@synopackageland/cli 0.33.1 → 0.34.0

package/CHANGELOG.md

@@ -1,9 +1,21 @@
 # Changelog
 
-## 0.33.1 (2026-10-27)
+## 0.34.0 (2026-10-29)
 
-- Use one NAS connection path for host login, secure session storage, TLS and every DSM request, including package commands, deployment, ctl transfers and e2e login helpers
-- Accept self-signed, untrusted CA, hostname-mismatched and expired NAS certificates by default
-- Record each leaf SHA-256 for display; warn once and update it when a certificate changes, then continue
-- Add opt-in --strict-tls for host profiles and individual commands; --ca also verifies CA trust, hostname, validity and recorded certificates
-- Keep passwords on the exact connection whose certificate was inspected, without changing global TLS settings
+- Enforce explicit App entry and reject undeclared App methods, dynamic route
+  names and custom HTTP dispatchers during check and build. Every App method
+  must appear in `permissions.json`, including administrator-default methods.
+  Register HTTP work through fixed SDK route constructors.
+- Validate and bind `identity_gateway.upstream_auth_paths` for client API/share
+  paths that use upstream authentication. Other paths retain DSM entry admission;
+  SDK RPC methods retain their own permissions. Use SDK 0.32.0.
+- Load `app.module.js` ES modules and lazy chunks from a content-addressed
+  snapshot of the entire frontend output. Module entries take precedence over
+  classic `app.js`; both require `app.css`. `inspect` verifies the complete tree.
+  Reload an open page after an upgrade if an old lazy chunk is unavailable.
+- Use templates 0.32.0 with SDK/scaffold pins at 0.32.0.
+
+## 0.33.2 (2026-10-28)
+
+- Load the installed app when a DSM window opens after a package upgrade without a page reload; the loader previously reused the app module the previous build left in the page
+- Give DSM windows and full pages `ctx.uiUpdate.check()`, which reports when the installed package has replaced the UI the page loaded, so the SDK's AppShell can offer a reload after an upgrade

package/README.md

@@ -53,6 +53,10 @@ A backend in Python, Node or Rust uses `backend: {runtime: python|node|rust, ...
 the SDK's Go runtime, which checks the DSM session and `permissions.json` and starts the App
 from `target/app` as the package account for each request (see `skills/reference/create.md`).
 
+[App entry and registration](docs/app-entry.md) explains administrator-only and
+Application Privileges admission, explicit method policies, gateway conflicts and
+the build-bound SDK checks.
+
 ## SDK and templates
 
 The CLI packages, deploys and checks. The app-side code is the SDK
@@ -70,12 +74,16 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI-only releases can differ from the SDK patch. Compose import and SDK defaults
+CLI 0.34.0 uses templates 0.32.0 and SDK 0.32.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+Every App method must be declared in the permissions table. Dynamic names and
+custom HTTP dispatchers are rejected; use fixed SDK route constructors and
+`identity_gateway.upstream_auth_paths` for client API paths that use upstream
+authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.32.1 depends on `~0.31.0`: npm installation or
-update can select the latest templates patch in the 0.31 minor line. Templates
+`@synopackageland/templates`. CLI 0.34.0 depends on `~0.32.0`: npm installation or
+update can select the latest templates patch in the 0.32 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
@@ -94,6 +102,13 @@ templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
 `npm ci && npm run build` in `$SYNOPKGLAND_SDK_DIR/ts` first, and again after SDK changes.
 
+Frontend builds may emit `app.module.js` exporting `mount(root, ctx)`, plus
+`app.css` and relative ES module chunks. The CLI packages that output under a
+content-addressed UI directory, so entry, lazy chunks and CSS share one build
+URL. `inspect` verifies that tree against the build inventory. Classic `app.js`
+Apps keep their existing registration contract and paths. See the SDK's
+[frontend bundle guide](https://github.com/synopackageland/syno-pkg-land-sdk/blob/main/docs/frontend-bundles.md).
+
 To check the CLI's DSM terminology rules against templates without a new templates release:
 
 ```sh
@@ -260,11 +275,11 @@ Use matching backend/frontend SDK pins. The profile participates in the
 normal executor approval digest; a profile change needs administrator approval.
 Users grant the named profile separately. The permanent denylist, current-user
 permission checks, bounded JSON and uncertain-outcome rules are in the SDK's
-executor/README.md. Binary downloads require later SDK support.
+executor/README.md.
 
 ## Raw WebAPI profiles
 
-SDK 0.12.1 add opt-in raw responses. In `capabilities.webapi.<profile>`,
+WebAPI profiles support opt-in raw responses. In `capabilities.webapi.<profile>`,
 set `raw_max_bytes: 26214400` for a 25 MiB MIME limit and explicitly allow
 `SYNO.MailClient.Message.get_original` v10. Omitting the limit preserves JSON-only
 profiles. Changing it changes the approved policy and requires fresh user consent.
@@ -274,6 +289,11 @@ package's private executor-staging folder with size/SHA-256 and immediate cleanu
 Do not use Attachment.download or follow X-Accel-Redirect. See the SDK raw response
 contract for the complete transport and CGI validation rules.
 
+`webapi.call` request parameters are JSON-only; it has no request upload field.
+Use streaming `files.write` for uploads, up to 100 MiB per file. Reads and URL
+downloads retain their separate 64 MiB limit. Rebuild with SDK 0.32.0 and approve
+the refreshed executor payload.
+
 ## App launch mode
 
 Native Apps declare `ui.launch: dsm-window | new-page` in `dsm-package.yaml`.
@@ -282,8 +302,10 @@ for every other frontend. Plain/binary scaffolds explicitly choose new-page; Vue
 native `ui.launch` resolves to `dsm-window`; the CLI does not guess a frontend's
 framework from its build command. `new-page` registers DSM `type: "standalone"`,
 so the main menu and Package Center open a full page on the DSM origin.
-`ctx.fullPage`, `ctx.appIcon`, session/SynoToken, launch parameters and entry
-permissions use the same wrapper in both modes. The wrapper sets the standalone
+`ctx.fullPage`, `ctx.appIcon`, `ctx.uiUpdate`, session/SynoToken, launch parameters and entry
+permissions use the same wrapper in both modes. `ctx.uiUpdate.check()` reports when
+a package upgrade replaced the UI the page loaded; AppShell then shows
+a one-line reload notice. The wrapper sets the standalone
 page title, favicon and device-width viewport. It retains ExtJS; `pureEnv` is
 not appropriate, and alternate Portal ports are not needed (`allowAltPort` is omitted).
