@synopackageland/cli 0.6.0 → 0.7.0

package/templates/native-authorization/AuthorizationGate.vue

@@ -0,0 +1,91 @@
+<script setup lang="ts">
+import {computed,onMounted,onUnmounted,ref} from 'vue'
+import {Button,Callout,Dialog,Surface} from '@synopackageland/ui'
+import {ShieldCheck,TriangleAlert} from '@lucide/vue'
+import type {AuthorizationStatus,Context} from '../context'
+import {authorizationCopy} from './i18n'
+const props=defineProps<{ctx:Context}>()
+const emit=defineEmits<{ready:[]}>()
+const state=ref<AuthorizationStatus>()
+const pendingState=ref<AuthorizationStatus>()
+const busy=ref(false)
+const failure=ref(false)
+const confirmRevoke=ref(false)
+let disposed=false,sequence=0,pendingRecheck=false
+let unsubscribe:(()=>void)|undefined
+const text=computed(()=>authorizationCopy(props.ctx.locale,props.ctx.displayName||'__DISPLAY_NAME__'))
+const ready=computed(()=>state.value?.state==='ready')
+const shown=computed(()=>state.value||pendingState.value)
+const required=computed(()=>shown.value?.state==='authorization_required')
+const untrusted=computed(()=>['helper_untrusted','cli_untrusted'].includes(shown.value?.reason||''))
+const canAuthorize=computed(()=>required.value&&!untrusted.value)
+const unavailableKey=computed(()=>shown.value?.reason==='credential_not_ready'?'credential':'unavailable')
+const title=computed(()=>!shown.value?text.value('checking'):required.value?text.value('title'):shown.value.state==='ready'?text.value('ready'):shown.value.state==='not_admin'?text.value('not_admin.title'):shown.value.state==='session_expired'?text.value('session_expired.title'):text.value(unavailableKey.value+'.title'))
+const body=computed(()=>required.value?text.value('purpose'):shown.value?.state==='not_admin'?text.value('not_admin.body'):shown.value?.state==='session_expired'?text.value('session_expired.body'):shown.value?.state==='unavailable'?text.value(unavailableKey.value+'.body'):text.value('purpose'))
+const reasons=['grant_missing','upgrade_reapproval','helper_untrusted','cli_untrusted','grant_incompatible','package_identity_changed','maintenance_task_missing','maintenance_task_mismatch','helper_health_rejected','capability_missing']
+const reason=computed(()=>reasons.includes(shown.value?.reason||'')?shown.value!.reason!:'unknown')
+const next=computed(()=>untrusted.value?'next.reinstall':reason.value==='grant_missing'?'next.install':reason.value==='upgrade_reapproval'||reason.value==='grant_incompatible'?'next.update':'next.repair')
+async function action(method:'status'|'request'|'revoke'){
+ if(busy.value||disposed)return
+ const current=++sequence
+ pendingState.value=method==='request'&&state.value?.state==='authorization_required'?state.value:undefined
+ busy.value=true;failure.value=false
+ // Mutation/revalidation immediately hides application content. A request
+ // keeps its prior reason visible while DSM's confirmation is pending.
+ state.value=undefined
+ try {
+  const result=await props.ctx.authorization?.[method]()
+  if(disposed||current!==sequence)return
+  if(!result||result.command!=='authorization'||result.schema_version!==1||!['ready','authorization_required','not_admin','session_expired','unavailable'].includes(result.state))throw Error('invalid status')
+  // A reason-only upgrade tombstone never accompanies a usable authorization.
+  if(result.reason==='upgrade_reapproval'&&result.state!=='authorization_required')throw Error('invalid status')
+  state.value=result
+  if(result.state==='ready')emit('ready')
+ } catch(e){if(!disposed&&current===sequence){
+  state.value=(e as {code?:string}).code==='session_required'?{command:'authorization',schema_version:1,state:'session_expired',reason:'session_expired'}:pendingState.value||{command:'authorization',schema_version:1,state:'unavailable',reason:'service_unavailable'}
+  failure.value=true
+ }} finally{if(!disposed&&current===sequence){busy.value=false;pendingState.value=undefined;if(pendingRecheck){pendingRecheck=false;void action('status')}}}
+}
+onMounted(()=>{unsubscribe=props.ctx.reopen(()=>{if(busy.value)pendingRecheck=true;else void action('status')});void action('status')})
+onUnmounted(()=>{disposed=true;sequence++;if(typeof unsubscribe==='function')unsubscribe()})
+</script>
+<template>
+ <p class="authorization-announcement" role="status" aria-live="polite" aria-atomic="true">{{ busy ? text('authorizing') : title }}</p>
+ <div v-if="!ready" class="authorization-view" :aria-busy="busy" :data-authorization-state="state?.state || 'checking'">
+  <Surface class="authorization-card" padding="lg" raised :aria-label="title">
+   <span class="authorization-icon" aria-hidden="true"><component :is="shown?.state==='unavailable'||shown?.state==='session_expired'?TriangleAlert:ShieldCheck" class="authorization-icon-glyph" /></span>
+   <h1 class="authorization-title">{{ title }}</h1>
+   <p class="authorization-body">{{ body }}</p>
+   <Callout v-if="required" class="authorization-status" :tone="['grant_missing','upgrade_reapproval'].includes(reason)?'info':'warning'" :title="text('reason.'+reason)">{{ text(next) }}</Callout>
+   <Callout v-if="failure" class="authorization-failed" tone="warning">{{ text('failed') }}</Callout>
+   <div class="authorization-actions">
+    <Button v-if="canAuthorize" variant="primary" :loading="busy" :disabled="busy" @click="action('request')">{{ busy ? text('authorizing') : text('authorize') }}</Button>
+    <Button v-else variant="primary" :loading="busy" :disabled="busy" @click="action('status')">{{ busy ? text('checking') : text('retry') }}</Button>
+   </div>
+  </Surface>
+ </div>
+ <div v-else class="authorization-authorized">
+  <div class="authorization-ready"><ShieldCheck :size="16" aria-hidden="true"/><span>{{ text('ready') }}</span><Button v-if="ctx.authorization?.canManage?.()" variant="secondary" :disabled="busy" @click="confirmRevoke=true">{{ text('revoke') }}</Button></div>
+  <slot />
+ </div>
+ <Dialog v-model:open="confirmRevoke" :title="text('revoke.title')" :description="text('revoke.body')">
+  <template #footer><Button variant="secondary" @click="confirmRevoke=false">{{ text('cancel') }}</Button><Button variant="danger" :disabled="busy" @click="confirmRevoke=false;action('revoke')">{{ text('revoke') }}</Button></template>
+ </Dialog>
+</template>
+<style scoped>
+.authorization-announcement{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap}
+/* T0156: auto margins center the whole card but preserve top scrolling in a short window. */
+.authorization-view{display:flex;align-items:flex-start;justify-content:center;min-height:100%;height:100%;box-sizing:border-box;padding:24px;overflow-y:auto;color:var(--ui-text);font-family:var(--ui-font-sans)}
+.authorization-card{display:flex;flex-direction:column;align-items:center;gap:12px;width:100%;max-width:28rem;margin:auto;text-align:center}
+.authorization-icon{display:flex;align-items:center;justify-content:center;width:48px;height:48px;flex-shrink:0;border-radius:9999px;background:var(--ui-primary-soft);color:var(--ui-primary)}
+.authorization-icon-glyph{width:24px;height:24px}
+.authorization-title{font-size:16px;font-weight:600;line-height:1.4;color:var(--ui-text);margin:0;text-wrap:balance}
+.authorization-body{max-width:24rem;font-size:13px;line-height:1.6;color:var(--ui-text);margin:0;text-align:center;text-wrap:pretty}
+.authorization-status,.authorization-failed{width:100%;text-align:left}
+/* Essential recovery text uses the full foreground; DSM's muted token is below 4.5:1. */
+.authorization-status,.authorization-failed{color:var(--ui-text)}
+.authorization-actions{display:flex;justify-content:center;width:100%;margin-top:4px}
+.authorization-authorized{display:flex;flex-direction:column;height:100%;min-height:0}.authorization-authorized :deep(.app-shell){flex:1;min-height:0;height:auto}
+.authorization-ready{display:flex;align-items:center;justify-content:flex-end;gap:8px;padding:8px 16px;color:var(--ui-text);font:13px var(--ui-font-sans)}
+@media(max-width:480px){.authorization-view{padding:16px}}
+</style>

