@synopackageland/cli 0.5.0 → 0.5.3

package/README.md

@@ -15,7 +15,7 @@ synopkgland --project ./my-app deploy --dry-run --arch x86_64
 synopkgland --project ./my-app deploy --host my-nas --arch x86_64
 ```
 
-Native-go requires Go 1.24+; binary consumes checked prebuilt archives; container SPKs use DSM resource workers. Root operations require DSM 7.1-42661 or later and per-operation DSM approval. DSM 7.1 keeps the native password dialog but creates root tasks using the admin session without a server-side password token; DSM 7.2+ retains its one-use token. See the native-go template README for the API matrix and completion limits. Remove root tasks before uninstall; changed task text needs fresh approval.
+Native-go requires Go 1.25+; binary consumes checked prebuilt archives; container SPKs use DSM resource workers. Root operations require DSM 7.1-42661 or later and per-operation DSM approval. DSM 7.1 keeps the native password dialog but creates root tasks using the admin session without a server-side password token; DSM 7.2+ retains its one-use token. See the native-go template README for the API matrix and completion limits. Remove root tasks before uninstall; changed task text needs fresh approval.
 
 `--ui vue --integration go|better-auth` generates a package-account integration
 (`privilege: none`, no helper). The privileged helper needs an explicit

package/dist/authorization-sdk.d.ts

@@ -0,0 +1,5 @@
+/** Public build-time adapter surface for native-layout products. */
+export { ROOT_RUNTIME, type RootTask } from './standalone/root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/authorization-window.js';
+/** Canonical Vue gate and nine catalogs, shipped unchanged in the npm archive. */
+export declare const authorizationTemplateDirectory: URL;

package/dist/authorization-sdk.js

@@ -0,0 +1,5 @@
+/** Public build-time adapter surface for native-layout products. */
+export { ROOT_RUNTIME } from './standalone/root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/authorization-window.js';
+/** Canonical Vue gate and nine catalogs, shipped unchanged in the npm archive. */
+export const authorizationTemplateDirectory = new URL('../templates/native-go-authorization/frontend/src/authorization/', import.meta.url);

package/dist/build-spk/delete-app-data.d.ts

@@ -3,7 +3,7 @@
  *
  * DSM keeps `@appdata`, `@apphome` and `@appconf` after an uninstall, so a
  * package that offers deletion has to do it itself. The uninstall wizard's
- * `pkgwizard_remove_additional` box (the key Synology's own packages use) is
+ * `pkgwizard_remove_additional` box (the key DSM's built-in packages use) is
  * unchecked by default, so an absent variable leaves the data in place. The
  * pre-0.5 key `delete_app_data` and DSM's `wizard_` mirror of either key are
  * still honoured for scripted callers.

package/dist/build-spk/uninstall-wizard.d.ts

@@ -1,4 +1,4 @@
-/** The key Synology's own packages use for their "also remove my data" box. */
+/** The key DSM's built-in packages use for their "also remove my data" box. */
 export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 export type UninstallWizardKind = "native" | "container";
 /** Options that add a warning without changing the data box. */

package/dist/build-spk/uninstall-wizard.js

@@ -1,5 +1,5 @@
 import { renderWizardFiles } from "./wizard-i18n.js";
-/** The key Synology's own packages use for their "also remove my data" box. */
