@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/supervisor_linux.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/supervisor_linux.go:1
 package helper
 
 import (
@@ -88,7 +91,8 @@ func superviseLinux(c Client, binary string) error {
 	defer cancelWatcher()
 	go o.watch(watcher)
 	epoch := r.Lifecycle.Epoch
-	defer persistObserverDiagnostic(c, epoch, o.gate)
+	stopDiagnostics := startObserverDiagnostics(c, epoch, o.gate)
+	defer stopDiagnostics()
 	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
 	if err != nil {
 		return err
@@ -147,7 +151,7 @@ func superviseLinux(c Client, binary string) error {
 		var code Code
 		grants, grantRepo, code = openSupervisorGrants(c, binary, cohort)
 		if code != "" {
-			o.gate.fence("grant-authority-unavailable")
+			o.gate.fenceStartup("grants-open", code)
 		}
 	}
 	fenceRetryExhausted := false

package/templates/native-go/backend/internal/helper/unit_connection_test.go

@@ -7,6 +7,8 @@ import (
 	"io"
 	"net"
 	"testing"
+
+	"github.com/godbus/dbus/v5"
 )
 
 type observerClosedReader struct{ *bytes.Reader }
@@ -33,18 +35,34 @@ func (s *observerTestStream) Write(p []byte) (int, error) {
 }
 func (s *observerTestStream) Close() error { return nil }
 
-func TestObserverDBusFrameCloseReturnsError(t *testing.T) {
+// Cover the dependency directly as well as the production recovery boundary.
+// Canonical frames avoid EncodeTo's map-order-dependent header alignment.
+func TestDBusClosedHeaderPaddingReturnsErrorWithoutPanic(t *testing.T) {
 	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
 		t.Run(order.String(), func(t *testing.T) {
 			packet, header := observerPaddedFrame(t, order)
+			defer func() {
+				if failure := recover(); failure != nil {
+					t.Fatalf("closed socket during header alignment panicked: %v", failure)
+				}
+			}()
+			msg, err := dbus.DecodeMessage(observerClosedReader{bytes.NewReader(packet[:header])})
+			if msg != nil || !errors.Is(err, net.ErrClosed) {
+				t.Fatalf("partial frame accepted or close error lost: %+v %v", msg, err)
+			}
+		})
+	}
+}
+
+func TestObserverDBusFrameCloseReturnsError(t *testing.T) {
+	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
+		t.Run(order.String(), func(t *testing.T) {
+			packet, _ := observerPaddedFrame(t, order)
 			for end := 0; end < len(packet); end++ {
 				frame, err := readObserverDBusFrame(observerClosedReader{bytes.NewReader(packet[:end])})
 				if frame != nil || !errors.Is(err, net.ErrClosed) {
 					t.Fatalf("close at byte %d: partial frame %x error %v", end, frame, err)
 				}
-				if end == header && !errors.Is(err, errObserverDBusDecode) {
-					t.Fatal("fixture did not exercise upstream padding panic recovery")
-				}
 			}
 		})
 	}

package/templates/native-go/backend/internal/helper/unit_linux.go

@@ -17,6 +17,9 @@ import (
 	"github.com/godbus/dbus/v5"
 )
 
+const unitQueryTimeout = 500 * time.Millisecond
+const unitProbeInterval = 250 * time.Millisecond
+
 const systemdName = "org.freedesktop.systemd1"
 const managerInterface = systemdName + ".Manager"
 const unitInterface = systemdName + ".Unit"
@@ -222,7 +225,7 @@ func jobID(v dbus.Variant) (uint32, bool) {
 }
 
 func openUnitObserver(parent context.Context, i Inventory) (*unitObserver, error) {
-	ctx, cancel := context.WithTimeout(parent, 500*time.Millisecond)
+	ctx, cancel := context.WithTimeout(parent, unitQueryTimeout)
 	defer cancel()
 	binding, err := installedBinding(i)
 	if err != nil {
@@ -309,7 +312,7 @@ func openUnitObserver(parent context.Context, i Inventory) (*unitObserver, error
 }
 
 func (o *unitObserver) watch(ctx context.Context) {
-	ticker := time.NewTicker(250 * time.Millisecond)
+	ticker := time.NewTimer(unitProbeInterval)
 	defer ticker.Stop()
 	for {
 		select {
@@ -320,12 +323,13 @@ func (o *unitObserver) watch(ctx context.Context) {
 			o.gate.fenceObserver("observation-unavailable", observerEvent{Detail: "bus-context-done", ErrorClass: observerErrorClass(o.conn.Context().Err())})
 			return
 		case <-ticker.C:
-			probe, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
+			probe, cancel := context.WithTimeout(ctx, unitQueryTimeout)
 			err := o.reconcile(probe)
 			cancel()
 			if err != nil {
 				return
 			}
+			ticker.Reset(unitProbeInterval)
 		}
 	}
 }

