@synopackageland/cli 0.5.3 → 0.6.0

package/dist/runtime/executor-build.js

@@ -0,0 +1,36 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { templatesRoot } from '../template-paths.js';
+import { StandaloneBuildError } from '../standalone/spk.js';
+import { checkCgiBinary } from '../standalone/binary.js';
+import { executorPolicy, sha256 } from './executor-policy.js';
+import { executorTasks } from './executor-tasks.js';
+export function buildExecutor(m, arch, work, run) {
+    if (!m.capabilities.delegate && !m.capabilities.rootOps)
+        return undefined;
+    const dir = join(work, `executor-${arch}`);
+    mkdirSync(dir);
+    const source = join(templatesRoot(), '_executor');
+    if (!existsSync(join(source, 'go.mod')))
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', 'Executor sources are missing.');
+    const binary = join(dir, 'executor');
+    const result = run('go', ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o', binary, '.'], { cwd: source, env: { ...process.env, CGO_ENABLED: '0', GOOS: 'linux', GOARCH: arch === 'x86_64' ? 'amd64' : 'arm64' } });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${result.stderr}`);
+    const problem = checkCgiBinary(work, binary, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    const lifecycleBinary = join(dir, 'lifecycle');
+    const lifecycleResult = run('go', ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o', lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: { ...process.env, CGO_ENABLED: '0', GOOS: 'linux', GOARCH: arch === 'x86_64' ? 'amd64' : 'arm64' } });
+    if (lifecycleResult.missing || lifecycleResult.status !== 0)
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${lifecycleResult.stderr}`);
+    const lifecycleProblem = checkCgiBinary(work, lifecycleBinary, arch);
+    if (lifecycleProblem)
+        throw new StandaloneBuildError(lifecycleProblem.code, lifecycleProblem.message);
+    const policy = executorPolicy(m), policyText = JSON.stringify(policy) + '\n';
+    const pins = { package: m.package, executorDigest: sha256(readFileSync(binary)), policyDigest: sha256(policyText) };
+    return { ...pins, binary, lifecycleBinary, policy, policyText, tasks: executorTasks(pins), implementation: 'executor' };
+}
+export function executorPlan(a) {
+    return { package: a.package, executorDigest: a.executorDigest, policyDigest: a.policyDigest, policy: a.policy, tasks: a.tasks, implementation: a.implementation };
+}

package/dist/runtime/executor-inspect.d.ts

@@ -0,0 +1,15 @@
+import { type ExecutorPolicy } from './executor-policy.js';
+import { type ExecutorTask } from './executor-tasks.js';
+export interface ExecutorInspection {
+    executorDigest: string;
+    policyDigest: string;
+    policy: ExecutorPolicy;
+    implementation: string;
+    tasks: Array<ExecutorTask & {
+        state: 'unknown' | 'ready' | 'needs-admin-approval' | 'blocked';
+    }>;
+}
+export declare function inspectExecutor(dir: string, pkg: string, arch: string): {
+    executor?: ExecutorInspection;
+    findings: string[];
+};