+/** The key DSM's built-in packages use for their "also remove my data" box. */
 export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;

package/dist/cli.js

@@ -247,14 +247,14 @@ export async function runCli(argv) {
         .addHelpText("after", `
 模板分兩類：
   獨立 Container / Binary App（synology-app.yaml）：
-    容器（compose.yaml）：hello-web、hello-web-page、hello-files、compose-import
+    容器（compose.yaml）：hello-files、compose-import
     binary（native.yaml）：執行一個預先建置的 binary 服務；可用 adminport 在自己的 port 提供網頁
   Standalone Package（未簽署原生 SPK，含 Go CGI 與 DSM 視窗，dsm-package.yaml）：
     native-go：Go CGI backend + DSM 視窗 UI，預設需登入、admin 動作另外宣告。
       --privilege root：另加固定的 root 操作（root/<名稱>.sh），由 DSM 管理員在套件視窗
       以密碼核准後才能執行；預設 none，完全不用 root。
 
-快速開始（native-go，需要 Go 1.24+）：
+快速開始（native-go，需要 Go 1.25+）：
   synopkgland init -t native-go my-app
   cd my-app && $EDITOR backend/internal/app/routes.go frontend/src/App.vue
   synopkgland build-spk          # → dist/<Package>-<version>-<arch>.spk

package/dist/error-registry.js

@@ -651,7 +651,7 @@ export const ERROR_REGISTRY = {
     "STANDALONE_BACKGROUND_BUILD_FAILED": {
         "code": "STANDALONE_BACKGROUND_BUILD_FAILED",
         "description": "無法建置套件的背景 worker。",
-        "suggestion": "安裝 Go 1.24 以上，確認 backend 含 cmd/background-worker（可用 synopkgland init --background 建立），並檢查 compiler stderr。"
+        "suggestion": "安裝 Go 1.25 以上，確認 backend 含 cmd/background-worker（可用 synopkgland init --background 建立），並檢查 compiler stderr。"
     },
     "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED": {
         "code": "STANDALONE_BACKGROUND_ARTIFACT_REQUIRED",
@@ -836,7 +836,7 @@ export const ERROR_REGISTRY = {
     "STANDALONE_GO_MISSING": {
         "code": "STANDALONE_GO_MISSING",
         "description": "找不到 go 指令。",
-        "suggestion": "請安裝 Go 1.24 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。"
+        "suggestion": "請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。"
     },
     "STANDALONE_GO_BUILD_FAILED": {
         "code": "STANDALONE_GO_BUILD_FAILED",
@@ -880,7 +880,7 @@ export const ERROR_REGISTRY = {
     },
     "STANDALONE_I18N_GLOSSARY_MISMATCH": {
         "code": "STANDALONE_I18N_GLOSSARY_MISMATCH",
-        "description": "訊息沒有使用用語表中的 Synology 官方用語。",
+        "description": "訊息沒有使用用語表中的 DSM 介面用語。",
         "suggestion": "請改用 glossary.json 中該語言的用語，與 DSM 介面保持一致。"
     },
     "DEPLOY_VERSION_INVALID": {

package/dist/host/dsm-port-profile.d.ts

@@ -36,7 +36,7 @@ export declare function installedPackageIdentitiesFromPayload(payload: unknown):
  *
  * The package list is a forward mapping: package identity -> project name.
  * Do not use presumedPackageIdentity here; replacing dashes with dots is
- * lossy for identities such as com.example.hello-web.
+ * lossy for identities such as com.example.container-web.
  */
 export declare function dsmPortProfileInventoryFromPayloads(portInfoPayload: unknown, packageListPayload: unknown): DsmPortProfileInventory | undefined;
 /**

package/dist/host/dsm-port-profile.js

@@ -136,7 +136,7 @@ export function installedPackageIdentitiesFromPayload(payload) {
  *
  * The package list is a forward mapping: package identity -> project name.
  * Do not use presumedPackageIdentity here; replacing dashes with dots is
- * lossy for identities such as com.example.hello-web.
+ * lossy for identities such as com.example.container-web.
