@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go-background/frontend/test/background.test.ts

@@ -0,0 +1,179 @@
+// @vitest-environment jsdom
+import {readFileSync} from 'node:fs'
+import {join} from 'node:path'
+import {test,expect} from 'vitest'
+import {createApp,h,nextTick} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import BackgroundPanel from '../src/background/BackgroundPanel.vue'
+import {backgroundCatalogs,backgroundCopy} from '../src/background/i18n'
+import {m2Copy} from '../src/nas/m2-i18n'
+// The UI Select is a Reka combobox: drive it by keyboard (the UI README helper), which also proves it is keyboard operable.
+// Attrs such as data-schedule-interval land on the focusable combobox itself.
+async function choose(root:HTMLElement,marker:string,label:string){
+ const trigger=root.querySelector<HTMLElement>(`[${marker}][role=combobox]`)!;expect(trigger,marker).toBeTruthy()
+ expect(trigger.id,marker).toBeTruthy();expect(root.querySelector(`label[for="${trigger.id}"]`),marker).toBeTruthy()
+ trigger.dispatchEvent(new KeyboardEvent('keydown',{key:'ArrowDown',bubbles:true,cancelable:true}));await settle()
+ const option=[...document.querySelectorAll<HTMLElement>('[role=option]')].find(o=>o.textContent?.trim()===label)
+ if(!option||option.getAttribute('aria-disabled')==='true')throw new Error(`No enabled option: ${label}`)
+ option.focus();option.dispatchEvent(new KeyboardEvent('keydown',{key:'Enter',bubbles:true,cancelable:true}));await settle()
+ expect(trigger.textContent).toContain(label)
+}
+async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
+type Call=(method:string,params?:Record<string,unknown>)=>Promise<any>
+function mount(call:Call,locale='en'){
+ const root=document.createElement('div');document.body.append(root)
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(BackgroundPanel,{ctx:{call,locale}}))})
+ app.config.idPrefix=`bg-${Math.random()}`;app.mount(root)
+ return {root,close(){app.unmount();root.remove()}}
+}
+const click=(root:HTMLElement,text:string)=>{const b=[...root.querySelectorAll('button')].find(b=>b.textContent?.trim()===text)!;expect(b).toBeTruthy();b.click()}
+const status=(enabled:boolean)=>({supported:true,enabled,admin:true,allowOrdinaryUsers:false,revision:1,queued:0,running:0,worker:{username:'SynoPkg',alive:true},limits:{maxInputBytes:524288,maxQueued:16,maxOwnerPending:2,maxOwnerBytes:1048576,maxTotalBytes:16777216,jobTimeoutSeconds:60}})
+
+test('non-administrators see unsupported and no action',async()=>{
+ const f=mount(async()=>{throw {code:'unsupported'}});await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').unsupported);expect(f.root.querySelector('button')).toBeNull();f.close()
+})
+const browse=(args?:Record<string,unknown>)=>args?.folder
+ ?{files:[{name:'fixture.bin',path:`${args.folder}/fixture.bin`,isdir:false,additional:{size:3}}],total:1,offset:0}
+ :{shares:[{name:'share',path:'/share',isdir:true}],total:1,offset:0}
+test('enable, pick a file, submit, cancel and result use only bg.* routes',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[];let enabled=false,jobs:any[]=[]
+ const f=mount(async(m,p)=>{
+  calls.push([m,p])
+  switch(m){
+   case 'bg.status':return status(enabled)
+   case 'bg.jobs.list':return {jobs}
+   case 'bg.browse':return browse(p)
+   case 'bg.mode.set':enabled=true;return {enabled}
+   case 'bg.jobs.submit':jobs=[{id:'j1',name:'fixture.bin',state:'queued'}];return {job:jobs[0],duplicate:false}
+   case 'bg.jobs.cancel':jobs=[{...jobs[0],state:'canceled'}];return {job:jobs[0]}
+   case 'bg.jobs.result':return {result:{sha256:'x'}}
+  }
+ });await settle()
+ const copy=backgroundCopy('en'),pick=m2Copy('en')
+ click(f.root,copy.enable);await settle()
+ expect(f.root.querySelector('[data-bg-folder]')).toBeNull();expect(f.root.querySelector('[data-bg-file]')).toBeNull()
+ const submitButton=()=>[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===copy.submit)!
+ expect(submitButton().disabled).toBe(true)
+ click(f.root,copy.chooseFile);await settle()
+ click(f.root,'Open share');await settle()
+ click(f.root,'Select fixture.bin');await settle();click(f.root,pick.confirm);await settle()
