@synopackageland/cli 0.3.10 → 0.4.0

package/dist/init.js

@@ -1,12 +1,13 @@
-import { mkdirSync, cpSync, existsSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 const TEMPLATE_NAMES = [
     "hello-web",
     "hello-web-page",
     "hello-files",
     "compose-import",
-    "native",
+    "binary",
+    "native-go",
 ];
 export function isTemplateName(value) {
     return TEMPLATE_NAMES.includes(value);
@@ -22,11 +23,118 @@ function templatesRoot() {
     }
     return join(moduleDir, "..", "templates");
 }
-export function initFromTemplate(template, targetDir) {
+/**
+ * native-go --privilege root: files laid over the native-go template, and the
+ * files they replace.
+ */
+const ROOT_OVERLAY = "native-go-root";
+const ROOT_REPLACED = ["backend/internal/app/root_none.go"];
+/** Templates whose identity is filled in at init (placeholders in these files). */
+const SUBSTITUTED = {
+    "native-go": ["dsm-package.yaml", "README.md"],
+};
+const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
+/** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
+const RENAMED = { gitignore: ".gitignore" };
+function words(dir) {
+    return basename(dir).split(/[^A-Za-z0-9]+/).filter(Boolean);
+}
+function defaultPackageId(dir) {
+    const id = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+    return PACKAGE_ID.test(id) ? id : "MyPackage";
+}
+function defaultDisplayName(dir) {
+    const name = words(dir).map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+    return name || "My Package";
+}
+function templateFiles(root, dir = root) {
+    return readdirSync(dir).flatMap((name) => {
+        const path = join(dir, name);
+        return statSync(path).isDirectory() ? templateFiles(root, path) : [relative(root, path)];
+    });
+}
+function targetName(file) {
+    return RENAMED[file] ?? file;
+}
+export function initFromTemplate(template, targetDir, options = {}) {
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
         throw new Error(`找不到模板：${template}`);
     }
+    const substitutions = substitutionsFor(template, targetDir, options);
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    const overlays = [
+        ...(privilege === "root" ? [ROOT_OVERLAY] : []),
+        ...(options.ui === "vue" ? ["native-go-vue"] : []),
+        ...(options.integration ? ["native-go-integration"] : []),
+        ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
+    ].map(name => join(templatesRoot(), name));
+    const files = [...templateFiles(source), ...overlays.flatMap(root => templateFiles(root))];
+    const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
+    if (collisions.length > 0) {
+        throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
+    }
     mkdirSync(targetDir, { recursive: true });
     cpSync(source, targetDir, { recursive: true });
+    for (const overlay of overlays)
+        cpSync(overlay, targetDir, { recursive: true });
+    if (privilege === "root")
+        ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
+    for (const [from, to] of Object.entries(RENAMED)) {
+        if (files.includes(from)) {
+            renameSync(join(targetDir, from), join(targetDir, to));
+        }
+    }
+    for (const file of new Set([...(SUBSTITUTED[template] ?? []), ...overlays.flatMap(root => templateFiles(root))])) {
+        const path = join(targetDir, targetName(file));
+        let text = readFileSync(path, "utf8");
+        for (const [token, value] of Object.entries(substitutions)) {
+            text = text.replaceAll(token, value);
+        }
+        writeFileSync(path, text);
+    }
+    if (options.ui === "vue") {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
+        rmSync(join(targetDir, "ui"), { recursive: true });
+    }
+    if (options.integration === "better-auth")
+        rmSync(join(targetDir, "backend/internal/app/identity_none.go"));
+    if (options.integration) {
+        const mod = join(targetDir, "backend/go.mod");
+        writeFileSync(mod, readFileSync(mod, "utf8").replace("go 1.24", "go 1.25"));
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nintegration:\n  protocol: 1\n  workers: {}\n" + (options.integration === "better-auth" ? "  identity: better-auth\n" : ""));
+        const routes = join(targetDir, "backend/internal/app/routes.go");
+        writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
+    }
+}
+function substitutionsFor(template, targetDir, options) {
+    if (options.privilege !== undefined && template !== "native-go") {
+        throw new Error("[INIT_PRIVILEGE_UNSUPPORTED] --privilege 只適用於 -t native-go。");
+    }
+    if ((options.ui !== undefined || options.integration !== undefined) && template !== "native-go")
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui/--integration 只適用於 native-go。");
+    if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
+        throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
+    if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
+        throw new Error("[INIT_INTEGRATION_INVALID] --integration 只接受 go 或 better-auth。");
+    if (options.integration && (options.ui !== "vue" || options.privilege === "none"))
+        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 --ui vue 與 root privilege（自動選用）。");
+    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    if (privilege !== "none" && privilege !== "root") {
+        throw new Error(`[INIT_PRIVILEGE_INVALID] --privilege 只接受 none 或 root，收到「${String(privilege)}」。`);
+    }
+    if (!SUBSTITUTED[template]) {
+        return {};
+    }
+    const packageId = options.packageId ?? defaultPackageId(targetDir);
+    if (!PACKAGE_ID.test(packageId)) {
+        throw new Error(`[INIT_PACKAGE_INVALID] package「${packageId}」必須以英文字母開頭，只含英數字（2–64 字），例如 PhotoTagger。`);
+    }
+    const displayName = options.displayName ?? defaultDisplayName(targetDir);
+    if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
+        throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
+    }
+    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege };
 }

package/dist/log.js

@@ -6,14 +6,13 @@ export async function followProjectLogs(options) {
         return { ok: false, lines: [], diagnostics: { code: "NOT_INSTALLED" } };
     }
     const lines = await options.host.fetchContainerLogs(identity.packageId);
-    const info = await options.host.getAttestationInfo(identity.packageId);
+    const info = await options.host.getInstalledPackageState?.(identity.packageId);
     return {
         ok: true,
         lines,
         diagnostics: {
             packageIdentity: identity.packageId,
-            attestationKind: info.attestationKind,
-            readiness: info.readiness,
+            readiness: info?.status,
             redacted: true,
         },
     };

package/dist/native/validate.js

@@ -11,7 +11,6 @@ function nativeSpan(file, doc, pathSegments, pathString) {
     return { file, line: pos.line, column: pos.column, path: dotPath };
 }
 const HEX64_REGEX = /^[0-9a-fA-F]{64}$/;
-const FORBIDDEN_SERVICE_FIELDS = ["user", "command", "pre_start", "post_start", "shell"];
 export function validateNative(parsed, nativeFile, options = {}) {
     const errors = [];
     const profile = options.profile ?? "personal";

package/dist/standalone/binary.d.ts

@@ -0,0 +1,9 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { StandaloneError } from "./manifest.js";
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily): StandaloneError | undefined;

package/dist/standalone/binary.js

@@ -0,0 +1,67 @@
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { relative } from "node:path";
+const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+const PT_INTERP = 3;
+const MAX_BINARY_BYTES = 256 * 1024 * 1024;
+const HEADER_BYTES = 64 * 1024;
+function fail(code, message) {
+    return { code, message };
+}
+/**
+ * Checks a prebuilt CGI before it is packaged: a regular file inside the
+ * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * (no PT_INTERP), because DSM models ship different libc versions.
+ * Returns undefined when the file is acceptable.
+ */
+export function checkCgiBinary(projectRoot, file, arch) {
+    let stat;
+    try {
+        stat = lstatSync(file);
+    }
+    catch {
+        return fail("STANDALONE_BINARY_MISSING", `找不到 ${arch} 的 backend 執行檔：${file}`);
+    }
+    if (!stat.isFile()) {
+        return fail("STANDALONE_BINARY_NOT_REGULAR", `${file} 必須是一般檔案（不可是 symlink 或目錄）。`);
+    }
+    const rel = relative(realpathSync(projectRoot), realpathSync(file));
+    if (rel.startsWith("..")) {
+        return fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${file} 實際位於專案目錄之外。`);
+    }
+    if (stat.size > MAX_BINARY_BYTES) {
+        return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
+    }
+    return checkElf(readHeader(file), file, arch);
+}
+function readHeader(file) {
+    const fd = openSync(file, "r");
+    try {
+        const buf = Buffer.alloc(HEADER_BYTES);
+        return buf.subarray(0, readSync(fd, buf, 0, HEADER_BYTES, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function checkElf(buf, file, arch) {
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 64-bit little-endian Linux ELF 執行檔。`);
+    if (buf.length < 64 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[4] !== 2 || buf[5] !== 1) {
+        return notElf;
+    }
+    const machine = buf.readUInt16LE(18);
+    if (machine !== ELF_MACHINE[arch]) {
+        return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
+    }
+    const phoff = Number(buf.readBigUInt64LE(32));
+    const phentsize = buf.readUInt16LE(54);
+    const phnum = buf.readUInt16LE(56);
+    if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
+        return notElf;
+    }
+    for (let i = 0; i < phnum; i++) {
+        if (buf.readUInt32LE(phoff + i * phentsize) === PT_INTERP) {
+            return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
+        }
+    }
+    return undefined;
+}

package/dist/standalone/build.d.ts

@@ -0,0 +1,25 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+export interface CommandResult {
+    status: number | null;
+    stderr: string;
+    /** The program itself was not found. */
+    missing?: boolean;
+}
+export type CommandRunner = (command: string, args: string[], options: {
+    cwd: string;
+    env: Record<string, string | undefined>;
+}) => CommandResult;
+export interface StandaloneBuildOptions {
+    root: string;
+    /** Defaults to every arch in the manifest. */
+    arches?: NativeArchFamily[];
+    /** Defaults to `<root>/dist`. */
+    outDir?: string;
+    run?: CommandRunner;
+}
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export declare const runCommand: CommandRunner;
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
+    outputs: string[];
+}>;

package/dist/standalone/build.js

@@ -0,0 +1,108 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkCgiBinary } from "./binary.js";
+import { loadStandaloneManifest } from "./manifest.js";
+import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
+import { buildHelper } from "./helper.js";
+const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
+/** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
+export const runCommand = (command, args, options) => {
+    const result = spawnSync(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["ignore", "inherit", "pipe"],
+        encoding: "utf8",
+    });
+    if (result.stderr) {
+        process.stderr.write(result.stderr);
+    }
+    const missing = result.error?.code === "ENOENT";
+    return { status: result.status, stderr: result.stderr ?? "", missing };
+};
+/** `build-spk` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
+export async function buildStandalone(options) {
+    const loaded = loadStandaloneManifest(options.root);
+    if (!loaded.ok) {
+        const [first] = loaded.errors;
+        throw new StandaloneBuildError(first.code, loaded.errors.map((e) => `[${e.code}] ${e.message}`).join("\n"));
+    }
+    const manifest = loaded.manifest;
+    const run = options.run ?? runCommand;
+    const arches = options.arches ?? manifest.arches;
+    for (const arch of arches) {
+        if (!manifest.arches.includes(arch)) {
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+        }
+    }
+    buildUi(manifest, run);
+    if (manifest.integration?.identity === "better-auth") {
+        const result = run("npm", ["run", "build"], { cwd: join(manifest.root, "node"), env: { ...process.env } });
+        if (result.missing || result.status !== 0)
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_BUILD_FAILED", `Optional Better Auth build failed.\n${result.stderr}`);
+    }
+    const outDir = options.outDir ?? join(options.root, "dist");
+    const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
+    try {
+        const outputs = [];
+        for (const arch of arches) {
+            const helper = buildHelper(manifest, arch, work, run);
+            if (helper) {
+                const problem = checkCgiBinary(work, helper.binary, arch);
+                if (problem)
+                    throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const cgiPath = backendFor(manifest, arch, work, run, helper);
+            const problem = checkCgiBinary(manifest.backend.kind === "go" ? work : manifest.root, cgiPath, arch);
+            if (problem) {
+                throw new StandaloneBuildError(problem.code, problem.message);
+            }
+            const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
+            const builtManifest = helper ? { ...manifest, rootOps: [...(manifest.rootOps ?? []), ...helper.ops] } : manifest;
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, helper });
+            outputs.push(outputPath);
+        }
+        return { outputs };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+function buildUi(manifest, run) {
+    const build = manifest.ui.build;
+    if (!build) {
+        return;
+    }
+    const [command, ...args] = build.command;
+    const result = run(command, args, { cwd: build.cwd, env: { ...process.env } });
+    if (result.missing || result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。\n${result.stderr}`);
+    }
+}
+function backendFor(manifest, arch, work, run, helper) {
+    const backend = manifest.backend;
+    if (backend.kind === "binary") {
+        return backend.files[arch];
+    }
+    const out = join(work, `api-${arch}.cgi`);
+    const ldflags = [
+        "-s",
+        "-w",
+        "-buildid=",
+        `-X main.packageID=${manifest.package}`,
+        `-X main.version=${manifest.spkVersion}`,
+        ...(helper ? [`-X 'main.helperInventory=${JSON.stringify(helper.inventory)}'`] : []),
+    ].join(" ");
+    const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
+        cwd: backend.dir,
+        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+    });
+    if (result.missing) {
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.24 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
+    }
+    if (result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);
+    }
+    return out;
+}

package/dist/standalone/dsm-window.d.ts

@@ -0,0 +1,26 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
+export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+export declare function cgiUrl(packageId: string): string;
+/**
+ * `createI18n(dsmLang, catalogs)` → `{ locale, t }`, plain ES5 so it runs in
+ * DSM's desktop as is. The DSM language picks a shipped catalog (else
+ * English); missing keys fall back to English, then to the key itself.
+ * `t(key, { count })` looks up `key.one` / `key.other` via Intl.PluralRules.
+ */
+export declare const I18N_RUNTIME: string;
+/**
+ * The wrapper file name carries the build so DSM never serves a wrapper
+ * cached from the previous version after an upgrade.
+ */
+export declare function windowScriptName(manifest: StandaloneManifest): string;
+/** `ui/config`: registers the DSM main-menu app and its window class. */
+export declare function renderUiConfig(manifest: StandaloneManifest): string;
+/**
+ * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
+ * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
+ * `assetVersion` busts browser caches when the UI changes.
+ */
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string): string;

package/dist/standalone/dsm-window.js

@@ -0,0 +1,251 @@
+import { DSM_LANGS } from "./i18n.js";
+import { ROOT_MESSAGES } from "./root-messages.js";
+import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+/** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
+export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+export function cgiUrl(packageId) {
+    return `/webman/3rdparty/${packageId}/cgi/api.cgi`;
+}
+const LOCALE_BY_DSM_LANG = Object.fromEntries(Object.entries(DSM_LANGS).map(([locale, lang]) => [lang, locale]));
+/**
+ * `createI18n(dsmLang, catalogs)` → `{ locale, t }`, plain ES5 so it runs in
+ * DSM's desktop as is. The DSM language picks a shipped catalog (else
+ * English); missing keys fall back to English, then to the key itself.
+ * `t(key, { count })` looks up `key.one` / `key.other` via Intl.PluralRules.
+ */
+export const I18N_RUNTIME = `function createI18n(dsmLang, catalogs) {
+  var byLang = ${JSON.stringify(LOCALE_BY_DSM_LANG)};
+  var has = function (object, key) { return Object.prototype.hasOwnProperty.call(object, key); };
+  var wanted = has(byLang, dsmLang) ? byLang[dsmLang] : "en";
+  var locale = has(catalogs, wanted) ? wanted : "en";
+  var own = catalogs[locale] || {};
+  var en = catalogs.en || {};
+  var plural = typeof Intl !== "undefined" && Intl.PluralRules ? new Intl.PluralRules(locale) : null;
+  function lookup(key) {
+    return has(own, key) ? own[key] : has(en, key) ? en[key] : undefined;
+  }
+  function t(key, params) {
+    var text = lookup(key);
+    if (text === undefined && params && typeof params.count === "number") {
+      var form = plural ? plural.select(params.count) : params.count === 1 ? "one" : "other";
+      text = lookup(key + "." + form);
+      if (text === undefined) text = lookup(key + ".other");
+    }
+    if (text === undefined) return key;
+    return text.replace(/\\{(\\w+)\\}/g, function (match, name) {
+      return params && has(params, name) ? String(params[name]) : match;
+    });
+  }
+  return { locale: locale, t: t };
+}`;
+/**
+ * The wrapper file name carries the build so DSM never serves a wrapper
+ * cached from the previous version after an upgrade.
+ */
+export function windowScriptName(manifest) {
+    return `window-${String(manifest.build).padStart(4, "0")}.js`;
+}
+/** `ui/config`: registers the DSM main-menu app and its window class. */
+export function renderUiConfig(manifest) {
+    const ns = `SYNO.SDS.${manifest.package}`;
+    return `${JSON.stringify({
+        [windowScriptName(manifest)]: {
+            [`${ns}.Instance`]: {
+                type: "app",
+                title: manifest.displayname,
+                desc: manifest.description,
+                icon: "images/app_{0}.png",
+                appWindow: `${ns}.MainWindow`,
+                allowMultiInstance: false,
+                allUsers: true,
+                depend: [`${ns}.MainWindow`],
+            },
+            [`${ns}.MainWindow`]: {
+                type: "lib",
+                title: manifest.displayname,
+                icon: "images/app_{0}.png",
+                depend: [],
+            },
+        },
+    }, null, 2)}\n`;
+}
+/**
+ * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
+ * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
+ * `assetVersion` busts browser caches when the UI changes.
+ */
+export function renderWindowScript(manifest, assetVersion) {
+    const pkg = manifest.package;
+    const ns = `SYNO.SDS.${pkg}`;
+    const p = JSON.stringify(pkg);
+    const root = manifest.rootOps ? renderRootParts(ns, manifest) : undefined;
+    return `/* Generated by synopkgland build-spk. Edit your UI in the project's ui folder. */
+Ext.ns(${JSON.stringify(ns)});
+
+${ns}.call = function (method, params) {
+  var headers = { "Content-Type": "application/json" };
+  var token = SYNO.SDS.Session && SYNO.SDS.Session.SynoToken;
+  if (token) {
+    headers["X-SYNO-TOKEN"] = token;
+  }
+  return fetch(${JSON.stringify(cgiUrl(pkg))}, {
+    method: "POST",
+    credentials: "same-origin",
+    headers: headers,
+    body: JSON.stringify({ method: method, params: params || {} })
+  }).then(function (response) {
+    return response.json().catch(function () {
+      return { success: false, error: { code: "bad_response", message: "HTTP " + response.status } };
+    });
+  }, function () {
+    return { success: false, error: { code: "network", message: "The NAS did not answer" } };
+  }).then(function (body) {
+    if (body && body.success === true) {
+      return body.data;
+    }
+    throw (body && body.error) || { code: "bad_response", message: "Unexpected response" };
+  });
+};
+
+${ns}.messages = ${JSON.stringify(manifest.i18n?.catalogs ?? { en: {} })};
+${ns}.createI18n = (function () {
+${I18N_RUNTIME}
+  return createI18n;
+})();
+
+${root ? root.definitions : ""}${ns}.loadApp = function (done) {
+  var apps = window.DsmPackageApps || {};
+  if (apps[${p}]) {
+    done(apps[${p}]);
+    return;
+  }
+  var base = "webman/3rdparty/${pkg}/app/";
+  var css = document.createElement("link");
+  css.rel = "stylesheet";
+  css.href = base + "app.css?v=${assetVersion}";
+  document.head.appendChild(css);
+  var js = document.createElement("script");
+  js.src = base + "app.js?v=${assetVersion}";
+  js.dataset.package = ${p};
+  js.onload = function () { done((window.DsmPackageApps || {})[${p}]); };
+  document.head.appendChild(js);
+};
+
+Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
+  extend: "SYNO.SDS.AppInstance",
+  appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
+});
+
+Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
+  extend: "SYNO.SDS.AppWindow",
+  constructor: function (config) {
+    this.callParent([Ext.apply({
+      width: 960, height: 640, minWidth: 640, minHeight: 420, layout: "fit",
+      ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
+    }, config)]);
+  },
+  onOpen: function () {
+    this.callParent(arguments);
+    var me = this;
+    if (me.mounted) {
+      me.reopenHandlers.forEach(function (fn) { fn(); });
+      return;
+    }
+    me.reopenHandlers = [];
+    var lang = typeof _S === "function" ? _S("lang") : "enu";
+${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
+      var root = me.body && me.body.dom.querySelector(".dsmapp-root");
+      if (app && root && !me.mounted) {
+        var i18n = ${ns}.createI18n(lang, ${ns}.messages);
+        root.lang = i18n.locale;
+        me.mounted = app.mount(root, {
+          call: ${ns}.call,
+          reopen: function (fn) { me.reopenHandlers.push(fn); },
+          appWindow: me,
+          lang: lang,
+          locale: i18n.locale,
+          t: i18n.t${root ? ",\n          root: access" : ""}
+        }) || {};
+      }
+    });
+  },
+  onDestroy: function () {
+    if (this.mounted && this.mounted.unmount) {
+      this.mounted.unmount();
+    }
+    this.mounted = null;
+    this.callParent(arguments);
+  }
+});
+`;
+}
+const ROOT_PANEL_CSS = [
+    ".dsmapp-rootpanel{margin:16px 20px;padding:12px 16px;border:1px solid #d5dce5;border-radius:4px;background:#f7f9fb;font-size:13px;line-height:1.5}",
+    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}",
+    ".dsmapp-rootpanel dl{display:grid;grid-template-columns:max-content 1fr;gap:2px 12px;margin:8px 0}",
+    ".dsmapp-rootpanel dt{color:#526070}.dsmapp-rootpanel dd{margin:0}",
+    ".dsmapp-rootpanel pre{margin:4px 0 8px;padding:6px 8px;background:#fff;border:1px solid #e1e6ec;white-space:pre-wrap;max-height:160px;overflow:auto}",
+    ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
+    ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
+    ".dsmapp-rootpanel-message{color:#c0392b}.dsmapp-rootpanel-hint{color:#526070;font-size:12px}",
+].join("");
+/**
+ * The privilege: root additions to the window: the exact tasks and panel
+ * text, the access runtime wired to DSM's own password confirmation and the
+ * AppWindow's WebAPI channel, and the panel above the app.
+ */
+function renderRootParts(ns, manifest) {
+    return {
+        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest))};
+${ns}.rootMessages = ${JSON.stringify(ROOT_MESSAGES)};
+${ns}.createRootAccess = (function () {
+${ROOT_RUNTIME}
+  return createRootAccess;
+})();
+${ns}.mountRootPanel = (function () {
+${ROOT_PANEL}
+  return mountRootPanel;
+})();
+
+`,
+        html: `autoScroll: true,
+      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div>'`,
+        mount: `    var session = function () {
+      var current = SYNO.SDS.Session || {};
+      return { name: current.user, admin: current.is_admin === true };
+    };
+    var access = ${ns}.createRootAccess({
+      tasks: ${ns}.rootTasks,
+      user: session,
+      send: function (api, method, version, params) {
+        return new Promise(function (resolve, reject) {
+          me.sendWebAPI({
+            api: api, method: method, version: version, params: params, scope: me,
+            callback: function (success, response) {
+              if (success) resolve(response);
+              else reject({ code: "dsm_" + ((response && response.code) || "error") });
+            }
+          });
+        });
+      },
+      confirmPassword: function () {
+        return new Promise(function (resolve) {
+          SYNO.SDS.Utils.PasswordConfirmDialog.openDialog(me, function (confirmation) {
+            resolve((confirmation && confirmation.SynoConfirmPWToken) || null);
+          }, [], function () { resolve(null); });
+        });
+      },
+      call: ${ns}.call,
+      wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
+    });
+    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
+    if (panels) {
+      var rootI18n = ${ns}.createI18n(lang, ${ns}.rootMessages);
+      panels.lang = rootI18n.locale;
+      ${ns}.mountRootPanel(panels, access, rootI18n, ${ns}.rootTasks, session().admin);
+    }
+`,
+    };
+}