@synopackageland/cli 0.5.3 → 0.6.1

package/README.md

@@ -1,39 +1,78 @@
 # Syno Package Land CLI
 
-Generate independent Synology packages. Run `synopkgland init --help` for templates.
+Create independent DSM packages by selecting a runtime and declaring the work your app needs.
 
 ```sh
-synopkgland init -t native-go --package MyApp ./my-app
-synopkgland init -t native-go --package AdminApp --privilege root ./admin-app
-synopkgland init --binary ./service
-synopkgland init -t compose-import ./upstream-app
-synopkgland --project ./my-app validate
-synopkgland --project ./my-app build-spk --arch x86_64
-synopkgland inspect --spk ./my-app/dist/MyApp-0.1.0-0001-x86_64.spk
-synopkgland --project ./my-app deploy --dry-run --arch x86_64
-# Explicit installation, only when intended:
-synopkgland --project ./my-app deploy --host my-nas --arch x86_64
+synopkgland init -t native-go --with files,jobs,login --package MyApp ./my-app
+(cd my-app/frontend && npm ci)
+synopkgland --project ./my-app check --json
+synopkgland --project ./my-app build --arch x86_64 --json
+synopkgland inspect ./my-app/dist/MyApp-0.1.0-0001-x86_64.spk --json
+synopkgland --project ./my-app deploy --dry-run --arch x86_64 --json
+# When installation on this configured NAS profile is intended:
+synopkgland --project ./my-app deploy --host my-nas --arch x86_64 --json
+synopkgland --project ./my-app status --host my-nas --json
 ```
 
-Native-go requires Go 1.25+; binary consumes checked prebuilt archives; container SPKs use DSM resource workers. Root operations require DSM 7.1-42661 or later and per-operation DSM approval. DSM 7.1 keeps the native password dialog but creates root tasks using the admin session without a server-side password token; DSM 7.2+ retains its one-use token. See the native-go template README for the API matrix and completion limits. Remove root tasks before uninstall; changed task text needs fresh approval.
+Native-go needs Go 1.25+ and defaults to Vue; install frontend dependencies before building. Use Node 22.19+ for the documented workflow. `--ui plain` skips the frontend npm build but cannot use standalone login. Binary packages a static Linux CGI that owns authentication. Compose imports an upstream project with `init -t compose --from ./compose.yaml`, or creates an example when the import option is omitted.
 
-`--ui vue --integration go|better-auth` generates a package-account integration
-(`privilege: none`, no helper). The privileged helper needs an explicit
-`--privilege root`; protocol, data-access and worker settings belong to it.
+## Capabilities and authorization
 
-For native-go helper integration, `--ui vue --integration go --privilege root
---integration-protocol 2 --data-access relaxed` selects the S1R build policy (`integration.dataAccess`).
-Default data access remains unavailable. Mode is pinned in helper/CGI inventory
-and requires rebuild and new root approval when changed. Missing certified DSM
-adapters still refuse NAS access; this setting does not open write gates.
-Recreated accounts with the same UID and username may retain grants; a change to
-either invalidates all grants for that identity and requires new authorization.
+| Class | Declaration | Execution, limits and administrator action |
+| --- | --- | --- |
+| A | Base private settings/data; `--with jobs` | Package-account work bound to trusted username/UID; ordinary users can submit and access their own jobs without admin setup. Private copies do not retain source authority. |
+| B | `--with files` | Caller-session metadata, TreeView/DataGrid file tree, shared NasPicker, streaming upload/download. File Station enforces the caller's permissions; no capability setup. |
+| I | `--with login` | Same-host DSM cookie reuse, including another port, or HTTPS DSM account/password/OTP fallback. App session at most 15 minutes; sensitive operations revalidate live DSM cookie/UID. Vue required. |
+| C | `--with delegate` | One-time admin executor setup, revocable subject/job/operation/scope/expiry grants; DSM runner and uid-dropped writes enforce the user's own permissions. |
+| R | `--with root-ops` | Fixed root/*.sh, administrator only. Shares one-time digest-locked executor setup with C; every root request independently verifies an active administrator. |
 
