@synopackageland/cli 0.3.10 → 0.4.1

package/dist/templates/native-go/i18n/messages/en.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "Loading...",
+  "app.refresh": "Refresh",
+  "app.title": "It works",
+  "error.admin_required": "Sorry, this user account has not been assigned proper privileges to perform this action.",
+  "error.auth_unavailable": "Unable to perform this operation. Please try again later.",
+  "error.bad_request": "Check the entered value and try again.",
+  "error.bad_response": "Unable to perform this operation. Please try again later.",
+  "error.cross_origin": "Unable to perform this operation. Please try again later.",
+  "error.internal": "Unable to perform this operation. Please try again later.",
+  "error.json_required": "Unable to perform this operation. Please try again later.",
+  "error.method_not_allowed": "Unable to perform this operation. Please try again later.",
+  "error.network": "Connection failed. Please check your network settings.",
+  "error.request_too_large": "Unable to perform this operation. Please try again later.",
+  "error.session_required": "Connection expired. Please sign in again.",
+  "error.unknown_method": "Unable to perform this operation. Please try again later.",
+  "greeting.adminOnly": "Only members of the administrators group can change the greeting.",
+  "greeting.label": "New greeting",
+  "greeting.save": "Save",
+  "greeting.setBy": "{text} — set by {user}",
+  "status.backend": "Backend",
+  "status.heading": "Backend status",
+  "status.package": "Package name",
+  "status.uid": "Runs as UID",
+  "status.user": "User",
+  "status.userAdmin": "{user} (administrator)",
+  "status.version": "Version"
+}

package/dist/templates/native-go/i18n/messages/es.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "Cargando...",
+  "app.refresh": "Actualizar",
+  "app.title": "Funciona",
+  "error.admin_required": "A esta cuenta de usuario no se le han asignado los privilegios adecuados para realizar esta acción.",
+  "error.auth_unavailable": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.bad_request": "Compruebe el valor introducido y vuelva a intentarlo.",
+  "error.bad_response": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.cross_origin": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.internal": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.json_required": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.method_not_allowed": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.network": "Error de la conexión. Compruebe su conexión de red.",
+  "error.request_too_large": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.session_required": "Conexión caducada. Vuelva a conectarse.",
+  "error.unknown_method": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "greeting.adminOnly": "Solo los miembros del grupo administrators pueden cambiar el saludo.",
+  "greeting.label": "Nuevo saludo",
+  "greeting.save": "Guardar",
+  "greeting.setBy": "{text} — establecido por {user}",
+  "status.backend": "Backend",
+  "status.heading": "Estado del backend",
+  "status.package": "Nombre del paquete",
+  "status.uid": "Se ejecuta como UID",
+  "status.user": "Usuario",
+  "status.userAdmin": "{user} (administrador)",
+  "status.version": "Versión"
+}

package/dist/templates/native-go/i18n/messages/fr.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "Chargement...",
+  "app.refresh": "Actualiser",
+  "app.title": "Ça fonctionne",
+  "error.admin_required": "Désolé, ce compte utilisateur ne dispose pas des droits nécessaires pour accomplir cette action.",
+  "error.auth_unavailable": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.bad_request": "Vérifiez la valeur saisie et réessayez.",
+  "error.bad_response": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.cross_origin": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.internal": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.json_required": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.method_not_allowed": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.network": "La connexion a échoué. Vérifiez vos paramètres réseau.",
+  "error.request_too_large": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.session_required": "La connexion a expiré. Reconnectez-vous.",
+  "error.unknown_method": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "greeting.adminOnly": "Seuls les membres du groupe administrators peuvent modifier le message d'accueil.",
+  "greeting.label": "Nouveau message d'accueil",
+  "greeting.save": "Sauvegarder",
+  "greeting.setBy": "{text} — défini par {user}",
+  "status.backend": "Backend",
+  "status.heading": "Statut du backend",
+  "status.package": "Nom du paquet",
+  "status.uid": "Exécuté avec l'UID",
+  "status.user": "Utilisateur",
+  "status.userAdmin": "{user} (administrateur)",
+  "status.version": "Version"
+}

