@synopackageland/cli 0.4.1 → 0.5.3

package/dist/init.js

@@ -1,14 +1,23 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, join, relative } from "node:path";
 import { templatesRoot } from "./template-paths.js";
+import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
+import { readSharedFolder } from "./standalone/shared-folder.js";
 const TEMPLATE_NAMES = [
-    "hello-web",
-    "hello-web-page",
     "hello-files",
     "compose-import",
     "binary",
     "native-go",
 ];
+/** Templates whose App runs through the DSM docker-project resource worker. */
+const CONTAINER_TEMPLATES = [
+    "hello-files",
+    "compose-import",
+];
+/** The container templates need DSM 7.2.1 or later; native-go and binary need 7.1. */
+export function isContainerTemplate(template) {
+    return CONTAINER_TEMPLATES.includes(template);
+}
 export function isTemplateName(value) {
     return TEMPLATE_NAMES.includes(value);
 }
@@ -17,10 +26,14 @@ export function listTemplates() {
 }
 /**
  * native-go --privilege root: files laid over the native-go template, and the
- * files they replace.
+ * files they replace. An integration's helper brings its own root tasks, so
+ * the whoami example is not added to it.
  */
 const ROOT_OVERLAY = "native-go-root";
 const ROOT_REPLACED = ["backend/internal/app/root_none.go"];
+/** native-go --background: overlay with the routes, the UI panel and the docs. */
+const BACKGROUND_OVERLAY = "native-go-background";
+const BACKGROUND_REPLACED = ["backend/internal/app/background_none.go"];
 /** Templates whose identity is filled in at init (placeholders in these files). */
 const SUBSTITUTED = {
     "native-go": ["dsm-package.yaml", "README.md"],
@@ -42,22 +55,52 @@ function defaultDisplayName(dir) {
 function templateFiles(root, dir = root) {
     return readdirSync(dir).flatMap((name) => {
         const path = join(dir, name);
-        return statSync(path).isDirectory() ? templateFiles(root, path) : [relative(root, path)];
+        if (statSync(path).isDirectory()) {
+            return isTemplateBuildArtifact(path) ? [] : templateFiles(root, path);
+        }
+        return [relative(root, path)];
     });
 }
 function targetName(file) {
     return RENAMED[file] ?? file;
 }
+/** native-go defaults to the Vue shell; the CLI and the library entry point agree. */
+function resolvedUi(template, options) {
+    return template === "native-go" ? options.ui ?? "vue" : options.ui;
+}
+/**
+ * Copy one template tree into a project. A template directory may carry a local
+ * `node_modules`/`dist` from developing the template itself; those never belong
+ * to a generated project (and would otherwise shadow the project's own install).
+ */
+export function copyTemplateTree(source, target) {
+    cpSync(source, target, { recursive: true, filter: (path) => !isTemplateBuildArtifact(path) });
+}
+function isTemplateBuildArtifact(path) {
+    const name = basename(path);
+    return name === "node_modules" || name === "dist";
+}
 export function initFromTemplate(template, targetDir, options = {}) {
     const source = join(templatesRoot(), template);
     if (!existsSync(source)) {
         throw new Error(`找不到模板：${template}`);
     }
+    const minDsm = options.minDsm === undefined ? undefined : resolveMinDsm(options.minDsm);
+    if (minDsm !== undefined && isContainerTemplate(template)) {
+        assertContainerMinDsm(minDsm);
+    }
     const substitutions = substitutionsFor(template, targetDir, options);
-    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    const ui = resolvedUi(template, options);
+    const privilege = options.privilege ?? "none";
+    if (privilege === "root" && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
