@synopackageland/cli 0.35.0 → 0.37.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.37.0 (2026-10-29)
+
+- Native Apps appear in Hyper Backup as applications by default. Build writes
+  `scripts/backup/{version,info,export,import}` from a fixed template and ships
+  the SDK backup control as `backup/control` with `backup/config.json`.
+  Hyper Backup runs the scripts as root; they only switch to the owner of the
+  App's data folder (refusing root), run the control as that package account
+  and move one archive they never read. Offline backup is the default
+  (Hyper Backup stops and restarts the App); `backup.online`,
+  `backup.data_version` and `backup.hook` are optional, and
+  `backup: {hyper_backup: false}` opts out. Compose Apps are not covered.
+  `check --json` reports `hyperBackup`; `inspect` verifies the exact script
+  bytes, modes, control and config, and refuses any other file in
+  `scripts/backup/`, such as `can_export` or `info.dynamic`, which Hyper
+  Backup would run as root while only listing applications. An SDK without
+  the control skips the default with `SDK_APP_BACKUP_UNSUPPORTED`; without Go
+  (prebuilt backends) it is skipped with `SDK_APP_BACKUP_BUILD_FAILED`; an
+  explicit `backup` fails in both cases. New
+  errors: `BACKUP_INVALID`, `BACKUP_COMPOSE_UNSUPPORTED`,
+  `BACKUP_HOOK_MISSING`, `SDK_APP_BACKUP_UNSUPPORTED`,
+  `SDK_APP_BACKUP_BUILD_FAILED`. New skill reference `backup`.
+- Rebuilt native Apps gain a fixed `scripts/backup/` shim that Hyper Backup
+  runs as root. The App itself still runs as the package user, and its
+  privilege tier is unchanged. Opt out with `backup: { hyper_backup: false }`.
+- Pin SDK/App 0.35.0.
+
+## 0.36.0 (2026-10-29)
+
+- Stop treating `net.Listener` and `net.ListenConfig` types as listeners.
+  Actual constructors, aliases and declared listener/server methods remain
+  rejected. Accept SDK child-port reservation/probe, named private HTTP servers
+  and peer-credential executor transport as explicit boundaries.
+- Add `audit-entry` for every custom-hook Go payload's own target import graph.
+  It never executes the App. Keep all files of imported shared packages in scope.
+- Bind ordinary CGI/workers to IPC tier `none`; only separately approved root
+  helper builds may use executor-tier peer serving. Update the App skill for
+  SDK/App 0.34.0, named data planes, child ports and helper boundaries.
+
+- Audit `(*api.Server).InvokeAsAdministrator` calls: each must name a literal
+  method declared `administrators` in permissions.json. Package commands outside
+  CGI use it instead of calling `ServeHTTP` on a server in process, which the
+  audit still rejects. Requires the SDK release with `InvokeAsAdministrator`.
+- Accept the `integration` permission for Go `api.HandleIntegration` service
+  callbacks. `dsm-package.yaml` `integrations` must list exactly those methods.
+  The route audit requires the constructor and permission together, admits only
+  the callback's handler graph, and binds each `?method=` selector into the
+  HTTP route inventory. The install and upgrade wizards list the callbacks for
+  administrator approval; `inspect` verifies them. Requires the SDK release
+  with `api.HandleIntegration`.
+- Stop the route audit from following a handler's receiver or parameter to
+  its type. A method value such as `cfg.serve` used to admit every method of
+  that type, which could hide an unregistered `ServeHTTP` dispatch elsewhere
+  on it.
+
 ## 0.35.0 (2026-10-29)
 
 - Audit the target Linux import graphs of configured Go binaries rather than

package/README.md

@@ -74,7 +74,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.35.0 uses templates ~0.32.0, whose default SDK pin remains 0.32.0. Compose import and SDK defaults
+CLI 0.37.0 uses templates ~0.33.0, whose default SDK pin is 0.35.0. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -85,8 +85,8 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.35.0 depends on `~0.32.0`: npm installation or
-update can select the latest templates patch in the 0.32 minor line. Templates
+`@synopackageland/templates`. CLI 0.37.0 depends on `~0.33.0`: npm installation or
+update can select the latest templates patch in the 0.33 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
@@ -173,6 +173,18 @@ template changes and executor-only handover eligibility. Without a comparable
 baseline, approval retention is unknown. Eligibility still requires live protected
 runtime and exact DSM task readback. See [the approval guide](skills/reference/approval-upgrades.md).
 