package/dist/runtime/executor-inspect.js

@@ -0,0 +1,32 @@
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FILE_OPERATIONS, sha256 } from './executor-policy.js';
+import { executorTasks } from './executor-tasks.js';
+import { familyOfArchToken } from '../build-spk/dsm-arch.js';
+import { ELF_MACHINE } from '../standalone/binary.js';
+export function inspectExecutor(dir, pkg, arch) {
+    try {
+        const binary = readFileSync(join(dir, 'executor/executor'));
+        if (!binary.subarray(0, 4).equals(Buffer.from([127, 69, 76, 70])) || binary.readUInt16LE(18) !== (familyOfArchToken(arch.split(' ')[0]) === 'aarch64' ? ELF_MACHINE.aarch64 : ELF_MACHINE.x86_64))
+            throw new Error('Executor ELF architecture mismatch.');
+        const text = readFileSync(join(dir, 'executor/policy.json'), 'utf8');
+        const plan = JSON.parse(readFileSync(join(dir, 'executor/setup.json'), 'utf8'));
+        const policy = JSON.parse(text);
+        const allowed = ['status', 'delegate.create', 'delegate.list', 'delegate.revoke', 'root.run', ...FILE_OPERATIONS];
+        if (policy.v !== 1 || policy.app !== `SYNO.SDS.${pkg}.Instance` || policy.package !== pkg || !Array.isArray(policy.operations) || !policy.operations.includes('status') || policy.operations.some(op => !allowed.includes(op)) || new Set(policy.operations).size !== policy.operations.length || !policy.root || typeof policy.root !== 'object' || Array.isArray(policy.root))
+            throw new Error('Invalid executor policy.');
+        for (const [name, digest] of Object.entries(policy.root)) {
+            const path = `root/${name}.sh`;
+            if (!/^[a-z][a-z0-9_]{0,31}$/.test(name) || !existsSync(join(dir, path)) || !lstatSync(join(dir, path)).isFile() || sha256(readFileSync(join(dir, path))) !== digest)
+                throw new Error('Root script digest mismatch.');
+        }
+        const executorDigest = sha256(binary), policyDigest = sha256(text);
+        const tasks = executorTasks({ package: pkg, executorDigest, policyDigest });
+        if (plan.package !== pkg || plan.executorDigest !== executorDigest || plan.policyDigest !== policyDigest || JSON.stringify(plan.policy) !== JSON.stringify(policy) || JSON.stringify(plan.tasks) !== JSON.stringify(tasks) || plan.implementation !== 'executor')
+            throw new Error('Executor pins or task binding mismatch.');
+        return { executor: { executorDigest, policyDigest, policy, implementation: plan.implementation, tasks: tasks.map(task => ({ ...task, state: 'unknown' })) }, findings: [] };
+    }
+    catch (e) {
+        return { findings: ['Executor inventory invalid: ' + e.message] };
+    }
+}

package/dist/runtime/executor-policy.d.ts

@@ -0,0 +1,25 @@
+import type { RootOp } from '../standalone/root-ops.js';
+export declare const FILE_OPERATIONS: readonly ["files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write"];
+export interface DelegateCapability {
+    operations: string[];
+    scope: string;
+}
+export declare function validDelegate(value: unknown): value is DelegateCapability;
+export declare const sha256: (data: string | Buffer) => string;
+export interface ExecutorPolicy {
+    v: 1;
+    app: string;
+    scope?: string;
+    package: string;
+    operations: string[];
+    root: Record<string, string>;
+}
+/** Version-independent, sorted policy. Only §2.4 operation IDs are admitted. */
+export declare function executorPolicy(m: {
+    package: string;
+    capabilities: {
+        delegate?: DelegateCapability;
+        rootOps?: true;
+    };
+    rootOps?: RootOp[];
+}): ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -0,0 +1,24 @@
+import { createHash } from 'node:crypto';
+export const FILE_OPERATIONS = ['files.list', 'files.info', 'files.createFolder', 'files.checkPermission', 'files.write'];
+export function validDelegate(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const d = value;
+    return Object.keys(d).every(key => ['operations', 'scope'].includes(key)) && Array.isArray(d.operations) && d.operations.length > 0 && new Set(d.operations).size === d.operations.length && d.operations.every(op => FILE_OPERATIONS.includes(op)) && typeof d.scope === 'string' && (d.scope === 'home' || /^shared:[^/\\\x00-\x1f:]+$/.test(d.scope) && d.scope.slice(7).trim() === d.scope.slice(7) && !['.', '..'].includes(d.scope.slice(7)));
+}
+export const sha256 = (data) => createHash('sha256').update(data).digest('hex');
+/** Version-independent, sorted policy. Only §2.4 operation IDs are admitted. */
+export function executorPolicy(m) {
+    if (m.capabilities.delegate && !validDelegate(m.capabilities.delegate))
+        throw new Error('[EXECUTOR_POLICY] Invalid delegate operations or scope.');
+    const operations = ['status'];
+    if (m.capabilities.delegate)
+        operations.push('delegate.create', 'delegate.list', 'delegate.revoke', ...m.capabilities.delegate.operations);
+    const root = {};
+    if (m.capabilities.rootOps) {
+        operations.push('root.run');
+        for (const op of [...m.rootOps ?? []].sort((a, b) => a.name.localeCompare(b.name, 'en')))
+            root[op.name] = sha256(op.body);
+    }
+    return { v: 1, package: m.package, app: `SYNO.SDS.${m.package}.Instance`, ...(m.capabilities.delegate ? { scope: m.capabilities.delegate.scope } : {}), operations: [...new Set(operations)].sort(), root };
+}