+        throw new Error(`[MIN_DSM_INVALID] root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
+    }
+    const rootExample = privilege === "root" && !options.integration;
     const overlays = [
-        ...(privilege === "root" ? [ROOT_OVERLAY] : []),
-        ...(options.ui === "vue" ? ["native-go-vue"] : []),
+        ...(rootExample ? [ROOT_OVERLAY] : []),
+        ...(ui === "vue" ? ["native-go-vue"] : []),
+        ...(privilege === "root" ? ["native-go-authorization"] : []),
+        ...(options.background ? [BACKGROUND_OVERLAY] : []),
         ...(options.integration ? ["native-go-integration"] : []),
         ...(options.integration === "better-auth" ? ["native-go-better-auth"] : []),
     ].map(name => join(templatesRoot(), name));
@@ -65,25 +108,29 @@ export function initFromTemplate(template, targetDir, options = {}) {
     // terms are an unconditional part of a generated project.
     const shared = join(templatesRoot(), "_shared");
     const files = [...templateFiles(source), "LICENSES/TEMPLATE.txt", ...overlays.flatMap(root => templateFiles(root)),
-        ...(options.ui === "vue" ? ["frontend/third-party-notices.mjs"] : []),
+        ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : []),
         ...(options.integration === "better-auth" ? ["node/third-party-notices.mjs", ...templateFiles(join(shared, 'notice-overrides')).map(file => `node/notice-overrides/${file}`)] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
     }
     mkdirSync(targetDir, { recursive: true });
-    cpSync(source, targetDir, { recursive: true });
+    copyTemplateTree(source, targetDir);
     mkdirSync(join(targetDir, "LICENSES"), { recursive: true });
     cpSync(join(shared, "LICENSES/TEMPLATE.txt"), join(targetDir, "LICENSES/TEMPLATE.txt"));
     for (const overlay of overlays)
-        cpSync(overlay, targetDir, { recursive: true });
-    for (const dir of [...(options.ui === "vue" ? ["frontend"] : []), ...(options.integration === "better-auth" ? ["node"] : [])]) {
+        copyTemplateTree(overlay, targetDir);
+    for (const dir of [...(ui === "vue" ? ["frontend"] : []), ...(options.integration === "better-auth" ? ["node"] : [])]) {
         cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
     }
     if (options.integration === "better-auth")
         cpSync(join(shared, 'notice-overrides'), join(targetDir, 'node/notice-overrides'), { recursive: true });
     if (privilege === "root")
+        rmSync(join(targetDir, "backend/internal/app/authorization_none.go"));
+    if (rootExample)
         ROOT_REPLACED.forEach(file => rmSync(join(targetDir, file)));
+    if (options.background)
+        BACKGROUND_REPLACED.forEach(file => rmSync(join(targetDir, file)));
     for (const [from, to] of Object.entries(RENAMED)) {
         if (files.includes(from)) {
             renameSync(join(targetDir, from), join(targetDir, to));
@@ -97,11 +144,53 @@ export function initFromTemplate(template, targetDir, options = {}) {
         }
         writeFileSync(path, text);
     }
-    if (options.ui === "vue") {
+    if (minDsm) {
+        const manifest = join(targetDir, template === "native-go" ? "dsm-package.yaml" : "synology-app.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^os_min_ver:.*$/m, `os_min_ver: "${minDsm}"`));
+    }
+    if (ui === "vue") {
         const manifest = join(targetDir, "dsm-package.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace("  dir: ui", "  dir: frontend/dist\n  build: {cwd: frontend, command: [npm, run, build]}"));
         rmSync(join(targetDir, "ui"), { recursive: true });
     }
+    if (privilege === "root" && ui === "vue") {
+        for (const entry of ["App.vue", "SDKApp.vue"]) {
