@synopackageland/cli 0.3.10 → 0.4.0

package/dist/standalone/manifest.js

@@ -0,0 +1,276 @@
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { parse } from "yaml";
+import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
+import { checkGlossary, isLocale, loadCatalogs } from "./i18n.js";
+import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
+import { readIntegration } from "./helper.js";
+/**
+ * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
+ * runs as its own DSM package account with a CGI backend and a DSM window UI.
+ */
+export const STANDALONE_MANIFEST = "dsm-package.yaml";
+const KNOWN_FIELDS = new Set([
+    "schema", "package", "version", "build", "displayname", "description",
+    "maintainer", "os_min_ver", "arches", "backend", "ui", "privilege", "i18n", "integration",
+]);
+const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
+const INFO_TEXT_FIELDS = new Set(["displayname", "description"]);
+const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
+const VERSION = /^\d+(\.\d+){0,3}$/;
+const OS_MIN_VER = /^\d+\.\d+(\.\d+)?-\d+$/;
+const GO_MAIN = /^\.\/[A-Za-z0-9_./-]*$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+class Collector {
+    root;
+    errors = [];
+    constructor(root) {
+        this.root = root;
+    }
+    fail(code, message) {
+        this.errors.push({ code, message });
+        return undefined;
+    }
+    /** A project-relative path that stays inside the project. */
+    path(value, field) {
+        if (typeof value !== "string" || value.trim() === "") {
+            return this.fail("STANDALONE_PATH_INVALID", `${field} 必須是專案內的相對路徑。`);
+        }
+        const resolved = resolve(this.root, value);
+        const rel = relative(this.root, resolved);
+        if (isAbsolute(value) || rel.startsWith("..") || isAbsolute(rel)) {
+            return this.fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${field}「${value}」必須位於專案目錄內。`);
+        }
+        return resolved;
+    }
+    text(value, field) {
+        if (typeof value !== "string" || value.trim() === "" || /[\r\n"\\]/.test(value)) {
+            return this.fail("STANDALONE_TEXT_INVALID", `${field} 必須是單行、非空且不含 " 或 \\ 的文字。`);
+        }
+        return value;
+    }
+}
+export function loadStandaloneManifest(root) {
+    const file = join(root, STANDALONE_MANIFEST);
+    if (!existsSync(file)) {
+        return { ok: false, errors: [{ code: "STANDALONE_MANIFEST_MISSING", message: `找不到 ${STANDALONE_MANIFEST}。` }] };
+    }
+    let raw;
+    try {
+        raw = parse(readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        return { ok: false, errors: [{ code: "STANDALONE_MANIFEST_YAML", message: String(error) }] };
+    }
+    const c = new Collector(root);
+    if (!isRecord(raw)) {
+        c.fail("STANDALONE_MANIFEST_YAML", `${STANDALONE_MANIFEST} 必須是 YAML 物件。`);
+        return { ok: false, errors: c.errors };
+    }
+    const manifest = readManifest(raw, c);
+    return manifest && c.errors.length === 0 ? { ok: true, manifest } : { ok: false, errors: c.errors };
+}
+function readManifest(raw, c) {
+    for (const key of Object.keys(raw)) {
+        if (!KNOWN_FIELDS.has(key)) {
+            c.fail("STANDALONE_FIELD_UNKNOWN", `不支援的欄位「${key}」。Standalone Package 不接受自訂 lifecycle scripts 或 DSM conf。`);
+        }
+    }
+    if (raw.schema !== 1) {
+        c.fail("STANDALONE_SCHEMA_INVALID", "schema 必須是 1。");
+    }
+    const privilege = raw.privilege === "none" || raw.privilege === "root"
+        ? raw.privilege
+        : c.fail("STANDALONE_PRIVILEGE_UNSUPPORTED", "privilege 只接受 none（只用套件帳號）或 root（由 DSM 管理員核准的 root 工作）；請見 README「Root access」。");
+    const rootOps = privilege && readRootOps(privilege, c);
+    const packageId = typeof raw.package === "string" && PACKAGE_ID.test(raw.package)
