@synopackageland/cli 0.6.1 → 0.7.0

package/dist/standalone/lifecycle.js

@@ -1,27 +1,56 @@
-import { renderBackgroundControl, backgroundUnitName } from "./background.js";
+import { renderBackgroundControl, renderBackgroundWorkerStart, renderBackgroundWorkerStop, renderUserManagerRecovery, backgroundUnitName } from "./background.js";
 import { renderPackagePostuninst } from "../build-spk/native-lifecycle.js";
 import { renderSharedFolderScript } from "./shared-folder.js";
+import { renderDelegateInstallDraft } from '../build-spk/delegate-scope.js';
+import { renderPortalLifecycle } from "../portal/package.js";
+import { nativePortal } from "./portal.js";
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
+    const portal = nativePortal(manifest);
+    const script = renderCapabilityScript(name, manifest);
+    return portal ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`) : script;
+}
+function renderCapabilityScript(name, manifest) {
+    if (name === 'preupgrade' && (manifest.capabilities.rootOps || manifest.capabilities.delegate)) {
+        const installed = `\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}`;
+        // Incoming preupgrade sees the OLD payload. Only complete absence is first
+        // introduction; a partial or symlinked executor must still fail closed.
+        const legacy = manifest.daemon
+            ? `  if [ -e "${installed}/daemon" ] || [ -L "${installed}/daemon" ]; then\n    "${installed}/daemon/control" stop "${installed}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n  fi\n`
+            : '';
+        return renderStandaloneScriptBody(name, manifest).replace('#!/bin/sh\n', `#!/bin/sh\nif [ ! -e "${installed}/executor" ] && [ ! -L "${installed}/executor" ]; then\n${legacy}  exit 0\nfi\n`);
+    }
+    return renderStandaloneScriptBody(name, manifest);
+}
+function renderStandaloneScriptBody(name, manifest) {
+    if (manifest.capabilities?.delegate?.scope === 'install-selected' && ['preinst', 'postinst'].includes(name)) {
+        const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, delegate: { ...manifest.capabilities.delegate, scope: 'home' } } });
+        return normal.replace('#!/bin/sh\n', () => '#!/bin/sh\n' + renderDelegateInstallDraft(manifest.package, name === 'preinst'));
+    }
+    if (manifest.daemon && manifest.capabilities?.jobs && (manifest.capabilities.delegate || manifest.capabilities.rootOps)
+        && ['start-stop-status', 'preupgrade', 'preuninst'].includes(name))
+        return renderDelegatedDaemonScript(name, manifest);
     if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["preuninst", "preupgrade", "start-stop-status"].includes(name)) {
         const helper = `"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle"`;
-        const stopWorker = manifest.capabilities.jobs ? `/usr/syno/bin/synosystemctl stop ${backgroundUnitName(manifest.package)} || echo "worker stop unconfirmed; continuing executor cleanup" >&2\n` : "";
+        // Attempt worker stop first, but let executor shutdown drain requests and
+        // close ingress even when it fails; a still-running worker fails the hook.
+        const workerStop = manifest.capabilities.jobs ? renderBackgroundWorkerStop(manifest.package) : "";
+        const stopWorker = manifest.capabilities.jobs ? "worker_result=0\nstop_background_worker || worker_result=1\n" : "";
+        const workerResult = manifest.capabilities.jobs ? 'exit "$worker_result"\n' : "exit 0\n";
         const request = (action) => `${helper} ${action} --package ${manifest.package} || exit $?\n`;
         if (name === "start-stop-status") {
-            const normal = renderStandaloneScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
-            // Attempt worker stop first. DSM may have already stopped it or deny this
-            // lifecycle context; executor shutdown drains requests and closes ingress.
+            const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
             const stopDaemon = manifest.daemon ? `"/var/packages/${manifest.package}/target/daemon/control" stop "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n` : "";
-            return normal.replace("#!/bin/sh\n", `#!/bin/sh\nif [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}exit 0\nfi\n`);
+            return normal.replace("#!/bin/sh\n", `#!/bin/sh\n${workerStop}if [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}${workerResult}fi\n`);
         }
         const action = name === "preuninst" ? '"$action"' : "stop";
         const choose = name === "preuninst" ? 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n' : "";
-        return `#!/bin/sh\n${stopWorker}${choose}${request(action)}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : "exit 0\n"}`;
+        return `#!/bin/sh\n${workerStop}${stopWorker}${choose}${request(action)}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : workerResult}`;
     }
     if (name === "postuninst")
         return renderPackagePostuninst(manifest.package);
     if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["postinst", "postupgrade"].includes(name)) {
-        const normal = renderStandaloneScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
+        const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
         return normal.replace("#!/bin/sh\n", `#!/bin/sh\n"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle" start --package ${manifest.package} || exit $?\n`);
     }
     if (manifest.sharedFolder && (name === "postinst" || name === "postupgrade"))
@@ -40,6 +69,55 @@ esac
     }
     return "#!/bin/sh\nexit 0\n";
 }
+/** DSM owns the single user unit; the daemon controller owns only its producer. */
+function renderDelegatedDaemonScript(name, manifest) {
+    const pkg = manifest.package;
+    const daemon = `"/var/packages/${pkg}/target/daemon/control"`;
+    const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
+    const helper = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}/executor/lifecycle"`;
+    const executor = (action) => `${helper} ${action} --package ${pkg}`;
+    const worker = (action) => `/usr/syno/bin/synosystemctl ${action} ${backgroundUnitName(pkg)}`;
+    // Try every owner even on failure; never leave protected ingress open merely
+    // because a producer could not stop. A partial teardown remains a failure.
+    const stop = (daemonAction, executorAction) => `result=0\nstop_background_worker || result=1\n${daemon} ${daemonAction} ${paths} || result=1\n${executor(executorAction)} || result=1\nexit "$result"\n`;
+    const workerStop = renderBackgroundWorkerStop(pkg);
+    if (name !== 'start-stop-status') {
+        if (name === 'preupgrade')
+            return `#!/bin/sh\n${workerStop}${stop('stop', 'stop')}`;
+        return `#!/bin/sh\n${workerStop}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop('stop', 'stop')}fi\n${stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge')}`;
+    }
+    return `#!/bin/sh
+${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
+  prestart) recover_user_manager ;;
+  prestop) exit 0 ;;
+  start)
+    ${executor('start')} || exit $?
+    if ! ${daemon} start ${paths}; then
+      ${daemon} stop ${paths}
+      ${executor('stop')}
+      exit 1
+    fi
+    if ! start_background_worker; then
+      ${worker('stop')}
+      ${daemon} stop ${paths}
+      ${executor('stop')}
+      exit 1
+    fi
+    exit 0 ;;
+  status)
+    ${daemon} status ${paths} || exit $?
+    worker_state="$(${worker('get-active-status')})" || exit 3
+    [ "$worker_state" = active ] && exit 0
+    exit 3 ;;
+  stop)
+${stop('stop', 'stop')}    ;;
+  restart)
+    "$0" stop || exit $?
+    exec "$0" start ;;
+  *) exit 1 ;;
+esac
+`;
+}
 function renderDaemonScript(name, manifest) {
     const pkg = manifest.package;
     const control = `"/var/packages/${pkg}/target/daemon/control"`;

