@synopackageland/cli 0.5.0 → 0.6.0

package/dist/host/types.d.ts

@@ -7,6 +7,12 @@ export interface DeployIdentity {
     displayname: string;
     developmentInstance: boolean;
 }
+export interface RootTaskInventory {
+    unsupported?: boolean;
+    error?: string;
+    tasks: Record<string, unknown>[];
+    total: number;
+}
 export interface NasHost {
     readonly dsmOrigin: string;
     installFromLocalSpk(input: {
@@ -20,6 +26,13 @@ export interface NasHost {
      * undefined when the DSM answer does not map to a family we ship, so the
      * caller refuses instead of guessing.
      */
+    /** Complete DSM scheduler task details; undefined means readback could not be verified. */
+    getRootTaskInventory?(packageIdentity: string): Promise<RootTaskInventory | undefined>;
+    getExecutorStatus?(packageIdentity: string): Promise<{
+        ready: boolean;
+        executor_digest: string;
+        policy_digest: string;
+    } | undefined>;
     getArchFamily?(): Promise<"x86_64" | "aarch64" | undefined>;
     /** List the current logical Shared Folder names using an administrator session. */
     listShareNames?(): Promise<string[]>;

package/dist/index.d.ts

@@ -8,3 +8,4 @@ export { testProject } from "./test-command.js";
 export { buildSpk } from "./build-spk/generator.js";
 export { RecordingComposeRunner } from "./compose/runner.js";
 export type { ValidationError, ValidationResult } from "./types.js";
+export { addCapabilities } from "./add.js";

package/dist/index.js

@@ -6,3 +6,4 @@ export { runDev } from "./dev.js";
 export { testProject } from "./test-command.js";
 export { buildSpk } from "./build-spk/generator.js";
 export { RecordingComposeRunner } from "./compose/runner.js";
+export { addCapabilities } from "./add.js";

package/dist/info.d.ts

@@ -1,16 +1,34 @@
 import type { ProjectRoot } from "./discovery.js";
-import type { NasHost } from "./host/types.js";
+import type { NasHost, RootTaskInventory } from "./host/types.js";
+import type { ExecutorInspection } from "./runtime/executor-inspect.js";
+import type { RootTask } from "./standalone/root-window.js";
+import { type UninstallCleanupItem } from "./runtime/uninstall-cleanup.js";
 export interface ProjectInfoOptions {
     project: ProjectRoot;
     host: NasHost;
     dev?: boolean;
 }
-export declare function projectInfo(options: ProjectInfoOptions): Promise<ProjectInfoResult>;
+export interface CapabilityStatus {
+    name: string;
+    state: "ready" | "needs-admin-approval" | "unsupported" | "blocked";
+    reason: string;
+}
 export interface ProjectInfoResult {
     packageIdentity: string;
     developmentInstance: boolean;
     openUrl?: string;
     readiness?: string;
     installed: boolean;
+    executor?: ExecutorInspection;
+    capabilities: CapabilityStatus[];
+    uninstallCleanup?: UninstallCleanupItem[];
 }
+export declare function projectInfo(options: ProjectInfoOptions): Promise<ProjectInfoResult>;
+/** Same task identity and exact script comparison used by the DSM root window. */
+export declare function classifyRootTasks(expected: RootTask[], inventory?: RootTaskInventory): CapabilityStatus;
+export declare function standaloneInfo(options: {
+    root: string;
+    host: NasHost;
+    dev?: boolean;
+}): Promise<ProjectInfoResult>;
 export declare function formatProjectInfo(info: ProjectInfoResult): string;