+## Hyper Backup
+
+Native Apps appear in Hyper Backup's backup wizard as applications. By default Hyper Backup stops
+the App, the SDK archives its data folder (the package's `var`) and Hyper Backup starts it again;
+a restore replaces that folder. `backup: {online: true}` keeps the App running and snapshots
+SQLite databases; `data_version` guards restores of newer data; `hook` runs a packaged
+`freeze`/`thaw` executable; `backup: {hyper_backup: false}` opts out. Compose Apps are not
+covered. The build compiles the SDK backup control with Go, also for a prebuilt backend; without
+Go it skips the default backup with a warning. Hyper Backup runs the generated `scripts/backup/` as root: a fixed script that only
+switches to the package account and moves one archive it never reads. This DSM-owned hook does
+not change how the App runs or its privilege tier. See `synopkgland skill show backup`.
+
 ## Commands
 
 | Command | Purpose |

package/assets/go/route-audit/main.go

@@ -178,6 +178,12 @@ func boundaryHandlers(sources []source) map[ast.Node]bool {
 			case *ast.Ident:
 				key = s.pkg + "." + v.Name
 				if v.Obj != nil {
+					// A parameter or receiver carries a value built elsewhere.
+					// Following its type would admit every method of that type,
+					// such as an App Config whose method value is the handler.
+					if _, param := v.Obj.Decl.(*ast.Field); param {
+						return true
+					}
 					if d, ok := v.Obj.Decl.(ast.Node); ok {
 						mark(d)
 					}
@@ -196,6 +202,13 @@ func boundaryHandlers(sources []source) map[ast.Node]bool {
 	for _, s := range sources {
 		ast.Inspect(s.file, func(n ast.Node) bool {
 			call, ok := n.(*ast.CallExpr)
+			if ok && len(call.Args) == 2 {
+				if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+					if id, ok := sel.X.(*ast.Ident); ok && s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleIntegration" {
+						mark(call.Args[1])
+					}
+				}
+			}
 			if !ok || len(call.Args) != 3 {
 				return true
 			}
@@ -205,7 +218,7 @@ func boundaryHandlers(sources []source) map[ast.Node]bool {
 			}
 			id, ok := sel.X.(*ast.Ident)
 			if ok && (s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleHTTP" ||
-				s.imports[id.Name] == sdkModule+"/ipc" && sel.Sel.Name == "ServeUnix") {
+				s.imports[id.Name] == sdkModule+"/ipc" && (sel.Sel.Name == "ServeUnix" || sel.Sel.Name == "StartUnix")) {
 				mark(call.Args[2])
 			}
 			return true
@@ -300,6 +313,127 @@ func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.
 	return found
 }
 
