@synopackageland/cli 0.9.7 → 0.10.1

package/dist/errors.js

@@ -11,7 +11,7 @@ export function formatError(error) {
     const location = error.span.path
         ? `${error.span.file}:${error.span.line}:${error.span.column} (${error.span.path})`
         : `${error.span.file}:${error.span.line}:${error.span.column}`;
-    return `[${error.code}] ${location}\n${error.message}\n建議：${error.suggestion}`;
+    return `[${error.code}] ${location}\n${error.message}\nSuggestion: ${error.suggestion}`;
 }
 /** The message of an error thrown with a code: the code in brackets, then the message; the code only once. */
 export function codedMessage(code, message) {

package/dist/host/dsm-port-profile.d.ts

@@ -1,5 +1,5 @@
 /** The precision caveat for the administrator-only fallback. */
-export declare const DSM_PORT_PROFILE_PRECISION_WARNING = "API \u7248\u672A\u8B80\u53D6 conf/resource\uFF1B\u82E5\u6709 App \u81EA\u8A02 Compose project \u540D\u53EF\u80FD\u8AA4\u5831";
+export declare const DSM_PORT_PROFILE_PRECISION_WARNING = "The API version does not read conf/resource; a custom Compose project name may cause a false positive";
 export interface DsmPortRange {
     start: number;
     end: number;

package/dist/host/dsm-port-profile.js

@@ -2,7 +2,7 @@ import { basename } from "node:path";
 import { composeProjectName } from "../build-spk/resource-worker.js";
 import { dsmFetch } from "./dsm-http.js";
 /** The precision caveat for the administrator-only fallback. */
-export const DSM_PORT_PROFILE_PRECISION_WARNING = "API 版未讀取 conf/resource；若有 App 自訂 Compose project 名可能誤報";
+export const DSM_PORT_PROFILE_PRECISION_WARNING = "The API version does not read conf/resource; a custom Compose project name may cause a false positive";
 /**
  * parsePortProfileFilename(). In particular, projectName is everything before
  * the final two dash-separated container segments.

package/dist/info.js

@@ -67,9 +67,9 @@ export function classifyRootTasks(expected, inventory) {
         ? result("needs-admin-approval", "Approve missing or outdated root tasks in the DSM package UI.")
         : result("ready", "Boot and control tasks match the executor and policy digests. Executor health must be checked in the App window.");
 }
-async function liveRootCapability(m, host) {
+async function liveRootCapability(m, host, arch) {
     try {
-        const policyDigest = sha256(executorPolicyText(executorPolicy(m)));
+        const policyDigest = sha256(executorPolicyText(executorPolicy(m, arch)));
         const classified = classifyRootTasks(executorTasks({ package: m.package, policyDigest }, requiredSdk(sdkBackend(m)).executorDir), await host.getRootTaskInventory?.(m.package));
         if (classified.state !== "ready")
             return classified;
@@ -101,14 +101,14 @@ async function rootCapability(m, host, version) {
         return blocked("NAS architecture cannot be matched to the local executor SPK artifact.");
     const spk = join(m.root, "dist", `${m.package}-${version}-${arch}.spk`);
     if (!existsSync(spk))
-        return liveRootCapability(m, host);
+        return liveRootCapability(m, host, arch);
     try {
         const inspected = await inspectSpk(spk);
         if (inspected.findings.length ||
             inspected.package !== m.package ||
             inspected.version !== version)
             return blocked("Executor SPK artifact failed inspection or identity checks.");
-        if (!inspected.executor || JSON.stringify(inspected.executor.policy) !== JSON.stringify(executorPolicy(m)))
+        if (!inspected.executor || JSON.stringify(inspected.executor.policy) !== JSON.stringify(executorPolicy(m, arch)))
             return blocked("Executor policy differs from source; rebuild and deploy before approval.");
         const inventory = await host.getRootTaskInventory?.(m.package);
         const classified = classifyRootTasks(inspected.executor.tasks, inventory);
@@ -204,13 +204,13 @@ async function packageState(pkg, host) {
 }
 export function formatProjectInfo(info) {
     return [
-        `Package Identity：${info.packageIdentity}`,
-        `開發用 Instance：${info.developmentInstance ? "是" : "否"}`,
-        `已安裝：${info.installed ? "是" : "否"}`,
-        info.openUrl ? `Open URL：${info.openUrl}` : "Open URL：（未設定）",
-        info.readiness ? `Readiness：${info.readiness}` : "",
-        ...info.capabilities.map((cap) => `能力 ${cap.name}：${cap.state} — ${cap.reason}`),
-        ...(info.uninstallCleanup ?? []).map(item => `Uninstall cleanup (if needed)：${item.target} — ${item.condition} ${item.action}`),
+        `Package Identity: ${info.packageIdentity}`,
+        `Development instance: ${info.developmentInstance ? "yes" : "no"}`,
+        `Installed: ${info.installed ? "yes" : "no"}`,
+        info.openUrl ? `Open URL: ${info.openUrl}` : "Open URL: (not set)",
+        info.readiness ? `Readiness: ${info.readiness}` : "",
+        ...info.capabilities.map((cap) => `Capability ${cap.name}: ${cap.state} — ${cap.reason}`),
+        ...(info.uninstallCleanup ?? []).map(item => `Uninstall cleanup (if needed): ${item.target} — ${item.condition} ${item.action}`),
     ]
         .filter(Boolean)
         .join("\n");

package/dist/init.d.ts

@@ -31,3 +31,5 @@ export interface InitOptions {
  */
 export declare function copyTemplateTree(source: string, target: string): void;
 export declare function initFromTemplate(template: TemplateName, targetDir: string, options?: InitOptions): void;
+/** What to run after init in `dir`, for a template built from source; undefined for the others. */
+export declare function initNextSteps(template: TemplateName, dir: string, frontend: boolean, localSdk: boolean): string | undefined;

package/dist/init.js

@@ -5,9 +5,10 @@ import { capabilityNames, capabilitySettings } from "./capabilities.js";
 import { MOVE_FROM_STAGING } from './runtime/delegate-contract.js';
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
-import { SDK_MODULE, SDK_PACKAGE } from "./runtime/sdk-source.js";
+import { SDK_MODULE, SDK_PACKAGE, sdkSource } from "./runtime/sdk-source.js";
 import { templatesRoot } from "./template-paths.js";
-import { borrowedFiles, borrowedTarget, capabilityOverlays, VUE_OVERLAYS } from "./capability-overlays.js";
+import { BASE_BORROWED, BRIDGE_TEMPLATES, borrowedFiles, borrowedTarget, capabilityOverlays, VUE_OVERLAYS } from "./capability-overlays.js";
+import { copyAppTree, copyNodeSdk, NODE_SDK_PACKAGE } from "./standalone/bridge-app.js";
 import { API_PERMISSIONS_FILE } from "./standalone/api-permissions.js";
 import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
 import { readSharedFolder } from "./standalone/shared-folder.js";
@@ -15,12 +16,17 @@ const TEMPLATE_NAMES = [
     "compose",
     "binary",
     "native-go",
-    "native-rust",
+    ...BRIDGE_TEMPLATES,
 ];
-/** Templates built from source with the SDK: capabilities, a Vue or plain UI, a shared folder. */
-const NATIVE_TEMPLATES = ["native-go", "native-rust"];
+/** Templates built from source with the SDK: capabilities, a Vue or plain UI. */
+const NATIVE_TEMPLATES = ["native-go", ...BRIDGE_TEMPLATES];
 const isNativeTemplate = (template) => NATIVE_TEMPLATES.includes(template);
-const BACKEND_KIND = { "native-go": "go", "native-rust": "rust" };
+const isBridgeTemplate = (template) => BRIDGE_TEMPLATES.includes(template);
+/** Where each native template keeps its API permissions. */
+const PERMISSIONS_FILE = {
+    "native-go": `backend/${API_PERMISSIONS_FILE.go}`, "native-python": `backend/app/${API_PERMISSIONS_FILE.python}`,
+    "native-node": `backend/app/${API_PERMISSIONS_FILE.node}`, "native-rust": `backend/${API_PERMISSIONS_FILE.rust}`,
+};
 /** Templates whose App runs through the DSM docker-project resource worker. */
 const CONTAINER_TEMPLATES = [
     "compose",
@@ -92,22 +98,24 @@ function isTemplateBuildArtifact(path) {
 }
 export function initFromTemplate(template, targetDir, options = {}) {
     if (!isTemplateName(template))
-        throw new Error(`[INIT_TEMPLATE_UNKNOWN] 未知模板：${template}`);
-    const caps = capabilityNames(options.with ?? []);
+        throw new Error(`[INIT_TEMPLATE_UNKNOWN] Unknown template: ${template}`);
+    const requested = capabilityNames(options.with ?? []);
+    const capability = isNativeTemplate(template) ? capabilityOverlays(template, requested) : { overlays: [], borrowed: [], removed: [], permissions: {}, implied: [], methods: [] };
+    const caps = capabilityNames([...new Set([...capability.implied ?? [], ...requested])]);
     if (caps.includes("login") && resolvedUi(template, options) === "plain")
-        throw new Error("[CAPABILITY_COMBINATION_INVALID] login 需要獨立登入頁；plain UI 不支援，請改用 --ui vue。");
+        throw new Error("[CAPABILITY_COMBINATION_INVALID] login needs a standalone sign-in page; plain UI does not support it, use --ui vue.");
     if (caps.includes("delegate") && resolvedUi(template, options) === "plain")
-        throw new Error("[CAPABILITY_COMBINATION_INVALID] delegate 的 install-selected scope 只能在 Vue 面板確認；plain UI 不支援，請改用 --ui vue。");
+        throw new Error("[CAPABILITY_COMBINATION_INVALID] the delegate install-selected scope can only be confirmed in a Vue panel; plain UI does not support it, use --ui vue.");
     if (options.from && template !== "compose")
-        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --from 只適用於 compose。");
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --from applies only to compose.");
     if (caps.length && !isNativeTemplate(template))
-        throw new Error("[CAPABILITY_UNSUPPORTED] binary／compose 不支援 --with 能力。");
+        throw new Error("[CAPABILITY_UNSUPPORTED] binary/compose does not support --with capabilities.");
     const localSdk = isNativeTemplate(template) && process.env.SYNOPKGLAND_SDK_DIR ? resolve(process.env.SYNOPKGLAND_SDK_DIR) : undefined;
     if (localSdk)
         assertLocalSdkReady(localSdk, resolvedUi(template, options) === "vue");
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
-        throw new Error(`找不到模板：${template}`);
+        throw new Error(`Template not found: ${template}`);
     }
     const minDsm = options.minDsm === undefined ? undefined : resolveMinDsm(options.minDsm);
     if (minDsm !== undefined && isContainerTemplate(template)) {
@@ -119,9 +127,11 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (rootExample && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
         throw new Error(`[MIN_DSM_INVALID] root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    const capability = isNativeTemplate(template) ? capabilityOverlays(template, caps) : { overlays: [], borrowed: [], removed: [] };
-    const borrowed = borrowedFiles(templatesRoot(), capability.borrowed);
-    const overlays = [...(ui === "vue" && isNativeTemplate(template) ? VUE_OVERLAYS[template] : []), ...capability.overlays].map(name => join(templatesRoot(), name));
+    const vue = ui === "vue" && isNativeTemplate(template) ? VUE_OVERLAYS[template] : { overlays: [], borrowed: [] };
+    const base = isNativeTemplate(template) ? BASE_BORROWED[template] : [];
+    // Later borrowed files replace earlier ones, as later overlays do.
+    const borrowed = borrowedFiles(templatesRoot(), [...base, ...vue.borrowed, ...capability.borrowed]);
+    const overlays = [...vue.overlays, ...capability.overlays].map(name => join(templatesRoot(), name));
     // Shared legal resources also live in the CLI package; only the template
     // terms are an unconditional part of a generated project.
     const shared = join(templatesRoot(), "_shared");
@@ -130,7 +140,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
         ...borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
-        throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
+        throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} already has ${collisions.join(", ")}; init does not overwrite existing files. Use an empty directory.`);
     }
     mkdirSync(targetDir, { recursive: true });
     copyTemplateTree(source, targetDir);
@@ -148,10 +158,10 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     for (const file of capability.removed)
         rmSync(join(targetDir, file));
-    if (caps.includes("delegate") && isNativeTemplate(template)) {
-        const path = join(targetDir, "backend", API_PERMISSIONS_FILE[BACKEND_KIND[template]]);
+    if (Object.keys(capability.permissions).length && isNativeTemplate(template)) {
+        const path = join(targetDir, PERMISSIONS_FILE[template]);
         const policy = JSON.parse(readFileSync(path, "utf8"));
-        policy.methods["app.status"] = "authenticated";
+        Object.assign(policy.methods, capability.permissions);
         writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
     }
     for (const [from, to] of Object.entries(RENAMED)) {
@@ -162,7 +172,14 @@ export function initFromTemplate(template, targetDir, options = {}) {
     for (const file of files.map(targetName))
         substitute(join(targetDir, file), substitutions);
     if (localSdk && isNativeTemplate(template))
-        useLocalSdk(targetDir, localSdk, BACKEND_KIND[template]);
+        useLocalSdk(targetDir, localSdk);
+    if (isBridgeTemplate(template))
+        vendorAppSdk(template, targetDir);
+    if (capability.methods?.length && template === "native-rust") {
+        // A cross-compiled Rust App cannot describe itself: its manifest lists the methods.
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^( {2}methods: \[.*)\]$/m, (_, list) => `${list}${capability.methods.map(name => `, ${name}`).join("")}]`));
+    }
     if (minDsm) {
         const manifest = join(targetDir, template !== "compose" ? "dsm-package.yaml" : "synology-app.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^os_min_ver:.*$/m, `os_min_ver: "${minDsm}"`));
@@ -186,7 +203,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
         for (const [arch, goarch] of [["x86_64", "amd64"], ["aarch64", "arm64"]]) {
             const result = spawnSync("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", join(targetDir, "prebuilt", `api-${arch}`), "main.go"], { cwd: join(targetDir, "example"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: goarch }, encoding: "utf8" });
             if (result.error || result.status !== 0)
-                throw new Error(`[INIT_BINARY_BUILD_FAILED] 安裝 Go 並重新 init，或提供自己的靜態 CGI binary。${result.stderr ?? result.error}`);
+                throw new Error(`[INIT_BINARY_BUILD_FAILED] Install Go and run init again, or provide your own static CGI binary. ${result.stderr ?? result.error}`);
         }
     }
     if (options.sharedFolder) {
@@ -194,16 +211,29 @@ export function initFromTemplate(template, targetDir, options = {}) {
         writeFileSync(manifest, readFileSync(manifest, "utf8") + sharedFolderYaml(options.sharedFolder));
     }
 }
+/** Each native template's method tests, as its README runs them; Node.js also compiles the backend/app the SPK ships. */
+const BACKEND_TESTS = {
+    "native-go": "go test ./...", "native-python": "python3 -m unittest discover -s tests",
+    "native-node": "npm ci && npm test && npm run build", "native-rust": "cargo test --locked",
+};
+/** What to run after init in `dir`, for a template built from source; undefined for the others. */
+export function initNextSteps(template, dir, frontend, localSdk) {
+    if (!isNativeTemplate(template))
+        return undefined;
+    // --install-links packs a local SDK like the released package; a symlink would load the checkout's own node_modules.
+    const install = frontend ? `  (cd frontend && npm install${localSdk ? " --install-links" : ""})\n` : "";
+    return `Next steps:\n  cd ${dir}\n  (cd backend && ${BACKEND_TESTS[template]})\n${install}  synopkgland build\nSee README.md.`;
+}
 /**
  * --from replaces the example Compose. The manifest takes the requested (or
  * directory-derived) identity and keeps only the example install entries the
- * imported Compose references as `${KEY}` (or `${KEY_UID}`／`${KEY_GID}`).
+ * imported Compose references as `${KEY}` (or `${KEY_UID}`/`${KEY_GID}`).
  */
 function importCompose(from, targetDir, options) {
     const imported = readFileSync(from, "utf8");
     const compose = parse(imported);
     if (!compose || typeof compose !== "object" || !compose.services)
-        throw new Error("[INIT_COMPOSE_INVALID] --from 需要包含 services 的 Compose YAML。");
+        throw new Error("[INIT_COMPOSE_INVALID] --from needs a Compose YAML with services.");
     writeFileSync(join(targetDir, "compose.yaml"), imported);
     const path = join(targetDir, "synology-app.yaml");
     const doc = parseDocument(readFileSync(path, "utf8"));
@@ -219,7 +249,7 @@ function importCompose(from, targetDir, options) {
 }
 function validDisplayName(displayName) {
     if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
-        throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
+        throw new Error("[INIT_DISPLAY_NAME_INVALID] The display name must be single-line and without \" or \\.");
     }
     return displayName;
 }
@@ -232,29 +262,46 @@ function sharedFolderYaml(options) {
     }
     return `\ninstall:\n  sharedFolder:\n${Object.entries(folder).map(([k, v]) => `    ${k}: ${v}\n`).join("")}`;
 }
+/**
+ * The App SDK a bridge App's tests import, in backend/vendor: the Python
+ * package, or the Node.js package without what npm would install for its own
+ * development. The build ships the release backend.sdk names, from the same
+ * source (SYNOPKGLAND_SDK_DIR, or that release's Go module).
+ */
+function vendorAppSdk(template, targetDir) {
+    if (template === "native-rust")
+        return;
+    const version = String(parse(readFileSync(join(targetDir, "dsm-package.yaml"), "utf8")).backend.sdk);
+    const sdk = sdkSource(version).goDir;
+    const vendor = join(targetDir, "backend/vendor");
+    if (template === "native-python")
+        return copyAppTree(join(sdk, "python/synopkgland_app"), join(vendor, "synopkgland_app"));
+    const target = join(vendor, NODE_SDK_PACKAGE);
+    copyNodeSdk(join(sdk, "node"), target);
+    const { devDependencies: _dev, scripts: _scripts, ...pkg } = JSON.parse(readFileSync(join(target, "package.json"), "utf8"));
+    writeFileSync(join(target, "package.json"), JSON.stringify(pkg, null, 2) + "\n");
+}
 /**
  * A local sdk checkout must hold the Go module, and for a Vue frontend the
  * built ts package: npm installs a file: package as it is, without its build.
  */
 function assertLocalSdkReady(sdkDir, vue) {
     if (!existsSync(join(sdkDir, "go.mod"))) {
-        throw new Error(`[SDK_DIR_NOT_READY] SYNOPKGLAND_SDK_DIR=${sdkDir} 沒有 go.mod；請指向 syno-pkg-land-sdk 的 checkout。`);
+        throw new Error(`[SDK_DIR_NOT_READY] SYNOPKGLAND_SDK_DIR=${sdkDir} has no go.mod; point it at a syno-pkg-land-sdk checkout.`);
     }
     const ts = join(sdkDir, "ts");
     if (vue && !existsSync(join(ts, "dist"))) {
-        throw new Error(`[SDK_DIR_NOT_READY] ${ts} 尚未建置；前端安裝本機 SDK 時 npm 不會替它 build。請先執行 (cd ${ts} && npm ci && npm run build)，SDK 原始碼改動後也要重新 build。`);
+        throw new Error(`[SDK_DIR_NOT_READY] ${ts} is not built; npm does not build a local SDK when the frontend installs it. Run (cd ${ts} && npm ci && npm run build) first, and rebuild after SDK source changes.`);
     }
 }
 /**
  * SYNOPKGLAND_SDK_DIR: the project builds against a local sdk checkout instead
- * of the released version. A Rust backend keeps its Cargo files; at build time
- * git reads the SDK repository from the checkout.
+ * of the released version.
  */
-function useLocalSdk(targetDir, sdkDir, backend) {
-    if (backend === "go") {
-        const goMod = join(targetDir, "backend/go.mod");
+function useLocalSdk(targetDir, sdkDir) {
+    const goMod = join(targetDir, "backend/go.mod");
+    if (existsSync(goMod))
         writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
-    }
     const frontend = join(targetDir, "frontend/package.json");
     if (!existsSync(frontend))
         return;
@@ -284,14 +331,14 @@ function substitute(path, substitutions) {
 function substitutionsFor(template, targetDir, options) {
     const caps = capabilityNames(options.with ?? []);
     if (options.ui !== undefined && !isNativeTemplate(template))
-        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go 與 native-rust。");
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui applies only to native-go, native-python, native-node and native-rust.");
     if (options.sharedFolder) {
-        if (!isNativeTemplate(template))
-            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go 與 native-rust。");
+        if (template !== "native-go")
+            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder applies only to -t native-go.");
         sharedFolderYaml(options.sharedFolder);
     }
     if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
-        throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
+        throw new Error("[INIT_UI_INVALID] --ui accepts only plain or vue.");
     if (!IDENTIFIED.includes(template)) {
         if (options.from && options.displayName !== undefined)
             validDisplayName(options.displayName);
@@ -299,7 +346,7 @@ function substitutionsFor(template, targetDir, options) {
     }
     const packageId = options.packageId ?? defaultPackageId(targetDir);
     if (!PACKAGE_ID.test(packageId)) {
-        throw new Error(`[INIT_PACKAGE_INVALID] package「${packageId}」必須以英文字母開頭，只含英數字（2–64 字），例如 PhotoTagger。`);
+        throw new Error(`[INIT_PACKAGE_INVALID] package "${packageId}" must start with a letter and contain only alphanumerics (2-64 characters), for example PhotoTagger.`);
     }
     const displayName = validDisplayName(options.displayName ?? defaultDisplayName(targetDir));
     return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __BACKGROUND_ENABLED__: caps.includes("jobs") || caps.includes("delegate") ? "true" : "false" };

package/dist/inspect.js

@@ -11,7 +11,7 @@ export function inspectProject(project) {
             services,
             publishedPorts,
             dataMounts,
-            risks: ["缺少 compose.yaml"],
+            risks: ["compose.yaml is missing"],
             webHints,
             exposedPorts: [],
         };
@@ -29,9 +29,9 @@ export function inspectProject(project) {
     collectRisks(compose, risks);
     if (publishedPorts.length > 0) {
         const primary = publishedPorts[0];
-        webHints.push(`偵測到 published port ${primary.port}，可考慮在 synology-app.yaml 設定 adminport: ${primary.port}。`);
-        webHints.push("Web App 通常還需要 adminprotocol 與 adminurl。");
-        webHints.push("Launch Mode：integration.web.launch 為 dsm-window（預設，DSM 視窗）或 new-page（新分頁）。");
+        webHints.push(`Detected published port ${primary.port}; consider setting adminport: ${primary.port} in synology-app.yaml.`);
+        webHints.push("A Web App usually also needs adminprotocol and adminurl.");
+        webHints.push("Launch Mode: integration.web.launch is dsm-window (default, DSM window) or new-page (new tab).");
     }
     const exposedPorts = listPortExposures(compose).filter((exposure) => !exposure.loopbackOnly);
     return { services, publishedPorts, dataMounts, risks, webHints, exposedPorts };
@@ -104,7 +104,7 @@ export function formatInspectReport(report) {
     lines.push("Port exposure:");
     lines.push(report.exposedPorts.length > 0
         ? report.exposedPorts
-            .map((e) => `CONTAINER_PORT_EXPOSED ${e.service}: ${e.entry} 綁在所有網路介面，可不經 DSM 驗證直接連線；請改綁 127.0.0.1。`)
+            .map((e) => `CONTAINER_PORT_EXPOSED ${e.service}: ${e.entry} binds to every network interface, so it is reachable without DSM verification; bind it to 127.0.0.1 instead.`)
             .join("\n")
         : "(none)");
     lines.push("");

package/dist/portal/alias.d.ts

@@ -16,7 +16,7 @@ export declare const RESERVED_PORTAL_ALIASES: readonly string[];
  * but leaves nginx serving the alias, and only the root executor purge can
  * reload it. A no-privilege App never runs anything as root.
  */
-export declare const PORTAL_REQUIRES_EXECUTOR = "portal \u9700\u8981 executor \u5C64\u7D1A\uFF08capabilities.rootOps \u6216 delegate\uFF09\uFF1A\u89E3\u9664\u5B89\u88DD\u5F8C DSM \u4E0D\u6703 reload nginx\uFF0C\u767B\u5165\u5165\u53E3\u5225\u540D\u8981\u7531 root executor \u6E05\u9664\u3002\u6C92\u6709 executor \u7684 App \u8ACB\u79FB\u9664 portal\uFF0C\u6539\u7531\u7BA1\u7406\u54E1\u5728 DSM \u624B\u52D5\u8A2D\u5B9A\u53CD\u5411\u4EE3\u7406\u3002";
+export declare const PORTAL_REQUIRES_EXECUTOR = "portal needs the executor level (capabilities.rootOps or delegate): after uninstall DSM does not reload nginx, and a root executor must remove the sign-in alias. An App without an executor should remove portal and let an administrator configure a reverse proxy in DSM.";
 export interface PortalDeclaration {
     alias: string;
 }

package/dist/portal/alias.js

@@ -20,7 +20,7 @@ export const RESERVED_PORTAL_ALIASES = [
  * but leaves nginx serving the alias, and only the root executor purge can
  * reload it. A no-privilege App never runs anything as root.
  */
-export const PORTAL_REQUIRES_EXECUTOR = "portal 需要 executor 層級（capabilities.rootOps 或 delegate）：解除安裝後 DSM 不會 reload nginx，登入入口別名要由 root executor 清除。沒有 executor 的 App 請移除 portal，改由管理員在 DSM 手動設定反向代理。";
+export const PORTAL_REQUIRES_EXECUTOR = "portal needs the executor level (capabilities.rootOps or delegate): after uninstall DSM does not reload nginx, and a root executor must remove the sign-in alias. An App without an executor should remove portal and let an administrator configure a reverse proxy in DSM.";
 export function isPortalAlias(value) {
     return typeof value === "string" && PORTAL_ALIAS_PATTERN.test(value) && !RESERVED_PORTAL_ALIASES.includes(value);
 }
@@ -50,10 +50,10 @@ const ENTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** Why the executor would refuse this entry; undefined when it accepts it. */
 export function portalEntryProblem(packageId, entry) {
     if (packageId.length > 64 || !ENTRY_PACKAGE.test(packageId))
-        return `套件名稱「${packageId}」不能當作 Application Portal 的檔名：只能用英數字，以 . _ - 分隔，最多 64 字。`;
+        return `The package name "${packageId}" cannot be an Application Portal file name: it may contain only alphanumerics separated by . _ -, at most 64 characters.`;
     if (!ENTRY_ALIAS.test(entry.alias))
-        return `portal 別名「${entry.alias}」不能當作 Application Portal 的路徑。`;
+        return `The portal alias "${entry.alias}" cannot be an Application Portal path.`;
     if (!entry.application || [...entry.application].length > 64 || /\p{Cc}/u.test(entry.application))
-        return `displayname「${entry.application}」不能當作 Application Portal 的名稱：1–64 個字，不可含控制字元。`;
+        return `The displayname "${entry.application}" cannot be an Application Portal name: 1-64 characters without control characters.`;
     return undefined;
 }

package/dist/runtime/executor-build.js

@@ -8,6 +8,7 @@ import { executorPolicy, executorPolicyText, sha256 } from './executor-policy.js
 import { executorTasks } from './executor-tasks.js';
 import { copyModule, verifyExecutorDigests } from './executor-source.js';
 import { requiredSdk } from './sdk-source.js';
+import { rootProgramsUnsupported } from './root-programs.js';
 /** CLI-owned build flags; the release digest table is computed the same way, so they must not change within an SDK minor. */
 const GO_BUILD = ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o'];
 function failure(error) {
@@ -63,7 +64,17 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     catch (error) {
         throw failure(error);
     }
-    const policy = executorPolicy(m), policyText = executorPolicyText(policy);
+    let policy;
+    try {
+        policy = executorPolicy(m, arch);
+    }
+    catch (error) {
+        throw failure(error);
+    }
+    const unsupported = rootProgramsUnsupported(policy, sdk.executorDir);
+    if (unsupported)
+        throw new StandaloneBuildError('EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED', unsupported);
+    const policyText = executorPolicyText(policy);
     const pins = { package: m.package, executorDigest, policyDigest: sha256(policyText) };
     return { ...pins, binary, lifecycleBinary, policy, policyText, tasks: executorTasks(pins, sdk.executorDir), implementation: 'executor', sdk: sdk.version, warnings };
 }

package/dist/runtime/executor-digests.json

@@ -1,100 +1,23 @@
 {
-    "0.9.0": {
-        "x86_64": "e009eb882e79e001fa8e6faf43e58525948c132f01f873562353284e5ac53b69",
-        "aarch64": "f9b84fb9b4a945abf28af6efe1bee0e11067dd0cc5ae26e53f8a949175d519a9",
-        "armv7": "05b670757c9a6cdea17596769ddd471c0563c044af75a564e1570caac8e37bd2",
+    "0.10.0": {
+        "x86_64": "fb2df6e3421361c73a1cd720ec12198e968f0d2a58b18b53151c7781c7f4c1ef",
+        "aarch64": "0a0f6d013c0174f3ea54585182ddda14c94064f331189ac4315de813099efcdd",
+        "armv7": "3fbb5bc74a03a9767ac06a389a10ff07a353c4c56be6fda7b7555a6759992aba",
         "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
     },
-    "0.9.1": {
-        "x86_64": "5d75af3ce1de5b1d3ef5d89e062be1651a8e8b84edbca9903eb1a0b81d122fb5",
-        "aarch64": "b0e1f8174bf53eb435616ae0faf39ac929b515056f0b2fad5a6c264a1ff7f6e2",
-        "armv7": "17db613a4bdb181e0aa0f127822bfc13d7473fa846aadfbac3344b7c17700a84",
+    "0.10.1": {
+        "x86_64": "51b538e6ec1cb8fa2a4e00291eda097969352d6e2d9a3e7ade5da5359f1065de",
+        "aarch64": "9038b5ad7b4822e967f18390ca28b6f0021a3044ed461809b3f7333f17400840",
+        "armv7": "22d872cc618e3af4a052955186d36a6851e9f96ad959ee8ea7d3fbb5eec968bd",
         "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.2": {
-        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
-        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
-        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
-        "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.3": {
-        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
-        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
-        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
-        "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.4": {
-        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
-        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
-        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
-        "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.5": {
-        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
-        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
-        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
-        "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.6": {
-        "x86_64": "4241dfebd2b819c2566eca062ee0021b99e7f86bbe4703f50833874f79b3cf54",
-        "aarch64": "923514aca8cf6576c6c52c737d53c2c7cc4bfcec40591dcec995005be41add95",
-        "armv7": "df959648ac8e6201f1cf9b86b57730c09ba1afb7ecc151ba2f530ad15dd90ccf",
-        "lifecycle": {
-            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
-            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
-            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.7": {
-        "x86_64": "d029ca6129e76cdc5b7016378722af166b511fb346fd1002082e611bec0aef4d",
-        "aarch64": "ac8018a9846a8aaca6f06323f033a27f7abef6705601efde57ea02565105a48d",
-        "armv7": "f7b4ee5fb90c8f2dd2c56ec1eeb7749300ad117a23d9df6da6840d8b2eff83b8",
-        "lifecycle": {
-            "x86_64": "f2f0a6aa83399688441b111adee3958d7df50e9d8e33939e3951da393f013819",
-            "aarch64": "d0f0d42f367093d5c9318afb4719b9ac76b1019574f1db34dd0fcb3aba44945b",
-            "armv7": "02da8b7016abfe00b8f18e27ef2d69bcff1ca376b43e17b8c04983ca6a6ef37d"
-        },
-        "goToolchain": "go1.26.9"
-    },
-    "0.9.8": {
-        "x86_64": "d029ca6129e76cdc5b7016378722af166b511fb346fd1002082e611bec0aef4d",
-        "aarch64": "ac8018a9846a8aaca6f06323f033a27f7abef6705601efde57ea02565105a48d",
-        "armv7": "f7b4ee5fb90c8f2dd2c56ec1eeb7749300ad117a23d9df6da6840d8b2eff83b8",
-        "lifecycle": {
-            "x86_64": "f2f0a6aa83399688441b111adee3958d7df50e9d8e33939e3951da393f013819",
-            "aarch64": "d0f0d42f367093d5c9318afb4719b9ac76b1019574f1db34dd0fcb3aba44945b",
-            "armv7": "02da8b7016abfe00b8f18e27ef2d69bcff1ca376b43e17b8c04983ca6a6ef37d"
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
     }

package/dist/runtime/executor-inspect.js

@@ -22,10 +22,17 @@ export function inspectExecutor(dir, pkg, arch) {
         const policy = JSON.parse(text);
         if (parseDocument(text, { uniqueKeys: true }).errors.length || !validExecutorPolicy(policy, pkg))
             throw new Error('Invalid executor policy.');
-        for (const [name, digest] of Object.entries(policy.root)) {
-            const path = `root/${name}.sh`;
-            if (!/^[a-z][a-z0-9_]{0,31}$/.test(name) || !existsSync(join(dir, path)) || !lstatSync(join(dir, path)).isFile() || sha256(readFileSync(join(dir, path))) !== digest)
-                throw new Error('Root script digest mismatch.');
+        const machine = ELF_MACHINE[familyOfArchToken(arch.split(' ')[0]) ?? 'x86_64'];
+        for (const [name, entry] of Object.entries(policy.root)) {
+            const program = typeof entry !== 'string' && entry.kind === 'binary' ? 'binary' : 'script';
+            const path = join(dir, program === 'binary' ? `root/${name}` : `root/${name}.sh`);
+            if (!existsSync(path) || !lstatSync(path).isFile())
+                throw new Error(`Root program ${name} is missing.`);
+            const bytes = readFileSync(path);
+            if (sha256(bytes) !== (typeof entry === 'string' ? entry : entry.digest))
+                throw new Error(`Root program ${name} digest mismatch.`);
+            if (program === 'binary' && (!(lstatSync(path).mode & 0o100) || !bytes.subarray(0, 4).equals(Buffer.from([127, 69, 76, 70])) || bytes.readUInt16LE(18) !== machine))
+                throw new Error(`Root program ${name} must be an executable for ${arch}.`);
         }
         const executorDigest = sha256(binary), policyDigest = sha256(text);
         if (typeof plan.sdk !== 'string' || !/^\d+\.\d+\.\d+$/.test(plan.sdk))

package/dist/runtime/executor-policy.d.ts

@@ -1,6 +1,8 @@
 import type { RootOp } from '../standalone/root-ops.js';
 import type { EntryMode } from '../standalone/manifest.js';
 import { type PortalDeclaration, type PortalEntry } from '../portal/alias.js';
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+import { type RootPolicyEntry, type RootSettings } from './root-programs.js';
 export declare const FILE_OPERATIONS: readonly ["files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.read", "files.rename", "files.copy", "files.move", "files.delete"];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export declare const FILE_TASK_OPERATIONS: readonly ["files.taskStatus", "files.taskCancel"];
@@ -28,7 +30,11 @@ export interface ExecutorPolicy {
     portal?: PortalEntry;
     /** The root op the executor runs at uninstall while the approval is live; a key of root. */
     purge?: string;
-    root: Record<string, string>;
+    /** The root entry the executor runs when the package stops or upgrades. */
+    stop?: string;
+    root: Record<string, RootPolicyEntry>;
+    /** Root programs get a directory only root can read, kept across upgrades. */
+    root_state?: true;
 }
 /** The exact policy file bytes whose sha256 is the policy pin. */
 export declare const executorPolicyText: (policy: ExecutorPolicy) => string;
@@ -41,6 +47,7 @@ export declare function executorPolicy(m: {
         rootOps?: true;
     };
     rootOps?: RootOp[];
+    rootPrograms?: RootSettings;
     portal?: PortalDeclaration;
     os_min_ver?: string;
     displayname?: string;
@@ -49,6 +56,6 @@ export declare function executorPolicy(m: {
             root?: string;
         };
     };
-}): ExecutorPolicy;
+}, arch?: NativeArchFamily): ExecutorPolicy;
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export declare function validExecutorPolicy(value: unknown, pkg: string): value is ExecutorPolicy;