", `  ${name}_UID="$1"`, `  ${name}_GID="$2"`, "  shift 2 || true", `  ${name}_GROUPS="$*"`, `  rewrite_group_add "${name}" "$${name}_GROUPS" "$PROJECT/docker-compose.yml"`);
     }
-    lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "$PLATFORM_SECRETS"');
+    if (hasOidcCompat(contract)) {
+        lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "${SYNOPKG_PKGDEST_VOL:?}/@appstore/${SYNOPKG_PKGNAME:?}/compose/secrets"', '  append_env "SYNOPKGLAND_OIDC_ISSUER" "$OIDC_ISSUER"', '  append_env "SYNOPKGLAND_OIDC_ISSUER_HOST" "$OIDC_ISSUER_HOST"', '  append_env "SYNOPKGLAND_OIDC_CLIENT_ID" "$OIDC_CLIENT_ID"');
+    }
+    else {
+        lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "$PLATFORM_SECRETS"');
+    }
     for (const { name, valueVar, type } of valueVars) {
         lines.push(`  append_env "${name}" "$${valueVar}" "${type}"`);
     }
     for (const { name, pathVar } of shareVars) {
         lines.push(`  append_env "${name}" "$${pathVar}" "string"`);
     }
+    for (const { name, namesVar, countVar } of posixVars) {
+        lines.push(`  append_env "${name}" "$${namesVar}" "string"`, `  append_env "${name}_COUNT" "$${countVar}" "string"`);
+    }
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;

package/dist/build-spk/resource-worker.js

@@ -79,44 +79,29 @@ export function renderResourceConfig(contract, eligibility) {
  */
 export function renderResourceWorkerStartStopStatus(packageId, adminport, headless = false) {
     if (headless) {
-        const projectName = composeProjectName(packageId);
         return `#!/bin/sh
-PKGVAR="\${SYNOPKG_PKGVAR:-/var/packages/${packageId}/var}"
-MARKER="$PKGVAR/.docker-project-managed"
-PROJECT_NAME="${projectName}"
+SYNOPKG_PKGNAME="\${SYNOPKG_PKGNAME:-${packageId}}"
+SYNOPKGLAND_PROC_ROOT="\${SYNOPKGLAND_PROC_ROOT:-/proc}"
 
-project_containers_running() {
-  command -v docker >/dev/null 2>&1 || return 2
-  containers="$(docker ps -aq --filter "label=com.docker.compose.project=$PROJECT_NAME" 2>/dev/null)" || return 2
-  [ -n "$containers" ] || return 1
-  for container in $containers; do
-    state="$(docker inspect --format '{{.State.Running}}' "$container" 2>/dev/null)" || return 2
-    [ "$state" = "true" ] || return 1
+probe_project_process() {
+  for p in "$SYNOPKGLAND_PROC_ROOT"/[0-9]*; do
+    [ -d "$p" ] || continue
+    if grep -q docker "$p/cgroup" 2>/dev/null &&
+      grep -q \\
+        "@appstore/\${SYNOPKG_PKGNAME}/compose/" \\
+        "$p/mountinfo" 2>/dev/null; then
+      return 0
+    fi
   done
-  return 0
-}
-
-marker_managed() {
-  [ -f "$MARKER" ] || return 1
-  [ ! -L "$MARKER" ] || return 1
-  [ "$(cat "$MARKER" 2>/dev/null || true)" = "managed" ]
+  return 1
 }
 
 case "$1" in
-  start|status)
-    project_containers_running
-    probe_status=$?
-    if [ "$probe_status" -eq 0 ]; then
-      exit 0
-    fi
-    # Package user may not have a usable Docker inspection path. DSM owns the
-    # docker-project lifecycle; the postinst marker records that ownership.
-    if [ "$probe_status" -eq 2 ] && marker_managed; then
-      exit 0
-    fi
-    exit 3
+  start|stop) exit 0 ;;
+  status)
+    probe_project_process
+    exit $?
     ;;
-  stop) exit 0 ;;
   *) exit 1 ;;
 esac
 `;

package/dist/compose/analyze.d.ts

@@ -57,6 +57,7 @@ export declare function validateComposeNumericCommandArgs(compose: ComposeDocume
 export interface HostBindContext {
     sharedFolderParams: ReadonlySet<string>;
     homesParams?: ReadonlySet<string>;
+    posixAllSharesParams?: ReadonlySet<string>;
     installParamNames: ReadonlySet<string>;
 }
 export declare function collectVolumeSourceInterpolations(compose: ComposeDocument): Set<string>;