package/templates/native-go/backend/internal/helper/unit_query_linux.go

@@ -54,7 +54,8 @@ func (o *unitObserver) reconcile(ctx context.Context) error {
 	return o.reconcileSnapshot(ctx, o.snapshot)
 }
 func (o *unitObserver) reconcileSnapshot(ctx context.Context, query func(context.Context) (Binding, map[string]dbus.Variant, error)) error {
-	serial, ready := o.gate.unitProbe(time.Now())
+	started := time.Now()
+	serial, ready := o.gate.unitProbe(started)
 	// Initial observation has no freshness baseline yet.
 	if !ready {
 		return nil
@@ -73,6 +74,9 @@ func (o *unitObserver) reconcileSnapshot(ctx context.Context, query func(context
 			}
 		}
 		o.gate.recordObserver(e)
+		if !definitive && errors.Is(err, context.DeadlineExceeded) && (e.Phase == "get-owner" || e.Phase == "get-unit" || e.Phase == "get-all") && o.gate.deferUnitDeadline(serial, started, time.Now(), e) {
+			return nil
+		}
 		if o.gate.failUnitProbe(serial, reason, definitive, time.Now(), e) {
 			return err
 		}

package/templates/native-go/backend/internal/helper/write_files_linux.go

@@ -173,10 +173,7 @@ func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
 		// the destination is ever performed, including failure/foreign replacement.
 		e := unix.Linkat(unix.AT_FDCWD, "/proc/self/fd/"+strconv.Itoa(int(x.file.Fd())), int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], unix.AT_SYMLINK_FOLLOW)
 		if e != nil {
-			if errors.Is(e, unix.EEXIST) {
-				return x.receipt, ErrDenied
-			}
-			return x.receipt, ErrUnsupported
+			return x.receipt, publishLinkError(e)
 		}
 	}
 	x.receipt.Published = true
@@ -192,6 +189,12 @@ func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
 	x.receipt.Committed = true
 	return x.receipt, ""
 }
+func publishLinkError(err error) Code {
+	if errors.Is(err, unix.EEXIST) || errors.Is(err, unix.EACCES) {
+		return ErrDenied
+	}
+	return ErrUnsupported
+}
 func (x *actorFileWriter) Close() {
 	if x.closed {
 		return

package/templates/native-go/backend/internal/helper/write_files_linux_test.go

@@ -8,6 +8,32 @@ import (
 	"testing"
 )
 
+func TestPublishLinkError(t *testing.T) {
+	for _, tc := range []struct {
+		err  error
+		want Code
+	}{
+		{unix.EACCES, ErrDenied},
+		{unix.EEXIST, ErrDenied},
+		{unix.EPERM, ErrUnsupported},
+		{unix.ENOSYS, ErrUnsupported},
+		{unix.EOPNOTSUPP, ErrUnsupported},
+		{unix.EINVAL, ErrUnsupported},
+		{unix.ENOENT, ErrUnsupported},
+		{unix.EXDEV, ErrUnsupported},
+		{unix.EROFS, ErrUnsupported},
+		{unix.EIO, ErrUnsupported},
+	} {
+		t.Run(tc.err.Error(), func(t *testing.T) {
+			for _, err := range []error{tc.err, &os.LinkError{Op: "linkat", Old: "fixed-fd", New: "destination", Err: tc.err}} {
+				if got := publishLinkError(err); got != tc.want {
+					t.Errorf("publishLinkError(%v) = %s, want %s", err, got, tc.want)
+				}
+			}
+		})
+	}
+}
+
 func TestWriteExclusivePartialAndNoForeignUnlink(t *testing.T) {
 	pin, root := readOnlyFixture(t)
 	w := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new"}, MaxBytes: 10}

package/templates/native-go/dsm-package.yaml

@@ -11,7 +11,7 @@ build: 1
 displayname: __DISPLAY_NAME__
 description: A native DSM package with a Go backend and a DSM window UI.
 maintainer: Your Name
-os_min_ver: "7.2-64570"
+os_min_ver: "7.1-42661"
 
