@synopackageland/cli 0.4.1 → 0.5.3

package/dist/build-spk/generator.js

@@ -5,15 +5,21 @@ import { createHash } from "node:crypto";
 import * as tar from "tar";
 import { parseDocument, Scalar } from "yaml";
 import { loadContract, collectInstallParameters } from "../contract/load.js";
-import { renderDsmWindowConfig, resolvedWebLaunch, trustedAppEntryPath, } from "../contract/web-launch.js";
+import { renderDsmWindowConfig, resolvedWebLaunch, trustedAppEntryPath, usesAuthGateway, } from "../contract/web-launch.js";
+import { buildGatewayBinary, gatewayConfig, writeGatewayPayload } from "./gateway.js";
 import { classifyComposeRoute, loadCompose } from "../compose/analyze.js";
 import { scanComposePrivilege } from "../compose/privilege.js";
 import { validateProject } from "../validate.js";
 import { writeDsmWindowIcons, writePackageCenterIcons } from "./dsm-icons.js";
 import { infoArchValue } from "./dsm-arch.js";
+import { assertContainerMinDsm, resolveMinDsm } from "./dsm-version.js";
 import { createReproducibleTar } from "./reproducible-archive.js";
 import { copyProjectNotices } from "./notices.js";
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
+import { renderUninstallWizardFiles } from "./uninstall-wizard.js";
+import { renderInstallWizardFiles } from "./install-wizard.js";
+import { renderWizardFiles, writeWizardUiFiles } from "./wizard-i18n.js";
+import { sharedFolderCombobox } from "./share-combobox.js";
 import { loadNative } from "../native/load.js";
 import { materializeNativePayload } from "./native-payload.js";
 import { renderNativePostinst, renderNativePrivilege, renderNativeStartStopStatus, renderNativePostuninst, renderNativePreuninst, } from "./native-lifecycle.js";
@@ -53,8 +59,14 @@ export async function buildSpk(options) {
     if (options.spkVersion) {
         contract.version = options.spkVersion;
     }
+    if (options.minDsm !== undefined) {
+        contract.os_min_ver = resolveMinDsm(options.minDsm);
+    }
     const nativePath = options.project.nativePath ?? join(options.project.root, "native.yaml");
     const isNative = existsSync(nativePath);
+    if (!isNative && options.minDsm !== undefined) {
+        assertContainerMinDsm(String(contract.os_min_ver));
+    }
     if (isNative) {
         if (!options.archFamily) {
             return { ok: false, errors: ["NATIVE_ARCH_FAMILY_REQUIRED"] };
@@ -74,10 +86,7 @@ export async function buildSpk(options) {
             mkdirSync(join(staging, "conf"), { recursive: true });
             writeFileSync(join(staging, "conf", "privilege"), renderNativePrivilege(), "utf8");
             writeFileSync(join(staging, "privilege"), renderNativePrivilege(), "utf8");
-            mkdirSync(join(staging, "WIZARD_UIFILES"), { recursive: true });
-            writeFileSync(join(staging, "WIZARD_UIFILES", INSTALL_UIFILE), JSON.stringify(renderInstallWizard(contract, undefined), null, 2), "utf8");
-            writeFileSync(join(staging, "WIZARD_UIFILES", UPGRADE_UIFILE), JSON.stringify(renderUpgradeWizard(contract, undefined), null, 2), "utf8");
-            writeFileSync(join(staging, "WIZARD_UIFILES", UNINSTALL_UIFILE), JSON.stringify(renderUninstallWizard(), null, 2), "utf8");
+            writeWizards(staging, contract, undefined, "native");
             mkdirSync(join(staging, "scripts"), { recursive: true });
             for (const name of SCRIPT_NAMES) {
                 const scriptPath = join(staging, "scripts", name);
@@ -109,9 +118,6 @@ export async function buildSpk(options) {
             copyFileSync(nativePath, join(packageDir, "native.yaml"));
             chmodSync(join(staging, "INFO"), FILE_MODE);
             chmodSync(join(staging, "privilege"), FILE_MODE);
-            chmodSync(join(staging, "WIZARD_UIFILES", INSTALL_UIFILE), FILE_MODE);
-            chmodSync(join(staging, "WIZARD_UIFILES", UPGRADE_UIFILE), FILE_MODE);
-            chmodSync(join(staging, "WIZARD_UIFILES", UNINSTALL_UIFILE), FILE_MODE);
             chmodSync(join(packageDir, "synology-app.yaml"), FILE_MODE);
             chmodSync(join(packageDir, "native.yaml"), FILE_MODE);
             const outputPath = options.outputPath ??