+        ? raw.package
+        : c.fail("STANDALONE_PACKAGE_INVALID", "package 必須以英文字母開頭，只含英數字（2–64 字）。");
+    const version = typeof raw.version === "string" && VERSION.test(raw.version)
+        ? raw.version
+        : c.fail("STANDALONE_VERSION_INVALID", "version 必須是數字版本，例如 1.2.0（build 另外填）。");
+    const build = Number.isInteger(raw.build) && raw.build >= 1 && raw.build <= 9999
+        ? raw.build
+        : c.fail("STANDALONE_BUILD_INVALID", "build 必須是 1–9999 的整數。");
+    const osMinVer = typeof raw.os_min_ver === "string" && OS_MIN_VER.test(raw.os_min_ver)
+        ? raw.os_min_ver
+        : c.fail("STANDALONE_OS_MIN_VER_INVALID", "os_min_ver 格式為 <major>.<minor>-<build>，例如 7.2-64570。");
+    const displayname = c.text(raw.displayname, "displayname");
+    const description = c.text(raw.description, "description");
+    const maintainer = c.text(raw.maintainer, "maintainer");
+    const arches = readArches(raw.arches, c);
+    const backend = arches && readBackend(raw.backend, arches, c);
+    const integration = readIntegration(raw.integration, c.root, e => c.fail(e.code, e.message));
+    if (integration && (privilege !== "root" || backend?.kind !== "go" || rootOps?.some(op => op.name.startsWith("helper_")))) {
+        c.fail("STANDALONE_INTEGRATION_INVALID", "integration 需要 privilege: root 和 backend.go；helper_ 操作名稱保留給 generator。");
+    }
+    const ui = readUi(raw.ui, c);
+    const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
+    if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
+        || !arches || !backend || !ui || !privilege || (privilege === "root" && !rootOps)) {
+        return undefined;
+    }
+    return {
+        root: c.root,
+        package: packageId,
+        version,
+        build,
+        spkVersion: `${version}-${String(build).padStart(4, "0")}`,
+        displayname,
+        description,
+        maintainer,
+        os_min_ver: osMinVer,
+        arches,
+        backend,
+        ui,
+        ...(i18n ? { i18n } : {}),
+        privilege,
+        ...(rootOps ? { rootOps } : {}),
+        ...(integration ? { integration } : {}),
+    };
+}
+function readRootOps(privilege, c) {
+    const dir = join(c.root, ROOT_OPS_DIR);
+    if (privilege === "none") {
+        return existsSync(dir)
+            ? c.fail("STANDALONE_ROOT_OPS_UNUSED", `${ROOT_OPS_DIR}/ 只用在 privilege: root；privilege: none 的套件不會執行它。`)
+            : undefined;
+    }
+    const loaded = loadRootOps(dir);
+    if (!loaded.ok) {
+        loaded.errors.forEach((e) => c.fail(e.code, e.message));
+        return undefined;
+    }
+    return loaded.ops;
+}
+function readArches(value, c) {
+    const ok = Array.isArray(value)
+        && value.length > 0
+        && value.every((arch) => typeof arch === "string" && isNativeArchFamily(arch))
+        && new Set(value).size === value.length;
+    return ok
+        ? value
+        : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64 清單，至少一個。");
+}
+function readBackend(value, arches, c) {
+    if (!isRecord(value) || ("go" in value) === ("binary" in value)) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend 必須恰好有 go 或 binary 其中之一。");
+    }
+    if ("go" in value) {
+        const go = value.go;
+        if (!isRecord(go) || typeof go.main !== "string" || !GO_MAIN.test(go.main) || go.main.includes("..")) {
+            return c.fail("STANDALONE_BACKEND_INVALID", "backend.go 需要 dir 與以 ./ 開頭的 main（例如 ./cmd/app）。");
+        }
+        const dir = c.path(go.dir, "backend.go.dir");
+        return dir ? { kind: "go", dir, main: go.main } : undefined;
+    }
+    const binary = value.binary;
+    if (!isRecord(binary)) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.binary 必須以架構為 key 指向 CGI 執行檔。");
