@synopackageland/cli 0.41.12 → 0.42.0

package/dist/host/package-commands.js

@@ -122,6 +122,8 @@ export async function installPackage(spec, options = {}, connection) {
             if (installed.has(item.package) &&
                 compareVersions(item.version, installed.get(item.package)) < 0)
                 throw fail("PACKAGE_DOWNGRADE_REFUSED", `Refusing downgrade of ${item.package}`, "Choose the installed version or a newer release");
+        const changes = plan.filter((item) => !installed.has(item.package) ||
+            compareVersions(item.version, installed.get(item.package)) !== 0);
         const publicPlan = {
             host: nas.name,
             target,
@@ -130,21 +132,30 @@ export async function installPackage(spec, options = {}, connection) {
                 package: item.package,
                 version: item.version,
                 size: item.size,
-                action: installed.has(item.package) ? "upgrade" : "install",
+                action: !installed.has(item.package)
+                    ? "install"
+                    : compareVersions(item.version, installed.get(item.package)) === 0
+                        ? "none"
+                        : "upgrade",
                 ...(item.package === root.package && report
                     ? { signed: report.signed }
                     : {}),
             })),
             parameters: Object.keys(options.param ?? {}),
+            ...(!changes.length
+                ? { message: `${root.package}@${root.version} is already up to date; no package changes required.` }
+                : {}),
         };
         if (options.dryRun)
             return { dryRun: true, ...publicPlan };
+        if (!changes.length)
+            return publicPlan;
         await requireAdministrator(nas);
-        await confirm(`Install ${plan.map((e) => e.package + "@" + e.version).join(", ")}`, options.yes);
+        await confirm(`Install ${changes.map((e) => e.package + "@" + e.version).join(", ")}`, options.yes);
         // Download, verify and inspect the entire plan before the first NAS write.
         const files = new Map();
         const images = new Map();
-        for (const entry of plan) {
+        for (const entry of changes) {
             let file = localFile;
             if (!local || entry.package !== root.package) {
                 const response = await fetchPackageSource(entry.link);
@@ -163,7 +174,7 @@ export async function installPackage(spec, options = {}, connection) {
             files.set(entry.package, file);
             images.set(entry.package, containerImageReferences(checked));
         }
-        for (const entry of plan)
+        for (const entry of changes)
             await installPackageFromLocalSpk({
                 dsmOrigin: nas.session.origin,
                 cookieHeader: nas.session.cookie,

package/dist/runtime/sdk-source.d.ts

@@ -1,5 +1,7 @@
 export { goPrivateCovers } from './go-env.js';
 import { type ExecutorManifest } from './sdk-executor-manifest.js';
+/** Pinned SDK for CLI-owned controllers and Compose planning; App pins take precedence. */
+export declare const DEFAULT_SDK_VERSION = "0.41.1";
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";

package/dist/runtime/sdk-source.js

@@ -4,6 +4,8 @@ import { readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
+/** Pinned SDK for CLI-owned controllers and Compose planning; App pins take precedence. */
+export const DEFAULT_SDK_VERSION = '0.41.1';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;

package/dist/spk/archive-inventory.d.ts

@@ -0,0 +1,9 @@
+export interface ArchiveIssue {
+    kind: 'path' | 'type' | 'duplicate' | 'collision' | 'unexpected';
+    path: string;
+    type: string;
+    message: string;
+}
+export declare const formatArchiveIssue: (issue: ArchiveIssue) => string;
+/** Scan names and types before extraction can merge or replace archive members. */
+export declare function archiveInventory(file: string, outer?: boolean, allowPayloadLinks?: boolean): Promise<ArchiveIssue[]>;