package/dist/info.js

@@ -1,6 +1,12 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
 import { loadContract } from "./contract/load.js";
 import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
+import { loadStandaloneManifest, } from "./standalone/manifest.js";
+import { inspectSpk } from "./standalone/inspect-spk.js";
+import { executorPolicy } from "./runtime/executor-policy.js";
+import { uninstallCleanup } from "./runtime/uninstall-cleanup.js";
 export async function projectInfo(options) {
     const identity = resolveDeployIdentity(options.project, { dev: options.dev });
     const remote = await options.host.getInstalledPackageState?.(identity.packageId);
@@ -12,6 +18,138 @@ export async function projectInfo(options) {
         openUrl: appOriginFromContract(options.host.dsmOrigin, contract),
         readiness: remote?.status ?? (installed ? "UNKNOWN" : "NOT_INSTALLED"),
         installed,
+        capabilities: [],
+    };
+}
+/** Same task identity and exact script comparison used by the DSM root window. */
+export function classifyRootTasks(expected, inventory) {
+    const result = (state, reason) => ({ name: "rootOps", state, reason });
+    if (inventory?.unsupported)
+        return result("unsupported", inventory.error ?? "DSM scheduler APIs are unavailable.");
+    if (!inventory || inventory.error ||
+        !Array.isArray(inventory.tasks) ||
+        !Number.isInteger(inventory.total) ||
+        inventory.total !== inventory.tasks.length ||
+        !expected.length)
+        return result("blocked", inventory?.error ?? "Complete scheduler readback is unavailable; open the DSM package UI to verify approval.");
+    let approval = false;
+    for (const task of expected) {
+        const named = inventory.tasks.filter((record) => record && record.name === task.name);
+        if (!named.length) {
+            approval = true;
+            continue;
+        }
+        if (named.length !== 1)
+            return result("blocked", `Conflicting root tasks: ${task.name}.`);
+        const actual = named[0];
+        const extra = actual.extra;
+        const boot = task.kind === "boot";
+        const script = boot ? actual.operation : extra?.script;
+        const rootOwner = actual.owner === "root" || (boot && actual.owner?.["0"] === "root");
+        if ((!boot && (!["string", "number"].includes(typeof actual.id) || !/^\d+$/.test(String(actual.id)))) ||
+            !rootOwner ||
+            (!boot && (actual.real_owner !== "root" || actual.enable !== false || actual.type !== "script")) ||
+            (boot && (actual.enable !== true || (actual.event ?? actual.trigger_event) !== "bootup" || actual.operation_type !== "script")) ||
+            typeof script !== "string")
+            return result("blocked", `Root task ownership or definition cannot be verified: ${task.name}.`);
+        if (script === task.script)
+            continue;
+        if (script.startsWith(task.header))
+            approval = true;
+        else
+            return result("blocked", `Root task conflicts with the pinned definition: ${task.name}.`);
+    }
+    return approval
+        ? result("needs-admin-approval", "Approve missing or outdated root tasks in the DSM package UI.")
+        : result("ready", "Boot and control tasks match the executor and policy digests. Executor health must be checked in the App window.");
+}
+async function rootCapability(m, host, version) {
+    const blocked = (reason) => ({
+        name: "rootOps",
+        state: "blocked",
+        reason,
+    });
+    if (!version)
+        return blocked("Installed package version cannot be matched to the local executor artifact.");
+    let arch;
+    try {
+        arch = await host.getArchFamily?.();
+    }
+    catch {
+        return blocked("NAS architecture readback failed; root readiness cannot be verified.");
+    }
+    if (!arch || !m.arches.includes(arch))
+        return blocked("NAS architecture cannot be matched to the local executor SPK artifact.");
+    const spk = join(m.root, "dist", `${m.package}-${version}-${arch}.spk`);
+    if (!existsSync(spk))
+        return blocked("Built executor SPK artifact is unavailable; build this installed version first.");
+    try {
+        const inspected = await inspectSpk(spk);
+        if (inspected.findings.length ||
+            inspected.package !== m.package ||
+            inspected.version !== version)
+            return blocked("Executor SPK artifact failed inspection or identity checks.");
+        if (!inspected.executor || JSON.stringify(inspected.executor.policy) !== JSON.stringify(executorPolicy(m)))
+            return blocked("Executor policy differs from source; rebuild and deploy before approval.");
+        const inventory = await host.getRootTaskInventory?.(m.package);
+        const classified = classifyRootTasks(inspected.executor.tasks, inventory);
+        const executor = { ...inspected.executor, tasks: inspected.executor.tasks.map(task => {
+                const one = classifyRootTasks([task], inventory);
+                return { ...task, state: one.state === "unsupported" ? "blocked" : one.state };
+            }) };
+        if (classified.state === "ready") {
+            const observed = await host.getExecutorStatus?.(m.package);
+            if (!observed || observed.ready !== true || observed.executor_digest !== executor.executorDigest || observed.policy_digest !== executor.policyDigest)
+                return { ...classified, executor, state: "blocked", reason: "Executor health or digest readback could not be verified." };
+        }
+        return { ...classified, executor };
+    }
+    catch {
+        return blocked("Executor SPK artifact or DSM root task readback could not be verified.");
+    }
+}
+export async function standaloneInfo(options) {
+    if (options.dev)
+        throw Object.assign(new Error("--dev is not supported for native-go/binary; choose a distinct package name at init"), { code: "DEVELOPMENT_INSTANCE_UNSUPPORTED" });
+    const loaded = loadStandaloneManifest(options.root);
+    if (!loaded.ok)
+        throw Object.assign(new Error(loaded.errors.map((e) => e.message).join("\n")), { code: loaded.errors[0].code });
+    const m = loaded.manifest;
+    const remote = await options.host.getInstalledPackageState?.(m.package);
+    const installed = await options.host.isPackageInstalled(m.package);
+    const capabilities = [];
+    let executor;
+    for (const name of ["files", "jobs", "identity", "rootOps", "delegate"]) {
+        if (!m.capabilities[name])
+            continue;
+        if (!installed)
+            capabilities.push({
+                name,
+                state: "blocked",
+                reason: "Package is not installed; deploy first.",
+            });
+        else if (name === "rootOps" || name === "delegate") {
+            const result = await rootCapability(m, options.host, remote?.version ?? (await options.host.getInstalledPackageVersion?.(m.package)));
+            executor = result.executor;
+            const { executor: ignored, ...capability } = result;
+            capabilities.push({ ...capability, name });
+        }
+        else
+            capabilities.push({
+                name,
+                state: "ready",
+                reason: "Installed package supports this capability without administrator approval.",
+            });
+    }
+    return {
+        packageIdentity: m.package,
+        developmentInstance: false,
+        installed,
+        readiness: remote?.status ?? (installed ? "UNKNOWN" : "NOT_INSTALLED"),
+        openUrl: `${options.host.dsmOrigin.replace(/\/$/, "")}/?launchApp=SYNO.SDS.${m.package}.Instance`,
+        capabilities,
+        ...(executor ? { executor } : {}),
+        uninstallCleanup: uninstallCleanup(m.package, Boolean(m.capabilities.rootOps || m.capabilities.delegate)),
     };
 }
 export function formatProjectInfo(info) {
@@ -21,6 +159,8 @@ export function formatProjectInfo(info) {
         `已安裝：${info.installed ? "是" : "否"}`,
         info.openUrl ? `Open URL：${info.openUrl}` : "Open URL：（未設定）",
         info.readiness ? `Readiness：${info.readiness}` : "",
+        ...info.capabilities.map((cap) => `能力 ${cap.name}：${cap.state} — ${cap.reason}`),
+        ...(info.uninstallCleanup ?? []).map(item => `Uninstall cleanup (if needed)：${item.target} — ${item.condition} ${item.action}`),
     ]
         .filter(Boolean)
         .join("\n");

