@synopackageland/cli 0.33.2 → 0.35.0

package/dist/standalone/api-description.js

@@ -33,6 +33,7 @@ export async function buildApiDescription(m, bridgeMethods, run) {
     if (!Array.isArray(methods) || methods.some(item => typeof item.method !== 'string' || typeof item.permission !== 'string'))
         throw new StandaloneBuildError('CTL_DESCRIBE_FAILED', 'Invalid registry snapshot.');
     const registry = new Map(methods.map(item => [item.method, item.permission]));
+    const rawHTTP = new Set(methods.filter(item => item.kind === 'http').map(item => item.method));
     // Identity transport routes are outside the business registry but have immutable SDK ownership.
     if (m.capabilities.identity) {
         registry.set('identity.session', 'public');
@@ -46,6 +47,8 @@ export async function buildApiDescription(m, bridgeMethods, run) {
         const names = flowMethods(command.flow);
         let permission = 'public';
         for (const name of names) {
+            if (rawHTTP.has(name))
+                throw new StandaloneBuildError('CTL_COMMAND_UNREGISTERED', `Command ${id} references raw HTTP route ${name}; ctl commands require RPC methods.`);
             if (!registry.has(name))
                 throw new StandaloneBuildError('CTL_COMMAND_UNREGISTERED', `Command ${id} references unregistered method ${name}.`);
             const effective = m.entry === 'admin-only' ? 'administrators' : registry.get(name);

package/dist/standalone/bridge-runtime.js

@@ -29,6 +29,8 @@ export async function buildBridgeRuntime(m, arch, work, run, digests) {
         `-X main.permissionsDigest=${digests.permissions}`,
         ...(m.portal && portalByExecutor(m.os_min_ver) ? ["-X main.portalMode=executor"] : []),
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${m.apiSDKPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${digests.permissions}`,
+        ...(m.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${m.entry}`] : []),
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, RUNTIME_MAIN], {
         cwd: sdk.goDir,

package/dist/standalone/build.js

@@ -1,4 +1,5 @@
 import { buildInstallSettings } from './install-settings.js';
+import { auditGoRoutes, httpRoutesDigest } from './route-audit.js';
 import { PORTAL_REQUIRES_EXECUTOR } from "../portal/alias.js";
 import { buildApiDescription } from "./api-description.js";
 import { goChildEnv } from "../runtime/go-env.js";
@@ -232,6 +233,11 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
             manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
+    const policy = readApiPermissions(backend, manifest.capabilities);
+    const audit = auditGoRoutes(backend.dir, policy.policy, policy.sdk, [backend.main], [goBuildEnv(arch).GOARCH]);
+    if (audit.problems.length || manifest.entry && !audit.entryGate) {
+        throw new StandaloneBuildError("STANDALONE_API_REGISTRY_INVALID", audit.problems.join("\n") || "App entry gate was removed during build.");
+    }
     const module = goModulePath(backend.dir);
     if (!module)
         throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} has no module line; backend must be a Go module.`);
@@ -245,6 +251,10 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         `-X main.requestTimeout=${requestTimeoutSeconds(backend)}`,
         `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedHTTPRoutesDigest=${httpRoutesDigest(audit)}`,
+        `-X ${SDK_MODULE}/ipc.packageID=${manifest.package}`,
+        ...(manifest.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${manifest.entry}`] : []),
         ...delegateBuildFlags(manifest),
         ...(manifest.executor
             ? [
@@ -294,11 +304,20 @@ async function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
+    const policy = readApiPermissions(manifest.backend, manifest.capabilities);
+    const audit = auditGoRoutes(manifest.backend.dir, policy.policy, policy.sdk, [BACKGROUND_WORKER_MAIN], [goBuildEnv(arch).GOARCH]);
+    if (audit.problems.length)
+        throw new StandaloneBuildError("STANDALONE_API_REGISTRY_INVALID", audit.problems.join("\n"));
     const ldflags = [
         "-s",
         "-w",
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
+        `-X ${SDK_MODULE}/ipc.packageID=${manifest.package}`,
+        `-X ${SDK_MODULE}/api.expectedHTTPRoutesDigest=${httpRoutesDigest(audit)}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        ...(manifest.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${manifest.entry}`] : []),
         ...delegateBuildFlags(manifest),
         ...(manifest.executor
             ? [

