@synopackageland/cli 0.4.1 → 0.5.3

package/dist/templates/native-go-background/BACKGROUND.md

@@ -0,0 +1,111 @@
+# Background jobs
+
+This package opted in with `synopkgland init --background`. `dsm-package.yaml` has
+`background: {worker: sha256-v1}`. The build adds a package-user worker that DSM
+runs as a systemd user unit. Nothing runs as root, and the CGI never starts a
+process in the background.
+
+## What runs
+
+- `conf/resource` is `{"systemd-user-unit":{}}` and `conf/systemd/pkguser-<Package>-background.service`
+  starts `target/background/worker`. `start-stop-status` only calls `synosystemctl`.
+- The worker is fixed: `sha256-v1` reads one imported file and writes its SHA-256.
+  Replace it by editing `backend/internal/background/runner.go` and bump `WorkerRevision`
+  (queued jobs of an older revision become `interrupted`, never replayed).
+- The spool is `/var/packages/<Package>/var/background` (dirs `0700`, files `0600`).
+  Limits: 1 job at a time, 16 queued, 512 KiB per file, 16 MiB total, 60 s per job.
+- Job states: `queued → running → succeeded | failed | canceled | interrupted`.
+  After a crash or forced stop a running job becomes `interrupted` and is not run again.
+
+## API and ownership
+
+`bg.status`, `bg.mode.set {enabled}`, `bg.users.set {allowOrdinaryUsers}`, `bg.jobs.purge {owner: {user, uid}}`, `bg.browse {folder?, offset?}`, `bg.jobs.submit {key, folder, relative}`,
+`bg.jobs.list`, `bg.jobs.get {id}`, `bg.jobs.cancel {id}`, `bg.jobs.result {id}`.
+
+The panel's **Choose a file** button opens the shared File Station picker, which lists shares and folders
+with `bg.browse`: read-only metadata from the signed-in caller's own DSM session. A pick stores no
+grant and adds no permission; `submit` still re-reads the file through the same session.
+
+`submit` copies `relative` below the shared `folder` through the caller's File Station session, so the signed-in
+administrator's own DSM permissions decide what can be imported. The job ID is returned
+only after the journal is durable, and `key` makes a retry return the same job.
+No cookie, SynoToken or password is stored. Closing the window or signing out does not
+cancel a job; sign in as the same owner again to read, download or cancel it.
+
+## Access
+
+Background mode is off until an administrator turns it on. Ordinary-user access
+has its own administrator switch.
+
+## Ordinary users (U1)
+
+Background mode and `allowOrdinaryUsers` are independent administrator switches,
+initially off. With ordinary users allowed, signed-in users can browse through
+**their own live File Station session**, import a copy, and list/get/cancel/download
+only their own jobs. `bg.mode.set`, `bg.users.set` and `bg.jobs.purge` remain admin-only.
+Administrators can see and cancel all jobs. Turning ordinary access off returns
+`unsupported` on owner routes; it does not delete or cancel previously admitted jobs.
+Turning background mode off cancels queued work and drains running work as before.
+
+Owners are matched by both authenticated username and freshly resolved numeric UID.
+An unknown UID refuses owner access and submission with `identity_unavailable`.
+Legacy jobs with an unknown UID remain admin-only. Recreated same-name accounts
+with different UIDs cannot access old jobs. This does not detect reuse of the same
+username **and** UID. Account disablement is enforced by DSM session authentication;
+this feature does not provide a separate account-lifecycle directory service.
+
+Idempotency keys are scoped to that owner. Cross-owner and missing IDs both return
+`not_found`. Queue/running counts for ordinary users include only their own jobs.
+Per-owner limits (including administrators): 2 queued/running jobs, 1 MiB of pending
+and retained imported inputs, schedule copies, plus 512 bytes reserved for each pending or retained result. The 16-job/16-MiB
+global bounds and 64 finished-job history remain. Two full 512-KiB inputs exceed the
+owner byte limit because of their result reservations. `owner-queue-full` and
+`owner-quota-exceeded` are distinct from global `queue-full`/`quota-exceeded`.
+
+An administrator may explicitly clear an exact owner `{user, uid}` (including
+unknown legacy UIDs). This removes saved results and queued inputs, requests cancel
+for running jobs, and hides those jobs until Finish/Recover drains them. A bounded
+64-entry audit stores actor, exact owner, time and counts in the durable journal;
+it contains no credentials or input contents. Uninstall retains data by default;
+the existing explicit delete-data wizard remains available.
+
+The package copy/result is not recalled when source-file permissions change.
+Offline access under a user's ACL, AD/LDAP UID stability and DSM reboot recovery
+are not claimed. No user credentials are stored.
+
+## Private-copy schedules (S1-a)
+
+Import a file and wait for its success, then choose **Schedule this copy** and
+explicitly consent. The package pins a separate copy and digest, without accessing
+File Station offline. `bg.schedules.create {key, jobId, intervalSeconds, consent:true}`
+accepts only 3600, 86400 or 604800 seconds; up to 8 schedules per package.
+`key` is scoped to username/UID and retries the exact definition.
+`bg.schedules.list`, `bg.schedules.disable {id}`, `bg.schedules.delete {id}` are
+owner-scoped; administrators see and can disable/delete all. Only an administrator
+can call `bg.schedules.enable {id, consent:true}` after reviewing the current revision.
+An administrator cannot create a schedule from another owner's imported copy.
