@synopackageland/cli 0.4.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 synopkgland
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -17,8 +17,45 @@ synopkgland --project ./my-app deploy --host my-nas --arch x86_64
 
 Native-go requires Go 1.24+; binary consumes checked prebuilt archives; container SPKs use DSM resource workers. Root operations require per-operation DSM approval. Remove root tasks before uninstall; changed task text needs fresh approval.
 
+For native-go integration, `--ui vue --integration go --integration-protocol 2
+--data-access relaxed` selects the S1R build policy (`integration.dataAccess`).
+Default data access remains unavailable. Mode is pinned in helper/CGI inventory
+and requires rebuild and new root approval when changed. Missing certified DSM
+adapters still refuse NAS access; this setting does not open write gates.
+Recreated accounts with the same UID and username may retain grants; a change to
+either invalidates all grants for that identity and requires new authorization.
+
 For containers, `--share MEDIA_SHARE=photos`, `--run-as RUN_AS=alice` and `--param APP_MODE=prod` supply declared values. Keep upstream target paths. Fixed service credentials govern mount access, while each upstream app owns user login and authorization.
 
 `dev` and `test` run local Compose. `info` and `log` read DSM package state/status; status output is not application log streaming. `skill path/list/show` exposes the bundled authoring guidance. `--dev` is available for container/binary development package identities. There is no release or public-submit command; deploy never publishes.
 
 See the repository's docs/independent-packages.md for supported parameters, lifecycle and limitations.
+## Licensing
+
+The CLI and original templates are MIT licensed, Copyright (c) 2026 synopkgland.
+Third-party components retain their own terms.
+Generated projects keep these template terms in `LICENSES/TEMPLATE.txt`.
+`init` does not create an app-level `LICENSE` or select a license for your work:
+choose your own terms and copyright holder in the project root `LICENSE`.
+Retain the template and dependency notices when distributing derived code.
+
+SPKs place legal material under the installed payload's `LICENSES/` directory:
+`TEMPLATE.txt`, optional developer `APP.txt`, Go's `GO-LICENSE`/`GO-PATENTS`,
+`GO-THIRD_PARTY_NOTICES.txt`, optional `HELPER-THIRD_PARTY_NOTICES.txt`, and
+`ui/` or `better-auth/` notice trees. The helper also retains its existing
+`integration/THIRD_PARTY_NOTICES.txt` location for compatibility.
+
+Vue and Better Auth builds generate full notices plus `inventory.json` from
+the installed, locked production dependency tree (a conservative superset of
+bundled code). Missing text or a version mismatch fails the build. Run `npm ci`
+in the generated frontend/Node directories before building. For
+`@better-auth/utils` 0.4.2 and 0.5.0, which omit license text in their npm
+archives, the tool retains the upstream project's subsequently added MIT
+license, with its pinned source commit and exact npm integrity recorded in
+`notice-overrides/index.json`. Unknown missing licenses require a new review;
+the tool never manufactures a license from a package's SPDX field.
+
+Keep `backend/THIRD_PARTY_NOTICES.txt` current if you change Go modules.
+The supplied notice inventory covers the pinned template dependencies and Go
+runtime; arbitrary developer binaries, Go module additions, container images,
+custom UI bundles and upstream applications need their own notice inventory.