package/dist/standalone/manifest.d.ts

@@ -1,3 +1,4 @@
+import { type PackageMetadata } from "../package-metadata.js";
 import { type DelegateCapability } from "../runtime/executor-policy.js";
 import type { ExecutorPins } from "../runtime/executor-tasks.js";
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
@@ -7,6 +8,7 @@ import { type Daemon } from "./daemon.js";
 import { type Background } from "./background.js";
 import { type SharedFolder } from "./shared-folder.js";
 import { type ApiPermissions } from "./api-permissions.js";
+import { type PortalDeclaration } from "../portal/alias.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -31,6 +33,7 @@ export interface StandaloneI18n {
     info: Partial<Record<Locale, InfoText>>;
 }
 export interface StandaloneManifest {
+    metadata?: PackageMetadata;
     root: string;
     package: string;
     version: string;
@@ -62,7 +65,16 @@ export interface StandaloneManifest {
     daemon?: Daemon;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;
+    /** Who may use the app at all; absent keeps the route policy alone. */
+    entry?: EntryMode;
+    /** `portal`: registers the DSM Application Portal entry; an administrator activates it. */
+    portal?: PortalDeclaration;
 }
+/**
+ * `admin-only`: DSM administrators only. `app-privilege`: administrators and
+ * accounts DSM's Control Panel > Application Privileges allows for the app.
+ */
+export type EntryMode = "admin-only" | "app-privilege";
 export interface Capabilities {
     files?: "session";
     identity?: "standalone";
@@ -81,6 +93,7 @@ export type ManifestResult = {
     ok: false;
     errors: StandaloneError[];
 };
+export declare const KNOWN_FIELDS: Set<string>;
 export declare function loadStandaloneManifest(root: string): ManifestResult;
 /**
  * The nearest directory at or above `start` that holds dsm-package.yaml,