  */
 export function dsmPortProfileInventoryFromPayloads(portInfoPayload, packageListPayload) {
     const profiles = parseDsmPortInfoPayload(portInfoPayload);

package/dist/init.js

@@ -4,8 +4,6 @@ import { templatesRoot } from "./template-paths.js";
 import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
 import { readSharedFolder } from "./standalone/shared-folder.js";
 const TEMPLATE_NAMES = [
-    "hello-web",
-    "hello-web-page",
     "hello-files",
     "compose-import",
     "binary",
@@ -13,8 +11,6 @@ const TEMPLATE_NAMES = [
 ];
 /** Templates whose App runs through the DSM docker-project resource worker. */
 const CONTAINER_TEMPLATES = [
-    "hello-web",
-    "hello-web-page",
     "hello-files",
     "compose-import",
 ];
@@ -103,6 +99,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
     const overlays = [
         ...(rootExample ? [ROOT_OVERLAY] : []),
         ...(ui === "vue" ? ["native-go-vue"] : []),
+        ...(privilege === "root" ? ["native-go-authorization"] : []),
         ...(options.background ? [BACKGROUND_OVERLAY] : []),
         ...(options.integration ? ["native-go-integration"] : []),
         ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
@@ -128,6 +125,8 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     if (options.integration === "better-auth")
         cpSync(join(shared, 'notice-overrides'), join(targetDir, 'node/notice-overrides'), { recursive: true });
+    if (privilege === "root")
+        rmSync(join(targetDir, "backend/internal/app/authorization_none.go"));
     if (rootExample)
         ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
     if (options.background)
@@ -154,6 +153,28 @@ export function initFromTemplate(template, targetDir, options = {}) {
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
         rmSync(join(targetDir, "ui"), { recursive: true });
     }
+    if (privilege === "root" && ui === "vue") {
+        for (const entry of ["App.vue", "SDKApp.vue"]) {
+            const app = join(targetDir, "frontend/src", entry);
+            writeFileSync(app, readFileSync(app, "utf8")
+                .replace("import AppShell from './shell/AppShell.vue'", "import AuthorizationGate from './authorization/AuthorizationGate.vue'\nimport AppShell from './shell/AppShell.vue'")
+                .replace('<AppShell v-model="page"', '<AuthorizationGate :ctx="ctx" @ready="authorizationReady"><AppShell v-model="page"')
+                .replace('onMounted(async()=>{\n props.ctx.reopen(()=>{if(!disposed) void refresh()})\n await refresh()', 'async function authorizationReady(){\n await refresh()')
+                .replace('})\nonUnmounted', '}\nonMounted(()=>{if(!props.ctx.authorization){props.ctx.reopen(()=>{if(!disposed) void refresh()});void authorizationReady()}})\nonUnmounted')
+                .replace('</AppShell>', '</AppShell></AuthorizationGate>'));
+        }
+        for (const entry of ["main.ts", "sdk-main.ts"]) {
+            const main = join(targetDir, "frontend/src", entry);
+            writeFileSync(main, readFileSync(main, "utf8").replace('{mount: typeof mount}', '{mount: typeof mount; authorizationUI?: boolean}').replace('{mount}', '{mount, authorizationUI: true}'));
+        }
+        for (const file of ["apps.test.ts", "nas-ui.test.ts", "shell-ui.test.ts", "shell-sdk.test.ts", "picker-wire.test.ts"]) {
+            const test = join(targetDir, "frontend/test", file);
+            const source = readFileSync(test, "utf8");
+            writeFileSync(test, source + "\n// Test the application surface independently; authorization has its own contract suite.\nvi.mock('../src/authorization/AuthorizationGate.vue',()=>({default:{template:'<slot />'}}))\n");
+        }
+    }
+    if (ui !== "vue")
+        rmSync(join(targetDir, "frontend"), { recursive: true, force: true });
     if (options.background) {
         const manifest = join(targetDir, "dsm-package.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nbackground:\n  worker: sha256-v1\n");

package/dist/standalone/authorization-window.d.ts

@@ -0,0 +1,2 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/authorization-window.js

@@ -0,0 +1,28 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options) {
+  var busy = null;
+  function fail(code) { var error = new Error(code); error.code = code; return error; }
+  function status() { return options.call("authorization.status").then(function (d) {
+    if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
+    return d;
+  }); }
+  function plan(method) { return options.call(method).then(function (p) {
+    if (!p || p.command !== "authorization" || p.schema_version !== 1 || p.phase !== "plan" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail("authorization_bad_response");
+    var seen = {};
+    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
+    return p;
+  }); }
+  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
+  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
+    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op) : null; });
+  }); },Promise.resolve()); }
+  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
+    return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); },revoke:function () { return exclusive(function () {