+
+Successful manual inputs are retained with the bounded 64-job history. Old U1
+results whose input was deleted cannot be scheduled: import again. Copies and
+schedule pins count toward the 1-MiB owner/16-MiB global storage limits; a full
+512-KiB source plus its pinned copy exceeds the owner limit, so use smaller inputs.
+A scheduled run also needs input/result quota and shares the 2-pending-owner limit.
+At least 4 global queue positions remain available for manual jobs.
+
+The package-user worker ticks its journal; no root task, crontab or global service
+is created. `nextAt` and the run's `scheduleId`/`scheduledAt` commit atomically.
+Completed jobs never replay. Each start records overdue ticks as `missed` and
+advances to the next future period. Delays over 5 seconds, a full quota/queue, and
+multi-period gaps are also missed; no catch-up. The latest missed time/reason and
+aggregate missed count are retained, not an unbounded event log. This is neither
+an exact-time nor exactly-once guarantee.
+
+Disabling/deleting cancels queued runs and requests running cancellation/drain;
+finished results remain. Background mode off also disables every schedule, and
+turning it on does not revive them. Blocking ordinary access hides owner routes,
+but admitted private-copy schedules continue, like admitted U1 jobs. Clearing an
+owner also deletes that owner's schedules/pins and drains running jobs. A worker
+revision mismatch disables the schedule (`worker-changed`) and requires explicit
+administrator re-enable; a package build +1 with the same worker revision preserves
+compatible definitions/results. Changed or missing pinned bytes disable the schedule.
+No S1-b share authorization or offline personal ACL reading is provided.

package/dist/templates/native-go-background/backend/internal/app/background_on.go

@@ -0,0 +1,7 @@
+package app
+
+import "dsmapp/internal/api"
+
+// backgroundRoutes serves the owner-scoped background job API. Jobs run
+// in the package-user worker unit (conf/systemd), never as root.
+func (cfg Config) backgroundRoutes() []api.Route { return BackgroundRoutes(cfg.DataDir) }

package/dist/templates/native-go-background/backend/internal/app/background_routes_test.go

@@ -0,0 +1,32 @@
+package app
+
+func init() {
+	// The generic route tests need valid params for every background route.
+	// Background mode is off in a fresh data dir, so submit is refused before
+	// any file is read and the id routes find nothing.
+	const id = `{"id":"missing"}`
+	sampleParams["bg.users.set"] = `{"allowOrdinaryUsers":true}`
+	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
+	sampleParams["bg.schedules.list"] = `{}`
+	sampleParams["bg.schedules.create"] = `{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}`
+	sampleParams["bg.schedules.disable"] = id
+	sampleParams["bg.schedules.delete"] = id
+	sampleParams["bg.schedules.enable"] = `{"id":"missing","consent":true}`
+	sampleOutcome["bg.schedules.create"] = "disabled"
+	sampleOutcome["bg.schedules.disable"] = "not_found"
+	sampleOutcome["bg.schedules.delete"] = "not_found"
+	sampleOutcome["bg.schedules.enable"] = "not_found"
+	sampleParams["bg.status"] = `{}`
+	sampleParams["bg.mode.set"] = `{"enabled":true}`
+	sampleParams["bg.browse"] = `{}`
+	sampleParams["bg.jobs.submit"] = `{"key":"k1","folder":"/share","relative":"a.bin"}`
+	sampleParams["bg.jobs.list"] = `{}`
+	sampleParams["bg.jobs.get"] = id
+	sampleParams["bg.jobs.cancel"] = id
+	sampleParams["bg.jobs.result"] = id
+	sampleOutcome["bg.browse"] = "session_required"
+	sampleOutcome["bg.jobs.submit"] = "disabled"
+	sampleOutcome["bg.jobs.get"] = "not_found"
+	sampleOutcome["bg.jobs.cancel"] = "not_found"
+	sampleOutcome["bg.jobs.result"] = "not_found"
+}

package/dist/templates/native-go-background/frontend/src/background/BackgroundPanel.vue

@@ -0,0 +1,178 @@
+<script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,provide,ref} from 'vue'
+import {Button,Callout,Checkbox,Form,FormActions,FormItem,Link,Select,SettingsSection} from '@synopackageland/ui'
+import type {Context} from '../context'
+import M2PathPicker from '../nas/M2PathPicker.vue'
+import {M2ProviderKey,type M2JobSource} from '../nas/m2-contract'
+import {backgroundCopy,backgroundErrorCopy} from './i18n'
+import {createBackgroundPickerProvider} from './picker-provider'
+interface Status{owner?:Owner;enabled:boolean;admin:boolean;allowOrdinaryUsers:boolean;revision:number;worker:{username:string;alive:boolean}|null;limits:{maxInputBytes:number;maxQueued:number;maxOwnerPending:number;maxOwnerBytes:number;jobTimeoutSeconds:number}}
+interface Owner{user:string;uid:string}
+interface Job{copyRetained?:boolean;scheduleId?:string;submitter:Owner;id:string;name:string;state:'queued'|'running'|'succeeded'|'failed'|'canceled'|'interrupted'}
+interface Schedule{id:string;name:string;owner:Owner;enabled:boolean;nextAt:string;intervalSeconds:number;workerRevision:number;missed:number;reason?:string}
+const props=defineProps<{ctx:Pick<Context,'call'|'locale'>}>()
+const copy=computed(()=>backgroundCopy(props.ctx.locale))
+const fill=(text:string,values:Record<string,string|number>)=>text.replace(/\{(\w+)\}/g,(_,k)=>String(values[k]??''))