@@ -135,25 +141,44 @@ export async function buildSpk(options) {
         return { ok: false, errors: ["COMPOSE_ROUTE_UNSUPPORTED"] };
     }
     const rwEligibility = route.eligibility;
+    const gateway = rwEligibility?.adminport !== undefined && usesAuthGateway(contract)
+        ? gatewayConfig(contract, rwEligibility.adminport)
+        : undefined;
+    if (gateway && !options.archFamily) {
+        return { ok: false, errors: ["GATEWAY_ARCH_FAMILY_REQUIRED"] };
+    }
     const isDynamicRoute = route?.route === "dynamic";
     const isResourceWorkerRoute = route?.route === "static-zero-config" ||
         isDynamicRoute;
     const staging = mkdtempSync(join(tmpdir(), "syno-spk-"));
+    const gatewayWork = mkdtempSync(join(tmpdir(), "syno-gateway-"));
     try {
+        let gatewayBinary;
+        if (gateway) {
+            const built = buildGatewayBinary({
+                packageId: String(contract.package),
+                arch: options.archFamily,
+                config: gateway,
+                work: gatewayWork,
+                run: options.gatewayRun,
+            });
+            if ("error" in built) {
+                console.error(built.detail);
+                return { ok: false, errors: [built.error] };
+            }
+            gatewayBinary = built.binary;
+        }
         writeFileSync(join(staging, "INFO"), renderInfo(contract, options.archFamily, isResourceWorkerRoute), "utf8");
         writePackageCenterIcons(staging);
         mkdirSync(join(staging, "conf"), { recursive: true });
         writeFileSync(join(staging, "conf", "privilege"), renderPrivilege(), "utf8");
         writeFileSync(join(staging, "privilege"), renderPrivilege(), "utf8");
         if (isResourceWorkerRoute) {
-            const resourceConfig = renderResourceConfig(contract, rwEligibility);
+            const resourceConfig = renderResourceConfig(contract, rwEligibility, parsedCompose.compose);
             writeFileSync(join(staging, "conf", "resource"), resourceConfig, "utf8");
             chmodSync(join(staging, "conf", "resource"), FILE_MODE);
         }
-        mkdirSync(join(staging, "WIZARD_UIFILES"), { recursive: true });
-        writeFileSync(join(staging, "WIZARD_UIFILES", INSTALL_UIFILE), JSON.stringify(renderInstallWizard(contract, parsedCompose?.compose), null, 2), "utf8");
-        writeFileSync(join(staging, "WIZARD_UIFILES", UPGRADE_UIFILE), JSON.stringify(renderUpgradeWizard(contract, parsedCompose?.compose), null, 2), "utf8");
-        writeFileSync(join(staging, "WIZARD_UIFILES", UNINSTALL_UIFILE), JSON.stringify(renderUninstallWizard(), null, 2), "utf8");
+        writeWizards(staging, contract, parsedCompose?.compose, "container");
         mkdirSync(join(staging, "scripts"), { recursive: true });
         for (const name of SCRIPT_NAMES) {
             const scriptPath = join(staging, "scripts", name);
@@ -215,11 +240,11 @@ export async function buildSpk(options) {
             writeFileSync(join(uiDir, "config"), renderDsmWindowConfig(contract), "utf8");
             writeDsmWindowIcons(uiDir);
         }
+        if (gateway && gatewayBinary) {
+            writeGatewayPayload(join(staging, "package"), gatewayBinary, gateway);
+        }
         chmodSync(join(staging, "INFO"), FILE_MODE);
         chmodSync(join(staging, "privilege"), FILE_MODE);
-        chmodSync(join(staging, "WIZARD_UIFILES", INSTALL_UIFILE), FILE_MODE);
-        chmodSync(join(staging, "WIZARD_UIFILES", UPGRADE_UIFILE), FILE_MODE);
-        chmodSync(join(staging, "WIZARD_UIFILES", UNINSTALL_UIFILE), FILE_MODE);
         chmodSync(join(staging, "package", "compose.yaml"), FILE_MODE);
         chmodSync(join(staging, "package", "synology-app.yaml"), FILE_MODE);
         if (contract.adminport !== undefined && resolvedWebLaunch(contract) === "dsm-window") {
@@ -232,6 +257,7 @@ export async function buildSpk(options) {
     }
     finally {
         rmSync(staging, { recursive: true, force: true });
+        rmSync(gatewayWork, { recursive: true, force: true });
     }
 }
 function quoteInfo(value) {
@@ -252,19 +278,21 @@ function renderInfo(contract, archFamily, isResourceWorker = false) {
     add("maintainer", String(contract.maintainer));
     add("arch", archFamily === undefined ? "noarch" : infoArchValue(archFamily));
     add("os_min_ver", String(contract.os_min_ver));
+    const viaGateway = isResourceWorker && usesAuthGateway(contract);
     if (isResourceWorker) {
         // DSM reports Container Manager as "not ready" through the package
         // dependency gate even while pkgctl-ContainerManager is running. The
         // docker-project worker itself remains the authoritative live prerequisite
         // (ContainerManager >= 1432); keep only the reliable Web Station package
         // dependency here so a valid resource-worker SPK can reach acquisition.
-        if (contract.adminport !== undefined) {
+        // A gateway package has no Web Station portal, so it does not depend on it.
+        if (contract.adminport !== undefined && !viaGateway) {
             add("install_dep_packages", "WebStation");
         }
     }
     add("startable", "yes");
     const launch = resolvedWebLaunch(contract);
-    if (contract.adminprotocol) {
+    if (contract.adminprotocol && !viaGateway) {
         add("adminprotocol", String(contract.adminprotocol));
     }
     if (launch === "new-page" || launch === "dsm-window") {
@@ -289,6 +317,10 @@ function renderInfo(contract, archFamily, isResourceWorker = false) {
         add("dsmuidir", "ui");
         add("dsmappname", String(contract.package));
     }
+    else if (viaGateway) {
+        // The gateway CGI is served from ui/ even when the App opens in a new page.
+        add("dsmuidir", "ui");
+    }
     return `${lines.join("\n")}\n`;
 }
 function renderPrivilege() {
@@ -298,15 +330,6 @@ function renderPrivilege() {
         },
     }, null, 2)}\n`;
 }
-const SHARED_FOLDER_MOUNT_CONSENT = "此 App 會用你在這台 NAS 選的資料夾；整顆應用都看得到。Shared Folder Mount 是整個 App Instance 的 container access：能打開這個 App 的使用者，容器裡的程式都看得到該 Share，即使該使用者在 File Station 看不到。這不是逐使用者 DSM ACL。檔案權限取決於容器服務帳號；App 必須自行實作使用者授權。";
-const HOMES_MOUNT_CONSENT = "此 App 會使用這台 NAS 已啟用的 User Home；整顆應用的容器都看得到，容器路徑由 Compose 決定。這不是逐使用者 DSM ACL；檔案權限取決於容器服務帳號；App 必須自行實作使用者授權。";
-const POSIX_ALL_SHARES_MAX_WARNING = "此 App 會使用安裝當下這台 NAS 的全部 Shared Folder（App-wide，不依個別 DSM ACL）；容器內可讀（或讀寫，依 Compose 模式）所有這些資料夾的檔案。安裝後新建的共用資料夾不會自動加入。Package Center 無法提供安裝當下的 Shared Folder 清單快照；要以全部 Share 安裝，請用 CLI `synopkgland deploy`，由 CLI 以管理員權限列舉全部 Share 並寫入快照。由管理員決定是否安裝。";
-const POSIX_ALL_SHARES_UPGRADE_NOTICE = "升級會保留既有快照（安裝當下由 CLI 列舉的全部 Shared Folder）；變更掛載範圍只能由 CLI 明確提供（`synopkgland deploy`）。Package Center 升級不會改動現有快照。";
-const DSM_USER_RUN_AS_CONSENT = "寫進 Share 的新檔在 File Station 顯示為你選的那位 DSM 使用者。點開此 App 的人共用這個磁碟身分，不是逐登入 ACL。";
-const DSM_USER_UPGRADE_CONSENT = "升級時更換 Container Run-as 不會 chown Share 上的舊檔；只有升級後寫入的新檔才會使用新的磁碟身分。";
-const UPGRADE_VALUE_REUSE_DESC = "留空＝沿用目前設定";
-const SHARED_FOLDER_RW_UPGRADE_CONSENT = "此版本把 Share 掛載改為讀寫；容器可讀取並寫入你選的 Share，不再是唯讀。";
-const APP_OWN_SPACE_CONSENT = "此 App 只用 App 自己的空間。";
 function volumeSources(compose) {
     return volumeMounts(compose).map((mount) => mount.source);
 }
@@ -389,8 +412,7 @@ function injectPosixAllSharesMarkers(composeContent, contract) {
     }
     return output.join("\n");
 }
-const PRIVILEGE_MAX_WARNING = "此 App 的容器有高權限，接近這台 NAS 的 root、幾乎整台機器。是否安裝由你這位管理員決定。";
-function renderInstallWizard(contract, compose) {
+function renderInstallWizard(t, contract, compose) {
     const items = [];
     const params = collectInstallParameters(contract);
     const hasSharedFolder = params.some((item) => item.param.type === "shared_folder");
@@ -398,27 +420,27 @@ function renderInstallWizard(contract, compose) {
     const hasDsmUser = params.some((item) => item.param.type === "dsm_user");
     if (compose && scanComposePrivilege(compose).length > 0) {
         items.push({
-            desc: PRIVILEGE_MAX_WARNING,
+            desc: t("consent.privilege"),
         });
     }
     if (hasSharedFolder) {
         items.push({
-            desc: SHARED_FOLDER_MOUNT_CONSENT,
+            desc: t("consent.sharedFolder"),
         });
     }
     if (hasHomes) {
         items.push({
-            desc: HOMES_MOUNT_CONSENT,
+            desc: t("consent.homes"),
         });
     }
     if (hasDsmUser) {
         items.push({
-            desc: DSM_USER_RUN_AS_CONSENT,
+            desc: t("consent.dsmUser"),
         });
     }
     if (!hasSharedFolder && (!compose || composeUsesOnlyAppSpace(compose))) {
         items.push({
-            desc: APP_OWN_SPACE_CONSENT,
+            desc: t("consent.appOwnSpace"),
         });
     }
     for (const { name, param } of params) {
@@ -428,7 +450,7 @@ function renderInstallWizard(contract, compose) {
         if (param.type === "string") {
             items.push({
                 type: "textfield",
-                desc: `Install Parameter: ${name}`,
+                desc: t("param.install", { name }),
                 subitems: [{
                         key: name,
                         desc: name,
@@ -441,7 +463,7 @@ function renderInstallWizard(contract, compose) {
         if (param.type === "boolean") {
             items.push({
                 type: "multiselect",
-                desc: `Install Parameter: ${name}`,
+                desc: t("param.install", { name }),
                 subitems: [{ key: name, desc: name, defaultValue: param.default ?? false }],
             });
             continue;
@@ -449,36 +471,13 @@ function renderInstallWizard(contract, compose) {
         if (param.type === "secret") {
             items.push({
                 type: "password",
-                desc: `Install Parameter: ${name}`,
+                desc: t("param.install", { name }),
                 subitems: [{ key: name, desc: name, validator: { allowBlank: false } }],
             });
             continue;
         }
         if (param.type === "shared_folder") {
-            items.push({
-                type: "combobox",
-                desc: `Shared Folder: ${name}`,
-                subitems: [{
-                        key: name,
-                        desc: name,
-                        displayField: "name",
-                        valueField: "name",
-                        editable: false,
-                        forceSelection: true,
-                        autoSelect: false,
-                        mode: "remote",
-                        api_store: {
-                            api: "SYNO.Core.Share",
-                            method: "list",
-                            version: 1,
-                            baseParams: { limit: -1, offset: 0 },
-                            root: "shares",
-                            idProperty: "name",
-                            fields: ["name"],
-                        },
-                        validator: { allowBlank: false },
-                    }],
-            });
+            items.push(sharedFolderCombobox(t, name));
             continue;
         }
         if (param.type === "posix_all_shares") {
@@ -493,14 +492,14 @@ function renderInstallWizard(contract, compose) {
             // ALL_SHARES and no CHANGE_ALL_SHARES.
             items.push({
                 type: "textblock",
-                desc: POSIX_ALL_SHARES_MAX_WARNING,
+                desc: t("consent.posixAllShares"),
             });
             continue;
         }
         if (param.type === "dsm_user") {
             items.push({
                 type: "combobox",
-                desc: `Container Run-as: ${name}`,
+                desc: t("param.runAs", { name }),
                 subitems: [{
                         key: name,
                         desc: name,
@@ -525,18 +524,20 @@ function renderInstallWizard(contract, compose) {
         }
     }
     return [{
-            step_title: "安裝設定",
+            step_title: t("install.step"),
             items,
         }];
 }
-function renderUpgradeWizard(contract, compose) {
-    const installWizard = renderInstallWizard(contract, compose);
+function renderUpgradeWizard(t, contract, compose) {
+    const installWizard = renderInstallWizard(t, contract, compose);
     const params = collectInstallParameters(contract);
     // Every type whose value must survive an upgrade the administrator did not
     // deliberately change. Two mechanisms are needed because DSM renders them
     // differently: a control that can be left blank just allows blank, while one
     // that always carries a value needs an explicit "change this" gate.
-    //   - dsm_user  : measurably comes up blank, so allowBlank is enough
+    //   - dsm_user  : blank in some layouts, but measured on DSM 7.4-90069 with
+    //                 Shared Folder controls beside it to come up pre-filled with a
+    //                 Shared Folder name, so it needs the same explicit gate
     //   - string    : blank once the new version's default is withheld (A44)
     //   - shared_folder : DSM prefills the first store row
     //   - boolean   : a checkbox has no blank state at all
@@ -551,7 +552,7 @@ function renderUpgradeWizard(contract, compose) {
         param.type === "string" ||
         param.type === "boolean")
         .map(({ name, param }) => [name, param.type]));
-    const needsChangeGate = (type) => type === "shared_folder" || type === "boolean";
+    const needsChangeGate = (type) => type === "shared_folder" || type === "dsm_user" || type === "boolean";
     const upgradeItems = installWizard[0].items.flatMap((item) => {
         if (!Array.isArray(item.subitems)) {
             return [item];
@@ -581,20 +582,24 @@ function renderUpgradeWizard(contract, compose) {
         }
         const control = {
             ...item,
-            desc: `${String(item.desc ?? "")}（${UPGRADE_VALUE_REUSE_DESC}）`,
+            desc: t("upgrade.reuseDesc", { desc: String(item.desc ?? "") }),
             subitems,
         };
         const changeControls = reuseKeys
             .filter((key) => needsChangeGate(upgradeReuseTypes.get(key)))
             .map((key) => {
             const type = upgradeReuseTypes.get(key);
-            const label = type === "shared_folder" ? "Shared Folder" : key;
+            const label = type === "shared_folder"
+                ? t("label.sharedFolder")
+                : type === "dsm_user"
+                    ? t("label.runAs")
+                    : key;
             return {
                 type: "multiselect",
-                desc: `變更 ${label}（不勾＝沿用目前設定）`,
+                desc: t("upgrade.changeDesc", { label }),
                 subitems: [{
                         key: `CHANGE_${key}`,
-                        desc: `變更 ${label}`,
+                        desc: t("upgrade.changeSub", { label }),
                         defaultValue: false,
                     }],
             };
@@ -616,23 +621,23 @@ function renderUpgradeWizard(contract, compose) {
         .map((item) => item.name);
     if (posixAllSharesNames.length > 0) {
         upgradeConsent.push({
-            desc: POSIX_ALL_SHARES_UPGRADE_NOTICE,
+            desc: t("upgrade.posixNotice"),
         });
     }
     if (hasReadWriteSharedFolder) {
         upgradeConsent.push({
-            desc: SHARED_FOLDER_RW_UPGRADE_CONSENT,
+            desc: t("upgrade.sharedFolderRw"),
         });
     }
     if (hasDsmUser && hasSharedFolder) {
         upgradeConsent.push({
-            desc: DSM_USER_UPGRADE_CONSENT,
+            desc: t("upgrade.dsmUser"),
         });
     }
     if (upgradeConsent.length === 0) {
         return [{
                 ...installWizard[0],
-                step_title: "升級設定",
+                step_title: t("upgrade.step"),
                 items: upgradeItems,
             }];
     }
@@ -642,30 +647,18 @@ function renderUpgradeWizard(contract, compose) {
     items.splice(insertAt, 0, ...upgradeConsent);
     return [{
             ...installWizard[0],
-            step_title: "升級設定",
+            step_title: t("upgrade.step"),
             items,
         }];
 }
-function renderUninstallWizard() {
-    return [{
-            step_title: "解除安裝",
-            items: [
-                {
-                    desc: "勾選 Delete App Data 會永久刪除 App data 與 secrets，但不刪 Shared Folder 或 named volume。平台沒有檢查 Hyper Backup，也未驗證可復原備份。",
-                },
-                {
-                    type: "multiselect",
-                    desc: "Delete App Data",
-                    subitems: [
-                        {
-                            key: "delete_app_data",
-                            desc: "Delete App Data",
-                            defaultValue: false,
-                        },
-                    ],
-                },
-            ],
-        }];
+function writeWizards(staging, contract, compose, kind) {
+    const install = renderInstallWizardFiles(String(contract.package), (t) => renderInstallWizard(t, contract, compose));
+    writeWizardUiFiles(staging, {
+        ...install.static,
+        ...install.dynamic,
+        ...renderWizardFiles(UPGRADE_UIFILE, (t) => renderUpgradeWizard(t, contract, compose)),
+        ...renderUninstallWizardFiles(String(contract.package), kind),
+    });
 }
 function renderDynamicPreinstMaterializer(contract) {
     const allParams = collectInstallParameters(contract);
@@ -728,7 +721,7 @@ function renderDynamicPreinstMaterializer(contract) {
     // which is true, so the gate silently always reused the canonical value.
     const usesUpgradeChangeGate = sharedFolderParams.length > 0 ||
         posixAllSharesParams.length > 0 ||
-        collectInstallParameters(contract).some(({ param }) => param.type === "boolean");
+        collectInstallParameters(contract).some(({ param }) => param.type === "boolean" || param.type === "dsm_user");
     if (usesUpgradeChangeGate) {
         lines.push("upgrade_change_enabled() {", "  normalized=\"$(printf '%s' \"$1\" | LC_ALL=C tr '[:upper:]' '[:lower:]')\"", "  case \"$normalized\" in", "    true|1|yes|on) return 0 ;;", "    *) return 1 ;;", "  esac", "}");
     }
@@ -788,7 +781,9 @@ function renderDynamicPreinstMaterializer(contract) {
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;
-        lines.push(`  if [ "\${${name}+x}" = x ] && [ -n "\${${name}}" ]; then`, `    ${rawUserVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+        // Like the Shared Folder gate: on UPGRADE the submitted user only counts when
+        // CHANGE_<name> is ticked, because the control is not reliably blank.
+        lines.push(`  if [ "$STATUS" = "UPGRADE" ] && upgrade_change_enabled "\${CHANGE_${name}:-}"; then`, `    if [ "\${${name}+x}" = x ] && [ -n "\${${name}}" ]; then`, `      ${rawUserVar}="\${${name}}"`, "    else", `      die "missing required dsm user parameter ${name}"`, "    fi", '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
             `${rawUserVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", `  elif [ "\${${name}+x}" = x ]; then`, `    ${rawUserVar}="\${${name}}"`, "  else", `    die "missing required dsm user parameter ${name}"`, "  fi", `  resolved_user_info="$(resolve_dsm_user "$${rawUserVar}")"`, "  set -- $resolved_user_info", `  ${name}_UID="$1"`, `  ${name}_GID="$2"`, "  shift 2 || true", `  ${name}_GROUPS="$*"`, `  rewrite_group_add "${name}" "$${name}_GROUPS" "$PROJECT/docker-compose.yml"`);
     }
     lines.push('  append_env "SYNOPKG_PKGVAR" "$PLATFORM_PKGVAR"', '  append_env "SYNO_APP_SECRETS_DIR" "$PLATFORM_SECRETS"');
@@ -890,16 +885,17 @@ function renderManagedScript(name, contract, nativeContext, isResourceWorker = f
             return renderHeadlessResourceMarker();
         }
         if (name === "postuninst") {
-            const projectRoot = isDynamicRoute ? 'PROJECT="${SYNOPKG_PKGDEST}/compose"\n' : "";
-            const deleteRoots = isDynamicRoute
-                ? ["PKGVAR", "PROJECT", "SECRETS"]
-                : ["PKGVAR", "SECRETS"];
+            const projectRoot = isDynamicRoute ? 'PROJECT="${SYNOPKG_PKGDEST:-}/compose"\n' : "";
+            const deleteRoots = [
+                { variable: "PKGVAR", area: "appdata" },
+                { variable: "PKGHOME", area: "apphome" },
+                ...(isDynamicRoute ? [{ variable: "PROJECT", area: "appstore" }] : []),
+            ];
             return `#!/bin/sh
 set -eu
-PKGVAR="\${SYNOPKG_PKGVAR}"
-PKGHOME="\${SYNOPKG_PKGHOME}"
-SECRETS="\${PKGHOME}/secrets"
-${projectRoot}${renderDeleteAppDataBlock(deleteRoots)}exit 0
+PKGVAR="\${SYNOPKG_PKGVAR:-}"
+PKGHOME="\${SYNOPKG_PKGHOME:-}"
+${projectRoot}${renderDeleteAppDataBlock(String(contract.package), deleteRoots)}exit 0
 `;
         }
         return `#!/bin/sh\nexit 0\n`;

package/dist/build-spk/install-wizard.d.ts

@@ -0,0 +1,20 @@
+import { type Translate } from "./wizard-i18n.js";
+/** One step of a DSM install wizard; `items` are rendered verbatim as JSON. */
+export interface InstallWizardStep {
+    step_title: string;
+    items: Array<Record<string, unknown>>;
+}
+/** The static JSON wizard per locale, and the dynamic script per locale. */
+export interface InstallWizardFiles {
+    static: Record<string, string>;
+    dynamic: Record<string, string>;
+}
+/**
+ * Builds the static `<base>` wizard files and one dynamic `<base>.sh` script
+ * per locale from the same render function. The static files stay for DSM
+ * versions and flows that do not run the dynamic script; both carry the same
+ * items, and only the dynamic one adds the reuse notice when data exists.
+ */
+export declare function renderInstallWizardFiles(packageName: string, render: (t: Translate) => InstallWizardStep[]): InstallWizardFiles;
+/** The native-go install step: no parameters, only the app-space consent. */
+export declare function renderNativeInstallWizard(t: Translate): InstallWizardStep[];

package/dist/build-spk/install-wizard.js

@@ -0,0 +1,76 @@
+import { DSM_LANGS, LOCALES } from "../standalone/i18n.js";
+import { renderWizardFiles, translator } from "./wizard-i18n.js";
+const BASE = "install_uifile";
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function localeName(locale, suffix) {
+    return locale === "en" ? `${BASE}${suffix}` : `${BASE}_${DSM_LANGS[locale]}${suffix}`;
+}
+/**
+ * The install wizard the administrator would otherwise never see: DSM keeps
+ * `@appdata` after an uninstall, so a reinstall silently inherits the old
+ * settings and generated secrets. This notice says so and how to start clean.
+ */
+function withReuseNotice(steps, packageName, t) {
+    const notice = { desc: t("install.reuseData", { package: packageName }) };
+    const [first, ...rest] = steps;
+    if (!first) {
+        return [{ step_title: t("install.step"), items: [notice] }];
+    }
+    return [{ ...first, items: [notice, ...first.items] }, ...rest];
+}
+/**
+ * A dynamic install wizard script. It only reads: `SYNOPKG_PKGDEST_VOL` when
+ * DSM already knows the target volume, otherwise every `/volume*` (the volume
+ * is chosen after the wizard on some flows). The wizard JSON is written to
+ * `SYNOPKG_TEMP_LOGFILE`, DSM's documented channel, or stdout without it.
+ */
+function renderDynamicScript(packageName, withData, withoutData) {
+    return `#!/bin/sh
+# Generated by synopkgland. Read-only: it checks whether this package already
+# has App Data on a volume, then prints the install wizard for this language.
+pkg=${shellQuote(packageName)}
+existing=
+for root in \${SYNOPKG_PKGDEST_VOL:-} /volume*; do
+  if [ -n "$root" ] && [ -d "$root/@appdata/$pkg" ]; then
+    existing=1
+    break
+  fi
+done
+if [ -n "\${SYNOPKG_TEMP_LOGFILE:-}" ]; then
+  exec > "$SYNOPKG_TEMP_LOGFILE"
+fi
+if [ -n "$existing" ]; then
+  cat <<'SYNOPKGLAND_WIZARD'
+${withData}
+SYNOPKGLAND_WIZARD
+else
+  cat <<'SYNOPKGLAND_WIZARD'
+${withoutData}
+SYNOPKGLAND_WIZARD
+fi
+`;
+}
+/**
+ * Builds the static `<base>` wizard files and one dynamic `<base>.sh` script
+ * per locale from the same render function. The static files stay for DSM
+ * versions and flows that do not run the dynamic script; both carry the same
+ * items, and only the dynamic one adds the reuse notice when data exists.
+ */
+export function renderInstallWizardFiles(packageName, render) {
+    const staticFiles = renderWizardFiles(BASE, render);
+    const dynamic = {};
+    for (const locale of LOCALES) {
+        const t = translator(locale);
+        const steps = render(t);
+        const withData = JSON.stringify(withReuseNotice(steps, packageName, t), null, 2);
+        const withoutData = JSON.stringify(steps, null, 2);
+        dynamic[localeName(locale, ".sh")] = renderDynamicScript(packageName, withData, withoutData);
+    }
+    return { static: staticFiles, dynamic };
+}
+/** The native-go install step: no parameters, only the app-space consent. */
+export function renderNativeInstallWizard(t) {
+    return [{ step_title: t("install.step"), items: [{ desc: t("consent.appOwnSpace") }] }];
+}

package/dist/build-spk/native-lifecycle.d.ts

@@ -1,4 +1,7 @@
 import type { NativeConfig } from "../native/types.js";
+import { type DeleteRoot } from "./delete-app-data.js";
+/** `@appdata` and `@apphome`; `@appconf` stays because no template writes there. */
+export declare const NATIVE_DELETE_ROOTS: readonly DeleteRoot[];
 export interface NativeLifecycleInput {
     packageIdentity: string;
     config: NativeConfig;
@@ -49,3 +52,5 @@ export declare function renderNativePreuninst(input: NativeLifecycleInput): stri
  * package user on uninstall; deleting a system account is not this script's job.
  */
 export declare function renderNativePostuninst(input: NativeLifecycleInput): string;
+/** The postuninst every native runtime shares: only the package name differs. */
+export declare function renderPackagePostuninst(pkg: string): string;

package/dist/build-spk/native-lifecycle.js

@@ -1,4 +1,9 @@
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
+/** `@appdata` and `@apphome`; `@appconf` stays because no template writes there. */
+export const NATIVE_DELETE_ROOTS = [
+    { variable: "PKGVAR", area: "appdata" },
+    { variable: "PKGHOME", area: "apphome" },
+];
 /**
  * Escapes a literal string for safe inclusion in POSIX `/bin/sh` single quotes.
  * A single quote is represented as `'\''` (close single quote, literal escaped single quote, reopen single quote).
@@ -192,11 +197,16 @@ exit 0
  * package user on uninstall; deleting a system account is not this script's job.
  */
 export function renderNativePostuninst(input) {
-    const pkg = input.packageIdentity;
+    return renderPackagePostuninst(input.packageIdentity);
+}
+/** The postuninst every native runtime shares: only the package name differs. */
+export function renderPackagePostuninst(pkg) {
     const pkgVarFallback = `\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}`;
+    const pkgHomeFallback = `\${SYNOPKG_PKGHOME:-/var/packages/${pkg}/home}`;
     return `#!/bin/sh
 set -eu
 PKGVAR="${pkgVarFallback}"
-${renderDeleteAppDataBlock(["PKGVAR"])}exit 0
+PKGHOME="${pkgHomeFallback}"
+${renderDeleteAppDataBlock(pkg, NATIVE_DELETE_ROOTS)}exit 0
 `;
 }

package/dist/build-spk/resource-worker.d.ts

@@ -1,10 +1,15 @@
-import type { AppContract } from "../types.js";
-import type { ResourceWorkerEligibility } from "../compose/analyze.js";
+import type { AppContract, ComposeDocument } from "../types.js";
+import { type ResourceWorkerEligibility } from "../compose/analyze.js";
 export { classifyComposeRoute, resourceWorkerEligibility, type ComposeRoute, type ComposeRouteClassification, type ResourceWorkerEligibility, type ResourceWorkerIneligibleReason, } from "../compose/analyze.js";
 export declare function composeProjectName(packageId: string): string;
-export declare function renderDockerProjectResource(packageId: string, projectPath?: string): Record<string, unknown>;
+/**
+ * `forcePull` re-resolves every image tag on install, which can move an image
+ * shared with other containers. Digest-pinned images cannot move, so it is only
+ * needed (and kept, to preserve upgrade behaviour) while a tag is unpinned.
+ */
+export declare function renderDockerProjectResource(packageId: string, projectPath?: string, forcePull?: boolean): Record<string, unknown>;
 export declare function renderWebserviceResource(contract: AppContract, adminport: number): Record<string, unknown>;
-export declare function renderResourceConfig(contract: AppContract, eligibility: ResourceWorkerEligibility): string;
+export declare function renderResourceConfig(contract: AppContract, eligibility: ResourceWorkerEligibility, compose: ComposeDocument): string;
 /**
  * Renders the lifecycle control script for the Docker Project resource-worker
  * route. ContainerManager owns the actual project start/stop operation through