@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go-background/frontend/src/background/i18n/zh-TW.json

@@ -0,0 +1,83 @@
+{
+  "title": "背景工作",
+  "help": "將選取的一個檔案複製到套件內，由套件帳號計算 SHA-256。登出後工作仍會繼續。副本與結果由套件保存，來源權限變動不會收回；再次登入即可查看自己的結果。",
+  "unsupported": "你的帳號無法使用背景工作。請管理員允許一般使用者。",
+  "modeOn": "背景模式已開啟",
+  "modeOff": "背景模式已關閉",
+  "enable": "開啟",
+  "disable": "關閉",
+  "worker": "Worker",
+  "workerRunning": "Worker 正以 {user} 執行",
+  "workerStopped": "Worker 未執行",
+  "chooseFile": "選擇檔案",
+  "chosen": "已選擇的檔案：{path}",
+  "pickerTitle": "選擇要匯入的檔案",
+  "pickerConsent": "選取的檔案會用你目前的 DSM 登入讀取一次並交給背景工作，不會保存授權。",
+  "submit": "匯入並送出",
+  "refresh": "重新整理",
+  "cancel": "取消",
+  "result": "結果",
+  "download": "下載結果",
+  "noJobs": "尚無工作",
+  "state_queued": "排隊中",
+  "state_running": "執行中",
+  "state_succeeded": "成功",
+  "state_failed": "失敗",
+  "state_canceled": "已取消",
+  "state_interrupted": "已中斷",
+  "limits": "每個檔案最多 {size} KiB、佇列 {queue} 個工作、每個工作 {seconds} 秒。",
+  "errors": {
+    "failed": "無法完成要求。請重新整理後再試。",
+    "unsupported": "你的帳號無法使用背景工作。請管理員允許一般使用者。",
+    "disabled": "背景模式已關閉。",
+    "limit-exceeded": "檔案超過上限。",
+    "queue-full": "佇列已滿。",
+    "quota-exceeded": "背景儲存空間已滿。",
+    "conflict": "工作狀態已變更，請重新整理。",
+    "not_found": "找不到。",
+    "denied": "存取被拒絕。",
+    "session_required": "DSM 工作階段已過期，請重新登入。",
+    "owner-queue-full": "你的待處理工作已達上限。請等待完成或取消一個工作。",
+    "owner-quota-exceeded": "你的背景儲存已達上限。請管理員清除舊工作。",
+    "identity_unavailable": "無法確認你的 DSM 使用者 UID。請重新登入或洽管理員。",
+    "schedule-full": "已達 8 個排程上限。請刪除排程。",
+    "input-unavailable": "私有副本不存在或已變更。請重新匯入。"
+  },
+  "ownerScope": "你只能檢視、取消及下載自己的工作。",
+  "adminScope": "管理員可檢視及取消所有使用者的工作。",
+  "ownerLimits": "每人上限：{jobs} 個待處理工作、{size} KiB 輸入與預留結果儲存。",
+  "allowUsers": "允許一般使用者",
+  "blockUsers": "停用一般使用者",
+  "usersOn": "已允許一般使用者",
+  "usersOff": "已停用一般使用者",
+  "owner": "擁有者：{user}（UID {uid}）",
+  "purgeOwner": "清除擁有者的工作",
+  "purgeConfirm": "清除 {user}（UID {uid}）的所有工作？執行中的工作會取消並等待結束；已儲存的結果會移除。",
+  "confirmPurge": "確認清除",
+  "keepJobs": "保留工作",
+  "schedulesTitle": "排程",
+  "scheduleHelp": "由套件帳號每小時、每日或每週重算固定私有副本。最多 8 個排程；錯過的執行只記錄，不補跑。",
+  "scheduleCopy": "排程重跑副本",
+  "scheduleSource": "私有副本：{name}",
+  "interval": "重複間隔",
+  "hourly": "每小時",
+  "daily": "每日",
+  "weekly": "每週",
+  "scheduleConsent": "我同意保留此固定副本，並由套件帳號重算。不讀取新來源檔案或個人 ACL。",
+  "createSchedule": "建立排程",
+  "noSchedules": "尚無排程",
+  "scheduleOn": "已啟用",
+  "scheduleOff": "已停用",
+  "nextRun": "下次執行：{time}",
+  "missedRuns": "錯過執行：{count} 次",
+  "disableSchedule": "停用排程",
+  "deleteSchedule": "刪除排程",
+  "deleteScheduleConsent": "刪除 {name} 的排程？排隊工作會取消，執行中工作會停止並完成收尾。已完成結果保留。",
+  "confirmDeleteSchedule": "確認刪除",
+  "enableSchedule": "啟用排程",
+  "enableScheduleConsent": "使用目前 worker revision 啟用 {name} 的排程？我同意重算此固定副本。不重播過去的執行。",
+  "confirmEnableSchedule": "確認啟用",
+  "revisionChanged": "Worker revision 已變更。管理員須審閱並明確啟用此排程。",
+  "scheduledJob": "排程執行",
+  "unknownTime": "未知"
+}

package/templates/native-go-background/frontend/src/background/i18n.ts

@@ -0,0 +1,19 @@
+import en from './i18n/en.json'
+import zhTW from './i18n/zh-TW.json'
+import zhCN from './i18n/zh-CN.json'
+import ja from './i18n/ja.json'
+import ko from './i18n/ko.json'
+import de from './i18n/de.json'
+import fr from './i18n/fr.json'
+import es from './i18n/es.json'
+import it from './i18n/it.json'
+export type BackgroundCopy=typeof en
+export const backgroundCatalogs:Record<string,BackgroundCopy>={en,'zh-TW':zhTW,'zh-CN':zhCN,ja,ko,de,fr,es,it}
+export function backgroundCopy(locale:string):BackgroundCopy{
+ const aliases:Record<string,string>={enu:'en',cht:'zh-TW',chs:'zh-CN',jpn:'ja',krn:'ko',ger:'de',fre:'fr',spn:'es',ita:'it'}
+ const key=locale.replaceAll('_','-');return backgroundCatalogs[aliases[key]??key]??backgroundCatalogs[key.split('-')[0]]??en
+}
+export function backgroundErrorCopy(e:unknown,copy:BackgroundCopy):string{
+ const code=(e as {code?:string})?.code??''
+ return (copy.errors as Record<string,string>)[code]??copy.errors.failed
+}

package/templates/native-go-background/frontend/src/background/picker-provider.ts

@@ -0,0 +1,13 @@
+import type {Context} from '../context'
+import {createM2Provider} from '../nas/m2-provider'
+import type {M2Provider} from '../nas/m2-contract'
+
+// The shared File Station picker browses through bg.browse, the caller's
+// own session, so a package built without --file-station still has a picker.
+// Confirming a pick stores nothing and grants nothing: submit re-reads the file
+// through the same session. Only the listing and the confirm step are real; the
+// grant and file operations of the full provider are never reached from here.
+export function createBackgroundPickerProvider(ctx:Pick<Context,'call'>):M2Provider{
+ const provider=createM2Provider({call:(method,params)=>ctx.call(method==='nas.discovery'?'bg.browse':method,params)})
+ return {...provider,async confirm(folder,writable){return {grantId:'',folder,writable}}}
+}