package/dist/build-spk/generator.js

@@ -12,6 +12,7 @@ import { validateProject } from "../validate.js";
 import { writeDsmWindowIcons, writePackageCenterIcons } from "./dsm-icons.js";
 import { infoArchValue } from "./dsm-arch.js";
 import { createReproducibleTar } from "./reproducible-archive.js";
+import { copyProjectNotices } from "./notices.js";
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
 import { loadNative } from "../native/load.js";
 import { materializeNativePayload } from "./native-payload.js";
@@ -115,6 +116,7 @@ export async function buildSpk(options) {
             chmodSync(join(packageDir, "native.yaml"), FILE_MODE);
             const outputPath = options.outputPath ??
                 join(options.project.root, `${String(contract.package)}-${options.archFamily}.spk`);
+            copyProjectNotices(options.project.root, packageDir);
             await createDeterministicSpk(staging, outputPath);
             return { ok: true, outputPath, errors: [] };
         }
@@ -224,6 +226,7 @@ export async function buildSpk(options) {
             chmodSync(join(staging, "package", "ui", "config"), FILE_MODE);
         }
         const outputPath = options.outputPath ?? join(options.project.root, `${String(contract.package)}.spk`);
+        copyProjectNotices(options.project.root, join(staging, 'package'));
         await createDeterministicSpk(staging, outputPath);
         return { ok: true, outputPath, errors: [] };
     }

package/dist/build-spk/notices.d.ts

@@ -0,0 +1,5 @@
+/** Copy legal text only; never follow a project-supplied symlink. */
+export declare function copyNoticeTree(source: string, target: string): void;
+/** Fixed payload location, independent of app code/binary paths. */
+export declare function copyProjectNotices(root: string, payload: string): void;
+export declare function copyStandaloneNotices(root: string, uiDir: string, payload: string, go: boolean, helper: boolean, identity: boolean, goDir?: string): void;

package/dist/build-spk/notices.js

@@ -0,0 +1,60 @@
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+/** Copy legal text only; never follow a project-supplied symlink. */
+export function copyNoticeTree(source, target) {
+    const stat = lstatSync(source);
+    if (stat.isSymbolicLink())
+        throw new Error(`[NOTICE_UNSAFE] Symlink in notice tree: ${source}`);
+    if (stat.isDirectory()) {
+        mkdirSync(target, { recursive: true });
+        for (const name of readdirSync(source).sort())
+            copyNoticeTree(join(source, name), join(target, name));
+    }
+    else if (stat.isFile() && stat.size <= 8 * 1024 * 1024) {
+        mkdirSync(dirname(target), { recursive: true });
+        copyFileSync(source, target);
+    }
+    else
+        throw new Error(`[NOTICE_UNSAFE] Notice must be a bounded regular file: ${source}`);
+}
+/** Fixed payload location, independent of app code/binary paths. */
+export function copyProjectNotices(root, payload) {
+    const dest = join(payload, 'LICENSES');
+    if (existsSync(join(root, 'LICENSES')))
+        copyNoticeTree(join(root, 'LICENSES'), dest);
+    if (existsSync(join(root, 'LICENSE')))
+        copyNoticeTree(join(root, 'LICENSE'), join(dest, 'APP.txt'));
+}
+export function copyStandaloneNotices(root, uiDir, payload, go, helper, identity, goDir = join(root, 'backend')) {
+    copyProjectNotices(root, payload);
+    const dest = join(payload, 'LICENSES');
+    const shared = new URL('../../templates/_shared/', import.meta.url);
+    if (go || helper) {
+        mkdirSync(dest, { recursive: true });
+        for (const name of ['GO-LICENSE', 'GO-PATENTS'])
+            copyFileSync(new URL(name, shared), join(dest, name));
+        if (existsSync(join(goDir, 'THIRD_PARTY_NOTICES.txt')))
+            copyNoticeTree(join(goDir, 'THIRD_PARTY_NOTICES.txt'), join(dest, 'GO-THIRD_PARTY_NOTICES.txt'));
+    }
+    if (helper)
+        copyFileSync(new URL('../../templates/native-go/backend/THIRD_PARTY_NOTICES.txt', import.meta.url), join(dest, 'HELPER-THIRD_PARTY_NOTICES.txt'));
+    const frontend = join(root, 'frontend/package.json');
+    const usesUi = existsSync(frontend) && Boolean(JSON.parse(readFileSync(frontend, 'utf8')).dependencies?.['@synopackageland/ui']);
+    if (usesUi) {
+        for (const name of ['UI-LICENSE', 'UI-THIRD_PARTY.md', 'THIRD_PARTY_NOTICES.txt', 'inventory.json']) {
+            const source = join(uiDir, 'LICENSES', name);
+            if (!existsSync(source))
+                throw new Error(`[NOTICE_MISSING] UI notice missing: ${source}; rebuild frontend`);
+        }
+    }
+    if (existsSync(join(uiDir, 'LICENSES')))
+        copyNoticeTree(join(uiDir, 'LICENSES'), join(dest, 'ui'));
+    if (identity) {
+        const source = join(root, 'node/dist/LICENSES');
+        for (const name of ['THIRD_PARTY_NOTICES.txt', 'inventory.json']) {
+            if (!existsSync(join(source, name)))
+                throw new Error(`[NOTICE_MISSING] Better Auth notice missing: ${name}; rebuild node bundle`);
+        }
+        copyNoticeTree(source, join(dest, 'better-auth'));
+    }
+}