package/dist/standalone/dsm-window.d.ts

@@ -39,8 +39,8 @@ export declare function windowAppId(manifest: Pick<StandaloneManifest, "package"
  */
 export declare function renderUiConfig(manifest: StandaloneManifest, icons?: PackageIcons, loginStyle?: Record<string, string>): string;
 /**
- * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * The DSM AppWindow that hosts the project's UI. It loads the classic app.js
+ * or the versioned app.module.js module and app.css, then calls mount(root, ctx). `ctx.call(method,
  * params, {signal})` is the only transport: same-origin POST with DSM's session
  * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
@@ -55,4 +55,4 @@ export declare function renderUiConfig(manifest: StandaloneManifest, icons?: Pac
  * the window (a `launchParam` desktop URL or `SYNO.SDS.AppLaunch(id, param)`),
  * and `ctx.onLaunch(fn)` hands fn those of each later launch with values.
  */
-export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string, icons?: PackageIcons, portalText?: PortalCatalogs): string;
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string, icons?: PackageIcons, portalText?: PortalCatalogs, moduleVersion?: string): string;

package/dist/standalone/dsm-window.js

@@ -203,8 +203,8 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
     }, null, 2)}\n`;
 }
 /**
- * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * The DSM AppWindow that hosts the project's UI. It loads the classic app.js
+ * or the versioned app.module.js module and app.css, then calls mount(root, ctx). `ctx.call(method,
  * params, {signal})` is the only transport: same-origin POST with DSM's session
  * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
@@ -219,7 +219,7 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
  * the window (a `launchParam` desktop URL or `SYNO.SDS.AppLaunch(id, param)`),
  * and `ctx.onLaunch(fn)` hands fn those of each later launch with values.
  */
-export function renderWindowScript(manifest, assetVersion, icons = packageIcons(manifest.icon), portalText) {
+export function renderWindowScript(manifest, assetVersion, icons = packageIcons(manifest.icon), portalText, moduleVersion) {
     const pkg = manifest.package;
     const ns = `SYNO.SDS.${pkg}`;
     const p = JSON.stringify(pkg);
@@ -407,16 +407,32 @@ ${ns}.loadApp = function (done) {
     done(apps[${p}]);
     return;
   }
-  var base = "webman/3rdparty/${pkg}/app/";
+${moduleVersion ? `  var loads = window.DsmPackageAppLoads = window.DsmPackageAppLoads || {};
+  var key = ${p} + ":${moduleVersion}";
+  if (loads[key]) { loads[key].then(function (app) { done(app); }, function (error) { done(null, error); }); return; }
+` : ""}  var base = "webman/3rdparty/${pkg}/app/${moduleVersion ? `${moduleVersion}/` : ""}";
   var css = document.createElement("link");
   css.rel = "stylesheet";
   css.href = base + "app.css?v=${assetVersion}";
   document.head.appendChild(css);
-  var js = document.createElement("script");
+${moduleVersion ? `  loads[key] = import(new URL(base + "app.module.js", document.baseURI).href).then(function (app) {
+    if (typeof app.mount !== "function") throw new Error("The UI module must export mount(root, ctx)");
+    window.DsmPackageApps = window.DsmPackageApps || {};
+    window.DsmPackageApps[${p}] = app;
+    versions[${p}] = "${assetVersion}";
+    return app;
+  });
+  loads[key].then(function (app) { done(app); }, function (error) {
+    delete loads[key];
+    css.remove();
+    done(null, error);
+  });
+` : `  var js = document.createElement("script");
   js.src = base + "app.js?v=${assetVersion}";
   js.dataset.package = ${p};
   js.onload = function () { versions[${p}] = "${assetVersion}"; done((window.DsmPackageApps || {})[${p}]); };
   document.head.appendChild(js);
+`}
 };
 