package/templates/native-go-background/frontend/test/background.test.ts

@@ -0,0 +1,179 @@
+// @vitest-environment jsdom
+import {readFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {test,expect} from 'vitest'
+import {createApp,h,nextTick} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import BackgroundPanel from '../src/background/BackgroundPanel.vue'
+import {backgroundCatalogs,backgroundCopy} from '../src/background/i18n'
+import {m2Copy} from '../src/nas/m2-i18n'
+// The UI Select is a Reka combobox: drive it by keyboard (the UI README helper), which also proves it is keyboard operable.
+// Attrs such as data-schedule-interval land on the focusable combobox itself.
+async function choose(root:HTMLElement,marker:string,label:string){
+ const trigger=root.querySelector<HTMLElement>(`[${marker}][role=combobox]`)!;expect(trigger,marker).toBeTruthy()
+ expect(trigger.id,marker).toBeTruthy();expect(root.querySelector(`label[for="${trigger.id}"]`),marker).toBeTruthy()
+ trigger.dispatchEvent(new KeyboardEvent('keydown',{key:'ArrowDown',bubbles:true,cancelable:true}));await settle()
+ const option=[...document.querySelectorAll<HTMLElement>('[role=option]')].find(o=>o.textContent?.trim()===label)
+ if(!option||option.getAttribute('aria-disabled')==='true')throw new Error(`No enabled option: ${label}`)
+ option.focus();option.dispatchEvent(new KeyboardEvent('keydown',{key:'Enter',bubbles:true,cancelable:true}));await settle()
+ expect(trigger.textContent).toContain(label)
+}
+async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
+type Call=(method:string,params?:Record<string,unknown>)=>Promise<any>
+function mount(call:Call,locale='en'){
+ const root=document.createElement('div');document.body.append(root)
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(BackgroundPanel,{ctx:{call,locale}}))})
+ app.config.idPrefix=`bg-${Math.random()}`;app.mount(root)
+ return {root,close(){app.unmount();root.remove()}}
+}
+const click=(root:HTMLElement,text:string)=>{const b=[...root.querySelectorAll('button')].find(b=>b.textContent?.trim()===text)!;expect(b).toBeTruthy();b.click()}
+const status=(enabled:boolean)=>({supported:true,enabled,admin:true,allowOrdinaryUsers:false,revision:1,queued:0,running:0,worker:{username:'SynoPkg',alive:true},limits:{maxInputBytes:524288,maxQueued:16,maxOwnerPending:2,maxOwnerBytes:1048576,maxTotalBytes:16777216,jobTimeoutSeconds:60}})
+
+test('non-administrators see unsupported and no action',async()=>{
+ const f=mount(async()=>{throw {code:'unsupported'}});await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').unsupported);expect(f.root.querySelector('button')).toBeNull();f.close()
+})
+const browse=(args?:Record<string,unknown>)=>args?.folder
+ ?{files:[{name:'fixture.bin',path:`${args.folder}/fixture.bin`,isdir:false,additional:{size:3}}],total:1,offset:0}
+ :{shares:[{name:'share',path:'/share',isdir:true}],total:1,offset:0}
+test('enable, pick a file, submit, cancel and result use only bg.* routes',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[];let enabled=false,jobs:any[]=[]
+ const f=mount(async(m,p)=>{
+  calls.push([m,p])
+  switch(m){
+   case 'bg.status':return status(enabled)
+   case 'bg.jobs.list':return {jobs}
+   case 'bg.browse':return browse(p)
+   case 'bg.mode.set':enabled=true;return {enabled}
+   case 'bg.jobs.submit':jobs=[{id:'j1',name:'fixture.bin',state:'queued'}];return {job:jobs[0],duplicate:false}
+   case 'bg.jobs.cancel':jobs=[{...jobs[0],state:'canceled'}];return {job:jobs[0]}
+   case 'bg.jobs.result':return {result:{sha256:'x'}}
+  }
+ });await settle()
+ const copy=backgroundCopy('en'),pick=m2Copy('en')
+ click(f.root,copy.enable);await settle()
+ expect(f.root.querySelector('[data-bg-folder]')).toBeNull();expect(f.root.querySelector('[data-bg-file]')).toBeNull()
+ const submitButton=()=>[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===copy.submit)!
+ expect(submitButton().disabled).toBe(true)
+ click(f.root,copy.chooseFile);await settle()
+ click(f.root,'Open share');await settle()
+ click(f.root,'Select fixture.bin');await settle();click(f.root,pick.confirm);await settle()
+ expect(f.root.textContent).toContain('/share/fixture.bin')
+ expect(submitButton().disabled).toBe(false)
+ click(f.root,copy.submit);await settle()
+ const submit=calls.find(c=>c[0]==='bg.jobs.submit')![1]!
+ expect(submit.folder).toBe('/share');expect(submit.relative).toBe('fixture.bin');expect(typeof submit.key).toBe('string')
+ expect(f.root.querySelector('[data-job-state=queued]')).not.toBeNull()
+ click(f.root,copy.cancel);await settle()
+ expect(f.root.querySelector('[data-job-state=canceled]')).not.toBeNull()
+ expect(calls.filter(c=>c[0]==='bg.browse').length).toBeGreaterThan(0)
+ expect(calls.every(c=>/^bg\./.test(c[0]))).toBe(true)
+ f.close()
+})
+test('a denied listing shows a localized error and cannot submit',async()=>{
+ const f=mount(async(m)=>{
+  if(m==='bg.status')return status(true)
+  if(m==='bg.jobs.list')return {jobs:[]}
+  if(m==='bg.browse')throw {code:'denied',message:'Cookie=CANARY'}
+ });await settle()
+ click(f.root,backgroundCopy('en').chooseFile);await settle()
+ expect(f.root.textContent).toContain(m2Copy('en').errorDenied);expect(f.root.textContent).not.toContain('CANARY')
+ expect([...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===backgroundCopy('en').submit)!.disabled).toBe(true)
+ f.close()
+})
+test('nine locales have identical keys and placeholders',()=>{
+ const en=backgroundCatalogs.en,flat=(o:any,p=''):Record<string,string>=>Object.fromEntries(Object.entries(o).flatMap(([k,v])=>typeof v==='string'?[[p+k,v]]:Object.entries(flat(v,`${p}${k}.`))))
+ const base=flat(en)
+ expect(Object.keys(backgroundCatalogs).sort()).toEqual(['de','en','es','fr','it','ja','ko','zh-CN','zh-TW'])
+ for(const catalog of Object.values(backgroundCatalogs)){
+  const map=flat(catalog);expect(Object.keys(map).sort()).toEqual(Object.keys(base).sort())
+  for(const [k,v] of Object.entries(map)){expect(v.length).toBeGreaterThan(0);expect(v.match(/\{\w+\}/g)??[]).toEqual(base[k].match(/\{\w+\}/g)??[])}
+ }
+})
+
+test('a null job list from the worker renders as no jobs',async()=>{
+ const f=mount(async m=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:null}:{});await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').noJobs);f.close()
+})
+
+test('the picker dialog explains the one-time read, not the M2 saved-selection consent',async()=>{
+ for(const locale of Object.keys(backgroundCatalogs)){
+  const f=mount(async(m,p)=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:[]}:browse(p),locale);await settle()
+  const copy=backgroundCopy(locale)
+  click(f.root,copy.chooseFile);await settle()
+  const dialog=f.root.querySelector('[role=dialog]')!.textContent!
+  expect(dialog).toContain(copy.pickerConsent);expect(dialog).not.toContain(m2Copy(locale).consent)
+  f.close()
+ }
+})
+
+test('ordinary owner can submit but has no administrator controls',async()=>{
+ const calls:string[]=[]
+ const f=mount(async(m,p)=>{calls.push(m);if(m==='bg.status')return {...status(true),admin:false,allowOrdinaryUsers:true};if(m==='bg.jobs.list')return {jobs:[{id:'owned',name:'owned.bin',state:'queued',submitter:{user:'bob',uid:'1025'}}]};if(m==='bg.browse')return browse(p);return {}});await settle()
+ const c=backgroundCopy('en')
+ expect(f.root.textContent).toContain(c.ownerScope)
+ expect(f.root.textContent).not.toContain(c.disable)
+ expect(f.root.textContent).not.toContain(c.allowUsers)
+ expect(f.root.textContent).not.toContain(c.purgeOwner)
+ expect([...f.root.querySelectorAll('button')].some(b=>b.textContent?.trim()===c.chooseFile)).toBe(true)
+ click(f.root,c.cancel);await settle();expect(calls).toContain('bg.jobs.cancel');f.close()
+})
+test('admin ordinary-user switch and exact owner purge require explicit confirmation',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[]
+ const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return {...status(true),admin:true,allowOrdinaryUsers:false};if(m==='bg.jobs.list')return {jobs:[{id:'one',name:'a',state:'succeeded',submitter:{user:'bob',uid:'1025'}}]};return {}});await settle()
+ const c=backgroundCopy('en');click(f.root,c.allowUsers);await settle()
+ expect(calls.find(([m])=>m==='bg.users.set')?.[1]).toEqual({allowOrdinaryUsers:true})
+ click(f.root,c.purgeOwner);await settle();expect(calls.some(([m])=>m==='bg.jobs.purge')).toBe(false)
+ click(f.root,c.confirmPurge);await settle()
+ expect(calls.find(([m])=>m==='bg.jobs.purge')?.[1]).toEqual({owner:{user:'bob',uid:'1025'}});f.close()
+})
+test('malformed status cannot render action controls or crash the panel',async()=>{
+ const f=mount(async()=>({state:'not-enabled'}));await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').errors.failed)
+ expect(f.root.querySelector('button')).toBeNull();f.close()
+})
+
+test('schedule creation requires copy consent; owner controls disable and delete exact schedule',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[];let schedules:any[]=[]
+ const f=mount(async(m,p)=>{calls.push([m,p]);switch(m){
+ case 'bg.status':return {...status(true),owner:{user:'bob',uid:'1025'},admin:false,allowOrdinaryUsers:true}
+ case 'bg.jobs.list':return {jobs:[{id:'import',name:'copy.bin',state:'succeeded',copyRetained:true,submitter:{user:'bob',uid:'1025'}}]}
+ case 'bg.schedules.list':return {schedules}
+ case 'bg.schedules.create':schedules=[{id:'schedule',name:'copy.bin',owner:{user:'bob',uid:'1025'},enabled:true,intervalSeconds:3600,nextAt:'2026-10-05T01:00:00Z',missed:0,workerRevision:1}];return {schedule:schedules[0]}
+ case 'bg.schedules.disable':schedules=[{...schedules[0],enabled:false}];return {schedule:schedules[0]}
+ case 'bg.schedules.delete':schedules=[];return {deleted:true}
+ default:return {}
+ }});await settle();const c=backgroundCopy('en')
+ click(f.root,c.scheduleCopy);await settle()
+ expect(calls.some(([m])=>m==='bg.schedules.create')).toBe(false)
+ const create=[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===c.createSchedule)!
+ expect(create.disabled).toBe(true)
+ await choose(f.root,'data-schedule-interval',c.weekly)
+ const consent=f.root.querySelector<HTMLElement>('[data-schedule-consent] [role=checkbox], [role=checkbox][data-schedule-consent]')!;consent.click();await settle()
+ click(f.root,c.createSchedule);await settle()
+ expect(calls.find(([m])=>m==='bg.schedules.create')?.[1]).toMatchObject({jobId:'import',intervalSeconds:604800,consent:true})
+ expect(f.root.querySelector('[data-schedule-id=schedule]')?.textContent).toContain(c.nextRun.replace('{time}','').trim().split(':')[0])
+ click(f.root,c.disableSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.disable')?.[1]).toEqual({id:'schedule'})
+ click(f.root,c.deleteSchedule);await settle();expect(calls.some(([m])=>m==='bg.schedules.delete')).toBe(false)
+ click(f.root,c.confirmDeleteSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.delete')?.[1]).toEqual({id:'schedule'});f.close()
+})
+
+test('administrator sees the exact selected copy before enabling a schedule',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[]
+ const name='private-'.padEnd(128,'x')
+ const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return status(true);if(m==='bg.jobs.list')return {jobs:[]};if(m==='bg.schedules.list')return {schedules:[{id:'disabled',name,owner:{user:'normal1',uid:'1025'},enabled:false,nextAt:'2026-10-05T01:00:00Z',missed:0}]};return {}});await settle()
+ const c=backgroundCopy('en');click(f.root,c.enableSchedule);await settle()
+ const expected=c.enableScheduleConsent.replace('{name}',name)
+ expect(expected).toContain(name);expect(f.root.textContent).toContain(expected)
+ expect(calls.some(([m])=>m==='bg.schedules.enable')).toBe(false)
+ click(f.root,c.confirmEnableSchedule);await settle()
+ expect(calls.find(([m])=>m==='bg.schedules.enable')?.[1]).toEqual({id:'disabled',consent:true});f.close()
+})
+
+// Same rule as the base template (test/native-controls.test.ts): UI components only, and the
+// UI's own Form auto layout and FormItem id binding instead of per-app workarounds.
+test('the background panel uses only UI components and the UI form binding',()=>{
+ const template=readFileSync(join(__dirname,'../src/background/BackgroundPanel.vue'),'utf8').replace(/<script[\s\S]*?<\/script>/g,'').replace(/<style[\s\S]*?<\/style>/g,'')
+ expect(template.match(/<(?:a|input|select|textarea|label)[\s>/]/g)).toBeNull()
+ expect(template).not.toMatch(/direction="vertical"|field\.controlId|role="group"/)
+})

package/templates/native-go-integration/backend/internal/app/personal.go

@@ -22,11 +22,11 @@ import (
 // The client may send an opaque ID, never a user name, UID or filesystem path.
 var personalLookup = user.Lookup
 var integrationHealth = func(ctx context.Context, cfg Config) helper.State {
-	return helper.NewClient(cfg.HelperInventory).Status(ctx)
+	return cfg.integrationState(ctx)
 }
 
 func (cfg Config) integrationRoutes() []api.Route {
-	if cfg.HelperInventory.Protocol != 1 {
+	if !cfg.PackageIntegration && cfg.HelperInventory.Protocol != 1 {
 		return nil
 	}
 	return append([]api.Route{api.User("personal.list", cfg.personalList), api.User("personal.read", cfg.personalRead), api.User("personal.write", cfg.personalWrite)}, cfg.identityRoutes()...)

package/templates/native-go-integration/backend/internal/app/personal_test.go

@@ -68,6 +68,43 @@ func TestPersonalUsersReadWriteAndMutuallyRefuse(t *testing.T) {
 		t.Fatal(code)
 	}
 }
+// Package-only integration has no helper: the sample stays package-owned data
+// and never waits for a helper health check.
+func TestPackageOnlyPersonalDataNeedsNoHelper(t *testing.T) {
+	oldLookup := personalLookup
+	personalLookup = func(name string) (*user.User, error) {
+		return &user.User{Username: name, Uid: map[string]string{"normal1": "1001", "normal2": "1002"}[name], Gid: "100"}, nil
+	}
+	t.Cleanup(func() { personalLookup = oldLookup })
+	cfg := testConfig(t)
+	cfg.PackageIntegration = true
+	if cfg.HelperInventory != (helper.Inventory{}) {
+		t.Fatal("fixture must have no helper inventory")
+	}
+	first, second := personalHandle(t, cfg, "normal1"), personalHandle(t, cfg, "normal2")
+	if first == second {
+		t.Fatal("handles must bind caller")
+	}
+	if code, out := personalCall(t, cfg, "normal1", "personal.write", `{"id":"`+first+`","text":"mine"}`); code != "" {
+		t.Fatal(code, out)
+	}
+	if code, out := personalCall(t, cfg, "normal1", "personal.read", `{"id":"`+first+`"}`); code != "" || out["data"].(map[string]any)["text"] != "mine" {
+		t.Fatal(code, out)
+	}
+	if code, _ := personalCall(t, cfg, "normal2", "personal.read", `{"id":"`+first+`"}`); code != "access_denied" {
+		t.Fatal(code)
+	}
+}
+
+// Without package-only mode and without an approved helper nothing is served:
+// a helper build whose inventory failed to load stays closed.
+func TestHelperlessConfigWithoutPackageModeServesNoPersonalRoutes(t *testing.T) {
+	cfg := testConfig(t)
+	if routes := cfg.integrationRoutes(); len(routes) != 0 {
+		t.Fatalf("%d routes", len(routes))
+	}
+}
+
 func TestPersonalRejectsForgedIdentityAndPaths(t *testing.T) {
 	cfg := personalFixture(t)
 	id := personalHandle(t, cfg, "normal1")

package/templates/native-go-vue/README.md

@@ -1,6 +1,6 @@
 # __DISPLAY_NAME__ — Vue DSM package
 
-This is the existing native-go template with the shared UI **0.4.0**. It uses
+This is the existing native-go template with the shared UI **0.5.7**. It uses
 AppRoot, the DSM embedded theme, Dialog, SettingsSection, Callout and existing
 controls. The generated `dsm-package.yaml` remains the only package manifest.
 