package/dist/compose/analyze.js

@@ -190,6 +190,7 @@ const HEADLESS_PACKAGE_ONLY_PARAMETER_TYPES = new Set([
     "boolean",
     "shared_folder",
     "dsm_user",
+    "posix_all_shares",
 ]);
 /**
  * Chooses the local route D0 can safely emit. The first dynamic slice is
@@ -227,10 +228,10 @@ export function classifyComposeRoute(contract, parsed, composeFile = "compose.ya
     // Keep the route decision in one place. build-spk must not independently
     // reinterpret an ineligible Compose as D1: only a route with a resolved
     // published adminport or an eligible headless Compose, plus at least one
-    // declared install parameter, has a package-only materializer. Every other
-    // buildable fallback is Broker.
+    // declared install parameter (or oidc_compat declaration), has a package-only materializer.
+    // Every other buildable fallback is Broker.
     if ((eligibility.adminport !== undefined || headlessPackageOnly) &&
-        collectInstallParameters(contract).length > 0) {
+        (collectInstallParameters(contract).length > 0 || hasBrokerManagedOidc(contract))) {
         return { route: "dynamic", eligibility, errors: [] };
     }
     return { route: "broker-installer", eligibility, errors: [] };
@@ -252,10 +253,14 @@ function collectRouteRejectErrors(contract, parsed, composeFile) {
     const installParams = collectInstallParameters(contract);
     const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
     const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
+    const posixAllSharesParams = new Set(installParams
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name));
     const installParamNames = new Set(installParams.map(({ name }) => name));
     errors.push(...validateComposeHostBinds(compose, composeFile, {
         sharedFolderParams,
         homesParams,
+        posixAllSharesParams,
         installParamNames,
     }));
     return dedupeValidationErrors(errors);
@@ -296,7 +301,8 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
         (param.type === "string" ||
             param.type === "boolean" ||
             param.type === "shared_folder" ||
-            param.type === "dsm_user"))
+            param.type === "dsm_user" ||
+            param.type === "posix_all_shares"))
         .map(({ name }) => name));
     const dsmUserParam = params.find(({ param }) => param.type === "dsm_user");
     const dsmUserDerivedNames = dsmUserParam
@@ -310,8 +316,9 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
         (param.type !== "string" &&
             param.type !== "boolean" &&
             param.type !== "shared_folder" &&
-            param.type !== "dsm_user"));
-    const brokerOidcInterpolationNames = params.length === 0 && hasBrokerManagedOidc(contract)
+            param.type !== "dsm_user" &&
+            param.type !== "posix_all_shares"));
+    const brokerOidcInterpolationNames = hasBrokerManagedOidc(contract)
         ? BROKER_OIDC_INTERPOLATION_VARS
         : [];
     const supportedInterpolationNames = new Set([
@@ -614,6 +621,7 @@ const PLATFORM_BIND_VARS = new Set(["SYNOPKG_PKGVAR", "SYNO_APP_SECRETS_DIR"]);
 const BROKER_OIDC_INTERPOLATION_VARS = new Set([
     "SYNOPKGLAND_OIDC_ISSUER",
     "SYNOPKGLAND_OIDC_CLIENT_ID",
+    "SYNOPKGLAND_OIDC_ISSUER_HOST",
 ]);
 function hasBrokerManagedOidc(contract) {
     if (!contract.integration || typeof contract.integration !== "object") {
@@ -725,7 +733,8 @@ function classifyVolumeSource(compose, mount, namedVolumes, context, composeFile
         }
         if (PLATFORM_BIND_VARS.has(varName) ||
             context.sharedFolderParams.has(varName) ||
-            context.homesParams?.has(varName)) {
+            context.homesParams?.has(varName) ||
+            context.posixAllSharesParams?.has(varName)) {
             return null;
         }
         if (context.installParamNames.has(varName)) {