+    }
+    const files = {};
+    for (const arch of arches) {
+        if (!(arch in binary)) {
+            c.fail("STANDALONE_BINARY_ARCH_MISSING", `arches 宣告了 ${arch}，但 backend.binary 沒有它的執行檔。`);
+            continue;
+        }
+        files[arch] = c.path(binary[arch], `backend.binary.${arch}`);
+    }
+    for (const key of Object.keys(binary)) {
+        if (!arches.includes(key)) {
+            c.fail("STANDALONE_BACKEND_INVALID", `backend.binary.${key} 不在 arches 內。`);
+        }
+    }
+    return Object.values(files).every(Boolean) ? { kind: "binary", files } : undefined;
+}
+function readUi(value, c) {
+    if (!isRecord(value)) {
+        return c.fail("STANDALONE_UI_INVALID", "ui 必須包含 dir。");
+    }
+    const dir = c.path(value.dir, "ui.dir");
+    if (value.build === undefined) {
+        return dir ? { dir } : undefined;
+    }
+    const build = value.build;
+    const command = isRecord(build) ? build.command : undefined;
+    if (!Array.isArray(command) || command.length === 0 || !command.every((arg) => typeof arg === "string" && arg !== "")) {
+        return c.fail("STANDALONE_UI_BUILD_INVALID", "ui.build.command 必須是 argv 字串陣列（不經 shell），例如 [npm, run, build]。");
+    }
+    const cwd = c.path(build.cwd, "ui.build.cwd");
+    return dir && cwd ? { dir, build: { cwd, command: command } } : undefined;
+}
+function readI18n(value, c) {
+    const invalid = (why) => c.fail("STANDALONE_I18N_INVALID", `i18n ${why}`);
+    if (!isRecord(value) || Object.keys(value).some((key) => !I18N_FIELDS.has(key))) {
+        return invalid("只接受 messages（訊息目錄）、glossary（用語表）與 info（各語言 INFO 文字）。");
+    }
+    const info = readInfoText(value.info, c);
+    if (value.messages === undefined) {
+        return value.glossary === undefined ? info && { info } : invalid("glossary 需要搭配 messages。");
+    }
+    const dir = c.path(value.messages, "i18n.messages");
+    const glossary = value.glossary === undefined ? undefined : c.path(value.glossary, "i18n.glossary");
+    if (!dir || (value.glossary !== undefined && !glossary)) {
+        return undefined;
+    }
+    const loaded = loadCatalogs(dir);
+    if (!loaded.ok) {
+        loaded.errors.forEach((e) => c.fail(e.code, e.message));
+        return undefined;
+    }
+    const drift = glossary ? checkGlossary(glossary, loaded.catalogs) : [];
+    drift.forEach((e) => c.fail(e.code, e.message));
+    return info && drift.length === 0 ? { catalogs: loaded.catalogs, info } : undefined;
+}
+function readInfoText(value, c) {
+    if (value === undefined) {
+        return {};
+    }
+    const invalid = (why) => c.fail("STANDALONE_I18N_INVALID", `i18n.info ${why}`);
+    if (!isRecord(value)) {
+        return invalid("必須以語言為 key，例如 zh-TW: { displayname, description }。");
+    }
+    const info = {};
+    for (const [locale, text] of Object.entries(value)) {
+        if (!isLocale(locale) || locale === "en") {
+            return invalid(`的「${locale}」不是支援的翻譯語言；英文寫在頂層 displayname / description。`);
+        }
+        if (!isRecord(text) || Object.keys(text).some((key) => !INFO_TEXT_FIELDS.has(key))) {
+            return invalid(`.${locale} 只接受 displayname 與 description。`);
+        }
+        const entry = {};
+        for (const field of INFO_TEXT_FIELDS) {
+            if (text[field] !== undefined) {
+                const checked = c.text(text[field], `i18n.info.${locale}.${field}`);
+                if (!checked) {
+                    return undefined;
+                }
+                entry[field] = checked;
+            }
+        }
+        info[locale] = entry;
+    }
+    return info;
+}
+/**
+ * The nearest directory at or above `start` that holds dsm-package.yaml,
+ * unless a Managed Profile project (synology-app.yaml) is found first.
