@synopackageland/cli 0.14.1 → 0.15.0

package/dist/error-registry.js

@@ -1,840 +1,1026 @@
+import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
-    'LAUNCHER_PORTAL_MISMATCH': { code: 'LAUNCHER_PORTAL_MISMATCH', description: 'The launcher has Portal fields without a matching explicit Portal declaration.', suggestion: 'Remove defaultAlias and login fields, or explicitly enable portal and rebuild.' },
-    'LAUNCHER_TYPE_MISMATCH': { code: 'LAUNCHER_TYPE_MISMATCH', description: 'The built launcher or INFO entry differs from the declared launch mode.', suggestion: 'Rebuild with synopkgland build; native new-page uses standalone, and schema-1 web uses url at the trusted entry; schema-2 SDK wrappers use standalone.' },
-    'STANDALONE_UI_LAUNCH_INVALID': { code: 'STANDALONE_UI_LAUNCH_INVALID', description: 'The native ui.launch value is invalid.', suggestion: 'Set ui.launch to dsm-window (UI SDK) or new-page (other frontends). Portal is a separate opt-in.' },
-    "NATIVE_LAYOUT_INVALID": {
-        code: "NATIVE_LAYOUT_INVALID",
-        description: "The native layout's manifest, hooks, toolkit or artifacts violate the package-only contract.",
-        suggestion: "Use schema 2 with backend.kind: native; check paths, ELF linkage and checksum pins."
+    ...COMPOSE_ERRORS,
+    CTL_TRUST_REQUIRED: { "code": "CTL_TRUST_REQUIRED", "description": "App description access requires approval.", "suggestion": "Run synopkgland ctl list with explicit host and approve the candidate batch." },
+    CTL_UNSUPPORTED_BACKEND: { "code": "CTL_UNSUPPORTED_BACKEND", "description": "Automatic descriptions require a native SDK backend.", "suggestion": "Disable ctl for binary/Compose wrappers or implement the public contract separately." },
+    CTL_DESCRIBE_REQUIRED: { "code": "CTL_DESCRIBE_REQUIRED", "description": "The Go backend has no build-only registry exporter.", "suggestion": "Update the native template and implement --describe using api.DescribeRoutes." },
+    CTL_DESCRIBE_FAILED: { "code": "CTL_DESCRIBE_FAILED", "description": "The backend registry export failed.", "suggestion": "Check the backend --describe output and build diagnostics." },
+    CTL_COMMAND_UNREGISTERED: { "code": "CTL_COMMAND_UNREGISTERED", "description": "A command references an unregistered backend method.", "suggestion": "Correct ctl.commands bindings or register the backend method." },
+    CTL_DESCRIPTOR_INVALID: { "code": "CTL_DESCRIPTOR_INVALID", "description": "The generated API description violates the public contract.", "suggestion": "Correct ctl.commands and rebuild the private synopkgland-api.json." },
+    CTL_DECLARATION_INVALID: { "code": "CTL_DECLARATION_INVALID", "description": "The ctl declaration is invalid.", "suggestion": "Check ctl.enabled, aliases and explicit commands in dsm-package.yaml." },
+    ...{
+        LAUNCHER_PORTAL_MISMATCH: {
+            code: "LAUNCHER_PORTAL_MISMATCH",
+            description: "The launcher has Portal fields without a matching explicit Portal declaration.",
+            suggestion: "Remove defaultAlias and login fields, or explicitly enable portal and rebuild.",
+        },
+        LAUNCHER_TYPE_MISMATCH: {
+            code: "LAUNCHER_TYPE_MISMATCH",
+            description: "The built launcher or INFO entry differs from the declared launch mode.",
+            suggestion: "Rebuild with synopkgland build; native new-page uses standalone, and schema-1 web uses url at the trusted entry; schema-2 SDK wrappers use standalone.",
+        },
+        STANDALONE_UI_LAUNCH_INVALID: {
+            code: "STANDALONE_UI_LAUNCH_INVALID",
+            description: "The native ui.launch value is invalid.",
+            suggestion: "Set ui.launch to dsm-window (UI SDK) or new-page (other frontends). Portal is a separate opt-in.",
+        },
+        NATIVE_LAYOUT_INVALID: {
+            code: "NATIVE_LAYOUT_INVALID",
+            description: "The native layout's manifest, hooks, toolkit or artifacts violate the package-only contract.",
+            suggestion: "Use schema 2 with backend.kind: native; check paths, ELF linkage and checksum pins.",
+        },
+        CONTRACT_SCHEMA_UNSUPPORTED: {
+            code: "CONTRACT_SCHEMA_UNSUPPORTED",
+            description: "The schema version in synology-app.yaml is not supported.",
+            suggestion: "Set the schema field in synology-app.yaml to 1.",
+        },
+        CONTRACT_MISSING_FIELD: {
+            code: "CONTRACT_MISSING_FIELD",
+            description: "synology-app.yaml is missing a required field.",
+            suggestion: "Add the missing required fields to synology-app.yaml (for example package, version, displayname).",
+        },
+        CONTRACT_SCHEMA_INVALID: {
+            code: "CONTRACT_SCHEMA_INVALID",
+            description: "synology-app.yaml does not match the JSON Schema.",
+            suggestion: "Fix the field formats in synology-app.yaml so they match the schema.",
+        },
+        PACKAGE_IDENTITY_TOO_LONG: {
+            code: "PACKAGE_IDENTITY_TOO_LONG",
+            description: "The Package Identity exceeds the length limit (28 characters for a formal identity, 32 for the final identity).",
+            suggestion: "Shorten the package name in synology-app.yaml (at most 28 characters for the formal identity, leaving 4 characters for the .dev suffix).",
+        },
+        CONTRACT_PACKAGE_TOO_LONG: {
+            code: "CONTRACT_PACKAGE_TOO_LONG",
+            description: "The Package Identity exceeds the DSM limit of 32 characters.",
+            suggestion: "Shorten the package name in synology-app.yaml to 32 characters or fewer.",
+        },
+        CONTRACT_ADMINPORT_INVALID: {
+            code: "CONTRACT_ADMINPORT_INVALID",
+            description: "adminport must be an integer.",
+            suggestion: "Provide an integer adminport in synology-app.yaml that matches the Compose published port.",
+        },
+        CONTRACT_LAUNCH_INVALID: {
+            code: "CONTRACT_LAUNCH_INVALID",
+            description: "The integration.web.launch mode is invalid.",
+            suggestion: "Use dsm-window (DSM window) or new-page (new tab, the default); omit this field for a headless App.",
+        },
+        CONTRACT_LAUNCH_REQUIRES_WEB: {
+            code: "CONTRACT_LAUNCH_REQUIRES_WEB",
+            description: "A headless App does not declare a Web Launch Mode.",
+            suggestion: "Remove integration.web.launch, or add the adminport that matches the Compose published port.",
+        },
+        CONTRACT_PORTAL_REQUIRES_EXECUTOR: {
+            code: "CONTRACT_PORTAL_REQUIRES_EXECUTOR",
+            description: "The Compose App declares integration.web.portal, but a Compose App has no executor; removing the sign-in alias after uninstall needs root so nginx stops serving it.",
+            suggestion: "Remove integration.web.portal; for a sign-in alias, ask an administrator to configure a reverse proxy in DSM instead.",
+        },
+        CONTRACT_ACCESS_INVALID: {
+            code: "CONTRACT_ACCESS_INVALID",
+            description: "The integration.web.access mode is invalid.",
+            suggestion: "Use dsm-users (signed-in DSM users, the default), dsm-admins, dsm-groups (with groups), or public to keep an anonymous Web Station entry.",
+        },
+        CONTRACT_ACCESS_GROUPS_INVALID: {
+            code: "CONTRACT_ACCESS_GROUPS_INVALID",
+            description: "integration.web.groups is missing, malformed, or not combined with access: dsm-groups.",
+            suggestion: "Use access: dsm-groups and list DSM group names, or remove groups.",
+        },
+        CONTRACT_ACCESS_REQUIRES_WEB: {
+            code: "CONTRACT_ACCESS_REQUIRES_WEB",
+            description: "A headless App does not declare Web access rules.",
+            suggestion: "Remove integration.web.access/groups, or add the adminport that matches the Compose published port.",
+        },
+        GATEWAY_ARCH_FAMILY_REQUIRED: {
+            code: "GATEWAY_ARCH_FAMILY_REQUIRED",
+            description: "The DSM verification gateway is a native binary, so the SPK must name its target architecture.",
+            suggestion: "Add --arch x86_64 or --arch aarch64 (deploy detects it from the NAS); only Apps without DSM verification may choose public in integration.web.access.",
+        },
+        CONTRACT_INVALID_STRING: {
+            code: "CONTRACT_INVALID_STRING",
+            description: "A contract string contains a control character or the ${ interpolation syntax, which is not allowed.",
+            suggestion: "Remove control characters and ${ interpolation; declare install parameters in the install block.",
+        },
+        INSTALL_STRING_TOO_LONG: {
+            code: "INSTALL_STRING_TOO_LONG",
+            description: "An Install Parameter string default exceeds 256 characters.",
+            suggestion: "Shorten the default string of the install parameter in synology-app.yaml.",
+        },
+        INSTALL_STRING_INVALID: {
+            code: "INSTALL_STRING_INVALID",
+            description: "An Install Parameter string value contains an invalid character or interpolation.",
+            suggestion: "Remove control characters and ${ interpolation from the install parameter default.",
+        },
+        CONTRACT_SECRET_UNSUPPORTED: {
+            code: "CONTRACT_SECRET_UNSUPPORTED",
+            description: "install.<NAME>.type: secret has no usable install path today: whether or not Compose references it, Package Center install ends in DSM broken/150 and creates no Container Manager project.",
+            suggestion: "Use type: string (non-sensitive), or have the App fetch the secret itself at startup or read a file an administrator places in ${SYNO_APP_SECRETS_DIR}. The secret type stays closed until the DSM worker failure reason is observable.",
+        },
+        CONTRACT_HOMES_UNSUPPORTED: {
+            code: "CONTRACT_HOMES_UNSUPPORTED",
+            description: "install.<NAME>.type: homes has no usable install path today: the install wizard generates no input control and Package Center install ends in DSM broken/150; CLI deploy can resolve /volume1/homes, but DSM rejects the compound install with 4540.",
+            suggestion: "If the App needs an administrator-chosen folder, use type: shared_folder instead. The homes type stays closed until the wizard control and preinst path resolution exist.",
+        },
+        CONTRACT_HOMES_PATH_FORBIDDEN: {
+            code: "CONTRACT_HOMES_PATH_FORBIDDEN",
+            description: "A homes Install Parameter must not write a NAS physical path or default value into the contract.",
+            suggestion: "Declare only type: homes, reference the parameter in Compose, and let the package resolve this NAS's User Home path at install time.",
+        },
+        CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN: {
+            code: "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN",
+            description: "A POSIX all-shares parameter must not specify a default or NAS physical path in the contract.",
+            suggestion: "Declare only type: posix_all_shares and let the wizard/CLI take the current Share snapshot at install time.",
+        },
+        CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED: {
+            code: "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED",
+            description: "posix_all_shares requires the CLI to take a Share list snapshot of this NAS with an administrator session at install time; Package Center and Package Source listing cannot fulfill this contract.",
+            suggestion: "Use synopkgland deploy --host <name> so an administrator session takes the Share list snapshot at install time; this type cannot ship through Package Center or Package Source listing.",
+        },
+        DSM_USER_REQUIRED: {
+            code: "DSM_USER_REQUIRED",
+            description: "A Shared Folder requires exactly one dsm_user as the Container Run-as.",
+            suggestion: "Add install.<NAME>.type: dsm_user to synology-app.yaml and reference ${NAME_UID}:${NAME_GID} in Compose.",
+        },
+        PROJECT_RUNTIME_EXCLUSIVE: {
+            code: "PROJECT_RUNTIME_EXCLUSIVE",
+            description: "The project has both compose.yaml and dsm-package.yaml, which are mutually exclusive.",
+            suggestion: "Choose compose.yaml (container App) or dsm-package.yaml (native App) and delete the other file.",
+        },
+        DEPLOY_FAILED: {
+            code: "DEPLOY_FAILED",
+            description: "An unclassified error occurred while deploying to the NAS.",
+            suggestion: "Check NAS connectivity and logs: synopkgland logs --host <nas>.",
+        },
+        SHARE_VALUE_REQUIRED: {
+            code: "SHARE_VALUE_REQUIRED",
+            description: "Deploy is missing the physical path mapping for a shared_folder declared in the contract.",
+            suggestion: "Provide the matching Shared Folder name with --share <SLOT>=<logical name>.",
+        },
+        SHARE_LOGICAL_NAME_REQUIRED: {
+            code: "SHARE_LOGICAL_NAME_REQUIRED",
+            description: "A Share parameter needs a logical name; physical paths such as /volume1/... are forbidden.",
+            suggestion: "Give the Shared Folder logical name from DSM Control Panel, for example --share MEDIA_SHARE=photos.",
+        },
+        SHARE_NOT_FOUND: {
+            code: "SHARE_NOT_FOUND",
+            description: "The named Shared Folder was not found on the target NAS.",
+            suggestion: "Create the Shared Folder in DSM Control Panel, or check the spelling.",
+        },
+        HOMES_NOT_ENABLED: {
+            code: "HOMES_NOT_ENABLED",
+            description: "The target NAS has User Home disabled, or the homes physical bind source cannot be resolved.",
+            suggestion: "Enable DSM User Home on this NAS, confirm the DSM API returns the resolved path, then deploy again.",
+        },
+        DSM_USER_LOGICAL_NAME_REQUIRED: {
+            code: "DSM_USER_LOGICAL_NAME_REQUIRED",
+            description: "A dsm_user parameter needs a DSM user logical name; a numeric UID is forbidden.",
+            suggestion: "Pass the DSM account name with --run-as (for example --run-as RUN_AS=alice).",
+        },
+        SHARE_RUN_AS_NO_ACCESS: {
+            code: "SHARE_RUN_AS_NO_ACCESS",
+            description: "The deploy pre-install check found that the chosen Container Run-as user has no permission on the chosen Shared Folder (or is explicitly denied). The container mounts the Share as that user, so the install succeeds but runtime reads and writes get Permission denied.",
+            suggestion: "Grant that user (or their group) permission on the Shared Folder in DSM Control Panel, or choose another user/Share, then deploy again. This check only runs in deploy; the Package Center install wizard does not go through it, and ACLs remain the administrator's responsibility.",
+        },
+        PORT_ALREADY_IN_USE: {
+            code: "PORT_ALREADY_IN_USE",
+            description: "The deploy pre-install check found the Compose published TCP port already taken by another service or container.",
+            suggestion: "Change the published host port in synology-app.yaml/compose.yaml; existing containers of the same Package Identity are allowed during upgrade or reinstall.",
+        },
+        CATALOG_INSTALL_FAILED: {
+            code: "CATALOG_INSTALL_FAILED",
+            description: "NAS Package Center failed to install the package.",
+            suggestion: "Check the install log in DSM Package Center or try installing manually.",
+        },
+        DEPLOY_PARAM_UNDECLARED: {
+            code: "DEPLOY_PARAM_UNDECLARED",
+            description: "deploy --param provided an Install Parameter the contract does not declare, or an install wizard value that a native-go/binary package does not have.",
+            suggestion: "For Compose pass only string or boolean names declared in synology-app.yaml install; native-go/binary accept only delegate_share or delegate_home from the install-selected delegate.",
+        },
+        DEPLOY_PARAM_REQUIRED: {
+            code: "DEPLOY_PARAM_REQUIRED",
+            description: "The first install of an install-selected delegate package did not provide the install wizard scope value, so preinst rejects the install.",
+            suggestion: "Add --param delegate_share=<shared folder> or --param delegate_home=true and deploy again.",
+        },
+        DEPLOY_PARAM_TYPE_INVALID: {
+            code: "DEPLOY_PARAM_TYPE_INVALID",
+            description: "The deploy --param value does not match the string or boolean type declared in the contract.",
+            suggestion: "Pass a non-empty string for string; pass only true or false for boolean.",
+        },
+        DSM_DEPENDENCY_CONFLICT: {
+            code: "DSM_DEPENDENCY_CONFLICT",
+            description: "DSM rejected the compound install request because of running dependent packages.",
+            suggestion: "Stop the listed dependent packages, then retry the upgrade.",
+        },
+        DSM_COMPOUND_FAILED: {
+            code: "DSM_COMPOUND_FAILED",
+            description: "A substep of the DSM compound install request failed.",
+            suggestion: "Check the api, method and errorCode in the response and the DSM Package Center log, then retry.",
+        },
+        DSM_REQUEST_FAILED: {
+            code: "DSM_REQUEST_FAILED",
+            description: "The DSM SYNO.Entry.Request compound request failed.",