package/dist/contract/posix-all-shares.js

@@ -39,12 +39,12 @@ export function validatePosixAllSharesSources(compose, composeFile, declaredPara
             const path = `services.${serviceName}.volumes.${index}`;
             if (declaredParameters.has(name)) {
                 if (suffix !== "") {
-                    errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN", composeSpan(composeFile, 1, 1, path), `POSIX all-shares 參數「${name}」只能作為完整 volume source，不能附加子路徑。`, `請將 ${source} 改成 \${${name}}，並保留 Compose 的 container target；Share 名稱由 Broker 在安裝時展開。`));
+                    errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN", composeSpan(composeFile, 1, 1, path), `POSIX all-shares 參數「${name}」只能作為完整 volume source，不能附加子路徑。`, `請將 ${source} 改成 \${${name}}，並保留 Compose 的 container target；Share 名稱由 package-only preinst 在安裝時展開。`));
                 }
                 continue;
             }
             if (RESERVED_MARKER_NAMES.has(name)) {
-                errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_UNDECLARED", composeSpan(composeFile, 1, 1, path), `Compose 使用了未宣告的 POSIX all-shares marker「${name}」。`, `請在 synology-app.yaml 宣告 install.${name}.type: ${POSIX_ALL_SHARES_TYPE}，並讓 Broker 以 DSM API 列出安裝當下的 Share。`));
+                errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_UNDECLARED", composeSpan(composeFile, 1, 1, path), `Compose 使用了未宣告的 POSIX all-shares marker「${name}」。`, `請在 synology-app.yaml 宣告 install.${name}.type: ${POSIX_ALL_SHARES_TYPE}，並讓 wizard／CLI 取得安裝當下的 Share 清單。`));
             }
         }
     }

package/dist/contract/schema-validate.js

@@ -30,7 +30,7 @@ function mapSchemaError(error, contractFile, parsed) {
 }
 export function validateContractSchema(parsed, contractFile) {
     const validate = getValidator();
-    const data = schemaCompatibleContract(parsed.doc.toJSON());
+    const data = parsed.doc.toJSON();
     const valid = validate(data);
     if (valid) {
         return [];
@@ -48,28 +48,3 @@ export function validateContractSchema(parsed, contractFile) {
     }
     return result;
 }
-/**
- * Keep the published v1 schema's historical enum stable for older tooling,
- * while allowing the P4 contract extension to be validated by the same v1
- * object shape. The semantic validator and Broker retain the raw type.
- */
-function schemaCompatibleContract(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return value;
-    }
-    const contract = value;
-    const install = contract.install;
-    if (!install || typeof install !== "object" || Array.isArray(install)) {
-        return value;
-    }
-    for (const parameter of Object.values(install)) {
-        if (!parameter || typeof parameter !== "object" || Array.isArray(parameter)) {
-            continue;
-        }
-        const record = parameter;
-        if (record.type === "posix_all_shares") {
-            record.type = "homes";
-        }
-    }
-    return value;
-}

package/dist/contract/validate.js

@@ -51,16 +51,6 @@ export function validateContract(parsed, contractFile) {
     errors.push(...validateInstallParameters(parsed, contractFile));
     errors.push(...validatePosixAllShares(parsed, contractFile));
     errors.push(...validateWebLaunch(parsed, contractFile));
-    // The P4 worker cannot edit the shared host-bind analyzer. Its existing
-    // platform-resolved `homes` slot has the same analyzer semantics (declared
-    // interpolation is an allowed source and must be used). This normalization
-    // is local to the validation object; Broker and SPK generation read the raw
-    // YAML again and retain the actual posix_all_shares type.
-    for (const parameter of Object.values(contract.install ?? {})) {
-        if (parameter && isPosixAllSharesType(parameter.type)) {
-            parameter.type = "homes";
-        }
-    }
     return errors;
 }
 function validatePosixAllShares(parsed, contractFile) {