 

package/assets/go/route-audit/main.go

@@ -0,0 +1,195 @@
+// Command route-audit inspects registrations without running application code.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+type input struct {
+	Dir         string
+	Permissions map[string]string
+	SDK         map[string]map[string]string
+}
+
+type result struct {
+	Problems  []string `json:"problems"`
+	EntryGate bool     `json:"entryGate"`
+}
+
+func main() {
+	var in input
+	if err := json.NewDecoder(os.Stdin).Decode(&in); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	out := result{Problems: []string{}}
+	sdk := map[string]bool{}
+	for _, group := range in.SDK {
+		for method := range group {
+			sdk[method] = true
+		}
+	}
+	set := token.NewFileSet()
+	err := filepath.WalkDir(in.Dir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if path != in.Dir && (strings.HasPrefix(d.Name(), ".") || d.Name() == "vendor" || d.Name() == "node_modules") {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		if d.Type()&os.ModeSymlink != 0 {
+			target, err := os.Stat(path)
+			if err == nil && target.IsDir() {
+				shown, _ := filepath.Rel(in.Dir, path)
+				out.Problems = append(out.Problems, filepath.ToSlash(shown)+":0: Go source directories cannot be symlinks")
+				return nil
+			}
+		}
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+		shown, _ := filepath.Rel(in.Dir, path)
+		problem := func(pos token.Pos, message string) {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%d: %s", filepath.ToSlash(shown), set.Position(pos).Line, message))
+		}
+		if d.Type()&os.ModeSymlink != 0 {
+			problem(token.NoPos, "Go source symlinks cannot be audited")
+			return nil
+		}
+		file, err := parser.ParseFile(set, path, nil, 0)
+		if err != nil {
+			return fmt.Errorf("%s: invalid Go source", shown)
+		}
+		imports := map[string]string{}
+		for _, spec := range file.Imports {
+			module, _ := strconv.Unquote(spec.Path.Value)
+			alias := filepath.Base(module)
+			if spec.Name != nil {
+				alias = spec.Name.Name
+			}
+			if alias == "." {
+				problem(spec.Pos(), "dot imports cannot be audited")
+			}
+			imports[alias] = module
+		}
+		constants := map[string]string{}
+		direct := map[*ast.SelectorExpr]bool{}
+		ast.Inspect(file, func(n ast.Node) bool {
+			if call, ok := n.(*ast.CallExpr); ok {
+				if selector, ok := call.Fun.(*ast.SelectorExpr); ok {
+					direct[selector] = true
+				}
+			}
+			return true
+		})
+		for _, decl := range file.Decls {
+			if g, ok := decl.(*ast.GenDecl); ok && g.Tok == token.CONST {
+				for _, spec := range g.Specs {
+					v := spec.(*ast.ValueSpec)
+					for i, name := range v.Names {
+						if i < len(v.Values) {
+							if lit, ok := v.Values[i].(*ast.BasicLit); ok && lit.Kind == token.STRING {
+								constants[name.Name], _ = strconv.Unquote(lit.Value)
+							}
+						}
+					}
+				}
+			}
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" {
+				problem(fn.Pos(), "custom ServeHTTP bypasses the SDK registry; use api.HandleRequest, HandleResponse or HandleStream")
+			}
+			selector, ok := n.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			pkg, ok := selector.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			module := imports[pkg.Name]
+			name := selector.Sel.Name
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/idgateway" && (name == "NewFront" || name == "Build" || name == "Run") {
+				problem(selector.Pos(), "gateway listeners must use identity_gateway in the manifest; upstream_auth_paths never exempts SDK RPC or custom HTTP handlers")
+			}
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/api" {
+				switch name {
+				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+					if !direct[selector] {
+						problem(selector.Pos(), "route constructor aliases cannot be audited; register methods directly")
+					}
+				}
+			}
+			if module == "net/http" {
+				switch name {
+				case "Handle", "HandleFunc", "HandlerFunc", "NewServeMux", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
+					problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+				}
+			}
+			return true
+		})
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			selector, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			pkg, ok := selector.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			module := imports[pkg.Name]
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/dsm" && selector.Sel.Name == "NewEntryGate" {
+				out.EntryGate = true
+			}
+			if module != "github.com/synopackageland/syno-pkg-land-sdk/api" {
+				return true
+			}
+			switch selector.Sel.Name {
+			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+			default:
+				return true
+			}
+			method := ""
+			if len(call.Args) > 0 {
+				switch arg := call.Args[0].(type) {
+				case *ast.BasicLit:
+					if arg.Kind == token.STRING {
+						method, _ = strconv.Unquote(arg.Value)
+					}
+				case *ast.Ident:
+					method = constants[arg.Name]
+				}
+			}
+			if method == "" {
+				problem(call.Pos(), "dynamic route name cannot be audited; register literal method names")
+			} else if _, declared := in.Permissions[method]; !declared && !sdk[method] {
+				problem(call.Pos(), "registered method missing from permissions.json: "+method)
+			}
+			return true
+		})
+		return nil
+	})
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	if err := json.NewEncoder(os.Stdout).Encode(out); err != nil {
+		os.Exit(1)
+	}
+}

package/dist/error-registry.js

@@ -550,8 +550,8 @@ export const ERROR_REGISTRY = {
         },
         STANDALONE_UI_ENTRY_MISSING: {
             code: "STANDALONE_UI_ENTRY_MISSING",
-            description: "The UI directory is missing app.js or app.css.",
-            suggestion: "Make ui.dir (or the UI build output) contain app.js and app.css.",
+            description: "The UI directory is missing its JavaScript entry or app.css.",
+            suggestion: "Make ui.dir contain app.js (classic) or app.module.js (ES module), plus app.css.",
         },
         STANDALONE_UI_SYMLINK: {
             code: "STANDALONE_UI_SYMLINK",
@@ -828,6 +828,11 @@ export const ERROR_REGISTRY = {
             description: "The display name is invalid.",
             suggestion: "Use single-line text without quotes or backslashes.",
         },
+        STANDALONE_API_REGISTRY_INVALID: {
+            code: "STANDALONE_API_REGISTRY_INVALID",
+            description: "An App handler is outside the central permissions registry.",
+            suggestion: "Declare every App method in permissions.json and use SDK route constructors; remove custom HTTP dispatch.",
+        },
         STANDALONE_API_PERMISSIONS_CHANGED: {
             code: "STANDALONE_API_PERMISSIONS_CHANGED",
             description: "The API policy changed during the build.",

package/dist/init.js

@@ -240,10 +240,14 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     for (const file of capability.removed)
         rmSync(join(targetDir, file));
-    if (Object.keys(capability.permissions).length &&
-        isNativeTemplate(template)) {
+    if (isNativeTemplate(template)) {
         const path = join(targetDir, PERMISSIONS_FILE[template]);
         const policy = JSON.parse(readFileSync(path, "utf8"));
+        // Older template releases relied on the administrator default. Materialize
+        // their three example routes so the generated registry is explicit.
