Capabilities

A capability gives your package one extra power on the NAS. Without any, your handlers run as the package account and keep private data. You add capabilities when you create the project (init --with) or later (add). Each one maps to a key under capabilities: in dsm-package.yaml.

Capability	`--with` / `add` name	Manifest key
Files	`files`	`files: session`
Login	`login`	`identity: standalone`
Jobs	`jobs`	`jobs: true`
Delegate	`delegate`	`delegate: {…}` (turns on `jobs` too)
Root operations	`root-ops`	`rootOps: true`

synopkgland add files jobs

add updates the manifest and the files the CLI owns. It keeps your handlers and pages. A file you edited that add would replace stops it with ADD_FILE_CONFLICT. See Existing native product for packages that do not use these templates.

Two kinds of app

Kind	Capabilities	Root	Approval	Uninstall
App without privileges	None, `files`, `login`, `jobs`	Never: not at install, while running or at uninstall.	None	DSM keeps the app’s rules in Control Panel > Application Privileges. An administrator removes them.
Executor app	`delegate` or `root-ops`	Only through the protected executor, limited to the approved policy.	A DSM administrator approves once.	The executor removes the app’s rules in Control Panel > Application Privileges and stops its Login Portal address.

Only an executor app can declare portal. See Portal and Data and removal.

Who your code runs as

Capability	Your code runs as	What it is for	Guide
None (base)	The package account	Handlers, settings and private data.	Native app
`files`	The signed-in user, through their own DSM session	Browse, upload and download the user’s NAS files while the user is signed in to DSM. File Station applies the user’s rights.	Files
`login`	The package account, with an app session for the person	Sign in with a Synology account outside the DSM desktop. The app session identifies the person. It does not give File Station access.	Login
`jobs`	The package account	Work that continues after the browser closes, on a private copy of the input.	Jobs
`delegate`	A protected executor, writing into a folder the user picked	Move a finished file into the user’s folder after the user is offline.	Delegate
`root-ops`	root, for a fixed script you ship	An administrator runs a named operation such as `root/whoami.sh`. No arguments are possible.	Root operations

Declaring a capability does not decide who may call your methods. Each method needs a rule in backend/internal/api/permissions.json. A method without a rule is administrators only. The optional entry field in dsm-package.yaml limits who can open the app: admin-only or app-privilege. See Manifest.

What needs administrator approval

Action	Who	When
`files`, `jobs`, `login`	Nobody	Ready once the package is installed.
A Shared Folder you select in the installation wizard	A DSM administrator	After install, give the package account access in Control Panel > Shared Folder > Edit > Permissions > System internal user. See Shared Folder.
`delegate` and `root-ops`	A DSM administrator	After install, the administrator confirms their DSM password once in the app window. Until then `status` shows `needs-admin-approval`.

Both delegate and root-ops use one approval. It covers the executor and its policy. The administrator approves again when you change entry, the delegate scope, destinations, lifetime or operations, or any root/*.sh file. A version bump, a UI change or a newer SDK with the same policy does not need a new approval. Uninstalling removes the approval and the delegations, so a reinstall needs a fresh one. See Data and removal.

What each template supports

Template	`files`	`login`	`jobs`	`delegate`	`root-ops`
`native-go` with Vue	Yes	Yes, over HTTPS	Yes	Yes	Yes
`native-go` with a plain UI	Backend only. No generated UI.	No	Backend only. No generated UI.	Backend only. The generated administrator panel cannot confirm a scope.	Yes
`binary`	No	No	No	No	Not scaffolded
`compose`	No	No	No	No	No
Existing native	No	No	No	No	No

A combination the template cannot use fails check with CAPABILITY_UNSUPPORTED or CAPABILITY_COMBINATION_INVALID. Container apps have their own login and access model. See Container app.

Limits

Limit	Value
`login` with a plain UI	Refused by `init` and `check`. The `login` UI needs a Vue UI.
`jobs` with `daemon`	Refused, unless `delegate` has `lifetime: until-revoked`.
`jobs` worker	Only the built-in worker `sha256-v1`. `worker:` accepts no other name.
`root-ops` minimum DSM	`os_min_ver` 7.1-42661 or later.
`armv7`	`native-go` and `binary` with every capability. The armv7 executor, jobs and daemon are built but not yet verified on a NAS.
Architectures for the executor	`x86_64`, `aarch64` and `armv7`.

root-ops needs at least one root/<name>.sh, and a root/ folder without rootOps: true fails with STANDALONE_ROOT_OPS_UNUSED.

Troubleshooting

Symptom or code	Cause	Fix
`needs-admin-approval` in `status`	`delegate` or `root-ops` is declared and not approved, or the policy changed.	A DSM administrator approves in the app window.
`CAPABILITY_UNSUPPORTED`	The template does not support the capability.	Use `native-go`, or remove the capability. See Errors.
`CAPABILITY_COMBINATION_INVALID`	`login` with a plain UI, or `jobs` with `daemon`.	Use the Vue UI, or drop one of the two.
`ADD_FILE_CONFLICT`	`add` would replace a file you changed.	Read the listed paths, merge by hand, and run `add` again.