package/dist/runtime/executor-tasks.d.ts

@@ -0,0 +1,16 @@
+export interface ExecutorPins {
+    package: string;
+    executorDigest: string;
+    policyDigest: string;
+    spkVersion?: string;
+}
+export interface ExecutorTask {
+    kind: 'boot' | 'control';
+    name: string;
+    header: string;
+    script: string;
+}
+export declare function validateTaskScript(script: string, limit: number): string;
+export declare function executorTasks(pins: ExecutorPins): ExecutorTask[];
+export declare function bootDefinition(task: ExecutorTask): Record<string, unknown>;
+export declare function controlDefinition(task: ExecutorTask): Record<string, unknown>;

package/dist/runtime/executor-tasks.js

@@ -0,0 +1,28 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { templatesRoot } from '../template-paths.js';
+export function validateTaskScript(script, limit) {
+    if (script.includes('%'))
+        throw new Error('[EXECUTOR_TASK_PERCENT] Task scripts must not contain percent characters.');
+    if (Buffer.byteLength(script) > limit)
+        throw new Error('[EXECUTOR_TASK_LENGTH] Task script exceeds DSM byte limit.');
+    return script;
+}
+export function executorTasks(pins) {
+    if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(pins.package))
+        throw new Error('[EXECUTOR_PACKAGE] Invalid package identity.');
+    for (const digest of [pins.executorDigest, pins.policyDigest])
+        if (!/^[a-f0-9]{64}$/.test(digest))
+            throw new Error('[EXECUTOR_DIGEST] Invalid sha256 pin.');
+    return ['boot', 'control'].map(kind => {
+        const script = readFileSync(join(templatesRoot(), '_executor', 'internal', 'taskscript', `${kind}.sh`), 'utf8')
+            .replaceAll('@PACKAGE@', pins.package).replaceAll('@EXECUTOR_DIGEST@', pins.executorDigest).replaceAll('@POLICY_DIGEST@', pins.policyDigest);
+        return { kind, name: `${pins.package} executor ${kind}`, header: `#!/bin/sh\n# synopkgland executor ${kind}\n`, script: validateTaskScript(script, kind === 'boot' ? 1024 : 6000) };
+    });
+}
+export function bootDefinition(task) {
+    return { task_name: task.name, event: 'bootup', owner: { '0': 'root' }, enable: true, depend_on_task: '', operation_type: 'script', operation: task.script, description: '', notify_mail: '', notify_enable: false, notify_if_error: false };
+}
+export function controlDefinition(task) {
+    return { name: task.name, owner: 'root', real_owner: 'root', enable: false, type: 'script', schedule: { date_type: 0, week_day: '0,1,2,3,4,5,6', repeat_date: 1001, monthly_week: [], hour: 0, minute: 0, repeat_hour: 0, repeat_min: 0, last_work_hour: 0, repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: Array.from({ length: 23 }, (_, i) => i + 1) }, extra: { notify_enable: false, script: task.script, notify_mail: '', notify_if_error: false } };
+}

package/dist/runtime/uninstall-cleanup.d.ts

@@ -0,0 +1,7 @@
+/** Prospective administrator checklist; these entries are not observed residues. */
+export interface UninstallCleanupItem {
+    target: string;
+    condition: string;
+    action: string;
+}
+export declare function uninstallCleanup(pkg: string, executor: boolean): UninstallCleanupItem[];