+// Resolve declared receiver types without executing the App or requiring a
+// successful type check (the audit also runs while projects are being edited).
+func receiverType(expr ast.Node, src source, sources []source, seen map[ast.Node]bool) string {
+	if expr == nil || seen[expr] {
+		return ""
+	}
+	seen[expr] = true
+	follow := func(n ast.Node) string { return receiverType(n, src, sources, seen) }
+	find := func(pkg, name string) (ast.Node, source) {
+		for _, s := range sources {
+			if s.pkg != pkg {
+				continue
+			}
+			for _, decl := range s.file.Decls {
+				if fn, ok := decl.(*ast.FuncDecl); ok && fn.Recv == nil && fn.Name.Name == name {
+					return fn, s
+				}
+				if gen, ok := decl.(*ast.GenDecl); ok {
+					for _, spec := range gen.Specs {
+						if typ, ok := spec.(*ast.TypeSpec); ok && typ.Name.Name == name {
+							return typ, s
+						}
+						if value, ok := spec.(*ast.ValueSpec); ok {
+							for _, id := range value.Names {
+								if id.Name == name {
+									return id, s
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+		return nil, src
+	}
+	switch v := expr.(type) {
+	case *ast.ParenExpr:
+		return follow(v.X)
+	case *ast.StarExpr:
+		return follow(v.X)
+	case *ast.UnaryExpr:
+		return follow(v.X)
+	case *ast.CompositeLit:
+		return follow(v.Type)
+	case *ast.SelectorExpr:
+		if id, ok := v.X.(*ast.Ident); ok && src.imports[id.Name] != "" {
+			return src.imports[id.Name] + "." + v.Sel.Name
+		}
+		typ := follow(v.X)
+		if dot := strings.LastIndex(typ, "."); dot > 0 {
+			decl, owner := find(typ[:dot], typ[dot+1:])
+			if d, ok := decl.(*ast.TypeSpec); ok {
+				if st, ok := d.Type.(*ast.StructType); ok {
+					for _, field := range st.Fields.List {
+						for _, name := range field.Names {
+							if name.Name == v.Sel.Name {
+								return receiverType(field.Type, owner, sources, seen)
+							}
+						}
+					}
+				}
+			}
+		}
+	case *ast.Ident:
+		if v.Obj != nil {
+			switch d := v.Obj.Decl.(type) {
+			case *ast.Field:
+				return follow(d.Type)
+			case *ast.ValueSpec:
+				if d.Type != nil {
+					return follow(d.Type)
+				}
+				for i, name := range d.Names {
+					if name.Name == v.Name && i < len(d.Values) {
+						return follow(d.Values[i])
+					}
+				}
+			case *ast.AssignStmt:
+				for i, lhs := range d.Lhs {
+					if id, ok := lhs.(*ast.Ident); ok && id.Name == v.Name && i < len(d.Rhs) {
+						return follow(d.Rhs[i])
+					}
+				}
+			case *ast.TypeSpec:
+				if _, ok := d.Type.(*ast.StructType); ok {
+					return src.pkg + "." + d.Name.Name
+				}
+				return follow(d.Type)
+			}
+		} else {
+			decl, owner := find(src.pkg, v.Name)
+			return receiverType(decl, owner, sources, seen)
+		}
+	case *ast.TypeSpec:
+		if _, ok := v.Type.(*ast.StructType); ok {
+			return src.pkg + "." + v.Name.Name
+		}
+		return follow(v.Type)
+	case *ast.FuncDecl:
+		if v.Type.Results != nil && len(v.Type.Results.List) > 0 {
+			return follow(v.Type.Results.List[0].Type)
+		}
+	case *ast.CallExpr:
+		if id, ok := v.Fun.(*ast.Ident); ok && id.Name == "new" && len(v.Args) == 1 {
+			return follow(v.Args[0])
+		}
+		pkg, name := src.pkg, ""
+		switch fun := v.Fun.(type) {
+		case *ast.Ident:
+			name = fun.Name
+		case *ast.SelectorExpr:
+			if id, ok := fun.X.(*ast.Ident); ok {
+				pkg, name = src.imports[id.Name], fun.Sel.Name
+			}
+		}
+		decl, owner := find(pkg, name)
+		return receiverType(decl, owner, sources, seen)
+	}
+	return ""
+}
+
 func main() {
 	var in input
 	if err := json.NewDecoder(os.Stdin).Decode(&in); err != nil {
@@ -390,7 +524,7 @@ func main() {
 		}
 		ast.Inspect(file, func(n ast.Node) bool {
 			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" && !safe[n] {
-				problem(fn.Pos(), "unregistered ServeHTTP; use api.HandleHTTP or ipc.ServeUnix")
+				problem(fn.Pos(), "unregistered ServeHTTP; use api.HandleHTTP, api.HandleIntegration or ipc.ServeUnix")
 			}
 			selector, ok := n.(*ast.SelectorExpr)
 			if !ok {
@@ -399,26 +533,37 @@ func main() {
 			if selector.Sel.Name == "ServeHTTP" && !safe[n] {
 				problem(selector.Pos(), "unregistered ServeHTTP dispatch")
 			}
+			receiver := receiverType(selector.X, src, sources, map[ast.Node]bool{})
+			if receiver == "net.ListenConfig" && (selector.Sel.Name == "Listen" || selector.Sel.Name == "ListenPacket") ||
+				receiver == "net/http.Server" && (selector.Sel.Name == "Serve" || selector.Sel.Name == "ServeTLS" ||
+					selector.Sel.Name == "ListenAndServe" || selector.Sel.Name == "ListenAndServeTLS") {
+				problem(selector.Pos(), "custom listener outside SDK boundaries: "+selector.Sel.Name)
+			}
 			pkg, ok := selector.X.(*ast.Ident)
 			if !ok {
 				return true
 			}
 			module := imports[pkg.Name]
 			name := selector.Sel.Name
-			if module == "net" && (strings.HasPrefix(name, "Listen") || name == "FileListener" || name == "FilePacketConn") ||
+			if module == "net" && (name == "Listen" || name == "ListenTCP" || name == "ListenUnix" ||
+				name == "ListenPacket" || name == "ListenUDP" || name == "ListenIP" || name == "ListenUnixgram" ||
+				name == "FileListener" || name == "FilePacketConn") ||
 				module == "crypto/tls" && name == "Listen" ||
 				(module == "syscall" || module == "golang.org/x/sys/unix") && (name == "Bind" || name == "Listen" || name == "Socket") {
 				problem(selector.Pos(), "custom listener outside SDK boundaries: "+name)
 			}
-			if module == sdkModule+"/ipc" && name == "ServeUnix" && !direct[selector] {
-				problem(selector.Pos(), "IPC constructor aliases cannot be audited")
+			if module == sdkModule+"/ipc" && !direct[selector] {
+				switch name {
+				case "ServeUnix", "StartUnix", "ServePeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
+					problem(selector.Pos(), "IPC constructor aliases cannot be audited")
+				}
 			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/idgateway" && (name == "NewFront" || name == "Build" || name == "Run") {
 				problem(selector.Pos(), "gateway listeners must use identity_gateway in the manifest; upstream_auth_paths never exempts SDK RPC or custom HTTP handlers")
 			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/api" {
 				switch name {
-				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
+				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP", "HandleIntegration":
 					if !direct[selector] {
 						problem(selector.Pos(), "route constructor aliases cannot be audited; register methods directly")
 					}
@@ -426,7 +571,7 @@ func main() {
 			}
 			if module == "net/http" {
 				switch name {
-				case "Handle", "HandleFunc", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
+				case "Handle", "HandleFunc", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
 					problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
 				case "HandlerFunc", "NewServeMux", "ServeMux", "FileServer", "FileServerFS", "StripPrefix", "TimeoutHandler", "NotFoundHandler", "RedirectHandler":
 					if !safe[n] {
@@ -453,6 +598,26 @@ func main() {
 			if !ok {
 				return true
 			}
+			// An in-process administrator call names one fixed route that
+			// already requires DSM administrators; the SDK verifies the account.
+			if selector.Sel.Name == "InvokeAsAdministrator" {
+				method := ""
+				if len(call.Args) == 4 {
+					switch arg := call.Args[2].(type) {
+					case *ast.BasicLit:
+						if arg.Kind == token.STRING {
+							method, _ = strconv.Unquote(arg.Value)
+						}
+					case *ast.Ident:
+						method = constants[arg.Name]
+					}
+				}
+				if method == "" {
+					problem(call.Pos(), "dynamic InvokeAsAdministrator method cannot be audited; name a literal method")
+				} else if in.Permissions[method] != "administrators" {
+					problem(call.Pos(), "InvokeAsAdministrator requires a method declared administrators in permissions.json: "+method)
+				}
+			}
 			pkg, ok := selector.X.(*ast.Ident)
 			if !ok {
 				return true
@@ -468,7 +633,7 @@ func main() {
 				return true
 			}
 			switch selector.Sel.Name {
-			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP":
+			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP", "HandleIntegration":
 			default:
 				return true
 			}
@@ -492,6 +657,14 @@ func main() {
 			} else if _, declared := in.Permissions[method]; !declared && !sdk[method] {
 				problem(call.Pos(), "registered method missing from permissions.json: "+method)
 			}
+			// Only HandleIntegration skips the DSM session; the permission
+			// value and the constructor must agree in both directions.
+			if (selector.Sel.Name == "HandleIntegration") != (in.Permissions[method] == "integration") {
+				problem(call.Pos(), "the integration permission requires api.HandleIntegration, and api.HandleIntegration requires the integration permission")
+			}
+			if selector.Sel.Name == "HandleIntegration" && method != "" {
+				out.HTTPRoutes = append(out.HTTPRoutes, httpRoute{"?method=" + method, method})
+			}
 			if selector.Sel.Name == "HandleHTTP" {
 				prefix := ""
 				if len(call.Args) > 0 {

package/dist/build-spk/install-wizard.d.ts

@@ -16,5 +16,7 @@ export interface InstallWizardFiles {
  * items, and only the dynamic one adds the reuse notice when data exists.
  */
 export declare function renderInstallWizardFiles(packageName: string, render: (t: Translate) => InstallWizardStep[]): InstallWizardFiles;
+/** Lists the App's unauthenticated service callbacks for the administrator. */
+export declare function integrationWizardSteps(t: Translate, methods?: readonly string[]): InstallWizardStep[];
 /** The native-go install step: no parameters, only the app-space consent. */
 export declare function renderNativeInstallWizard(t: Translate): InstallWizardStep[];

package/dist/build-spk/install-wizard.js

@@ -70,6 +70,10 @@ export function renderInstallWizardFiles(packageName, render) {
     }
     return { static: staticFiles, dynamic };
 }
+/** Lists the App's unauthenticated service callbacks for the administrator. */
+export function integrationWizardSteps(t, methods = []) {
+    return methods.length ? [{ step_title: t("integration.step"), items: [{ desc: t("integration.notice", { methods: methods.join(", ") }) }] }] : [];
+}
 /** The native-go install step: no parameters, only the app-space consent. */
 export function renderNativeInstallWizard(t) {
     return [{ step_title: t("install.step"), items: [{ desc: t("consent.appOwnSpace") }] }];

package/dist/build-spk/wizard-messages.d.ts

@@ -230,6 +230,28 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "integration.step": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "integration.notice": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "install.reuseData": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -230,6 +230,28 @@ export const WIZARD_MESSAGES = {
         es: "Configuración de instalación",
         it: "Impostazioni di installazione",
     },
+    "integration.step": {
+        en: "Service callbacks",
+        "zh-TW": "服務回呼入口",
+        "zh-CN": "服务回调入口",
+        ja: "サービスコールバック",
+        ko: "서비스 콜백",
+        de: "Dienst-Callbacks",
+        fr: "Rappels de services",
+        es: "Devoluciones de llamada de servicios",
+        it: "Callback dei servizi",
+    },
+    "integration.notice": {
+        en: "These app entry points accept requests from other services without a DSM sign-in: {methods}. The app verifies each request with its own token, signature or key. It acts only for DSM accounts that are enabled and allowed by Application Privileges, and never with administrator rights.",
+        "zh-TW": "這些 App 入口接受其他服務在未登入 DSM 的情況下送來的請求：{methods}。App 會用自己的 token、簽章或金鑰驗證每個請求，只會代表已啟用且 Application Privileges 允許的 DSM 帳號執行，且一律不具管理員權限。",
+        "zh-CN": "这些应用入口接受其他服务在未登录 DSM 的情况下发送的请求：{methods}。应用会用自己的 token、签名或密钥验证每个请求，只会代表已启用且 Application Privileges 允许的 DSM 账号执行，且始终不具备管理员权限。",
+        ja: "次のアプリの入口は、DSM にサインインしていない他のサービスからの要求を受け付けます：{methods}。アプリは各要求を独自のトークン、署名、またはキーで検証します。有効で、アプリケーション権限で許可された DSM アカウントとしてのみ動作し、管理者権限は使いません。",
+        ko: "다음 앱 진입점은 DSM에 로그인하지 않은 다른 서비스의 요청을 받습니다: {methods}. 앱은 자체 토큰, 서명 또는 키로 각 요청을 확인합니다. 활성화되어 있고 애플리케이션 권한이 허용하는 DSM 계정으로만 동작하며, 관리자 권한은 사용하지 않습니다.",
+        de: "Diese App-Einstiegspunkte nehmen Anfragen anderer Dienste ohne DSM-Anmeldung an: {methods}. Die App prüft jede Anfrage mit eigenem Token, eigener Signatur oder eigenem Schlüssel. Sie handelt nur für aktivierte DSM-Konten, die die Anwendungsberechtigungen zulassen, und nie mit Administratorrechten.",
+        fr: "Ces points d'entrée de l'application acceptent des requêtes d'autres services sans connexion DSM : {methods}. L'application vérifie chaque requête avec son propre jeton, sa signature ou sa clé. Elle n'agit que pour des comptes DSM activés et autorisés par les privilèges d'application, et jamais avec des droits d'administrateur.",
+        es: "Estos puntos de entrada de la aplicación aceptan solicitudes de otros servicios sin iniciar sesión en DSM: {methods}. La aplicación verifica cada solicitud con su propio token, firma o clave. Solo actúa en nombre de cuentas de DSM habilitadas y permitidas por los privilegios de aplicación, y nunca con derechos de administrador.",
+        it: "Questi punti di ingresso dell'app accettano richieste da altri servizi senza accesso a DSM: {methods}. L'app verifica ogni richiesta con il proprio token, firma o chiave. Agisce solo per account DSM abilitati e consentiti dai privilegi delle applicazioni, mai con diritti di amministratore.",
+    },
     "install.reuseData": {
         en: "Data from an earlier installation is still on this NAS (@appdata/{package}), so this install reuses it: saved settings and generated secrets stay. To start empty, cancel and clear that data first — uninstall the app with “Also delete the app data listed above” ticked — then install again.",
         "zh-TW": "這台 NAS 還留有先前安裝的資料（@appdata/{package}），本次安裝會沿用：已存的設定與產生的 secrets 都會保留。若要從空白開始，請先取消並清除該資料——解除安裝時勾選「一併刪除上列 App 資料」——再重新安裝。",

package/dist/cli.js

@@ -38,7 +38,10 @@ import { checkJobs, commitOutputs, forEachArch, } from "./standalone/arch-jobs.j
 import { checkReproducible } from "./reproducible.js";
 import { spkApprovalDiff, formatApprovalDiff } from "./runtime/approval-diff.js";
 import { inspectAnySpk } from "./spk/inspect.js";
+import { backupRecord } from "./standalone/hyper-backup.js";
 import { terminalSafe } from "./terminal-text.js";
+import { auditGoRoutes } from "./standalone/route-audit.js";
+import { parseApiPermissions } from "./standalone/api-permissions.js";
 function failure(code, message, hint = "Fix the configuration and retry; use --help to see command usage.") {
     return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
@@ -123,10 +126,14 @@ function formatRootSteps(report) {
 function formatInstallSettings(settings) {
     return settings ? Object.entries(settings).map(([key, s]) => `Installation setting ${key}: ${s.type}, ${s.required ? 'required' : 'optional'} (${s.label}); values are private`) : [];
 }
+function formatHyperBackup(b) {
+    return [b ? `Hyper Backup: application backup on, ${b.online ? 'online (App keeps running; SQLite snapshots)' : 'offline (App stopped during export)'}, data version ${b.dataVersion}${b.hook ? `, hook ${b.hook}` : ''}. Hyper Backup runs the fixed backup scripts as root; they only switch to the package account.` : 'Hyper Backup: application backup off'];
+}
 function formatSpkReport(spk, report) {
     return [
         `SPK: ${spk}`,
         ...formatInstallSettings(report.installSettings),
+        ...(report.synopkgland ? formatHyperBackup(report.hyperBackup) : []),
         ...(report.identityGateway ? [report.identityGateway.notice, `OIDC issuer access: ${report.identityGateway.issuerAccess}`] : []),
         `package: ${report.package ?? "?"}  version: ${report.version ?? "?"}`,
         report.synopkgland
@@ -335,6 +342,30 @@ async function runCliWithin(argv) {
         .option("--json", "Print a single JSON object")
         .action(async (id, options) => { const { uninstallPackage } = await import('./host/package-commands.js'); const result = await uninstallPackage(id, options); emit('uninstall', result, JSON.stringify(result, null, 2)); });
     program.command("ctl").description("Control registered NAS Apps using described AI commands (ctl --help)");
+    program.command("audit-entry <main>")
+        .description("Audit one custom Go payload's target import graph without executing it")
+        .option("--dir <dir>", "Go module directory", ".")
+        .option("--arch <arches>", "Comma-separated Go target architectures", "amd64,arm64,arm")
+        .option("--permissions <file>", "App permissions JSON, when the payload registers App methods")
+        .option("--json", "Print a single JSON object")
+        .action((main, options) => {
+        const arches = options.arch.split(",");
+        if (!arches.length || arches.some(arch => !["amd64", "arm64", "arm"].includes(arch))) {
+            throw new Error("audit-entry: --arch must contain amd64, arm64 or arm");
+        }
+        const dir = resolve(options.dir);
+        const policy = options.permissions
+            ? parseApiPermissions(readFileSync(resolve(dir, options.permissions)))
+            : { schema: 1, default: "administrators", methods: {} };
+        const audit = auditGoRoutes(dir, policy, {}, [main], arches);
+        const ok = audit.problems.length === 0;
+        if (json)
+            stdout(JSON.stringify({ ok, ...audit }));
+        else
+            stdout(terminalSafe(ok ? "Entry audit passed" : audit.problems.join("\n")));
+        if (!ok)
+            process.exitCode = 1;
+    });
     program
         .command("check")
         .description("Validate the manifest, capability combination and Compose")
@@ -375,6 +406,7 @@ async function runCliWithin(argv) {
                 package: loaded.manifest.package,
                 warnings: validation.warnings ?? [],
                 ...("installSettings" in loaded.manifest && loaded.manifest.installSettings ? { installSettings: loaded.manifest.installSettings } : {}),
+                ...("hyperBackup" in loaded.manifest && loaded.manifest.hyperBackup ? { hyperBackup: backupRecord(loaded.manifest.hyperBackup) } : {}),
                 ...("identityGateway" in loaded.manifest && gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) ? { identityGateway: gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) } : {}),
                 capabilities: "capabilities" in loaded.manifest
                     ? loaded.manifest.capabilities
@@ -397,6 +429,7 @@ async function runCliWithin(argv) {
             }, [
                 "Validation passed.",
                 ...formatInstallSettings("installSettings" in loaded.manifest ? loaded.manifest.installSettings : undefined),
+                ...("capabilities" in loaded.manifest ? formatHyperBackup(loaded.manifest.hyperBackup) : []),
                 ...("identityGateway" in loaded.manifest && gatewayAdmissionReport(loaded.manifest.identityGateway) ? [gatewayAdmissionReport(loaded.manifest.identityGateway).notice] : []),
                 ...("compose" in loaded.manifest && loaded.manifest.compose
                     ? [

package/dist/error-registry.js

@@ -15,6 +15,11 @@ export const ERROR_REGISTRY = {
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
     SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.24.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
     SDK_INSTALL_SETTINGS_BUILD_FAILED: { "code": "SDK_INSTALL_SETTINGS_BUILD_FAILED", "description": "The SDK installation settings controller could not be built.", "suggestion": "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },
+    BACKUP_INVALID: { code: "BACKUP_INVALID", description: "The Hyper Backup application backup declaration or its packaged scripts are invalid.", suggestion: "Use backup.hyper_backup: false to opt out, or only online, data_version (\"major.minor\") and hook; rebuild so scripts/backup holds exactly the fixed export, import, info and version files." },
+    BACKUP_COMPOSE_UNSUPPORTED: { code: "BACKUP_COMPOSE_UNSUPPORTED", description: "Compose Apps keep their data in container volumes, which application backup does not cover.", suggestion: "Remove backup from a Compose App or set backup.hyper_backup: false." },
+    BACKUP_HOOK_MISSING: { code: "BACKUP_HOOK_MISSING", description: "backup.hook does not name an executable file in the package.", suggestion: "Package the hook (for example in the daemon payload or the App folder) and give its path relative to the package target." },
+    SDK_APP_BACKUP_UNSUPPORTED: { code: "SDK_APP_BACKUP_UNSUPPORTED", description: "The selected SDK does not provide Hyper Backup application backup.", suggestion: "Pin an SDK release with appbackup/cmd/control, or remove the backup declaration; without one the build skips application backup." },
+    SDK_APP_BACKUP_BUILD_FAILED: { code: "SDK_APP_BACKUP_BUILD_FAILED", description: "The SDK backup control could not be built.", suggestion: "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },
     INIT_HEALTH_INVALID: { code: "INIT_HEALTH_INVALID", description: "The Compose readiness selection is invalid.", suggestion: "Supply both --health-path and --health-status with the actual endpoint and expected 2xx response; redirects are not followed." },
     INIT_UPSTREAM_IMAGE_REQUIRED: { code: "INIT_UPSTREAM_IMAGE_REQUIRED", description: "The official upstream image repository was not selected.", suggestion: "Use init --upstream-fork --upstream-image <official-repository> for Compose." },
     INIT_UPSTREAM_IMAGE_INVALID: { code: "INIT_UPSTREAM_IMAGE_INVALID", description: "The upstream image repository is invalid.", suggestion: "Supply the official repository without a tag or digest; upgrade.sh selects the matching release and resolves its digest." },
@@ -843,6 +848,16 @@ export const ERROR_REGISTRY = {
             description: "The API policy is invalid.",
             suggestion: "Fix backend/internal/api/permissions.json.",
         },
+        STANDALONE_INTEGRATIONS_INVALID: {
+            code: "STANDALONE_INTEGRATIONS_INVALID",
+            description: "The integrations list in dsm-package.yaml is invalid or used where an integration callback cannot run.",
+            suggestion: "List each integration method once, sorted, as a string; integrations need a Go backend without compose.",
+        },
+        STANDALONE_INTEGRATIONS_MISMATCH: {
+            code: "STANDALONE_INTEGRATIONS_MISMATCH",
+            description: "The integrations list does not match the methods permissions.json marks integration.",
+            suggestion: "List exactly the integration methods from permissions.json in dsm-package.yaml integrations.",
+        },
         CLI_OPTION_UNKNOWN: {
             code: "CLI_OPTION_UNKNOWN",
             description: "Unknown CLI option.",

