@synopackageland/cli 0.10.12 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.11.0 (2026-10-16)
+
+- Add capabilities.webapi named profiles with purpose and exact API/method/version lists, pinned in the administrator-approved executor policy. Build, inspect, lifecycle, bridge services and consent details support WebAPI-only Apps without granting file/root operations.
+- Require SDK 0.11.0 for WebAPI profiles and record the three-architecture executor/lifecycle digests. The SDK and templates now share the 0.11 minor line; upgrade backend/frontend pins together.
+- 繁中：新增具名 WebAPI profile，宣告用途與 API／method／version 清單並納入管理員核准；建置、檢查、生命週期與 bridge 支援僅 WebAPI 的 App。使用此功能需 SDK 0.11.0，後端／前端 pin 一併升級至 0.11。
+
 ## 0.10.12 (2026-10-15)
 
 - Generated Apps use templates 0.10.13, SDK 0.10.12 and UI 0.9.10, including PageInfo, responsive page headers and confirmation before removing a Portal page's own entry.

package/README.md

@@ -184,3 +184,23 @@ Third-party components keep their own terms.
   `frontend/` first. A missing notice or version mismatch fails the build.
 - Keep `backend/THIRD_PARTY_NOTICES.txt` current when you change Go modules. Your own binaries,
   added modules, container images and upstream apps need their own notices.
+
+SDK 0.11.0 adds delegated JSON WebAPI profiles. With CLI 0.11.0, declare:
+
+```yaml
+capabilities:
+  webapi:
+    calendar:
+      purpose: Create calendar reminders after workflow approval
+      apis:
+        SYNO.Cal.Event:
+          list: [6]
+          create: [6]
+          delete: [6]
+```
+
+Use matching backend/frontend SDK 0.11.0 pins. The profile participates in the
+normal executor approval digest; a profile change needs administrator approval.
+Users grant the named profile separately. The permanent denylist, current-user
+permission checks, bounded JSON and uncertain-outcome rules are in the SDK's
+executor/README.md. Binary downloads require later SDK support.

package/dist/add.js

@@ -71,8 +71,8 @@ function refuseNoPrivilegePortal(root, rest) {
     const loaded = loadStandaloneManifest(root);
     if (!loaded.ok)
         throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
-    const { rootOps, delegate } = loaded.manifest.capabilities;
-    if (!rootOps && !delegate && !rest.some(name => name === 'root-ops' || name === 'delegate')) {
+    const { rootOps, delegate, webapi } = loaded.manifest.capabilities;
+    if (!rootOps && !delegate && !webapi && !rest.some(name => name === 'root-ops' || name === 'delegate')) {
         throw new Error(`[STANDALONE_PORTAL_REQUIRES_EXECUTOR] ${PORTAL_REQUIRES_EXECUTOR}`);
     }
 }

package/dist/deploy/plan.js

@@ -35,7 +35,7 @@ export function planDeployment(root, options = {}) {
             arch: options.arch,
             capabilities: Object.keys(m.capabilities),
             transport: "dsm-local-spk",
-            notes: m.capabilities.rootOps || m.capabilities.delegate
+            notes: m.capabilities.rootOps || m.capabilities.delegate || m.capabilities.webapi
                 ? [
                     "Installation does not mean ready. Approve boot and control tasks once in the App window. An executor-only upgrade stays ready without approval (INFO anchors the executor digest); a policy digest change requires approval again.",
                 ]