package/templates/native-authorization/i18n/de.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} benötigt Ihre Erlaubnis",
+  "authorization.purpose": "Dieses Paket benötigt eine Genehmigung für feste Root-Operationen. DSM verarbeitet Ihr Passwort; das Paket sieht oder speichert es nicht.",
+  "authorization.reason.grant_missing": "Root-Operationen sind noch nicht autorisiert.",
+  "authorization.reason.upgrade_reapproval": "Das Paket wurde im Paket-Zentrum aktualisiert, daher wurde die bisherige Autorisierung widerrufen.",
+  "authorization.reason.helper_untrusted": "Dem privilegierten Helfer konnte nicht vertraut werden.",
+  "authorization.reason.cli_untrusted": "Dem privilegierten Befehl konnte nicht vertraut werden.",
+  "authorization.reason.grant_incompatible": "Der privilegierte Helfer muss aktualisiert werden.",
+  "authorization.reason.package_identity_changed": "Das Paketkonto hat sich geändert.",
+  "authorization.reason.maintenance_task_missing": "Die Wartungsaufgabe fehlt.",
+  "authorization.reason.maintenance_task_mismatch": "Die Wartungsaufgabe passt nicht mehr zur Berechtigung.",
+  "authorization.reason.helper_health_rejected": "Der privilegierte Helfer hat seine Integritätsprüfung nicht bestanden.",
+  "authorization.reason.capability_missing": "Dem privilegierten Helfer fehlt eine erforderliche Fähigkeit.",
+  "authorization.reason.unknown": "Die Berechtigung fehlt oder ist nicht mehr gültig.",
+  "authorization.next.install": "Wählen Sie Autorisieren und bestätigen Sie Ihr DSM-Passwort, um diesen Build zu genehmigen.",
+  "authorization.next.update": "Dieser Build benötigt eine neue Autorisierung. Wählen Sie Autorisieren und bestätigen Sie Ihr DSM-Passwort.",
+  "authorization.next.repair": "Prüfen Sie die Aufgaben dieses Pakets im Aufgabenplaner und versuchen Sie es erneut.",
+  "authorization.authorize": "Berechtigen",
+  "authorization.authorizing": "Warten auf DSM…",
+  "authorization.failed": "Die Berechtigung wurde nicht abgeschlossen. Sie können es erneut versuchen.",
+  "authorization.unavailable.title": "Berechtigung konnte nicht geprüft werden",
+  "authorization.unavailable.body": "Das ist meist vorübergehend. Versuchen Sie es erneut; {package} fragt nicht nach Ihrem Passwort.",
+  "authorization.credential.title": "Die DSM-Anmeldeinformationen sind nicht bereit",
+  "authorization.credential.body": "Diese DSM-Sitzung wurde ohne Anmeldung mit Kennwort wiederhergestellt, daher kann DSM die Anfragen von {package} nicht bestätigen. Melden Sie sich bei DSM ab, melden Sie sich erneut mit Ihrem Kennwort an und öffnen Sie dann {package} erneut.",
+  "authorization.retry": "Erneut versuchen",
+  "authorization.next.reinstall": "Die installierten Dateien stimmen nicht mit diesem Build überein. Installieren Sie das Paket aus einer vertrauenswürdigen Quelle neu.",
+  "authorization.not_admin.title": "Administrator erforderlich",
+  "authorization.not_admin.body": "Bitten Sie einen DSM-Administrator, dieses Paket zu öffnen und zu autorisieren.",
+  "authorization.session_expired.title": "Sitzung abgelaufen",
+  "authorization.session_expired.body": "Melden Sie sich erneut bei DSM an und öffnen Sie dieses Paket wieder.",
+  "authorization.ready": "Autorisiert",
+  "authorization.revoke": "Autorisierung widerrufen",
+  "authorization.revoke.title": "Autorisierung widerrufen?",
+  "authorization.revoke.body": "Neuer Helper-Zugriff wird deaktiviert. Paketdaten und bisherige Ergebnisse bleiben erhalten.",
+  "authorization.cancel": "Abbrechen",
+  "authorization.checking": "Autorisierung wird geprüft…"
+}