package/dist/skill.js

@@ -52,6 +52,11 @@ const SKILL_CATALOG = [
         file: "reference/lifecycle.md",
         when: "Add work to install, upgrade, uninstall, start or stop (dsm-scripts/)",
     },
+    {
+        id: "backup",
+        file: "reference/backup.md",
+        when: "Change or opt out of Hyper Backup application backup",
+    },
     { id: "deploy", file: "reference/deploy.md", when: "Deploy to a NAS" },
     {
         id: "diagnose",

package/dist/standalone/api-permissions.d.ts

@@ -5,7 +5,8 @@ export declare const API_PERMISSIONS_FILE: Record<SdkBackend["kind"], string>;
 type SdkPermissions = Record<string, Record<string, ApiPermission>>;
 export declare const MAX_PERMISSIONS_BYTES = 65536;
 export declare const MAX_PERMISSION_METHODS = 1024;
-export type ApiPermission = "administrators" | "authenticated" | "public";
+/** `integration` marks a Go `api.HandleIntegration` callback that arrives without a DSM session. */
+export type ApiPermission = "administrators" | "authenticated" | "public" | "integration";
 export interface ApiPermissions {
     schema: 1;
     default: "administrators";
@@ -30,4 +31,6 @@ export declare function floorAtAdministrators(policy: ApiPermissions, sdkPermiss
 };
 /** Launcher access is derived from the same API policy; no second setting. */
 export declare function permitsOrdinaryUsers(policy?: ApiPermissions): boolean;
+/** Methods declared with the `integration` permission, sorted. */
+export declare function integrationMethods(policy?: ApiPermissions): string[];
 export {};

package/dist/standalone/api-permissions.js

@@ -27,7 +27,7 @@ export function parseApiPermissions(raw) {
         throw new Error("too many permission methods");
     for (const [method, permission] of entries) {
         const matched = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/.exec(method);
-        if (method.length > 128 || matched?.[0] !== method || !["administrators", "authenticated", "public"].includes(permission)) {
+        if (method.length > 128 || matched?.[0] !== method || !["administrators", "authenticated", "public", "integration"].includes(permission)) {
             throw new Error(`invalid permission for method ${JSON.stringify(method)}`);
         }
     }
@@ -63,11 +63,17 @@ export function readApiPermissions(backend, capabilities = {}) {
 export function floorAtAdministrators(policy, sdkPermissions) {
     const sdk = new Set(Object.values(sdkPermissions).flatMap(methods => Object.keys(methods)));
     const methods = Object.fromEntries(Object.entries(policy.methods)
-        .map(([method, permission]) => [method, sdk.has(method) && permission === "public" ? permission : "administrators"]));
-    const widened = Object.entries(policy.methods).filter(([method, permission]) => !sdk.has(method) && permission !== "administrators").map(([method]) => method);
+        .map(([method, permission]) => [method, sdk.has(method) && permission === "public" || permission === "integration" ? permission : "administrators"]));
+    // An integration callback admits no DSM account by itself: api.ActAs refuses
+    // every account in an administrator-only App.
+    const widened = Object.entries(policy.methods).filter(([method, permission]) => !sdk.has(method) && permission !== "administrators" && permission !== "integration").map(([method]) => method);
     return { policy: { ...policy, methods }, widened };
 }
 /** Launcher access is derived from the same API policy; no second setting. */
 export function permitsOrdinaryUsers(policy) {
-    return policy !== undefined && Object.values(policy.methods).some(permission => permission !== "administrators");
+    return policy !== undefined && Object.values(policy.methods).some(permission => permission !== "administrators" && permission !== "integration");
+}
+/** Methods declared with the `integration` permission, sorted. */
+export function integrationMethods(policy) {
+    return Object.entries(policy?.methods ?? {}).filter(([, permission]) => permission === "integration").map(([method]) => method).sort();
 }