package/dist/runtime/uninstall-cleanup.js

@@ -0,0 +1,10 @@
+export function uninstallCleanup(pkg, executor) {
+    const items = [
+        { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
+        { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
+        { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
+    ];
+    if (executor)
+        items.unshift(...['boot', 'control'].map(kind => ({ target: `${pkg} executor ${kind}`, condition: 'Only if automatic task cleanup was skipped or failed after uninstall.', action: 'The root executor deletes this exact task after verifying its recorded name, root owner and script digest. Administrator: inspect a surviving definition before deleting it in Control Panel > Task Scheduler.' })), { target: `/usr/local/etc/synopkgland/${pkg}, /run/synopkgland/${pkg}`, condition: 'After uninstall, if protected runtime/delegations/socket remain.', action: `The running executor handles the preuninst purge mailbox immediately and completes cleanup asynchronously. Its fallback pauses service while the package directory or INFO identity is unavailable, and automatically purges only after 10 minutes of continuous absence, even while paused. Reappearance resets the timer. If its process is absent, the next boot purges after verifying the retained pins. Lifecycle timeout does not block uninstall. If cleanup still fails, an administrator must inspect the protected state before deleting both tasks.` });
+    return items;
+}

package/dist/skill.js

@@ -7,8 +7,10 @@ const SKILL_CATALOG = [
     { id: "wrap", file: "reference/wrap.md", when: "已有 Compose 或要補契約" },
     { id: "identity", file: "reference/identity.md", when: "需要 DSM 登入者" },
     { id: "files", file: "reference/files.md", when: "需要 NAS 檔案" },
+    { id: "ui-vue", file: "reference/ui-vue.md", when: "編寫／檢查 Vue UI" },
+    { id: "ui-json", file: "reference/ui-json.md", when: "產生／檢查 JSON UI" },
     { id: "deploy", file: "reference/deploy.md", when: "要放到 NAS" },
-    { id: "diagnose", file: "reference/diagnose.md", when: "validate／deploy／Open 失敗" },
+    { id: "diagnose", file: "reference/diagnose.md", when: "check／deploy／Open 失敗" },
 ];
 export function resolveSkillsRoot() {
     const moduleDir = dirname(fileURLToPath(import.meta.url));

package/dist/standalone/api-permissions.d.ts

@@ -0,0 +1,18 @@
+import type { Capabilities } from "./manifest.js";
+export declare const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+export declare const MAX_PERMISSIONS_BYTES = 65536;
+export declare const MAX_PERMISSION_METHODS = 1024;
+export type ApiPermission = "administrators" | "authenticated" | "public";
+export interface ApiPermissions {
+    schema: 1;
+    default: "administrators";
+    methods: Record<string, ApiPermission>;
+}
+export declare function parseApiPermissions(raw: Uint8Array): ApiPermissions;
+export declare function readApiPermissions(backendDir: string, capabilities?: Capabilities): {
+    policy: ApiPermissions;
+    digest: string;
+    sdkDigest: string;
+};
+/** Launcher access is derived from the same API policy; no second setting. */
+export declare function permitsOrdinaryUsers(policy?: ApiPermissions): boolean;

package/dist/standalone/api-permissions.js

@@ -0,0 +1,63 @@
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { templatesRoot } from "../template-paths.js";
+import { parseDocument } from "yaml";
+export const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+export const MAX_PERMISSIONS_BYTES = 65536;
+export const MAX_PERMISSION_METHODS = 1024;
+export function parseApiPermissions(raw) {
+    if (raw.byteLength > MAX_PERMISSIONS_BYTES)
+        throw new Error("permissions JSON exceeds 65536 bytes");
+    const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    const value = JSON.parse(text);
+    // JSON.parse silently overwrites duplicate keys. The second parser checks
+    // uniqueness after escape decoding; it does not permit YAML-only syntax.
+    if (parseDocument(text, { uniqueKeys: true }).errors.length > 0)
+        throw new Error("duplicate JSON permission keys");
+    const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+    if (!object(value) || Object.keys(value).length !== 3 || value.schema !== 1 || value.default !== "administrators" || !object(value.methods)) {
+        throw new Error("permissions require schema: 1, default: administrators and a methods object");
+    }
+    const entries = Object.entries(value.methods);
+    if (entries.length > MAX_PERMISSION_METHODS)
+        throw new Error("too many permission methods");
+    for (const [method, permission] of entries) {
+        const matched = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/.exec(method);
+        if (method.length > 128 || matched?.[0] !== method || !["administrators", "authenticated", "public"].includes(permission)) {
+            throw new Error(`invalid permission for method ${JSON.stringify(method)}`);
+        }
+    }
+    return value;
+}
+export function readApiPermissions(backendDir, capabilities = {}) {
+    const file = join(backendDir, API_PERMISSIONS_FILE);
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.size > MAX_PERMISSIONS_BYTES)
+        throw new Error("permissions must be a regular bounded JSON file");
+    const raw = readFileSync(file);
+    const policy = parseApiPermissions(raw);
+    const sdkRaw = readFileSync(join(templatesRoot(), 'native-go/backend/internal/api/sdk-permissions.json'));
+    const sdkFile = join(backendDir, 'internal/api/sdk-permissions.json');
+    if (existsSync(sdkFile)) {
+        const sdkStat = lstatSync(sdkFile);
+        if (!sdkStat.isFile() || sdkStat.size !== sdkRaw.length || !readFileSync(sdkFile).equals(sdkRaw)) {
+            throw new Error('SDK route policy differs from the CLI policy; restore the SDK-owned file');
+        }
+    }
+    const sdk = JSON.parse(sdkRaw.toString('utf8'));
+    for (const methods of Object.values(sdk))
+        for (const method of Object.keys(methods)) {
+            if (Object.hasOwn(policy.methods, method))
+                throw new Error(`App policy cannot override SDK route ${method}`);
+        }
+    for (const [capability, methods] of Object.entries(sdk)) {
+        if (capabilities[capability] || ['rootOps', 'files'].includes(capability) && capabilities.delegate)
+            Object.assign(policy.methods, methods);
+    }
+    return { policy, sdkDigest: createHash("sha256").update(sdkRaw).digest("hex"), digest: createHash("sha256").update(raw).digest("hex") };
+}
+/** Launcher access is derived from the same API policy; no second setting. */
+export function permitsOrdinaryUsers(policy) {
+    return policy !== undefined && Object.values(policy.methods).some(permission => permission !== "administrators");
+}

package/dist/standalone/build.d.ts

@@ -21,7 +21,7 @@ export interface StandaloneBuildOptions {
 }
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export declare const runCommand: CommandRunner;
-/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+/** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
     outputs: string[];
 }>;

package/dist/standalone/build.js

@@ -1,22 +1,22 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
-import { buildHelper } from "./helper.js";
 import { buildDaemonControl } from "./daemon.js";
-import { buildAuthorization, authorizationPlan } from "./authorization.js";
+import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
+import { readApiPermissions } from "./api-permissions.js";
 const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export const runCommand = (command, args, options) => {
     const result = spawnSync(command, args, {
         cwd: options.cwd,
         env: options.env,
-        stdio: ["ignore", "inherit", "pipe"],
+        stdio: ["ignore", process.stderr, "pipe"],
         encoding: "utf8",
     });
     if (result.stderr) {
@@ -25,7 +25,7 @@ export const runCommand = (command, args, options) => {
     const missing = result.error?.code === "ENOENT";
     return { status: result.status, stderr: result.stderr ?? "", missing };
 };
-/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+/** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export async function buildStandalone(options) {
     const loaded = loadStandaloneManifest(options.root);
     if (!loaded.ok) {
@@ -35,7 +35,7 @@ export async function buildStandalone(options) {
     const manifest = options.minDsm === undefined
         ? loaded.manifest
         : { ...loaded.manifest, os_min_ver: resolveMinDsm(options.minDsm) };
-    if (manifest.privilege === "root" && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
+    if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
     const run = options.run ?? runCommand;
@@ -46,42 +46,22 @@ export async function buildStandalone(options) {
         }
     }
     buildUi(manifest, run);
-    if (manifest.integration?.identity === "better-auth") {
-        const result = run("npm", ["run", "build"], { cwd: join(manifest.root, "node"), env: { ...process.env } });
-        if (result.missing || result.status !== 0)
-            throw new StandaloneBuildError("STANDALONE_IDENTITY_BUILD_FAILED", `Optional Better Auth build failed.\n${result.stderr}`);
-    }
     const outDir = options.outDir ?? join(options.root, "dist");
     const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
     try {
         const outputs = [];
         for (const arch of arches) {
-            const helper = buildHelper(manifest, arch, work, run);
-            if (helper) {
-                const problem = checkCgiBinary(work, helper.binary, arch);
-                if (problem)
-                    throw new StandaloneBuildError(problem.code, problem.message);
-            }
-            const operationsManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
-            const authorization = buildAuthorization(operationsManifest, arch, work, run);
-            if (authorization) {
-                const problem = checkCgiBinary(work, authorization.binary, arch);
-                if (problem)
-                    throw new StandaloneBuildError(problem.code, problem.message);
-            }
-            const cgiPath = backendFor(manifest, arch, work, run, helper, authorization);
+            const executor = buildExecutor(manifest, arch, work, run);
+            const builtManifest = executor ? { ...manifest, executor } : manifest;
+            const cgiPath = backendFor(builtManifest, arch, work, run);
             const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
             if (problem) {
                 throw new StandaloneBuildError(problem.code, problem.message);
             }
-            if (authorization && !readFileSync(cgiPath).includes(Buffer.from(JSON.stringify(authorizationPlan(authorization, manifest))).toString("base64"))) {
-                throw new StandaloneBuildError("AUTHORIZATION_CGI_REQUIRED", "root CGI must contain its compiled authorization plan; regenerate the root template adapter");
-            }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const builtManifest = authorization ? { ...manifest, rootOps: authorization.ops } : operationsManifest;
             const backgroundWorker = buildBackgroundWorker(manifest, arch, work, run);
-            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper, daemonControl, backgroundWorker, authorization });
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             outputs.push(outputPath);
         }
         return { outputs };
@@ -96,19 +76,24 @@ function buildUi(manifest, run) {
         return;
     }
     const [command, ...args] = build.command;
-    const result = run(command, args, { cwd: build.cwd, env: { ...process.env, SYNOPKGLAND_SDK_WORKERS: manifest.integration?.sdkWorkers ? "1" : "0" } });
+    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
     if (result.missing || result.status !== 0) {
         const installHint = command === "npm" && existsSync(join(build.cwd, "package.json")) && !existsSync(join(build.cwd, "node_modules"))
-            ? `\nUI 依賴尚未安裝。請在 ${build.cwd} 執行 npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"}，然後重新執行 build-spk。`
+            ? `\nUI 依賴尚未安裝。請在 ${build.cwd} 執行 npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"}，然後重新執行 build。`
             : "";
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
-function backendFor(manifest, arch, work, run, helper, authorization) {
+function backendFor(manifest, arch, work, run) {
     const backend = manifest.backend;
     if (backend.kind === "binary") {
         return backend.files[arch];
     }
+    // UI build hooks run after validation. Refuse policy changes rather than
+    // compiling CGI permissions different from the launcher metadata snapshot.
+    if (readApiPermissions(backend.dir, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend.dir, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
+        throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
+    }
     const out = join(work, `api-${arch}.cgi`);
     const ldflags = [
         "-s",
@@ -116,13 +101,14 @@ function backendFor(manifest, arch, work, run, helper, authorization) {
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
         `-X main.version=${manifest.spkVersion}`,
-        ...(helper ? [`-X 'main.helperInventory=${JSON.stringify(helper.inventory)}'`] : []),
-        ...(authorization ? [`-X 'main.rootAuthorization=${Buffer.from(JSON.stringify(authorizationPlan(authorization, manifest))).toString('base64')}'`] : []),
-        // Integration without a helper: the CGI serves its package-account features itself.
-        ...(manifest.integration && !helper ? ["-X main.integrationMode=package"] : []),
-        ...(manifest.fileStation ? [`-X main.fileStation=${manifest.fileStation}`] : []),
+        `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        ...(manifest.capabilities.delegate ? [`-X ${JSON.stringify(`main.delegateScope=${manifest.capabilities.delegate.scope}`)}`] : []),
+        ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
+        ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
+        ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
     ].join(" ");
-    const result = run("go", ["build", ...(manifest.integration?.sdkWorkers ? ["-tags=synopkgland_sdk_workers"] : []), "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
         env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
     });
@@ -136,7 +122,7 @@ function backendFor(manifest, arch, work, run, helper, authorization) {
 }
 /** The fixed worker is a second binary of the project's own Go module. */
 function buildBackgroundWorker(manifest, arch, work, run) {
-    if (!manifest.background || manifest.backend.kind !== "go")
+    if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
     const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`].join(" ");

package/dist/standalone/dsm-window.js

@@ -1,9 +1,8 @@
-import { AUTHORIZATION_RUNTIME } from "./authorization-window.js";
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { ROOT_MESSAGES } from "./root-messages.js";
 import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
+import { permitsOrdinaryUsers } from "./api-permissions.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export function cgiUrl(packageId) {
@@ -60,7 +59,7 @@ export function renderUiConfig(manifest) {
                 icon: "images/app_{0}.png",
                 appWindow: `${ns}.MainWindow`,
                 allowMultiInstance: false,
-                allUsers: true,
+                allUsers: permitsOrdinaryUsers(manifest.apiPermissions),
                 depend: [`${ns}.MainWindow`],
             },
             [`${ns}.MainWindow`]: {
@@ -83,8 +82,8 @@ export function renderWindowScript(manifest, assetVersion) {
     const pkg = manifest.package;
     const ns = `SYNO.SDS.${pkg}`;
     const p = JSON.stringify(pkg);
-    const root = manifest.rootOps ? renderRootParts(ns, manifest) : undefined;
-    return `/* Generated by synopkgland build-spk. Edit your UI in the project's ui folder. */
+    const root = manifest.executor ? renderRootParts(ns, manifest) : undefined;
+    return `/* Generated by synopkgland build. Edit your UI in the project's ui folder. */
 Ext.ns(${JSON.stringify(ns)});
 