package/dist/deploy/deploy.js

@@ -13,6 +13,7 @@ import { homesParameterNames, resolveHomesExtraValues } from "./homes-values.js"
 import { resolveInstallParameterExtraValues } from "./param-values.js";
 import { CURATED_BUILD_OFFSET } from "@synopackageland/package-source/index-manifest";
 const CURATED_DEPLOY_REFUSED_MESSAGE = "此 NAS 已持有 Curated App Package Attestation。請改用 --dev，或使用 --replace-curated 明確降級。";
+const POSIX_ALL_SHARES_LOOKUP_FAILED = "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED";
 function brokerCapabilitiesFromContract(project) {
     const contract = loadContract(project.contractPath).contract;
     const capabilities = ["identity"];
@@ -67,9 +68,34 @@ export async function deployProject(options) {
         return { ok: false, code: "CURATED_DEPLOY_REFUSED", message: CURATED_DEPLOY_REFUSED_MESSAGE };
     }
     const contract = loadContract(options.project.contractPath).contract;
+    const paramValues = { ...(options.paramValues ?? {}) };
+    const posixAllSharesNames = Object.entries(contract.install ?? {})
+        .filter(([, parameter]) => parameter?.type === "posix_all_shares")
+        .map(([name]) => name);
+    for (const name of posixAllSharesNames) {
+        if (Object.prototype.hasOwnProperty.call(paramValues, name)) {
+            continue;
+        }
+        let shareNames;
+        try {
+            shareNames = await options.host.listShareNames?.();
+        }
+        catch {
+            shareNames = undefined;
+        }
+        const names = (shareNames ?? []).map((value) => value.trim()).filter(Boolean);
+        if (names.length === 0) {
+            return {
+                ok: false,
+                code: POSIX_ALL_SHARES_LOOKUP_FAILED,
+                message: `無法用管理員 session 列出這台 NAS 的 Shared Folder，無法填入 POSIX all-shares 參數「${name}」。`,
+            };
+        }
+        paramValues[name] = names.join(",");
+    }
     const paramResolved = resolveInstallParameterExtraValues({
         contract,
-        provided: options.paramValues,
+        provided: paramValues,
     });
     if (!paramResolved.ok) {
         return { ok: false, code: paramResolved.code, message: paramResolved.message };
@@ -129,8 +155,9 @@ export async function deployProject(options) {
             }
         }
     }
+    let attestationResult;
     try {
-        await options.host.requestAttestation({
+        attestationResult = await options.host.requestAttestation({
             packageIdentity: identity.packageId,
             contractDigest,
             bundleDigest,
@@ -185,6 +212,7 @@ export async function deployProject(options) {
         displayname: identity.displayname,
         spkVersion,
         archFamily,
+        embeddedAttestationToken: attestationResult.token,
     });
     if (!build.ok || !build.outputPath) {
         return { ok: false, code: "BUILD_SPK_FAILED", message: build.errors.join(", ") };

package/dist/deploy/param-values.js

@@ -1,4 +1,5 @@
 import { collectInstallParameters, stringViolations } from "../contract/load.js";
+import { isPosixAllSharesType } from "../contract/posix-all-shares.js";
 /**
  * Validate the local, non-secret values accepted by `deploy --param`.
  *
@@ -30,7 +31,7 @@ export function resolveInstallParameterExtraValues(input) {
             extraValues[name] = raw;
             continue;
         }
-        if (param.type !== "string") {
+        if (param.type !== "string" && !isPosixAllSharesType(param.type)) {
             return {
                 ok: false,
                 code: "DEPLOY_PARAM_TYPE_INVALID",

package/dist/doctor.js

@@ -212,6 +212,11 @@ export async function runDoctor(options) {
                 message: "未指定 --host，略過 Trusted App Entry 檢查",
             });
         }
+        checks.push({
+            id: "host.oidc_origin",
+            status: "skip",
+            message: "未指定 --host，略過 OIDC origin 檢查",
+        });
     }
     else {
         const host = options.host;
@@ -253,6 +258,11 @@ export async function runDoctor(options) {
                 status: "skip",
                 message: "NAS 無法連線，略過 Attestation Trust Root 檢查",
             });
+            checks.push({
+                id: "host.oidc_origin",
+                status: "skip",
+                message: "NAS 無法連線，略過 OIDC origin 檢查",
+            });
             if (options.packageId) {
                 checks.push({
                     id: "host.package_binding",
@@ -395,6 +405,50 @@ export async function runDoctor(options) {
                     }
                 }
             }
+            // Check 2.3a: OIDC-compatible public origin. This is deliberately
+            // optional so a pre-A39 Broker remains a usable doctor target.
+            if (!isBrokerReady || !host.getOidcCompatSettings) {
+                checks.push({
+                    id: "host.oidc_origin",
+                    status: "skip",
+                    message: !isBrokerReady
+                        ? "Broker 未就緒，略過 OIDC origin 檢查"
+                        : "舊版 Broker 沒有 OIDC origin endpoint，略過",
+                });
+            }
+            else {
+                try {
+                    const oidc = await host.getOidcCompatSettings();
+                    if (!oidc) {
+                        checks.push({
+                            id: "host.oidc_origin",
+                            status: "skip",
+                            message: "舊版 Broker 沒有 OIDC origin endpoint，略過",
+                        });
+                    }
+                    else if (oidc.origin.ready && oidc.origin.hostname) {
+                        checks.push({
+                            id: "host.oidc_origin",
+                            status: "pass",
+                            message: `${oidc.origin.kind} ${oidc.origin.hostname}`,
+                        });
+                    }
+                    else {
+                        checks.push({
+                            id: "host.oidc_origin",
+                            status: "skip",
+                            message: `未就緒（${oidc.origin.kind}）：${oidc.origin.setupHint}`,
+                        });
+                    }
+                }
+                catch {
+                    checks.push({
+                        id: "host.oidc_origin",
+                        status: "skip",
+                        message: "OIDC origin endpoint 無法取得，略過",
+                    });
+                }
+            }
             // Check 2.3b: DSM Residue check (A29)
             if (isBrokerReady && host.getDsmDiagnostics) {
                 try {