+        for (const method of ["app.status", "greeting.get", "greeting.set"]) {
+            policy.methods[method] ??= "administrators";
+        }
         Object.assign(policy.methods, capability.permissions);
         writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
     }

package/dist/standalone/bridge-runtime.js

@@ -29,6 +29,8 @@ export async function buildBridgeRuntime(m, arch, work, run, digests) {
         `-X main.permissionsDigest=${digests.permissions}`,
         ...(m.portal && portalByExecutor(m.os_min_ver) ? ["-X main.portalMode=executor"] : []),
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${m.apiSDKPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${digests.permissions}`,
+        ...(m.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${m.entry}`] : []),
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, RUNTIME_MAIN], {
         cwd: sdk.goDir,

package/dist/standalone/build.js

@@ -1,4 +1,5 @@
 import { buildInstallSettings } from './install-settings.js';
+import { auditGoRoutes } from './route-audit.js';
 import { PORTAL_REQUIRES_EXECUTOR } from "../portal/alias.js";
 import { buildApiDescription } from "./api-description.js";
 import { goChildEnv } from "../runtime/go-env.js";
@@ -232,6 +233,11 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
             manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
+    const policy = readApiPermissions(backend, manifest.capabilities);
+    const audit = auditGoRoutes(backend.dir, policy.policy, policy.sdk);
+    if (audit.problems.length || manifest.entry && !audit.entryGate) {
+        throw new StandaloneBuildError("STANDALONE_API_REGISTRY_INVALID", audit.problems.join("\n") || "App entry gate was removed during build.");
+    }
     const module = goModulePath(backend.dir);
     if (!module)
         throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} has no module line; backend must be a Go module.`);
@@ -245,6 +251,8 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         `-X main.requestTimeout=${requestTimeoutSeconds(backend)}`,
         `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        ...(manifest.entry ? [`-X ${SDK_MODULE}/api.expectedEntryMode=${manifest.entry}`] : []),
         ...delegateBuildFlags(manifest),
         ...(manifest.executor
             ? [

package/dist/standalone/dsm-window.d.ts

@@ -39,8 +39,8 @@ export declare function windowAppId(manifest: Pick<StandaloneManifest, "package"
  */
 export declare function renderUiConfig(manifest: StandaloneManifest, icons?: PackageIcons, loginStyle?: Record<string, string>): string;
 /**
- * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * The DSM AppWindow that hosts the project's UI. It loads the classic app.js
+ * or the versioned app.module.js module and app.css, then calls mount(root, ctx). `ctx.call(method,
  * params, {signal})` is the only transport: same-origin POST with DSM's session
  * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
@@ -49,8 +49,10 @@ export declare function renderUiConfig(manifest: StandaloneManifest, icons?: Pac
  * (and add a device-width viewport), and `ctx.appIcon` is the package icon a
  * full-page shell shows beside the name, where a DSM window has a title bar.
  * A portal App's `ctx.portal` shows `portalText`, the SDK's panel text.
+ * `ctx.uiUpdate.check()` answers whether the installed package replaced this
+ * window's UI (the SDK's AppShell then offers a reload).
  * `ctx.launchParams` holds the App's own values from the launch that opened
  * the window (a `launchParam` desktop URL or `SYNO.SDS.AppLaunch(id, param)`),
  * and `ctx.onLaunch(fn)` hands fn those of each later launch with values.
  */
-export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string, icons?: PackageIcons, portalText?: PortalCatalogs): string;
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string, icons?: PackageIcons, portalText?: PortalCatalogs, moduleVersion?: string): string;

package/dist/standalone/dsm-window.js

@@ -203,8 +203,8 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
     }, null, 2)}\n`;
 }
 /**
- * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * The DSM AppWindow that hosts the project's UI. It loads the classic app.js
+ * or the versioned app.module.js module and app.css, then calls mount(root, ctx). `ctx.call(method,
  * params, {signal})` is the only transport: same-origin POST with DSM's session
  * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
@@ -213,11 +213,13 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
  * (and add a device-width viewport), and `ctx.appIcon` is the package icon a
  * full-page shell shows beside the name, where a DSM window has a title bar.
  * A portal App's `ctx.portal` shows `portalText`, the SDK's panel text.
+ * `ctx.uiUpdate.check()` answers whether the installed package replaced this
+ * window's UI (the SDK's AppShell then offers a reload).
  * `ctx.launchParams` holds the App's own values from the launch that opened
  * the window (a `launchParam` desktop URL or `SYNO.SDS.AppLaunch(id, param)`),
  * and `ctx.onLaunch(fn)` hands fn those of each later launch with values.
  */
-export function renderWindowScript(manifest, assetVersion, icons = packageIcons(manifest.icon), portalText) {
+export function renderWindowScript(manifest, assetVersion, icons = packageIcons(manifest.icon), portalText, moduleVersion) {
     const pkg = manifest.package;
     const ns = `SYNO.SDS.${pkg}`;
     const p = JSON.stringify(pkg);
@@ -394,22 +396,62 @@ ${ns}.sessionUser = function () {
   return { name: typeof session.user === "string" ? session.user : "", isAdmin: session.is_admin === true };
 };
 
-${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns, portalText) : ""}${ns}.loadApp = function (done) {
+${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns, portalText) : ""}// DSM loads the installed build's window script when a window opens after a
+// package upgrade, but keeps the page and the app module the previous build
+// registered. Reuse it only when this build loaded it; an older loader records
+// no build, so its app is replaced as well.
+${ns}.loadApp = function (done) {
   var apps = window.DsmPackageApps || {};
-  if (apps[${p}]) {
+  var versions = window.DsmPackageAppVersions = window.DsmPackageAppVersions || {};
+  if (apps[${p}] && versions[${p}] === "${assetVersion}") {
     done(apps[${p}]);
     return;
   }
-  var base = "webman/3rdparty/${pkg}/app/";
+${moduleVersion ? `  var loads = window.DsmPackageAppLoads = window.DsmPackageAppLoads || {};
+  var key = ${p} + ":${moduleVersion}";
+  if (loads[key]) { loads[key].then(function (app) { done(app); }, function (error) { done(null, error); }); return; }
+` : ""}  var base = "webman/3rdparty/${pkg}/app/${moduleVersion ? `${moduleVersion}/` : ""}";
   var css = document.createElement("link");
   css.rel = "stylesheet";
   css.href = base + "app.css?v=${assetVersion}";
   document.head.appendChild(css);
-  var js = document.createElement("script");
+${moduleVersion ? `  loads[key] = import(new URL(base + "app.module.js", document.baseURI).href).then(function (app) {
+    if (typeof app.mount !== "function") throw new Error("The UI module must export mount(root, ctx)");
+    window.DsmPackageApps = window.DsmPackageApps || {};
+    window.DsmPackageApps[${p}] = app;
+    versions[${p}] = "${assetVersion}";
+    return app;
+  });
+  loads[key].then(function (app) { done(app); }, function (error) {
+    delete loads[key];
+    css.remove();
+    done(null, error);
+  });
+` : `  var js = document.createElement("script");
   js.src = base + "app.js?v=${assetVersion}";
   js.dataset.package = ${p};
-  js.onload = function () { done((window.DsmPackageApps || {})[${p}]); };
+  js.onload = function () { versions[${p}] = "${assetVersion}"; done((window.DsmPackageApps || {})[${p}]); };
   document.head.appendChild(js);
+`}
+};
+
+// DSM keeps a loaded window script after a package upgrade until the page
+// reloads, so a window opened again runs the old UI. ui/config names the
+// installed build's window file: once it no longer names this one, the
+// installed UI replaced this page's. no-store, not no-cache: DSM tags
+// ui/config by size alone, so a revalidation can keep an older build's copy.
+// An uninstalled package or a failed read answers false.
