@synopackageland/cli 0.3.10 → 0.4.0

package/dist/standalone/root-ops.js

@@ -0,0 +1,101 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export const ROOT_OPS_DIR = "root";
+export const ROOT_OP_END = "SYNOPKGLAND_ROOT_OP_END";
+const MAX_ROOT_OP_BYTES = 16 * 1024;
+const OP_FILE = /^([a-z][a-z0-9_]{0,31})\.sh$/;
+export function rootTaskName(packageId, op) {
+    return `${packageId} root: ${op}`;
+}
+/**
+ * The fixed start of an operation's task text. It does not carry the version,
+ * so the window can tell its own outdated task from someone else's.
+ */
+export function rootTaskHeader(packageId, op) {
+    return `#!/bin/sh\n# synopkgland root operation "${op}" of ${packageId} `;
+}
+/** Root-owned tmpfs folder the tasks write to; the package account can only read it. */
+export function rootOutputDir(packageId) {
+    return `/run/synopkgland-${packageId}`;
+}
+export function loadRootOps(dir) {
+    const names = existsSync(dir) ? readdirSync(dir).sort() : [];
+    if (names.length === 0) {
+        return {
+            ok: false,
+            errors: [{ code: "STANDALONE_ROOT_OPS_MISSING", message: `privilege: root 需要 ${ROOT_OPS_DIR}/<名稱>.sh，至少一個 root 操作。` }],
+        };
+    }
+    const errors = [];
+    const ops = [];
+    for (const file of names) {
+        const op = readRootOp(join(dir, file), file);
+        if ("error" in op) {
+            errors.push({ code: "STANDALONE_ROOT_OP_INVALID", message: `${ROOT_OPS_DIR}/${file}：${op.error}` });
+        }
+        else {
+            ops.push(op);
+        }
+    }
+    return errors.length === 0 ? { ok: true, ops } : { ok: false, errors };
+}
+function readRootOp(path, file) {
+    const name = OP_FILE.exec(file)?.[1];
+    if (!name) {
+        return { error: "檔名必須是小寫英數與底線組成的 <名稱>.sh（最多 32 字元），此資料夾不放其他檔案。" };
+    }
+    const stat = lstatSync(path);
+    if (!stat.isFile()) {
+        return { error: "必須是一般檔案（不可是 symlink 或資料夾）。" };
+    }
+    if (stat.size > MAX_ROOT_OP_BYTES) {
+        return { error: `不可超過 ${MAX_ROOT_OP_BYTES} bytes。` };
+    }
+    const body = readFileSync(path, "utf8");
+    if (!body.startsWith("#!/bin/sh\n") || body.includes("\0") || body.includes("�")) {
+        return { error: "必須是以 #!/bin/sh 開頭的 UTF-8 文字 script。" };
+    }
+    if (body.split("\n").includes(ROOT_OP_END)) {
+        return { error: `不可包含單獨一行的 ${ROOT_OP_END}。` };
+    }
+    return { name, body };
+}
+/**
+ * The exact text of the DSM task. The body runs from a quoted here-document
+ * (no expansion) and its stdout replaces `<op>.out` in the root-owned run
+ * folder. The package version is part of the text, so every upgrade changes
+ * what the administrator approved and needs approval again.
+ */
+export function renderRootTaskScript(manifest, op) {
+    const body = op.body.endsWith("\n") ? op.body : `${op.body}\n`;
+    return `${rootTaskHeader(manifest.package, op.name)}${manifest.spkVersion}.
+# Approved by a DSM administrator; runs only when this task is run.
+set -eu
+umask 022
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+dir=${rootOutputDir(manifest.package)}
+${op.protectedOutput ? `[ "$(id -u)" = 0 ]
+[ ! -L /run ] && [ "$(stat -c %u /run)" = 0 ]
+[ ! -L "$dir" ]
+if [ ! -e "$dir" ]; then mkdir -m 0755 "$dir"; fi
+[ -d "$dir" ] && [ "$(stat -c %u "$dir")" = 0 ]
+output_mode=$(stat -c %a "$dir")
+[ "$((0$output_mode & 0022))" = 0 ]
+` : `if [ -L "$dir" ] || [ ! -d "$dir" ]; then
+  rm -f "$dir"
+  mkdir -m 0755 "$dir"
+fi
+`}tmp=$(mktemp "$dir/.${op.name}.XXXXXX")
+if /bin/sh -eu >"$tmp" <<'${ROOT_OP_END}'
+${body}${ROOT_OP_END}
+then
+  chmod 0644 "$tmp"
+  mv -f "$tmp" "$dir/${op.name}.out"
+else
+  status=$?
+  rm -f "$tmp"
+  exit "$status"
+fi
+`;
+}

package/dist/standalone/root-window.d.ts

@@ -0,0 +1,35 @@
+import { type RootOp } from "./root-ops.js";
+/** What the window embeds per root operation: the task it may create, and how to recognize it. */
+export interface RootTask {
+    op: string;
+    name: string;
+    header: string;
+    script: string;
+}
+export declare function rootTasks(manifest: {
+    package: string;
+    spkVersion: string;
+    rootOps?: RootOp[];
+}): RootTask[];
+/**
+ * `createRootAccess(options)` → `{ state, authorize, run, remove }`, plain
+ * ES5 for DSM's desktop. Every DSM call goes through `options.send` (the
+ * AppWindow's sendWebAPI) as the signed-in administrator:
+ *
+ * - authorize: DSM's own password confirmation, then one disabled root task
+ *   with exactly the embedded script. The one-use token goes into that single
+ *   create call and is never kept.
+ * - run: re-reads the task and runs it only if it is still exactly ours, then
+ *   waits for its history entry and asks the backend for the output.
+ * - an older version of our task is "outdated" and never runs; authorizing
+ *   again replaces it. A same-named task that is not ours is a "conflict" and
+ *   is never run, replaced or deleted.
+ */
+export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {};\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function find(task) {\n    return options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return options.send(API, \"get\", 4, ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (token) {\n            if (!token) return \"cancelled\";\n            var params = definition(task, options.user().name);\n            params.SynoConfirmPWToken = token;\n            var replaced = found.state === \"outdated\"\n              ? options.send(API, \"delete\", 2, { tasks: [found.ref] })\n              : Promise.resolve();\n            return replaced.then(function () {\n              return options.send(API + \".Root\", \"create\", 4, params);\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n          return history(found.ref).then(function (before) {\n            return options.send(API, \"run\", 2, { tasks: [found.ref] }).then(function () {\n              return waitForRun(found.ref, before, POLLS);\n            });\n          });\n        }).then(function () {\n          return options.call(\"root.output\", { op: op });\n        });\n      });\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.send(API, \"delete\", 2, { tasks: [found.ref] }).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(function () {\n        return options.call(\"root.output\", { op: op });\n      });\n    }\n  };\n}";
+/**
+ * The authorization panel the window shows above the app for each root
+ * operation, identical in every package. `rootPanelView(model)` decides what
+ * it shows; `mountRootPanel(host, access, i18n, tasks, admin)` draws it with
+ * DOM text nodes only (no HTML from data).
+ */
+export declare const ROOT_PANEL = "function rootPanelShowsResult(state) {\n  return state === \"ready\" || state === \"outdated\";\n}\n\nfunction rootPanelView(model) {\n  if (!model.admin) return { status: null, buttons: [], message: { key: \"admin_only\" } };\n  function buttons(actions) {\n    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });\n  }\n  if (model.error) {\n    return {\n      status: \"state.\" + model.state, buttons: buttons([\"retry\"]),\n      message: { key: \"error.\" + model.error, params: { name: model.name, code: model.error } }\n    };\n  }\n  var message = model.notice ? { key: model.notice } : null;\n  switch (model.state) {\n    case \"missing\":\n      return { status: \"state.missing\", buttons: buttons([\"authorize\"]), message: message };\n    case \"outdated\":\n      return { status: \"state.outdated\", buttons: buttons([\"authorize\", \"remove\"]), message: message };\n    case \"ready\":\n      return { status: \"state.ready\", buttons: buttons([\"run\", \"remove\"]), message: message };\n    case \"conflict\":\n      return { status: \"state.conflict\", buttons: buttons([\"retry\"]), message: { key: \"error.root_conflict\", params: { name: model.name } } };\n    default:\n      return { status: \"state.checking\", buttons: [], message: null };\n  }\n}\n\nfunction mountRootPanel(host, access, i18n, tasks, admin) {\n  var t = i18n.t;\n  function el(tag, className, text) {\n    var node = document.createElement(tag);\n    if (className) node.className = className;\n    if (text !== undefined) node.textContent = text;\n    return node;\n  }\n  function say(message) {\n    if (!message) return \"\";\n    var text = t(message.key, message.params);\n    return text === message.key && message.key.indexOf(\"error.\") === 0 ? t(\"error.default\", message.params) : text;\n  }\n  tasks.forEach(function (task) {\n    var model = { admin: admin, name: task.name, state: \"checking\", busy: false, error: null, notice: null };\n    var result = null;\n    var section = el(\"section\", \"dsmapp-rootpanel\");\n    host.appendChild(section);\n\n    function render() {\n      var view = rootPanelView(model);\n      while (section.firstChild) section.removeChild(section.firstChild);\n      section.appendChild(el(\"h2\", null, t(\"title\")));\n      section.appendChild(el(\"p\", null, t(\"intro\", { op: task.op })));\n      if (view.status) {\n        var facts = el(\"dl\");\n        facts.appendChild(el(\"dt\", null, t(\"status\")));\n        facts.appendChild(el(\"dd\", \"dsmapp-rootpanel-state\", t(view.status, { name: task.name })));\n        facts.appendChild(el(\"dt\", null, t(\"last_run\")));\n        facts.appendChild(el(\"dd\", null, result && result.modified\n          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t(\"never\")));\n        section.appendChild(facts);\n      }\n      if (view.message) section.appendChild(el(\"p\", \"dsmapp-rootpanel-message\", say(view.message)));\n      if (result && typeof result.output === \"string\") {\n        section.appendChild(el(\"div\", \"dsmapp-rootpanel-label\", t(\"output\")));\n        section.appendChild(el(\"pre\", \"dsmapp-rootpanel-output\", result.output));\n      }\n      var actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n      view.buttons.forEach(function (button) {\n        var node = el(\"button\", button.action === \"remove\" ? null : \"dsmapp-rootpanel-primary\", t(button.action));\n        node.type = \"button\";\n        node.disabled = button.disabled;\n        node.onclick = function () { act(button.action); };\n        actions.appendChild(node);\n      });\n      section.appendChild(actions);\n      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el(\"p\", \"dsmapp-rootpanel-hint\", t(\"uninstall_hint\")));\n    }\n    function settle(promise, notice) {\n      model.busy = true;\n      model.error = null;\n      model.notice = null;\n      render();\n      return promise.then(function (value) {\n        model.notice = typeof notice === \"function\" ? notice(value) : notice;\n      }, function (error) {\n        model.error = (error && error.code) || \"unknown\";\n      }).then(function () {\n        model.busy = false;\n        render();\n      });\n    }\n    function refresh(notice) {\n      return settle(access.state(task.op).then(function (state) {\n        model.state = state;\n        if (!rootPanelShowsResult(state)) return;\n        return access.output(task.op).then(function (out) { result = out; });\n      }), notice);\n    }\n    function refreshAfterChange() {\n      return model.error ? null : refresh(model.notice);\n    }\n    function act(action) {\n      if (action === \"retry\") return refresh(null);\n      if (action === \"authorize\") {\n        return settle(access.authorize(task.op), function (outcome) {\n          return outcome === \"cancelled\" ? \"cancelled\" : null;\n        }).then(refreshAfterChange);\n      }\n      if (action === \"run\") {\n        return settle(access.run(task.op).then(function (out) { result = out; }), \"completed\");\n      }\n      if (action === \"remove\") {\n        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);\n      }\n    }\n    render();\n    if (admin) refresh(null);\n  });\n}";

package/dist/standalone/root-window.js

@@ -0,0 +1,290 @@
+import { renderRootTaskScript, rootTaskHeader, rootTaskName } from "./root-ops.js";
+export function rootTasks(manifest) {
+    return (manifest.rootOps ?? []).map((op) => ({
+        op: op.name,
+        name: rootTaskName(manifest.package, op.name),
+        header: rootTaskHeader(manifest.package, op.name),
+        script: renderRootTaskScript(manifest, op),
+    }));
+}
+/**
+ * `createRootAccess(options)` → `{ state, authorize, run, remove }`, plain
+ * ES5 for DSM's desktop. Every DSM call goes through `options.send` (the
+ * AppWindow's sendWebAPI) as the signed-in administrator:
+ *
+ * - authorize: DSM's own password confirmation, then one disabled root task
+ *   with exactly the embedded script. The one-use token goes into that single
+ *   create call and is never kept.
+ * - run: re-reads the task and runs it only if it is still exactly ours, then
+ *   waits for its history entry and asks the backend for the output.
+ * - an older version of our task is "outdated" and never runs; authorizing
+ *   again replaces it. A same-named task that is not ours is a "conflict" and
+ *   is never run, replaced or deleted.
+ */
+export const ROOT_RUNTIME = `function createRootAccess(options) {
+  var API = "SYNO.Core.TaskScheduler";
+  var POLL_MS = 500, POLLS = 60;
+  var byOp = {};
+  options.tasks.forEach(function (task) { byOp[task.op] = task; });
+
+  function fail(code) {
+    var error = new Error(code);
+    error.code = code;
+    return error;
+  }
+  function begin(op) {
+    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail("root_unknown_op"));
+    if (options.user().admin !== true) return Promise.reject(fail("admin_required"));
+    return Promise.resolve(byOp[op]);
+  }
+  function isRootTask(summary) {
+    return summary.owner === "root" && summary.real_owner === "root" && summary.enable === false && summary.type === "script";
+  }
+  function find(task) {
+    return options.send(API, "list", 3, { start: 0, limit: 500 }).then(function (data) {
+      if (!data || !Array.isArray(data.tasks)) throw fail("root_bad_response");
+      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });
+      if (named.length === 0) return { state: "missing" };
+      if (named.length > 1 || !isRootTask(named[0])) return { state: "conflict" };
+      var ref = { id: named[0].id, real_owner: named[0].real_owner };
+      return options.send(API, "get", 4, ref).then(function (detail) {
+        var script = detail && detail.extra && detail.extra.script;
+        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name
+            || detail.owner !== "root" || detail.enable !== false || detail.type !== "script" || typeof script !== "string") {
+          return { state: "conflict" };
+        }
+        if (script === task.script) return { state: "ready", ref: ref };
+        if (script.indexOf(task.header) === 0) return { state: "outdated", ref: ref };
+        return { state: "conflict" };
+      });
+    });
+  }
+  function definition(task, user) {
+    var hours = [];
+    for (var h = 1; h <= 23; h++) hours.push(h);
+    return {
+      name: task.name,
+      real_owner: user,
+      owner: "root",
+      enable: false,
+      type: "script",
+      schedule: {
+        date_type: 0, week_day: "0,1,2,3,4,5,6", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,
+        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,
+        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours
+      },
+      extra: { notify_enable: false, script: task.script, notify_mail: "", notify_if_error: false }
+    };
+  }
+  function newest(history) {
+    if (!Array.isArray(history)) throw fail("root_bad_response");
+    return history.reduce(function (latest, entry) {
+      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;
+    }, null);
+  }
+  function history(ref) {
+    return options.send(API, "get_history_status_list", 1, { id: ref.id }).then(newest);
+  }
+  function waitForRun(ref, before, polls) {
+    return history(ref).then(function (latest) {
+      var finished = latest && (!before || latest.timestamp !== before.timestamp)
+        && latest.exit_type !== "running" && latest.stop_time;
+      if (finished) {
+        if (latest.exit_code !== 0) throw fail("root_task_failed");
+        return;
+      }
+      if (polls <= 1) throw fail("root_timeout");
+      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });
+    });
+  }
+
+  return {
+    state: function (op) {
+      return begin(op).then(find).then(function (found) { return found.state; });
+    },
+    authorize: function (op) {
+      return begin(op).then(function (task) {
+        return find(task).then(function (found) {
+          if (found.state === "ready") return "ready";
+          if (found.state === "conflict") throw fail("root_conflict");
+          return options.confirmPassword().then(function (token) {
+            if (!token) return "cancelled";
+            var params = definition(task, options.user().name);
+            params.SynoConfirmPWToken = token;
+            var replaced = found.state === "outdated"
+              ? options.send(API, "delete", 2, { tasks: [found.ref] })
+              : Promise.resolve();
+            return replaced.then(function () {
+              return options.send(API + ".Root", "create", 4, params);
+            }).then(function () {
+              return find(task);
+            }).then(function (after) {
+              if (after.state !== "ready") throw fail("root_verify_failed");
+              return "ready";
+            });
+          });
+        });
+      });
+    },
+    run: function (op) {
+      return begin(op).then(function (task) {
+        return find(task).then(function (found) {
+          if (found.state !== "ready") throw fail("root_not_ready");
+          return history(found.ref).then(function (before) {
+            return options.send(API, "run", 2, { tasks: [found.ref] }).then(function () {
+              return waitForRun(found.ref, before, POLLS);
+            });
+          });
+        }).then(function () {
+          return options.call("root.output", { op: op });
+        });
+      });
+    },
+    remove: function (op) {
+      return begin(op).then(function (task) {
+        return find(task).then(function (found) {
+          if (found.state === "missing") return "missing";
+          if (found.state === "conflict") throw fail("root_conflict");
+          return options.send(API, "delete", 2, { tasks: [found.ref] }).then(function () {
+            return find(task);
+          }).then(function (after) {
+            if (after.state !== "missing") throw fail("root_verify_failed");
+            return "missing";
+          });
+        });
+      });
+    },
+    output: function (op) {
+      return begin(op).then(function () {
+        return options.call("root.output", { op: op });
+      });
+    }
+  };
+}`;
+/**
+ * The authorization panel the window shows above the app for each root
+ * operation, identical in every package. `rootPanelView(model)` decides what
+ * it shows; `mountRootPanel(host, access, i18n, tasks, admin)` draws it with
+ * DOM text nodes only (no HTML from data).
+ */
+export const ROOT_PANEL = `function rootPanelShowsResult(state) {
+  return state === "ready" || state === "outdated";
+}
+
+function rootPanelView(model) {
+  if (!model.admin) return { status: null, buttons: [], message: { key: "admin_only" } };
+  function buttons(actions) {
+    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });
+  }
+  if (model.error) {
+    return {
+      status: "state." + model.state, buttons: buttons(["retry"]),
+      message: { key: "error." + model.error, params: { name: model.name, code: model.error } }
+    };
+  }
+  var message = model.notice ? { key: model.notice } : null;
+  switch (model.state) {
+    case "missing":
+      return { status: "state.missing", buttons: buttons(["authorize"]), message: message };
+    case "outdated":
+      return { status: "state.outdated", buttons: buttons(["authorize", "remove"]), message: message };
+    case "ready":
+      return { status: "state.ready", buttons: buttons(["run", "remove"]), message: message };
+    case "conflict":
+      return { status: "state.conflict", buttons: buttons(["retry"]), message: { key: "error.root_conflict", params: { name: model.name } } };
+    default:
+      return { status: "state.checking", buttons: [], message: null };
+  }
+}
+
+function mountRootPanel(host, access, i18n, tasks, admin) {
+  var t = i18n.t;
+  function el(tag, className, text) {
+    var node = document.createElement(tag);
+    if (className) node.className = className;
+    if (text !== undefined) node.textContent = text;
+    return node;
+  }
+  function say(message) {
+    if (!message) return "";
+    var text = t(message.key, message.params);
+    return text === message.key && message.key.indexOf("error.") === 0 ? t("error.default", message.params) : text;
+  }
+  tasks.forEach(function (task) {
+    var model = { admin: admin, name: task.name, state: "checking", busy: false, error: null, notice: null };
+    var result = null;
+    var section = el("section", "dsmapp-rootpanel");
+    host.appendChild(section);
+
+    function render() {
+      var view = rootPanelView(model);
+      while (section.firstChild) section.removeChild(section.firstChild);
+      section.appendChild(el("h2", null, t("title")));
+      section.appendChild(el("p", null, t("intro", { op: task.op })));
+      if (view.status) {
+        var facts = el("dl");
+        facts.appendChild(el("dt", null, t("status")));
+        facts.appendChild(el("dd", "dsmapp-rootpanel-state", t(view.status, { name: task.name })));
+        facts.appendChild(el("dt", null, t("last_run")));
+        facts.appendChild(el("dd", null, result && result.modified
+          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t("never")));
+        section.appendChild(facts);
+      }
+      if (view.message) section.appendChild(el("p", "dsmapp-rootpanel-message", say(view.message)));
+      if (result && typeof result.output === "string") {
+        section.appendChild(el("div", "dsmapp-rootpanel-label", t("output")));
+        section.appendChild(el("pre", "dsmapp-rootpanel-output", result.output));
+      }
+      var actions = el("div", "dsmapp-rootpanel-actions");
+      view.buttons.forEach(function (button) {
+        var node = el("button", button.action === "remove" ? null : "dsmapp-rootpanel-primary", t(button.action));
+        node.type = "button";
+        node.disabled = button.disabled;
+        node.onclick = function () { act(button.action); };
+        actions.appendChild(node);
+      });
+      section.appendChild(actions);
+      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el("p", "dsmapp-rootpanel-hint", t("uninstall_hint")));
+    }
+    function settle(promise, notice) {
+      model.busy = true;
+      model.error = null;
+      model.notice = null;
+      render();
+      return promise.then(function (value) {
+        model.notice = typeof notice === "function" ? notice(value) : notice;
+      }, function (error) {
+        model.error = (error && error.code) || "unknown";
+      }).then(function () {
+        model.busy = false;
+        render();
+      });
+    }
+    function refresh(notice) {
+      return settle(access.state(task.op).then(function (state) {
+        model.state = state;
+        if (!rootPanelShowsResult(state)) return;
+        return access.output(task.op).then(function (out) { result = out; });
+      }), notice);
+    }
+    function refreshAfterChange() {
+      return model.error ? null : refresh(model.notice);
+    }
+    function act(action) {
+      if (action === "retry") return refresh(null);
+      if (action === "authorize") {
+        return settle(access.authorize(task.op), function (outcome) {
+          return outcome === "cancelled" ? "cancelled" : null;
+        }).then(refreshAfterChange);
+      }
+      if (action === "run") {
+        return settle(access.run(task.op).then(function (out) { result = out; }), "completed");
+      }
+      if (action === "remove") {
+        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);
+      }
+    }
+    render();
+    if (admin) refresh(null);
+  });
+}`;

package/dist/standalone/spk.d.ts

@@ -0,0 +1,22 @@
+import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { StandaloneManifest } from "./manifest.js";
+import type { HelperArtifact } from "./helper.js";
+export declare const LIFECYCLE_SCRIPTS: readonly ["preinst", "postinst", "preuninst", "postuninst", "preupgrade", "postupgrade", "start-stop-status"];
+export declare class StandaloneBuildError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface AssembleOptions {
+    manifest: StandaloneManifest;
+    arch: NativeArchFamily;
+    /** The compiled or prebuilt CGI executable, already checked. */
+    cgiPath: string;
+    outputPath: string;
+    helper?: HelperArtifact;
+}
+/**
+ * Packs an unsigned Standalone Package SPK. Nothing in it runs as root: the
+ * package account owns the payload, lifecycle scripts do nothing, and the
+ * only entry point is the CGI DSM runs behind its own login.
+ */
+export declare function assembleStandaloneSpk(options: AssembleOptions): Promise<void>;