@synopackageland/cli 0.6.1 → 0.7.0

package/dist/standalone/build.js

@@ -2,7 +2,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { goBuildEnv } from "../build-spk/dsm-arch.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
@@ -10,7 +11,6 @@ import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
-const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export const runCommand = (command, args, options) => {
     const result = spawnSync(command, args, {
@@ -38,11 +38,14 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+        throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
+    }
     const run = options.run ?? runCommand;
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
-            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
         }
     }
     buildUi(manifest, run);
@@ -60,7 +63,7 @@ export async function buildStandalone(options) {
             }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const backgroundWorker = buildBackgroundWorker(manifest, arch, work, run);
+            const backgroundWorker = buildBackgroundWorker(builtManifest, arch, work, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             outputs.push(outputPath);
         }
@@ -103,14 +106,16 @@ function backendFor(manifest, arch, work, run) {
         `-X main.version=${manifest.spkVersion}`,
         `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
-        ...(manifest.capabilities.delegate ? [`-X ${JSON.stringify(`main.delegateScope=${manifest.capabilities.delegate.scope}`)}`] : []),
+        ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
+        ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
+        ...(manifest.portal ? ["-X main.portal=on"] : []),
     ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
@@ -125,10 +130,12 @@ function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
-    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`].join(" ");
+    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`, ...delegateBuildFlags(manifest),
+        ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
+    ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker（${BACKGROUND_WORKER_MAIN}）build 失敗；這個專案的 backend 需要含該 package。\n${result.stderr}`);
@@ -138,3 +145,26 @@ function buildBackgroundWorker(manifest, arch, work, run) {
         throw new StandaloneBuildError(problem.code, problem.message);
     return out;
 }
+function delegateBuildFlags(manifest) {
+    const d = manifest.capabilities.delegate;
+    if (!d)
+        return [];
+    const values = {
+        delegateScope: d.scope,
+        delegateOperationsJSON: JSON.stringify([...d.operations].sort()),
+        delegateDestinationsJSON: JSON.stringify(d.destinations ? [...d.destinations].sort() : []),
+        delegateLifetime: d.lifetime ?? '',
+    };
+    // Go's quoted.Split does not process backslash escapes. Interior JSON quotes
+    // in a whitespace-free argument are literal; never shell-escape this string.
+    return Object.entries(values).map(([key, value]) => {
+        const arg = `main.${key}=${value}`;
+        if (!/\s/.test(arg))
+            return `-X ${arg}`;
+        if (!arg.includes("'"))
+            return `-X '${arg}'`;
+        if (!arg.includes('"'))
+            return `-X "${arg}"`;
+        throw new StandaloneBuildError('STANDALONE_GO_BUILD_FAILED', 'Delegate scope with whitespace and both quote types cannot be represented in Go linker flags.');
+    });
+}

package/dist/standalone/daemon.d.ts

@@ -1,4 +1,4 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {

package/dist/standalone/daemon.js

@@ -1,5 +1,6 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { goBuildEnv } from "../build-spk/dsm-arch.js";
 import { templatesRoot } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
@@ -58,7 +59,7 @@ export function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build 需要 Go 1.24 以上。\n${result.stderr}`);

package/dist/standalone/dsm-window.d.ts

@@ -1,4 +1,4 @@
-import type { StandaloneManifest } from "./manifest.js";
+import type { EntryMode, StandaloneManifest } from "./manifest.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export declare function cgiUrl(packageId: string): string;
@@ -14,6 +14,8 @@ export declare const I18N_RUNTIME: string;
  * cached from the previous version after an upgrade.
  */
 export declare function windowScriptName(manifest: Pick<StandaloneManifest, "build">): string;
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export declare function renderUiConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/dsm-window.js

@@ -3,6 +3,7 @@ import { DSM_LANGS } from "./i18n.js";
 import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
+import { PORTAL_RUNTIME } from "./portal-window.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export function cgiUrl(packageId) {
@@ -47,6 +48,20 @@ export const I18N_RUNTIME = `function createI18n(dsmLang, catalogs) {
 export function windowScriptName(manifest) {
     return `window-${String(manifest.build).padStart(4, "0")}.js`;
 }
+/**
+ * Who sees the main-menu entry. app-privilege also registers the app in
+ * Control Panel > Application Privileges (local and directory accounts, with
+ * IP rules); DSM then filters the launcher and the CGI checks the same rule.
+ */
+function launcherAccess(manifest) {
+    return manifest.entry ? entryLauncherAccess(manifest.entry) : { allUsers: permitsOrdinaryUsers(manifest.apiPermissions) };
+}
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export function entryLauncherAccess(entry) {
+    return entry === "admin-only"
+        ? { allUsers: false }
+        : { allUsers: true, grantPrivilege: "all", advanceGrantPrivilege: true };
+}
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export function renderUiConfig(manifest) {
     const ns = `SYNO.SDS.${manifest.package}`;
@@ -59,7 +74,7 @@ export function renderUiConfig(manifest) {
                 icon: "images/app_{0}.png",
                 appWindow: `${ns}.MainWindow`,
                 allowMultiInstance: false,
-                allUsers: permitsOrdinaryUsers(manifest.apiPermissions),
+                ...launcherAccess(manifest),
                 depend: [`${ns}.MainWindow`],
             },
             [`${ns}.MainWindow`]: {
@@ -127,7 +142,14 @@ ${HOST_ADAPTER_RUNTIME}
   return createHostAdapter;
 })();
 
-${root ? root.definitions : ""}${ns}.loadApp = function (done) {
+${root || manifest.portal ? renderWebApi(ns) : ""}// A display hint for hiding or disabling administrator settings; the CGI
+// decides access on its own and never trusts this value.
+${ns}.sessionUser = function () {
+  var session = (SYNO.SDS && SYNO.SDS.Session) || {};
+  return { name: typeof session.user === "string" ? session.user : "", isAdmin: session.is_admin === true };
+};
+
+${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) : ""}${ns}.loadApp = function (done) {
   var apps = window.DsmPackageApps || {};
   if (apps[${p}]) {
     done(apps[${p}]);
@@ -186,6 +208,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
           call: ${ns}.call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
+          user: ${ns}.sessionUser(),${manifest.portal ? `\n          portal: ${renderPortalAccess(ns, manifest)},` : ""}
           host: me.hostAccess,
           appWindow: me,
           lang: lang,
@@ -221,6 +244,50 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
     }
   }
 });
+`;
+}
+function renderPortalDefinition(ns) {
+    return `${ns}.createPortalAccess = (function () {
+${PORTAL_RUNTIME}
+  return createPortalAccess;
+})();
+
+`;
+}
+/**
+ * `ctx.portal`: administrators use their own DSM session; isAdmin only picks
+ * the path. The SDK ships the panel text in every DSM language, so it follows
+ * DSM even where the app has no catalog.
+ */
+function renderPortalAccess(ns, manifest) {
+    return `${ns}.createPortalAccess({
+            appId: ${JSON.stringify(`${ns}.Instance`)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
+            send: ${ns}.webApi(me),
+            call: ${ns}.call,
+            launch: function (app, params) { SYNO.SDS.AppLaunch(app, params); },
+            location: window.location,
+            locale: ${ns}.createI18n(lang, ${JSON.stringify(Object.fromEntries(Object.keys(DSM_LANGS).map((locale) => [locale, {}])))}).locale
+          })`;
+}
+/** DSM WebAPI in the window's own session: resolves data, rejects `{code: "dsm_<n>"}`. */
+function renderWebApi(ns) {
+    return `// DSM WebAPI in the window's own session: resolves data, rejects {code: "dsm_<n>"}.
+${ns}.webApi = function (win) {
+  return function (api, method, version, params) {
+    return new Promise(function (resolve, reject) {
+      win.sendWebAPI({
+        api: api, method: method, version: version, params: params, scope: win,
+        callback: function (success, response) {
+          if (success) resolve(response);
+          else reject({ code: "dsm_" + ((response && response.code) || "error") });
+        }
+      });
+    });
+  };
+};
+
 `;
 }
 const ROOT_PANEL_CSS = [
@@ -259,19 +326,9 @@ ${ROOT_PANEL}
     };
     var access = ${ns}.createRootAccess({
       tasks: ${ns}.rootTasks,
-      pins: ${JSON.stringify({ executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
+      pins: ${JSON.stringify({ package: manifest.package, executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
       user: session,
-      send: function (api, method, version, params) {
-        return new Promise(function (resolve, reject) {
-          me.sendWebAPI({
-            api: api, method: method, version: version, params: params, scope: me,
-            callback: function (success, response) {
-              if (success) resolve(response);
-              else reject({ code: "dsm_" + ((response && response.code) || "error") });
-            }
-          });
-        });
-      },
+      send: ${ns}.webApi(me),
       confirmPassword: function (suppliedPassword) {
         // Send exactly one PasswordConfirm v2 auth with a masked password field.
         return new Promise(function (resolve, reject) {
@@ -309,7 +366,7 @@ ${ROOT_PANEL}
       wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
     });
     var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
-    if (panels) {
+    if (panels && ${manifest.ui.build !== undefined && manifest.capabilities.delegate?.scope === "install-selected" ? "false" : "true"}) {
       ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
     }
 `,

package/dist/standalone/inspect-spk.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
+import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
 export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
@@ -22,6 +23,13 @@ export interface SpkInspection {
     }>;
     executor?: ExecutorInspection;
     uninstallCleanup?: UninstallCleanupItem[];
+    /** Application Portal entry; inactive until an administrator applies the alias. */
+    portal?: {
+        appId: string;
+        alias: string;
+    };
+    /** Declared `entry` mode; `admin-only` is the administrator floor of every route. */
+    entry?: EntryMode;
 }
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;

package/dist/standalone/inspect-spk.js

@@ -1,22 +1,25 @@
 import { inspectNativeLayout } from "./native-layout.js";
-import { inspectExecutor } from "../runtime/executor-inspect.js";
+import { inspectExecutor, inspectExecutorAnchor } from "../runtime/executor-inspect.js";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
 import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
-import { CONTAINER_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
-import { CGI_PAYLOAD_PATH } from "./dsm-window.js";
+import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
+import { renderDelegateScopeSteps, renderDelegateInstallDraft } from "../build-spk/delegate-scope.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { uninstallCleanup } from "../runtime/uninstall-cleanup.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, portalResource, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
+import { isPortalAlias } from "../portal/alias.js";
 const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
@@ -48,7 +51,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadataText !== undefined) {
             try {
                 const raw = JSON.parse(metadataText);
-                if (raw.schema !== 2 || !["go", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length)
+                if (raw.schema !== 2 || !["go", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
                 metadata = raw;
             }
@@ -63,18 +66,19 @@ export async function inspectSpk(spkPath, expectedKind) {
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
         const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
-        checkConf(dir, findings, kind, background, sharedFolder, info.package);
+        const portal = await recoverPortal(dir, info, kind === "container" ? info.package ?? "" : `SYNO.SDS.${info.package}.Instance`, paths, payload, findings);
+        if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
+            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
+        }
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal);
         checkScripts(dir, findings);
-        if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder);
         checkUninstall(dir, findings);
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
         const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor");
+        const daemon = standalone ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background) : undefined;
         if (background)
-            checkBackground(dir, info, payload, findings, hasExecutor);
-        if (standalone)
-            await checkDaemon(dir, info, paths, payload, findings, hasExecutor);
+            checkBackground(dir, info, payload, findings, hasExecutor, daemon);
         let executor;
         if ((metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor")) {
             const executorDir = join(dir, "executor-inspection");
@@ -83,6 +87,8 @@ export async function inspectSpk(spkPath, expectedKind) {
             const inspected = inspectExecutor(executorDir, info.package, info.arch);
             findings.push(...inspected.findings);
             executor = inspected.executor;
+            if (executor)
+                findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
             if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
             if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
@@ -99,6 +105,13 @@ export async function inspectSpk(spkPath, expectedKind) {
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
         }
+        if (background && daemon && (executor?.policy.lifetime !== 'until-revoked' || !metadata.capabilities?.includes('delegate'))) {
+            findings.push('daemon/background combination requires an explicitly pinned until-revoked delegate policy.');
+        }
+        if (metadata.entry)
+            await checkEntryLauncher(dir, info.package, metadata.entry, findings);
+        if (standalone)
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
             findings.push(`payload 沒有 ${CGI_PAYLOAD_PATH}`);
@@ -109,6 +122,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         return {
             kind,
             ...(executor ? { executor } : {}),
+            ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
+            ...(metadata.entry ? { entry: metadata.entry } : {}),
             ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, hasExecutor) } : {}),
             package: info.package,
             version: info.version,
@@ -124,6 +139,23 @@ export async function inspectSpk(spkPath, expectedKind) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+/** The launcher in ui/config must carry exactly the access the declared entry mode fixes. */
+async function checkEntryLauncher(dir, pkg, entry, findings) {
+    const target = join(dir, "entry-inspection");
+    mkdirSync(target);
+    await tar.x({ file: join(dir, "package.tgz"), cwd: target, filter: path => path.replace(/^\.\//, "") === "ui/config" });
+    let launcher;
+    try {
+        const config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
+        launcher = Object.values(config)[0]?.[`SYNO.SDS.${pkg}.Instance`];
+    }
+    catch { /* reported below */ }
+    const expected = entryLauncherAccess(entry);
+    const fields = ["allUsers", "grantPrivilege", "advanceGrantPrivilege"];
+    if (!launcher || fields.some(field => launcher[field] !== expected[field])) {
+        findings.push(`ENTRY_LAUNCHER_MISMATCH sdk-package.json 宣告 entry: ${entry}，但 ui/config 的 launcher 不是 ${JSON.stringify(expected)}；請用 synopkgland build 重新產生`);
+    }
+}
 const OS_MIN_VER = /^7\.\d+(\.\d+)?-\d+$/;
 /** INFO os_min_ver and arch must be values DSM accepts, and arch must match the shipped CGI. */
 async function checkArch(dir, info, kind, hasCgi, findings) {
@@ -157,7 +189,7 @@ async function checkArch(dir, info, kind, hasCgi, findings) {
         findings.push(`INFO arch 宣告 ${declared}，但 ${CGI_PAYLOAD_PATH} 是 ${actual} 的執行檔`);
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background) {
     if (![...paths].some(path => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -178,13 +210,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor) {
             throw new Error("invalid config");
         if (payload.find(p => p.path === `daemon/payload/${daemon.exec}`)?.mode !== "0755")
             throw new Error("missing executable");
-        const manifest = { package: info.package, daemon, capabilities: executor ? { rootOps: true } : {} };
+        const manifest = { package: info.package, daemon, capabilities: { ...(executor ? { rootOps: true } : {}), ...(background ? { jobs: { worker: 'sha256-v1' } } : {}) } };
         if (readFileSync(join(unpacked, "daemon/config.json"), "utf8") !== daemonConfig(manifest))
             throw new Error("non-canonical daemon config");
         for (const hook of ["start-stop-status", "preupgrade", "preuninst"]) {
             if (readFileSync(join(dir, "scripts", hook), "utf8") !== renderStandaloneScript(hook, manifest))
                 findings.push(`daemon scripts/${hook} 與固定 lifecycle 不符`);
         }
+        return daemon;
     }
     catch {
         findings.push("daemon/config.json 或 payload 不符合固定 daemon 契約");
@@ -234,12 +267,12 @@ async function checkContainerExposure(dir, packageTgz, findings) {
 function readOptional(path) {
     return existsSync(path) ? readFileSync(path, "utf8") : undefined;
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
-    const nativeResource = kind !== "container" ? renderStandaloneResource({ package: pkg ?? "", capabilities: background ? { jobs: { worker: "sha256-v1" } } : {}, ...(sharedFolder ? { sharedFolder } : {}) }) : undefined;
+    const nativeResource = kind !== "container" ? renderStandaloneResource({ package: pkg ?? "", capabilities: background ? { jobs: { worker: "sha256-v1" } } : {}, ...(sharedFolder ? { sharedFolder } : {}) }, portal) : undefined;
     if (nativeResource !== undefined && readOptional(join(confDir, "resource")) !== nativeResource) {
-        findings.push(`conf/resource 必須是 ${nativeResource}（只有官方 data-share 與 systemd-user-unit，且與 install.sharedFolder 宣告一致）`);
+        findings.push(`conf/resource 必須是 ${nativeResource}（只有官方 data-share、systemd-user-unit 與 web-config，且與 install.sharedFolder、portal 宣告一致）`);
     }
     for (const name of entries) {
         if (name !== "privilege" && !(kind === "container" && name === "resource") && !(nativeResource !== undefined && name === "resource") && !(background && name === "systemd")) {
@@ -252,9 +285,11 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
             if (!resource["docker-project"])
                 findings.push("container 缺少 docker-project resource");
             for (const key of Object.keys(resource)) {
-                if (!["docker-project", "webservice"].includes(key))
+                if (!["docker-project", "webservice", ...(portal ? ["web-config"] : [])].includes(key))
                     findings.push(`未知 container resource: ${key}`);
             }
+            if (portal && JSON.stringify(resource["web-config"]) !== JSON.stringify(portalResource()["web-config"]))
+                findings.push("container web-config 必須只有固定的 app-portal 註冊");
         }
         catch {
             findings.push("container 缺少有效的 conf/resource");
@@ -283,19 +318,21 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg) {
     }
 }
 /** The opt-in package user unit must be exactly what the generator writes. */
-function checkBackground(dir, info, payload, findings, executor) {
+function checkBackground(dir, info, payload, findings, executor, daemon) {
     const pkg = info.package;
     if (!pkg)
         return;
     const read = (path) => existsSync(join(dir, path)) ? readFileSync(join(dir, path), "utf8") : undefined;
     if (payload.find(p => p.path === BACKGROUND_WORKER_PAYLOAD)?.mode !== "0755")
         findings.push(`${BACKGROUND_WORKER_PAYLOAD} 缺少或非 executable`);
+    if (info.precheckstartstop !== "yes")
+        findings.push('background INFO 必須明確設定 precheckstartstop="yes"（prestart 復原失去 socket 的套件使用者 manager）');
     const units = existsSync(join(dir, BACKGROUND_UNIT_DIR)) ? readdirSync(join(dir, BACKGROUND_UNIT_DIR)) : [];
     const unit = backgroundUnitName(pkg);
     if (units.length !== 1 || units[0] !== unit || read(`${BACKGROUND_UNIT_DIR}/${unit}`) !== renderBackgroundUnit(pkg)) {
         findings.push(`${BACKGROUND_UNIT_DIR} 必須只有固定的 ${unit}（套件帳號執行，無 User=、無 root）`);
     }
-    if (read("scripts/start-stop-status") !== renderStandaloneScript("start-stop-status", { package: pkg, capabilities: { jobs: { worker: "sha256-v1" }, ...(executor ? { rootOps: true } : {}) } }))
+    if (read("scripts/start-stop-status") !== renderStandaloneScript("start-stop-status", { package: pkg, ...(daemon ? { daemon } : {}), capabilities: { jobs: { worker: "sha256-v1" }, ...(executor ? { rootOps: true } : {}) } }))
         findings.push("background scripts/start-stop-status 與固定 synosystemctl lifecycle 不符");
 }
 /**
@@ -304,7 +341,7 @@ function checkBackground(dir, info, payload, findings, executor) {
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : []).filter(name => /^(install|upgrade)_uifile(_|\.|$)/.test(name)).sort();
     const postinst = readOptional(join(dir, "scripts/postinst"));
@@ -312,27 +349,69 @@ function checkSharedFolder(dir, findings, pkg, folder) {
         findings.push("scripts/postinst 的 install.sharedFolder 宣告無效");
     if (!pkg)
         return;
-    const wizards = expectedWizardFiles(pkg, folder);
-    const source = folder ? "install.sharedFolder 宣告" : "native-go 預設安裝精靈";
-    // The default native wizard is optional; a declared shared folder needs all of its files.
-    for (const name of folder ? Object.keys(wizards) : present.filter(n => n in wizards)) {
+    const wizards = expectedWizardFiles(pkg, folder, selected, portal);
+    const source = selected ? "install-selected policy" : folder ? "install.sharedFolder 宣告" : portal ? "portal 宣告" : "native-go 預設安裝精靈";
+    // The default native wizard is optional; a declared shared folder or portal needs all of its files.
+    for (const name of folder || selected || portal ? Object.keys(wizards) : present.filter(n => n in wizards)) {
         if (readOptional(join(wizardDir, name)) !== wizards[name])
             findings.push(`WIZARD_UIFILES/${name} 與${source}不符`);
     }
     for (const name of present.filter(n => !(n in wizards)))
         findings.push(`WIZARD_UIFILES/${name} 不是${source}產生的精靈檔`);
+    if (selected) {
+        for (const hook of ['preinst', 'postinst']) {
+            if (!readOptional(join(dir, 'scripts', hook))?.includes(renderDelegateInstallDraft(pkg, hook === 'preinst')))
+                findings.push(`scripts/${hook} missing install-selected draft handling`);
+        }
+    }
     if (!folder)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
-        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder })) {
+        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : {}), ...portalManifest(portal) })) {
             findings.push(`scripts/${hook} 與 install.sharedFolder 宣告的固定腳本不符`);
         }
     }
 }
-function expectedWizardFiles(pkg, folder) {
-    const install = renderInstallWizardFiles(pkg, folder ? sharedFolderInstallSteps(pkg, folder) : renderNativeInstallWizard);
+function expectedWizardFiles(pkg, folder, selected = false, portal) {
+    const steps = selected ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(pkg, folder)(t) : [])] : folder ? sharedFolderInstallSteps(pkg, folder) : renderNativeInstallWizard;
+    const install = renderInstallWizardFiles(pkg, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
     return { ...install.static, ...install.dynamic, ...(folder ? renderSharedFolderUpgradeWizardFiles(pkg, folder) : {}) };
 }
+function portalManifest(portal) {
+    return portal ? { displayname: portal.application, portal: { alias: portal.alias } } : {};
+}
+/**
+ * The portal declaration is recovered from the payload's etc/portal.json. Its
+ * files and alias lifecycle must be exactly what the generator writes for the
+ * package's own DSM window (native AppInstance or Compose `.url` entry); activation is never part of the package.
+ */
+async function recoverPortal(dir, info, appId, paths, payload, findings) {
+    const files = [PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH];
+    if (!files.some(path => paths.has(path)))
+        return;
+    const unpacked = join(dir, "portal-inspection");
+    mkdirSync(unpacked);
+    await tar.x({ file: join(dir, "package.tgz"), cwd: unpacked, filter: path => files.includes(path.replace(/^\.\//, "")) });
+    try {
+        if (files.some(path => payload.find(p => p.path === path)?.mode !== "0644"))
+            throw new Error("mode");
+        const json = readFileSync(join(unpacked, PORTAL_JSON_RELPATH), "utf8");
+        const alias = JSON.parse(json).alias;
+        if (!isPortalAlias(alias))
+            throw new Error("alias");
+        const portal = { appId, application: info.displayname ?? "", alias };
+        if (json !== renderPortalJson(portal) || readFileSync(join(unpacked, PORTAL_MUSTACHE_RELPATH), "utf8") !== renderPortalMustache())
+            throw new Error("content");
+        for (const hook of ["preinst", "postinst", "postupgrade"]) {
+            if (!readOptional(join(dir, "scripts", hook))?.startsWith(`#!/bin/sh\n${renderPortalLifecycle(hook, portal)}`))
+                throw new Error(hook);
+        }
+        return portal;
+    }
+    catch {
+        findings.push("PORTAL_INVALID etc/portal.json、etc/portal.mustache 或 lifecycle 不符合固定 Application Portal 契約（應開啟套件自己的 DSM 視窗）");
+    }
+}
 function checkScripts(dir, findings) {
     const scriptsDir = join(dir, "scripts");
     if (!existsSync(join(scriptsDir, "start-stop-status"))) {