@synopackageland/cli 0.5.3 → 0.6.1

package/dist/standalone/inspect-spk.d.ts

@@ -1,4 +1,5 @@
-import { type IntegrationInspection } from "./inspect-helper.js";
+import { type ExecutorInspection } from "../runtime/executor-inspect.js";
+import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
 export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
@@ -9,13 +10,18 @@ export interface SpkInspection {
     signed: boolean;
     /** Payload path of the package CGI, when present with mode 0755. */
     cgi?: string;
-    integration?: IntegrationInspection;
     payload: Array<{
         path: string;
         mode: string;
     }>;
     /** Anything that breaks the unsigned, package-account-only contract. */
     findings: string[];
+    capabilities: Array<{
+        name: string;
+        requiresAdminApproval: boolean;
+    }>;
+    executor?: ExecutorInspection;
+    uninstallCleanup?: UninstallCleanupItem[];
 }
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;

package/dist/standalone/inspect-spk.js

@@ -1,4 +1,5 @@
-import { inspectAuthorization } from "./authorization.js";
+import { inspectNativeLayout } from "./native-layout.js";
+import { inspectExecutor } from "../runtime/executor-inspect.js";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -8,14 +9,14 @@ import { CONTAINER_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
-import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundControl, renderBackgroundUnit } from "./background.js";
+import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
+import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
-import { inspectHelper } from "./inspect-helper.js";
-import { inspectNativeLayout } from "./native-layout.js";
+import { uninstallCleanup } from "../runtime/uninstall-cleanup.js";
 const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
@@ -28,11 +29,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         await tar.x({ file: spkPath, cwd: dir });
         const findings = [];
         if (!expectedKind && existsSync(join(dir, "native-layout.json"))) {
-            const findings = [];
-            const info = Object.fromEntries(readFileSync(join(dir, "INFO"), "utf8").split("\n").flatMap(line => {
-                const m = line.match(/^([a-z_]+)="([^"\r\n]*)"$/);
-                return m ? [[m[1], m[2]]] : [];
-            }));
+            const info = readInfo(join(dir, "INFO"), findings, "native-layout");
             const payload = await listPayload(join(dir, "package.tgz"), findings);
             const target = join(dir, "layout-inspection");
             mkdirSync(target);
@@ -41,55 +38,69 @@ export async function inspectSpk(spkPath, expectedKind) {
             for (const key of ["package", "version", "arch", "os_min_ver", "checksum"])
                 if (!info[key])
                     findings.push(`Missing INFO ${key}`);
-            return { kind: "native-layout", package: info.package, version: info.version, arch: info.arch, signed: existsSync(join(dir, "syno_signature.asc")), payload, findings };
+            return { kind: "native-layout", package: info.package, version: info.version, arch: info.arch,
+                signed: existsSync(join(dir, "syno_signature.asc")), payload, findings, capabilities: [] };
         }
         const payload = await listPayload(join(dir, "package.tgz"), findings);
         const paths = new Set(payload.map(entry => entry.path));
-        const kind = expectedKind ?? (paths.has(CGI_PAYLOAD_PATH) ? "native-go"
-            : paths.has("native.yaml") ? "binary" : paths.has("compose.yaml") ? "container" : "native-go");
-        const helperPayload = ["integration/helper", "integration/inventory.json", "integration/workers.json"].every(path => paths.has(path));
-        const identityPayload = [CGI_PAYLOAD_PATH, "integration/identity/app.mjs"].every(path => paths.has(path)) && (helperPayload || !paths.has("integration/helper"));
-        const info = readInfo(join(dir, "INFO"), findings, kind, identityPayload);
-        if (kind === "native-go" && paths.has("integration/helper") && info.precheckstartstop !== "yes") {
-            findings.push('integration INFO 必須明確設定 precheckstartstop="yes"，否則 DSM 不執行 prestop');
+        let metadata = {};
+        const metadataText = readOptional(join(dir, "sdk-package.json"));
+        if (metadataText !== undefined) {
+            try {
+                const raw = JSON.parse(metadataText);
+                if (raw.schema !== 2 || !["go", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length)
+                    throw new Error();
+                metadata = raw;
+            }
+            catch {
+                findings.push("sdk-package.json 不符合 schema 2 capability inventory。");
+            }
         }
+        const binaryBackend = metadata.backend === "binary";
+        const kind = expectedKind ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : "native-go");
+        const standalone = kind === "native-go" || kind === "binary";
+        const info = readInfo(join(dir, "INFO"), findings, kind);
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
-        const sharedFolder = kind === "native-go" ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
+        const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
         checkConf(dir, findings, kind, background, sharedFolder, info.package);
         checkScripts(dir, findings);
-        if (kind === "native-go")
+        if (standalone)
             checkSharedFolder(dir, findings, info.package, sharedFolder);
         checkUninstall(dir, findings);
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
+        const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor");
         if (background)
-            checkBackground(dir, info, payload, findings);
-        if (kind === "native-go")
-            await checkDaemon(dir, info, paths, payload, findings);
-        let integration;
-        const integrationPaths = [...paths].filter(path => path.startsWith("integration/"));
-        if (integrationPaths.length > 0 && paths.has("integration/helper")) {
-            if (kind !== "native-go" || payload.find(p => p.path === "integration/helper")?.mode !== "0755")
-                findings.push("integration 必須有 native-go executable helper");
-            else if (!findings.length)
-                integration = await inspectHelper(dir, info, findings, paths.has("daemon/config.json"));
-        }
-        else if (integrationPaths.some(path => path !== "integration/identity/app.mjs")) {
-            findings.push("integration 沒有 helper 時只可附 integration/identity/app.mjs");
-        }
-        if (info.sdk_root_authorization === "2" || [...paths].some(path => path.startsWith("authorization/"))) {
-            if (info.sdk_root_authorization !== "2")
-                findings.push("root authorization INFO marker missing");
-            const authDir = join(dir, "authorization-inspection");
-            mkdirSync(authDir);
-            await tar.x({ file: join(dir, "package.tgz"), cwd: authDir });
-            findings.push(...inspectAuthorization(authDir, info.package, info.version));
-            if (payload.find(p => p.path === "authorization/bootstrap")?.mode !== "0755")
-                findings.push("authorization bootstrap must be executable");
+            checkBackground(dir, info, payload, findings, hasExecutor);
+        if (standalone)
+            await checkDaemon(dir, info, paths, payload, findings, hasExecutor);
+        let executor;
+        if ((metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor")) {
+            const executorDir = join(dir, "executor-inspection");
+            mkdirSync(executorDir);
+            await tar.x({ file: join(dir, "package.tgz"), cwd: executorDir });
+            const inspected = inspectExecutor(executorDir, info.package, info.arch);
+            findings.push(...inspected.findings);
+            executor = inspected.executor;
+            if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
+                findings.push("Executor must be executable.");
+            if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
+                findings.push("Executor lifecycle helper must be executable.");
+            if (![...paths].some(path => path.startsWith("daemon/"))) {
+                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) } };
+                for (const hook of ["preuninst", "preupgrade", "start-stop-status"]) {
+                    if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, lifecycleManifest))
+                        findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
+                }
+            }
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true }))) {
+                if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
+                    findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
+            }
         }
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
-        if (kind === "native-go" && !cgiEntry) {
+        if (standalone && !cgiEntry) {
             findings.push(`payload 沒有 ${CGI_PAYLOAD_PATH}`);
         }
         else if (cgiEntry && cgiEntry.mode !== "0755") {
@@ -97,14 +108,16 @@ export async function inspectSpk(spkPath, expectedKind) {
         }
         return {
             kind,
+            ...(executor ? { executor } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, hasExecutor) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,
             signed: existsSync(join(dir, "syno_signature.asc")),
             cgi: cgiEntry?.mode === "0755" ? CGI_PAYLOAD_PATH : undefined,
             payload,
-            ...(integration ? { integration } : {}),
             findings,
+            capabilities: (metadata.capabilities ?? []).map(name => ({ name, requiresAdminApproval: name === "rootOps" || name === "delegate" })),
         };
     }
     finally {
@@ -130,7 +143,7 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
     if (families.size > 1) {
         findings.push(`INFO arch 混用多個架構（${[...families].join("、")}）；一個 SPK 只含一種架構的 binary`);
     }
-    if (kind !== "native-go" || !hasCgi || families.size !== 1)
+    if (kind === "container" || !hasCgi || families.size !== 1)
         return;
     const [declared] = families;
     const cgi = join(dir, "cgi-inspection");
@@ -144,7 +157,7 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