 # One SPK per architecture. Supported: x86_64, aarch64.
 arches: [x86_64, aarch64]

package/templates/native-go-background/BACKGROUND.md

@@ -0,0 +1,111 @@
+# Background jobs
+
+This package opted in with `synopkgland init --background`. `dsm-package.yaml` has
+`background: {worker: sha256-v1}`. The build adds a package-user worker that DSM
+runs as a systemd user unit. Nothing runs as root, and the CGI never starts a
+process in the background.
+
+## What runs
+
+- `conf/resource` is `{"systemd-user-unit":{}}` and `conf/systemd/pkguser-<Package>-background.service`
+  starts `target/background/worker`. `start-stop-status` only calls `synosystemctl`.
+- The worker is fixed: `sha256-v1` reads one imported file and writes its SHA-256.
+  Replace it by editing `backend/internal/background/runner.go` and bump `WorkerRevision`
+  (queued jobs of an older revision become `interrupted`, never replayed).
+- The spool is `/var/packages/<Package>/var/background` (dirs `0700`, files `0600`).
+  Limits: 1 job at a time, 16 queued, 512 KiB per file, 16 MiB total, 60 s per job.
+- Job states: `queued → running → succeeded | failed | canceled | interrupted`.
+  After a crash or forced stop a running job becomes `interrupted` and is not run again.
+
+## API and ownership
+
+`bg.status`, `bg.mode.set {enabled}`, `bg.users.set {allowOrdinaryUsers}`, `bg.jobs.purge {owner: {user, uid}}`, `bg.browse {folder?, offset?}`, `bg.jobs.submit {key, folder, relative}`,
+`bg.jobs.list`, `bg.jobs.get {id}`, `bg.jobs.cancel {id}`, `bg.jobs.result {id}`.
+
+The panel's **Choose a file** button opens the shared File Station picker, which lists shares and folders
+with `bg.browse`: read-only metadata from the signed-in caller's own DSM session. A pick stores no
+grant and adds no permission; `submit` still re-reads the file through the same session.
+
+`submit` copies `relative` below the shared `folder` through the caller's File Station session, so the signed-in
+administrator's own DSM permissions decide what can be imported. The job ID is returned
+only after the journal is durable, and `key` makes a retry return the same job.
+No cookie, SynoToken or password is stored. Closing the window or signing out does not
+cancel a job; sign in as the same owner again to read, download or cancel it.
+
+## Access
+
+Background mode is off until an administrator turns it on. Ordinary-user access
+has its own administrator switch.
+
+## Ordinary users (U1)
+
+Background mode and `allowOrdinaryUsers` are independent administrator switches,
+initially off. With ordinary users allowed, signed-in users can browse through
+**their own live File Station session**, import a copy, and list/get/cancel/download
+only their own jobs. `bg.mode.set`, `bg.users.set` and `bg.jobs.purge` remain admin-only.
+Administrators can see and cancel all jobs. Turning ordinary access off returns
+`unsupported` on owner routes; it does not delete or cancel previously admitted jobs.
+Turning background mode off cancels queued work and drains running work as before.
+
+Owners are matched by both authenticated username and freshly resolved numeric UID.
+An unknown UID refuses owner access and submission with `identity_unavailable`.
+Legacy jobs with an unknown UID remain admin-only. Recreated same-name accounts
+with different UIDs cannot access old jobs. This does not detect reuse of the same
+username **and** UID. Account disablement is enforced by DSM session authentication;
+this feature does not provide a separate account-lifecycle directory service.
+
+Idempotency keys are scoped to that owner. Cross-owner and missing IDs both return
+`not_found`. Queue/running counts for ordinary users include only their own jobs.
+Per-owner limits (including administrators): 2 queued/running jobs, 1 MiB of pending
+and retained imported inputs, schedule copies, plus 512 bytes reserved for each pending or retained result. The 16-job/16-MiB
+global bounds and 64 finished-job history remain. Two full 512-KiB inputs exceed the
+owner byte limit because of their result reservations. `owner-queue-full` and
+`owner-quota-exceeded` are distinct from global `queue-full`/`quota-exceeded`.
+
+An administrator may explicitly clear an exact owner `{user, uid}` (including
+unknown legacy UIDs). This removes saved results and queued inputs, requests cancel
+for running jobs, and hides those jobs until Finish/Recover drains them. A bounded
+64-entry audit stores actor, exact owner, time and counts in the durable journal;
+it contains no credentials or input contents. Uninstall retains data by default;
+the existing explicit delete-data wizard remains available.
+
+The package copy/result is not recalled when source-file permissions change.
+Offline access under a user's ACL, AD/LDAP UID stability and DSM reboot recovery
+are not claimed. No user credentials are stored.
+
+## Private-copy schedules (S1-a)
+
+Import a file and wait for its success, then choose **Schedule this copy** and
+explicitly consent. The package pins a separate copy and digest, without accessing
+File Station offline. `bg.schedules.create {key, jobId, intervalSeconds, consent:true}`
+accepts only 3600, 86400 or 604800 seconds; up to 8 schedules per package.
+`key` is scoped to username/UID and retries the exact definition.
+`bg.schedules.list`, `bg.schedules.disable {id}`, `bg.schedules.delete {id}` are
+owner-scoped; administrators see and can disable/delete all. Only an administrator
+can call `bg.schedules.enable {id, consent:true}` after reviewing the current revision.
+An administrator cannot create a schedule from another owner's imported copy.
+
+Successful manual inputs are retained with the bounded 64-job history. Old U1
+results whose input was deleted cannot be scheduled: import again. Copies and
+schedule pins count toward the 1-MiB owner/16-MiB global storage limits; a full
+512-KiB source plus its pinned copy exceeds the owner limit, so use smaller inputs.
+A scheduled run also needs input/result quota and shares the 2-pending-owner limit.
+At least 4 global queue positions remain available for manual jobs.
+
+The package-user worker ticks its journal; no root task, crontab or global service
+is created. `nextAt` and the run's `scheduleId`/`scheduledAt` commit atomically.
+Completed jobs never replay. Each start records overdue ticks as `missed` and
+advances to the next future period. Delays over 5 seconds, a full quota/queue, and
+multi-period gaps are also missed; no catch-up. The latest missed time/reason and
+aggregate missed count are retained, not an unbounded event log. This is neither
+an exact-time nor exactly-once guarantee.
+
+Disabling/deleting cancels queued runs and requests running cancellation/drain;
+finished results remain. Background mode off also disables every schedule, and
+turning it on does not revive them. Blocking ordinary access hides owner routes,
+but admitted private-copy schedules continue, like admitted U1 jobs. Clearing an
+owner also deletes that owner's schedules/pins and drains running jobs. A worker
+revision mismatch disables the schedule (`worker-changed`) and requires explicit
+administrator re-enable; a package build +1 with the same worker revision preserves
+compatible definitions/results. Changed or missing pinned bytes disable the schedule.
+No S1-b share authorization or offline personal ACL reading is provided.

