@synopackageland/cli 0.6.1 → 0.7.0

package/dist/templates/native-go-delegate/backend/internal/delegate/staging.go

@@ -0,0 +1,121 @@
+package delegate
+
+import (
+	"dsmapp/internal/background"
+	"os"
+	"path"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+func validStaging(p string) bool {
+	if p == "" || len(p) > 4096 || path.IsAbs(p) || path.Clean(p) != p {
+		return false
+	}
+	for _, part := range strings.Split(p, "/") {
+		if !validName(part) {
+			return false
+		}
+	}
+	return true
+}
+
+// stagingParent opens each relative directory without following symlinks.
+// The startup-owned staging root itself must be private and package-owned.
+func stagingParent(stagingDir, relative string) (int, background.StagingIdentity, error) {
+	var identity background.StagingIdentity
+	if !validStaging(relative) || background.RefuseRoot(os.Geteuid()) != nil {
+		return -1, identity, fail("STAGING_UNAVAILABLE")
+	}
+	fd, err := unix.Open(stagingDir, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return -1, identity, fail("STAGING_UNAVAILABLE")
+	}
+	var st unix.Stat_t
+	if unix.Fstat(fd, &st) != nil || st.Uid != uint32(os.Geteuid()) || st.Mode&0077 != 0 {
+		unix.Close(fd)
+		return -1, identity, fail("STAGING_UNAVAILABLE")
+	}
+	identity.RootDevice, identity.RootInode = uint64(st.Dev), uint64(st.Ino)
+	parts := strings.Split(relative, "/")
+	for _, part := range parts[:len(parts)-1] {
+		next, err := unix.Openat(fd, part, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		unix.Close(fd)
+		if err != nil {
+			return -1, identity, fail("STAGING_UNAVAILABLE")
+		}
+		fd = next
+		if unix.Fstat(fd, &st) != nil || st.Uid != uint32(os.Geteuid()) || st.Mode&0022 != 0 {
+			unix.Close(fd)
+			return -1, identity, fail("STAGING_UNAVAILABLE")
+		}
+	}
+	if unix.Fstat(fd, &st) != nil {
+		unix.Close(fd)
+		return -1, identity, fail("STAGING_UNAVAILABLE")
+	}
+	identity.ParentDevice, identity.ParentInode = uint64(st.Dev), uint64(st.Ino)
+	return fd, identity, nil
+}
+
+func sourceIdentity(parent int, relative string, identity background.StagingIdentity) (background.StagingIdentity, error) {
+	fd, err := unix.Openat(parent, path.Base(relative), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return identity, err
+	}
+	file := os.NewFile(uintptr(fd), "staging")
+	defer file.Close()
+	var st unix.Stat_t
+	if unix.Fstat(fd, &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Uid != uint32(os.Geteuid()) || st.Nlink != 1 {
+		return identity, fail("STAGING_UNAVAILABLE")
+	}
+	info, err := file.Stat()
+	if err != nil {
+		return identity, err
+	}
+	identity.Device, identity.Inode, identity.UID, identity.Size, identity.ModifiedNS = uint64(st.Dev), uint64(st.Ino), st.Uid, st.Size, info.ModTime().UnixNano()
+	return identity, nil
+}
+
+func pinSource(stagingDir, relative string, size int64) (background.StagingIdentity, error) {
+	parent, identity, err := stagingParent(stagingDir, relative)
+	if err != nil {
+		return identity, err
+	}
+	defer unix.Close(parent)
+	identity, err = sourceIdentity(parent, relative, identity)
+	if err != nil || identity.Size != size {
+		return identity, fail("STAGING_UNAVAILABLE")
+	}
+	return identity, nil
+}
+
+// cleanupSource runs under the package UID, never the destination subject or
+// root. A replaced source/parent is retained; only the pinned name is removed.
+// As with the executor's FD design, a concurrent rename after the last check
+// is not an ancestry sandbox or an atomic compare-and-unlink primitive.
+func cleanupSource(stagingDir, relative string, pinned background.StagingIdentity) error {
+	parent, identity, err := stagingParent(stagingDir, relative)
+	if err != nil {
+		return err
+	}
+	defer unix.Close(parent)
+	if identity.RootDevice != pinned.RootDevice || identity.RootInode != pinned.RootInode || identity.ParentDevice != pinned.ParentDevice || identity.ParentInode != pinned.ParentInode {
+		return fail("STAGING_CHANGED")
+	}
+	identity, err = sourceIdentity(parent, relative, identity)
+	if err == unix.ENOENT {
+		return nil
+	}
+	if err != nil || identity != pinned {
+		return fail("STAGING_CHANGED")
+	}
+	if err = unix.Unlinkat(parent, path.Base(relative), 0); err != nil {
+		return fail("STAGING_UNAVAILABLE")
+	}
+	if err = unix.Fsync(parent); err != nil {
+		return fail("STAGING_UNAVAILABLE")
+	}
+	return nil
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/status_disabled_test.go

@@ -0,0 +1,51 @@
+package delegate
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+func TestStatusExposesOnlyVerifiedDisabledState(t *testing.T) {
+	for _, tc := range []struct {
+		wire, state string
+		disabled    *bool
+	}{
+		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`, "ready", boolRef(false)},
+		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":true}`, "disabled", boolRef(true)},
+		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":false,"disabled":false}`, "blocked", nil},
+		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true}`, "blocked", nil},
+	} {
+		s := service(t, nil)
+		s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
+			if op != "status" || auth != nil {
+				t.Fatal(op, auth)
+			}
+			return json.Unmarshal([]byte(tc.wire), out)
+		})
+		got := s.Status(context.Background())
+		wire, _ := json.Marshal(got)
+		var out struct {
+			Disabled *bool `json:"disabled"`
+		}
+		json.Unmarshal(wire, &out)
+		if got.State != tc.state || (out.Disabled == nil) != (tc.disabled == nil) || (out.Disabled != nil && *out.Disabled != *tc.disabled) {
+			t.Fatal(string(wire), tc.state)
+		}
+	}
+}
+func boolRef(value bool) *bool { return &value }
+
+func TestStatusDeclaresTrustedLongRunningPickerConfiguration(t *testing.T) {
+	s := service(t, nil)
+	s.Lifetime = "until-revoked"
+	s.Destinations = []string{"save", "reports"}
+	s.Client = fakeExecutor(func(_ context.Context, _ string, _ map[string]string, _ any, out any) error {
+		return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`), out)
+	})
+	out := rpc(t, s, "alice", "delegate.status", "{}")
+	data := out["data"].(map[string]any)
+	if data["lifetime"] != "until-revoked" || len(data["destinations"].([]any)) != 2 {
+		t.Fatal(out)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/testdata/executor_contract.txt

@@ -0,0 +1,112 @@
+package main
+
+// Compiled beside the unmodified executor sources by W2's adapter tests.
+// Only DSM, peer credentials, and the bulk writer are substituted. The v1
+// decoder, grant/store, async journal, and publication fence are production.
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+type w2DSM struct{ root string }
+
+func (d w2DSM) Verify(_ context.Context, cookie, token string) (string, error) {
+	if token != "contract-token" || (cookie != "alice" && cookie != "bob" && cookie != "admin") {
+		return "", errors.New("invalid session")
+	}
+	return cookie, nil
+}
+func (d w2DSM) Account(_ context.Context, name string) (Subject, error) {
+	uid := 1205
+	if name == "bob" {
+		uid = 1206
+	}
+	if name == "admin" {
+		uid = 1207
+	}
+	return Subject{Username: name, UID: uid, GID: 100, Groups: []int{100}, Home: d.root, Expired: "normal", Admin: name == "admin"}, nil
+}
+func (d w2DSM) Allow(context.Context, Subject, string, string) error       { return nil }
+func (d w2DSM) ScopeRoot(context.Context, Subject, string) (string, error) { return d.root, nil }
+func (d w2DSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
+	return json.RawMessage(`{"allowed":true}`), nil
+}
+
+type w2Writer struct{ control string }
+
+func (w w2Writer) Write(context.Context, Subject, string, string, string, string) error {
+	return errors.New("not a legacy writer test")
+}
+func (w w2Writer) Move(ctx context.Context, _ Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	f, err := os.OpenFile(filepath.Join(w.control, "attempt-"+op.Job), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	_, err = f.WriteString("attempt\n")
+	f.Close()
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	if strings.HasPrefix(op.Job, "stuck-") {
+		// Models a write that does not observe cancellation until released.
+		for {
+			if _, err = os.Stat(filepath.Join(w.control, "release-"+op.Job)); err == nil {
+				break
+			}
+			time.Sleep(5 * time.Millisecond)
+		}
+	}
+	if strings.HasPrefix(op.Job, "hold-") {
+		ticker := time.NewTicker(5 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			if _, err = os.Stat(filepath.Join(w.control, "release-"+op.Job)); err == nil {
+				break
+			}
+			select {
+			case <-ctx.Done():
+				return MoveReceipt{}, ctx.Err()
+			case <-ticker.C:
+			}
+		}
+	}
+	return guard(func() (MoveReceipt, error) {
+		if strings.HasPrefix(op.Job, "uncertain-") {
+			return MoveReceipt{}, errors.New("publication reply lost")
+		}
+		return MoveReceipt{Path: d.Path + "/" + op.Name}, nil
+	})
+}
+
+func TestW2ContractServer(t *testing.T) {
+	dir := os.Getenv("W2_CONTRACT_DIR")
+	if dir == "" {
+		t.Skip("adapter subprocess only")
+	}
+	e := &Executor{Policy: Policy{Version: 1, Package: "contract", App: "app", Scope: "home", Operations: []string{"delegate.create", "delegate.list", "delegate.revoke", "files.write", "files.moveFromStaging", "files.operationStatus", "files.cancelOperation", "delegate.disable", "delegate.enable", "delegate.audit"}, Destinations: []string{"save"}, Lifetime: "until-revoked"}, DSM: w2DSM{filepath.Join(dir, "home")}, Writer: w2Writer{dir}, Store: &Store{Dir: filepath.Join(dir, "protected")}, Now: time.Now}
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	socket := filepath.Join(dir, "executor.sock")
+	os.Remove(socket)
+	listener, err := net.Listen("unix", socket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	for {
+		c, err := listener.Accept()
+		if err != nil {
+			t.Fatal(err)
+		}
+		go e.Connection(context.Background(), c, os.Getuid(), func(net.Conn) (int, error) { return os.Getuid(), nil })
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/transient_contract_test.go

@@ -0,0 +1,137 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/background"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// A producer must know from the code alone whether repeating the same params
+// is safe: retryable codes never wrote anything a retry could duplicate, and
+// terminal codes need the package or administrator to repair the spool first.
+func TestJobErrorSeparatesRetryableFromTerminalSpoolFailures(t *testing.T) {
+	for _, tc := range []struct {
+		err  error
+		want string
+	}{
+		{background.ErrBusy, "jobs_busy"},
+		{context.DeadlineExceeded, "canceled"},
+		{context.Canceled, "canceled"},
+		{fmt.Errorf("journal: %w", context.DeadlineExceeded), "canceled"},
+		{&fs.PathError{Op: "write", Path: "journal.json", Err: syscall.EIO}, "jobs_unavailable"},
+		{background.ErrUnsafeSpool, "spool_unsafe"},
+		{background.ErrJournalUnreadable, "journal_corrupt"},
+		{background.ErrJournalSchema, "journal_corrupt"},
+	} {
+		code(t, jobError(tc.err), tc.want)
+	}
+}
+
+// holdJournal keeps the spool lock as another process would, until release.
+func holdJournal(t *testing.T, s *Service) (release func()) {
+	t.Helper()
+	lock, err := os.OpenFile(filepath.Join(filepath.Dir(s.StagingDir), "background", "lock"), os.O_RDWR, 0o600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		t.Fatal(err)
+	}
+	return func() { unix.Flock(int(lock.Fd()), unix.LOCK_UN); lock.Close() }
+}
+
+func commit(e *dedupExecutor, in MoveParams) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.ops[in.JobID] = OperationResult{JobID: in.JobID, State: "committed", Receipt: &Receipt{Path: "/home/" + in.Name, Size: in.Size}}
+}
+
+// t-0183 C3: a caller deadline spent waiting for the journal is retryable, and
+// the same params later converge on the original committed operation.
+func TestJournalDeadlineIsRetryableAndConvergesOnTheOriginalOperation(t *testing.T) {
+	s, in, e, _ := recoveringService(t)
+	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "queued" {
+		t.Fatal(out, err)
+	}
+	release := holdJournal(t, s)
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	_, err := s.MoveFromStaging(ctx, in)
+	cancel()
+	release()
+	code(t, err, "canceled")
+	commit(e, in)
+	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "committed" {
+		t.Fatal(out, err)
+	}
+	if moves, created := e.counts(); moves != 1 || created != 1 {
+		t.Fatal("same tuple admitted again", moves, created)
+	}
+}
+
+func TestFirstAdmissionUnderJournalDeadlineSendsNothingUntilRetried(t *testing.T) {
+	s, in, e, _ := recoveringService(t)
+	if _, err := s.Store.PendingMoves(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	release := holdJournal(t, s)
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	_, err := s.MoveFromStaging(ctx, in)
+	cancel()
+	release()
+	code(t, err, "canceled")
+	if moves, _ := e.counts(); moves != 0 {
+		t.Fatal("admitted without a durable reservation", moves)
+	}
+	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "queued" {
+		t.Fatal(out, err)
+	}
+	if moves, created := e.counts(); moves != 1 || created != 1 {
+		t.Fatal(moves, created)
+	}
+}
+
+// A busy journal must not hide a committed receipt: the same ref answers from
+// the executor's original operation, read-only, without a new admission.
+func TestCommittedRefAnswersItsReceiptWhileTheJournalIsBusy(t *testing.T) {
+	s, in, e, _ := recoveringService(t)
+	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+		t.Fatal(err)
+	}
+	commit(e, in)
+	s.Store = background.NewRequestStore(filepath.Join(filepath.Dir(s.StagingDir), "background"))
+	release := holdJournal(t, s)
+	defer release()
+	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "committed" {
+		t.Fatal(out, err)
+	}
+	ref := OperationRef{in.DelegationID, in.JobID}
+	if out, err := s.OperationStatus(context.Background(), nil, ref); err != nil || out.State != "committed" || out.Receipt == nil || out.Receipt.Size != in.Size {
+		t.Fatal(out, err)
+	}
+	if moves, created := e.counts(); moves != 1 || created != 1 {
+		t.Fatal(moves, created)
+	}
+}
+
+func TestUnknownRefStaysRetryableWhileTheJournalIsBusy(t *testing.T) {
+	s, in, e, _ := recoveringService(t)
+	if _, err := s.Store.PendingMoves(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	s.Store = background.NewRequestStore(filepath.Join(filepath.Dir(s.StagingDir), "background"))
+	release := holdJournal(t, s)
+	defer release()
+	_, err := s.MoveFromStaging(context.Background(), in)
+	code(t, err, "jobs_busy")
+	if moves, _ := e.counts(); moves != 0 {
+		t.Fatal(moves)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/filestation/files.go

@@ -39,35 +39,5 @@ func (s sessionFiles) Write(ctx context.Context, p, n string, r io.Reader, size
 	return s.Service.Upload(ctx, s.Caller, s.Request, p, n, r, size)
 }
 func (s sessionFiles) CheckPermission(ctx context.Context, p string) error {
-	if e := s.Service.verify(ctx, s.Caller, s.Request); e != nil {
-		return e
-	}
-	// Kept outside DSMClient so existing session providers need no new methods.
-	checker, ok := s.Service.client.(interface {
-		CheckPermission(context.Context, *http.Request, string) error
-	})
-	if !ok {
-		return fail("unsupported")
-	}
-	return checker.CheckPermission(ctx, s.Request, p)
-}
-func (c *Client) CheckPermission(ctx context.Context, r *http.Request, p string) error {
-	if !validPath(p) {
-		return fail("invalid-request")
-	}
-	v := fields("SYNO.FileStation.CheckPermission", "write", "3")
-	v.Set("path", p)
-	v.Set("filename", ".synopkgland-permission-probe")
-	v.Set("overwrite", "false")
-	v.Set("size", "0")
-	var out struct {
-		Skip *bool `json:"blSkip"`
-	}
-	if e := c.call(ctx, r, v, &out); e != nil {
-		return e
-	}
-	if out.Skip == nil || *out.Skip {
-		return fail("denied")
-	}
-	return nil
+	return s.Service.CheckPermission(ctx, s.Caller, s.Request, p)
 }

package/dist/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -1,10 +1,37 @@
 <script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,ref} from 'vue'
+import {Button,Callout} from '@synopackageland/ui'
 import type {Context} from './context'
 import ExecutorSettings from './delegate/ExecutorSettings.vue'
 import DelegatePanel from './delegate/DelegatePanel.vue'
-defineProps<{ctx:Context;admin:boolean}>()
+import BackgroundSavePanel from './delegate/BackgroundSavePanel.vue'
+import {createBackgroundSaveFacade} from './delegate/facade'
+import {createBackgroundPickerProvider} from './background/picker-provider'
+import {saveCopy} from './delegate/save-copy'
+const props=defineProps<{ctx:Context;admin:boolean}>()
+const mode=ref<'loading'|'long'|'legacy'|'unavailable'>(props.ctx.delegate?'long':'loading')
+const keys=ref<string[]>([]),copy=computed(()=>saveCopy(props.ctx.locale))
+const revision=ref(0)
+const sdk=props.ctx.delegate??createBackgroundSaveFacade(props.ctx),provider=createBackgroundPickerProvider(props.ctx)
+let disposed=false
+async function detect(){
+ mode.value='loading'
+ try{
+  const out=await props.ctx.call<{lifetime?:string;destinations?:string[]}>('delegate.status')
+  if(disposed)return
+  if(out.lifetime==='until-revoked'){
+   if(!Array.isArray(out.destinations)||!out.destinations.length||out.destinations.some(key=>typeof key!=='string'||!key))throw {code:'EXECUTOR_PROTOCOL'}
+   keys.value=out.destinations;mode.value='long'
+  }else mode.value='legacy'
+ }catch{if(!disposed)mode.value='unavailable'}
+}
+onMounted(()=>{if(!props.ctx.delegate)void detect()})
+onBeforeUnmount(()=>{disposed=true;provider.dispose()})
 </script>
 <template>
- <ExecutorSettings :admin="admin" :locale="ctx.locale" />
- <DelegatePanel :ctx="ctx" />
+ <ExecutorSettings :admin="admin" :locale="ctx.locale" :ctx="ctx" @confirmed="revision++;detect()" />
+ <BackgroundSavePanel v-if="mode==='long'" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" />
+ <DelegatePanel v-else-if="mode==='legacy'" :ctx="ctx" />
+ <p v-else-if="mode==='loading'" role="status">{{ copy.loading }}</p>
+ <Callout v-else tone="danger" role="alert">{{ copy.error }} <Button variant="secondary" @click="detect">{{ copy.refresh }}</Button></Callout>
 </template>

package/dist/templates/native-go-delegate/frontend/src/delegate/BackgroundSavePanel.vue

@@ -0,0 +1,113 @@
+<script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,ref} from 'vue'
+import {Button,Callout,SettingsSection} from '@synopackageland/ui'
+import type {BackgroundSaveFacade,BackgroundSaveStatus,DestinationGrant,DestinationState,SaveOperation} from './long-running'
+import {scopedPicker} from './scoped-picker'
+import {saveCopy,saveError} from './save-copy'
+import NasPicker from '../nas/NasPicker.vue'
+import type {NasProvider} from '../nas/contract'
+const props=defineProps<{sdk:BackgroundSaveFacade;admin:boolean;locale:string;picker?:{provider:NasProvider;keys:string[]}}>()
+const emit=defineEmits<{authorized:[grant:DestinationGrant]}>()
+const picking=ref(false),destinationKey=ref('')
+const copy=computed(()=>saveCopy(props.locale)),status=ref<BackgroundSaveStatus>(),grants=ref<DestinationGrant[]>([]),operations=ref<SaveOperation[]>([])
+const busy=ref(false),error=ref<unknown>(),notice=ref('')
+const destinations=ref<DestinationState[]>([])
+const pickerProvider=computed(()=>props.picker&&(status.value?.selection?scopedPicker(props.picker.provider,status.value.selection.root):status.value?.scopeMode==='install-selected'?undefined:props.picker.provider))
+let disposed=false,timer:ReturnType<typeof setInterval>|undefined
+// An acknowledged cancel keeps copying until the writer stops; poll, never resend.
+const canceling=(job:SaveOperation)=>job.state==='copying'&&job.code==='CANCEL_REQUESTED'
+const state=(job:SaveOperation)=>canceling(job)?'canceling':job.state==='committed'&&!job.receipt?.path?'uncertain':job.state
+const pending=(job:SaveOperation)=>['queued','copying'].includes(job.state)&&!canceling(job)
+function clear(){status.value=undefined;grants.value=[];operations.value=[];destinations.value=[];picking.value=false}
+async function refresh(){
+ const [current,listed,jobs,choices]=await Promise.all([props.sdk.status(),props.sdk.list(),props.sdk.operations(),Promise.all((props.picker?.keys??[]).map(key=>props.sdk.destination(key)))])
+ if(disposed)return
+ // Display only an acknowledged snapshot; never infer authority from cached paths.
+ if(!current||typeof current.disabled!=='boolean'||!Array.isArray(listed)||!Array.isArray(jobs))throw {code:'unavailable'}
+ if(status.value?.selection?.generation!==current.selection?.generation||status.value?.selection?.scope!==current.selection?.scope)picking.value=false
+ status.value=current;grants.value=choices.length?listed.filter(g=>choices.some(d=>d.status==='active'&&d.destination?.id===g.id)):listed;operations.value=jobs;destinations.value=choices
+}
+async function action(work:()=>Promise<void>){
+ if(disposed||busy.value)return
+ busy.value=true;error.value=undefined;notice.value=''
+ try{await work()}
+ catch(e){if(!disposed){clear();error.value=e}}
+ finally{if(!disposed)busy.value=false}
+}
+const reload=()=>action(refresh)
+function authorized(grant:DestinationGrant){emit('authorized',grant);void reload()}
+const revoke=(id:string)=>action(async()=>{
+ const result=await props.sdk.revoke({delegation_id:id})
+ if(result?.revoked!==true)throw {code:'commit-uncertain'}
+ await refresh();if(!disposed)notice.value=copy.value.revoked
+})
+const cancel=(job:SaveOperation)=>action(async()=>{await props.sdk.cancel({delegation_id:job.delegation_id,job_id:job.job_id});await refresh()})
+const toggle=()=>action(async()=>{
+ if(!props.admin||!status.value)return
+ const wasDisabled=status.value.disabled
+ const result=wasDisabled?await props.sdk.enable():await props.sdk.disable()
+ if(result?.disabled!==!wasDisabled)throw {code:'commit-uncertain'}
+ await refresh()
+})
+const example=(key:string)=>action(async()=>{
+ const job_id='example-'+Array.from(crypto.getRandomValues(new Uint8Array(16)),b=>b.toString(16).padStart(2,'0')).join('')
+ await props.sdk.exportExample({key,job_id})
+ await refresh()
+})
+onMounted(()=>{void reload();timer=setInterval(()=>{if(operations.value.some(pending))void reload()},3000)})
+onBeforeUnmount(()=>{disposed=true;if(timer)clearInterval(timer)})
+</script>
+<template>
+ <SettingsSection :title="copy.title" :collapsible="false" :aria-busy="busy" class="background-save-panel">
+  <p>{{ copy.help }}</p>
+  <Callout v-if="error" tone="danger" role="alert" class="save-message">{{ saveError(error,copy) }}</Callout>
+  <p v-if="busy&&!status" role="status">{{ copy.loading }}</p>
+  <p v-if="notice" role="status">{{ notice }}</p>
+  <p v-if="status?.selection"><strong>{{ copy.scope }}</strong>: {{ status.selection.root }}</p>
+  <Callout v-if="status?.mismatch" tone="warning">{{ copy.scopeMismatch }} {{ status.preselection }} → {{ status.selection?.root }}</Callout>
+  <Callout v-if="status?.scopeMode==='install-selected'&&!status.selection" tone="warning">{{ copy.scopeNeeds }}</Callout>
+  <Callout v-if="status?.disabled" tone="warning" role="status" class="save-message">{{ copy.disabled }}</Callout>
+  <p v-else-if="status" role="status">{{ copy.enabled }}</p>
+  <div class="save-actions">
+   <Button variant="secondary" :disabled="busy" @click="reload">{{ copy.refresh }}</Button>
+   <Button v-if="admin&&status" :variant="status.disabled?'secondary':'danger'" :disabled="busy" @click="toggle">{{ status.disabled?copy.enable:copy.disable }}</Button>
+  </div>
+  <p v-if="admin&&status">{{ copy.disableHelp }}</p>
+  <h3>{{ copy.delegations }}</h3>
+  <Callout v-if="destinations.some(d=>d.status==='reselection-required')" tone="warning">{{ copy.reselect }}</Callout>
+  <div v-if="picker" class="save-actions"><Button v-for="key in picker.keys" :key="key" variant="secondary" :disabled="busy||!status||status.disabled||!pickerProvider" @click="destinationKey=key;picking=true">{{ copy.choose }} ({{ key }})</Button></div>
+  <NasPicker v-if="pickerProvider" :key="status?.selection?.scope" v-model:open="picking" :provider="pickerProvider" :locale="locale" mode="folder" :destination="{key:destinationKey,selectDestination:sdk.selectDestination}" @authorized="authorized" />
+  <p v-if="status&&!grants.length">{{ copy.empty }}</p>
+  <ul class="save-records"><li v-for="grant in grants" :key="grant.id">
+   <div><strong>{{ grant.path }}</strong><p>{{ copy.untilRevoked }}</p></div>
+   <Button variant="secondary" :disabled="busy" @click="revoke(grant.id)">{{ copy.revoke }}</Button>
+  </li></ul>
+  <template v-if="destinations.some(d=>d.status==='active')">
+   <p>{{ copy.exampleHelp }}</p>
+   <div class="save-actions"><Button v-for="d in destinations.filter(d=>d.status==='active')" :key="d.key" variant="secondary" :disabled="busy||status?.disabled" @click="example(d.key)">{{ copy.example }} ({{ d.key }})</Button></div>
+  </template>
+  <h3>{{ copy.operations }}</h3>
+  <p v-if="status&&!operations.length">{{ copy.noOperations }}</p>
+  <ul class="save-records"><li v-for="job in operations" :key="job.job_id" :data-job-id="job.job_id" :data-save-state="state(job)">
+   <div>
+    <strong>{{ job.name }}</strong><p>{{ copy[state(job)] }} · {{ job.job_id }}</p>
+    <p v-if="state(job)==='committed'">{{ job.receipt?.path }}</p>
+    <Callout v-if="state(job)==='uncertain'" tone="warning" class="save-message">{{ copy.uncertainHelp }}</Callout>
+    <Callout v-else-if="state(job)==='interrupted'" tone="warning" class="save-message">{{ copy.interruptedHelp }}</Callout>
+    <p v-if="job.code&&!canceling(job)">{{ saveError({code:job.code},copy) }}</p>
+   </div>
+   <Button v-if="pending(job)" variant="secondary" :disabled="busy" @click="cancel(job)">{{ copy.cancel }}</Button>
+  </li></ul>
+ </SettingsSection>
+</template>
+<style scoped>
+.background-save-panel {min-width:0;overflow-wrap:anywhere;}
+.save-message {--ui-text-secondary:var(--ui-text);}
+h3 {font-size:var(--ui-font-size-base,14px);font-weight:600;margin:var(--ui-space-6,24px) 0 var(--ui-space-3,12px);}
+.save-actions,.save-records li {display:flex;align-items:flex-start;justify-content:space-between;flex-wrap:wrap;gap:var(--ui-space-3,12px);}
+.save-actions {justify-content:flex-start;}
+.save-records {list-style:none;margin:0;padding:0;}
+.save-records li {padding-block:var(--ui-space-4,16px);border-bottom:1px solid var(--ui-border);}
+.save-records li>div {min-width:0;max-width:100%;}
+.save-records p {margin:var(--ui-space-2,8px) 0;}
+</style>

package/dist/templates/native-go-delegate/frontend/src/delegate/copy.ts

@@ -1,9 +1,8 @@
-import en from './i18n/en.json'
-import zh from './i18n/zh-TW.json'
+import {uiLocale} from '../nas/locale'
+import {delegateCatalogs,type DelegateCopy} from './catalogs'
 import waiting from './i18n/waiting.json'
 export function delegateCopy(locale='en'){
- const language=locale.toLowerCase().replaceAll('_','-')
- const key=language.startsWith('zh')?(language.startsWith('zh-cn')||language.startsWith('zh-hans')?'zh-CN':'zh-TW'):language.split('-')[0]
- return {...(language.startsWith('zh')?zh:en),waiting_executor:waiting[key as keyof typeof waiting]??waiting.en}
+ const key=uiLocale(locale)
+ return {...delegateCatalogs[key]!,waiting_executor:waiting[key as keyof typeof waiting]??waiting.en}
 }
-export function errorCopy(error:unknown,copy:typeof en){const code=(error as {code?:string})?.code;return ['session_required','AUTH_DENIED'].includes(code??'')?copy.session:['DENIED','SCOPE_DENIED','PERMISSION_DENIED','APP_DENIED','INELIGIBLE','denied'].includes(code??'')?copy.denied:copy.error}
+export function errorCopy(error:unknown,copy:DelegateCopy){const code=(error as {code?:string})?.code;return ['session_required','AUTH_DENIED'].includes(code??'')?copy.session:['DENIED','SCOPE_DENIED','PERMISSION_DENIED','APP_DENIED','INELIGIBLE','denied'].includes(code??'')?copy.denied:copy.error}