 ${ns}.call = function (method, params) {
@@ -155,7 +154,7 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   extend: "SYNO.SDS.AppWindow",
   constructor: function (config) {
     this.callParent([Ext.apply({
-      width: 960, height: 640, minWidth: 640, minHeight: 420, layout: "fit",
+      width: 960, height: 640, minWidth: 700, minHeight: 420, layout: "fit",
       ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
     }, config)]);
   },
@@ -181,17 +180,17 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
         var i18n = ${ns}.createI18n(lang, ${ns}.messages);
         me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });
         root.lang = i18n.locale;
-        if (app.authorizationUI && me.body) { var panels = me.body.dom.querySelector(".dsmapp-rootpanels"); if (panels) panels.hidden = true; }
         try {
           me.mounted = app.mount(root, {
           displayName: ${JSON.stringify(manifest.displayname)},
           call: ${ns}.call,
+          files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
           host: me.hostAccess,
           appWindow: me,
           lang: lang,
           locale: i18n.locale,
-          t: i18n.t${root ? `,\n          root: access,\n          authorization: ${ns}.createAuthorizationAccess({root: access, call: ${ns}.call, tasks: ${ns}.rootTasks, user: session})` : ""}
+          t: i18n.t${root ? `,\n          executor: access` : ""}
           }) || {};
         } catch (error) {
           me.hostAccess.dispose();
@@ -235,18 +234,13 @@ const ROOT_PANEL_CSS = [
     ".dsmapp-rootpanel-message{color:#c0392b}.dsmapp-rootpanel-hint{color:#526070;font-size:12px}",
 ].join("");
 /**
- * The privilege: root additions to the window: the exact tasks and panel
+ * The capabilities.rootOps: true additions to the window: the exact tasks and panel
  * text, the access runtime wired to DSM's own password confirmation and the
  * AppWindow's WebAPI channel, and the panel above the app.
  */
 function renderRootParts(ns, manifest) {
     return {
-        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest))};
-${ns}.createAuthorizationAccess = (function () {
-${AUTHORIZATION_RUNTIME}
-return createAuthorizationAccess;
-})();
-${ns}.rootMessages = ${JSON.stringify(ROOT_MESSAGES)};
+        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest.executor))};
 ${ns}.createRootAccess = (function () {
 ${ROOT_RUNTIME}
   return createRootAccess;
@@ -265,6 +259,7 @@ ${ROOT_PANEL}
     };
     var access = ${ns}.createRootAccess({
       tasks: ${ns}.rootTasks,
+      pins: ${JSON.stringify({ executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
       user: session,
       send: function (api, method, version, params) {
         return new Promise(function (resolve, reject) {
@@ -277,11 +272,37 @@ ${ROOT_PANEL}
           });
         });
       },
-      confirmPassword: function () {
-        return new Promise(function (resolve) {
-          SYNO.SDS.Utils.PasswordConfirmDialog.openDialog(me, function (confirmation) {
-            resolve({ confirmed: true, token: (confirmation && confirmation.SynoConfirmPWToken) || null });
-          }, [], function () { resolve({ confirmed: false, token: null }); });
+      confirmPassword: function (suppliedPassword) {
+        // Send exactly one PasswordConfirm v2 auth with a masked password field.
+        return new Promise(function (resolve, reject) {
+          if (typeof suppliedPassword === "string" && suppliedPassword) {
+            me.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: 2, params: {password: suppliedPassword}, scope: me,
+              callback: function(success, response) { suppliedPassword = ""; if (!success) reject({code: "dsm_" + ((response && response.code) || "error")}); else resolve({confirmed: true, token: response && response.SynoConfirmPWToken}); }
+            });
+            suppliedPassword = "";
+            return;
+          }
+          var form = document.createElement("form"), label = document.createElement("label"), input = document.createElement("input");
+          var submit = document.createElement("button"), cancel = document.createElement("button");
+          label.textContent = "Confirm your DSM administrator password";
+          input.type = "password"; input.autocomplete = "current-password"; input.required = true;
+          label.appendChild(input); form.appendChild(label);
+          submit.type = "submit"; submit.textContent = "Approve"; form.appendChild(submit);
+          cancel.type = "button"; cancel.textContent = "Cancel"; form.appendChild(cancel);
+          me.body.dom.appendChild(form); input.focus();
+          function close() { input.value = ""; if (form.parentNode) form.parentNode.removeChild(form); }
+          cancel.onclick = function() { close(); resolve({confirmed: false}); };
+          form.onsubmit = function(event) {
+            event.preventDefault(); submit.disabled = cancel.disabled = true;
+            var password = input.value; input.value = "";
+            me.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: 2, params: {password: password}, scope: me,
+              callback: function(success, response) {
+                password = ""; close();
+                if (!success) { reject({code: "dsm_" + ((response && response.code) || "error")}); return; }
+                resolve({confirmed: true, token: response && response.SynoConfirmPWToken});
+              }
+            });
+          };
         });
       },
       call: ${ns}.call,
@@ -289,9 +310,7 @@ ${ROOT_PANEL}
     });
     var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
     if (panels) {
-      var rootI18n = ${ns}.createI18n(lang, ${ns}.rootMessages);
-      panels.lang = rootI18n.locale;
-      ${ns}.mountRootPanel(panels, access, rootI18n, ${ns}.rootTasks, session().admin);
+      ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
     }
 `,
     };