+${ns}.uiUpdate = {
+  check: function (signal) {
+    if (typeof fetch !== "function") return Promise.resolve(false);
+    return fetch("webman/3rdparty/${pkg}/config", { cache: "no-store", credentials: "same-origin", signal: signal })
+      .then(function (response) { return response.ok ? response.json() : null; })
+      .then(function (config) {
+        return !!config && typeof config === "object" && !Array.isArray(config) &&
+          !Object.prototype.hasOwnProperty.call(config, ${JSON.stringify(windowScriptName(manifest))});
+      })
+      .catch(function () { return false; });
+  }
 };
 
 // A Portal/standalone launch is the whole page, on a phone as well: no desktop
@@ -478,10 +520,11 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
     var ctx = { requestTimeout: ${requestTimeout} };
     var call = function (method, params, options) { return ${ns}.call(method, params, options, ctx.requestTimeout); };
     var batch = ${batchRuntime ? `function (calls, options) { return ${ns}.batch(calls, options, ctx.requestTimeout); }` : "undefined"};
-${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
+${root ? root.mount : ""}    ${ns}.loadApp(function (app, error) {
       if (me.mountToken !== mountToken) return;
       me.mountPending = false;
       var root = me.body && me.body.dom.querySelector(".dsmapp-root");
+      if (error && root) { root.textContent = "Unable to load the package UI. Reload this page to try again."; return; }
       if (app && root && !me.mounted) {
         var i18n = ${ns}.createI18n(lang, ${ns}.messages);
         me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });
@@ -501,6 +544,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
           appWindow: me,
           fullPage: ${ns}.fullPage(),
           appIcon: ${ns}.appIcon,
+          uiUpdate: ${ns}.uiUpdate,
           lang: lang,
           locale: i18n.locale,
           t: i18n.t${root ? `,\n          executor: access` : ""}

package/dist/standalone/identity-gateway.d.ts

@@ -64,6 +64,7 @@ export interface IdentityGateway {
         https?: number;
     };
     passthrough: string[];
+    upstream_auth_paths?: string[];
     optional_passthrough?: Record<string, {
         prefixes: string[];
     }>;
@@ -121,5 +122,18 @@ export declare function identityGatewayConfig(m: StandaloneManifest): string;
 export declare function gatewayDaemon(daemon: Daemon): Daemon;
 /** Builds the gateway from the declared SDK release with the pinned Go, binding its config path. */
 export declare function buildIdentityGateway(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
+/** Exact JSON contract shared with idgateway.Config.EntryPolicyDigest. */
+export declare function gatewayEntryPolicyDigest(cfg: {
+    entry?: string;
+    access?: string;
+    upstream_access?: string;
+    upstream_auth_paths?: string[];
+    groups?: string[];
+    compose_blocked?: boolean;
+    passthrough?: string[];
+    optional_passthrough?: Record<string, {
+        prefixes: string[];
+    }>;
+}): string;
 /** The manifest form of a normalized gateway, retained for artifact inspection. */
 export declare function identityGatewayDeclaration(g: IdentityGateway | undefined): unknown;

package/dist/standalone/identity-gateway.js

@@ -1,4 +1,5 @@
 import { nativeGatewaySupported } from './native-gateway.js';
+import { createHash } from 'node:crypto';
 import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -41,6 +42,17 @@ const localPath = (v) => typeof v === "string" &&
     /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(v) &&
     !v.startsWith("//") &&
     !v.split("/").some((p) => p === "." || p === "..");
+const pathPrefix = (path, prefix) => {
+    const base = prefix.replace(/\/$/, "");
+    return path === base || path.startsWith(base + "/");
+};
+const upstreamPrefix = (v) => typeof v === "string" && v.length <= 512 && /^\/[A-Za-z0-9._~/-]+$/.test(v) &&
+    v !== "/" && !v.includes("//") && !v.split("/").some(p => p === "." || p === "..") &&
+    !pathPrefix(v, "/_sso") && !pathPrefix(v, "/_spl");
+function upstreamAuthSdkSupported(dir) {
+    const source = join(dir, "idgateway/upstream_auth.go");
+    return existsSync(source) && /const UpstreamAuthPathsVersion = 1\b/.test(readFileSync(source, "utf8"));
+}
 const strings = (v, ok, max = 64) => Array.isArray(v) && v.length <= max && v.every(ok);
 const name = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(v);
 const headerName = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(v);
@@ -151,6 +163,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             "upstream",
             "listen",
             "passthrough",
+            "upstream_auth_paths",
             "optional_passthrough",
             "redirects",
             "email_domain",
@@ -161,7 +174,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             "token",
             "account",
         ])) {
-        return invalid("accepts only sdk, external_access, mode, access, upstream_access, groups, upstream, listen, passthrough, optional_passthrough, redirects, email_domain, session_ttl, roles, headers, oidc, token and account.");
+        return invalid("accepts only sdk, external_access, mode, access, upstream_access, groups, upstream, listen, passthrough, upstream_auth_paths, optional_passthrough, redirects, email_domain, session_ttl, roles, headers, oidc, token and account.");
     }
     const v = value;
     let externalAccess;
@@ -270,6 +283,25 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
         }
     }
     const redirects = v.redirects ?? {};
+    const upstreamAuth = v.upstream_auth_paths;
+    if (upstreamAuth !== undefined) {
+        if (!strings(upstreamAuth, upstreamPrefix, 16) || !upstreamAuth.length)
+            return invalid("upstream_auth_paths needs 1-16 fixed path prefixes outside /_sso and /_spl, without wildcards or encoded paths.");
+        for (let i = 0; i < upstreamAuth.length; i++) {
+            if (upstreamAuth.slice(0, i).some(p => pathPrefix(p, upstreamAuth[i]) || pathPrefix(upstreamAuth[i], p)))
+                return invalid("upstream_auth_paths prefixes must not overlap.");
+        }
+        const all = [...passthrough, ...Object.values((optional ?? {})).flatMap(rule => rule.prefixes)];
+        if (all.some(p => !upstreamPrefix(p) || !upstreamAuth.some(prefix => pathPrefix(p, prefix))))
+            return invalid("passthrough must be contained in upstream_auth_paths.");
+        try {
+            if (!upstreamAuthSdkSupported(sdkSource(v.sdk).goDir))
+                return invalid("The selected SDK lacks upstream_auth_paths and its build-bound entry policy; use matching SDK sources.");
+        }
+        catch {
+            return invalid("The SDK upstream_auth_paths source is unavailable; use matching SDK sources.");
+        }
+    }
     if (!record(redirects) ||
         Object.entries(redirects).some(([from, to]) => !localPath(from) || !localPath(to)))
         return invalid("redirects maps local paths to local paths.");
@@ -316,6 +348,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
             ...(listen.https ? { https: listen.https } : {}),
         },
         passthrough: passthrough,
+        ...(upstreamAuth !== undefined ? { upstream_auth_paths: upstreamAuth } : {}),
         ...(optional !== undefined ? { optional_passthrough: optional } : {}),
         redirects: redirects,
         ...(v.email_domain ? { email_domain: v.email_domain } : {}),
@@ -451,7 +484,7 @@ export function identityGatewayConfig(m) {
         access: g.access ?? "dsm-users",
         ...(g.upstream_access ? { upstream_access: g.upstream_access } : {}),
         ...(g.groups ? { groups: g.groups } : {}),
-        ...(m.entry || g.upstream_access === "public" ? { entry: m.entry ?? "app-privilege" } : {}),
+        ...(m.entry ? { entry: m.entry } : {}),
         ...(m.compose ? { container_app: true } : {}),
         ...(m.compose?.plan.mounts_blocked ? { compose_blocked: true } : {}),
         ...(g.max_upload_bytes ? { max_upload_bytes: g.max_upload_bytes } : {}),
@@ -468,6 +501,7 @@ export function identityGatewayConfig(m) {
         authorize_cgi: `/webman/3rdparty/${m.package}/sso/authorize.cgi`,
         state_dir: `/var/packages/${m.package}/var/sso`,
         passthrough: g.passthrough,
+        ...(g.upstream_auth_paths ? { upstream_auth_paths: g.upstream_auth_paths } : {}),
         ...(g.optional_passthrough ? { optional_passthrough: g.optional_passthrough } : {}),
         redirects: g.redirects,
         ...(g.email_domain ? { email_domain: g.email_domain } : {}),
@@ -526,6 +560,8 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("SDK_DOWNLOAD_FAILED", error.message.replace(/^\[[A-Z_]+\] /, ""));
     }
     runtimeBudgetSource(sdk.goDir, m);
+    if (m.identityGateway.upstream_auth_paths && !upstreamAuthSdkSupported(sdk.goDir))
+        throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "The selected SDK lacks upstream_auth_paths and its build-bound entry policy; use matching SDK sources.");
     if (gatewayExternalAccess(m.identityGateway)) {
         const config = join(sdk.goDir, "idgateway/config.go");
         const main = join(sdk.goDir, "idgateway/cmd/gateway/main.go");
@@ -553,7 +589,10 @@ export async function buildIdentityGateway(m, arch, work, run) {
             throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "The selected SDK lacks fixed launch_path support; use a matching SDK release or an explicit development source override.");
     }
     const out = join(work, `identity-gateway-${arch}`);
-    const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}`;
+    const policyFlag = upstreamAuthSdkSupported(sdk.goDir)
+        ? ` -X github.com/synopackageland/syno-pkg-land-sdk/idgateway.expectedEntryPolicyDigest=${gatewayEntryPolicyDigest(JSON.parse(identityGatewayConfig(m)))}`
+        : "";
+    const ldflags = `-s -w -buildid= -X main.configPath=${packageDest(m)}/${GATEWAY_CONFIG_PATH}${policyFlag}`;
     const result = await run("go", [
         "build",
         "-trimpath",
@@ -578,6 +617,19 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_BUILD_FAILED", toolchain);
     return out;
 }
+/** Exact JSON contract shared with idgateway.Config.EntryPolicyDigest. */
+export function gatewayEntryPolicyDigest(cfg) {
+    // Serialize keys explicitly: JSON.stringify reorders integer-like object keys.