package/dist/spk/archive-inventory.js

@@ -0,0 +1,65 @@
+import * as tar from 'tar';
+import { createReadStream } from 'node:fs';
+import { KNOWN_TOP_LEVEL } from './dsm-spec.js';
+export const formatArchiveIssue = (issue) => `SPK_ARCHIVE_${issue.kind.toUpperCase()} ${issue.message}`;
+/** Scan names and types before extraction can merge or replace archive members. */
+export async function archiveInventory(file, outer = false, allowPayloadLinks = false) {
+    const findings = [];
+    const names = new Map();
+    const spellings = new Map();
+    const scan = (entry) => {
+        const raw = entry.path;
+        const add = (kind, message) => findings.push({ kind, path: raw, type: entry.type, message });
+        const path = raw.replace(/^\.\//, '').replace(/\/$/, '');
+        if (!path || path === '.') {
+            if (entry.type !== 'Directory')
+                add('path', `invalid root entry: ${raw}`);
+            return;
+        }
+        const parts = path.split('/');
+        if (raw.startsWith('/') || path.includes('\\') || parts.some(p => !p || p === '.' || p === '..') || /[\x00-\x1f\x7f]/.test(path))
+            add('path', `noncanonical archive path: ${raw}`);
+        if (!['File', 'Directory', ...(allowPayloadLinks ? ['SymbolicLink', 'Link'] : [])].includes(entry.type))
+            add('type', `unexpected ${entry.type} entry: ${raw}`);
+        const previous = names.get(path);
+        if (previous)
+            add('duplicate', `repeated archive path: ${raw}`);
+        names.set(path, { path, type: entry.type });
+        // Include implicit parent directories: Bin/a and bin/b collide too.
+        for (let i = 1; i <= parts.length; i++) {
+            const prefix = parts.slice(0, i).join('/');
+            const folded = prefix.normalize('NFC').toLowerCase();
+            const spelling = spellings.get(folded);
+            if (spelling !== undefined && spelling !== prefix)
+                add('collision', `case or Unicode alias: ${spelling} and ${prefix}`);
+            spellings.set(folded, prefix);
+        }
+        if (outer && !KNOWN_TOP_LEVEL.includes(parts[0]))
+            add('unexpected', `unknown SPK metadata entry: ${raw}`);
+        else if (outer) {
+            const directory = ['scripts', 'conf', 'WIZARD_UIFILES'].includes(parts[0]);
+            if (!directory && (parts.length > 1 || entry.type === 'Directory') ||
+                directory && parts.length === 1 && entry.type === 'File')
+                add('type', `SPK metadata has the wrong file or directory role: ${raw}`);
+        }
+    };
+    const parser = new tar.Parser({ strict: true, onReadEntry(entry) { scan(entry); entry.resume(); } });
+    // tar.t silently drops unknown type flags; they are still archive members.
+    parser.on('ignoredEntry', scan);
+    const input = createReadStream(file);
+    await new Promise((resolve, reject) => {
+        input.on('error', reject);
+        parser.on('error', error => { input.destroy(); reject(error); });
+        parser.on('end', resolve);
+        input.pipe(parser);
+    });
+    for (const [path] of names) {
+        const parts = path.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            const parent = names.get(parts.slice(0, i).join('/'));
+            if (parent && parent.type !== 'Directory')
+                findings.push({ kind: 'collision', path, type: parent.type, message: `file used as a directory: ${parent.path}` });
+        }
+    }
+    return findings;
+}

package/dist/spk/check-payload.js

@@ -2,6 +2,7 @@ import { openSync, readSync, closeSync } from "node:fs";
 import { posix } from "node:path";
 import * as tar from "tar";
 import { ARCH_ELF_MACHINE } from "./dsm-spec.js";
+import { archiveInventory, formatArchiveIssue } from './archive-inventory.js';
 const XZ_MAGIC = Buffer.from([0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00]);
 const ELF_MAGIC = Buffer.from("\x7fELF", "latin1");
 const MAX_TEXT = 1024 * 1024;
@@ -145,6 +146,14 @@ export async function checkPayload(payloadPath, info, findings) {
         return;
     }
     const dirs = uiDirs(info.dsmuidir);
+    try {
+        for (const issue of await archiveInventory(payloadPath, false, true)) {
+            if (issue.kind === 'path' && (issue.path.startsWith('/') || posix.normalize(issue.path).split('/')[0] === '..'))
+                continue;
+            findings.add('SPK_ARCHIVE_INVALID', formatArchiveIssue(issue), at(issue.path));
+        }
+    }
+    catch { /* scanPayload reports unreadable archives */ }
     const configs = new Set(dirs.map((dir) => posix.join(dir, "config")));
     const files = await scanPayload(payloadPath, (path) => configs.has(path) || (/\/texts\/[^/]+\/strings$/.test(path) && dirs.some((dir) => path.startsWith(`${dir}/`))), findings);
     if (!files)