         findings.push(`INFO arch 宣告 ${declared}，但 ${CGI_PAYLOAD_PATH} 是 ${actual} 的執行檔`);
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings) {
+async function checkDaemon(dir, info, paths, payload, findings, executor) {
     if (![...paths].some(path => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -165,7 +178,7 @@ async function checkDaemon(dir, info, paths, payload, findings) {
             throw new Error("invalid config");
         if (payload.find(p => p.path === `daemon/payload/${daemon.exec}`)?.mode !== "0755")
             throw new Error("missing executable");
-        const manifest = { package: info.package, daemon, ...(paths.has("integration/helper") ? { integration: {}, privilege: "root" } : {}) };
+        const manifest = { package: info.package, daemon, capabilities: executor ? { rootOps: true } : {} };
         if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== daemonConfig(manifest))
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
@@ -177,7 +190,7 @@ async function checkDaemon(dir, info, paths, payload, findings) {
         findings.push("daemon/config.json 或 payload 不符合固定 daemon 契約");
     }
 }
-function readInfo(path, findings, kind, identityPayload) {
+function readInfo(path, findings, kind) {
     if (!existsSync(path)) {
         findings.push("缺少 INFO");
         return {};
@@ -194,13 +207,10 @@ function readInfo(path, findings, kind, identityPayload) {
             findings.push(`INFO 缺少 ${key}`);
         }
     }
-    if (kind === "native-go" && (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
+    if (kind !== "container" && (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
         findings.push('INFO 必須有 thirdparty="yes" 與 dsmuidir="ui"，DSM 才會提供 /webman/3rdparty/<package>/');
     }
-    const allowedDependency = kind === "container"
-        ? info.install_dep_packages?.split(":").every(dep => /^(WebStation|ContainerManager)([><=].*)?$/.test(dep))
-        : kind === "native-go" && identityPayload && info.install_dep_packages === "Node.js_v22";
-    if (info.install_dep_packages && !allowedDependency) {
+    if (info.install_dep_packages && !(kind === "container" && info.install_dep_packages.split(":").every(dep => /^(WebStation|ContainerManager)([><=].*)?$/.test(dep)))) {
         findings.push(`INFO 依賴其他套件：${info.install_dep_packages}`);
     }
     return info;
@@ -227,7 +237,7 @@ function readOptional(path) {
 function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
-    const nativeResource = kind === "native-go" ? renderStandaloneResource({ package: pkg ?? "", ...(background ? { background: { worker: "sha256-v1" } } : {}), ...(sharedFolder ? { sharedFolder } : {}) }) : undefined;
+    const nativeResource = kind !== "container" ? renderStandaloneResource({ package: pkg ?? "", capabilities: background ? { jobs: { worker: "sha256-v1" } } : {}, ...(sharedFolder ? { sharedFolder } : {}) }) : undefined;
     if (nativeResource !== undefined && readOptional(join(confDir, "resource")) !== nativeResource) {
         findings.push(`conf/resource 必須是 ${nativeResource}（只有官方 data-share 與 systemd-user-unit，且與 install.sharedFolder 宣告一致）`);
     }
@@ -273,7 +283,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings) {
+function checkBackground(dir, info, payload, findings, executor) {
     const pkg = info.package;
     if (!pkg)
         return;
@@ -285,7 +295,7 @@ function checkBackground(dir, info, payload, findings) {
     if (units.length !== 1 || units[0] !== unit || read(`${BACKGROUND_UNIT_DIR}/${unit}`) !== renderBackgroundUnit(pkg)) {
         findings.push(`${BACKGROUND_UNIT_DIR} 必須只有固定的 ${unit}（套件帳號執行，無 User=、無 root）`);
     }
-    if (read("scripts/start-stop-status") !== renderBackgroundControl(pkg))
+    if (read("scripts/start-stop-status") !== renderStandaloneScript("start-stop-status", { package: pkg, capabilities: { jobs: { worker: "sha256-v1" }, ...(executor ? { rootOps: true } : {}) } }))
         findings.push("background scripts/start-stop-status 與固定 synosystemctl lifecycle 不符");
 }
 /**
@@ -366,9 +376,9 @@ function checkUninstall(dir, findings) {
         if (!UPGRADE_GUARD.test(body))
             findings.push('UNINSTALL_NO_UPGRADE_GUARD scripts/postuninst 刪除資料但沒有 [ "$SYNOPKG_PKG_STATUS" != UPGRADE ] 防護，升級時會誤刪');
         if (!/is_package_area\(\)\s*\{/.test(body) || !/if ! is_package_area "\$real"/.test(body))
-            findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst 刪除的路徑沒有驗證落在 /volumeN/@appdata|@apphome|@appstore/<package>；變數為空或指向別處時會刪錯資料");
+            findings.push("UNINSTALL_UNSAFE_DELETE scripts/postuninst 刪除的路徑沒有驗證落在 /volumeN/@appdata|@apphome|@appconf|@appstore/<package>；變數為空或指向別處時會刪錯資料");
         for (const line of body.split("\n").filter(l => DELETE_COMMAND.test(l))) {
-            for (const path of line.match(/\/volume\w*\/(?!@app(data|home|store)\/)[^\s"'$;]*/g) ?? [])
+            for (const path of line.match(/\/volume\w*\/(?!@app(data|home|conf|store)\/)[^\s"'$;]*/g) ?? [])
                 findings.push(`UNINSTALL_UNSAFE_DELETE scripts/postuninst 刪除 ${path}，不在套件自己的 @app* 目錄內`);
         }
         if (!boxes.some(box => box.name === "uninstall_uifile"))