+    const optional = Object.entries(cfg.optional_passthrough ?? {})
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+        .map(([id, rule]) => `${JSON.stringify(id)}:${JSON.stringify({ prefixes: rule.prefixes })}`).join(",");
+    const base = JSON.stringify({
+        entry: cfg.entry ?? "", access: cfg.access ?? "", upstream_access: cfg.upstream_access ?? "",
+        groups: cfg.groups ?? [], compose_blocked: cfg.compose_blocked ?? false,
+        upstream_auth_paths: cfg.upstream_auth_paths ?? [], passthrough: cfg.passthrough ?? [],
+    });
+    return createHash("sha256").update(`${base.slice(0, -1)},"optional_passthrough":{${optional}}}`).digest("hex");
+}
 /** The manifest form of a normalized gateway, retained for artifact inspection. */
 export function identityGatewayDeclaration(g) {
     if (!g)

package/dist/standalone/inspect-spk.js

@@ -1,4 +1,5 @@
 import { readInstallSettings, settingsInstallSteps, settingsConfig, renderSettingsHook } from './install-settings.js';
+import { MODULE_UI_ENTRY, uiTreeDigest } from "./ui-assets.js";
 import { nativePortal } from "./portal.js";
 import { nativeGatewaySupported, renderNativeGatewayConfig, renderNativeGatewayDiagnostic, renderNativeGatewayPrepare, NATIVE_GATEWAY_CONFIG, gatewayEntryPath } from './native-gateway.js';
 import { inspectPortalInfo } from "../portal/info.js";
@@ -101,6 +102,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                 const raw = JSON.parse(metadataText);
                 if ((raw.launch !== undefined && !isWebLaunchMode(raw.launch)) ||
                     raw.schema !== 2 ||
+                    (raw.ui_module !== undefined && (typeof raw.ui_module !== "string" || !/^[a-f0-9]{64}$/.test(raw.ui_module) || raw.window === false || raw.compose !== undefined)) ||
                     !["go", "python", "node", "rust", "binary"].includes(raw.backend) ||
                     !Array.isArray(raw.capabilities) ||
                     raw.capabilities.some((name) => ![
@@ -130,6 +132,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             }
         }
         const daemonRestart = recoverDaemonRestart(metadata.daemon_restart, metadata.daemon_sdk, findings);
+        await inspectModuleUi(dir, paths, metadata.ui_module, findings);
         if (metadata.daemon_restart !== undefined && (metadata.compose !== undefined || !paths.has("daemon/control")))
             findings.push("DAEMON_RESTART_INVALID daemon restart requires a native daemon controller, without Compose supervision");
         const identityGateway = await inspectProviderOnlyAdmission(dir, paths, metadata.provider_only_oidc, findings);
@@ -344,6 +347,31 @@ export async function inspectSpk(spkPath, expectedKind) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+async function inspectModuleUi(dir, paths, version, findings) {
+    if (version === undefined) {
+        if ([...paths].some(path => /^ui\/app\/[a-f0-9]{64}\/app\.module\.js$/.test(path)))
+            findings.push("UI_MODULE_INVALID module UI requires its build record");
+        return;
+    }
+    try {
+        if (!/^[a-f0-9]{64}$/.test(version))
+            throw new Error("invalid UI tree digest");
+        const prefix = `ui/app/${version}/`;
+        for (const entry of [MODULE_UI_ENTRY, "app.css"])
+            if (!paths.has(prefix + entry))
+                throw new Error(`missing ${entry}`);
+        if ([...paths].some(path => path.startsWith("ui/app/") && path !== `ui/app/${version}` && !path.startsWith(prefix)))
+            throw new Error("module UI assets must all belong to the recorded tree");
+        const root = join(dir, "module-ui-inspection");
+        mkdirSync(root);
+        await tar.x({ file: join(dir, "package.tgz"), cwd: root, filter: path => path.replace(/^\.\//, "").startsWith(prefix) });
+        if (uiTreeDigest(join(root, "ui/app", version), true) !== version)
+            throw new Error("UI assets differ from their recorded digest");
+    }
+    catch (error) {
+        findings.push(`UI_MODULE_INVALID ${error.message}`);
+    }
+}
 const LAUNCHER_TYPE_MISMATCH = "LAUNCHER_TYPE_MISMATCH";
 const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 /** Compare the actual launcher and Portal fields to the packaged declaration. */
@@ -1110,7 +1138,7 @@ async function inspectProviderOnlyAdmission(dir, paths, saved, findings) {
             return;
         }
         if (cfg.mode !== "oidc" || !["dsm-users", "dsm-admins", "dsm-groups"].includes(cfg.access)
-            || !["app-privilege", "admin-only"].includes(cfg.entry) || cfg.compose_blocked
+            || cfg.entry !== undefined || cfg.compose_blocked
             || Object.keys(cfg.optional_passthrough ?? {}).length)
             throw new Error("OIDC admission policy weakens issuer or Share protection");
         if (cfg.access === "dsm-groups" && (!Array.isArray(cfg.groups) || !cfg.groups.length || !cfg.groups.every((g) => typeof g === "string" && g.length > 0)))

package/dist/standalone/manifest.js

@@ -1,4 +1,5 @@
 import { readInstallSettings } from './install-settings.js';
+import { auditGoRoutes } from './route-audit.js';
 import { isWebLaunchMode } from "../contract/web-launch.js";
 import { validWebAPIProfiles, } from "../runtime/webapi-profile.js";
 import { validateMetadata } from "../package-metadata.js";
@@ -24,7 +25,7 @@ import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration, }
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { LOGIN_COLOR, loginImageProblem, } from "../build-spk/login-style.js";
 import { validateReproducible } from "../reproducible-config.js";
-import { appSdkVersion, SDK_MODULE, } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_MODULE, sdkSource, } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
 import { readWindowSize } from "./window-size.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
@@ -337,6 +338,32 @@ function readManifest(raw, c) {
             (raw.entry === "admin-only" || raw.entry === "app-privilege")
             ? raw.entry
             : readEntry(raw.entry, backend, permissions?.policy, c);
+    if (entry && identityGateway && (identityGateway.access === "public" || identityGateway.upstream_access === "public" ||
+        !identityGateway.upstream_auth_paths?.length &&
+            (identityGateway.passthrough.length || Object.keys(identityGateway.optional_passthrough ?? {}).length)))
+        c.fail("STANDALONE_ENTRY_WIDENED", "App entry requires protected gateway access and passthrough contained in explicit upstream_auth_paths.");
+    if (entry && raw.compose !== undefined && identityGateway) {
+        try {
+            if (!readFileSync(join(sdkSource(identityGateway.sdk).goDir, "api/server.go"), "utf8").includes("expectedEntryMode")) {
+                c.fail("STANDALONE_ENTRY_UNSUPPORTED", "Update the SDK: App entry requires the build-bound entry floor and gateway admission.");
+            }
+        }
+        catch {
+            c.fail("STANDALONE_ENTRY_UNSUPPORTED", "The SDK entry floor source is unavailable; update the SDK and retry.");
+        }