package/templates/native-go-background/backend/internal/app/background_on.go

@@ -0,0 +1,7 @@
+package app
+
+import "dsmapp/internal/api"
+
+// backgroundRoutes serves the owner-scoped background job API. Jobs run
+// in the package-user worker unit (conf/systemd), never as root.
+func (cfg Config) backgroundRoutes() []api.Route { return BackgroundRoutes(cfg.DataDir) }

package/templates/native-go-background/backend/internal/app/background_routes_test.go

@@ -0,0 +1,32 @@
+package app
+
+func init() {
+	// The generic route tests need valid params for every background route.
+	// Background mode is off in a fresh data dir, so submit is refused before
+	// any file is read and the id routes find nothing.
+	const id = `{"id":"missing"}`
+	sampleParams["bg.users.set"] = `{"allowOrdinaryUsers":true}`
+	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
+	sampleParams["bg.schedules.list"] = `{}`
+	sampleParams["bg.schedules.create"] = `{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}`
+	sampleParams["bg.schedules.disable"] = id
+	sampleParams["bg.schedules.delete"] = id
+	sampleParams["bg.schedules.enable"] = `{"id":"missing","consent":true}`
+	sampleOutcome["bg.schedules.create"] = "disabled"
+	sampleOutcome["bg.schedules.disable"] = "not_found"
+	sampleOutcome["bg.schedules.delete"] = "not_found"
+	sampleOutcome["bg.schedules.enable"] = "not_found"
+	sampleParams["bg.status"] = `{}`
+	sampleParams["bg.mode.set"] = `{"enabled":true}`
+	sampleParams["bg.browse"] = `{}`
+	sampleParams["bg.jobs.submit"] = `{"key":"k1","folder":"/share","relative":"a.bin"}`
+	sampleParams["bg.jobs.list"] = `{}`
+	sampleParams["bg.jobs.get"] = id
+	sampleParams["bg.jobs.cancel"] = id
+	sampleParams["bg.jobs.result"] = id
+	sampleOutcome["bg.browse"] = "session_required"
+	sampleOutcome["bg.jobs.submit"] = "disabled"
+	sampleOutcome["bg.jobs.get"] = "not_found"
+	sampleOutcome["bg.jobs.cancel"] = "not_found"
+	sampleOutcome["bg.jobs.result"] = "not_found"
+}

package/templates/native-go-background/frontend/src/background/BackgroundPanel.vue

