@synopackageland/cli 0.6.1 → 0.7.0

package/dist/standalone/portal-window.js

@@ -0,0 +1,155 @@
+import { PORTAL_ALIAS_PATTERN, RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
+/** SDK-owned portal panel text, shared by the plain panel and the Vue template. */
+export const PORTAL_MESSAGES = {
+    title: { en: "Application Portal", "zh-TW": "應用程式入口", "zh-CN": "应用程序门户", ja: "アプリケーションポータル", ko: "응용 프로그램 포털", de: "Anwendungsportal", fr: "Portail d'application", es: "Portal de aplicaciones", it: "Portale applicazioni" },
+    link: { en: "Direct link after DSM sign-in:", "zh-TW": "DSM 登入後的直接連結：", "zh-CN": "DSM 登录后的直接链接：", ja: "DSM サインイン後の直接リンク：", ko: "DSM 로그인 후 바로 가기 링크:", de: "Direkter Link nach der DSM-Anmeldung:", fr: "Lien direct après connexion à DSM :", es: "Enlace directo tras iniciar sesión en DSM:", it: "Link diretto dopo l'accesso a DSM:" },
+    inactive: { en: "Not active. Apply an alias to let users open this app directly after DSM sign-in.", "zh-TW": "尚未啟用。套用別名後，使用者可在 DSM 登入後直接開啟這個 App。", "zh-CN": "尚未启用。应用别名后，用户可在 DSM 登录后直接打开此应用。", ja: "無効です。エイリアスを適用すると、DSM サインイン後にこのアプリを直接開けます。", ko: "비활성 상태입니다. 별칭을 적용하면 DSM 로그인 후 이 앱을 바로 열 수 있습니다.", de: "Nicht aktiv. Wenden Sie einen Alias an, damit Benutzer diese App nach der DSM-Anmeldung direkt öffnen können.", fr: "Inactif. Appliquez un alias pour ouvrir cette application directement après connexion à DSM.", es: "Inactivo. Aplique un alias para abrir esta aplicación directamente tras iniciar sesión en DSM.", it: "Non attivo. Applica un alias per aprire questa app direttamente dopo l'accesso a DSM." },
+    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하세요", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
+    alias: { en: "Alias", "zh-TW": "別名", "zh-CN": "别名", ja: "エイリアス", ko: "별칭", de: "Alias", fr: "Alias", es: "Alias", it: "Alias" },
+    apply: { en: "Apply", "zh-TW": "套用", "zh-CN": "应用", ja: "適用", ko: "적용", de: "Übernehmen", fr: "Appliquer", es: "Aplicar", it: "Applica" },
+    disable: { en: "Turn off", "zh-TW": "停用", "zh-CN": "停用", ja: "無効にする", ko: "끄기", de: "Ausschalten", fr: "Désactiver", es: "Desactivar", it: "Disattiva" },
+    advanced: { en: "Advanced settings in Control Panel", "zh-TW": "在控制台進行進階設定", "zh-CN": "在控制面板中进行高级设置", ja: "コントロールパネルの詳細設定", ko: "제어판의 고급 설정", de: "Erweiterte Einstellungen in der Systemsteuerung", fr: "Paramètres avancés dans le Panneau de configuration", es: "Ajustes avanzados en el Panel de control", it: "Impostazioni avanzate nel Pannello di controllo" },
+    controlPanel: { en: "Open Control Panel Application Portal", "zh-TW": "開啟控制台 Application Portal", "zh-CN": "打开控制面板 Application Portal", ja: "コントロールパネルの Application Portal を開く", ko: "제어판 Application Portal 열기", de: "Application Portal in der Systemsteuerung öffnen", fr: "Ouvrir Application Portal dans le Panneau de configuration", es: "Abrir Application Portal en el Panel de control", it: "Apri Application Portal nel Pannello di controllo" },
+    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하세요.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
+    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하세요.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
+    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하세요.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
+    admin_required: { en: "Only a DSM administrator can change this.", "zh-TW": "只有 DSM 管理員可以變更這項設定。", "zh-CN": "只有 DSM 管理员可以更改此设置。", ja: "これを変更できるのは DSM 管理者のみです。", ko: "DSM 관리자만 변경할 수 있습니다.", de: "Nur ein DSM-Administrator kann dies ändern.", fr: "Seul un administrateur DSM peut modifier ce paramètre.", es: "Solo un administrador de DSM puede cambiar esto.", it: "Solo un amministratore DSM può modificarlo." },
+    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하세요.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+};
+function localizedMessages() {
+    const out = {};
+    for (const [key, texts] of Object.entries(PORTAL_MESSAGES)) {
+        for (const [locale, text] of Object.entries(texts))
+            (out[locale] ??= {})[key] = text;
+    }
+    return out;
+}
+/**
+ * `createPortalAccess(options)` → `ctx.portal`, plain ES5 for DSM's desktop.
+ *
+ * An administrator reads and sets the alias with DSM's own
+ * SYNO.Core.AppPortal API in their own session, after SYNO.API.Info shows the
+ * API; DSM itself refuses everyone else (105). An ordinary user reads the
+ * alias only through the package backend's `portal.status`. Anything
+ * unexpected reads as `unavailable`; an administrator then gets only the
+ * Control Panel shortcut.
+ *
+ * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
+ * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
+ * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * `messages` is the panel text in the window's locale; `mountPanel(element)`
+ * renders a plain panel for UIs without their own.
+ */
+export const PORTAL_RUNTIME = `function createPortalAccess(options) {
+  var ALIAS = new RegExp(${JSON.stringify(PORTAL_ALIAS_PATTERN.source)});
+  var RESERVED = ${JSON.stringify(RESERVED_PORTAL_ALIASES)};
+  var LINKABLE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+  var CATALOGS = ${JSON.stringify(localizedMessages())};
+  var messages = CATALOGS[options.locale] || CATALOGS.en;
+  var ERRORS = { dsm_4100: "portal_alias_invalid", dsm_4102: "portal_alias_reserved", dsm_4103: "portal_alias_in_use", dsm_105: "admin_required" };