package/templates/native-authorization/i18n/en.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} needs your permission",
+  "authorization.purpose": "This package needs approval for its fixed root operations. DSM handles your password; the package never sees or stores it.",
+  "authorization.reason.grant_missing": "Root operations are not authorized yet.",
+  "authorization.reason.upgrade_reapproval": "The package was updated in Package Center, so its previous authorization was revoked.",
+  "authorization.reason.helper_untrusted": "The privileged helper could not be trusted.",
+  "authorization.reason.cli_untrusted": "The privileged command could not be trusted.",
+  "authorization.reason.grant_incompatible": "The privileged helper needs an update.",
+  "authorization.reason.package_identity_changed": "The package account changed.",
+  "authorization.reason.maintenance_task_missing": "The maintenance task is missing.",
+  "authorization.reason.maintenance_task_mismatch": "The maintenance task no longer matches the authorization.",
+  "authorization.reason.helper_health_rejected": "The privileged helper did not pass its health check.",
+  "authorization.reason.capability_missing": "The privileged helper lacks a required capability.",
+  "authorization.reason.unknown": "The authorization is missing or no longer valid.",
+  "authorization.next.install": "Choose Authorize and confirm your DSM password to approve this build.",
+  "authorization.next.update": "This build needs fresh authorization. Choose Authorize and confirm your DSM password.",
+  "authorization.next.repair": "Review this package and its tasks in Task Scheduler, then retry.",
+  "authorization.authorize": "Authorize",
+  "authorization.authorizing": "Waiting for DSM…",
+  "authorization.failed": "Authorization did not finish. You can try again.",
+  "authorization.unavailable.title": "Authorization could not be checked",
+  "authorization.unavailable.body": "This is usually temporary. Try again — {package} will not ask for your password.",
+  "authorization.credential.title": "DSM's sign-in credential is not ready",
+  "authorization.credential.body": "This DSM session was restored without a password sign-in, so DSM cannot vouch for {package}'s requests. Sign out of DSM, sign in again with your password, then reopen {package}.",
+  "authorization.retry": "Try again",
+  "authorization.next.reinstall": "The installed files do not match this build. Reinstall the package from a trusted source, then retry.",
+  "authorization.not_admin.title": "Administrator needed",
+  "authorization.not_admin.body": "Ask a DSM administrator to open this package and authorize it.",
+  "authorization.session_expired.title": "Session expired",
+  "authorization.session_expired.body": "Sign in to DSM again, then reopen this package.",
+  "authorization.ready": "Authorized",
+  "authorization.revoke": "Revoke authorization",
+  "authorization.revoke.title": "Revoke authorization?",
+  "authorization.revoke.body": "New helper access will be disabled. Package data and past results are retained.",
+  "authorization.cancel": "Cancel",
+  "authorization.checking": "Checking authorization…"
+}

package/templates/native-authorization/i18n/es.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} necesita su permiso",
+  "authorization.purpose": "Este paquete requiere aprobación para sus operaciones root fijas. DSM gestiona su contraseña; el paquete no la ve ni la almacena.",
+  "authorization.reason.grant_missing": "Las operaciones root aún no están autorizadas.",
+  "authorization.reason.upgrade_reapproval": "El paquete se actualizó en el Centro de paquetes, por lo que se revocó la autorización anterior.",
+  "authorization.reason.helper_untrusted": "No se pudo confiar en el asistente privilegiado.",
+  "authorization.reason.cli_untrusted": "No se pudo confiar en el comando privilegiado.",
+  "authorization.reason.grant_incompatible": "El asistente privilegiado necesita una actualización.",
+  "authorization.reason.package_identity_changed": "La cuenta del paquete ha cambiado.",
+  "authorization.reason.maintenance_task_missing": "Falta la tarea de mantenimiento.",
+  "authorization.reason.maintenance_task_mismatch": "La tarea de mantenimiento ya no coincide con la autorización.",
+  "authorization.reason.helper_health_rejected": "El asistente privilegiado no superó su comprobación de estado.",
+  "authorization.reason.capability_missing": "Al asistente privilegiado le falta una capacidad necesaria.",
+  "authorization.reason.unknown": "La autorización falta o ya no es válida.",
+  "authorization.next.install": "Elija Autorizar y confirme su contraseña de DSM para aprobar esta versión.",
+  "authorization.next.update": "Esta versión requiere una nueva autorización. Elija Autorizar y confirme su contraseña de DSM.",
+  "authorization.next.repair": "Revise las tareas de este paquete en el Programador de tareas y vuelva a intentarlo.",
+  "authorization.authorize": "Autorizar",
+  "authorization.authorizing": "Esperando a DSM…",
+  "authorization.failed": "La autorización no se completó. Puede intentarlo de nuevo.",
+  "authorization.unavailable.title": "No se pudo comprobar la autorización",
+  "authorization.unavailable.body": "Suele ser temporal. Inténtelo de nuevo; {package} no le pedirá la contraseña.",
+  "authorization.credential.title": "Las credenciales de inicio de sesión de DSM no están listas",
+  "authorization.credential.body": "Esta sesión de DSM se restauró sin iniciar sesión con contraseña, por lo que DSM no puede avalar las solicitudes de {package}. Cierre sesión en DSM, inicie sesión de nuevo con su contraseña y vuelva a abrir {package}.",
+  "authorization.retry": "Reintentar",
+  "authorization.next.reinstall": "Los archivos instalados no coinciden con esta versión. Reinstale el paquete desde una fuente fiable y vuelva a intentarlo.",
+  "authorization.not_admin.title": "Se requiere un administrador",
+  "authorization.not_admin.body": "Pida a un administrador de DSM que abra y autorice este paquete.",
+  "authorization.session_expired.title": "Sesión caducada",
+  "authorization.session_expired.body": "Inicie sesión de nuevo en DSM y vuelva a abrir este paquete.",
+  "authorization.ready": "Autorizado",
+  "authorization.revoke": "Revocar autorización",
+  "authorization.revoke.title": "¿Revocar autorización?",
+  "authorization.revoke.body": "Se desactivarán los nuevos accesos del asistente privilegiado. Se conservan los datos del paquete y los resultados anteriores.",
+  "authorization.cancel": "Cancelar",
+  "authorization.checking": "Comprobando autorización…"
+}