package/dist/error-registry.js

@@ -83,7 +83,7 @@ export const ERROR_REGISTRY = {
     CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN: {
         code: "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN",
         description: "POSIX all-shares 參數不得在契約中指定 default 或 NAS 實體路徑。",
-        suggestion: "請只宣告 type: posix_all_shares，讓 Broker 在安裝時用 DSM API 建立 Share snapshot。",
+        suggestion: "請只宣告 type: posix_all_shares，讓 wizard／CLI 在安裝時取得當下的 Share snapshot。",
     },
     DSM_USER_REQUIRED: {
         code: "DSM_USER_REQUIRED",
@@ -149,12 +149,12 @@ export const ERROR_REGISTRY = {
     COMPOSE_POSIX_ALL_SHARES_UNDECLARED: {
         code: "COMPOSE_POSIX_ALL_SHARES_UNDECLARED",
         description: "Compose 使用了未宣告的 POSIX all-shares marker。",
-        suggestion: "請宣告 type: posix_all_shares，讓 Broker 透過 DSM API 建立安裝當下的 Share snapshot。",
+        suggestion: "請宣告 type: posix_all_shares，讓 package-only wizard／CLI 取得安裝當下的 Share snapshot。",
     },
     COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN: {
         code: "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN",
         description: "POSIX all-shares marker 不得附加 Share 子路徑。",
-        suggestion: "請只使用完整的 ${ALL_SHARES} source；每個 Share 的 container target 由 Broker 展開。",
+        suggestion: "請只使用完整的 ${ALL_SHARES} source；每個 Share 的 container target 由 package-only preinst 展開。",
     },
     COMPOSE_HOST_BIND_FORBIDDEN: {
         code: "COMPOSE_HOST_BIND_FORBIDDEN",
@@ -529,6 +529,11 @@ export const ERROR_REGISTRY = {
         description: "deploy --param 的值不符合契約宣告的 string 或 boolean 型別。",
         suggestion: "string 請傳非空字串；boolean 請只傳 true 或 false。",
     },
+    DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED: {
+        code: "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED",
+        description: "無法以管理員 session 列出部署當下的 Shared Folder 清單。",
+        suggestion: "請確認 DSM 管理員 session 可呼叫 SYNO.Core.Share list，或用 --param NAME=... 明確提供清單。",
+    },
     DSM_DEPENDENCY_CONFLICT: {
         code: "DSM_DEPENDENCY_CONFLICT",
         description: "DSM 複合安裝請求因執行中的依賴套件而拒絕。",