package/dist/spk/rules.d.ts

@@ -11,6 +11,11 @@ export interface SpkRule {
     source: string;
 }
 export declare const SPK_RULES: {
+    readonly SPK_ARCHIVE_INVALID: {
+        readonly severity: "error";
+        readonly description: "An archive has noncanonical or colliding names, repeated entries, or unsupported entry types.";
+        readonly source: "Archive inventory";
+    };
     readonly SPK_NOT_TAR: {
         readonly severity: "error";
         readonly description: "The file is not a readable tar archive; an SPK is an uncompressed tar.";

package/dist/spk/rules.js

@@ -1,5 +1,6 @@
 const GUIDE = "DSM 7 Developer Guide";
 export const SPK_RULES = {
+    SPK_ARCHIVE_INVALID: { severity: "error", description: "An archive has noncanonical or colliding names, repeated entries, or unsupported entry types.", source: "Archive inventory" },
     SPK_NOT_TAR: { severity: "error", description: "The file is not a readable tar archive; an SPK is an uncompressed tar.", source: `${GUIDE}: Package Structure` },
     SPK_ENTRY_UNSAFE: { severity: "error", description: "A path inside the SPK escapes the archive root (an absolute path or ..), or is a link.", source: `${GUIDE}: Package Structure` },
     SPK_ENTRY_UNKNOWN: { severity: "warning", description: "The SPK top level has a file or directory the guide does not list (file names are case-sensitive).", source: `${GUIDE}: Package Structure` },

package/dist/spk/validate-spk.js

@@ -8,6 +8,7 @@ import { checkMetadata } from "./check-metadata.js";
 import { checkPayload } from "./check-payload.js";
 import { KNOWN_TOP_LEVEL } from "./dsm-spec.js";
 import { Findings } from "./findings.js";
+import { archiveInventory, formatArchiveIssue } from './archive-inventory.js';
 /** Outer files other than package.tgz are metadata; anything larger is not read. */
 const MAX_OUTER_FILE = 16 * 1024 * 1024;
 const TOP_LEVEL = new Set(KNOWN_TOP_LEVEL);
@@ -17,6 +18,17 @@ export async function validateSpk(spkPath) {
     const dir = mkdtempSync(join(tmpdir(), "syno-validate-spk-"));
     let info = {};
     try {
+        try {
+            for (const issue of await archiveInventory(spkPath, true)) {
+                // The existing outer rules already report escaping names and links.
+                if (issue.kind === 'unexpected' || issue.kind === 'type' && ['SymbolicLink', 'Link'].includes(issue.type))
+                    continue;
+                if (issue.kind === 'path' && (issue.path.startsWith('/') || issue.path.split('/').includes('..')))
+                    continue;
+                findings.add('SPK_ARCHIVE_INVALID', formatArchiveIssue(issue), issue.path);
+            }
+        }
+        catch { /* readOuter reports unreadable archives */ }
         const outer = await readOuter(spkPath, dir, findings);
         if (outer) {
             checkOuterEntries(outer.entries, findings);

package/dist/standalone/compose.js

@@ -9,7 +9,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { parse } from "yaml";
-import { templateSdkVersion } from "../template-paths.js";
+import { DEFAULT_SDK_VERSION } from "../runtime/sdk-source.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { sdkSource } from "../runtime/sdk-source.js";
 import { readDaemon } from "./daemon.js";
@@ -106,10 +106,10 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
             return invalid("compose.host_udp allows at most 32 distinct ports 1024-65535 with lowercase purpose labels of 1-64 characters.", "COMPOSE_HOST_UDP_INVALID");
         hostUdp = [...value.host_udp].map(l => ({ port: l.port, purpose: l.purpose })).sort((a, b) => a.port - b.port);
     }
-    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? templateSdkVersion());
+    const sdk = typeof value.sdk === "string" ? value.sdk : (context.sdk ?? DEFAULT_SDK_VERSION);
     let targets = {};
     if (value.helpers !== undefined) {
-        const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail);
+        const d = readDaemon({ exec: "_sso/gateway", targets: value.helpers }, root, arches, fail, context.package);
         if (!d)
             return;
         targets = d.targets;
@@ -309,7 +309,7 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     return { ...m, compose };
 }
 export function composeInputs(root, file, envFile) {
-    const result = spawnSync(planner(templateSdkVersion()), [
+    const result = spawnSync(planner(DEFAULT_SDK_VERSION), [
         "sources",
         "--root",
         root,