package/dist/cli.js

@@ -1,6 +1,6 @@
 import { planDeployment, deployStandalone } from "./deploy/plan.js";
 import { Command } from "commander";
-import { renameSync } from "node:fs";
+import { readFileSync, renameSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { findProjectRoot } from "./discovery.js";
 import { loadContract } from "./contract/load.js";
@@ -21,6 +21,8 @@ import { resolveInstallParameterExtraValues } from "./deploy/param-values.js";
 import { findStandaloneRoot, loadStandaloneManifest } from "./standalone/manifest.js";
 import { buildStandalone } from "./standalone/build.js";
 import { inspectSpk } from "./standalone/inspect-spk.js";
+import { templatesRoot } from "./template-paths.js";
+import { join } from "node:path";
 function collectKvOption(value, previous, flag, example) {
     const separator = value.indexOf("=");
     if (separator <= 0) {
@@ -54,6 +56,7 @@ function formatSpkInspection(spk, report) {
         `arch：${report.arch ?? "?"}  runtime：${report.kind ?? "?"}`,
         `簽署：${report.signed ? "有 Synology 簽章" : "未簽署（Package Center 需允許任何發行者）"}`,
         `CGI：${report.cgi ?? "無"}`,
+        ...(report.integration ? [`integration protocol：${report.integration.protocol}；NAS data mode：${report.integration.dataAccess}；policy：${report.integration.dataAccess === "relaxed" ? "UID + username" : "unavailable"}；inspect 只核對產物，不證明 runtime adapters／DSM 認證`] : []),
         "payload：",
         ...report.payload.map((entry) => `  ${entry.mode} ${entry.path}`),
     ];
@@ -163,8 +166,10 @@ export async function runCli(argv) {
         .option("--package <id>", "native-go：INFO.package（預設由目錄名產生，例如 photo-tagger → PhotoTagger）")
         .option("--name <display>", "native-go：顯示名稱（預設由目錄名產生）")
         .option("--privilege <none|root>", "native-go：root 另加由 DSM 管理員在套件視窗核准的 root 操作（預設 none）")
-        .option("--ui <plain|vue>", "native-go：沿用 UI 0.3.1 的 Vue 介面（預設 plain）")
+        .option("--ui <plain|vue>", `native-go：沿用 UI ${JSON.parse(readFileSync(join(templatesRoot(), "native-go-vue/frontend/package.json"), "utf8")).dependencies["@synopackageland/ui"]} 的 Vue 介面（預設 plain）`)
         .option("--integration <go|better-auth>", "native-go --ui vue：每包 helper 與私有範例；better-auth 才加入 Node")
+        .option("--integration-protocol <1|2>", "helper inventory protocol（預設 1）；2 可選 NAS data policy，缺已認證 adapters 仍拒絕")
+        .option("--data-access <unavailable|relaxed>", "protocol 2 build-time 身分模式（預設 unavailable）；relaxed 不繞過 DSM／App／lifecycle gates")
         .argument("[dir]", "目標目錄", ".")
         .addHelpText("after", `
 模板分兩類：
@@ -208,6 +213,8 @@ export async function runCli(argv) {
                 privilege: options.privilege,
                 ui: options.ui,
                 integration: options.integration,
+                integrationProtocol: options.integrationProtocol === undefined ? undefined : (["1", "2"].includes(options.integrationProtocol) ? Number(options.integrationProtocol) : NaN),
+                dataAccess: options.dataAccess,
             });
         }
         catch (error) {

package/dist/error-registry.js

@@ -579,6 +579,26 @@ export const ERROR_REGISTRY = {
         "description": "每包 helper 的 integration 宣告不合法。",
         "suggestion": "使用 native-go、privilege: root、protocol: 1 和 workers map；不要自訂 helper_ 操作。"
     },
+    "STANDALONE_DAEMON_INVALID": {
+        "code": "STANDALONE_DAEMON_INVALID",
+        "description": "套件 daemon 的宣告不符合固定 argv、環境與生命週期契約。",
+        "suggestion": "核對 daemon.exec、各架構 targets、args、env、uninstall_args 與整數秒 timeouts；移除 shell、user 與自訂 conf。"
+    },
+    "STANDALONE_DAEMON_BUILD_FAILED": {
+        "code": "STANDALONE_DAEMON_BUILD_FAILED",
+        "description": "無法建置套件 daemon 的 Go supervisor。",
+        "suggestion": "安裝 Go 1.24 以上並檢查 compiler stderr；NAS 不需要 Go toolchain。"
+    },
+    "STANDALONE_DAEMON_PAYLOAD_INVALID": {
+        "code": "STANDALONE_DAEMON_PAYLOAD_INVALID",
+        "description": "daemon payload 不是專案內的有界、無連結目錄。",
+        "suggestion": "重建各架構 bundle；移除 symlink、特殊檔與 setid，並將大小限制在 512 MiB。"
+    },
+    "STANDALONE_DAEMON_ARTIFACT_REQUIRED": {
+        "code": "STANDALONE_DAEMON_ARTIFACT_REQUIRED",
+        "description": "組裝 daemon SPK 時缺少已建置的 supervisor。",
+        "suggestion": "透過 synopkgland build-spk 建置完整產物，不直接呼叫缺少 controller 的 assembler。"
+    },
     "HELPER_WORKER_UNSAFE": {
         "code": "HELPER_WORKER_UNSAFE",
         "description": "worker inventory 檔案不在專案內或不是一般檔案。",

package/dist/init.d.ts

@@ -10,5 +10,9 @@ export interface InitOptions {
     privilege?: "none" | "root";
     ui?: "plain" | "vue";
     integration?: "go" | "better-auth";
+    /** Pin the helper inventory protocol; protocol 2 still refuses NAS data. */
+    integrationProtocol?: 1 | 2;
+    /** Protocol 2 policy only; unavailable adapters still refuse data. */
+    dataAccess?: "unavailable" | "relaxed";
 }
 export declare function initFromTemplate(template: TemplateName, targetDir: string, options?: InitOptions): void;

