@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/write_operation_linux.go

@@ -0,0 +1,245 @@
+package helper
+
+import (
+	"context"
+	"io"
+	"net"
+	"os"
+	"time"
+)
+
+type linuxWriteOperation struct {
+	*linuxOperation
+	writeWork      writeWork
+	receipt        MutationReceipt
+	resultCode     Code
+	ready          bool
+	resultReleased bool
+}
+
+func startLinuxWriteOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w writeWork, input net.Conn) (operationProcess, error) {
+	if w.validate() != "" || pin == nil || pin.path != w.RootPath {
+		return nil, ErrDenied
+	}
+	w.Segments = append([]string{}, w.Segments...)
+	return startLinuxOperationWork(c, binary, a, b, input, pin, nil, &w)
+}
+func (p *linuxWriteOperation) idle() (bool, error) {
+	idle, e := p.linuxOperation.idle()
+	if p.result != nil && p.result.Mutation != nil {
+		p.receipt = *p.result.Mutation
+		p.resultCode = p.result.Code
+		p.ready = true
+		p.result = nil
+	}
+	return idle, e
+}
+func (p *linuxWriteOperation) mutationResult() (MutationReceipt, Code, bool) {
+	idle, e := p.idle()
+	if e != nil {
+		return p.receipt, ErrCleanupRequired, false
+	}
+	return p.receipt, p.resultCode, p.ready && idle
+}
+func (p *linuxWriteOperation) chunk(n uint32) error { return p.chunkWithActor(n, NativeActor{}) }
+func (p *linuxWriteOperation) chunkWithActor(n uint32, a NativeActor) error {
+	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
+		return ErrStale
+	}
+	return p.beginWrite(a, n, false)
+}
+func (p *linuxWriteOperation) commitWithActor(a NativeActor) error { return p.beginWrite(a, 0, true) }
+func (p *linuxWriteOperation) beginWrite(a NativeActor, n uint32, commit bool) error {
+	idle, e := p.idle()
+	if e != nil {
+		return e
+	}
+	if !idle || p.closed || !p.ready || p.resultCode != "" || p.finishSent || !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) || !commit && (n == 0 || n > MaxChunkBytes) {
+		return errTrust
+	}
+	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
+	p.sequence++
+	lease := operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef(), ProofDeadline: p.proofDeadline.UnixNano(), Commit: commit}
+	info, e := openOperationFDInfo(p.process.Pid)
+	if e != nil {
+		return e
+	}
+	done := make(chan operationRelayOutcome, 1)
+	p.pending = done
+	p.ready = false
+	control, data, input := p.control, p.data, p.output
+	boot, w := p.bootstrap, p.writeWork
+	sequence, mounts, deadline := p.sequence, p.mountSequence, p.proofDeadline
+	previous := p.receipt
+	results := make(chan readOnlyPacketOutcome, 1)
+	p.resultPending = results
+	// One outstanding lease. Read only the admitted bytes from the fixed binary
+	// input, then hand them to the actor. No bytes or file descriptors enter JSON.
+	go func() {
+		var e error
+		if !commit {
+			e = input.SetReadDeadline(deadline)
+			buffer := make([]byte, n)
+			if e == nil {
+				_, e = io.ReadFull(input, buffer)
+			}
+			if e == nil {
+				e = writeOperationPacket(control, lease)
+			}
+			if e == nil {
+				var written int
+				written, e = data.Write(buffer)
+				if e == nil && written != len(buffer) {
+					e = io.ErrShortWrite
+				}
+			}
+		} else {
+			e = writeOperationPacket(control, lease)
+		}
+		outcome := readOnlyPacketOutcome{}
+		if e == nil {
+			outcome = receiveWriteProof(control, info, boot, w, p.process.Pid, mounts, sequence, time.Until(deadline))
+			e = outcome.err
+			if e == nil {
+				m := outcome.result.Mutation
+				upper := previous.BytesWritten + uint64(n)
+				if commit {
+					upper = previous.BytesWritten
+				}
+				if m.BytesWritten < previous.BytesWritten || m.BytesWritten > upper || outcome.result.Code == "" && m.BytesWritten != upper || !commit && (m.Published || m.Committed) {
+					e = errTrust
+				}
+			}
+		}
+		if closeErr := info.Close(); e == nil {
+			e = closeErr
+		}
+		outcome.err = e
+		results <- outcome
+		done <- operationRelayOutcome{err: e, mountSequence: outcome.mountSequence}
+	}()
+	if commit {
+		p.finishSent = true
+	}
+	return nil
+}