+    }
+    if (backend?.kind === "go" && permissions && sdkVersionOrUndefined(backend) && (raw.entry === undefined || entry)) {
+        try {
+            const audit = auditGoRoutes(backend.dir, permissions.policy, permissions.sdk);
+            for (const problem of audit.problems)
+                c.fail("STANDALONE_API_REGISTRY_INVALID", problem);
+            if (entry && !audit.entryGate)
+                c.fail("STANDALONE_ENTRY_UNSUPPORTED", "App entry requires an actual dsm.NewEntryGate call; comments do not enforce admission.");
+        }
+        catch (error) {
+            c.fail("STANDALONE_API_REGISTRY_INVALID", error.message);
+        }
+    }
     if (entry === "admin-only" && permissions) {
         const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
@@ -498,6 +525,9 @@ export function bridgeMethodProblems(methods, permissions, file) {
         problems.push(`App methods must not use an SDK method name: ${taken.join(", ")}.`);
     if (!methods)
         return problems;
+    const missing = methods.filter(method => !sdk.has(method) && !Object.hasOwn(permissions.policy.methods, method));
+    if (missing.length)
+        problems.push(`${file} must declare every registered App method: ${missing.join(", ")}.`);
     const unlisted = Object.keys(permissions.policy.methods).filter((method) => !sdk.has(method) && !methods.includes(method));
     if (unlisted.length)
         problems.push(`${file} sets methods the App does not have: ${unlisted.join(", ")}; the runtime refuses to start.`);
@@ -645,6 +675,17 @@ function readEntry(value, backend, policy, c) {
         const shown = main ? relative(c.root, main) : "the backend.main main.go";
         return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry needs the SDK entry gate: ${gate?.sdk ?? `backend/go.mod must require ${SDK_MODULE}`}, and wrap the authenticator with ${gate?.call.slice(0, -1) ?? "dsm.NewEntryGate"} in ${shown}.`);
     }
+    const version = sdkVersionOrUndefined(backend);
+    if (version) {
+        try {
+            if (!readFileSync(join(sdkSource(version).goDir, "api/server.go"), "utf8").includes("expectedEntryMode")) {
+                return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "Update the SDK: App entry requires the build-bound entry floor in api.Server.");
+            }
+        }
+        catch {
+            return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "The SDK entry floor source is unavailable; update the SDK and retry.");
+        }
+    }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege needs at least one route marked authenticated in permissions.json, otherwise regular users have nothing to use.");
     }

package/dist/standalone/route-audit.d.ts

@@ -0,0 +1,6 @@
+import type { ApiPermissions } from './api-permissions.js';
+/** Parse Go syntax without executing an App's main, init functions or --describe. */
+export declare function auditGoRoutes(dir: string, policy: ApiPermissions, sdk: Record<string, Record<string, string>>): {
+    problems: string[];
+    entryGate: boolean;
+};

package/dist/standalone/route-audit.js

@@ -0,0 +1,25 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { goChildEnv } from '../runtime/go-env.js';
+let binary;
+/** Parse Go syntax without executing an App's main, init functions or --describe. */
+export function auditGoRoutes(dir, policy, sdk) {
+    const env = goChildEnv({ ...process.env, GOOS: undefined, GOARCH: undefined, GOARM: undefined, GOWORK: 'off', CGO_ENABLED: '0' });
+    if (!binary) {
+        const work = mkdtempSync(join(tmpdir(), 'synopkgland-route-audit-'));
+        process.once('exit', () => rmSync(work, { recursive: true, force: true }));
+        const out = join(work, process.platform === 'win32' ? 'route-audit.exe' : 'route-audit');
+        const source = fileURLToPath(new URL('../../assets/go/route-audit/main.go', import.meta.url));
+        const build = spawnSync('go', ['build', '-trimpath', '-o', out, source], { env: goChildEnv(env), encoding: 'utf8', timeout: 120_000 });
+        if (build.error || build.status !== 0)
+            throw new Error('Cannot build the Go route auditor; install Go and retry.');
+        binary = out;
+    }
+    const result = spawnSync(binary, [], { env, input: JSON.stringify({ Dir: realpathSync(dir), Permissions: policy.methods, SDK: sdk }), encoding: 'utf8', timeout: 30_000, maxBuffer: 4 << 20 });
+    if (result.error || result.status !== 0)
+        throw new Error(`Cannot audit Go routes: ${result.stderr?.trim() || 'auditor unavailable'}`);
+    return JSON.parse(result.stdout);
+}

package/dist/standalone/spk.js

@@ -6,7 +6,7 @@ import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { gatewayAdmissionPolicy } from "./identity-gateway.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, sep } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
@@ -19,6 +19,7 @@ import { renderDelegateScopeSteps } from "../build-spk/delegate-scope.js";
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
+import { MODULE_UI_ENTRY, uiTreeDigest } from "./ui-assets.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { appTitle, CGI_PAYLOAD_PATH, hasSdkWindow, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
@@ -81,7 +82,16 @@ export async function assembleStandaloneSpk(options) {
             copyUiTree(manifest.ui.dir, appDir, manifest.root);
         else
             mkdirSync(appDir, { recursive: true });
-        const assetVersion = digestTree(appDir).slice(0, 12);
+        const moduleUi = hasSdkWindow(manifest) && existsSync(join(appDir, MODULE_UI_ENTRY));
+        const uiDigest = uiTreeDigest(appDir, moduleUi);
+        const assetVersion = uiDigest.slice(0, 12);
+        const moduleVersion = moduleUi ? uiDigest : undefined;
+        if (moduleVersion) {
+            const snapshot = join(uiRoot, "app-snapshot");
+            renameSync(appDir, snapshot);
+            mkdirSync(appDir);
+            renameSync(snapshot, join(appDir, moduleVersion));
+        }
         const login = manifest.portal
             ? loginStyleAssets(manifest.loginStyle)
             : undefined;
@@ -89,7 +99,7 @@ export async function assembleStandaloneSpk(options) {
         for (const [path, bytes] of login?.files ?? [])
             writeFile(join(uiRoot, path), bytes);
         if (hasSdkWindow(manifest))
-            writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
+            writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText, moduleVersion));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
         writeUiTexts(uiRoot, appTitle(manifest), manifest.console);
@@ -225,6 +235,7 @@ export async function assembleStandaloneSpk(options) {
             .digest("hex");
         writeFile(join(staging, "sdk-package.json"), JSON.stringify({
             schema: 2,
+            ...(moduleVersion ? { ui_module: moduleVersion } : {}),
             ...(manifest.installSettings ? { installSettings: manifest.installSettings } : {}),
             ...(manifest.lifecycleTimeouts ? { lifecycleTimeouts: manifest.lifecycleTimeouts } : {}),
