@synopackageland/cli 0.3.10 → 0.4.1

package/dist/build-spk/generator.js

@@ -12,32 +12,19 @@ import { validateProject } from "../validate.js";
 import { writeDsmWindowIcons, writePackageCenterIcons } from "./dsm-icons.js";
 import { infoArchValue } from "./dsm-arch.js";
 import { createReproducibleTar } from "./reproducible-archive.js";
+import { copyProjectNotices } from "./notices.js";
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
-import { BROKER_INSTALLER_VARS, BROKER_SOCKET_REQUIRED_SCRIPT, renderBrokerStatusProbe, } from "./broker-glue.js";
 import { loadNative } from "../native/load.js";
 import { materializeNativePayload } from "./native-payload.js";
-import { renderNativePrivilege, renderNativeStartStopStatus, renderNativePostuninst, } from "./native-lifecycle.js";
+import { renderNativePostinst, renderNativePrivilege, renderNativeStartStopStatus, renderNativePostuninst, renderNativePreuninst, } from "./native-lifecycle.js";
 import { renderHeadlessResourceMarker, renderResourceConfig, renderResourceWorkerStartStopStatus, } from "./resource-worker.js";
 const FILE_MODE = 0o644;
 const SCRIPT_MODE = 0o755;
-function hasInterpolation(value) {
-    if (typeof value === "string") {
-        return /\$\{([^}]+)\}/.test(value);
-    }
-    if (Array.isArray(value)) {
-        return value.some(hasInterpolation);
-    }
-    if (value && typeof value === "object") {
-        return Object.values(value).some(hasInterpolation);
-    }
-    return false;
-}
 const INSTALL_UIFILE = "install_uifile";
 const UPGRADE_UIFILE = "upgrade_uifile";
 const UNINSTALL_UIFILE = "uninstall_uifile";
 const HEADLESS_PROBE_VOLUME = "./.synopkgland:/run/synopkgland:ro";
 const HEADLESS_PROBE_README = "Reserved bind target for package-user headless status probing.\n";
-export const EMBEDDED_ATTESTATION_RELATIVE_PATH = ".synopkgland/attestation.jwt";
 const SCRIPT_NAMES = [
     "preinst",
     "postinst",
@@ -48,9 +35,6 @@ const SCRIPT_NAMES = [
     "start-stop-status",
 ];
 export async function buildSpk(options) {
-    if (options.embeddedAttestationToken !== undefined && options.embeddedAttestationToken.length === 0) {
-        return { ok: false, errors: ["EMBEDDED_ATTESTATION_TOKEN_EMPTY"] };
-    }
     const validation = validateProject(options.project);
     if (!validation.ok) {
         return {
@@ -123,12 +107,6 @@ export async function buildSpk(options) {
             }
             copyFileSync(options.project.contractPath, join(packageDir, "synology-app.yaml"));
             copyFileSync(nativePath, join(packageDir, "native.yaml"));
-            if (options.embeddedAttestationToken !== undefined) {
-                const attestationPath = join(packageDir, EMBEDDED_ATTESTATION_RELATIVE_PATH);
-                mkdirSync(join(packageDir, ".synopkgland"), { recursive: true });
-                writeFileSync(attestationPath, options.embeddedAttestationToken, "utf8");
-                chmodSync(attestationPath, FILE_MODE);
-            }
             chmodSync(join(staging, "INFO"), FILE_MODE);
             chmodSync(join(staging, "privilege"), FILE_MODE);
             chmodSync(join(staging, "WIZARD_UIFILES", INSTALL_UIFILE), FILE_MODE);
@@ -138,6 +116,7 @@ export async function buildSpk(options) {
             chmodSync(join(packageDir, "native.yaml"), FILE_MODE);
             const outputPath = options.outputPath ??
                 join(options.project.root, `${String(contract.package)}-${options.archFamily}.spk`);
+            copyProjectNotices(options.project.root, packageDir);
             await createDeterministicSpk(staging, outputPath);
             return { ok: true, outputPath, errors: [] };
         }
@@ -152,7 +131,10 @@ export async function buildSpk(options) {
     if (route && route.errors.length > 0) {
         return { ok: false, errors: route.errors.map((error) => error.code) };
     }
-    const rwEligibility = route?.eligibility;
+    if (!route || route.route === "reject") {
+        return { ok: false, errors: ["COMPOSE_ROUTE_UNSUPPORTED"] };
+    }
+    const rwEligibility = route.eligibility;
     const isDynamicRoute = route?.route === "dynamic";
     const isResourceWorkerRoute = route?.route === "static-zero-config" ||
         isDynamicRoute;
@@ -186,7 +168,7 @@ export async function buildSpk(options) {
             mkdirSync(resourceProjectDir, { recursive: true });
             const dsmUserParam = collectInstallParameters(contract).find((p) => p.param.type === "dsm_user");
             let composeContent;
-            if (dsmUserParam || rwEligibility?.headless === true || hasOidcCompat(contract)) {
+            if (dsmUserParam || rwEligibility?.headless === true) {
                 const rawYaml = readFileSync(options.project.composePath, "utf8");
                 const doc = parseDocument(rawYaml);
                 const services = doc.get("services");
@@ -198,28 +180,6 @@ export async function buildSpk(options) {
                         doc.setIn(["services", sName, "user"], userVal);
                     }
                 }
-                if (hasOidcCompat(contract) && services && typeof services === "object" && typeof services.toJSON === "function") {
-                    const rawServices = services.toJSON();
-                    for (const [sName, sValue] of Object.entries(rawServices)) {
-                        if (sValue && typeof sValue === "object" && hasInterpolation(sValue)) {
-                            const str = JSON.stringify(sValue);
-                            if (str.includes("SYNOPKGLAND_OIDC_ISSUER")) {
-                                const serviceDoc = doc.getIn(["services", sName]);
-                                const existingExtraHosts = serviceDoc?.get?.("extra_hosts");
-                                const hostGatewayMapping = "${SYNOPKGLAND_OIDC_ISSUER_HOST}:host-gateway";
-                                if (!existingExtraHosts) {
-                                    doc.setIn(["services", sName, "extra_hosts"], [hostGatewayMapping]);
-                                }
-                                else if (Array.isArray(existingExtraHosts.toJSON?.())) {
-                                    const arr = existingExtraHosts.toJSON();
-                                    if (!arr.includes(hostGatewayMapping)) {
-                                        doc.setIn(["services", sName, "extra_hosts"], [...arr, hostGatewayMapping]);
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
                 if (rwEligibility?.headless === true) {
                     injectHeadlessProbeVolume(doc);
                 }
@@ -241,11 +201,6 @@ export async function buildSpk(options) {
                 writeFileSync(join(probePayloadDir, "README"), HEADLESS_PROBE_README, "utf8");
                 chmodSync(join(probePayloadDir, "README"), FILE_MODE);
             }
-            const routeMarkerDir = join(staging, "package", ".synopkgland");
-            mkdirSync(routeMarkerDir, { recursive: true });
-            const routeMarker = join(routeMarkerDir, "route");
-            writeFileSync(routeMarker, "package-only", "utf8");
-            chmodSync(routeMarker, FILE_MODE);
         }
         const htmlDir = join(options.project.root, "html");
         if (existsSync(htmlDir)) {
@@ -254,12 +209,6 @@ export async function buildSpk(options) {
                 cpSync(htmlDir, join(staging, "package", "compose", "html"), { recursive: true });
             }
         }
-        if (options.embeddedAttestationToken !== undefined) {
-            const attestationPath = join(staging, "package", EMBEDDED_ATTESTATION_RELATIVE_PATH);
-            mkdirSync(join(staging, "package", ".synopkgland"), { recursive: true });
-            writeFileSync(attestationPath, options.embeddedAttestationToken, "utf8");
-            chmodSync(attestationPath, FILE_MODE);
-        }
         if (contract.adminport !== undefined && resolvedWebLaunch(contract) === "dsm-window") {
             const uiDir = join(staging, "package", "ui");
             mkdirSync(uiDir, { recursive: true });
@@ -277,6 +226,7 @@ export async function buildSpk(options) {
             chmodSync(join(staging, "package", "ui", "config"), FILE_MODE);
         }
         const outputPath = options.outputPath ?? join(options.project.root, `${String(contract.package)}.spk`);
+        copyProjectNotices(options.project.root, join(staging, 'package'));
         await createDeterministicSpk(staging, outputPath);
         return { ok: true, outputPath, errors: [] };
     }
@@ -312,12 +262,6 @@ function renderInfo(contract, archFamily, isResourceWorker = false) {
             add("install_dep_packages", "WebStation");
         }
     }
-    else {
-        // synopkg's Container Manager dep gate reports "not ready" even when CM is
-        // running. Depend on Broker only; Broker's adapter.probe() checks CM at
-        // App install time (CM_CAPABILITY_MISSING).
-        add("install_dep_packages", "SynoPkgLandService>=0.1.0-0016");
-    }
     add("startable", "yes");
     const launch = resolvedWebLaunch(contract);
     if (contract.adminprotocol) {
@@ -354,47 +298,15 @@ function renderPrivilege() {
         },
     }, null, 2)}\n`;
 }
-const SHARED_FOLDER_MOUNT_CONSENT = "此 App 會用你在這台 NAS 選的資料夾；整顆應用都看得到。Shared Folder Mount 是整個 App Instance 的 container access：能打開這個 App 的使用者，容器裡的程式都看得到該 Share，即使該使用者在 File Station 看不到。這不是逐使用者 DSM ACL。要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
-const HOMES_MOUNT_CONSENT = "此 App 會使用這台 NAS 已啟用的 User Home；整顆應用的容器都看得到，容器路徑由 Compose 決定。這不是逐使用者 DSM ACL；要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
-const POSIX_ALL_SHARES_MAX_WARNING = "掛載這台 NAS 目前列出的每一個共用資料夾。容器內可讀（或讀寫，依 Compose 模式）所有這些資料夾的檔案。安裝後新建的共用資料夾不會自動加入。由管理員決定是否安裝。";
+const SHARED_FOLDER_MOUNT_CONSENT = "此 App 會用你在這台 NAS 選的資料夾；整顆應用都看得到。Shared Folder Mount 是整個 App Instance 的 container access：能打開這個 App 的使用者，容器裡的程式都看得到該 Share，即使該使用者在 File Station 看不到。這不是逐使用者 DSM ACL。檔案權限取決於容器服務帳號；App 必須自行實作使用者授權。";
+const HOMES_MOUNT_CONSENT = "此 App 會使用這台 NAS 已啟用的 User Home；整顆應用的容器都看得到，容器路徑由 Compose 決定。這不是逐使用者 DSM ACL；檔案權限取決於容器服務帳號；App 必須自行實作使用者授權。";
+const POSIX_ALL_SHARES_MAX_WARNING = "此 App 會使用安裝當下這台 NAS 的全部 Shared Folder（App-wide，不依個別 DSM ACL）；容器內可讀（或讀寫，依 Compose 模式）所有這些資料夾的檔案。安裝後新建的共用資料夾不會自動加入。Package Center 無法提供安裝當下的 Shared Folder 清單快照；要以全部 Share 安裝，請用 CLI `synopkgland deploy`，由 CLI 以管理員權限列舉全部 Share 並寫入快照。由管理員決定是否安裝。";
+const POSIX_ALL_SHARES_UPGRADE_NOTICE = "升級會保留既有快照（安裝當下由 CLI 列舉的全部 Shared Folder）；變更掛載範圍只能由 CLI 明確提供（`synopkgland deploy`）。Package Center 升級不會改動現有快照。";
 const DSM_USER_RUN_AS_CONSENT = "寫進 Share 的新檔在 File Station 顯示為你選的那位 DSM 使用者。點開此 App 的人共用這個磁碟身分，不是逐登入 ACL。";
 const DSM_USER_UPGRADE_CONSENT = "升級時更換 Container Run-as 不會 chown Share 上的舊檔；只有升級後寫入的新檔才會使用新的磁碟身分。";
+const UPGRADE_VALUE_REUSE_DESC = "留空＝沿用目前設定";
 const SHARED_FOLDER_RW_UPGRADE_CONSENT = "此版本把 Share 掛載改為讀寫；容器可讀取並寫入你選的 Share，不再是唯讀。";
 const APP_OWN_SPACE_CONSENT = "此 App 只用 App 自己的空間。";
-const OIDC_COMPAT_CONSENT = "此 App 可用你的 DSM 帳號登入；如果這台 NAS 尚未啟用相容模式，App 會使用自己的登入。登入不等於 File Station ACL。";
-function hasOidcCompat(contract) {
-    const integration = contract.integration;
-    if (!integration || typeof integration !== "object") {
-        return false;
-    }
-    const identity = integration.identity;
-    if (!identity || typeof identity !== "object") {
-        return false;
-    }
-    const oidcCompat = identity.oidc_compat;
-    return Boolean(oidcCompat && typeof oidcCompat === "object");
-}
-function renderFilesCapability(contract) {
-    const permissions = contract.permissions;
-    const files = permissions?.files;
-    if (!files) {
-        return null;
-    }
-    const parts = [];
-    if (files.read) {
-        parts.push("讀取檔案");
-    }
-    if (files.write) {
-        parts.push("寫入檔案");
-    }
-    if (files.delete) {
-        parts.push("刪除檔案");
-    }
-    if (parts.length === 0) {
-        return null;
-    }
-    return `此 App 需要以下檔案能力：${parts.join("、")}。這是每位登入者的 DSM ACL，經 File Gateway。`;
-}
 function volumeSources(compose) {
     return volumeMounts(compose).map((mount) => mount.source);
 }
@@ -484,17 +396,11 @@ function renderInstallWizard(contract, compose) {
     const hasSharedFolder = params.some((item) => item.param.type === "shared_folder");
     const hasHomes = params.some((item) => item.param.type === "homes");
     const hasDsmUser = params.some((item) => item.param.type === "dsm_user");
-    const capabilityText = renderFilesCapability(contract);
     if (compose && scanComposePrivilege(compose).length > 0) {
         items.push({
             desc: PRIVILEGE_MAX_WARNING,
         });
     }
-    if (hasOidcCompat(contract)) {
-        items.push({
-            desc: OIDC_COMPAT_CONSENT,
-        });
-    }
     if (hasSharedFolder) {
         items.push({
             desc: SHARED_FOLDER_MOUNT_CONSENT,
@@ -510,15 +416,7 @@ function renderInstallWizard(contract, compose) {
             desc: DSM_USER_RUN_AS_CONSENT,
         });
     }
-    if (capabilityText) {
-        items.push({
-            desc: capabilityText,
-        });
-    }
-    // No compose at all is the native branch: the binary gets PKGVAR and nothing
-    // else, so it earns the same line. Requiring a compose left native wizards
-    // empty, which DSM rejects as an invalid package.
-    if (!hasSharedFolder && !capabilityText && (!compose || composeUsesOnlyAppSpace(compose))) {
+    if (!hasSharedFolder && (!compose || composeUsesOnlyAppSpace(compose))) {
         items.push({
             desc: APP_OWN_SPACE_CONSENT,
         });
@@ -584,36 +482,19 @@ function renderInstallWizard(contract, compose) {
             continue;
         }
         if (param.type === "posix_all_shares") {
+            // A47 (install side): DSM's declarative wizard only ever renders a
+            // single-select combo here, so the former multiSelect control silently
+            // mounted exactly one Share instead of every Share. Package Center can
+            // therefore never carry the full Share list, and there is no honest
+            // control to render -- so this branch produces only an informational
+            // textblock. The full snapshot arrives exclusively via CLI
+            // extra_values (`synopkgland deploy`), which the preinst materializer
+            // expands. No subitem key is emitted, so the install uifile contains no
+            // ALL_SHARES and no CHANGE_ALL_SHARES.
             items.push({
                 type: "textblock",
                 desc: POSIX_ALL_SHARES_MAX_WARNING,
             });
-            items.push({
-                type: "combobox",
-                multiSelect: true,
-                desc: `POSIX all shares: ${name}`,
-                subitems: [{
-                        key: name,
-                        desc: name,
-                        displayField: "name",
-                        valueField: "name",
-                        multiSelect: true,
-                        editable: false,
-                        forceSelection: true,
-                        autoSelect: false,
-                        mode: "remote",
-                        api_store: {
-                            api: "SYNO.Core.Share",
-                            method: "list",
-                            version: 1,
-                            baseParams: { limit: -1, offset: 0 },
-                            root: "shares",
-                            idProperty: "name",
-                            fields: ["name"],
-                        },
-                        validator: { allowBlank: false },
-                    }],
-            });
             continue;
         }
         if (param.type === "dsm_user") {
@@ -651,6 +532,75 @@ function renderInstallWizard(contract, compose) {
 function renderUpgradeWizard(contract, compose) {
     const installWizard = renderInstallWizard(contract, compose);
     const params = collectInstallParameters(contract);
+    // Every type whose value must survive an upgrade the administrator did not
+    // deliberately change. Two mechanisms are needed because DSM renders them
+    // differently: a control that can be left blank just allows blank, while one
+    // that always carries a value needs an explicit "change this" gate.
+    //   - dsm_user  : measurably comes up blank, so allowBlank is enough
+    //   - string    : blank once the new version's default is withheld (A44)
+    //   - shared_folder : DSM prefills the first store row
+    //   - boolean   : a checkbox has no blank state at all
+    // posix_all_shares is intentionally absent: it renders as a textblock with
+    // no subitem, so there is nothing to blank or gate on the upgrade wizard.
+    // Its value can only arrive via CLI extra_values, and the preinst
+    // change-gate shell (`upgrade_change_enabled`, `CHANGE_<name>`) still
+    // governs that path, reusing the canonical snapshot on an untouched upgrade.
+    const upgradeReuseTypes = new Map(params
+        .filter(({ param }) => param.type === "shared_folder" ||
+        param.type === "dsm_user" ||
+        param.type === "string" ||
+        param.type === "boolean")
+        .map(({ name, param }) => [name, param.type]));
+    const needsChangeGate = (type) => type === "shared_folder" || type === "boolean";
+    const upgradeItems = installWizard[0].items.flatMap((item) => {
+        if (!Array.isArray(item.subitems)) {
+            return [item];
+        }
+        const reuseKeys = [];
+        const subitems = item.subitems.map((subitem) => {
+            if (!subitem || typeof subitem !== "object") {
+                return subitem;
+            }
+            const record = subitem;
+            if (typeof record.key !== "string" || !upgradeReuseTypes.has(record.key)) {
+                return subitem;
+            }
+            reuseKeys.push(record.key);
+            const reused = {
+                ...record,
+                validator: { allowBlank: true },
+            };
+            // Withholding the default is what makes an untouched upgrade blank, and
+            // blank is what lets preinst fall through to the canonical .env value.
+            // Install keeps the default -- only this upgrade copy drops it.
+            delete reused.defaultValue;
+            return reused;
+        });
+        if (reuseKeys.length === 0) {
+            return [item];
+        }
+        const control = {
+            ...item,
+            desc: `${String(item.desc ?? "")}（${UPGRADE_VALUE_REUSE_DESC}）`,
+            subitems,
+        };
+        const changeControls = reuseKeys
+            .filter((key) => needsChangeGate(upgradeReuseTypes.get(key)))
+            .map((key) => {
+            const type = upgradeReuseTypes.get(key);
+            const label = type === "shared_folder" ? "Shared Folder" : key;
+            return {
+                type: "multiselect",
+                desc: `變更 ${label}（不勾＝沿用目前設定）`,
+                subitems: [{
+                        key: `CHANGE_${key}`,
+                        desc: `變更 ${label}`,
+                        defaultValue: false,
+                    }],
+            };
+        });
+        return [...changeControls, control];
+    });
     const sharedFolderNames = params
         .filter((item) => item.param.type === "shared_folder")
         .map((item) => item.name);
@@ -661,6 +611,14 @@ function renderUpgradeWizard(contract, compose) {
         volumeMounts(compose).some((mount) => !mount.readOnly &&
             sharedFolderNames.some((name) => mount.source === `\${${name}}` || mount.source.startsWith(`\${${name}}/`)));
     const upgradeConsent = [];
+    const posixAllSharesNames = params
+        .filter((item) => item.param.type === "posix_all_shares")
+        .map((item) => item.name);
+    if (posixAllSharesNames.length > 0) {
+        upgradeConsent.push({
+            desc: POSIX_ALL_SHARES_UPGRADE_NOTICE,
+        });
+    }
     if (hasReadWriteSharedFolder) {
         upgradeConsent.push({
             desc: SHARED_FOLDER_RW_UPGRADE_CONSENT,
@@ -675,11 +633,12 @@ function renderUpgradeWizard(contract, compose) {
         return [{
                 ...installWizard[0],
                 step_title: "升級設定",
+                items: upgradeItems,
             }];
     }
-    const firstControl = installWizard[0].items.findIndex((item) => item.subitems !== undefined);
-    const insertAt = firstControl === -1 ? installWizard[0].items.length : firstControl;
-    const items = [...installWizard[0].items];
+    const firstControl = upgradeItems.findIndex((item) => item.subitems !== undefined);
+    const insertAt = firstControl === -1 ? upgradeItems.length : firstControl;
+    const items = [...upgradeItems];
     items.splice(insertAt, 0, ...upgradeConsent);
     return [{
             ...installWizard[0],
@@ -708,7 +667,6 @@ function renderUninstallWizard() {
             ],
         }];
 }
-const LEGACY_BROKER_STATE_REGISTRY_CODE = "COMPOSE_LEGACY_BROKER_STATE_PRESENT";
 function renderDynamicPreinstMaterializer(contract) {
     const allParams = collectInstallParameters(contract);
     const scalarParams = allParams.filter(({ param }) => param.type === "string" || param.type === "boolean");
@@ -721,18 +679,6 @@ function renderDynamicPreinstMaterializer(contract) {
         "umask 077",
         "# D3/D5.4 package-only carrier; values are wizard answers, canonical values, or defaults.",
         "die() { echo \"dynamic route materialization failed: $1\" >&2; exit 1; }",
-        `# registry-code="${LEGACY_BROKER_STATE_REGISTRY_CODE}"`,
-        'APPDATA="${SYNOPKG_PKGDEST_VOL:?}/@appdata/${SYNOPKG_PKGNAME:?}"',
-        'if [ -d "$APPDATA" ]; then',
-        '  broker_uid="$(id -u SynoPkgLandService 2>/dev/null || true)"',
-        '  if [ -n "$broker_uid" ]; then',
-        '    for item in "$APPDATA"/* "$APPDATA"/.[!.]* "$APPDATA"/..?*; do',
-        '      [ -e "$item" ] || continue',
-        '      item_uid="$(stat -c %u "$item" 2>/dev/null || true)"',
-        '      [ "$item_uid" = "$broker_uid" ] && die "MIGRATION_UNSUPPORTED: ${SYNOPKG_PKGNAME} 曾由 Broker installer 安裝；dynamic 路線不支援就地遷移，請以新的 Package Identity 安裝或先完整卸載並清除 App Data"',
-        "    done",
-        "  fi",
-        "fi",
         'T="${SYNOPKG_PKGINST_TEMP_DIR:?}"',
         'STATUS="${SYNOPKG_PKG_STATUS:?}"',
         'PROJECT="$T/compose"',
@@ -776,6 +722,16 @@ function renderDynamicPreinstMaterializer(contract) {
         "  esac",
         "}",
     ];
+    // Emitted whenever anything reads a CHANGE_ gate. Boolean parameters (A44) use
+    // it too, and a package with only booleans has no Share resolvers -- leaving it
+    // behind that condition made `! upgrade_change_enabled ...` a missing command,
+    // which is true, so the gate silently always reused the canonical value.
+    const usesUpgradeChangeGate = sharedFolderParams.length > 0 ||
+        posixAllSharesParams.length > 0 ||
+        collectInstallParameters(contract).some(({ param }) => param.type === "boolean");
+    if (usesUpgradeChangeGate) {
+        lines.push("upgrade_change_enabled() {", "  normalized=\"$(printf '%s' \"$1\" | LC_ALL=C tr '[:upper:]' '[:lower:]')\"", "  case \"$normalized\" in", "    true|1|yes|on) return 0 ;;", "    *) return 1 ;;", "  esac", "}");
+    }
     if (sharedFolderParams.length > 0 || posixAllSharesParams.length > 0) {
         lines.push("resolve_shared_folder() {", "  share_name=\"$1\"", "  case \"$share_name\" in", "    */*|*..*) die \"invalid share name $share_name\" ;;", "    '') die \"share name is empty\" ;;", "  esac", "  mounts_file=\"${D54_MOUNTS_FILE:-/proc/mounts}\"", "  if [ ! -r \"$mounts_file\" ] && [ -r \"/etc/mtab\" ]; then", "    mounts_file=\"/etc/mtab\"", "  fi", "  if [ ! -r \"$mounts_file\" ]; then", "    die \"cannot read mount points from $mounts_file\"", "  fi", "  vols=\"$(awk '$2 ~ /^\\/volume[0-9]+$/ {print $2}' \"$mounts_file\" | sort -u)\"", '  if [ -z "$vols" ]; then', "    vols=\"$(awk '{print $2}' \"$mounts_file\" | sort -u)\"", "  fi", "  matched=\"\"", "  count=0", "  for v in $vols; do", "    if [ -d \"$v/$share_name\" ]; then", "      matched=\"$v/$share_name\"", "      count=$((count + 1))", "    fi", "  done", "  if [ \"$count\" -eq 0 ]; then", "    die \"share $share_name not found on any volume\"", "  elif [ \"$count\" -gt 1 ]; then", "    die \"share $share_name matched multiple volumes\"", "  fi", "  printf '%s' \"$matched\"", "}");
     }
@@ -785,14 +741,6 @@ function renderDynamicPreinstMaterializer(contract) {
     if (dsmUserParam) {
         lines.push("resolve_dsm_user() {", "  user_name=\"$1\"", "  case \"$user_name\" in", "    */*|*..*|*[[:cntrl:]]*) die \"invalid user name $user_name\" ;;", "    '') die \"user name is empty\" ;;", "  esac", "  u_uid=\"$(id -u -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_uid\" in", "    ''|*[!0-9]*) die \"resolved uid for $user_name is not a valid integer\" ;;", "    0) die \"resolved uid for $user_name cannot be 0 (root)\" ;;", "  esac", "  u_gid=\"$(id -g -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_gid\" in", "    ''|*[!0-9]*) die \"resolved gid for $user_name is not a valid integer\" ;;", "  esac", "  # id -G returns all group ids including primary", "  raw_groups=\"$(id -G -- \"$user_name\" 2>/dev/null || true)\"", "  # filter out primary gid, deduplicate, keep numeric only", "  supp_groups=\"\"", "  for g in $raw_groups; do", "    case \"$g\" in", "      ''|*[!0-9]*) continue ;;", "    esac", "    if [ \"$g\" != \"$u_gid\" ]; then", "      already=0", "      for sg in $supp_groups; do", "        if [ \"$sg\" = \"$g\" ]; then", "          already=1", "          break", "        fi", "      done", "      if [ \"$already\" -eq 0 ]; then", "        supp_groups=\"${supp_groups}${supp_groups:+ }$g\"", "      fi", "    fi", "  done", "  printf '%s %s %s' \"$u_uid\" \"$u_gid\" \"$supp_groups\"", "}", "rewrite_group_add() {", "  p_name=\"$1\"", "  g_list=\"$2\"", "  compose_file=\"$3\"", "  [ -f \"$compose_file\" ] || die \"compose file missing at $compose_file\"", "  [ ! -L \"$compose_file\" ] || die \"compose file is a symlink\"", "  tmp_compose=\"$(mktemp \"${compose_file}.tmp.XXXXXX\")\"", "  awk -v param=\"$p_name\" -v g_list=\"$g_list\" '", "    BEGIN {", "      n = split(g_list, g_arr, \" \")", "    }", "    {", "      regex = \"^[ \\t]*# synopkgland:group_add \" param \"$\"", "      if ($0 ~ regex) {", "        match($0, /^[ \\t]*/)", "        indent = substr($0, RSTART, RLENGTH)", "        if (n > 0) {", "          print indent \"group_add:\"", "          for (i = 1; i <= n; i++) {", "            print indent \"  - ${\" param \"_GROUP_\" i \"}\"", "          }", "        }", "      } else {", "        print $0", "      }", "    }", "  ' \"$compose_file\" > \"$tmp_compose\" || die \"failed to rewrite group_add in $compose_file\"", "  mv \"$tmp_compose\" \"$compose_file\" || die \"failed to replace $compose_file\"", "}");
     }
-    if (hasOidcCompat(contract)) {
-        const identity = contract.integration?.identity;
-        const redirectPath = identity?.oidc_compat?.redirect_path ?? "";
-        const adminProtocol = contract.adminprotocol ?? "http";
-        const adminPort = Number(contract.adminport ?? 0);
-        const escapedRedirectPath = redirectPath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-        lines.push("oidc_register() {", "  # DSM compose does not create missing bind sources: the secrets dir must exist even when compat is off.", "  (umask 077 && mkdir -p \"$PROJECT/secrets\" && chmod 700 \"$PROJECT/secrets\") || die \"failed to create $PROJECT/secrets\"", "  OIDC_ISSUER=\"\"", "  OIDC_ISSUER_HOST=\"oidc.invalid\"", "  OIDC_CLIENT_ID=\"\"", "  OIDC_CLIENT_SECRET=\"\"", "  identity_file=\"${SYNOPKGLAND_IDENTITY_FILE:-/var/packages/SynoPkgLandService/var/identity.json}\"", "  if [ ! -r \"$identity_file\" ]; then", "    identity_file=\"/volume1/@appdata/SynoPkgLandService/identity.json\"", "  fi", "  if [ ! -r \"$identity_file\" ]; then", "    # Identity endpoint not found -> Broker not installed -> skip as 404", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  base_url=\"$(python3 -c 'import json, sys; data=json.load(open(sys.argv[1])); print(data.get(\"baseUrl\", \"\"))' \"$identity_file\" 2>/dev/null || true)\"", "  if [ -z \"$base_url\" ]; then", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  attestation_file=\"$T/.synopkgland/attestation.jwt\"", "  if [ ! -f \"$attestation_file\" ]; then", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    return 0", "  fi", "  attestation_token=\"$(cat \"$attestation_file\")\"", "  phase=\"install\"", "  case \"$STATUS\" in", "    UPGRADE) phase=\"upgrade\" ;;", "    *) phase=\"install\" ;;", "  esac", "  req_body=\"$(python3 -c 'import json, sys; print(json.dumps({\"protocolVersion\": 1, \"attestation\": sys.argv[1], \"packageIdentity\": sys.argv[2], \"packageVersion\": sys.argv[3], \"redirectPath\": sys.argv[4], \"adminProtocol\": sys.argv[5], \"adminPort\": int(sys.argv[6]), \"phase\": sys.argv[7]}))' \"$attestation_token\" \"${SYNOPKG_PKGNAME:?}\" \"${SYNOPKG_PKGVER:?}\" \"" + escapedRedirectPath + "\" \"" + String(adminProtocol) + "\" \"" + String(adminPort) + "\" \"$phase\")\"", "  resp_file=\"$(mktemp \"$T/oidc_resp.XXXXXX\")\"", "  http_code=\"$(curl -s -S --connect-timeout 5 --max-time 30 -o \"$resp_file\" -w '%{http_code}' -X POST -H 'Content-Type: application/json' --data-binary \"$req_body\" \"${base_url}/internal/v1/oidc/register\" 2>/dev/null || true)\"", "  case \"$http_code\" in [0-9][0-9][0-9]) ;; *) http_code=\"000\" ;; esac", "  if [ \"$http_code\" = \"200\" ]; then", "    parsed_res=\"$(python3 -c 'import json, sys; d=json.load(open(sys.argv[1])); print(d.get(\"issuer\", \"\")); print(d.get(\"issuerHost\", \"\")); print(d.get(\"clientId\", \"\")); print(d.get(\"clientSecret\", \"\"))' \"$resp_file\" 2>/dev/null || true)\"", "    rm -f \"$resp_file\"", "    OIDC_ISSUER=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '1p')\"", "    OIDC_ISSUER_HOST=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '2p')\"", "    OIDC_CLIENT_ID=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '3p')\"", "    OIDC_CLIENT_SECRET=\"$(printf '%s\\n' \"$parsed_res\" | sed -n '4p')\"", "    (umask 077 && mkdir -p \"$PROJECT/secrets\" && printf '%s' \"$OIDC_CLIENT_SECRET\" > \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\")", "  elif [ \"$http_code\" = \"404\" ] || [ \"$http_code\" = \"000\" ]; then", "    rm -f \"$resp_file\"", "    rm -f \"$PROJECT/secrets/SYNOPKGLAND_OIDC_CLIENT_SECRET\"", "    OIDC_ISSUER=\"\"", "    OIDC_ISSUER_HOST=\"oidc.invalid\"", "    OIDC_CLIENT_ID=\"\"", "  else", "    rm -f \"$resp_file\"", "    die \"OIDC_REGISTER_FAILED $http_code\"", "  fi", "}", "oidc_register");
-    }
     lines.push('tmp="$(mktemp "$PROJECT/.env.tmp.XXXXXX")"', 'chmod 600 "$tmp"', '[ "$(stat -c %a "$tmp")" = "600" ] || die "temporary env mode is not 0600"', '[ "$(stat -c %u "$tmp")" = "$(id -u)" ] || die "temporary env owner is not the package user"', "trap 'rm -f \"$tmp\"' EXIT HUP INT TERM", "{");
     const valueVars = [];
     for (const { name, param } of scalarParams) {
@@ -804,16 +752,27 @@ function renderDynamicPreinstMaterializer(contract) {
             : type === "boolean"
                 ? "false"
                 : "";
-        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${valueVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+        // A44: on UPGRADE the wizard always submits something for these controls, so
+        // "was it submitted" cannot mean "did the administrator choose it". A blank
+        // string, or a boolean whose CHANGE_ gate is unchecked, means "keep what is
+        // installed" -- otherwise the new version's default would silently replace a
+        // value chosen at install time. INSTALL is unaffected: STATUS is not UPGRADE,
+        // so the reuse branch is skipped and the default still applies.
+        const reuseGuard = type === "boolean"
+            ? `! upgrade_change_enabled "\${CHANGE_${name}:-}"`
+            : `[ -z "\${${name}:-}" ]`;
+        lines.push(`  if [ "$STATUS" = "UPGRADE" ] && ${reuseGuard} && [ -f "$CANONICAL_ENV" ] && ` +
+            `[ ! -L "$CANONICAL_ENV" ] && ${valueVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", `  elif [ "\${${name}+x}" = x ]; then`, `    ${valueVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
             `${valueVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", "    " + valueVar + "=" + shellQuote(fallback), "  fi");
     }
     const shareVars = [];
     for (const { name } of sharedFolderParams) {
         const rawVar = "D54_RAW_SHARE_" + name;
         const pathVar = "D54_RESOLVED_PATH_" + name;
+        const changeVar = "CHANGE_" + name;
         shareVars.push({ name, pathVar });
-        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
-            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required shared folder parameter ${name}"`, "  fi", `  case "$${rawVar}" in`, "    /*) " + pathVar + "=\"$" + rawVar + "\" ;;", "    *) " + pathVar + "=\"$(resolve_shared_folder \"$" + rawVar + "\")\" ;;", "  esac");
+        lines.push(`  if [ "$STATUS" = "UPGRADE" ] && upgrade_change_enabled "\${${changeVar}:-}"; then`, `    if [ "\${${name}+x}" = x ] && [ -n "\${${name}}" ]; then`, `      ${rawVar}="\${${name}}"`, "    else", `      die "missing required shared folder parameter ${name}"`, "    fi", '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", '  elif [ "$STATUS" = "UPGRADE" ]; then', `    die "missing canonical shared folder parameter ${name}"`, `  elif [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, "  else", `    die "missing required shared folder parameter ${name}"`, "  fi", `  case "$${rawVar}" in`, "    /*) " + pathVar + "=\"$" + rawVar + "\" ;;", "    *) " + pathVar + "=\"$(resolve_shared_folder \"$" + rawVar + "\")\" ;;", "  esac");
     }
     const posixVars = [];
     for (const { name } of posixAllSharesParams) {
@@ -821,22 +780,18 @@ function renderDynamicPreinstMaterializer(contract) {
         const namesVar = "D54_POSIX_NAMES_" + name;
         const pathsVar = "D54_POSIX_PATHS_" + name;
         const countVar = "D54_POSIX_COUNT_" + name;
+        const changeVar = "CHANGE_" + name;
         posixVars.push({ name, namesVar, pathsVar, countVar });
-        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
-            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required POSIX all-shares parameter ${name}"`, "  fi", `  posix_info="$(resolve_posix_all_shares "$${rawVar}")"`, `  ${namesVar}="$(printf '%s\\n' "$posix_info" | sed -n '1p')"`, `  ${pathsVar}="$(printf '%s\\n' "$posix_info" | sed -n '2p')"`, `  ${countVar}="$(printf '%s\\n' "$posix_info" | sed -n '3p')"`, `  rewrite_posix_all_shares "${name}" "$${namesVar}" "$${pathsVar}" "$PROJECT/docker-compose.yml"`);
+        lines.push(`  if [ "$STATUS" = "UPGRADE" ] && upgrade_change_enabled "\${${changeVar}:-}"; then`, `    if [ "\${${name}+x}" = x ] && [ -n "\${${name}}" ]; then`, `      ${rawVar}="\${${name}}"`, "    else", `      die "missing required POSIX all-shares parameter ${name}"`, "    fi", '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", '  elif [ "$STATUS" = "UPGRADE" ]; then', `    die "missing canonical POSIX all-shares parameter ${name}"`, `  elif [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, "  else", `    die "missing required POSIX all-shares parameter ${name}"`, "  fi", `  posix_info="$(resolve_posix_all_shares "$${rawVar}")"`, `  ${namesVar}="$(printf '%s\\n' "$posix_info" | sed -n '1p')"`, `  ${pathsVar}="$(printf '%s\\n' "$posix_info" | sed -n '2p')"`, `  ${countVar}="$(printf '%s\\n' "$posix_info" | sed -n '3p')"`, `  rewrite_posix_all_shares "${name}" "$${namesVar}" "$${pathsVar}" "$PROJECT/docker-compose.yml"`);
     }
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;
-        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawUserVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
-            `${rawUserVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required dsm user parameter ${name}"`, "  fi", `  resolved_user_info="$(resolve_dsm_user "$${rawUserVar}")"`, "  set -- $resolved_user_info", `  ${name}_UID="$1"`, `  ${name}_GID="$2"`, "  shift 2 || true", `  ${name}_GROUPS="$*"`, `  rewrite_group_add "${name}" "$${name}_GROUPS" "$PROJECT/docker-compose.yml"`);
-    }
-    if (hasOidcCompat(contract)) {
-        lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "${SYNOPKG_PKGDEST_VOL:?}/@appstore/${SYNOPKG_PKGNAME:?}/compose/secrets"', '  append_env "SYNOPKGLAND_OIDC_ISSUER" "$OIDC_ISSUER"', '  append_env "SYNOPKGLAND_OIDC_ISSUER_HOST" "$OIDC_ISSUER_HOST"', '  append_env "SYNOPKGLAND_OIDC_CLIENT_ID" "$OIDC_CLIENT_ID"');
-    }
-    else {
-        lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "$PLATFORM_SECRETS"');
+        lines.push(`  if [ "\${${name}+x}" = x ] && [ -n "\${${name}}" ]; then`, `    ${rawUserVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+            `${rawUserVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", `  elif [ "\${${name}+x}" = x ]; then`, `    ${rawUserVar}="\${${name}}"`, "  else", `    die "missing required dsm user parameter ${name}"`, "  fi", `  resolved_user_info="$(resolve_dsm_user "$${rawUserVar}")"`, "  set -- $resolved_user_info", `  ${name}_UID="$1"`, `  ${name}_GID="$2"`, "  shift 2 || true", `  ${name}_GROUPS="$*"`, `  rewrite_group_add "${name}" "$${name}_GROUPS" "$PROJECT/docker-compose.yml"`);
     }
+    lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "$PLATFORM_SECRETS"');
     for (const { name, valueVar, type } of valueVars) {
         lines.push(`  append_env "${name}" "$${valueVar}" "${type}"`);
     }
@@ -910,29 +865,11 @@ function renderManagedScript(name, contract, nativeContext, isResourceWorker = f
         if (name === "start-stop-status") {
             return renderNativeStartStopStatus(lifecycleInput);
         }
-        if (name === "preinst" || name === "preupgrade") {
-            return BROKER_SOCKET_REQUIRED_SCRIPT;
-        }
         if (name === "postinst" || name === "postupgrade") {
-            const installerScript = renderInstallerCallScript(contract, name === "postupgrade" ? "update" : "install");
-            // The service process needs its scratch directory before it can start,
-            // and the installer call is the script's exit status, so widen the
-            // existing mkdir rather than appending after it.
-            return installerScript.replace('mkdir -p "${SYNOPKG_PKGVAR}" "${SYNOPKG_PKGHOME}/secrets"', 'mkdir -p "${SYNOPKG_PKGVAR}" "${SYNOPKG_PKGVAR}/tmp" "${SYNOPKG_PKGHOME}/secrets"');
+            return renderNativePostinst(lifecycleInput);
         }
         if (name === "preuninst") {
-            // Compose installer uninstall (with UPGRADE early exit) + stop native process
-            const installerScript = renderInstallerCallScript(contract, "uninstall").replace("set -eu\n", 'set -eu\nif [ "${SYNOPKG_PKG_STATUS:-}" = "UPGRADE" ]; then\n  exit 0\nfi\n');
-            // Stop the process BEFORE deregistering: `set -eu` aborts the script if
-            // the installer fails, so a stop appended after it would never run. The
-            // stop itself is best effort -- DSM already calls `start-stop-status
-            // stop` directly (N0), and a non-zero preuninst blocks uninstall.
-            const preuninstStopBlock = `CONTROL="/var/packages/\${SYNOPKG_PKGNAME:-${contract.package}}/scripts/start-stop-status"
-if [ -x "$CONTROL" ]; then
-  "$CONTROL" stop 2>/dev/null || true
-fi
-`;
-            return installerScript.replace('"$INSTALLER"', `${preuninstStopBlock}"$INSTALLER"`);
+            return renderNativePreuninst(lifecycleInput);
         }
         if (name === "postuninst") {
             return renderNativePostuninst(lifecycleInput);
@@ -967,93 +904,7 @@ ${projectRoot}${renderDeleteAppDataBlock(deleteRoots)}exit 0
         }
         return `#!/bin/sh\nexit 0\n`;
     }
-    if (name === "start-stop-status") {
-        return `#!/bin/sh
-${BROKER_INSTALLER_VARS}
-case "$1" in
-  start) exit 0 ;;
-  stop) exit 0 ;;
-  status)
-${renderBrokerStatusProbe(String(contract.package))}
-    exit 0
-    ;;
-  *) exit 1 ;;
-esac
-`;
-    }
-    if (name === "preinst" || name === "preupgrade") {
-        return BROKER_SOCKET_REQUIRED_SCRIPT;
-    }
-    if (name === "postinst" || name === "postupgrade") {
-        return renderInstallerCallScript(contract, name === "postupgrade" ? "update" : "install");
-    }
-    if (name === "preuninst") {
-        return renderInstallerCallScript(contract, "uninstall").replace("set -eu\n", 'set -eu\nif [ "${SYNOPKG_PKG_STATUS:-}" = "UPGRADE" ]; then\n  exit 0\nfi\n');
-    }
-    if (name === "postuninst") {
-        return `#!/bin/sh
-set -eu
-PKGVAR="\${SYNOPKG_PKGVAR}"
-PKGHOME="\${SYNOPKG_PKGHOME}"
-SECRETS="\${PKGHOME}/secrets"
-${renderDeleteAppDataBlock(["PKGVAR", "SECRETS"])}exit 0
-`;
-    }
-    return `#!/bin/sh
-exit 0
-`;
-}
-function renderInstallerCallScript(contract, phase) {
-    const params = collectInstallParameters(contract);
-    const secrets = params.filter((item) => item.param.type === "secret");
-    const nonSecrets = params.filter((item) => item.param.type !== "secret");
-    const lines = [
-        "#!/bin/sh",
-        "set -eu",
-        'INSTALLER="${BROKER_INSTALLER:-/var/packages/SynoPkgLandService/target/bin/synopkgland-installer}"',
-        'SOCKET="${BROKER_SOCKET:-/var/packages/SynoPkgLandService/var/installer.sock}"',
-        `PACKAGE_ROOT="/var/packages/${contract.package}"`,
-        'ATTEMPT_ID="${SYNOPKG_PKGNAME}-${SYNOPKG_PKGVER}-$$"',
-        'WORK="$(mktemp -d /tmp/synopkgland-install.XXXXXX)"',
-        'chmod 700 "$WORK"',
-        "cleanup() { rm -rf \"$WORK\"; }",
-        "trap cleanup EXIT",
-        'mkdir -p "${SYNOPKG_PKGVAR}" "${SYNOPKG_PKGHOME}/secrets"',
-        'chmod 770 "${SYNOPKG_PKGVAR}" "${SYNOPKG_PKGHOME}" "${SYNOPKG_PKGHOME}/secrets" 2>/dev/null || true',
-        'chgrp synopkgs "${SYNOPKG_PKGVAR}" "${SYNOPKG_PKGHOME}" "${SYNOPKG_PKGHOME}/secrets" 2>/dev/null || true',
-        'VARS=""',
-        'SECRET_FILES=""',
-    ];
-    for (const { name, param } of secrets) {
-        if (param.generate === true) {
-            continue;
-        }
-        lines.push(`if [ -n "\${${name}+x}" ]; then`);
-        lines.push("  umask 077");
-        lines.push(`  printf '%s' "\$${name}" > "$WORK/${name}"`);
-        lines.push(`  unset ${name}`);
-        lines.push(`  SECRET_FILES="$SECRET_FILES --secret-file ${name}=$WORK/${name}"`);
-        lines.push("fi");
-    }
-    for (const { name } of nonSecrets) {
-        lines.push(`if [ -n "\${${name}+x}" ]; then`);
-        lines.push(`  VARS="$VARS --var ${name}=\$${name}"`);
-        lines.push("fi");
-    }
-    const generateFlags = secrets
-        .filter((item) => item.param.generate === true)
-        .map((item) => `--generate-secret ${item.name}`)
-        .join(" ");
-    lines.push(`"$INSTALLER" --socket "$SOCKET" --phase ${phase} --attempt-id "$ATTEMPT_ID" \\`);
-    lines.push(`  --package-identity "${contract.package}" --package-version "\${SYNOPKG_PKGVER}" \\`);
-    lines.push('  --package-path "$PACKAGE_ROOT/target" --bundle-path "$PACKAGE_ROOT/target" \\');
-    lines.push('  --pkg-var "$PACKAGE_ROOT/var" --pkg-home "$PACKAGE_ROOT/home" \\');
-    if (generateFlags) {
-        lines.push(`  ${generateFlags} \\`);
-    }
-    lines.push('  $VARS $SECRET_FILES');
-    lines.push("exit $?");
-    return `${lines.join("\n")}\n`;
+    throw new Error("Unsupported container route");
 }
 async function createDeterministicSpk(stagingDir, outputPath) {
     const payloadDir = join(stagingDir, "package");