+            suggestion: "Check the DSM session, request parameters and Package Center log, then retry.",
+        },
+        NOT_INSTALLED: {
+            code: "NOT_INSTALLED",
+            description: "The package is not installed on the target NAS yet.",
+            suggestion: "Run synopkgland deploy --host <nas> to install the package first.",
+        },
+        STANDALONE_MANIFEST_MISSING: {
+            code: "STANDALONE_MANIFEST_MISSING",
+            description: "dsm-package.yaml was not found.",
+            suggestion: "Run from the project root, or create a project with synopkgland init -t native-go.",
+        },
+        STANDALONE_MANIFEST_YAML: {
+            code: "STANDALONE_MANIFEST_YAML",
+            description: "dsm-package.yaml is not a valid YAML object.",
+            suggestion: "Fix the YAML syntax in dsm-package.yaml.",
+        },
+        APP_SCRIPT_UNKNOWN: {
+            code: "APP_SCRIPT_UNKNOWN",
+            description: "A file in the project's dsm-scripts/ folder does not have a DSM package script name the SDK runs.",
+            suggestion: "Name it preinst, postinst, preuninst, postuninst, preupgrade, postupgrade or start-stop-status, or move it out of dsm-scripts/. prereplace and postreplace are not supported.",
+        },
+        APP_SCRIPT_INVALID: {
+            code: "APP_SCRIPT_INVALID",
+            description: "A dsm-scripts/<DSM script name> entry is a symlink, directory or special file.",
+            suggestion: "Make it a regular file in the project's dsm-scripts/ folder.",
+        },
+        APP_SCRIPT_NOT_EXECUTABLE: {
+            code: "APP_SCRIPT_NOT_EXECUTABLE",
+            description: "A dsm-scripts/<DSM script name> file is not executable; DSM runs it directly.",
+            suggestion: "Run chmod +x on the file.",
+        },
+        APP_SCRIPT_NO_SHEBANG: {
+            code: "APP_SCRIPT_NO_SHEBANG",
+            description: "A dsm-scripts/<DSM script name> file does not start with #!.",
+            suggestion: "Start the file with an interpreter line such as #!/bin/sh.",
+        },
+        STANDALONE_FIELD_UNKNOWN: {
+            code: "STANDALONE_FIELD_UNKNOWN",
+            description: "dsm-package.yaml contains an unsupported field.",
+            suggestion: "Remove the field; a Standalone Package does not accept custom lifecycle scripts or DSM conf.",
+        },
+        STANDALONE_SCHEMA_INVALID: {
+            code: "STANDALONE_SCHEMA_INVALID",
+            description: "The schema version in dsm-package.yaml is not supported.",
+            suggestion: "Set schema to 2 and use backend.kind and capabilities.",
+        },
+        STANDALONE_ROOT_OPS_MISSING: {
+            code: "STANDALONE_ROOT_OPS_MISSING",
+            description: "capabilities.rootOps: true is set but there are no root operations.",
+            suggestion: "Put at least one <name>.sh in root/, or drop capabilities.rootOps.",
+        },
+        STANDALONE_DAEMON_INVALID: {
+            code: "STANDALONE_DAEMON_INVALID",
+            description: "The package daemon declaration does not match the fixed argv, environment and lifecycle contract.",
+            suggestion: "Check daemon.exec, the per-architecture targets, args, env, uninstall_args and integer-second timeouts; remove shell, user and custom conf.",
+        },
+        UNINSTALL_INVALID: {
+            code: "UNINSTALL_INVALID",
+            description: "The uninstall declaration does not match the fixed exec, argv, environment and timeout contract.",
+            suggestion: "Check uninstall.purge's exec (inside the package, not in executor/ or root/), args, env (SYNOPKGLAND_* not allowed) and 2-120 second timeout, and the unique keys of state.items.",
+        },
+        UNINSTALL_STATE_REQUIRES_PURGE: {
+            code: "UNINSTALL_STATE_REQUIRES_PURGE",
+            description: "uninstall.state has no App uninstall hook that could delete the state.",
+            suggestion: "Add uninstall.purge so the App deletes the listed state when SYNOPKGLAND_DELETE_STATE=1, or remove uninstall.state.",
+        },
+        UNINSTALL_STATE_TEXT_MISSING: {
+            code: "UNINSTALL_STATE_TEXT_MISSING",
+            description: "The uninstall wizard cannot list the text of the uninstall.state items.",
+            suggestion: "Add uninstall.state.<key> to i18n.messages en.json (and the other languages).",
+        },
+        UNINSTALL_ROOT_REQUIRES_ROOT_OPS: {
+            code: "UNINSTALL_ROOT_REQUIRES_ROOT_OPS",
+            description: "uninstall.purge.root needs administrator-approved root operations.",
+            suggestion: "Declare capabilities.rootOps: true and provide root/<name>.sh, or remove uninstall.purge.root.",
+        },
+        UNINSTALL_ROOT_OP_MISSING: {
+            code: "UNINSTALL_ROOT_OP_MISSING",
+            description: "uninstall.purge.root points at a root operation that does not exist.",
+            suggestion: "Add root/<name>.sh, or change uninstall.purge.root to an existing root operation name.",
+        },
+        UNINSTALL_EXEC_MISSING: {
+            code: "UNINSTALL_EXEC_MISSING",
+            description: "uninstall.purge.exec is not a regular executable file inside the built package.",
+            suggestion: "Point at an executable in the package, for example ui/cgi/api.cgi, background/worker, or an executable file under daemon/payload/.",
+        },
+        UNINSTALL_EXEC_UNSAFE: {
+            code: "UNINSTALL_EXEC_UNSAFE",
+            description: "uninstall.purge.exec is a shell script that tries to gain root.",
+            suggestion: "Hooks always run as the package account; put cleanup that needs root in root/<name>.sh and declare it with uninstall.purge.root.",
+        },
+        STANDALONE_DAEMON_BUILD_FAILED: {
+            code: "STANDALONE_DAEMON_BUILD_FAILED",
+            description: "The package daemon's Go supervisor could not be built.",
+            suggestion: "Install Go 1.21 or later (builds pin go1.26.9 and need it offline) and check the compiler stderr; the NAS does not need a Go toolchain.",
+        },
+        STANDALONE_DAEMON_PAYLOAD_INVALID: {
+            code: "STANDALONE_DAEMON_PAYLOAD_INVALID",
+            description: "The daemon payload is not a bounded, link-free directory inside the project.",
+            suggestion: "Rebuild the per-architecture bundles; remove symlinks, special files and setid bits, and keep the size under 512 MiB.",
+        },
+        STANDALONE_DAEMON_ARTIFACT_REQUIRED: {
+            code: "STANDALONE_DAEMON_ARTIFACT_REQUIRED",
+            description: "The built supervisor is missing while assembling the daemon SPK.",
+            suggestion: "Build the complete artifacts with synopkgland build; do not call the assembler directly without the controller.",
+        },
+        STANDALONE_IDENTITY_GATEWAY_INVALID: {
+            code: "STANDALONE_IDENTITY_GATEWAY_INVALID",
+            description: "The identity_gateway declaration does not match the gateway contract.",
+            suggestion: "Declare a daemon; set sdk, mode (oidc, header or token), the App's loopback upstream port and distinct listen ports other than 5000/5001; keep passthrough and redirects local paths outside /_sso; oidc needs issuer_port and clients, header needs headers.user, token needs token.exec in the daemon payload.",
+        },
+        STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED: {
+            code: "STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED",
+            description: "The SDK identity gateway could not be built from identity_gateway.sdk.",
+            suggestion: "Use an SDK release that contains idgateway/cmd/gateway, install Go (builds pin go1.26.9) and check the compiler stderr.",
+        },
+        STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED: {
+            code: "STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED",
+            description: "The built identity gateway is missing while assembling the SPK.",
+            suggestion: "Build the complete artifacts with synopkgland build; do not call the assembler directly without the gateway.",
+        },
+        STANDALONE_SHARED_FOLDER_INVALID: {
+            code: "STANDALONE_SHARED_FOLDER_INVALID",
+            description: "The install.sharedFolder declaration in dsm-package.yaml is invalid.",
+            suggestion: "Write install: { sharedFolder: { mode: select|create, key: <lowercase alphanumeric and underscore>, permission: ro|rw } }; create also needs name (the DSM shared folder name) and select must not have one.",
+        },
+        STANDALONE_BACKGROUND_INVALID: {
+            code: "STANDALONE_BACKGROUND_INVALID",
+            description: "The package background job declaration does not match the fixed worker contract.",
+            suggestion: "Write only capabilities.jobs: true or { worker: sha256-v1 }, use backend.kind: go, and do not combine it with daemon or integration; background processes always run as the package account.",
+        },
+        STANDALONE_BACKGROUND_BUILD_FAILED: {
+            code: "STANDALONE_BACKGROUND_BUILD_FAILED",
+            description: "The package background worker could not be built.",
+            suggestion: "Install Go 1.25 or later, confirm the backend has cmd/background-worker (create it with synopkgland init -t native-go --with jobs), and check the compiler stderr.",
+        },
+        STANDALONE_BACKGROUND_ARTIFACT_REQUIRED: {
+            code: "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED",
+            description: "The built worker is missing while assembling the background job SPK.",
+            suggestion: "Build the complete artifacts with synopkgland build; do not call the assembler directly without the worker.",
+        },
+        STANDALONE_ROOT_OP_INVALID: {
+            code: "STANDALONE_ROOT_OP_INVALID",
+            description: "root/ contains an invalid root operation file.",
+            suggestion: "A script must be a regular root/<lowercase name>.sh starting with #!/bin/sh and under 16 KiB; a binary must be root/<arch>/<lowercase name>, an ELF for that architecture, under 64 MiB, and must not share a script's name.",
+        },
+        STANDALONE_ROOT_PROGRAMS_INVALID: {
+            code: "STANDALONE_ROOT_PROGRAMS_INVALID",
+            description: "The root settings in dsm-package.yaml are invalid, or the executor does not accept them.",
+            suggestion: "root accepts only programs (<name>: {kind, schema, run, job} matching root/<name>.sh or root/<arch>/<name>), stop (a program in root/) and state: true, and requires capabilities.rootOps: true.",
+        },
+        STANDALONE_ROOT_OPS_UNUSED: {
+            code: "STANDALONE_ROOT_OPS_UNUSED",
+            description: "The project has a root/ directory but capabilities.rootOps is not enabled.",
+            suggestion: "Set capabilities.rootOps: true to use root operations, or delete root/.",
+        },
+        STANDALONE_PACKAGE_INVALID: {
+            code: "STANDALONE_PACKAGE_INVALID",
+            description: "The package name is invalid.",
+            suggestion: "Use a 2-64 character name that starts with a letter and contains only alphanumerics, for example PhotoTagger.",
+        },
+        STANDALONE_VERSION_INVALID: {
+            code: "STANDALONE_VERSION_INVALID",
+            description: "version is not a numeric version.",
+            suggestion: "Use a version such as 1.2.0 and put the build number in build.",
+        },
+        STANDALONE_BUILD_INVALID: {
+            code: "STANDALONE_BUILD_INVALID",
+            description: "build is not an integer from 1 to 9999.",
+            suggestion: "Set build to an integer from 1 to 9999 and increment it for each SPK release.",
+        },
+        STANDALONE_OS_MIN_VER_INVALID: {
+            code: "STANDALONE_OS_MIN_VER_INVALID",
+            description: "os_min_ver has the wrong format.",
+            suggestion: "Use <major>.<minor>-<build>, for example 7.2-64570.",
+        },
+        STANDALONE_TEXT_INVALID: {
+            code: "STANDALONE_TEXT_INVALID",
+            description: "A display text field is invalid.",
+            suggestion: 'Use single-line, non-empty text without " or \\.',
+        },
+        STANDALONE_ARCHES_INVALID: {
+            code: "STANDALONE_ARCHES_INVALID",
+            description: "arches is invalid.",
+            suggestion: "List one or more unique values from x86_64, aarch64 or armv7.",
+        },
+        STANDALONE_ARCH_NOT_DECLARED: {
+            code: "STANDALONE_ARCH_NOT_DECLARED",
+            description: "The requested build architecture is not in arches.",
+            suggestion: "Add the architecture to arches in dsm-package.yaml, or use a declared --arch.",
+        },
+        STANDALONE_BACKEND_INVALID: {
+            code: "STANDALONE_BACKEND_INVALID",
+            description: "The backend configuration is invalid.",
+            suggestion: "backend must contain exactly one of go (dir and a ./ main) or binary (keyed by architecture).",
+        },
+        STANDALONE_BINARY_ARCH_MISSING: {
+            code: "STANDALONE_BINARY_ARCH_MISSING",
+            description: "An architecture declared in arches has no backend.files executable.",
+            suggestion: "Add the executable for that architecture to backend.files, or remove it from arches.",
+        },
+        STANDALONE_BINARY_MISSING: {
+            code: "STANDALONE_BINARY_MISSING",
+            description: "The backend executable was not found.",
+            suggestion: "Confirm the file backend.files points at exists.",
+        },
+        STANDALONE_BINARY_NOT_REGULAR: {
+            code: "STANDALONE_BINARY_NOT_REGULAR",
+            description: "The backend executable is not a regular file.",
+            suggestion: "Use a real file; no symlinks, directories or special files.",
+        },
+        STANDALONE_BINARY_TOO_LARGE: {
+            code: "STANDALONE_BINARY_TOO_LARGE",
+            description: "The backend executable exceeds 256 MiB.",
+            suggestion: 'Shrink the executable (for example -ldflags "-s -w").',
+        },
+        STANDALONE_BINARY_NOT_ELF: {
+            code: "STANDALONE_BINARY_NOT_ELF",
+            description: "The backend executable is not the little-endian Linux ELF the architecture needs (64-bit for x86_64 and aarch64, 32-bit for armv7).",
+            suggestion: "Provide an x86_64, aarch64 or armv7 executable built for Linux.",
+        },
+        STANDALONE_BINARY_ARCH_MISMATCH: {
+            code: "STANDALONE_BINARY_ARCH_MISMATCH",
+            description: "The backend executable's CPU architecture does not match the target.",
+            suggestion: "Rebuild for that architecture, or fix the backend.files mapping.",
+        },
+        STANDALONE_BINARY_DYNAMIC: {
+            code: "STANDALONE_BINARY_DYNAMIC",
+            description: "The backend executable is dynamically linked.",
+            suggestion: "Link statically (set CGO_ENABLED=0 for Go); the libc version differs across DSM models.",
+        },
+        STANDALONE_PATH_INVALID: {
+            code: "STANDALONE_PATH_INVALID",
+            description: "The path field is not a relative path inside the project.",
+            suggestion: "Use a path relative to the project root.",
+        },
+        STANDALONE_PATH_OUTSIDE_PROJECT: {
+            code: "STANDALONE_PATH_OUTSIDE_PROJECT",
+            description: "The path points outside the project directory.",
+            suggestion: "Keep the files inside the project directory (also after resolving symlinks).",
+        },
+        STANDALONE_UI_INVALID: {
+            code: "STANDALONE_UI_INVALID",
+            description: "The ui configuration is invalid.",
+            suggestion: "Provide ui.dir.",
+        },
+        STANDALONE_UI_BUILD_INVALID: {
+            code: "STANDALONE_UI_BUILD_INVALID",
+            description: "The ui.build configuration is invalid.",
+            suggestion: "ui.build.command must be an argv string array (not going through a shell), for example [npm, run, build].",
+        },
+        STANDALONE_TIMEOUT_UNSUPPORTED: {
+            code: "STANDALONE_TIMEOUT_UNSUPPORTED",
+            description: "backend.timeout_seconds needs a Go main that reads the requestTimeout the build passes.",
+            suggestion: 'Declare var requestTimeout = "" in main.go and pass its seconds to api.WithRequestDeadline(handler, api.Timeout(...)), or remove timeout_seconds.',
+        },
+        STANDALONE_REQUEST_TIMEOUT_SHORT: {
+            code: "STANDALONE_REQUEST_TIMEOUT_SHORT",
+            description: "The request deadline ends before a root program that root.run may run would answer: the executor answers 10 seconds after run.timeout_s and its client waits 10 more.",
+            suggestion: "Set backend.timeout_seconds to at least the program's run.timeout_s (20 by default) + 20, or lower run.timeout_s.",
+        },
+        STANDALONE_UI_WINDOW_INVALID: {
+            code: "STANDALONE_UI_WINDOW_INVALID",
+            description: "ui.window does not give a valid DSM window size.",
+            suggestion: "Give width and height as whole numbers from 320 to 3840 and 240 to 2160, keep minWidth and minHeight (700 and 420 by default) no larger than them, and write only the fields you change.",
+        },
+        STANDALONE_UI_BUILD_FAILED: {
+            code: "STANDALONE_UI_BUILD_FAILED",
+            description: "The UI build command failed.",