package/dist/info.js

@@ -140,7 +140,7 @@ export async function standaloneInfo(options) {
     const installed = state.installed;
     const capabilities = [];
     let executor;
-    for (const name of ["files", "jobs", "identity", "rootOps", "delegate"]) {
+    for (const name of ["files", "jobs", "identity", "rootOps", "delegate", "webapi"]) {
         if (!m.capabilities[name])
             continue;
         if (!installed)
@@ -149,7 +149,7 @@ export async function standaloneInfo(options) {
                 state: "blocked",
                 reason: "Package is not installed; deploy first.",
             });
-        else if (name === "rootOps" || name === "delegate") {
+        else if (name === "rootOps" || name === "delegate" || name === "webapi") {
             const result = await rootCapability(m, options.host, remote?.version ?? (await options.host.getInstalledPackageVersion?.(m.package)));
             executor = result.executor;
             const { executor: ignored, ...capability } = result;
@@ -170,7 +170,7 @@ export async function standaloneInfo(options) {
         ...state,
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
+        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate || m.capabilities.webapi), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
     };
 }
 /** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */

package/dist/runtime/executor-build.js

@@ -23,7 +23,7 @@ function failure(error) {
  * the module directory, `go build .` and `./cmd/lifecycle` inside it.
  */
 export async function buildExecutor(m, arch, work, run, options = {}) {
-    if (!m.capabilities.delegate && !m.capabilities.rootOps)
+    if (!m.capabilities.delegate && !m.capabilities.rootOps && !m.capabilities.webapi)
         return undefined;
     let sdk;
     try {

package/dist/runtime/executor-digests.json

@@ -1,140 +1,8 @@
 {
-    "0.10.0": {
-        "x86_64": "fb2df6e3421361c73a1cd720ec12198e968f0d2a58b18b53151c7781c7f4c1ef",
-        "aarch64": "0a0f6d013c0174f3ea54585182ddda14c94064f331189ac4315de813099efcdd",
-        "armv7": "3fbb5bc74a03a9767ac06a389a10ff07a353c4c56be6fda7b7555a6759992aba",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.1": {
-        "x86_64": "51b538e6ec1cb8fa2a4e00291eda097969352d6e2d9a3e7ade5da5359f1065de",
-        "aarch64": "9038b5ad7b4822e967f18390ca28b6f0021a3044ed461809b3f7333f17400840",
-        "armv7": "22d872cc618e3af4a052955186d36a6851e9f96ad959ee8ea7d3fbb5eec968bd",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.2": {
-        "x86_64": "bb7aebb120562633e852d590007870489b7839ea2c943db897b7a71dea743fae",
-        "aarch64": "2fd8365aabfa2ea2ea7c767f89fa8222d7f4fc04cbdde6b7d510c74002a5bb89",
-        "armv7": "6f757614eab802fa07c2601c801bcf2c14ad3076d7c01f9ed20d62744ef13979",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.3": {
-        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
-        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
-        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.4": {
-        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
-        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
-        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.5": {
-        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
-        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
-        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.6": {
-        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
-        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
-        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.7": {
-        "x86_64": "4ba7040761a719e74d6b047ef68b9415e658ebb8b373b69555b8c307524e26ba",
-        "aarch64": "ba80b389e3291419389b66be7b0a0e1085d3dfec55c9c651fecae427279bb3d5",
-        "armv7": "49474467b9c9a7f31b30b5053b70eb4f71a95f2c06fbf3566e8de8f16972a299",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.8": {
-        "x86_64": "ba38f5764d5f0510706afe39979eef18bf2b8a72421a3a495810c628db0c962d",
-        "aarch64": "b5129b26714c25c0eda83931f3a66961fa9ecd059074c534159db6a68aefd8f7",
-        "armv7": "359005fbab7714c29d0d0598f09f3b011aa643be26d0368726a023edbef53b8e",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.9": {
-        "x86_64": "ba38f5764d5f0510706afe39979eef18bf2b8a72421a3a495810c628db0c962d",
-        "aarch64": "b5129b26714c25c0eda83931f3a66961fa9ecd059074c534159db6a68aefd8f7",
-        "armv7": "359005fbab7714c29d0d0598f09f3b011aa643be26d0368726a023edbef53b8e",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.10": {
-        "x86_64": "9c2c6f92edd2536b3061f8b9eef8b500a1f064909deb4c1b44b496465879b90d",
-        "aarch64": "175731dafb52b83f771878cd41407cae6353a90628649ec78118d6a1e1ffb9fb",
-        "armv7": "27402fa2aa47732a280434cefaa876b0cfe8202a6dc103fd9dd1984e9dc69c81",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.11": {
-        "x86_64": "7fe3118a8de76b2d83ff4410ce76dd1aca791388286a0929602beaf4536a7194",
-        "aarch64": "0d44c4da7c464d62fcdba8d0ea5f65b935fc505e0faaa8bd61bbb5ec4deb1cea",
-        "armv7": "720a321c56669f31bc289e303627b9b88a56b9ca195ce837821639479491ab8f",
-        "lifecycle": {
-            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
-            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
-            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.10.12": {
-        "x86_64": "7fe3118a8de76b2d83ff4410ce76dd1aca791388286a0929602beaf4536a7194",
-        "aarch64": "0d44c4da7c464d62fcdba8d0ea5f65b935fc505e0faaa8bd61bbb5ec4deb1cea",
-        "armv7": "720a321c56669f31bc289e303627b9b88a56b9ca195ce837821639479491ab8f",
+    "0.11.0": {
+        "x86_64": "abe0a42699fed06aeeb7520e5a4f3393cae64f83a66773b70630f0db0c5ed107",
+        "aarch64": "1fdf171a665279f16ca1c2605a54996b2359fa69531c6fe4e890f5bda61c1bef",
+        "armv7": "946f73df833929283f94289f025fd73897416777be5e0867d1e73f0b6c3031d7",
         "lifecycle": {
             "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
             "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",

package/dist/runtime/executor-policy-check.js

@@ -53,7 +53,7 @@ export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText,
 }
 /** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
 export function manifestPolicyProblem(m, env = process.env) {
-    if (!m.capabilities.delegate && !m.capabilities.rootOps)
+    if (!m.capabilities.delegate && !m.capabilities.rootOps && !m.capabilities.webapi)
         return undefined;
     try {
         const sdk = requiredSdk(sdkBackend(m), env);

package/dist/runtime/executor-policy.d.ts

@@ -1,3 +1,4 @@
+import { type WebAPIProfiles } from './webapi-profile.js';
 import type { RootOp } from '../standalone/root-ops.js';
 import type { EntryMode } from '../standalone/manifest.js';
 import { type PortalDeclaration, type PortalEntry } from '../portal/alias.js';
@@ -17,6 +18,7 @@ export interface DelegateCapability {
 export declare function validDelegate(value: unknown): value is DelegateCapability;
 export declare const sha256: (data: string | Buffer) => string;
 export interface ExecutorPolicy {
+    webapi?: WebAPIProfiles;
     v: 1;
     app: string;
     /** Present only with a manifest `entry`; the executor then applies the same App Privileges rule offline. */
@@ -47,6 +49,7 @@ export declare function executorPolicy(m: {
     capabilities: {
         delegate?: DelegateCapability;
         rootOps?: true;
+        webapi?: WebAPIProfiles;
     };
     rootOps?: RootOp[];
     rootPrograms?: RootSettings;

package/dist/runtime/executor-policy.js

@@ -1,3 +1,4 @@
+import { validWebAPIProfiles, sortedWebAPIProfiles } from './webapi-profile.js';
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
 import { portalByExecutor } from '../build-spk/dsm-version.js';
@@ -29,6 +30,8 @@ export const executorPolicyText = (policy) => JSON.stringify(policy) + '\n';
 export function executorPolicy(m, arch) {
     if (m.capabilities.delegate && !validDelegate(m.capabilities.delegate))
         throw new Error('[EXECUTOR_POLICY] Invalid delegate operations or scope.');
+    if (m.capabilities.webapi && !validWebAPIProfiles(m.capabilities.webapi))
+        throw new Error('[EXECUTOR_POLICY] Invalid WebAPI profiles.');
     const portal = executorPortal(m);
     const operations = ['status', ...(portal ? PORTAL_OPERATIONS : [])];
     if (m.capabilities.delegate) {
@@ -38,6 +41,8 @@ export function executorPolicy(m, arch) {
         if (m.capabilities.delegate.lifetime === 'until-revoked')
             operations.push(...DELEGATE_EXTENSION_OPERATIONS);
     }
+    if (m.capabilities.webapi)
+        operations.push('delegate.create', 'delegate.list', 'delegate.revoke', 'delegate.disable', 'delegate.enable', 'delegate.audit', 'webapi.call');
     const root = {};
     const settings = m.capabilities.rootOps ? m.rootPrograms : undefined;
     if (m.capabilities.rootOps) {
@@ -51,6 +56,7 @@ export function executorPolicy(m, arch) {
         ...(d?.lifetime ? { destinations: [...d.destinations].sort(), lifetime: d.lifetime } : {}),
         operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), ...(purge ? { purge } : {}), ...(settings?.stop ? { stop: settings.stop } : {}),
         ...(settings?.start ? { start: settings.start } : {}),
+        ...(m.capabilities.webapi ? { webapi: sortedWebAPIProfiles(m.capabilities.webapi) } : {}),
         root, ...(settings?.state ? { root_state: true } : {}) };
 }
 /** A script without settings keeps the bare digest; a binary pins the bytes built for this architecture. */
@@ -80,7 +86,7 @@ export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state'].includes(key))
+    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'stop', 'start', 'root', 'root_state', 'webapi'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
@@ -95,18 +101,25 @@ export function validExecutorPolicy(value, pkg) {
     if (![...ROOT_JOB_OPERATIONS, 'root.run'].every(op => p.operations.includes(op) === rootOps.includes(op)))
         return false;
     const base = ['status', 'root.run', ...ROOT_JOB_OPERATIONS, 'delegate.create', 'delegate.list', 'delegate.revoke'];
-    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS].includes(op)))
+    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS, 'webapi.call'].includes(op)))
         return false;
     if (!PORTAL_OPERATIONS.every(op => p.operations.includes(op) === (p.portal !== undefined)) || p.portal !== undefined && !validPortalEntry(p.portal, pkg))
         return false;
-    const delegated = p.operations.some(op => op.startsWith('files.') || op.startsWith('delegate.'));
-    if (!delegated)
-        return p.scope === undefined && p.lifetime === undefined && p.destinations === undefined;
+    if ((p.webapi !== undefined) !== p.operations.includes('webapi.call') || p.webapi !== undefined && !validWebAPIProfiles(p.webapi))
+        return false;
+    const delegated = p.operations.some(op => op.startsWith('files.'));
+    if (!delegated) {
+        if (p.scope !== undefined || p.lifetime !== undefined || p.destinations !== undefined)
+            return false;
+        const expected = executorPolicy({ package: pkg, capabilities: { ...(p.webapi ? { webapi: p.webapi } : {}) } }).operations;
+        const declared = p.operations.filter(op => !PORTAL_OPERATIONS.includes(op) && !rootOps.includes(op));
+        return expected.length === declared.length && expected.every(op => declared.includes(op));
+    }
     const capability = { scope: p.scope, operations: p.operations.filter(op => FILE_OPERATIONS.includes(op) || op === MOVE_FROM_STAGING),
         ...('lifetime' in p ? { lifetime: p.lifetime } : {}), ...('destinations' in p ? { destinations: p.destinations } : {}) };
     if (!validDelegate(capability))
         return false;
-    const expected = [...executorPolicy({ package: pkg, capabilities: { delegate: capability } }).operations, ...rootOps];
+    const expected = [...executorPolicy({ package: pkg, capabilities: { delegate: capability, ...(p.webapi ? { webapi: p.webapi } : {}) } }).operations, ...rootOps];
     const declared = p.operations.filter(op => !PORTAL_OPERATIONS.includes(op));
     return expected.length === declared.length && expected.every(op => declared.includes(op));
 }

package/dist/runtime/webapi-profile.d.ts

@@ -0,0 +1,8 @@
+/** JSON WebAPI profiles, independently enforced again by the pinned executor. */
+export interface WebAPIProfile {
+    purpose: string;
+    apis: Record<string, Record<string, number[]>>;
+}
+export type WebAPIProfiles = Record<string, WebAPIProfile>;
+export declare function validWebAPIProfiles(value: unknown): value is WebAPIProfiles;
+export declare function sortedWebAPIProfiles(profiles: WebAPIProfiles): WebAPIProfiles;

package/dist/runtime/webapi-profile.js

@@ -0,0 +1,27 @@
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const blocked = new Set(['api', 'entry', 'core', 'auth', 'authentication', 'filestation', 'package', 'packagemanager', 'packagemanagement', 'user', 'users', 'group', 'groups', 'permission', 'permissions', 'privilege', 'privileges', 'owner', 'sharing', 'admin', 'setting', 'settings', 'teamfolder', 'mailplusserver', 'directoryserver', 'taskscheduler', 'eventscheduler', 'request', 'batch', 'compound']);
+const methodBlocked = new Set(['auth', 'login', 'logout', 'sudo', 'permission', 'permissions', 'privilege', 'privileges', 'share', 'sharing', 'owner', 'admin']);
+export function validWebAPIProfiles(value) {
+    if (!record(value) || !Object.keys(value).length || Object.keys(value).length > 32)
+        return false;
+    let total = 0;
+    for (const [name, p] of Object.entries(value)) {
+        if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || name === 'home' || !record(p) || Object.keys(p).some(k => !['purpose', 'apis'].includes(k)) || typeof p.purpose !== 'string' || !p.purpose.trim() || Buffer.byteLength(p.purpose) > 1024 || /[\x00-\x1f\x7f]/.test(p.purpose) || !record(p.apis) || !Object.keys(p.apis).length)
+            return false;
+        for (const [api, methods] of Object.entries(p.apis)) {
+            if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || api.toLowerCase().split('.').slice(1).some(x => blocked.has(x)) || !record(methods) || !Object.keys(methods).length)
+                return false;
+            for (const [method, versions] of Object.entries(methods)) {
+                if (!/^[a-z][a-z0-9_]{0,63}$/.test(method) || method.split('_').some(x => methodBlocked.has(x)) || !Array.isArray(versions) || !versions.length || new Set(versions).size !== versions.length || versions.some(x => !Number.isSafeInteger(x) || x < 1 || x > 65535))
+                    return false;
+                total += versions.length;
+                if (total > 256)
+                    return false;
+            }
+        }
+    }
+    return true;
+}
+export function sortedWebAPIProfiles(profiles) {
+    return Object.fromEntries(Object.entries(profiles).sort(([a], [b]) => a < b ? -1 : 1).map(([name, p]) => [name, { purpose: p.purpose, apis: Object.fromEntries(Object.entries(p.apis).sort(([a], [b]) => a < b ? -1 : 1).map(([api, methods]) => [api, Object.fromEntries(Object.entries(methods).sort(([a], [b]) => a < b ? -1 : 1).map(([m, versions]) => [m, [...versions].sort((a, b) => a - b)]))])) }]));
+}

package/dist/standalone/api-permissions.js

@@ -49,7 +49,7 @@ export function readApiPermissions(backend, capabilities = {}) {
                 throw new Error(`App policy cannot override SDK route ${method}`);
         }
     for (const [capability, methods] of Object.entries(sdk)) {
-        if (capabilities[capability] || ['rootOps', 'files'].includes(capability) && capabilities.delegate)
+        if (capabilities[capability] || ['rootOps', 'files'].includes(capability) && capabilities.delegate || capability === 'rootOps' && capabilities.webapi)
             Object.assign(policy.methods, methods);
     }
     return { policy, sdk, sdkDigest: createHash("sha256").update(sdkRaw).digest("hex"), digest: createHash("sha256").update(raw).digest("hex") };

package/dist/standalone/bridge-json.js

@@ -22,6 +22,7 @@ export function renderBridgeJson(m, methods) {
         ...(m.portal ? { portal: true } : {}),
         ...(capabilities.jobs ? { jobs: true } : {}),
         ...(capabilities.rootOps ? { root: true } : {}),
+        ...(capabilities.webapi ? { webapi: true } : {}),
         ...(delegate ? { delegate: {
                 scope: delegate.scope,
                 destinations: [...delegate.destinations ?? []].sort(),

package/dist/standalone/dsm-window.js

@@ -495,6 +495,7 @@ ${PASSWORD_CONFIRM}
     };
     var access = ${ns}.createRootAccess({
       tasks: ${ns}.rootTasks,
+      webapiProfiles: ${JSON.stringify(manifest.capabilities.webapi ?? {})},
       pins: ${JSON.stringify({ package: manifest.package, executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
       user: session,
       send: ${ns}.webApi(me),

package/dist/standalone/inspect-spk.js

@@ -62,7 +62,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadataText !== undefined) {
             try {
                 const raw = JSON.parse(metadataText);
-                if (raw.schema !== 2 || !["go", "python", "node", "rust", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
+                if (raw.schema !== 2 || !["go", "python", "node", "rust", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate", "webapi"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
                 metadata = raw;
             }
@@ -96,14 +96,14 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
         const bridge = compiledKind && kind !== "native-go" ? await checkBridgeApp(dir, metadata.backend, info, payload, findings) : undefined;
-        const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor");
+        const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor");
         if (standalone && portal && !hasExecutor)
             findings.push("PORTAL_REQUIRES_EXECUTOR portal needs the executor level (rootOps or delegate): after uninstall only a root purge can stop nginx serving the alias");
         const daemon = standalone ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background) : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go");
         let executor;
-        if ((metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor")) {
+        if ((metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate" || name === "webapi") || paths.has("executor/executor")) {
             const executorDir = join(dir, "executor-inspection");
             mkdirSync(executorDir);
             await tar.x({ file: join(dir, "package.tgz"), cwd: executorDir });
@@ -168,7 +168,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             cgi: cgiEntry?.mode === "0755" ? CGI_PAYLOAD_PATH : undefined,
             payload,
             findings,
-            capabilities: (metadata.capabilities ?? []).map(name => ({ name, requiresAdminApproval: name === "rootOps" || name === "delegate" })),
+            capabilities: (metadata.capabilities ?? []).map(name => ({ name, requiresAdminApproval: name === "rootOps" || name === "delegate" || name === "webapi" })),
         };
     }
     finally {

package/dist/standalone/lifecycle.js

@@ -15,7 +15,7 @@ export function renderStandaloneScript(name, manifest) {
     return manifest.appScripts?.some(app => app === name) ? composeAppScript(name, sdk) : sdk;
 }
 function renderCapabilityScript(name, manifest) {
-    if (name === 'preupgrade' && (manifest.capabilities.rootOps || manifest.capabilities.delegate)) {
+    if (name === 'preupgrade' && (manifest.capabilities.rootOps || manifest.capabilities.delegate || manifest.capabilities.webapi)) {
         const installed = `\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}`;
         // Incoming preupgrade sees the OLD payload. Only complete absence is first
         // introduction; a partial or symlinked executor must still fail closed.
@@ -31,10 +31,10 @@ function renderStandaloneScriptBody(name, manifest) {
         const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, delegate: { ...manifest.capabilities.delegate, scope: 'home' } } });
         return normal.replace('#!/bin/sh\n', () => '#!/bin/sh\n' + renderDelegateInstallDraft(manifest.package, name === 'preinst'));
     }
-    if (manifest.daemon && manifest.capabilities?.jobs && (manifest.capabilities.delegate || manifest.capabilities.rootOps)
+    if (manifest.daemon && manifest.capabilities?.jobs && (manifest.capabilities.delegate || manifest.capabilities.rootOps || manifest.capabilities.webapi)
         && ['start-stop-status', 'preupgrade', 'preuninst'].includes(name))
         return renderDelegatedDaemonScript(name, manifest);
-    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["preuninst", "preupgrade", "start-stop-status"].includes(name)) {
+    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate || manifest.capabilities?.webapi) && ["preuninst", "preupgrade", "start-stop-status"].includes(name)) {
         const helper = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle"`;
         // Attempt worker stop first, but let executor shutdown drain requests and
         // close ingress even when it fails; a still-running worker fails the hook.
@@ -43,7 +43,7 @@ function renderStandaloneScriptBody(name, manifest) {
         const workerResult = manifest.capabilities.jobs ? 'exit "$worker_result"\n' : "exit 0\n";
         const request = (action) => `${helper} ${action} --package ${manifest.package} || exit $?\n`;
         if (name === "start-stop-status") {
-            const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
+            const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined, webapi: undefined } });
             const stopDaemon = manifest.daemon ? `"/var/packages/${manifest.package}/target/daemon/control" stop "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n` : "";
             return normal.replace("#!/bin/sh\n", `#!/bin/sh\n${workerStop}if [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}${workerResult}fi\n`);
         }
@@ -57,8 +57,8 @@ function renderStandaloneScriptBody(name, manifest) {
         const body = manifest.daemon ? renderDaemonPreuninst(manifest) : `${UNINSTALL_ONLY}exit 0\n`;
         return `#!/bin/sh\n${renderUninstallHook(manifest)}${body}`;
     }
-    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["postinst", "postupgrade"].includes(name)) {
-        const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
+    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate || manifest.capabilities?.webapi) && ["postinst", "postupgrade"].includes(name)) {
+        const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined, webapi: undefined } });
         return normal.replace("#!/bin/sh\n", `#!/bin/sh\n"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle" start --package ${manifest.package} || exit $?\n`);
     }
     if (manifest.sharedFolder && (name === "postinst" || name === "postupgrade"))

package/dist/standalone/manifest.d.ts

@@ -1,3 +1,4 @@
+import { type WebAPIProfiles } from '../runtime/webapi-profile.js';
 import { type PackageMetadata } from "../package-metadata.js";
 import { type DelegateCapability } from "../runtime/executor-policy.js";
 import type { ExecutorPins, ExecutorTask } from "../runtime/executor-tasks.js";
@@ -96,6 +97,7 @@ export interface StandaloneManifest {
  */
 export type EntryMode = "admin-only" | "app-privilege";
 export interface Capabilities {
+    webapi?: WebAPIProfiles;
     files?: "session";
     identity?: "standalone";
     jobs?: Background;

package/dist/standalone/manifest.js

@@ -1,3 +1,4 @@
+import { validWebAPIProfiles } from '../runtime/webapi-profile.js';
 import { validateMetadata } from "../package-metadata.js";
 import { validDelegate } from "../runtime/executor-policy.js";
 import { existsSync, readFileSync } from "node:fs";
@@ -207,16 +208,21 @@ function readManifest(raw, c) {
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "The delegate install-selected scope can only be confirmed in a Vue panel; plain UI does not support it, use a vue UI (init --ui vue).");
     if (backend && backend.kind !== "binary") {
-        for (const problem of sdkProblems(backend, ui?.build?.cwd, isBridgeBackend(backend) || Boolean(capabilities.delegate || capabilities.rootOps)))
+        for (const problem of sdkProblems(backend, ui?.build?.cwd, isBridgeBackend(backend) || Boolean(capabilities.delegate || capabilities.rootOps || capabilities.webapi)))
             c.fail(problem.code, problem.message);
     }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
+    if (capabilities.webapi && backend) {
+        const sdk = sdkVersionOrUndefined(backend);
+        if (!sdk || Number(sdk.split('.')[0]) === 0 && Number(sdk.split('.')[1]) < 11)
+            c.fail("SDK_UNSUPPORTED", "capabilities.webapi requires SDK 0.11.0 or later; update backend and frontend together.");
+    }
     const uninstall = readUninstall(raw.uninstall, { rootOps: capabilities.rootOps === true, ops: rootOps, en: i18n?.catalogs?.en }, e => c.fail(e.code, e.message));
     const appScripts = readAppScripts(c.root, e => c.fail(e.code, e.message));
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
         ?? c.fail("STANDALONE_PORTAL_INVALID", "portal must be {} or { alias: <1-64 lowercase alphanumerics or -, not a DSM reserved path> }.");
-    if (portal && !capabilities.rootOps && !capabilities.delegate) {
+    if (portal && !capabilities.rootOps && !capabilities.delegate && !capabilities.webapi) {
         c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
     }
     if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
@@ -538,7 +544,13 @@ function readCapabilities(value, c) {
     }
     const result = {};
     for (const [name, setting] of Object.entries(value)) {
-        if (name === "delegate") {
+        if (name === "webapi") {
+            if (validWebAPIProfiles(setting))
+                result.webapi = setting;
+            else
+                c.fail("CAPABILITY_INVALID", "webapi requires named profiles with purpose and exact safe API/method/version lists.");
+        }
+        else if (name === "delegate") {
             if (validDelegate(setting))
                 result.delegate = setting;
             else

package/dist/standalone/root-window.js

@@ -367,6 +367,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     }, verify);
   }
   return {
+    webapiProfiles: options.webapiProfiles || {},
     status: function () { return (isAdmin() ? adminStatus() : userStatus()).then(publish); },
     authorize: function (password, selectedScope) {
       if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { var r = block({tasks: {}}, e); r.retry = !!(e && e.passwordConfirm); return r; }).then(function (r) { busy = null; return publish(r); });

package/dist/standalone/spk.js

@@ -60,7 +60,7 @@ export async function assembleStandaloneSpk(options) {
     const { manifest } = options;
     const staging = mkdtempSync(join(tmpdir(), "syno-standalone-spk-"));
     try {
-        if ((manifest.capabilities.rootOps || manifest.capabilities.delegate) && !options.executor)
+        if ((manifest.capabilities.rootOps || manifest.capabilities.delegate || manifest.capabilities.webapi) && !options.executor)
             throw new StandaloneBuildError("EXECUTOR_PIN_REQUIRED", "Executor artifact required.");
         const icons = packageIcons(manifest.icon);
         const uiRoot = join(staging, "package", "ui");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.12",
+  "version": "0.11.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.13",
+    "@synopackageland/templates": "0.11.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/schema/bridge-manifest.v1.schema.json

@@ -59,6 +59,7 @@
         "identity": { "const": "standalone", "$comment": "The SDK's App sign-in (identity.*) authenticates instead of DSM." },
         "portal": { "type": "boolean", "$comment": "true serves portal.status, to the browser and as the svc portal.status." },
         "jobs": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc bg.submit, bg.get and bg.cancel on the package's job store." },
+        "webapi": { "type": "boolean", "$comment": "Since 0.11.0: profile grant/list/revoke and JSON call services through the executor." },
         "root": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc root.run, root.start, root.jobs.list, root.jobs.get and root.jobs.stop: the runtime forwards them to the package's executor with the request's DSM session, and the executor's policy and the App privilege decide. It also serves the browser routes executor.status and executor.control (README, Executor routes)." },
         "delegate": {
           "type": "object",