+            const app = join(targetDir, "frontend/src", entry);
+            writeFileSync(app, readFileSync(app, "utf8")
+                .replace("import AppShell from './shell/AppShell.vue'", "import AuthorizationGate from './authorization/AuthorizationGate.vue'\nimport AppShell from './shell/AppShell.vue'")
+                .replace('<AppShell v-model="page"', '<AuthorizationGate :ctx="ctx" @ready="authorizationReady"><AppShell v-model="page"')
+                .replace('onMounted(async()=>{\n props.ctx.reopen(()=>{if(!disposed) void refresh()})\n await refresh()', 'async function authorizationReady(){\n await refresh()')
+                .replace('})\nonUnmounted', '}\nonMounted(()=>{if(!props.ctx.authorization){props.ctx.reopen(()=>{if(!disposed) void refresh()});void authorizationReady()}})\nonUnmounted')
+                .replace('</AppShell>', '</AppShell></AuthorizationGate>'));
+        }
+        for (const entry of ["main.ts", "sdk-main.ts"]) {
+            const main = join(targetDir, "frontend/src", entry);
+            writeFileSync(main, readFileSync(main, "utf8").replace('{mount: typeof mount}', '{mount: typeof mount; authorizationUI?: boolean}').replace('{mount}', '{mount, authorizationUI: true}'));
+        }
+        for (const file of ["apps.test.ts", "nas-ui.test.ts", "shell-ui.test.ts", "shell-sdk.test.ts", "picker-wire.test.ts"]) {
+            const test = join(targetDir, "frontend/test", file);
+            const source = readFileSync(test, "utf8");
+            writeFileSync(test, source + "\n// Test the application surface independently; authorization has its own contract suite.\nvi.mock('../src/authorization/AuthorizationGate.vue',()=>({default:{template:'<slot />'}}))\n");
+        }
+    }
+    if (ui !== "vue")
+        rmSync(join(targetDir, "frontend"), { recursive: true, force: true });
+    if (options.background) {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nbackground:\n  worker: sha256-v1\n");
+        const app = join(targetDir, "frontend/src/App.vue");
+        writeFileSync(app, readFileSync(app, "utf8")
+            .replace("import NasUnavailable from './nas/NasUnavailable.vue'\n", "import NasUnavailable from './nas/NasUnavailable.vue'\nimport BackgroundPanel from './background/BackgroundPanel.vue'\n")
+            .replace("   <!-- BACKGROUND_PANEL -->", "   <BackgroundPanel v-if=\"app\" :key=\"app.user\" :ctx=\"ctx\" />"));
+    }
+    if (options.fileStation) {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + "\nfileStation: session\n");
+    }
+    if (options.sharedFolder) {
+        const manifest = join(targetDir, "dsm-package.yaml");
+        writeFileSync(manifest, readFileSync(manifest, "utf8") + sharedFolderYaml(options.sharedFolder));
+    }
     if (options.integration === "better-auth")
         rmSync(join(targetDir, "backend/internal/app/identity_none.go"));
     if (options.integration) {
@@ -113,12 +202,31 @@ export function initFromTemplate(template, targetDir, options = {}) {
         writeFileSync(routes, readFileSync(routes, "utf8").replace("return append(routes, cfg.rootRoutes()...)", "routes = append(routes, cfg.integrationRoutes()...)\n\treturn append(routes, cfg.rootRoutes()...)"));
     }
 }
+/** The `install.sharedFolder` block, validated by the same reader build-spk uses. */
+function sharedFolderYaml(options) {
+    const folder = { mode: options.mode, key: options.key ?? "shared", ...(options.name === undefined ? {} : { name: options.name }), permission: options.permission ?? "rw" };
+    const errors = [];
+    if (!readSharedFolder({ sharedFolder: folder }, e => errors.push(e.message))) {