package/dist/standalone/lifecycle.d.ts

@@ -1,3 +1,3 @@
 import type { StandaloneManifest } from "./manifest.js";
-/** Package-UID hooks: root auth withdraws via the trusted socket, then retains the stopped veto. */
+/** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export declare function renderStandaloneScript(name: string, manifest: StandaloneManifest): string;

package/dist/standalone/lifecycle.js

@@ -1,35 +1,35 @@
-import { hasHelper } from "./helper-inventory.js";
-import { renderHelperStoppedCheck } from "./lifecycle-helper.js";
-import { renderBackgroundControl } from "./background.js";
+import { renderBackgroundControl, backgroundUnitName } from "./background.js";
 import { renderPackagePostuninst } from "../build-spk/native-lifecycle.js";
 import { renderSharedFolderScript } from "./shared-folder.js";
-/** Package-UID hooks: root auth withdraws via the trusted socket, then retains the stopped veto. */
+/** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
+    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["preuninst", "preupgrade", "start-stop-status"].includes(name)) {
+        const helper = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle"`;
+        const stopWorker = manifest.capabilities.jobs ? `/usr/syno/bin/synosystemctl stop ${backgroundUnitName(manifest.package)} || echo "worker stop unconfirmed; continuing executor cleanup" >&2\n` : "";
+        const request = (action) => `${helper} ${action} --package ${manifest.package} || exit $?\n`;
+        if (name === "start-stop-status") {
+            const normal = renderStandaloneScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
+            // Attempt worker stop first. DSM may have already stopped it or deny this
+            // lifecycle context; executor shutdown drains requests and closes ingress.
+            const stopDaemon = manifest.daemon ? `"/var/packages/${manifest.package}/target/daemon/control" stop "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n` : "";
+            return normal.replace("#!/bin/sh\n", `#!/bin/sh\nif [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}exit 0\nfi\n`);
+        }
+        const action = name === "preuninst" ? '"$action"' : "stop";
+        const choose = name === "preuninst" ? 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n' : "";
+        return `#!/bin/sh\n${stopWorker}${choose}${request(action)}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : "exit 0\n"}`;
+    }
     if (name === "postuninst")
         return renderPackagePostuninst(manifest.package);
+    if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["postinst", "postupgrade"].includes(name)) {
+        const normal = renderStandaloneScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
+        return normal.replace("#!/bin/sh\n", `#!/bin/sh\n"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle" start --package ${manifest.package} || exit $?\n`);
+    }
     if (manifest.sharedFolder && (name === "postinst" || name === "postupgrade"))
         return renderSharedFolderScript(manifest.package, manifest.sharedFolder);
     if (manifest.daemon)
         return renderDaemonScript(name, manifest);
-    if (manifest.background && name === "start-stop-status")
+    if (manifest.capabilities.jobs && name === "start-stop-status")
         return renderBackgroundControl(manifest.package);
-    if (hasHelper(manifest) && ["preupgrade", "preuninst", "start-stop-status"].includes(name)) {
-        const check = renderHelperStoppedCheck(manifest.package, manifest.privilege === 'root');
-        if (name !== "start-stop-status")
-            return `#!/bin/sh\n${check}`;
-        return `#!/bin/sh
-case "$1" in
-  # Start the ordinary app even when integration is disabled or needs cleanup.
-  # No root enable/recover here; the administrator must explicitly approve it.
-  prestart|start|status) exit 0 ;;
-  prestop|stop)
-  # prestop is the management veto. stop runs inside ExecStop: its failure
-  # reports unsafe residue but cannot keep the DSM unit active.
-${check}    ;;
-  *) exit 1 ;;
-esac
-`;
-    }
     if (name === "start-stop-status") {
         return `#!/bin/sh
 case "$1" in
@@ -44,19 +44,23 @@ function renderDaemonScript(name, manifest) {
     const pkg = manifest.package;
     const control = `"/var/packages/${pkg}/target/daemon/control"`;
     const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
-    const check = hasHelper(manifest) ? renderHelperStoppedCheck(pkg, manifest.privilege === 'root') : "";
-    if (["preupgrade", "preuninst"].includes(name))
-        return `#!/bin/sh\n${check}exec ${control} ${name === "preuninst" && manifest.daemon?.uninstall_args ? "uninstall" : "stop"} ${paths}\n`;
+    // Preserve the existing Connect upgrade safeguard when moving to this SDK:
+    // DSM also runs the outgoing preuninst hook during package upgrades.
+    if (["preupgrade", "preuninst"].includes(name)) {
+        const uninstall = name === "preuninst" && manifest.daemon?.uninstall_args;
+        const upgrade = uninstall ? `if [ "\${SYNOPKG_PKG_STATUS:-}" = "UPGRADE" ]; then\n  exec ${control} stop ${paths}\nfi\n` : "";
+        return `#!/bin/sh\n${upgrade}exec ${control} ${uninstall ? "uninstall" : "stop"} ${paths}\n`;
+    }
     if (name !== "start-stop-status")
         return "#!/bin/sh\nexit 0\n";
     return `#!/bin/sh
 case "$1" in
   prestart) exit 0 ;;
   prestop)
-${check}    exit 0 ;;
+    exit 0 ;;
   start|status) exec ${control} "$1" ${paths} ;;
   stop|restart)
-${check}    exec ${control} "$1" ${paths} ;;
+    exec ${control} "$1" ${paths} ;;
   *) exit 1 ;;
 esac
 `;

package/dist/standalone/manifest.d.ts

@@ -1,10 +1,12 @@
+import { type DelegateCapability } from "../runtime/executor-policy.js";
+import type { ExecutorPins } from "../runtime/executor-tasks.js";
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Catalogs, type Locale } from "./i18n.js";
 import { type RootOp } from "./root-ops.js";
-import { type Integration } from "./helper.js";
 import { type Daemon } from "./daemon.js";
 import { type Background } from "./background.js";
 import { type SharedFolder } from "./shared-folder.js";
+import { type ApiPermissions } from "./api-permissions.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -41,6 +43,10 @@ export interface StandaloneManifest {
     os_min_ver: string;
     arches: NativeArchFamily[];
     backend: StandaloneBackend;
+    /** Effective App and SDK route policies used by the launcher and CGI. */
+    apiPermissions?: ApiPermissions;
+    apiPermissionsDigest?: string;
+    apiSDKPermissionsDigest?: string;
     ui: {
         dir: string;
         build?: {
@@ -49,24 +55,21 @@ export interface StandaloneManifest {
         };
     };
     i18n?: StandaloneI18n;
-    /**
-     * `none`: the package account only; an integration then has no helper.
-     * `root`: adds DSM-approved root tasks and, with an integration, its helper.
-     */
-    privilege: "none" | "root";
-    /** `root/<name>.sh`, present exactly when privilege is root (empty for a helper-only integration). */
+    capabilities: Capabilities;
+    /** Fixed root/<name>.sh operations, enabled by capabilities.rootOps. */
     rootOps?: RootOp[];
-    integration?: Integration;
+    executor?: ExecutorPins;
     daemon?: Daemon;
-    background?: Background;
-    /**
-     * `session`: the package account serves the interactive File Station routes
-     * through each caller's own DSM session. No helper, no stored credential.
-     */
-    fileStation?: "session";
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;
 }
+export interface Capabilities {
+    files?: "session";
+    identity?: "standalone";
+    jobs?: Background;
+    rootOps?: true;
+    delegate?: DelegateCapability;
+}
 export interface StandaloneError {
     code: string;
     message: string;