             ...("timeoutSeconds" in manifest.backend && manifest.backend.timeoutSeconds ? { operationSeconds: manifest.backend.timeoutSeconds } : {}),
@@ -387,7 +398,7 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
 function copyUiTree(source, target, root) {
-    for (const entry of ["app.js", "app.css"]) {
+    for (const entry of [existsSync(join(source, MODULE_UI_ENTRY)) ? MODULE_UI_ENTRY : "app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {
             throw new StandaloneBuildError("STANDALONE_UI_ENTRY_MISSING", `The UI directory is missing ${entry}: ${source}`);
         }
@@ -425,19 +436,3 @@ function copyUiTree(source, target, root) {
     };
     walk(source, target);
 }
-function digestTree(root) {
-    const hash = createHash("sha256");
-    const walk = (dir, prefix) => {
-        for (const name of readdirSync(dir).sort()) {
-            const path = join(dir, name);
-            if (lstatSync(path).isDirectory()) {
-                walk(path, `${prefix}${name}/`);
-            }
-            else {
-                hash.update(`${prefix}${name}\0`).update(readFileSync(path));
-            }
-        }
-    };
-    walk(root, "");
-    return hash.digest("hex");
-}

package/dist/standalone/ui-assets.d.ts

@@ -0,0 +1,3 @@
+export declare const MODULE_UI_ENTRY = "app.module.js";
+/** Include paths and bytes: moving a chunk changes its import URL too. */
+export declare function uiTreeDigest(root: string, framed?: boolean): string;

package/dist/standalone/ui-assets.js

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+export const MODULE_UI_ENTRY = "app.module.js";
+/** Include paths and bytes: moving a chunk changes its import URL too. */
+export function uiTreeDigest(root, framed = false) {
+    const hash = createHash("sha256");
+    const walk = (dir, prefix) => {
+        for (const name of readdirSync(dir).sort()) {
+            const path = join(dir, name);
+            const stat = lstatSync(path);
+            if (stat.isDirectory())
+                walk(path, `${prefix}${name}/`);
+            else if (stat.isFile()) {
+                hash.update(`${prefix}${name}\0`);
+                // Module snapshots frame bytes; classic cache tokens keep their old digest.
+                if (framed)
+                    hash.update(`${stat.size}\0`);
+                hash.update(readFileSync(path));
+            }
+            else
+                throw new Error("UI assets must be regular files and directories");
+        }
+    };
+    walk(root, "");
+    return hash.digest("hex");
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
-    "synopkgland": "dist/bin.js"
+    "synopkgland": "./dist/bin.js"
   },
   "engines": {
     "node": ">=22.12"
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.31.0",
+    "@synopackageland/templates": "~0.32.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -24,6 +24,13 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
+Use SDK 0.32.0 and CLI 0.34.0 for App entry enforcement. Declare every App method
+in the permissions table; dynamic names and custom HTTP dispatchers are rejected.
+Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
+paths that rely on upstream authentication. Read
+[reference/identity.md](reference/identity.md) and
+[reference/identity-gateway.md](reference/identity-gateway.md) before migration.
+
 **If you package someone else's open-source project, set `maintainer` to the
 original project/owner (prefer the project's own team/org name, else the owner's
 display name, else login), `metadata.maintainer_url` to the upstream repository,
@@ -184,7 +191,7 @@ Scaffold 明確寫入此選擇，plain／binary 使用 `new-page`，Vue UI SDK
 預設的 `dsm-window`（省略 `ui.launch`）。原生 manifest 省略 `ui.launch` 時解析為 `dsm-window`，CLI 不猜測前端依賴。
 
 `new-page` 產生 DSM `type: "standalone"` launcher，主選單及套件中心皆在 DSM
-本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、SynoToken／session、
+本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、`ctx.uiUpdate`、SynoToken／session、
 `ctx.launchParams`／`onLaunch`、`entry` 權限沿用共用 wrapper；全頁的標題、
 favicon 與手機 viewport 由 wrapper 設定。不需要 `pureEnv` 或 `allowAltPort`。
 

package/skills/reference/create.md

@@ -56,7 +56,7 @@ backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
 - Python：DSM 的 `/usr/bin/python3`；SDK 放進 `app/vendor/synopkgland_app/`，`PYTHONPATH=vendor`。
 - Node：Package Center 的 Node.js_v18／v20／v22 成為 INFO `install_dep_packages`；SDK 的 `package.json` 與 `dist/` 放進 `node_modules/@synopackageland/app`，其他 dependencies 先在 App 目錄 `npm ci --omit=dev`。
 - Rust：Cargo.toml 以 git＋tag 相依 `syno-pkg-land-app`；`cargo zigbuild` 交叉編譯（x86_64／aarch64 musl、armv7 glibc），`panic = "unwind"`；binary 在 `app/bin/<entry>`。需要 rustup 的 cargo、三個 target、cargo-zigbuild 與 zig。
-- methods：沒寫時 build 在建置機執行 `<entry> --describe`；Rust 必須寫。`permissions.json` 只能設定 methods 內的 method。
+- methods：沒寫時 build 在建置機執行 `<entry> --describe`；Rust 必須寫。每個 App method 都必須明列於 `permissions.json`，且表內只能設定 methods 內的 method。動態名稱與自訂 HTTP dispatcher 會被拒絕；請使用固定 SDK routes。
 - capabilities：`files`、`identity`、`jobs`、`rootOps`、`delegate`（僅 `until-revoked`＋`files.moveFromStaging`＋destinations）與 `portal`；daemon 需要 Go。jobs 或 delegate 時，同一個 runtime 另裝為 `target/background/worker`，DSM 以套件帳號執行 `worker --worker`；rootOps、delegate 附 executor，`bridge.json` 的 delegate digest 必須等於 SPK 的 executor。
 - transfers：`backend.transfers: {<method>: upload|download}`（method 必須在 methods 內），`backend.max_upload_bytes` 上限 16 GiB。
 
@@ -231,7 +231,7 @@ Scaffold 明確寫入此選擇，plain／binary 使用 `new-page`，Vue UI SDK
 預設的 `dsm-window`（省略 `ui.launch`）。原生 manifest 省略 `ui.launch` 時解析為 `dsm-window`，CLI 不猜測前端依賴。
 
 `new-page` 產生 DSM `type: "standalone"` launcher，主選單及套件中心皆在 DSM
-本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、SynoToken／session、
+本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、`ctx.uiUpdate`、SynoToken／session、
 `ctx.launchParams`／`onLaunch`、`entry` 權限沿用共用 wrapper；全頁的標題、
 favicon 與手機 viewport 由 wrapper 設定。不需要 `pureEnv` 或 `allowAltPort`。
 

package/skills/reference/files.md

@@ -2,6 +2,11 @@
 
 Native-go 的 B 能力使用 `init --with files` 或 `add files`，對應 schema 2 `capabilities.files: session`。File tree 與共用 NasPicker 以 TreeView／DataGrid 顯示本人可見內容；一般選取不建立授權；delegate destination 選取例外，確認即授權。FilePicker 選瀏覽器本機檔案。上傳／下載使用 streaming transport，不把內容放進 JSON。每次以呼叫者有效 DSM session 由 File Station 判權，不需管理員進行能力設定。
 
+SDK 0.32.0 的 delegated `files.write` 逐檔上限為 100 MiB；`files.read` 與
+URL 下載另維持 64 MiB 上限。`webapi.call` 的 request params 只接受 JSON，
+不提供 request upload；檔案上傳使用串流 `files.write`。更新後重建套件，
+並重新核准變更的 executor payload。
+
 只有 App session 沒有有效 DSM cookie 時回 `dsm_session_required`，須在同 hostname 登入 DSM。不能以套件帳號或 root 作後備存取。
 
 A 能力 `--with jobs` 使用套件帳號處理已匯入的私有副本，依可信 username／UID 綁定；一般使用者不需 admin 設定即可提交、查詢與取消自己的工作。關閉瀏覽器後繼續，不保存 cookie／SID／密碼。匯入需要本人在線 session；私有副本不是離線讀取原檔案的權限。Jobs 與 daemon 互斥。

package/skills/reference/identity-gateway.md

@@ -1,5 +1,25 @@
 # Wrap an OSS app with DSM accounts
 
+## Upstream-authenticated paths
+
+Build with SDK 0.32.0 and CLI 0.34.0. Use `upstream_auth_paths` for client API
+paths that use upstream authentication.
