@synopackageland/templates 0.38.0 → 0.39.0

package/README.md

@@ -22,7 +22,7 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.38.0 pin UI 0.19.1 and SDK 0.43.0 in native and Compose projects.
+Templates 0.38.0 pin UI 0.19.1 and SDK 0.47.0 in native and Compose projects.
 Use a CLI that supports executor manifest format 1. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
@@ -87,16 +87,15 @@ the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
 (and `Cargo.lock`); all of them pin 0.41.1. The Vue frontend pins
-`@synopackageland/ui` 0.19.1. SDK 0.43.0 accepts UI `>=0.10.1 <0.20.0`,
+`@synopackageland/ui` 0.19.1. SDK 0.47.0 accepts UI `>=0.10.1 <0.20.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 Interactive NAS file operations use same-origin browser calls.
 Custom file handlers use the SDK's
 [session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/dsm-session-transport.md).
-The CLI reads SDK 0.43.0's release manifest, which names immutable
+The CLI reads SDK 0.47.0's release manifest, which names immutable
 executor/v0.39.0 and its executor digests. CLI distributions must resolve
-templates 0.38.x before default scaffolds use this release; a `~0.36.0`
-templates dependency remains on the older minor.
+templates 0.39.x for the current registry scaffolds.
 
 Every App method must appear in the permissions table, including methods whose
 permission equals `default: administrators`. Dynamic method names and custom
@@ -110,7 +109,7 @@ Keep punctuation between sentences and intentional loading ellipses.
 
 ## Request deadlines and background work
 
-SDK/App 0.43.0 defaults to 300 seconds for cooperative requests and 302 seconds
+SDK/App 0.47.0 defaults to 300 seconds for cooperative requests and 302 seconds
 for the TS client and generated DSM window. The CLI reads the selected SDK's
 timeout spec; `backend.timeout_seconds` explicitly overrides it for native
 backends, and an earlier parent deadline still wins. Go assembly should fall
@@ -304,7 +303,7 @@ The bridge examples expose submission, lookup and cancellation through
 
 ## External access
 
-With a compatible CLI and SDK 0.43.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+With a compatible CLI and SDK 0.47.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
 
 
 Compose templates declare an app-named dedicated shared folder by default. DSM
@@ -351,5 +350,6 @@ for retry because the executor may already have admitted it. Other settled
 sources use the SDK's explicit discard operation when the App deletes the job.
 
 An opt-in [DSM path ingress migration guide](examples/path-ingress/README.md)
-explains how a prefix-aware upstream uses `/synopkgland/<package>/` on the DSM
-origin after upgrading to a matching CLI and SDK release.
+explains the default `/synopkgland/<package>/` on the DSM origin and opt-in
+custom lowercase paths for upstreams with a fixed base. Root `/` is unsupported;
+installation checks route ownership before DSM registers the resource.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -54,13 +54,15 @@ Application Privileges allows for `SYNO.SDS.<package>.Instance`; DSM's install
 default allows administrators only, so nobody else enters until an admin grants
 access. One CGI check covers every route; failures refuse; changes apply within
 30 seconds. Never re-implement AppPriv rules in the App.
-List every App method explicitly in permissions.json, including administrator
-methods. Dynamic method names and unregistered HTTP dispatchers are rejected; use
+Declare every App method once in operations.json with a required ai class. Run
+`ctl generate` to generate permissions, routes, commands, AI tools and the App
+reference; run `ctl generate --check` and `check` to refuse drift. Read generated
+operation descriptions instead of maintaining a second list in a skill. Dynamic method names and unregistered HTTP dispatchers are rejected; use
 fixed SDK route constructors. Use identity_gateway.upstream_auth_paths for
 client API paths authenticated by the upstream.
 `api.HandleHTTP("/proxy/", "app.proxy", handler)` serves raw HTTP
 for literal, disjoint full-segment prefixes outside SDK reserved paths. Declare
-the key as authenticated or administrators in permissions.json. Origin, entry,
+the key as authenticated or administrators in operations.json, then generate. Origin, entry,
 identity and permission checks precede raw streaming/initial-upgrade handlers;
 CGI itself cannot upgrade a connection. For package-private worker HTTP use
 `ipc.ServeUnix(ctx, path, handler)` and `ipc.DialUnix`: owned mode-0600 sockets
@@ -76,8 +78,7 @@ dsm-package.yaml.
 Mark routes ordinary users call `authenticated`, mark whole admin routes
 `administrators`, guard global settings inside shared routes with
 the SDK's require-admin check, and hide admin controls with `ctx.user?.isAdmin`
-(UI only, never the authority). Example: users read the greeting; only admins
-call `greeting.set`.
+(UI only, never the authority). Declare actual App permissions in operations.json and regenerate the policy.
 
 ## DSM Application Portal (`portal`)
 

package/templates/_shared/CLAUDE.md

@@ -1 +1,3 @@
 Read [AGENTS.md](AGENTS.md).
+
+Operation metadata belongs only in operations.json; read the generated reference. Run ctl generate, ctl generate --check and check.

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.43.0
+  sdk: 0.47.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -6,7 +6,7 @@ runs as its own DSM package account, needs no containers, and has no root by def
 
 ```text
 DSM main menu → DSM window (ui/app.js)
-                   │  ctx.call("greeting.get")  same-origin POST + DSM session
+                   │  ctx.call("app.status")  same-origin POST + DSM session
                    ▼
    /webman/3rdparty/__PACKAGE__/cgi/api.cgi   (backend/, runs as package user)
       1. transport guards: POST, JSON, same origin, ≤ 1 MiB, bounded JSON complexity
@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.43.0 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.47.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.43.0/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.47.0/docs/request-deadlines.md).
 
 ## Quick start
 
@@ -35,6 +35,8 @@ Needs Node.js with `synopkgland` installed, and Go 1.25+.
 
 ```bash
 (cd backend && go test ./...)   # auth policy + route tests
+synopkgland ctl generate
+synopkgland check
 synopkgland build           # → dist/__PACKAGE__-0.1.0-0001-{x86_64,aarch64}.spk
 synopkgland inspect dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 ```
@@ -42,8 +44,7 @@ synopkgland inspect dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 Install: Package Center → Settings → General → Trust Level "Any publisher",
 then Manual Install with the SPK for your NAS's CPU. Open
 **__DISPLAY_NAME__** from the DSM main menu: it shows who you are signed in
-as, what the backend reports, and (for administrators) a form that stores a
-greeting in the package's data folder.
+as and what the backend reports.
 
 ## Capabilities and schema 2
 
@@ -79,7 +80,7 @@ resolve them before retrying. Already-declared capabilities are a no-op.
 | `i18n/messages/<locale>.json` | UI text in nine languages | Yes |
 | `i18n/glossary.json` | DSM's own UI terms, and which messages must use them | Add terms |
 | `backend/internal/app/` | Your API: routes and handlers | Yes — your backend |
-| `backend/internal/api/permissions.json` | Who may call each of your methods | Yes |
+| `backend/internal/api/permissions.json` | Generated method policy | No |
 | `backend/cmd/app/` | Wires your routes to the SDK server | Rarely |
 | `backend/go.mod` | Your module; `require github.com/synopackageland/syno-pkg-land-sdk` pins the SDK | SDK upgrades |
 | `dist/` | Built SPKs (ignored by git) | No |
@@ -91,15 +92,13 @@ resolve them before retrying. Already-declared capabilities are a no-op.
 ## Add an API operation
 
 Add a handler in `backend/internal/app/routes.go`. Every method defaults to
-DSM administrator membership, resolved by its native SDK. All access rules live in
-`backend/internal/api/permissions.json`, including launcher access:
+DSM administrator membership, resolved by its native SDK. Operation metadata and access rules live in `operations.json`;
+`ctl generate` writes the runtime policy and launcher access:
 
 ```go
 func Routes(cfg Config) []api.Route {
 	return []api.Route{
 		api.Handle("app.status", cfg.status),
-		api.Handle("greeting.get", cfg.getGreeting),
-		api.Handle("greeting.set", cfg.setGreeting),
 		api.Handle("notes.list", cfg.listNotes),   // new: administrators by default
 		api.Handle("notes.purge", cfg.purgeNotes), // new: administrators by default
 	}
@@ -397,7 +396,7 @@ Use `install.sharedFolder: {mode: dedicated, key: media, name: __PACKAGE__, perm
 for shared data. DSM creates the app-specific folder and grants the declared
 package-account permission. The wizard defaults to it and validates any existing
 folder choice before Next. The backend reports the real state: the `sharedfolder.status` operation (administrators only
-unless you change `permissions.json`) returns each folder with what the App needs, what the
+unless you change the operation registry) returns each folder with what the App needs, what the
 package account has (`none`, `read`, `write`) and a `state` (`ready`, `pending`, `missing`,
 `ambiguous`). `cfg.SharedFolderPath(key)` returns the path or an error that names the
 Control Panel step instead of failing on a file read. Keep `SharedFolderRequired` in
@@ -426,3 +425,21 @@ Submit with `bg.jobs.submit`; use `bg.jobs.get` for progress and
 `bg.jobs.cancel` to cancel. Pause/resume and existing schedule routes continue
 to operate on retained imported copies. Schedules require explicit consent and
 reprocess the fixed private copy, without rereading the source file.
+
+## Operation registry
+
+Declare each App method once in `operations.json`, including its English summary,
+params/result schemas, effect, permission, flow and required `ai` class. The
+SDK contributes its own hidden operation catalog for enabled capability routes.
+Register the handler, then run `synopkgland ctl generate`, `synopkgland ctl
+generate --check` and `synopkgland check`. Build refuses generated drift or a
+route/spec mismatch. Never maintain commands or operation descriptions in the
+manifest or skill by hand. Read the generated `generated/operations.md`.
+
+`examples/operations.json` illustrates read, preview, draft, human-only and hidden.
+It is documentation only: its operations have no handlers and are never shipped
+as commands. Copy a declaration only when implementing a real App capability.
+Draft writes require a non-mutating preview and explicit human confirmation.
+Long operations use the existing job flow; tools own polling and pagination.
+
+Use a matching SDK/CLI/templates release containing the registry support.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.43.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.47.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/cmd/app/main.go

@@ -47,6 +47,8 @@ var (
 	portal = ""
 	// backend.timeout_seconds, api.DefaultRequestTimeout unless set.
 	requestTimeout = ""
+	// Build enables registry equality only for Apps that opt in to ctl.registry.
+	operationRegistry = ""
 )
 
 // deadline is the CGI request deadline: requestTimeout seconds, or
@@ -73,7 +75,7 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		cfg := app.Config{PackageID: packageID, Version: version, DataDir: ".", Portal: portal != ""}
+		cfg := app.Config{PackageID: packageID, Version: version, DataDir: ".", Portal: portal != "", PortalExecutor: portal == "executor"}
 		if app.SessionFilesEnabled(fileStation) {
 			cfg.SessionFiles = filestation.Local(cfg.DataDir)
 		}
@@ -131,7 +133,12 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	srv, err := api.NewServerWithPermissions(auth, permissions, app.Routes(cfg)...)
+	var srv *api.Server
+	if operationRegistry == "on" {
+		srv, err = api.NewServerWithOperations(auth, appapi.Operations(), permissions, app.Routes(cfg)...)
+	} else {
+		srv, err = api.NewServerWithPermissions(auth, permissions, app.Routes(cfg)...)
+	}
 	if err != nil {
 		log.Fatal(err)
 	}

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.43.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.47.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.43.0 h1:SgUaOxjyOeiZE44Z+JAmZXtoy+idkgVF74N7palFH4k=
-github.com/synopackageland/syno-pkg-land-sdk v0.43.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.47.0 h1:NYGAo/D1MTuC/rfHe61JpVdgBmiY4DW5C0AvNvNIVxU=
+github.com/synopackageland/syno-pkg-land-sdk v0.47.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/api/operations.json

@@ -0,0 +1,5 @@
+{
+  "format": "synopkgland.api",
+  "version": 2,
+  "operations": {}
+}

package/templates/native-go/backend/internal/api/permissions.go

@@ -24,3 +24,10 @@ func Permissions() ([]byte, error) {
 	}
 	return permissionsJSON, nil
 }
+
+// operationsJSON is generated from the App registry and the SDK capability catalog.
+//
+//go:embed operations.json
+var operationsJSON []byte
+
+func Operations() []byte { return operationsJSON }

package/templates/native-go/backend/internal/api/permissions.json

@@ -1,5 +1,7 @@
 {
   "schema": 1,
   "default": "administrators",
-  "methods": {}
+  "methods": {
+    "app.status": "administrators"
+  }
 }

package/templates/native-go/backend/internal/app/routes.go

@@ -1,7 +1,5 @@
-// Package app holds this package's business operations. Add a route here and
-// register its handler here. App permissions live in internal/api/permissions.json; SDK capability routes
-// use the immutable SDK policy.
-// unlisted methods require membership in DSM's administrators group.
+// Package app holds the business handlers. Declare each operation once in
+// operations.json; ctl generate writes the policy and SDK runtime registry.
 //
 //line __PACKAGE__/internal/app/routes.go:1
 package app
@@ -10,13 +8,10 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"runtime"
 	"time"
-	"unicode/utf8"
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
@@ -59,8 +54,6 @@ func Routes(cfg Config) []api.Route {
 	routes = append(routes, []api.Route{
 		api.Handle("app.status", cfg.status),
 		api.Handle("sharedfolder.status", cfg.sharedFolderStatus),
-		api.Handle("greeting.get", cfg.getGreeting),
-		api.Handle("greeting.set", cfg.setGreeting),
 	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
@@ -81,43 +74,6 @@ func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage
 	}, nil
 }
 
-type greeting struct {
-	Text      string `json:"text"`
-	UpdatedBy string `json:"updated_by,omitempty"`
-}
-
-func (cfg Config) greetingPath() string { return filepath.Join(cfg.DataDir, "greeting.json") }
-
-func (cfg Config) getGreeting(context.Context, api.Caller, json.RawMessage) (any, error) {
-	data, err := os.ReadFile(cfg.greetingPath())
-	if errors.Is(err, fs.ErrNotExist) {
-		return greeting{Text: "Hello"}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var g greeting
-	return g, json.Unmarshal(data, &g)
-}
-
-func (cfg Config) setGreeting(_ context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-	var in struct {
-		Text string `json:"text"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if n := utf8.RuneCountInString(in.Text); n < 1 || n > 200 {
-		return nil, api.BadRequest("text must be 1 to 200 characters")
-	}
-	g := greeting{Text: in.Text, UpdatedBy: caller.User()}
-	data, err := json.Marshal(g)
-	if err != nil {
-		return nil, err
-	}
-	return g, writeFileAtomic(cfg.greetingPath(), data)
-}
-
 // decodeParams decodes params strictly: unknown fields are an error.
 func decodeParams(params json.RawMessage, into any) error {
 	if len(params) == 0 {

package/templates/native-go/backend/internal/app/routes_test.go

@@ -109,8 +109,6 @@ var sampleOutcome = map[string]string{}
 var sampleParams = map[string]string{
 	"app.status":          `{}`,
 	"sharedfolder.status": `{}`,
-	"greeting.get":        `{}`,
-	"greeting.set":        `{"text":"Hi"}`,
 }
 
 func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {
@@ -174,30 +172,11 @@ func TestStatusReportsPackageAndCaller(t *testing.T) {
 	}
 }
 
-func TestGreetingDefaultsAndAdminCanChangeIt(t *testing.T) {
-	cfg := testConfig(t)
-	_, out := call(t, cfg, alice, "greeting.get", `{}`)
-	if got := out["data"].(map[string]any)["text"]; got != "Hello" {
-		t.Fatalf("default greeting = %v", got)
-	}
-	if code, out := call(t, cfg, alice, "greeting.set", `{"text":"Hi from DSM"}`); code != "" {
-		t.Fatalf("set: %q %v", code, out)
-	}
-	_, out = call(t, cfg, alice, "greeting.get", `{}`)
-	data := out["data"].(map[string]any)
-	if data["text"] != "Hi from DSM" || data["updated_by"] != "alice" {
-		t.Fatalf("after set: %v", data)
-	}
-}
-
-func TestGreetingSetValidatesText(t *testing.T) {
-	for _, params := range []string{`{}`, `{"text":""}`, `{"text":"` + strings.Repeat("x", 201) + `"}`, `{"text":7}`, `{"text":"ok","extra":1}`} {
-		cfg := testConfig(t)
-		code, _ := call(t, cfg, alice, "greeting.set", params)
-		if code != "bad_request" {
-			t.Errorf("%s: %q, want bad_request", params, code)
+func TestSampleOperationsAreAbsent(t *testing.T) {
+	for _, method := range []string{"greeting.get", "greeting.set"} {
+		if code, _ := call(t, testConfig(t), alice, method, `{}`); code != "unknown_method" {
+			t.Fatalf("sample route %s remains: %s", method, code)
 		}
-		assertDataDirEmpty(t, cfg)
 	}
 }
 

package/templates/native-go/dsm-package.yaml

@@ -103,33 +103,7 @@ capabilities: {}
 #     items:
 #       - key: jobs          # i18n key uninstall.state.jobs
 
-# Explicit AI commands. Internal/UI methods are not automatically exposed.
+# Operation metadata has one source. Generate/check before building.
 ctl:
   enabled: true
-  commands:
-    status.show:
-      cli: [status]
-      summary: Show this App's status and verified caller
-      effect: read
-      flow: {type: invoke, method: app.status}
-      paramsSchema: {type: object, additionalProperties: false}
-      examples: [{}]
-    greeting.get:
-      cli: [greeting, get]
-      summary: Read the greeting
-      effect: read
-      flow: {type: invoke, method: greeting.get}
-      paramsSchema: {type: object, additionalProperties: false}
-      examples: [{}]
-    greeting.set:
-      cli: [greeting, set]
-      summary: Set the greeting
-      effect: write
-      flow: {type: invoke, method: greeting.set}
-      paramsSchema:
-        type: object
-        required: [text]
-        additionalProperties: false
-        properties:
-          text: {type: string, minLength: 1, maxLength: 200, description: Greeting text, examples: [Hello]}
-      examples: [{text: Hello}]
+  registry: operations.json

package/templates/native-go/examples/operations.json

@@ -0,0 +1,112 @@
+{
+  "format": "synopkgland.api",
+  "version": 2,
+  "operations": {
+    "example.read": {
+      "summary": "Read a resource",
+      "ai": "read",
+      "cli": [
+        "example",
+        "read"
+      ],
+      "effect": "read",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "example.read"
+      }
+    },
+    "example.preview": {
+      "summary": "Preview a resource change",
+      "ai": "preview",
+      "cli": [
+        "example",
+        "preview"
+      ],
+      "effect": "read",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "example.preview"
+      }
+    },
+    "example.draft": {
+      "summary": "Draft a resource change for human confirmation",
+      "ai": "draft",
+      "cli": [
+        "example",
+        "draft"
+      ],
+      "effect": "write",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "example.draft"
+      },
+      "preview": "example.preview"
+    },
+    "example.human": {
+      "summary": "Delete a resource after human review",
+      "ai": "human-only",
+      "cli": [
+        "example",
+        "human"
+      ],
+      "effect": "destructive",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "example.human"
+      }
+    },
+    "example.hidden": {
+      "summary": "Read internal state",
+      "ai": "hidden",
+      "cli": [
+        "example",
+        "hidden"
+      ],
+      "effect": "read",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "example.hidden"
+      }
+    }
+  }
+}

package/templates/native-go/operations.json

@@ -0,0 +1,27 @@
+{
+  "format": "synopkgland.api",
+  "version": 2,
+  "operations": {
+    "app.status": {
+      "summary": "Read App status",
+      "ai": "read",
+      "cli": [
+        "app",
+        "status"
+      ],
+      "effect": "read",
+      "permission": "administrators",
+      "paramsSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "resultSchema": {
+        "type": "object"
+      },
+      "flow": {
+        "type": "invoke",
+        "method": "app.status"
+      }
+    }
+  }
+}

package/templates/native-go/ui/app.js

@@ -36,23 +36,13 @@
   function mount(root, ctx) {
     var t = ctx.t;
     var status = el("dl", { class: "dsmapp-facts" });
-    var greeting = el("p", { class: "dsmapp-greeting", text: t("app.loading") });
-    var setBy = el("p", { class: "dsmapp-note", hidden: "" });
-    var input = el("input", { type: "text", maxlength: "200", "aria-label": t("greeting.label"), placeholder: t("greeting.label") });
-    var save = el("button", { type: "submit", text: t("greeting.save") });
     var refreshButton = el("button", { type: "button", class: "dsmapp-secondary", text: t("app.refresh") });
     var message = el("p", { class: "dsmapp-message", role: "status" });
-    var form = el("form", { class: "dsmapp-form", hidden: "" }, [input, save]);
-    var adminOnly = el("p", { class: "dsmapp-note", hidden: "", text: t("greeting.adminOnly") });
     var portal = ctx.portal ? el("section", { class: "dsmapp-portal" }) : null;
 
     root.classList.add("dsmapp");
     root.replaceChildren(
       el("div", { class: "dsmapp-header" }, [el("h1", { text: t("app.title") }), refreshButton]),
-      greeting,
-      setBy,
-      form,
-      adminOnly,
       message,
       el("h2", { text: t("status.heading") }),
       status
@@ -80,24 +70,9 @@
           status.appendChild(el("dt", { text: row[0] }));
           status.appendChild(el("dd", { text: row[1] }));
         });
-        form.hidden = !data.admin;
-        adminOnly.hidden = data.admin;
-      }).catch(showError);
-      ctx.call("greeting.get").then(function (data) {
-        greeting.textContent = data.text;
-        setBy.textContent = data.updated_by ? t("greeting.setBy", { user: data.updated_by }) : "";
-        setBy.hidden = !data.updated_by;
       }).catch(showError);
     }
 
-    form.addEventListener("submit", function (event) {
-      event.preventDefault();
-      save.disabled = true;
-      ctx.call("greeting.set", { text: input.value })
-        .then(function () { input.value = ""; refresh(); })
-        .catch(showError)
-        .then(function () { save.disabled = false; });
-    });
     refreshButton.addEventListener("click", refresh);
 
     ctx.reopen(refresh);