+    return plan("authorization.revoke").then(function (p) {
+      if (p.withdraw === true && typeof options.withdraw !== "function") throw fail("authorization_bad_response");
+      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize(["helper_disable"],true) : Promise.resolve();
+      return disabled.then(function () { return p.purge === true ? authorize(["helper_purge"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });
+    }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); }};
+}`;

package/dist/standalone/authorization.d.ts

@@ -0,0 +1,48 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+import type { CommandRunner } from './build.js';
+import { type RootOp } from './root-ops.js';
+import type { StandaloneManifest } from './manifest.js';
+export interface PinnedFile {
+    path: string;
+    size: number;
+    sha256: string;
+}
+export interface AuthorizationInventory {
+    schema: 2;
+    package: string;
+    version: string;
+    arch: string;
+    operations: RootOp[];
+    files: PinnedFile[];
+    digest: string;
+}
+export interface AuthorizationArtifact {
+    binary: string;
+    inventory: AuthorizationInventory;
+    bootstrapSha256: string;
+    ops: RootOp[];
+}
+export declare function authorizationInventory(m: {
+    package: string;
+    spkVersion: string;
+    rootOps?: RootOp[];
+}, arch: string, files: PinnedFile[]): AuthorizationInventory;
+export declare function bootstrapOps(m: {
+    package: string;
+    spkVersion: string;
+    rootOps?: RootOp[];
+}, pin: string): RootOp[];
+export declare function authorizationPlan(a: AuthorizationArtifact, m: {
+    package: string;
+    spkVersion: string;
+}): {
+    schema: number;
+    package: string;
+    version: string;
+    bootstrapSha256: string;
+    inventory: AuthorizationInventory;
+    tasks: import("./root-window.js").RootTask[];
+};
+export declare function buildAuthorization(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): AuthorizationArtifact | undefined;
+/** Archive consistency, not publisher authenticity or device runtime certification. */
+export declare function inspectAuthorization(dir: string, pkg: string, version: string): string[];

package/dist/standalone/authorization.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { renderRootTaskScript } from './root-ops.js';
+import { rootTasks } from './root-window.js';
+import { StandaloneBuildError } from './spk.js';
+import { assertHelperTaskBudget } from './helper.js';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function authorizationInventory(m, arch, files) {
+    const base = { schema: 2, package: m.package, version: m.spkVersion, arch, operations: m.rootOps ?? [], files: [...files].sort((a, b) => a.path.localeCompare(b.path, 'en')) };
+    return { ...base, digest: hash(JSON.stringify(base)) };
+}
+export function bootstrapOps(m, pin) {
+    if (!/^[a-f0-9]{64}$/.test(pin))
+        throw new StandaloneBuildError('AUTHORIZATION_PIN_REQUIRED', 'bootstrap SHA-256 pin required');
+    return (m.rootOps ?? []).map(op => ({ name: op.name, protectedOutput: true, exposeOutput: op.protectedOutput !== true, body: `#!/bin/sh
+set -eu
+umask 077
+[ "$(id -u)" = 0 ]
+info=/var/packages/${m.package}/INFO
+[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
+grep -Fqx 'version="${m.spkVersion}"' "$info"
+for p in /var /var/lib; do
+ [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
+ mode=$(stat -c %a "$p"); [ "$((0$mode & 0022))" = 0 ]
+done
+s=/var/lib/synopkgland-auth-${m.package}
+[ ! -L "$s" ]
+if [ ! -e "$s" ]; then mkdir -m 0700 "$s"; fi
+[ -d "$s" ] && [ "$(stat -c %u:%a "$s")" = 0:700 ]
+tmp=$(mktemp "$s/.bootstrap.XXXXXX")
+trap 'rm -f "$tmp"; rmdir "$s" 2>/dev/null || :' EXIT HUP INT TERM
+dd if=/var/packages/${m.package}/target/authorization/bootstrap of="$tmp" bs=65536 count=1025 2>/dev/null
+[ "$(stat -c %s "$tmp")" -le 67108864 ]
+chmod 0700 "$tmp"
+[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${pin}' ]
+"$tmp" '${op.name}'
+` }));
+}
+export function authorizationPlan(a, m) {
+    return { schema: 2, package: m.package, version: m.spkVersion, bootstrapSha256: a.bootstrapSha256, inventory: a.inventory, tasks: rootTasks({ ...m, rootOps: a.ops }) };
+}
+export function buildAuthorization(m, arch, work, run) {
+    if (m.privilege !== 'root')
+        return undefined;
+    if (m.backend.kind !== 'go')
+        throw new StandaloneBuildError('AUTHORIZATION_GO_REQUIRED', 'root authorization requires the native-Go CGI template');
+    const files = [];
+    const add = (path, source) => { const bytes = readFileSync(source); files.push({ path, size: bytes.length, sha256: hash(bytes) }); };
+    const walk = (dir) => { for (const name of readdirSync(dir).sort()) {
+        const p = join(dir, name), st = lstatSync(p);
+        if (st.isDirectory())
+            walk(p);
+        else if (st.isFile())
+            add('ui/app/' + relative(m.ui.dir, p).split('\\').join('/'), p);
+        else
+            throw new StandaloneBuildError('AUTHORIZATION_PAYLOAD_UNSAFE', 'UI inventory requires regular files');
+    } };
+    walk(m.ui.dir);
+    // Helper bodies already contain the exact helper digest; worker payloads are
+    // bound by its compiled registry. UI bytes are additionally checked at launch.