+        throw new Error(`[INIT_SHARED_FOLDER_INVALID] ${errors.join(" ")}`);
+    }
+    return `\ninstall:\n  sharedFolder:\n${Object.entries(folder).map(([k, v]) => `    ${k}: ${v}\n`).join("")}`;
+}
 function substitutionsFor(template, targetDir, options) {
+    const ui = resolvedUi(template, options);
     if (options.privilege !== undefined && template !== "native-go") {
         throw new Error("[INIT_PRIVILEGE_UNSUPPORTED] --privilege 只適用於 -t native-go。");
     }
     if ((options.ui !== undefined || options.integration !== undefined) && template !== "native-go")
         throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui/--integration 只適用於 native-go。");
+    if (options.background && (template !== "native-go" || ui !== "vue" || options.privilege === "root" || options.integration === "better-auth"))
+        throw new Error("[INIT_BACKGROUND_OPTIONS] --background 只適用於 -t native-go 的 Vue UI（--ui vue，預設；--ui plain 不適用），且不能與 --privilege root 或 --integration better-auth 併用（背景 worker 只以套件帳號執行）；可與 --integration go、--file-station 併用。");
+    if (options.fileStation && (template !== "native-go" || (options.integration !== undefined && options.privilege === "root")))
+        throw new Error("[INIT_FILESTATION_OPTIONS] --file-station 只適用於 -t native-go，且不能與 --privilege root 的 --integration 並用（helper 有自己的 File Station gate）。");
+    if (options.sharedFolder) {
+        if (template !== "native-go")
+            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go。");
+        sharedFolderYaml(options.sharedFolder);
+    }
     if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))
         throw new Error("[INIT_UI_INVALID] --ui 只接受 plain 或 vue。");
     if (options.integration !== undefined && !["go", "better-auth"].includes(options.integration))
@@ -127,9 +235,11 @@ function substitutionsFor(template, targetDir, options) {
         throw new Error("[INIT_DATA_ACCESS_INVALID] --data-access 只接受 unavailable 或 relaxed，且需要 --integration 與 --integration-protocol 2；缺少已認證 adapter 仍拒絕 NAS 操作。");
     if (options.integrationProtocol !== undefined && (!options.integration || ![1, 2].includes(options.integrationProtocol)))
         throw new Error("[INIT_INTEGRATION_PROTOCOL_INVALID] --integration-protocol 只接受 1 或 2，且需要 --integration；protocol 2 不啟用 NAS data path。");
-    if (options.integration && (options.ui !== "vue" || options.privilege === "none"))
-        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 --ui vue 與 root privilege（自動選用）。");
-    const privilege = options.privilege ?? (options.integration ? "root" : "none");
+    if (options.integration && ui !== "vue")
+        throw new Error("[INIT_INTEGRATION_OPTIONS] integration 需要 Vue UI（--ui vue，預設）；--ui plain 不適用。");
+    if (options.integration && options.privilege !== "root" && (options.integrationProtocol !== undefined || options.dataAccess !== undefined))
+        throw new Error("[INIT_INTEGRATION_HELPER_OPTIONS] --integration-protocol 與 --data-access 屬於 root helper，需要 --privilege root；沒有它時 integration 只以套件帳號執行，不含 helper。");
+    const privilege = options.privilege ?? "none";
     if (privilege !== "none" && privilege !== "root") {
         throw new Error(`[INIT_PRIVILEGE_INVALID] --privilege 只接受 none 或 root，收到「${String(privilege)}」。`);
     }
@@ -144,5 +254,5 @@ function substitutionsFor(template, targetDir, options) {
     if (displayName.trim() === "" || /[\r\n"\\]/.test(displayName)) {
         throw new Error("[INIT_DISPLAY_NAME_INVALID] 顯示名稱必須是單行，且不含 \" 或 \\。");
     }
-    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege };
+    return { __PACKAGE__: packageId, __DISPLAY_NAME__: displayName, __PRIVILEGE__: privilege, __BACKGROUND_ENABLED__: options.background ? "true" : "false" };
 }

