@synopackageland/cli 0.4.0 → 0.5.0

package/dist/standalone/native-layout.d.ts

@@ -0,0 +1,74 @@
+import type { CommandRunner } from './build.js';
+export declare const LAYOUT_ARCHES: {
+    readonly x86_64: readonly [2, 62];
+    readonly aarch64: readonly [2, 183];
+    readonly armv8: readonly [2, 183];
+    readonly armv7: readonly [1, 40];
+};
+export type LayoutArch = keyof typeof LAYOUT_ARCHES;
+type Hook = {
+    command: string[];
+    cwd: string;
+    env: Record<string, string>;
+};
+type Toolkit = {
+    url: string;
+    sha256: string;
+};
+type Binary = {
+    path: string;
+    linkage: 'static' | 'dynamic';
+    arches?: LayoutArch[];
+};
+export interface NativeLayout {
+    root: string;
+    package: string;
+    version: string;
+    build: number;
+    displayname: string;
+    description: string;
+    maintainer: string;
+    os_min_ver: string;
+    privilege: 'none';
+    arches: LayoutArch[];
+    layout: {
+        payload: string;
+        metadata: string;
+        binaries: Binary[];
+    };
+    native: {
+        prepare?: Hook;
+        hook: Hook;
+        toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
+    };
+}
+export declare function isNativeLayout(root: string): boolean;
+export declare function loadNativeLayout(root: string): {
+    ok: true;
+    manifest: NativeLayout;
+} | {
+    ok: false;
+    errors: {
+        code: string;
+        message: string;
+    }[];
+};
+export declare function verifyToolkitArchive(path: string, expected: string): void;
+export declare function layoutFiles(root: string): Array<{
+    path: string;
+    mode: number;
+    sha256: string;
+}>;
+export declare function checkLayoutBinary(root: string, b: Binary, arch: LayoutArch): void;
+export declare function checkLayoutMetadata(root: string, inspection?: boolean, packageId?: string): void;
+export declare function buildNativeLayout(options: {
+    root: string;
+    arches?: string[];
+    outDir?: string;
+    build?: number;
+    run?: CommandRunner;
+}): Promise<{
+    outputs: string[];
+}>;
+export declare function inspectNativeLayout(dir: string, payload: string, info: Record<string, string>): string[];
+export {};