+    const inventory = authorizationInventory(m, arch, files);
+    const dir = join(work, 'authorization-' + arch);
+    mkdirSync(dir);
+    const source = readFileSync(new URL('../../templates/_authorization/main.go', import.meta.url), 'utf8');
+    writeFileSync(join(dir, 'main.go'), source);
+    const binary = join(work, 'bootstrap-' + arch);
+    const compiled = JSON.stringify({ ...inventory, operations: inventory.operations.map(op => ({ ...op, body: op.body })) });
+    const result = run('go', ['build', '-trimpath', '-buildvcs=false', '-ldflags', `-s -w -buildid= -X 'main.inventoryBase64=${Buffer.from(compiled).toString('base64')}'`, '-o', binary, 'main.go'], { cwd: dir, env: { ...process.env, CGO_ENABLED: '0', GOOS: 'linux', GOARCH: arch === 'x86_64' ? 'amd64' : 'arm64' } });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError('AUTHORIZATION_BUILD_FAILED', result.stderr);
+    const bootstrapSha256 = hash(readFileSync(binary));
+    const ops = bootstrapOps(m, bootstrapSha256);
+    ops.forEach(op => assertHelperTaskBudget(renderRootTaskScript(m, op)));
+    return { binary, inventory, bootstrapSha256, ops };
+}
+/** Archive consistency, not publisher authenticity or device runtime certification. */
+export function inspectAuthorization(dir, pkg, version) {
+    if (!existsSync(join(dir, 'authorization/manifest.json')))
+        return ['root authorization manifest missing'];
+    try {
+        const plan = JSON.parse(readFileSync(join(dir, 'authorization/manifest.json'), 'utf8'));
+        if (plan.schema !== 2 || plan.package !== pkg || plan.version !== version || !/^[a-f0-9]{64}$/.test(plan.bootstrapSha256))
+            throw Error();
+        const bytes = readFileSync(join(dir, 'authorization/bootstrap'));
+        if (hash(bytes) !== plan.bootstrapSha256 || !bytes.includes(Buffer.from(Buffer.from(JSON.stringify(plan.inventory)).toString('base64'))))
+            throw Error();
+        const inventory = authorizationInventory({ package: pkg, spkVersion: version, rootOps: plan.inventory.operations }, plan.inventory.arch, plan.inventory.files);
+        if (JSON.stringify(inventory) !== JSON.stringify(plan.inventory))
+            throw Error();
+        if (JSON.stringify(plan.tasks) !== JSON.stringify(rootTasks({ package: pkg, spkVersion: version, rootOps: bootstrapOps({ package: pkg, spkVersion: version, rootOps: inventory.operations }, plan.bootstrapSha256) })))
+            throw Error();
+        const seen = new Set();
+        for (const f of inventory.files) {
+            if (!/^ui\/app\/(?!.*(?:^|\/)\.\.(?:\/|$))[^\x00\\]+$/.test(f.path) || seen.has(f.path))
+                throw Error();
+            seen.add(f.path);
+            const b = readFileSync(join(dir, f.path));
+            if (b.length !== f.size || hash(b) !== f.sha256)
+                throw Error();
+        }
+        const cgi = readFileSync(join(dir, 'ui/cgi/api.cgi'));
+        if (!cgi.includes(Buffer.from(Buffer.from(JSON.stringify(plan)).toString('base64'))))
+            throw Error();
+        const windows = readdirSync(join(dir, 'ui')).filter(f => /^window-\d+\.js$/.test(f));
+        if (windows.length !== 1)
+            throw Error();
+        const window = readFileSync(join(dir, 'ui', windows[0]), 'utf8');
+        if (!window.includes(JSON.stringify(plan.tasks)))
+            throw Error();
+        return [];
+    }
+    catch {
+        return ['root authorization bootstrap pin, inventory, CGI or task binding invalid'];
+    }
+}

package/dist/standalone/build.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
@@ -8,6 +8,7 @@ import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildHelper } from "./helper.js";
 import { buildDaemonControl } from "./daemon.js";
+import { buildAuthorization, authorizationPlan } from "./authorization.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
@@ -61,16 +62,26 @@ export async function buildStandalone(options) {
                 if (problem)
                     throw new StandaloneBuildError(problem.code, problem.message);
             }
-            const cgiPath = backendFor(manifest, arch, work, run, helper);
+            const operationsManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
+            const authorization = buildAuthorization(operationsManifest, arch, work, run);
+            if (authorization) {
+                const problem = checkCgiBinary(work, authorization.binary, arch);
+                if (problem)
+                    throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const cgiPath = backendFor(manifest, arch, work, run, helper, authorization);
             const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
             if (problem) {
                 throw new StandaloneBuildError(problem.code, problem.message);
             }
+            if (authorization && !readFileSync(cgiPath).includes(Buffer.from(JSON.stringify(authorizationPlan(authorization, manifest))).toString("base64"))) {
+                throw new StandaloneBuildError("AUTHORIZATION_CGI_REQUIRED", "root CGI must contain its compiled authorization plan; regenerate the root template adapter");
+            }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const builtManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
+            const builtManifest = authorization ? { ...manifest, rootOps: authorization.ops } : operationsManifest;
             const backgroundWorker = buildBackgroundWorker(manifest, arch, work, run);
-            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper, daemonControl, backgroundWorker });
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper, daemonControl, backgroundWorker, authorization });
             outputs.push(outputPath);
         }
         return { outputs };
@@ -93,7 +104,7 @@ function buildUi(manifest, run) {
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
-function backendFor(manifest, arch, work, run, helper) {
+function backendFor(manifest, arch, work, run, helper, authorization) {
     const backend = manifest.backend;
     if (backend.kind === "binary") {
         return backend.files[arch];
@@ -106,6 +117,7 @@ function backendFor(manifest, arch, work, run, helper) {
         `-X main.packageID=${manifest.package}`,
         `-X main.version=${manifest.spkVersion}`,
         ...(helper ? [`-X 'main.helperInventory=${JSON.stringify(helper.inventory)}'`] : []),
+        ...(authorization ? [`-X 'main.rootAuthorization=${Buffer.from(JSON.stringify(authorizationPlan(authorization, manifest))).toString('base64')}'`] : []),
         // Integration without a helper: the CGI serves its package-account features itself.
         ...(manifest.integration && !helper ? ["-X main.integrationMode=package"] : []),
         ...(manifest.fileStation ? [`-X main.fileStation=${manifest.fileStation}`] : []),
@@ -115,7 +127,7 @@ function backendFor(manifest, arch, work, run, helper) {
         env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
     });
     if (result.missing) {
-        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.24 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
     }
     if (result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);

package/dist/standalone/dsm-window.js

@@ -1,3 +1,4 @@
+import { AUTHORIZATION_RUNTIME } from "./authorization-window.js";
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
 import { ROOT_MESSAGES } from "./root-messages.js";
@@ -180,15 +181,17 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
         var i18n = ${ns}.createI18n(lang, ${ns}.messages);
         me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });
         root.lang = i18n.locale;
+        if (app.authorizationUI && me.body) { var panels = me.body.dom.querySelector(".dsmapp-rootpanels"); if (panels) panels.hidden = true; }
         try {
           me.mounted = app.mount(root, {
+          displayName: ${JSON.stringify(manifest.displayname)},
           call: ${ns}.call,
           reopen: me.reopenEvents.subscribe,