package/dist/inspect.d.ts

@@ -1,3 +1,4 @@
+import { type PortExposure } from "./compose/analyze.js";
 import { type ProjectRoot } from "./discovery.js";
 export interface InspectReport {
     services: string[];
@@ -8,6 +9,8 @@ export interface InspectReport {
     dataMounts: string[];
     risks: string[];
     webHints: string[];
+    /** Ports reachable from outside the NAS without DSM authentication. */
+    exposedPorts: PortExposure[];
 }
 export declare function inspectProject(project: ProjectRoot): InspectReport;
 export declare function formatInspectReport(report: InspectReport): string;

package/dist/inspect.js

@@ -1,5 +1,5 @@
 import { existsSync } from "node:fs";
-import { collectPublishedTcpPorts, listServiceNames, loadCompose, } from "./compose/analyze.js";
+import { collectPublishedTcpPorts, collectUnpinnedImages, listPortExposures, listServiceNames, loadCompose, } from "./compose/analyze.js";
 export function inspectProject(project) {
     const services = [];
     const publishedPorts = [];
@@ -13,11 +13,12 @@ export function inspectProject(project) {
             dataMounts,
             risks: ["缺少 compose.yaml"],
             webHints,
+            exposedPorts: [],
         };
     }
     const parsed = loadCompose(project.composePath);
     if (!parsed) {
-        return { services, publishedPorts, dataMounts, risks, webHints };
+        return { services, publishedPorts, dataMounts, risks, webHints, exposedPorts: [] };
     }
     const compose = parsed.compose;
     services.push(...listServiceNames(compose));
@@ -32,7 +33,8 @@ export function inspectProject(project) {
         webHints.push("Web App 通常還需要 adminprotocol 與 adminurl。");
         webHints.push("Launch Mode：integration.web.launch 為 dsm-window（預設，DSM 視窗）或 new-page（新分頁）。");
     }
-    return { services, publishedPorts, dataMounts, risks, webHints };
+    const exposedPorts = listPortExposures(compose).filter((exposure) => !exposure.loopbackOnly);
+    return { services, publishedPorts, dataMounts, risks, webHints, exposedPorts };
 }
 function collectDataMounts(compose, out) {
     if (!compose.services) {
@@ -51,6 +53,9 @@ function collectRisks(compose, out) {
     if (!compose.services) {
         return;
     }
+    for (const { service, image } of collectUnpinnedImages(compose)) {
+        out.push(`${service}: image ${image} is not pinned by digest (run \`synopkgland images pin\`; build-spk sets force_pull: true, so installs re-resolve the tag)`);
+    }
     for (const [serviceName, service] of Object.entries(compose.services)) {
         if (service.privileged) {
             out.push(`${serviceName}: privileged`);
@@ -96,6 +101,13 @@ export function formatInspectReport(report) {
     lines.push("Risk intents:");
     lines.push(report.risks.length > 0 ? report.risks.join("\n") : "(none)");
     lines.push("");
+    lines.push("Port exposure:");
+    lines.push(report.exposedPorts.length > 0
+        ? report.exposedPorts
+            .map((e) => `CONTAINER_PORT_EXPOSED ${e.service}: ${e.entry} 綁在所有網路介面，可不經 DSM 驗證直接連線；請改綁 127.0.0.1。`)
+            .join("\n")
+        : "(none)");
+    lines.push("");
     lines.push("Web entry hints:");
     lines.push(report.webHints.length > 0 ? report.webHints.join("\n") : "(none)");
     return lines.join("\n");

package/dist/standalone/authorization-window.d.ts

@@ -0,0 +1,2 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/authorization-window.js

@@ -0,0 +1,28 @@
+/** Shared host flow. CGI plans are never accepted as completed authorization. */
+export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options) {
+  var busy = null;
+  function fail(code) { var error = new Error(code); error.code = code; return error; }
+  function status() { return options.call("authorization.status").then(function (d) {
+    if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
+    return d;
+  }); }
+  function plan(method) { return options.call(method).then(function (p) {
+    if (!p || p.command !== "authorization" || p.schema_version !== 1 || p.phase !== "plan" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail("authorization_bad_response");
+    var seen = {};
+    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
+    return p;
+  }); }
+  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
+  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
+    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op) : null; });
+  }); },Promise.resolve()); }
+  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
+    return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); },revoke:function () { return exclusive(function () {
+    return plan("authorization.revoke").then(function (p) {
+      if (p.withdraw === true && typeof options.withdraw !== "function") throw fail("authorization_bad_response");
+      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize(["helper_disable"],true) : Promise.resolve();
+      return disabled.then(function () { return p.purge === true ? authorize(["helper_purge"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });
+    }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });
+  }); }};
+}`;

package/dist/standalone/authorization.d.ts

@@ -0,0 +1,48 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+import type { CommandRunner } from './build.js';
+import { type RootOp } from './root-ops.js';
+import type { StandaloneManifest } from './manifest.js';
+export interface PinnedFile {
+    path: string;
+    size: number;
+    sha256: string;
+}
+export interface AuthorizationInventory {
+    schema: 2;
+    package: string;
+    version: string;
+    arch: string;
+    operations: RootOp[];
+    files: PinnedFile[];
+    digest: string;
+}
+export interface AuthorizationArtifact {
+    binary: string;
+    inventory: AuthorizationInventory;
+    bootstrapSha256: string;
+    ops: RootOp[];
+}
+export declare function authorizationInventory(m: {
+    package: string;
+    spkVersion: string;
+    rootOps?: RootOp[];
+}, arch: string, files: PinnedFile[]): AuthorizationInventory;
+export declare function bootstrapOps(m: {
+    package: string;
+    spkVersion: string;
+    rootOps?: RootOp[];
+}, pin: string): RootOp[];
+export declare function authorizationPlan(a: AuthorizationArtifact, m: {
+    package: string;
+    spkVersion: string;
+}): {
+    schema: number;
+    package: string;
+    version: string;
+    bootstrapSha256: string;
+    inventory: AuthorizationInventory;
+    tasks: import("./root-window.js").RootTask[];
+};
+export declare function buildAuthorization(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): AuthorizationArtifact | undefined;
+/** Archive consistency, not publisher authenticity or device runtime certification. */
+export declare function inspectAuthorization(dir: string, pkg: string, version: string): string[];