package/dist/standalone/manifest.js

@@ -1,3 +1,4 @@
+import { validateMetadata } from "../package-metadata.js";
 import { validDelegate } from "../runtime/executor-policy.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
@@ -7,17 +8,18 @@ import { checkGlossary, isLocale, loadCatalogs } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readDaemon } from "./daemon.js";
 import { readBackground } from "./background.js";
-import { DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
-import { readApiPermissions } from "./api-permissions.js";
+import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
+import { readPortalDeclaration } from "../portal/alias.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
  */
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
-const KNOWN_FIELDS = new Set([
+export const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install",
+    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const INFO_TEXT_FIELDS = new Set(["displayname", "description"]);
@@ -108,6 +110,14 @@ function readManifest(raw, c) {
     const displayname = c.text(raw.displayname, "displayname");
     const description = c.text(raw.description, "description");
     const maintainer = c.text(raw.maintainer, "maintainer");
+    let metadata;
+    if (raw.metadata !== undefined)
+        try {
+            metadata = validateMetadata(raw.metadata);
+        }
+        catch {
+            c.fail("STANDALONE_TEXT_INVALID", "metadata 欄位格式不正確；請檢查文字、email、URLs 與 screenshots。");
+        }
     const arches = readArches(raw.arches, c);
     const backend = arches && readBackend(raw.backend, arches, c);
     let permissions;
@@ -120,8 +130,8 @@ function readManifest(raw, c) {
         }
     }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
-    if (capabilities.jobs && raw.daemon !== undefined) {
-        c.fail("CAPABILITY_COMBINATION_INVALID", "daemon 與 capabilities.jobs 互斥。");
+    if (capabilities.jobs && raw.daemon !== undefined && capabilities.delegate?.lifetime !== 'until-revoked') {
+        c.fail("CAPABILITY_COMBINATION_INVALID", "daemon 僅可與明確 until-revoked delegate 的固定 worker 共存；一般 capabilities.jobs 仍互斥。");
     }
     if (backend?.kind === "binary") {
         for (const name of ["files", "jobs", "identity", "delegate"]) {
@@ -130,10 +140,25 @@ function readManifest(raw, c) {
         }
     }
     const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
+    const entry = raw.entry === undefined ? undefined : readEntry(raw.entry, backend, permissions?.policy, c);
+    if (entry === "admin-only" && permissions) {
+        const floored = floorAtAdministrators(permissions.policy);
+        if (floored.widened.length) {
+            c.fail("STANDALONE_ENTRY_WIDENED", `entry: admin-only 以管理員為所有 route 的下限；permissions.json 的 ${floored.widened.join("、")} 會開放給其他人。請改為 administrators，或改用 entry: app-privilege／省略 entry。`);
+        }
+        permissions.policy = floored.policy;
+    }
     const ui = readUi(raw.ui, c);
     if (capabilities.identity && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
+    if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
+        c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
+    const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
+        ?? c.fail("STANDALONE_PORTAL_INVALID", "portal 必須是 {} 或 { alias: <小寫英數與 -，1–64 字，不可為 DSM 保留路徑> }。");
+    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
+        c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
+    }
     if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
         || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
         return undefined;
@@ -147,6 +172,7 @@ function readManifest(raw, c) {
         displayname,
         description,
         maintainer,
+        ...(metadata ? { metadata } : {}),
         os_min_ver: osMinVer,
         arches,
         backend,
@@ -157,8 +183,31 @@ function readManifest(raw, c) {
         ...(rootOps ? { rootOps } : {}),
         ...(daemon ? { daemon } : {}),
         ...(sharedFolder ? { sharedFolder } : {}),
+        ...(entry ? { entry } : {}),
+        ...(portal ? { portal } : {}),
     };
 }
+/**
+ * The CGI enforces the entry mode only when the project's backend carries the
+ * SDK gate and main wires it; `-X main.entry` on an older main would be
+ * silently dropped and leave a registered app ungated.
+ */
+function readEntry(value, backend, policy, c) {
+    if (value !== "admin-only" && value !== "app-privilege") {
+        return c.fail("STANDALONE_ENTRY_INVALID", "entry 必須是 admin-only 或 app-privilege；省略則維持既有 permissions.json 行為。");
+    }
+    if (!backend)
+        return undefined;
+    const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
+    if (backend.kind !== "go" || !existsSync(join(backend.dir, "internal/dsm/entry.go"))
+        || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "entry 需要 Go backend 內的 SDK entry gate：請從 SDK 範本複製 internal/dsm/entry.go、apppriv.go 與 native bridge，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。");
+    }
+    if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
+        return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");
+    }
+    return value;
+}
 function readRootOps(enabled, c) {
     const dir = join(c.root, ROOT_OPS_DIR);
     if (!enabled) {
@@ -180,7 +229,7 @@ function readArches(value, c) {
         && new Set(value).size === value.length;
     return ok
         ? value
-        : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64 清單，至少一個。");
+        : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64／armv7 清單，至少一個。");
 }
 function readBackend(value, arches, c) {
     if (!isRecord(value) || !["go", "binary"].includes(String(value.kind))) {
@@ -314,7 +363,7 @@ function readCapabilities(value, c) {
             if (validDelegate(setting))
                 result.delegate = setting;
             else
-                c.fail("CAPABILITY_INVALID", "delegate requires nonempty unique §2.4 files operations and scope home or shared:<name>.");
+                c.fail("CAPABILITY_INVALID", "delegate requires scope home or shared:<name> and legacy files operations, or scope home/shared:<name>/install-selected with exactly files.moveFromStaging, nonempty unique destinations and lifetime: until-revoked.");
         }
         else if (name === "files" && setting === "session")
             result.files = "session";

package/dist/standalone/native-authorization-window.d.ts

@@ -1,2 +1,2 @@
 /** Shared host flow. CGI plans are never accepted as completed authorization. */
-export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";
+export declare const AUTHORIZATION_RUNTIME = "function createAuthorizationAccess(options) {\n  var busy = null;\n  function fail(code) { var error = new Error(code); error.code = code; return error; }\n  function status() { return options.call(\"authorization.status\").then(function (d) {\n    if (!d || d.command !== \"authorization\" || d.schema_version !== 1 || [\"ready\",\"authorization_required\",\"not_admin\",\"session_expired\",\"unavailable\"].indexOf(d.state) < 0) throw fail(\"authorization_bad_response\");\n    // upgrade_reapproval is a reason-only tombstone: it can only explain a pending request.\n    if (d.reason === \"upgrade_reapproval\" && d.state !== \"authorization_required\") throw fail(\"authorization_bad_response\");\n    return d;\n  }); }\n  function plan(method) { return options.call(method).then(function (p) {\n    if (!p || p.command !== \"authorization\" || p.schema_version !== 1 || p.phase !== \"plan\" || !Array.isArray(p.operations) || p.operations.length === 0 || p.operations.length > options.tasks.length) throw fail(\"authorization_bad_response\");\n    var seen = {};\n    p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail(\"authorization_bad_response\"); seen[op] = true; });\n    return p;\n  }); }\n  function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }\n  function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {\n    return options.root.authorize(op).then(function (state) { if (state !== \"ready\") throw fail(\"root_cancelled\"); return run ? options.root.run(op) : null; });\n  }); },Promise.resolve()); }\n  return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {\n    return plan(\"authorization.request\").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); },revoke:function () { return exclusive(function () {\n    return plan(\"authorization.revoke\").then(function (p) {\n      if (p.withdraw === true && typeof options.withdraw !== \"function\") throw fail(\"authorization_bad_response\");\n      var disabled = p.withdraw === true ? options.withdraw() : p.disable === true ? authorize([\"helper_disable\"],true) : Promise.resolve();\n      return disabled.then(function () { return p.purge === true ? authorize([\"helper_purge\"],true) : null; }).then(function () { return p.operations.reduce(function (previous,op) {return previous.then(function () {return options.root.remove(op);});},Promise.resolve()); });\n    }).then(status,function (e) { if (e.code === \"root_cancelled\") return status();throw e; });\n  }); }};\n}";

package/dist/standalone/native-authorization-window.js

@@ -4,6 +4,8 @@ export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options
   function fail(code) { var error = new Error(code); error.code = code; return error; }
   function status() { return options.call("authorization.status").then(function (d) {
     if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
+    // upgrade_reapproval is a reason-only tombstone: it can only explain a pending request.
+    if (d.reason === "upgrade_reapproval" && d.state !== "authorization_required") throw fail("authorization_bad_response");
     return d;
   }); }
   function plan(method) { return options.call(method).then(function (p) {

package/dist/standalone/native-layout.d.ts

@@ -1,3 +1,4 @@
+import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
@@ -21,6 +22,7 @@ type Binary = {
     arches?: LayoutArch[];
 };
 export interface NativeLayout {
+    metadata?: PackageMetadata;
     root: string;
     package: string;
     version: string;
@@ -39,6 +41,7 @@ export interface NativeLayout {
         payload: string;
         metadata: string;
         binaries: Binary[];
+        anchors?: Record<string, string>;
     };
     native: {
         prepare?: Hook;

package/dist/standalone/native-layout.js

@@ -1,3 +1,4 @@
+import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
@@ -36,6 +37,20 @@ function inside(root, path) {
         fail('path escapes project');
     return full;
 }
+// Package Center writes INFO as root, so product root helpers can trust these
+// payload digests across upgrades. The synopkgland_ prefix stays reserved.
+function anchors(value) {
+    const a = object(value, Object.keys(value ?? {}));
+    if (Object.keys(a).length > 16)
+        fail('at most 16 INFO anchors');
+    for (const [key, path] of Object.entries(a)) {
+        if (!/^[a-z][a-z0-9_]{0,48}_sha256$/.test(key) || key.startsWith('synopkgland_'))
+            fail(`invalid INFO anchor key: ${key}`);
+        if (pathText(path).includes('{arch}'))
+            fail('INFO anchor path is relative to the architecture payload');
+    }
+    return a;
+}
 function hook(value) {
     const h = object(value, ['command', 'cwd', 'env']);
     if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
@@ -56,13 +71,15 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
         if (backend.kind !== 'native' || (m.privilege !== undefined && m.privilege !== 'none'))
             fail('backend.kind: native and package-only privilege required');
         m.privilege = 'none';
+        if (m.metadata !== undefined)
+            m.metadata = validateMetadata(m.metadata);
         if (existsSync(join(root, 'compose.yaml')))
             fail('compose.yaml and dsm-package.yaml are mutually exclusive');
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
@@ -73,11 +90,13 @@ export function loadNativeLayout(root) {
             text(m[k]);
         if (!Array.isArray(m.arches) || !m.arches.length || new Set(m.arches).size !== m.arches.length || m.arches.some((a) => !Object.hasOwn(LAYOUT_ARCHES, a)))
             fail('invalid architecture list');
-        const layout = object(m.layout, ['payload', 'metadata', 'binaries']);
+        const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
         if (!Array.isArray(layout.binaries) || !layout.binaries.length)
             fail('binary assertions required');
+        if (layout.anchors !== undefined)
+            layout.anchors = anchors(layout.anchors);
         for (const b of layout.binaries) {
             object(b, ['path', 'linkage', 'arches']);
             pathText(b.path);
@@ -300,8 +319,11 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            writeFileSync(join(stage, 'INFO'), Object.entries(fields).map(([k, v]) => `${k}="${v}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files }));
+            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
+            if (new Set(info.map(([k]) => k)).size !== info.length)
+                fail('INFO anchor collides with an INFO field');
+            writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
             const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
             mkdirSync(dirname(output), { recursive: true });
             await createReproducibleTar(stage, output);
@@ -319,7 +341,7 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
         if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
@@ -337,9 +359,19 @@ export function inspectNativeLayout(dir, payload, info) {
         }
         if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
             fail('package checksum mismatch');
+        checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
         return [];
     }
     catch (e) {
         return [String(e)];
     }
 }
+function anchorFields(declared, files) {
+    return Object.entries(declared).map(([key, path]) => [key, files.find(f => f.path === path)?.sha256 ?? fail(`INFO anchor file missing: ${path}`)]);
+}
+function checkInfoAnchors(info, declared, files) {
+    const lines = info.split('\n').filter(line => /^[a-z0-9_]+_sha256=/.test(line));
+    const expected = anchorFields(declared, files).map(([key, digest]) => `${key}="${digest}"`);
+    if (JSON.stringify(lines.sort()) !== JSON.stringify(expected.sort()))
+        fail('INFO anchors do not match the payload');
+}

package/dist/standalone/portal-window.d.ts

@@ -0,0 +1,21 @@
+type PortalLocale = "en" | "zh-TW" | "zh-CN" | "ja" | "ko" | "de" | "fr" | "es" | "it";
+/** SDK-owned portal panel text, shared by the plain panel and the Vue template. */
+export declare const PORTAL_MESSAGES: Record<string, Record<PortalLocale, string>>;
+/**
+ * `createPortalAccess(options)` → `ctx.portal`, plain ES5 for DSM's desktop.
+ *
+ * An administrator reads and sets the alias with DSM's own
+ * SYNO.Core.AppPortal API in their own session, after SYNO.API.Info shows the
+ * API; DSM itself refuses everyone else (105). An ordinary user reads the
+ * alias only through the package backend's `portal.status`. Anything
+ * unexpected reads as `unavailable`; an administrator then gets only the
+ * Control Panel shortcut.
+ *
+ * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
+ * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
+ * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * `messages` is the panel text in the window's locale; `mountPanel(element)`
+ * renders a plain panel for UIs without their own.
+ */
+export declare const PORTAL_RUNTIME: string;
+export {};