package/dist/init.d.ts

@@ -10,17 +10,9 @@ export interface InitOptions {
     packageId?: string;
     /** Standalone templates: display name (default: from the directory name). */
     displayName?: string;
-    /**
-     * native-go: "root" adds administrator-approved root operations (default
-     * "none"). With --integration, "root" is also what adds the privileged helper.
-     */
-    privilege?: "none" | "root";
     ui?: "plain" | "vue";
-    integration?: "go" | "better-auth";
-    /** native-go --ui vue: package-user background jobs (systemd user unit + sha256-v1 worker). */
-    background?: boolean;
-    /** native-go: interactive File Station routes through each caller's own DSM session, run by the package account. */
-    fileStation?: boolean;
+    with?: string[];
+    from?: string;
     /** native-go: `install.sharedFolder` (select from the NAS, or create one). key defaults to "shared", permission to "rw". */
     sharedFolder?: {
         mode: "select" | "create";
@@ -28,10 +20,6 @@ export interface InitOptions {
         key?: string;
         permission?: "ro" | "rw";
     };
-    /** Helper inventory protocol (needs privilege root); protocol 2 still refuses NAS data. */
-    integrationProtocol?: 1 | 2;
-    /** Protocol 2 policy (needs privilege root); unavailable adapters still refuse data. */
-    dataAccess?: "unavailable" | "relaxed";
 }
 /**
  * Copy one template tree into a project. A template directory may carry a local

package/dist/init.js

@@ -1,22 +1,19 @@
+import { spawnSync } from "node:child_process";
+import { parse, stringify } from "yaml";
+import { capabilityNames, capabilitySettings } from "./capabilities.js";
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, join, relative } from "node:path";
 import { templatesRoot } from "./template-paths.js";
 import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
 import { readSharedFolder } from "./standalone/shared-folder.js";
 const TEMPLATE_NAMES = [
-    "hello-web",
-    "hello-web-page",
-    "hello-files",
-    "compose-import",
+    "compose",
     "binary",
     "native-go",
 ];
 /** Templates whose App runs through the DSM docker-project resource worker. */
 const CONTAINER_TEMPLATES = [
-    "hello-web",
-    "hello-web-page",
-    "hello-files",
-    "compose-import",
+    "compose",
 ];
 /** The container templates need DSM 7.2.1 or later; native-go and binary need 7.1. */
 export function isContainerTemplate(template) {
@@ -29,18 +26,18 @@ export function listTemplates() {
     return [...TEMPLATE_NAMES];
 }
 /**
- * native-go --privilege root: files laid over the native-go template, and the
- * files they replace. An integration's helper brings its own root tasks, so
- * the whoami example is not added to it.
+ * native-go --with root-ops: files laid over the native-go template, and the
+ * files they replace.
  */
-const ROOT_OVERLAY = "native-go-root";
+const ROOT_OVERLAY = "native-go-root-ops";
 const ROOT_REPLACED = ["backend/internal/app/root_none.go"];
-/** native-go --background: overlay with the routes, the UI panel and the docs. */
-const BACKGROUND_OVERLAY = "native-go-background";
+/** native-go --with jobs: overlay with the routes, the UI panel and the docs. */
+const BACKGROUND_OVERLAY = "native-go-jobs";
 const BACKGROUND_REPLACED = ["backend/internal/app/background_none.go"];
 /** Templates whose identity is filled in at init (placeholders in these files). */
 const SUBSTITUTED = {
     "native-go": ["dsm-package.yaml", "README.md"],
+    "binary": ["dsm-package.yaml", "ui/app.js"],
 };
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 /** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
@@ -59,6 +56,8 @@ function defaultDisplayName(dir) {
 function templateFiles(root, dir = root) {
     return readdirSync(dir).flatMap((name) => {
         const path = join(dir, name);
+        if (isTemplateBuildArtifact(path))
+            return [];
         if (statSync(path).isDirectory()) {
             return isTemplateBuildArtifact(path) ? [] : templateFiles(root, path);
         }
@@ -82,9 +81,20 @@ export function copyTemplateTree(source, target) {
 }
 function isTemplateBuildArtifact(path) {
     const name = basename(path);
-    return name === "node_modules" || name === "dist";
+    return name === "node_modules" || name === "dist" || name === ".go-results.json";
 }
 export function initFromTemplate(template, targetDir, options = {}) {
+    if (!isTemplateName(template))
+        throw new Error(`[INIT_TEMPLATE_INVALID] 未知模板：${template}`);
+    const caps = capabilityNames(options.with ?? []);
+    if (caps.includes("login") && resolvedUi(template, options) === "plain")
+        throw new Error("[CAPABILITY_COMBINATION_INVALID] login 需要獨立登入頁；plain UI 不支援，請改用 --ui vue。");
+    if (options.from && template !== "compose")
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --from 只適用於 compose。");
+    if (caps.length && template !== "native-go")
+        throw new Error("[CAPABILITY_UNSUPPORTED] binary／compose 不支援 --with 能力。");
+    const background = caps.includes("jobs") || caps.includes("delegate");
+    const executor = caps.includes("root-ops") || caps.includes("delegate");
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
         throw new Error(`找不到模板：${template}`);
@@ -95,24 +105,24 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     const substitutions = substitutionsFor(template, targetDir, options);
     const ui = resolvedUi(template, options);
-    const privilege = options.privilege ?? "none";
-    if (privilege === "root" && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
+    const rootExample = caps.includes("root-ops");
+    if (rootExample && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
         throw new Error(`[MIN_DSM_INVALID] root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    const rootExample = privilege === "root" && !options.integration;
     const overlays = [
         ...(rootExample ? [ROOT_OVERLAY] : []),
         ...(ui === "vue" ? ["native-go-vue"] : []),
-        ...(options.background ? [BACKGROUND_OVERLAY] : []),
-        ...(options.integration ? ["native-go-integration"] : []),
-        ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
+        ...(background ? [BACKGROUND_OVERLAY] : []),
+        ...(caps.includes("login") && existsSync(join(templatesRoot(), "native-go-identity")) ? ["native-go-identity"] : []),
+        ...(caps.includes("files") && existsSync(join(templatesRoot(), "native-go-files")) ? ["native-go-files"] : []),
+        ...(caps.includes("delegate") ? ["native-go-delegate"] : []),
     ].map(name => join(templatesRoot(), name));
     // Shared legal resources also live in the CLI package; only the template
     // terms are an unconditional part of a generated project.
     const shared = join(templatesRoot(), "_shared");
-    const files = [...templateFiles(source), "LICENSES/TEMPLATE.txt", ...overlays.flatMap(root => templateFiles(root)),
-        ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : []),
-        ...(options.integration === "better-auth" ? ["node/third-party-notices.mjs", ...templateFiles(join(shared, 'notice-overrides')).map(file => `node/notice-overrides/${file}`)] : [])];
+    const sharedFiles = ["LICENSES/TEMPLATE.txt", "AGENTS.md", "CLAUDE.md"];
+    const files = [...templateFiles(source), ...sharedFiles, ...overlays.flatMap(root => templateFiles(root)),
+        ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
@@ -120,17 +130,28 @@ export function initFromTemplate(template, targetDir, options = {}) {
     mkdirSync(targetDir, { recursive: true });
     copyTemplateTree(source, targetDir);
     mkdirSync(join(targetDir, "LICENSES"), { recursive: true });
-    cpSync(join(shared, "LICENSES/TEMPLATE.txt"), join(targetDir, "LICENSES/TEMPLATE.txt"));
+    for (const file of sharedFiles)
+        cpSync(join(shared, file), join(targetDir, file));
     for (const overlay of overlays)
         copyTemplateTree(overlay, targetDir);
-    for (const dir of [...(ui === "vue" ? ["frontend"] : []), ...(options.integration === "better-auth" ? ["node"] : [])]) {
+    for (const dir of (ui === "vue" ? ["frontend"] : [])) {
         cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
     }
-    if (options.integration === "better-auth")
-        cpSync(join(shared, 'notice-overrides'), join(targetDir, 'node/notice-overrides'), { recursive: true });
     if (rootExample)
         ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
-    if (options.background)
+    if (caps.includes("delegate") && !rootExample) {
+        cpSync(join(templatesRoot(), ROOT_OVERLAY, "backend/internal/app/executor.go"), join(targetDir, "backend/internal/app/executor.go"));
+        cpSync(join(templatesRoot(), ROOT_OVERLAY, "backend/internal/app/executor_test.go"), join(targetDir, "backend/internal/app/executor_test.go"));
+        ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file), { force: true }));
+    }
+    if (caps.includes("delegate")) {
+        rmSync(join(targetDir, "backend/internal/app/delegate_none.go"));
+        const path = join(targetDir, "backend/internal/api/permissions.json");
+        const policy = JSON.parse(readFileSync(path, "utf8"));
+        policy.methods["app.status"] = "authenticated";
+        writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
+    }
+    if (background)
         BACKGROUND_REPLACED.forEach(file => rmSync(join(targetDir, file)));
     for (const [from, to] of Object.entries(RENAMED)) {
         if (files.includes(from)) {
@@ -146,7 +167,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
         writeFileSync(path, text);
     }
     if (minDsm) {
-        const manifest = join(targetDir, template === "native-go" ? "dsm-package.yaml" : "synology-app.yaml");
+        const manifest = join(targetDir, template !== "compose" ? "dsm-package.yaml" : "synology-app.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^os_min_ver:.*$/m, `os_min_ver: "${minDsm}"`));
     }
     if (ui === "vue") {
@@ -154,32 +175,51 @@ export function initFromTemplate(template, targetDir, options = {}) {
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
         rmSync(join(targetDir, "ui"), { recursive: true });
     }
-    if (options.background) {
-        const manifest = join(targetDir, "dsm-package.yaml");
-        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nbackground:\n  worker: sha256-v1\n");
+    if (ui !== "vue")
+        rmSync(join(targetDir, "frontend"), { recursive: true, force: true });
+    if (background) {
+        const routeTest = join(targetDir, "backend/internal/app/routes_test.go");
+        writeFileSync(routeTest, readFileSync(routeTest, "utf8").replace('want := ""', 'want := sampleOutcome[r.Method()]'));
+    }
+    if (executor) {
+        const path = join(targetDir, "backend/internal/app/routes_test.go");
+        writeFileSync(path, readFileSync(path, "utf8").replace('if strings.HasPrefix(r.Method(), "jobs.") {', 'if r.Method() == "executor.status" { want = "internal" }\n\t\tif r.Method() == "root.run" { want = "session_required" }\n\t\tif strings.HasPrefix(r.Method(), "jobs.") {'));
+    }
+    if (background && ui === "vue") {
         const app = join(targetDir, "frontend/src/App.vue");
         writeFileSync(app, readFileSync(app, "utf8")
-            .replace("import NasUnavailable from './nas/NasUnavailable.vue'\n", "import NasUnavailable from './nas/NasUnavailable.vue'\nimport BackgroundPanel from './background/BackgroundPanel.vue'\n")
+            .replace("import AppShell from './shell/AppShell.vue'\n", "import AppShell from './shell/AppShell.vue'\nimport BackgroundPanel from './background/BackgroundPanel.vue'\n")
             .replace("   <!-- BACKGROUND_PANEL -->", "   <BackgroundPanel v-if=\"app\" :key=\"app.user\" :ctx=\"ctx\" />"));
     }
-    if (options.fileStation) {
-        const manifest = join(targetDir, "dsm-package.yaml");
-        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nfileStation: session\n");
+    if (template !== "compose") {
+        const path = join(targetDir, "dsm-package.yaml");
+        const raw = parse(readFileSync(path, "utf8"));
+        raw.capabilities = capabilitySettings(caps);
+        writeFileSync(path, stringify(raw));
+    }
+    if (template === "compose" && options.from) {
+        const imported = readFileSync(options.from, "utf8");
+        const compose = parse(imported);
+        if (!compose || typeof compose !== "object" || !compose.services)
+            throw new Error("[INIT_COMPOSE_INVALID] --from 需要包含 services 的 Compose YAML。");
+        writeFileSync(join(targetDir, "compose.yaml"), imported);
+        const path = join(targetDir, "synology-app.yaml");
+        const raw = parse(readFileSync(path, "utf8"));
+        delete raw.install;
+        writeFileSync(path, stringify(raw));
+    }
+    if (template === "binary") {
+        mkdirSync(join(targetDir, "prebuilt"), { recursive: true });
+        for (const [arch, goarch] of [["x86_64", "amd64"], ["aarch64", "arm64"]]) {
+            const result = spawnSync("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", join(targetDir, "prebuilt", `api-${arch}`), "main.go"], { cwd: join(targetDir, "example"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: goarch }, encoding: "utf8" });
+            if (result.error || result.status !== 0)
+                throw new Error(`[INIT_BINARY_BUILD_FAILED] 安裝 Go 並重新 init，或提供自己的靜態 CGI binary。${result.stderr ?? result.error}`);
+        }
     }
     if (options.sharedFolder) {
         const manifest = join(targetDir, "dsm-package.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8") + sharedFolderYaml(options.sharedFolder));
     }
-    if (options.integration === "better-auth")
-        rmSync(join(targetDir, "backend/internal/app/identity_none.go"));
-    if (options.integration) {
-        const mod = join(targetDir, "backend/go.mod");
-        writeFileSync(mod, readFileSync(mod, "utf8").replace("go 1.24", "go 1.25"));
-        const manifest = join(targetDir, "dsm-package.yaml");
-        writeFileSync(manifest, readFileSync(manifest, "utf8") + `\nintegration:\n  protocol: ${options.integrationProtocol ?? 1}\n  workers: {}\n` + (options.integration === "better-auth" ? "  identity: better-auth\n" : "") + (options.dataAccess ? `  dataAccess: ${options.dataAccess}\n` : ""));
-        const routes = join(targetDir, "backend/internal/app/routes.go");
-        writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
-    }
 }
 /** The `install.sharedFolder` block, validated by the same reader build-spk uses. */
 function sharedFolderYaml(options) {
@@ -192,15 +232,9 @@ function sharedFolderYaml(options) {
 }
 function substitutionsFor(template, targetDir, options) {
     const ui = resolvedUi(template, options);
-    if (options.privilege !== undefined && template !== "native-go") {
-        throw new Error("[INIT_PRIVILEGE_UNSUPPORTED] --privilege 只適用於 -t native-go。");
-    }
-    if ((options.ui !== undefined || options.integration !== undefined) && template !== "native-go")
-        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui/--integration 只適用於 native-go。");
-    if (options.background && (template !== "native-go" || ui !== "vue" || options.privilege === "root" || options.integration === "better-auth"))
-        throw new Error("[INIT_BACKGROUND_OPTIONS] --background 只適用於 -t native-go 的 Vue UI（--ui vue，預設；--ui plain 不適用），且不能與 --privilege root 或 --integration better-auth 併用（背景 worker 只以套件帳號執行）；可與 --integration go、--file-station 併用。");
-    if (options.fileStation && (template !== "native-go" || (options.integration !== undefined && options.privilege === "root")))
-        throw new Error("[INIT_FILESTATION_OPTIONS] --file-station 只適用於 -t native-go，且不能與 --privilege root 的 --integration 並用（helper 有自己的 File Station gate）。");
+    const caps = capabilityNames(options.with ?? []);
+    if (options.ui !== undefined && template !== "native-go")
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go。");
     if (options.sharedFolder) {
         if (template !== "native-go")
             throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go。");
@@ -208,20 +242,6 @@ function substitutionsFor(template, targetDir, options) {
     }
     if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
         throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
-    if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
-        throw new Error("[INIT_INTEGRATION_INVALID] --integration 只接受 go 或 better-auth。");
-    if (options.dataAccess !== undefined && (!options.integration || options.integrationProtocol !== 2 || !["unavailable", "relaxed"].includes(options.dataAccess)))
-        throw new Error("[INIT_DATA_ACCESS_INVALID] --data-access 只接受 unavailable 或 relaxed，且需要 --integration 與 --integration-protocol 2；缺少已認證 adapter 仍拒絕 NAS 操作。");
-    if (options.integrationProtocol !== undefined && (!options.integration || ![1, 2].includes(options.integrationProtocol)))
-        throw new Error("[INIT_INTEGRATION_PROTOCOL_INVALID] --integration-protocol 只接受 1 或 2，且需要 --integration；protocol 2 不啟用 NAS data path。");
-    if (options.integration && ui !== "vue")
-        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 Vue UI（--ui vue，預設）；--ui plain 不適用。");
-    if (options.integration && options.privilege !== "root" && (options.integrationProtocol !== undefined || options.dataAccess !== undefined))
-        throw new Error("[INIT_INTEGRATION_HELPER_OPTIONS] --integration-protocol 與 --data-access 屬於 root helper，需要 --privilege root；沒有它時 integration 只以套件帳號執行，不含 helper。");
-    const privilege = options.privilege ?? "none";
-    if (privilege !== "none" && privilege !== "root") {
-        throw new Error(`[INIT_PRIVILEGE_INVALID] --privilege 只接受 none 或 root，收到「${String(privilege)}」。`);
-    }
     if (!SUBSTITUTED[template]) {
         return {};
     }
@@ -233,5 +253,5 @@ function substitutionsFor(template, targetDir, options) {
     if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
         throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
     }
-    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege, __BACKGROUND_ENABLED__: options.background ? "true" : "false" };
+    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __BACKGROUND_ENABLED__: caps.includes("jobs") || caps.includes("delegate") ? "true" : "false" };
 }

package/dist/inspect.js

@@ -54,7 +54,7 @@ function collectRisks(compose, out) {
         return;
     }
     for (const { service, image } of collectUnpinnedImages(compose)) {
-        out.push(`${service}: image ${image} is not pinned by digest (run \`synopkgland images pin\`; build-spk sets force_pull: true, so installs re-resolve the tag)`);
+        out.push(`${service}: image ${image} is not pinned by digest (run \`synopkgland images pin\`; build sets force_pull: true, so installs re-resolve the tag)`);
     }
     for (const [serviceName, service] of Object.entries(compose.services)) {
         if (service.privileged) {

package/dist/log.d.ts

@@ -11,3 +11,8 @@ export interface FollowProjectLogsResult {
     diagnostics?: Record<string, unknown>;
 }
 export declare function followProjectLogs(options: FollowProjectLogsOptions): Promise<FollowProjectLogsResult>;
+export declare function followStandaloneLogs(options: {
+    root: string;
+    host: NasHost;
+    dev?: boolean;
+}): Promise<FollowProjectLogsResult>;

package/dist/log.js

@@ -1,3 +1,4 @@
+import { loadStandaloneManifest } from "./standalone/manifest.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
 export async function followProjectLogs(options) {
     const identity = resolveDeployIdentity(options.project, { dev: options.dev });
@@ -17,3 +18,20 @@ export async function followProjectLogs(options) {
         },
     };
 }
+export async function followStandaloneLogs(options) {
+    if (options.dev)
+        throw new Error("--dev is not supported for native-go/binary; choose a distinct package name at init");
+    const loaded = loadStandaloneManifest(options.root);
+    if (!loaded.ok)
+        throw Object.assign(new Error(loaded.errors.map((error) => error.message).join("\n")), { code: loaded.errors[0].code });
+    const packageIdentity = loaded.manifest.package;
+    if (!(await options.host.isPackageInstalled(packageIdentity)))
+        return { ok: false, lines: [], diagnostics: { code: "NOT_INSTALLED" } };
+    const lines = await options.host.fetchContainerLogs(packageIdentity);
+    const info = await options.host.getInstalledPackageState?.(packageIdentity);
+    return {
+        ok: true,
+        lines,
+        diagnostics: { packageIdentity, readiness: info?.status, redacted: true },
+    };
+}

package/dist/runtime/executor-build.d.ts

@@ -0,0 +1,22 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+import type { CommandRunner } from '../standalone/build.js';
+import type { StandaloneManifest } from '../standalone/manifest.js';
+import { type ExecutorPolicy } from './executor-policy.js';
+import { type ExecutorPins, type ExecutorTask } from './executor-tasks.js';
+export interface ExecutorArtifact extends ExecutorPins {
+    binary: string;
+    lifecycleBinary: string;
+    policy: ExecutorPolicy;
+    policyText: string;
+    tasks: ExecutorTask[];
+    implementation: 'executor';
+}
+export declare function buildExecutor(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): ExecutorArtifact | undefined;
+export declare function executorPlan(a: ExecutorArtifact): {
+    package: string;
+    executorDigest: string;
+    policyDigest: string;
+    policy: ExecutorPolicy;
+    tasks: ExecutorTask[];
+    implementation: "executor";
+};