+  function result(state, alias, managed) {
+    var out = { state: state, canManage: managed === true, controlPanel: managed !== undefined, defaultAlias: options.defaultAlias };
+    if (state === "active") {
+      out.alias = alias;
+      out.url = options.location.protocol + "//" + options.location.host + "/" + encodeURIComponent(alias) + "/";
+    }
+    return out;
+  }
+  function fromBackend() {
+    return options.call("portal.status", {}).then(function (data) {
+      if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
+      return result(data && data.state === "inactive" ? "inactive" : "unavailable");
+    }, function () {
+      return result("unavailable");
+    });
+  }
+  function fromDsm() {
+    return options.send("SYNO.API.Info", "query", 1, { query: "SYNO.Core.AppPortal" }).then(function (info) {
+      var api = info && info["SYNO.Core.AppPortal"];
+      if (!api || !(api.maxVersion >= 2)) return null;
+      return options.send("SYNO.Core.AppPortal", "get", 2, { id: options.appId, additional: ["default_setting"] });
+    }).then(function (item) {
+      if (!item || item.id !== options.appId) return result("unavailable", undefined, false);
+      var alias = typeof item.alias === "string" && LINKABLE.test(item.alias) ? item.alias : "";
+      var out = result(alias ? "active" : "inactive", alias, true);
+      var setting = item.additional && item.additional.default_setting;
+      if (setting && typeof setting.alias === "string" && ALIAS.test(setting.alias)) out.defaultAlias = setting.alias;
+      return out;
+    }, function () {
+      return result("unavailable", undefined, false);
+    });
+  }
+  function status() {
+    return options.isAdmin() ? fromDsm() : fromBackend();
+  }
+  function set(alias) {
+    if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
+    return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
+      throw { code: ERRORS[error && error.code] || "portal_unavailable" };
+    });
+  }
+  var access = {
+    messages: messages,
+    status: status,
+    apply: function (alias) {
+      if (typeof alias !== "string" || !ALIAS.test(alias)) return Promise.reject({ code: "portal_alias_invalid" });
+      if (RESERVED.indexOf(alias) >= 0) return Promise.reject({ code: "portal_alias_reserved" });
+      return set(alias);
+    },
+    disable: function () {
+      return set(null);
+    },
+    openControlPanel: function () {
+      options.launch("SYNO.SDS.AdminCenter.Application", { fn: "SYNO.SDS.AdminCenter.Login.Main", tab: "applications" });
+    },
+    mountPanel: function (element) {
+      return mountPanel(element);
+    }
+  };
+  function node(tag, attrs, children) {
+    var out = document.createElement(tag);
+    for (var key in attrs) {
+      if (key === "text") out.textContent = attrs[key];
+      else out.setAttribute(key, attrs[key]);
+    }
+    for (var i = 0; children && i < children.length; i++) out.appendChild(children[i]);
+    return out;
+  }
+  function button(text, onClick) {
+    var out = node("button", { type: "button", text: text });
+    out.addEventListener("click", function (event) { event.preventDefault(); onClick(); });
+    return out;
+  }
+  function mountPanel(element) {
+    var disposed = false;
+    function render(current, error) {
+      if (disposed) return;
+      var parts = [node("h2", { text: messages.title })];
+      var settle = function (next) { return next.then(function (fresh) { render(fresh); }, function (failure) { render(current, failure); }); };
+      if (current.state === "active") {
+        parts.push(node("p", {}, [node("span", { text: messages.link + " " }), node("a", { href: current.url, target: "_blank", rel: "noopener", text: current.url })]));
+      }
+      if (current.canManage) {
+        if (current.state !== "active") parts.push(node("p", { text: messages.inactive }));
+        var input = node("input", { type: "text", maxlength: "64", autocomplete: "off", "aria-label": messages.alias });
+        input.value = current.alias || current.defaultAlias;
+        var form = node("form", { class: "dsmapp-portal-form" }, [node("label", { text: messages.alias }), input, node("button", { type: "submit", text: messages.apply })]);
+        form.addEventListener("submit", function (event) { event.preventDefault(); settle(access.apply(input.value)); });
+        if (current.state === "active") form.appendChild(button(messages.disable, function () { settle(access.disable()); }));
+        parts.push(form, button(messages.advanced, access.openControlPanel));
+      } else if (current.controlPanel) {
+        parts.push(button(messages.controlPanel, access.openControlPanel));
+      } else if (current.state !== "active") {
+        parts.push(node("p", { text: messages.askAdmin }));
+      }
+      if (error) parts.push(node("p", { role: "alert", class: "dsmapp-portal-error", text: messages[error.code] || messages.portal_unavailable }));
+      element.replaceChildren.apply(element, parts);
+    }
+    status().then(function (current) { render(current); });
+    return {
+      refresh: function () { return status().then(function (current) { render(current); }); },
+      dispose: function () { disposed = true; element.replaceChildren(); }
+    };
+  }
+  return access;
+}`;