package/dist/standalone/daemon-ingress.d.ts

@@ -1,13 +1,14 @@
 import type { StandaloneError } from "./manifest.js";
 /** `daemon.ingress`: one path in DSM's own server blocks, proxied to the daemon. */
 export interface DaemonIngress {
-    /** `/<name>/`, served on DSM's ports and custom domains, so same-origin with DSM. */
+    /** `/synopkgland/<package>/`, with the exact manifest package ID. */
     path: string;
     /** nginx proxy_read_timeout and proxy_send_timeout in seconds. */
     timeout: number;
 }
 export declare const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
-export declare function readDaemonIngress(value: unknown, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
+export declare const daemonIngressPath: (packageId: string) => string;
+export declare function readDaemonIngress(value: unknown, packageId: string | undefined, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
 /** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
 export declare function daemonIngressMinDsmProblem(osMinVer: string | undefined): string | undefined;
 export declare const daemonIngressSocket: (pkg: string) => string;

package/dist/standalone/daemon-ingress.js

@@ -1,9 +1,7 @@
 import { isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
-import { RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
 export const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
-const PATH = /^\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/$/;
-const reserved = (path) => RESERVED_PORTAL_ALIASES.includes(path.slice(1, -1));
-export function readDaemonIngress(value, fail) {
+export const daemonIngressPath = (packageId) => `/synopkgland/${packageId}/`;
+export function readDaemonIngress(value, packageId, fail) {
     if (value === undefined)
         return undefined;
     const v = value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
@@ -11,14 +9,14 @@ export function readDaemonIngress(value, fail) {
     if (!v ||
         Object.keys(v).some((k) => k !== "path" && k !== "timeout") ||
         typeof v.path !== "string" ||
-        !PATH.test(v.path) ||
-        reserved(v.path) ||
+        !packageId || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageId) ||
+        v.path !== daemonIngressPath(packageId) ||
         !Number.isInteger(timeout) ||
         timeout < 1 ||
         timeout > 3600) {
         fail({
             code: "STANDALONE_DAEMON_INGRESS_INVALID",
-            message: `daemon.ingress needs path "/<name>/" (lowercase letters, digits and -, not a DSM path such as /webapi/) and an optional timeout of 1–3600 seconds.`,
+            message: `daemon.ingress.path must be exactly /synopkgland/<package>/ with the manifest package ID (case-sensitive), and timeout must be 1–3600 seconds`,
         });
         return undefined;
     }
@@ -31,9 +29,14 @@ export function daemonIngressMinDsmProblem(osMinVer) {
     return `daemon.ingress needs os_min_ver ${PORTAL_MIN_DSM} or later; os_min_ver is "${osMinVer ?? ""}". DSM 7.1 rejects the unsigned web-config worker that adds the path to DSM's nginx. Raise os_min_ver or remove daemon.ingress.`;
 }
 export const daemonIngressSocket = (pkg) => `/tmp/synopkgland-ingress-${pkg}.sock`;
+function checkedIngressPath(pkg, ingress) {
+    if (!readDaemonIngress(ingress, pkg, () => { }))
+        throw new Error('Invalid daemon ingress: use /synopkgland/<package>/ with the exact package ID');
+    return daemonIngressPath(pkg);
+}
 /** What the daemon learns: where to listen and which path prefix it serves. */
 export function ingressEnv(pkg, ingress) {
-    return { SYNOPKGLAND_INGRESS_PATH: ingress.path, SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
+    return { SYNOPKGLAND_INGRESS_PATH: checkedIngressPath(pkg, ingress), SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
 }
 export function daemonIngressResource() {
     return { "nginx-static-config": { enable: [{ type: "dsm", relpath: DAEMON_INGRESS_CONFIG }] } };
@@ -43,7 +46,7 @@ export function daemonIngressResource() {
  * unbuffered; nginx replaces any client X-Real-IP with the peer address.
  */
 export function renderDaemonIngressConfig(pkg, ingress) {
-    return `location ^~ ${ingress.path} {
+    return `location ^~ ${checkedIngressPath(pkg, ingress)} {
     proxy_pass http://unix:${daemonIngressSocket(pkg)}:;
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;