package/dist/standalone/authorization.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { renderRootTaskScript } from './root-ops.js';
+import { rootTasks } from './root-window.js';
+import { StandaloneBuildError } from './spk.js';
+import { assertHelperTaskBudget } from './helper.js';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function authorizationInventory(m, arch, files) {
+    const base = { schema: 2, package: m.package, version: m.spkVersion, arch, operations: m.rootOps ?? [], files: [...files].sort((a, b) => a.path.localeCompare(b.path, 'en')) };
+    return { ...base, digest: hash(JSON.stringify(base)) };
+}
+export function bootstrapOps(m, pin) {
+    if (!/^[a-f0-9]{64}$/.test(pin))
+        throw new StandaloneBuildError('AUTHORIZATION_PIN_REQUIRED', 'bootstrap SHA-256 pin required');
+    return (m.rootOps ?? []).map(op => ({ name: op.name, protectedOutput: true, exposeOutput: op.protectedOutput !== true, body: `#!/bin/sh
+set -eu
+umask 077
+[ "$(id -u)" = 0 ]
+info=/var/packages/${m.package}/INFO
+[ ! -L "$info" ] && [ "$(stat -c %u "$info")" = 0 ]
+grep -Fqx 'version="${m.spkVersion}"' "$info"
+for p in /var /var/lib; do
+ [ ! -L "$p" ] && [ -d "$p" ] && [ "$(stat -c %u "$p")" = 0 ]
+ mode=$(stat -c %a "$p"); [ "$((0$mode & 0022))" = 0 ]
+done
+s=/var/lib/synopkgland-auth-${m.package}
+[ ! -L "$s" ]
+if [ ! -e "$s" ]; then mkdir -m 0700 "$s"; fi
+[ -d "$s" ] && [ "$(stat -c %u:%a "$s")" = 0:700 ]
+tmp=$(mktemp "$s/.bootstrap.XXXXXX")
+trap 'rm -f "$tmp"; rmdir "$s" 2>/dev/null || :' EXIT HUP INT TERM
+dd if=/var/packages/${m.package}/target/authorization/bootstrap of="$tmp" bs=65536 count=1025 2>/dev/null
+[ "$(stat -c %s "$tmp")" -le 67108864 ]
+chmod 0700 "$tmp"
+[ "$(sha256sum "$tmp" | cut -d ' ' -f 1)" = '${pin}' ]
+"$tmp" '${op.name}'
+` }));
+}
+export function authorizationPlan(a, m) {
+    return { schema: 2, package: m.package, version: m.spkVersion, bootstrapSha256: a.bootstrapSha256, inventory: a.inventory, tasks: rootTasks({ ...m, rootOps: a.ops }) };
+}
+export function buildAuthorization(m, arch, work, run) {
+    if (m.privilege !== 'root')
+        return undefined;
+    if (m.backend.kind !== 'go')
+        throw new StandaloneBuildError('AUTHORIZATION_GO_REQUIRED', 'root authorization requires the native-Go CGI template');
+    const files = [];
+    const add = (path, source) => { const bytes = readFileSync(source); files.push({ path, size: bytes.length, sha256: hash(bytes) }); };
+    const walk = (dir) => { for (const name of readdirSync(dir).sort()) {
+        const p = join(dir, name), st = lstatSync(p);
+        if (st.isDirectory())
+            walk(p);
+        else if (st.isFile())
+            add('ui/app/' + relative(m.ui.dir, p).split('\\').join('/'), p);
+        else
+            throw new StandaloneBuildError('AUTHORIZATION_PAYLOAD_UNSAFE', 'UI inventory requires regular files');
+    } };
+    walk(m.ui.dir);
+    // Helper bodies already contain the exact helper digest; worker payloads are
+    // bound by its compiled registry. UI bytes are additionally checked at launch.
+    const inventory = authorizationInventory(m, arch, files);
+    const dir = join(work, 'authorization-' + arch);
+    mkdirSync(dir);
+    const source = readFileSync(new URL('../../templates/_authorization/main.go', import.meta.url), 'utf8');
+    writeFileSync(join(dir, 'main.go'), source);
+    const binary = join(work, 'bootstrap-' + arch);
+    const compiled = JSON.stringify({ ...inventory, operations: inventory.operations.map(op => ({ ...op, body: op.body })) });
+    const result = run('go', ['build', '-trimpath', '-buildvcs=false', '-ldflags', `-s -w -buildid= -X 'main.inventoryBase64=${Buffer.from(compiled).toString('base64')}'`, '-o', binary, 'main.go'], { cwd: dir, env: { ...process.env, CGO_ENABLED: '0', GOOS: 'linux', GOARCH: arch === 'x86_64' ? 'amd64' : 'arm64' } });
+    if (result.missing || result.status !== 0)
+        throw new StandaloneBuildError('AUTHORIZATION_BUILD_FAILED', result.stderr);
+    const bootstrapSha256 = hash(readFileSync(binary));
+    const ops = bootstrapOps(m, bootstrapSha256);
+    ops.forEach(op => assertHelperTaskBudget(renderRootTaskScript(m, op)));
+    return { binary, inventory, bootstrapSha256, ops };
+}
+/** Archive consistency, not publisher authenticity or device runtime certification. */
+export function inspectAuthorization(dir, pkg, version) {
+    if (!existsSync(join(dir, 'authorization/manifest.json')))
+        return ['root authorization manifest missing'];
+    try {
+        const plan = JSON.parse(readFileSync(join(dir, 'authorization/manifest.json'), 'utf8'));
+        if (plan.schema !== 2 || plan.package !== pkg || plan.version !== version || !/^[a-f0-9]{64}$/.test(plan.bootstrapSha256))
+            throw Error();
+        const bytes = readFileSync(join(dir, 'authorization/bootstrap'));
+        if (hash(bytes) !== plan.bootstrapSha256 || !bytes.includes(Buffer.from(Buffer.from(JSON.stringify(plan.inventory)).toString('base64'))))
+            throw Error();
+        const inventory = authorizationInventory({ package: pkg, spkVersion: version, rootOps: plan.inventory.operations }, plan.inventory.arch, plan.inventory.files);
+        if (JSON.stringify(inventory) !== JSON.stringify(plan.inventory))
+            throw Error();
+        if (JSON.stringify(plan.tasks) !== JSON.stringify(rootTasks({ package: pkg, spkVersion: version, rootOps: bootstrapOps({ package: pkg, spkVersion: version, rootOps: inventory.operations }, plan.bootstrapSha256) })))
+            throw Error();
+        const seen = new Set();
+        for (const f of inventory.files) {
+            if (!/^ui\/app\/(?!.*(?:^|\/)\.\.(?:\/|$))[^\x00\\]+$/.test(f.path) || seen.has(f.path))
+                throw Error();
+            seen.add(f.path);
+            const b = readFileSync(join(dir, f.path));
+            if (b.length !== f.size || hash(b) !== f.sha256)
+                throw Error();
+        }
+        const cgi = readFileSync(join(dir, 'ui/cgi/api.cgi'));
+        if (!cgi.includes(Buffer.from(Buffer.from(JSON.stringify(plan)).toString('base64'))))
+            throw Error();
+        const windows = readdirSync(join(dir, 'ui')).filter(f => /^window-\d+\.js$/.test(f));
+        if (windows.length !== 1)
+            throw Error();
+        const window = readFileSync(join(dir, 'ui', windows[0]), 'utf8');
+        if (!window.includes(JSON.stringify(plan.tasks)))
+            throw Error();
+        return [];
+    }
+    catch {
+        return ['root authorization bootstrap pin, inventory, CGI or task binding invalid'];
+    }
+}