package/dist/templates/native-go/i18n/messages/it.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "Caricamento...",
+  "app.refresh": "Aggiorna",
+  "app.title": "Funziona",
+  "error.admin_required": "Siamo spiacenti, a questo account utente non sono stati assegnati privilegi appropriati per eseguire questa azione.",
+  "error.auth_unavailable": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.bad_request": "Controllare il valore inserito e riprovare.",
+  "error.bad_response": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.cross_origin": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.internal": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.json_required": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.method_not_allowed": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.network": "Connessione non riuscita. Controllare le impostazioni di rete.",
+  "error.request_too_large": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.session_required": "Connessione scaduta. Accedere nuovamente.",
+  "error.unknown_method": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "greeting.adminOnly": "Solo i membri del gruppo administrators possono modificare il saluto.",
+  "greeting.label": "Nuovo saluto",
+  "greeting.save": "Salva",
+  "greeting.setBy": "{text} — impostato da {user}",
+  "status.backend": "Backend",
+  "status.heading": "Stato del backend",
+  "status.package": "Nome pacchetto",
+  "status.uid": "Eseguito come UID",
+  "status.user": "Utente",
+  "status.userAdmin": "{user} (amministratore)",
+  "status.version": "Versione"
+}

package/dist/templates/native-go/i18n/messages/ja.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "読み込み中...",
+  "app.refresh": "最新の情報に更新",
+  "app.title": "動作しています",
+  "error.admin_required": "申し訳ありませんが、このユーザー アカウントにはこの操作を行うための権限が与えられていません。",
+  "error.auth_unavailable": "この操作は実行できません。後でもう一度お試しください。",
+  "error.bad_request": "入力した値を確認して、もう一度お試しください。",
+  "error.bad_response": "この操作は実行できません。後でもう一度お試しください。",
+  "error.cross_origin": "この操作は実行できません。後でもう一度お試しください。",
+  "error.internal": "この操作は実行できません。後でもう一度お試しください。",
+  "error.json_required": "この操作は実行できません。後でもう一度お試しください。",
+  "error.method_not_allowed": "この操作は実行できません。後でもう一度お試しください。",
+  "error.network": "接続に失敗しました。ネットワーク設定を確認してください。",
+  "error.request_too_large": "この操作は実行できません。後でもう一度お試しください。",
+  "error.session_required": "接続の期限が切れています。もう 1 度サイン インしてください。",
+  "error.unknown_method": "この操作は実行できません。後でもう一度お試しください。",
+  "greeting.adminOnly": "あいさつを変更できるのは administrators グループのメンバーのみです。",
+  "greeting.label": "新しいあいさつ",
+  "greeting.save": "保存",
+  "greeting.setBy": "{text} — {user} が設定",
+  "status.backend": "バックエンド",
+  "status.heading": "バックエンドの状態",
+  "status.package": "パッケージ名",
+  "status.uid": "実行 UID",
+  "status.user": "ユーザー",
+  "status.userAdmin": "{user}（管理者）",
+  "status.version": "バージョン"
+}

package/dist/templates/native-go/i18n/messages/ko.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "로드 중…",
+  "app.refresh": "새로 고침",
+  "app.title": "정상적으로 작동합니다",
+  "error.admin_required": "죄송합니다. 이 사용자 계정에는 이 작업을 수행하기에 적절한 권한이 할당되지 않았습니다.",
+  "error.auth_unavailable": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.bad_request": "입력한 값을 확인한 후 다시 시도하십시오.",
+  "error.bad_response": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.cross_origin": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.internal": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.json_required": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.method_not_allowed": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.network": "연결 실패. 네트워크 설정을 확인해 주십시오.",
+  "error.request_too_large": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.session_required": "연결 만료됨. 다시 로그인 해 주십시오.",
+  "error.unknown_method": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "greeting.adminOnly": "administrators 그룹의 구성원만 인사말을 변경할 수 있습니다.",
+  "greeting.label": "새 인사말",
+  "greeting.save": "저장",
+  "greeting.setBy": "{text} — {user}님이 설정함",
+  "status.backend": "백엔드",
+  "status.heading": "백엔드 상태",
+  "status.package": "패키지 이름",
+  "status.uid": "실행 UID",
+  "status.user": "사용자",
+  "status.userAdmin": "{user}(관리자)",
+  "status.version": "버전"
+}

package/dist/templates/native-go/i18n/messages/zh-CN.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "加载中...",
+  "app.refresh": "刷新",
+  "app.title": "运行成功",
+  "error.admin_required": "抱歉，此用户帐户权限不足，无法执行此操作。",
+  "error.auth_unavailable": "无法执行此操作。请稍后再试。",
+  "error.bad_request": "请检查输入的值后重试。",
+  "error.bad_response": "无法执行此操作。请稍后再试。",
+  "error.cross_origin": "无法执行此操作。请稍后再试。",
+  "error.internal": "无法执行此操作。请稍后再试。",
+  "error.json_required": "无法执行此操作。请稍后再试。",
+  "error.method_not_allowed": "无法执行此操作。请稍后再试。",
+  "error.network": "无法联机，请检查你的网络设置。",
+  "error.request_too_large": "无法执行此操作。请稍后再试。",
+  "error.session_required": "联机超时，请重新登录。",
+  "error.unknown_method": "无法执行此操作。请稍后再试。",
+  "greeting.adminOnly": "只有 administrators 群组的成员可以更改问候语。",
+  "greeting.label": "新的问候语",
+  "greeting.save": "保存",
+  "greeting.setBy": "{text} — 由 {user} 设置",
+  "status.backend": "后端",
+  "status.heading": "后端状态",
+  "status.package": "套件名称",
+  "status.uid": "运行身份 UID",
+  "status.user": "用户帐号",
+  "status.userAdmin": "{user}（管理员）",
+  "status.version": "版本"
+}

package/dist/templates/native-go/i18n/messages/zh-TW.json

@@ -0,0 +1,28 @@
+{
+  "app.loading": "載入中...",
+  "app.refresh": "重新整理",
+  "app.title": "成功運作了",
+  "error.admin_required": "抱歉，此使用者帳號權限不足，無法執行此動作。",
+  "error.auth_unavailable": "無法執行此操作。請稍後再試。",
+  "error.bad_request": "請檢查輸入的值後再試一次。",
+  "error.bad_response": "無法執行此操作。請稍後再試。",
+  "error.cross_origin": "無法執行此操作。請稍後再試。",
+  "error.internal": "無法執行此操作。請稍後再試。",
+  "error.json_required": "無法執行此操作。請稍後再試。",
+  "error.method_not_allowed": "無法執行此操作。請稍後再試。",
+  "error.network": "無法連線，請檢查你的網路設定。",
+  "error.request_too_large": "無法執行此操作。請稍後再試。",
+  "error.session_required": "連線逾時。請重新登入。",
+  "error.unknown_method": "無法執行此操作。請稍後再試。",
+  "greeting.adminOnly": "只有 administrators 群組的成員可以變更問候語。",
+  "greeting.label": "新的問候語",
+  "greeting.save": "儲存",
+  "greeting.setBy": "{text} — 由 {user} 設定",
+  "status.backend": "後端",
+  "status.heading": "後端狀態",
+  "status.package": "套件名稱",
+  "status.uid": "執行身分 UID",
+  "status.user": "使用者帳號",
+  "status.userAdmin": "{user}（管理員）",
+  "status.version": "版本"
+}

package/dist/templates/native-go/ui/app.css

@@ -0,0 +1,35 @@
+/* Scoped to .dsmapp: the DSM desktop shares one page with every other app. */
+.dsmapp {
+  box-sizing: border-box;
+  height: 100%;
+  overflow: auto;
+  padding: 20px 24px;
+  font: 13px/1.5 "Noto Sans", "Helvetica Neue", Arial, sans-serif;
+  color: #1d2733;
+  background: #fff;
+}
+.dsmapp-header { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.dsmapp h1 { margin: 0 0 4px; font-size: 20px; font-weight: 600; }
+.dsmapp-secondary {
+  height: 28px; padding: 0 12px; border: 1px solid #c8d0da; border-radius: 3px;
+  background: #fff; color: inherit; font: inherit; cursor: pointer;
+}
+.dsmapp h2 { margin: 24px 0 8px; font-size: 14px; font-weight: 600; }
+.dsmapp-greeting { margin: 0 0 12px; font-size: 15px; }
+.dsmapp-form { display: flex; gap: 8px; max-width: 420px; }
+.dsmapp-form[hidden] { display: none; }
+.dsmapp-form input {
+  flex: 1; height: 28px; padding: 0 8px;
+  border: 1px solid #c8d0da; border-radius: 3px; font: inherit;
+}
+.dsmapp-form button {
+  height: 30px; padding: 0 16px; border: 0; border-radius: 3px;
+  background: #0086e5; color: #fff; font: inherit; cursor: pointer;
+}
+.dsmapp-form button:disabled { opacity: 0.6; cursor: default; }
+.dsmapp-note { margin: 0; color: #5d6b7a; }
+.dsmapp-note[hidden] { display: none; }
+.dsmapp-message { min-height: 1.5em; color: #c0392b; }
+.dsmapp-facts { display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 0; }
+.dsmapp-facts dt { color: #5d6b7a; }
+.dsmapp-facts dd { margin: 0; }

package/dist/templates/native-go/ui/app.js

@@ -0,0 +1,101 @@
+// The app inside the DSM window. The generated DSM wrapper loads this file and
+// calls mount(root, ctx) when the window opens:
+//   ctx.call(method, params) -> Promise<data>  POSTs to the package CGI with
+//                                              DSM's session; rejects with
+//                                              { code, message } on errors
+//   ctx.t(key, params)       -> text from i18n/messages/<locale>.json in DSM's
+//                               language ({name} placeholders, key.one/.other
+//                               plurals with { count }), English as fallback
+//   ctx.locale               -> "en", "zh-TW", … (use it for Intl formatting)
+//   ctx.reopen(fn)           -> idempotent unsubscribe; fn runs on re-show
+//   ctx.host.platform()     -> read-only host/launch mode/language/version snapshot
+//   ctx.host.setTitle(text) -> encoded DSM title or standalone document.title;
+//                              inspect the returned status, not host authority
+//   ctx.host.subscribe(event, fn) -> status + dispose for window-resize;
+//                                   host-theme/language-change unsupported
+//   ctx.host.openFileManager(path) / revealFile(path) -> File Station virtual path
+//       request only; preview/details/settings return unsupported, never a grant
+// Replace everything below with your own UI (plain JS, or a bundle you build
+// with Vite/Vue into this folder -- see README.md).
+(function () {
+  "use strict";
+
+  function el(tag, attrs, children) {
+    var node = document.createElement(tag);
+    Object.keys(attrs || {}).forEach(function (key) {
+      if (key === "text") node.textContent = attrs[key];
+      else node.setAttribute(key, attrs[key]);
+    });
+    (children || []).forEach(function (child) { node.appendChild(child); });
+    return node;
+  }
+
+  function mount(root, ctx) {
+    var t = ctx.t;
+    var status = el("dl", { class: "dsmapp-facts" });
+    var greeting = el("p", { class: "dsmapp-greeting", text: t("app.loading") });
+    var input = el("input", { type: "text", maxlength: "200", "aria-label": t("greeting.label"), placeholder: t("greeting.label") });
+    var save = el("button", { type: "submit", text: t("greeting.save") });
+    var refreshButton = el("button", { type: "button", class: "dsmapp-secondary", text: t("app.refresh") });
+    var message = el("p", { class: "dsmapp-message", role: "status" });
+    var form = el("form", { class: "dsmapp-form", hidden: "" }, [input, save]);
+    var adminOnly = el("p", { class: "dsmapp-note", hidden: "", text: t("greeting.adminOnly") });
+
+    root.classList.add("dsmapp");
+    root.replaceChildren(
+      el("div", { class: "dsmapp-header" }, [el("h1", { text: t("app.title") }), refreshButton]),
+      greeting,
+      form,
+      adminOnly,
+      message,
+      el("h2", { text: t("status.heading") }),
+      status
+    );
+
+    // Errors arrive as { code }; the backend's English message is only a fallback.
+    function showError(error) {
+      var code = (error && error.code) || "internal";
+      var text = t("error." + code);
+      message.textContent = text === "error." + code ? (error && error.message) || t("error.internal") : text;
+    }
+
+    function refresh() {
+      message.textContent = "";
+      ctx.call("app.status").then(function (data) {
+        status.replaceChildren();
+        [[t("status.user"), data.admin ? t("status.userAdmin", { user: data.user }) : data.user],
+         [t("status.package"), data.package],
+         [t("status.version"), data.version],
+         [t("status.backend"), data.go_version + " · " + data.platform],
+         [t("status.uid"), String(data.process.uid)]].forEach(function (row) {
+          status.appendChild(el("dt", { text: row[0] }));
+          status.appendChild(el("dd", { text: row[1] }));
+        });
+        form.hidden = !data.admin;
+        adminOnly.hidden = data.admin;
+      }).catch(showError);
+      ctx.call("greeting.get").then(function (data) {
+        greeting.textContent = data.updated_by
+          ? t("greeting.setBy", { text: data.text, user: data.updated_by })
+          : data.text;
+      }).catch(showError);
+    }
+
+    form.addEventListener("submit", function (event) {
+      event.preventDefault();
+      save.disabled = true;
+      ctx.call("greeting.set", { text: input.value })
+        .then(function () { input.value = ""; refresh(); })
+        .catch(showError)
+        .then(function () { save.disabled = false; });
+    });
+    refreshButton.addEventListener("click", refresh);
+
+    ctx.reopen(refresh);
+    refresh();
+    return { unmount: function () { root.replaceChildren(); } };
+  }
+
+  window.DsmPackageApps = window.DsmPackageApps || {};
+  window.DsmPackageApps[document.currentScript.dataset.package] = { mount: mount };
+})();

package/dist/templates/native-go-better-auth/backend/internal/app/identity.go

@@ -0,0 +1,208 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"os/exec"
+	"syscall"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+const maxIdentityBytes = 1 << 20
+
+// Only the selected overlay includes this runner. It invokes a fixed package
+// payload as the package account, never a root helper or arbitrary command.
+var identityRun = func(ctx context.Context, cfg Config, input []byte) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "/var/packages/Node.js_v22/target/usr/local/bin/node", "/var/packages/"+cfg.PackageID+"/target/integration/identity/app.mjs")
+	cmd.Env = []string{"NODE_ENV=production", "PATH=/usr/bin:/bin"}
+	cmd.Stdin = bytes.NewReader(input)
+	var out limitedIdentityOutput
+	cmd.Stdout = &out
+	// Do not expose subprocess messages or credentials in the CGI envelope.
+	if err := cmd.Run(); err != nil {
+		return nil, err
+	}
+	return out.Bytes(), nil
+}
+
+type limitedIdentityOutput struct{ bytes.Buffer }
+
+func (w *limitedIdentityOutput) Write(p []byte) (int, error) {
+	if w.Len()+len(p) > maxIdentityBytes {
+		return 0, errors.New("oversized identity output")
+	}
+	return w.Buffer.Write(p)
+}
+func (cfg Config) identityRoutes() []api.Route {
+	return []api.Route{
+		api.User("identity.status", func(_ context.Context, _ api.Caller, p json.RawMessage) (any, error) {
+			if err := decodeParams(p, &struct{}{}); err != nil {
+				return nil, err
+			}
+			return map[string]string{"mode": "better-auth"}, nil
+		}),
+		api.User("identity.login", cfg.identityHandler("login")), api.User("identity.current", cfg.identityHandler("current")), api.User("identity.logout", cfg.identityHandler("logout")),
+	}
+}
+func (cfg Config) identityHandler(method string) api.Handler {
+	return func(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+		var cookie string
+		if method == "login" {
+			if err := decodeParams(params, &struct{}{}); err != nil {
+				return nil, err
+			}
+		} else {
+			var in struct {
+				Cookie string `json:"cookie"`
+			}
+			if err := decodeParams(params, &in); err != nil {
+				return nil, err
+			}
+			cookie = in.Cookie
+			if len(cookie) > 8192 {
+				return nil, api.BadRequest("app session too large")
+			}
+		}
+		if _, err := cfg.personalID(ctx, caller); err != nil {
+			return nil, err
+		}
+		principal, err := personalLookup(caller.User())
+		if err != nil || principal.Username != caller.User() {
+			return nil, identityUnavailable()
+		}
+		result, err := cfg.identityExchange(ctx, method, cookie, map[string]string{"name": caller.User(), "uid": principal.Uid, "gid": principal.Gid})
+		if err != nil {
+			return nil, identityUnavailable()
+		}
+		if !result.OK {
+			return nil, &api.Error{Code: "identity_refused", Message: "App session refused; create a fresh app session with your DSM login"}
+		}
+		return map[string]string{"user": result.User, "cookie": result.Cookie, "expiresAt": result.ExpiresAt}, nil
+	}
+}
+
+type identityResult struct {
+	OK        bool   `json:"ok"`
+	User      string `json:"user"`
+	Cookie    string `json:"cookie"`
+	ExpiresAt string `json:"expiresAt"`
+}
+
+func identityUnavailable() error {
+	return &api.Error{Code: "identity_unavailable", Message: "Optional Node identity is unavailable; check the selected Node.js_v22 runtime"}
+}
+func (cfg Config) identityExchange(ctx context.Context, method, cookie string, principal map[string]string) (identityResult, error) {
+	var result identityResult
+	root, err := os.OpenRoot(cfg.DataDir)
+	if err != nil {
+		return result, err
+	}
+	defer root.Close()
+	if err = root.Mkdir("identity", 0700); err != nil && !errors.Is(err, fs.ErrExist) {
+		return result, err
+	}
+	info, err := root.Lstat("identity")
+	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
+		return result, errors.New("unsafe directory")
+	}
+	dir, err := root.OpenRoot("identity")
+	if err != nil {
+		return result, err
+	}
+	defer dir.Close()
+	lock, err := dir.OpenFile("store.lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return result, err
+	}
+	defer lock.Close()
+	if err = personalRegular(lock); err != nil {
+		return result, err
+	}
+	// Nonblocking retry bounds contention. CGI never hangs on an abandoned lock.
+	deadline := time.NewTimer(10 * time.Second)
+	defer deadline.Stop()
+	for {
+		err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+		if err == nil {
+			break
+		}
+		if err != syscall.EWOULDBLOCK && err != syscall.EAGAIN {
+			return result, err
+		}
+		select {
+		case <-ctx.Done():
+			return result, ctx.Err()
+		case <-deadline.C:
+			return result, errors.New("identity busy")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+	store := json.RawMessage(`{}`)
+	f, err := dir.OpenFile("store.json", os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err == nil {
+		if err = personalRegular(f); err != nil {
+			f.Close()
+			return result, err
+		}
+		b, e := io.ReadAll(io.LimitReader(f, maxIdentityBytes+1))
+		f.Close()
+		if e != nil || len(b) > maxIdentityBytes || !json.Valid(b) {
+			return result, errors.New("invalid store")
+		}
+		store = b
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return result, err
+	}
+	nonce := make([]byte, 32)
+	if _, err = rand.Read(nonce); err != nil {
+		return result, err
+	}
+	input, err := json.Marshal(map[string]any{"packageID": cfg.PackageID, "store": store, "method": method, "cookie": cookie, "principal": principal, "ticket": hex.EncodeToString(nonce)})
+	if err != nil || len(input) > maxIdentityBytes {
+		return result, errors.New("identity input too large")
+	}
+	output, err := identityRun(ctx, cfg, input)
+	if err != nil || len(output) > maxIdentityBytes {
+		return result, errors.New("identity subprocess failed")
+	}
+	var response struct {
+		Store  json.RawMessage `json:"store"`
+		Result identityResult  `json:"result"`
+	}
+	if err = json.Unmarshal(output, &response); err != nil || len(response.Store) == 0 || !json.Valid(response.Store) {
+		return result, errors.New("invalid response")
+	}
+	tempName := ".store-" + hex.EncodeToString(nonce)
+	temp, err := dir.OpenFile(tempName, os.O_CREATE|os.O_EXCL|os.O_WRONLY|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return result, err
+	}
+	defer dir.Remove(tempName)
+	_, err = temp.Write(response.Store)
+	if err == nil {
+		err = temp.Sync()
+	}
+	closeErr := temp.Close()
+	if err != nil {
+		return result, err
+	}
+	if closeErr != nil {
+		return result, closeErr
+	}
+	if err = dir.Rename(tempName, "store.json"); err != nil {
+		return result, err
+	}
+	return response.Result, nil
+}