@synopackageland/cli 0.37.0 → 0.39.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.39.0 (2026-10-29)
+
+- Add schema-2 `dependencies.packages` for DSM package dependencies independent
+  of the App language or daemon interpreter. Each entry has a validated `name`
+  and optional quoted numeric `min_version`. Build merges, sorts and
+  deduplicates these with Node backend and `daemon.node` requirements into
+  one INFO `install_dep_packages` field; distinct specified minimum versions
+  for one package fail validation. Daemon executable, arguments, environment
+  and supervision are unchanged. Native layouts and Compose are supported.
+  `check --json` reports normalized dependencies, build metadata records them,
+  and `inspect` verifies normalization, INFO agreement and inferred Node
+  requirements. Document `/var/packages/<name>/target`, the manifest field
+  and the difference from `daemon.node` in the manifest/daemon guides and App
+  skill. Add parser, merge/conflict, compiled CLI, artifact and mutation tests.
+- Make the native gateway listener-wait test assert both listeners close,
+  without assuming a scheduling-dependent minimum number of polls.
+
+## 0.38.0 (2026-10-29)
+
+- Audit direct `ipc.StartPeerUnix` calls and reject constructor aliases.
+  Document connection ownership, admission stop and final ACK sequencing in
+  the App skill. Use SDK/App 0.36.0.
+- Pin templates 0.34.0 and its SDK/App 0.36.0 defaults.
+- Fix CGI handler reachability when initialization shares Config or error
+  values. Follow each identifier's initializer so SDK CGI handlers are
+  accepted while private IPC handlers remain refused through assignments
+  and wrappers.
+
 ## 0.37.0 (2026-10-29)
 
 - Native Apps appear in Hyper Backup as applications by default. Build writes

package/README.md

@@ -49,6 +49,10 @@ See the [upstream scaffold and release checklist](skills/reference/upstream-fork
 Existing native products with their own payload layout use `backend: {kind: native}` in
 `dsm-package.yaml`.
 
+Declare language-independent DSM installation requirements with
+[`dependencies.packages`](docs/manifest.md). They merge with inferred Node
+requirements without changing the App's executable or runtime.
+
 A backend in Python, Node or Rust uses `backend: {runtime: python|node|rust, ...}`: the CGI is
 the SDK's Go runtime, which checks the DSM session and `permissions.json` and starts the App
 from `target/app` as the package account for each request (see `skills/reference/create.md`).
@@ -74,7 +78,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.37.0 uses templates ~0.33.0, whose default SDK pin is 0.35.0. Compose import and SDK defaults
+CLI 0.38.0 uses templates ~0.34.0, whose default SDK pin is 0.36.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -85,8 +89,8 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.37.0 depends on `~0.33.0`: npm installation or
-update can select the latest templates patch in the 0.33 minor line. Templates
+`@synopackageland/templates`. CLI 0.38.0 depends on `~0.34.0`: npm installation or
+update can select the latest templates patch in the 0.34 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.

package/assets/go/route-audit/main.go

@@ -248,6 +248,9 @@ func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.
 			}
 		}
 	}
+	if safe[expr] {
+		return true
+	}
 	found := false
 	ast.Inspect(expr, func(n ast.Node) bool {
 		if n == nil || found {
@@ -263,8 +266,38 @@ func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.
 		if id, ok := n.(*ast.Ident); ok {
 			if id.Obj != nil {
 				if decl, ok := id.Obj.Decl.(ast.Node); ok {
-					found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+					// An identifier carries its own initializer, not the other
+					// values/errors declared beside it in a shared assignment.
+					var names []*ast.Ident
+					var values []ast.Expr
+					switch d := decl.(type) {
+					case *ast.AssignStmt:
+						for _, lhs := range d.Lhs {
+							name, _ := lhs.(*ast.Ident)
+							names = append(names, name)
+						}
+						values = d.Rhs
+					case *ast.ValueSpec:
+						names, values = d.Names, d.Values
+					}
+					if len(values) > 0 {
+						for i, name := range names {
+							if name != nil && name.Obj == id.Obj {
+								index := i
+								if len(values) == 1 {
+									index = 0
+								}
+								if index < len(values) {
+									found = reusesBoundary(values[index], owner, sources, safe, seen)
+								}
+								break
+							}
+						}
+					} else {
+						found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+					}
 				}
+				return false
 			} else {
 				targetPackage, targetName = owner.pkg, id.Name
 			}
@@ -554,7 +587,7 @@ func main() {
 			}
 			if module == sdkModule+"/ipc" && !direct[selector] {
 				switch name {
-				case "ServeUnix", "StartUnix", "ServePeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
+				case "ServeUnix", "StartUnix", "ServePeerUnix", "StartPeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
 					problem(selector.Pos(), "IPC constructor aliases cannot be audited")
 				}
 			}