package/templates/native-authorization/i18n/fr.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} demande votre autorisation",
+  "authorization.purpose": "Ce paquet nécessite une autorisation pour ses opérations root fixes. DSM traite votre mot de passe ; le paquet ne le voit ni ne le stocke.",
+  "authorization.reason.grant_missing": "Les opérations root ne sont pas encore autorisées.",
+  "authorization.reason.upgrade_reapproval": "Le paquet a été mis à jour dans le Centre de paquets ; l'autorisation précédente a donc été révoquée.",
+  "authorization.reason.helper_untrusted": "L'assistant privilégié n'a pas pu être approuvé.",
+  "authorization.reason.cli_untrusted": "La commande privilégiée n'a pas pu être approuvée.",
+  "authorization.reason.grant_incompatible": "L'assistant privilégié doit être mis à jour.",
+  "authorization.reason.package_identity_changed": "Le compte du paquet a changé.",
+  "authorization.reason.maintenance_task_missing": "La tâche de maintenance est introuvable.",
+  "authorization.reason.maintenance_task_mismatch": "La tâche de maintenance ne correspond plus à l'autorisation.",
+  "authorization.reason.helper_health_rejected": "L'assistant privilégié n'a pas réussi son contrôle d'intégrité.",
+  "authorization.reason.capability_missing": "Il manque à l'assistant privilégié une capacité requise.",
+  "authorization.reason.unknown": "L'autorisation est absente ou n'est plus valide.",
+  "authorization.next.install": "Choisissez Autoriser et confirmez votre mot de passe DSM pour approuver cette version.",
+  "authorization.next.update": "Cette version nécessite une nouvelle autorisation. Choisissez Autoriser et confirmez votre mot de passe DSM.",
+  "authorization.next.repair": "Vérifiez les tâches de ce paquet dans le Planificateur de tâches, puis réessayez.",
+  "authorization.authorize": "Autoriser",
+  "authorization.authorizing": "En attente de DSM…",
+  "authorization.failed": "L'autorisation ne s'est pas terminée. Vous pouvez réessayer.",
+  "authorization.unavailable.title": "Impossible de vérifier l'autorisation",
+  "authorization.unavailable.body": "C'est généralement temporaire. Réessayez ; {package} ne demandera pas votre mot de passe.",
+  "authorization.credential.title": "Les identifiants de connexion DSM ne sont pas prêts",
+  "authorization.credential.body": "Cette session DSM a été restaurée sans connexion par mot de passe : DSM ne peut donc pas authentifier les requêtes de {package}. Déconnectez-vous de DSM, reconnectez-vous avec votre mot de passe, puis rouvrez {package}.",
+  "authorization.retry": "Réessayer",
+  "authorization.next.reinstall": "Les fichiers installés ne correspondent pas à cette version. Réinstallez le paquet depuis une source fiable, puis réessayez.",
+  "authorization.not_admin.title": "Administrateur requis",
+  "authorization.not_admin.body": "Demandez à un administrateur DSM d’ouvrir ce paquet et de l’autoriser.",
+  "authorization.session_expired.title": "Session expirée",
+  "authorization.session_expired.body": "Reconnectez-vous à DSM, puis rouvrez ce paquet.",
+  "authorization.ready": "Autorisé",
+  "authorization.revoke": "Révoquer l’autorisation",
+  "authorization.revoke.title": "Révoquer l’autorisation ?",
+  "authorization.revoke.body": "Les nouveaux accès helper seront désactivés. Les données du paquet et les résultats précédents sont conservés.",
+  "authorization.cancel": "Annuler",
+  "authorization.checking": "Vérification de l’autorisation…"
+}

package/templates/native-authorization/i18n/index.ts

@@ -0,0 +1,15 @@
+import en from './en.json'
+import zhTW from './zh-TW.json'
+import zhCN from './zh-CN.json'
+import ja from './ja.json'
+import ko from './ko.json'
+import de from './de.json'
+import fr from './fr.json'
+import es from './es.json'
+import it from './it.json'
+const catalogs:Record<string,Record<string,string>>={en,'zh-TW':zhTW,'zh-CN':zhCN,ja,ko,de,fr,es,it}
+/** Copy follows Reclaim T0156; root-task semantics are template-owned. */
+export function authorizationCopy(locale:string,packageName:string){
+ const catalog={...en,...catalogs[locale]}
+ return (key:string)=>((catalog as Record<string,string>)[`authorization.${key}`]||key).replaceAll('{package}',packageName)
+}

package/templates/native-authorization/i18n/it.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} richiede l’autorizzazione",
+  "authorization.purpose": "Questo pacchetto richiede l’approvazione per le sue operazioni root fisse. DSM gestisce la password; il pacchetto non la vede né la memorizza.",
+  "authorization.reason.grant_missing": "Le operazioni root non sono ancora autorizzate.",
+  "authorization.reason.upgrade_reapproval": "Il pacchetto è stato aggiornato in Centro pacchetti, quindi l'autorizzazione precedente è stata revocata.",
+  "authorization.reason.helper_untrusted": "Non è stato possibile considerare attendibile l'helper privilegiato.",
+  "authorization.reason.cli_untrusted": "Non è stato possibile considerare attendibile il comando privilegiato.",
+  "authorization.reason.grant_incompatible": "L'helper privilegiato deve essere aggiornato.",
+  "authorization.reason.package_identity_changed": "L'account del pacchetto è cambiato.",
+  "authorization.reason.maintenance_task_missing": "L'attività di manutenzione non è presente.",
+  "authorization.reason.maintenance_task_mismatch": "L'attività di manutenzione non corrisponde più all'autorizzazione.",
+  "authorization.reason.helper_health_rejected": "L'helper privilegiato non ha superato il controllo di integrità.",
+  "authorization.reason.capability_missing": "All'helper privilegiato manca una capacità necessaria.",
+  "authorization.reason.unknown": "L'autorizzazione è mancante o non più valida.",
+  "authorization.next.install": "Scegliere «Autorizza» e confermare la password DSM per approvare questa versione.",
+  "authorization.next.update": "Questa versione richiede una nuova autorizzazione. Scegliere «Autorizza» e confermare la password DSM.",
+  "authorization.next.repair": "Controllare le attività del pacchetto nell’Utilità di pianificazione, quindi riprovare.",
+  "authorization.authorize": "Autorizza",
+  "authorization.authorizing": "In attesa di DSM…",
+  "authorization.failed": "L’autorizzazione non è stata completata. È possibile riprovare.",
+  "authorization.unavailable.title": "Impossibile verificare l'autorizzazione",
+  "authorization.unavailable.body": "Di solito è temporaneo. Riprovare; {package} non chiederà la password.",
+  "authorization.credential.title": "Le credenziali di accesso di DSM non sono pronte",
+  "authorization.credential.body": "Questa sessione DSM è stata ripristinata senza accesso con password, quindi DSM non può garantire per le richieste di {package}. Disconnettersi da DSM, accedere di nuovo con la password e riaprire {package}.",
+  "authorization.retry": "Riprova",
+  "authorization.next.reinstall": "I file installati non corrispondono a questa versione. Reinstallare il pacchetto da una fonte attendibile, quindi riprovare.",
+  "authorization.not_admin.title": "Amministratore necessario",
+  "authorization.not_admin.body": "Chiedere a un amministratore DSM di aprire e autorizzare questo pacchetto.",
+  "authorization.session_expired.title": "Sessione scaduta",
+  "authorization.session_expired.body": "Accedere nuovamente a DSM e riaprire questo pacchetto.",
+  "authorization.ready": "Autorizzato",
+  "authorization.revoke": "Revoca autorizzazione",
+  "authorization.revoke.title": "Revocare l’autorizzazione?",
+  "authorization.revoke.body": "I nuovi accessi helper saranno disabilitati. I dati del pacchetto e i risultati precedenti vengono conservati.",
+  "authorization.cancel": "Annulla",
+  "authorization.checking": "Verifica dell’autorizzazione…"
+}

package/templates/native-authorization/i18n/ja.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} に承認が必要です",
+  "authorization.purpose": "このパッケージの固定 root 操作には承認が必要です。パスワードは DSM が処理し、パッケージは閲覧も保存もしません。",
+  "authorization.reason.grant_missing": "root 操作はまだ承認されていません。",
+  "authorization.reason.upgrade_reapproval": "パッケージ センターでパッケージが更新されたため、以前の承認は取り消されました。",
+  "authorization.reason.helper_untrusted": "特権ヘルパーを信頼できませんでした。",
+  "authorization.reason.cli_untrusted": "特権コマンドを信頼できませんでした。",
+  "authorization.reason.grant_incompatible": "特権ヘルパーの更新が必要です。",
+  "authorization.reason.package_identity_changed": "パッケージ アカウントが変更されました。",
+  "authorization.reason.maintenance_task_missing": "メンテナンス タスクが見つかりません。",
+  "authorization.reason.maintenance_task_mismatch": "メンテナンス タスクが認可と一致しません。",
+  "authorization.reason.helper_health_rejected": "特権ヘルパーがヘルス チェックに合格しませんでした。",
+  "authorization.reason.capability_missing": "特権ヘルパーに必要な機能がありません。",
+  "authorization.reason.unknown": "認可が見つからないか、無効になっています。",
+  "authorization.next.install": "「承認」を選び、DSM パスワードでこのビルドを承認してください。",
+  "authorization.next.update": "このビルドには再承認が必要です。「承認」を選び、DSM パスワードで確認してください。",
+  "authorization.next.repair": "タスク スケジューラでこのパッケージのタスクを確認し、再試行してください。",
+  "authorization.authorize": "認可",
+  "authorization.authorizing": "DSM を待機しています…",
+  "authorization.failed": "認可が完了しませんでした。もう一度お試しください。",
+  "authorization.unavailable.title": "認可を確認できませんでした",
+  "authorization.unavailable.body": "通常は一時的な問題です。もう一度お試しください。{package} がパスワードを求めることはありません。",
+  "authorization.credential.title": "DSM のサインイン資格情報が準備できていません",
+  "authorization.credential.body": "この DSM セッションはパスワードによるサインインなしで復元されたため、DSM は {package} のリクエストを保証できません。DSM からサインアウトし、パスワードで再度サインインしてから、{package} を開き直してください。",
+  "authorization.retry": "再試行",
+  "authorization.next.reinstall": "インストールされたファイルがこのビルドと一致しません。信頼できる配布元から再インストールし、再試行してください。",
+  "authorization.not_admin.title": "管理者が必要です",
+  "authorization.not_admin.body": "DSM 管理者にこのパッケージの承認を依頼してください。",
+  "authorization.session_expired.title": "セッションが期限切れです",
+  "authorization.session_expired.body": "DSM に再ログインし、このパッケージを開き直してください。",
+  "authorization.ready": "承認済み",
+  "authorization.revoke": "承認を取り消す",
+  "authorization.revoke.title": "承認を取り消しますか？",
+  "authorization.revoke.body": "新しい helper アクセスを無効にします。パッケージのデータと過去の結果は保持されます。",
+  "authorization.cancel": "キャンセル",
+  "authorization.checking": "承認を確認中…"
+}