 // DSM keeps a loaded window script after a package upgrade until the page
@@ -504,10 +520,11 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
     var ctx = { requestTimeout: ${requestTimeout} };
     var call = function (method, params, options) { return ${ns}.call(method, params, options, ctx.requestTimeout); };
     var batch = ${batchRuntime ? `function (calls, options) { return ${ns}.batch(calls, options, ctx.requestTimeout); }` : "undefined"};
-${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
+${root ? root.mount : ""}    ${ns}.loadApp(function (app, error) {
       if (me.mountToken !== mountToken) return;
       me.mountPending = false;
       var root = me.body && me.body.dom.querySelector(".dsmapp-root");
+      if (error && root) { root.textContent = "Unable to load the package UI. Reload this page to try again."; return; }
       if (app && root && !me.mounted) {
         var i18n = ${ns}.createI18n(lang, ${ns}.messages);
         me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });

package/dist/standalone/identity-gateway.d.ts

@@ -64,6 +64,7 @@ export interface IdentityGateway {
         https?: number;
     };
     passthrough: string[];
+    upstream_auth_paths?: string[];
     optional_passthrough?: Record<string, {
         prefixes: string[];
     }>;
@@ -121,5 +122,18 @@ export declare function identityGatewayConfig(m: StandaloneManifest): string;
 export declare function gatewayDaemon(daemon: Daemon): Daemon;
 /** Builds the gateway from the declared SDK release with the pinned Go, binding its config path. */
 export declare function buildIdentityGateway(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
+/** Exact JSON contract shared with idgateway.Config.EntryPolicyDigest. */
+export declare function gatewayEntryPolicyDigest(cfg: {
+    entry?: string;
+    access?: string;
+    upstream_access?: string;
+    upstream_auth_paths?: string[];
+    groups?: string[];
+    compose_blocked?: boolean;
+    passthrough?: string[];
+    optional_passthrough?: Record<string, {
+        prefixes: string[];
+    }>;
+}): string;
 /** The manifest form of a normalized gateway, retained for artifact inspection. */
 export declare function identityGatewayDeclaration(g: IdentityGateway | undefined): unknown;