+
+Keep browser routes behind `entry: admin-only` or `entry: app-privilege`; list
+only upstream API/share prefixes in `identity_gateway.upstream_auth_paths`, for
+example `[/rest, /share]`. Prefixes are case-sensitive and segment-bounded;
+`/rest` does not match `/restore`. Use 1-16 nonoverlapping absolute prefixes with
+URL unreserved characters and `/`, no root, dot segments, repeated slashes,
+percent escapes, wildcards or reserved `/_sso` / `/_spl` paths.
+
+Permanent/optional passthrough must be contained in those prefixes. Requests
+preserve upstream credentials but lose DSM/SDK cookies and trusted identity
+headers. Upstream auth owns authentication, CSRF, authorization and WebSockets;
+public upstream share links remain public. Other paths keep the DSM entry gate.
+SDK RPC methods cannot use this exception. The CLI checks matching SDK capability
+and links the gateway policy digest; editing the static paths requires rebuilding.
+See `docs/app-entry.md` for the complete contract.
+
 ## External access
 
 Use SDK 0.30.0 or later with matching gateway sources. Add this to the existing

package/skills/reference/identity.md

@@ -2,6 +2,14 @@
 
 Native-go validates the caller's DSM session per package. Business route permissions come from backend/internal/api/permissions.json; SDK-owned route policy is protected separately. Capabilities describe execution/resources and do not grant business route access. Never trust a request username as owner.
 
+With SDK 0.32.0 and CLI 0.34.0, every App method must appear in the permissions
+table, including administrator-default methods. Dynamic names and custom HTTP
+dispatchers are rejected. Use fixed SDK route constructors and declare
+`identity_gateway.upstream_auth_paths` for client API paths authenticated by the
+upstream. These paths never exempt SDK RPC methods from their own permissions.
+Read [App entry and registration](https://github.com/synopackageland/syno-pkg-land-cli/blob/main/docs/app-entry.md)
+for migration and build binding.
+
 Entry: omit `entry` for legacy access; `entry: admin-only` admits administrators only and is the floor of every route: SDK routes a capability adds (files, jobs, portal, delegate, rootOps) refuse ordinary users with `admin_required`, the launcher is hidden, and an app route marked `authenticated` or `public` in permissions.json fails validate/build with `STANDALONE_ENTRY_WIDENED` (only the public `identity: standalone` login routes stay public; they admit no one by themselves). The SPK records the mode in `sdk-package.json`; `inspect` prints it and flags `ENTRY_LAUNCHER_MISMATCH`; `entry: app-privilege` also admits accounts DSM Application Privileges allows for `SYNO.SDS.<package>.Instance` (native-go only, needs an `authenticated` route). DSM evaluates user/group/everyone rules, allow/deny precedence and IP ranges; one CGI check covers every route, failures refuse with `app_privilege_denied`, and decisions are cached at most 30 seconds. DSM's install default allows administrators only, so declaring or upgrading never opens the app to everyone. DSM keeps those rules after uninstall and applies them again to a later install under the same name: an App with the executor (rootOps or delegate) removes them automatically at uninstall (failures go to the system log entry `synopkgland-executor`); a no-privilege App never uses root, so an administrator removes them in Control Panel > Application Privileges. The delegate executor applies the same entry rule to every protected and producer move: once DSM no longer allows a user, new moves under that user's still-valid grant are refused (`APP_DENIED`, grant invalidated); files already saved stay. Guard global settings in shared routes with Go `api.RequireAdmin(caller)` (`admin_required`); the frontend `ctx.user?.isAdmin` only hides controls.
 
 I capability: init --with login or add login enables Go-native standalone identity and Vue login. Same-host DSM cookies can be reused across ports after backend verification. Missing cookies use an HTTPS DSM account/password/OTP fallback; passwords and DSM credentials are not persisted. Plain UI is unsupported. App sessions last at most 15 minutes; sensitive operations revalidate live DSM cookies and local UID. Password-only sessions permit only basic app.status/greeting.get reads. Missing revalidation returns session_revalidation_required; files return dsm_session_required. Sign in to DSM on the same hostname. Web Station portal/proxy acceptance remains pending.

package/skills/reference/portal.md

@@ -49,7 +49,7 @@ Scaffold 明確寫入此選擇，plain／binary 使用 `new-page`，Vue UI SDK
 預設的 `dsm-window`（省略 `ui.launch`）。原生 manifest 省略 `ui.launch` 時解析為 `dsm-window`，CLI 不猜測前端依賴。
 
 `new-page` 產生 DSM `type: "standalone"` launcher，主選單及套件中心皆在 DSM
-本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、SynoToken／session、
+本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、`ctx.uiUpdate`、SynoToken／session、
 `ctx.launchParams`／`onLaunch`、`entry` 權限沿用共用 wrapper；全頁的標題、
 favicon 與手機 viewport 由 wrapper 設定。不需要 `pureEnv` 或 `allowAltPort`。
 

package/skills/reference/ui-vue.md

@@ -173,7 +173,7 @@ Scaffold 明確寫入此選擇，plain／binary 使用 `new-page`，Vue UI SDK
 預設的 `dsm-window`（省略 `ui.launch`）。原生 manifest 省略 `ui.launch` 時解析為 `dsm-window`，CLI 不猜測前端依賴。
 
 `new-page` 產生 DSM `type: "standalone"` launcher，主選單及套件中心皆在 DSM
-本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、SynoToken／session、
+本身的 origin 開啟全頁。`ctx.fullPage`、`ctx.appIcon`、`ctx.uiUpdate`、SynoToken／session、
 `ctx.launchParams`／`onLaunch`、`entry` 權限沿用共用 wrapper；全頁的標題、
 favicon 與手機 viewport 由 wrapper 設定。不需要 `pureEnv` 或 `allowAltPort`。