@@ -0,0 +1,178 @@
+<script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,provide,ref} from 'vue'
+import {Button,Callout,Checkbox,Form,FormActions,FormItem,Link,Select,SettingsSection} from '@synopackageland/ui'
+import type {Context} from '../context'
+import M2PathPicker from '../nas/M2PathPicker.vue'
+import {M2ProviderKey,type M2JobSource} from '../nas/m2-contract'
+import {backgroundCopy,backgroundErrorCopy} from './i18n'
+import {createBackgroundPickerProvider} from './picker-provider'
+interface Status{owner?:Owner;enabled:boolean;admin:boolean;allowOrdinaryUsers:boolean;revision:number;worker:{username:string;alive:boolean}|null;limits:{maxInputBytes:number;maxQueued:number;maxOwnerPending:number;maxOwnerBytes:number;jobTimeoutSeconds:number}}
+interface Owner{user:string;uid:string}
+interface Job{copyRetained?:boolean;scheduleId?:string;submitter:Owner;id:string;name:string;state:'queued'|'running'|'succeeded'|'failed'|'canceled'|'interrupted'}
+interface Schedule{id:string;name:string;owner:Owner;enabled:boolean;nextAt:string;intervalSeconds:number;workerRevision:number;missed:number;reason?:string}
+const props=defineProps<{ctx:Pick<Context,'call'|'locale'>}>()
+const copy=computed(()=>backgroundCopy(props.ctx.locale))
+const fill=(text:string,values:Record<string,string|number>)=>text.replace(/\{(\w+)\}/g,(_,k)=>String(values[k]??''))
+const status=ref<Status>(),jobs=ref<Job[]>([]),error=ref<unknown>(),unsupported=ref(false),busy=ref(false)
+const schedules=ref<Schedule[]>([]),scheduleSource=ref<Job>(),scheduleConsent=ref(false),scheduleInterval=ref('3600'),scheduleDelete=ref<Schedule>(),scheduleEnable=ref<Schedule>()
+const purgeOwner=ref<Owner>(),refreshing=ref(false)
+const picking=ref(false),picked=ref<{folder:string;relative:string}>(),download=ref(''),downloadName=ref('')
+const picker=createBackgroundPickerProvider(props.ctx);provide(M2ProviderKey,picker)
+let timer:ReturnType<typeof setInterval>|undefined,disposed=false
+const settled=(j:Job)=>!['queued','running'].includes(j.state)
+async function call<T>(method:string,params?:Record<string,unknown>):Promise<T|undefined>{
+ try{return await props.ctx.call<T>(method,params)}
+ catch(e){
+  if(disposed)return undefined
+  if((e as {code?:string})?.code==='unsupported'){unsupported.value=true;jobs.value=[];schedules.value=[];scheduleSource.value=undefined;scheduleDelete.value=undefined;scheduleEnable.value=undefined;status.value=undefined;purgeOwner.value=undefined;picked.value=undefined;if(download.value)URL.revokeObjectURL(download.value);download.value=''}
+  else if(!disposed)error.value=e
+  return undefined
+ }
+}
+async function refresh(){
+ if(disposed||refreshing.value)return
+ refreshing.value=true
+ try{
+ const s=await call<Status>('bg.status')
+ if(!s||disposed)return
+ if(!s.limits||typeof s.enabled!=='boolean'||typeof s.admin!=='boolean'){error.value={code:'unavailable'};return}
+ unsupported.value=false;status.value=s
+ const list=await call<{jobs:Job[]}>('bg.jobs.list')
+ if(list&&!disposed)jobs.value=list.jobs??[]
+ const scheduleList=await call<{schedules:Schedule[]}>('bg.schedules.list')
+ if(scheduleList&&!disposed)schedules.value=scheduleList.schedules??[]
+ if(!disposed&&!status.value?.enabled&&jobs.value.every(settled)&&timer){clearInterval(timer);timer=undefined}
+ }finally{refreshing.value=false}
+}
+function poll(){if(!timer)timer=setInterval(()=>void refresh(),3000)}
+async function guarded(work:()=>Promise<unknown>){
+ if(busy.value)return
+ busy.value=true;error.value=undefined
+ try{await work();await refresh();if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}finally{if(!disposed)busy.value=false}
+}
+const setMode=(enabled:boolean)=>guarded(()=>call('bg.mode.set',{enabled}))
+const setUsers=(allowOrdinaryUsers:boolean)=>guarded(()=>call('bg.users.set',{allowOrdinaryUsers}))
+const purge=()=>guarded(async()=>{if(!purgeOwner.value)return;const out=await call('bg.jobs.purge',{owner:purgeOwner.value});if(out)purgeOwner.value=undefined})
+const intervalOptions=computed(()=>[{value:'3600',label:copy.value.hourly},{value:'86400',label:copy.value.daily},{value:'604800',label:copy.value.weekly}])
+const selectSchedule=(job:Job)=>{scheduleSource.value=job;scheduleConsent.value=false;scheduleInterval.value='3600'}
+const createSchedule=()=>guarded(async()=>{if(!scheduleSource.value||!scheduleConsent.value)return;const out=await call('bg.schedules.create',{key:crypto.randomUUID(),jobId:scheduleSource.value.id,intervalSeconds:Number(scheduleInterval.value),consent:true});if(out)scheduleSource.value=undefined})
+const disableSchedule=(id:string)=>guarded(()=>call('bg.schedules.disable',{id}))
+const deleteSchedule=()=>guarded(async()=>{if(!scheduleDelete.value)return;const out=await call('bg.schedules.delete',{id:scheduleDelete.value.id});if(out)scheduleDelete.value=undefined})
+const enableSchedule=()=>guarded(async()=>{if(!scheduleEnable.value)return;const out=await call('bg.schedules.enable',{id:scheduleEnable.value.id,consent:true});if(out)scheduleEnable.value=undefined})
+const formatTime=(value:string)=>{const date=new Date(value);return Number.isFinite(date.getTime())?date.toLocaleString():copy.value.unknownTime}
+const ownCopy=(job:Job)=>job.copyRetained&&job.state==='succeeded'&&!job.scheduleId&&job.submitter?.user===status.value?.owner?.user&&job.submitter?.uid===status.value?.owner?.uid
+const cancel=(id:string)=>guarded(()=>call('bg.jobs.cancel',{id}))
+const pick=(value:M2JobSource)=>{picked.value={folder:value.selection.folder,relative:value.segments.join('/')}}
+// The signed-in caller's own File Station session decides whether the
+// file can be read; the submit itself is the consent to copy that one file.
+const submit=()=>guarded(async()=>{
+ if(!picked.value)return
+ const sent=await call('bg.jobs.submit',{key:crypto.randomUUID(),...picked.value})
+ if(sent)picked.value=undefined
+})
+async function fetchResult(job:Job){
+ const value=await call<{result:unknown}>('bg.jobs.result',{id:job.id})
+ if(!value||disposed)return
+ if(download.value)URL.revokeObjectURL(download.value)
+ download.value=URL.createObjectURL(new Blob([JSON.stringify(value.result,null,2)],{type:'application/json'}))
+ downloadName.value=`${job.name||job.id}.sha256.json`
+}
+onMounted(()=>void refresh().then(()=>{if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}))
+onBeforeUnmount(()=>{disposed=true;picker.dispose();if(timer)clearInterval(timer);if(download.value)URL.revokeObjectURL(download.value)})
+</script>
+<template>
+ <SettingsSection :aria-busy="busy||refreshing" :title="copy.title" :collapsible="false" data-background-panel>
+  <Callout v-if="unsupported" tone="warning">{{ copy.unsupported }}</Callout>
+  <template v-else>
+   <p class="integration-help">{{ copy.help }}</p>
+   <Callout v-if="error" tone="danger" role="alert">{{ backgroundErrorCopy(error,copy) }}</Callout>
+   <template v-if="status">
+    <p role="status">{{ status.enabled ? copy.modeOn : copy.modeOff }} · {{ status.worker?.alive ? fill(copy.workerRunning,{user:status.worker.username}) : copy.workerStopped }}</p>
+    <p class="integration-help">{{ fill(copy.limits,{size:status.limits.maxInputBytes/1024,queue:status.limits.maxQueued,seconds:status.limits.jobTimeoutSeconds}) }}</p>
+    <p class="integration-help">{{ status.admin ? copy.adminScope : copy.ownerScope }}</p>
+    <p class="integration-help">{{ fill(copy.ownerLimits,{jobs:status.limits.maxOwnerPending,size:status.limits.maxOwnerBytes/1024}) }}</p>
+    <div class="integration-actions">
+     <Button v-if="status.admin&&!status.enabled" variant="primary" :disabled="busy" @click="setMode(true)">{{ copy.enable }}</Button>
+     <Button v-else-if="status.admin" variant="secondary" :disabled="busy" @click="setMode(false)">{{ copy.disable }}</Button>
+     <Button variant="secondary" :disabled="busy" @click="refresh">{{ copy.refresh }}</Button>
+    </div>
+    <div v-if="status.admin" class="integration-actions">
+     <Button variant="secondary" :disabled="busy" @click="setUsers(!status.allowOrdinaryUsers)">{{ status.allowOrdinaryUsers ? copy.blockUsers : copy.allowUsers }}</Button>
+     <span role="status">{{ status.allowOrdinaryUsers ? copy.usersOn : copy.usersOff }}</span>
+    </div>
+    <template v-if="status.enabled">
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="picking=true">{{ copy.chooseFile }}</Button>
+      <Button variant="primary" :disabled="busy||!picked" @click="submit">{{ copy.submit }}</Button>
+     </div>
+     <p v-if="picked" role="status" data-bg-picked>{{ fill(copy.chosen,{path:`${picked.folder}/${picked.relative}`}) }}</p>
+     <M2PathPicker v-model:open="picking" :locale="ctx.locale" select-files read-only :title="copy.pickerTitle" :consent="copy.pickerConsent" @source="pick" />
+    </template>
+    <Callout v-if="purgeOwner&&status.admin" tone="warning">
+     <p>{{ fill(copy.purgeConfirm,{user:purgeOwner.user,uid:purgeOwner.uid}) }}</p>
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="purge">{{ copy.confirmPurge }}</Button>
+      <Button variant="secondary" :disabled="busy" @click="purgeOwner=undefined">{{ copy.keepJobs }}</Button>
+     </div>
+    </Callout>
+    <p v-if="!jobs.length">{{ copy.noJobs }}</p>
+    <ul v-else class="integration-jobs">
+     <li v-for="job in jobs" :key="job.id" :data-job-state="job.state" :data-job-id="job.id">
+      <span class="nas-folder-name">{{ job.name }} — {{ copy[`state_${job.state}`] }}</span>
+      <span v-if="status.admin&&job.submitter" class="integration-help">{{ fill(copy.owner,{user:job.submitter.user,uid:job.submitter.uid}) }}</span>
+      <Button v-if="status.admin&&job.submitter" variant="secondary" :disabled="busy" @click="purgeOwner=job.submitter">{{ copy.purgeOwner }}</Button>
+      <Button v-if="!settled(job)" variant="secondary" :disabled="busy" @click="cancel(job.id)">{{ copy.cancel }}</Button>
+      <Button v-if="status.enabled&&ownCopy(job)" variant="secondary" :disabled="busy" @click="selectSchedule(job)">{{ copy.scheduleCopy }}</Button>
+      <span v-if="job.scheduleId" class="integration-help">{{ copy.scheduledJob }}</span>
+      <Button v-if="job.state==='succeeded'" variant="secondary" :disabled="busy" @click="fetchResult(job)">{{ copy.result }}</Button>
+     </li>
+    </ul>
+    <section data-bg-schedules class="bg-schedules" :aria-label="copy.schedulesTitle">
+     <h3>{{ copy.schedulesTitle }}</h3>
+     <p class="integration-help">{{ copy.scheduleHelp }}</p>
+     <Form v-if="scheduleSource&&status.enabled" class="bg-schedule-form" @submit.prevent="createSchedule">
+      <p>{{ fill(copy.scheduleSource,{name:scheduleSource.name}) }}</p>
+      <FormItem :label="copy.interval"><Select v-model="scheduleInterval" data-schedule-interval :options="intervalOptions" :disabled="busy" /></FormItem>
+      <Checkbox v-model="scheduleConsent" data-schedule-consent :disabled="busy" :label="copy.scheduleConsent" />
+      <FormActions><Button type="submit" variant="primary" :disabled="busy||!scheduleConsent">{{ copy.createSchedule }}</Button><Button type="button" variant="secondary" :disabled="busy" @click="scheduleSource=undefined">{{ copy.cancel }}</Button></FormActions>
+     </Form>
+     <p v-if="!schedules.length">{{ copy.noSchedules }}</p>
+     <ul v-else class="integration-jobs">
+      <li v-for="schedule in schedules" :key="schedule.id" :data-schedule-id="schedule.id">
+       <span class="nas-folder-name">{{ schedule.name }} — {{ schedule.enabled ? copy.scheduleOn : copy.scheduleOff }}</span>
+       <span v-if="status.admin" class="integration-help">{{ fill(copy.owner,{user:schedule.owner.user,uid:schedule.owner.uid}) }}</span>
+       <span v-if="schedule.enabled" class="integration-help">{{ fill(copy.nextRun,{time:formatTime(schedule.nextAt)}) }}</span>
+       <span class="integration-help">{{ fill(copy.missedRuns,{count:schedule.missed}) }}</span>
+       <Callout v-if="schedule.reason==='worker-changed'" tone="warning">{{ copy.revisionChanged }}</Callout>
+       <Callout v-else-if="schedule.reason==='input-unavailable'" tone="warning">{{ copy.errors['input-unavailable'] }}</Callout>
+       <div class="integration-actions">
+       <Button v-if="schedule.enabled" variant="secondary" :disabled="busy" @click="disableSchedule(schedule.id)">{{ copy.disableSchedule }}</Button>
+       <Button v-else-if="status.admin&&status.enabled" variant="secondary" :disabled="busy" @click="scheduleEnable=schedule">{{ copy.enableSchedule }}</Button>
+       <Button variant="secondary" :disabled="busy" @click="scheduleDelete=schedule">{{ copy.deleteSchedule }}</Button>
+       </div>
+      </li>
+     </ul>
+     <Callout v-if="scheduleDelete" tone="warning">
+      <p>{{ fill(copy.deleteScheduleConsent,{name:scheduleDelete.name}) }}</p>
+      <div class="integration-actions"><Button variant="danger" :disabled="busy" @click="deleteSchedule">{{ copy.confirmDeleteSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleDelete=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+     <Callout v-if="scheduleEnable" tone="warning">
+      <p>{{ fill(copy.enableScheduleConsent,{name:scheduleEnable.name}) }}</p>
+      <div class="integration-actions"><Button variant="primary" :disabled="busy" @click="enableSchedule">{{ copy.confirmEnableSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleEnable=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+    </section>
+    <Link v-if="download" :href="download" :download="downloadName">{{ copy.download }}</Link>
+   </template>
+  </template>
+ </SettingsSection>
+</template>
+
+<style scoped>
+.integration-jobs { overflow-wrap:anywhere; min-width:0; }
+.bg-schedules { margin-block-start: var(--ui-space-6,24px); min-width:0; overflow-wrap:anywhere; }
+.bg-schedules .integration-jobs { display:grid; gap:var(--ui-space-4,16px); padding-inline-start:var(--ui-space-5,20px); }
+.bg-schedules .integration-jobs li { display:flex; flex-direction:column; align-items:flex-start; gap:var(--ui-space-2,8px); min-width:0; }
+.bg-schedules p, .bg-schedules li > span { min-width:0; max-width:100%; }
+.bg-schedules h3 { font-size:15px; font-weight:600; }
+.bg-schedule-form { margin-block:var(--ui-space-4,16px); }
+</style>

package/templates/native-go-background/frontend/src/background/i18n/de.json

@@ -0,0 +1,83 @@
+{
+  "title": "Hintergrundaufträge",
+  "help": "Kopiert eine ausgewählte Datei ins Paket und berechnet ihren SHA-256 als Paketbenutzer. Aufträge laufen nach der Abmeldung weiter. Kopie und Ergebnis bleiben im Paket; geänderte Quellberechtigungen rufen sie nicht zurück. Melden Sie sich erneut an, um Ihr Ergebnis zu sehen.",
+  "unsupported": "Hintergrundaufträge sind für Ihr Konto nicht verfügbar. Bitten Sie einen Administrator, normale Benutzer zuzulassen.",
+  "modeOn": "Hintergrundmodus ist an",
+  "modeOff": "Hintergrundmodus ist aus",
+  "enable": "Einschalten",
+  "disable": "Ausschalten",
+  "worker": "Worker",
+  "workerRunning": "Worker läuft als {user}",
+  "workerStopped": "Worker läuft nicht",
+  "chooseFile": "Datei auswählen",
+  "chosen": "Ausgewählte Datei: {path}",
+  "pickerTitle": "Datei zum Importieren auswählen",
+  "pickerConsent": "Die ausgewählte Datei wird einmalig mit Ihrer aktuellen DSM-Anmeldung gelesen und an den Hintergrundjob übergeben. Es wird keine Berechtigung gespeichert.",
+  "submit": "Importieren und senden",
+  "refresh": "Aktualisieren",
+  "cancel": "Abbrechen",
+  "result": "Ergebnis",
+  "download": "Ergebnis herunterladen",
+  "noJobs": "Noch keine Aufträge",
+  "state_queued": "In Warteschlange",
+  "state_running": "Läuft",
+  "state_succeeded": "Erfolgreich",
+  "state_failed": "Fehlgeschlagen",
+  "state_canceled": "Abgebrochen",
+  "state_interrupted": "Unterbrochen",
+  "limits": "Bis zu {size} KiB pro Datei, {queue} Aufträge in der Warteschlange, {seconds} Sekunden pro Auftrag.",
+  "errors": {
+    "failed": "Die Anfrage konnte nicht abgeschlossen werden. Aktualisieren und erneut versuchen.",
+    "unsupported": "Hintergrundaufträge sind für Ihr Konto nicht verfügbar. Bitten Sie einen Administrator, normale Benutzer zuzulassen.",
+    "disabled": "Der Hintergrundmodus ist aus.",
+    "limit-exceeded": "Die Datei überschreitet das Limit.",
+    "queue-full": "Die Warteschlange ist voll.",
+    "quota-exceeded": "Der Hintergrundspeicher ist voll.",
+    "conflict": "Der Auftragsstatus hat sich geändert. Aktualisieren.",
+    "not_found": "Nicht gefunden.",
+    "denied": "Zugriff verweigert.",
+    "session_required": "Ihre DSM-Sitzung ist abgelaufen. Melden Sie sich erneut an.",
+    "owner-queue-full": "Ihr Limit für offene Aufträge ist erreicht. Warten Sie auf einen Abschluss oder brechen Sie einen Auftrag ab.",
+    "owner-quota-exceeded": "Ihr Speicherlimit ist erreicht. Bitten Sie einen Administrator, alte Aufträge zu löschen.",
+    "identity_unavailable": "Ihre DSM-Benutzer-UID konnte nicht geprüft werden. Melden Sie sich erneut an oder fragen Sie einen Administrator.",
+    "schedule-full": "Maximal 8 Zeitpläne. Löschen Sie einen Zeitplan.",
+    "input-unavailable": "Die private Kopie fehlt oder wurde geändert. Importieren Sie sie erneut."
+  },
+  "ownerScope": "Sie können nur eigene Aufträge sehen, abbrechen und herunterladen.",
+  "adminScope": "Administratoren können Aufträge aller Benutzer sehen und abbrechen.",
+  "ownerLimits": "Pro Benutzer: {jobs} offene Aufträge und {size} KiB für Eingaben und reservierte Ergebnisse.",
+  "allowUsers": "Normale Benutzer zulassen",
+  "blockUsers": "Normale Benutzer sperren",
+  "usersOn": "Normale Benutzer zugelassen",
+  "usersOff": "Normale Benutzer gesperrt",
+  "owner": "Besitzer: {user} (UID {uid})",
+  "purgeOwner": "Aufträge des Besitzers löschen",
+  "purgeConfirm": "Alle Aufträge von {user} (UID {uid}) löschen? Laufende Aufträge werden abgebrochen und beendet; gespeicherte Ergebnisse werden entfernt.",
+  "confirmPurge": "Löschen bestätigen",
+  "keepJobs": "Aufträge behalten",
+  "schedulesTitle": "Zeitpläne",
+  "scheduleHelp": "Die feste private Kopie wird als Paketbenutzer stündlich, täglich oder wöchentlich neu berechnet. Bis zu 8 Zeitpläne. Verpasste Läufe werden protokolliert, nicht nachgeholt.",
+  "scheduleCopy": "Diese Kopie planen",
+  "scheduleSource": "Private Kopie: {name}",
+  "interval": "Wiederholungsintervall",
+  "hourly": "Stündlich",
+  "daily": "Täglich",
+  "weekly": "Wöchentlich",
+  "scheduleConsent": "Ich stimme zu, diese feste Kopie zu speichern und als Paketbenutzer neu zu berechnen. Neue Quelldateien und persönliche ACLs werden nicht gelesen.",
+  "createSchedule": "Zeitplan erstellen",
+  "noSchedules": "Noch keine Zeitpläne",
+  "scheduleOn": "Aktiviert",
+  "scheduleOff": "Deaktiviert",
+  "nextRun": "Nächster Lauf: {time}",
+  "missedRuns": "Verpasste Läufe: {count}",
+  "disableSchedule": "Zeitplan deaktivieren",
+  "deleteSchedule": "Zeitplan löschen",
+  "deleteScheduleConsent": "Zeitplan für {name} löschen? Wartende Jobs werden abgebrochen, laufende Jobs werden gestoppt und abgeschlossen. Fertige Ergebnisse bleiben erhalten.",
+  "confirmDeleteSchedule": "Löschen bestätigen",
+  "enableSchedule": "Zeitplan aktivieren",
+  "enableScheduleConsent": "Zeitplan für {name} mit der aktuellen Worker-Revision aktivieren? Ich stimme der Neuberechnung dieser festen Kopie zu. Frühere Läufe werden nicht wiederholt.",
+  "confirmEnableSchedule": "Aktivierung bestätigen",
+  "revisionChanged": "Die Worker-Revision hat sich geändert. Ein Administrator muss diesen Zeitplan prüfen und ausdrücklich aktivieren.",
+  "scheduledJob": "Geplanter Lauf",
+  "unknownTime": "Unbekannt"
+}