package/dist/standalone/identity-gateway.js

@@ -1,4 +1,5 @@
 import { nativeGatewaySupported } from './native-gateway.js';
+import { createHash } from 'node:crypto';
 import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -41,6 +42,17 @@ const localPath = (v) => typeof v === "string" &&
     /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(v) &&
     !v.startsWith("//") &&
     !v.split("/").some((p) => p === "." || p === "..");
+const pathPrefix = (path, prefix) => {
+    const base = prefix.replace(/\/$/, "");
+    return path === base || path.startsWith(base + "/");
+};
+const upstreamPrefix = (v) => typeof v === "string" && v.length <= 512 && /^\/[A-Za-z0-9._~/-]+$/.test(v) &&
+    v !== "/" && !v.includes("//") && !v.split("/").some(p => p === "." || p === "..") &&
+    !pathPrefix(v, "/_sso") && !pathPrefix(v, "/_spl");
+function upstreamAuthSdkSupported(dir) {
+    const source = join(dir, "idgateway/upstream_auth.go");
+    return existsSync(source) && /const UpstreamAuthPathsVersion = 1\b/.test(readFileSync(source, "utf8"));
+}
 const strings = (v, ok, max = 64) => Array.isArray(v) && v.length <= max && v.every(ok);
 const name = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(v);
 const headerName = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(v);
@@ -151,6 +163,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             "upstream",
             "listen",
             "passthrough",
+            "upstream_auth_paths",
             "optional_passthrough",
             "redirects",
             "email_domain",
@@ -161,7 +174,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             "token",
             "account",
         ])) {
-        return invalid("accepts only sdk, external_access, mode, access, upstream_access, groups, upstream, listen, passthrough, optional_passthrough, redirects, email_domain, session_ttl, roles, headers, oidc, token and account.");
+        return invalid("accepts only sdk, external_access, mode, access, upstream_access, groups, upstream, listen, passthrough, upstream_auth_paths, optional_passthrough, redirects, email_domain, session_ttl, roles, headers, oidc, token and account.");
     }
     const v = value;
     let externalAccess;
@@ -270,6 +283,25 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
         }
     }
     const redirects = v.redirects ?? {};
+    const upstreamAuth = v.upstream_auth_paths;
+    if (upstreamAuth !== undefined) {
+        if (!strings(upstreamAuth, upstreamPrefix, 16) || !upstreamAuth.length)
+            return invalid("upstream_auth_paths needs 1-16 fixed path prefixes outside /_sso and /_spl, without wildcards or encoded paths.");
+        for (let i = 0; i < upstreamAuth.length; i++) {
+            if (upstreamAuth.slice(0, i).some(p => pathPrefix(p, upstreamAuth[i]) || pathPrefix(upstreamAuth[i], p)))
+                return invalid("upstream_auth_paths prefixes must not overlap.");
+        }
+        const all = [...passthrough, ...Object.values((optional ?? {})).flatMap(rule => rule.prefixes)];
+        if (all.some(p => !upstreamPrefix(p) || !upstreamAuth.some(prefix => pathPrefix(p, prefix))))
+            return invalid("passthrough must be contained in upstream_auth_paths.");
+        try {
+            if (!upstreamAuthSdkSupported(sdkSource(v.sdk).goDir))
+                return invalid("The selected SDK lacks upstream_auth_paths and its build-bound entry policy; use matching SDK sources.");
+        }
+        catch {
+            return invalid("The SDK upstream_auth_paths source is unavailable; use matching SDK sources.");
+        }
+    }
     if (!record(redirects) ||
         Object.entries(redirects).some(([from, to]) => !localPath(from) || !localPath(to)))
         return invalid("redirects maps local paths to local paths.");
@@ -316,6 +348,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             ...(listen.https ? { https: listen.https } : {}),
         },
         passthrough: passthrough,
+        ...(upstreamAuth !== undefined ? { upstream_auth_paths: upstreamAuth } : {}),
         ...(optional !== undefined ? { optional_passthrough: optional } : {}),
         redirects: redirects,
         ...(v.email_domain ? { email_domain: v.email_domain } : {}),
@@ -451,7 +484,7 @@ export function identityGatewayConfig(m) {
         access: g.access ?? "dsm-users",
         ...(g.upstream_access ? { upstream_access: g.upstream_access } : {}),
         ...(g.groups ? { groups: g.groups } : {}),
-        ...(m.entry || g.upstream_access === "public" ? { entry: m.entry ?? "app-privilege" } : {}),
+        ...(m.entry ? { entry: m.entry } : {}),
         ...(m.compose ? { container_app: true } : {}),
         ...(m.compose?.plan.mounts_blocked ? { compose_blocked: true } : {}),
         ...(g.max_upload_bytes ? { max_upload_bytes: g.max_upload_bytes } : {}),
@@ -468,6 +501,7 @@ export function identityGatewayConfig(m) {
         authorize_cgi: `/webman/3rdparty/${m.package}/sso/authorize.cgi`,
         state_dir: `/var/packages/${m.package}/var/sso`,
         passthrough: g.passthrough,
+        ...(g.upstream_auth_paths ? { upstream_auth_paths: g.upstream_auth_paths } : {}),
         ...(g.optional_passthrough ? { optional_passthrough: g.optional_passthrough } : {}),
         redirects: g.redirects,
         ...(g.email_domain ? { email_domain: g.email_domain } : {}),
@@ -526,6 +560,8 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("SDK_DOWNLOAD_FAILED", error.message.replace(/^\[[A-Z_]+\] /, ""));
     }
     runtimeBudgetSource(sdk.goDir, m);
+    if (m.identityGateway.upstream_auth_paths && !upstreamAuthSdkSupported(sdk.goDir))
+        throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "The selected SDK lacks upstream_auth_paths and its build-bound entry policy; use matching SDK sources.");
     if (gatewayExternalAccess(m.identityGateway)) {
         const config = join(sdk.goDir, "idgateway/config.go");
         const main = join(sdk.goDir, "idgateway/cmd/gateway/main.go");
@@ -553,7 +589,10 @@ export async function buildIdentityGateway(m, arch, work, run) {
             throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "The selected SDK lacks fixed launch_path support; use a matching SDK release or an explicit development source override.");
     }
     const out = join(work, `identity-gateway-${arch}`);
-    const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}`;
+    const policyFlag = upstreamAuthSdkSupported(sdk.goDir)
+        ? ` -X github.com/synopackageland/syno-pkg-land-sdk/idgateway.expectedEntryPolicyDigest=${gatewayEntryPolicyDigest(JSON.parse(identityGatewayConfig(m)))}`
+        : "";
+    const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}${policyFlag}`;
     const result = await run("go", [
         "build",
         "-trimpath",
@@ -578,6 +617,19 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED", toolchain);
     return out;
 }
+/** Exact JSON contract shared with idgateway.Config.EntryPolicyDigest. */
+export function gatewayEntryPolicyDigest(cfg) {
+    // Serialize keys explicitly: JSON.stringify reorders integer-like object keys.
+    const optional = Object.entries(cfg.optional_passthrough ?? {})
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+        .map(([id, rule]) => `${JSON.stringify(id)}:${JSON.stringify({ prefixes: rule.prefixes })}`).join(",");
+    const base = JSON.stringify({
+        entry: cfg.entry ?? "", access: cfg.access ?? "", upstream_access: cfg.upstream_access ?? "",
+        groups: cfg.groups ?? [], compose_blocked: cfg.compose_blocked ?? false,
+        upstream_auth_paths: cfg.upstream_auth_paths ?? [], passthrough: cfg.passthrough ?? [],
+    });
+    return createHash("sha256").update(`${base.slice(0, -1)},"optional_passthrough":{${optional}}}`).digest("hex");
+}
 /** The manifest form of a normalized gateway, retained for artifact inspection. */
 export function identityGatewayDeclaration(g) {
     if (!g)

