@synopackageland/cli 0.5.3 → 0.6.1

package/dist/standalone/manifest.js

@@ -1,15 +1,15 @@
+import { validDelegate } from "../runtime/executor-policy.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { parse } from "yaml";
 import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { checkGlossary, isLocale, loadCatalogs } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
-import { readIntegration } from "./helper.js";
-import { hasHelper } from "./helper-inventory.js";
 import { readDaemon } from "./daemon.js";
 import { readBackground } from "./background.js";
 import { DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
+import { readApiPermissions } from "./api-permissions.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -17,7 +17,7 @@ import { readSharedFolder } from "./shared-folder.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "maintainer", "os_min_ver", "arches", "backend", "ui", "privilege", "i18n", "integration", "daemon", "background", "fileStation", "install",
+    "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const INFO_TEXT_FIELDS = new Set(["displayname", "description"]);
@@ -70,6 +70,8 @@ export function loadStandaloneManifest(root) {
         return { ok: false, errors: [{ code: "STANDALONE_MANIFEST_YAML", message: String(error) }] };
     }
     const c = new Collector(root);
+    if (existsSync(join(root, "compose.yaml")))
+        c.fail("PROJECT_RUNTIME_EXCLUSIVE", "compose.yaml 與 dsm-package.yaml 互斥；請保留其中一個。");
     if (!isRecord(raw)) {
         c.fail("STANDALONE_MANIFEST_YAML", `${STANDALONE_MANIFEST} 必須是 YAML 物件。`);
         return { ok: false, errors: c.errors };
@@ -83,14 +85,11 @@ function readManifest(raw, c) {
             c.fail("STANDALONE_FIELD_UNKNOWN", `不支援的欄位「${key}」。Standalone Package 不接受自訂 lifecycle scripts 或 DSM conf。`);
         }
     }
-    if (raw.schema !== 1) {
-        c.fail("STANDALONE_SCHEMA_INVALID", "schema 必須是 1。");
+    if (raw.schema !== 2) {
+        c.fail("STANDALONE_SCHEMA_INVALID", "schema: 2 必填；請改成 schema: 2、backend.kind: go|binary，並將 privilege: root、background、fileStation 分別改為 capabilities.rootOps: true、capabilities.jobs: true、capabilities.files: session。");
     }
-    const privilege = raw.privilege === "none" || raw.privilege === "root"
-        ? raw.privilege
-        : c.fail("STANDALONE_PRIVILEGE_UNSUPPORTED", "privilege 只接受 none（只用套件帳號）或 root（由 DSM 管理員核准的 root 工作）；請見 README「Root access」。");
-    const integration = readIntegration(raw.integration, c.root, e => c.fail(e.code, e.message));
-    const rootOps = privilege && readRootOps(privilege, integration !== undefined, c);
+    const capabilities = readCapabilities(raw.capabilities, c);
+    const rootOps = readRootOps(capabilities.rootOps === true, c);
     const packageId = typeof raw.package === "string" && PACKAGE_ID.test(raw.package)
         ? raw.package
         : c.fail("STANDALONE_PACKAGE_INVALID", "package 必須以英文字母開頭，只含英數字（2–64 字）。");
@@ -103,7 +102,7 @@ function readManifest(raw, c) {
     const osMinVer = typeof raw.os_min_ver === "string" && OS_MIN_VER.test(raw.os_min_ver)
         ? raw.os_min_ver
         : c.fail("STANDALONE_OS_MIN_VER_INVALID", "os_min_ver 格式為 <major>.<minor>-<build>，例如 7.2-64570。");
-    if (privilege === "root" && osMinVer && !isDsmAtLeast(osMinVer, DEFAULT_MIN_DSM)) {
+    if (capabilities.rootOps === true && osMinVer && !isDsmAtLeast(osMinVer, DEFAULT_MIN_DSM)) {
         c.fail("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
     const displayname = c.text(raw.displayname, "displayname");
@@ -111,20 +110,32 @@ function readManifest(raw, c) {
     const maintainer = c.text(raw.maintainer, "maintainer");
     const arches = readArches(raw.arches, c);
     const backend = arches && readBackend(raw.backend, arches, c);
+    let permissions;
+    if (backend?.kind === "go") {
+        try {
+            permissions = readApiPermissions(backend.dir, capabilities);
+        }
+        catch (error) {
+            c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
+        }
+    }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
-    if (integration && (backend?.kind !== "go" || rootOps?.some(op => op.name.startsWith("helper_")) || (privilege === "none" && !isPackageOnly(integration)))) {
-        c.fail("STANDALONE_INTEGRATION_INVALID", "integration 需要 backend.go；helper_ 操作名稱保留給 generator。privilege: none 只提供套件帳號整合（protocol 1、workers 為空，可選 identity），helper 設定需要 privilege: root。");
+    if (capabilities.jobs && raw.daemon !== undefined) {
+        c.fail("CAPABILITY_COMBINATION_INVALID", "daemon 與 capabilities.jobs 互斥。");
     }
-    const background = readBackground(raw.background, e => c.fail(e.code, e.message));
-    if (raw.background !== undefined && (backend?.kind !== "go" || raw.daemon !== undefined || privilege === "root")) {
-        c.fail("STANDALONE_BACKGROUND_INVALID", "background 需要 backend.go（worker 由專案的 Go module 編譯）與 privilege: none，且不能與 daemon 並用；套件帳號 integration 可並用，root helper 不行。");
+    if (backend?.kind === "binary") {
+        for (const name of ["files", "jobs", "identity", "delegate"]) {
+            if (isRecord(raw.capabilities) && raw.capabilities[name] !== undefined)
+                c.fail("CAPABILITY_UNSUPPORTED", `backend.kind: binary 不支援 capabilities.${name}。`);
+        }
     }
-    const fileStation = raw.fileStation === undefined ? undefined : readFileStation(raw.fileStation, backend?.kind === "go" && !hasHelper({ integration, privilege }), c);
     const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
     const ui = readUi(raw.ui, c);
+    if (capabilities.identity && ui && !ui.build)
+        c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
-        || !arches || !backend || !ui || !privilege || (privilege === "root" && !rootOps)) {
+        || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
         return undefined;
     }
     return {
@@ -139,33 +150,22 @@ function readManifest(raw, c) {
         os_min_ver: osMinVer,
         arches,
         backend,
+        ...(permissions ? { apiPermissions: permissions.policy, apiPermissionsDigest: permissions.digest, apiSDKPermissionsDigest: permissions.sdkDigest } : {}),
         ui,
         ...(i18n ? { i18n } : {}),
-        privilege,
+        capabilities,
         ...(rootOps ? { rootOps } : {}),
-        ...(integration ? { integration } : {}),
         ...(daemon ? { daemon } : {}),
-        ...(background ? { background } : {}),
-        ...(fileStation ? { fileStation } : {}),
         ...(sharedFolder ? { sharedFolder } : {}),
     };
 }
-/** Without privilege: root there is no helper, so none of its inventory settings apply. */
-function isPackageOnly(integration) {
-    return integration.protocol === 1 && Object.keys(integration.workers).length === 0
-        && integration.dataAccess === undefined && integration.sdkWorkers === undefined;
-}
-/** A root integration's helper tasks are generated; it needs no root/ operation of its own. */
-function readRootOps(privilege, hasIntegration, c) {
+function readRootOps(enabled, c) {
     const dir = join(c.root, ROOT_OPS_DIR);
-    if (privilege === "none") {
+    if (!enabled) {
         return existsSync(dir)
-            ? c.fail("STANDALONE_ROOT_OPS_UNUSED", `${ROOT_OPS_DIR}/ 只用在 privilege: root；privilege: none 的套件不會執行它。`)
+            ? c.fail("STANDALONE_ROOT_OPS_UNUSED", `${ROOT_OPS_DIR}/ 需要 capabilities.rootOps: true；請宣告能力或刪除此目錄。`)
             : undefined;
     }
-    if (hasIntegration && !existsSync(dir)) {
-        return [];
-    }
     const loaded = loadRootOps(dir);
     if (!loaded.ok) {
         loaded.errors.forEach((e) => c.fail(e.code, e.message));
@@ -183,32 +183,31 @@ function readArches(value, c) {
         : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64 清單，至少一個。");
 }
 function readBackend(value, arches, c) {
-    if (!isRecord(value) || ("go" in value) === ("binary" in value)) {
-        return c.fail("STANDALONE_BACKEND_INVALID", "backend 必須恰好有 go 或 binary 其中之一。");
+    if (!isRecord(value) || !["go", "binary"].includes(String(value.kind))) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind 必須是 go 或 binary。");
     }
-    if ("go" in value) {
-        const go = value.go;
-        if (!isRecord(go) || typeof go.main !== "string" || !GO_MAIN.test(go.main) || go.main.includes("..")) {
-            return c.fail("STANDALONE_BACKEND_INVALID", "backend.go 需要 dir 與以 ./ 開頭的 main（例如 ./cmd/app）。");
+    if (value.kind === "go") {
+        if (Object.keys(value).some(key => !["kind", "dir", "main"].includes(key)) || (value.main !== undefined && (typeof value.main !== "string" || !GO_MAIN.test(value.main) || value.main.includes("..")))) {
+            return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: go 需要 dir，可選 main（預設 ./cmd/app）。");
         }
-        const dir = c.path(go.dir, "backend.go.dir");
-        return dir ? { kind: "go", dir, main: go.main } : undefined;
+        const dir = c.path(value.dir, "backend.dir");
+        return dir ? { kind: "go", dir, main: value.main ?? "./cmd/app" } : undefined;
     }
-    const binary = value.binary;
-    if (!isRecord(binary)) {
-        return c.fail("STANDALONE_BACKEND_INVALID", "backend.binary 必須以架構為 key 指向 CGI 執行檔。");
+    const binary = value.files;
+    if (!isRecord(binary) || Object.keys(value).some(key => !["kind", "files"].includes(key))) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: binary 需要 files，以架構為 key 指向 CGI 執行檔。");
     }
     const files = {};
     for (const arch of arches) {
         if (!(arch in binary)) {
-            c.fail("STANDALONE_BINARY_ARCH_MISSING", `arches 宣告了 ${arch}，但 backend.binary 沒有它的執行檔。`);
+            c.fail("STANDALONE_BINARY_ARCH_MISSING", `arches 宣告了 ${arch}，但 backend.files 沒有它的執行檔。`);
             continue;
         }
-        files[arch] = c.path(binary[arch], `backend.binary.${arch}`);
+        files[arch] = c.path(binary[arch], `backend.files.${arch}`);
     }
     for (const key of Object.keys(binary)) {
         if (!arches.includes(key)) {
-            c.fail("STANDALONE_BACKEND_INVALID", `backend.binary.${key} 不在 arches 內。`);
+            c.fail("STANDALONE_BACKEND_INVALID", `backend.files.${key} 不在 arches 內。`);
         }
     }
     return Object.values(files).every(Boolean) ? { kind: "binary", files } : undefined;
@@ -302,9 +301,34 @@ export function findStandaloneRoot(start) {
         current = parent;
     }
 }
-function readFileStation(value, allowed, c) {
-    if (value === "session" && allowed)
-        return "session";
-    c.fail("STANDALONE_FILESTATION_INVALID", "fileStation 只接受 session，需要 backend.go，且不能與 root helper integration 並用（helper 有自己的 File Station gate）。");
-    return undefined;
+function readCapabilities(value, c) {
+    if (value === undefined)
+        return {};
+    if (!isRecord(value)) {
+        c.fail("CAPABILITY_INVALID", "capabilities 必須是物件。");
+        return {};
+    }
+    const result = {};
+    for (const [name, setting] of Object.entries(value)) {
+        if (name === "delegate") {
+            if (validDelegate(setting))
+                result.delegate = setting;
+            else
+                c.fail("CAPABILITY_INVALID", "delegate requires nonempty unique §2.4 files operations and scope home or shared:<name>.");
+        }
+        else if (name === "files" && setting === "session")
+            result.files = "session";
+        else if (name === "identity" && setting === "standalone")
+            result.identity = "standalone";
+        else if (name === "rootOps" && setting === true)
+            result.rootOps = true;
+        else if (name === "jobs") {
+            result.jobs = readBackground(setting === true ? { worker: "sha256-v1" } : setting, e => c.fail("CAPABILITY_INVALID", e.message.replace("background", "capabilities.jobs")));
+        }
+        else
+            c.fail("CAPABILITY_INVALID", `不支援的 capabilities.${name} 值；files: session、identity: standalone、jobs: true 或 {worker: sha256-v1}、rootOps: true。`);
+    }
+    if (result.delegate && !result.jobs)
+        result.jobs = { worker: "sha256-v1" };
+    return result;
 }

package/dist/standalone/native-layout.d.ts

@@ -31,6 +31,10 @@ export interface NativeLayout {
     os_min_ver: string;
     privilege: 'none';
     arches: LayoutArch[];
+    schema: 2;
+    backend: {
+        kind: 'native';
+    };
     layout: {
         payload: string;
         metadata: string;
@@ -66,6 +70,7 @@ export declare function buildNativeLayout(options: {
     arches?: string[];
     outDir?: string;
     build?: number;
+    minDsm?: string;
     run?: CommandRunner;
 }): Promise<{
     outputs: string[];

package/dist/standalone/native-layout.js

@@ -6,8 +6,9 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
 import { runCommand } from './build.js';
+import { resolveMinDsm } from '../build-spk/dsm-version.js';
 export const LAYOUT_ARCHES = { x86_64: [2, 62], aarch64: [2, 183], armv8: [2, 183], armv7: [1, 40] };
-function fail(message) { throw new Error(`NATIVE_LAYOUT_INVALID: ${message}`); }
+function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
 function object(value, fields) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -47,7 +48,7 @@ function hook(value) {
 }
 export function isNativeLayout(root) {
     try {
-        return parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8'))?.layout !== undefined;
+        return (() => { const raw = parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')); return raw?.layout !== undefined || raw?.backend?.kind === 'native'; })();
     }
     catch {
         return false;
@@ -55,9 +56,15 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
-        if (m.schema !== 1 || m.privilege !== 'none')
-            fail('schema 1 and privilege: none required');
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
+        if (m.schema !== 2)
+            fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
+        const backend = object(m.backend, ['kind']);
+        if (backend.kind !== 'native' || (m.privilege !== undefined && m.privilege !== 'none'))
+            fail('backend.kind: native and package-only privilege required');
+        m.privilege = 'none';
+        if (existsSync(join(root, 'compose.yaml')))
+            fail('compose.yaml and dsm-package.yaml are mutually exclusive');
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
             fail('invalid package/version/DSM');
         if (!Number.isSafeInteger(m.build) || m.build < 1 || m.build > 2147483647)
@@ -207,7 +214,9 @@ function copyTree(from, to) {
     return entries;
 }
 export function checkLayoutMetadata(root, inspection = false, packageId) {
-    const p = JSON.parse(readFileSync(join(root, 'conf/privilege'), 'utf8'));
+    layoutFiles(root);
+    const p = object(JSON.parse(readFileSync(join(root, 'conf/privilege'), 'utf8')), ['defaults', 'username', 'groupname']);
+    object(p.defaults, ['run-as']);
     if (p.defaults?.['run-as'] !== 'package' || Object.keys(p).some(k => !['defaults', 'username', 'groupname'].includes(k)) || ['username', 'groupname'].some(k => p[k] !== undefined && p[k] !== packageId) || Object.keys(p.defaults).some(k => k !== 'run-as'))
         fail('native layout requires package-only lifecycle privilege');
     if (!existsSync(join(root, 'scripts/start-stop-status')))
@@ -220,14 +229,28 @@ export function checkLayoutMetadata(root, inspection = false, packageId) {
     if (existsSync(join(root, 'conf/systemd'))) {
         for (const entry of layoutFiles(join(root, 'conf/systemd'))) {
             const unit = readFileSync(join(root, 'conf/systemd', entry.path), 'utf8');
+            // Keep the package-only grammar unambiguous; systemd joins continued lines
+            // before interpreting Exec prefixes, which a physical-line check misses.
+            if (/\\\s*$/m.test(unit))
+                fail('systemd unit continuations are unsupported');
+            let section = '';
+            for (const line of unit.split('\n')) {
+                const heading = line.match(/^\s*\[([^\]]+)\]\s*$/);
+                if (heading)
+                    section = heading[1];
+                if (/^\s*(?:User|Group|Exec\w*)\s*=/.test(line) && section !== 'Service')
+                    fail('systemd execution directives require the package Service section');
+            }
+            if (!/^[^/]+\.service$/.test(entry.path))
+                fail('only package service units are supported');
             const users = [...unit.matchAll(/^\s*User\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
             const groups = [...unit.matchAll(/^\s*Group\s*=\s*(.*?)\s*$/gm)].map(m => m[1]);
-            if (!packageId || users.length !== 1 || users[0] !== packageId || groups.some(group => group !== packageId) || /^\s*(?:AmbientCapabilities|SupplementaryGroups|PermissionsStartOnly|RootDirectory|RootImage)\s*=/m.test(unit) || /^\s*Exec\w*\s*=\s*[+!]/m.test(unit))
+            if (!packageId || users.length !== 1 || users[0] !== packageId || groups.some(group => group !== packageId) || /^\s*(?:AmbientCapabilities|SupplementaryGroups|PermissionsStartOnly|RootDirectory|RootImage)\s*=/m.test(unit) || /^\s*Exec\w*\s*=\s*[-:@|]*[+!]/m.test(unit))
                 fail('systemd unit must run only as the package account');
         }
     }
     for (const name of readdirSync(root))
-        if (!['conf', 'scripts', 'WIZARD_UIFILES', 'PACKAGE_ICON.PNG', 'PACKAGE_ICON_256.PNG', ...(inspection ? ['INFO', 'package.tgz', 'native-layout.json', 'layout-inspection'] : [])].includes(name))
+        if (!['conf', 'scripts', 'WIZARD_UIFILES', 'PACKAGE_ICON.PNG', 'PACKAGE_ICON_256.PNG', ...(inspection ? ['INFO', 'package.tgz', 'native-layout.json', 'layout-inspection', 'syno_signature.asc'] : [])].includes(name))
             fail(`unsupported SPK metadata: ${name}`);
     for (const f of layoutFiles(root)) {
         if (f.path.startsWith('scripts/') && /\bsudo\b|\bchown\s+root\b|chmod\s+[ugo]*\+s\b/.test(readFileSync(join(root, f.path), 'utf8')))
@@ -239,6 +262,8 @@ export async function buildNativeLayout(options) {
     if (!loaded.ok)
         fail(loaded.errors.map(e => e.message).join('\n'));
     const m = loaded.manifest;
+    if (options.minDsm !== undefined)
+        m.os_min_ver = resolveMinDsm(options.minDsm);
     if (options.build !== undefined) {
         if (!Number.isSafeInteger(options.build) || options.build < 1 || options.build > 2147483647)
             fail('invalid build override');
@@ -292,6 +317,8 @@ export async function buildNativeLayout(options) {
 }
 export function inspectNativeLayout(dir, payload, info) {
     try {
+        if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
+            fail('invalid native INFO identity/version/DSM');
         const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
         if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
             fail('invalid native layout inventory');

package/dist/standalone/native-root-window.d.ts

@@ -0,0 +1,26 @@
+/** Build-time adapter for explicitly approved native product tasks. */
+/** What the window embeds per root operation: the task it may create, and how to recognize it. */
+export interface RootTask {
+    op: string;
+    name: string;
+    header: string;
+    script: string;
+    /** Whether the package backend serves `root.output` for this op; helper ops report through the helper instead. */
+    output: boolean;
+}
+/**
+ * `createRootAccess(options)` → `{ state, authorize, run, remove }`, plain
+ * ES5 for DSM's desktop. Every DSM call goes through `options.send` (the
+ * AppWindow's sendWebAPI) as the signed-in administrator:
+ *
+ * - authorize: DSM's own password confirmation, then one disabled root task
+ *   with exactly the embedded script. The one-use token goes into that single
+ *   create call and is never kept.
+ * - run: re-reads the task and runs it only if it is still exactly ours, then
+ *   waits for its history entry and asks the backend for the output. Repair
+ *   additionally requires fresh PasswordConfirm and another exact task check.
+ * - an older version of our task is "outdated" and never runs; authorizing
+ *   again replaces it. A same-named task that is not ours is a "conflict" and
+ *   is never run, replaced or deleted.
+ */
+export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {}, running = {};\n  var legacy = null, probe = null;\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function readOutput(task) {\n    return task.output ? options.call(\"root.output\", { op: task.op }) : Promise.resolve(null);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function listTasks() {\n    if (legacy === false) return options.send(API, \"list\", 3, { start: 0, limit: 500 });\n    if (legacy === true) return legacyList();\n    if (!probe) {\n      probe = options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n        legacy = false;\n        return data;\n      }, function (error) {\n        if (!error || (error.code !== \"dsm_103\" && error.code !== 103)) {\n          probe = null;\n          throw error;\n        }\n        legacy = true;\n        return legacyList();\n      });\n    }\n    return probe;\n  }\n  function legacyList() {\n    return options.send(API, \"list\", 2, { offset: 0, limit: 500 }).then(function (data) {\n      // Refuse a truncated snapshot: a same-named task could lie outside it.\n      if (!data || !Array.isArray(data.tasks) || data.tasks.length > 500\n          || !(typeof data.total === \"number\" && isFinite(data.total) && Math.floor(data.total) === data.total) || data.total !== data.tasks.length) throw fail(\"root_bad_response\");\n      return data;\n    });\n  }\n  function readTask(ref) {\n    return options.send(API, \"get\", legacy ? 3 : 4, ref);\n  }\n  function createTask(params) {\n    return options.send(legacy ? API : API + \".Root\", \"create\", legacy ? 3 : 4, params);\n  }\n  function deleteTask(ref) {\n    return options.send(API, \"delete\", 2, { tasks: [ref] });\n  }\n  function runTask(ref) {\n    return options.send(API, \"run\", 2, { tasks: [ref] });\n  }\n  function find(task) {\n    return listTasks().then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return readTask(ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.real_owner !== ref.real_owner || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  function validTime(value) {\n    if (typeof value !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$/.test(value)) return false;\n    var normalized = value.replace(\" \", \"T\") + \"Z\";\n    var date = new Date(normalized);\n    return !isNaN(date.getTime()) && date.toISOString().slice(0, 19) === normalized.slice(0, 19);\n  }\n  function bounded(call, deadline) {\n    // A poll count alone cannot bound a stalled DSM callback. Discard late replies.\n    return new Promise(function (resolve, reject) {\n      var remaining = deadline - Date.now();\n      if (remaining <= 0) { reject(fail(\"root_timeout\")); return; }\n      var timer = setTimeout(function () { reject(fail(\"root_timeout\")); }, remaining);\n      Promise.resolve().then(call).then(function (value) {\n        clearTimeout(timer);\n        if (Date.now() >= deadline) reject(fail(\"root_timeout\"));\n        else resolve(value);\n      }, function (error) { clearTimeout(timer); reject(error); });\n    });\n  }\n  function legacyHistory(ref, deadline) {\n    return bounded(function () { return options.send(API, \"view\", 1, { id: ref.id }); }, deadline).then(function (records) {\n      // DSM 7.1 omits data entirely when a task has never run.\n      if (records === undefined) records = [];\n      if (!Array.isArray(records) || records.length > 500) throw fail(\"root_bad_response\");\n      var seen = {};\n      records.forEach(function (record) {\n        if (!record || !validTime(record.start_time) || typeof record.stop_time !== \"string\"\n            || (record.stop_time && (!validTime(record.stop_time) || record.stop_time < record.start_time))\n            || typeof record.exit_type !== \"string\" || !(typeof record.exit_code === \"number\" && isFinite(record.exit_code) && Math.floor(record.exit_code) === record.exit_code)\n            || seen[record.start_time]) throw fail(\"root_bad_response\");\n        seen[record.start_time] = true;\n      });\n      return records;\n    });\n  }\n  function waitForLegacyRun(ref, before, deadline, polls) {\n    return legacyHistory(ref, deadline).then(function (records) {\n      var previous = before.map(function (record) { return record.start_time; });\n      var newestBefore = previous.slice().sort().pop();\n      var fresh = records.filter(function (record) { return previous.indexOf(record.start_time) === -1; });\n      if (fresh.length > 1) throw fail(\"root_bad_response\");\n      var latest = fresh[0];\n      if (latest && (!newestBefore || latest.start_time > newestBefore) && latest.stop_time) {\n        if (latest.exit_code !== 0 || latest.exit_type !== \"normal\") throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1 || Date.now() >= deadline) throw fail(\"root_timeout\");\n      return options.wait(Math.min(POLL_MS, deadline - Date.now())).then(function () {\n        return waitForLegacyRun(ref, before, deadline, polls - 1);\n      });\n    });\n  }\n  function execute(task, verified) {\n    if (!legacy) {\n      return history(verified.ref).then(function (before) {\n        return runTask(verified.ref).then(function () { return waitForRun(verified.ref, before, POLLS); });\n      });\n    }\n    var deadline = Date.now() + POLL_MS * POLLS;\n    return legacyHistory(verified.ref, deadline).then(function (before) {\n      if (before.some(function (record) { return !record.stop_time || record.exit_type === \"running\"; })) throw fail(\"root_not_ready\");\n      // Mutating calls are sent exactly once, never retried with another profile.\n      return bounded(function () { return runTask(verified.ref); }, deadline).then(function () {\n        return waitForLegacyRun(verified.ref, before, deadline, POLLS);\n      });\n    }).then(function () {\n      return bounded(function () { return find(task); }, deadline).then(function (after) {\n        if (after.state !== \"ready\" || String(after.ref.id) !== String(verified.ref.id)) throw fail(\"root_verify_failed\");\n      });\n    });\n  }\n  function performRun(op) {\n    return begin(op).then(function (task) {\n      return find(task).then(function (found) {\n        if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n        var consent = op === \"helper_repair\" ? options.confirmPassword() : Promise.resolve({ confirmed: true });\n        return consent.then(function (confirmation) {\n          if (!confirmation || confirmation.confirmed !== true) throw fail(\"root_cancelled\");\n          return op === \"helper_repair\" ? begin(op).then(find) : found;\n        }).then(function (verified) {\n          if (verified.state !== \"ready\") throw fail(\"root_not_ready\");\n          return execute(task, verified);\n        });\n      }).then(function () { return readOutput(task); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (confirmation) {\n            if (!confirmation || confirmation.confirmed !== true) return \"cancelled\";\n            if (!legacy && (typeof confirmation.token !== \"string\" || !confirmation.token)) throw fail(\"root_verify_failed\");\n            var params = definition(task, options.user().name);\n            if (!legacy) params.SynoConfirmPWToken = confirmation.token;\n            // Re-read after the legacy client-side dialog before replacing a task.\n            var checked = legacy ? begin(op).then(find) : Promise.resolve(found);\n            return checked.then(function (current) {\n              if (current.state === \"conflict\") throw fail(\"root_conflict\");\n              if (current.state === \"ready\") return;\n              var replaced = current.state === \"outdated\" ? deleteTask(current.ref) : Promise.resolve();\n              return replaced.then(function () { return createTask(params); });\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n      if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n      if (running[op]) return running[op];\n      var pending = performRun(op).then(function (value) {\n        delete running[op];\n        return value;\n      }, function (error) { delete running[op]; throw error; });\n      running[op] = pending;\n      return pending;\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return deleteTask(found.ref).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(readOutput);\n    }\n  };\n}";