package/dist/standalone/portal.d.ts

@@ -0,0 +1,4 @@
+import type { StandaloneManifest } from "./manifest.js";
+import type { PortalPackage } from "../portal/package.js";
+/** A native portal opens the package's own DSM window. */
+export declare function nativePortal(manifest: StandaloneManifest): PortalPackage | undefined;

package/dist/standalone/portal.js

@@ -0,0 +1,4 @@
+/** A native portal opens the package's own DSM window. */
+export function nativePortal(manifest) {
+    return manifest.portal && { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
+}

package/dist/standalone/resource.d.ts

@@ -1,11 +1,13 @@
 import type { Capabilities } from "./manifest.js";
 import { type SharedFolder } from "./shared-folder.js";
+import { type PortalPackage } from "../portal/package.js";
 /**
- * `conf/resource` for a native package: only DSM's official `data-share` and
- * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ * `conf/resource` for a native package: only DSM's official `data-share`,
+ * `systemd-user-unit` and `web-config` workers, in a fixed key order.
+ * Undefined when none applies.
  */
 export declare function renderStandaloneResource(m: {
     package: string;
     capabilities: Capabilities;
     sharedFolder?: SharedFolder;
-}): string | undefined;
+}, portal?: PortalPackage): string | undefined;

package/dist/standalone/resource.js

@@ -1,13 +1,16 @@
 import { sharedFolderResource } from "./shared-folder.js";
+import { portalResource } from "../portal/package.js";
 /**
- * `conf/resource` for a native package: only DSM's official `data-share` and
- * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ * `conf/resource` for a native package: only DSM's official `data-share`,
+ * `systemd-user-unit` and `web-config` workers, in a fixed key order.
+ * Undefined when none applies.
  */
-export function renderStandaloneResource(m) {
+export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
     const resource = {
         ...(dataShare ? { "data-share": dataShare } : {}),
         ...(m.capabilities.jobs ? { "systemd-user-unit": {} } : {}),
+        ...(portal ? portalResource() : {}),
     };
     return Object.keys(resource).length > 0 ? JSON.stringify(resource) : undefined;
 }