package/templates/native-authorization/i18n/ko.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} 승인 필요",
+  "authorization.purpose": "이 패키지의 고정 root 작업에는 승인이 필요합니다. 암호는 DSM이 처리하며 패키지는 암호를 보거나 저장하지 않습니다.",
+  "authorization.reason.grant_missing": "root 작업이 아직 승인되지 않았습니다.",
+  "authorization.reason.upgrade_reapproval": "패키지 센터에서 패키지가 업데이트되어 이전 승인이 취소되었습니다.",
+  "authorization.reason.helper_untrusted": "권한 있는 도우미를 신뢰할 수 없습니다.",
+  "authorization.reason.cli_untrusted": "권한 있는 명령을 신뢰할 수 없습니다.",
+  "authorization.reason.grant_incompatible": "권한 있는 도우미를 업데이트해야 합니다.",
+  "authorization.reason.package_identity_changed": "패키지 계정이 변경되었습니다.",
+  "authorization.reason.maintenance_task_missing": "유지 관리 작업이 없습니다.",
+  "authorization.reason.maintenance_task_mismatch": "유지 관리 작업이 권한과 일치하지 않습니다.",
+  "authorization.reason.helper_health_rejected": "권한 있는 도우미가 상태 검사를 통과하지 못했습니다.",
+  "authorization.reason.capability_missing": "권한 있는 도우미에 필요한 기능이 없습니다.",
+  "authorization.reason.unknown": "권한이 없거나 더 이상 유효하지 않습니다.",
+  "authorization.next.install": "승인을 선택하고 DSM 암호로 이 빌드를 승인하십시오.",
+  "authorization.next.update": "이 빌드는 새 승인이 필요합니다. 승인을 선택하고 DSM 암호로 확인하십시오.",
+  "authorization.next.repair": "작업 스케줄러에서 패키지 작업을 확인한 후 다시 시도하십시오.",
+  "authorization.authorize": "권한 부여",
+  "authorization.authorizing": "DSM을 기다리는 중…",
+  "authorization.failed": "권한 부여가 완료되지 않았습니다. 다시 시도할 수 있습니다.",
+  "authorization.unavailable.title": "권한을 확인할 수 없습니다",
+  "authorization.unavailable.body": "일반적으로 일시적인 문제입니다. 다시 시도하십시오. {package}은 암호를 요구하지 않습니다.",
+  "authorization.credential.title": "DSM 로그인 자격 증명이 준비되지 않았습니다",
+  "authorization.credential.body": "이 DSM 세션은 암호 로그인 없이 복원되었으므로 DSM이 {package}의 요청을 보증할 수 없습니다. DSM에서 로그아웃한 후 암호로 다시 로그인하고 {package}을 다시 여십시오.",
+  "authorization.retry": "다시 시도",
+  "authorization.next.reinstall": "설치된 파일이 이 빌드와 일치하지 않습니다. 신뢰할 수 있는 출처에서 패키지를 다시 설치한 후 다시 시도하십시오.",
+  "authorization.not_admin.title": "관리자가 필요합니다",
+  "authorization.not_admin.body": "DSM 관리자에게 이 패키지를 열고 승인하도록 요청하십시오.",
+  "authorization.session_expired.title": "세션이 만료되었습니다",
+  "authorization.session_expired.body": "DSM에 다시 로그인한 후 패키지를 다시 여십시오.",
+  "authorization.ready": "승인됨",
+  "authorization.revoke": "승인 취소",
+  "authorization.revoke.title": "승인을 취소하시겠습니까?",
+  "authorization.revoke.body": "새 helper 액세스가 비활성화됩니다. 패키지 데이터와 이전 결과는 유지됩니다.",
+  "authorization.cancel": "취소",
+  "authorization.checking": "승인 확인 중…"
+}

package/templates/native-authorization/i18n/zh-CN.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} 需要授权",
+  "authorization.purpose": "此套件执行固定的 root 操作前需要批准。密码由 DSM 处理，套件不会看到或存储。",
+  "authorization.reason.grant_missing": "尚未授权 root 操作。",
+  "authorization.reason.upgrade_reapproval": "套件已通过套件中心更新，之前的授权已撤销。",
+  "authorization.reason.helper_untrusted": "无法信任特权 helper。",
+  "authorization.reason.cli_untrusted": "无法信任特权命令。",
+  "authorization.reason.grant_incompatible": "特权 helper 需要更新。",
+  "authorization.reason.package_identity_changed": "套件账号已更改。",
+  "authorization.reason.maintenance_task_missing": "找不到维护任务。",
+  "authorization.reason.maintenance_task_mismatch": "维护任务已与授权不符。",
+  "authorization.reason.helper_health_rejected": "特权 helper 未通过健康检查。",
+  "authorization.reason.capability_missing": "特权 helper 缺少必要的能力。",
+  "authorization.reason.unknown": "授权已丢失或不再有效。",
+  "authorization.next.install": "选择“授权”，并使用 DSM 密码确认，即可批准此版本。",
+  "authorization.next.update": "此版本需要重新授权。请选择“授权”，并使用 DSM 密码确认。",
+  "authorization.next.repair": "请在任务计划中检查此套件的任务，再重试。",
+  "authorization.authorize": "授权",
+  "authorization.authorizing": "正在等待 DSM…",
+  "authorization.failed": "授权未完成，请重试。",
+  "authorization.unavailable.title": "无法检查授权",
+  "authorization.unavailable.body": "这通常是暂时的。请重试，{package} 不会要求输入密码。",
+  "authorization.credential.title": "DSM 的登录凭据尚未就绪",
+  "authorization.credential.body": "此 DSM 会话是恢复而来，并未使用密码登录，因此 DSM 无法为 {package} 的请求作证。请注销 DSM，使用密码重新登录，然后再打开 {package}。",
+  "authorization.retry": "重试",
+  "authorization.next.reinstall": "安装的文件与此版本不符。请从可信任的来源重新安装套件，再重试。",
+  "authorization.not_admin.title": "需要管理员处理",
+  "authorization.not_admin.body": "请 DSM 管理员打开此套件并完成授权。",
+  "authorization.session_expired.title": "登录已超时",
+  "authorization.session_expired.body": "请重新登录 DSM，再打开此套件。",
+  "authorization.ready": "已授权",
+  "authorization.revoke": "撤销授权",
+  "authorization.revoke.title": "撤销授权？",
+  "authorization.revoke.body": "新的 helper 访问将被禁用。套件数据与过往结果会保留。",
+  "authorization.cancel": "取消",
+  "authorization.checking": "正在检查授权…"
+}

package/templates/native-authorization/i18n/zh-TW.json

@@ -0,0 +1,37 @@
+{
+  "authorization.title": "{package} 需要授權",
+  "authorization.purpose": "此套件執行固定的 root 操作前需要核准。密碼由 DSM 處理，套件不會看到或儲存。",
+  "authorization.reason.grant_missing": "尚未授權 root 操作。",
+  "authorization.reason.upgrade_reapproval": "套件已透過套件中心更新，先前的授權已撤銷。",
+  "authorization.reason.helper_untrusted": "無法信任特權 helper。",
+  "authorization.reason.cli_untrusted": "無法信任特權命令。",
+  "authorization.reason.grant_incompatible": "特權 helper 需要更新。",
+  "authorization.reason.package_identity_changed": "套件帳號已變更。",
+  "authorization.reason.maintenance_task_missing": "找不到維護任務。",
+  "authorization.reason.maintenance_task_mismatch": "維護任務已與授權不符。",
+  "authorization.reason.helper_health_rejected": "特權 helper 未通過健康檢查。",
+  "authorization.reason.capability_missing": "特權 helper 缺少必要的能力。",
+  "authorization.reason.unknown": "授權已遺失或不再有效。",
+  "authorization.next.install": "選擇「授權」，並以 DSM 密碼確認，即可核准此版本。",
+  "authorization.next.update": "此版本需要重新授權。請選擇「授權」，並以 DSM 密碼確認。",
+  "authorization.next.repair": "請在任務排程表中檢查此套件的任務，再重試。",
+  "authorization.authorize": "授權",
+  "authorization.authorizing": "正在等待 DSM…",
+  "authorization.failed": "授權未完成，請再試一次。",
+  "authorization.unavailable.title": "無法檢查授權",
+  "authorization.unavailable.body": "這通常是暫時的。請再試一次，{package} 不會要求輸入密碼。",
+  "authorization.credential.title": "DSM 的登入憑證尚未就緒",
+  "authorization.credential.body": "此 DSM 工作階段是還原而來，並未使用密碼登入，因此 DSM 無法為 {package} 的要求作證。請登出 DSM，以密碼重新登入，然後再開啟 {package}。",
+  "authorization.retry": "重試",
+  "authorization.next.reinstall": "安裝的檔案與此版本不符。請從可信任的來源重新安裝套件，再重試。",
+  "authorization.not_admin.title": "需要管理員處理",
+  "authorization.not_admin.body": "請 DSM 管理員開啟此套件並完成授權。",
+  "authorization.session_expired.title": "登入已逾時",
+  "authorization.session_expired.body": "請重新登入 DSM，再開啟此套件。",
+  "authorization.ready": "已授權",
+  "authorization.revoke": "撤銷授權",
+  "authorization.revoke.title": "撤銷授權？",
+  "authorization.revoke.body": "新的 helper 存取將被停用。套件資料與過往結果會保留。",
+  "authorization.cancel": "取消",
+  "authorization.checking": "正在檢查授權…"
+}

package/templates/native-go/README.md

@@ -38,8 +38,9 @@ Declare `capabilities.files: session` for interactive File Station access,
 `capabilities.jobs: true` for persistent package-account jobs,
 `capabilities.identity: standalone` for independent DSM login, and
 `capabilities.rootOps: true` for administrator-approved fixed executor operations.
-`init --with files,jobs,login,root-ops` supports plain and Vue UI.
-Jobs and `daemon` are mutually exclusive; `delegate` is not implemented until P2.
+`init --with files,jobs,root-ops` supports plain and Vue UI; `login` and
+`delegate` need the Vue UI. `daemon` cannot be combined with `jobs`, but it can
+be combined with an until-revoked `delegate`.
 
 ```sh
 synopkgland add files jobs login
@@ -126,7 +127,7 @@ access. The template ships no exceptions and sets DSM `allUsers` to `false`.
 | absent or `administrators` | `session_required` | `admin_required` | runs |
 | explicit `authenticated` | `session_required` | runs | runs |
 | explicit `public` | runs | runs | runs |
-| unregistered method | `session_required` | `admin_required` | `unknown_method` |
+| unregistered method | `session_required` | `unknown_method` | `unknown_method` |
 
 Missing or invalid JSON, duplicate keys, unknown permissions and rules for
 unregistered methods fail closed. The CLI validates the file and binds its
@@ -193,13 +194,24 @@ Known limits:
 - Directory reachability and DSM name-service freshness affect native role
   checks. The bridge bypasses DSM's administrator-role cache but cannot force
   an upstream directory replica to be current. It refuses unknown results.
-- The static Go CGI embeds a minimal native bridge for Linux amd64/arm64,
+- The static Go CGI embeds a minimal native bridge for Linux amd64/arm64/armv7,
   reproduced with Zig 0.16.0 from `internal/dsm/native/admin_check.c`. The bridge
   runs from a sealed memory file with a clean environment, a 3-second deadline
   and bounded output; no runtime Zig, compiler, writable executable or root
   privilege is required. The ELF files and build/source hashes are recorded in
   `native/provenance.json`. DSM must expose the native SDK symbol; otherwise
   authentication refuses access.
+- Kernels without `memfd_create` (DSM 7 on Linux 3.10: armv7 and the x86_64
+  `avoton`, `braswell`, `bromolow`, `grantley` and `cedarview` platforms) cannot
+  seal the bridge. Only there, the CGI stages it in the package's own
+  `/var/packages/<package>/tmp` (DSM mounts `/tmp` noexec): a fresh 0700
+  directory, a 0500 file reopened read-only and unlinked before it runs. The
+  seal guarantee is lost: between the write and the unlink, a process running
+  as the same package account could replace the bridge. That account already
+  runs the CGI, so the bridge never trusts anything that account does not
+  already control; other accounts cannot write the directory, which must be
+  owned by the package account and not group- or world-writable. Any other
+  memfd failure still refuses.
 
 ## Customize the UI
 
@@ -323,6 +335,11 @@ use a DSM term, copy its `text` from the glossary and add your key to the
 term's `keys`. A Vue or React UI can keep its own i18n library; `ctx.t` and
 `ctx.locale` are there if you want them.
 
+The Vue shell (`--ui vue`) keeps its text in `frontend/src/**/i18n/<locale>.json`,
+one folder per area (status page, sign-in, files, background jobs), in the same
+nine languages. Add new text to all nine files rather than writing it into a
+`.vue` file.
+
 ## Package an existing binary
 
 Keep the Go backend and call your tool from a handler (recommended: auth
@@ -343,6 +360,22 @@ It then owns everything `backend/internal/api` does for you: bounded reads,
 POST-only JSON, same-origin checks, authentication before any work, and a
 refusal for unknown methods.
 
+## DSM Application Portal link
+
+`synopkgland add portal` adds `portal: {}` to dsm-package.yaml so
+`https://<nas>/<alias>/` opens this app right after DSM sign-in. The install
+wizard proposes the alias (the package name in lowercase by default); an
+administrator turns it on from the app's portal panel or Control Panel >
+Login Portal > Applications. Ordinary users then see the link; until then
+they see "ask an administrator". DSM owns the setting: the backend's
+`portal.status` only reads it, and nothing in the package may write it. See
+`synopkgland skill show portal`.
+
+A portal needs DSM 7.3.2-86009 or later, so `add portal` raises a lower
+`os_min_ver` and build refuses one below it. DSM 7.1.1 rejects an unsigned
+package that registers a portal (Package Center error 320); 7.3.2 and 7.4
+install it; 7.2 is untested. To keep supporting older DSM, remove `portal:`.
+
 ## Data, upgrades, uninstall
 
 The backend stores data in `/var/packages/__PACKAGE__/var` (the package's
@@ -384,9 +417,9 @@ install reuses the old data and how to start clean.
 The generated SPK ships
 an uninstall wizard (English, plus eight other languages) with one box, **Also
 delete the app data listed above** (`pkgwizard_remove_additional`), unchecked by
-default. Ticked, `postuninst` empties `@appdata/<package>` and `@apphome/<package>`
-and nothing else: not `@appconf`, Shared Folders, the package account or other
-packages. An upgrade never deletes anything. Do not write your own `postuninst`;
+default. Ticked, `postuninst` empties `@appdata/<package>`, `@apphome/<package>`
+and `@appconf/<package>` and nothing else: not Shared Folders, the package
+account or other packages. An upgrade never deletes anything. Do not write your own `postuninst`;
 `synopkgland inspect` flags a deleting script that lacks the upgrade guard
 or deletes outside the package's own folders.
 
@@ -421,6 +454,6 @@ DSM testing.
 | | Status |
 | --- | --- |
 | Build hosts | macOS, Linux (any OS with Go and Node) |
-| Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
-| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
-| Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |
+| Target CPUs | x86_64 and aarch64 DSM models (one SPK each). armv7 (DSM 7.2+ platforms `alpine`, `alpine4k`, `armada38x`, `monaco`) is opt-in: add it to `arches`; it covers the Go CGI (plain or Vue UI), jobs, daemon, root-ops and delegate. armv7 jobs, daemon and executor (root-ops, delegate) are built and checked locally but have not been verified on a NAS |
+| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
+| Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |