@synopackageland/cli 0.33.2 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.35.0 (2026-10-29)
+
+- Audit the target Linux import graphs of configured Go binaries rather than
+  recursively scanning unshipped development commands.
+- Accept fixed, permission-declared `api.HandleHTTP` routes and package-private
+  `ipc.ServeUnix` handler graphs with SDK 0.33.0. Reject direct listeners and
+  unregistered handlers even when an IPC handler is reused.
+- Bind the raw HTTP prefix inventory and package IPC identity into each Go
+  binary. Repeat source validation after UI hooks. Retain executor 0.32.0 bytes
+  and templates 0.32.0.
+
+## 0.34.0 (2026-10-29)
+
+- Enforce explicit App entry and reject undeclared App methods, dynamic route
+  names and custom HTTP dispatchers during check and build. Every App method
+  must appear in `permissions.json`, including administrator-default methods.
+  Register HTTP work through fixed SDK route constructors.
+- Validate and bind `identity_gateway.upstream_auth_paths` for client API/share
+  paths that use upstream authentication. Other paths retain DSM entry admission;
+  SDK RPC methods retain their own permissions. Use SDK 0.32.0.
+- Load `app.module.js` ES modules and lazy chunks from a content-addressed
+  snapshot of the entire frontend output. Module entries take precedence over
+  classic `app.js`; both require `app.css`. `inspect` verifies the complete tree.
+  Reload an open page after an upgrade if an old lazy chunk is unavailable.
+- Use templates 0.32.0 with SDK/scaffold pins at 0.32.0.
+
 ## 0.33.2 (2026-10-28)
 
 - Load the installed app when a DSM window opens after a package upgrade without a page reload; the loader previously reused the app module the previous build left in the page

package/README.md

@@ -53,6 +53,10 @@ A backend in Python, Node or Rust uses `backend: {runtime: python|node|rust, ...
 the SDK's Go runtime, which checks the DSM session and `permissions.json` and starts the App
 from `target/app` as the package account for each request (see `skills/reference/create.md`).
 
+[App entry and registration](docs/app-entry.md) explains administrator-only and
+Application Privileges admission, explicit method policies, gateway conflicts and
+the build-bound SDK checks.
+
 ## SDK and templates
 
 The CLI packages, deploys and checks. The app-side code is the SDK
@@ -70,12 +74,19 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI-only releases can differ from the SDK patch. Compose import and SDK defaults
+CLI 0.35.0 uses templates ~0.32.0, whose default SDK pin remains 0.32.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
+Every App method must be declared in the permissions table. Dynamic names and
+custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
+`api.HandleHTTP` prefixes for authorized raw HTTP and `ipc.ServeUnix` for private
+package Unix sockets. The audit follows each shipped Linux binary's import graph;
+unimported development commands are excluded. Use
+`identity_gateway.upstream_auth_paths` for client API paths that use upstream
+authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.32.1 depends on `~0.31.0`: npm installation or
-update can select the latest templates patch in the 0.31 minor line. Templates
+`@synopackageland/templates`. CLI 0.35.0 depends on `~0.32.0`: npm installation or
+update can select the latest templates patch in the 0.32 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
@@ -94,6 +105,13 @@ templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
 `npm ci && npm run build` in `$SYNOPKGLAND_SDK_DIR/ts` first, and again after SDK changes.
 
+Frontend builds may emit `app.module.js` exporting `mount(root, ctx)`, plus
+`app.css` and relative ES module chunks. The CLI packages that output under a
+content-addressed UI directory, so entry, lazy chunks and CSS share one build
+URL. `inspect` verifies that tree against the build inventory. Classic `app.js`
+Apps keep their existing registration contract and paths. See the SDK's
+[frontend bundle guide](https://github.com/synopackageland/syno-pkg-land-sdk/blob/main/docs/frontend-bundles.md).
+
 To check the CLI's DSM terminology rules against templates without a new templates release:
 
 ```sh
@@ -260,11 +278,11 @@ Use matching backend/frontend SDK pins. The profile participates in the
 normal executor approval digest; a profile change needs administrator approval.
 Users grant the named profile separately. The permanent denylist, current-user
 permission checks, bounded JSON and uncertain-outcome rules are in the SDK's
-executor/README.md. Binary downloads require later SDK support.
+executor/README.md.
 
 ## Raw WebAPI profiles
 
-SDK 0.12.1 add opt-in raw responses. In `capabilities.webapi.<profile>`,
+WebAPI profiles support opt-in raw responses. In `capabilities.webapi.<profile>`,
 set `raw_max_bytes: 26214400` for a 25 MiB MIME limit and explicitly allow
 `SYNO.MailClient.Message.get_original` v10. Omitting the limit preserves JSON-only
 profiles. Changing it changes the approved policy and requires fresh user consent.
@@ -274,6 +292,11 @@ package's private executor-staging folder with size/SHA-256 and immediate cleanu
 Do not use Attachment.download or follow X-Accel-Redirect. See the SDK raw response
 contract for the complete transport and CGI validation rules.
 
+`webapi.call` request parameters are JSON-only; it has no request upload field.
+Use streaming `files.write` for uploads, up to 100 MiB per file. Reads and URL
+downloads retain their separate 64 MiB limit. Rebuild with SDK 0.32.0 and approve
+the refreshed executor payload.
+
 ## App launch mode
 
 Native Apps declare `ui.launch: dsm-window | new-page` in `dsm-package.yaml`.
@@ -284,7 +307,7 @@ framework from its build command. `new-page` registers DSM `type: "standalone"`,
 so the main menu and Package Center open a full page on the DSM origin.
 `ctx.fullPage`, `ctx.appIcon`, `ctx.uiUpdate`, session/SynoToken, launch parameters and entry
 permissions use the same wrapper in both modes. `ctx.uiUpdate.check()` reports when
-a package upgrade replaced the UI the page loaded; SDK 0.31.5+ AppShell then shows
+a package upgrade replaced the UI the page loaded; AppShell then shows
 a one-line reload notice. The wrapper sets the standalone
 page title, favicon and device-width viewport. It retains ExtJS; `pureEnv` is
 not appropriate, and alternate Portal ports are not needed (`allowAltPort` is omitted).

package/assets/go/route-audit/main.go

@@ -0,0 +1,526 @@
+// Command route-audit inspects registrations without running application code.
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+type input struct {
+	Dir         string
+	Roots       []string
+	Arches      []string
+	Permissions map[string]string
+	SDK         map[string]map[string]string
+}
+
+type result struct {
+	Problems   []string    `json:"problems"`
+	EntryGate  bool        `json:"entryGate"`
+	HTTPRoutes []httpRoute `json:"httpRoutes"`
+}
+
+type httpRoute struct {
+	Prefix string `json:"prefix"`
+	Method string `json:"method"`
+}
+
+const sdkModule = "github.com/synopackageland/syno-pkg-land-sdk"
+
+// Resolve target build constraints without running any application code.
+func shippedFiles(in input) (map[string]string, error) {
+	files := map[string]string{}
+	if _, err := os.Stat(filepath.Join(in.Dir, "go.mod")); os.IsNotExist(err) {
+		matches, err := filepath.Glob(filepath.Join(in.Dir, "*.go"))
+		for _, path := range matches {
+			if !strings.HasSuffix(path, "_test.go") {
+				files[path] = "fixture"
+			}
+		}
+		return files, err
+	}
+	roots, arches := in.Roots, in.Arches
+	if len(roots) == 0 {
+		roots = []string{"."}
+	}
+	if len(arches) == 0 {
+		arches = []string{"amd64", "arm64", "arm"}
+	}
+	for _, arch := range arches {
+		cmd := exec.Command("go", append([]string{"list", "-e", "-mod=readonly", "-deps", "-json"}, roots...)...)
+		cmd.Dir = in.Dir
+		cmd.Env = append(os.Environ(), "GOOS=linux", "GOARCH="+arch, "GOARM=7", "CGO_ENABLED=0", "GOWORK=off", "GOFLAGS=")
+		raw, err := cmd.Output()
+		if err != nil {
+			return nil, fmt.Errorf("cannot resolve shipped Go import graph")
+		}
+		d := json.NewDecoder(bytes.NewReader(raw))
+		for {
+			var p struct {
+				Dir, ImportPath string
+				GoFiles         []string
+				Standard        bool
+				DepOnly         bool
+				Error           *struct{ Err string }
+				Module          *struct {
+					Main    bool
+					Replace *struct{ Dir string }
+				}
+			}
+			err := d.Decode(&p)
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				return nil, err
+			}
+			if !p.DepOnly && p.Error != nil {
+				return nil, fmt.Errorf("cannot resolve a configured shipped Go root")
+			}
+			if p.Standard || p.ImportPath == sdkModule || strings.HasPrefix(p.ImportPath, sdkModule+"/") {
+				continue
+			}
+			if p.Module == nil || !p.Module.Main && p.Module.Replace == nil {
+				continue
+			}
+			for _, name := range p.GoFiles {
+				files[filepath.Join(p.Dir, name)] = p.ImportPath
+			}
+		}
+	}
+	if len(files) == 0 {
+		return nil, fmt.Errorf("shipped Go roots contain no auditable source")
+	}
+	return files, nil
+}
+
+func stringLiteral(expr ast.Expr) string {
+	if v, ok := expr.(*ast.BasicLit); ok && v.Kind == token.STRING {
+		s, _ := strconv.Unquote(v.Value)
+		return s
+	}
+	return ""
+}
+
+type source struct {
+	file      *ast.File
+	path, pkg string
+	imports   map[string]string
+}
+
+// Follow the handler argument through local declarations and factories. A
+// boundary never exempts an entire directory, file, or any listener primitive.
+func boundaryHandlers(sources []source) map[ast.Node]bool {
+	decls := map[string][]ast.Node{}
+	owners := map[ast.Node]source{}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			if n != nil {
+				owners[n] = s
+			}
+			return true
+		})
+		for _, decl := range s.file.Decls {
+			switch d := decl.(type) {
+			case *ast.FuncDecl:
+				key := s.pkg + "." + d.Name.Name
+				if d.Recv != nil {
+					t := d.Recv.List[0].Type
+					if v, ok := t.(*ast.StarExpr); ok {
+						t = v.X
+					}
+					if v, ok := t.(*ast.Ident); ok {
+						key = s.pkg + "." + v.Name
+					}
+				}
+				decls[key] = append(decls[key], d)
+			case *ast.GenDecl:
+				for _, spec := range d.Specs {
+					switch v := spec.(type) {
+					case *ast.TypeSpec:
+						decls[s.pkg+"."+v.Name.Name] = append(decls[s.pkg+"."+v.Name.Name], v)
+					case *ast.ValueSpec:
+						for _, name := range v.Names {
+							decls[s.pkg+"."+name.Name] = append(decls[s.pkg+"."+name.Name], v)
+						}
+					}
+				}
+			}
+		}
+	}
+	safe, visited := map[ast.Node]bool{}, map[ast.Node]bool{}
+	var mark func(ast.Node)
+	mark = func(root ast.Node) {
+		if root == nil || visited[root] {
+			return
+		}
+		visited[root] = true
+		s := owners[root]
+		ast.Inspect(root, func(n ast.Node) bool {
+			if n == nil {
+				return false
+			}
+			safe[n] = true
+			key := ""
+			switch v := n.(type) {
+			case *ast.Ident:
+				key = s.pkg + "." + v.Name
+				if v.Obj != nil {
+					if d, ok := v.Obj.Decl.(ast.Node); ok {
+						mark(d)
+					}
+				}
+			case *ast.SelectorExpr:
+				if id, ok := v.X.(*ast.Ident); ok {
+					key = s.imports[id.Name] + "." + v.Sel.Name
+				}
+			}
+			for _, decl := range decls[key] {
+				mark(decl)
+			}
+			return true
+		})
+	}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok || len(call.Args) != 3 {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			id, ok := sel.X.(*ast.Ident)
+			if ok && (s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleHTTP" ||
+				s.imports[id.Name] == sdkModule+"/ipc" && sel.Sel.Name == "ServeUnix") {
+				mark(call.Args[2])
+			}
+			return true
+		})
+	}
+	return safe
+}
+
+// A handler admitted to a private/raw boundary cannot also be installed as
+// the CGI root. SDK server construction ends this search because it gates
+// its registered routes before invoking their handlers.
+func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.Node]bool, seen map[ast.Node]bool) bool {
+	if expr == nil || seen[expr] {
+		return false
+	}
+	seen[expr] = true
+	imports := owner.imports
+	if call, ok := expr.(*ast.CallExpr); ok {
+		if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+			if id, ok := sel.X.(*ast.Ident); ok && imports[id.Name] == sdkModule+"/api" {
+				switch sel.Sel.Name {
+				case "NewServerWithPermissions":
+					return false
+				case "WithRequestDeadline", "WithDescription":
+					return len(call.Args) > 0 && reusesBoundary(call.Args[0], owner, sources, safe, seen)
+				}
+			}
+		}
+	}
+	found := false
+	ast.Inspect(expr, func(n ast.Node) bool {
+		if n == nil || found {
+			return false
+		}
+		if n != expr {
+			if _, ok := n.(*ast.CallExpr); ok {
+				found = reusesBoundary(n, owner, sources, safe, seen)
+				return false
+			}
+		}
+		targetPackage, targetName := "", ""
+		if id, ok := n.(*ast.Ident); ok {
+			if id.Obj != nil {
+				if decl, ok := id.Obj.Decl.(ast.Node); ok {
+					found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+				}
+			} else {
+				targetPackage, targetName = owner.pkg, id.Name
+			}
+		}
+		if selector, ok := n.(*ast.SelectorExpr); ok {
+			if pkg, ok := selector.X.(*ast.Ident); ok {
+				targetPackage, targetName = imports[pkg.Name], selector.Sel.Name
+			}
+		}
+		if targetPackage != "" {
+			for _, candidate := range sources {
+				if candidate.pkg != targetPackage {
+					continue
+				}
+				for _, decl := range candidate.file.Decls {
+					var target ast.Node
+					switch d := decl.(type) {
+					case *ast.FuncDecl:
+						if d.Recv == nil && d.Name.Name == targetName {
+							target = d
+						}
+					case *ast.GenDecl:
+						for _, spec := range d.Specs {
+							switch v := spec.(type) {
+							case *ast.TypeSpec:
+								if v.Name.Name == targetName {
+									target = v
+								}
+							case *ast.ValueSpec:
+								for _, name := range v.Names {
+									if name.Name == targetName {
+										target = v
+									}
+								}
+							}
+						}
+					}
+					if target != nil && (safe[target] || reusesBoundary(target, candidate, sources, safe, seen)) {
+						found = true
+					}
+				}
+			}
+		}
+		return !found
+	})
+	return found
+}
+
+func main() {
+	var in input
+	if err := json.NewDecoder(os.Stdin).Decode(&in); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	out := result{Problems: []string{}, HTTPRoutes: []httpRoute{}}
+	sdk := map[string]bool{}
+	for _, group := range in.SDK {
+		for method := range group {
+			sdk[method] = true
+		}
+	}
+	set := token.NewFileSet()
+	files, err := shippedFiles(in)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	var sources []source
+	for path, pkg := range files {
+		file, err := parser.ParseFile(set, path, nil, 0)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "invalid shipped Go source")
+			os.Exit(1)
+		}
+		imports := map[string]string{}
+		for _, spec := range file.Imports {
+			module, _ := strconv.Unquote(spec.Path.Value)
+			alias := filepath.Base(module)
+			if spec.Name != nil {
+				alias = spec.Name.Name
+			}
+			imports[alias] = module
+		}
+		sources = append(sources, source{file, path, pkg, imports})
+	}
+	safe := boundaryHandlers(sources)
+	for _, src := range sources {
+		path, file, imports := src.path, src.file, src.imports
+		shown, _ := filepath.Rel(in.Dir, path)
+		problem := func(pos token.Pos, message string) {
+			out.Problems = append(out.Problems, fmt.Sprintf("%s:%d: %s", filepath.ToSlash(shown), set.Position(pos).Line, message))
+		}
+		d, err := os.Lstat(path)
+		if err != nil || d.Mode()&os.ModeSymlink != 0 {
+			problem(token.NoPos, "Go source symlinks cannot be audited")
+			continue
+		}
+		for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+			info, err := os.Lstat(dir)
+			if err == nil && info.Mode()&os.ModeSymlink != 0 {
+				problem(token.NoPos, "Go source directories cannot be symlinks")
+				break
+			}
+			if dir == in.Dir {
+				break
+			}
+		}
+		for _, spec := range file.Imports {
+			if spec.Name != nil && spec.Name.Name == "." {
+				problem(spec.Pos(), "dot imports cannot be audited")
+			}
+		}
+		constants := map[string]string{}
+		direct := map[*ast.SelectorExpr]bool{}
+		ast.Inspect(file, func(n ast.Node) bool {
+			if call, ok := n.(*ast.CallExpr); ok {
+				if selector, ok := call.Fun.(*ast.SelectorExpr); ok {
+					direct[selector] = true
+				}
+			}
+			return true
+		})
+		for _, decl := range file.Decls {
+			if g, ok := decl.(*ast.GenDecl); ok && g.Tok == token.CONST {
+				for _, spec := range g.Specs {
+					v := spec.(*ast.ValueSpec)
+					for i, name := range v.Names {
+						if i < len(v.Values) {
+							if lit, ok := v.Values[i].(*ast.BasicLit); ok && lit.Kind == token.STRING {
+								constants[name.Name], _ = strconv.Unquote(lit.Value)
+							}
+						}
+					}
+				}
+			}
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" && !safe[n] {
+				problem(fn.Pos(), "unregistered ServeHTTP; use api.HandleHTTP or ipc.ServeUnix")
+			}
+			selector, ok := n.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			if selector.Sel.Name == "ServeHTTP" && !safe[n] {
+				problem(selector.Pos(), "unregistered ServeHTTP dispatch")
+			}
+			pkg, ok := selector.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			module := imports[pkg.Name]
+			name := selector.Sel.Name
+			if module == "net" && (strings.HasPrefix(name, "Listen") || name == "FileListener" || name == "FilePacketConn") ||
+				module == "crypto/tls" && name == "Listen" ||
+				(module == "syscall" || module == "golang.org/x/sys/unix") && (name == "Bind" || name == "Listen" || name == "Socket") {
+				problem(selector.Pos(), "custom listener outside SDK boundaries: "+name)
+			}
+			if module == sdkModule+"/ipc" && name == "ServeUnix" && !direct[selector] {
+				problem(selector.Pos(), "IPC constructor aliases cannot be audited")
+			}
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/idgateway" && (name == "NewFront" || name == "Build" || name == "Run") {
+				problem(selector.Pos(), "gateway listeners must use identity_gateway in the manifest; upstream_auth_paths never exempts SDK RPC or custom HTTP handlers")
+			}
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/api" {
+				switch name {
+				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
+					if !direct[selector] {
+						problem(selector.Pos(), "route constructor aliases cannot be audited; register methods directly")
+					}
+				}
+			}
+			if module == "net/http" {
+				switch name {
+				case "Handle", "HandleFunc", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
+					problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+				case "HandlerFunc", "NewServeMux", "ServeMux", "FileServer", "FileServerFS", "StripPrefix", "TimeoutHandler", "NotFoundHandler", "RedirectHandler":
+					if !safe[n] {
+						problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+					}
+				}
+			}
+			if module == "net/http/httputil" && (name == "ReverseProxy" || name == "NewSingleHostReverseProxy") && !safe[n] {
+				problem(selector.Pos(), "HTTP proxy outside the SDK registry")
+			}
+			if module == "net/http/cgi" && name == "Serve" {
+				if !direct[selector] {
+					problem(selector.Pos(), "CGI constructor aliases cannot be audited")
+				}
+			}
+			return true
+		})
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			selector, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			pkg, ok := selector.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			module := imports[pkg.Name]
+			if module == "net/http/cgi" && selector.Sel.Name == "Serve" && len(call.Args) > 0 && reusesBoundary(call.Args[0], src, sources, safe, map[ast.Node]bool{}) {
+				problem(call.Pos(), "private or raw HTTP handler reused outside its SDK boundary")
+			}
+			if module == "github.com/synopackageland/syno-pkg-land-sdk/dsm" && selector.Sel.Name == "NewEntryGate" {
+				out.EntryGate = true
+			}
+			if module != "github.com/synopackageland/syno-pkg-land-sdk/api" {
+				return true
+			}
+			switch selector.Sel.Name {
+			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
+			default:
+				return true
+			}
+			method := ""
+			index := 0
+			if selector.Sel.Name == "HandleHTTP" {
+				index = 1
+			}
+			if len(call.Args) > index {
+				switch arg := call.Args[index].(type) {
+				case *ast.BasicLit:
+					if arg.Kind == token.STRING {
+						method, _ = strconv.Unquote(arg.Value)
+					}
+				case *ast.Ident:
+					method = constants[arg.Name]
+				}
+			}
+			if method == "" {
+				problem(call.Pos(), "dynamic route name cannot be audited; register literal method names")
+			} else if _, declared := in.Permissions[method]; !declared && !sdk[method] {
+				problem(call.Pos(), "registered method missing from permissions.json: "+method)
+			}
+			if selector.Sel.Name == "HandleHTTP" {
+				prefix := ""
+				if len(call.Args) > 0 {
+					prefix = stringLiteral(call.Args[0])
+				}
+				if !regexp.MustCompile(`^/([A-Za-z0-9_-]+/)+$`).MatchString(prefix) {
+					problem(call.Pos(), "HTTP prefix must be a fixed literal full-segment path ending in /")
+				}
+				for _, reserved := range []string{"/_sso/", "/_spl/", "/api/", "/api.cgi/", "/rpc/", "/webman/", "/cgi/"} {
+					if strings.HasPrefix(prefix, reserved) || strings.HasPrefix(reserved, prefix) {
+						problem(call.Pos(), "HTTP prefix overlaps a reserved path")
+					}
+				}
+				if sdk[method] || in.Permissions[method] != "authenticated" && in.Permissions[method] != "administrators" {
+					problem(call.Pos(), "HTTP routes require an explicit App authenticated or administrators permission")
+				}
+				for _, other := range out.HTTPRoutes {
+					if strings.HasPrefix(prefix, other.Prefix) || strings.HasPrefix(other.Prefix, prefix) {
+						problem(call.Pos(), "HTTP prefixes must not overlap")
+					}
+				}
+				out.HTTPRoutes = append(out.HTTPRoutes, httpRoute{prefix, method})
+			}
+			return true
+		})
+	}
+	sort.Strings(out.Problems)
+	sort.Slice(out.HTTPRoutes, func(i, j int) bool { return out.HTTPRoutes[i].Prefix < out.HTTPRoutes[j].Prefix })
+	if err := json.NewEncoder(os.Stdout).Encode(out); err != nil {
+		os.Exit(1)
+	}
+}

package/dist/error-registry.js

@@ -550,8 +550,8 @@ export const ERROR_REGISTRY = {
         },
         STANDALONE_UI_ENTRY_MISSING: {
             code: "STANDALONE_UI_ENTRY_MISSING",
-            description: "The UI directory is missing app.js or app.css.",
-            suggestion: "Make ui.dir (or the UI build output) contain app.js and app.css.",
+            description: "The UI directory is missing its JavaScript entry or app.css.",
+            suggestion: "Make ui.dir contain app.js (classic) or app.module.js (ES module), plus app.css.",
         },
         STANDALONE_UI_SYMLINK: {
             code: "STANDALONE_UI_SYMLINK",
@@ -828,6 +828,11 @@ export const ERROR_REGISTRY = {
             description: "The display name is invalid.",
             suggestion: "Use single-line text without quotes or backslashes.",
         },
+        STANDALONE_API_REGISTRY_INVALID: {
+            code: "STANDALONE_API_REGISTRY_INVALID",
+            description: "An App handler is outside the central permissions registry.",
+            suggestion: "Declare every App method in permissions.json and use SDK route constructors; remove custom HTTP dispatch.",
+        },
         STANDALONE_API_PERMISSIONS_CHANGED: {
             code: "STANDALONE_API_PERMISSIONS_CHANGED",
             description: "The API policy changed during the build.",

package/dist/init.js

@@ -240,10 +240,14 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     for (const file of capability.removed)
         rmSync(join(targetDir, file));
-    if (Object.keys(capability.permissions).length &&
-        isNativeTemplate(template)) {
+    if (isNativeTemplate(template)) {
         const path = join(targetDir, PERMISSIONS_FILE[template]);
         const policy = JSON.parse(readFileSync(path, "utf8"));
+        // Older template releases relied on the administrator default. Materialize
+        // their three example routes so the generated registry is explicit.
+        for (const method of ["app.status", "greeting.get", "greeting.set"]) {
+            policy.methods[method] ??= "administrators";
+        }
         Object.assign(policy.methods, capability.permissions);
         writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
     }