package/dist/standalone/root-window.js

@@ -1,4 +1,5 @@
 import { bootDefinition, controlDefinition } from '../runtime/executor-tasks.js';
+import { executorScopeTask } from '../runtime/executor-scope-task.js';
 export { executorTasks as rootTasks } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
@@ -10,15 +11,9 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     var code = String(e && e.code || "executor_bad_response");
     return code + (code === "105" || code === "dsm_105" ? ": DSM denied administrator scheduler access. Check the DSM session and scheduler; a NAS restart resolved this on the measured DSM. No automatic retry was made." : ": scheduler readback or operation failed.");
   }
-  function wire(params) {
-    var encoded = {};
-    Object.keys(params).forEach(function (key) {
-      var value = params[key];
-      encoded[key] = value === "" || typeof value === "boolean" || typeof value === "object" ? JSON.stringify(value) : value;
-    });
-    return encoded;
-  }
-  function send(api, method, version, params) { return options.send(api, method, version, wire(params || {})); }
+  // AppWindow.sendWebAPI encodes JSON parameters. Preserve their native types;
+  // pre-encoding turns objects/booleans into strings and DSM rejects create.
+  function send(api, method, version, params) { return options.send(api, method, version, params || {}); }
   function admin() { if (!options.user() || options.user().admin !== true) throw fail("admin_required"); }
   function find(task) {
     var boot = task.kind === "boot";
@@ -55,10 +50,12 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
     });
   }
   function definition(task) { return task.kind === "boot" ? (${bootDefinition.toString()})(task) : (${controlDefinition.toString()})(task); }
-  function approve(password) {
+  function approve(password, selectedScope) {
+    var selectionTask;
+    if (selectedScope !== undefined) selectionTask = (${executorScopeTask.toString()})(options.pins, selectedScope, options.user() && options.user().name, 0);
     return read().then(function (before) {
       if (before.state === "blocked" || before.state === "unsupported") return before;
-      if (before.state === "ready") return start(before);
+      if (before.state === "ready" && !selectionTask) return start(before);
       return options.confirmPassword(password).then(function (confirmation) {
         if (!confirmation || confirmation.confirmed !== true) return {state: "cancelled", tasks: before.tasks};
         if (typeof confirmation.token !== "string" || !confirmation.token) throw fail("executor_confirmation_missing");
@@ -84,15 +81,65 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
           Object.keys(errors).forEach(function (kind) {
             if (after.tasks[kind].state !== "ready") { after.tasks[kind].state = "blocked"; after.tasks[kind].reason = errors[kind]; after.state = "blocked"; after.reason = errors[kind]; }
           });
-          return after.state === "ready" ? start(after) : after;
+          // A scope change must not restart a running executor: the boot task
+          // stops it, which interrupts in-flight copies instead of canceling them.
+          return after.state === "ready" ? (selectionTask ? running(after) : Promise.resolve(null)).then(function (live) { return live || start(after); }).then(function (started) {
+            if (!selectionTask || started.state !== "ready") return started;
+            var generation = started.executor.selection ? started.executor.selection.generation : 0;
+            if (started.executor.selection && (!Number.isSafeInteger(generation) || generation <= 0)) throw fail("executor_selection_invalid");
+            selectionTask = (${executorScopeTask.toString()})(options.pins, selectedScope, options.user() && options.user().name, generation);
+            // The root task may still land after this reply. requested lets the
+            // app converge by readback: applied once status().executor.selection
+            // shows this scope above this generation. A resubmit is pinned and safe.
+            return selectScope(selectionTask, confirmation, started, selectedScope).catch(function (e) {
+              return {state: "blocked", reason: reason(e), tasks: started.tasks, requested: {scope: selectedScope, generation: generation}};
+            });
+          }) : after;
         });
       });
     });
   }
+  function selectScope(task, confirmation, verified, selectedScope) {
+    function removeExact() {
+      return find(task).then(function (current) {
+        if (current.state === "ready") return send(taskAPI, "delete", 2, {tasks: [current.ref]});
+        if (current.ref) throw fail("executor_selection_cleanup_conflict");
+      });
+    }
+    return find(task).then(function (current) {
+      if (current.state === "blocked" || current.state === "unsupported") throw fail("executor_selection_conflict");
+      var removed = current.ref ? send(taskAPI, "delete", 2, {tasks: [current.ref]}) : Promise.resolve();
+      return removed.then(function () {
+        var params = definition(task); params.SynoConfirmPWToken = confirmation.token;
+        return send(taskAPI + ".Root", "create", 4, params);
+      });
+    }).then(function () { return find(task); }).then(function (current) {
+      if (current.state !== "ready") throw fail("executor_selection_readback_mismatch");
+      return send(taskAPI, "run", 2, {tasks: [current.ref]});
+    }).then(function () {
+      function readSelection(attempts) {
+        return health(verified, 1).then(function (current) {
+          if (current.state === "ready" && current.executor.selection && current.executor.selection.scope === selectedScope && Number.isSafeInteger(current.executor.selection.generation) && current.executor.selection.generation > 0) return current;
+          if (attempts > 1 && options.wait) return options.wait(500).then(function () { verified.state = "ready"; return readSelection(attempts - 1); });
+          throw fail("executor_selection_unconfirmed");
+        });
+      }
+      return readSelection(40);
+    }).then(function (result) { return removeExact().then(function () { return result; }); }, function (error) {
+      return removeExact().then(function () { throw error; });
+    });
+  }
+  function pinned(status) { return !!status && status.ready === true && !!options.pins && status.executor_digest === options.pins.executorDigest && status.policy_digest === options.pins.policyDigest; }
+  function running(verified) {
+    return options.call("executor.status", {}).then(function (status) {
+      if (!pinned(status)) return null;
+      verified.executor = status; return verified;
+    }, function () { return null; });
+  }
   function health(verified, attempts) {
     if (verified.state !== "ready") return Promise.resolve(verified);
     return options.call("executor.status", {}).then(function (status) {
-      if (!status || status.ready !== true || !options.pins || status.executor_digest !== options.pins.executorDigest || status.policy_digest !== options.pins.policyDigest) throw fail("executor_status_mismatch");
+      if (!pinned(status)) throw fail("executor_status_mismatch");
       verified.executor = status; return verified;
     }).catch(function (e) {
       if (attempts > 1 && options.wait) return options.wait(500).then(function () { return health(verified, attempts - 1); });
@@ -109,8 +156,8 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
   }
   return {
     status: function () { return read().then(function (verified) { return health(verified, 1); }); },
-    authorize: function (password) {
-      if (!busy) busy = approve(password).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}}; }).then(function (r) { busy = null; return r; });
+    authorize: function (password, selectedScope) {
+      if (!busy) busy = Promise.resolve().then(function () { return approve(password, selectedScope); }).catch(function (e) { return {state: "blocked", reason: reason(e), tasks: {}}; }).then(function (r) { busy = null; return r; });
       return busy;
     },
     control: function (action) {

