@synopackageland/cli 0.5.0 → 0.5.3

package/templates/native-go/backend/internal/helper/revoke_test.go

@@ -0,0 +1,121 @@
+package helper
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestPackageRevokeDurablyDisablesExactInventory(t *testing.T) {
+	c, _ := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+	record(t, c.Client, r)
+	if err := packageRevoke(c.Client, Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || got.Enabled || !got.Residual || got.Lifecycle.Phase != "fenced" {
+		t.Fatalf("not durably revoked: %+v %v", got, err)
+	}
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("revocation acknowledgement accepted as completion")
+	}
+	if err := c.Control(context.Background(), "recover"); err == nil {
+		t.Fatal("revoked approval recovered")
+	}
+}
+
+func TestRevokeAcknowledgementCannotCertifyQuiescence(t *testing.T) {
+	c, _ := controlFixture(t)
+	live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: req.Nonce, OK: true} })
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if c.Revoke(ctx) == nil {
+		t.Fatal("socket acknowledgement certified live process")
+	}
+}
+
+func TestRevokeRejectsUntrustedPeerAndWrongNonce(t *testing.T) {
+	for _, which := range []string{"peer", "nonce"} {
+		t.Run(which, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: "wrong", OK: true} })
+			if which == "peer" {
+				c.Peer = func(*net.UnixConn) error { return errTrust }
+			}
+			if c.Revoke(context.Background()) == nil {
+				t.Fatal("untrusted response accepted")
+			}
+		})
+	}
+}
+
+func TestRevokeNewBuildConsumesOldDisabledTerminalWithoutMutation(t *testing.T) {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	c.Expected.Version = "1.0.0-0002"
+	if err := c.Revoke(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	if string(before) != string(after) {
+		t.Fatal("new build rewrote old publication")
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "completion-"+l.Epoch+".json")); err != nil {
+		t.Fatal(err)
+	}
+	if c.Revoke(context.Background()) == nil {
+		t.Fatal("missing terminal proof accepted")
+	}
+}
+
+func TestPackageRevokeRejectsWrongBuildInvalidFrameAndConcurrentEnable(t *testing.T) {
+	for _, kind := range []string{"build", "nonce", "operation", "busy"} {
+		t.Run(kind, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+			record(t, c.Client, r)
+			req := Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}
+			switch kind {
+			case "build":
+				req.Inventory.Version = "0.1.0-0002"
+			case "nonce":
+				req.Nonce = ""
+			case "operation":
+				req.Op = "enable"
+			case "busy":
+				f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR, 0600)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer f.Close()
+				if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if packageRevoke(c.Client, req) == nil {
+				t.Fatal("unsafe revoke accepted")
+			}
+			got, _ := readRecord(c.StateDir, c.Owner)
+			if !got.Enabled || got.Residual || got.Lifecycle.Phase != "running" {
+				t.Fatal("rejected request changed approval")
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_server_linux.go

@@ -53,8 +53,8 @@ func serveLinux(c Client) error {
 	if err := os.Chmod(socket, 0660); err != nil {
 		return err
 	}
-	// Bound concurrency and each frame's size/time. No privileged mutations are
-	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	// Bound concurrency and each frame. The authenticated package UID may only
+	// withdraw authority; activation remains an exact approved root task.
 	slots := make(chan struct{}, 8)
 	for {
 		conn, err := l.AcceptUnix()
@@ -105,6 +105,15 @@ func serveLinux(c Client) error {
 			if health.Decode(&req) != nil {
 				return
 			}
+			if req.Op == "revoke" {
+				err := packageRevoke(c, req)
+				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+				if err != nil {
+					res.Error = "revoke-refused"
+				}
+				json.NewEncoder(conn).Encode(res)
+				return
+			}
 			r, err := readRecord(c.StateDir, 0)
 			readiness := "fenced"
 			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {

package/templates/native-go/backend/internal/helper/server_linux.go

@@ -53,8 +53,8 @@ func serveLinux(c Client) error {
 	if err := os.Chmod(socket, 0660); err != nil {
 		return err
 	}
-	// Bound concurrency and each frame's size/time. No privileged mutations are
-	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	// Bound concurrency and each frame. The authenticated package UID may only
+	// withdraw authority; activation remains an exact approved root task.
 	slots := make(chan struct{}, 8)
 	for {
 		conn, err := l.AcceptUnix()
@@ -80,6 +80,15 @@ func serveLinux(c Client) error {
 			if d.Decode(&req) != nil {
 				return
 			}
+			if req.Op == "revoke" {
+				err := packageRevoke(c, req)
+				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+				if err != nil {
+					res.Error = "revoke-refused"
+				}
+				json.NewEncoder(conn).Encode(res)
+				return
+			}
 			r, err := readRecord(c.StateDir, 0)
 			readiness := "fenced"
 			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {

package/templates/native-go/dsm-package.yaml

@@ -35,7 +35,7 @@ ui:
 # UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
 # fr, es and it (DSM's other languages fall back to English). build-spk checks
 # that every language has the en.json keys and placeholders, and that the keys
-# listed in the glossary use Synology's own DSM wording.
+# listed in the glossary use DSM's own wording.
 i18n:
   messages: i18n/messages
   glossary: i18n/glossary.json

package/templates/native-go-authorization/backend/internal/app/authorization.go

@@ -0,0 +1,298 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/api"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Compiled into the CGI. Package-owned JSON is never the source of trust.
+type authorizationTask struct {
+	Op     string `json:"op"`
+	Name   string `json:"name"`
+	Header string `json:"header"`
+	Script string `json:"script"`
+	Output bool   `json:"output"`
+}
+type authorizationBuild struct {
+	Schema    int    `json:"schema"`
+	Package   string `json:"package"`
+	Version   string `json:"version"`
+	Pin       string `json:"bootstrapSha256"`
+	Inventory struct {
+		Files []struct {
+			Path string `json:"path"`
+			Size int64  `json:"size"`
+			Hash string `json:"sha256"`
+		} `json:"files"`
+	} `json:"inventory"`
+	Tasks []authorizationTask `json:"tasks"`
+}
+
+func (cfg Config) authorizationRoutes() []api.Route {
+	if cfg.RootAuthorization == "" {
+		return nil
+	}
+	return []api.Route{api.UserRequest("authorization.status", cfg.authorizationStatus), api.Admin("authorization.request", cfg.authorizationRequest), api.Admin("authorization.revoke", cfg.authorizationRevoke)}
+}
+func authorizationDocument(state string, reason any) any {
+	return map[string]any{"command": "authorization", "schema_version": 1, "state": state, "reason": reason}
+}
+func (cfg Config) authorizationPlan() (authorizationBuild, error) {
+	var p authorizationBuild
+	raw, decode := base64.StdEncoding.DecodeString(cfg.RootAuthorization)
+	if decode != nil || json.Unmarshal(raw, &p) != nil || p.Schema != 2 || p.Package != cfg.PackageID || p.Version != cfg.Version || len(p.Tasks) == 0 || len(p.Pin) != 64 {
+		return p, errors.New("invalid build authorization")
+	}
+	if b, e := hex.DecodeString(p.Pin); e != nil || len(b) != 32 {
+		return p, errors.New("invalid bootstrap pin")
+	}
+	return p, nil
+}
+func (cfg Config) authorizationRequest(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return nil, &api.Error{Code: "authorization_required", Message: "Build payload cannot be trusted; reinstall this package"}
+	}
+	ops := []string{}
+	for _, t := range p.Tasks {
+		if t.Op == "helper_enable" {
+			ops = []string{t.Op}
+			break
+		}
+		ops = append(ops, t.Op)
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "run": cfg.HelperInventory.Package != ""}, nil
+}
+func (cfg Config) authorizationRevoke(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	// Root task still pins bootstrap. Corrupt UI must not prevent safe cleanup.
+	ops := []string{}
+	purge := false
+	for _, t := range p.Tasks {
+		ops = append(ops, t.Op)
+		if cfg.HelperInventory.Package != "" && t.Op == "helper_purge" {
+			purge = true
+		}
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "disable": cfg.HelperInventory.Package != "", "purge": purge}, nil
+}
+func (cfg Config) authorizationTrusted(p authorizationBuild) error {
+	root, e := os.OpenRoot("/var/packages/" + cfg.PackageID + "/target")
+	if e != nil {
+		return e
+	}
+	defer root.Close()
+	verify := func(path string, size int64, want string) error {
+		f, e := root.Open(path)
+		if e != nil {
+			return e
+		}
+		defer f.Close()
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Size() > 64<<20 || size >= 0 && st.Size() != size {
+			return errors.New("untrusted payload")
+		}
+		h := sha256.New()
+		_, e = io.Copy(h, io.LimitReader(f, (64<<20)+1))
+		if e != nil || hex.EncodeToString(h.Sum(nil)) != want {
+			return errors.New("untrusted payload")
+		}
+		return nil
+	}
+	if e = verify("authorization/bootstrap", -1, p.Pin); e != nil {
+		return e
+	}
+	for _, f := range p.Inventory.Files {
+		if e = verify(f.Path, f.Size, f.Hash); e != nil {
+			return e
+		}
+	}
+	return nil
+}
+func (cfg Config) authorizationStatus(ctx context.Context, caller api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return authorizationDocument("unavailable", "service_unavailable"), nil
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return authorizationDocument("authorization_required", "helper_untrusted"), nil
+	}
+	if cfg.HelperInventory.Package != "" {
+		s := cfg.integrationState(ctx)
+		if s.State == "ready" {
+			return authorizationDocument("ready", nil), nil
+		}
+		if !caller.Admin() {
+			return authorizationDocument("not_admin", "not_admin"), nil
+		}
+		switch s.State {
+		case "incompatible":
+			return authorizationDocument("authorization_required", "grant_incompatible"), nil
+		case "pending":
+			return authorizationDocument("unavailable", "health_probe_timeout"), nil
+		case "failed":
+			return authorizationDocument("unavailable", "service_unavailable"), nil
+		}
+	}
+	if !caller.Admin() {
+		return authorizationDocument("not_admin", "not_admin"), nil
+	}
+	state, reason := authorizationScheduler(ctx, r, p.Tasks)
+	if cfg.HelperInventory.Package != "" && state == "ready" {
+		state = "authorization_required"
+		reason = "grant_missing"
+	}
+	return authorizationDocument(state, reason), nil
+}
+
+// Read-only scheduler observations; never accept caller-selected URLs or task IDs.
+// One modern probe; legacy fallback only for explicit missing method (103).
+func authorizationScheduler(ctx context.Context, r *http.Request, tasks []authorizationTask) (string, any) {
+	return authorizationSchedulerAt(ctx, r, tasks, "http://127.0.0.1:5000")
+}
+func authorizationSchedulerAt(ctx context.Context, r *http.Request, tasks []authorizationTask, endpoint string) (string, any) {
+	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, DisableCompression: true, ResponseHeaderTimeout: 5 * time.Second, MaxResponseHeaderBytes: 32 << 10}
+	defer tr.CloseIdleConnections()
+	client := &http.Client{Transport: tr, Timeout: 8 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	call := func(method string, version int, params url.Values) (json.RawMessage, int, error) {
+		params.Set("api", "SYNO.Core.TaskScheduler")
+		params.Set("method", method)
+		params.Set("version", strconv.Itoa(version))
+		req, e := http.NewRequestWithContext(ctx, "GET", endpoint+"/webapi/entry.cgi?"+params.Encode(), nil)
+		if e != nil {
+			return nil, 0, e
+		}
+		cookies := r.CookiesNamed("id")
+		if len(cookies) != 1 {
+			return nil, 0, errors.New("session")
+		}
+		req.AddCookie(cookies[0])
+		req.Header.Set("X-SYNO-TOKEN", r.Header.Get("X-SYNO-TOKEN"))
+		response, e := client.Do(req)
+		if e != nil {
+			return nil, 0, e
+		}
+		defer response.Body.Close()
+		b, e := io.ReadAll(io.LimitReader(response.Body, (1<<20)+1))
+		if e != nil || len(b) > 1<<20 || response.StatusCode != 200 {
+			return nil, 0, errors.New("scheduler unavailable")
+		}
+		var wire struct {
+			Success bool            `json:"success"`
+			Data    json.RawMessage `json:"data"`
+			Error   struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		if json.Unmarshal(b, &wire) != nil {
+			return nil, 0, errors.New("scheduler schema")
+		}
+		if !wire.Success {
+			return nil, wire.Error.Code, errors.New("scheduler refused")
+		}
+		return wire.Data, 0, nil
+	}
+	data, code, e := call("list", 3, url.Values{"start": {"0"}, "limit": {"500"}})
+	legacy := code == 103
+	if legacy {
+		data, code, e = call("list", 2, url.Values{"offset": {"0"}, "limit": {"500"}})
+	}
+	if e != nil {
+		if code == 106 || code == 107 || code == 119 {
+			return "session_expired", "session_expired"
+		}
+		return "unavailable", "scheduler_unavailable"
+	}
+	type item struct {
+		ID        json.Number `json:"id"`
+		Name      string      `json:"name"`
+		Owner     string      `json:"owner"`
+		RealOwner string      `json:"real_owner"`
+		Enable    *bool       `json:"enable"`
+		Type      string      `json:"type"`
+		Extra     struct {
+			Script string `json:"script"`
+		} `json:"extra"`
+	}
+	var list struct {
+		Tasks []item `json:"tasks"`
+		Total *int   `json:"total"`
+	}
+	if json.Unmarshal(data, &list) != nil || list.Total == nil || *list.Total != len(list.Tasks) || len(list.Tasks) > 500 {
+		return "unavailable", "scheduler_unavailable"
+	}
+	for _, expected := range tasks {
+		// Helper control tasks are individually approved on demand. Enable is the
+		// activation anchor; live helper health remains required separately.
+		if strings.HasPrefix(expected.Op, "helper_") && expected.Op != "helper_enable" {
+			continue
+		}
+		var found *item
+		for n := range list.Tasks {
+			if list.Tasks[n].Name == expected.Name {
+				if found != nil {
+					return "authorization_required", "maintenance_task_mismatch"
+				}
+				found = &list.Tasks[n]
+			}
+		}
+		if found == nil {
+			return "authorization_required", "grant_missing"
+		}
+		valid := func(t item) bool {
+			return t.Owner == "root" && t.RealOwner == "root" && t.Enable != nil && !*t.Enable && t.Type == "script"
+		}
+		if !valid(*found) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		version := 4
+		if legacy {
+			version = 3
+		}
+		detail, _, e := call("get", version, url.Values{"id": {string(found.ID)}, "real_owner": {"root"}})
+		if e != nil {
+			return "unavailable", "scheduler_unavailable"
+		}
+		var full item
+		if json.Unmarshal(detail, &full) != nil || full.ID != found.ID || full.Name != expected.Name || !valid(full) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		if full.Extra.Script != expected.Script {
+			if strings.HasPrefix(full.Extra.Script, expected.Header) {
+				return "authorization_required", "grant_incompatible"
+			}
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+	}
+	return "ready", nil
+}

package/templates/native-go-authorization/backend/internal/app/authorization_test.go

@@ -0,0 +1,96 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+)
+
+func TestAuthorizationFailClosed(t *testing.T) {
+	cfg := Config{PackageID: "RootDemo", Version: "0.1.0-0001", RootAuthorization: `{"schema":2}`}
+	if _, e := cfg.authorizationPlan(); e == nil {
+		t.Fatal("accepted missing pin")
+	}
+	if _, e := cfg.authorizationRequest(context.Background(), api.Caller{}, json.RawMessage(`{"op":"arbitrary"}`)); e == nil {
+		t.Fatal("accepted arbitrary params")
+	}
+	if len((Config{}).authorizationRoutes()) != 0 {
+		t.Fatal("default registered root routes")
+	}
+}
+func TestAuthorizationDocuments(t *testing.T) {
+	for _, state := range []string{"ready", "authorization_required", "not_admin", "unavailable"} {
+		b, e := json.Marshal(authorizationDocument(state, nil))
+		if e != nil {
+			t.Fatal(e)
+		}
+		var d map[string]any
+		json.Unmarshal(b, &d)
+		if d["command"] != "authorization" || d["schema_version"] != float64(1) || d["state"] != state {
+			t.Fatal(string(b))
+		}
+	}
+}
+
+func TestSchedulerRejectsChangedTaskAndFallsBackOnlyOn103(t *testing.T) {
+	for _, legacy := range []bool{false, true} {
+		altered := false
+		var versions []string
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			q := r.URL.Query()
+			versions = append(versions, q.Get("method")+":"+q.Get("version"))
+			if q.Get("method") == "list" && q.Get("version") == "3" && legacy {
+				io.WriteString(w, `{"success":false,"error":{"code":103}}`)
+				return
+			}
+			script := "approved"
+			if altered {
+				script = "unapproved"
+			}
+			item := map[string]any{"id": 1, "name": "RootDemo root: whoami", "owner": "root", "real_owner": "root", "enable": false, "type": "script", "extra": map[string]string{"script": script}}
+			var data any = item
+			if q.Get("method") == "list" {
+				data = map[string]any{"tasks": []any{item}, "total": 1}
+			}
+			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": data})
+		}))
+		request := httptest.NewRequest("POST", "/", nil)
+		request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+		tasks := []authorizationTask{{Op: "whoami", Name: "RootDemo root: whoami", Script: "approved", Header: "header"}}
+		state, _ := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "ready" {
+			t.Fatal(state)
+		}
+		if legacy && !slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		if !legacy && slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		altered = true
+		state, reason := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "authorization_required" || reason != "maintenance_task_mismatch" {
+			t.Fatal(state, reason)
+		}
+		server.Close()
+	}
+}
+func TestSchedulerPermissionFailureIsNotLegacyFallback(t *testing.T) {
+	calls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		io.WriteString(w, `{"success":false,"error":{"code":105}}`)
+	}))
+	defer server.Close()
+	request := httptest.NewRequest("POST", "/", nil)
+	request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+	state, _ := authorizationSchedulerAt(context.Background(), request, nil, server.URL)
+	if state != "unavailable" || calls != 1 {
+		t.Fatal(state, calls)
+	}
+}

package/templates/native-go-authorization/frontend/src/authorization/AuthorizationGate.vue

@@ -0,0 +1,89 @@
+<script setup lang="ts">
+import {computed,onMounted,onUnmounted,ref} from 'vue'
+import {Button,Callout,Dialog,Surface} from '@synopackageland/ui'
+import {ShieldCheck,TriangleAlert} from '@lucide/vue'
+import type {AuthorizationStatus,Context} from '../context'
+import {authorizationCopy} from './i18n'
+const props=defineProps<{ctx:Context}>()
+const emit=defineEmits<{ready:[]}>()
+const state=ref<AuthorizationStatus>()
+const pendingState=ref<AuthorizationStatus>()
+const busy=ref(false)
+const failure=ref(false)
+const confirmRevoke=ref(false)
+let disposed=false,sequence=0,pendingRecheck=false
+let unsubscribe:(()=>void)|undefined
+const text=computed(()=>authorizationCopy(props.ctx.locale,props.ctx.displayName||'__DISPLAY_NAME__'))
+const ready=computed(()=>state.value?.state==='ready')
+const shown=computed(()=>state.value||pendingState.value)
+const required=computed(()=>shown.value?.state==='authorization_required')
+const untrusted=computed(()=>['helper_untrusted','cli_untrusted'].includes(shown.value?.reason||''))
+const canAuthorize=computed(()=>required.value&&!untrusted.value)
+const unavailableKey=computed(()=>shown.value?.reason==='credential_not_ready'?'credential':'unavailable')
+const title=computed(()=>!shown.value?text.value('checking'):required.value?text.value('title'):shown.value.state==='ready'?text.value('ready'):shown.value.state==='not_admin'?text.value('not_admin.title'):shown.value.state==='session_expired'?text.value('session_expired.title'):text.value(unavailableKey.value+'.title'))
+const body=computed(()=>required.value?text.value('purpose'):shown.value?.state==='not_admin'?text.value('not_admin.body'):shown.value?.state==='session_expired'?text.value('session_expired.body'):shown.value?.state==='unavailable'?text.value(unavailableKey.value+'.body'):text.value('purpose'))
+const reasons=['grant_missing','helper_untrusted','cli_untrusted','grant_incompatible','package_identity_changed','maintenance_task_missing','maintenance_task_mismatch','helper_health_rejected','capability_missing']
+const reason=computed(()=>reasons.includes(shown.value?.reason||'')?shown.value!.reason!:'unknown')
+const next=computed(()=>untrusted.value?'next.reinstall':reason.value==='grant_missing'?'next.install':reason.value==='grant_incompatible'?'next.update':'next.repair')
+async function action(method:'status'|'request'|'revoke'){
+ if(busy.value||disposed)return
+ const current=++sequence
+ pendingState.value=method==='request'&&state.value?.state==='authorization_required'?state.value:undefined
+ busy.value=true;failure.value=false
+ // Mutation/revalidation immediately hides application content. A request
+ // keeps its prior reason visible while DSM's confirmation is pending.
+ state.value=undefined
+ try {
+  const result=await props.ctx.authorization?.[method]()
+  if(disposed||current!==sequence)return
+  if(!result||result.command!=='authorization'||result.schema_version!==1||!['ready','authorization_required','not_admin','session_expired','unavailable'].includes(result.state))throw Error('invalid status')
+  state.value=result
+  if(result.state==='ready')emit('ready')
+ } catch(e){if(!disposed&&current===sequence){
+  state.value=(e as {code?:string}).code==='session_required'?{command:'authorization',schema_version:1,state:'session_expired',reason:'session_expired'}:pendingState.value||{command:'authorization',schema_version:1,state:'unavailable',reason:'service_unavailable'}
+  failure.value=true
+ }} finally{if(!disposed&&current===sequence){busy.value=false;pendingState.value=undefined;if(pendingRecheck){pendingRecheck=false;void action('status')}}}
+}
+onMounted(()=>{unsubscribe=props.ctx.reopen(()=>{if(busy.value)pendingRecheck=true;else void action('status')});void action('status')})
+onUnmounted(()=>{disposed=true;sequence++;if(typeof unsubscribe==='function')unsubscribe()})
+</script>
+<template>
+ <p class="authorization-announcement" role="status" aria-live="polite" aria-atomic="true">{{ busy ? text('authorizing') : title }}</p>
+ <div v-if="!ready" class="authorization-view" :aria-busy="busy" :data-authorization-state="state?.state || 'checking'">
+  <Surface class="authorization-card" padding="lg" raised :aria-label="title">
+   <span class="authorization-icon" aria-hidden="true"><component :is="shown?.state==='unavailable'||shown?.state==='session_expired'?TriangleAlert:ShieldCheck" class="authorization-icon-glyph" /></span>
+   <h1 class="authorization-title">{{ title }}</h1>
+   <p class="authorization-body">{{ body }}</p>
+   <Callout v-if="required" class="authorization-status" :tone="reason==='grant_missing'?'info':'warning'" :title="text('reason.'+reason)">{{ text(next) }}</Callout>
+   <Callout v-if="failure" class="authorization-failed" tone="warning">{{ text('failed') }}</Callout>
+   <div class="authorization-actions">
+    <Button v-if="canAuthorize" variant="primary" :loading="busy" :disabled="busy" @click="action('request')">{{ busy ? text('authorizing') : text('authorize') }}</Button>
+    <Button v-else variant="primary" :loading="busy" :disabled="busy" @click="action('status')">{{ busy ? text('checking') : text('retry') }}</Button>
+   </div>
+  </Surface>
+ </div>
+ <div v-else class="authorization-authorized">
+  <div class="authorization-ready"><ShieldCheck :size="16" aria-hidden="true"/><span>{{ text('ready') }}</span><Button v-if="ctx.authorization?.canManage?.()" variant="secondary" :disabled="busy" @click="confirmRevoke=true">{{ text('revoke') }}</Button></div>
+  <slot />
+ </div>
+ <Dialog v-model:open="confirmRevoke" :title="text('revoke.title')" :description="text('revoke.body')">
+  <template #footer><Button variant="secondary" @click="confirmRevoke=false">{{ text('cancel') }}</Button><Button variant="danger" :disabled="busy" @click="confirmRevoke=false;action('revoke')">{{ text('revoke') }}</Button></template>
+ </Dialog>
+</template>
+<style scoped>
+.authorization-announcement{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap}
+/* T0156: auto margins center the whole card but preserve top scrolling in a short window. */
+.authorization-view{display:flex;align-items:flex-start;justify-content:center;min-height:100%;height:100%;box-sizing:border-box;padding:24px;overflow-y:auto;color:var(--ui-text);font-family:var(--ui-font-sans)}
+.authorization-card{display:flex;flex-direction:column;align-items:center;gap:12px;width:100%;max-width:28rem;margin:auto;text-align:center}
+.authorization-icon{display:flex;align-items:center;justify-content:center;width:48px;height:48px;flex-shrink:0;border-radius:9999px;background:var(--ui-primary-soft);color:var(--ui-primary)}
+.authorization-icon-glyph{width:24px;height:24px}
+.authorization-title{font-size:16px;font-weight:600;line-height:1.4;color:var(--ui-text);margin:0;text-wrap:balance}
+.authorization-body{max-width:24rem;font-size:13px;line-height:1.6;color:var(--ui-text);margin:0;text-align:center;text-wrap:pretty}
+.authorization-status,.authorization-failed{width:100%;text-align:left}
+/* Essential recovery text uses the full foreground; DSM's muted token is below 4.5:1. */
+.authorization-status,.authorization-failed{color:var(--ui-text)}
+.authorization-actions{display:flex;justify-content:center;width:100%;margin-top:4px}
+.authorization-authorized{display:flex;flex-direction:column;height:100%;min-height:0}.authorization-authorized :deep(.app-shell){flex:1;min-height:0;height:auto}
+.authorization-ready{display:flex;align-items:center;justify-content:flex-end;gap:8px;padding:8px 16px;color:var(--ui-text);font:13px var(--ui-font-sans)}
+@media(max-width:480px){.authorization-view{padding:16px}}
+</style>