+ */
+export function findStandaloneRoot(start) {
+    let current = resolve(start);
+    while (true) {
+        if (existsSync(join(current, "synology-app.yaml"))) {
+            return null;
+        }
+        if (existsSync(join(current, STANDALONE_MANIFEST))) {
+            return current;
+        }
+        const parent = resolve(current, "..");
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}

package/dist/standalone/root-messages.d.ts

@@ -0,0 +1,7 @@
+import type { Catalog, Locale } from "./i18n.js";
+/**
+ * Text of the authorization panel every privilege: root package shows, the
+ * same in every package. DSM's own words (Task Scheduler, Run, Remove, …) are
+ * taken verbatim from DSM 7.4; test/standalone-root-messages.test.ts pins them.
+ */
+export declare const ROOT_MESSAGES: Record<Locale, Catalog>;

package/dist/standalone/root-messages.js

@@ -0,0 +1,250 @@
+/**
+ * Text of the authorization panel every privilege: root package shows, the
+ * same in every package. DSM's own words (Task Scheduler, Run, Remove, …) are
+ * taken verbatim from DSM 7.4; test/standalone-root-messages.test.ts pins them.
+ */
+export const ROOT_MESSAGES = {
+    en: {
+        title: "Administrator authorization",
+        intro: "This package can run the fixed operation \"{op}\" as root. A DSM administrator approves it once with their password. DSM then keeps it as a disabled task in Task Scheduler that runs only when an administrator clicks Run here.",
+        status: "Status",
+        last_run: "Last run time",
+        never: "Not run yet",
+        output: "Result",
+        "state.checking": "Loading...",
+        "state.missing": "Not authorized",
+        "state.ready": "Authorized",
+        "state.outdated": "The package was updated and needs authorization again",
+        "state.conflict": "Another Task Scheduler task already uses the name \"{name}\"",
+        authorize: "Authorize",
+        run: "Run",
+        remove: "Remove",
+        retry: "Retry",
+        completed: "Completed",
+        cancelled: "Authorization was cancelled. Nothing was created.",
+        admin_only: "Only administrator accounts can perform this operation.",
+        uninstall_hint: "Before uninstalling this package, click Remove to delete its task from Task Scheduler.",
+        "error.root_conflict": "Rename or delete the task \"{name}\" in Task Scheduler, then click Retry.",
+        "error.root_not_ready": "Authorize this operation first.",
+        "error.root_task_failed": "The task ended with an error. Check its history in Task Scheduler, then click Retry.",
+        "error.root_timeout": "The task did not finish in time. Check it in Task Scheduler, then click Retry.",
+        "error.root_verify_failed": "Task Scheduler does not show the expected task. Click Retry.",
+        "error.default": "The operation failed ({code}). Click Retry.",
+    },
+    "zh-TW": {
+        title: "管理員授權",
+        intro: "此套件可用 root 身分執行固定操作「{op}」。DSM 管理員以密碼核准一次後，DSM 會在任務排程表中保留一個已停用的任務，只有管理員在此按下「執行」時才會執行。",
+        status: "狀態",
+        last_run: "最後執行時間",
+        never: "尚未執行",
+        output: "結果",
+        "state.checking": "載入中...",
+        "state.missing": "未授權",
+        "state.ready": "已授權",
+        "state.outdated": "套件已更新，需要重新授權",
+        "state.conflict": "任務排程表中已有其他任務使用名稱「{name}」",
+        authorize: "授權",
+        run: "執行",
+        remove: "移除",
+        retry: "重試",
+        completed: "已完成",
+        cancelled: "已取消授權，未建立任何任務。",
+        admin_only: "僅限管理員帳號允許執行此操作。",
+        uninstall_hint: "解除安裝此套件前，請按「移除」從任務排程表刪除它的任務。",
+        "error.root_conflict": "請在任務排程表中重新命名或刪除任務「{name}」，再按「重試」。",
+        "error.root_not_ready": "請先授權此操作。",
+        "error.root_task_failed": "任務執行失敗。請在任務排程表查看其記錄，再按「重試」。",
+        "error.root_timeout": "任務未在時限內完成。請在任務排程表確認後，再按「重試」。",
+        "error.root_verify_failed": "任務排程表中沒有預期的任務。請按「重試」。",
+        "error.default": "操作失敗（{code}）。請按「重試」。",
+    },
+    "zh-CN": {
+        title: "管理员授权",
+        intro: "此套件可以 root 身份运行固定操作“{op}”。DSM 管理员用密码批准一次后，DSM 会在任务计划中保留一个已禁用的任务，只有管理员在此单击“运行”时才会运行。",
+        status: "状态",
+        last_run: "最后运行时间",
+        never: "尚未运行",
+        output: "结果",
+        "state.checking": "加载中...",
+        "state.missing": "未授权",
+        "state.ready": "已授权",
+        "state.outdated": "套件已更新，需要重新授权",
+        "state.conflict": "任务计划中已有其他任务使用名称“{name}”",
+        authorize: "授权",
+        run: "运行",
+        remove: "删除",
+        retry: "重试",
+        completed: "已完成",
+        cancelled: "已取消授权，未创建任何任务。",
+        admin_only: "只有管理员帐户才能执行此操作。",
+        uninstall_hint: "卸载此套件前，请单击“删除”从任务计划中删除它的任务。",
+        "error.root_conflict": "请在任务计划中重命名或删除任务“{name}”，然后单击“重试”。",
+        "error.root_not_ready": "请先授权此操作。",
+        "error.root_task_failed": "任务运行失败。请在任务计划中查看其记录，然后单击“重试”。",
+        "error.root_timeout": "任务未在时限内完成。请在任务计划中确认后单击“重试”。",
+        "error.root_verify_failed": "任务计划中没有预期的任务。请单击“重试”。",
+        "error.default": "操作失败（{code}）。请单击“重试”。",
+    },
+    ja: {
+        title: "管理者の承認",
+        intro: "このパッケージは固定の操作「{op}」を root として実行できます。DSM 管理者がパスワードで一度承認すると、DSM はタスク スケジューラーに無効のタスクとして保持し、管理者がここで「実行」をクリックしたときだけ実行します。",
+        status: "状態",
+        last_run: "最終実行時刻",
+        never: "まだ実行されていません",
+        output: "結果",
+        "state.checking": "読み込み中...",
+        "state.missing": "未承認",
+        "state.ready": "承認済み",
+        "state.outdated": "パッケージが更新されたため、再承認が必要です",
+        "state.conflict": "タスク スケジューラーの別のタスクが名前「{name}」を使用しています",
+        authorize: "承認",
+        run: "実行",
+        remove: "削除",
+        retry: "再試行",
+        completed: "完了",
+        cancelled: "承認はキャンセルされました。何も作成されていません。",
+        admin_only: "この操作を実行できるのは管理者アカウントのみです。",
+        uninstall_hint: "このパッケージをアンインストールする前に、「削除」をクリックしてタスク スケジューラーからタスクを削除してください。",
+        "error.root_conflict": "タスク スケジューラーでタスク「{name}」の名前を変更するか削除してから、「再試行」をクリックしてください。",
+        "error.root_not_ready": "先にこの操作を承認してください。",
+        "error.root_task_failed": "タスクがエラーで終了しました。タスク スケジューラーで履歴を確認してから、「再試行」をクリックしてください。",
+        "error.root_timeout": "タスクが時間内に完了しませんでした。タスク スケジューラーで確認してから、「再試行」をクリックしてください。",
+        "error.root_verify_failed": "タスク スケジューラーに想定したタスクが見つかりません。「再試行」をクリックしてください。",
+        "error.default": "操作に失敗しました ({code})。「再試行」をクリックしてください。",
+    },
+    ko: {
+        title: "관리자 승인",
+        intro: "이 패키지는 고정된 작업 \"{op}\"을(를) root로 실행할 수 있습니다. DSM 관리자가 암호로 한 번 승인하면 DSM이 작업 스케줄러에 비활성화된 작업으로 보관하며, 관리자가 여기에서 \"실행\"을 클릭할 때만 실행됩니다.",
+        status: "상태",
+        last_run: "마지막 실행 시간",
+        never: "아직 실행되지 않음",
+        output: "결과",
+        "state.checking": "로드 중…",
+        "state.missing": "승인되지 않음",
+        "state.ready": "승인됨",
+        "state.outdated": "패키지가 업데이트되어 다시 승인해야 합니다",
+        "state.conflict": "작업 스케줄러의 다른 작업이 이미 \"{name}\" 이름을 사용하고 있습니다",
+        authorize: "승인",
+        run: "실행",
+        remove: "제거",
+        retry: "재시도",
+        completed: "완료됨",
+        cancelled: "승인이 취소되었습니다. 아무것도 만들어지지 않았습니다.",
+        admin_only: "관리자 계정에서만 이 작업을 수행할 수 있습니다.",
+        uninstall_hint: "이 패키지를 제거하기 전에 \"제거\"를 클릭하여 작업 스케줄러에서 작업을 삭제하십시오.",
+        "error.root_conflict": "작업 스케줄러에서 작업 \"{name}\"의 이름을 바꾸거나 삭제한 후 \"재시도\"를 클릭하십시오.",
+        "error.root_not_ready": "먼저 이 작업을 승인하십시오.",
+        "error.root_task_failed": "작업이 오류로 종료되었습니다. 작업 스케줄러에서 기록을 확인한 후 \"재시도\"를 클릭하십시오.",
+        "error.root_timeout": "작업이 제시간에 완료되지 않았습니다. 작업 스케줄러에서 확인한 후 \"재시도\"를 클릭하십시오.",
+        "error.root_verify_failed": "작업 스케줄러에 예상한 작업이 없습니다. \"재시도\"를 클릭하십시오.",
+        "error.default": "작업에 실패했습니다({code}). \"재시도\"를 클릭하십시오.",
+    },
+    de: {
+        title: "Administratorfreigabe",
+        intro: "Dieses Paket kann den festen Vorgang „{op}“ als root ausführen. Ein DSM-Administrator genehmigt ihn einmal mit seinem Passwort. DSM behält ihn dann als deaktivierte Aufgabe im Aufgabenplaner, die nur ausgeführt wird, wenn ein Administrator hier auf „Ausführen“ klickt.",
+        status: "Status",
+        last_run: "Letzte Ausführungszeit",
+        never: "Noch nicht ausgeführt",
+        output: "Ergebnis",
+        "state.checking": "Wird geladen...",
+        "state.missing": "Nicht freigegeben",
+        "state.ready": "Freigegeben",
+        "state.outdated": "Das Paket wurde aktualisiert und muss erneut freigegeben werden",
+        "state.conflict": "Eine andere Aufgabe im Aufgabenplaner verwendet bereits den Namen „{name}“",
+        authorize: "Freigeben",
+        run: "Ausführen",
+        remove: "Entfernen",
+        retry: "Neuer Versuch",
+        completed: "Abgeschlossen",
+        cancelled: "Die Freigabe wurde abgebrochen. Es wurde nichts erstellt.",
+        admin_only: "Nur Administratorkonten können diesen Vorgang ausführen.",
+        uninstall_hint: "Klicken Sie vor der Deinstallation dieses Pakets auf „Entfernen“, um seine Aufgabe aus dem Aufgabenplaner zu löschen.",
+        "error.root_conflict": "Benennen Sie die Aufgabe „{name}“ im Aufgabenplaner um oder löschen Sie sie, und klicken Sie dann auf „Neuer Versuch“.",
+        "error.root_not_ready": "Geben Sie diesen Vorgang zuerst frei.",
+        "error.root_task_failed": "Die Aufgabe wurde mit einem Fehler beendet. Prüfen Sie ihren Verlauf im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
+        "error.root_timeout": "Die Aufgabe wurde nicht rechtzeitig beendet. Prüfen Sie sie im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
+        "error.root_verify_failed": "Der Aufgabenplaner zeigt die erwartete Aufgabe nicht. Klicken Sie auf „Neuer Versuch“.",
+        "error.default": "Der Vorgang ist fehlgeschlagen ({code}). Klicken Sie auf „Neuer Versuch“.",
+    },
+    fr: {
+        title: "Autorisation de l'administrateur",
+        intro: "Ce paquet peut exécuter l'opération fixe « {op} » en tant que root. Un administrateur DSM l'approuve une fois avec son mot de passe. DSM la conserve ensuite comme tâche désactivée dans le Planificateur de tâches, qui ne s'exécute que lorsqu'un administrateur clique ici sur « Exécuter ».",
+        status: "Statut",
+        last_run: "Dernière heure d'exécution",
+        never: "Pas encore exécutée",
+        output: "Résultat",
+        "state.checking": "Chargement...",
+        "state.missing": "Non autorisée",
+        "state.ready": "Autorisée",
+        "state.outdated": "Le paquet a été mis à jour et doit être autorisé de nouveau",
+        "state.conflict": "Une autre tâche du Planificateur de tâches utilise déjà le nom « {name} »",
+        authorize: "Autoriser",
+        run: "Exécuter",
+        remove: "Supprimer",
+        retry: "Réessayer",
+        completed: "Terminé",
+        cancelled: "L'autorisation a été annulée. Rien n'a été créé.",
+        admin_only: "Seuls les comptes administrateur peuvent effectuer cette opération.",
+        uninstall_hint: "Avant de désinstaller ce paquet, cliquez sur « Supprimer » pour retirer sa tâche du Planificateur de tâches.",
+        "error.root_conflict": "Renommez ou supprimez la tâche « {name} » dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
+        "error.root_not_ready": "Autorisez d'abord cette opération.",
+        "error.root_task_failed": "La tâche s'est terminée avec une erreur. Consultez son historique dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
+        "error.root_timeout": "La tâche ne s'est pas terminée à temps. Vérifiez-la dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
+        "error.root_verify_failed": "Le Planificateur de tâches n'affiche pas la tâche attendue. Cliquez sur « Réessayer ».",
+        "error.default": "L'opération a échoué ({code}). Cliquez sur « Réessayer ».",
+    },
+    es: {
+        title: "Autorización del administrador",
+        intro: "Este paquete puede ejecutar la operación fija «{op}» como root. Un administrador de DSM la aprueba una vez con su contraseña. Después, DSM la conserva como una tarea desactivada en el Programador de tareas que solo se ejecuta cuando un administrador hace clic aquí en «Ejecutar».",
+        status: "Estado",
+        last_run: "Hora de la última ejecución",
+        never: "Aún no se ha ejecutado",
+        output: "Resultado",
+        "state.checking": "Cargando...",
+        "state.missing": "No autorizada",
+        "state.ready": "Autorizada",
+        "state.outdated": "El paquete se actualizó y debe autorizarse de nuevo",
+        "state.conflict": "Otra tarea del Programador de tareas ya usa el nombre «{name}»",
+        authorize: "Autorizar",
+        run: "Ejecutar",
+        remove: "Quitar",
+        retry: "Volver a intentar",
+        completed: "Finalizado",
+        cancelled: "Se canceló la autorización. No se creó nada.",
+        admin_only: "Solo las cuentas de administrador pueden realizar esta operación.",
+        uninstall_hint: "Antes de desinstalar este paquete, haga clic en «Quitar» para eliminar su tarea del Programador de tareas.",
+        "error.root_conflict": "Cambie el nombre de la tarea «{name}» o elimínela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
+        "error.root_not_ready": "Primero autorice esta operación.",
+        "error.root_task_failed": "La tarea terminó con un error. Consulte su historial en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
+        "error.root_timeout": "La tarea no terminó a tiempo. Revísela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
+        "error.root_verify_failed": "El Programador de tareas no muestra la tarea esperada. Haga clic en «Volver a intentar».",
+        "error.default": "Error en la operación ({code}). Haga clic en «Volver a intentar».",
+    },
+    it: {
+        title: "Autorizzazione dell'amministratore",
+        intro: "Questo pacchetto può eseguire l'operazione fissa \"{op}\" come root. Un amministratore DSM la approva una volta con la propria password. DSM la conserva quindi come attività disattivata in Utilità di pianificazione, che viene eseguita solo quando un amministratore fa clic qui su \"Esegui\".",
+        status: "Stato",
+        last_run: "Ora ultima esecuzione",
+        never: "Non ancora eseguita",
+        output: "Risultato",
+        "state.checking": "Caricamento...",
+        "state.missing": "Non autorizzata",
+        "state.ready": "Autorizzata",
+        "state.outdated": "Il pacchetto è stato aggiornato e deve essere autorizzato di nuovo",
+        "state.conflict": "Un'altra attività in Utilità di pianificazione usa già il nome \"{name}\"",
+        authorize: "Autorizza",
+        run: "Esegui",
+        remove: "Rimuovi",
+        retry: "Riprova",
+        completed: "Completato",
+        cancelled: "Autorizzazione annullata. Non è stato creato nulla.",
+        admin_only: "Solo gli account administrator possono eseguire questa operazione.",
+        uninstall_hint: "Prima di disinstallare questo pacchetto, fare clic su \"Rimuovi\" per eliminare la sua attività da Utilità di pianificazione.",
+        "error.root_conflict": "Rinominare o eliminare l'attività \"{name}\" in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
+        "error.root_not_ready": "Autorizzare prima questa operazione.",
+        "error.root_task_failed": "L'attività è terminata con un errore. Controllarne la cronologia in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
+        "error.root_timeout": "L'attività non è terminata in tempo. Controllarla in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
+        "error.root_verify_failed": "Utilità di pianificazione non mostra l'attività prevista. Fare clic su \"Riprova\".",
+        "error.default": "Operazione non riuscita ({code}). Fare clic su \"Riprova\".",
+    },
+};

package/dist/standalone/root-ops.d.ts

@@ -0,0 +1,42 @@
+import type { StandaloneError } from "./manifest.js";
+/**
+ * Root operations of a `privilege: root` Standalone Package. Each
+ * `root/<name>.sh` becomes the fixed script of one disabled DSM Task
+ * Scheduler task owned by root, which a DSM administrator creates through
+ * DSM's own password confirmation and runs on demand. The package itself
+ * never runs as root and nothing it can write is ever executed as root.
+ */
+export interface RootOp {
+    name: string;
+    body: string;
+    /** Internal generator flag for protected helper control output. */
+    protectedOutput?: boolean;
+}
+export type RootOpsResult = {
+    ok: true;
+    ops: RootOp[];
+} | {
+    ok: false;
+    errors: StandaloneError[];
+};
+export declare const ROOT_OPS_DIR = "root";
+export declare const ROOT_OP_END = "SYNOPKGLAND_ROOT_OP_END";
+export declare function rootTaskName(packageId: string, op: string): string;
+/**
+ * The fixed start of an operation's task text. It does not carry the version,
+ * so the window can tell its own outdated task from someone else's.
+ */
+export declare function rootTaskHeader(packageId: string, op: string): string;
+/** Root-owned tmpfs folder the tasks write to; the package account can only read it. */
+export declare function rootOutputDir(packageId: string): string;
+export declare function loadRootOps(dir: string): RootOpsResult;
+/**
+ * The exact text of the DSM task. The body runs from a quoted here-document
+ * (no expansion) and its stdout replaces `<op>.out` in the root-owned run
+ * folder. The package version is part of the text, so every upgrade changes
+ * what the administrator approved and needs approval again.
+ */
+export declare function renderRootTaskScript(manifest: {
+    package: string;
+    spkVersion: string;
+}, op: RootOp): string;