-For containers, `--share MEDIA_SHARE=photos`, `--run-as RUN_AS=alice` and `--param APP_MODE=prod` supply declared values. Keep upstream target paths. Fixed service credentials govern mount access, while each upstream app owns user login and authorization.
+An App session identifies the person but does not create File Station authority. Files without a live DSM cookie return `dsm_session_required`; sensitive business methods may return `session_revalidation_required`. Sign in to DSM on the same hostname. P2 scope is a usage restriction, not the permission boundary; per-operation account/AppPriv checks must reject disabled accounts and denied application access. Digest-locked boot tasks restore the executor after reboot; complete integrated lifecycle acceptance remains pending.
+
+Generated native-go/binary require schema 2 `dsm-package.yaml`, with `backend: {kind: go, dir: backend}` or `backend: {kind: binary, files: {x86_64: prebuilt/api-x86_64}}`. Capability values are `files: session`, `jobs: true` (or `{worker: sha256-v1}`), `identity: standalone`, `rootOps: true`, `delegate: {operations: [files.write], scope: home}` inside `capabilities`. Jobs and daemon are mutually exclusive. Binary/compose do not support files/jobs/login/delegate; current rootOps also requires Go. Business route access comes from `backend/internal/api/permissions.json`; SDK-owned route policy cannot be overridden.
+
+See the [delegate guide](../../website/src/content/docs/docs/guides/delegate.md) ([繁體中文](../../website/src/content/docs/zh-tw/docs/guides/delegate.md)) and [administrator lifecycle checks](../../website/src/content/docs/docs/concepts/lifecycle.md) ([繁體中文](../../website/src/content/docs/zh-tw/docs/concepts/lifecycle.md)) for exact operations, errors and cleanup.
+
+## Add capabilities and inspect readiness
+
+`add files jobs login` updates the manifest and SDK-owned overlays while preserving App-owned handlers/pages. A differing overlay or modified SDK placeholder causes `ADD_FILE_CONFLICT`; review the listed paths. Already-declared capabilities are a no-op. Pristine SDK stubs and the generated route-policy test scaffold may be replaced only while matching the bundled base.
+
+`check`, `build`, `inspect`, `deploy` and `status` support `--json`. Stdout contains one object; progress uses stderr; errors contain stable `code`, `message`, `hint`. `status --host <profile>` reports package state, Open URL and per-capability ready/needs-admin-approval/unsupported/blocked reasons. Installation success is separate from approval and runtime caller permissions. `logs` currently reads DSM package status diagnostics; it does not stream App/worker/executor logs and has no follow flag.
+
+## Containers and distribution
+
+Compose retains its separate synology-app.yaml contract. `--share MEDIA_SHARE=photos`, `--run-as RUN_AS=alice` and `--param APP_MODE=prod` supply installation answers. Retain upstream container target paths. Fixed UID/GID mounts govern service access; upstream authentication remains explicit. The DSM gateway controls entry and does not supply a general per-user files capability. `dev`, `test` and `images pin` are Compose tools.
+
+`--dev` selects container development identities. Deploy uploads directly to the selected DSM host, never to a catalog. There is no release, signing or public-submit command.
+
+Uninstall requests executor purge and verified own-task removal. If automatic cleanup is unavailable or skipped, an administrator must inspect surviving tasks and protected state. The Delete App Data checkbox does not prove complete deletion: retained DSM directories, account/group and symlink artifacts need readback. Full device lifecycle acceptance and DSM-update persistence remain separate.
+
+See the bilingual website CLI and schema reference for the complete command/flag inventory; website tests compare it to this CLI's help output.
+
+## AI authoring guidance
+
+Every scaffold includes AGENTS.md and a CLAUDE.md pointer. Start with
+`synopkgland skill list`, read `synopkgland skill show orchestrator`, then the
+relevant skill. `synopkgland skill path` locates the bundled reference files.
+For UI work, read `synopkgland skill show ui-vue` for direct Vue components and
+`synopkgland skill show ui-json` for optional JSON specs. Both use the installed
+UI contracts; the Vue template does not require JSON. Follow AGENTS.md's local
+check/build/inspect workflow and obtain authorization before connecting to NAS.
+
+For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
+`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
+Read its prompt and exported Vue docs/types before choosing component APIs.
+Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.
+
+For an empty directory or one-off discovery, select the package explicitly:
+
+```sh
+npx -y -p @synopackageland/ui syno-pkg-land-ui catalog
+```
+
+The render output defaults to `syno-pkg-land-ui-render`; use `--out shots` to
+choose an artifact directory.
 
-`dev` and `test` run local Compose. `info` and `log` read DSM package state/status; status output is not application log streaming. `skill path/list/show` exposes the bundled authoring guidance. `--dev` is available for container/binary development package identities. There is no release or public-submit command; deploy never publishes.
 
-See the repository's docs/independent-packages.md for supported parameters, lifecycle and limitations.
 ## Licensing
 
 The CLI and original templates are MIT licensed, Copyright (c) 2026 synopkgland.
@@ -45,21 +84,24 @@ Retain the template and dependency notices when distributing derived code.
 
 SPKs place legal material under the installed payload's `LICENSES/` directory:
 `TEMPLATE.txt`, optional developer `APP.txt`, Go's `GO-LICENSE`/`GO-PATENTS`,
-`GO-THIRD_PARTY_NOTICES.txt`, optional `HELPER-THIRD_PARTY_NOTICES.txt`, and
-`ui/` or `better-auth/` notice trees. The helper also retains its existing
-`integration/THIRD_PARTY_NOTICES.txt` location for compatibility.
-
-Vue and Better Auth builds generate full notices plus `inventory.json` from
-the installed, locked production dependency tree (a conservative superset of
-bundled code). Missing text or a version mismatch fails the build. Run `npm ci`
-in the generated frontend/Node directories before building. For
-`@better-auth/utils` 0.4.2 and 0.5.0, which omit license text in their npm
-archives, the tool retains the upstream project's subsequently added MIT
-license, with its pinned source commit and exact npm integrity recorded in
-`notice-overrides/index.json`. Unknown missing licenses require a new review;
-the tool never manufactures a license from a package's SPDX field.
+`GO-THIRD_PARTY_NOTICES.txt`, and the Vue `ui/` notice tree.
+
+Vue builds generate full notices plus `inventory.json` from the installed,
+locked production dependency tree. Missing text or a version mismatch fails the
+build. Run `npm ci` in the generated frontend before building.
 
 Keep `backend/THIRD_PARTY_NOTICES.txt` current if you change Go modules.
 The supplied notice inventory covers the pinned template dependencies and Go
 runtime; arbitrary developer binaries, Go module additions, container images,
 custom UI bundles and upstream applications need their own notice inventory.
+
+### Existing native products
+
+Schema 2 also supports `backend: {kind: native}` with `layout` and `native` declarations.
+This preserves project-owned multi-executable payloads, metadata/conf, lifecycle hooks,
+checksum-pinned DSM toolkits and x86_64/aarch64/armv8/armv7 families. Lifecycle and
+systemd remain package-only; root task authorization is an explicit product responsibility.
+The separate `@synopackageland/cli/authorization-sdk` export provides the pinned-task
+host adapter and Vue authorization gate. Generated Go rootOps/delegate still use the executor.
+See the [native layout and migration guide](../../website/src/content/docs/docs/guides/native-layout.md)
+([繁體中文](../../website/src/content/docs/zh-tw/docs/guides/native-layout.md)).

package/dist/add.d.ts

@@ -0,0 +1,4 @@
+export declare function addCapabilities(root: string, requested: string[]): {
+    added: string[];
+    unchanged: string[];
+};

package/dist/add.js

@@ -0,0 +1,124 @@
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative } from 'node:path';
+import { parseDocument } from 'yaml';
+import { capabilityNames, capabilitySettings } from './capabilities.js';
+import { initFromTemplate } from './init.js';
+import { templatesRoot } from './template-paths.js';
+import { DEFAULT_MIN_DSM, isDsmAtLeast } from './build-spk/dsm-version.js';
+import { loadStandaloneManifest } from './standalone/manifest.js';
+const overlays = {
+    jobs: ['native-go-jobs'],
+    'root-ops': ['native-go-root-ops'],
+    delegate: ['native-go-jobs', 'native-go-delegate'],
+    files: ['native-go-files'], login: ['native-go-identity'],
+};
+const removed = {
+    jobs: ['backend/internal/app/background_none.go'],
+    'root-ops': ['backend/internal/app/root_none.go'],
+    delegate: ['backend/internal/app/background_none.go', 'backend/internal/app/root_none.go', 'backend/internal/app/delegate_none.go'],
+};
+function files(root, dir = root) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir).flatMap(name => {
+        if (['dist', 'node_modules'].includes(name))
+            return [];
+        const path = join(dir, name);
+        return lstatSync(path).isDirectory() ? files(root, path) : [relative(root, path)];
+    });
+}
+/** Refuse symlinks on every existing segment, including absent destinations. */
+function safePath(root, file) {
+    let current = root;
+    if (lstatSync(root).isSymbolicLink())
+        return false;
+    for (const part of file.split('/')) {
+        current = join(current, part);
+        try {
+            if (lstatSync(current).isSymbolicLink())
+                return false;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                return false;
+        }
+    }
+    return true;
+}
+export function addCapabilities(root, requested) {
+    const names = capabilityNames(requested);
+    const loaded = loadStandaloneManifest(root);
+    if (!loaded.ok)
+        throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
+    const m = loaded.manifest;
+    if (m.backend.kind !== 'go')
+        throw new Error('[CAPABILITY_UNSUPPORTED] add 需要 backend.kind: go。');
+    const existing = Object.entries(capabilitySettings(names)).filter(([key]) => key in m.capabilities).map(([key]) => key);
+    const unchanged = names.filter(name => existing.includes(Object.keys(capabilitySettings([name]))[0]));
+    const added = names.filter(name => !unchanged.includes(name));
+    if (!added.length)
+        return { added, unchanged };
+    if ((added.includes('jobs') || added.includes('delegate')) && m.daemon)
+        throw new Error('[CAPABILITY_COMBINATION_INVALID] daemon 與 capabilities.jobs 互斥。');
+    if (m.backend.dir !== join(root, 'backend'))
+        throw new Error('[ADD_LAYOUT_UNSUPPORTED] SDK overlay 需要 backend.dir: backend。');
+    const work = mkdtempSync(join(tmpdir(), 'synopkgland-add-'));
+    try {
+        // Generate SDK files using init's identical substitutions, without touching app-owned files.
+        const existingNames = Object.keys(m.capabilities).map(name => name === 'identity' ? 'login' : name === 'rootOps' ? 'root-ops' : name);
+        const before = join(work, 'before'), generated = join(work, 'generated');
+        initFromTemplate('native-go', before, { ui: m.ui.build ? 'vue' : 'plain', with: existingNames, packageId: m.package, displayName: m.displayname });
+        initFromTemplate('native-go', generated, { ui: m.ui.build ? 'vue' : 'plain', with: [...existingNames, ...added], packageId: m.package, displayName: m.displayname });
+        const destinations = [...new Set(added.flatMap(name => overlays[name].flatMap(overlay => files(join(templatesRoot(), overlay)))))].filter(file => existsSync(join(generated, file)));
+        if (added.includes('delegate'))
+            destinations.push('backend/internal/background/store.go', 'backend/internal/app/executor.go', 'backend/internal/app/executor_test.go', 'backend/internal/api/sdk-permissions.json');
+        if (added.includes('jobs') || added.includes('delegate') || added.includes('root-ops'))
+            destinations.push('backend/internal/app/routes_test.go');
+        const deletions = added.flatMap(name => removed[name] ?? []);
+        const conflicts = [];
+        for (const file of destinations) {
+            if (existsSync(join(before, file)) && safePath(root, file) && existsSync(join(root, file)) && lstatSync(join(root, file)).isFile() && readFileSync(join(root, file)).equals(readFileSync(join(before, file))))
+                continue;
+            if (!safePath(root, file) || (existsSync(join(root, file)) && (!lstatSync(join(root, file)).isFile() || !readFileSync(join(root, file)).equals(readFileSync(join(generated, file))))))
+                conflicts.push(file);
+        }
+        for (const file of deletions) {
+            const path = join(root, file);
+            if (!safePath(root, file) || (existsSync(path) && (!lstatSync(path).isFile() || !readFileSync(path).equals(readFileSync(join(templatesRoot(), 'native-go', file))))))
+                conflicts.push(file);
+        }
+        const manifestPath = join(root, 'dsm-package.yaml');
+        if (added.includes('delegate') && !safePath(root, 'backend/internal/api/permissions.json'))
+            conflicts.push('backend/internal/api/permissions.json');
+        if (!safePath(root, 'dsm-package.yaml'))
+            conflicts.push('dsm-package.yaml');
+        if (conflicts.length)
+            throw new Error(`[ADD_FILE_CONFLICT] 既有檔案與 SDK overlay 不同：${conflicts.join(', ')}；請先移動或合併衝突，不會覆寫。`);
+        const doc = parseDocument(readFileSync(manifestPath, 'utf8'));
+        for (const [key, value] of Object.entries(capabilitySettings(added)))
+            doc.setIn(['capabilities', key], value);
+        // All semantic checks precede writes to the user's project.
+        if (added.includes('root-ops') && !isDsmAtLeast(m.os_min_ver, DEFAULT_MIN_DSM))
+            throw new Error('[STANDALONE_OS_MIN_VER_INVALID] rootOps 需要 DSM 7.1-42661 或以上。');
+        for (const file of destinations) {
+            const path = join(root, file);
+            mkdirSync(dirname(path), { recursive: true });
+            writeFileSync(path, readFileSync(join(generated, file)), { mode: lstatSync(join(generated, file)).mode & 0o777 });
+        }
+        for (const file of deletions)
+            rmSync(join(root, file), { force: true });
+        if (added.includes('delegate')) {
+            const path = join(root, 'backend/internal/api/permissions.json');
+            const policy = JSON.parse(readFileSync(path, 'utf8'));
+            if (!Object.hasOwn(policy.methods, 'app.status'))
+                policy.methods['app.status'] = 'authenticated';
+            writeFileSync(path, JSON.stringify(policy, null, 2) + '\n');
+        }
+        writeFileSync(manifestPath, String(doc));
+        return { added, unchanged };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}

package/dist/authorization-sdk.d.ts

@@ -1,5 +1,7 @@
-/** Public build-time adapter surface for native-layout products. */
-export { ROOT_RUNTIME, type RootTask } from './standalone/root-window.js';
-export { AUTHORIZATION_RUNTIME } from './standalone/authorization-window.js';
-/** Canonical Vue gate and nine catalogs, shipped unchanged in the npm archive. */
+/** Explicit build-time adapter for native products with their own pinned root tasks.
+ * Generated Go capabilities continue to use the protected executor.
+ * No task/grant is created by importing this module.
+ */
+export { ROOT_RUNTIME, type RootTask } from './standalone/native-root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
 export declare const authorizationTemplateDirectory: URL;

package/dist/authorization-sdk.js

@@ -1,5 +1,7 @@
-/** Public build-time adapter surface for native-layout products. */
-export { ROOT_RUNTIME } from './standalone/root-window.js';
-export { AUTHORIZATION_RUNTIME } from './standalone/authorization-window.js';
-/** Canonical Vue gate and nine catalogs, shipped unchanged in the npm archive. */
-export const authorizationTemplateDirectory = new URL('../templates/native-go-authorization/frontend/src/authorization/', import.meta.url);
+/** Explicit build-time adapter for native products with their own pinned root tasks.
+ * Generated Go capabilities continue to use the protected executor.
+ * No task/grant is created by importing this module.
+ */
+export { ROOT_RUNTIME } from './standalone/native-root-window.js';
+export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
+export const authorizationTemplateDirectory = new URL('../templates/native-authorization/', import.meta.url);

package/dist/build-spk/delete-app-data.d.ts

@@ -13,12 +13,12 @@
  *
  * Every root is resolved first and must land on `/volumeN/@<area>/<package>`
  * (or below it) for this package; anything else — an empty variable, another
- * package, a shared folder, `@appconf` — is reported and left alone. A root is
+ * package or a shared folder — is reported and left alone. A root is
  * emptied rather than removed (the mount point is DSM's), symlinks inside it
  * are removed rather than followed, and remnants are reported instead of
  * failing the script: a non-zero postuninst blocks uninstall.
  */
-export type AppDataArea = "appdata" | "apphome" | "appstore";
+export type AppDataArea = "appdata" | "apphome" | "appstore" | "appconf";
 export interface DeleteRoot {
     /** Name of the shell variable that holds the root directory. */
     variable: string;

package/dist/build-spk/generator.js

@@ -20,9 +20,6 @@ import { renderUninstallWizardFiles } from "./uninstall-wizard.js";
 import { renderInstallWizardFiles } from "./install-wizard.js";
 import { renderWizardFiles, writeWizardUiFiles } from "./wizard-i18n.js";
 import { sharedFolderCombobox } from "./share-combobox.js";
-import { loadNative } from "../native/load.js";
-import { materializeNativePayload } from "./native-payload.js";
-import { renderNativePostinst, renderNativePrivilege, renderNativeStartStopStatus, renderNativePostuninst, renderNativePreuninst, } from "./native-lifecycle.js";
 import { renderHeadlessResourceMarker, renderResourceConfig, renderResourceWorkerStartStopStatus, } from "./resource-worker.js";
 const FILE_MODE = 0o644;
 const SCRIPT_MODE = 0o755;
@@ -62,74 +59,9 @@ export async function buildSpk(options) {
     if (options.minDsm !== undefined) {
         contract.os_min_ver = resolveMinDsm(options.minDsm);
     }
-    const nativePath = options.project.nativePath ?? join(options.project.root, "native.yaml");
-    const isNative = existsSync(nativePath);
-    if (!isNative && options.minDsm !== undefined) {
+    if (options.minDsm !== undefined) {
         assertContainerMinDsm(String(contract.os_min_ver));
     }
-    if (isNative) {
-        if (!options.archFamily) {
-            return { ok: false, errors: ["NATIVE_ARCH_FAMILY_REQUIRED"] };
-        }
-        const parsedNative = loadNative(nativePath);
-        if (!parsedNative) {
-            return { ok: false, errors: ["NATIVE_LOAD_FAILED"] };
-        }
-        const targetSource = parsedNative.native.targets[options.archFamily];
-        if (!targetSource) {
-            return { ok: false, errors: ["NATIVE_TARGET_NOT_DECLARED"] };
-        }
-        const staging = mkdtempSync(join(tmpdir(), "syno-spk-"));
-        try {
-            writeFileSync(join(staging, "INFO"), renderInfo(contract, options.archFamily), "utf8");
-            writePackageCenterIcons(staging);
-            mkdirSync(join(staging, "conf"), { recursive: true });
-            writeFileSync(join(staging, "conf", "privilege"), renderNativePrivilege(), "utf8");
-            writeFileSync(join(staging, "privilege"), renderNativePrivilege(), "utf8");
-            writeWizards(staging, contract, undefined, "native");
-            mkdirSync(join(staging, "scripts"), { recursive: true });
-            for (const name of SCRIPT_NAMES) {
-                const scriptPath = join(staging, "scripts", name);
-                writeFileSync(scriptPath, renderManagedScript(name, contract, { config: parsedNative.native }), "utf8");
-                chmodSync(scriptPath, SCRIPT_MODE);
-            }
-            const packageDir = join(staging, "package");
-            mkdirSync(packageDir, { recursive: true });
-            // 1. Materialize native payload
-            try {
-                await materializeNativePayload({
-                    source: targetSource,
-                    projectRoot: options.project.root,
-                    destDir: packageDir,
-                });
-            }
-            catch (err) {
-                const code = err && typeof err === "object" && "code" in err
-                    ? String(err.code)
-                    : "NATIVE_PAYLOAD_ERROR";
-                return { ok: false, errors: [code] };
-            }
-            // Check collision with App Bundle members before copying
-            if (existsSync(join(packageDir, "synology-app.yaml")) ||
-                existsSync(join(packageDir, "native.yaml"))) {
-                return { ok: false, errors: ["NATIVE_PAYLOAD_BUNDLE_COLLISION"] };
-            }
-            copyFileSync(options.project.contractPath, join(packageDir, "synology-app.yaml"));
-            copyFileSync(nativePath, join(packageDir, "native.yaml"));
-            chmodSync(join(staging, "INFO"), FILE_MODE);
-            chmodSync(join(staging, "privilege"), FILE_MODE);
-            chmodSync(join(packageDir, "synology-app.yaml"), FILE_MODE);
-            chmodSync(join(packageDir, "native.yaml"), FILE_MODE);
-            const outputPath = options.outputPath ??
-                join(options.project.root, `${String(contract.package)}-${options.archFamily}.spk`);
-            copyProjectNotices(options.project.root, packageDir);
-            await createDeterministicSpk(staging, outputPath);
-            return { ok: true, outputPath, errors: [] };
-        }
-        finally {
-            rmSync(staging, { recursive: true, force: true });
-        }
-    }
     const parsedCompose = loadCompose(options.project.composePath);
     const route = parsedCompose?.compose
         ? classifyComposeRoute(contract, parsedCompose)
@@ -182,7 +114,7 @@ export async function buildSpk(options) {
         mkdirSync(join(staging, "scripts"), { recursive: true });
         for (const name of SCRIPT_NAMES) {
             const scriptPath = join(staging, "scripts", name);
-            writeFileSync(scriptPath, renderManagedScript(name, contract, undefined, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true), "utf8");
+            writeFileSync(scriptPath, renderManagedScript(name, contract, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true), "utf8");
             chmodSync(scriptPath, SCRIPT_MODE);
         }
         mkdirSync(join(staging, "package"), { recursive: true });
@@ -851,26 +783,7 @@ function renderDynamicCanonicalMirror(headless = false) {
 function shellQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-function renderManagedScript(name, contract, nativeContext, isResourceWorker = false, resourceWorkerAdminport, isDynamicRoute = false, isHeadlessRoute = false) {
-    if (nativeContext) {
-        const lifecycleInput = {
-            packageIdentity: String(contract.package),
-            config: nativeContext.config,
-        };
-        if (name === "start-stop-status") {
-            return renderNativeStartStopStatus(lifecycleInput);
-        }
-        if (name === "postinst" || name === "postupgrade") {
-            return renderNativePostinst(lifecycleInput);
-        }
-        if (name === "preuninst") {
-            return renderNativePreuninst(lifecycleInput);
-        }
-        if (name === "postuninst") {
-            return renderNativePostuninst(lifecycleInput);
-        }
-        return `#!/bin/sh\nexit 0\n`;
-    }
+function renderManagedScript(name, contract, isResourceWorker = false, resourceWorkerAdminport, isDynamicRoute = false, isHeadlessRoute = false) {
     if (isResourceWorker) {
         if (name === "start-stop-status") {
             return renderResourceWorkerStartStopStatus(String(contract.package), resourceWorkerAdminport, isHeadlessRoute);

package/dist/build-spk/native-lifecycle.d.ts

@@ -1,56 +1,10 @@
-import type { NativeConfig } from "../native/types.js";
-import { type DeleteRoot } from "./delete-app-data.js";
-/** `@appdata` and `@apphome`; `@appconf` stays because no template writes there. */
+import { type DeleteRoot, type DeleteAppDataOptions } from "./delete-app-data.js";
+/** Package data roots shared by CGI and daemon packages. */
 export declare const NATIVE_DELETE_ROOTS: readonly DeleteRoot[];
-export interface NativeLifecycleInput {
-    packageIdentity: string;
-    config: NativeConfig;
-}
 /**
  * Renders `conf/privilege` content.
  * For non-container native packages, DSM accepts `{"defaults":{"run-as":"package"}}`.
  */
 export declare function renderNativePrivilege(): string;
-/**
- * Renders `scripts/start-stop-status`.
- *
- * Requirements & hard facts from N0:
- * - Start must be backgrounded via `nohup setsid ... &` because Package Center uses a oneshot unit.
- * - PID is tracked in `$PKGVAR/<pkg>.pid`.
- * - Status exit codes: 0 = running, 1 = PID file present but process dead, 3 = stopped / no PID file.
- * - Fallbacks for `SYNOPKG_PKGDEST` and `SYNOPKG_PKGVAR` via `:-/var/packages/<pkg>/target` and `:-/var/packages/<pkg>/var`.
- * - `exec` is relative to `SYNOPKG_PKGDEST` (no `target/` subfolder).
- * - Safe quoting for `exec`, `args`, and `env`.
- */
-export declare function renderNativeStartStopStatus(input: NativeLifecycleInput): string;
-/**
- * Renders `scripts/postinst`.
- *
- * Requirements from N0:
- * - DSM creates the package user/group and sets up `SYNOPKG_PKGVAR` (drwxr-xr-x) before postinst runs.
- * - Does NOT create any users (no synouser/useradd/adduser).
- * - Does NOT chown.
- * - Only ensures that subdirectories (like `$SYNOPKG_PKGVAR/tmp`) exist.
- */
-export declare function renderNativePostinst(input: NativeLifecycleInput): string;
-/**
- * Renders `scripts/preuninst`.
- *
- * Requirements from N0:
- * - Non-zero exit blocks uninstallation, so it must be best-effort (`|| true`).
- * - Skips when `SYNOPKG_PKG_STATUS=UPGRADE`.
- * - Calls stop via `/var/packages/${SYNOPKG_PKGNAME:-<pkg>}/scripts/start-stop-status stop`.
- * - Does NOT use postfix stripping like `%/target`.
- */
-export declare function renderNativePreuninst(input: NativeLifecycleInput): string;
-/**
- * Renders `scripts/postuninst`.
- *
- * Shares `renderDeleteAppDataBlock` with the Compose generator so both runtimes
- * honour the same unchecked-by-default wizard variable and the same refusal to
- * follow a symlink out of `@appdata`. N0 showed DSM does not reclaim the
- * package user on uninstall; deleting a system account is not this script's job.
- */
-export declare function renderNativePostuninst(input: NativeLifecycleInput): string;
 /** The postuninst every native runtime shares: only the package name differs. */
-export declare function renderPackagePostuninst(pkg: string): string;
+export declare function renderPackagePostuninst(pkg: string, options?: DeleteAppDataOptions): string;