+            suggestion: "Install the UI dependencies in ui.build.cwd (npm ci when package-lock.json exists, otherwise npm install), then run the UI build command and fix the errors.",
+        },
+        STANDALONE_UI_ENTRY_MISSING: {
+            code: "STANDALONE_UI_ENTRY_MISSING",
+            description: "The UI directory is missing app.js or app.css.",
+            suggestion: "Make ui.dir (or the UI build output) contain app.js and app.css.",
+        },
+        STANDALONE_UI_SYMLINK: {
+            code: "STANDALONE_UI_SYMLINK",
+            description: "The UI directory contains a symlink.",
+            suggestion: "Replace the symlink with a real file.",
+        },
+        STANDALONE_UI_SPECIAL_FILE: {
+            code: "STANDALONE_UI_SPECIAL_FILE",
+            description: "The UI directory contains a special file.",
+            suggestion: "The UI directory may contain only regular files and directories.",
+        },
+        STANDALONE_UI_TOO_LARGE: {
+            code: "STANDALONE_UI_TOO_LARGE",
+            description: "The total UI file size exceeds 64 MiB.",
+            suggestion: "Shrink the UI assets.",
+        },
+        STANDALONE_GO_MISSING: {
+            code: "STANDALONE_GO_MISSING",
+            description: "The go command was not found.",
+            suggestion: "Install Go 1.25 or later (https://go.dev/dl/), or package an existing executable with backend.files.",
+        },
+        STANDALONE_GO_BUILD_FAILED: {
+            code: "STANDALONE_GO_BUILD_FAILED",
+            description: "go build failed.",
+            suggestion: "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, make sure git can read github.com with credentials (verify with git ls-remote).",
+        },
+        STANDALONE_PORTAL_INVALID: {
+            code: "STANDALONE_PORTAL_INVALID",
+            description: "The portal format or alias in dsm-package.yaml is invalid.",
+            suggestion: "Use portal: {} or portal: { alias: my-app }; alias is 1-64 lowercase alphanumerics or -, and not a DSM reserved path.",
+        },
+        STANDALONE_PORTAL_REQUIRES_EXECUTOR: {
+            code: "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
+            description: "An App without an executor (capabilities.rootOps or delegate) declares portal.",
+            suggestion: "Removing the sign-in alias after uninstall needs root so nginx stops serving it, but an App without escalation uses no root at any stage. Add capabilities.rootOps or delegate (executor level), or remove portal and let an administrator configure a reverse proxy in DSM.",
+        },
+        STANDALONE_LOGIN_STYLE_INVALID: {
+            code: "STANDALONE_LOGIN_STYLE_INVALID",
+            description: "login_style in dsm-package.yaml is malformed, or set without portal.",
+            suggestion: "Declare portal, and give login_style only color (#RRGGBB), wallpaper together with wallpaper_thumbnail, and title; omit login_style to use the CLI default style.",
+        },
+        STANDALONE_LOGIN_STYLE_IMAGE_INVALID: {
+            code: "STANDALONE_LOGIN_STYLE_IMAGE_INVALID",
+            description: "An image login_style names is missing, in the wrong format or the wrong size.",
+            suggestion: "Use a JPEG wallpaper of at least 1920x1080 and at most 2 MiB, a 320x200 JPEG wallpaper_thumbnail and a 680x124 PNG title, inside the project.",
+        },
+        STANDALONE_I18N_INVALID: {
+            code: "STANDALONE_I18N_INVALID",
+            description: "The i18n configuration in dsm-package.yaml is invalid.",
+            suggestion: "i18n accepts only messages, glossary and info; info is keyed by a supported language such as zh-TW or ja (English goes at the top level).",
+        },
+        STANDALONE_I18N_MESSAGES_MISSING: {
+            code: "STANDALONE_I18N_MESSAGES_MISSING",
+            description: "The i18n.messages directory is missing en.json.",
+            suggestion: "Add en.json; it is the fallback text and key list for every language.",
+        },
+        STANDALONE_I18N_LOCALE_UNSUPPORTED: {
+            code: "STANDALONE_I18N_LOCALE_UNSUPPORTED",
+            description: "A message file's language is not one of the nine supported locales.",
+            suggestion: "Use en, zh-TW, zh-CN, ja, ko, de, fr, es, it; every other DSM language shows English.",
+        },
+        STANDALONE_I18N_CATALOG_INVALID: {
+            code: "STANDALONE_I18N_CATALOG_INVALID",
+            description: "A message file is not a flat key -> text JSON object.",
+            suggestion: 'Use a format like { "greeting.save": "Save" }.',
+        },
+        STANDALONE_I18N_KEYS_MISMATCH: {
+            code: "STANDALONE_I18N_KEYS_MISMATCH",
+            description: "One language's message keys differ from en.json.",
+            suggestion: "Give every language file exactly the keys of en.json.",
+        },
+        STANDALONE_I18N_PLACEHOLDER_MISMATCH: {
+            code: "STANDALONE_I18N_PLACEHOLDER_MISMATCH",
+            description: "A translation has a missing or extra {placeholder}.",
+            suggestion: "Keep every {name} placeholder from the en.json text.",
+        },
+        STANDALONE_I18N_GLOSSARY_INVALID: {
+            code: "STANDALONE_I18N_GLOSSARY_INVALID",
+            description: "The glossary format is wrong, or it points at a message key that does not exist.",
+            suggestion: "Fix the terms (id, text, keys) in glossary.json.",
+        },
+        STANDALONE_I18N_GLOSSARY_MISMATCH: {
+            code: "STANDALONE_I18N_GLOSSARY_MISMATCH",
+            description: "A message does not use the DSM interface term from the glossary.",
+            suggestion: "Use that language's term from glossary.json to stay consistent with the DSM interface.",
+        },
+        DEPLOY_VERSION_INVALID: {
+            code: "DEPLOY_VERSION_INVALID",
+            description: "The package version is invalid or lower than the installed version.",
+            suggestion: "Set a higher valid version/build and deploy again.",
+        },
+        CAPABILITY_INVALID: {
+            code: "CAPABILITY_INVALID",
+            description: "The capability declaration is invalid.",
+            suggestion: "Use files: session, jobs: true or {worker: sha256-v1}, identity: standalone, rootOps: true.",
+        },
+        CAPABILITY_UNSUPPORTED: {
+            code: "CAPABILITY_UNSUPPORTED",
+            description: "This runtime does not support the chosen capability.",
+            suggestion: "files, jobs and identity need backend.kind: go; compose does not support native capabilities.",
+        },
+        CAPABILITY_COMBINATION_INVALID: {
+            code: "CAPABILITY_COMBINATION_INVALID",
+            description: "The capability combination with the runtime or UI is invalid.",
+            suggestion: "daemon cannot combine with capabilities.jobs; identity/login needs a vue UI (--ui vue).",
+        },
+        ADD_FILE_CONFLICT: {
+            code: "ADD_FILE_CONFLICT",
+            description: "Existing files conflict with the SDK overlay.",
+            suggestion: "Move or merge the listed conflicting files before running add; the CLI never overwrites different content.",
+        },
+        ADD_LAYOUT_UNSUPPORTED: {
+            code: "ADD_LAYOUT_UNSUPPORTED",
+            description: "The SDK overlay needs the standard backend directory.",
+            suggestion: "Use backend.dir: backend, or merge the SDK overlay manually.",
+        },
+        MIN_DSM_CONTAINER_FLOOR: {
+            code: "MIN_DSM_CONTAINER_FLOOR",
+            description: "The Compose minimum DSM version is too low.",
+            suggestion: "Compose needs DSM 7.2.1-69057 or later.",
+        },
+        STANDALONE_PORTAL_ENTRY_INVALID: {
+            code: "STANDALONE_PORTAL_ENTRY_INVALID",
+            description: "When os_min_ver is below DSM 7.2-64570 the executor registers the portal, and the package name or displayname does not match its rules.",
+            suggestion: "The package name may contain only alphanumerics separated by . _ -, at most 64 characters; displayname is 1-64 characters without control characters.",
+        },
+        STANDALONE_PORTAL_MIN_DSM: {
+            code: "STANDALONE_PORTAL_MIN_DSM",
+            description: "A package that declares portal has os_min_ver below DSM 7.1-42661.",
+            suggestion: "Before DSM 7.2-64570 the executor writes the entry into DSM's app.d, and that format is only verified from DSM 7.1. Raise os_min_ver to 7.1-42661 or later, or remove portal.",
+        },
+        MIN_DSM_INVALID: {
+            code: "MIN_DSM_INVALID",
+            description: "The minimum DSM version format is invalid.",
+            suggestion: "Specify a 7.x release or a full 7.x-build.",
+        },
+        NOTICE_UNSAFE: {
+            code: "NOTICE_UNSAFE",
+            description: "A license file does not meet the regular-file limits.",
+            suggestion: "Remove symlinks, special files and oversized license files.",
+        },
+        NOTICE_MISSING: {
+            code: "NOTICE_MISSING",
+            description: "Third-party license information is missing.",
+            suggestion: "Reinstall the template dependencies and generate the third-party notices.",
+        },
+        PROJECT_NOT_FOUND: {
+            code: "PROJECT_NOT_FOUND",
+            description: "The project manifest was not found.",
+            suggestion: "Run from the project root or use --project.",
+        },
+        CLI_OPTION_INVALID: {
+            code: "CLI_OPTION_INVALID",
+            description: "A command option is invalid.",
+            suggestion: "Use --help to check the options and the available runtime.",
+        },
+        CLI_OUTPUT_ARCH_REQUIRED: {
+            code: "CLI_OUTPUT_ARCH_REQUIRED",
+            description: "Writing a single file needs an architecture.",
+            suggestion: "Combine -o with a single --arch, or use --out-dir.",
+        },
+        HOST_REQUIRED: {
+            code: "HOST_REQUIRED",
+            description: "No NAS was specified.",
+            suggestion: "Use --host <profile>; for a local deploy check use --dry-run.",
+        },
+        NAS_CREDENTIALS_MISSING: {
+            code: "NAS_CREDENTIALS_MISSING",
+            description: "NAS credentials were not found.",
+            suggestion: "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD.",
+        },
+        NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE: {
+            code: "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE",
+            description: "A scripts/ lifecycle script in the native layout metadata is not executable (inspect's SPK_SCRIPT_NOT_EXECUTABLE).",
+            suggestion: "chmod +x the script in the layout metadata directory, then build again.",
+        },
+        NATIVE_TOOLKIT_TAR_UNSUPPORTED: {
+            code: "NATIVE_TOOLKIT_TAR_UNSUPPORTED",
+            description: "Extracting native.toolkits needs GNU tar or bsdtar, but the tar on PATH is neither.",
+            suggestion: "Point the tar on PATH at GNU tar or bsdtar (macOS ships bsdtar, most Linux distros GNU tar), then build again.",
+        },
+        SPK_INSPECTION_FAILED: {
+            code: "SPK_INSPECTION_FAILED",
+            description: "The SPK does not match the DSM 7 package format (dsm.errors), or a synopkgland-built SPK does not match the build contract (findings).",
+            suggestion: "Fix the SPK_* rule codes and findings, then repackage; warnings do not affect the result.",
+        },
+        IMAGE_PIN_REQUIRED: {
+            code: "IMAGE_PIN_REQUIRED",
+            description: "The image digest is not pinned.",
+            suggestion: "Run images pin.",
+        },
+        INIT_TEMPLATE_REQUIRED: {
+            code: "INIT_TEMPLATE_REQUIRED",
+            description: "No template was specified.",
+            suggestion: "Use -t native-go, native-python, native-node, native-rust, binary or compose.",
+        },
+        INIT_TEMPLATE_UNKNOWN: {
+            code: "INIT_TEMPLATE_UNKNOWN",
+            description: "Unknown template.",
+            suggestion: "Use -t native-go, native-python, native-node, native-rust, binary or compose.",
+        },
+        CLI_ARCH_INVALID: {
+            code: "CLI_ARCH_INVALID",
+            description: "The architecture option is invalid.",
+            suggestion: "Use x86_64, aarch64 or armv7 (armv7 is for native-go and binary, not for Container Manager Apps).",
+        },
+        CLI_JOBS_INVALID: {
+            code: "CLI_JOBS_INVALID",
+            description: "--jobs is not a positive integer.",
+            suggestion: "Use --jobs 1 (the default) or a larger integer.",
+        },
+        BUILD_NOT_REPRODUCIBLE: {
+            code: "BUILD_NOT_REPRODUCIBLE",
+            description: "A second SPK built by build --verify-reproducible differs from the first.",
+            suggestion: "Look at the listed payload and metadata files and remove anything that changes per build (timestamps, random or absolute paths, unpinned dependencies).",
+        },
+        REPRODUCIBLE_INVALID: {
+            code: "REPRODUCIBLE_INVALID",
+            description: "The reproducible configuration is malformed, or a listed input is not a file inside the project.",
+            suggestion: "Use reproducible: {inputs: [files...], clean: [paths...]} with project-relative paths; {arch} is only allowed in clean.",
+        },
+        DEVELOPMENT_INSTANCE_UNSUPPORTED: {
+            code: "DEVELOPMENT_INSTANCE_UNSUPPORTED",
+            description: "A native project does not support --dev.",
+            suggestion: "Use a different package ID when running init.",
+        },
+        INIT_OPTIONS_UNSUPPORTED: {
+            code: "INIT_OPTIONS_UNSUPPORTED",
+            description: "The option does not apply to this template.",
+            suggestion: "--from is compose only; --ui is native templates only (native-go, native-python, native-node, native-rust).",
+        },
+        INIT_TARGET_NOT_EMPTY: {
+            code: "INIT_TARGET_NOT_EMPTY",
+            description: "The init directory already has conflicting files.",
+            suggestion: "Use an empty directory; add capabilities to an existing project with add.",
+        },
+        INIT_COMPOSE_INVALID: {
+            code: "INIT_COMPOSE_INVALID",
+            description: "The imported Compose is invalid.",
+            suggestion: "Point --from at a YAML file with services.",
+        },
+        INIT_BINARY_BUILD_FAILED: {
+            code: "INIT_BINARY_BUILD_FAILED",
+            description: "The binary example failed to compile.",
+            suggestion: "Install Go or provide your own static CGI ELF.",
+        },
+        INIT_SHARED_FOLDER_INVALID: {
+            code: "INIT_SHARED_FOLDER_INVALID",
+            description: "The shared folder option is invalid.",
+            suggestion: "Use select or create; add --shared-folder-name with create.",
+        },
+        INIT_UI_INVALID: {
+            code: "INIT_UI_INVALID",
+            description: "The UI option is invalid.",
+            suggestion: "Use --ui vue or plain.",
+        },
+        INIT_PACKAGE_INVALID: {
+            code: "INIT_PACKAGE_INVALID",
+            description: "The package name is invalid.",
+            suggestion: "Use a 2-64 character alphanumeric name that starts with a letter.",
+        },
+        INIT_DISPLAY_NAME_INVALID: {
+            code: "INIT_DISPLAY_NAME_INVALID",
+            description: "The display name is invalid.",
+            suggestion: "Use single-line text without quotes or backslashes.",
+        },
+        STANDALONE_API_PERMISSIONS_CHANGED: {
+            code: "STANDALONE_API_PERMISSIONS_CHANGED",
+            description: "The API policy changed during the build.",
+            suggestion: "Freeze permissions.json, then run check/build again.",
+        },
+        STANDALONE_API_PERMISSIONS_INVALID: {
+            code: "STANDALONE_API_PERMISSIONS_INVALID",
+            description: "The API policy is invalid.",
+            suggestion: "Fix backend/internal/api/permissions.json.",
+        },
+        CLI_OPTION_UNKNOWN: {
+            code: "CLI_OPTION_UNKNOWN",
+            description: "Unknown CLI option.",
+            suggestion: "Use --help to see the currently supported options.",
+        },
+        CLI_ARGUMENT_MISSING: {
+            code: "CLI_ARGUMENT_MISSING",
+            description: "A command argument is missing.",
+            suggestion: "Use --help to see the required arguments.",
+        },
+        CLI_OPTION_MISSING: {
+            code: "CLI_OPTION_MISSING",
+            description: "A required option is missing.",
+            suggestion: "Use --help to see the required options.",
+        },
+        CLI_OPTION_ARGUMENT_MISSING: {
+            code: "CLI_OPTION_ARGUMENT_MISSING",
+            description: "An option is missing its value.",
+            suggestion: "Pass the value the option needs.",
+        },
+        CLI_COMMAND_UNKNOWN: {
+            code: "CLI_COMMAND_UNKNOWN",
+            description: "Unknown command.",
+            suggestion: "Use synopkgland --help to see the commands.",
+        },
+        COMMAND_FAILED: {
+            code: "COMMAND_FAILED",
+            description: "The command failed.",
+            suggestion: "Check the message and stderr, fix the problem and retry.",
+        },
+        DEPLOY_PLAN_INVALID: {
+            code: "DEPLOY_PLAN_INVALID",
+            description: "The deploy plan does not match the runtime.",
+            suggestion: "Run check again and regenerate the deploy plan.",
+        },
+        DEPLOY_ARCH_UNDETERMINED: {
+            code: "DEPLOY_ARCH_UNDETERMINED",
+            description: "The NAS architecture could not be determined.",
+            suggestion: "Use --arch x86_64, aarch64 or armv7.",
+        },
+        CONTAINER_ARCH_UNSUPPORTED: {
+            code: "CONTAINER_ARCH_UNSUPPORTED",
+            description: "Container Manager Apps support only x86_64 and aarch64; DSM does not provide Container Manager for armv7.",
+            suggestion: "Use --arch x86_64 or aarch64, or switch to the native-go template.",
+        },
+        DEPLOY_BUILD_OUTPUT_INVALID: {
+            code: "DEPLOY_BUILD_OUTPUT_INVALID",
+            description: "The number of deploy build outputs does not match.",
+            suggestion: "Specify a single architecture and build again.",
+        },
+        EXECUTOR_BUILD_FAILED: {
+            code: "EXECUTOR_BUILD_FAILED",
+            description: "Compiling the executor or lifecycle helper from the App's SDK version failed.",
+            suggestion: "Confirm Go 1.21 or later is installed and go1.26.9 is available (prepare it offline), and check the compiler output in the message.",
+        },
+        EXECUTOR_DIGEST_MISMATCH: {
+            code: "EXECUTOR_DIGEST_MISMATCH",
+            description: "The executor built from the SDK version does not match the sha256 table bundled in the CLI, or the table has no entry for this SDK version.",
+            suggestion: "Confirm github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod is a release version and Go is go1.26.9; upgrade the CLI when the table has no entry for that version.",
+        },
+        EXECUTOR_DIGEST_UNVERIFIED: {
+            code: "EXECUTOR_DIGEST_UNVERIFIED",
+            description: "SYNOPKGLAND_SDK_DIR points at a local SDK, so the executor was not checked against the sha256 table (warning).",
+            suggestion: "Development only; for a publishable SPK unset SYNOPKGLAND_SDK_DIR and build again.",
+        },
+        SDK_REQUIRED: {
+            code: "SDK_REQUIRED",
+            description: "Python, Node and Rust Apps, and rootOps or delegate, need the SDK, but the backend does not name an SDK version (Go: backend/go.mod; Python and Node: backend.sdk; Rust: syno-pkg-land-app in Cargo.toml).",
+            suggestion: "In Go add require github.com/synopackageland/syno-pkg-land-sdk to backend/go.mod; in Python and Node write backend.sdk in dsm-package.yaml; in Rust depend on syno-pkg-land-app by git+tag in the App's Cargo.toml; keep the version on the same minor as the CLI.",
+        },
+        SDK_TAG_REQUIRED: {
+            code: "SDK_TAG_REQUIRED",
+            description: "The Rust App's Cargo.lock does not pin exactly one syno-pkg-land-app to a release tag (branch, rev, path, registry and multiple versions are all rejected).",
+            suggestion: 'Write syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "vX.Y.Z" } in Cargo.toml, run cargo update -p syno-pkg-land-app and commit Cargo.lock.',
+        },
+        SDK_VERSION_MISMATCH: {
+            code: "SDK_VERSION_MISMATCH",
+            description: "The @synopackageland/sdk in frontend/package.json differs from the SDK version the backend requires (backend/go.mod or backend/Cargo.lock).",
+            suggestion: "Make both sides the same version; for a file: dependency the comparison uses that directory's package.json version.",
+        },
+        SDK_UNSUPPORTED: {
+            code: "SDK_UNSUPPORTED",
+            description: "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.",
+            suggestion: "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message).",
+        },
+        SDK_DIR_NOT_READY: {
+            code: "SDK_DIR_NOT_READY",
+            description: "The SDK checkout SYNOPKGLAND_SDK_DIR points at has no go.mod, or the ts package a Vue project needs is not built (no ts/dist).",
+            suggestion: "Point at a syno-pkg-land-sdk checkout; for a Vue project first run npm ci && npm run build in $SYNOPKGLAND_SDK_DIR/ts (npm does not build file: packages for you).",
+        },
+        SDK_DOWNLOAD_FAILED: {
+            code: "SDK_DOWNLOAD_FAILED",
+            description: "go mod download cannot fetch the SDK version backend/go.mod requires.",
+            suggestion: "The CLI fetches the private SDK with git: make sure git can read github.com with credentials (verify with git ls-remote), then confirm the version exists. Offline, run go mod download once on the same machine first.",
+        },
+        TEMPLATES_MISSING: {
+            code: "TEMPLATES_MISSING",
+            description: "@synopackageland/templates was not found.",
+            suggestion: "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout.",
+        },
+        EXECUTOR_PIN_REQUIRED: {
+            code: "EXECUTOR_PIN_REQUIRED",
+            description: "A package that declares rootOps or delegate was built without the executor artifact.",
+            suggestion: "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly.",
+        },
+        EXECUTOR_POLICY: {
+            code: "EXECUTOR_POLICY",
+            description: "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.",
+            suggestion: "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches.",
+        },
+        EXECUTOR_POLICY_REJECTED: {
+            code: "EXECUTOR_POLICY_REJECTED",
+            description: "The executor of the App's SDK version refuses the policy the CLI generated, so the NAS would refuse it at approval.",
+            suggestion: "The reason names the refused part: policy root/start/stop/purge → root.programs (schema, run, job), root.start, root.stop, uninstall.purge; policy scope/operation/destination/move/lifetime → capabilities.delegate; policy portal → portal; policy entry → entry. Fix that part of dsm-package.yaml; if it already matches the manifest reference, use the SDK version this CLI release names.",
+        },
+        EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED: {
+            code: "EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED",
+            description: "The root settings in dsm-package.yaml need an executor that supports root program settings, which the App's SDK version lacks.",
+            suggestion: "Use an SDK with root programs, stop and root_state (executor/stop_step.go), or remove the root settings.",
+        },
+        EXECUTOR_PACKAGE: {
+            code: "EXECUTOR_PACKAGE",
+            description: "The package name pinned into the root task is invalid.",
+            suggestion: "package must start with a letter and contain only alphanumerics (2-64 characters).",
+        },
+        EXECUTOR_DIGEST: {
+            code: "EXECUTOR_DIGEST",
+            description: "The sha256 pin for the executor or policy is malformed.",
+            suggestion: "Build again so the CLI recomputes the pin; do not hand-edit pins inside the SPK.",
+        },
+        EXECUTOR_TASK_PERCENT: {
+            code: "EXECUTOR_TASK_PERCENT",
+            description: "The root task script contains %, which the DSM task scheduler cannot store.",
+            suggestion: "Remove % from the root/ scripts (for example rewrite the date format).",
+        },
+        EXECUTOR_TASK_LENGTH: {
+            code: "EXECUTOR_TASK_LENGTH",
+            description: "The root task script exceeds the DSM task scheduler's length limit.",
+            suggestion: "Shorten the root/ scripts; move the logic into a file inside the package and call it from the script.",
+        },
+        STANDALONE_ENTRY_INVALID: {
+            code: "STANDALONE_ENTRY_INVALID",
+            description: "The entry configuration is invalid.",
+            suggestion: "Set entry to admin-only or app-privilege; app-privilege needs at least one authenticated route.",
+        },
+        STANDALONE_ENTRY_WIDENED: {
+            code: "STANDALONE_ENTRY_WIDENED",
+            description: "entry: admin-only conflicts with routes that widen access.",
+            suggestion: "Change the authenticated or public routes in permissions.json to administrators; to open it to regular users use entry: app-privilege or omit entry.",
+        },
+        STANDALONE_ENTRY_UNSUPPORTED: {
+            code: "STANDALONE_ENTRY_UNSUPPORTED",
+            description: "The backend cannot enforce the entry mode.",
+            suggestion: "Use a Go backend: require github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod and wrap the authenticator with dsm.NewEntryGate in the main.go of backend.main (init defaults to cmd/app/main.go).",
+        },
+        DSM_TLS_UNTRUSTED: {
+            code: "DSM_TLS_UNTRUSTED",
+            description: "The DSM TLS certificate is not trusted by this computer (self-signed, expired or a name mismatch).",
+            suggestion: "Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<file>; or give DSM a trusted certificate whose name matches the host profile. Do not disable certificate verification.",
+        },
+        STANDALONE_ICON_INVALID: {
+            code: "STANDALONE_ICON_INVALID",
+            description: "The icon in dsm-package.yaml is not a usable package icon.",
+            suggestion: "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon.",
+        },
+        CONTRACT_ICON_INVALID: {
+            code: "CONTRACT_ICON_INVALID",
+            description: "The icon in synology-app.yaml is not a usable package icon.",
+            suggestion: "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon.",
+        },
+        CONTRACT_I18N_INVALID: {
+            code: "CONTRACT_I18N_INVALID",
+            description: "The i18n configuration in synology-app.yaml is invalid.",
+            suggestion: 'i18n accepts only info; info is keyed by a supported language such as zh-TW or ja with single-line displayname / description values without " or \\ (English goes at the top level).',
+        },
+        STANDALONE_BRIDGE_APP_IN_UI: {
+            code: "STANDALONE_BRIDGE_APP_IN_UI",
+            description: "The backend.dir and ui.dir of a Python, Node or Rust App overlap; DSM serves the files under ui/ directly.",
+            suggestion: "Put the App in a directory outside ui.dir (for example app/); neither may contain the other.",
+        },
+        STANDALONE_BRIDGE_METHODS_MISMATCH: {
+            code: "STANDALONE_BRIDGE_METHODS_MISMATCH",
+            description: "The App's methods do not match permissions.json, or use an SDK method name; the runtime refuses to start.",
+            suggestion: "permissions.json lists only the App's own methods; an App method must not share a name with an SDK method (nas.*, identity.*, portal.status and others).",
+        },
+        STANDALONE_RUNTIME_BUILD_FAILED: {
+            code: "STANDALONE_RUNTIME_BUILD_FAILED",
+            description: "Compiling the bridge runtime (bridge/cmd/runtime) from the App's SDK version failed, or the result was not built with go1.26.9.",
+            suggestion: "Confirm Go 1.21 or later is installed and go1.26.9 is available; that SDK version must contain the bridge runtime; check the compiler output in the message.",
+        },
+        STANDALONE_BRIDGE_DESCRIBE_FAILED: {
+            code: "STANDALONE_BRIDGE_DESCRIBE_FAILED",
+            description: "There is no backend.methods, so build starts the App to read hello, but the App did not answer a v1 hello.",
+            suggestion: "Install python3 or node on the build machine and make sure the App starts; or list backend.methods in dsm-package.yaml.",
+        },
+        STANDALONE_NODE_DEPENDENCY_MISSING: {
+            code: "STANDALONE_NODE_DEPENDENCY_MISSING",
+            description: "The Node App's package.json dependencies are not installed in the App's node_modules.",
+            suggestion: "Run npm ci --omit=dev in the App directory and build again; the CLI places @synopackageland/app, so it does not need installing.",
+        },
+        STANDALONE_BRIDGE_APP_INVALID: {
+            code: "STANDALONE_BRIDGE_APP_INVALID",
+            description: "The App directory contains a symlink or special file, or exceeds 256 MiB.",
+            suggestion: "Keep only regular files and directories in the App directory; move large data out of it.",
+        },
+        STANDALONE_RUST_BUILD_FAILED: {
+            code: "STANDALONE_RUST_BUILD_FAILED",
+            description: "The Rust App's cargo zigbuild cross-compile failed, or it produced no binary for backend.entry.",
+            suggestion: "Install Rust with rustup and the three targets (x86_64/aarch64-unknown-linux-musl, armv7-unknown-linux-gnueabihf), install cargo-zigbuild and zig; set backend.entry to the Cargo binary name; check the compiler output in the message.",
+        },
+        STANDALONE_BRIDGE_MANIFEST_INVALID: {
+            code: "STANDALONE_BRIDGE_MANIFEST_INVALID",
+            description: "The bridge.json the CLI produced does not match spec/bridge/v1 manifest.schema.json.",
+            suggestion: "Check backend.entry, methods and node.package; if it still fails, report the CLI bug.",
+        },
+        STANDALONE_PYTHON_SDK_MISSING: {
+            code: "STANDALONE_PYTHON_SDK_MISSING",
+            description: "The App's SDK version has no Python SDK (python/synopkgland_app).",
+            suggestion: "Point SYNOPKGLAND_SDK_DIR at a syno-pkg-land-sdk checkout that has python/synopkgland_app, or require an SDK release that ships it.",
+        },
+        STANDALONE_NODE_SDK_NOT_BUILT: {
+            code: "STANDALONE_NODE_SDK_NOT_BUILT",
+            description: "The App's SDK version has no built Node SDK (node/dist).",
+            suggestion: "Run npm ci && npm run build in node/ of the SYNOPKGLAND_SDK_DIR checkout first; a release SDK must contain node/dist.",
+        },
+        COMPOSE_POSIX_ALL_SHARES_UNDECLARED: {
+            code: "COMPOSE_POSIX_ALL_SHARES_UNDECLARED",
+            description: "Compose uses an undeclared POSIX all-shares marker.",
+            suggestion: "Declare type: posix_all_shares so the package-only wizard/CLI takes the Share snapshot at install time.",
+        },
+        COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN: {
+            code: "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN",
+            description: "A POSIX all-shares marker must not carry a Share subpath.",
+            suggestion: "Use the complete ${ALL_SHARES} source only; the package-only preinst expands each Share's container target.",
+        },
+        COMPOSE_ENV_MISSING: {
+            code: "COMPOSE_ENV_MISSING",
+            description: "The project is missing the required environment variable directory structure.",
+            suggestion: "Make sure SYNOPKG_PKGVAR and the secrets directory are created correctly.",
+        },
+        COMPOSE_NOT_HEALTHY: {
+            code: "COMPOSE_NOT_HEALTHY",
+            description: "The Compose service did not reach healthy within the time limit.",
+            suggestion: "Check the container healthcheck and application logs: synopkgland logs --host <nas>.",
+        },
+        COMPOSE_NOT_RUNNING: {
+            code: "COMPOSE_NOT_RUNNING",
+            description: "The Compose service did not stay running within the time limit.",
+            suggestion: "Check the container start script and logs for the crash cause: synopkgland logs --host <nas>.",
+        },
     },
-    "COMPOSE_ROUTE_UNSUPPORTED": {
-        "code": "COMPOSE_ROUTE_UNSUPPORTED",
-        "description": "Compose has no supported DSM resource worker execution path.",
-        "suggestion": "Use a prebuilt image and supported install parameters; remove unsupported privileges, secrets or build settings."
-    },
-    "LOCAL_SPK_INSTALL_FAILED": {
-        "code": "LOCAL_SPK_INSTALL_FAILED",
-        "description": "The local SPK install in DSM failed.",
-        "suggestion": "Check the DSM Package Center install error and confirm the package version and requirements."
-    },
-    "CONTRACT_SCHEMA_UNSUPPORTED": {
-        "code": "CONTRACT_SCHEMA_UNSUPPORTED",
-        "description": "The schema version in synology-app.yaml is not supported.",
-        "suggestion": "Set the schema field in synology-app.yaml to 1."
-    },
-    "CONTRACT_MISSING_FIELD": {
-        "code": "CONTRACT_MISSING_FIELD",
-        "description": "synology-app.yaml is missing a required field.",
-        "suggestion": "Add the missing required fields to synology-app.yaml (for example package, version, displayname)."
-    },
-    "CONTRACT_SCHEMA_INVALID": {
-        "code": "CONTRACT_SCHEMA_INVALID",
-        "description": "synology-app.yaml does not match the JSON Schema.",
-        "suggestion": "Fix the field formats in synology-app.yaml so they match the schema."
-    },
-    "PACKAGE_IDENTITY_TOO_LONG": {
-        "code": "PACKAGE_IDENTITY_TOO_LONG",
-        "description": "The Package Identity exceeds the length limit (28 characters for a formal identity, 32 for the final identity).",
-        "suggestion": "Shorten the package name in synology-app.yaml (at most 28 characters for the formal identity, leaving 4 characters for the .dev suffix)."
-    },
-    "CONTRACT_PACKAGE_TOO_LONG": {
-        "code": "CONTRACT_PACKAGE_TOO_LONG",
-        "description": "The Package Identity exceeds the DSM limit of 32 characters.",
-        "suggestion": "Shorten the package name in synology-app.yaml to 32 characters or fewer."
-    },
-    "CONTRACT_ADMINPORT_INVALID": {
-        "code": "CONTRACT_ADMINPORT_INVALID",
-        "description": "adminport must be an integer.",
-        "suggestion": "Provide an integer adminport in synology-app.yaml that matches the Compose published port."
-    },
-    "CONTRACT_ADMINPORT_UNMAPPED": {
-        "code": "CONTRACT_ADMINPORT_UNMAPPED",
-        "description": "adminport does not map to a container port in the Compose ports declaration.",
-        "suggestion": "Declare a port mapping for adminport in the compose.yaml ports block (for example \"8080:80\")."
-    },
-    "CONTRACT_LAUNCH_INVALID": {
-        "code": "CONTRACT_LAUNCH_INVALID",
-        "description": "The integration.web.launch mode is invalid.",
-        "suggestion": "Use dsm-window (DSM window) or new-page (new tab, the default); omit this field for a headless App."
-    },
-    "CONTRACT_LAUNCH_REQUIRES_WEB": {
-        "code": "CONTRACT_LAUNCH_REQUIRES_WEB",
-        "description": "A headless App does not declare a Web Launch Mode.",
-        "suggestion": "Remove integration.web.launch, or add the adminport that matches the Compose published port."
-    },
-    "CONTRACT_PORTAL_REQUIRES_EXECUTOR": {
-        "code": "CONTRACT_PORTAL_REQUIRES_EXECUTOR",
-        "description": "The Compose App declares integration.web.portal, but a Compose App has no executor; removing the sign-in alias after uninstall needs root so nginx stops serving it.",
-        "suggestion": "Remove integration.web.portal; for a sign-in alias, ask an administrator to configure a reverse proxy in DSM instead."
-    },
-    "CONTRACT_ACCESS_INVALID": {
-        "code": "CONTRACT_ACCESS_INVALID",
-        "description": "The integration.web.access mode is invalid.",
-        "suggestion": "Use dsm-users (signed-in DSM users, the default), dsm-admins, dsm-groups (with groups), or public to keep an anonymous Web Station entry."
-    },
-    "CONTRACT_ACCESS_GROUPS_INVALID": {
-        "code": "CONTRACT_ACCESS_GROUPS_INVALID",
-        "description": "integration.web.groups is missing, malformed, or not combined with access: dsm-groups.",
-        "suggestion": "Use access: dsm-groups and list DSM group names, or remove groups."
-    },
-    "CONTRACT_ACCESS_REQUIRES_WEB": {
-        "code": "CONTRACT_ACCESS_REQUIRES_WEB",
-        "description": "A headless App does not declare Web access rules.",
-        "suggestion": "Remove integration.web.access/groups, or add the adminport that matches the Compose published port."
-    },
-    "COMPOSE_GATEWAY_PORT_EXPOSED": {
-        "code": "COMPOSE_GATEWAY_PORT_EXPOSED",
-        "description": "The DSM verification gateway is the container's only entry point, but the Compose port behind adminport binds to every network interface.",
-        "suggestion": "Bind ports to loopback only (for example \"127.0.0.1:18333:18333\"), or choose public explicitly in integration.web.access."
-    },
-    "GATEWAY_ARCH_FAMILY_REQUIRED": {
-        "code": "GATEWAY_ARCH_FAMILY_REQUIRED",
-        "description": "The DSM verification gateway is a native binary, so the SPK must name its target architecture.",
-        "suggestion": "Add --arch x86_64 or --arch aarch64 (deploy detects it from the NAS); only Apps without DSM verification may choose public in integration.web.access."
-    },
-    "GATEWAY_GO_MISSING": {
-        "code": "GATEWAY_GO_MISSING",
-        "description": "Building the DSM verification gateway needs Go, but the go command was not found.",
-        "suggestion": "Install Go 1.21 or later (https://go.dev/dl/, builds pin go1.26.9), or choose public explicitly in integration.web.access."
-    },
-    "GATEWAY_BUILD_FAILED": {
-        "code": "GATEWAY_BUILD_FAILED",
-        "description": "The DSM verification gateway failed to build, or the output is not a static ELF for the target architecture.",
-        "suggestion": "Check the go build output; the gateway always builds with go1.26.9, so install go1.26.9 offline or let GOPROXY serve golang.org/toolchain, and confirm assets/go/gateway in the CLI package is unmodified."
-    },
-    "CONTRACT_INVALID_STRING": {
-        "code": "CONTRACT_INVALID_STRING",
-        "description": "A contract string contains a control character or the ${ interpolation syntax, which is not allowed.",
-        "suggestion": "Remove control characters and ${ interpolation; declare install parameters in the install block."
-    },
-    "CONTRACT_DSM_USER_DUPLICATE": {
-        "code": "CONTRACT_DSM_USER_DUPLICATE",
-        "description": "Each App may declare at most one dsm_user install parameter.",
-        "suggestion": "Keep only one Container Run-as parameter in synology-app.yaml."
-    },
-    "INSTALL_STRING_TOO_LONG": {
-        "code": "INSTALL_STRING_TOO_LONG",
-        "description": "An Install Parameter string default exceeds 256 characters.",
-        "suggestion": "Shorten the default string of the install parameter in synology-app.yaml."
-    },
-    "INSTALL_STRING_INVALID": {
-        "code": "INSTALL_STRING_INVALID",
-        "description": "An Install Parameter string value contains an invalid character or interpolation.",
-        "suggestion": "Remove control characters and ${ interpolation from the install parameter default."
-    },
-    "CONTRACT_SECRET_UNSUPPORTED": {
-        "code": "CONTRACT_SECRET_UNSUPPORTED",
-        "description": "install.<NAME>.type: secret has no usable install path today: whether or not Compose references it, Package Center install ends in DSM broken/150 and creates no Container Manager project.",
-        "suggestion": "Use type: string (non-sensitive), or have the App fetch the secret itself at startup or read a file an administrator places in ${SYNO_APP_SECRETS_DIR}. The secret type stays closed until the DSM worker failure reason is observable."
-    },
-    "CONTRACT_HOMES_UNSUPPORTED": {
-        "code": "CONTRACT_HOMES_UNSUPPORTED",
-        "description": "install.<NAME>.type: homes has no usable install path today: the install wizard generates no input control and Package Center install ends in DSM broken/150; CLI deploy can resolve /volume1/homes, but DSM rejects the compound install with 4540.",
-        "suggestion": "If the App needs an administrator-chosen folder, use type: shared_folder instead. The homes type stays closed until the wizard control and preinst path resolution exist."
-    },
-    "INSTALL_PARAMETER_UNREFERENCED": {
-        "code": "INSTALL_PARAMETER_UNREFERENCED",
-        "description": "An install parameter is declared but not referenced in Compose.",
-        "suggestion": "Reference the parameter in compose.yaml as ${NAME}, or remove the unused declaration from synology-app.yaml."
-    },
-    "CONTRACT_HOMES_PATH_FORBIDDEN": {
-        "code": "CONTRACT_HOMES_PATH_FORBIDDEN",
-        "description": "A homes Install Parameter must not write a NAS physical path or default value into the contract.",
-        "suggestion": "Declare only type: homes, reference the parameter in Compose, and let the package resolve this NAS's User Home path at install time."
-    },
-    "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN": {
-        "code": "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN",
-        "description": "A POSIX all-shares parameter must not specify a default or NAS physical path in the contract.",
-        "suggestion": "Declare only type: posix_all_shares and let the wizard/CLI take the current Share snapshot at install time."
-    },
-    "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED": {
-        "code": "CONTRACT_POSIX_ALL_SHARES_LISTING_UNSUPPORTED",
-        "description": "posix_all_shares requires the CLI to take a Share list snapshot of this NAS with an administrator session at install time; Package Center and Package Source listing cannot fulfill this contract.",
-        "suggestion": "Use synopkgland deploy --host <name> so an administrator session takes the Share list snapshot at install time; this type cannot ship through Package Center or Package Source listing."
-    },
-    "DSM_USER_REQUIRED": {
-        "code": "DSM_USER_REQUIRED",
-        "description": "A Shared Folder requires exactly one dsm_user as the Container Run-as.",
-        "suggestion": "Add install.<NAME>.type: dsm_user to synology-app.yaml and reference ${NAME_UID}:${NAME_GID} in Compose."
-    },
-    "PROJECT_RUNTIME_EXCLUSIVE": {
-        "code": "PROJECT_RUNTIME_EXCLUSIVE",
-        "description": "The project has both compose.yaml and dsm-package.yaml, which are mutually exclusive.",
-        "suggestion": "Choose compose.yaml (container App) or dsm-package.yaml (native App) and delete the other file."
-    },
-    "COMPOSE_MISSING": {
-        "code": "COMPOSE_MISSING",
-        "description": "compose.yaml or dsm-package.yaml was not found.",
-        "suggestion": "Create compose.yaml or dsm-package.yaml in the project root."
-    },
-    "COMPOSE_SERVICE_NOT_FOUND": {
-        "code": "COMPOSE_SERVICE_NOT_FOUND",
-        "description": "A service referenced by depends_on does not exist in compose.yaml.",
-        "suggestion": "Fix depends_on in compose.yaml to point at a defined service name."
-    },
-    "COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN": {
-        "code": "COMPOSE_NUMERIC_COMMAND_ARG_FORBIDDEN",
-        "description": "A Compose command/entrypoint array that goes through the DSM Docker Project resource worker contains a pure numeric string, which a YAML round-trip may turn into an integer and fail to acquire.",
-        "suggestion": "Wrap the whole command in one string, for example command: [\"sh\", \"-c\", \"httpd -f -p 8080 -h /srv\"], or join it with the flag as \"-p8080\"."
-    },
-    "COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED": {
-        "code": "COMPOSE_DYNAMIC_ROUTE_UNSUPPORTED",
-        "description": "A Compose dynamic route is outside the D1/D2 allowlist, or uses a secret/config source the DSM worker does not load.",
-        "suggestion": "Use only ${NAME} interpolation of string/boolean wizard answers; secret/config are rejected because the DSM worker does not read docker-compose.override.yml."
-    },
-    "COMPOSE_BUILD_FORBIDDEN": {
-        "code": "COMPOSE_BUILD_FORBIDDEN",
-        "description": "The D0 Compose route forbids build: at NAS install time; the build capability is permanently rejected.",
-        "suggestion": "Remove build: and use an existing image (preferably pinned with image@sha256:...), then run check again."
-    },
-    "COMPOSE_SOCKET_MOUNT_FORBIDDEN": {
-        "code": "COMPOSE_SOCKET_MOUNT_FORBIDDEN",
-        "description": "Mounting the Docker socket or sensitive system sockets is forbidden.",
-        "suggestion": "Remove the docker.sock mount from compose.yaml; for file access use a shared_folder or the App's own file API."
-    },
-    "COMPOSE_BIND_SOURCE_FORBIDDEN": {
-        "code": "COMPOSE_BIND_SOURCE_FORBIDDEN",
-        "description": "A mount source path is invalid or is a protected system path.",
-        "suggestion": "Use the controlled ${SYNOPKG_PKGVAR}, ${SYNO_APP_SECRETS_DIR}, or a declared ${SHARED_FOLDER} slot."
-    },
-    "COMPOSE_BIND_SOURCE_UNDECLARED": {
-        "code": "COMPOSE_BIND_SOURCE_UNDECLARED",
-        "description": "A volume mount uses an undeclared Shared Folder variable.",
-        "suggestion": "Declare the shared_folder parameter in the synology-app.yaml install block first."
-    },
-    "COMPOSE_BIND_SUFFIX_INVALID": {
-        "code": "COMPOSE_BIND_SUFFIX_INVALID",
-        "description": "A Shared Folder subpath is invalid (it contains .. or a control character).",
-        "suggestion": "Use a valid relative subpath, for example ${MEDIA_SHARE}/data:/data."
-    },
-    "COMPOSE_POSIX_ALL_SHARES_UNDECLARED": {
-        "code": "COMPOSE_POSIX_ALL_SHARES_UNDECLARED",
-        "description": "Compose uses an undeclared POSIX all-shares marker.",
-        "suggestion": "Declare type: posix_all_shares so the package-only wizard/CLI takes the Share snapshot at install time."
-    },
-    "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN": {
-        "code": "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN",
-        "description": "A POSIX all-shares marker must not carry a Share subpath.",
-        "suggestion": "Use the complete ${ALL_SHARES} source only; the package-only preinst expands each Share's container target."
-    },
-    "COMPOSE_HOST_BIND_FORBIDDEN": {
-        "code": "COMPOSE_HOST_BIND_FORBIDDEN",
-        "description": "Hard-coded host paths (for example /volume1/... or ./) are forbidden.",
-        "suggestion": "Declare a shared_folder parameter in synology-app.yaml and reference it as ${SLOT} in Compose."
-    },
-    "COMPOSE_NAMED_VOLUME_UNDECLARED": {
-        "code": "COMPOSE_NAMED_VOLUME_UNDECLARED",
-        "description": "A service uses a Named Volume that is not declared in the top-level volumes.",
-        "suggestion": "Add the volume declaration to the top-level volumes block in compose.yaml, or use a controlled directory."
-    },
-    "COMPOSE_USER_ROOT_FORBIDDEN": {
-        "code": "COMPOSE_USER_ROOT_FORBIDDEN",
-        "description": "The container runs as root (0:0), violating least privilege.",
-        "suggestion": "Declare dsm_user in synology-app.yaml and use ${USER_UID}:${USER_GID} in Compose."
-    },
-    "COMPOSE_USER_CONFLICTS_DSM_USER": {
-        "code": "COMPOSE_USER_CONFLICTS_DSM_USER",
-        "description": "The Compose service defines its own user field, which conflicts with the dsm_user declared in the contract.",
-        "suggestion": "Remove the user field from Compose; dsm_user injects ${NAME_UID}:${NAME_GID} and group_add automatically."
-    },
-    "COMPOSE_USER_NUMERIC_FORBIDDEN": {
-        "code": "COMPOSE_USER_NUMERIC_FORBIDDEN",
-        "description": "Hard-coding a numeric uid:gid in compose.yaml is forbidden.",
-        "suggestion": "Declare dsm_user in synology-app.yaml and reference ${NAME_UID}:${NAME_GID} in Compose."
-    },
-    "COMPOSE_PRIVILEGED_FORBIDDEN": {
-        "code": "COMPOSE_PRIVILEGED_FORBIDDEN",
-        "description": "privileged: true is used but not declared in the contract.",
-        "suggestion": "Add privilege.privileged: true to synology-app.yaml, or remove privileged: true."
-    },
-    "COMPOSE_HOST_NETWORK_FORBIDDEN": {
-        "code": "COMPOSE_HOST_NETWORK_FORBIDDEN",
-        "description": "host network mode is used but not declared in the contract.",
-        "suggestion": "Add privilege.host_network: true to synology-app.yaml, or use a controlled network mode."
-    },
-    "COMPOSE_HOST_PID_FORBIDDEN": {
-        "code": "COMPOSE_HOST_PID_FORBIDDEN",
-        "description": "pid: host is used but not declared in the contract.",
-        "suggestion": "Add privilege.host_pid: true to synology-app.yaml, or remove pid: host."
-    },
-    "COMPOSE_HOST_IPC_FORBIDDEN": {
-        "code": "COMPOSE_HOST_IPC_FORBIDDEN",
-        "description": "ipc: host is used but not declared in the contract.",
-        "suggestion": "Add privilege.host_ipc: true to synology-app.yaml, or remove ipc: host."
-    },
-    "COMPOSE_DEVICES_FORBIDDEN": {
-        "code": "COMPOSE_DEVICES_FORBIDDEN",
-        "description": "Device access is used but not declared in the contract.",
-        "suggestion": "Add privilege.devices: true to synology-app.yaml, or remove the devices block."
-    },
-    "COMPOSE_CAP_ADD_FORBIDDEN": {
-        "code": "COMPOSE_CAP_ADD_FORBIDDEN",
-        "description": "cap_add privilege escalation is used but not declared in the contract.",
-        "suggestion": "Add privilege.cap_add: true to synology-app.yaml, or remove the cap_add block."
-    },
-    "COMPOSE_ENV_MISSING": {
-        "code": "COMPOSE_ENV_MISSING",
-        "description": "The project is missing the required environment variable directory structure.",
-        "suggestion": "Make sure SYNOPKG_PKGVAR and the secrets directory are created correctly."
-    },
-    "COMPOSE_NOT_HEALTHY": {
-        "code": "COMPOSE_NOT_HEALTHY",
-        "description": "The Compose service did not reach healthy within the time limit.",
-        "suggestion": "Check the container healthcheck and application logs: synopkgland logs --host <nas>."
-    },
-    "COMPOSE_NOT_RUNNING": {
-        "code": "COMPOSE_NOT_RUNNING",
-        "description": "The Compose service did not stay running within the time limit.",
-        "suggestion": "Check the container start script and logs for the crash cause: synopkgland logs --host <nas>."
-    },
-    "BUILD_SPK_FAILED": {
-        "code": "BUILD_SPK_FAILED",
-        "description": "The SPK packaging flow failed.",
-        "suggestion": "Fix the check errors and file permissions, then retry."
-    },
-    "VALIDATION_FAILED": {
-        "code": "VALIDATION_FAILED",
-        "description": "The project failed contract or security validation; deploy stopped.",
-        "suggestion": "Run synopkgland check first to fix contract and Compose errors."
-    },
-    "DEPLOY_FAILED": {
-        "code": "DEPLOY_FAILED",
-        "description": "An unclassified error occurred while deploying to the NAS.",
-        "suggestion": "Check NAS connectivity and logs: synopkgland logs --host <nas>."
-    },
-    "SHARE_VALUE_REQUIRED": {
-        "code": "SHARE_VALUE_REQUIRED",
-        "description": "Deploy is missing the physical path mapping for a shared_folder declared in the contract.",
-        "suggestion": "Provide the matching Shared Folder name with --share <SLOT>=<logical name>."
-    },
-    "SHARE_LOGICAL_NAME_REQUIRED": {
-        "code": "SHARE_LOGICAL_NAME_REQUIRED",
-        "description": "A Share parameter needs a logical name; physical paths such as /volume1/... are forbidden.",
-        "suggestion": "Give the Shared Folder logical name from DSM Control Panel, for example --share MEDIA_SHARE=photos."
-    },
-    "SHARE_NOT_FOUND": {
-        "code": "SHARE_NOT_FOUND",
-        "description": "The named Shared Folder was not found on the target NAS.",
-        "suggestion": "Create the Shared Folder in DSM Control Panel, or check the spelling."
-    },
-    "HOMES_NOT_ENABLED": {
-        "code": "HOMES_NOT_ENABLED",
-        "description": "The target NAS has User Home disabled, or the homes physical bind source cannot be resolved.",
-        "suggestion": "Enable DSM User Home on this NAS, confirm the DSM API returns the resolved path, then deploy again."
-    },
-    "DSM_USER_LOGICAL_NAME_REQUIRED": {
-        "code": "DSM_USER_LOGICAL_NAME_REQUIRED",
-        "description": "A dsm_user parameter needs a DSM user logical name; a numeric UID is forbidden.",
-        "suggestion": "Pass the DSM account name with --run-as (for example --run-as RUN_AS=alice)."
-    },
-    "SHARE_RUN_AS_NO_ACCESS": {
-        "code": "SHARE_RUN_AS_NO_ACCESS",
-        "description": "The deploy pre-install check found that the chosen Container Run-as user has no permission on the chosen Shared Folder (or is explicitly denied). The container mounts the Share as that user, so the install succeeds but runtime reads and writes get Permission denied.",
-        "suggestion": "Grant that user (or their group) permission on the Shared Folder in DSM Control Panel, or choose another user/Share, then deploy again. This check only runs in deploy; the Package Center install wizard does not go through it, and ACLs remain the administrator's responsibility."
-    },
-    "PORT_ALREADY_IN_USE": {
-        "code": "PORT_ALREADY_IN_USE",
-        "description": "The deploy pre-install check found the Compose published TCP port already taken by another service or container.",
-        "suggestion": "Change the published host port in synology-app.yaml/compose.yaml; existing containers of the same Package Identity are allowed during upgrade or reinstall."
-    },
-    "CATALOG_INSTALL_FAILED": {
-        "code": "CATALOG_INSTALL_FAILED",
-        "description": "NAS Package Center failed to install the package.",
-        "suggestion": "Check the install log in DSM Package Center or try installing manually."
-    },
-    "DEPLOY_PARAM_UNDECLARED": {
-        "code": "DEPLOY_PARAM_UNDECLARED",
-        "description": "deploy --param provided an Install Parameter the contract does not declare, or an install wizard value that a native-go/binary package does not have.",
-        "suggestion": "For Compose pass only string or boolean names declared in synology-app.yaml install; native-go/binary accept only delegate_share or delegate_home from the install-selected delegate."
-    },
-    "DEPLOY_PARAM_REQUIRED": {
-        "code": "DEPLOY_PARAM_REQUIRED",
-        "description": "The first install of an install-selected delegate package did not provide the install wizard scope value, so preinst rejects the install.",
-        "suggestion": "Add --param delegate_share=<shared folder> or --param delegate_home=true and deploy again."
-    },
-    "DEPLOY_PARAM_TYPE_INVALID": {
-        "code": "DEPLOY_PARAM_TYPE_INVALID",
-        "description": "The deploy --param value does not match the string or boolean type declared in the contract.",
-        "suggestion": "Pass a non-empty string for string; pass only true or false for boolean."
-    },
-    "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED": {
-        "code": "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED",
-        "description": "The Shared Folder list at deploy time could not be listed with an administrator session.",
-        "suggestion": "Confirm the DSM administrator session can call SYNO.Core.Share list, or provide the list explicitly with --param NAME=...."
-    },
-    "DSM_DEPENDENCY_CONFLICT": {
-        "code": "DSM_DEPENDENCY_CONFLICT",
-        "description": "DSM rejected the compound install request because of running dependent packages.",
-        "suggestion": "Stop the listed dependent packages, then retry the upgrade."
-    },
-    "DSM_COMPOUND_FAILED": {
-        "code": "DSM_COMPOUND_FAILED",
-        "description": "A substep of the DSM compound install request failed.",
-        "suggestion": "Check the api, method and errorCode in the response and the DSM Package Center log, then retry."
-    },
-    "DSM_REQUEST_FAILED": {
-        "code": "DSM_REQUEST_FAILED",
-        "description": "The DSM SYNO.Entry.Request compound request failed.",
-        "suggestion": "Check the DSM session, request parameters and Package Center log, then retry."
-    },
-    "NOT_INSTALLED": {
-        "code": "NOT_INSTALLED",
-        "description": "The package is not installed on the target NAS yet.",
-        "suggestion": "Run synopkgland deploy --host <nas> to install the package first."
-    },
-    "STANDALONE_MANIFEST_MISSING": {
-        "code": "STANDALONE_MANIFEST_MISSING",
-        "description": "dsm-package.yaml was not found.",
-        "suggestion": "Run from the project root, or create a project with synopkgland init -t native-go."
-    },
-    "STANDALONE_MANIFEST_YAML": {
-        "code": "STANDALONE_MANIFEST_YAML",
-        "description": "dsm-package.yaml is not a valid YAML object.",
-        "suggestion": "Fix the YAML syntax in dsm-package.yaml."
-    },
-    "APP_SCRIPT_UNKNOWN": {
-        "code": "APP_SCRIPT_UNKNOWN",
-        "description": "A file in the project's dsm-scripts/ folder does not have a DSM package script name the SDK runs.",
-        "suggestion": "Name it preinst, postinst, preuninst, postuninst, preupgrade, postupgrade or start-stop-status, or move it out of dsm-scripts/. prereplace and postreplace are not supported."
-    },
-    "APP_SCRIPT_INVALID": {
-        "code": "APP_SCRIPT_INVALID",
-        "description": "A dsm-scripts/<DSM script name> entry is a symlink, directory or special file.",
-        "suggestion": "Make it a regular file in the project's dsm-scripts/ folder."
-    },
-    "APP_SCRIPT_NOT_EXECUTABLE": {
-        "code": "APP_SCRIPT_NOT_EXECUTABLE",
-        "description": "A dsm-scripts/<DSM script name> file is not executable; DSM runs it directly.",
-        "suggestion": "Run chmod +x on the file."
-    },
-    "APP_SCRIPT_NO_SHEBANG": {
-        "code": "APP_SCRIPT_NO_SHEBANG",
-        "description": "A dsm-scripts/<DSM script name> file does not start with #!.",
-        "suggestion": "Start the file with an interpreter line such as #!/bin/sh."
-    },
-    "STANDALONE_FIELD_UNKNOWN": {
-        "code": "STANDALONE_FIELD_UNKNOWN",
-        "description": "dsm-package.yaml contains an unsupported field.",
-        "suggestion": "Remove the field; a Standalone Package does not accept custom lifecycle scripts or DSM conf."
-    },
-    "STANDALONE_SCHEMA_INVALID": {
-        "code": "STANDALONE_SCHEMA_INVALID",
-        "description": "The schema version in dsm-package.yaml is not supported.",
-        "suggestion": "Set schema to 2 and use backend.kind and capabilities."
-    },
-    "STANDALONE_ROOT_OPS_MISSING": {
-        "code": "STANDALONE_ROOT_OPS_MISSING",
-        "description": "capabilities.rootOps: true is set but there are no root operations.",
-        "suggestion": "Put at least one <name>.sh in root/, or drop capabilities.rootOps."
-    },
-    "STANDALONE_DAEMON_INVALID": {
-        "code": "STANDALONE_DAEMON_INVALID",
-        "description": "The package daemon declaration does not match the fixed argv, environment and lifecycle contract.",
-        "suggestion": "Check daemon.exec, the per-architecture targets, args, env, uninstall_args and integer-second timeouts; remove shell, user and custom conf."
-    },
-    "UNINSTALL_INVALID": {
-        "code": "UNINSTALL_INVALID",
-        "description": "The uninstall declaration does not match the fixed exec, argv, environment and timeout contract.",
-        "suggestion": "Check uninstall.purge's exec (inside the package, not in executor/ or root/), args, env (SYNOPKGLAND_* not allowed) and 2-120 second timeout, and the unique keys of state.items."
-    },
-    "UNINSTALL_STATE_REQUIRES_PURGE": {
-        "code": "UNINSTALL_STATE_REQUIRES_PURGE",
-        "description": "uninstall.state has no App uninstall hook that could delete the state.",
-        "suggestion": "Add uninstall.purge so the App deletes the listed state when SYNOPKGLAND_DELETE_STATE=1, or remove uninstall.state."
-    },
-    "UNINSTALL_STATE_TEXT_MISSING": {
-        "code": "UNINSTALL_STATE_TEXT_MISSING",
-        "description": "The uninstall wizard cannot list the text of the uninstall.state items.",
-        "suggestion": "Add uninstall.state.<key> to i18n.messages en.json (and the other languages)."
-    },
-    "UNINSTALL_ROOT_REQUIRES_ROOT_OPS": {
-        "code": "UNINSTALL_ROOT_REQUIRES_ROOT_OPS",
-        "description": "uninstall.purge.root needs administrator-approved root operations.",
-        "suggestion": "Declare capabilities.rootOps: true and provide root/<name>.sh, or remove uninstall.purge.root."
-    },
-    "UNINSTALL_ROOT_OP_MISSING": {
-        "code": "UNINSTALL_ROOT_OP_MISSING",
-        "description": "uninstall.purge.root points at a root operation that does not exist.",
-        "suggestion": "Add root/<name>.sh, or change uninstall.purge.root to an existing root operation name."
-    },
-    "UNINSTALL_EXEC_MISSING": {
-        "code": "UNINSTALL_EXEC_MISSING",
-        "description": "uninstall.purge.exec is not a regular executable file inside the built package.",
-        "suggestion": "Point at an executable in the package, for example ui/cgi/api.cgi, background/worker, or an executable file under daemon/payload/."
-    },
-    "UNINSTALL_EXEC_UNSAFE": {
-        "code": "UNINSTALL_EXEC_UNSAFE",
-        "description": "uninstall.purge.exec is a shell script that tries to gain root.",
-        "suggestion": "Hooks always run as the package account; put cleanup that needs root in root/<name>.sh and declare it with uninstall.purge.root."
-    },
-    "STANDALONE_DAEMON_BUILD_FAILED": {
-        "code": "STANDALONE_DAEMON_BUILD_FAILED",
-        "description": "The package daemon's Go supervisor could not be built.",
-        "suggestion": "Install Go 1.21 or later (builds pin go1.26.9 and need it offline) and check the compiler stderr; the NAS does not need a Go toolchain."
-    },
-    "STANDALONE_DAEMON_PAYLOAD_INVALID": {
-        "code": "STANDALONE_DAEMON_PAYLOAD_INVALID",
-        "description": "The daemon payload is not a bounded, link-free directory inside the project.",
-        "suggestion": "Rebuild the per-architecture bundles; remove symlinks, special files and setid bits, and keep the size under 512 MiB."
-    },
-    "STANDALONE_DAEMON_ARTIFACT_REQUIRED": {
-        "code": "STANDALONE_DAEMON_ARTIFACT_REQUIRED",
-        "description": "The built supervisor is missing while assembling the daemon SPK.",
-        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the controller."
-    },
-    "STANDALONE_IDENTITY_GATEWAY_INVALID": {
-        "code": "STANDALONE_IDENTITY_GATEWAY_INVALID",
-        "description": "The identity_gateway declaration does not match the gateway contract.",
-        "suggestion": "Declare a daemon; set sdk, mode (oidc, header or token), the App's loopback upstream port and distinct listen ports other than 5000/5001; keep passthrough and redirects local paths outside /_sso; oidc needs issuer_port and clients, header needs headers.user, token needs token.exec in the daemon payload."
-    },
-    "STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED": {
-        "code": "STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED",
-        "description": "The SDK identity gateway could not be built from identity_gateway.sdk.",
-        "suggestion": "Use an SDK release that contains idgateway/cmd/gateway, install Go (builds pin go1.26.9) and check the compiler stderr."
-    },
-    "STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED": {
-        "code": "STANDALONE_IDENTITY_GATEWAY_ARTIFACT_REQUIRED",
-        "description": "The built identity gateway is missing while assembling the SPK.",
-        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the gateway."
-    },
-    "STANDALONE_SHARED_FOLDER_INVALID": {
-        "code": "STANDALONE_SHARED_FOLDER_INVALID",
-        "description": "The install.sharedFolder declaration in dsm-package.yaml is invalid.",
-        "suggestion": "Write install: { sharedFolder: { mode: select|create, key: <lowercase alphanumeric and underscore>, permission: ro|rw } }; create also needs name (the DSM shared folder name) and select must not have one."
-    },
-    "STANDALONE_BACKGROUND_INVALID": {
-        "code": "STANDALONE_BACKGROUND_INVALID",
-        "description": "The package background job declaration does not match the fixed worker contract.",
-        "suggestion": "Write only capabilities.jobs: true or { worker: sha256-v1 }, use backend.kind: go, and do not combine it with daemon or integration; background processes always run as the package account."
-    },
-    "STANDALONE_BACKGROUND_BUILD_FAILED": {
-        "code": "STANDALONE_BACKGROUND_BUILD_FAILED",
-        "description": "The package background worker could not be built.",
-        "suggestion": "Install Go 1.25 or later, confirm the backend has cmd/background-worker (create it with synopkgland init -t native-go --with jobs), and check the compiler stderr."
-    },
-    "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED": {
-        "code": "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED",
-        "description": "The built worker is missing while assembling the background job SPK.",
-        "suggestion": "Build the complete artifacts with synopkgland build; do not call the assembler directly without the worker."
-    },
-    "STANDALONE_ROOT_OP_INVALID": {
-        "code": "STANDALONE_ROOT_OP_INVALID",
-        "description": "root/ contains an invalid root operation file.",
-        "suggestion": "A script must be a regular root/<lowercase name>.sh starting with #!/bin/sh and under 16 KiB; a binary must be root/<arch>/<lowercase name>, an ELF for that architecture, under 64 MiB, and must not share a script's name."
-    },
-    "STANDALONE_ROOT_PROGRAMS_INVALID": {
-        "code": "STANDALONE_ROOT_PROGRAMS_INVALID",
-        "description": "The root settings in dsm-package.yaml are invalid, or the executor does not accept them.",
-        "suggestion": "root accepts only programs (<name>: {kind, schema, run, job} matching root/<name>.sh or root/<arch>/<name>), stop (a program in root/) and state: true, and requires capabilities.rootOps: true."
-    },
-    "STANDALONE_ROOT_OPS_UNUSED": {
-        "code": "STANDALONE_ROOT_OPS_UNUSED",
-        "description": "The project has a root/ directory but capabilities.rootOps is not enabled.",
-        "suggestion": "Set capabilities.rootOps: true to use root operations, or delete root/."
-    },
-    "STANDALONE_PACKAGE_INVALID": {
-        "code": "STANDALONE_PACKAGE_INVALID",
-        "description": "The package name is invalid.",
-        "suggestion": "Use a 2-64 character name that starts with a letter and contains only alphanumerics, for example PhotoTagger."
-    },
-    "STANDALONE_VERSION_INVALID": {
-        "code": "STANDALONE_VERSION_INVALID",
-        "description": "version is not a numeric version.",
-        "suggestion": "Use a version such as 1.2.0 and put the build number in build."
-    },
-    "STANDALONE_BUILD_INVALID": {
-        "code": "STANDALONE_BUILD_INVALID",
-        "description": "build is not an integer from 1 to 9999.",
-        "suggestion": "Set build to an integer from 1 to 9999 and increment it for each SPK release."
-    },
-    "STANDALONE_OS_MIN_VER_INVALID": {
-        "code": "STANDALONE_OS_MIN_VER_INVALID",
-        "description": "os_min_ver has the wrong format.",
-        "suggestion": "Use <major>.<minor>-<build>, for example 7.2-64570."
-    },
-    "STANDALONE_TEXT_INVALID": {
-        "code": "STANDALONE_TEXT_INVALID",
-        "description": "A display text field is invalid.",
-        "suggestion": "Use single-line, non-empty text without \" or \\."
-    },
-    "STANDALONE_ARCHES_INVALID": {
-        "code": "STANDALONE_ARCHES_INVALID",
-        "description": "arches is invalid.",
-        "suggestion": "List one or more unique values from x86_64, aarch64 or armv7."
-    },
-    "STANDALONE_ARCH_NOT_DECLARED": {
-        "code": "STANDALONE_ARCH_NOT_DECLARED",
-        "description": "The requested build architecture is not in arches.",
-        "suggestion": "Add the architecture to arches in dsm-package.yaml, or use a declared --arch."
-    },
-    "STANDALONE_BACKEND_INVALID": {
-        "code": "STANDALONE_BACKEND_INVALID",
-        "description": "The backend configuration is invalid.",
-        "suggestion": "backend must contain exactly one of go (dir and a ./ main) or binary (keyed by architecture)."
-    },
-    "STANDALONE_BINARY_ARCH_MISSING": {
-        "code": "STANDALONE_BINARY_ARCH_MISSING",
-        "description": "An architecture declared in arches has no backend.files executable.",
-        "suggestion": "Add the executable for that architecture to backend.files, or remove it from arches."
-    },
-    "STANDALONE_BINARY_MISSING": {
-        "code": "STANDALONE_BINARY_MISSING",
-        "description": "The backend executable was not found.",
-        "suggestion": "Confirm the file backend.files points at exists."
-    },
-    "STANDALONE_BINARY_NOT_REGULAR": {
-        "code": "STANDALONE_BINARY_NOT_REGULAR",
-        "description": "The backend executable is not a regular file.",
-        "suggestion": "Use a real file; no symlinks, directories or special files."
-    },
-    "STANDALONE_BINARY_TOO_LARGE": {
-        "code": "STANDALONE_BINARY_TOO_LARGE",
-        "description": "The backend executable exceeds 256 MiB.",
-        "suggestion": "Shrink the executable (for example -ldflags \"-s -w\")."
-    },
-    "STANDALONE_BINARY_NOT_ELF": {
-        "code": "STANDALONE_BINARY_NOT_ELF",
-        "description": "The backend executable is not the little-endian Linux ELF the architecture needs (64-bit for x86_64 and aarch64, 32-bit for armv7).",
-        "suggestion": "Provide an x86_64, aarch64 or armv7 executable built for Linux."
-    },
-    "STANDALONE_BINARY_ARCH_MISMATCH": {
-        "code": "STANDALONE_BINARY_ARCH_MISMATCH",
-        "description": "The backend executable's CPU architecture does not match the target.",
-        "suggestion": "Rebuild for that architecture, or fix the backend.files mapping."
-    },
-    "STANDALONE_BINARY_DYNAMIC": {
-        "code": "STANDALONE_BINARY_DYNAMIC",
-        "description": "The backend executable is dynamically linked.",
-        "suggestion": "Link statically (set CGO_ENABLED=0 for Go); the libc version differs across DSM models."
-    },
-    "STANDALONE_PATH_INVALID": {
-        "code": "STANDALONE_PATH_INVALID",
-        "description": "The path field is not a relative path inside the project.",
-        "suggestion": "Use a path relative to the project root."
-    },
-    "STANDALONE_PATH_OUTSIDE_PROJECT": {
-        "code": "STANDALONE_PATH_OUTSIDE_PROJECT",
-        "description": "The path points outside the project directory.",
-        "suggestion": "Keep the files inside the project directory (also after resolving symlinks)."
-    },
-    "STANDALONE_UI_INVALID": {
-        "code": "STANDALONE_UI_INVALID",
-        "description": "The ui configuration is invalid.",
-        "suggestion": "Provide ui.dir."
-    },
-    "STANDALONE_UI_BUILD_INVALID": {
-        "code": "STANDALONE_UI_BUILD_INVALID",
-        "description": "The ui.build configuration is invalid.",
-        "suggestion": "ui.build.command must be an argv string array (not going through a shell), for example [npm, run, build]."
-    },
-    "STANDALONE_TIMEOUT_UNSUPPORTED": {
-        "code": "STANDALONE_TIMEOUT_UNSUPPORTED",
-        "description": "backend.timeout_seconds needs a Go main that reads the requestTimeout the build passes.",
-        "suggestion": "Declare var requestTimeout = \"\" in main.go and pass its seconds to api.WithRequestDeadline(handler, api.Timeout(...)), or remove timeout_seconds."
-    },
-    "STANDALONE_REQUEST_TIMEOUT_SHORT": {
-        "code": "STANDALONE_REQUEST_TIMEOUT_SHORT",
-        "description": "The request deadline ends before a root program that root.run may run would answer: the executor answers 10 seconds after run.timeout_s and its client waits 10 more.",
-        "suggestion": "Set backend.timeout_seconds to at least the program's run.timeout_s (20 by default) + 20, or lower run.timeout_s."
-    },
-    "STANDALONE_UI_WINDOW_INVALID": {
-        "code": "STANDALONE_UI_WINDOW_INVALID",
-        "description": "ui.window does not give a valid DSM window size.",
-        "suggestion": "Give width and height as whole numbers from 320 to 3840 and 240 to 2160, keep minWidth and minHeight (700 and 420 by default) no larger than them, and write only the fields you change."
-    },
-    "STANDALONE_UI_BUILD_FAILED": {
-        "code": "STANDALONE_UI_BUILD_FAILED",
-        "description": "The UI build command failed.",
-        "suggestion": "Install the UI dependencies in ui.build.cwd (npm ci when package-lock.json exists, otherwise npm install), then run the UI build command and fix the errors."
-    },
-    "STANDALONE_UI_ENTRY_MISSING": {
-        "code": "STANDALONE_UI_ENTRY_MISSING",
-        "description": "The UI directory is missing app.js or app.css.",
-        "suggestion": "Make ui.dir (or the UI build output) contain app.js and app.css."
-    },
-    "STANDALONE_UI_SYMLINK": {
-        "code": "STANDALONE_UI_SYMLINK",
-        "description": "The UI directory contains a symlink.",
-        "suggestion": "Replace the symlink with a real file."
-    },
-    "STANDALONE_UI_SPECIAL_FILE": {
-        "code": "STANDALONE_UI_SPECIAL_FILE",
-        "description": "The UI directory contains a special file.",
-        "suggestion": "The UI directory may contain only regular files and directories."
-    },
-    "STANDALONE_UI_TOO_LARGE": {
-        "code": "STANDALONE_UI_TOO_LARGE",
-        "description": "The total UI file size exceeds 64 MiB.",
-        "suggestion": "Shrink the UI assets."
-    },
-    "STANDALONE_GO_MISSING": {
-        "code": "STANDALONE_GO_MISSING",
-        "description": "The go command was not found.",
-        "suggestion": "Install Go 1.25 or later (https://go.dev/dl/), or package an existing executable with backend.files."
-    },
-    "STANDALONE_GO_BUILD_FAILED": {
-        "code": "STANDALONE_GO_BUILD_FAILED",
-        "description": "go build failed.",
-        "suggestion": "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, make sure git can read github.com with credentials (verify with git ls-remote)."
-    },
-    "STANDALONE_PORTAL_INVALID": {
-        "code": "STANDALONE_PORTAL_INVALID",
-        "description": "The portal format or alias in dsm-package.yaml is invalid.",
-        "suggestion": "Use portal: {} or portal: { alias: my-app }; alias is 1-64 lowercase alphanumerics or -, and not a DSM reserved path."
-    },
-    "STANDALONE_PORTAL_REQUIRES_EXECUTOR": {
-        "code": "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
-        "description": "An App without an executor (capabilities.rootOps or delegate) declares portal.",
-        "suggestion": "Removing the sign-in alias after uninstall needs root so nginx stops serving it, but an App without escalation uses no root at any stage. Add capabilities.rootOps or delegate (executor level), or remove portal and let an administrator configure a reverse proxy in DSM."
-    },
-    "STANDALONE_LOGIN_STYLE_INVALID": {
-        "code": "STANDALONE_LOGIN_STYLE_INVALID",
-        "description": "login_style in dsm-package.yaml is malformed, or set without portal.",
-        "suggestion": "Declare portal, and give login_style only color (#RRGGBB), wallpaper together with wallpaper_thumbnail, and title; omit login_style to use the CLI default style."
-    },
-    "STANDALONE_LOGIN_STYLE_IMAGE_INVALID": {
-        "code": "STANDALONE_LOGIN_STYLE_IMAGE_INVALID",
-        "description": "An image login_style names is missing, in the wrong format or the wrong size.",
-        "suggestion": "Use a JPEG wallpaper of at least 1920x1080 and at most 2 MiB, a 320x200 JPEG wallpaper_thumbnail and a 680x124 PNG title, inside the project."
-    },
-    "STANDALONE_I18N_INVALID": {
-        "code": "STANDALONE_I18N_INVALID",
-        "description": "The i18n configuration in dsm-package.yaml is invalid.",
-        "suggestion": "i18n accepts only messages, glossary and info; info is keyed by a supported language such as zh-TW or ja (English goes at the top level)."
-    },
-    "STANDALONE_I18N_MESSAGES_MISSING": {
-        "code": "STANDALONE_I18N_MESSAGES_MISSING",
-        "description": "The i18n.messages directory is missing en.json.",
-        "suggestion": "Add en.json; it is the fallback text and key list for every language."
-    },
-    "STANDALONE_I18N_LOCALE_UNSUPPORTED": {
-        "code": "STANDALONE_I18N_LOCALE_UNSUPPORTED",
-        "description": "A message file's language is not one of the nine supported locales.",
-        "suggestion": "Use en, zh-TW, zh-CN, ja, ko, de, fr, es, it; every other DSM language shows English."
-    },
-    "STANDALONE_I18N_CATALOG_INVALID": {
-        "code": "STANDALONE_I18N_CATALOG_INVALID",
-        "description": "A message file is not a flat key -> text JSON object.",
-        "suggestion": "Use a format like { \"greeting.save\": \"Save\" }."
-    },
-    "STANDALONE_I18N_KEYS_MISMATCH": {
-        "code": "STANDALONE_I18N_KEYS_MISMATCH",
-        "description": "One language's message keys differ from en.json.",
-        "suggestion": "Give every language file exactly the keys of en.json."
-    },
-    "STANDALONE_I18N_PLACEHOLDER_MISMATCH": {
-        "code": "STANDALONE_I18N_PLACEHOLDER_MISMATCH",
-        "description": "A translation has a missing or extra {placeholder}.",
-        "suggestion": "Keep every {name} placeholder from the en.json text."
-    },
-    "STANDALONE_I18N_GLOSSARY_INVALID": {
-        "code": "STANDALONE_I18N_GLOSSARY_INVALID",
-        "description": "The glossary format is wrong, or it points at a message key that does not exist.",
-        "suggestion": "Fix the terms (id, text, keys) in glossary.json."
-    },
-    "STANDALONE_I18N_GLOSSARY_MISMATCH": {
-        "code": "STANDALONE_I18N_GLOSSARY_MISMATCH",
-        "description": "A message does not use the DSM interface term from the glossary.",
-        "suggestion": "Use that language's term from glossary.json to stay consistent with the DSM interface."
-    },
-    "DEPLOY_VERSION_INVALID": {
-        "code": "DEPLOY_VERSION_INVALID",
-        "description": "The package version is invalid or lower than the installed version.",
-        "suggestion": "Set a higher valid version/build and deploy again."
-    }
 };
-for (const [code, description, suggestion] of [
-    ["CAPABILITY_INVALID", "The capability declaration is invalid.", "Use files: session, jobs: true or {worker: sha256-v1}, identity: standalone, rootOps: true."],
-    ["CAPABILITY_UNSUPPORTED", "This runtime does not support the chosen capability.", "files, jobs and identity need backend.kind: go; compose does not support native capabilities."],
-    ["CAPABILITY_COMBINATION_INVALID", "The capability combination with the runtime or UI is invalid.", "daemon cannot combine with capabilities.jobs; identity/login needs a vue UI (--ui vue)."],
-    ["ADD_FILE_CONFLICT", "Existing files conflict with the SDK overlay.", "Move or merge the listed conflicting files before running add; the CLI never overwrites different content."],
-])
-    ERROR_REGISTRY[code] = { code, description, suggestion };
-ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "The SDK overlay needs the standard backend directory.", "suggestion": "Use backend.dir: backend, or merge the SDK overlay manually." };
-ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "The Compose minimum DSM version is too low.", "suggestion": "Compose needs DSM 7.2.1-69057 or later." };
-ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "When os_min_ver is below DSM 7.2-64570 the executor registers the portal, and the package name or displayname does not match its rules.", "suggestion": "The package name may contain only alphanumerics separated by . _ -, at most 64 characters; displayname is 1-64 characters without control characters." };
-ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "A package that declares portal has os_min_ver below DSM 7.1-42661.", "suggestion": "Before DSM 7.2-64570 the executor writes the entry into DSM's app.d, and that format is only verified from DSM 7.1. Raise os_min_ver to 7.1-42661 or later, or remove portal." };
-ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "The minimum DSM version format is invalid.", "suggestion": "Specify a 7.x release or a full 7.x-build." };
-ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "A license file does not meet the regular-file limits.", "suggestion": "Remove symlinks, special files and oversized license files." };
-ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "Third-party license information is missing.", "suggestion": "Reinstall the template dependencies and generate the third-party notices." };
-ERROR_REGISTRY["PROJECT_NOT_FOUND"] = { "code": "PROJECT_NOT_FOUND", "description": "The project manifest was not found.", "suggestion": "Run from the project root or use --project." };
-ERROR_REGISTRY["CLI_OPTION_INVALID"] = { "code": "CLI_OPTION_INVALID", "description": "A command option is invalid.", "suggestion": "Use --help to check the options and the available runtime." };
-ERROR_REGISTRY["CLI_OUTPUT_ARCH_REQUIRED"] = { "code": "CLI_OUTPUT_ARCH_REQUIRED", "description": "Writing a single file needs an architecture.", "suggestion": "Combine -o with a single --arch, or use --out-dir." };
-ERROR_REGISTRY["HOST_REQUIRED"] = { "code": "HOST_REQUIRED", "description": "No NAS was specified.", "suggestion": "Use --host <profile>; for a local deploy check use --dry-run." };
-ERROR_REGISTRY["NAS_CREDENTIALS_MISSING"] = { "code": "NAS_CREDENTIALS_MISSING", "description": "NAS credentials were not found.", "suggestion": "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD." };
-ERROR_REGISTRY["NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE"] = { "code": "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE", "description": "A scripts/ lifecycle script in the native layout metadata is not executable (inspect's SPK_SCRIPT_NOT_EXECUTABLE).", "suggestion": "chmod +x the script in the layout metadata directory, then build again." };
-ERROR_REGISTRY["NATIVE_TOOLKIT_TAR_UNSUPPORTED"] = { "code": "NATIVE_TOOLKIT_TAR_UNSUPPORTED", "description": "Extracting native.toolkits needs GNU tar or bsdtar, but the tar on PATH is neither.", "suggestion": "Point the tar on PATH at GNU tar or bsdtar (macOS ships bsdtar, most Linux distros GNU tar), then build again." };
-ERROR_REGISTRY["SPK_INSPECTION_FAILED"] = { "code": "SPK_INSPECTION_FAILED", "description": "The SPK does not match the DSM 7 package format (dsm.errors), or a synopkgland-built SPK does not match the build contract (findings).", "suggestion": "Fix the SPK_* rule codes and findings, then repackage; warnings do not affect the result." };
-ERROR_REGISTRY["IMAGE_PIN_REQUIRED"] = { "code": "IMAGE_PIN_REQUIRED", "description": "The image digest is not pinned.", "suggestion": "Run images pin." };
-ERROR_REGISTRY["INIT_TEMPLATE_REQUIRED"] = { "code": "INIT_TEMPLATE_REQUIRED", "description": "No template was specified.", "suggestion": "Use -t native-go, native-python, native-node, native-rust, binary or compose." };
-ERROR_REGISTRY["INIT_TEMPLATE_UNKNOWN"] = { "code": "INIT_TEMPLATE_UNKNOWN", "description": "Unknown template.", "suggestion": "Use -t native-go, native-python, native-node, native-rust, binary or compose." };
-ERROR_REGISTRY["CLI_ARCH_INVALID"] = { "code": "CLI_ARCH_INVALID", "description": "The architecture option is invalid.", "suggestion": "Use x86_64, aarch64 or armv7 (armv7 is for native-go and binary, not for Container Manager Apps)." };
-ERROR_REGISTRY["CLI_JOBS_INVALID"] = { "code": "CLI_JOBS_INVALID", "description": "--jobs is not a positive integer.", "suggestion": "Use --jobs 1 (the default) or a larger integer." };
-ERROR_REGISTRY["BUILD_NOT_REPRODUCIBLE"] = { "code": "BUILD_NOT_REPRODUCIBLE", "description": "A second SPK built by build --verify-reproducible differs from the first.", "suggestion": "Look at the listed payload and metadata files and remove anything that changes per build (timestamps, random or absolute paths, unpinned dependencies)." };
-ERROR_REGISTRY["REPRODUCIBLE_INVALID"] = { "code": "REPRODUCIBLE_INVALID", "description": "The reproducible configuration is malformed, or a listed input is not a file inside the project.", "suggestion": "Use reproducible: {inputs: [files...], clean: [paths...]} with project-relative paths; {arch} is only allowed in clean." };
-ERROR_REGISTRY["NATIVE_ARCH_UNDETERMINED"] = { "code": "NATIVE_ARCH_UNDETERMINED", "description": "The NAS architecture could not be determined.", "suggestion": "Specify --arch x86_64, aarch64 or armv7." };
-ERROR_REGISTRY["DEVELOPMENT_INSTANCE_UNSUPPORTED"] = { "code": "DEVELOPMENT_INSTANCE_UNSUPPORTED", "description": "A native project does not support --dev.", "suggestion": "Use a different package ID when running init." };
-ERROR_REGISTRY["INIT_OPTIONS_UNSUPPORTED"] = { "code": "INIT_OPTIONS_UNSUPPORTED", "description": "The option does not apply to this template.", "suggestion": "--from is compose only; --ui is native templates only (native-go, native-python, native-node, native-rust)." };
-ERROR_REGISTRY["INIT_TARGET_NOT_EMPTY"] = { "code": "INIT_TARGET_NOT_EMPTY", "description": "The init directory already has conflicting files.", "suggestion": "Use an empty directory; add capabilities to an existing project with add." };
-ERROR_REGISTRY["INIT_COMPOSE_INVALID"] = { "code": "INIT_COMPOSE_INVALID", "description": "The imported Compose is invalid.", "suggestion": "Point --from at a YAML file with services." };
-ERROR_REGISTRY["INIT_BINARY_BUILD_FAILED"] = { "code": "INIT_BINARY_BUILD_FAILED", "description": "The binary example failed to compile.", "suggestion": "Install Go or provide your own static CGI ELF." };
-ERROR_REGISTRY["INIT_SHARED_FOLDER_INVALID"] = { "code": "INIT_SHARED_FOLDER_INVALID", "description": "The shared folder option is invalid.", "suggestion": "Use select or create; add --shared-folder-name with create." };
-ERROR_REGISTRY["INIT_UI_INVALID"] = { "code": "INIT_UI_INVALID", "description": "The UI option is invalid.", "suggestion": "Use --ui vue or plain." };
-ERROR_REGISTRY["INIT_PACKAGE_INVALID"] = { "code": "INIT_PACKAGE_INVALID", "description": "The package name is invalid.", "suggestion": "Use a 2-64 character alphanumeric name that starts with a letter." };
-ERROR_REGISTRY["INIT_DISPLAY_NAME_INVALID"] = { "code": "INIT_DISPLAY_NAME_INVALID", "description": "The display name is invalid.", "suggestion": "Use single-line text without quotes or backslashes." };
-ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_CHANGED"] = { "code": "STANDALONE_API_PERMISSIONS_CHANGED", "description": "The API policy changed during the build.", "suggestion": "Freeze permissions.json, then run check/build again." };
-ERROR_REGISTRY["STANDALONE_API_PERMISSIONS_INVALID"] = { "code": "STANDALONE_API_PERMISSIONS_INVALID", "description": "The API policy is invalid.", "suggestion": "Fix backend/internal/api/permissions.json." };
-ERROR_REGISTRY["CLI_OPTION_UNKNOWN"] = { "code": "CLI_OPTION_UNKNOWN", "description": "Unknown CLI option.", "suggestion": "Use --help to see the currently supported options." };
-ERROR_REGISTRY["CLI_ARGUMENT_MISSING"] = { "code": "CLI_ARGUMENT_MISSING", "description": "A command argument is missing.", "suggestion": "Use --help to see the required arguments." };
-ERROR_REGISTRY["CLI_OPTION_MISSING"] = { "code": "CLI_OPTION_MISSING", "description": "A required option is missing.", "suggestion": "Use --help to see the required options." };
-ERROR_REGISTRY["CLI_OPTION_ARGUMENT_MISSING"] = { "code": "CLI_OPTION_ARGUMENT_MISSING", "description": "An option is missing its value.", "suggestion": "Pass the value the option needs." };
-ERROR_REGISTRY["CLI_COMMAND_UNKNOWN"] = { "code": "CLI_COMMAND_UNKNOWN", "description": "Unknown command.", "suggestion": "Use synopkgland --help to see the commands." };
-ERROR_REGISTRY["COMMAND_FAILED"] = { "code": "COMMAND_FAILED", "description": "The command failed.", "suggestion": "Check the message and stderr, fix the problem and retry." };
-ERROR_REGISTRY["DEPLOY_PLAN_INVALID"] = { "code": "DEPLOY_PLAN_INVALID", "description": "The deploy plan does not match the runtime.", "suggestion": "Run check again and regenerate the deploy plan." };
-ERROR_REGISTRY["DEPLOY_ARCH_UNDETERMINED"] = { "code": "DEPLOY_ARCH_UNDETERMINED", "description": "The NAS architecture could not be determined.", "suggestion": "Use --arch x86_64, aarch64 or armv7." };
-ERROR_REGISTRY["CONTAINER_ARCH_UNSUPPORTED"] = { "code": "CONTAINER_ARCH_UNSUPPORTED", "description": "Container Manager Apps support only x86_64 and aarch64; DSM does not provide Container Manager for armv7.", "suggestion": "Use --arch x86_64 or aarch64, or switch to the native-go template." };
-ERROR_REGISTRY["DEPLOY_BUILD_OUTPUT_INVALID"] = { "code": "DEPLOY_BUILD_OUTPUT_INVALID", "description": "The number of deploy build outputs does not match.", "suggestion": "Specify a single architecture and build again." };
 export function getErrorCode(code) {
     return ERROR_REGISTRY[code];
 }
-for (const [code, description, suggestion] of [
-    ["EXECUTOR_BUILD_FAILED", "Compiling the executor or lifecycle helper from the App's SDK version failed.", "Confirm Go 1.21 or later is installed and go1.26.9 is available (prepare it offline), and check the compiler output in the message."],
-    ["EXECUTOR_DIGEST_MISMATCH", "The executor built from the SDK version does not match the sha256 table bundled in the CLI, or the table has no entry for this SDK version.", "Confirm github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod is a release version and Go is go1.26.9; upgrade the CLI when the table has no entry for that version."],
-    ["EXECUTOR_DIGEST_UNVERIFIED", "SYNOPKGLAND_SDK_DIR points at a local SDK, so the executor was not checked against the sha256 table (warning).", "Development only; for a publishable SPK unset SYNOPKGLAND_SDK_DIR and build again."],
-    ["SDK_REQUIRED", "Python, Node and Rust Apps, and rootOps or delegate, need the SDK, but the backend does not name an SDK version (Go: backend/go.mod; Python and Node: backend.sdk; Rust: syno-pkg-land-app in Cargo.toml).", "In Go add require github.com/synopackageland/syno-pkg-land-sdk to backend/go.mod; in Python and Node write backend.sdk in dsm-package.yaml; in Rust depend on syno-pkg-land-app by git+tag in the App's Cargo.toml; keep the version on the same minor as the CLI."],
-    ["SDK_TAG_REQUIRED", "The Rust App's Cargo.lock does not pin exactly one syno-pkg-land-app to a release tag (branch, rev, path, registry and multiple versions are all rejected).", "Write syno-pkg-land-app = { git = \"https://github.com/synopackageland/syno-pkg-land-sdk\", tag = \"vX.Y.Z\" } in Cargo.toml, run cargo update -p syno-pkg-land-app and commit Cargo.lock."],
-    ["SDK_VERSION_MISMATCH", "The @synopackageland/sdk in frontend/package.json differs from the SDK version the backend requires (backend/go.mod or backend/Cargo.lock).", "Make both sides the same version; for a file: dependency the comparison uses that directory's package.json version."],
-    ["SDK_UNSUPPORTED", "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.", "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message)."],
-    ["SDK_DIR_NOT_READY", "The SDK checkout SYNOPKGLAND_SDK_DIR points at has no go.mod, or the ts package a Vue project needs is not built (no ts/dist).", "Point at a syno-pkg-land-sdk checkout; for a Vue project first run npm ci && npm run build in $SYNOPKGLAND_SDK_DIR/ts (npm does not build file: packages for you)."],
-    ["SDK_DOWNLOAD_FAILED", "go mod download cannot fetch the SDK version backend/go.mod requires.", "The CLI fetches the private SDK with git: make sure git can read github.com with credentials (verify with git ls-remote), then confirm the version exists. Offline, run go mod download once on the same machine first."],
-    ["TEMPLATES_MISSING", "@synopackageland/templates was not found.", "Reinstall @synopackageland/cli, or point SYNOPKGLAND_TEMPLATES_DIR at a templates checkout."],
-    ["EXECUTOR_PIN_REQUIRED", "A package that declares rootOps or delegate was built without the executor artifact.", "Use synopkgland build so the CLI compiles and pins the executor; do not call the low-level SPK API directly."],
-    ["EXECUTOR_POLICY", "capabilities.delegate has invalid operations or scope, or a binary root program lacks the file for this architecture, so the executor policy cannot be generated.", "Use the delegate declaration init/add produces and fix scope and operations against the manifest reference; for binary root programs provide root/<arch>/<name> for every arch in arches."],
-    ["EXECUTOR_POLICY_REJECTED", "The executor of the App's SDK version refuses the policy the CLI generated, so the NAS would refuse it at approval.", "The reason names the refused part: policy root/start/stop/purge → root.programs (schema, run, job), root.start, root.stop, uninstall.purge; policy scope/operation/destination/move/lifetime → capabilities.delegate; policy portal → portal; policy entry → entry. Fix that part of dsm-package.yaml; if it already matches the manifest reference, use the SDK version this CLI release names."],
-    ["EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED", "The root settings in dsm-package.yaml need an executor that supports root program settings, which the App's SDK version lacks.", "Use an SDK with root programs, stop and root_state (executor/stop_step.go), or remove the root settings."],
-    ["EXECUTOR_PACKAGE", "The package name pinned into the root task is invalid.", "package must start with a letter and contain only alphanumerics (2-64 characters)."],
-    ["EXECUTOR_DIGEST", "The sha256 pin for the executor or policy is malformed.", "Build again so the CLI recomputes the pin; do not hand-edit pins inside the SPK."],
-    ["EXECUTOR_TASK_PERCENT", "The root task script contains %, which the DSM task scheduler cannot store.", "Remove % from the root/ scripts (for example rewrite the date format)."],
-    ["EXECUTOR_TASK_LENGTH", "The root task script exceeds the DSM task scheduler's length limit.", "Shorten the root/ scripts; move the logic into a file inside the package and call it from the script."],
-])
-    ERROR_REGISTRY[code] = { code, description, suggestion };
-ERROR_REGISTRY["STANDALONE_ENTRY_INVALID"] = { "code": "STANDALONE_ENTRY_INVALID", "description": "The entry configuration is invalid.", "suggestion": "Set entry to admin-only or app-privilege; app-privilege needs at least one authenticated route." };
-ERROR_REGISTRY["STANDALONE_ENTRY_WIDENED"] = { "code": "STANDALONE_ENTRY_WIDENED", "description": "entry: admin-only conflicts with routes that widen access.", "suggestion": "Change the authenticated or public routes in permissions.json to administrators; to open it to regular users use entry: app-privilege or omit entry." };
-ERROR_REGISTRY["STANDALONE_ENTRY_UNSUPPORTED"] = { "code": "STANDALONE_ENTRY_UNSUPPORTED", "description": "The backend cannot enforce the entry mode.", "suggestion": "Use a Go backend: require github.com/synopackageland/syno-pkg-land-sdk in backend/go.mod and wrap the authenticator with dsm.NewEntryGate in the main.go of backend.main (init defaults to cmd/app/main.go)." };
-ERROR_REGISTRY["DSM_TLS_UNTRUSTED"] = { "code": "DSM_TLS_UNTRUSTED", "description": "The DSM TLS certificate is not trusted by this computer (self-signed, expired or a name mismatch).", "suggestion": "Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<file>; or give DSM a trusted certificate whose name matches the host profile. Do not disable certificate verification." };
-ERROR_REGISTRY["STANDALONE_ICON_INVALID"] = { "code": "STANDALONE_ICON_INVALID", "description": "The icon in dsm-package.yaml is not a usable package icon.", "suggestion": "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon." };
-ERROR_REGISTRY["CONTRACT_ICON_INVALID"] = { "code": "CONTRACT_ICON_INVALID", "description": "The icon in synology-app.yaml is not a usable package icon.", "suggestion": "Set icon to a square PNG inside the project (at least 256x256), or a directory of icon_<size>.png including icon_256.png; omit it to use the SDK default icon." };
-ERROR_REGISTRY["CONTRACT_I18N_INVALID"] = { "code": "CONTRACT_I18N_INVALID", "description": "The i18n configuration in synology-app.yaml is invalid.", "suggestion": "i18n accepts only info; info is keyed by a supported language such as zh-TW or ja with single-line displayname / description values without \" or \\ (English goes at the top level)." };
-for (const [code, description, suggestion] of [
-    ["STANDALONE_BRIDGE_APP_IN_UI", "The backend.dir and ui.dir of a Python, Node or Rust App overlap; DSM serves the files under ui/ directly.", "Put the App in a directory outside ui.dir (for example app/); neither may contain the other."],
-    ["STANDALONE_BRIDGE_METHODS_MISMATCH", "The App's methods do not match permissions.json, or use an SDK method name; the runtime refuses to start.", "permissions.json lists only the App's own methods; an App method must not share a name with an SDK method (nas.*, identity.*, portal.status and others)."],
-    ["STANDALONE_RUNTIME_BUILD_FAILED", "Compiling the bridge runtime (bridge/cmd/runtime) from the App's SDK version failed, or the result was not built with go1.26.9.", "Confirm Go 1.21 or later is installed and go1.26.9 is available; that SDK version must contain the bridge runtime; check the compiler output in the message."],
-    ["STANDALONE_BRIDGE_DESCRIBE_FAILED", "There is no backend.methods, so build starts the App to read hello, but the App did not answer a v1 hello.", "Install python3 or node on the build machine and make sure the App starts; or list backend.methods in dsm-package.yaml."],
-    ["STANDALONE_NODE_DEPENDENCY_MISSING", "The Node App's package.json dependencies are not installed in the App's node_modules.", "Run npm ci --omit=dev in the App directory and build again; the CLI places @synopackageland/app, so it does not need installing."],
-    ["STANDALONE_BRIDGE_APP_INVALID", "The App directory contains a symlink or special file, or exceeds 256 MiB.", "Keep only regular files and directories in the App directory; move large data out of it."],
-    ["STANDALONE_RUST_BUILD_FAILED", "The Rust App's cargo zigbuild cross-compile failed, or it produced no binary for backend.entry.", "Install Rust with rustup and the three targets (x86_64/aarch64-unknown-linux-musl, armv7-unknown-linux-gnueabihf), install cargo-zigbuild and zig; set backend.entry to the Cargo binary name; check the compiler output in the message."],
-    ["STANDALONE_BRIDGE_MANIFEST_INVALID", "The bridge.json the CLI produced does not match spec/bridge/v1 manifest.schema.json.", "Check backend.entry, methods and node.package; if it still fails, report the CLI bug."],
-    ["STANDALONE_PYTHON_SDK_MISSING", "The App's SDK version has no Python SDK (python/synopkgland_app).", "Point SYNOPKGLAND_SDK_DIR at a syno-pkg-land-sdk checkout that has python/synopkgland_app, or require an SDK release that ships it."],
-    ["STANDALONE_NODE_SDK_NOT_BUILT", "The App's SDK version has no built Node SDK (node/dist).", "Run npm ci && npm run build in node/ of the SYNOPKGLAND_SDK_DIR checkout first; a release SDK must contain node/dist."],
-])
-    ERROR_REGISTRY[code] = { code, description, suggestion };