package/dist/standalone/daemon-restart.d.ts

@@ -7,7 +7,7 @@ export interface DaemonRestart {
     max_attempts: number;
     window_seconds: number;
 }
-/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+/** Normalize explicit manifest policies; omission uses the SDK controller default. */
 export declare function readDaemonRestart(value: unknown, fail: (error: StandaloneError) => void): DaemonRestart | undefined;
 export declare function daemonRestartSdkSupported(sdk: string): boolean;
 export declare function daemonRestartSdkProblem(sdk: string): string | undefined;

package/dist/standalone/daemon-restart.js

@@ -7,7 +7,7 @@ let validator;
 function restartValidator() {
     return validator ??= new Ajv().compile(JSON.parse(readFileSync(new URL("../../schema/daemon-restart.v1.schema.json", import.meta.url), "utf8")));
 }
-/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+/** Normalize explicit manifest policies; omission uses the SDK controller default. */
 export function readDaemonRestart(value, fail) {
     if (value === undefined)
         return undefined;
@@ -35,7 +35,7 @@ export function daemonRestartSdkSupported(sdk) {
 }
 export function daemonRestartSdkProblem(sdk) {
     if (!daemonRestartSdkSupported(sdk))
-        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the templates supplying the default controller SDK before rebuilding.`;
+        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the CLI supplying the default controller SDK before rebuilding.`;
     return undefined;
 }
 /** Development overrides must contain the decoder as well as the restart code. */
@@ -50,6 +50,6 @@ export function requireDaemonRestartSource(dir, sdk, policy) {
     catch { /* Fail below before compiling or packaging a mismatched runtime. */ }
     const problem = daemonRestartSdkProblem(sdk);
     if (problem || !/\bRestart\s+\*restartPolicy\s+`json:"restart,omitempty"`/.test(main) ||
-        !/^func normalizeRestart\(/m.test(restart) || !/^type restartBudget struct\s*\{/m.test(restart))
+        !/^func normalizeRestart\(/m.test(restart) || !/^type restartPolicy struct\s*\{/m.test(restart))
         throw new StandaloneBuildError("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem ?? `Selected SDK ${sdk} source does not support daemon.restart; use matching SDK ${DAEMON_RESTART_MIN_SDK} or later sources, including for a local development override.`);
 }

package/dist/standalone/daemon.d.ts

@@ -5,7 +5,7 @@ import { type DaemonRestart } from "./daemon-restart.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
-    /** Optional bounded recovery; omitted means off. SDK 0.26.0 or later. */
+    /** Optional bounded recovery; omission uses the SDK controller default. SDK 0.26.0 or later. */
     restart?: DaemonRestart;
     /** Fixed foreground executable relative to daemon/payload; empty for a backend daemon. */
     exec: string;
@@ -53,7 +53,7 @@ export declare const token: (v: unknown) => v is string;
 export declare const envKey: (k: string) => boolean;
 /** A relative path to a fixed executable, without `.` or `..` parts. */
 export declare const relativeExec: (v: unknown) => v is string;
-export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void, packageId: string | undefined): Daemon | undefined;
 export declare function daemonSdkVersion(manifest: Pick<StandaloneManifest, "backend" | "identityGateway">): string;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/daemon.js

@@ -5,7 +5,7 @@ import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync,
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
-import { templateSdkVersion } from "../template-paths.js";
+import { DEFAULT_SDK_VERSION } from "../runtime/sdk-source.js";
 import { checkCgiBinary } from "./binary.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
@@ -65,7 +65,7 @@ export const relativeExec = (v) => typeof v === "string" &&
     !v.split("/").some((p) => p === "." || p === "..");
 /** A Node entry such as `server.mjs` or `dist/main.js`, inside the payload. */
 const relativeEntry = (v) => typeof v === "string" && relativeExec(`_/${v}`);
-export function readDaemon(value, root, arches, fail) {
+export function readDaemon(value, root, arches, fail, packageId) {
     if (value === undefined)
         return undefined;
     const invalid = () => {
@@ -126,10 +126,10 @@ export function readDaemon(value, root, arches, fail) {
     const node = readDaemonNode(value.node, fail);
     if (value.node !== undefined && !node)
         return undefined;
-    const ingress = readDaemonIngress(value.ingress, fail);
+    const ingress = readDaemonIngress(value.ingress, packageId, fail);
     if (value.ingress !== undefined && !ingress)
         return undefined;
-    if (ingress && Object.keys(env).some((key) => key in ingressEnv("", ingress)))
+    if (ingress && Object.keys(env).some((key) => key in ingressEnv(packageId, ingress)))
         return invalid();
     if (backend && node && Object.keys(env).some((key) => key in backendNodeEnv()))
         return invalid();
@@ -172,7 +172,7 @@ function readDaemonNode(value, fail) {
 export function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
-        templateSdkVersion();
+        DEFAULT_SDK_VERSION;
 }
 export function daemonConfig(manifest) {
     const { exec, args, uninstall_args, env, timeouts, restart } = manifest.compose

package/dist/standalone/inspect-bridge.d.ts

@@ -1,8 +1,10 @@
+import type { EntryMode } from './manifest.js';
 type Payload = Array<{
     path: string;
     mode: string;
 }>;
 export interface BridgeJson {
+    access?: EntryMode;
     runtime?: string;
     entry?: string;
     methods?: string[];
@@ -22,7 +24,7 @@ export interface BridgeJson {
  * permissions.json by digest, the App lives in target/app (never under ui/),
  * and its entry, SDK and dependencies are in the package.
  */
-export declare function checkBridgeApp(dir: string, backend: string, info: Record<string, string>, payload: Payload, findings: string[]): Promise<BridgeJson | undefined>;
+export declare function checkBridgeApp(dir: string, backend: string, info: Record<string, string>, payload: Payload, findings: string[], entry?: EntryMode): Promise<BridgeJson | undefined>;
 /** root and delegate reach the package's executor; delegate pins the one this SPK ships. */
 export declare function checkBridgeExecutor(bridge: BridgeJson, executor: {
     executorDigest: string;

package/dist/standalone/inspect-bridge.js

@@ -7,6 +7,7 @@ import { ELF_MACHINE } from "./binary.js";
 import { NODE_SDK_PACKAGE } from "./bridge-app.js";
 import { BRIDGE_JSON, bridgeManifestProblems, PYTHON_VENDOR_DIR } from "./bridge-json.js";
 import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
+import { parseApiPermissions } from './api-permissions.js';
 /** Files that belong in target/app only: DSM serves everything under ui/ to the browser. */
 const APP_ONLY = [`/${BRIDGE_JSON}`, "/permissions.json", `/${PYTHON_VENDOR_DIR}/synopkgland_app/`, `/node_modules/${NODE_SDK_PACKAGE}/`];
 /**
@@ -14,7 +15,7 @@ const APP_ONLY = [`/${BRIDGE_JSON}`, "/permissions.json", `/${PYTHON_VENDOR_DIR}
  * permissions.json by digest, the App lives in target/app (never under ui/),
  * and its entry, SDK and dependencies are in the package.
  */
-export async function checkBridgeApp(dir, backend, info, payload, findings) {
+export async function checkBridgeApp(dir, backend, info, payload, findings, entry) {
     const paths = new Set(payload.map(entry => entry.path));
     for (const path of payload.map(entry => `/${entry.path}`).filter(path => path.startsWith("/ui/") && APP_ONLY.some(name => path.includes(name)))) {
         findings.push(`BRIDGE_APP_IN_UI ${path.slice(1)} is an App file and must not be placed in ui/ (DSM serves it directly to the browser)`);
@@ -31,6 +32,8 @@ export async function checkBridgeApp(dir, backend, info, payload, findings) {
         return undefined;
     }
     const bridge = JSON.parse(text);
+    if (bridge.access !== entry)
+        findings.push('BRIDGE_ACCESS_MISMATCH app/bridge.json access differs from sdk-package.json entry');
     if (bridge.runtime !== backend)
         findings.push(`BRIDGE_MANIFEST_INVALID the runtime "${bridge.runtime}" in app/${BRIDGE_JSON} differs from the backend "${backend}" in sdk-package.json`);
     checkEntry(app, bridge, info, payload, findings);
@@ -82,10 +85,10 @@ function checkEntry(app, bridge, info, payload, findings) {
 function checkPermissions(bytes, bridge, findings) {
     let methods;
     try {
-        methods = Object.keys(JSON.parse(bytes.toString("utf8")).methods ?? {});
+        methods = Object.keys(parseApiPermissions(bytes).methods);
     }
     catch {
-        findings.push("BRIDGE_PERMISSIONS app/permissions.json is not JSON");
+        findings.push("BRIDGE_PERMISSIONS app/permissions.json must be a valid bounded method policy with default administrators");
         return;
     }
     const unlisted = methods.filter(method => !bridge.methods?.includes(method));

package/dist/standalone/inspect-spk.js

@@ -14,6 +14,7 @@ import { readComposeApp, composeSource, dsmComposeProblem, COMPOSE_READINESS_LIM
 import { createHash } from "node:crypto";
 import { inspectNativeLayout } from "./native-layout.js";
 import { checkBridgeApp, checkBridgeExecutor } from "./inspect-bridge.js";
+import { archiveInventory, formatArchiveIssue } from '../spk/archive-inventory.js';
 import { inspectExecutor, inspectExecutorAnchor, } from "../runtime/executor-inspect.js";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { sdkScriptOf, unwrapAppScripts } from "./app-scripts.js";
@@ -65,8 +66,15 @@ export async function inspectStandaloneSpk(spkPath) {
 export async function inspectSpk(spkPath, expectedKind) {
     const dir = mkdtempSync(join(tmpdir(), "syno-inspect-spk-"));
     try {
+        const findings = (await archiveInventory(spkPath, true)).map(formatArchiveIssue);
+        if (findings.length)
+            return { signed: false, payload: [], findings, capabilities: [] };
         await tar.x({ file: spkPath, cwd: dir });
-        const findings = [];
+        if (existsSync(join(dir, 'package.tgz'))) {
+            findings.push(...(await archiveInventory(join(dir, 'package.tgz'))).map(formatArchiveIssue));
+            if (findings.length)
+                return { signed: existsSync(join(dir, 'syno_signature.asc')), payload: [], findings, capabilities: [] };
+        }
         if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
             let dependencies;
             try {
@@ -240,7 +248,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             }
         }
         const bridge = compiledKind && kind !== "native-go"
-            ? await checkBridgeApp(dir, metadata.backend, info, payload, findings)
+            ? await checkBridgeApp(dir, metadata.backend, info, payload, findings, metadata.entry)
             : undefined;
         if (dependencies && bridge?.node?.package && !dependencies.packages.some(d => d.name === bridge.node.package))
             findings.push("DEPENDENCIES_INVALID build metadata dependencies omit the Node backend package.");
@@ -996,7 +1004,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
             timeouts: config.timeouts,
             restart: config.restart,
             targets: { x86_64: "payload" },
-        }, dir, ["x86_64"], () => { });
+        }, dir, ["x86_64"], () => { }, info.package);
         if (!daemon)
             throw new Error("invalid config");
         // The packaged config already carries the launcher argv; only the launcher itself is checked here.
@@ -1280,7 +1288,7 @@ async function recoverNativeGateway(dir, value, info, findings) {
 function recoverDaemonNode(value, findings) {
     if (value === undefined)
         return undefined;
-    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { });
+    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { }, undefined);
     if (!daemon?.node || !isDeepStrictEqual(daemon.node, value)) {
         findings.push("DAEMON_NODE_INVALID sdk-package.json daemon_node is not a Node.js package declaration build writes");
         return undefined;
@@ -1291,7 +1299,7 @@ async function recoverDaemonIngress(dir, value, info, paths, findings) {
     if (value === undefined)
         return undefined;
     try {
-        const ingress = readDaemonIngress(value, () => { });
+        const ingress = readDaemonIngress(value, info.package, () => { });
         if (!ingress || !isDeepStrictEqual(ingress, value))
             throw new Error("invalid ingress record");
         const minDsm = daemonIngressMinDsmProblem(info.os_min_ver);
@@ -1369,10 +1377,18 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
         findings.push("conf/privilege is not JSON");
         return;
     }
+    if (!privilege || typeof privilege !== 'object' || Array.isArray(privilege)) {
+        findings.push('conf/privilege must be a JSON object');
+        return;
+    }
     const defaults = privilege.defaults;
     if (defaults?.["run-as"] !== "package") {
         findings.push('conf/privilege defaults.run-as must be "package"');
     }
+    if (Object.keys(privilege).some(key => key !== 'defaults') || !defaults ||
+        Object.keys(defaults).some(key => key !== 'run-as')) {
+        findings.push('conf/privilege must contain only defaults.run-as: package');
+    }
     for (const key of ["tool", "ctrl-script", "executable", "join-groupname"]) {
         if (key in privilege) {
             findings.push(`conf/privilege requires ${key} (root or extra group privileges)`);
@@ -1624,8 +1640,12 @@ function checkScripts(dir, findings) {
             for (const name of readdirSync(path))
                 scan(`${relative}/${name}`);
         }
-        else if (ROOT_SCRIPT_HINTS.some((pattern) => pattern.test(readFileSync(path, "utf8")))) {
-            findings.push(`${relative} tries to gain root (sudo, chown root or setuid)`);
+        else {
+            if (!(lstatSync(path).mode & 0o111))
+                findings.push(`${relative} is not executable`);
+            if (ROOT_SCRIPT_HINTS.some(pattern => pattern.test(readFileSync(path, "utf8")))) {
+                findings.push(`${relative} tries to gain root (sudo, chown root or setuid)`);
+            }
         }
     };
     if (existsSync(scriptsDir))

package/dist/standalone/install-settings.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { sdkSource } from '../runtime/sdk-source.js';
-import { templateSdkVersion } from '../template-paths.js';
+import { DEFAULT_SDK_VERSION } from '../runtime/sdk-source.js';
 import { goChildEnv } from '../runtime/go-env.js';
 import { pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
 import { checkCgiBinary } from './binary.js';
@@ -49,7 +49,7 @@ export function renderSettingsHook(name, m) {
 export async function buildInstallSettings(m, arch, work, run) {
     if (!m.installSettings && !m.installPorts)
         return;
-    const sdk = m.compose?.sdk ?? m.identityGateway?.sdk ?? templateSdkVersion(), source = sdkSource(sdk);
+    const sdk = m.compose?.sdk ?? m.identityGateway?.sdk ?? DEFAULT_SDK_VERSION, source = sdkSource(sdk);
     if (!existsSync(join(source.goDir, 'installsettings/cmd/control/main.go')))
         throw new StandaloneBuildError('SDK_INSTALL_SETTINGS_UNSUPPORTED', 'Use an SDK release with native install.settings support.');
     if (m.installPorts && !existsSync(join(source.goDir, 'installsettings/ports.go')))

package/dist/standalone/manifest.js

@@ -250,7 +250,7 @@ function readManifest(raw, c) {
     const timeoutOnly = isRecord(raw.daemon) && Object.keys(raw.daemon).length === 1 && 'timeouts' in raw.daemon;
     const lifecycleTimeouts = timeoutOnly ? readLifecycleTimeouts(raw.daemon.timeouts, (e) => c.fail(e.code, e.message)) : undefined;
     const daemon = arches &&
-        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message));
+        readDaemon(timeoutOnly ? undefined : raw.daemon, c.root, arches, (e) => c.fail(e.code, e.message), packageId);
     let dependencies;
     try {
         const explicit = readPackageDependencies(raw.dependencies);