package/dist/standalone/spk.d.ts

@@ -14,7 +14,7 @@ export interface AssembleOptions {
     outputPath: string;
     executor?: ExecutorArtifact;
     daemonControl?: string;
-    /** The compiled background worker, required exactly when the manifest declares background. */
+    /** The compiled background worker, required exactly when capabilities.jobs is enabled. */
     backgroundWorker?: string;
 }
 /**

package/dist/standalone/spk.js

@@ -1,3 +1,4 @@
+import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
@@ -8,6 +9,7 @@ import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
 import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
+import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
@@ -17,7 +19,10 @@ import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
+import { nativePortal } from "./portal.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
+import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
@@ -77,6 +82,11 @@ export async function assembleStandaloneSpk(options) {
         copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
             copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+        const portal = nativePortal(manifest);
+        if (portal) {
+            writeFile(join(staging, "package", PORTAL_JSON_RELPATH), renderPortalJson(portal));
+            writeFile(join(staging, "package", PORTAL_MUSTACHE_RELPATH), renderPortalMustache());
+        }
         if (options.executor) {
             const executorDir = join(staging, "package", "executor");
             mkdirSync(executorDir);
@@ -93,11 +103,11 @@ export async function assembleStandaloneSpk(options) {
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort() }));
-        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum));
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}) }));
+        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
-        const resource = renderStandaloneResource(manifest);
+        const resource = renderStandaloneResource(manifest, portal);
         if (resource)
             writeFile(join(staging, "conf", "resource"), resource);
         if (manifest.capabilities.jobs) {
@@ -109,7 +119,10 @@ export async function assembleStandaloneSpk(options) {
             writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
         const folder = manifest.sharedFolder;
-        const install = renderInstallWizardFiles(manifest.package, folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard);
+        const steps = manifest.capabilities.delegate?.scope === 'install-selected'
+            ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
+            : folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard;
+        const install = renderInstallWizardFiles(manifest.package, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
         writeWizardUiFiles(staging, {
             ...install.static,
             ...install.dynamic,
@@ -130,10 +143,10 @@ function writeFile(path, content, mode = FILE_MODE) {
     chmodSync(path, mode);
 }
 function quote(value) {
-    return `"${value}"`;
+    return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
 /** Manifest validation already refused quotes, backslashes and newlines. */
-function renderInfo(manifest, arch, checksum) {
+function renderInfo(manifest, arch, checksum, executorDigest) {
     const fields = [
         ["package", manifest.package],
         ["version", manifest.spkVersion],
@@ -148,7 +161,12 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
-    if (manifest.daemon)
+    // Package Center writes INFO as root; root tasks accept only this executor.
+    if (executorDigest)
+        fields.push([EXECUTOR_ANCHOR, executorDigest]);
+    fields.push(...metadataInfoFields(manifest.metadata));
+    // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
+    if (manifest.daemon || manifest.capabilities.jobs)
         fields.push(["precheckstartstop", "yes"]);
     for (const locale of LOCALES) {
         const text = manifest.i18n?.info[locale];

package/dist/templates/_daemon/main_test.go

@@ -41,9 +41,15 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dest, "daemon/payload/app"), raw, 0755); err != nil {
+	app := filepath.Join(dest, "daemon/payload/app")
+	if err := os.WriteFile(app, raw, 0755); err != nil {
 		t.Fatal(err)
 	}
+	// macOS verifies a newly written executable on its first exec, which takes
+	// seconds on a loaded host; pay it here, not inside a one-second budget.
+	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
+		t.Fatalf("payload warm-up: %v %s", err, raw)
+	}
 	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
@@ -91,22 +97,69 @@ func runControl(control, action, dest, data string) (int, string) {
 	return -1, err.Error()
 }
 
+// Readiness only proves the child stayed alive for a second, not that it reached
+// main: on a loaded host a stop can kill it before it writes its line. Spawn
+// identity therefore comes from the inventory, and log content is awaited.
+func recordedChild(t *testing.T, data string) int {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var r record
+	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
+		t.Fatalf("daemon inventory: %v %s", err, raw)
+	}
+	return r.Child
+}
+
+func awaitChildLines(t *testing.T, data string, want int) {
+	t.Helper()
+	path := filepath.Join(data, "daemon/daemon.log")
+	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+		raw, _ := os.ReadFile(path)
+		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
+			if got != want {
+				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
+			}
+			return
+		}
+	}
+}
+
 func TestDaemonLifecycle(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
-	for _, step := range []struct {
-		action string
-		want   int
-	}{{"status", 3}, {"stop", 0}, {"start", 0}, {"status", 0}, {"start", 0}, {"restart", 0}, {"stop", 0}, {"stop", 0}, {"status", 3}, {"unknown", 1}} {
-		if rc, out := runControl(control, step.action, dest, data); rc != step.want {
-			t.Fatalf("%s rc=%d want=%d: %s", step.action, rc, step.want, out)
+	step := func(action string, want int) {
+		t.Helper()
+		if rc, out := runControl(control, action, dest, data); rc != want {
+			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
 		}
 	}
+	step("status", 3)
+	step("stop", 0)
+	step("start", 0)
+	awaitChildLines(t, data, 1)
+	first := recordedChild(t, data)
+	step("status", 0)
+	step("start", 0)
+	if child := recordedChild(t, data); child != first {
+		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
+	}
+	step("restart", 0)
+	if child := recordedChild(t, data); child == first {
+		t.Fatalf("restart kept child %d", child)
+	}
+	awaitChildLines(t, data, 2)
+	step("stop", 0)
+	step("stop", 0)
+	step("status", 3)
+	step("unknown", 1)
 	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("duplicate start spawned another child: %s", raw)
+		t.Fatalf("unexpected child spawn: %s", raw)
 	}
 	if strings.Contains(string(raw), "must-not-leak") {
 		t.Fatalf("ambient environment leaked: %s", raw)