+func receiveWriteProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w writeWork, pid int, mounts, sequence uint64, timeout time.Duration) readOnlyPacketOutcome {
+	deadline := time.Now().Add(timeout)
+	for {
+		var packet readOnlyPacket
+		cred, e := readOperationPacketBound(control, &packet, MaxControlBytes, time.Until(deadline))
+		if e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		if packet.Result != nil {
+			r := packet.Result
+			m := r.Mutation
+			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != sequence || m == nil || m.EffectsUnknown || m.BytesWritten > w.MaxBytes || m.Committed && !m.Published || m.Published && !m.Created || r.Bytes != 0 || r.Entry != nil || r.List != nil || r.Code != "" && !r.Code.Valid() {
+				return readOnlyPacketOutcome{err: errTrust}
+			}
+			return readOnlyPacketOutcome{result: r, mountSequence: mounts}
+		}
+		if packet.MountFD == nil || packet.ChunkSequence != 0 || packet.MountSequence != mounts+1 || mounts >= maxReadOnlyMountQueries {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		mounts++
+		id, c := operationFDInfoMount(info, *packet.MountFD)
+		if e := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: mounts, Mount: id, Code: c}); e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+	}
+}
+func operationWriteChild(ctx context.Context, control *net.UnixConn, boot operationBootstrap) error {
+	w := *boot.Write
+	witness := os.NewFile(6, "write-root-witness")
+	if witness == nil {
+		return errTrust
+	}
+	defer witness.Close()
+	input := os.NewFile(5, "write-input")
+	if input == nil {
+		return errTrust
+	}
+	defer input.Close()
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+	pin := &pinnedReadOnlyRoot{path: w.RootPath, file: witness}
+	x, c := openActorWriteTransfer(ctx, pin, w, operationReadOnlyACL)
+	receipt := MutationReceipt{}
+	if x != nil {
+		defer x.Close()
+		receipt = x.Receipt()
+	}
+	send := func(sequence uint64, r MutationReceipt, c Code) error {
+		return writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, ChunkSequence: sequence, Result: &readOnlyResult{Code: c, Mutation: &r}}, MaxControlBytes)
+	}
+	if e := send(0, receipt, c); e != nil {
+		return e
+	}
+	if c != "" {
+		return awaitReadOnlyFinish(control, boot.Token)
+	}
+	var sequence, total uint64
+	for {
+		var lease operationLease
+		timeout := BoundedTimeout
+		if w.Staged {
+			timeout = StreamIdleTimeout
+		}
+		if deadline, ok := ctx.Deadline(); ok && time.Until(deadline) < timeout {
+			timeout = time.Until(deadline)
+		}
+		if _, e := readOperationPacketBound(control, &lease, MaxHealthBytes, timeout); e != nil {
+			return e
+		}
+		if lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef || lease.ProofDeadline == 0 {
+			return errTrust
+		}
+		proofDeadline := time.Unix(0, lease.ProofDeadline)
+		if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
+			return ErrStale
+		}
+		proofCtx, cancel := context.WithDeadline(ctx, proofDeadline)
+		sequence++
+		var r MutationReceipt
+		if lease.Commit {
+			if lease.Bytes != 0 {
+				cancel()
+				return errTrust
+			}
+			r, c = x.Commit(proofCtx)
+		} else {
+			if lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || total+uint64(lease.Bytes) > w.MaxBytes {
+				cancel()
+				return errTrust
+			}
+			b := make([]byte, lease.Bytes)
+			input.SetReadDeadline(proofDeadline)
+			if _, e := io.ReadFull(input, b); e != nil {
+				cancel()
+				return e
+			}
+			total += uint64(lease.Bytes)
+			r, c = x.WriteChunk(proofCtx, b)
+		}
+		cancel()
+		if e := send(sequence, r, c); e != nil {
+			return e
+		}
+		// Retain lifetime/FDs until parent acknowledges or drains; receipt available
+		// even for partial effects. No named file is automatically cleaned up.
+		if lease.Commit || c != "" {
+			return awaitReadOnlyFinish(control, boot.Token)
+		}
+	}
+}
+
+func (p *linuxWriteOperation) releaseWriteResult() error {
+	if p.resultReleased {
+		return nil
+	}
+	p.resultReleased = true
+	return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
+}