+const status=ref<Status>(),jobs=ref<Job[]>([]),error=ref<unknown>(),unsupported=ref(false),busy=ref(false)
+const schedules=ref<Schedule[]>([]),scheduleSource=ref<Job>(),scheduleConsent=ref(false),scheduleInterval=ref('3600'),scheduleDelete=ref<Schedule>(),scheduleEnable=ref<Schedule>()
+const purgeOwner=ref<Owner>(),refreshing=ref(false)
+const picking=ref(false),picked=ref<{folder:string;relative:string}>(),download=ref(''),downloadName=ref('')
+const picker=createBackgroundPickerProvider(props.ctx);provide(M2ProviderKey,picker)
+let timer:ReturnType<typeof setInterval>|undefined,disposed=false
+const settled=(j:Job)=>!['queued','running'].includes(j.state)
+async function call<T>(method:string,params?:Record<string,unknown>):Promise<T|undefined>{
+ try{return await props.ctx.call<T>(method,params)}
+ catch(e){
+  if(disposed)return undefined
+  if((e as {code?:string})?.code==='unsupported'){unsupported.value=true;jobs.value=[];schedules.value=[];scheduleSource.value=undefined;scheduleDelete.value=undefined;scheduleEnable.value=undefined;status.value=undefined;purgeOwner.value=undefined;picked.value=undefined;if(download.value)URL.revokeObjectURL(download.value);download.value=''}
+  else if(!disposed)error.value=e
+  return undefined
+ }
+}
+async function refresh(){
+ if(disposed||refreshing.value)return
+ refreshing.value=true
+ try{
+ const s=await call<Status>('bg.status')
+ if(!s||disposed)return
+ if(!s.limits||typeof s.enabled!=='boolean'||typeof s.admin!=='boolean'){error.value={code:'unavailable'};return}
+ unsupported.value=false;status.value=s
+ const list=await call<{jobs:Job[]}>('bg.jobs.list')
+ if(list&&!disposed)jobs.value=list.jobs??[]
+ const scheduleList=await call<{schedules:Schedule[]}>('bg.schedules.list')
+ if(scheduleList&&!disposed)schedules.value=scheduleList.schedules??[]
+ if(!disposed&&!status.value?.enabled&&jobs.value.every(settled)&&timer){clearInterval(timer);timer=undefined}
+ }finally{refreshing.value=false}
+}
+function poll(){if(!timer)timer=setInterval(()=>void refresh(),3000)}
+async function guarded(work:()=>Promise<unknown>){
+ if(busy.value)return
+ busy.value=true;error.value=undefined
+ try{await work();await refresh();if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}finally{if(!disposed)busy.value=false}
+}
+const setMode=(enabled:boolean)=>guarded(()=>call('bg.mode.set',{enabled}))
+const setUsers=(allowOrdinaryUsers:boolean)=>guarded(()=>call('bg.users.set',{allowOrdinaryUsers}))
+const purge=()=>guarded(async()=>{if(!purgeOwner.value)return;const out=await call('bg.jobs.purge',{owner:purgeOwner.value});if(out)purgeOwner.value=undefined})
+const intervalOptions=computed(()=>[{value:'3600',label:copy.value.hourly},{value:'86400',label:copy.value.daily},{value:'604800',label:copy.value.weekly}])
+const selectSchedule=(job:Job)=>{scheduleSource.value=job;scheduleConsent.value=false;scheduleInterval.value='3600'}
+const createSchedule=()=>guarded(async()=>{if(!scheduleSource.value||!scheduleConsent.value)return;const out=await call('bg.schedules.create',{key:crypto.randomUUID(),jobId:scheduleSource.value.id,intervalSeconds:Number(scheduleInterval.value),consent:true});if(out)scheduleSource.value=undefined})
+const disableSchedule=(id:string)=>guarded(()=>call('bg.schedules.disable',{id}))
+const deleteSchedule=()=>guarded(async()=>{if(!scheduleDelete.value)return;const out=await call('bg.schedules.delete',{id:scheduleDelete.value.id});if(out)scheduleDelete.value=undefined})
+const enableSchedule=()=>guarded(async()=>{if(!scheduleEnable.value)return;const out=await call('bg.schedules.enable',{id:scheduleEnable.value.id,consent:true});if(out)scheduleEnable.value=undefined})
+const formatTime=(value:string)=>{const date=new Date(value);return Number.isFinite(date.getTime())?date.toLocaleString():copy.value.unknownTime}
+const ownCopy=(job:Job)=>job.copyRetained&&job.state==='succeeded'&&!job.scheduleId&&job.submitter?.user===status.value?.owner?.user&&job.submitter?.uid===status.value?.owner?.uid
+const cancel=(id:string)=>guarded(()=>call('bg.jobs.cancel',{id}))
+const pick=(value:M2JobSource)=>{picked.value={folder:value.selection.folder,relative:value.segments.join('/')}}
+// The signed-in caller's own File Station session decides whether the
+// file can be read; the submit itself is the consent to copy that one file.
+const submit=()=>guarded(async()=>{
+ if(!picked.value)return
+ const sent=await call('bg.jobs.submit',{key:crypto.randomUUID(),...picked.value})
+ if(sent)picked.value=undefined
+})
+async function fetchResult(job:Job){
+ const value=await call<{result:unknown}>('bg.jobs.result',{id:job.id})
+ if(!value||disposed)return
+ if(download.value)URL.revokeObjectURL(download.value)
+ download.value=URL.createObjectURL(new Blob([JSON.stringify(value.result,null,2)],{type:'application/json'}))
+ downloadName.value=`${job.name||job.id}.sha256.json`
+}
+onMounted(()=>void refresh().then(()=>{if(status.value?.enabled||jobs.value.some(j=>!settled(j)))poll()}))
+onBeforeUnmount(()=>{disposed=true;picker.dispose();if(timer)clearInterval(timer);if(download.value)URL.revokeObjectURL(download.value)})
+</script>
+<template>
+ <SettingsSection :aria-busy="busy||refreshing" :title="copy.title" :collapsible="false" data-background-panel>
+  <Callout v-if="unsupported" tone="warning">{{ copy.unsupported }}</Callout>
+  <template v-else>
+   <p class="integration-help">{{ copy.help }}</p>
+   <Callout v-if="error" tone="danger" role="alert">{{ backgroundErrorCopy(error,copy) }}</Callout>
+   <template v-if="status">
+    <p role="status">{{ status.enabled ? copy.modeOn : copy.modeOff }} · {{ status.worker?.alive ? fill(copy.workerRunning,{user:status.worker.username}) : copy.workerStopped }}</p>
+    <p class="integration-help">{{ fill(copy.limits,{size:status.limits.maxInputBytes/1024,queue:status.limits.maxQueued,seconds:status.limits.jobTimeoutSeconds}) }}</p>
+    <p class="integration-help">{{ status.admin ? copy.adminScope : copy.ownerScope }}</p>
+    <p class="integration-help">{{ fill(copy.ownerLimits,{jobs:status.limits.maxOwnerPending,size:status.limits.maxOwnerBytes/1024}) }}</p>
+    <div class="integration-actions">
+     <Button v-if="status.admin&&!status.enabled" variant="primary" :disabled="busy" @click="setMode(true)">{{ copy.enable }}</Button>
+     <Button v-else-if="status.admin" variant="secondary" :disabled="busy" @click="setMode(false)">{{ copy.disable }}</Button>
+     <Button variant="secondary" :disabled="busy" @click="refresh">{{ copy.refresh }}</Button>
+    </div>
+    <div v-if="status.admin" class="integration-actions">
+     <Button variant="secondary" :disabled="busy" @click="setUsers(!status.allowOrdinaryUsers)">{{ status.allowOrdinaryUsers ? copy.blockUsers : copy.allowUsers }}</Button>
+     <span role="status">{{ status.allowOrdinaryUsers ? copy.usersOn : copy.usersOff }}</span>
+    </div>
+    <template v-if="status.enabled">
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="picking=true">{{ copy.chooseFile }}</Button>
+      <Button variant="primary" :disabled="busy||!picked" @click="submit">{{ copy.submit }}</Button>
+     </div>
+     <p v-if="picked" role="status" data-bg-picked>{{ fill(copy.chosen,{path:`${picked.folder}/${picked.relative}`}) }}</p>
+     <M2PathPicker v-model:open="picking" :locale="ctx.locale" select-files read-only :title="copy.pickerTitle" :consent="copy.pickerConsent" @source="pick" />
+    </template>
+    <Callout v-if="purgeOwner&&status.admin" tone="warning">
+     <p>{{ fill(copy.purgeConfirm,{user:purgeOwner.user,uid:purgeOwner.uid}) }}</p>
+     <div class="integration-actions">
+      <Button variant="secondary" :disabled="busy" @click="purge">{{ copy.confirmPurge }}</Button>
+      <Button variant="secondary" :disabled="busy" @click="purgeOwner=undefined">{{ copy.keepJobs }}</Button>
+     </div>
+    </Callout>
+    <p v-if="!jobs.length">{{ copy.noJobs }}</p>
+    <ul v-else class="integration-jobs">
+     <li v-for="job in jobs" :key="job.id" :data-job-state="job.state" :data-job-id="job.id">
+      <span class="nas-folder-name">{{ job.name }} — {{ copy[`state_${job.state}`] }}</span>
+      <span v-if="status.admin&&job.submitter" class="integration-help">{{ fill(copy.owner,{user:job.submitter.user,uid:job.submitter.uid}) }}</span>
+      <Button v-if="status.admin&&job.submitter" variant="secondary" :disabled="busy" @click="purgeOwner=job.submitter">{{ copy.purgeOwner }}</Button>
+      <Button v-if="!settled(job)" variant="secondary" :disabled="busy" @click="cancel(job.id)">{{ copy.cancel }}</Button>
+      <Button v-if="status.enabled&&ownCopy(job)" variant="secondary" :disabled="busy" @click="selectSchedule(job)">{{ copy.scheduleCopy }}</Button>
+      <span v-if="job.scheduleId" class="integration-help">{{ copy.scheduledJob }}</span>
+      <Button v-if="job.state==='succeeded'" variant="secondary" :disabled="busy" @click="fetchResult(job)">{{ copy.result }}</Button>
+     </li>
+    </ul>
+    <section data-bg-schedules class="bg-schedules" :aria-label="copy.schedulesTitle">
+     <h3>{{ copy.schedulesTitle }}</h3>
+     <p class="integration-help">{{ copy.scheduleHelp }}</p>
