@synopackageland/cli 0.6.0 → 0.7.0

package/dist/standalone/background.js

@@ -35,12 +35,79 @@ TimeoutStopSec=10
 Restart=no
 `;
 }
+/** Shell function that stops the worker in lifecycle hooks; call it as `stop_background_worker`. */
+export function renderBackgroundWorkerStop(pkg) {
+    return `stop_background_worker() {
+  ${SYNOSYSTEMCTL} stop ${backgroundUnitName(pkg)} && return 0
+  # DSM's native uninstall stops the unit, then releases the package user's
+  # systemd manager before preuninst, so a repeated stop fails. That is only
+  # "already stopped" when no process runs the worker executable.
+  [ -d /proc/self ] || return 1
+  worker="$(readlink -f "\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}/${BACKGROUND_WORKER_PAYLOAD}")" || return 1
+  for exe in /proc/[0-9]*/exe; do
+    case "$(readlink "$exe" 2>/dev/null)" in
+      "$worker"|"$worker (deleted)") echo "background worker still running" >&2; return 1 ;;
+    esac
+  done
+  echo "background worker already stopped" >&2
+}
+`;
+}
+/**
+ * Shell function for `prestart`, which DSM runs before its systemd-user-unit
+ * acquire: call it as `recover_user_manager`.
+ *
+ * On a restart under load, pkgctl's `Requires=user@UID` can start the package
+ * user's new manager in the old runtime dir just before logind removes it.
+ * That manager stays active without its private socket, so every later
+ * synosystemctl call fails with "Failed to get D-Bus connection" until it
+ * exits. Stop only such a manager, as the package user; the acquire that
+ * follows then starts a fresh one.
+ */
+export function renderUserManagerRecovery() {
+    return `recover_user_manager() {
+  uid="$(id -u)" || return 1
+  [ "$uid" != 0 ] || return 0
+  i=0
+  while [ "$(/usr/bin/loginctl show-user "$uid" -p State 2>/dev/null)" = State=closing ] && [ "$i" -lt 100 ]; do
+    sleep 0.1; i=$((i + 1))
+  done
+  [ -S "/run/user/$uid/systemd/private" ] && return 0
+  for exe in /proc/[0-9]*/exe; do
+    pid="\${exe%/exe}"; pid="\${pid##*/}"
+    [ -O "/proc/$pid" ] && [ "$(readlink "$exe" 2>/dev/null)" = /usr/lib/systemd/systemd ] || continue
+    case " $(tr '\\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null)" in *" --user "*) ;; *) continue ;; esac
+    echo "package user manager $pid has no socket in /run/user/$uid; stopping it so DSM starts a fresh one" >&2
+    kill -TERM "$pid" || return 1
+    i=0
+    while kill -0 "$pid" 2>/dev/null; do
+      [ "$i" -lt 100 ] || { echo "package user manager $pid did not exit" >&2; return 1; }
+      sleep 0.1; i=$((i + 1))
+    done
+  done
+}
+`;
+}
+/** Shell function that starts the worker and names the failed step; call it as `start_background_worker`. */
+export function renderBackgroundWorkerStart(pkg) {
+    const unit = backgroundUnitName(pkg);
+    return `start_background_worker() {
+  ${SYNOSYSTEMCTL} start ${unit} && return 0
+  rc=$?; socket=missing
+  [ -S "/run/user/$(id -u)/systemd/private" ] && socket=present
+  echo "background worker ${unit} failed to start (exit $rc; package user manager socket $socket)" >&2
+  return "$rc"
+}
+`;
+}
 /** Package Center's start/stop/status map straight onto the user unit. */
 export function renderBackgroundControl(pkg) {
     const unit = backgroundUnitName(pkg);
     return `#!/bin/sh
-case "$1" in
-  start) exec ${SYNOSYSTEMCTL} start ${unit} ;;
+${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+  prestart) recover_user_manager ;;
+  prestop) exit 0 ;;
+  start) start_background_worker ;;
   stop) exec ${SYNOSYSTEMCTL} stop ${unit} ;;
   status)
     [ "$(${SYNOSYSTEMCTL} get-active-status ${unit})" = active ] && exit 0

package/dist/standalone/binary.d.ts

@@ -3,7 +3,7 @@ import type { StandaloneError } from "./manifest.js";
 export declare const ELF_MACHINE: Record<NativeArchFamily, number>;
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
- * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * project, a little-endian ELF of `arch`'s class and machine, and statically linked
  * (no PT_INTERP), because DSM models ship different libc versions.
  * Returns undefined when the file is acceptable.
  */

package/dist/standalone/binary.js

@@ -1,6 +1,7 @@
 import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
 import { relative } from "node:path";
-export const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+export const ELF_MACHINE = { x86_64: 62, aarch64: 183, armv7: 40 };
+const ELF_CLASS64 = { x86_64: true, aarch64: true, armv7: false };
 const PT_INTERP = 3;
 const MAX_BINARY_BYTES = 256 * 1024 * 1024;
 const HEADER_BYTES = 64 * 1024;
@@ -9,7 +10,7 @@ function fail(code, message) {
 }
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
- * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * project, a little-endian ELF of `arch`'s class and machine, and statically linked
  * (no PT_INTERP), because DSM models ship different libc versions.
  * Returns undefined when the file is acceptable.
  */
@@ -43,18 +44,31 @@ function readHeader(file) {
         closeSync(fd);
     }
 }
+/** The little-endian Linux ELF header fields the checks need, for either ELF class. */
+function readElfHeader(buf) {
+    if (buf.length < 52 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[5] !== 1) {
+        return undefined;
+    }
+    const machine = buf.readUInt16LE(18);
+    if (buf[4] === 2 && buf.length >= 64) {
+        return { class64: true, machine, phoff: Number(buf.readBigUInt64LE(32)), phentsize: buf.readUInt16LE(54), phnum: buf.readUInt16LE(56) };
+    }
+    if (buf[4] === 1) {
+        return { class64: false, machine, phoff: buf.readUInt32LE(28), phentsize: buf.readUInt16LE(42), phnum: buf.readUInt16LE(44) };
+    }
+    return undefined;
+}
 function checkElf(buf, file, arch) {
-    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 64-bit little-endian Linux ELF 執行檔。`);
-    if (buf.length < 64 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[4] !== 2 || buf[5] !== 1) {
+    const bits = ELF_CLASS64[arch] ? 64 : 32;
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 ${arch} 需要的 ${bits}-bit little-endian Linux ELF 執行檔。`);
+    const header = readElfHeader(buf);
+    if (!header || header.class64 !== ELF_CLASS64[arch]) {
         return notElf;
     }
-    const machine = buf.readUInt16LE(18);
+    const { machine, phoff, phentsize, phnum } = header;
     if (machine !== ELF_MACHINE[arch]) {
         return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
     }
-    const phoff = Number(buf.readBigUInt64LE(32));
-    const phentsize = buf.readUInt16LE(54);
-    const phnum = buf.readUInt16LE(56);
     if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
         return notElf;
     }

package/dist/standalone/build.d.ts

@@ -1,4 +1,4 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 export interface CommandResult {
     status: number | null;
     stderr: string;

package/dist/standalone/build.js

@@ -2,7 +2,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { goBuildEnv } from "../build-spk/dsm-arch.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
@@ -10,7 +11,6 @@ import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
-const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export const runCommand = (command, args, options) => {
     const result = spawnSync(command, args, {
@@ -38,11 +38,14 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+        throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
+    }
     const run = options.run ?? runCommand;
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
-            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
         }
     }
     buildUi(manifest, run);
@@ -60,7 +63,7 @@ export async function buildStandalone(options) {
             }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const backgroundWorker = buildBackgroundWorker(manifest, arch, work, run);
+            const backgroundWorker = buildBackgroundWorker(builtManifest, arch, work, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             outputs.push(outputPath);
         }
@@ -103,14 +106,16 @@ function backendFor(manifest, arch, work, run) {
         `-X main.version=${manifest.spkVersion}`,
         `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
-        ...(manifest.capabilities.delegate ? [`-X ${JSON.stringify(`main.delegateScope=${manifest.capabilities.delegate.scope}`)}`] : []),
+        ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
+        ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
+        ...(manifest.portal ? ["-X main.portal=on"] : []),
     ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
@@ -125,10 +130,12 @@ function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
-    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`].join(" ");
+    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`, ...delegateBuildFlags(manifest),
+        ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
+    ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker（${BACKGROUND_WORKER_MAIN}）build 失敗；這個專案的 backend 需要含該 package。\n${result.stderr}`);
@@ -138,3 +145,26 @@ function buildBackgroundWorker(manifest, arch, work, run) {
         throw new StandaloneBuildError(problem.code, problem.message);
     return out;
 }
+function delegateBuildFlags(manifest) {
+    const d = manifest.capabilities.delegate;
+    if (!d)
+        return [];
+    const values = {
+        delegateScope: d.scope,
+        delegateOperationsJSON: JSON.stringify([...d.operations].sort()),
+        delegateDestinationsJSON: JSON.stringify(d.destinations ? [...d.destinations].sort() : []),
+        delegateLifetime: d.lifetime ?? '',
+    };
+    // Go's quoted.Split does not process backslash escapes. Interior JSON quotes
+    // in a whitespace-free argument are literal; never shell-escape this string.
+    return Object.entries(values).map(([key, value]) => {
+        const arg = `main.${key}=${value}`;
+        if (!/\s/.test(arg))
+            return `-X ${arg}`;
+        if (!arg.includes("'"))
+            return `-X '${arg}'`;
+        if (!arg.includes('"'))
+            return `-X "${arg}"`;
+        throw new StandaloneBuildError('STANDALONE_GO_BUILD_FAILED', 'Delegate scope with whitespace and both quote types cannot be represented in Go linker flags.');
+    });
+}

package/dist/standalone/daemon.d.ts

@@ -1,4 +1,4 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {

package/dist/standalone/daemon.js

@@ -1,5 +1,6 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { goBuildEnv } from "../build-spk/dsm-arch.js";
 import { templatesRoot } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
@@ -58,7 +59,7 @@ export function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build 需要 Go 1.24 以上。\n${result.stderr}`);

package/dist/standalone/dsm-window.d.ts

@@ -1,4 +1,4 @@
-import type { StandaloneManifest } from "./manifest.js";
+import type { EntryMode, StandaloneManifest } from "./manifest.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export declare function cgiUrl(packageId: string): string;
@@ -14,6 +14,8 @@ export declare const I18N_RUNTIME: string;
  * cached from the previous version after an upgrade.
  */
 export declare function windowScriptName(manifest: Pick<StandaloneManifest, "build">): string;
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export declare function renderUiConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/dsm-window.js

@@ -3,6 +3,7 @@ import { DSM_LANGS } from "./i18n.js";
 import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
+import { PORTAL_RUNTIME } from "./portal-window.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export function cgiUrl(packageId) {
@@ -47,6 +48,20 @@ export const I18N_RUNTIME = `function createI18n(dsmLang, catalogs) {
 export function windowScriptName(manifest) {
     return `window-${String(manifest.build).padStart(4, "0")}.js`;
 }
+/**
+ * Who sees the main-menu entry. app-privilege also registers the app in
+ * Control Panel > Application Privileges (local and directory accounts, with
+ * IP rules); DSM then filters the launcher and the CGI checks the same rule.
+ */
+function launcherAccess(manifest) {
+    return manifest.entry ? entryLauncherAccess(manifest.entry) : { allUsers: permitsOrdinaryUsers(manifest.apiPermissions) };
+}
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export function entryLauncherAccess(entry) {
+    return entry === "admin-only"
+        ? { allUsers: false }
+        : { allUsers: true, grantPrivilege: "all", advanceGrantPrivilege: true };
+}
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export function renderUiConfig(manifest) {
     const ns = `SYNO.SDS.${manifest.package}`;
@@ -59,7 +74,7 @@ export function renderUiConfig(manifest) {
                 icon: "images/app_{0}.png",
                 appWindow: `${ns}.MainWindow`,
                 allowMultiInstance: false,
-                allUsers: permitsOrdinaryUsers(manifest.apiPermissions),
+                ...launcherAccess(manifest),
                 depend: [`${ns}.MainWindow`],
             },
             [`${ns}.MainWindow`]: {
@@ -127,7 +142,14 @@ ${HOST_ADAPTER_RUNTIME}
   return createHostAdapter;
 })();
 
-${root ? root.definitions : ""}${ns}.loadApp = function (done) {
+${root || manifest.portal ? renderWebApi(ns) : ""}// A display hint for hiding or disabling administrator settings; the CGI
+// decides access on its own and never trusts this value.
+${ns}.sessionUser = function () {
+  var session = (SYNO.SDS && SYNO.SDS.Session) || {};
+  return { name: typeof session.user === "string" ? session.user : "", isAdmin: session.is_admin === true };
+};
+
+${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) : ""}${ns}.loadApp = function (done) {
   var apps = window.DsmPackageApps || {};
   if (apps[${p}]) {
     done(apps[${p}]);
@@ -186,6 +208,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
           call: ${ns}.call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
+          user: ${ns}.sessionUser(),${manifest.portal ? `\n          portal: ${renderPortalAccess(ns, manifest)},` : ""}
           host: me.hostAccess,
           appWindow: me,
           lang: lang,
@@ -221,6 +244,50 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
     }
   }
 });
+`;
+}
+function renderPortalDefinition(ns) {
+    return `${ns}.createPortalAccess = (function () {
+${PORTAL_RUNTIME}
+  return createPortalAccess;
+})();
+
+`;
+}
+/**
+ * `ctx.portal`: administrators use their own DSM session; isAdmin only picks
+ * the path. The SDK ships the panel text in every DSM language, so it follows
+ * DSM even where the app has no catalog.
+ */
+function renderPortalAccess(ns, manifest) {
+    return `${ns}.createPortalAccess({
+            appId: ${JSON.stringify(`${ns}.Instance`)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
+            send: ${ns}.webApi(me),
+            call: ${ns}.call,
+            launch: function (app, params) { SYNO.SDS.AppLaunch(app, params); },
+            location: window.location,
+            locale: ${ns}.createI18n(lang, ${JSON.stringify(Object.fromEntries(Object.keys(DSM_LANGS).map((locale) => [locale, {}])))}).locale
+          })`;
+}
+/** DSM WebAPI in the window's own session: resolves data, rejects `{code: "dsm_<n>"}`. */
+function renderWebApi(ns) {
+    return `// DSM WebAPI in the window's own session: resolves data, rejects {code: "dsm_<n>"}.
+${ns}.webApi = function (win) {
+  return function (api, method, version, params) {
+    return new Promise(function (resolve, reject) {
+      win.sendWebAPI({
+        api: api, method: method, version: version, params: params, scope: win,
+        callback: function (success, response) {
+          if (success) resolve(response);
+          else reject({ code: "dsm_" + ((response && response.code) || "error") });
+        }
+      });
+    });
+  };
+};
+
 `;
 }
 const ROOT_PANEL_CSS = [
@@ -259,19 +326,9 @@ ${ROOT_PANEL}
     };
     var access = ${ns}.createRootAccess({
       tasks: ${ns}.rootTasks,
-      pins: ${JSON.stringify({ executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
+      pins: ${JSON.stringify({ package: manifest.package, executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
       user: session,
-      send: function (api, method, version, params) {
-        return new Promise(function (resolve, reject) {
-          me.sendWebAPI({
-            api: api, method: method, version: version, params: params, scope: me,
-            callback: function (success, response) {
-              if (success) resolve(response);
-              else reject({ code: "dsm_" + ((response && response.code) || "error") });
-            }
-          });
-        });
-      },
+      send: ${ns}.webApi(me),
       confirmPassword: function (suppliedPassword) {
         // Send exactly one PasswordConfirm v2 auth with a masked password field.
         return new Promise(function (resolve, reject) {
@@ -309,7 +366,7 @@ ${ROOT_PANEL}
       wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
     });
     var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
-    if (panels) {
+    if (panels && ${manifest.ui.build !== undefined && manifest.capabilities.delegate?.scope === "install-selected" ? "false" : "true"}) {
       ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
     }
 `,

package/dist/standalone/inspect-spk.d.ts

@@ -1,6 +1,7 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
+import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
-export type SpkKind = "native-go" | "binary" | "container";
+export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
     package?: string;
@@ -22,6 +23,13 @@ export interface SpkInspection {
     }>;
     executor?: ExecutorInspection;
     uninstallCleanup?: UninstallCleanupItem[];
+    /** Application Portal entry; inactive until an administrator applies the alias. */
+    portal?: {
+        appId: string;
+        alias: string;
+    };
+    /** Declared `entry` mode; `admin-only` is the administrator floor of every route. */
+    entry?: EntryMode;
 }
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;