package/dist/templates/native-go/backend/internal/helper/write_test.go

@@ -0,0 +1,53 @@
+package helper
+
+import "testing"
+
+func TestWriteGatesDefaultDenyAndPublishIsIndependent(t *testing.T) {
+	for _, tc := range []struct {
+		gates   writeGates
+		action  Action
+		allowed bool
+	}{
+		{writeGates{}, ActionCreate, false}, {writeGates{}, ActionWriteStream, false},
+		{writeGates{Create: true}, ActionCreate, true}, {writeGates{Create: true}, ActionWriteStream, false},
+		{writeGates{Stream: true}, ActionWriteStream, false}, {writeGates{Create: true, Stream: true}, ActionWriteStream, false},
+		{writeGates{Create: true, Stream: true, Publish: true}, ActionWriteStream, true},
+		{writeGates{Publish: true}, ActionPublish, false}, {writeGates{Create: true, Publish: true}, ActionPublish, true},
+	} {
+		if tc.gates.allows(tc.action) != tc.allowed {
+			t.Fatal(tc)
+		}
+	}
+}
+func TestWriteWorkRejectsPathsLimitsAndUngatedStage(t *testing.T) {
+	valid := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: MaxBoundedBytes}
+	if c := valid.validate(); c != "" {
+		t.Fatal(c)
+	}
+	for _, kind := range []string{"root", "escape", "zero", "limit", "action", "stage"} {
+		w := valid
+		switch kind {
+		case "root":
+			w.RootPath = "/"
+		case "escape":
+			w.Segments = []string{"..", "file"}
+		case "zero":
+			w.MaxBytes = 0
+		case "limit":
+			w.MaxBytes++
+		case "action":
+			w.Action = ActionRead
+		case "stage":
+			w.Staged = true
+		}
+		if c := w.validate(); c == "" {
+			t.Fatal("accepted", kind)
+		}
+	}
+}
+
+func TestWriteProofPacketDoesNotBecomeReadMetadata(t *testing.T) {
+	if (readOnlyResult{Mutation: &MutationReceipt{Created: true}}).validFor(readOnlyWork{Action: ActionRead, MaxBytes: 10}) {
+		t.Fatal("write receipt accepted as read metadata")
+	}
+}

package/dist/templates/native-go/dsm-package.yaml

@@ -11,7 +11,7 @@ build: 1
 displayname: __DISPLAY_NAME__
 description: A native DSM package with a Go backend and a DSM window UI.
 maintainer: Your Name
-os_min_ver: "7.2-64570"
+os_min_ver: "7.1-42661"
 
 # One SPK per architecture. Supported: x86_64, aarch64.
 arches: [x86_64, aarch64]

package/dist/templates/native-go/ui/app.js

@@ -7,7 +7,14 @@
 //                               language ({name} placeholders, key.one/.other
 //                               plurals with { count }), English as fallback
 //   ctx.locale               -> "en", "zh-TW", … (use it for Intl formatting)
-//   ctx.reopen(fn)           -> fn runs each time DSM re-shows the window
+//   ctx.reopen(fn)           -> idempotent unsubscribe; fn runs on re-show
+//   ctx.host.platform()     -> read-only host/launch mode/language/version snapshot
+//   ctx.host.setTitle(text) -> encoded DSM title or standalone document.title;
+//                              inspect the returned status, not host authority
+//   ctx.host.subscribe(event, fn) -> status + dispose for window-resize;
+//                                   host-theme/language-change unsupported
+//   ctx.host.openFileManager(path) / revealFile(path) -> File Station virtual path
+//       request only; preview/details/settings return unsupported, never a grant
 // Replace everything below with your own UI (plain JS, or a bundle you build
 // with Vite/Vue into this folder -- see README.md).
 (function () {

package/dist/templates/native-go-background/BACKGROUND.md

@@ -0,0 +1,111 @@
+# Background jobs
+
+This package opted in with `synopkgland init --background`. `dsm-package.yaml` has
+`background: {worker: sha256-v1}`. The build adds a package-user worker that DSM
+runs as a systemd user unit. Nothing runs as root, and the CGI never starts a
+process in the background.
+
+## What runs
+
+- `conf/resource` is `{"systemd-user-unit":{}}` and `conf/systemd/pkguser-<Package>-background.service`
+  starts `target/background/worker`. `start-stop-status` only calls `synosystemctl`.
+- The worker is fixed: `sha256-v1` reads one imported file and writes its SHA-256.
+  Replace it by editing `backend/internal/background/runner.go` and bump `WorkerRevision`
+  (queued jobs of an older revision become `interrupted`, never replayed).
+- The spool is `/var/packages/<Package>/var/background` (dirs `0700`, files `0600`).
+  Limits: 1 job at a time, 16 queued, 512 KiB per file, 16 MiB total, 60 s per job.
+- Job states: `queued → running → succeeded | failed | canceled | interrupted`.
+  After a crash or forced stop a running job becomes `interrupted` and is not run again.
+
+## API and ownership
+
+`bg.status`, `bg.mode.set {enabled}`, `bg.users.set {allowOrdinaryUsers}`, `bg.jobs.purge {owner: {user, uid}}`, `bg.browse {folder?, offset?}`, `bg.jobs.submit {key, folder, relative}`,
+`bg.jobs.list`, `bg.jobs.get {id}`, `bg.jobs.cancel {id}`, `bg.jobs.result {id}`.
+
+The panel's **Choose a file** button opens the shared File Station picker, which lists shares and folders
+with `bg.browse`: read-only metadata from the signed-in caller's own DSM session. A pick stores no
+grant and adds no permission; `submit` still re-reads the file through the same session.
+
+`submit` copies `relative` below the shared `folder` through the caller's File Station session, so the signed-in
+administrator's own DSM permissions decide what can be imported. The job ID is returned
+only after the journal is durable, and `key` makes a retry return the same job.
+No cookie, SynoToken or password is stored. Closing the window or signing out does not
+cancel a job; sign in as the same owner again to read, download or cancel it.
+
+## Access
+
+Background mode is off until an administrator turns it on. Ordinary-user access
+has its own administrator switch.
+
+## Ordinary users (U1)
+
+Background mode and `allowOrdinaryUsers` are independent administrator switches,
+initially off. With ordinary users allowed, signed-in users can browse through
+**their own live File Station session**, import a copy, and list/get/cancel/download
+only their own jobs. `bg.mode.set`, `bg.users.set` and `bg.jobs.purge` remain admin-only.
+Administrators can see and cancel all jobs. Turning ordinary access off returns
+`unsupported` on owner routes; it does not delete or cancel previously admitted jobs.
+Turning background mode off cancels queued work and drains running work as before.
+
+Owners are matched by both authenticated username and freshly resolved numeric UID.
+An unknown UID refuses owner access and submission with `identity_unavailable`.
+Legacy jobs with an unknown UID remain admin-only. Recreated same-name accounts
+with different UIDs cannot access old jobs. This does not detect reuse of the same
+username **and** UID. Account disablement is enforced by DSM session authentication;
+this feature does not provide a separate account-lifecycle directory service.
+
+Idempotency keys are scoped to that owner. Cross-owner and missing IDs both return
+`not_found`. Queue/running counts for ordinary users include only their own jobs.
+Per-owner limits (including administrators): 2 queued/running jobs, 1 MiB of pending
+and retained imported inputs, schedule copies, plus 512 bytes reserved for each pending or retained result. The 16-job/16-MiB
+global bounds and 64 finished-job history remain. Two full 512-KiB inputs exceed the
+owner byte limit because of their result reservations. `owner-queue-full` and
+`owner-quota-exceeded` are distinct from global `queue-full`/`quota-exceeded`.
+
+An administrator may explicitly clear an exact owner `{user, uid}` (including
+unknown legacy UIDs). This removes saved results and queued inputs, requests cancel
+for running jobs, and hides those jobs until Finish/Recover drains them. A bounded
+64-entry audit stores actor, exact owner, time and counts in the durable journal;
+it contains no credentials or input contents. Uninstall retains data by default;
+the existing explicit delete-data wizard remains available.
+
+The package copy/result is not recalled when source-file permissions change.
+Offline access under a user's ACL, AD/LDAP UID stability and DSM reboot recovery
+are not claimed. No user credentials are stored.
+
+## Private-copy schedules (S1-a)
+
+Import a file and wait for its success, then choose **Schedule this copy** and
+explicitly consent. The package pins a separate copy and digest, without accessing
+File Station offline. `bg.schedules.create {key, jobId, intervalSeconds, consent:true}`
+accepts only 3600, 86400 or 604800 seconds; up to 8 schedules per package.
+`key` is scoped to username/UID and retries the exact definition.
+`bg.schedules.list`, `bg.schedules.disable {id}`, `bg.schedules.delete {id}` are
+owner-scoped; administrators see and can disable/delete all. Only an administrator
+can call `bg.schedules.enable {id, consent:true}` after reviewing the current revision.
+An administrator cannot create a schedule from another owner's imported copy.
+
+Successful manual inputs are retained with the bounded 64-job history. Old U1
+results whose input was deleted cannot be scheduled: import again. Copies and
+schedule pins count toward the 1-MiB owner/16-MiB global storage limits; a full
+512-KiB source plus its pinned copy exceeds the owner limit, so use smaller inputs.
+A scheduled run also needs input/result quota and shares the 2-pending-owner limit.
+At least 4 global queue positions remain available for manual jobs.
+
+The package-user worker ticks its journal; no root task, crontab or global service
+is created. `nextAt` and the run's `scheduleId`/`scheduledAt` commit atomically.
+Completed jobs never replay. Each start records overdue ticks as `missed` and
+advances to the next future period. Delays over 5 seconds, a full quota/queue, and
+multi-period gaps are also missed; no catch-up. The latest missed time/reason and
+aggregate missed count are retained, not an unbounded event log. This is neither
+an exact-time nor exactly-once guarantee.
+
+Disabling/deleting cancels queued runs and requests running cancellation/drain;
+finished results remain. Background mode off also disables every schedule, and
+turning it on does not revive them. Blocking ordinary access hides owner routes,
+but admitted private-copy schedules continue, like admitted U1 jobs. Clearing an
+owner also deletes that owner's schedules/pins and drains running jobs. A worker
+revision mismatch disables the schedule (`worker-changed`) and requires explicit
+administrator re-enable; a package build +1 with the same worker revision preserves
+compatible definitions/results. Changed or missing pinned bytes disable the schedule.
+No S1-b share authorization or offline personal ACL reading is provided.

package/dist/templates/native-go-background/backend/internal/app/background_on.go

@@ -0,0 +1,7 @@
+package app
+
+import "dsmapp/internal/api"
+
+// backgroundRoutes serves the owner-scoped background job API. Jobs run
+// in the package-user worker unit (conf/systemd), never as root.
+func (cfg Config) backgroundRoutes() []api.Route { return BackgroundRoutes(cfg.DataDir) }

package/dist/templates/native-go-background/backend/internal/app/background_routes_test.go

@@ -0,0 +1,32 @@
+package app
+
+func init() {
+	// The generic route tests need valid params for every background route.
+	// Background mode is off in a fresh data dir, so submit is refused before
+	// any file is read and the id routes find nothing.
+	const id = `{"id":"missing"}`
+	sampleParams["bg.users.set"] = `{"allowOrdinaryUsers":true}`
+	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
+	sampleParams["bg.schedules.list"] = `{}`
+	sampleParams["bg.schedules.create"] = `{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}`
+	sampleParams["bg.schedules.disable"] = id
+	sampleParams["bg.schedules.delete"] = id
+	sampleParams["bg.schedules.enable"] = `{"id":"missing","consent":true}`
+	sampleOutcome["bg.schedules.create"] = "disabled"
+	sampleOutcome["bg.schedules.disable"] = "not_found"
+	sampleOutcome["bg.schedules.delete"] = "not_found"
+	sampleOutcome["bg.schedules.enable"] = "not_found"
+	sampleParams["bg.status"] = `{}`
+	sampleParams["bg.mode.set"] = `{"enabled":true}`
+	sampleParams["bg.browse"] = `{}`
+	sampleParams["bg.jobs.submit"] = `{"key":"k1","folder":"/share","relative":"a.bin"}`
+	sampleParams["bg.jobs.list"] = `{}`
+	sampleParams["bg.jobs.get"] = id
+	sampleParams["bg.jobs.cancel"] = id
+	sampleParams["bg.jobs.result"] = id
+	sampleOutcome["bg.browse"] = "session_required"
+	sampleOutcome["bg.jobs.submit"] = "disabled"
+	sampleOutcome["bg.jobs.get"] = "not_found"
+	sampleOutcome["bg.jobs.cancel"] = "not_found"
+	sampleOutcome["bg.jobs.result"] = "not_found"
+}

package/dist/templates/native-go-background/frontend/src/background/BackgroundPanel.vue

@@ -0,0 +1,178 @@
+<script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,provide,ref} from 'vue'
+import {Button,Callout,Checkbox,Form,FormActions,FormItem,Link,Select,SettingsSection} from '@synopackageland/ui'
+import type {Context} from '../context'
+import M2PathPicker from '../nas/M2PathPicker.vue'
+import {M2ProviderKey,type M2JobSource} from '../nas/m2-contract'
+import {backgroundCopy,backgroundErrorCopy} from './i18n'
+import {createBackgroundPickerProvider} from './picker-provider'
+interface Status{owner?:Owner;enabled:boolean;admin:boolean;allowOrdinaryUsers:boolean;revision:number;worker:{username:string;alive:boolean}|null;limits:{maxInputBytes:number;maxQueued:number;maxOwnerPending:number;maxOwnerBytes:number;jobTimeoutSeconds:number}}
+interface Owner{user:string;uid:string}
+interface Job{copyRetained?:boolean;scheduleId?:string;submitter:Owner;id:string;name:string;state:'queued'|'running'|'succeeded'|'failed'|'canceled'|'interrupted'}
+interface Schedule{id:string;name:string;owner:Owner;enabled:boolean;nextAt:string;intervalSeconds:number;workerRevision:number;missed:number;reason?:string}
+const props=defineProps<{ctx:Pick<Context,'call'|'locale'>}>()
+const copy=computed(()=>backgroundCopy(props.ctx.locale))
+const fill=(text:string,values:Record<string,string|number>)=>text.replace(/\{(\w+)\}/g,(_,k)=>String(values[k]??''))
+const status=ref<Status>(),jobs=ref<Job[]>([]),error=ref<unknown>(),unsupported=ref(false),busy=ref(false)
+const schedules=ref<Schedule[]>([]),scheduleSource=ref<Job>(),scheduleConsent=ref(false),scheduleInterval=ref('3600'),scheduleDelete=ref<Schedule>(),scheduleEnable=ref<Schedule>()
+const purgeOwner=ref<Owner>(),refreshing=ref(false)
+const picking=ref(false),picked=ref<{folder:string;relative:string}>(),download=ref(''),downloadName=ref('')
+const picker=createBackgroundPickerProvider(props.ctx);provide(M2ProviderKey,picker)
+let timer:ReturnType<typeof setInterval>|undefined,disposed=false
+const settled=(j:Job)=>!['queued','running'].includes(j.state)
+async function call<T>(method:string,params?:Record<string,unknown>):Promise<T|undefined>{
+ try{return await props.ctx.call<T>(method,params)}
+ catch(e){
+  if(disposed)return undefined
+  if((e as {code?:string})?.code==='unsupported'){unsupported.value=true;jobs.value=[];schedules.value=[];scheduleSource.value=undefined;scheduleDelete.value=undefined;scheduleEnable.value=undefined;status.value=undefined;purgeOwner.value=undefined;picked.value=undefined;if(download.value)URL.revokeObjectURL(download.value);download.value=''}
+  else if(!disposed)error.value=e
+  return undefined
+ }
+}
+async function refresh(){
+ if(disposed||refreshing.value)return
+ refreshing.value=true
+ try{
+ const s=await call<Status>('bg.status')
+ if(!s||disposed)return
+ if(!s.limits||typeof s.enabled!=='boolean'||typeof s.admin!=='boolean'){error.value={code:'unavailable'};return}
+ unsupported.value=false;status.value=s
+ const list=await call<{jobs:Job[]}>('bg.jobs.list')
+ if(list&&!disposed)jobs.value=list.jobs??[]
+ const scheduleList=await call<{schedules:Schedule[]}>('bg.schedules.list')
+ if(scheduleList&&!disposed)schedules.value=scheduleList.schedules??[]
+ if(!disposed&&!status.value?.enabled&&jobs.value.every(settled)&&timer){clearInterval(timer);timer=undefined}
+ }finally{refreshing.value=false}
+}
+function poll(){if(!timer)timer=setInterval(()=>void refresh(),3000)}
+async function guarded(work:()=>Promise<unknown>){
+ if(busy.value)return
+ busy.value=true;error.value=undefined
+ try{await work();await refresh();if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}finally{if(!disposed)busy.value=false}
+}
+const setMode=(enabled:boolean)=>guarded(()=>call('bg.mode.set',{enabled}))
+const setUsers=(allowOrdinaryUsers:boolean)=>guarded(()=>call('bg.users.set',{allowOrdinaryUsers}))
+const purge=()=>guarded(async()=>{if(!purgeOwner.value)return;const out=await call('bg.jobs.purge',{owner:purgeOwner.value});if(out)purgeOwner.value=undefined})
+const intervalOptions=computed(()=>[{value:'3600',label:copy.value.hourly},{value:'86400',label:copy.value.daily},{value:'604800',label:copy.value.weekly}])
+const selectSchedule=(job:Job)=>{scheduleSource.value=job;scheduleConsent.value=false;scheduleInterval.value='3600'}
+const createSchedule=()=>guarded(async()=>{if(!scheduleSource.value||!scheduleConsent.value)return;const out=await call('bg.schedules.create',{key:crypto.randomUUID(),jobId:scheduleSource.value.id,intervalSeconds:Number(scheduleInterval.value),consent:true});if(out)scheduleSource.value=undefined})
+const disableSchedule=(id:string)=>guarded(()=>call('bg.schedules.disable',{id}))
+const deleteSchedule=()=>guarded(async()=>{if(!scheduleDelete.value)return;const out=await call('bg.schedules.delete',{id:scheduleDelete.value.id});if(out)scheduleDelete.value=undefined})
+const enableSchedule=()=>guarded(async()=>{if(!scheduleEnable.value)return;const out=await call('bg.schedules.enable',{id:scheduleEnable.value.id,consent:true});if(out)scheduleEnable.value=undefined})
+const formatTime=(value:string)=>{const date=new Date(value);return Number.isFinite(date.getTime())?date.toLocaleString():copy.value.unknownTime}
+const ownCopy=(job:Job)=>job.copyRetained&&job.state==='succeeded'&&!job.scheduleId&&job.submitter?.user===status.value?.owner?.user&&job.submitter?.uid===status.value?.owner?.uid
+const cancel=(id:string)=>guarded(()=>call('bg.jobs.cancel',{id}))
+const pick=(value:M2JobSource)=>{picked.value={folder:value.selection.folder,relative:value.segments.join('/')}}
+// The signed-in caller's own File Station session decides whether the
+// file can be read; the submit itself is the consent to copy that one file.
+const submit=()=>guarded(async()=>{
+ if(!picked.value)return
+ const sent=await call('bg.jobs.submit',{key:crypto.randomUUID(),...picked.value})
+ if(sent)picked.value=undefined
+})
+async function fetchResult(job:Job){
+ const value=await call<{result:unknown}>('bg.jobs.result',{id:job.id})
+ if(!value||disposed)return
+ if(download.value)URL.revokeObjectURL(download.value)
+ download.value=URL.createObjectURL(new Blob([JSON.stringify(value.result,null,2)],{type:'application/json'}))
+ downloadName.value=`${job.name||job.id}.sha256.json`
+}
+onMounted(()=>void refresh().then(()=>{if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}))
+onBeforeUnmount(()=>{disposed=true;picker.dispose();if(timer)clearInterval(timer);if(download.value)URL.revokeObjectURL(download.value)})
+</script>
+<template>
+ <SettingsSection :aria-busy="busy||refreshing" :title="copy.title" :collapsible="false" data-background-panel>
+  <Callout v-if="unsupported" tone="warning">{{ copy.unsupported }}</Callout>
+  <template v-else>
+   <p class="integration-help">{{ copy.help }}</p>
+   <Callout v-if="error" tone="danger" role="alert">{{ backgroundErrorCopy(error,copy) }}</Callout>
+   <template v-if="status">
+    <p role="status">{{ status.enabled ? copy.modeOn : copy.modeOff }} · {{ status.worker?.alive ? fill(copy.workerRunning,{user:status.worker.username}) : copy.workerStopped }}</p>
+    <p class="integration-help">{{ fill(copy.limits,{size:status.limits.maxInputBytes/1024,queue:status.limits.maxQueued,seconds:status.limits.jobTimeoutSeconds}) }}</p>
+    <p class="integration-help">{{ status.admin ? copy.adminScope : copy.ownerScope }}</p>
+    <p class="integration-help">{{ fill(copy.ownerLimits,{jobs:status.limits.maxOwnerPending,size:status.limits.maxOwnerBytes/1024}) }}</p>
+    <div class="integration-actions">
+     <Button v-if="status.admin&&!status.enabled" variant="primary" :disabled="busy" @click="setMode(true)">{{ copy.enable }}</Button>
+     <Button v-else-if="status.admin" variant="secondary" :disabled="busy" @click="setMode(false)">{{ copy.disable }}</Button>
+     <Button variant="secondary" :disabled="busy" @click="refresh">{{ copy.refresh }}</Button>
+    </div>
+    <div v-if="status.admin" class="integration-actions">
+     <Button variant="secondary" :disabled="busy" @click="setUsers(!status.allowOrdinaryUsers)">{{ status.allowOrdinaryUsers ? copy.blockUsers : copy.allowUsers }}</Button>
+     <span role="status">{{ status.allowOrdinaryUsers ? copy.usersOn : copy.usersOff }}</span>
+    </div>
+    <template v-if="status.enabled">
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="picking=true">{{ copy.chooseFile }}</Button>
+      <Button variant="primary" :disabled="busy||!picked" @click="submit">{{ copy.submit }}</Button>
+     </div>
+     <p v-if="picked" role="status" data-bg-picked>{{ fill(copy.chosen,{path:`${picked.folder}/${picked.relative}`}) }}</p>
+     <M2PathPicker v-model:open="picking" :locale="ctx.locale" select-files read-only :title="copy.pickerTitle" :consent="copy.pickerConsent" @source="pick" />
+    </template>
+    <Callout v-if="purgeOwner&&status.admin" tone="warning">
+     <p>{{ fill(copy.purgeConfirm,{user:purgeOwner.user,uid:purgeOwner.uid}) }}</p>
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="purge">{{ copy.confirmPurge }}</Button>
+      <Button variant="secondary" :disabled="busy" @click="purgeOwner=undefined">{{ copy.keepJobs }}</Button>
+     </div>
+    </Callout>
+    <p v-if="!jobs.length">{{ copy.noJobs }}</p>
+    <ul v-else class="integration-jobs">
+     <li v-for="job in jobs" :key="job.id" :data-job-state="job.state" :data-job-id="job.id">
+      <span class="nas-folder-name">{{ job.name }} — {{ copy[`state_${job.state}`] }}</span>
+      <span v-if="status.admin&&job.submitter" class="integration-help">{{ fill(copy.owner,{user:job.submitter.user,uid:job.submitter.uid}) }}</span>
+      <Button v-if="status.admin&&job.submitter" variant="secondary" :disabled="busy" @click="purgeOwner=job.submitter">{{ copy.purgeOwner }}</Button>
+      <Button v-if="!settled(job)" variant="secondary" :disabled="busy" @click="cancel(job.id)">{{ copy.cancel }}</Button>
+      <Button v-if="status.enabled&&ownCopy(job)" variant="secondary" :disabled="busy" @click="selectSchedule(job)">{{ copy.scheduleCopy }}</Button>
+      <span v-if="job.scheduleId" class="integration-help">{{ copy.scheduledJob }}</span>
+      <Button v-if="job.state==='succeeded'" variant="secondary" :disabled="busy" @click="fetchResult(job)">{{ copy.result }}</Button>
+     </li>
+    </ul>
+    <section data-bg-schedules class="bg-schedules" :aria-label="copy.schedulesTitle">
+     <h3>{{ copy.schedulesTitle }}</h3>
+     <p class="integration-help">{{ copy.scheduleHelp }}</p>
+     <Form v-if="scheduleSource&&status.enabled" class="bg-schedule-form" @submit.prevent="createSchedule">
+      <p>{{ fill(copy.scheduleSource,{name:scheduleSource.name}) }}</p>
+      <FormItem :label="copy.interval"><Select v-model="scheduleInterval" data-schedule-interval :options="intervalOptions" :disabled="busy" /></FormItem>
+      <Checkbox v-model="scheduleConsent" data-schedule-consent :disabled="busy" :label="copy.scheduleConsent" />
+      <FormActions><Button type="submit" variant="primary" :disabled="busy||!scheduleConsent">{{ copy.createSchedule }}</Button><Button type="button" variant="secondary" :disabled="busy" @click="scheduleSource=undefined">{{ copy.cancel }}</Button></FormActions>
+     </Form>
+     <p v-if="!schedules.length">{{ copy.noSchedules }}</p>
+     <ul v-else class="integration-jobs">
+      <li v-for="schedule in schedules" :key="schedule.id" :data-schedule-id="schedule.id">
+       <span class="nas-folder-name">{{ schedule.name }} — {{ schedule.enabled ? copy.scheduleOn : copy.scheduleOff }}</span>
+       <span v-if="status.admin" class="integration-help">{{ fill(copy.owner,{user:schedule.owner.user,uid:schedule.owner.uid}) }}</span>
+       <span v-if="schedule.enabled" class="integration-help">{{ fill(copy.nextRun,{time:formatTime(schedule.nextAt)}) }}</span>
+       <span class="integration-help">{{ fill(copy.missedRuns,{count:schedule.missed}) }}</span>
+       <Callout v-if="schedule.reason==='worker-changed'" tone="warning">{{ copy.revisionChanged }}</Callout>
+       <Callout v-else-if="schedule.reason==='input-unavailable'" tone="warning">{{ copy.errors['input-unavailable'] }}</Callout>
+       <div class="integration-actions">
+       <Button v-if="schedule.enabled" variant="secondary" :disabled="busy" @click="disableSchedule(schedule.id)">{{ copy.disableSchedule }}</Button>
+       <Button v-else-if="status.admin&&status.enabled" variant="secondary" :disabled="busy" @click="scheduleEnable=schedule">{{ copy.enableSchedule }}</Button>
+       <Button variant="secondary" :disabled="busy" @click="scheduleDelete=schedule">{{ copy.deleteSchedule }}</Button>
+       </div>
+      </li>
+     </ul>
+     <Callout v-if="scheduleDelete" tone="warning">
+      <p>{{ fill(copy.deleteScheduleConsent,{name:scheduleDelete.name}) }}</p>
+      <div class="integration-actions"><Button variant="danger" :disabled="busy" @click="deleteSchedule">{{ copy.confirmDeleteSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleDelete=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+     <Callout v-if="scheduleEnable" tone="warning">
+      <p>{{ fill(copy.enableScheduleConsent,{name:scheduleEnable.name}) }}</p>
+      <div class="integration-actions"><Button variant="primary" :disabled="busy" @click="enableSchedule">{{ copy.confirmEnableSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleEnable=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+    </section>
+    <Link v-if="download" :href="download" :download="downloadName">{{ copy.download }}</Link>
+   </template>
+  </template>
+ </SettingsSection>
+</template>
+
+<style scoped>
+.integration-jobs { overflow-wrap:anywhere; min-width:0; }
+.bg-schedules { margin-block-start: var(--ui-space-6,24px); min-width:0; overflow-wrap:anywhere; }
+.bg-schedules .integration-jobs { display:grid; gap:var(--ui-space-4,16px); padding-inline-start:var(--ui-space-5,20px); }
+.bg-schedules .integration-jobs li { display:flex; flex-direction:column; align-items:flex-start; gap:var(--ui-space-2,8px); min-width:0; }
+.bg-schedules p, .bg-schedules li > span { min-width:0; max-width:100%; }
+.bg-schedules h3 { font-size:15px; font-weight:600; }
+.bg-schedule-form { margin-block:var(--ui-space-4,16px); }
+</style>