package/dist/standalone/native-layout.js

@@ -0,0 +1,318 @@
+/** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
+import { createHash } from 'node:crypto';
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
+import { runCommand } from './build.js';
+export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
+function fail(message) { throw new Error(`NATIVE_LAYOUT_INVALID: ${message}`); }
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+function object(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('expected object');
+    const obj = value;
+    if (Object.keys(obj).some(k => !fields.includes(k)))
+        fail('unknown field');
+    return obj;
+}
+function text(value) {
+    if (typeof value !== 'string' || !value || /[\r\n"\\\0]/.test(value))
+        fail('invalid text');
+    return value;
+}
+function pathText(value) {
+    const path = text(value);
+    if (isAbsolute(path) || path.split('/').some(p => p === '..' || p === '') || /[{}]/.test(path.replaceAll('{arch}', '')))
+        fail('path must stay inside project');
+    return path;
+}
+function inside(root, path) {
+    const full = resolve(root, path);
+    const rel = relative(realpathSync(root), realpathSync(full));
+    if (rel === '..' || rel.startsWith('../') || isAbsolute(rel))
+        fail('path escapes project');
+    return full;
+}
+function hook(value) {
+    const h = object(value, ['command', 'cwd', 'env']);
+    if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
+        fail('hook requires argv');
+    const env = object(h.env ?? {}, Object.keys(h.env ?? {}));
+    for (const [key, value] of Object.entries(env))
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(key) || typeof value !== 'string' || value.includes('\0') || key.startsWith('SYNOPKGLAND_'))
+            fail('invalid hook environment');
+    return { command: h.command, cwd: pathText(h.cwd ?? '.'), env };
+}
+export function isNativeLayout(root) {
+    try {
+        return parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8'))?.layout !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+export function loadNativeLayout(root) {
+    try {
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
+        if (m.schema !== 1 || m.privilege !== 'none')
+            fail('schema 1 and privilege: none required');
+        if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
+            fail('invalid package/version/DSM');
+        if (!Number.isSafeInteger(m.build) || m.build < 1 || m.build > 2147483647)
+            fail('build must be 1..2147483647');
+        for (const k of ['displayname', 'description', 'maintainer'])
+            text(m[k]);
+        if (!Array.isArray(m.arches) || !m.arches.length || new Set(m.arches).size !== m.arches.length || m.arches.some((a) => !Object.hasOwn(LAYOUT_ARCHES, a)))
+            fail('invalid architecture list');
+        const layout = object(m.layout, ['payload', 'metadata', 'binaries']);
+        layout.payload = pathText(layout.payload);
+        layout.metadata = pathText(layout.metadata);
+        if (!Array.isArray(layout.binaries) || !layout.binaries.length)
+            fail('binary assertions required');
+        for (const b of layout.binaries) {
+            object(b, ['path', 'linkage', 'arches']);
+            pathText(b.path);
+            if (!['static', 'dynamic'].includes(b.linkage))
+                fail('declare binary linkage');
+            if (b.arches !== undefined && (!Array.isArray(b.arches) || !b.arches.length || b.arches.some((a) => !m.arches.includes(a))))
+                fail('invalid binary arches');
+        }
+        const native = object(m.native, ['prepare', 'hook', 'toolkits']);
+        const toolkits = object(native.toolkits ?? {}, m.arches);
+        for (const entries of Object.values(toolkits)) {
+            if (!Array.isArray(entries) || !entries.length)
+                fail('toolkits require archives');
+            for (const t of entries) {
+                object(t, ['url', 'sha256']);
+                const u = new URL(t.url);
+                if (u.protocol !== 'https:' || u.username || u.password || !/^[a-f0-9]{64}$/.test(t.sha256))
+                    fail('toolkits require HTTPS and SHA-256');
+            }
+        }
+        return { ok: true, manifest: { ...m, root: resolve(root), native: { hook: hook(native.hook), ...(native.prepare ? { prepare: hook(native.prepare) } : {}), toolkits } } };
+    }
+    catch (error) {
+        return { ok: false, errors: [{ code: 'NATIVE_LAYOUT_INVALID', message: String(error) }] };
+    }
+}
+export function verifyToolkitArchive(path, expected) {
+    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
+        fail('toolkit checksum mismatch');
+}
+async function toolkitFor(m, arch, run) {
+    const inputs = m.native.toolkits[arch] ?? [];
+    if (!inputs.length)
+        return '';
+    const cache = resolve(process.env.SYNOPKGLAND_CACHE_DIR ?? join(m.root, '.synopkgland-cache'));
+    mkdirSync(cache, { recursive: true, mode: 0o700 });
+    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
+        fail('toolkit cache must be owned and private');
+    const archives = [];
+    for (const input of inputs) {
+        const archive = join(cache, `${input.sha256}.txz`);
+        if (!existsSync(archive)) {
+            const download = mkdtempSync(join(cache, '.download-'));
+            try {
+                const out = join(download, 'archive');
+                const r = run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
+                if (r.status !== 0)
+                    fail('toolkit download failed');
+                verifyToolkitArchive(out, input.sha256);
+                renameSync(out, archive);
+            }
+            finally {
+                rmSync(download, { recursive: true, force: true });
+            }
+        }
+        verifyToolkitArchive(archive, input.sha256);
+        archives.push(archive);
+    }
+    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
+    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
+    try {
+        for (const archive of archives) {
+            const r = run('tar', ['-xJf', archive, '-C', stage, '--keep-directory-symlink'], { cwd: m.root, env: { ...process.env } });
+            if (r.status !== 0)
+                fail('toolkit extraction failed');
+        }
+        return stage;
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw e;
+    }
+}
+function runHook(m, h, env, run) {
+    const [cmd, ...args] = h.command;
+    const r = run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
+    if (r.status !== 0 || r.missing)
+        fail(`native hook failed: ${r.stderr}`);
+}
+export function layoutFiles(root) {
+    if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink())
+        fail('layout root must be a regular directory');
+    const files = [];
+    let total = 0;
+    const walk = (prefix) => {
+        for (const name of readdirSync(join(root, prefix)).sort()) {
+            const path = prefix ? `${prefix}/${name}` : name;
+            const s = lstatSync(join(root, path));
+            if (s.isSymbolicLink() || (!s.isFile() && !s.isDirectory()))
+                fail('layout contains symlink or special file');
+            if (s.mode & 0o6000)
+                fail('privileged file modes are forbidden');
+            if (s.isDirectory())
+                walk(path);
+            else {
+                total += s.size;
+                if (s.size > 256 * 1024 * 1024 || total > 1024 * 1024 * 1024)
+                    fail('layout exceeds size bound');
+                files.push({ path, mode: s.mode & 0o111 ? 0o755 : 0o644, sha256: digest(readFileSync(join(root, path))) });
+            }
+        }
+    };
+    walk('');
+    return files;
+}
+export function checkLayoutBinary(root, b, arch) {
+    const path = inside(root, b.path);
+    const bytes = readFileSync(path);
+    const [cls, machine] = LAYOUT_ARCHES[arch];
+    if (bytes.length < 64 || bytes.toString('latin1', 0, 4) !== '\x7fELF' || bytes[4] !== cls || bytes[5] !== 1 || bytes.readUInt16LE(18) !== machine || ![2, 3].includes(bytes.readUInt16LE(16)))
+        fail(`ELF architecture mismatch: ${b.path}`);
+    const offset = cls === 1 ? bytes.readUInt32LE(28) : Number(bytes.readBigUInt64LE(32));
+    const size = bytes.readUInt16LE(cls === 1 ? 42 : 54);
+    const count = bytes.readUInt16LE(cls === 1 ? 44 : 56);
+    if (!count || size < (cls === 1 ? 32 : 56) || !Number.isSafeInteger(offset) || offset + size * count > bytes.length)
+        fail('invalid ELF program headers');
+    let dynamic = false;
+    for (let i = 0; i < count; i++)
+        if (bytes.readUInt32LE(offset + size * i) === 3)
+            dynamic = true;
+    if (dynamic !== (b.linkage === 'dynamic'))
+        fail(`ELF linkage mismatch: ${b.path}`);
+    if (!(lstatSync(path).mode & 0o111))
+        fail(`binary must be executable: ${b.path}`);
+}
+function copyTree(from, to) {
+    const entries = layoutFiles(from);
+    for (const entry of entries) {
+        const out = join(to, entry.path);
+        mkdirSync(dirname(out), { recursive: true });
+        copyFileSync(join(from, entry.path), out);
+        chmodSync(out, entry.mode);
+    }
+    return entries;
+}
+export function checkLayoutMetadata(root, inspection = false, packageId) {
+    const p = JSON.parse(readFileSync(join(root, 'conf/privilege'), 'utf8'));
+    if (p.defaults?.['run-as'] !== 'package' || Object.keys(p).some(k => !['defaults', 'username', 'groupname'].includes(k)) || ['username', 'groupname'].some(k => p[k] !== undefined && p[k] !== packageId) || Object.keys(p.defaults).some(k => k !== 'run-as'))
+        fail('native layout requires package-only lifecycle privilege');
+    if (!existsSync(join(root, 'scripts/start-stop-status')))
+        fail('start-stop-status missing');
+    if (existsSync(join(root, 'conf/resource'))) {
+        const resource = object(JSON.parse(readFileSync(join(root, 'conf/resource'), 'utf8')), ['systemd-unit']);
+        if (resource['systemd-unit'] !== undefined && Object.keys(object(resource['systemd-unit'], [])).length)
+            fail('unsupported resource worker');
+    }
+    if (existsSync(join(root, 'conf/systemd'))) {
+        for (const entry of layoutFiles(join(root, 'conf/systemd'))) {
+            const unit = readFileSync(join(root, 'conf/systemd', entry.path), 'utf8');
+            const users = [...unit.matchAll(/^\s*User\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
+            const groups = [...unit.matchAll(/^\s*Group\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
+            if (!packageId || users.length !== 1 || users[0] !== packageId || groups.some(group => group !== packageId) || /^\s*(?:AmbientCapabilities|SupplementaryGroups|PermissionsStartOnly|RootDirectory|RootImage)\s*=/m.test(unit) || /^\s*Exec\w*\s*=\s*[+!]/m.test(unit))
+                fail('systemd unit must run only as the package account');
+        }
+    }
+    for (const name of readdirSync(root))
+        if (!['conf', 'scripts', 'WIZARD_UIFILES', 'PACKAGE_ICON.PNG', 'PACKAGE_ICON_256.PNG', ...(inspection ? ['INFO', 'package.tgz', 'native-layout.json', 'layout-inspection'] : [])].includes(name))
+            fail(`unsupported SPK metadata: ${name}`);
+    for (const f of layoutFiles(root)) {
+        if (f.path.startsWith('scripts/') && /\bsudo\b|\bchown\s+root\b|chmod\s+[ugo]*\+s\b/.test(readFileSync(join(root, f.path), 'utf8')))
+            fail('root lifecycle operation forbidden');
+    }
+}
+export async function buildNativeLayout(options) {
+    const loaded = loadNativeLayout(options.root);
+    if (!loaded.ok)
+        fail(loaded.errors.map(e => e.message).join('\n'));
+    const m = loaded.manifest;
+    if (options.build !== undefined) {
+        if (!Number.isSafeInteger(options.build) || options.build < 1 || options.build > 2147483647)
+            fail('invalid build override');
+        m.build = options.build;
+    }
+    const arches = options.arches ?? m.arches;
+    if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
+        fail('architecture not declared');
+    const run = options.run ?? runCommand;
+    const version = `${m.version}-${String(m.build).padStart(4, '0')}`;
+    const env = { SYNOPKGLAND_PACKAGE: m.package, SYNOPKGLAND_VERSION: m.version, SYNOPKGLAND_BUILD: String(m.build), SYNOPKGLAND_SPK_VERSION: version, SYNOPKGLAND_PROJECT_DIR: m.root };
+    if (m.native.prepare)
+        runHook(m, m.native.prepare, env, run);
+    const outputs = [];
+    for (const requested of arches) {
+        const arch = requested;
+        const toolkit = await toolkitFor(m, arch, run);
+        const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
+        try {
+            runHook(m, m.native.hook, { ...env, SYNOPKGLAND_ARCH: arch, SYNOPKGLAND_TOOLKIT_DIR: toolkit }, run);
+            const payload = inside(m.root, m.layout.payload.replaceAll('{arch}', arch));
+            const metadata = inside(m.root, m.layout.metadata);
+            checkLayoutMetadata(metadata, false, m.package);
+            layoutFiles(payload);
+            const binaries = m.layout.binaries.filter(b => !b.arches || b.arches.includes(arch));
+            if (!binaries.length)
+                fail("binary assertions required for every architecture");
+            for (const b of binaries)
+                checkLayoutBinary(payload, b, arch);
+            copyTree(metadata, stage);
+            const target = join(stage, 'payload');
+            mkdirSync(target);
+            const files = copyTree(payload, target);
+            await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
+            rmSync(target, { recursive: true });
+            const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
+            writeFileSync(join(stage, 'INFO'), Object.entries(fields).map(([k, v]) => `${k}="${v}"\n`).join(''));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files }));
+            const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
+            mkdirSync(dirname(output), { recursive: true });
+            await createReproducibleTar(stage, output);
+            outputs.push(output);
+        }
+        finally {
+            rmSync(stage, { recursive: true, force: true });
+            if (toolkit)
+                rmSync(toolkit, { recursive: true, force: true });
+        }
+    }
+    return { outputs };
+}
+export function inspectNativeLayout(dir, payload, info) {
+    try {
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
+        if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
+            fail('invalid native layout inventory');
+        checkLayoutMetadata(dir, true, info.package);
+        const actual = layoutFiles(payload);
+        if (JSON.stringify(actual) !== JSON.stringify(inv.files))
+            fail('payload checksum or mode mismatch');
+        if (!Array.isArray(inv.binaries) || !inv.binaries.length)
+            fail('missing binary assertions');
+        for (const b of inv.binaries) {
+            object(b, ['path', 'linkage']);
+            pathText(b.path);
+            if (!['static', 'dynamic'].includes(b.linkage))
+                fail('invalid linkage');
+            checkLayoutBinary(payload, b, inv.arch);
+        }
+        if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
+            fail('package checksum mismatch');
+        return [];
+    }
+    catch (e) {
+        return [String(e)];
+    }
+}

package/dist/standalone/reopen-events.d.ts

@@ -0,0 +1,2 @@
+/** Wrapper-owned subscriptions; no dependency on native event names or Ext. */
+export declare const REOPEN_EVENTS_RUNTIME = "\nfunction createReopenEvents() {\n  var active = true, handlers = [];\n  function subscribe(fn) {\n    if (!active || typeof fn !== \"function\") return function () {};\n    function handler() { if (active && fn) fn(); }\n    function unsubscribe() {\n      if (!fn) return;\n      fn = null;\n      var index = handlers.indexOf(handler);\n      if (index !== -1) handlers.splice(index, 1);\n    }\n    handler.unsubscribe = unsubscribe;\n    handlers.push(handler);\n    return unsubscribe;\n  }\n  return {\n    handlers: handlers,\n    subscribe: subscribe,\n    emit: function () { handlers.slice().forEach(function (handler) { handler(); }); },\n    dispose: function () {\n      active = false;\n      handlers.slice().forEach(function (handler) { handler.unsubscribe(); });\n    }\n  };\n}\n";

package/dist/standalone/reopen-events.js

@@ -0,0 +1,28 @@
+/** Wrapper-owned subscriptions; no dependency on native event names or Ext. */
+export const REOPEN_EVENTS_RUNTIME = `
+function createReopenEvents() {
+  var active = true, handlers = [];
+  function subscribe(fn) {
+    if (!active || typeof fn !== "function") return function () {};
+    function handler() { if (active && fn) fn(); }
+    function unsubscribe() {
+      if (!fn) return;
+      fn = null;
+      var index = handlers.indexOf(handler);
+      if (index !== -1) handlers.splice(index, 1);
+    }
+    handler.unsubscribe = unsubscribe;
+    handlers.push(handler);
+    return unsubscribe;
+  }
+  return {
+    handlers: handlers,
+    subscribe: subscribe,
+    emit: function () { handlers.slice().forEach(function (handler) { handler(); }); },
+    dispose: function () {
+      active = false;
+      handlers.slice().forEach(function (handler) { handler.unsubscribe(); });
+    }
+  };
+}
+`;

package/dist/standalone/resource.d.ts

@@ -0,0 +1,11 @@
+import type { Background } from "./background.js";
+import { type SharedFolder } from "./shared-folder.js";
+/**
+ * `conf/resource` for a native package: only DSM's official `data-share` and
+ * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ */
+export declare function renderStandaloneResource(m: {
+    package: string;
+    background?: Background;
+    sharedFolder?: SharedFolder;
+}): string | undefined;

package/dist/standalone/resource.js

@@ -0,0 +1,13 @@
+import { sharedFolderResource } from "./shared-folder.js";
+/**
+ * `conf/resource` for a native package: only DSM's official `data-share` and
+ * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ */
+export function renderStandaloneResource(m) {
+    const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
+    const resource = {
+        ...(dataShare ? { "data-share": dataShare } : {}),
+        ...(m.background ? { "systemd-user-unit": {} } : {}),
+    };
+    return Object.keys(resource).length > 0 ? JSON.stringify(resource) : undefined;
+}

package/dist/standalone/root-messages.js

@@ -25,6 +25,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Only administrator accounts can perform this operation.",
         uninstall_hint: "Before uninstalling this package, click Remove to delete its task from Task Scheduler.",
         "error.root_conflict": "Rename or delete the task \"{name}\" in Task Scheduler, then click Retry.",
+        "error.root_cancelled": "Password confirmation was cancelled. No operation was run.",
         "error.root_not_ready": "Authorize this operation first.",
         "error.root_task_failed": "The task ended with an error. Check its history in Task Scheduler, then click Retry.",
         "error.root_timeout": "The task did not finish in time. Check it in Task Scheduler, then click Retry.",
@@ -52,6 +53,7 @@ export const ROOT_MESSAGES = {
         admin_only: "僅限管理員帳號允許執行此操作。",
         uninstall_hint: "解除安裝此套件前，請按「移除」從任務排程表刪除它的任務。",
         "error.root_conflict": "請在任務排程表中重新命名或刪除任務「{name}」，再按「重試」。",
+        "error.root_cancelled": "已取消密碼確認，未執行任何操作。",
         "error.root_not_ready": "請先授權此操作。",
         "error.root_task_failed": "任務執行失敗。請在任務排程表查看其記錄，再按「重試」。",
         "error.root_timeout": "任務未在時限內完成。請在任務排程表確認後，再按「重試」。",
@@ -79,6 +81,7 @@ export const ROOT_MESSAGES = {
         admin_only: "只有管理员帐户才能执行此操作。",
         uninstall_hint: "卸载此套件前，请单击“删除”从任务计划中删除它的任务。",
         "error.root_conflict": "请在任务计划中重命名或删除任务“{name}”，然后单击“重试”。",
+        "error.root_cancelled": "已取消密码确认，未执行任何操作。",
         "error.root_not_ready": "请先授权此操作。",
         "error.root_task_failed": "任务运行失败。请在任务计划中查看其记录，然后单击“重试”。",
         "error.root_timeout": "任务未在时限内完成。请在任务计划中确认后单击“重试”。",
@@ -106,6 +109,7 @@ export const ROOT_MESSAGES = {
         admin_only: "この操作を実行できるのは管理者アカウントのみです。",
         uninstall_hint: "このパッケージをアンインストールする前に、「削除」をクリックしてタスク スケジューラーからタスクを削除してください。",
         "error.root_conflict": "タスク スケジューラーでタスク「{name}」の名前を変更するか削除してから、「再試行」をクリックしてください。",
+        "error.root_cancelled": "パスワードの確認がキャンセルされました。操作は実行されていません。",
         "error.root_not_ready": "先にこの操作を承認してください。",
         "error.root_task_failed": "タスクがエラーで終了しました。タスク スケジューラーで履歴を確認してから、「再試行」をクリックしてください。",
         "error.root_timeout": "タスクが時間内に完了しませんでした。タスク スケジューラーで確認してから、「再試行」をクリックしてください。",
@@ -133,6 +137,7 @@ export const ROOT_MESSAGES = {
         admin_only: "관리자 계정에서만 이 작업을 수행할 수 있습니다.",
         uninstall_hint: "이 패키지를 제거하기 전에 \"제거\"를 클릭하여 작업 스케줄러에서 작업을 삭제하십시오.",
         "error.root_conflict": "작업 스케줄러에서 작업 \"{name}\"의 이름을 바꾸거나 삭제한 후 \"재시도\"를 클릭하십시오.",
+        "error.root_cancelled": "비밀번호 확인이 취소되었습니다. 작업이 실행되지 않았습니다.",
         "error.root_not_ready": "먼저 이 작업을 승인하십시오.",
         "error.root_task_failed": "작업이 오류로 종료되었습니다. 작업 스케줄러에서 기록을 확인한 후 \"재시도\"를 클릭하십시오.",
         "error.root_timeout": "작업이 제시간에 완료되지 않았습니다. 작업 스케줄러에서 확인한 후 \"재시도\"를 클릭하십시오.",
@@ -160,6 +165,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Nur Administratorkonten können diesen Vorgang ausführen.",
         uninstall_hint: "Klicken Sie vor der Deinstallation dieses Pakets auf „Entfernen“, um seine Aufgabe aus dem Aufgabenplaner zu löschen.",
         "error.root_conflict": "Benennen Sie die Aufgabe „{name}“ im Aufgabenplaner um oder löschen Sie sie, und klicken Sie dann auf „Neuer Versuch“.",
+        "error.root_cancelled": "Die Passwortbestätigung wurde abgebrochen. Es wurde keine Aktion ausgeführt.",
         "error.root_not_ready": "Geben Sie diesen Vorgang zuerst frei.",
         "error.root_task_failed": "Die Aufgabe wurde mit einem Fehler beendet. Prüfen Sie ihren Verlauf im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
         "error.root_timeout": "Die Aufgabe wurde nicht rechtzeitig beendet. Prüfen Sie sie im Aufgabenplaner, und klicken Sie dann auf „Neuer Versuch“.",
@@ -187,6 +193,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Seuls les comptes administrateur peuvent effectuer cette opération.",
         uninstall_hint: "Avant de désinstaller ce paquet, cliquez sur « Supprimer » pour retirer sa tâche du Planificateur de tâches.",
         "error.root_conflict": "Renommez ou supprimez la tâche « {name} » dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
+        "error.root_cancelled": "La confirmation du mot de passe a été annulée. Aucune opération n’a été exécutée.",
         "error.root_not_ready": "Autorisez d'abord cette opération.",
         "error.root_task_failed": "La tâche s'est terminée avec une erreur. Consultez son historique dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
         "error.root_timeout": "La tâche ne s'est pas terminée à temps. Vérifiez-la dans le Planificateur de tâches, puis cliquez sur « Réessayer ».",
@@ -214,6 +221,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Solo las cuentas de administrador pueden realizar esta operación.",
         uninstall_hint: "Antes de desinstalar este paquete, haga clic en «Quitar» para eliminar su tarea del Programador de tareas.",
         "error.root_conflict": "Cambie el nombre de la tarea «{name}» o elimínela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
+        "error.root_cancelled": "Se canceló la confirmación de la contraseña. No se ejecutó ninguna operación.",
         "error.root_not_ready": "Primero autorice esta operación.",
         "error.root_task_failed": "La tarea terminó con un error. Consulte su historial en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
         "error.root_timeout": "La tarea no terminó a tiempo. Revísela en el Programador de tareas y, a continuación, haga clic en «Volver a intentar».",
@@ -241,6 +249,7 @@ export const ROOT_MESSAGES = {
         admin_only: "Solo gli account administrator possono eseguire questa operazione.",
         uninstall_hint: "Prima di disinstallare questo pacchetto, fare clic su \"Rimuovi\" per eliminare la sua attività da Utilità di pianificazione.",
         "error.root_conflict": "Rinominare o eliminare l'attività \"{name}\" in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
+        "error.root_cancelled": "La conferma della password è stata annullata. Nessuna operazione è stata eseguita.",
         "error.root_not_ready": "Autorizzare prima questa operazione.",
         "error.root_task_failed": "L'attività è terminata con un errore. Controllarne la cronologia in Utilità di pianificazione, quindi fare clic su \"Riprova\".",
         "error.root_timeout": "L'attività non è terminata in tempo. Controllarla in Utilità di pianificazione, quindi fare clic su \"Riprova\".",

package/dist/standalone/root-window.d.ts

@@ -5,6 +5,8 @@ export interface RootTask {
     name: string;
     header: string;
     script: string;
+    /** Whether the package backend serves `root.output` for this op; helper ops report through the helper instead. */
+    output: boolean;
 }
 export declare function rootTasks(manifest: {
     package: string;
@@ -20,16 +22,17 @@ export declare function rootTasks(manifest: {
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
  * - run: re-reads the task and runs it only if it is still exactly ours, then
- *   waits for its history entry and asks the backend for the output.
+ *   waits for its history entry and asks the backend for the output. Repair
+ *   additionally requires fresh PasswordConfirm and another exact task check.
  * - an older version of our task is "outdated" and never runs; authorizing
  *   again replaces it. A same-named task that is not ours is a "conflict" and
  *   is never run, replaced or deleted.
  */
-export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {};\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function find(task) {\n    return options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return options.send(API, \"get\", 4, ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (token) {\n            if (!token) return \"cancelled\";\n            var params = definition(task, options.user().name);\n            params.SynoConfirmPWToken = token;\n            var replaced = found.state === \"outdated\"\n              ? options.send(API, \"delete\", 2, { tasks: [found.ref] })\n              : Promise.resolve();\n            return replaced.then(function () {\n              return options.send(API + \".Root\", \"create\", 4, params);\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n          return history(found.ref).then(function (before) {\n            return options.send(API, \"run\", 2, { tasks: [found.ref] }).then(function () {\n              return waitForRun(found.ref, before, POLLS);\n            });\n          });\n        }).then(function () {\n          return options.call(\"root.output\", { op: op });\n        });\n      });\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.send(API, \"delete\", 2, { tasks: [found.ref] }).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(function () {\n        return options.call(\"root.output\", { op: op });\n      });\n    }\n  };\n}";
+export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {}, running = {};\n  var legacy = null, probe = null;\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function readOutput(task) {\n    return task.output ? options.call(\"root.output\", { op: task.op }) : Promise.resolve(null);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function listTasks() {\n    if (legacy === false) return options.send(API, \"list\", 3, { start: 0, limit: 500 });\n    if (legacy === true) return legacyList();\n    if (!probe) {\n      probe = options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n        legacy = false;\n        return data;\n      }, function (error) {\n        if (!error || (error.code !== \"dsm_103\" && error.code !== 103)) {\n          probe = null;\n          throw error;\n        }\n        legacy = true;\n        return legacyList();\n      });\n    }\n    return probe;\n  }\n  function legacyList() {\n    return options.send(API, \"list\", 2, { offset: 0, limit: 500 }).then(function (data) {\n      // Refuse a truncated snapshot: a same-named task could lie outside it.\n      if (!data || !Array.isArray(data.tasks) || data.tasks.length > 500\n          || !(typeof data.total === \"number\" && isFinite(data.total) && Math.floor(data.total) === data.total) || data.total !== data.tasks.length) throw fail(\"root_bad_response\");\n      return data;\n    });\n  }\n  function readTask(ref) {\n    return options.send(API, \"get\", legacy ? 3 : 4, ref);\n  }\n  function createTask(params) {\n    return options.send(legacy ? API : API + \".Root\", \"create\", legacy ? 3 : 4, params);\n  }\n  function deleteTask(ref) {\n    return options.send(API, \"delete\", 2, { tasks: [ref] });\n  }\n  function runTask(ref) {\n    return options.send(API, \"run\", 2, { tasks: [ref] });\n  }\n  function find(task) {\n    return listTasks().then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return readTask(ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.real_owner !== ref.real_owner || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  function validTime(value) {\n    if (typeof value !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$/.test(value)) return false;\n    var normalized = value.replace(\" \", \"T\") + \"Z\";\n    var date = new Date(normalized);\n    return !isNaN(date.getTime()) && date.toISOString().slice(0, 19) === normalized.slice(0, 19);\n  }\n  function bounded(call, deadline) {\n    // A poll count alone cannot bound a stalled DSM callback. Discard late replies.\n    return new Promise(function (resolve, reject) {\n      var remaining = deadline - Date.now();\n      if (remaining <= 0) { reject(fail(\"root_timeout\")); return; }\n      var timer = setTimeout(function () { reject(fail(\"root_timeout\")); }, remaining);\n      Promise.resolve().then(call).then(function (value) {\n        clearTimeout(timer);\n        if (Date.now() >= deadline) reject(fail(\"root_timeout\"));\n        else resolve(value);\n      }, function (error) { clearTimeout(timer); reject(error); });\n    });\n  }\n  function legacyHistory(ref, deadline) {\n    return bounded(function () { return options.send(API, \"view\", 1, { id: ref.id }); }, deadline).then(function (records) {\n      // DSM 7.1 omits data entirely when a task has never run.\n      if (records === undefined) records = [];\n      if (!Array.isArray(records) || records.length > 500) throw fail(\"root_bad_response\");\n      var seen = {};\n      records.forEach(function (record) {\n        if (!record || !validTime(record.start_time) || typeof record.stop_time !== \"string\"\n            || (record.stop_time && (!validTime(record.stop_time) || record.stop_time < record.start_time))\n            || typeof record.exit_type !== \"string\" || !(typeof record.exit_code === \"number\" && isFinite(record.exit_code) && Math.floor(record.exit_code) === record.exit_code)\n            || seen[record.start_time]) throw fail(\"root_bad_response\");\n        seen[record.start_time] = true;\n      });\n      return records;\n    });\n  }\n  function waitForLegacyRun(ref, before, deadline, polls) {\n    return legacyHistory(ref, deadline).then(function (records) {\n      var previous = before.map(function (record) { return record.start_time; });\n      var newestBefore = previous.slice().sort().pop();\n      var fresh = records.filter(function (record) { return previous.indexOf(record.start_time) === -1; });\n      if (fresh.length > 1) throw fail(\"root_bad_response\");\n      var latest = fresh[0];\n      if (latest && (!newestBefore || latest.start_time > newestBefore) && latest.stop_time) {\n        if (latest.exit_code !== 0 || latest.exit_type !== \"normal\") throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1 || Date.now() >= deadline) throw fail(\"root_timeout\");\n      return options.wait(Math.min(POLL_MS, deadline - Date.now())).then(function () {\n        return waitForLegacyRun(ref, before, deadline, polls - 1);\n      });\n    });\n  }\n  function execute(task, verified) {\n    if (!legacy) {\n      return history(verified.ref).then(function (before) {\n        return runTask(verified.ref).then(function () { return waitForRun(verified.ref, before, POLLS); });\n      });\n    }\n    var deadline = Date.now() + POLL_MS * POLLS;\n    return legacyHistory(verified.ref, deadline).then(function (before) {\n      if (before.some(function (record) { return !record.stop_time || record.exit_type === \"running\"; })) throw fail(\"root_not_ready\");\n      // Mutating calls are sent exactly once, never retried with another profile.\n      return bounded(function () { return runTask(verified.ref); }, deadline).then(function () {\n        return waitForLegacyRun(verified.ref, before, deadline, POLLS);\n      });\n    }).then(function () {\n      return bounded(function () { return find(task); }, deadline).then(function (after) {\n        if (after.state !== \"ready\" || String(after.ref.id) !== String(verified.ref.id)) throw fail(\"root_verify_failed\");\n      });\n    });\n  }\n  function performRun(op) {\n    return begin(op).then(function (task) {\n      return find(task).then(function (found) {\n        if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n        var consent = op === \"helper_repair\" ? options.confirmPassword() : Promise.resolve({ confirmed: true });\n        return consent.then(function (confirmation) {\n          if (!confirmation || confirmation.confirmed !== true) throw fail(\"root_cancelled\");\n          return op === \"helper_repair\" ? begin(op).then(find) : found;\n        }).then(function (verified) {\n          if (verified.state !== \"ready\") throw fail(\"root_not_ready\");\n          return execute(task, verified);\n        });\n      }).then(function () { return readOutput(task); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (confirmation) {\n            if (!confirmation || confirmation.confirmed !== true) return \"cancelled\";\n            if (!legacy && (typeof confirmation.token !== \"string\" || !confirmation.token)) throw fail(\"root_verify_failed\");\n            var params = definition(task, options.user().name);\n            if (!legacy) params.SynoConfirmPWToken = confirmation.token;\n            // Re-read after the legacy client-side dialog before replacing a task.\n            var checked = legacy ? begin(op).then(find) : Promise.resolve(found);\n            return checked.then(function (current) {\n              if (current.state === \"conflict\") throw fail(\"root_conflict\");\n              if (current.state === \"ready\") return;\n              var replaced = current.state === \"outdated\" ? deleteTask(current.ref) : Promise.resolve();\n              return replaced.then(function () { return createTask(params); });\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n      if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n      if (running[op]) return running[op];\n      var pending = performRun(op).then(function (value) {\n        delete running[op];\n        return value;\n      }, function (error) { delete running[op]; throw error; });\n      running[op] = pending;\n      return pending;\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return deleteTask(found.ref).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(readOutput);\n    }\n  };\n}";
 /**
  * The authorization panel the window shows above the app for each root
  * operation, identical in every package. `rootPanelView(model)` decides what
  * it shows; `mountRootPanel(host, access, i18n, tasks, admin)` draws it with
  * DOM text nodes only (no HTML from data).
  */
-export declare const ROOT_PANEL = "function rootPanelShowsResult(state) {\n  return state === \"ready\" || state === \"outdated\";\n}\n\nfunction rootPanelView(model) {\n  if (!model.admin) return { status: null, buttons: [], message: { key: \"admin_only\" } };\n  function buttons(actions) {\n    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });\n  }\n  if (model.error) {\n    return {\n      status: \"state.\" + model.state, buttons: buttons([\"retry\"]),\n      message: { key: \"error.\" + model.error, params: { name: model.name, code: model.error } }\n    };\n  }\n  var message = model.notice ? { key: model.notice } : null;\n  switch (model.state) {\n    case \"missing\":\n      return { status: \"state.missing\", buttons: buttons([\"authorize\"]), message: message };\n    case \"outdated\":\n      return { status: \"state.outdated\", buttons: buttons([\"authorize\", \"remove\"]), message: message };\n    case \"ready\":\n      return { status: \"state.ready\", buttons: buttons([\"run\", \"remove\"]), message: message };\n    case \"conflict\":\n      return { status: \"state.conflict\", buttons: buttons([\"retry\"]), message: { key: \"error.root_conflict\", params: { name: model.name } } };\n    default:\n      return { status: \"state.checking\", buttons: [], message: null };\n  }\n}\n\nfunction mountRootPanel(host, access, i18n, tasks, admin) {\n  var t = i18n.t;\n  function el(tag, className, text) {\n    var node = document.createElement(tag);\n    if (className) node.className = className;\n    if (text !== undefined) node.textContent = text;\n    return node;\n  }\n  function say(message) {\n    if (!message) return \"\";\n    var text = t(message.key, message.params);\n    return text === message.key && message.key.indexOf(\"error.\") === 0 ? t(\"error.default\", message.params) : text;\n  }\n  tasks.forEach(function (task) {\n    var model = { admin: admin, name: task.name, state: \"checking\", busy: false, error: null, notice: null };\n    var result = null;\n    var section = el(\"section\", \"dsmapp-rootpanel\");\n    host.appendChild(section);\n\n    function render() {\n      var view = rootPanelView(model);\n      while (section.firstChild) section.removeChild(section.firstChild);\n      section.appendChild(el(\"h2\", null, t(\"title\")));\n      section.appendChild(el(\"p\", null, t(\"intro\", { op: task.op })));\n      if (view.status) {\n        var facts = el(\"dl\");\n        facts.appendChild(el(\"dt\", null, t(\"status\")));\n        facts.appendChild(el(\"dd\", \"dsmapp-rootpanel-state\", t(view.status, { name: task.name })));\n        facts.appendChild(el(\"dt\", null, t(\"last_run\")));\n        facts.appendChild(el(\"dd\", null, result && result.modified\n          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t(\"never\")));\n        section.appendChild(facts);\n      }\n      if (view.message) section.appendChild(el(\"p\", \"dsmapp-rootpanel-message\", say(view.message)));\n      if (result && typeof result.output === \"string\") {\n        section.appendChild(el(\"div\", \"dsmapp-rootpanel-label\", t(\"output\")));\n        section.appendChild(el(\"pre\", \"dsmapp-rootpanel-output\", result.output));\n      }\n      var actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n      view.buttons.forEach(function (button) {\n        var node = el(\"button\", button.action === \"remove\" ? null : \"dsmapp-rootpanel-primary\", t(button.action));\n        node.type = \"button\";\n        node.disabled = button.disabled;\n        node.onclick = function () { act(button.action); };\n        actions.appendChild(node);\n      });\n      section.appendChild(actions);\n      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el(\"p\", \"dsmapp-rootpanel-hint\", t(\"uninstall_hint\")));\n    }\n    function settle(promise, notice) {\n      model.busy = true;\n      model.error = null;\n      model.notice = null;\n      render();\n      return promise.then(function (value) {\n        model.notice = typeof notice === \"function\" ? notice(value) : notice;\n      }, function (error) {\n        model.error = (error && error.code) || \"unknown\";\n      }).then(function () {\n        model.busy = false;\n        render();\n      });\n    }\n    function refresh(notice) {\n      return settle(access.state(task.op).then(function (state) {\n        model.state = state;\n        if (!rootPanelShowsResult(state)) return;\n        return access.output(task.op).then(function (out) { result = out; });\n      }), notice);\n    }\n    function refreshAfterChange() {\n      return model.error ? null : refresh(model.notice);\n    }\n    function act(action) {\n      if (action === \"retry\") return refresh(null);\n      if (action === \"authorize\") {\n        return settle(access.authorize(task.op), function (outcome) {\n          return outcome === \"cancelled\" ? \"cancelled\" : null;\n        }).then(refreshAfterChange);\n      }\n      if (action === \"run\") {\n        return settle(access.run(task.op).then(function (out) { result = out; }), \"completed\");\n      }\n      if (action === \"remove\") {\n        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);\n      }\n    }\n    render();\n    if (admin) refresh(null);\n  });\n}";
+export declare const ROOT_PANEL = "function rootPanelShowsResult(state) {\n  return state === \"ready\" || state === \"outdated\";\n}\n\nfunction rootPanelView(model) {\n  if (!model.admin) return { status: null, buttons: [], message: { key: \"admin_only\" } };\n  function buttons(actions) {\n    return actions.map(function (action) { return { action: action, disabled: model.busy === true }; });\n  }\n  if (model.error) {\n    return {\n      status: \"state.\" + model.state, buttons: buttons([\"retry\"]),\n      message: { key: \"error.\" + model.error, params: { name: model.name, code: model.error } }\n    };\n  }\n  var message = model.notice ? { key: model.notice } : null;\n  switch (model.state) {\n    case \"missing\":\n      return { status: \"state.missing\", buttons: buttons([\"authorize\"]), message: message };\n    case \"outdated\":\n      return { status: \"state.outdated\", buttons: buttons([\"authorize\", \"remove\"]), message: message };\n    case \"ready\":\n      return { status: \"state.ready\", buttons: buttons([\"run\", \"remove\"]), message: message };\n    case \"conflict\":\n      return { status: \"state.conflict\", buttons: buttons([\"retry\"]), message: { key: \"error.root_conflict\", params: { name: model.name } } };\n    default:\n      return { status: \"state.checking\", buttons: [], message: null };\n  }\n}\n\nfunction mountRootPanel(host, access, i18n, tasks, admin) {\n  var t = i18n.t;\n  function el(tag, className, text) {\n    var node = document.createElement(tag);\n    if (className) node.className = className;\n    if (text !== undefined) node.textContent = text;\n    return node;\n  }\n  function say(message) {\n    if (!message) return \"\";\n    var text = t(message.key, message.params);\n    return text === message.key && message.key.indexOf(\"error.\") === 0 ? t(\"error.default\", message.params) : text;\n  }\n  tasks.forEach(function (task) {\n    var model = { admin: admin, name: task.name, state: \"checking\", busy: false, error: null, notice: null };\n    var result = null;\n    var section = el(\"section\", \"dsmapp-rootpanel\");\n    host.appendChild(section);\n\n    function render() {\n      var view = rootPanelView(model);\n      while (section.firstChild) section.removeChild(section.firstChild);\n      section.appendChild(el(\"h2\", null, t(\"title\")));\n      section.appendChild(el(\"p\", null, t(\"intro\", { op: task.op })));\n      if (view.status) {\n        var facts = el(\"dl\");\n        facts.appendChild(el(\"dt\", null, t(\"status\")));\n        facts.appendChild(el(\"dd\", \"dsmapp-rootpanel-state\", t(view.status, { name: task.name })));\n        facts.appendChild(el(\"dt\", null, t(\"last_run\")));\n        facts.appendChild(el(\"dd\", null, result && result.modified\n          ? new Date(result.modified * 1000).toLocaleString(i18n.locale) : t(\"never\")));\n        section.appendChild(facts);\n      }\n      if (view.message) section.appendChild(el(\"p\", \"dsmapp-rootpanel-message\", say(view.message)));\n      if (result && typeof result.output === \"string\") {\n        section.appendChild(el(\"div\", \"dsmapp-rootpanel-label\", t(\"output\")));\n        section.appendChild(el(\"pre\", \"dsmapp-rootpanel-output\", result.output));\n      }\n      var actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n      view.buttons.forEach(function (button) {\n        var node = el(\"button\", button.action === \"remove\" ? null : \"dsmapp-rootpanel-primary\", t(button.action));\n        node.type = \"button\";\n        node.disabled = button.disabled;\n        node.onclick = function () { act(button.action); };\n        actions.appendChild(node);\n      });\n      section.appendChild(actions);\n      if (admin && rootPanelShowsResult(model.state)) section.appendChild(el(\"p\", \"dsmapp-rootpanel-hint\", t(\"uninstall_hint\")));\n    }\n    function settle(promise, notice) {\n      model.busy = true;\n      model.error = null;\n      model.notice = null;\n      render();\n      return promise.then(function (value) {\n        model.notice = typeof notice === \"function\" ? notice(value) : notice;\n      }, function (error) {\n        if (error && error.code === \"root_cancelled\") model.notice = \"cancelled\";\n        else model.error = (error && error.code) || \"unknown\";\n      }).then(function () {\n        model.busy = false;\n        render();\n      });\n    }\n    function refresh(notice) {\n      return settle(access.state(task.op).then(function (state) {\n        model.state = state;\n        if (!rootPanelShowsResult(state)) return;\n        return access.output(task.op).then(function (out) { result = out; });\n      }), notice);\n    }\n    function refreshAfterChange() {\n      return model.error ? null : refresh(model.notice);\n    }\n    function act(action) {\n      if (action === \"retry\") return refresh(null);\n      if (action === \"authorize\") {\n        return settle(access.authorize(task.op), function (outcome) {\n          return outcome === \"cancelled\" ? \"cancelled\" : null;\n        }).then(refreshAfterChange);\n      }\n      if (action === \"run\") {\n        return settle(access.run(task.op).then(function (out) { result = out; }), \"completed\");\n      }\n      if (action === \"remove\") {\n        return settle(access.remove(task.op).then(function () { result = null; }), null).then(refreshAfterChange);\n      }\n    }\n    render();\n    if (admin) refresh(null);\n  });\n}";