package/dist/init.js

@@ -1,6 +1,6 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, relative } from "node:path";
-import { fileURLToPath } from "node:url";
+import { basename, join, relative } from "node:path";
+import { templatesRoot } from "./template-paths.js";
 const TEMPLATE_NAMES = [
     "hello-web",
     "hello-web-page",
@@ -15,14 +15,6 @@ export function isTemplateName(value) {
 export function listTemplates() {
     return [...TEMPLATE_NAMES];
 }
-function templatesRoot() {
-    const moduleDir = dirname(fileURLToPath(import.meta.url));
-    const distTemplates = join(moduleDir, "templates");
-    if (existsSync(distTemplates)) {
-        return distTemplates;
-    }
-    return join(moduleDir, "..", "templates");
-}
 /**
  * native-go --privilege root: files laid over the native-go template, and the
  * files they replace.
@@ -69,15 +61,27 @@ export function initFromTemplate(template, targetDir, options = {}) {
         ...(options.integration ? ["native-go-integration"] : []),
         ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
     ].map(name => join(templatesRoot(), name));
-    const files = [...templateFiles(source), ...overlays.flatMap(root => templateFiles(root))];
+    // Shared legal resources also live in the CLI package; only the template
+    // terms are an unconditional part of a generated project.
+    const shared = join(templatesRoot(), "_shared");
+    const files = [...templateFiles(source), "LICENSES/TEMPLATE.txt", ...overlays.flatMap(root => templateFiles(root)),
+        ...(options.ui === "vue" ? ["frontend/third-party-notices.mjs"] : []),
+        ...(options.integration === "better-auth" ? ["node/third-party-notices.mjs", ...templateFiles(join(shared, 'notice-overrides')).map(file => `node/notice-overrides/${file}`)] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
     }
     mkdirSync(targetDir, { recursive: true });
     cpSync(source, targetDir, { recursive: true });
+    mkdirSync(join(targetDir, "LICENSES"), { recursive: true });
+    cpSync(join(shared, "LICENSES/TEMPLATE.txt"), join(targetDir, "LICENSES/TEMPLATE.txt"));
     for (const overlay of overlays)
         cpSync(overlay, targetDir, { recursive: true });
+    for (const dir of [...(options.ui === "vue" ? ["frontend"] : []), ...(options.integration === "better-auth" ? ["node"] : [])]) {
+        cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
+    }
+    if (options.integration === "better-auth")
+        cpSync(join(shared, 'notice-overrides'), join(targetDir, 'node/notice-overrides'), { recursive: true });
     if (privilege === "root")
         ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
     for (const [from, to] of Object.entries(RENAMED)) {
@@ -104,7 +108,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
         const mod = join(targetDir, "backend/go.mod");
         writeFileSync(mod, readFileSync(mod, "utf8").replace("go 1.24", "go 1.25"));
         const manifest = join(targetDir, "dsm-package.yaml");
-        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nintegration:\n  protocol: 1\n  workers: {}\n" + (options.integration === "better-auth" ? "  identity: better-auth\n" : ""));
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + `\nintegration:\n  protocol: ${options.integrationProtocol ?? 1}\n  workers: {}\n` + (options.integration === "better-auth" ? "  identity: better-auth\n" : "") + (options.dataAccess ? `  dataAccess: ${options.dataAccess}\n` : ""));
         const routes = join(targetDir, "backend/internal/app/routes.go");
         writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
     }
@@ -119,6 +123,10 @@ function substitutionsFor(template, targetDir, options) {
         throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
     if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
         throw new Error("[INIT_INTEGRATION_INVALID] --integration 只接受 go 或 better-auth。");
+    if (options.dataAccess !== undefined && (!options.integration || options.integrationProtocol !== 2 || !["unavailable", "relaxed"].includes(options.dataAccess)))
+        throw new Error("[INIT_DATA_ACCESS_INVALID] --data-access 只接受 unavailable 或 relaxed，且需要 --integration 與 --integration-protocol 2；缺少已認證 adapter 仍拒絕 NAS 操作。");
+    if (options.integrationProtocol !== undefined && (!options.integration || ![1, 2].includes(options.integrationProtocol)))
+        throw new Error("[INIT_INTEGRATION_PROTOCOL_INVALID] --integration-protocol 只接受 1 或 2，且需要 --integration；protocol 2 不啟用 NAS data path。");
     if (options.integration && (options.ui !== "vue" || options.privilege === "none"))
         throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 --ui vue 與 root privilege（自動選用）。");
     const privilege = options.privilege ?? (options.integration ? "root" : "none");

package/dist/standalone/build.js

@@ -6,6 +6,7 @@ import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildHelper } from "./helper.js";
+import { buildDaemonControl } from "./daemon.js";
 const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export const runCommand = (command, args, options) => {
@@ -59,8 +60,9 @@ export async function buildStandalone(options) {
                 throw new StandaloneBuildError(problem.code, problem.message);
             }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const daemonControl = buildDaemonControl(manifest, arch, work, run);
             const builtManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
-            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper });
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper, daemonControl });
             outputs.push(outputPath);
         }
         return { outputs };

package/dist/standalone/daemon.d.ts

@@ -0,0 +1,23 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneError, StandaloneManifest } from "./manifest.js";
+export interface Daemon {
+    /** Fixed foreground executable relative to daemon/payload. */
+    exec: string;
+    /** Architecture-specific project directories, copied without links. */
+    targets: Partial<Record<NativeArchFamily, string>>;
+    args: string[];
+    /** Optional fixed executable argv, after stop, only on uninstall. */
+    uninstall_args?: string[];
+    /** The only application environment inherited beyond PATH/HOME/TMPDIR. */
+    env: Record<string, string>;
+    timeouts: {
+        start: number;
+        stop: number;
+        status: number;
+    };
+}
+export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function daemonConfig(manifest: StandaloneManifest): string;
+export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): string | undefined;
+export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;

package/dist/standalone/daemon.js

@@ -0,0 +1,114 @@
+import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { templatesRoot } from "../template-paths.js";
+import { checkCgiBinary } from "./binary.js";
+import { StandaloneBuildError } from "./spk.js";
+const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
+const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
+    && !v.replaceAll("${SYNOPKG_PKGDEST}", "").replaceAll("${SYNOPKG_PKGVAR}", "").includes("${");
+const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
+    && !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
+export function readDaemon(value, root, arches, fail) {
+    if (value === undefined)
+        return undefined;
+    const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon 只接受固定 exec、targets、args、env 與 timeouts；路徑須在專案內，環境不接受 loader/shell/system 變數。" }); return undefined; };
+    if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
+        return invalid();
+    if (typeof value.exec !== "string" || !/^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(value.exec)
+        || value.exec.split("/").some(p => p === "." || p === "..") || value.exec.length > 200)
+        return invalid();
+    if (!record(value.targets) || Object.keys(value.targets).length !== arches.length)
+        return invalid();
+    const targets = {};
+    for (const arch of arches) {
+        const path = value.targets[arch];
+        if (typeof path !== "string" || !path.trim() || path.includes("\0") || isAbsolute(path) || path.split(/[\\/]/).includes(".."))
+            return invalid();
+        const resolved = resolve(root, path), rel = relative(root, resolved);
+        if (!rel || rel.startsWith("..") || isAbsolute(rel))
+            return invalid();
+        targets[arch] = resolved;
+    }
+    const args = value.args ?? [];
+    if (!Array.isArray(args) || args.length > 64 || !args.every(token))
+        return invalid();
+    const uninstall = value.uninstall_args;
+    if (uninstall !== undefined && (!Array.isArray(uninstall) || !uninstall.length || uninstall.length > 64 || !uninstall.every(token)))
+        return invalid();
+    const env = value.env ?? {};
+    if (!record(env) || Object.keys(env).length > 64 || Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
+        return invalid();
+    const limits = value.timeouts ?? {};
+    if (!record(limits) || Object.keys(limits).some(k => !["start", "stop", "status"].includes(k)))
+        return invalid();
+    const timeouts = { start: limits.start ?? 5, stop: limits.stop ?? 10, status: limits.status ?? 2 };
+    for (const [key, v] of Object.entries(timeouts)) {
+        if (!Number.isInteger(v) || v < (key === "start" ? 2 : key === "stop" ? 2 : 1) || v > (key === "status" ? 10 : 120))
+            return invalid();
+    }
+    return { exec: value.exec, targets, args, ...(uninstall ? { uninstall_args: uninstall } : {}), env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])), timeouts: timeouts };
+}
+export function daemonConfig(manifest) {
+    const { exec, args, uninstall_args, env, timeouts } = manifest.daemon;
+    return JSON.stringify({ package: manifest.package, exec, args, ...(uninstall_args ? { uninstall_args } : {}), env, timeouts }) + "\n";
+}
+export function buildDaemonControl(manifest, arch, work, run) {
+    if (!manifest.daemon)
+        return undefined;
+    const out = join(work, `daemon-control-${arch}`);
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
+        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+    });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build 需要 Go 1.24 以上。\n${result.stderr}`);
+    const problem = checkCgiBinary(work, out, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    return out;
+}
+export function copyDaemonPayload(manifest, arch, target, controller) {
+    const daemon = manifest.daemon;
+    const source = daemon.targets[arch];
+    const invalid = (message) => { throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", message); };
+    let total = 0;
+    const walk = (from, to) => {
+        const stat = lstatSync(from);
+        const rel = relative(realpathSync(manifest.root), realpathSync(from));
+        if (rel.startsWith("..") || isAbsolute(rel) || stat.isSymbolicLink())
+            invalid(`daemon payload 路徑不可含 symlink 或跳出專案：${from}`);
+        if (stat.isDirectory()) {
+            mkdirSync(to, { recursive: true });
+            chmodSync(to, 0o755);
+            for (const name of readdirSync(from).sort())
+                walk(join(from, name), join(to, name));
+        }
+        else if (stat.isFile()) {
+            total += stat.size;
+            if (total > 512 * 1024 * 1024 || (stat.mode & 0o6000))
+                invalid(`daemon payload 不接受 setid 或超過 512 MiB：${from}`);
+            copyFileSync(from, to);
+            chmodSync(to, stat.mode & 0o111 ? 0o755 : 0o644);
+        }
+        else
+            invalid(`daemon payload 只接受一般檔案及目錄：${from}`);
+    };
+    try {
+        if (!lstatSync(source).isDirectory())
+            invalid("daemon.targets 必須指向目錄。");
+        walk(source, join(target, "payload"));
+    }
+    catch (error) {
+        if (error instanceof StandaloneBuildError)
+            throw error;
+        invalid(`無法讀取 daemon payload：${String(error)}`);
+    }
+    const exec = join(source, daemon.exec);
+    const problem = checkCgiBinary(manifest.root, exec, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    chmodSync(join(target, "payload", daemon.exec), 0o755);
+    copyFileSync(controller, join(target, "control"));
+    chmodSync(join(target, "control"), 0o755);
+    writeFileSync(join(target, "config.json"), daemonConfig(manifest), { mode: 0o644 });
+}

package/dist/standalone/dsm-window.d.ts

@@ -13,7 +13,7 @@ export declare const I18N_RUNTIME: string;
  * The wrapper file name carries the build so DSM never serves a wrapper
  * cached from the previous version after an upgrade.
  */
-export declare function windowScriptName(manifest: StandaloneManifest): string;
+export declare function windowScriptName(manifest: Pick<StandaloneManifest, "build">): string;
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export declare function renderUiConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/dsm-window.js

@@ -1,6 +1,8 @@
+import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
 import { ROOT_MESSAGES } from "./root-messages.js";
 import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export function cgiUrl(packageId) {
@@ -115,6 +117,16 @@ ${I18N_RUNTIME}
   return createI18n;
 })();
 
+${ns}.createReopenEvents = (function () {
+${REOPEN_EVENTS_RUNTIME}
+  return createReopenEvents;
+})();
+
+${ns}.createHost = (function () {
+${HOST_ADAPTER_RUNTIME}
+  return createHostAdapter;
+})();
+
 ${root ? root.definitions : ""}${ns}.loadApp = function (done) {
   var apps = window.DsmPackageApps || {};
   if (apps[${p}]) {
@@ -150,33 +162,61 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
     this.callParent(arguments);
     var me = this;
     if (me.mounted) {
-      me.reopenHandlers.forEach(function (fn) { fn(); });
+      me.reopenEvents.emit();
       return;
     }
-    me.reopenHandlers = [];
-    var lang = typeof _S === "function" ? _S("lang") : "enu";
+    if (me.mountPending) return;
+    me.mountPending = true;
+    var mountToken = me.mountToken = {};
+    me.reopenEvents = ${ns}.createReopenEvents();
+    me.reopenHandlers = me.reopenEvents.handlers;
+    var lang = "enu";
+    try { if (typeof _S === "function") lang = _S("lang"); } catch (error) {}
 ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
+      if (me.mountToken !== mountToken) return;
+      me.mountPending = false;
       var root = me.body && me.body.dom.querySelector(".dsmapp-root");
       if (app && root && !me.mounted) {
         var i18n = ${ns}.createI18n(lang, ${ns}.messages);
+        me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });
         root.lang = i18n.locale;
-        me.mounted = app.mount(root, {
+        try {
+          me.mounted = app.mount(root, {
           call: ${ns}.call,
-          reopen: function (fn) { me.reopenHandlers.push(fn); },
+          reopen: me.reopenEvents.subscribe,
+          host: me.hostAccess,
           appWindow: me,
           lang: lang,
           locale: i18n.locale,
           t: i18n.t${root ? ",\n          root: access" : ""}
-        }) || {};
+          }) || {};
+        } catch (error) {
+          me.hostAccess.dispose();
+          me.hostAccess = null;
+          me.mountToken = null;
+          me.reopenEvents.dispose();
+          me.reopenEvents = null;
+          me.reopenHandlers = [];
+          throw error;
+        }
       }
     });
   },
   onDestroy: function () {
-    if (this.mounted && this.mounted.unmount) {
-      this.mounted.unmount();
-    }
+    this.mountToken = null;
+    this.mountPending = false;
+    if (this.reopenEvents) this.reopenEvents.dispose();
+    this.reopenEvents = null;
+    this.reopenHandlers = [];
+    if (this.hostAccess) this.hostAccess.dispose();
+    this.hostAccess = null;
+    var mounted = this.mounted;
     this.mounted = null;
-    this.callParent(arguments);
+    try {
+      if (mounted && mounted.unmount) mounted.unmount();
+    } finally {
+      this.callParent(arguments);
+    }
   }
 });
 `;

package/dist/standalone/helper-inventory.d.ts

@@ -0,0 +1,16 @@
+export type DataAccessMode = "unavailable" | "relaxed";
+export interface Integration {
+    protocol: 1 | 2;
+    workers: Record<string, string>;
+    identity?: "better-auth";
+    dataAccess?: DataAccessMode;
+}
+export interface HelperInventory {
+    package: string;
+    version: string;
+    protocol: number;
+    payloadDigest: string;
+    registryDigest: string;
+    dataAccess?: DataAccessMode;
+}
+export declare const sha256: (b: string | Buffer) => string;

package/dist/standalone/helper-inventory.js

@@ -0,0 +1,2 @@
+import { createHash } from "node:crypto";
+export const sha256 = (b) => createHash("sha256").update(b).digest("hex");

package/dist/standalone/helper.d.ts

@@ -2,18 +2,8 @@ import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 import { type RootOp } from "./root-ops.js";
-export interface Integration {
-    protocol: number;
-    workers: Record<string, string>;
-    identity?: "better-auth";
-}
-export interface HelperInventory {
-    package: string;
-    version: string;
-    protocol: number;
-    payloadDigest: string;
-    registryDigest: string;
-}
+export type { Integration, HelperInventory } from "./helper-inventory.js";
+import { type Integration, type HelperInventory } from "./helper-inventory.js";
 export interface WorkerPayload {
     id: string;
     digest: string;