package/dist/standalone/inspect-spk.js

@@ -1,4 +1,5 @@
 import { readInstallSettings, settingsInstallSteps, settingsConfig, renderSettingsHook } from './install-settings.js';
+import { MODULE_UI_ENTRY, uiTreeDigest } from "./ui-assets.js";
 import { nativePortal } from "./portal.js";
 import { nativeGatewaySupported, renderNativeGatewayConfig, renderNativeGatewayDiagnostic, renderNativeGatewayPrepare, NATIVE_GATEWAY_CONFIG, gatewayEntryPath } from './native-gateway.js';
 import { inspectPortalInfo } from "../portal/info.js";
@@ -101,6 +102,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                 const raw = JSON.parse(metadataText);
                 if ((raw.launch !== undefined && !isWebLaunchMode(raw.launch)) ||
                     raw.schema !== 2 ||
+                    (raw.ui_module !== undefined && (typeof raw.ui_module !== "string" || !/^[a-f0-9]{64}$/.test(raw.ui_module) || raw.window === false || raw.compose !== undefined)) ||
                     !["go", "python", "node", "rust", "binary"].includes(raw.backend) ||
                     !Array.isArray(raw.capabilities) ||
                     raw.capabilities.some((name) => ![
@@ -130,6 +132,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             }
         }
         const daemonRestart = recoverDaemonRestart(metadata.daemon_restart, metadata.daemon_sdk, findings);
+        await inspectModuleUi(dir, paths, metadata.ui_module, findings);
         if (metadata.daemon_restart !== undefined && (metadata.compose !== undefined || !paths.has("daemon/control")))
             findings.push("DAEMON_RESTART_INVALID daemon restart requires a native daemon controller, without Compose supervision");
         const identityGateway = await inspectProviderOnlyAdmission(dir, paths, metadata.provider_only_oidc, findings);
@@ -344,6 +347,31 @@ export async function inspectSpk(spkPath, expectedKind) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+async function inspectModuleUi(dir, paths, version, findings) {
+    if (version === undefined) {
+        if ([...paths].some(path => /^ui\/app\/[a-f0-9]{64}\/app\.module\.js$/.test(path)))
+            findings.push("UI_MODULE_INVALID module UI requires its build record");
+        return;
+    }
+    try {
+        if (!/^[a-f0-9]{64}$/.test(version))
+            throw new Error("invalid UI tree digest");
+        const prefix = `ui/app/${version}/`;
+        for (const entry of [MODULE_UI_ENTRY, "app.css"])
+            if (!paths.has(prefix + entry))
+                throw new Error(`missing ${entry}`);
+        if ([...paths].some(path => path.startsWith("ui/app/") && path !== `ui/app/${version}` && !path.startsWith(prefix)))
+            throw new Error("module UI assets must all belong to the recorded tree");
+        const root = join(dir, "module-ui-inspection");
+        mkdirSync(root);
+        await tar.x({ file: join(dir, "package.tgz"), cwd: root, filter: path => path.replace(/^\.\//, "").startsWith(prefix) });
+        if (uiTreeDigest(join(root, "ui/app", version), true) !== version)
+            throw new Error("UI assets differ from their recorded digest");
+    }
+    catch (error) {
+        findings.push(`UI_MODULE_INVALID ${error.message}`);
+    }
+}
 const LAUNCHER_TYPE_MISMATCH = "LAUNCHER_TYPE_MISMATCH";
 const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 /** Compare the actual launcher and Portal fields to the packaged declaration. */
@@ -1110,7 +1138,7 @@ async function inspectProviderOnlyAdmission(dir, paths, saved, findings) {
             return;
         }
         if (cfg.mode !== "oidc" || !["dsm-users", "dsm-admins", "dsm-groups"].includes(cfg.access)
-            || !["app-privilege", "admin-only"].includes(cfg.entry) || cfg.compose_blocked
+            || cfg.entry !== undefined || cfg.compose_blocked
             || Object.keys(cfg.optional_passthrough ?? {}).length)
             throw new Error("OIDC admission policy weakens issuer or Share protection");
         if (cfg.access === "dsm-groups" && (!Array.isArray(cfg.groups) || !cfg.groups.length || !cfg.groups.every((g) => typeof g === "string" && g.length > 0)))

package/dist/standalone/manifest.js

@@ -1,4 +1,6 @@
 import { readInstallSettings } from './install-settings.js';
+import { auditGoRoutes } from './route-audit.js';
+import { BACKGROUND_WORKER_MAIN } from './background.js';
 import { isWebLaunchMode } from "../contract/web-launch.js";
 import { validWebAPIProfiles, } from "../runtime/webapi-profile.js";
 import { validateMetadata } from "../package-metadata.js";
@@ -24,7 +26,7 @@ import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration, }
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { LOGIN_COLOR, loginImageProblem, } from "../build-spk/login-style.js";
 import { validateReproducible } from "../reproducible-config.js";
-import { appSdkVersion, SDK_MODULE, } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_MODULE, sdkSource, } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
 import { readWindowSize } from "./window-size.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
@@ -337,6 +339,39 @@ function readManifest(raw, c) {
             (raw.entry === "admin-only" || raw.entry === "app-privilege")
             ? raw.entry
             : readEntry(raw.entry, backend, permissions?.policy, c);
+    if (entry && identityGateway && (identityGateway.access === "public" || identityGateway.upstream_access === "public" ||
+        !identityGateway.upstream_auth_paths?.length &&
+            (identityGateway.passthrough.length || Object.keys(identityGateway.optional_passthrough ?? {}).length)))
+        c.fail("STANDALONE_ENTRY_WIDENED", "App entry requires protected gateway access and passthrough contained in explicit upstream_auth_paths.");
+    if (entry && raw.compose !== undefined && identityGateway) {
+        try {
+            if (!readFileSync(join(sdkSource(identityGateway.sdk).goDir, "api/server.go"), "utf8").includes("expectedEntryMode")) {
+                c.fail("STANDALONE_ENTRY_UNSUPPORTED", "Update the SDK: App entry requires the build-bound entry floor and gateway admission.");
+            }
+        }
+        catch {
+            c.fail("STANDALONE_ENTRY_UNSUPPORTED", "The SDK entry floor source is unavailable; update the SDK and retry.");
+        }
+    }
+    if (backend?.kind === "go" && permissions && sdkVersionOrUndefined(backend) && (raw.entry === undefined || entry)) {
+        try {
+            const problems = new Set();
+            for (const main of [backend.main, ...(capabilities.jobs ? [BACKGROUND_WORKER_MAIN] : [])]) {
+                for (const arch of arches ?? []) {
+                    const audit = auditGoRoutes(backend.dir, permissions.policy, permissions.sdk, [main], [({ x86_64: 'amd64', aarch64: 'arm64', armv7: 'arm' })[arch]]);
+                    for (const problem of audit.problems)
+                        problems.add(problem);
+                    if (main === backend.main && entry && !audit.entryGate)
+                        c.fail("STANDALONE_ENTRY_UNSUPPORTED", "App entry requires an actual dsm.NewEntryGate call; comments do not enforce admission.");
+                }
+            }
+            for (const problem of problems)
+                c.fail("STANDALONE_API_REGISTRY_INVALID", problem);
+        }
+        catch (error) {
+            c.fail("STANDALONE_API_REGISTRY_INVALID", error.message);
+        }
+    }
     if (entry === "admin-only" && permissions) {
         const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
@@ -498,6 +533,9 @@ export function bridgeMethodProblems(methods, permissions, file) {
         problems.push(`App methods must not use an SDK method name: ${taken.join(", ")}.`);
     if (!methods)
         return problems;
+    const missing = methods.filter(method => !sdk.has(method) && !Object.hasOwn(permissions.policy.methods, method));
+    if (missing.length)
+        problems.push(`${file} must declare every registered App method: ${missing.join(", ")}.`);
     const unlisted = Object.keys(permissions.policy.methods).filter((method) => !sdk.has(method) && !methods.includes(method));
     if (unlisted.length)
         problems.push(`${file} sets methods the App does not have: ${unlisted.join(", ")}; the runtime refuses to start.`);
@@ -645,6 +683,17 @@ function readEntry(value, backend, policy, c) {
         const shown = main ? relative(c.root, main) : "the backend.main main.go";
         return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry needs the SDK entry gate: ${gate?.sdk ?? `backend/go.mod must require ${SDK_MODULE}`}, and wrap the authenticator with ${gate?.call.slice(0, -1) ?? "dsm.NewEntryGate"} in ${shown}.`);
     }
+    const version = sdkVersionOrUndefined(backend);
+    if (version) {
+        try {
+            if (!readFileSync(join(sdkSource(version).goDir, "api/server.go"), "utf8").includes("expectedEntryMode")) {
+                return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "Update the SDK: App entry requires the build-bound entry floor in api.Server.");
+            }
+        }
+        catch {
+            return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "The SDK entry floor source is unavailable; update the SDK and retry.");
+        }
+    }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege needs at least one route marked authenticated in permissions.json, otherwise regular users have nothing to use.");
     }

package/dist/standalone/route-audit.d.ts

@@ -0,0 +1,12 @@
+import type { ApiPermissions } from './api-permissions.js';
+export interface RouteAudit {
+    problems: string[];
+    entryGate: boolean;
+    httpRoutes: {
+        prefix: string;
+        method: string;
+    }[];
+}
+export declare function httpRoutesDigest(audit: RouteAudit): string;
+/** Parse Go syntax without executing an App's main, init functions or --describe. */
+export declare function auditGoRoutes(dir: string, policy: ApiPermissions, sdk: Record<string, Record<string, string>>, roots?: string[], arches?: string[]): RouteAudit;

package/dist/standalone/route-audit.js

@@ -0,0 +1,29 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdtempSync, rmSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { goChildEnv } from '../runtime/go-env.js';
+let binary;
+export function httpRoutesDigest(audit) {
+    return createHash('sha256').update(JSON.stringify(audit.httpRoutes)).digest('hex');
+}
+/** Parse Go syntax without executing an App's main, init functions or --describe. */
+export function auditGoRoutes(dir, policy, sdk, roots = ['.'], arches = ['amd64', 'arm64', 'arm']) {
+    const env = goChildEnv({ ...process.env, GOOS: undefined, GOARCH: undefined, GOARM: undefined, GOWORK: 'off', CGO_ENABLED: '0' });
+    if (!binary) {
+        const work = mkdtempSync(join(tmpdir(), 'synopkgland-route-audit-'));
+        process.once('exit', () => rmSync(work, { recursive: true, force: true }));
+        const out = join(work, process.platform === 'win32' ? 'route-audit.exe' : 'route-audit');
+        const source = fileURLToPath(new URL('../../assets/go/route-audit/main.go', import.meta.url));
+        const build = spawnSync('go', ['build', '-trimpath', '-o', out, source], { env: goChildEnv(env), encoding: 'utf8', timeout: 120_000 });
+        if (build.error || build.status !== 0)
+            throw new Error('Cannot build the Go route auditor; install Go and retry.');
+        binary = out;
+    }
+    const result = spawnSync(binary, [], { env, input: JSON.stringify({ Dir: realpathSync(dir), Roots: roots, Arches: arches, Permissions: policy.methods, SDK: sdk }), encoding: 'utf8', timeout: 120_000, maxBuffer: 4 << 20 });
+    if (result.error || result.status !== 0)
+        throw new Error(`Cannot audit Go routes: ${result.stderr?.trim() || 'auditor unavailable'}`);
+    return JSON.parse(result.stdout);
+}