+ expect(f.root.textContent).toContain('/share/fixture.bin')
+ expect(submitButton().disabled).toBe(false)
+ click(f.root,copy.submit);await settle()
+ const submit=calls.find(c=>c[0]==='bg.jobs.submit')![1]!
+ expect(submit.folder).toBe('/share');expect(submit.relative).toBe('fixture.bin');expect(typeof submit.key).toBe('string')
+ expect(f.root.querySelector('[data-job-state=queued]')).not.toBeNull()
+ click(f.root,copy.cancel);await settle()
+ expect(f.root.querySelector('[data-job-state=canceled]')).not.toBeNull()
+ expect(calls.filter(c=>c[0]==='bg.browse').length).toBeGreaterThan(0)
+ expect(calls.every(c=>/^bg\./.test(c[0]))).toBe(true)
+ f.close()
+})
+test('a denied listing shows a localized error and cannot submit',async()=>{
+ const f=mount(async(m)=>{
+  if(m==='bg.status')return status(true)
+  if(m==='bg.jobs.list')return {jobs:[]}
+  if(m==='bg.browse')throw {code:'denied',message:'Cookie=CANARY'}
+ });await settle()
+ click(f.root,backgroundCopy('en').chooseFile);await settle()
+ expect(f.root.textContent).toContain(m2Copy('en').errorDenied);expect(f.root.textContent).not.toContain('CANARY')
+ expect([...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===backgroundCopy('en').submit)!.disabled).toBe(true)
+ f.close()
+})
+test('nine locales have identical keys and placeholders',()=>{
+ const en=backgroundCatalogs.en,flat=(o:any,p=''):Record<string,string>=>Object.fromEntries(Object.entries(o).flatMap(([k,v])=>typeof v==='string'?[[p+k,v]]:Object.entries(flat(v,`${p}${k}.`))))
+ const base=flat(en)
+ expect(Object.keys(backgroundCatalogs).sort()).toEqual(['de','en','es','fr','it','ja','ko','zh-CN','zh-TW'])
+ for(const catalog of Object.values(backgroundCatalogs)){
+  const map=flat(catalog);expect(Object.keys(map).sort()).toEqual(Object.keys(base).sort())
+  for(const [k,v] of Object.entries(map)){expect(v.length).toBeGreaterThan(0);expect(v.match(/\{\w+\}/g)??[]).toEqual(base[k].match(/\{\w+\}/g)??[])}
+ }
+})
+
+test('a null job list from the worker renders as no jobs',async()=>{
+ const f=mount(async m=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:null}:{});await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').noJobs);f.close()
+})
+
+test('the picker dialog explains the one-time read, not the M2 saved-selection consent',async()=>{
+ for(const locale of Object.keys(backgroundCatalogs)){
+  const f=mount(async(m,p)=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:[]}:browse(p),locale);await settle()
+  const copy=backgroundCopy(locale)
+  click(f.root,copy.chooseFile);await settle()
+  const dialog=f.root.querySelector('[role=dialog]')!.textContent!
+  expect(dialog).toContain(copy.pickerConsent);expect(dialog).not.toContain(m2Copy(locale).consent)
+  f.close()
+ }
+})
+
+test('ordinary owner can submit but has no administrator controls',async()=>{
+ const calls:string[]=[]
+ const f=mount(async(m,p)=>{calls.push(m);if(m==='bg.status')return {...status(true),admin:false,allowOrdinaryUsers:true};if(m==='bg.jobs.list')return {jobs:[{id:'owned',name:'owned.bin',state:'queued',submitter:{user:'bob',uid:'1025'}}]};if(m==='bg.browse')return browse(p);return {}});await settle()
+ const c=backgroundCopy('en')
+ expect(f.root.textContent).toContain(c.ownerScope)
+ expect(f.root.textContent).not.toContain(c.disable)
+ expect(f.root.textContent).not.toContain(c.allowUsers)
+ expect(f.root.textContent).not.toContain(c.purgeOwner)
+ expect([...f.root.querySelectorAll('button')].some(b=>b.textContent?.trim()===c.chooseFile)).toBe(true)
+ click(f.root,c.cancel);await settle();expect(calls).toContain('bg.jobs.cancel');f.close()
+})
+test('admin ordinary-user switch and exact owner purge require explicit confirmation',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[]
+ const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return {...status(true),admin:true,allowOrdinaryUsers:false};if(m==='bg.jobs.list')return {jobs:[{id:'one',name:'a',state:'succeeded',submitter:{user:'bob',uid:'1025'}}]};return {}});await settle()
+ const c=backgroundCopy('en');click(f.root,c.allowUsers);await settle()
+ expect(calls.find(([m])=>m==='bg.users.set')?.[1]).toEqual({allowOrdinaryUsers:true})
+ click(f.root,c.purgeOwner);await settle();expect(calls.some(([m])=>m==='bg.jobs.purge')).toBe(false)
+ click(f.root,c.confirmPurge);await settle()
+ expect(calls.find(([m])=>m==='bg.jobs.purge')?.[1]).toEqual({owner:{user:'bob',uid:'1025'}});f.close()
+})
+test('malformed status cannot render action controls or crash the panel',async()=>{
+ const f=mount(async()=>({state:'not-enabled'}));await settle()
+ expect(f.root.textContent).toContain(backgroundCopy('en').errors.failed)
+ expect(f.root.querySelector('button')).toBeNull();f.close()
+})
+
+test('schedule creation requires copy consent; owner controls disable and delete exact schedule',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[];let schedules:any[]=[]
+ const f=mount(async(m,p)=>{calls.push([m,p]);switch(m){
+ case 'bg.status':return {...status(true),owner:{user:'bob',uid:'1025'},admin:false,allowOrdinaryUsers:true}
+ case 'bg.jobs.list':return {jobs:[{id:'import',name:'copy.bin',state:'succeeded',copyRetained:true,submitter:{user:'bob',uid:'1025'}}]}
+ case 'bg.schedules.list':return {schedules}
+ case 'bg.schedules.create':schedules=[{id:'schedule',name:'copy.bin',owner:{user:'bob',uid:'1025'},enabled:true,intervalSeconds:3600,nextAt:'2026-10-05T01:00:00Z',missed:0,workerRevision:1}];return {schedule:schedules[0]}
+ case 'bg.schedules.disable':schedules=[{...schedules[0],enabled:false}];return {schedule:schedules[0]}
+ case 'bg.schedules.delete':schedules=[];return {deleted:true}
+ default:return {}
+ }});await settle();const c=backgroundCopy('en')
+ click(f.root,c.scheduleCopy);await settle()
+ expect(calls.some(([m])=>m==='bg.schedules.create')).toBe(false)
+ const create=[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===c.createSchedule)!
+ expect(create.disabled).toBe(true)
+ await choose(f.root,'data-schedule-interval',c.weekly)
+ const consent=f.root.querySelector<HTMLElement>('[data-schedule-consent] [role=checkbox], [role=checkbox][data-schedule-consent]')!;consent.click();await settle()
+ click(f.root,c.createSchedule);await settle()
+ expect(calls.find(([m])=>m==='bg.schedules.create')?.[1]).toMatchObject({jobId:'import',intervalSeconds:604800,consent:true})
+ expect(f.root.querySelector('[data-schedule-id=schedule]')?.textContent).toContain(c.nextRun.replace('{time}','').trim().split(':')[0])
+ click(f.root,c.disableSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.disable')?.[1]).toEqual({id:'schedule'})
+ click(f.root,c.deleteSchedule);await settle();expect(calls.some(([m])=>m==='bg.schedules.delete')).toBe(false)
+ click(f.root,c.confirmDeleteSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.delete')?.[1]).toEqual({id:'schedule'});f.close()
+})
+
+test('administrator sees the exact selected copy before enabling a schedule',async()=>{
+ const calls:Array<[string,Record<string,unknown>|undefined]>=[]
+ const name='private-'.padEnd(128,'x')
+ const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return status(true);if(m==='bg.jobs.list')return {jobs:[]};if(m==='bg.schedules.list')return {schedules:[{id:'disabled',name,owner:{user:'normal1',uid:'1025'},enabled:false,nextAt:'2026-10-05T01:00:00Z',missed:0}]};return {}});await settle()
+ const c=backgroundCopy('en');click(f.root,c.enableSchedule);await settle()
+ const expected=c.enableScheduleConsent.replace('{name}',name)
+ expect(expected).toContain(name);expect(f.root.textContent).toContain(expected)
+ expect(calls.some(([m])=>m==='bg.schedules.enable')).toBe(false)
+ click(f.root,c.confirmEnableSchedule);await settle()
+ expect(calls.find(([m])=>m==='bg.schedules.enable')?.[1]).toEqual({id:'disabled',consent:true});f.close()
+})
+
+// Same rule as the base template (test/native-controls.test.ts): UI components only, and the
+// UI's own Form auto layout and FormItem id binding instead of per-app workarounds.
+test('the background panel uses only UI components and the UI form binding',()=>{
+ const template=readFileSync(join(__dirname,'../src/background/BackgroundPanel.vue'),'utf8').replace(/<script[\s\S]*?<\/script>/g,'').replace(/<style[\s\S]*?<\/style>/g,'')
+ expect(template.match(/<(?:a|input|select|textarea|label)[\s>/]/g)).toBeNull()
+ expect(template).not.toMatch(/direction="vertical"|field\.controlId|role="group"/)
+})

package/templates/native-go-integration/backend/internal/app/personal.go

@@ -22,11 +22,11 @@ import (
 // The client may send an opaque ID, never a user name, UID or filesystem path.
 var personalLookup = user.Lookup
 var integrationHealth = func(ctx context.Context, cfg Config) helper.State {
-	return helper.NewClient(cfg.HelperInventory).Status(ctx)
+	return cfg.integrationState(ctx)
 }
 
 func (cfg Config) integrationRoutes() []api.Route {
-	if cfg.HelperInventory.Protocol != 1 {
+	if !cfg.PackageIntegration && cfg.HelperInventory.Protocol != 1 {
 		return nil
 	}
 	return append([]api.Route{api.User("personal.list", cfg.personalList), api.User("personal.read", cfg.personalRead), api.User("personal.write", cfg.personalWrite)}, cfg.identityRoutes()...)

package/templates/native-go-integration/backend/internal/app/personal_test.go

@@ -68,6 +68,43 @@ func TestPersonalUsersReadWriteAndMutuallyRefuse(t *testing.T) {
 		t.Fatal(code)
 	}
 }
+// Package-only integration has no helper: the sample stays package-owned data
+// and never waits for a helper health check.
+func TestPackageOnlyPersonalDataNeedsNoHelper(t *testing.T) {
+	oldLookup := personalLookup
+	personalLookup = func(name string) (*user.User, error) {
+		return &user.User{Username: name, Uid: map[string]string{"normal1": "1001", "normal2": "1002"}[name], Gid: "100"}, nil
+	}
+	t.Cleanup(func() { personalLookup = oldLookup })
+	cfg := testConfig(t)
+	cfg.PackageIntegration = true
+	if cfg.HelperInventory != (helper.Inventory{}) {
+		t.Fatal("fixture must have no helper inventory")
+	}
+	first, second := personalHandle(t, cfg, "normal1"), personalHandle(t, cfg, "normal2")
+	if first == second {
+		t.Fatal("handles must bind caller")
+	}
+	if code, out := personalCall(t, cfg, "normal1", "personal.write", `{"id":"`+first+`","text":"mine"}`); code != "" {
+		t.Fatal(code, out)
+	}
+	if code, out := personalCall(t, cfg, "normal1", "personal.read", `{"id":"`+first+`"}`); code != "" || out["data"].(map[string]any)["text"] != "mine" {
+		t.Fatal(code, out)
+	}
+	if code, _ := personalCall(t, cfg, "normal2", "personal.read", `{"id":"`+first+`"}`); code != "access_denied" {
+		t.Fatal(code)
+	}
+}
+
+// Without package-only mode and without an approved helper nothing is served:
+// a helper build whose inventory failed to load stays closed.
+func TestHelperlessConfigWithoutPackageModeServesNoPersonalRoutes(t *testing.T) {
+	cfg := testConfig(t)
+	if routes := cfg.integrationRoutes(); len(routes) != 0 {
+		t.Fatalf("%d routes", len(routes))
+	}
+}
+
 func TestPersonalRejectsForgedIdentityAndPaths(t *testing.T) {
 	cfg := personalFixture(t)
 	id := personalHandle(t, cfg, "normal1")

package/templates/native-go-vue/README.md

@@ -1,6 +1,6 @@
 # __DISPLAY_NAME__ — Vue DSM package
 
-This is the existing native-go template with the shared UI **0.4.0**. It uses
+This is the existing native-go template with the shared UI **0.5.7**. It uses
 AppRoot, the DSM embedded theme, Dialog, SettingsSection, Callout and existing
 controls. The generated `dsm-package.yaml` remains the only package manifest.
 
@@ -14,7 +14,7 @@ synopkgland build-spk
 synopkgland inspect --spk dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 ```
 
-The pinned `@synopackageland/ui@0.4.0` dependency is public on
+The pinned `@synopackageland/ui@0.5.7` dependency is public on
 `https://registry.npmjs.org`, selected by `frontend/.npmrc`. No registry account
 or credentials are required. Dependencies are installed and UI bundled on the
 build machine; the NAS never downloads npm packages. Commit your lockfiles.
@@ -37,8 +37,12 @@ first, verify the helper is no longer ready, then Stop the package. V1 found
 this on a real NAS; the M1e investigation is ongoing.
 
 Generate with `synopkgland init -t native-go --ui vue --integration go <dir>`.
-This automatically chooses root privilege and adds only the existing M1a
-`integration: {protocol: 1, workers: {}}` contract. The native-go baseline without
+This keeps `privilege: none`: the private note and status screen run as the
+package account, with no helper, scheduler task or precheck hook, and
+`integration.status` reports `ready / package-only`. Add `--privilege root` to
+get the privileged helper described below (the existing M1a
+`integration: {protocol: 1, workers: {}}` contract). The helper brings only its
+five `helper_*` tasks, not the `whoami` demo. The native-go baseline without
 these options remains unchanged. Vue alone keeps the original Go 1.24 module;
 integration uses Go **1.25+** for fd-rooted atomic storage updates.
 
@@ -67,7 +71,7 @@ version history or general filesystem permission is implied.
 ## NAS picker and grants (S4 mock preview)
 
 The Vue template includes `NasPathPicker` and `NasGrantSettings`, built from UI
-0.4.0's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
+0.5.7's Dialog, TreeView, DataGrid, Button and SettingsSection. The existing
 browser `FilePicker` still represents local `File[]`; NAS selections return
 opaque directory grant handles. The new UI has catalogs for en, zh-TW, zh-CN,
 ja, ko, de, fr, es and it, selected from `ctx.locale` with English fallback.
@@ -142,7 +146,7 @@ clears instance/session state and stale reopen callbacks become no-ops.
 IDs, overlay roots, reopen/unmount, errors and empty data with jsdom. Real
 unsigned artifact tests additionally cross-compile Go and bundle UI/Node.
 
-UI **0.4.0** enables `<AppRoot modal-scope="app">`. Each mount assigns a
+UI **0.5.7** enables `<AppRoot modal-scope="app">`. Each mount assigns a
 package-prefixed, instance-unique Vue `idPrefix` before mounting. The sizing
 class on the mount element fills the existing bounded DSM fit-layout body;
 AppRoot fills that element and owns the background scroll container and local
@@ -189,7 +193,7 @@ isolated Linux systemd VM evidence; DSM 4.4 acceptance is still unknown.
 ## M2 S1R build policy and unavailable delivery
 
 The S8 source candidate also accepts `--integration-protocol 2` with
-`--integration go` or `better-auth`. The default stays protocol 1. The manifest,
+`--integration go` or `better-auth`, and only together with `--privilege root`. The default stays protocol 1. The manifest,
 compiled helper/CGI inventory, payload/worker digests, inspector and lifecycle
 approval pin the same protocol. A change requires exact new approval, never
 protocol 1 data fallback.
@@ -222,3 +226,30 @@ Anonymous/expired DSM sessions return `session_required`; authentication failure
 returns `auth_unavailable`. Relogin restores only the ordinary app session.
 Positive NAS functionality, ACL and final DSM SPK acceptance remain blocked /
 unknown; local refusal and QEMU fixtures do not certify them.
+
+
+## Interactive jobs after an observer pause
+
+The opt-in workers session API refuses requests with `revalidating` while the
+existing bounded reload/query observer checks are pending. Admission stays
+closed, running jobs are conservatively canceled, and no attach lease is
+extended. Sticky fences still return `fenced`. After a valid session-mode status
+reply confirms recovery, new submissions can proceed; canceled jobs never resume.
+
+JobsPanel keeps the revalidation message until recovery is confirmed and explains
+`canceled` jobs with `safeReason: "fenced"` in all nine locales. Resubmit is an
+explicit user action: the connected provider uses a mount-local plan snapshot
+and calls fresh prepare/submit for a new intent and job ID, rechecking permissions.
+There is no automatic resubmission. A lost submit reply locks further submission
+and offers lookup of the new intent. Reopening the view loses the local plan;
+select inputs again instead of inferring them from history. Existing initial
+picker/submission form wiring remains outside this template.
+
+See `docs/m3-adapt-simple-session-jobs.md` in the SDK repository for the full
+contract and the distinction between local evidence and DSM acceptance.
+
+## Interactive NAS picker and job submission
+
+For the opt-in SDK-workers entry, see [frontend/README-JOBS.md](frontend/README-JOBS.md).
+It connects the existing File Station folder/file picker, session selection and
+fixed read plan to prepare/submit, progress, cancel and explicit fenced resubmission.

package/templates/native-go-vue/frontend/DESIGN.md

@@ -1,6 +1,6 @@
 ---
 name: Native DSM Vue integration template
-description: Existing package settings UI using Syno Package Land UI 0.4.0.
+description: Existing package settings UI using Syno Package Land UI 0.5.7.
 typography:
   body:
     fontFamily: "var(--ui-font-sans)"
@@ -24,7 +24,7 @@ spacing:
 
 This records the built template, not a new visual identity. The settings surface operates inside a DSM package window: users inspect integration health, administrators approve maintenance operations, and each account edits its own synthetic sample note. Its usage mode is **Operate**; preserve the compact, readable hierarchy and existing native component behavior.
 
-Visual authority is `@synopackageland/ui` **0.4.0**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
+Visual authority is `@synopackageland/ui` **0.5.7**, its public exports and `themes/dsm7-embedded.css`, plus the application styles in `src/style.css`. `AppRoot` scopes the component world. Local synthetic browser screenshots (`ui-desktop.png`, `ui-minimum.png`, `ui-user-failed.png`) support this description; they do not establish DSM runtime acceptance.
 
 ## Colors
 
@@ -56,7 +56,7 @@ The application adds no shadows or elevation system. Surface, overlay and dialog
 - **Loading, empty and mutation states:** Refresh and mutations disable competing controls; the main region exposes `aria-busy` and textual status. Failed status loading offers Refresh. A ready integration with no note ID shows the “No sample data” Callout. A labeled Textarea and Save button appear when a note exists. Completion notices use `role=status`; error copy uses `role=alert` and identifies a recovery action. Optional app identity appears only when its route reports `better-auth`.
 - **Dialog:** Disable opens the library confirmation dialog, explains refusal of new requests and retention of existing data/output, and presents Cancel plus danger Confirm disable. No application modal replacement is provided.
 
-**App-local modality:** consume UI 0.4.0's `AppRoot modal-scope="app"`.
+**App-local modality:** consume UI 0.5.7's `AppRoot modal-scope="app"`.
 Each independent mount sets a package-prefixed, unique Vue `idPrefix` before
 mounting. The mount sizing class and AppRoot use `height: 100%` inside the
 existing bounded DSM fit-layout body. AppRoot owns background scrolling and
@@ -70,9 +70,21 @@ custom out-of-root portals. Other UI versions/modal libraries, Safari/iOS and
 manual screen-reader acceptance remain unvalidated. Test the generated final
 SPK on DSM separately from local jsdom/Chromium evidence.
 
+### Opt-in background schedules (S1-a)
+
+The `native-go-background` overlay extends this **Operate** surface within the inherited `AppRoot`, embedded theme, `SettingsSection`, Button and Callout system. It introduces no new palette or global tokens.
+
+- **Private-copy consent:** “Schedule this copy” is available for the signed-in owner's retained, successful, unscheduled job copy. “Private copy: {name}” identifies the input; “Repeat every” offers “Hour”, “Day” and “Week”. “Create schedule” stays disabled until the user checks “I agree to keep and reprocess this fixed copy as the package user. No new source files or personal ACLs are read.” The help explains the eight-schedule limit and that missed runs are recorded, never replayed.
+- **Ownership and recovery:** preserve user-and-UID owner isolation. Administrator rows expose “Owner: {user} (UID {uid})”. A worker change shows “The worker revision changed. An administrator must review and explicitly enable this schedule.” Only administrators, while background mode is on, see “Enable schedule”. Its confirmation names the exact private copy: “Enable the schedule for {name} with the current worker revision? I agree to reprocess this fixed copy. Past runs will not be replayed.” Actions are “Confirm enable” and “Cancel”.
+- **Layout:** schedule name/state, owner, next run, missed runs and warnings stack above a grouped, wrapping action row. Long names and copy wrap within the available width. Keep the inherited vertical scrolling at the minimum window size; do not squeeze schedules into one viewport. The labeled select and consent checkbox retain visible keyboard focus using existing theme tokens.
+- **Errors and cleanup:** danger alerts map known error codes to localized safe copy, with a localized fallback rather than raw server text. The catalogs cover nine locales. Preserve per-mount disposal: stop polling, dispose the picker, revoke result download URLs and prevent pending responses from restoring disposed state. Deletion confirmation explains that queued jobs cancel, running jobs drain and finished results remain.
+
+Evidence: `.herdr-project/syno-package-land-sdk-t-0129/library/ui-desktop.png` and `ui-minimum.png` are local component-fixture captures. The finish review disposition is **ship**, with all three material findings resolved. A fresh `normal1` NAS browser readback passed before the final UI adjustments; these captures validate the final adjustments locally and do not establish final DSM visual acceptance.
+
 ## Do's and Don'ts
 
 - Do use existing public UI components, embedded theme tokens and state/recovery copy.
 - Do retain permission gating, readable loading/empty/error states and per-instance cleanup.
+- Do use the library's `Select`, `Checkbox`, `Input`, `Textarea`, `Form`, `FormItem`, `FilePicker` (`variant="compact"`, in the app locale) and `Link` for controls; there is no native `<input>` or `<a>`. Leave `Form` on its automatic direction (labels stack below 520px of container width) and let a `FormItem` bind its control, with no `direction="vertical"`, `role="group"` or `field.controlId`.
 - Don't claim trusted helper readiness from scheduler values or treat app identity as native session/filesystem authorization.
 - Don't introduce a separate palette, component system or modal workaround around the library contract.

package/templates/native-go-vue/frontend/README-JOBS.md

@@ -0,0 +1,75 @@
+# Interactive NAS picker → job (experimental)
+
+Use the existing `native-go --ui vue --integration go` project, then opt in to
+protocol 2, relaxed File Station session access and a fixed SDK read worker:
+
+```yaml
+integration:
+  protocol: 2
+  dataAccess: relaxed
+  workers: {}
+  sdkWorkers:
+    scan:
+      kind: sdk-read-plan
+      workerRevision: 1
+      actions: [nas.files.list, nas.files.stat, nas.files.read]
+      modes: [interactive]
+```
+
+Install frontend dependencies and run `synopkgland build-spk` as usual. The
+builder sets `SYNOPKGLAND_SDK_WORKERS=1` from the manifest and chooses
+`src/sdk-main.ts`. Leave `SYNOPKGLAND_M2_SIMPLE` unset: that flag deliberately
+selects the separate session-only file-operation entry without job controls.
+For a standalone frontend check use `SYNOPKGLAND_SDK_WORKERS=1 npm run build`.
+
+An administrator uses the existing exact-payload approval and activation flow.
+The session SDK surface hides the native personal-note sample, whose routes
+are absent from this protocol-2 build.
+Each user opens the package in their own DSM session. The jobs panel enables
+the source picker only after a fresh `jobs.status` reports session availability.
+Choose a file or folder, confirm selection, select the worker and operation,
+set its bound where required, then submit once. Progress refreshes every 2.5 s
+while this page contains active jobs; errors stop polling and require Refresh.
+Cancel uses the existing owner/revision checks. Closing the window requests
+cancellation and stops renewal. Observer revalidation pauses submission;
+fenced jobs stay canceled and require an explicit fresh submission after
+recovery. Nothing resumes or retries automatically.
+
+`jobs.status.workers` projects only interactive workers with session-supported
+list/stat/read actions, exact registry revision and the smaller of the worker's
+bounded/total byte limits and 512 KiB. It contains no compiled bindings or
+credentials. This is display metadata: prepare still verifies the registry,
+selection, session and current permissions. Missing metadata in an older owner
+leaves the form disabled. The form submits one step; list is 1–100 entries,
+read is 1–the projected byte limit, and stat has no byte/entry argument.
+This read-only worker requires no destination and discards content, returning
+only counters. Background jobs remain unsupported even if the manifest lists
+background mode. Writes and custom executables are not part of this form.
+
+`M2PathPicker` extends the existing Dialog/TreeView/DataGrid composition with
+`select-files` and `read-only` props and a `source` event (`M2JobSource`). Folder
+picks return an empty segment list. File picks call the existing
+`nas.grants.confirm` for the containing folder with `writable:false`, then use
+one relative filename in `jobs.prepare.input`. The `folder` grant therefore
+records consent for that containing folder, not a file-only authority. Existing
+folder-only consumers and their `selected` event are unchanged. These selections
+remain path based; they do not pin inodes or confine symlink/rename races.
+
+The SDK mount provides both `M2ProviderKey` and `JobsProviderKey` per window.
+`JobsProvider.interactive` exposes `workers`, `prepareInteractive` and
+`submitInteractive`; applications can reuse this interface with their own form.
+Transport stays in the existing `ctx.call`, which carries the current DSM
+session and CSRF token. Never put credentials in form fields, persistent
+storage, logs or an administrator-session fallback.
+
+A missing submit reply freezes the form with its original intent. **Check
+original job** calls `jobs.lookup`; it never submits or acquires a replacement
+lease. If the job is found, status shows its actual outcome. Without the lost
+attach receipt it may expire after 6 s. Unmount or an account/package change
+clears selection and pending input, disconnects the provider, and discards late
+responses. Refreshing cannot certify remote rollback or completed cleanup.
+The attach contract remains 2 s renewal / 6 s TTL.
+
+Nine catalogs cover en, zh-TW, zh-CN, ja, ko, de, fr, es and it via `ctx.locale`.
+Unit and browser fixtures are synthetic; DSM compatibility must be established
+on the final generated SPK with each user's session and File Station permissions.

package/templates/native-go-vue/frontend/README-M2.md

@@ -0,0 +1,64 @@
+# Interactive File Station UI (experimental)
+
+This optional entry uses the package CGI's `ctx.call` transport and the current
+user's DSM session. It does not borrow an administrator session, request root
+helper approval, cache DSM credentials or install a mock provider.
+
+The existing `main.ts` and SDK worker entry remain the default. To select this
+session-only UI in a generated `native-go --ui vue` project:
+
+1. Enable `integration: {protocol: 2, workers: {}}` in `dsm-package.yaml`.
+2. Set `SYNOPKGLAND_M2_SIMPLE=1` in `frontend/.env.production.local`.
+3. Run the existing `synopkgland build-spk` workflow and inspect the final SPK.
+
+You can also build the frontend with `SYNOPKGLAND_M2_SIMPLE=1 npm run build`.
+The flag selects `src/m2-main.ts` before the existing SDK-workers entry; it
+selects a session-only surface, without background job or root-maintenance UI.
+It does not change backend permissions. Protocol 1 / no integration lacks the
+required routes and the UI shows that the adapter is unavailable. Without this
+flag, generated artifacts retain their previous bytes.
+
+## SDK display contract
+
+`src/nas/m2-contract.ts` exports `M2Provider`, `M2Selection`, `M2Entry`,
+`M2Page`, `M2Session`, safe codes and the 512 KiB / 100-entry bounds.
+`createM2Provider(ctx)` implements status, discovery, confirmation, saved
+selection listing/revocation, relative list/stat/read, mkdir and upload.
+Pass an AbortSignal per operation and call `dispose()` on unmount. Each mount
+owns its provider and clears its UI after account/package change or pagehide.
+
+`M2Selection.writable` records consent to attempt writes; it is not a File
+Station permission probe. The backend validates the actual session and current
+File Station permissions on every operation. A selection is an opaque handle
+with a display path, not the native helper's prepare/digest/revision grant.
+User/UID fields in backend records are stripped from the frontend projection.
+Selections use relaxed username/UID identity: recreating both may preserve a
+selection. Paths do not pin inodes or provide symlink/rename confinement.
+
+Discovery supports files in returned pages but shows only folders in the
+picker. Pagination advances by the full server page, not the filtered count;
+rendering is bounded to the latest 200 entries. Writes require explicit
+writable consent. Upload creates a new file and does not overwrite. Read and
+upload are limited to 512 KiB; read bytes become a local binary download, never
+HTML or an inline preview.
+
+Requests are observed for at most 22 seconds (backend handler: 20 seconds).
+The existing `ctx.call` does not expose transport abort: closing or canceling
+suppresses late display updates but does not establish server rollback or Q.
+No operation is retried automatically. A lost mutation response reports
+`commit-uncertain`; inspect saved selections or the destination before
+resubmitting. Session expiry requires signing into DSM again and refreshing.
+Background/offline work, streaming and atomic publish remain unsupported.
+
+## Local checks
+
+Copy `../../_shared/third-party-notices.mjs` into this folder before `npm ci`,
+`npm test`, `npx vue-tsc --noEmit` and `npm run build`. Also build with the M2
+flag. Remove the copied notice tool, `node_modules` and `dist` before root
+repository tests or generating fixtures: the generator copies template files.
+
+`test/m2-preview.html` serves synthetic `ctx.call` responses for local browser
+QA. It does not access a NAS and is not the production provider's backend.
+Local unit/jsdom/Chromium tests do not establish DSM compatibility. Actual DSM
+session, File Station ACL, multipart upload and download validation belongs to
+the backend/device-validation thread. No public support claim is made here.

package/templates/native-go-vue/frontend/package-lock.json

@@ -6,7 +6,8 @@
     "": {
       "name": "native-dsm-vue-app",
       "dependencies": {
-        "@synopackageland/ui": "0.4.0",
+        "@lucide/vue": "1.48.0",
+        "@synopackageland/ui": "0.5.7",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1050,9 +1051,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.4.0.tgz",
-      "integrity": "sha512-is5/UdiaDbqvqy53IaecTwoGtFBiX0tcaypBhma6dEnlefHaQrb8UszwPWdY0YrMhgLmt8Z2EIhnesfxnrRVFA==",
+      "version": "0.5.7",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.5.7.tgz",
+      "integrity": "sha512-egHKoU4Jk33MhZULykelsq5+JB+l8DuRTCD/hOo3ZZa+p2aXoZSl6M0Gwpd+FGLvvARTsrtT8A5lk/PXTMqUmA==",
       "license": "MIT",
       "dependencies": {
         "@internationalized/date": "3.12.4",

package/templates/native-go-vue/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "native-dsm-vue-app", "private": true, "type": "module",
   "scripts": {"build": "vue-tsc --noEmit && vite build", "test": "vitest run"},
-  "dependencies": {"@synopackageland/ui": "0.4.0", "vue": "3.5.43"},
+  "dependencies": {"@lucide/vue": "1.48.0", "@synopackageland/ui": "0.5.7", "vue": "3.5.43"},
   "devDependencies": {"@vitejs/plugin-vue": "6.0.9", "vite": "7.3.6", "typescript": "5.9.3", "vue-tsc": "3.3.11", "vitest": "4.1.11", "jsdom": "26.1.0"}
 }