+     <Form v-if="scheduleSource&&status.enabled" class="bg-schedule-form" @submit.prevent="createSchedule">
+      <p>{{ fill(copy.scheduleSource,{name:scheduleSource.name}) }}</p>
+      <FormItem :label="copy.interval"><Select v-model="scheduleInterval" data-schedule-interval :options="intervalOptions" :disabled="busy" /></FormItem>
+      <Checkbox v-model="scheduleConsent" data-schedule-consent :disabled="busy" :label="copy.scheduleConsent" />
+      <FormActions><Button type="submit" variant="primary" :disabled="busy||!scheduleConsent">{{ copy.createSchedule }}</Button><Button type="button" variant="secondary" :disabled="busy" @click="scheduleSource=undefined">{{ copy.cancel }}</Button></FormActions>
+     </Form>
+     <p v-if="!schedules.length">{{ copy.noSchedules }}</p>
+     <ul v-else class="integration-jobs">
+      <li v-for="schedule in schedules" :key="schedule.id" :data-schedule-id="schedule.id">
+       <span class="nas-folder-name">{{ schedule.name }} — {{ schedule.enabled ? copy.scheduleOn : copy.scheduleOff }}</span>
+       <span v-if="status.admin" class="integration-help">{{ fill(copy.owner,{user:schedule.owner.user,uid:schedule.owner.uid}) }}</span>
+       <span v-if="schedule.enabled" class="integration-help">{{ fill(copy.nextRun,{time:formatTime(schedule.nextAt)}) }}</span>
+       <span class="integration-help">{{ fill(copy.missedRuns,{count:schedule.missed}) }}</span>
+       <Callout v-if="schedule.reason==='worker-changed'" tone="warning">{{ copy.revisionChanged }}</Callout>
+       <Callout v-else-if="schedule.reason==='input-unavailable'" tone="warning">{{ copy.errors['input-unavailable'] }}</Callout>
+       <div class="integration-actions">
+       <Button v-if="schedule.enabled" variant="secondary" :disabled="busy" @click="disableSchedule(schedule.id)">{{ copy.disableSchedule }}</Button>
+       <Button v-else-if="status.admin&&status.enabled" variant="secondary" :disabled="busy" @click="scheduleEnable=schedule">{{ copy.enableSchedule }}</Button>
+       <Button variant="secondary" :disabled="busy" @click="scheduleDelete=schedule">{{ copy.deleteSchedule }}</Button>
+       </div>
+      </li>
+     </ul>
+     <Callout v-if="scheduleDelete" tone="warning">
+      <p>{{ fill(copy.deleteScheduleConsent,{name:scheduleDelete.name}) }}</p>
+      <div class="integration-actions"><Button variant="danger" :disabled="busy" @click="deleteSchedule">{{ copy.confirmDeleteSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleDelete=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+     <Callout v-if="scheduleEnable" tone="warning">
+      <p>{{ fill(copy.enableScheduleConsent,{name:scheduleEnable.name}) }}</p>
+      <div class="integration-actions"><Button variant="primary" :disabled="busy" @click="enableSchedule">{{ copy.confirmEnableSchedule }}</Button><Button variant="secondary" :disabled="busy" @click="scheduleEnable=undefined">{{ copy.cancel }}</Button></div>
+     </Callout>
+    </section>
+    <Link v-if="download" :href="download" :download="downloadName">{{ copy.download }}</Link>
+   </template>
+  </template>
+ </SettingsSection>
+</template>
+
+<style scoped>
+.integration-jobs { overflow-wrap:anywhere; min-width:0; }
+.bg-schedules { margin-block-start: var(--ui-space-6,24px); min-width:0; overflow-wrap:anywhere; }
+.bg-schedules .integration-jobs { display:grid; gap:var(--ui-space-4,16px); padding-inline-start:var(--ui-space-5,20px); }
+.bg-schedules .integration-jobs li { display:flex; flex-direction:column; align-items:flex-start; gap:var(--ui-space-2,8px); min-width:0; }
+.bg-schedules p, .bg-schedules li > span { min-width:0; max-width:100%; }
+.bg-schedules h3 { font-size:15px; font-weight:600; }
+.bg-schedule-form { margin-block:var(--ui-space-4,16px); }
+</style>

package/dist/templates/native-go-background/frontend/src/background/i18n/de.json

@@ -0,0 +1,83 @@
+{
+  "title": "Hintergrundaufträge",
+  "help": "Kopiert eine ausgewählte Datei ins Paket und berechnet ihren SHA-256 als Paketbenutzer. Aufträge laufen nach der Abmeldung weiter. Kopie und Ergebnis bleiben im Paket; geänderte Quellberechtigungen rufen sie nicht zurück. Melden Sie sich erneut an, um Ihr Ergebnis zu sehen.",
+  "unsupported": "Hintergrundaufträge sind für Ihr Konto nicht verfügbar. Bitten Sie einen Administrator, normale Benutzer zuzulassen.",
+  "modeOn": "Hintergrundmodus ist an",
+  "modeOff": "Hintergrundmodus ist aus",
+  "enable": "Einschalten",
+  "disable": "Ausschalten",
+  "worker": "Worker",
+  "workerRunning": "Worker läuft als {user}",
+  "workerStopped": "Worker läuft nicht",
+  "chooseFile": "Datei auswählen",
+  "chosen": "Ausgewählte Datei: {path}",
+  "pickerTitle": "Datei zum Importieren auswählen",
+  "pickerConsent": "Die ausgewählte Datei wird einmalig mit Ihrer aktuellen DSM-Anmeldung gelesen und an den Hintergrundjob übergeben. Es wird keine Berechtigung gespeichert.",
+  "submit": "Importieren und senden",
+  "refresh": "Aktualisieren",
+  "cancel": "Abbrechen",
+  "result": "Ergebnis",
+  "download": "Ergebnis herunterladen",
+  "noJobs": "Noch keine Aufträge",
+  "state_queued": "In Warteschlange",
+  "state_running": "Läuft",
+  "state_succeeded": "Erfolgreich",
+  "state_failed": "Fehlgeschlagen",
+  "state_canceled": "Abgebrochen",
+  "state_interrupted": "Unterbrochen",
+  "limits": "Bis zu {size} KiB pro Datei, {queue} Aufträge in der Warteschlange, {seconds} Sekunden pro Auftrag.",
+  "errors": {
+    "failed": "Die Anfrage konnte nicht abgeschlossen werden. Aktualisieren und erneut versuchen.",
+    "unsupported": "Hintergrundaufträge sind für Ihr Konto nicht verfügbar. Bitten Sie einen Administrator, normale Benutzer zuzulassen.",
+    "disabled": "Der Hintergrundmodus ist aus.",
+    "limit-exceeded": "Die Datei überschreitet das Limit.",
+    "queue-full": "Die Warteschlange ist voll.",
+    "quota-exceeded": "Der Hintergrundspeicher ist voll.",
+    "conflict": "Der Auftragsstatus hat sich geändert. Aktualisieren.",
+    "not_found": "Nicht gefunden.",
+    "denied": "Zugriff verweigert.",
+    "session_required": "Ihre DSM-Sitzung ist abgelaufen. Melden Sie sich erneut an.",
+    "owner-queue-full": "Ihr Limit für offene Aufträge ist erreicht. Warten Sie auf einen Abschluss oder brechen Sie einen Auftrag ab.",
+    "owner-quota-exceeded": "Ihr Speicherlimit ist erreicht. Bitten Sie einen Administrator, alte Aufträge zu löschen.",
+    "identity_unavailable": "Ihre DSM-Benutzer-UID konnte nicht geprüft werden. Melden Sie sich erneut an oder fragen Sie einen Administrator.",
+    "schedule-full": "Maximal 8 Zeitpläne. Löschen Sie einen Zeitplan.",
+    "input-unavailable": "Die private Kopie fehlt oder wurde geändert. Importieren Sie sie erneut."
+  },
+  "ownerScope": "Sie können nur eigene Aufträge sehen, abbrechen und herunterladen.",
+  "adminScope": "Administratoren können Aufträge aller Benutzer sehen und abbrechen.",
+  "ownerLimits": "Pro Benutzer: {jobs} offene Aufträge und {size} KiB für Eingaben und reservierte Ergebnisse.",
+  "allowUsers": "Normale Benutzer zulassen",
+  "blockUsers": "Normale Benutzer sperren",
+  "usersOn": "Normale Benutzer zugelassen",
+  "usersOff": "Normale Benutzer gesperrt",
+  "owner": "Besitzer: {user} (UID {uid})",
+  "purgeOwner": "Aufträge des Besitzers löschen",
+  "purgeConfirm": "Alle Aufträge von {user} (UID {uid}) löschen? Laufende Aufträge werden abgebrochen und beendet; gespeicherte Ergebnisse werden entfernt.",
+  "confirmPurge": "Löschen bestätigen",
+  "keepJobs": "Aufträge behalten",
+  "schedulesTitle": "Zeitpläne",
+  "scheduleHelp": "Die feste private Kopie wird als Paketbenutzer stündlich, täglich oder wöchentlich neu berechnet. Bis zu 8 Zeitpläne. Verpasste Läufe werden protokolliert, nicht nachgeholt.",
+  "scheduleCopy": "Diese Kopie planen",
+  "scheduleSource": "Private Kopie: {name}",
+  "interval": "Wiederholungsintervall",
+  "hourly": "Stündlich",
+  "daily": "Täglich",
+  "weekly": "Wöchentlich",
+  "scheduleConsent": "Ich stimme zu, diese feste Kopie zu speichern und als Paketbenutzer neu zu berechnen. Neue Quelldateien und persönliche ACLs werden nicht gelesen.",
+  "createSchedule": "Zeitplan erstellen",
+  "noSchedules": "Noch keine Zeitpläne",
+  "scheduleOn": "Aktiviert",
+  "scheduleOff": "Deaktiviert",
+  "nextRun": "Nächster Lauf: {time}",
+  "missedRuns": "Verpasste Läufe: {count}",
+  "disableSchedule": "Zeitplan deaktivieren",
+  "deleteSchedule": "Zeitplan löschen",
+  "deleteScheduleConsent": "Zeitplan für {name} löschen? Wartende Jobs werden abgebrochen, laufende Jobs werden gestoppt und abgeschlossen. Fertige Ergebnisse bleiben erhalten.",
+  "confirmDeleteSchedule": "Löschen bestätigen",
+  "enableSchedule": "Zeitplan aktivieren",
+  "enableScheduleConsent": "Zeitplan für {name} mit der aktuellen Worker-Revision aktivieren? Ich stimme der Neuberechnung dieser festen Kopie zu. Frühere Läufe werden nicht wiederholt.",
+  "confirmEnableSchedule": "Aktivierung bestätigen",
+  "revisionChanged": "Die Worker-Revision hat sich geändert. Ein Administrator muss diesen Zeitplan prüfen und ausdrücklich aktivieren.",
+  "scheduledJob": "Geplanter Lauf",
+  "unknownTime": "Unbekannt"
+}

package/dist/templates/native-go-background/frontend/src/background/i18n/en.json

@@ -0,0 +1,83 @@
+{
+  "title": "Background jobs",
+  "help": "Copies one selected file into this package and computes its SHA-256 as the package user. Jobs continue after sign-out. The package keeps the copy and result; changes to source permissions do not recall them. Sign back in to read your result.",
+  "unsupported": "Background jobs are not available to your account. Ask an administrator to allow ordinary users.",
+  "modeOn": "Background mode is on",
+  "modeOff": "Background mode is off",
+  "enable": "Turn on",
+  "disable": "Turn off",
+  "worker": "Worker",
+  "workerRunning": "Worker is running as {user}",
+  "workerStopped": "Worker is not running",
+  "chooseFile": "Choose a file",
+  "chosen": "Selected file: {path}",
+  "pickerTitle": "Choose a file to import",
+  "pickerConsent": "The selected file is read once with your current DSM sign-in and handed to the background job. No permission is saved.",
+  "submit": "Import and submit",
+  "refresh": "Refresh",
+  "cancel": "Cancel",
+  "result": "Result",
+  "download": "Download result",
+  "noJobs": "No jobs yet",
+  "state_queued": "Queued",
+  "state_running": "Running",
+  "state_succeeded": "Succeeded",
+  "state_failed": "Failed",
+  "state_canceled": "Canceled",
+  "state_interrupted": "Interrupted",
+  "limits": "Up to {size} KiB per file, {queue} queued jobs, {seconds} seconds per job.",
+  "errors": {
+    "failed": "The request could not be completed. Refresh and try again.",
+    "unsupported": "Background jobs are not available to your account. Ask an administrator to allow ordinary users.",
+    "disabled": "Background mode is off.",
+    "limit-exceeded": "The file is larger than the limit.",
+    "queue-full": "The queue is full.",
+    "quota-exceeded": "The background storage is full.",
+    "conflict": "The job changed state. Refresh.",
+    "not_found": "Not found.",
+    "denied": "Access was denied.",
+    "session_required": "Your DSM session expired. Sign in again.",
+    "owner-queue-full": "Your pending job limit is reached. Wait for a job to finish or cancel one.",
+    "owner-quota-exceeded": "Your background storage limit is reached. Ask an administrator to clear your old jobs.",
+    "identity_unavailable": "Your DSM user UID could not be verified. Sign in again or ask an administrator.",
+    "schedule-full": "The 8-schedule limit is reached. Delete a schedule.",
+    "input-unavailable": "The private copy is unavailable or changed. Import it again."
+  },
+  "ownerScope": "You can see, cancel and download only your own jobs.",
+  "adminScope": "Administrators can see and cancel every user’s jobs.",
+  "ownerLimits": "Per user: {jobs} pending jobs and {size} KiB of input and reserved result storage.",
+  "allowUsers": "Allow ordinary users",
+  "blockUsers": "Block ordinary users",
+  "usersOn": "Ordinary users allowed",
+  "usersOff": "Ordinary users blocked",
+  "owner": "Owner: {user} (UID {uid})",
+  "purgeOwner": "Clear owner’s jobs",
+  "purgeConfirm": "Clear all jobs owned by {user} (UID {uid})? Running jobs are canceled and drained; this removes their saved results.",
+  "confirmPurge": "Confirm clear",
+  "keepJobs": "Keep jobs",
+  "schedulesTitle": "Schedules",
+  "scheduleHelp": "Reprocess a fixed private copy hourly, daily or weekly as the package user. Up to 8 schedules; missed runs are recorded and never replayed.",
+  "scheduleCopy": "Schedule this copy",
+  "scheduleSource": "Private copy: {name}",
+  "interval": "Repeat every",
+  "hourly": "Hour",
+  "daily": "Day",
+  "weekly": "Week",
+  "scheduleConsent": "I agree to keep and reprocess this fixed copy as the package user. No new source files or personal ACLs are read.",
+  "createSchedule": "Create schedule",
+  "noSchedules": "No schedules yet",
+  "scheduleOn": "Enabled",
+  "scheduleOff": "Disabled",
+  "nextRun": "Next run: {time}",
+  "missedRuns": "Missed runs: {count}",
+  "disableSchedule": "Disable schedule",
+  "deleteSchedule": "Delete schedule",
+  "deleteScheduleConsent": "Delete the schedule for {name}? Queued jobs are canceled and running jobs drain. Finished results remain.",
+  "confirmDeleteSchedule": "Confirm delete",
+  "enableSchedule": "Enable schedule",
+  "enableScheduleConsent": "Enable the schedule for {name} with the current worker revision? I agree to reprocess this fixed copy. Past runs will not be replayed.",
+  "confirmEnableSchedule": "Confirm enable",
+  "revisionChanged": "The worker revision changed. An administrator must review and explicitly enable this schedule.",
+  "scheduledJob": "Scheduled run",
+  "unknownTime": "Unknown"
+}

package/dist/templates/native-go-background/frontend/src/background/i18n/es.json

@@ -0,0 +1,83 @@
+{
+  "title": "Trabajos en segundo plano",
+  "help": "Copia un archivo seleccionado al paquete y calcula su SHA-256 con la cuenta del paquete. Los trabajos continúan al cerrar sesión. El paquete conserva la copia y el resultado; cambiar los permisos de origen no los retira. Inicia sesión de nuevo para ver tu resultado.",
+  "unsupported": "Tu cuenta no puede usar trabajos en segundo plano. Pide a un administrador que permita usuarios normales.",
+  "modeOn": "El modo en segundo plano está activado",
+  "modeOff": "El modo en segundo plano está desactivado",
+  "enable": "Activar",
+  "disable": "Desactivar",
+  "worker": "Worker",
+  "workerRunning": "El worker se ejecuta como {user}",
+  "workerStopped": "El worker no se está ejecutando",
+  "chooseFile": "Elegir un archivo",
+  "chosen": "Archivo seleccionado: {path}",
+  "pickerTitle": "Elegir un archivo para importar",
+  "pickerConsent": "El archivo seleccionado se lee una sola vez con su inicio de sesión de DSM actual y se entrega al trabajo en segundo plano. No se guarda ningún permiso.",
+  "submit": "Importar y enviar",
+  "refresh": "Actualizar",
+  "cancel": "Cancelar",
+  "result": "Resultado",
+  "download": "Descargar resultado",
+  "noJobs": "Aún no hay trabajos",
+  "state_queued": "En cola",
+  "state_running": "En ejecución",
+  "state_succeeded": "Correcto",
+  "state_failed": "Error",
+  "state_canceled": "Cancelado",
+  "state_interrupted": "Interrumpido",
+  "limits": "Hasta {size} KiB por archivo, {queue} trabajos en cola, {seconds} segundos por trabajo.",
+  "errors": {
+    "failed": "No se pudo completar la solicitud. Actualice e inténtelo de nuevo.",
+    "unsupported": "Tu cuenta no puede usar trabajos en segundo plano. Pide a un administrador que permita usuarios normales.",
+    "disabled": "El modo en segundo plano está desactivado.",
+    "limit-exceeded": "El archivo supera el límite.",
+    "queue-full": "La cola está llena.",
+    "quota-exceeded": "El almacenamiento en segundo plano está lleno.",
+    "conflict": "El estado del trabajo cambió. Actualice.",
+    "not_found": "No encontrado.",
+    "denied": "Acceso denegado.",
+    "session_required": "Su sesión de DSM caducó. Inicie sesión de nuevo.",
+    "owner-queue-full": "Has alcanzado el límite de trabajos pendientes. Espera a que termine uno o cancélalo.",
+    "owner-quota-exceeded": "Has alcanzado el límite de almacenamiento. Pide a un administrador que borre trabajos antiguos.",
+    "identity_unavailable": "No se pudo verificar tu UID de usuario DSM. Inicia sesión de nuevo o contacta con un administrador.",
+    "schedule-full": "Se alcanzó el límite de 8 programaciones. Elimine una.",
+    "input-unavailable": "La copia privada no está disponible o cambió. Impórtela de nuevo."
+  },
+  "ownerScope": "Solo puedes ver, cancelar y descargar tus propios trabajos.",
+  "adminScope": "Los administradores pueden ver y cancelar los trabajos de todos los usuarios.",
+  "ownerLimits": "Por usuario: {jobs} trabajos pendientes y {size} KiB para entradas y resultados reservados.",
+  "allowUsers": "Permitir usuarios normales",
+  "blockUsers": "Bloquear usuarios normales",
+  "usersOn": "Usuarios normales permitidos",
+  "usersOff": "Usuarios normales bloqueados",
+  "owner": "Propietario: {user} (UID {uid})",
+  "purgeOwner": "Borrar trabajos del propietario",
+  "purgeConfirm": "¿Borrar todos los trabajos de {user} (UID {uid})? Los trabajos en curso se cancelarán y terminarán; se eliminarán los resultados guardados.",
+  "confirmPurge": "Confirmar borrado",
+  "keepJobs": "Conservar trabajos",
+  "schedulesTitle": "Programaciones",
+  "scheduleHelp": "Recalcula la copia privada fija como usuario del paquete cada hora, día o semana. Hasta 8 programaciones. Las ejecuciones perdidas se registran sin recuperarlas.",
+  "scheduleCopy": "Programar esta copia",
+  "scheduleSource": "Copia privada: {name}",
+  "interval": "Intervalo de repetición",
+  "hourly": "Cada hora",
+  "daily": "Cada día",
+  "weekly": "Cada semana",
+  "scheduleConsent": "Acepto conservar esta copia fija y recalcularla como usuario del paquete. No se leen nuevos archivos de origen ni ACL personales.",
+  "createSchedule": "Crear programación",
+  "noSchedules": "No hay programaciones",
+  "scheduleOn": "Activada",
+  "scheduleOff": "Desactivada",
+  "nextRun": "Próxima ejecución: {time}",
+  "missedRuns": "Ejecuciones perdidas: {count}",
+  "disableSchedule": "Desactivar programación",
+  "deleteSchedule": "Eliminar programación",
+  "deleteScheduleConsent": "¿Eliminar la programación de {name}? Los trabajos en cola se cancelan y los activos se detienen y finalizan. Se conservan los resultados completados.",
+  "confirmDeleteSchedule": "Confirmar eliminación",
+  "enableSchedule": "Activar programación",
+  "enableScheduleConsent": "¿Activar la programación de {name} con la revisión actual del worker? Acepto recalcular esta copia fija. No se repetirán ejecuciones anteriores.",
+  "confirmEnableSchedule": "Confirmar activación",
+  "revisionChanged": "La revisión del worker cambió. Un administrador debe revisar y activar explícitamente esta programación.",
+  "scheduledJob": "Ejecución programada",
+  "unknownTime": "Desconocida"
+}