           host: me.hostAccess,
           appWindow: me,
           lang: lang,
           locale: i18n.locale,
-          t: i18n.t${root ? ",\n          root: access" : ""}
+          t: i18n.t${root ? `,\n          root: access,\n          authorization: ${ns}.createAuthorizationAccess({root: access, call: ${ns}.call, tasks: ${ns}.rootTasks, user: session})` : ""}
           }) || {};
         } catch (error) {
           me.hostAccess.dispose();
@@ -239,6 +242,10 @@ const ROOT_PANEL_CSS = [
 function renderRootParts(ns, manifest) {
     return {
         definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest))};
+${ns}.createAuthorizationAccess = (function () {
+${AUTHORIZATION_RUNTIME}
+return createAuthorizationAccess;
+})();
 ${ns}.rootMessages = ${JSON.stringify(ROOT_MESSAGES)};
 ${ns}.createRootAccess = (function () {
 ${ROOT_RUNTIME}

package/dist/standalone/helper.js

@@ -57,7 +57,7 @@ export function assertHelperTaskBudget(script, metadata = JSON.stringify({ scrip
         throw new StandaloneBuildError("HELPER_METADATA_TOO_LARGE", "helper scheduler metadata 超過 8191 bytes 有界限制。");
 }
 export function helperOps(m, inventory) {
-    return ["enable", "recover", "teardown", "disable", "repair"].map(action => {
+    return ["enable", "recover", "teardown", "disable", "repair", ...(m.privilege === 'root' ? ['purge'] : [])].map(action => {
         const op = { name: `helper_${action}`, protectedOutput: true, body: `#!/bin/sh
 set -eu
 umask 077

package/dist/standalone/inspect-helper.js

@@ -1,3 +1,4 @@
+import { bootstrapOps } from "./authorization.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as tar from "tar";
@@ -18,7 +19,7 @@ export async function inspectHelper(dir, info, findings, daemon = false) {
             // Enumerate candidates to reject extras; only the INFO-derived exact path is read.
             if (/^ui\/window-[^/]*\.js$/.test(path))
                 windows.push(path);
-            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
+            if (entry.type !== "File" || !(path.startsWith("integration/workers/") || ["authorization/manifest.json", "integration/helper", "integration/inventory.json", "integration/workers.json", "ui/cgi/api.cgi", windowPath].includes(path)))
                 return;
             const limit = ["integration/helper", "ui/cgi/api.cgi"].includes(path) ? 64 * 1024 * 1024 : 1024 * 1024;
             if (files.has(path) || entry.size > limit) {
@@ -75,7 +76,16 @@ export async function inspectHelper(dir, info, findings, daemon = false) {
             throw new Error("unregistered worker");
         const manifest = { package: i.package, spkVersion: i.version, privilege: "root", integration: { protocol: i.protocol, workers: {} } };
         const tasks = JSON.parse(/\.rootTasks = (\[[^\n]+\]);/.exec(bytes(windowPath).toString("utf8"))?.[1] ?? "null");
-        const expected = rootTasks({ ...manifest, rootOps: helperOps(manifest, i) });
+        const originalOps = helperOps(manifest, i);
+        let expected = rootTasks({ ...manifest, rootOps: originalOps });
+        // Existing CLI 0.5 archives have inline hash-pinned helper tasks. New
+        // bootstrap archives carry an additional independently inspected inventory.
+        if (files.has("authorization/manifest.json")) {
+            const plan = JSON.parse(bytes("authorization/manifest.json").toString("utf8"));
+            if (JSON.stringify(plan.inventory.operations.filter((op) => op.name.startsWith("helper_"))) !== JSON.stringify(originalOps))
+                throw new Error("bootstrap helper binding mismatch");
+            expected = rootTasks({ ...manifest, rootOps: bootstrapOps({ ...manifest, rootOps: originalOps }, plan.bootstrapSha256) });
+        }
         if (!Array.isArray(tasks) || JSON.stringify(tasks.filter(t => t.op?.startsWith("helper_"))) !== JSON.stringify(expected))
             throw new Error("approved task mismatch");
         // Daemon lifecycle is verified separately with the complete daemon config.