package/dist/standalone/spk.js

@@ -6,7 +6,7 @@ import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { gatewayAdmissionPolicy } from "./identity-gateway.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, sep } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
@@ -19,6 +19,7 @@ import { renderDelegateScopeSteps } from "../build-spk/delegate-scope.js";
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
+import { MODULE_UI_ENTRY, uiTreeDigest } from "./ui-assets.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { appTitle, CGI_PAYLOAD_PATH, hasSdkWindow, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
@@ -81,7 +82,16 @@ export async function assembleStandaloneSpk(options) {
             copyUiTree(manifest.ui.dir, appDir, manifest.root);
         else
             mkdirSync(appDir, { recursive: true });
-        const assetVersion = digestTree(appDir).slice(0, 12);
+        const moduleUi = hasSdkWindow(manifest) && existsSync(join(appDir, MODULE_UI_ENTRY));
+        const uiDigest = uiTreeDigest(appDir, moduleUi);
+        const assetVersion = uiDigest.slice(0, 12);
+        const moduleVersion = moduleUi ? uiDigest : undefined;
+        if (moduleVersion) {
+            const snapshot = join(uiRoot, "app-snapshot");
+            renameSync(appDir, snapshot);
+            mkdirSync(appDir);
+            renameSync(snapshot, join(appDir, moduleVersion));
+        }
         const login = manifest.portal
             ? loginStyleAssets(manifest.loginStyle)
             : undefined;
@@ -89,7 +99,7 @@ export async function assembleStandaloneSpk(options) {
         for (const [path, bytes] of login?.files ?? [])
             writeFile(join(uiRoot, path), bytes);
         if (hasSdkWindow(manifest))
-            writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
+            writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText, moduleVersion));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
         writeUiTexts(uiRoot, appTitle(manifest), manifest.console);
@@ -225,6 +235,7 @@ export async function assembleStandaloneSpk(options) {
             .digest("hex");
         writeFile(join(staging, "sdk-package.json"), JSON.stringify({
             schema: 2,
+            ...(moduleVersion ? { ui_module: moduleVersion } : {}),
             ...(manifest.installSettings ? { installSettings: manifest.installSettings } : {}),
             ...(manifest.lifecycleTimeouts ? { lifecycleTimeouts: manifest.lifecycleTimeouts } : {}),
             ...("timeoutSeconds" in manifest.backend && manifest.backend.timeoutSeconds ? { operationSeconds: manifest.backend.timeoutSeconds } : {}),
@@ -387,7 +398,7 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
 function copyUiTree(source, target, root) {
-    for (const entry of ["app.js", "app.css"]) {
+    for (const entry of [existsSync(join(source, MODULE_UI_ENTRY)) ? MODULE_UI_ENTRY : "app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {
             throw new StandaloneBuildError("STANDALONE_UI_ENTRY_MISSING", `The UI directory is missing ${entry}: ${source}`);
         }
@@ -425,19 +436,3 @@ function copyUiTree(source, target, root) {
     };
     walk(source, target);
 }
-function digestTree(root) {
-    const hash = createHash("sha256");
-    const walk = (dir, prefix) => {
-        for (const name of readdirSync(dir).sort()) {
-            const path = join(dir, name);
-            if (lstatSync(path).isDirectory()) {
-                walk(path, `${prefix}${name}/`);
-            }
-            else {
-                hash.update(`${prefix}${name}\0`).update(readFileSync(path));
-            }
-        }
-    };
-    walk(root, "");
-    return hash.digest("hex");
-}

package/dist/standalone/ui-assets.d.ts

@@ -0,0 +1,3 @@
+export declare const MODULE_UI_ENTRY = "app.module.js";
+/** Include paths and bytes: moving a chunk changes its import URL too. */
+export declare function uiTreeDigest(root: string, framed?: boolean): string;

package/dist/standalone/ui-assets.js

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+export const MODULE_UI_ENTRY = "app.module.js";
+/** Include paths and bytes: moving a chunk changes its import URL too. */
+export function uiTreeDigest(root, framed = false) {
+    const hash = createHash("sha256");
+    const walk = (dir, prefix) => {
+        for (const name of readdirSync(dir).sort()) {
+            const path = join(dir, name);
+            const stat = lstatSync(path);
+            if (stat.isDirectory())
+                walk(path, `${prefix}${name}/`);
+            else if (stat.isFile()) {
+                hash.update(`${prefix}${name}\0`);
+                // Module snapshots frame bytes; classic cache tokens keep their old digest.
+                if (framed)
+                    hash.update(`${stat.size}\0`);
+                hash.update(readFileSync(path));
+            }
+            else
+                throw new Error("UI assets must be regular files and directories");
+        }
+    };
+    walk(root, "");
+    return hash.digest("hex");
+}