package/dist/standalone/background.d.ts

@@ -0,0 +1,21 @@
+import type { StandaloneError } from "./manifest.js";
+/**
+ * Opt-in package-private background jobs: DSM's official `systemd-user-unit`
+ * resource runs one fixed worker as the package account. There is no root,
+ * no root boot task and no process started from the CGI.
+ */
+export interface Background {
+    worker: "sha256-v1";
+}
+/** Payload path of the worker executable, relative to the package target. */
+export declare const BACKGROUND_WORKER_PAYLOAD = "background/worker";
+/** Go main package of the fixed worker inside the project's backend module. */
+export declare const BACKGROUND_WORKER_MAIN = "./cmd/background-worker";
+export declare const BACKGROUND_UNIT_DIR = "conf/systemd";
+export declare function backgroundUnitName(pkg: string): string;
+export declare function readBackground(value: unknown, fail: (error: StandaloneError) => void): Background | undefined;
+/** `conf/resource`: only the official user-unit resource. */
+export declare function renderBackgroundResource(): string;
+export declare function renderBackgroundUnit(pkg: string): string;
+/** Package Center's start/stop/status map straight onto the user unit. */
+export declare function renderBackgroundControl(pkg: string): string;

package/dist/standalone/background.js

@@ -0,0 +1,52 @@
+/** Payload path of the worker executable, relative to the package target. */
+export const BACKGROUND_WORKER_PAYLOAD = "background/worker";
+/** Go main package of the fixed worker inside the project's backend module. */
+export const BACKGROUND_WORKER_MAIN = "./cmd/background-worker";
+export const BACKGROUND_UNIT_DIR = "conf/systemd";
+const SYNOSYSTEMCTL = "/usr/syno/bin/synosystemctl";
+export function backgroundUnitName(pkg) {
+    return `pkguser-${pkg}-background.service`;
+}
+export function readBackground(value, fail) {
+    if (value === undefined)
+        return undefined;
+    const ok = typeof value === "object" && value !== null && !Array.isArray(value)
+        && Object.keys(value).length === 1 && value.worker === "sha256-v1";
+    if (!ok) {
+        fail({ code: "STANDALONE_BACKGROUND_INVALID", message: "background 只接受 { worker: sha256-v1 }；背景程序固定以套件帳號執行，不能指定使用者、指令或權限。" });
+        return undefined;
+    }
+    return { worker: "sha256-v1" };
+}
+/** `conf/resource`: only the official user-unit resource. */
+export function renderBackgroundResource() {
+    return JSON.stringify({ "systemd-user-unit": {} });
+}
+export function renderBackgroundUnit(pkg) {
+    return `[Unit]
+Description=${pkg} background worker
+
+[Service]
+Type=simple
+ExecStart=/var/packages/${pkg}/target/${BACKGROUND_WORKER_PAYLOAD}
+UMask=0077
+KillMode=control-group
+TimeoutStopSec=10
+Restart=no
+`;
+}
+/** Package Center's start/stop/status map straight onto the user unit. */
+export function renderBackgroundControl(pkg) {
+    const unit = backgroundUnitName(pkg);
+    return `#!/bin/sh
+case "$1" in
+  start) exec ${SYNOSYSTEMCTL} start ${unit} ;;
+  stop) exec ${SYNOSYSTEMCTL} stop ${unit} ;;
+  status)
+    [ "$(${SYNOSYSTEMCTL} get-active-status ${unit})" = active ] && exit 0
+    exit 3
+    ;;
+  *) exit 1 ;;
+esac
+`;
+}

package/dist/standalone/binary.d.ts

@@ -1,5 +1,6 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { StandaloneError } from "./manifest.js";
+export declare const ELF_MACHINE: Record<NativeArchFamily, number>;
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
  * project, a 64-bit little-endian ELF for `arch`, and statically linked

package/dist/standalone/binary.js

@@ -1,6 +1,6 @@
 import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
 import { relative } from "node:path";
-const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+export const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
 const PT_INTERP = 3;
 const MAX_BINARY_BYTES = 256 * 1024 * 1024;
 const HEADER_BYTES = 64 * 1024;

package/dist/standalone/build.d.ts

@@ -15,6 +15,8 @@ export interface StandaloneBuildOptions {
     arches?: NativeArchFamily[];
     /** Defaults to `<root>/dist`. */
     outDir?: string;
+    /** INFO os_min_ver for every SPK (a release such as 7.1, or a full 7.x-build); defaults to the manifest's. */
+    minDsm?: string;
     run?: CommandRunner;
 }
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */