@synopackageland/cli 0.10.1 → 0.10.3

package/dist/standalone/sdk-check.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { appSdkVersion, SDK_DEPENDENCY, SDK_PACKAGE } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor } from "../runtime/sdk-source.js";
 const minorLine = (version) => version.split(".").slice(0, 2).join(".");
 /** The file that names each backend kind's SDK version. */
 const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "Cargo.lock", python: "backend.sdk", node: "backend.sdk" };
@@ -29,6 +29,9 @@ export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VER
     if (minorLine(version) !== minorLine(cliVersion)) {
         problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports only SDK ${minorLine(cliVersion)}.x. Use the matching CLI, or raise the SDK to ${minorLine(cliVersion)}.x.` });
     }
+    else if (sdkBelowFloor(version)) {
+        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports SDK ${SDK_FLOOR} or later. Raise the SDK to ${SDK_FLOOR} or later.` });
+    }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
         problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json has ${SDK_PACKAGE} ${frontend.spec} (${frontend.version ?? "version unreadable"}), while ${file} requires ${version}; the two must match.` });

package/dist/standalone/spk.d.ts

@@ -1,6 +1,7 @@
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { StandaloneManifest } from "./manifest.js";
 import { type ExecutorArtifact } from "../runtime/executor-build.js";
+import type { PortalCatalogs } from "./portal-window.js";
 export declare const LIFECYCLE_SCRIPTS: readonly ["preinst", "postinst", "preuninst", "postuninst", "preupgrade", "postupgrade", "start-stop-status"];
 export declare class StandaloneBuildError extends Error {
     readonly code: string;
@@ -18,6 +19,8 @@ export interface AssembleOptions {
     backgroundWorker?: string;
     /** A Python, Node or Rust App's finished directory, installed as target/app. */
     app?: string;
+    /** The SDK's portal panel text, required exactly when the manifest declares a portal. */
+    portalText?: PortalCatalogs;
 }
 /**
  * Packs an unsigned Standalone Package SPK. DSM runs installation/lifecycle

package/dist/standalone/spk.js

@@ -12,10 +12,12 @@ import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
 import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
+import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
 import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
+import { loginStyleAssets } from "../build-spk/login-style.js";
 import { copyStandaloneNotices } from "../build-spk/notices.js";
 import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
@@ -65,8 +67,11 @@ export async function assembleStandaloneSpk(options) {
         const appDir = join(uiRoot, "app");
         copyUiTree(manifest.ui.dir, appDir);
         const assetVersion = digestTree(appDir).slice(0, 12);
-        writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons));
-        writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons));
+        const login = manifest.portal ? loginStyleAssets(manifest.loginStyle) : undefined;
+        writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons, login?.fields));
+        for (const [path, bytes] of login?.files ?? [])
+            writeFile(join(uiRoot, path), bytes);
+        writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
         writeUiTexts(uiRoot, appTitle(manifest));
@@ -141,6 +146,8 @@ export async function assembleStandaloneSpk(options) {
         for (const name of LIFECYCLE_SCRIPTS) {
             writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
+        for (const name of manifest.appScripts ?? [])
+            copyExecutable(join(manifest.root, APP_SCRIPTS_DIR, name), join(staging, APP_SCRIPTS_SPK_DIR, name));
         const folder = manifest.sharedFolder;
         const steps = manifest.capabilities.delegate?.scope === 'install-selected'
             ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
@@ -171,7 +178,7 @@ function copyExecutable(source, target) {
 }
 function writeFile(path, content, mode = FILE_MODE) {
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, content, "utf8");
+    writeFileSync(path, content);
     chmodSync(path, mode);
 }
 function quote(value) {

package/dist/validate.js

@@ -9,6 +9,8 @@ import { classifyComposeRoute, collectComposeInterpolations, collectVolumeSource
 import { usesAuthGateway } from "./contract/web-launch.js";
 import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { loadStandaloneManifest } from "./standalone/manifest.js";
+import { APP_SCRIPTS_DIR, readAppScripts } from "./standalone/app-scripts.js";
+import { manifestPolicyProblem } from "./runtime/executor-policy-check.js";
 import { COMPOSE_FILENAME, CONTRACT_FILENAME, DSM_PACKAGE_FILENAME, } from "./discovery.js";
 import { declaredPrivilegeFlags } from "./compose/privilege.js";
 export function validateProject(project, options = {}) {
@@ -29,7 +31,9 @@ export function validateProject(project, options = {}) {
     }
     if (hasStandalone) {
         const loaded = isNativeLayout(project.root) ? loadNativeLayout(project.root) : loadStandaloneManifest(project.root);
-        return loaded.ok ? { ok: true, errors: [] } : { ok: false, errors: loaded.errors.map(error => ({
+        const policy = loaded.ok && "capabilities" in loaded.manifest ? manifestPolicyProblem(loaded.manifest) : undefined;
+        const problems = loaded.ok ? (policy ? [policy] : []) : loaded.errors;
+        return !problems.length ? { ok: true, errors: [] } : { ok: false, errors: problems.map(error => ({
                 ...error, span: { file: DSM_PACKAGE_FILENAME, line: 1, column: 1 },
                 suggestion: getErrorCode(error.code)?.suggestion ?? "Fix the schema 2 fields and capability declarations in dsm-package.yaml.",
             })) };
@@ -40,6 +44,7 @@ export function validateProject(project, options = {}) {
     if (capabilities !== undefined) {
         errors.push(makeError("CAPABILITY_UNSUPPORTED", contractSpan(contractFile, 1, 1, "capabilities"), "A compose project does not support capabilities.", "Remove capabilities, or use a dsm-package.yaml native-go project."));
     }
+    readAppScripts(project.root, e => errors.push({ ...e, span: { file: APP_SCRIPTS_DIR, line: 1, column: 1 }, suggestion: getErrorCode(e.code).suggestion }));
     if (profile === "listing") {
         for (const { name, type, code } of findListingUnsupportedInstallTypes(parsed.contract)) {
             const pos = getValuePosition(parsed.doc, ["install", name, "type"]) ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.10.1",
+    "@synopackageland/templates": "0.10.3",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",
@@ -49,7 +49,6 @@
     "url": "https://github.com/synopackageland/syno-pkg-land-cli/issues"
   },
   "exports": {
-    "./authorization-sdk": "./dist/authorization-sdk.js",
     "./dist/*": "./dist/*",
     "./package.json": "./package.json",
     "./native-layout": "./dist/standalone/native-layout.js"

package/skills/SKILL.md

@@ -13,7 +13,9 @@ Never install, uninstall, publish or modify NAS data without task authorization.
 
 Native projects use schema 2 capabilities and `--with files,jobs,login,root-ops,delegate`; use `add` for existing projects. Prefer `check --json`, `build --json`, `inspect <spk> --json`, `deploy --dry-run --json`, and `status --host <profile> --json` for structured results. Read the conflict policy in reference/create.md before adding overlays.
 
-Read reference/portal.md before declaring or changing a DSM Application Portal alias (`add portal`); DSM owns the saved setting, and only an App with rootOps or delegate may declare one. Read reference/files.md and reference/identity.md for capability boundaries. RootOps and delegate share one-time protected executor boot/control setup with digest approval. Existing native products can explicitly use the separate authorization-sdk build-time adapter; do not mix its tasks with generated executor capabilities. App sessions alone do not grant NAS file authority.
+Read reference/portal.md before declaring or changing a DSM Application Portal alias (`add portal`); DSM owns the saved setting, and only an App with rootOps or delegate may declare one. Read reference/files.md and reference/identity.md for capability boundaries. RootOps and delegate share one-time protected executor boot/control setup with digest approval. Existing native products can explicitly use the separate native runtimes in @synopackageland/sdk/native; do not mix its tasks with generated executor capabilities. App sessions alone do not grant NAS file authority.
+
+Read [reference/lifecycle.md](reference/lifecycle.md) before editing `dsm-scripts/` (preinst, postinst, preupgrade, postupgrade, preuninst, postuninst, start-stop-status): the SDK runs them inside its generated scripts as the package account; never add root work or repeat SDK steps there.
 
 Read [reference/ui-vue.md](reference/ui-vue.md) when editing Vue components in the native-go Vue template; use the installed SDK contracts, keep DSM embedding boundaries, and verify the actual app.
 

package/skills/reference/create.md

@@ -32,7 +32,7 @@ native-go 與 binary 使用 `dsm-package.yaml` 的 `schema: 2`，backend 寫 `ki
 既有 native-go 專案用 `synopkgland add files jobs login`；已存在能力回報 no-op。overlay 檔案已有不同內容或 stub 被改動時，add 拒絕並列出衝突；不修改業務 routes 或 App.vue。
 check、inspect、build、deploy、status 支援 `--json`，stdout 只有單一 JSON 物件，錯誤包含 code、message、hint；進度在 stderr。
 
-rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected executor、boot/control tasks；精確 task readback 與 digest health 一致才 ready；policy（operations、scope、root 腳本）變更須重核准，policy 不變的 executor 更新會自動 repin，install-selected 的 scope 需管理員確認一次。Vue App 只在 SDK 的 ExecutorSettings 核准；plain UI 由 DSM 視窗面板核准，兩者都在面板內輸入密碼並走 PasswordConfirm。native 產品另可明確 opt-in authorization-sdk adapter，不與 generated executor tasks 混用。SDK off stub 與 routes_test.go 的預設 policy scaffold 只有內容仍等於 bundled base 時才會替換；App 自訂版本拒絕。
+rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected executor、boot/control tasks；精確 task readback 與 digest health 一致才 ready；policy（operations、scope、root 腳本）變更須重核准，policy 不變的 executor 更新會自動 repin，install-selected 的 scope 需管理員確認一次。Vue App 只在 SDK 的 ExecutorSettings 核准；plain UI 由 DSM 視窗面板核准，兩者都在面板內輸入密碼並走 PasswordConfirm。native 產品另可明確 opt-in `@synopackageland/sdk/native` 的 runtime，不與 generated executor tasks 混用。SDK off stub 與 routes_test.go 的預設 policy scaffold 只有內容仍等於 bundled base 時才會替換；App 自訂版本拒絕。
 
 ## Python、Node、Rust App
 
@@ -100,6 +100,7 @@ width、minWidth 是 320–3840，height、minHeight 是 240–2160，最小值
 ```yaml
 root:
   state: true            # root_state：/volumeN/@synopkgland/<package>，只有 root 可讀，升級保留
+  start: migrate         # 每次安裝或升級後第一次啟動時由 executor 執行一次（install，或 upgrade <前一版>）
   stop: prepare          # 套件停止與升級時由 executor 執行（stop 或 prepare-upgrade）
   programs:
     scan:
@@ -108,8 +109,11 @@ root:
       run: {timeout_s: 60}                  # root.run：1–120 秒，max_output ≤ 64 MiB
       job: {timeout_s: 3600, max_concurrent: 1}  # root.start 與 root.jobs.*
     prepare: {}          # 沒有 run、job：只作為 stop 步驟
+    migrate: {}          # 沒有 run、job：只作為 start 步驟
 ```
 
+start、stop 步驟與 `uninstall.purge.root` 都以 root、無 session 執行，只在管理員核准有效時跑；這些程式不能宣告 run 或 job（session 要用時以另一個名稱設定，可指向同一份內容）。start 步驟在新版本第一次啟動、executor 開 socket 並回讀核准任務之後執行，最多 60 秒；執行期間 executor 只回應 `status`（`state: "starting"`），其他請求回可重試的 `EXECUTOR_STARTING`，DSM 視窗的核准會等它結束，失敗只寫進 executor log，不擋啟動；同一版本不重跑，程式要能重複執行。結果由 executor `status` 的 `start_step` 讀取（`pending`、`ok`、`failed`，含 exit 與 output）。DSM 的 start 只寫入要求就返回，所以 `dsm-scripts/postinst`、`postupgrade`、`start` 看不到它的結果；root 的清理或遷移放 `root.start`，非特權的收尾放 `dsm-scripts/`。宣告 `root.start` 會改變 policy digest，需要管理員重新核准；沒有宣告的 App policy 不變。需要 SDK 0.10.3 以上。
+
 schema 是 executor 的封閉子集（每個 object 都要 `additionalProperties: false`，key `[a-z0-9_]`，pattern 為 RE2）。這些設定需要支援它們的 SDK executor（`EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED`）。preupgrade 呼叫 `executor/lifecycle stop --upgrade`；舊 SDK 的 helper 不認得此旗標時改用一般 stop。
 
 ## Permanent destination integration

package/skills/reference/identity.md

@@ -75,6 +75,6 @@ recovered admission of that ref returns `canceled` and never copies; a producer
 cancel is also written to the mirror first, so `MoveFromStaging` and the worker
 sweep forward the cancel instead of admitting it.
 
-RootOps/delegate share PasswordConfirm-approved digest-pinned setup with exact task readback and health. Pins changes require reapproval. The separate native authorization-sdk adapter must not mix its tasks with generated executor tasks.
+RootOps/delegate share PasswordConfirm-approved digest-pinned setup with exact task readback and health. Pins changes require reapproval. The separate native runtimes (@synopackageland/sdk/native) must not mix its tasks with generated executor tasks.
 
 Compose uses its DSM gateway plus upstream authentication. A fixed service UID/GID identifies the service, not the browser user. Do not infer general SSO or per-user file authority from a service mount.

package/skills/reference/lifecycle.md

@@ -0,0 +1,110 @@
+# DSM lifecycle scripts
+
+DSM runs a package's lifecycle scripts at install, upgrade, uninstall, start and
+stop. `synopkgland build` generates all of them, because the SDK's own steps
+(executor, daemon, background worker, portal, Shared Folder, data deletion)
+live there. An App adds its own work with a file of the same name in the
+project's `dsm-scripts/` folder (`scripts/` stays free for your own
+tools). Every template ships these files; each one does
+nothing (`exit 0`) until you edit it.
+
+```
+dsm-scripts/preinst    dsm-scripts/postinst    dsm-scripts/preupgrade
+dsm-scripts/postupgrade  dsm-scripts/preuninst  dsm-scripts/postuninst
+dsm-scripts/start-stop-status
+```
+
+There is no setting in `dsm-package.yaml` or `synology-app.yaml`: a file with
+a DSM script name is used, a missing file changes nothing. `check` and `build`
+refuse any other name in `dsm-scripts/` (`APP_SCRIPT_UNKNOWN`), a file that is not
+executable (`APP_SCRIPT_NOT_EXECUTABLE`), a file without `#!`
+(`APP_SCRIPT_NO_SHEBANG`) and a symlink or directory (`APP_SCRIPT_INVALID`).
+prereplace and postreplace are not supported: DSM runs them only for
+`install_replace_packages`, which the SDK never declares. Dotfiles are ignored.
+
+## How the SDK runs your script
+
+The SPK carries your file as `scripts/app/<name>`. The generated
+`scripts/<name>` runs the SDK steps in a subshell and calls your script with
+the same arguments and environment. You cannot replace or skip an SDK step.
+`inspect` lists the App scripts and flags an edited wrapper.
+
+| Script | Order | Your exit code |
+| --- | --- | --- |
+| preinst, postinst, postupgrade, postuninst | SDK, then App | An SDK failure stops before your script; yours becomes the script's exit code |
+| preupgrade, preuninst | App, then SDK | Non-zero stops before the SDK steps and DSM aborts the upgrade or uninstall |
+| start-stop-status `start`, `prestart`, `status` | SDK, then App | `start`: a failure makes the SDK stop again, then DSM reports the start failed. `status`: asked only while the SDK reports running |
+| start-stop-status `stop`, `prestop` | App, then SDK | The SDK stop always runs; the script fails if either failed |
+| start-stop-status `restart` | `stop`, then `start` | As above |
+
+Why `stop` and a failed `start` always stop the SDK: DSM then treats the
+package as stopped, so the SDK must not leave its ingress, daemon or worker
+running.
+
+## What DSM does (DSM 7.4, Package Developer Guide)
+
+- **Install:** preinst, files copied, postinst, then start-stop-status
+  `prestart` (only with INFO `precheckstartstop`) and `start` if the user
+  chose to start.
+- **Upgrade:** old `stop`; the NEW package's preupgrade, run against the old
+  install; the OLD package's preuninst; the old files are deleted; the OLD
+  package's postuninst; the new preinst, files, postinst, postupgrade; then
+  `start` if it was running. So an upgrade also runs the old preuninst and
+  postuninst, with `SYNOPKG_PKG_STATUS=UPGRADE`.
+- **Uninstall:** `stop`, preuninst, files deleted, postuninst. postuninst
+  cannot read `$SYNOPKG_PKGDEST` any more; `scripts/app` still exists.
+- **Start / stop:** `prestart`, `start` / `prestop`, `stop`. At boot DSM runs
+  `start` and at shutdown `stop`, with `SYNOPKG_PKG_STATUS` empty.
+
+`SYNOPKG_PKG_STATUS` is `INSTALL`, `UPGRADE`, `UNINSTALL`, `START`, `STOP` or
+empty (boot and shutdown). Guard uninstall-only work with
+`[ "$SYNOPKG_PKG_STATUS" = UNINSTALL ]`.
+
+Exit codes have DSM's meaning: non-zero preinst, preupgrade or preuninst
+aborts the operation; non-zero postinst or postupgrade leaves the package
+failed; the guide gives postuninst no meaning. `status` returns 0 running,
+1 dead with a pid file, 2 dead with a lock file, 3 not running, 4 unknown,
+150 broken.
+
+To show the user a message, write plain text to `$SYNOPKG_TEMP_LOGFILE`
+(for example `echo "Port 8080 is in use." > "$SYNOPKG_TEMP_LOGFILE"`) and exit
+non-zero; DSM shows it after the action. Branch on `$SYNOPKG_DSM_LANGUAGE`
+(`enu`, `cht`, ...) to localize. Do not rely on it being shown on success.
+
+## Environment
+
+| Variable | Meaning |
+| --- | --- |
+| `SYNOPKG_PKGNAME`, `SYNOPKG_PKGVER`, `SYNOPKG_OLD_PKGVER` | Package id, version, previous version (upgrade only) |
+| `SYNOPKG_PKG_STATUS` | See above |
+| `SYNOPKG_PKGDEST` | Installed files (`/var/packages/<id>/target`) |
+| `SYNOPKG_PKGVAR`, `SYNOPKG_PKGHOME` | Package data and home; they survive an upgrade |
+| `SYNOPKG_TEMP_LOGFILE` | Message file for the user |
+| `SYNOPKG_TEMP_UPGRADE_FOLDER` | Scratch folder from preupgrade to postupgrade |
+| `SYNOPKG_DSM_LANGUAGE`, `SYNOPKG_DSM_VERSION_MAJOR/MINOR/BUILD`, `SYNOPKG_DSM_ARCH` | DSM facts |
+| `SYNOPKG_USERNAME` | Who started the action; empty when DSM did |
+
+Each wizard item `key` arrives as an environment variable of the same name
+(`true`, `false` or text): install wizard in preinst and postinst, upgrade
+wizard in every upgrade script, uninstall wizard in preuninst and postuninst.
+A silent upgrade has no wizard values; use a default.
+
+## Rules
+
+- Scripts run as the package account (`conf/privilege` `run-as: package`),
+  never as root. Root work belongs in `root/*.sh` through the SDK executor
+  (`add root-ops`). Root cleanup or migration after an install or upgrade is
+  `root.start` in dsm-package.yaml: the executor runs it once per version,
+  after an administrator's approval. Package start only requests the
+  executor, so `postinst`, `postupgrade` and `start` cannot wait for that
+  step; keep the unprivileged follow-up here, and read the step's result from
+  the executor `status` (`start_step`).
+- Do not repeat what the SDK does: starting or stopping the daemon, worker or
+  executor, the portal, the Shared Folder, deleting app data (the uninstall
+  wizard), or `uninstall.purge`.
+- Keep scripts short. Neither DSM nor the SDK documents a timeout, so a script
+  that hangs blocks the install or Package Center.
+- Keep pre-scripts to checks; DSM aborts after them, and nothing undoes a
+  change they made.
+- An upgrade runs the old package's preuninst and postuninst; check
+  `SYNOPKG_PKG_STATUS` before deleting anything.

package/skills/reference/portal.md

@@ -6,6 +6,18 @@ Declare: native-go/binary with rootOps or delegate, `portal: {}` or `portal: {al
 
 Build (os_min_ver 7.2-64570+): the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
 
+Login style: every portal build gives the launcher in `ui/config` a DSM `loginStyle`, which Control Panel > Login Portal > Applications draws as the entry's thumbnail and the alias login page uses for its wallpaper and button colour. Without it the thumbnail is blank. The CLI default is a neutral wallpaper, its thumbnail, a login-box mask and colour `#2F6BD8`; the launcher's `loginIcon` is the App icon, so the login page shows the icon beside the NAS name. Override any part in dsm-package.yaml:
+
+```yaml
+login_style:
+  color: "#0F766E"                                   # login button, #RGB or #RRGGBB
+  wallpaper: branding/login-wallpaper.jpg            # JPEG, at least 1920x1080, at most 2 MiB
+  wallpaper_thumbnail: branding/login-thumbnail.jpg  # JPEG 320x200; required with wallpaper
+  title: branding/login-title.png                    # PNG 680x124 (shown at 340x62) in place of icon and NAS name
+```
+
+DSM uses a package wallpaper only when both wallpaper and its thumbnail are set, so they go together. check refuses `login_style` without `portal` and a malformed one (`STANDALONE_LOGIN_STYLE_INVALID`), and a missing image or one of the wrong format or size (`STANDALONE_LOGIN_STYLE_IMAGE_INVALID`); it prints the style in effect. inspect prints it (`loginStyle: {color, wallpaper: default|custom, title: app-icon|custom|none}` in `--json`) and flags a portal SPK without one (`LOGIN_STYLE_MISSING`) or naming a file it does not carry (`LOGIN_STYLE_FILE_MISSING`). An administrator's own wallpaper in Login Portal still wins.
+
 Activate: DSM owns the saved setting. Administrators use the app's portal panel (`ctx.portal.apply(alias)` / `disable()`, DSM `SYNO.Core.AppPortal set` with their own session; DSM refuses non-administrators with 105) or Control Panel > Login Portal > Applications (`ctx.portal.openControlPanel()`). DSM errors map to `portal_alias_invalid`, `portal_alias_reserved`, `portal_alias_in_use`, `admin_required`, `portal_unavailable`.
 
 Read: ordinary users call the Go backend's `portal.status` (`authenticated`), which reads `/var/packages/<package>/etc/AppPortal.json` read-only, bounded (64 KiB, no symlinks, one JSON object, matching app id). Anything else is `unavailable` and the UI shows "ask an administrator". A binary CGI must implement the same `{state, alias}` answer itself or ordinary users never see the link.

package/dist/authorization-sdk.d.ts

@@ -1,6 +0,0 @@
-/** Explicit build-time adapter for native products with their own pinned root tasks.
- * Generated Go capabilities continue to use the protected executor.
- * No task/grant is created by importing this module.
- */
-export { ROOT_RUNTIME, type RootTask } from './standalone/native-root-window.js';
-export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';

package/dist/authorization-sdk.js

@@ -1,6 +0,0 @@
-/** Explicit build-time adapter for native products with their own pinned root tasks.
- * Generated Go capabilities continue to use the protected executor.
- * No task/grant is created by importing this module.
- */
-export { ROOT_RUNTIME } from './standalone/native-root-window.js';
-export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';

package/dist/standalone/native-authorization-window.d.ts

@@ -1,2 +0,0 @@
-/** Shared host flow. CGI plans are never accepted as completed authorization. */
-export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    // upgrade_reapproval is a reason-only tombstone: it can only explain a pending request.\n    if (d.reason === \"upgrade_reapproval\" && d.state !== \"authorization_required\") throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  // The backend's grant decides: a task still waiting at the window's limit, or\n  // one signalled after it wrote the grant, has still authorized the package.\n  function settled(e) {\n    if (!e || (e.code !== \"root_timeout\" && e.code !== \"root_task_failed\")) throw e;\n    return status().then(function (d) { if (d.state !== \"ready\") throw e; });\n  }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op).catch(settled) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/native-authorization-window.js

@@ -1,36 +0,0 @@
-/** Shared host flow. CGI plans are never accepted as completed authorization. */
-export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options) {
-  var busy = null;
-  function fail(code) { var error = new Error(code); error.code = code; return error; }
-  function status() { return options.call("authorization.status").then(function (d) {
-    if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
-    // upgrade_reapproval is a reason-only tombstone: it can only explain a pending request.
-    if (d.reason === "upgrade_reapproval" && d.state !== "authorization_required") throw fail("authorization_bad_response");
-    return d;
-  }); }
-  function plan(method) { return options.call(method).then(function (p) {
-    if (!p || p.command !== "authorization" || p.schema_version !== 1 || p.phase !== "plan" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail("authorization_bad_response");
-    var seen = {};
-    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
-    return p;
-  }); }
-  // The backend's grant decides: a task still waiting at the window's limit, or
-  // one signalled after it wrote the grant, has still authorized the package.
-  function settled(e) {
-    if (!e || (e.code !== "root_timeout" && e.code !== "root_task_failed")) throw e;
-    return status().then(function (d) { if (d.state !== "ready") throw e; });
-  }
-  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
-  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
-    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op).catch(settled) : null; });
-  }); },Promise.resolve()); }
-  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
-    return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
-  }); },revoke:function () { return exclusive(function () {
-    return plan("authorization.revoke").then(function (p) {
-      if (p.withdraw === true && typeof options.withdraw !== "function") throw fail("authorization_bad_response");
-      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize(["helper_disable"],true) : Promise.resolve();
-      return disabled.then(function () { return p.purge === true ? authorize(["helper_purge"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });
-    }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
-  }); }};
-}`;

package/dist/standalone/native-root-window.d.ts

@@ -1,29 +0,0 @@
-/** Build-time adapter for explicitly approved native product tasks. */
-/** What the window embeds per root operation: the task it may create, and how to recognize it. */
-export interface RootTask {
-    op: string;
-    name: string;
-    header: string;
-    script: string;
-    /** Whether the package backend serves `root.output` for this op; helper ops report through the helper instead. */
-    output: boolean;
-}
-/**
- * `createRootAccess(options)` → `{ state, authorize, run, remove }`, plain
- * ES5 for DSM's desktop. Every DSM call goes through `options.send` (the
- * AppWindow's sendWebAPI) as the signed-in administrator:
- *
- * - authorize: DSM's own password confirmation, then one disabled root task
- *   with exactly the embedded script. The one-use token goes into that single
- *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours (the
- *   first run after an authorize uses the task that authorize just read back), then
- *   waits for its history entry and asks the backend for the output. A queued
- *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
- *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
- *   additionally requires fresh PasswordConfirm and another exact task check.
- * - an older version of our task is "outdated" and never runs; authorizing
- *   again replaces it. A same-named task that is not ours is a "conflict" and
- *   is never run, replaced or deleted.
- */
-export declare const ROOT_RUNTIME: string;