@@ -14,7 +14,7 @@ synopkgland build-spk
 synopkgland inspect --spk dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 ```
 
-The pinned `@synopackageland/ui@0.4.0` dependency is public on
+The pinned `@synopackageland/ui@0.5.7` dependency is public on
 `https://registry.npmjs.org`, selected by `frontend/.npmrc`. No registry account
 or credentials are required. Dependencies are installed and UI bundled on the
 build machine; the NAS never downloads npm packages. Commit your lockfiles.
@@ -37,8 +37,12 @@ first, verify the helper is no longer ready, then Stop the package. V1 found
 this on a real NAS; the M1e investigation is ongoing.
 
 Generate with `synopkgland init -t native-go --ui vue --integration go <dir>`.
-This automatically chooses root privilege and adds only the existing M1a
-`integration: {protocol: 1, workers: {}}` contract. The native-go baseline without
+This keeps `privilege: none`: the private note and status screen run as the
+package account, with no helper, scheduler task or precheck hook, and
+`integration.status` reports `ready / package-only`. Add `--privilege root` to
+get the privileged helper described below (the existing M1a
+`integration: {protocol: 1, workers: {}}` contract). The helper brings only its
+five `helper_*` tasks, not the `whoami` demo. The native-go baseline without
 these options remains unchanged. Vue alone keeps the original Go 1.24 module;
 integration uses Go **1.25+** for fd-rooted atomic storage updates.
 
@@ -67,7 +71,7 @@ version history or general filesystem permission is implied.
 ## NAS picker and grants (S4 mock preview)
 
 The Vue template includes `NasPathPicker` and `NasGrantSettings`, built from UI
-0.4.0's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
+0.5.7's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
 browser `FilePicker` still represents local `File[]`; NAS selections return
 opaque directory grant handles. The new UI has catalogs for en, zh-TW, zh-CN,
 ja, ko, de, fr, es and it, selected from `ctx.locale` with English fallback.
@@ -142,7 +146,7 @@ clears instance/session state and stale reopen callbacks become no-ops.
 IDs, overlay roots, reopen/unmount, errors and empty data with jsdom. Real
 unsigned artifact tests additionally cross-compile Go and bundle UI/Node.
 
-UI **0.4.0** enables `<AppRoot modal-scope="app">`. Each mount assigns a
+UI **0.5.7** enables `<AppRoot modal-scope="app">`. Each mount assigns a
 package-prefixed, instance-unique Vue `idPrefix` before mounting. The sizing
 class on the mount element fills the existing bounded DSM fit-layout body;
 AppRoot fills that element and owns the background scroll container and local
@@ -189,7 +193,7 @@ isolated Linux systemd VM evidence; DSM 4.4 acceptance is still unknown.
 ## M2 S1R build policy and unavailable delivery
 
 The S8 source candidate also accepts `--integration-protocol 2` with
-`--integration go` or `better-auth`. The default stays protocol 1. The manifest,
+`--integration go` or `better-auth`, and only together with `--privilege root`. The default stays protocol 1. The manifest,
 compiled helper/CGI inventory, payload/worker digests, inspector and lifecycle
 approval pin the same protocol. A change requires exact new approval, never
 protocol 1 data fallback.
@@ -222,3 +226,30 @@ Anonymous/expired DSM sessions return `session_required`; authentication failure
 returns `auth_unavailable`. Relogin restores only the ordinary app session.
 Positive NAS functionality, ACL and final DSM SPK acceptance remain blocked /
 unknown; local refusal and QEMU fixtures do not certify them.
+
+
+## Interactive jobs after an observer pause
+
+The opt-in workers session API refuses requests with `revalidating` while the
+existing bounded reload/query observer checks are pending. Admission stays
+closed, running jobs are conservatively canceled, and no attach lease is
+extended. Sticky fences still return `fenced`. After a valid session-mode status
+reply confirms recovery, new submissions can proceed; canceled jobs never resume.
+
+JobsPanel keeps the revalidation message until recovery is confirmed and explains
+`canceled` jobs with `safeReason: "fenced"` in all nine locales. Resubmit is an
+explicit user action: the connected provider uses a mount-local plan snapshot
+and calls fresh prepare/submit for a new intent and job ID, rechecking permissions.
+There is no automatic resubmission. A lost submit reply locks further submission
+and offers lookup of the new intent. Reopening the view loses the local plan;
+select inputs again instead of inferring them from history. Existing initial
+picker/submission form wiring remains outside this template.
+
+See `docs/m3-adapt-simple-session-jobs.md` in the SDK repository for the full
+contract and the distinction between local evidence and DSM acceptance.
+
+## Interactive NAS picker and job submission
+
+For the opt-in SDK-workers entry, see [frontend/README-JOBS.md](frontend/README-JOBS.md).
+It connects the existing File Station folder/file picker, session selection and
+fixed read plan to prepare/submit, progress, cancel and explicit fenced resubmission.

package/templates/native-go-vue/frontend/DESIGN.md

@@ -1,6 +1,6 @@
 ---
 name: Native DSM Vue integration template
-description: Existing package settings UI using Syno Package Land UI 0.4.0.
+description: Existing package settings UI using Syno Package Land UI 0.5.7.
 typography:
   body:
     fontFamily: "var(--ui-font-sans)"
@@ -24,7 +24,7 @@ spacing:
 
 This records the built template, not a new visual identity. The settings surface operates inside a DSM package window: users inspect integration health, administrators approve maintenance operations, and each account edits its own synthetic sample note. Its usage mode is **Operate**; preserve the compact, readable hierarchy and existing native component behavior.
 
-Visual authority is `@synopackageland/ui` **0.4.0**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
+Visual authority is `@synopackageland/ui` **0.5.7**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
 
 ## Colors
 
@@ -56,7 +56,7 @@ The application adds no shadows or elevation system. Surface, overlay and dialog
 - **Loading, empty and mutation states:** Refresh and mutations disable competing controls; the main region exposes `aria-busy` and textual status. Failed status loading offers Refresh. A ready integration with no note ID shows the “No sample data” Callout. A labeled Textarea and Save button appear when a note exists. Completion notices use `role=status`; error copy uses `role=alert` and identifies a recovery action. Optional app identity appears only when its route reports `better-auth`.
 - **Dialog:** Disable opens the library confirmation dialog, explains refusal of new requests and retention of existing data/output, and presents Cancel plus danger Confirm disable. No application modal replacement is provided.
 
-**App-local modality:** consume UI 0.4.0's `AppRoot modal-scope="app"`.
+**App-local modality:** consume UI 0.5.7's `AppRoot modal-scope="app"`.
 Each independent mount sets a package-prefixed, unique Vue `idPrefix` before
 mounting. The mount sizing class and AppRoot use `height: 100%` inside the
 existing bounded DSM fit-layout body. AppRoot owns background scrolling and
@@ -70,9 +70,21 @@ custom out-of-root portals. Other UI versions/modal libraries, Safari/iOS and
 manual screen-reader acceptance remain unvalidated. Test the generated final
 SPK on DSM separately from local jsdom/Chromium evidence.
 
+### Opt-in background schedules (S1-a)
+
+The `native-go-background` overlay extends this **Operate** surface within the inherited `AppRoot`, embedded theme, `SettingsSection`, Button and Callout system. It introduces no new palette or global tokens.
+
+- **Private-copy consent:** “Schedule this copy” is available for the signed-in owner's retained, successful, unscheduled job copy. “Private copy: {name}” identifies the input; “Repeat every” offers “Hour”, “Day” and “Week”. “Create schedule” stays disabled until the user checks “I agree to keep and reprocess this fixed copy as the package user. No new source files or personal ACLs are read.” The help explains the eight-schedule limit and that missed runs are recorded, never replayed.
+- **Ownership and recovery:** preserve user-and-UID owner isolation. Administrator rows expose “Owner: {user} (UID {uid})”. A worker change shows “The worker revision changed. An administrator must review and explicitly enable this schedule.” Only administrators, while background mode is on, see “Enable schedule”. Its confirmation names the exact private copy: “Enable the schedule for {name} with the current worker revision? I agree to reprocess this fixed copy. Past runs will not be replayed.” Actions are “Confirm enable” and “Cancel”.
+- **Layout:** schedule name/state, owner, next run, missed runs and warnings stack above a grouped, wrapping action row. Long names and copy wrap within the available width. Keep the inherited vertical scrolling at the minimum window size; do not squeeze schedules into one viewport. The labeled select and consent checkbox retain visible keyboard focus using existing theme tokens.
+- **Errors and cleanup:** danger alerts map known error codes to localized safe copy, with a localized fallback rather than raw server text. The catalogs cover nine locales. Preserve per-mount disposal: stop polling, dispose the picker, revoke result download URLs and prevent pending responses from restoring disposed state. Deletion confirmation explains that queued jobs cancel, running jobs drain and finished results remain.
+
+Evidence: `.herdr-project/syno-package-land-sdk-t-0129/library/ui-desktop.png` and `ui-minimum.png` are local component-fixture captures. The finish review disposition is **ship**, with all three material findings resolved. A fresh `normal1` NAS browser readback passed before the final UI adjustments; these captures validate the final adjustments locally and do not establish final DSM visual acceptance.
+
 ## Do's and Don'ts
 
 - Do use existing public UI components, embedded theme tokens and state/recovery copy.
 - Do retain permission gating, readable loading/empty/error states and per-instance cleanup.
+- Do use the library's `Select`, `Checkbox`, `Input`, `Textarea`, `Form`, `FormItem`, `FilePicker` (`variant="compact"`, in the app locale) and `Link` for controls; there is no native `<input>` or `<a>`. Leave `Form` on its automatic direction (labels stack below 520px of container width) and let a `FormItem` bind its control, with no `direction="vertical"`, `role="group"` or `field.controlId`.
 - Don't claim trusted helper readiness from scheduler values or treat app identity as native session/filesystem authorization.
 - Don't introduce a separate palette, component system or modal workaround around the library contract.

package/templates/native-go-vue/frontend/README-JOBS.md

@@ -0,0 +1,75 @@
+# Interactive NAS picker → job (experimental)
+
+Use the existing `native-go --ui vue --integration go` project, then opt in to
+protocol 2, relaxed File Station session access and a fixed SDK read worker:
+
+```yaml
+integration:
+  protocol: 2
+  dataAccess: relaxed
+  workers: {}
+  sdkWorkers:
+    scan:
+      kind: sdk-read-plan
+      workerRevision: 1
+      actions: [nas.files.list, nas.files.stat, nas.files.read]
+      modes: [interactive]
+```
+
+Install frontend dependencies and run `synopkgland build-spk` as usual. The
+builder sets `SYNOPKGLAND_SDK_WORKERS=1` from the manifest and chooses
+`src/sdk-main.ts`. Leave `SYNOPKGLAND_M2_SIMPLE` unset: that flag deliberately
+selects the separate session-only file-operation entry without job controls.
+For a standalone frontend check use `SYNOPKGLAND_SDK_WORKERS=1 npm run build`.
+
+An administrator uses the existing exact-payload approval and activation flow.
+The session SDK surface hides the native personal-note sample, whose routes
+are absent from this protocol-2 build.
+Each user opens the package in their own DSM session. The jobs panel enables
+the source picker only after a fresh `jobs.status` reports session availability.
+Choose a file or folder, confirm selection, select the worker and operation,
+set its bound where required, then submit once. Progress refreshes every 2.5 s
+while this page contains active jobs; errors stop polling and require Refresh.
+Cancel uses the existing owner/revision checks. Closing the window requests
+cancellation and stops renewal. Observer revalidation pauses submission;
+fenced jobs stay canceled and require an explicit fresh submission after
+recovery. Nothing resumes or retries automatically.
+
+`jobs.status.workers` projects only interactive workers with session-supported
+list/stat/read actions, exact registry revision and the smaller of the worker's
+bounded/total byte limits and 512 KiB. It contains no compiled bindings or
+credentials. This is display metadata: prepare still verifies the registry,
+selection, session and current permissions. Missing metadata in an older owner
+leaves the form disabled. The form submits one step; list is 1–100 entries,
+read is 1–the projected byte limit, and stat has no byte/entry argument.
+This read-only worker requires no destination and discards content, returning
+only counters. Background jobs remain unsupported even if the manifest lists
+background mode. Writes and custom executables are not part of this form.
+
+`M2PathPicker` extends the existing Dialog/TreeView/DataGrid composition with
+`select-files` and `read-only` props and a `source` event (`M2JobSource`). Folder
+picks return an empty segment list. File picks call the existing
+`nas.grants.confirm` for the containing folder with `writable:false`, then use
+one relative filename in `jobs.prepare.input`. The `folder` grant therefore
+records consent for that containing folder, not a file-only authority. Existing
+folder-only consumers and their `selected` event are unchanged. These selections
+remain path based; they do not pin inodes or confine symlink/rename races.
+
+The SDK mount provides both `M2ProviderKey` and `JobsProviderKey` per window.
+`JobsProvider.interactive` exposes `workers`, `prepareInteractive` and
+`submitInteractive`; applications can reuse this interface with their own form.
+Transport stays in the existing `ctx.call`, which carries the current DSM
+session and CSRF token. Never put credentials in form fields, persistent
+storage, logs or an administrator-session fallback.
+
+A missing submit reply freezes the form with its original intent. **Check
+original job** calls `jobs.lookup`; it never submits or acquires a replacement
+lease. If the job is found, status shows its actual outcome. Without the lost
+attach receipt it may expire after 6 s. Unmount or an account/package change
+clears selection and pending input, disconnects the provider, and discards late
+responses. Refreshing cannot certify remote rollback or completed cleanup.
+The attach contract remains 2 s renewal / 6 s TTL.
+
+Nine catalogs cover en, zh-TW, zh-CN, ja, ko, de, fr, es and it via `ctx.locale`.
+Unit and browser fixtures are synthetic; DSM compatibility must be established
+on the final generated SPK with each user's session and File Station permissions.