package/dist/cli.js

@@ -405,6 +405,7 @@ async function runCliWithin(argv) {
             emit("check", {
                 package: loaded.manifest.package,
                 warnings: validation.warnings ?? [],
+                ...("dependencies" in loaded.manifest && loaded.manifest.dependencies ? { dependencies: loaded.manifest.dependencies } : {}),
                 ...("installSettings" in loaded.manifest && loaded.manifest.installSettings ? { installSettings: loaded.manifest.installSettings } : {}),
                 ...("hyperBackup" in loaded.manifest && loaded.manifest.hyperBackup ? { hyperBackup: backupRecord(loaded.manifest.hyperBackup) } : {}),
                 ...("identityGateway" in loaded.manifest && gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) ? { identityGateway: gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) } : {}),

package/dist/error-registry.js

@@ -283,6 +283,11 @@ export const ERROR_REGISTRY = {
             description: "dsm-package.yaml contains an unsupported field.",
             suggestion: "Remove the field; a Standalone Package does not accept custom lifecycle scripts or DSM conf.",
         },
+        STANDALONE_DEPENDENCIES_INVALID: {
+            code: "STANDALONE_DEPENDENCIES_INVALID",
+            description: "The DSM package dependencies are invalid or conflict with an inferred dependency.",
+            suggestion: "Use dependencies.packages entries with only name and optional quoted numeric min_version; use one identical minimum version per package, including daemon.node.",
+        },
         STANDALONE_SCHEMA_INVALID: {
             code: "STANDALONE_SCHEMA_INVALID",
             description: "The schema version in dsm-package.yaml is not supported.",

package/dist/standalone/inspect-spk.d.ts

@@ -1,3 +1,4 @@
+import { type PackageDependencies } from "./package-dependencies.js";
 import { type InstallSettings } from './install-settings.js';
 import { type WebLaunchMode } from "../contract/web-launch.js";
 import { type ComposeApp } from "./compose.js";
@@ -9,6 +10,7 @@ import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
 export type SpkKind = "native-go" | "native-python" | "native-node" | "native-rust" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
+    dependencies?: PackageDependencies;
     installSettings?: InstallSettings;
     /** Hyper Backup application backup, as sdk-package.json records it. */
     hyperBackup?: HyperBackup;

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,4 @@
+import { inspectPackageDependencies, dependencyInfo } from "./package-dependencies.js";
 import { readInstallSettings, settingsInstallSteps, settingsConfig, renderSettingsHook } from './install-settings.js';
 import { MODULE_UI_ENTRY, uiTreeDigest } from "./ui-assets.js";
 import { nativePortal } from "./portal.js";
@@ -66,7 +67,12 @@ export async function inspectSpk(spkPath, expectedKind) {
         await tar.x({ file: spkPath, cwd: dir });
         const findings = [];
         if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
-            const info = readInfo(join(dir, "INFO"), findings, "native-layout");
+            let dependencies;
+            try {
+                dependencies = inspectPackageDependencies(JSON.parse(readFileSync(join(dir, "native-layout.json"), "utf8")).dependencies, findings);
+            }
+            catch { /* inspectNativeLayout reports a malformed inventory. */ }
+            const info = readInfo(join(dir, "INFO"), findings, "native-layout", false, undefined, dependencies);
             const payload = await listPayload(join(dir, "package.tgz"), findings);
             const target = join(dir, "layout-inspection");
             mkdirSync(target);
@@ -83,6 +89,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                     findings.push(`Missing INFO ${key}`);
             const icon = inspectPackageIcons(dir, findings);
             return {
+                ...(dependencies ? { dependencies } : {}),
                 kind: "native-layout",
                 package: info.package,
                 version: info.version,
@@ -134,6 +141,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json does not match the schema 2 capability inventory.");
             }
         }
+        const dependencies = inspectPackageDependencies(metadata.dependencies, findings);
         const daemonRestart = recoverDaemonRestart(metadata.daemon_restart, metadata.daemon_sdk, findings);
         await inspectModuleUi(dir, paths, metadata.ui_module, findings);
         if (metadata.daemon_restart !== undefined && (metadata.compose !== undefined || !paths.has("daemon/control")))
@@ -152,6 +160,9 @@ export async function inspectSpk(spkPath, expectedKind) {
         const integrations = metadata.integrations ?? [];
         if (metadata.compose !== undefined) {
             const result = await inspectUnifiedCompose(dir, payload, { ...metadata, installSettings }, findings);
+            if (dependencies) {
+                result.dependencies = dependencies;
+            }
             if (installSettings)
                 result.installSettings = installSettings;
             if (hyperBackup)
@@ -181,7 +192,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ? undefined
             : await recoverCompose(dir, metadata.compose, findings);
         const daemonNode = recoverDaemonNode(metadata.daemon_node, findings);
-        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined), daemonNode);
+        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined), daemonNode, dependencies);
         if (combined &&
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
@@ -230,6 +241,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         const bridge = compiledKind && kind !== "native-go"
             ? await checkBridgeApp(dir, metadata.backend, info, payload, findings)
             : undefined;
+        if (dependencies && bridge?.node?.package && !dependencies.packages.some(d => d.name === bridge.node.package))
+            findings.push("DEPENDENCIES_INVALID build metadata dependencies omit the Node backend package.");
         const hasExecutor = (metadata.capabilities ?? []).some((name) => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor");
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
@@ -315,6 +328,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             findings.push(`${CGI_PAYLOAD_PATH} has mode ${cgiEntry.mode}; it should be 0755`);
         }
         return {
+            ...(dependencies ? { dependencies } : {}),
             kind,
             ...(identityGateway ? { identityGateway } : {}),
             ...(installSettings ? { installSettings } : {}),
@@ -691,7 +705,7 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
 }
 /** Replay the SDK planner over archived source bytes, not merely a mutable lock. */
 async function inspectUnifiedCompose(dir, payload, metadata, findings) {
-    const info = readInfo(join(dir, "INFO"), findings, "binary", true);
+    const info = readInfo(join(dir, "INFO"), findings, "binary", true, undefined, inspectPackageDependencies(metadata.dependencies, findings));
     const base = {
         kind: "container",
         package: info.package,
@@ -1064,7 +1078,7 @@ function archivedInfoTranslations(info) {
     }
     return translations;
 }
-function readInfo(path, findings, kind, compose = false, daemonNode) {
+function readInfo(path, findings, kind, compose = false, daemonNode, dependencies) {
     if (!existsSync(path)) {
         findings.push("INFO is missing");
         return {};
@@ -1073,6 +1087,8 @@ function readInfo(path, findings, kind, compose = false, daemonNode) {
     for (const line of readFileSync(path, "utf8").split("\n")) {
         const match = line.match(/^([a-z_]+)="(.*)"$/);
         if (match) {
+            if (match[1] === "install_dep_packages" && Object.hasOwn(info, match[1]))
+                findings.push("INFO install_dep_packages must appear only once");
             info[match[1]] = match[2];
         }
     }
@@ -1098,7 +1114,14 @@ function readInfo(path, findings, kind, compose = false, daemonNode) {
             : kind === "native-node"
                 ? /^Node\.js_v[0-9]{2}([><=].*)?$/
                 : undefined;
-    if (daemonNode && info.install_dep_packages !== nodeDependency(daemonNode))
+    if (dependencies) {
+        if ((info.install_dep_packages ?? "") !== dependencyInfo(dependencies))
+            findings.push("INFO install_dep_packages does not match build metadata dependencies");
+        const inferred = daemonNode && dependencies.packages.find(d => d.name === daemonNode.package);
+        if (daemonNode && (!inferred || daemonNode.min_version !== undefined && inferred.min_version !== daemonNode.min_version))
+            findings.push("DEPENDENCIES_INVALID build metadata dependencies conflict with daemon.node");
+    }
+    else if (daemonNode && info.install_dep_packages !== nodeDependency(daemonNode))
         findings.push(`daemon.node requires INFO install_dep_packages="${nodeDependency(daemonNode)}"`);
     else if (!daemonNode &&
         info.install_dep_packages &&
@@ -1453,7 +1476,7 @@ async function inspectInstallSettings(dir, payload, metadata, findings) {
     const root = join(dir, 'install-settings-inspection');
     mkdirSync(root);
     await tar.x({ file: join(dir, 'package.tgz'), cwd: root });
-    const info = readInfo(join(dir, 'INFO'), findings, 'binary', Boolean(metadata.compose));
+    const info = readInfo(join(dir, 'INFO'), findings, 'binary', Boolean(metadata.compose), undefined, inspectPackageDependencies(metadata.dependencies, findings));
     const gateway = metadata.compose?.gateway ?? metadata.native_gateway;
     const m = { package: info.package, os_min_ver: info.os_min_ver, capabilities: {}, installSettings: settings, identityGateway: gateway };
     try {

package/dist/standalone/manifest.d.ts

@@ -1,3 +1,4 @@
+import { type PackageDependencies } from "./package-dependencies.js";
 import { type InstallSettings } from './install-settings.js';
 import { type WebLaunchMode } from "../contract/web-launch.js";
 import { type WebAPIProfiles } from "../runtime/webapi-profile.js";
@@ -51,6 +52,7 @@ export interface StandaloneManifest {
         commands: Record<string, import("../ctl/descriptor.js").Operation>;
     };
     metadata?: PackageMetadata;
+    dependencies?: PackageDependencies;
     root: string;
     package: string;
     version: string;

package/dist/standalone/manifest.js

@@ -1,3 +1,4 @@
+import { readPackageDependencies, packageDependencies, dependencyError } from "./package-dependencies.js";
 import { readInstallSettings } from './install-settings.js';
 import { auditGoRoutes } from './route-audit.js';
 import { BACKGROUND_WORKER_MAIN } from './background.js';
@@ -55,6 +56,7 @@ export const KNOWN_FIELDS = new Set([
     "capabilities",
     "i18n",
     "daemon",
+    "dependencies",
     "identity_gateway",
     "compose",
     "install",
@@ -247,6 +249,19 @@ function readManifest(raw, c) {
     const lifecycleTimeouts = timeoutOnly ? readLifecycleTimeouts(raw.daemon.timeouts, (e) => c.fail(e.code, e.message)) : undefined;
     const daemon = arches &&
         readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+    let dependencies;
+    try {
+        const explicit = readPackageDependencies(raw.dependencies);
+        if (backend) {
+            const effective = packageDependencies({ backend, daemon, dependencies: explicit });
+            if (explicit || effective.packages.length)
+                dependencies = effective;
+        }
+    }
+    catch (error) {
+        const problem = dependencyError(error);
+        c.fail(problem.code, problem.message);
+    }
     const gatewayRaw = isRecord(raw.identity_gateway) ? raw.identity_gateway : {};
     if (raw.compose !== undefined && isRecord(raw.ctl) && raw.ctl.enabled === true)
         c.fail("CTL_UNSUPPORTED_BACKEND", "Compose does not support automatic ctl descriptions; disable ctl.");
@@ -507,6 +522,7 @@ function readManifest(raw, c) {
         ...(rootOps ? { rootOps } : {}),
         ...(rootPrograms ? { rootPrograms } : {}),
         ...(daemon ? { daemon } : {}),
+        ...(dependencies ? { dependencies } : {}),
         ...(lifecycleTimeouts ? { lifecycleTimeouts } : {}),
         ...(identityGateway ? { identityGateway } : {}),
         ...(compose ? { compose } : {}),

package/dist/standalone/native-layout.d.ts

@@ -1,3 +1,4 @@
+import { type PackageDependencies } from "./package-dependencies.js";
 import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
 import { type Toolkit } from './toolkit.js';
@@ -21,6 +22,7 @@ type Binary = {
 };
 export interface NativeLayout {
     metadata?: PackageMetadata;
+    dependencies?: PackageDependencies;
     root: string;
     package: string;
     version: string;

package/dist/standalone/native-layout.js

@@ -1,3 +1,4 @@
+import { readPackageDependencies, dependencyInfo, inspectPackageDependencies } from "./package-dependencies.js";
 import { portalInfoFields } from "../portal/info.js";
 import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
@@ -106,13 +107,15 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible', 'portal']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible', 'portal', 'dependencies']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
         if (backend.kind !== 'native' || (m.privilege !== undefined && m.privilege !== 'none'))
             fail('backend.kind: native and package-only privilege required');
         m.privilege = 'none';
+        if (m.dependencies !== undefined)
+            m.dependencies = readPackageDependencies(m.dependencies);
         if (m.metadata !== undefined)
             m.metadata = validateMetadata(m.metadata);
         if (existsSync(join(root, 'compose.yaml')))
@@ -330,11 +333,12 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            const info = portalInfoFields([...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)], Boolean(m.portal));
+            const deps = dependencyInfo(m.dependencies ?? { packages: [] });
+            const info = portalInfoFields([...Object.entries(fields), ...(deps ? [["install_dep_packages", deps]] : []), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)], Boolean(m.portal));
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}), ...(m.portal ? { portal: m.portal } : {}) }));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, dependencies: m.dependencies ?? { packages: [] }, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}), ...(m.portal ? { portal: m.portal } : {}) }));
             const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
             return output;
@@ -351,9 +355,15 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors', 'portal']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors', 'portal', 'dependencies']);
         if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
+        const errors = [];
+        const dependencies = inspectPackageDependencies(inv.dependencies, errors);
+        if (errors.length)
+            fail(errors.join("; "));
+        if ((info.install_dep_packages ?? "") !== dependencyInfo(dependencies ?? { packages: [] }))
+            fail("INFO install_dep_packages differs from native layout dependencies");
         checkLayoutMetadata(dir, true, info.package);
         const actual = layoutFiles(payload);
         if (JSON.stringify(actual) !== JSON.stringify(inv.files))

package/dist/standalone/package-dependencies.d.ts

@@ -0,0 +1,17 @@
+import type { StandaloneManifest, StandaloneError } from "./manifest.js";
+export interface PackageDependency {
+    name: string;
+    min_version?: string;
+}
+export interface PackageDependencies {
+    packages: PackageDependency[];
+}
+/** Fixed INFO tokens, never shell expressions or dependency operators. */
+export declare function readPackageDependencies(value: unknown): PackageDependencies | undefined;
+/** Unversioned requirements accept a specified minimum; distinct minima conflict. */
+export declare function mergePackageDependencies(...groups: PackageDependency[][]): PackageDependency[];
+export declare function packageDependencies(manifest: Pick<StandaloneManifest, "backend" | "daemon" | "dependencies">): PackageDependencies;
+export declare function dependencyInfo(dependencies: PackageDependencies): string;
+/** Old build records have no field; new records must already be normalized. */
+export declare function inspectPackageDependencies(value: unknown, findings: string[]): PackageDependencies | undefined;
+export declare function dependencyError(error: unknown): StandaloneError;

package/dist/standalone/package-dependencies.js

@@ -0,0 +1,57 @@
+import { isDeepStrictEqual } from "node:util";
+const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const NAME = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
+const VERSION = /^\d+(?:\.\d+){0,3}(?:-\d+)?$/;
+/** Fixed INFO tokens, never shell expressions or dependency operators. */
+export function readPackageDependencies(value) {
+    if (value === undefined)
+        return undefined;
+    if (!record(value) || Object.keys(value).some(k => k !== "packages") || !Array.isArray(value.packages))
+        throw new Error("dependencies accepts only packages: an array of {name, min_version?}.");
+    const packages = value.packages.map((entry, i) => {
+        if (!record(entry) || Object.keys(entry).some(k => k !== "name" && k !== "min_version") ||
+            typeof entry.name !== "string" || !NAME.test(entry.name))
+            throw new Error(`dependencies.packages[${i}].name must start with a letter and contain only ASCII letters, digits, _, . or - (1-64 characters); only name and min_version are accepted.`);
+        if (entry.min_version !== undefined && (typeof entry.min_version !== "string" || entry.min_version.length > 64 || !VERSION.test(entry.min_version)))
+            throw new Error(`dependencies.packages[${i}].min_version must be a quoted numeric version with 1-4 components and an optional numeric -build (at most 64 characters).`);
+        return { name: entry.name, ...(entry.min_version !== undefined ? { min_version: entry.min_version } : {}) };
+    });
+    return { packages: mergePackageDependencies(packages) };
+}
+/** Unversioned requirements accept a specified minimum; distinct minima conflict. */
+export function mergePackageDependencies(...groups) {
+    const byName = new Map();
+    for (const dep of groups.flat()) {
+        const prev = byName.get(dep.name);
+        if (prev?.min_version !== undefined && dep.min_version !== undefined && prev.min_version !== dep.min_version)
+            throw new Error(`Conflicting min_version for package ${dep.name}: ${prev.min_version} and ${dep.min_version}. Use one identical minimum version.`);
+        byName.set(dep.name, { name: dep.name, ...(prev?.min_version !== undefined ? { min_version: prev.min_version } : dep.min_version !== undefined ? { min_version: dep.min_version } : {}) });
+    }
+    return [...byName.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
+export function packageDependencies(manifest) {
+    const node = "node" in manifest.backend ? manifest.backend.node : undefined;
+    const daemonNode = manifest.daemon?.node;
+    return { packages: mergePackageDependencies(readPackageDependencies(manifest.dependencies)?.packages ?? [], node ? [{ name: node.package }] : [], daemonNode ? [{ name: daemonNode.package, ...(daemonNode.min_version ? { min_version: daemonNode.min_version } : {}) }] : []) };
+}
+export function dependencyInfo(dependencies) {
+    return dependencies.packages.map(d => d.name + (d.min_version === undefined ? "" : `>=${d.min_version}`)).join(":");
+}
+/** Old build records have no field; new records must already be normalized. */
+export function inspectPackageDependencies(value, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const normalized = readPackageDependencies(value);
+        if (!isDeepStrictEqual(normalized, value))
+            throw new Error("dependencies must be sorted, deduplicated and normalized.");
+        return normalized;
+    }
+    catch (error) {
+        findings.push(`DEPENDENCIES_INVALID build metadata dependencies: ${error.message}`);
+        return { packages: [] };
+    }
+}
+export function dependencyError(error) {
+    return { code: "STANDALONE_DEPENDENCIES_INVALID", message: error.message };
+}

package/dist/standalone/spk.js

@@ -1,3 +1,4 @@
+import { packageDependencies, dependencyInfo } from "./package-dependencies.js";
 import { settingsInstallSteps, settingsConfig } from './install-settings.js';
 import { backupConfig, backupHookProblem, backupRecord, renderBackupScripts, BACKUP_PAYLOAD_DIR, BACKUP_SCRIPTS_DIR, BACKUP_SCRIPT_MODES } from './hyper-backup.js';
 import { nativeGatewaySupported, nativeGatewaySdk, renderNativeGatewayConfig, NATIVE_GATEWAY_CONFIG, legacyGatewayNotice, gatewayEntryPath } from './native-gateway.js';
@@ -31,7 +32,7 @@ import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { writeComposePayload } from "./compose.js";
-import { copyDaemonPayload, daemonSdkVersion, nodeDependency } from "./daemon.js";
+import { copyDaemonPayload, daemonSdkVersion } from "./daemon.js";
 import { DAEMON_INGRESS_CONFIG, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { gatewayCgiPaths, gatewayExternalAccess, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
@@ -244,6 +245,7 @@ export async function assembleStandaloneSpk(options) {
             .digest("hex");
         writeFile(join(staging, "sdk-package.json"), JSON.stringify({
             schema: 2,
+            dependencies: packageDependencies(manifest),
             ...(moduleVersion ? { ui_module: moduleVersion } : {}),
             ...(manifest.installSettings ? { installSettings: manifest.installSettings } : {}),
             ...(backup ? { hyperBackup: backupRecord(backup) } : {}),
@@ -389,11 +391,9 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
             "adminurl",
             gatewayEntryPath(manifest),
         ]);
-    const backend = manifest.backend;
-    if (isBridgeBackend(backend) && backend.node)
-        fields.push(["install_dep_packages", backend.node.package]);
-    if (manifest.daemon?.node)
-        fields.push(["install_dep_packages", nodeDependency(manifest.daemon.node)]);
+    const dependencies = dependencyInfo(packageDependencies(manifest));
+    if (dependencies)
+        fields.push(["install_dep_packages", dependencies]);
     fields.push(...metadataInfoFields(manifest.metadata));
     // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
     if (manifest.daemon || manifest.compose || manifest.capabilities.jobs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.33.0",
+    "@synopackageland/templates": "~0.34.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.36.0 installs templates through `~0.32.0`. A templates patch needs only a
+The CLI installs templates through `~0.34.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -24,7 +24,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.35.0 and CLI 0.37.0 for App entry enforcement. Declare every App method
+Use SDK/App 0.36.0 and CLI 0.38.0 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
@@ -53,14 +53,26 @@ retaining it. Check child readiness and retry bind conflicts: release-to-bind
 is inherently racy. Never replace these with custom listeners or fixed ports.
 
 An optional root helper is a separately approved executor payload.
-`ipc.ServePeerUnix(ctx, path, ipc.PeerPolicy{UID: uid, GID: gid}, handler)`
-supports a bounded raw JSON control protocol on a root-owned 0660 socket under
+`ipc.StartPeerUnix(ctx, path, ipc.PeerPolicy{UID: uid, GID: gid}, handler)`
+synchronously returns a peer-server handle for a bounded raw JSON control
+protocol on a root-owned 0660 socket under
 `/var/run/synopkgland/<package>/`. The SDK authenticates exactly the selected
 UID with SO_PEERCRED; the handler validates bounded frames and current
 authorization. `ipc.DialPeerUnix` verifies root ownership, protected ancestors,
 mode and server UID zero. The server requires root AND the helper's explicit
 `ipc.executorTier=executor` linker binding. Bind packageID in custom builds.
 Generated CGI/workers bind tier `none`; never launch or install them as root.
+The handler owns its verified conn even after returning; close it when done.
+Stop and reap a supervised child on its owning OS thread, call the handle's
+`StopAccepting`, write the complete final ACK, then retain the conn until
+process exit. StopAccepting waits for listener/socket cleanup while keeping
+accepted peers and handler contexts alive. `Wait` waits for admission stop,
+not handlers or retained peers. `Close` or context cancellation cancels handler
+contexts and closes all peers, including after StopAccepting; keep the context
+alive through the ACK. Eight slots cover both retained conns and still-running
+callbacks; set explicit deadlines for exchanges beyond the initial five seconds.
+`ServePeerUnix` is the blocking form that closes a peer on callback return.
+Use direct constructor calls; aliases are rejected by the audit.
 The transport does not provide installation, approval or privilege elevation.
 
 Audit every custom-hook Go payload with
@@ -87,6 +99,23 @@ Never install, uninstall, publish or modify NAS data without task authorization.
 
 Native projects use schema 2 capabilities and `--with files,jobs,login,root-ops,delegate`; use `add` for existing projects. Prefer `check --json`, `build --json`, `inspect <spk> --json`, `deploy --dry-run --json`, and `status --host <profile> --json` for structured results. Read the conflict policy in reference/create.md before adding overlays.
 
+For DSM Package Center dependencies independent of the App language, declare
+`dependencies: {packages: [{name: Node.js_v22, min_version: "22.19.0"}]}` in
+`dsm-package.yaml`; `min_version` is optional. Names are 1-64 ASCII letters,
+digits, `_`, `.` or `-`, starting with a letter. Versions are quoted numeric
+strings with 1-4 dotted components and optional numeric `-build` (64 characters
+maximum); other keys and unsafe INFO syntax fail validation. Requirements
+merge with a Node backend or `daemon.node`, sort and deduplicate; two distinct
+specified minimum versions for one package fail. `check --json` reports them;
+build records them and `inspect` verifies exact agreement with INFO. This
+works with native layouts and Compose too (host packages are not container
+mounts). It leaves daemon exec/args/env/supervision unchanged. Use
+`daemon.node` only for a JavaScript daemon: it replaces exec with the Node
+launcher. For a Go daemon spawning Node children, keep the Go exec and use
+`dependencies.packages`; call `/var/packages/Node.js_v22/target/usr/local/bin/node`.
+Any dependency's target is `/var/packages/<name>/target`; no env vars or PATH
+entries are injected, and the declaration grants no private-data access.
+
 Read reference/portal.md before declaring or changing a DSM Application Portal alias (`add portal`); DSM owns the saved setting; DSM 7.2-64570+ supports schema-2 Portal without an executor, while DSM 7.1 requires executor registration. Read reference/files.md and reference/identity.md for capability boundaries. RootOps and delegate share one-time protected executor boot/control setup with digest approval. Existing native products can explicitly use the separate native runtimes in @synopackageland/sdk/native; do not mix its tasks with generated executor capabilities. App sessions alone do not grant NAS file authority.
 
 Read [reference/lifecycle.md](reference/lifecycle.md) before editing `dsm-scripts/` (preinst, postinst, preupgrade, postupgrade, preuninst, postuninst, start-stop-status): the SDK runs them inside its generated scripts as the package account; never add root work or repeat SDK steps there.