package/dist/host/dsm-client.js

@@ -4,10 +4,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { IDENTITY_CGI_PATH } from "./broker-paths.js";
 import { packageSourceOrigin } from "../deploy/catalog-publish.js";
-import { lookupSharePathWithSynoagentcli } from "./share-lookup.js";
+import { listShareNamesWithSynoagentcli, lookupSharePathWithSynoagentcli } from "./share-lookup.js";
 import { dsmFetch } from "./dsm-http.js";
 import { installPackageFromCatalog, installPackageFromLocalSpk, uninstallPackageFromDsm, fetchInstalledPackageState, packageStateFromRecord, } from "./catalog-install.js";
 import { resolveHostCredentials } from "./credentials.js";
+const OIDC_COMPAT_PATH = "/api/v1/inner-loop/oidc-compat";
 export function createNasHost(options = {}) {
     const credentials = options.credentials ?? resolveHostCredentials(options.host);
     if (!credentials) {
@@ -160,7 +161,12 @@ function createDsmNasHost(credentials, profileName) {
                 error.code = body.error?.code;
                 throw error;
             }
-            return { kind: "local", attestationDigest: body.attestationDigest ?? "" };
+            const token = typeof body.token === "string" && body.token.length > 0 ? body.token : undefined;
+            return {
+                kind: "local",
+                attestationDigest: body.attestationDigest ?? "",
+                ...(token !== undefined ? { token } : {}),
+            };
         },
         async ensurePackageSource(origin) {
             ensurePackageSourceFeed(origin);
@@ -225,6 +231,9 @@ function createDsmNasHost(credentials, profileName) {
         async resolveSharePath(logicalName) {
             return lookupSharePathWithSynoagentcli(logicalName, profileName);
         },
+        async listShareNames() {
+            return listShareNamesWithSynoagentcli(profileName);
+        },
         async resolveHomesPath() {
             try {
                 const result = synoagentcli(["dsm", "control-panel", "user-group", "advanced", "get", "--section", "home"], profileName);
@@ -343,6 +352,51 @@ function createDsmNasHost(credentials, profileName) {
                 return undefined;
             }
         },
+        async getOidcCompatSettings() {
+            try {
+                await ensureLogin();
+                const response = await dsmFetch(`${brokerBaseUrl}${OIDC_COMPAT_PATH}`, {
+                    headers: { cookie: cookieHeader ?? "" },
+                });
+                const text = await response.text();
+                if (response.status === 404 || text.trimStart().startsWith("<")) {
+                    return undefined;
+                }
+                if (!response.ok) {
+                    return undefined;
+                }
+                const payload = JSON.parse(text);
+                const settings = payload.settings;
+                if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+                    return undefined;
+                }
+                const record = settings;
+                const origin = record.origin;
+                if (!origin || typeof origin !== "object" || Array.isArray(origin)) {
+                    return undefined;
+                }
+                const originRecord = origin;
+                if (typeof record.enabled !== "boolean" ||
+                    typeof originRecord.ready !== "boolean" ||
+                    typeof originRecord.kind !== "string" ||
+                    typeof originRecord.setupHint !== "string") {
+                    return undefined;
+                }
+                return {
+                    enabled: record.enabled,
+                    origin: {
+                        ready: originRecord.ready,
+                        kind: originRecord.kind,
+                        hostname: typeof originRecord.hostname === "string" ? originRecord.hostname : undefined,
+                        issuerUrl: typeof originRecord.issuerUrl === "string" ? originRecord.issuerUrl : undefined,
+                        setupHint: originRecord.setupHint,
+                    },
+                };
+            }
+            catch {
+                return undefined;
+            }
+        },
         async smokeRequireLogin(input) {
             await ensureLogin();
             const info = await this.getAttestationInfo(input.packageIdentity);

package/dist/host/fake-nas.d.ts

@@ -1,9 +1,10 @@
-import type { AttestationKind, HostInstallRecord, NasHost, PackageRoute } from "./types.js";
+import type { AttestationKind, HostInstallRecord, HostOidcCompatSettings, NasHost, PackageRoute } from "./types.js";
 export interface FakeNasHostOptions {
     curated?: string[];
     dsmOrigin?: string;
     homesPath?: string;
     installationId?: string;
+    shareNames?: string[];
     shares?: Record<string, string>;
     installedEnv?: Record<string, Record<string, string>>;
     diagnostics?: {
@@ -12,6 +13,8 @@ export interface FakeNasHostOptions {
         isPackageOnly?: boolean;
         [key: string]: unknown;
     };
+    /** Omit to model an older Broker without the OIDC settings endpoint. */
+    oidcCompat?: HostOidcCompatSettings;
 }
 export declare function createFakeNasHost(options?: FakeNasHostOptions): NasHost & {
     installs: HostInstallRecord[];

package/dist/host/fake-nas.js

@@ -8,6 +8,11 @@ export function createFakeNasHost(options = {}) {
     const installed = new Set();
     const openUrls = new Map();
     const shares = { ...(options.shares ?? {}) };
+    const shareNames = options.shareNames
+        ? [...options.shareNames]
+        : Object.keys(shares).length > 0
+            ? Object.keys(shares)
+            : ["docker", "home", "photo"];
     const installedEnv = Object.fromEntries(Object.entries(options.installedEnv ?? {}).map(([packageId, env]) => [packageId, { ...env }]));
     const host = {
         dsmOrigin,
@@ -24,6 +29,9 @@ export function createFakeNasHost(options = {}) {
         async resolveSharePath(logicalName) {
             return shares[logicalName];
         },
+        async listShareNames() {
+            return [...shareNames];
+        },
         async resolveHomesPath() {
             return options.homesPath;
         },
@@ -49,7 +57,11 @@ export function createFakeNasHost(options = {}) {
             }
             const digest = `${input.packageIdentity}:${input.bundleDigest}:${input.contractDigest}`;
             host.attestations.add(input.packageIdentity);
-            return { kind: "local", attestationDigest: digest };
+            return {
+                kind: "local",
+                attestationDigest: digest,
+                token: `fake-local-attestation.${input.packageIdentity}`,
+            };
         },
         async ensurePackageSource() { },
         async installFromCatalog(input) {
@@ -111,6 +123,15 @@ export function createFakeNasHost(options = {}) {
         async getDsmDiagnostics() {
             return options.diagnostics;
         },
+        async getOidcCompatSettings() {
+            if (!options.oidcCompat) {
+                return undefined;
+            }
+            return {
+                enabled: options.oidcCompat.enabled,
+                origin: { ...options.oidcCompat.origin },
+            };
+        },
         async smokeRequireLogin() {
             return { ok: true, username: "admin" };
         },

package/dist/host/share-lookup.d.ts

@@ -1,3 +1,5 @@
 export declare function shareRealPathFromEntry(entry: Record<string, unknown>, logicalName: string): string | undefined;
 export declare function findShareRealPath(payload: unknown, logicalName: string): string | undefined;
+export declare function findShareNames(payload: unknown): string[];
 export declare function lookupSharePathWithSynoagentcli(logicalName: string, profileName?: string): string | undefined;
+export declare function listShareNamesWithSynoagentcli(profileName?: string): string[];

package/dist/host/share-lookup.js

@@ -59,6 +59,16 @@ export function findShareRealPath(payload, logicalName) {
     }
     return undefined;
 }
+export function findShareNames(payload) {
+    const names = new Set();
+    for (const record of collectRecords(payload)) {
+        const name = record.name ?? record.share_name;
+        if (typeof name === "string" && name.trim() !== "") {
+            names.add(name.trim());
+        }
+    }
+    return [...names];
+}
 function synoagentcli(args, profileName) {
     const fullArgs = [...args];
     if (profileName) {
@@ -142,3 +152,10 @@ export function lookupSharePathWithSynoagentcli(logicalName, profileName) {
     }
     return lookupSharePathWithDsmHttp(logicalName, profileName);
 }
+export function listShareNamesWithSynoagentcli(profileName) {
+    const list = synoagentcli(["dsm", "control-panel", "shared-folder", "list"], profileName);
+    if (list.status !== 0) {
+        return [];
+    }
+    return findShareNames(parseJson(list.stdout));
+}

package/dist/host/types.d.ts

@@ -1,6 +1,18 @@
 import type { InstalledPackageState } from "./catalog-install.js";
 export type AttestationKind = "local" | "app-package" | "none";
 export type PackageRoute = "package-only" | "broker-installer" | "unknown";
+export type OidcOriginKind = "public-ca" | "quickconnect" | "lan-ip" | "self-signed" | "private-ca" | "http";
+export interface HostOidcOriginEvaluation {
+    ready: boolean;
+    kind: OidcOriginKind;
+    hostname?: string;
+    issuerUrl?: string;
+    setupHint: string;
+}
+export interface HostOidcCompatSettings {
+    enabled: boolean;
+    origin: HostOidcOriginEvaluation;
+}
 export interface DeployIdentity {
     packageId: string;
     displayname: string;
@@ -9,6 +21,7 @@ export interface DeployIdentity {
 export interface AttestationIssueResult {
     kind: "local";
     attestationDigest: string;
+    token?: string;
 }
 export interface ResidueItem {
     kind: "port_profile_sc" | "cm_project_config";
@@ -63,6 +76,8 @@ export interface NasHost {
      * caller refuses instead of guessing.
      */
     getArchFamily?(): Promise<"x86_64" | "aarch64" | undefined>;
+    /** List the current logical Shared Folder names using an administrator session. */
+    listShareNames?(): Promise<string[]>;
     resolveSharePath?(logicalName: string): Promise<string | undefined>;
     /** Resolve the NAS-specific user-home root when DSM User Home is enabled. */
     resolveHomesPath?(): Promise<string | undefined>;
@@ -79,6 +94,8 @@ export interface NasHost {
         isPackageOnly?: boolean;
         [key: string]: unknown;
     } | undefined>;
+    /** Read the optional administrator OIDC compatibility settings endpoint. */
+    getOidcCompatSettings?(): Promise<HostOidcCompatSettings | undefined>;
     smokeRequireLogin(input: {
         packageIdentity: string;
         cookieHeader: string;