package/dist/standalone/inspect-spk.js

@@ -1,3 +1,4 @@
+import { inspectAuthorization } from "./authorization.js";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -77,6 +78,16 @@ export async function inspectSpk(spkPath, expectedKind) {
         else if (integrationPaths.some(path => path !== "integration/identity/app.mjs")) {
             findings.push("integration 沒有 helper 時只可附 integration/identity/app.mjs");
         }
+        if (info.sdk_root_authorization === "2" || [...paths].some(path => path.startsWith("authorization/"))) {
+            if (info.sdk_root_authorization !== "2")
+                findings.push("root authorization INFO marker missing");
+            const authDir = join(dir, "authorization-inspection");
+            mkdirSync(authDir);
+            await tar.x({ file: join(dir, "package.tgz"), cwd: authDir });
+            findings.push(...inspectAuthorization(authDir, info.package, info.version));
+            if (payload.find(p => p.path === "authorization/bootstrap")?.mode !== "0755")
+                findings.push("authorization bootstrap must be executable");
+        }
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (kind === "native-go" && !cgiEntry) {
             findings.push(`payload 沒有 ${CGI_PAYLOAD_PATH}`);

package/dist/standalone/lifecycle-helper.d.ts

@@ -1,2 +1,2 @@
 /** Non-privileged management veto shared by the generated package hooks. */
-export declare function renderHelperStoppedCheck(packageId: string): string;
+export declare function renderHelperStoppedCheck(packageId: string, revoke?: boolean): string;

package/dist/standalone/lifecycle-helper.js

@@ -1,6 +1,6 @@
 /** Non-privileged management veto shared by the generated package hooks. */
-export function renderHelperStoppedCheck(packageId) {
-    return `/var/packages/${packageId}/target/integration/helper check-stopped || {
+export function renderHelperStoppedCheck(packageId, revoke = false) {
+    return `${revoke ? `/var/packages/${packageId}/target/integration/helper revoke && ` : ''}/var/packages/${packageId}/target/integration/helper check-stopped || {
   message='Run the approved helper_teardown or helper_disable operation before stopping, upgrading or uninstalling.'
   printf '%s\\n' "$message" >&2
   if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then

package/dist/standalone/lifecycle.d.ts

@@ -1,3 +1,3 @@
 import type { StandaloneManifest } from "./manifest.js";
-/** Non-privileged hooks: precheck gates DSM management; no hook tears down root. */
+/** Package-UID hooks: root auth withdraws via the trusted socket, then retains the stopped veto. */
 export declare function renderStandaloneScript(name: string, manifest: StandaloneManifest): string;

package/dist/standalone/lifecycle.js

@@ -3,7 +3,7 @@ import { renderHelperStoppedCheck } from "./lifecycle-helper.js";
 import { renderBackgroundControl } from "./background.js";
 import { renderPackagePostuninst } from "../build-spk/native-lifecycle.js";
 import { renderSharedFolderScript } from "./shared-folder.js";
-/** Non-privileged hooks: precheck gates DSM management; no hook tears down root. */
+/** Package-UID hooks: root auth withdraws via the trusted socket, then retains the stopped veto. */
 export function renderStandaloneScript(name, manifest) {
     if (name === "postuninst")
         return renderPackagePostuninst(manifest.package);
@@ -14,7 +14,7 @@ export function renderStandaloneScript(name, manifest) {
     if (manifest.background && name === "start-stop-status")
         return renderBackgroundControl(manifest.package);
     if (hasHelper(manifest) && ["preupgrade", "preuninst", "start-stop-status"].includes(name)) {
-        const check = renderHelperStoppedCheck(manifest.package);
+        const check = renderHelperStoppedCheck(manifest.package, manifest.privilege === 'root');
         if (name !== "start-stop-status")
             return `#!/bin/sh\n${check}`;
         return `#!/bin/sh
@@ -44,7 +44,7 @@ function renderDaemonScript(name, manifest) {
     const pkg = manifest.package;
     const control = `"/var/packages/${pkg}/target/daemon/control"`;
     const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
-    const check = hasHelper(manifest) ? renderHelperStoppedCheck(pkg) : "";
+    const check = hasHelper(manifest) ? renderHelperStoppedCheck(pkg, manifest.privilege === 'root') : "";
     if (["preupgrade", "preuninst"].includes(name))
         return `#!/bin/sh\n${check}exec ${control} ${name === "preuninst" && manifest.daemon?.uninstall_args ? "uninstall" : "stop"} ${paths}\n`;
     if (name !== "start-stop-status")

package/dist/standalone/root-ops.d.ts

@@ -11,6 +11,8 @@ export interface RootOp {
     body: string;
     /** Internal generator flag for protected helper control output. */
     protectedOutput?: boolean;
+    /** Bootstrap wraps public output in a protected directory without hiding it. */
+    exposeOutput?: boolean;
 }
 export type RootOpsResult = {
     ok: true;