package/dist/validate.js

@@ -68,10 +68,14 @@ export function validateProject(project, options = {}) {
     const installParams = collectInstallParameters(parsed.contract);
     const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
     const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
+    const posixAllSharesParams = new Set(installParams
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name));
     const installParamNames = new Set(installParams.map(({ name }) => name));
     errors.push(...validateComposeHostBinds(parsedCompose.compose, composeFile, {
         sharedFolderParams,
         homesParams,
+        posixAllSharesParams,
         installParamNames,
     }));
     if (typeof parsed.contract.adminport === "number") {
@@ -105,13 +109,14 @@ export function validateProject(project, options = {}) {
         ? { ...item, severity: (profile === "listing" ? "error" : "warning") }
         : item));
     for (const { name, param } of installParams) {
-        const referenced = param.type === "shared_folder" || param.type === "homes"
+        const referenced = param.type === "shared_folder" || param.type === "homes" || param.type === "posix_all_shares"
             ? volumeSourceVars.has(name)
             : interpolations.has(name);
         if ((param.type === "string" ||
             param.type === "boolean" ||
             param.type === "shared_folder" ||
-            param.type === "homes") &&
+            param.type === "homes" ||
+            param.type === "posix_all_shares") &&
             !referenced) {
             errors.push({
                 code: "INSTALL_PARAMETER_UNREFERENCED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/schema/synology-app.schema.json

@@ -59,7 +59,7 @@
         "properties": {
           "type": {
             "type": "string",
-            "enum": ["string", "boolean", "secret", "shared_folder", "dsm_user", "homes"]
+            "enum": ["string", "boolean", "secret", "shared_folder", "dsm_user", "homes", "posix_all_shares"]
           },
           "default": {},
           "generate": {

package/skills/reference/create.md

@@ -38,6 +38,10 @@ ports:
 
 包現成 Compose 時，先用 `inspect` 看原本的 volume mapping。容器路徑跟 Compose／映像的 upstream target 走，不要為了套平台範例改成 `/data`；只把 host source 換成 `${PARAM}`。原有的 upstream named volume 要保留在頂層 `volumes:`。需要既有 Share 時宣告 `install.<PARAM>.type: shared_folder`，管理員在安裝時選這台 NAS 的 Share。
 
+### `posix_all_shares`
+
+當 App 必須在安裝當下掛載這台 NAS 目前列出的每一個共用資料夾時，宣告 `install.<NAME>.type: posix_all_shares`，並把 `${NAME}` 作為完整 Compose volume source，例如 `${NAME}:/shares:ro`。Package Center wizard 會以 `SYNO.Core.Share.list` 的 multi-select 讓管理員再次確認；這是最大警告：容器可讀（或依 Compose 模式讀寫）所有列出的 Share，安裝後新建的共用資料夾不會自動加入，由管理員決定是否安裝。不要在契約或 Compose 寫 `/volume*`、domain、實體 path；`CLI deploy` 未給 `--param NAME=...` 時會用管理員 session 重新列出當下的 Share，preinst 只解析清單，不掃描檔案系統。
+
 ## 路線判準：零設定（Static Zero-Config）vs Dynamic vs Broker
 
 Syno Package Land 在打包 Compose App 時，依契約與 Compose 內容自動分類為不同路線：

package/skills/reference/deploy.md

@@ -1,6 +1,6 @@
 # 部署（Deploy）
 
-Inner Loop：thin SPK、NAS Administrator DSM 授權、Local Attestation、經 Package Center 安裝。**不要 SSH**，不要把 Compose 貼進 Container Manager 手工裝。
+Inner Loop：thin SPK、NAS Administrator DSM 授權、Local Attestation、經 Package Center 安裝。Personal deploy 會把 Broker 簽發的 local attestation 內嵌到套件供 preinst 使用。**不要 SSH**，不要把 Compose 貼進 Container Manager 手工裝。
 
 ## 前置